uplink-cli 0.2.7 → 0.2.8

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.2.8 — 2026-08-31
+
+`domains list` is now grouped by provider and honest about what it knows: cPanel entries show as **hosted** (a panel serving a site says nothing about ownership), registrar expiry dates in the past show as **EXPIRED**, and new **`--verify`** RDAP-checks every entry without registration data (DNS zones, hosted sites) to reveal lapsed domains. RDAP goes straight to each TLD registry via the IANA bootstrap, with a DNS-delegation fallback for registries that 404.
+
 ## 0.2.7 — 2026-08-31
 
 Multiple **cPanel** accounts: `providers connect cpanel --host …` now appends (people have sites on several hosts), `providers disconnect cpanel --host …` removes one account, and `providers list` shows the connected hosts. One user, many shared hosts, one inventory.

package/cli/src/registrars/cpanel.ts

@@ -129,7 +129,9 @@ async function listHostedDomains(creds: RegistrarCredentials): Promise<Inventory
         const normalized = domain.toLowerCase();
         if (seen.has(normalized)) continue;
         seen.add(normalized);
-        out.push({ domain: normalized, provider: "cpanel", status: "owned" });
+        // "hosted": the panel serves this domain; it says nothing about
+        // whether the registration is still owned.
+        out.push({ domain: normalized, provider: "cpanel", status: "hosted" });
       }
     } catch (error) {
       errors.push(error instanceof Error ? error.message : String(error));
@@ -165,7 +167,7 @@ export const cpanelAdapter: RegistrarAdapter = {
     // domains, otherwise let the chain fall through to a registrar.
     const hosted = await listHostedDomains(creds);
     if (hosted.some((item) => item.domain === domain.toLowerCase())) {
-      return { domain, provider: "cpanel", status: "owned", buyable: false };
+      return { domain, provider: "cpanel", status: "taken", buyable: false };
     }
     throw new Error("cPanel only knows domains hosted on the connected accounts");
   },

package/cli/src/registrars/types.ts

@@ -27,7 +27,8 @@ export type RegistrarCredentials = {
 export type InventoryDomain = {
   domain: string;
   provider: ProviderId;
-  status: "owned";
+  /** "owned" = registrar registration; "hosted" = served by a panel (says nothing about ownership). */
+  status: "owned" | "hosted";
   expiresAt?: string;
 };
 

package/cli/src/subcommands/domains.ts

@@ -19,6 +19,8 @@ import { cpanelAccountsOf, mergeCpanelCredentials, normalizeCpanelHost } from ".
 import {
   checkDomainAvailability,
   formatPublicAvailability,
+  rdapRegistration,
+  type RdapRegistration,
 } from "../utils/domain-availability";
 import { searchDomains } from "../utils/domain-search";
 import {
@@ -124,6 +126,60 @@ async function credentialsFromFlags(
   return creds;
 }
 
