insta 0.1.3 → 0.1.4

package/dist/commands/domain.js

@@ -336,4 +336,91 @@ export async function domainDetach(host, opts, deps) {
     }
     return removeDomain(name, opts, d);
 }
+const zonePath = (orgId, domainName) => `/orgs/${encodeURIComponent(orgId)}/zones${domainName ? `/${encodeURIComponent(domainName.trim().toLowerCase())}` : ''}`;
+export function zoneLines(z, orgFlag) {
+    const orgArg = orgFlag ? ` --org ${orgFlag}` : '';
+    if (z.status === 'active')
+        return [`${z.domainName}  delegated (${z.nameservers.join(', ')})`];
+    return [
+        `${z.domainName}  waiting for nameservers`,
+        `  set these at your domain's registrar: ${z.nameservers.join(', ')}`,
+        `  review the zone BEFORE switching: insta domain zone records ${z.domainName}${orgArg}`,
+    ];
+}
+export function zoneRecordLines(records) {
+    if (!records.length)
+        return ['no records in the zone yet — the provider scan runs shortly after delegating; run this again in a moment'];
+    const w = (pick) => Math.max(...records.map((r) => pick(r).length));
+    const typeW = w((r) => r.type), hostW = w((r) => r.host), answerW = w((r) => r.answer);
+    return records.map((r) => `  ${r.type.padEnd(typeW)}  ${r.host.padEnd(hostW)}  ${r.answer.padEnd(answerW)}${r.ttl !== undefined ? `  ttl ${r.ttl}` : ''}${r.priority !== undefined ? `  prio ${r.priority}` : ''}${r.proxied ? '  (proxied)' : ''}`);
+}
+/**
+ * Delegate a bring-your-own domain: the platform builds a managed zone for it and answers the two
+ * nameservers to set at the domain's own registrar. From then on every attach publishes its records
+ * into the zone itself — apexes included — instead of printing them for hand-copying. The zone is
+ * SEEDED by the provider's record scan, which is a heuristic: the review-then-switch contract
+ * (printed, and enforced by nothing else) is to compare `zone records` against the domain's current
+ * DNS and add what is missing at the CURRENT provider — re-running delegate re-imports — before
+ * re-pointing. A domain carrying live MX records is refused outright: a DNS move that can drop
+ * mail is never done implicitly. 202 approval_required in agent mode (zone.delegate); org admin
+ * either way.
+ */
+const orgArgOf = (opts) => (opts.org ? ` --org ${opts.org}` : '');
+export async function zoneDelegate(domainName, opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    // Same precedent as `domain delegate`: the org route signs for the linked project in agent mode
+    // (zone.delegate is read at the session project), but only when the link belongs to the org
+    // being mutated — under `--org` naming another org the call goes projectless and the platform's
+    // org-administration path judges it.
+    const link = deps?.project ?? (await readProject()) ?? undefined;
+    const projectId = link && link.orgId === orgId ? link.projectId : undefined;
+    const res = await api.rawRequest('POST', zonePath(orgId), { domainName }, projectId ? { projectId } : undefined);
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    const z = res.body;
+    for (const line of zoneLines(z, opts.org))
+        info(line);
+    info(`the zone was seeded by a provider scan — a heuristic. Check \`insta domain zone records ${z.domainName}${orgArgOf(opts)}\` against your current DNS, add anything missing at your CURRENT provider (re-running delegate re-imports), and only then switch the nameservers.`);
+}
+export async function zoneList(opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('GET', zonePath(orgId));
+    if (opts.json)
+        return printJson(r);
+    if (!r.items.length)
+        return info('no delegated zones — start one: insta domain zone delegate <domain>');
+    for (const z of r.items)
+        for (const line of zoneLines(z, opts.org))
+            info(line);
+}
+export async function zoneRecords(domainName, opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('GET', `${zonePath(orgId, domainName)}/records`);
+    if (opts.json)
+        return printJson(r);
+    for (const line of zoneRecordLines(r.items))
+        info(line);
+    if (r.items.length)
+        info(`every type shows here (the scan is a heuristic) — add anything missing at your current DNS provider and re-run \`insta domain zone delegate ${domainName.trim().toLowerCase()}${orgArgOf(opts)}\` to re-import before switching nameservers`);
+}
+/**
+ * Release a delegated zone: the platform prunes the records it published and deletes the managed
+ * zone. The customer's next step — printed — is pointing the domain's nameservers back at their
+ * own provider; hostnames then re-verify on the records path.
+ */
+export async function zoneRelease(domainName, opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const link = deps?.project ?? (await readProject()) ?? undefined;
+    const projectId = link && link.orgId === orgId ? link.projectId : undefined;
+    const res = await api.rawRequest('DELETE', zonePath(orgId, domainName), undefined, projectId ? { projectId } : undefined);
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    const r = res.body;
+    info(`${r.domainName}  released`);
+    info(`point the domain's nameservers back at your DNS provider — hostnames re-verify on the records path (insta domain attach prints them)`);
+}
 //# sourceMappingURL=domain.js.map

package/dist/index.js

@@ -279,6 +279,19 @@ ns.command('set <domain> <nameservers...>').description("Delegate the zone to na
 ns.command('reset <domain>').description("Put the zone back on the registrar's own nameservers — from your own delegation or from an InstaCloud-managed zone alike; a hostname `set` took down is re-attached with `insta domain attach`, one a managed zone was serving re-verifies on its own")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((domain, o) => domainCmd.domainNameserversReset(domain, o)));
+const zone = dom.command('zone').description("Bring-your-own domains served from an InstaCloud-managed zone (nameserver delegation): point the domain's registrar at the pair `zone delegate` answers, and every attach's records — apexes included — are published for you. The alternative stays available: `insta domain attach` alone prints records to paste into your own zone");
+zone.command('delegate <domain>').description("Delegate a domain you own elsewhere: builds its managed zone (seeded by a provider record scan — a HEURISTIC, so review `zone records` and add anything missing at your current provider BEFORE switching nameservers; re-running delegate re-imports) and answers the two nameservers to set at your registrar. A domain carrying live MX records is refused — move mail first or keep the records path (org admin; gated: zone.delegate — agent mode gates from a linked project, an unlinked --org call falls under org administration instead)")
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((domain, o) => domainCmd.zoneDelegate(domain, o)));
+zone.command('list').description("The org's delegated zones: which are still waiting for the nameserver switch and which are serving")
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((o) => domainCmd.zoneList(o)));
+zone.command('records <domain>').description("Every record in the delegated zone — the pre-switch review. The scan seeds common records but is not exhaustive: compare against your current DNS and add what is missing at your CURRENT provider, then re-run `zone delegate` to re-import")
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((domain, o) => domainCmd.zoneRecords(domain, o)));
+zone.command('release <domain>').description("Release a delegated zone: the platform's records are pruned and the zone deleted. Point the nameservers back at your own provider; hostnames re-verify on the records path (org admin; gated: zone.delegate — agent mode gates from a linked project, an unlinked --org call falls under org administration instead)")
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((domain, o) => domainCmd.zoneRelease(domain, o)));
 const xfer = dom.command('transfer').description('Take a bought domain to another registrar — open the lock, then read the code (all three need org admin)');
 xfer.command('lock <domain> <mode>').description("Open or close the registrar transfer lock (mode: on|off). ICANN's own 60-day lock on a new registration outranks it")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [