uplink-cli 0.1.38 → 0.2.0

package/AGENTS.md

@@ -0,0 +1,177 @@
+# Agent Integration Guide
+
+For agents (Cursor, Claude Code, Codex, Windsurf, and similar) to use Uplink **non-interactively**.
+
+Install: `npm install -g uplink-cli` or `npx uplink-cli …`  
+Until **0.2.0** is on npm: `npm install -g github:firstprinciplecode/uplink#v0.2.0`  
+Package name: `uplink-cli` · Binary: `uplink`
+
+## Auth
+
+- `uplink tunnel create` automatically creates guest access when no token exists. Guest access includes **1 active tunnel**, expiring after **24 hours**.
+- Use `AGENTCLOUD_TOKEN` (bearer). Prefer stdin over argv:
+  ```bash
+  echo "$TOKEN" | uplink --token-stdin …
+  ```
+- Humans: `uplink login --email you@example.com` then `--code 123456`. This upgrades current guest access, preserves its tunnel, and unlocks persistent features. Credentials are saved to `~/.uplink/credentials` (chmod 600).
+- API base: `--api-base https://api.uplink.spot` or `AGENTCLOUD_API_BASE`.
+
+## Explicit guest token (optional)
+
+```bash
+uplink signup --json
+uplink signup --label "cursor-agent" --expires-days 30 --json
+```
+
+Save `token` from the JSON — it is shown only once. Then:
+
+```bash
+export AGENTCLOUD_TOKEN='…'
+```
+
+Explicit signup creates guest access. A later email login upgrades that guest account when the current token is available.
+
+## Machine-mode contract
+
+| Rule | Detail |
+|------|--------|
+| `--json` | stdout = JSON only; logs/errors go to stderr |
+| Exit `0` | success |
+| Exit `2` | usage / bad args |
+| Exit `10` | auth missing/invalid |
+| Exit `20` | network |
+| Exit `30` | server / unknown |
+
+Guest accounts can share one local port and use public domain search. Hosting, databases, aliases, and custom domains require a verified email account. Gate error: `ACCOUNT_VERIFICATION_REQUIRED`.
+
+Premium aliases may return `ALIAS_NOT_ENABLED` / `ALIAS_LIMIT_REACHED`.
+
+Free hosting (new accounts): **1 app**, **100 MB** of live artifacts, **no custom domains**, app **sleeps after 30 minutes idle**. Errors: `HOST_APP_LIMIT_REACHED`, `HOST_STORAGE_LIMIT_REACHED`, `HOST_DOMAIN_NOT_ENABLED`. Check quota: the `hosting` object on `GET /v1/me`.
+
+## Tunnels (share localhost)
+
+`tunnel create` **creates the API record and starts the local client** so the public URL works. Use `--api-only` only if you will start the client yourself.
+
+```bash
+# Create + start client (optional alias if enabled)
+echo "$TOKEN" | uplink --token-stdin \
+  tunnel create --port 3000 --alias myapp --json
+
+# List (includes connected status)
+echo "$TOKEN" | uplink --token-stdin tunnel list --json
+
+# Alias on an existing tunnel
+echo "$TOKEN" | uplink --token-stdin tunnel alias-set --id tun_xxx --alias myapp --json
+echo "$TOKEN" | uplink --token-stdin tunnel alias-delete --id tun_xxx --json
+
+# Stats / stop
+echo "$TOKEN" | uplink --token-stdin tunnel stats --id tun_xxx --json
+echo "$TOKEN" | uplink --token-stdin tunnel stop --id tun_xxx --json
+echo "$TOKEN" | uplink --token-stdin tunnel stop --all --json
+```
+
+JSON create shape (representative):
+
+```json
+{
+  "tunnel": { "id": "tun_…", "url": "https://abc.x.uplink.spot", "token": "…", "status": "…" },
+  "alias": "myapp",
+  "aliasError": null,
+  "url": "https://myapp.uplink.spot",
+  "client": { "pid": 12345, "started": true }
+}
+```
+
+`connected` on `tunnel list` means the local client is attached to the relay.
+
+## Hosting
+
+Use `--json`. For prompts, pass `--yes`.
+
+```bash
+echo "$TOKEN" | uplink --token-stdin host setup \
+  --path /path/to/app --name myapp --env-file /path/to/.env \
+  --wait-timeout 900 --wait-interval 5 --yes --json
+
+echo "$TOKEN" | uplink --token-stdin host deploy \
+  --path /path/to/app --name myapp --wait --json
+
+echo "$TOKEN" | uplink --token-stdin host analyze --path /path/to/app --json
+echo "$TOKEN" | uplink --token-stdin host preflight --path /path/to/app --json
+echo "$TOKEN" | uplink --token-stdin host list --json
+echo "$TOKEN" | uplink --token-stdin host status --id app_xxx --json
+echo "$TOKEN" | uplink --token-stdin host logs --id app_xxx --json
+echo "$TOKEN" | uplink --token-stdin host delete --id app_xxx --yes --json
+```
+
+Notes:
+- Next.js server hosting expects `output: "standalone"`. Vite/CRA → static `dist`/`build`.
+- Prefer a `.uplinkignore` (`node_modules`, `.next`, `dist`, `*.log`, local `.db`, …).
+- `host logs` may return `NOT_READY` until a deployment is running.
+- `host delete` requires `--yes` (or typing `DELETE` interactively).
+
+## Custom domains
+
+Registrar inventory is CLI. Attach/verify is under `host domains`.  
+The bare `uplink domains` search TUI is **optional** and not bundled with npm — use the JSON commands below.
+
+```bash
+uplink domains providers connect godaddy --token-env GODADDY_PAT --json
+uplink domains providers connect cloudflare --token-env CF_API_TOKEN --json
+uplink domains providers connect hostinger --token-env HOSTINGER_API_TOKEN --json
+uplink domains providers connect dreamhost --token-env DREAMHOST_API_KEY --json
+uplink domains providers connect namecheap --token-env NAMECHEAP_API_KEY --user-env NAMECHEAP_API_USER --json
+uplink domains providers list --json
+uplink domains providers disconnect godaddy --json
+
+uplink domains list --json
+uplink domains check example.com --json
+
+echo "$TOKEN" | uplink --token-stdin host domains add --id app_xxx --hostname example.com --json
+echo "$TOKEN" | uplink --token-stdin host domains verify --id app_xxx --hostname example.com --json
+echo "$TOKEN" | uplink --token-stdin host domains list --id app_xxx --json
+echo "$TOKEN" | uplink --token-stdin host domains remove --id app_xxx --hostname example.com --json
+```
+
+`domains check` works without a registrar: it falls back to public DNS/RDAP and returns `provider: "public"` with no price. Do not treat RDAP “available” as buyable unless `domains check` says `buyable: true`. Purchase is not wired yet.
+
+## Databases (optional)
+
+```bash
+echo "$TOKEN" | uplink --token-stdin db create --name mydb --project myproj --json
+echo "$TOKEN" | uplink --token-stdin db list --json
+echo "$TOKEN" | uplink --token-stdin db info --id db_xxx --json
+echo "$TOKEN" | uplink --token-stdin db delete --id db_xxx --yes --json
+```
+
+## Failure modes agents should expect
+
+| Symptom | Likely cause |
+|---------|----------------|
+| URL 502 / not connected | Local process on `--port` not running, or client died — re-run `tunnel create` or check `tunnel list` |
+| Auth errors | Missing/invalid `AGENTCLOUD_TOKEN`; use `--token-stdin` |
+| `ALIAS_NOT_ENABLED` | Account does not have permanent aliases |
+| Domain search TUI missing | Expected on npm — use `domains list` / `check` / `host domains *` |
+| `HOST_APP_LIMIT_REACHED` | Free plan is 1 hosted app — delete one or the account needs hosting granted |
+| `HOST_STORAGE_LIMIT_REACHED` | Upload exceeds the 100 MB free hosting budget |
+| `HOST_DOMAIN_NOT_ENABLED` | Custom domains are paid — `*.host.uplink.spot` still works |
+| First request after idle is slow | Free apps sleep after 30 minutes; the router wakes them |
+| Hosting stuck `queued` | Edge builder/runner issue — check `host status` / `host logs` |
+
+## Interactive menu
+
+Humans: `uplink` or `uplink menu` (Share · Hosting · Domains).  
+Agents should prefer the non-interactive commands above.
+
+## URLs
+
+- Ephemeral tunnels: `https://<token>.x.uplink.spot`
+- Aliases: `https://<alias>.uplink.spot`
+
+## More
+
+- Menu map: `docs/MENU_STRUCTURE.md`
+- Hosting: `docs/HOSTING.md`
+- Product: `docs/PRODUCT.md`
+- Website: https://uplink.spot
+- npm: https://www.npmjs.com/package/uplink-cli (0.2.0 pending; use the GitHub tag until then)