+/** Registrars report expiry in mixed formats (GoDaddy ISO, Namecheap MM/DD/YYYY). */
+function parseExpiry(value?: string): Date | undefined {
+  if (!value) return undefined;
+  const mdy = value.match(/^(\d{2})\/(\d{2})\/(\d{4})$/);
+  const date = mdy ? new Date(`${mdy[3]}-${mdy[1]}-${mdy[2]}T00:00:00Z`) : new Date(value);
+  return Number.isNaN(date.getTime()) ? undefined : date;
+}
+
+function formatDay(date: Date): string {
+  return date.toISOString().slice(0, 10);
+}
+
+const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+/** RDAP-check registration for domains whose source can't attest ownership. */
+async function verifyRegistrations(domains: string[]): Promise<Map<string, RdapRegistration>> {
+  const out = new Map<string, RdapRegistration>();
+  const run = async (targets: string[], batchSize: number, pauseMs: number) => {
+    for (let i = 0; i < targets.length; i += batchSize) {
+      if (i > 0) await sleep(pauseMs);
+      const results = await Promise.all(targets.slice(i, i + batchSize).map(rdapRegistration));
+      for (const result of results) out.set(result.domain, result);
+    }
+  };
+  await run([...new Set(domains)], 4, 400);
+  // rdap.org rate-limits bursts; give inconclusive lookups one slower retry.
+  const inconclusive = [...out.values()].filter((r) => r.registered === null).map((r) => r.domain);
+  if (inconclusive.length > 0) {
+    await sleep(2000);
+    await run(inconclusive, 2, 1000);
+  }
+  return out;
+}
+
+function inventoryMarker(item: InventoryDomain, verified?: RdapRegistration): string {
+  const now = new Date();
+  if (verified) {
+    if (verified.registered === false) return "NOT REGISTERED — lapsed";
+    if (verified.registered === null) return `rdap inconclusive (${verified.detail})`;
+    const expiry = parseExpiry(verified.expiresAt);
+    if (expiry) {
+      return expiry < now
+        ? `registered · EXPIRED ${formatDay(expiry)} (rdap)`
+        : `registered · expires ${formatDay(expiry)} (rdap)`;
+    }
+    return verified.detail ? `registered · ${verified.detail}` : "registered (rdap)";
+  }
+  const expiry = parseExpiry(item.expiresAt);
+  if (expiry) {
+    return expiry < now ? `EXPIRED ${formatDay(expiry)}` : `expires ${formatDay(expiry)}`;
+  }
+  return item.status === "hosted" ? "hosted (ownership unknown)" : "no expiry data";
+}
+
 async function listInventory(providerFilter?: ProviderId): Promise<InventoryDomain[]> {
   const store = readRegistrarStore();
   const ids = providerFilter ? [providerFilter] : CHECK_ORDER.filter((id) => store[id]);
@@ -192,24 +248,62 @@ domainsCommand.action(() => {
 
 domainsCommand
   .command("list")
-  .description("List domains owned at connected registrars")
+  .description("Inventory across connected registrars and cPanel hosts, grouped by provider")
   .option("--provider <id>", "Only this provider (godaddy|cloudflare|hostinger|namecheap|dreamhost|cpanel)")
+  .option("--verify", "RDAP-check registration for entries without expiry data (zones/hosted sites)", false)
   .option("--json", "Output JSON", false)
   .action(async (opts) => {
     try {
       const provider = parseProvider(opts.provider);
       const domains = await listInventory(provider);
+
+      // Zones (DreamHost) and hosted sites (cPanel) carry no registration
+      // data — a lapsed domain can linger there forever. --verify asks RDAP.
+      let verified: Map<string, RdapRegistration> | undefined;
+      if (opts.verify) {
+        const unverifiable = domains.filter((item) => !parseExpiry(item.expiresAt));
+        verified = await verifyRegistrations(unverifiable.map((item) => item.domain));
+      }
+
       if (opts.json) {
-        printJson({ domains, count: domains.length });
+        const enriched = domains.map((item) => {
+          const check = verified?.get(item.domain);
+          return check
+            ? {
+                ...item,
+                registration: {
+                  registered: check.registered,
+                  ...(check.expiresAt ? { expiresAt: check.expiresAt } : {}),
+                  ...(check.detail ? { detail: check.detail } : {}),
+                },
+              }
+            : item;
+        });
+        printJson({ domains: enriched, count: enriched.length });
         return;
       }
+
       if (domains.length === 0) {
         console.log("No domains. Connect a registrar: uplink domains providers connect godaddy");
         return;
       }
+
+      const byProvider = new Map<ProviderId, InventoryDomain[]>();
       for (const item of domains) {
-        const expiry = item.expiresAt ? `  expires ${item.expiresAt}` : "";
-        console.log(`- ${item.domain} (${item.provider}${expiry})`);
+        const group = byProvider.get(item.provider) || [];
+        group.push(item);
+        byProvider.set(item.provider, group);
+      }
+      for (const [id, items] of byProvider) {
+        console.log(`${id} (${items.length})`);
+        for (const item of items) {
+          console.log(`  ${item.domain.padEnd(30)} ${inventoryMarker(item, verified?.get(item.domain))}`);
+        }
+        console.log("");
+      }
+      if (!opts.verify && domains.some((item) => !parseExpiry(item.expiresAt))) {
+        console.log("Entries without expiry come from DNS zones / hosted sites and may be lapsed.");
+        console.log("Check actual registration: uplink domains list --verify");
       }
     } catch (error) {
       handleError(error, { json: opts.json });

package/cli/src/utils/domain-availability.ts

@@ -46,6 +46,87 @@ export async function checkDomainAvailability(domain: string): Promise<PublicAva
   return { domain, status: "unknown", source: "rdap", detail: lastFailure };
 }
 
