uplink-cli 0.2.2 → 0.2.6

package/AGENTS.md

@@ -111,7 +111,10 @@ Notes:
 
 ## Custom domains
 
-Registrar inventory is CLI. Attach/verify is under `host domains`.  
+Uplink is a hub for domains and hosting spread across providers: registrar inventory
+(GoDaddy, Cloudflare, Hostinger, Namecheap, DreamHost) and hosted domains from any
+**cPanel** account (Namecheap shared, Bluehost, HostGator, …) land in one `domains list`.
+Attach/verify is under `host domains`.
 The bare `uplink domains` command opens Find a domain. Agents should use JSON:
 
 ```bash
@@ -123,6 +126,7 @@ uplink domains providers connect cloudflare --token-env CF_API_TOKEN --json
 uplink domains providers connect hostinger --token-env HOSTINGER_API_TOKEN --json
 uplink domains providers connect dreamhost --token-env DREAMHOST_API_KEY --json
 uplink domains providers connect namecheap --token-env NAMECHEAP_API_KEY --user-env NAMECHEAP_API_USER --json
+uplink domains providers connect cpanel --host server341.web-hosting.com --user-env CPANEL_USER --token-env CPANEL_API_TOKEN --json
 uplink domains providers list --json
 uplink domains providers disconnect godaddy --json
 
@@ -132,7 +136,19 @@ echo "$TOKEN" | uplink --token-stdin host domains list --id app_xxx --json
 echo "$TOKEN" | uplink --token-stdin host domains remove --id app_xxx --hostname example.com --json
 ```
 
-`domains check` works without a registrar: it falls back to public DNS/RDAP and returns `provider: "public"` with no price. Do not treat RDAP “available” as buyable unless `domains check` says `buyable: true`. Purchase is not wired yet.
+`domains check` works without a registrar: it falls back to public DNS/RDAP and returns `provider: "public"` with no price. Do not treat RDAP “available” as buyable unless `domains check` says `buyable: true`.
+
+Purchase (Namecheap):
+
+```bash
+uplink domains contact seed --json          # copy WHOIS from an owned domain
+uplink domains contact set --json           # or set flags / interactive
+uplink domains fund --amount 20 --json      # payment page URL to tank balance
+uplink domains buy alchemy.photos --yes --json
+uplink domains buy alchemy.photos --open-cart --json   # browser cart instead
+```
+
+API buys charge Namecheap **account balance**. If balance is low, `buy` / the Find a domain TUI return/open an add-funds `redirectUrl` from `namecheap.users.createaddfundsrequest`.
 
 ## Databases (optional)
 

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.2.6 — 2026-08-30
+
+Uplink as a **domain hub**: connect any **cPanel** host (Namecheap shared, Bluehost, HostGator, and most shared hosting) alongside registrars, so domains and sites scattered across providers land in one `domains list`. Connect with `uplink domains providers connect cpanel --host server.example.com --user-env CPANEL_USER --token-env CPANEL_API_TOKEN` (token from cPanel → Security → Manage API Tokens), or through the menu under Domains → Connect registrar.
+
+## 0.2.5 — 2026-08-30
+
+Find a domain: ↑↓ / mouse wheel to select results, enter or click for details, then buy via Namecheap API (or open cart / add-funds payment URL when balance is low). New commands: `domains buy`, `domains fund`, `domains contact show|set|seed`.
+
+## 0.2.4 — 2026-08-30
+
+Fix interactive menu crash (`uplink` / `uplink menu`): `domain-check.ts` still statically imported Ink's DomainSearch into the CommonJS graph, so tsx transformed `yoga-layout` as CJS (`Top-level await is currently not supported with the "cjs" output format`). Find a domain from the menu now spawns the ESM child the same way `uplink domains` does. Also stop passing the root CJS `tsconfig` into ESM Ink screens, and resolve `tsx` via `tsx/cli` for newer tsx releases.
+
+## 0.2.3 — 2026-08-30
+
+New **`uplink upgrade`** (Uplink Pro subscription — $9/mo or `--yearly` $90/yr via Stripe Checkout) and **`uplink billing`** (Stripe billing portal for cancel/card changes). Pro unlocks unlimited hosted apps within 1 GB of storage, always-on for your 5 most-active apps, custom domains, and permanent aliases.
+
+Fix global CLI crash on every command (`host list`, `login`, …): `domains.ts` was statically importing Ink, so tsx tried to load `yoga-layout` as CommonJS (`Top-level await is currently not supported with the "cjs" output format`). Interactive Find a domain now runs as a child ESM process, same as the menu.
+
 ## 0.2.2 — 2026-08-29
 