package/CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog
+
+## 0.2.0 — 2026-08-28
+
+Tagged on GitHub. npm publish is pending org auth (`firstprinciplellc`). Until then install from the tag (see README).
+
+- **Guest access** — `tunnel create` and the interactive menu mint a guest token when none exists (1 active tunnel, 24-hour expiry). Stored in `~/.uplink/credentials`.
+- **Email login** — `uplink login --email` / `--code` upgrades that guest account, keeps the tunnel, and unlocks hosting, databases, and registrar inventory.
+- **Public domain check** — `uplink domains check` works with no registrar (DNS + RDAP). Connect a registrar for price.
+- **DreamHost** — inventory adapter; DNS-scoped keys and multiple `--token-env` names are supported.
+- **GoDaddy** — stop falling back to the v1 API on rate-limit / auth errors.
+
+## 0.1.39 — 2026-08-27
+
+Current version on npm. Agent-ready CLI: `--json`, `--token-stdin`, tunnels, hosting, domains.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 First Principle Code
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,81 +1,98 @@
 # Uplink CLI
 
-Share your local app with others for demos, testing, review, and quick feedback — without deploying.
+**Software for agents** — share localhost, host apps, and attach domains from the terminal. Built for Cursor, Claude Code, Codex, Windsurf, and humans who live in a shell.
 
 ![Uplink CLI](./assets/cli-screenshot.png)
 
 ## Key features
-- **Expose any local port**: Turn `localhost:<port>` into a public HTTPS URL like `https://abc123.x.uplink.spot`
-- **Agent-first**: Works well with Cursor, Claude Code, Codex, Windsurf (and other agentic tools)
-- **Terminal-native**: Start/stop tunnels and manage URLs from an interactive menu
-- **No browser required**: Create an account + token from the CLI (`uplink signup`), then automate everything
-- **Open source CLI**: Inspect, extend, and contribute
-
-## Why use Uplink
-- **Fastest way to share localhost**: Great for “can you look at this?” moments
-- **Works great with agents**: machine-readable `--json`, stable exit codes, and stdin token support
-- **Share links + optional permanent URLs**: Permanent URLs are available if enabled on your account
+- **Share any local port**: `localhost:<port>` → public HTTPS (`https://abc123.x.uplink.spot`)
+- **Agent-first**: `--json`, stable exit codes, `--token-stdin` (no browser required)
+- **Hosting**: deploy Next.js / Vite / static apps to Uplink
+- **Domains**: list registrar inventory and attach custom hostnames to hosted apps
+- **Interactive menu**: `uplink` for humans; CLI subcommands for agents
 
 Learn more at [uplink.spot](https://uplink.spot)
 
 ## Install
+
+**npm (current published: 0.1.39)** — guest login and DreamHost land in **0.2.0**, tagged on GitHub, npm publish waiting on org auth.
+
 ```bash
+# Until 0.2.0 is on npm:
+npm install -g github:firstprinciplecode/uplink#v0.2.0
+
+# After publish:
 npm install -g uplink-cli
-# or
 npx uplink-cli --help
 ```
 
-## Authenticate (no browser)
+Changelog: [CHANGELOG.md](./CHANGELOG.md). Product overview: [docs/PRODUCT.md](./docs/PRODUCT.md). Hosting: [docs/HOSTING.md](./docs/HOSTING.md).
+
+## Start without signup
 ```bash
-uplink signup --json                     # creates account + token
-# or interactive: uplink (Get Started)
-export AGENTCLOUD_TOKEN=your-token-here  # save securely
+# Guest token is created and saved automatically
+uplink tunnel create --port 3000 --json
 ```
 