+export type RdapRegistration = {
+  domain: string;
+  /** null = RDAP unreachable / inconclusive. */
+  registered: boolean | null;
+  expiresAt?: string;
+  detail?: string;
+};
+
+/**
+ * IANA RDAP bootstrap: maps a TLD to its authoritative registry RDAP base.
+ * Querying registries directly avoids the rdap.org aggregator's tight rate
+ * limits when verifying many domains.
+ */
+let rdapBootstrap: Map<string, string> | null = null;
+
+async function rdapBaseFor(domain: string): Promise<string> {
+  const tld = domain.slice(domain.lastIndexOf(".") + 1).toLowerCase();
+  if (!rdapBootstrap) {
+    rdapBootstrap = new Map();
+    try {
+      const response = await fetch("https://data.iana.org/rdap/dns.json", {
+        timeout: RDAP_TIMEOUT_MS,
+      });
+      if (response.ok) {
+        const body = (await response.json()) as { services?: Array<[string[], string[]]> };
+        for (const [tlds, urls] of body.services || []) {
+          const url = urls.find((u) => u.startsWith("https://")) || urls[0];
+          if (!url) continue;
+          const base = url.endsWith("/") ? url : `${url}/`;
+          for (const t of tlds) rdapBootstrap.set(t.toLowerCase(), base);
+        }
+      }
+    } catch {
+      // Bootstrap unavailable — fall back to the aggregator for everything.
+    }
+  }
+  const base = rdapBootstrap.get(tld);
+  return base ? `${base}domain/` : "https://rdap.org/domain/";
+}
+
+/**
+ * Authoritative registration lookup via RDAP: is the domain registered at
+ * all, and when does the registration expire? Used to audit inventory
+ * entries whose source (DNS zones, cPanel) says nothing about ownership.
+ */
+export async function rdapRegistration(domain: string): Promise<RdapRegistration> {
+  try {
+    const response = await fetch(`${await rdapBaseFor(domain)}${encodeURIComponent(domain)}`, {
+      headers: { accept: "application/rdap+json" },
+      timeout: RDAP_TIMEOUT_MS,
+    });
+    if (response.status === 404) {
+      // Some registries 404 on rdap.org for registered domains. A domain
+      // that is delegated in public DNS is registered regardless.
+      try {
+        const nameservers = await dns.resolveNs(domain);
+        if (nameservers.length > 0) {
+          return { domain, registered: true, detail: "delegated in DNS (no RDAP record)" };
+        }
+      } catch {
+        // NXDOMAIN — the 404 stands.
+      }
+      return { domain, registered: false, detail: "no registration record" };
+    }
+    if (!response.ok) {
+      return { domain, registered: null, detail: `RDAP returned ${response.status}` };
+    }
+    const body = (await response.json()) as {
+      events?: Array<{ eventAction?: string; eventDate?: string }>;
+    };
+    const expiration = body.events?.find((e) => e.eventAction === "expiration")?.eventDate;
+    return { domain, registered: true, expiresAt: expiration };
+  } catch (error) {
+    return {
+      domain,
+      registered: null,
+      detail: error instanceof Error ? error.message : String(error),
+    };
+  }
+}
+
 export function formatPublicAvailability(result: PublicAvailability): string {
   const lines = [`${result.domain}  ${result.status}  (${result.detail})`];
   if (result.status === "available") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "uplink-cli",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "description": "Software for agents — share localhost, host apps, and attach domains from the terminal. JSON-first CLI for Cursor, Claude, Codex, and Windsurf.",
   "keywords": [
     "ai-agents",