 Built-in **Find a domain** in the CLI (no Domainking install). Type a label to check common TLDs via DNS/RDAP. `uplink domains` opens it; agents use `uplink domains search acme --json`. Domainking remains a separate app.

package/README.md

@@ -8,7 +8,8 @@
 - **Share any local port**: `localhost:<port>` → public HTTPS (`https://abc123.x.uplink.spot`)
 - **Agent-first**: `--json`, stable exit codes, `--token-stdin` (no browser required)
 - **Hosting**: deploy Next.js / Vite / static apps to Uplink
-- **Domains**: list registrar inventory and attach custom hostnames to hosted apps
+- **Domain hub**: one inventory for domains scattered across GoDaddy, Cloudflare, Hostinger, Namecheap, DreamHost — and any cPanel host (Namecheap shared, Bluehost, HostGator, …)
+- **Custom hostnames**: attach a domain you own to a hosted app and verify DNS
 - **Interactive menu**: `uplink` for humans; CLI subcommands for agents
 
 Learn more at [uplink.spot](https://uplink.spot)
@@ -21,7 +22,7 @@ npm install -g uplink-cli
 npx uplink-cli --help
 ```
 
-`latest` on npm is **0.2.0** (guest login, email OTP, public `domains check`, DreamHost). Changelog: [CHANGELOG.md](./CHANGELOG.md). Product: [docs/PRODUCT.md](./docs/PRODUCT.md). Hosting: [docs/HOSTING.md](./docs/HOSTING.md).
+Changelog: [CHANGELOG.md](./CHANGELOG.md). Product: [docs/PRODUCT.md](./docs/PRODUCT.md). Hosting: [docs/HOSTING.md](./docs/HOSTING.md).
 
 ## Start without signup
 ```bash
@@ -68,6 +69,8 @@ echo "$AGENTCLOUD_TOKEN" | uplink --token-stdin host setup \
 ## Domains (non-interactive)
 ```bash
 uplink domains providers connect godaddy --token-env GODADDY_PAT --json
+uplink domains providers connect cpanel --host server341.web-hosting.com \
+  --user-env CPANEL_USER --token-env CPANEL_API_TOKEN --json
 uplink domains list --json
 echo "$AGENTCLOUD_TOKEN" | uplink --token-stdin \
   host domains add --id app_xxx --hostname example.com --json

package/cli/bin/uplink.js

@@ -27,11 +27,11 @@ if (args.length === 0) {
 // Find tsx - prefer project-local, otherwise fall back to PATH
 let tsxPath = "tsx";
 try {
-  // Newer tsx exposes a CLI entry at dist/cli.cjs
-  tsxPath = require.resolve("tsx/dist/cli.cjs", { paths: [projectRoot] });
+  // Package exports entry (tsx 4.21–4.23+)
+  tsxPath = require.resolve("tsx/cli", { paths: [projectRoot] });
 } catch (e) {
   try {
-    tsxPath = require.resolve("tsx/cli", { paths: [projectRoot] });
+    tsxPath = require.resolve("tsx/dist/cli.cjs", { paths: [projectRoot] });
   } catch (_) {
     // keep fallback to PATH
   }

package/cli/src/index.ts

@@ -10,6 +10,7 @@ import { signupCommand } from "./subcommands/signup";
 import { systemCommand } from "./subcommands/system";
 import { hostCommand } from "./subcommands/host";
 import { domainsCommand } from "./subcommands/domains";
+import { upgradeCommand, billingCommand } from "./subcommands/upgrade";
 import { readFileSync } from "fs";
 import { join } from "path";
 import { ensureApiBase, parseTokenEnv } from "./utils/api-base";
@@ -39,6 +40,8 @@ program.addCommand(systemCommand);
 program.addCommand(menuCommand);
 program.addCommand(hostCommand);
 program.addCommand(domainsCommand);
+program.addCommand(upgradeCommand);
+program.addCommand(billingCommand);
 
 // Global pre-action hook to apply shared options
 let cachedTokenStdin: string | null = null;

package/cli/src/registrars/cpanel.ts

@@ -0,0 +1,119 @@