-## Quick start (interactive)
+Guest access includes one active tunnel for 24 hours and public domain search.
+
+## Unlock persistent features
 ```bash
-uplink        # open menu
+uplink login --email you@example.com
+uplink login --email you@example.com --code 123456 --json
 ```
-- Start Tunnel → pick or enter port → get URL (e.g., https://abc123.x.uplink.spot)
-- My Tunnels → see status and permanent URL if set
-- Create Permanent URL → pick tunnel → enter alias (if premium enabled)
-
-### Hosting (interactive)
-- Hosting → Setup Wizard → analyze + create + deploy
-- Hosting → Deploy to Existing App → select app with arrow keys
-- Hosting → List Hosted Apps → select app to view ID + URL
-- Hosting → Delete Hosted App → select app, confirm options (type `DELETE` to proceed)
-- Next.js default: server hosting expects `output: "standalone"`
-- Vite / CRA: static build is supported (dist/build served as static)
-
-## Quick start (non-interactive)
+
+Email verification preserves the guest tunnel and unlocks hosting, databases, and registrar features. Aliases and custom domains still depend on the account plan.
+
+## Quick start (agents)
 ```bash
-# Create tunnel (any port: 3000, 8080, 5173, etc.)
-echo "$AGENTCLOUD_TOKEN" | uplink --token-stdin tunnel create --port 3000 --json
+# Creates guest access automatically when needed
+uplink tunnel create --port 3000 --json
 
-# List tunnels
+# List / stop
 echo "$AGENTCLOUD_TOKEN" | uplink --token-stdin tunnel list --json
+echo "$AGENTCLOUD_TOKEN" | uplink --token-stdin tunnel stop --id tun_xxx --json
+```
 
-# Set alias (if enabled on account)
-echo "$AGENTCLOUD_TOKEN" | uplink --token-stdin tunnel alias-set --id tun_xxx --alias myapp --json
+Full contract: **[AGENTS.md](./AGENTS.md)** (also at `docs/AGENTS.md`).
+
+## Quick start (interactive)
+```bash
+uplink        # open menu
+```
+- **Share** → Start tunnel → pick port → public URL
+- **Hosting** → Setup / Deploy / List / Delete
+- **Domains** → connect registrar, attach hostname to a hosted app
+
+## Hosting (non-interactive)
+```bash
+echo "$AGENTCLOUD_TOKEN" | uplink --token-stdin host setup \
+  --path . --name myapp --yes --json
+```
+
+## Domains (non-interactive)
+```bash
+uplink domains providers connect godaddy --token-env GODADDY_PAT --json
+uplink domains list --json
+echo "$AGENTCLOUD_TOKEN" | uplink --token-stdin \
+  host domains add --id app_xxx --hostname example.com --json
 ```
 
 ## Agent essentials
 - **`--json`**: stdout = JSON only; stderr = logs/errors
 - **`--token-stdin`**: read token once from stdin (avoid argv leaks)
 - **`--api-base`**: override API host if needed
-- **Exit codes**: 0 ok; 2 usage; 10 auth missing/invalid; 20 network; 30 server/unknown  
-See `docs/AGENTS.md` for the full contract.
+- **Exit codes**: 0 ok · 2 usage · 10 auth · 20 network · 30 server/unknown
 
 ## Key commands
 - `uplink menu` — interactive UI
-- `uplink tunnel create --port <p> [--alias <a>] [--json]`
-- `uplink tunnel list --json`
-- `uplink tunnel alias-set --id <id> --alias <a> --json`
-- `uplink tunnel alias-delete --id <id> --json`
-- `uplink tunnel stats --id <id> --json`
-- `uplink tunnel stop --id <id> --json`
-- `uplink signup --json` — create user + token (no auth)
+- `uplink login --email <email> [--code <code>] [--json]`
+- `uplink signup --json`
+- `uplink tunnel create --port <p> [--alias <a>] [--json]` — starts client
+- `uplink tunnel list|stats|stop|alias-set|alias-delete --json`
+- `uplink host setup|deploy|list|status|logs|delete …`
+- `uplink host domains add|verify|list|remove …`
+- `uplink domains list|check|providers …`
 
 ## Environment
 ```bash
@@ -86,14 +103,17 @@ export TUNNEL_DOMAIN=x.uplink.spot
 ```
 
 ## Troubleshooting
-- “No running tunnel clients found” — make sure the tunnel client is still running; restart `uplink` and start a tunnel.
-- Auth errors — verify `AGENTCLOUD_TOKEN` is set/exported; use `--token-stdin`.
-- Relay errors — ensure `TUNNEL_CTRL=tunnel.uplink.spot:7071`.
+- URL not live — ensure something is listening on the port and the client started (`tunnel list` → `connected`)
+- Auth errors — verify `AGENTCLOUD_TOKEN` or `~/.uplink/credentials`; prefer `--token-stdin` for agents
+- Relay errors — `TUNNEL_CTRL=tunnel.uplink.spot:7071`
+- Domain search TUI — not bundled on npm; use `domains list` / `check` / `host domains *`
 
