porkbun: registration spends prepaid credit, and balance is pennies - #33
Merged
Conversation
Two corrections, both from reading the full API reference rather than the overview page. `register` claimed it "pays from the account balance, topping up the card on file if that is short". There is no card. `/domain/create` spends **prepaid account credit** and refuses outright when the balance will not cover the price — the overview's "auto top-up on API spend" is an opt-in guardrail on the API settings page, not the default funding path. An account sitting at $0.00 cannot register anything, so short funds is now a stop that names the shortfall rather than a note promising a charge that will never happen. `balance` in the dry-run preview is **pennies as a number** (5000 meaning $50.00), not a rendered string. It was being read with a `typeof === 'string'` guard, so it came back null for every account on every call — the kind of nothing that reads as "the API didn't say" rather than as a bug. The CLI printed `balance: unknown` and would have gone on doing so forever. Also records the three account gates the reference documents and no read endpoint exposes: verified email *and* phone, at least one previous registration, and premium names being website-only at any price. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QLFd9jDQ4D5UpHCWFJi8YM
ThreatCrush Security Scan16 finding(s) HIGH/CRITICAL: 5 | MEDIUM: 2 | LOW: 9
Snippets are redacted; ThreatCrush never prints matched credential material. |
ralyodio
added a commit
that referenced
this pull request
Aug 30, 2026
Eight commits since 0.15.0, one of them a new command, so the minor moves. - sysupdate: apt lists, apt packages and snaps in one command, reachable from the pit as /update (#37) - root-ubuntu.sh: a 2G swapfile on a box with no swap at all, plus vm.swappiness=10 (#36) - root-ubuntu.sh: one ssh-agent per user under systemd (#35) - root-ubuntu.sh: lm-sensors, smartmontools and the rest of the hardware inventory set, with sensor detection on bare metal - companions: diskpush, and installers that are not npm (#34) - porkbun: Porkbun's own pre-flight, structured refusals, and the fact that registration spends prepaid credit rather than a card (#32, #33) Claude-Session: https://claude.ai/code/session_013TerE4nvNU3jvS51nRR6Pd Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two corrections, both found by reading
llms-full.txt(the full API reference) instead of the overview page.There is no card
registertold users it "pays from the account balance, topping up the card on file if that is short." That is wrong./domain/createspends prepaid account credit and refuses outright when the balance won't cover the price:The overview's "auto top-up on API spend" is an opt-in guardrail on the API settings page, not the default funding path. An account at $0.00 cannot register anything, so short funds is now a stop that names the shortfall rather than a note promising a charge that would never happen.
balanceis pennies, as a numberThe dry-run preview returns
"balance": 5000meaning $50.00 — an integer, not a rendered string. It was parsed with atypeof === 'string'guard, so it evaluated tonullfor every account on every call, and the CLI printedbalance: unknownunconditionally. That is the worst shape of bug: it reads as "the API didn't tell us" rather than as something broken, so it would have sat there indefinitely.Now parsed as pennies, with both
balanceCentsand a renderedbalance. The preview also keeps Porkbun's ownmessage, which is worth printing verbatim on a refusal.Documented gates
The three account facts Porkbun requires that no read endpoint exposes are now recorded in the README and
--help: a verified email and phone, at least one registration placed previously, and the name not being premium (premium is website-only at any price).Testing
balanceas pennies specifically.src/free-names.ts:80,89is still red on master from free-names: generating and checking as one command #30/0.15.0: restore the version free-names rolled backwards #31 — untouched here, still happy to fix separately.Why this surfaced
Registering diskpush.com is blocked on
VERIFICATION_REQUIRED, so the pre-flight path had never actually run to completion against a live account — which is exactly how a null-for-everyone parse and a wrong sentence about billing both survived review.🤖 Generated with Claude Code
https://claude.ai/code/session_01QLFd9jDQ4D5UpHCWFJi8YM