+import type { InventoryDomain, RegistrarAdapter, RegistrarCredentials } from "./types";
+
+/**
+ * cPanel is not a registrar, but it is where many people's sites actually
+ * live (Namecheap shared, Bluehost, HostGator, A2, GoDaddy shared, …).
+ * Connecting a cPanel account pulls its hosted domains into the same
+ * inventory as registrar-owned domains, so Uplink can act as the hub for
+ * domains and hosting scattered across providers.
+ *
+ * Auth: a cPanel API token (Security → Manage API Tokens in the panel),
+ * sent as `Authorization: cpanel user:token` to the UAPI on port 2083.
+ */
+
+type UapiResponse = {
+  status?: number;
+  data?: unknown;
+  errors?: string[] | null;
+};
+
+const HOST_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+(:\d{2,5})?$/i;
+
+export function normalizeCpanelHost(raw: string): string {
+  const host = raw
+    .trim()
+    .replace(/^https?:\/\//i, "")
+    .replace(/\/.*$/, "")
+    .toLowerCase();
+  if (!HOST_RE.test(host)) {
+    throw new Error(`Invalid cPanel host: ${raw}. Pass a hostname like server341.web-hosting.com`);
+  }
+  return host;
+}
+
+function baseUrl(creds: RegistrarCredentials): string {
+  const host = normalizeCpanelHost(creds.host || "");
+  return host.includes(":") ? `https://${host}` : `https://${host}:2083`;
+}
+
+async function uapi(creds: RegistrarCredentials, module: string, fn: string): Promise<unknown> {
+  const user = creds.apiUser || "";
+  const token = creds.token || "";
+  if (!user || !token) throw new Error("cPanel needs a username and an API token");
+  const url = `${baseUrl(creds)}/execute/${module}/${fn}`;
+  let res: Response;
+  try {
+    res = await fetch(url, {
+      headers: {
+        Authorization: `cpanel ${user}:${token}`,
+        Accept: "application/json",
+      },
+    });
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    throw new Error(`Could not reach cPanel at ${baseUrl(creds)} (${detail})`);
+  }
+  if (res.status === 401 || res.status === 403) {
+    throw new Error("cPanel rejected the credentials (check username and API token)");
+  }
+  const text = await res.text();
+  let body: UapiResponse;
+  try {
+    body = text ? (JSON.parse(text) as UapiResponse) : {};
+  } catch {
+    throw new Error(`cPanel returned a non-JSON response (HTTP ${res.status})`);
+  }
+  if (!res.ok || body.status !== 1) {
+    const detail = body.errors?.filter(Boolean).join("; ") || `HTTP ${res.status}`;
+    throw new Error(`cPanel ${module}/${fn} failed: ${detail}`);
+  }
+  return body.data;
+}
+
+function stringsOf(value: unknown): string[] {
+  if (!Array.isArray(value)) return [];
+  return value.filter((item): item is string => typeof item === "string" && item.includes("."));
+}
+
+async function listHostedDomains(creds: RegistrarCredentials): Promise<InventoryDomain[]> {
+  const data = (await uapi(creds, "DomainInfo", "list_domains")) as Record<string, unknown> | null;
+  const out: InventoryDomain[] = [];
+  const seen = new Set<string>();
+  const push = (domain: string) => {
+    const normalized = domain.toLowerCase();
+    if (seen.has(normalized)) return;
+    seen.add(normalized);
+    out.push({ domain: normalized, provider: "cpanel", status: "owned" });
+  };
+  const main = data?.main_domain;
+  if (typeof main === "string" && main.includes(".")) push(main);
+  for (const domain of stringsOf(data?.addon_domains)) push(domain);