 ## Docs
-- Menu reference: `docs/MENU_STRUCTURE.md`
-- Agent guide: `docs/AGENTS.md`
-- Open source CLI scope vs backend: `docs/OPEN_SOURCE_CLI.md`
+- Agents: [AGENTS.md](./AGENTS.md)
+- Product: [docs/PRODUCT.md](./docs/PRODUCT.md)
+- Hosting: [docs/HOSTING.md](./docs/HOSTING.md)
+- Menu: [docs/MENU_STRUCTURE.md](./docs/MENU_STRUCTURE.md)
+- Changelog: [CHANGELOG.md](./CHANGELOG.md)
 
 ## License
-MIT
+MIT — see [LICENSE](./LICENSE)

package/cli/src/index.ts

@@ -5,12 +5,16 @@ import { devCommand } from "./subcommands/dev";
 import { adminCommand } from "./subcommands/admin";
 import { menuCommand } from "./subcommands/menu";
 import { tunnelCommand } from "./subcommands/tunnel";
+import { loginCommand } from "./subcommands/login";
 import { signupCommand } from "./subcommands/signup";
 import { systemCommand } from "./subcommands/system";
 import { hostCommand } from "./subcommands/host";
+import { domainsCommand } from "./subcommands/domains";
 import { readFileSync } from "fs";
 import { join } from "path";
 import { ensureApiBase, parseTokenEnv } from "./utils/api-base";
+import { readStoredCredentials } from "./utils/credentials";
+import { handleError } from "./utils/machine";
 
 // Get version from package.json (CommonJS build: __dirname available)
 const pkgPath = join(__dirname, "../../package.json");
@@ -20,7 +24,7 @@ const program = new Command();
 
 program
   .name("uplink")
-  .description("Agent-friendly cloud CLI")
+  .description("Software for agents — share localhost, host apps, attach domains")
   .version(pkg.version)
   .option("--api-base <url>", "Override API base URL (default env AGENTCLOUD_API_BASE)")
   .option("--token-stdin", "Read AGENTCLOUD_TOKEN from stdin once");
@@ -30,9 +34,11 @@ program.addCommand(devCommand);
 program.addCommand(adminCommand);
 program.addCommand(tunnelCommand);
 program.addCommand(signupCommand);
+program.addCommand(loginCommand);
 program.addCommand(systemCommand);
 program.addCommand(menuCommand);
 program.addCommand(hostCommand);
+program.addCommand(domainsCommand);
 
 // Global pre-action hook to apply shared options
 let cachedTokenStdin: string | null = null;
@@ -68,6 +74,14 @@ program.hook("preAction", async (thisCommand) => {
     if (!process.env.AGENTCLOUD_API_BASE && parsed.apiBase) {
       process.env.AGENTCLOUD_API_BASE = parsed.apiBase;
     }
+  } else {
+    const stored = readStoredCredentials();
+    if (stored?.token && !process.env.AGENTCLOUD_TOKEN) {
+      process.env.AGENTCLOUD_TOKEN = stored.token;
+      if (!process.env.AGENTCLOUD_API_BASE && stored.apiBase) {
+        process.env.AGENTCLOUD_API_BASE = stored.apiBase;
+      }
+    }
   }
 
   const isInteractive = Boolean(process.stdin.isTTY && process.stdout.isTTY && !opts.json);
@@ -83,7 +97,6 @@ if (process.argv.length === 2) {
 }
 
 program.parseAsync(process.argv).catch((err) => {
-  console.error(err);
-  process.exit(1);
+  handleError(err);
 });
 