+  for (const domain of stringsOf(data?.parked_domains)) push(domain);
+  return out;
+}
+
+export const cpanelAdapter: RegistrarAdapter = {
+  id: "cpanel",
+  label: "cPanel hosting",
+  connectHelp:
+    "Any cPanel host (Namecheap shared, Bluehost, HostGator, …). --host server.example.com --user-env CPANEL_USER --token-env CPANEL_API_TOKEN (token: cPanel → Security → Manage API Tokens)",
+  async verify(creds) {
+    if (!creds.host) throw new Error("cPanel needs --host (e.g. server341.web-hosting.com)");
+    creds.host = normalizeCpanelHost(creds.host);
+    await listHostedDomains(creds);
+    return creds;
+  },
+  async listDomains(creds) {
+    const domains = await listHostedDomains(creds);
+    return domains.sort((a, b) => a.domain.localeCompare(b.domain));
+  },
+  async check(creds, domain) {
+    // cPanel hosts sites; it has no availability API. Confirm hosted
+    // domains, otherwise let the chain fall through to a registrar.
+    const hosted = await listHostedDomains(creds);
+    if (hosted.some((item) => item.domain === domain.toLowerCase())) {
+      return { domain, provider: "cpanel", status: "owned", buyable: false };
+    }
+    throw new Error("cPanel only knows domains hosted on the connected account");
+  },
+};

package/cli/src/registrars/index.ts

@@ -1,4 +1,5 @@
 import { cloudflareAdapter } from "./cloudflare";
+import { cpanelAdapter } from "./cpanel";
 import { dreamhostAdapter } from "./dreamhost";
 import { godaddyAdapter } from "./godaddy";
 import { hostingerAdapter } from "./hostinger";
@@ -12,6 +13,7 @@ export const adapters: RegistrarAdapter[] = [
   hostingerAdapter,
   namecheapAdapter,
   dreamhostAdapter,
+  cpanelAdapter,
 ];
 
 const byId = new Map(adapters.map((adapter) => [adapter.id, adapter]));

package/cli/src/registrars/namecheap-purchase.ts

@@ -0,0 +1,219 @@
+import { httpError } from "./http";
+import type { RegistrarCredentials } from "./types";
+import type { RegistrantContact } from "../utils/registrant-contact";
+
+const API_URL = "https://api.namecheap.com/xml.response";
+
+let clientIpPromise: Promise<string> | undefined;
+
+async function clientIp(): Promise<string> {
+  clientIpPromise ??= fetch("https://api.ipify.org")
+    .then(async (res) => {
+      if (!res.ok) throw new Error(`ip lookup failed (${res.status})`);
+      return (await res.text()).trim();
+    })
+    .catch((error: unknown) => {
+      clientIpPromise = undefined;
+      throw error;
+    });
+  return clientIpPromise;
+}
+
+function attr(tag: string, name: string): string | undefined {
+  return new RegExp(`${name}="([^"]*)"`, "i").exec(tag)?.[1];
+}
+
+async function namecheapCall(
+  creds: RegistrarCredentials,
+  command: string,
+  extra: Record<string, string>,
+  method: "GET" | "POST" = "GET"
+): Promise<string> {
+  if (!creds.apiUser || !creds.apiKey) throw new Error("Namecheap API user and key are required");
+  const params = new URLSearchParams({
+    ApiUser: creds.apiUser,
+    ApiKey: creds.apiKey,
+    UserName: creds.apiUser,
+    Command: command,
+    ClientIp: await clientIp(),
+    ...extra,
+  });
+  const res =
+    method === "POST"
+      ? await fetch(API_URL, {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: params,
+        })
+      : await fetch(`${API_URL}?${params}`);
+  const xml = await res.text();
+  const status = /Status="([^"]+)"/.exec(xml)?.[1];
+  if (status !== "OK") {
+    const err = /<Error[^>]*>([^<]+)<\/Error>/.exec(xml)?.[1] || `Namecheap ${status || res.status}`;
+    const ip = await clientIp().catch(() => "");
+    if (/ip/i.test(err) && ip) {
+      throw new Error(`${err}. Whitelist this machine's IP in Namecheap API access: ${ip}`);
+    }
+    throw new Error(err);
+  }
+  if (!res.ok) throw httpError(res, xml);
+  return xml;
+}
+
+export type NamecheapBalance = {
+  currency: string;
+  available: number;
+  account: number;
+};
+
+export async function getNamecheapBalance(creds: RegistrarCredentials): Promise<NamecheapBalance> {
+  const xml = await namecheapCall(creds, "namecheap.users.getBalances", {});
+  const tag = xml.match(/<UserGetBalancesResult\b([^>]*)\/?>/i)?.[1];
+  if (!tag) throw new Error("Namecheap balance response missing");
+  return {
+    currency: attr(tag, "Currency") || "USD",
+    available: Number(attr(tag, "AvailableBalance") || "0"),
+    account: Number(attr(tag, "AccountBalance") || "0"),
+  };
+}
+
+export type AddFundsRequest = {
+  tokenId: string;
+  redirectUrl: string;
+  returnUrl: string;
+  amount: number;
+};
+
+/**
+ * Creates a Namecheap credit-card add-funds session and returns the payment URL.
+ * Domain purchase charges account balance — fund first if AvailableBalance is low.
+ */
+export async function createNamecheapAddFundsRequest(
+  creds: RegistrarCredentials,
+  amount: number,
+  returnUrl = "https://www.namecheap.com/"
+): Promise<AddFundsRequest> {
+  if (!Number.isFinite(amount) || amount < 5) {
+    throw new Error("Namecheap add-funds amount must be at least $5");
+  }
+  const xml = await namecheapCall(creds, "namecheap.users.createaddfundsrequest", {
+    Username: creds.apiUser || "",
+    PaymentType: "creditcard",
+    Amount: amount.toFixed(2),
+    ReturnUrl: returnUrl,
+  });
+  const tag =
+    xml.match(/<Createaddfundsrequestresult\b([^>]*)\/?>/i)?.[1] ||
+    xml.match(/<CreateAddFundsRequestResult\b([^>]*)\/?>/i)?.[1];
+  if (!tag) throw new Error("Namecheap add-funds response missing redirect URL");
+  const redirectUrl = attr(tag, "RedirectURL") || attr(tag, "ReturnURL");
+  const tokenId = attr(tag, "TokenID") || "";
+  if (!redirectUrl) throw new Error("Namecheap add-funds response missing RedirectURL");
+  return {
+    tokenId,
+    redirectUrl,
+    returnUrl: attr(tag, "ReturnURL") || returnUrl,
+    amount,
+  };
+}
+
+function contactFields(prefix: string, contact: RegistrantContact): Record<string, string> {
+  const fields: Record<string, string> = {
+    [`${prefix}FirstName`]: contact.firstName,
+    [`${prefix}LastName`]: contact.lastName,
+    [`${prefix}Address1`]: contact.address1,
+    [`${prefix}City`]: contact.city,
+    [`${prefix}StateProvince`]: contact.stateProvince,
+    [`${prefix}PostalCode`]: contact.postalCode,
+    [`${prefix}Country`]: contact.country,
+    [`${prefix}Phone`]: contact.phone,
+    [`${prefix}EmailAddress`]: contact.email,
+  };
+  if (contact.organizationName) fields[`${prefix}OrganizationName`] = contact.organizationName;
+  return fields;
+}
+
+export type RegisterDomainResult = {
+  domain: string;
+  registered: boolean;
+  chargedAmount?: number;
+  orderId?: string;
+  domainId?: string;
+  transactionId?: string;
+};
+
+export async function registerNamecheapDomain(
+  creds: RegistrarCredentials,
+  opts: {
+    domain: string;
+    years?: number;
+    contact: RegistrantContact;