package/cli/src/registrars/cloudflare.ts

@@ -0,0 +1,148 @@
+import { httpError } from "./http";
+import type { DomainQuote, InventoryDomain, RegistrarAdapter, RegistrarCredentials } from "./types";
+
+const BASE = "https://api.cloudflare.com/client/v4";
+
+type CfEnvelope<T> = {
+  success?: boolean;
+  errors?: Array<{ message?: string }>;
+  result?: T;
+  result_info?: { cursor?: string };
+};
+
+async function cfFetch(
+  creds: RegistrarCredentials,
+  path: string,
+  init: RequestInit = {}
+): Promise<Response> {
+  if (!creds.token) throw new Error("Cloudflare token is missing");
+  return fetch(`${BASE}${path}`, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${creds.token}`,
+      Accept: "application/json",
+      "Content-Type": "application/json",
+      ...(init.headers || {}),
+    },
+  });
+}
+
+async function cfJson<T>(res: Response): Promise<CfEnvelope<T>> {
+  const text = await res.text();
+  let body: CfEnvelope<T>;
+  try {
+    body = text ? (JSON.parse(text) as CfEnvelope<T>) : {};
+  } catch {
+    throw httpError(res, text);
+  }
+  if (!res.ok || body.success === false) {
+    const message = body.errors?.map((e) => e.message).filter(Boolean).join("; ") || text;
+    throw httpError(res, message);
+  }
+  return body;
+}
+
+function pickUsd(value: unknown): number | undefined {
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value === "string") {
+    const n = Number(value);
+    return Number.isFinite(n) ? n : undefined;
+  }
+  if (value && typeof value === "object") {
+    const obj = value as { amount?: unknown; value?: unknown; usd?: unknown };
+    return pickUsd(obj.amount ?? obj.value ?? obj.usd);
+  }
+  return undefined;
+}
+
+export const cloudflareAdapter: RegistrarAdapter = {
+  id: "cloudflare",
+  label: "Cloudflare",
+  connectHelp: "API token with account read. --token-env CF_API_TOKEN (optional --account-env CF_ACCOUNT_ID)",
+  async verify(creds) {
+    const res = await cfFetch(creds, "/accounts?per_page=1");
+    const body = await cfJson<Array<{ id?: string }>>(res);
+    const accountId = creds.accountId || body.result?.[0]?.id;
+    if (!accountId) throw new Error("Cloudflare token has no accounts");
+    return { ...creds, accountId };
+  },
+  async listDomains(creds) {
+    const accountId = creds.accountId;
+    if (!accountId) throw new Error("Cloudflare account id is missing");
+    const out: InventoryDomain[] = [];
+
+    const registrations = await cfFetch(creds, `/accounts/${accountId}/registrar/registrations`);
+    if (registrations.ok) {
+      const body = await cfJson<Array<{ domain_name?: string; expires_at?: string }>>(registrations);
+      for (const item of body.result || []) {
+        if (!item.domain_name) continue;
+        out.push({
+          domain: item.domain_name.toLowerCase(),
+          provider: "cloudflare",
+          status: "owned",
+          expiresAt: item.expires_at,
+        });
+      }
+    }
+
+    if (out.length > 0) return out;
+
+    const zones = await cfFetch(creds, "/zones?per_page=50");
+    if (!zones.ok) {
+      if (!registrations.ok) throw httpError(registrations, await registrations.text());
+      return out;
+    }
+    const body = await cfJson<Array<{ name?: string }>>(zones);
+    for (const zone of body.result || []) {
+      if (!zone.name) continue;
+      out.push({ domain: zone.name.toLowerCase(), provider: "cloudflare", status: "owned" });
+    }
+    return out;
+  },
+  async check(creds, domain) {
+    const accountId = creds.accountId;
+    if (!accountId) throw new Error("Cloudflare account id is missing");
+    let res = await cfFetch(creds, `/accounts/${accountId}/registrar/domain-check`, {
+      method: "POST",
+      body: JSON.stringify({ domains: [domain] }),
+    });
+    if (res.status === 400) {
+      res = await cfFetch(creds, `/accounts/${accountId}/registrar/domain-check`, {
+        method: "POST",
+        body: JSON.stringify({ domain_names: [domain] }),
+      });
+    }
+    if (!res.ok) throw httpError(res, await res.text());
+    const body = await cfJson<unknown>(res);
+    const rows = Array.isArray(body.result) ? body.result : body.result ? [body.result] : [];
+    const row = (rows[0] || {}) as {
+      domain_name?: string;
+      registrable?: boolean;
+      available?: boolean;
+      tier?: string;
+      reason?: string;
+      fees?: { registration?: unknown };
+      prices?: { registration?: unknown };
+      price?: unknown;
+    };
+    const available = row.registrable === true || row.available === true;
+    const priceUsd = pickUsd(row.fees?.registration ?? row.prices?.registration ?? row.price);
+    if (available) {
+      return {
+        domain,
+        provider: "cloudflare",
+        status: "available",
+        buyable: row.tier !== "premium",
+        premium: row.tier === "premium",
+        priceUsd,
+      };
+    }
+    return {
+      domain,
+      provider: "cloudflare",
+      status: row.reason ? "not_for_sale" : "taken",
+      buyable: false,
+      error: row.reason,
+    };
+  },
+};