+    premium?: boolean;
+    premiumPrice?: number;
+  }
+): Promise<RegisterDomainResult> {
+  const years = opts.years ?? 1;
+  const extra: Record<string, string> = {
+    DomainName: opts.domain,
+    Years: String(years),
+    AddFreeWhoisguard: "yes",
+    WGEnabled: "yes",
+    ...contactFields("Registrant", opts.contact),
+    ...contactFields("Tech", opts.contact),
+    ...contactFields("Admin", opts.contact),
+    ...contactFields("AuxBilling", opts.contact),
+  };
+  if (opts.premium) {
+    extra.IsPremiumDomain = "true";
+    if (opts.premiumPrice != null) extra.PremiumPrice = opts.premiumPrice.toFixed(2);
+  }
+  const xml = await namecheapCall(creds, "namecheap.domains.create", extra, "POST");
+  const tag = xml.match(/<DomainCreateResult\b([^>]*)\/?>/i)?.[1];
+  if (!tag) throw new Error("Namecheap create response missing DomainCreateResult");
+  const registered = attr(tag, "Registered")?.toLowerCase() === "true";
+  return {
+    domain: attr(tag, "Domain") || opts.domain,
+    registered,
+    chargedAmount: Number(attr(tag, "ChargedAmount") || "") || undefined,
+    orderId: attr(tag, "OrderID"),
+    domainId: attr(tag, "DomainID"),
+    transactionId: attr(tag, "TransactionID"),
+  };
+}
+
+/** Pull registrant contact from an already-owned domain (seeds ~/.uplink/registrant.json). */
+export async function fetchNamecheapDomainContact(
+  creds: RegistrarCredentials,
+  domain: string
+): Promise<RegistrantContact | null> {
+  const xml = await namecheapCall(creds, "namecheap.domains.getContacts", { DomainName: domain });
+  const block = xml.match(/<Registrant>([\s\S]*?)<\/Registrant>/i)?.[1];
+  if (!block) return null;
+  const get = (name: string) =>
+    new RegExp(`<${name}>([^<]*)</${name}>`, "i").exec(block)?.[1]?.trim() || "";
+  const contact: RegistrantContact = {
+    firstName: get("FirstName"),
+    lastName: get("LastName"),
+    address1: get("Address1"),
+    city: get("City"),
+    stateProvince: get("StateProvince"),
+    postalCode: get("PostalCode"),
+    country: get("Country"),
+    phone: get("Phone"),
+    email: get("EmailAddress"),
+    organizationName: get("OrganizationName") || undefined,
+  };
+  if (!contact.firstName || !contact.lastName || !contact.email) return null;
+  return contact;
+}
+
+/** Browser cart deep-link (manual checkout — does not use API balance). */
+export function namecheapCartUrl(domain: string, years = 1): string {
+  const params = new URLSearchParams({
+    producttype: "domains",
+    action: "purchase",
+    domainlist: domain,
+    billingcycle: String(years),
+  });
+  return `https://www.namecheap.com/cart/addtocart.aspx?${params}`;
+}

package/cli/src/registrars/types.ts

@@ -1,4 +1,4 @@
-export const PROVIDER_IDS = ["godaddy", "cloudflare", "hostinger", "namecheap", "dreamhost"] as const;
+export const PROVIDER_IDS = ["godaddy", "cloudflare", "hostinger", "namecheap", "dreamhost", "cpanel"] as const;
 export type ProviderId = (typeof PROVIDER_IDS)[number];
 
 export function isProviderId(value: string): value is ProviderId {
@@ -10,6 +10,8 @@ export type RegistrarCredentials = {
   apiUser?: string;
   apiKey?: string;
   accountId?: string;
+  /** Server hostname for panel-based providers (e.g. cPanel on port 2083). */
+  host?: string;
   /** Additional API keys for providers with multiple accounts (e.g. DreamHost). */
   extraTokens?: string[];
 };