@aoxborrow/registrar-client 0.10.1 → 0.12.0

package/README.md

@@ -187,6 +187,9 @@ are the guaranteed contract; **extended** methods are opt-in per provider.
 | Extended method       | CF  | DY  | GA  | GD  | NB  | NC  | NS  | PB  | SP  | NM  | 101 |
 | --------------------- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
 | `getAuthCode`         | ✗   | ✓   | ✓   | ✓   | ✓   | ✗ⁱ  | ✗ⁱ  | ✗   | ✓   | ✓   | ✗   |
+| `getTransferOut`      | ✗   | ✓ⁿ  | ✓ⁿ  | ✓ⁿ  | ✗   | ✗   | ✗   | ✗   | ✗   | ✗   | ✗   |
+| `approveTransferOut`  | ✗   | ✓ⁿ  | ✓ⁿ  | ✓ⁿ  | ✗   | ✗   | ✗   | ✗   | ✗   | ✗   | ✗   |
+| `rejectTransferOut`   | ✗   | ✓ⁿ  | ✓ⁿ  | ✓ⁿ  | ✗   | ✗   | ✗   | ✗   | ✗   | ✗ⁿ  | ✗   |
 | `getDnssec`           | ✗   | ✓   | ✓   | ✗   | ✗   | ✗   | ✓   | ✓   | ✗   | ✗ᵐ  | ✗   |
 | `disableDnssec`       | ✗   | ✓   | ✓   | ✗   | ✗   | ✗   | ✓   | ✓   | ✗   | ✗ᵐ  | ✗   |
 | `getEmailForwarding`  | ✓   | ✓   | ✓   | ✗   | ✗   | ✓   | ✓   | ✗   | ✗   | ✗ᵐ  | ✗   |
@@ -232,6 +235,16 @@ not a claim of available API endpoints. See [101domain](docs/registrars/101domai
 - **ʲ** Dynadot and NameSilo forward the whole domain (a single `@` rule);
   clearing a forward restores the default nameservers.
 - **ᵏ** Gandi web redirects are per host, apex included; creating one replaces the host's DNS record.
+- **ⁿ** Transfer-out approval answers a transfer another registrar requested with
+  the auth code. Dynadot's is sandbox-verified only up to "no such order" (its
+  sandbox can't start an outbound transfer); a real pending one's read was
+  checked in production. GoDaddy's uses the v2 customer-scoped API, so it needs a
+  `customerId` as forwarding does (ˡ); it reads the domain's recent actions, with
+  no expiry date. Gandi has no transfer-out to read: a `pendingTransfer` status
+  reads as pending, with no dates, and approving sends the current auth code
+  back. Neither has been tried on a real transfer yet. Name.com can only reject
+  (not wired up); the rest leave it to the dashboard or the transfer email, and
+  release the domain after about 5 days. See each registrar's doc.
 - **ˡ** GoDaddy domain forwarding uses the v2 customer-scoped API, so it requires
   a `customerId` (the customer UUID, or a numeric shopper ID the client resolves to
   the UUID via an sso-key-only lookup); the old v1 forwarding route was removed.
@@ -335,6 +348,19 @@ the registrant); Namecheap requires all four roles; Dynadot and Porkbun use the
 account's default WHOIS contact. Transfers carry over the existing contacts, so
 most providers need only the auth code (`TransferDomainInput`).
 
+Going the other way, a sold or departing name leaves with its auth code
+(`getAuthCode`). When the buyer's registrar requests it, the losing registrar
+holds the transfer for a few days unless the owner answers it; where the API
+allows, `getTransferOut` reads that request and `approveTransferOut` /
+`rejectTransferOut` answer it:
+
+```ts
+if (provider.supports(Feature.GetTransferOut)) {
+  const transfer = await provider.getTransferOut('example.com'); // null if none
+  if (transfer?.status === 'pending') await provider.approveTransferOut('example.com');
+}
+```
+
 > `registerDomain` is implemented for **every bundled provider**, and `transferIn`
 > for every one whose API has a transfer endpoint (all except **Cloudflare** and
 > **NameBright**). `registerDomain` has been exercised live against several

package/dist/index.cjs

@@ -685,6 +685,12 @@ var Feature = {
   // --- extended (opt-in; declared per provider) ---
   GetAuthCode: "getAuthCode",
   // retrieve transfer auth/EPP code (transfer out)
+  GetTransferOut: "getTransferOut",
+  // read an outbound transfer another registrar requested
+  ApproveTransferOut: "approveTransferOut",
+  // release a pending outbound transfer now
+  RejectTransferOut: "rejectTransferOut",
+  // refuse a pending outbound transfer
   GetDnssec: "getDnssec",
   // read whether DNSSEC is enabled (DS / key records)
   DisableDnssec: "disableDnssec",
@@ -720,6 +726,9 @@ var CORE_FEATURES = [
 ];
 var EXTENDED_FEATURES = [
   Feature.GetAuthCode,
+  Feature.GetTransferOut,
+  Feature.ApproveTransferOut,
+  Feature.RejectTransferOut,
   Feature.GetDnssec,
   Feature.DisableDnssec,
   Feature.GetEmailForwarding,
@@ -752,6 +761,9 @@ var FEATURE_CALLS = {
   getDnsRecords: { intent: "read", optsIndex: 1 },
   setDnsRecords: { intent: "write", optsIndex: 2 },
   getAuthCode: { intent: "write", optsIndex: 1 },
+  getTransferOut: { intent: "read", optsIndex: 1 },
+  approveTransferOut: { intent: "write", optsIndex: 1 },
+  rejectTransferOut: { intent: "write", optsIndex: 1 },
   getDnssec: { intent: "read", optsIndex: 1 },
   disableDnssec: { intent: "write", optsIndex: 1 },
   getEmailForwarding: { intent: "read", optsIndex: 1 },
@@ -913,6 +925,15 @@ var BaseRegistrar = class {
   getAuthCode(_domainName, _opts) {
     return this.notImplemented("getAuthCode");
   }
+  getTransferOut(_domainName, _opts) {
+    return this.notImplemented("getTransferOut");
+  }
+  approveTransferOut(_domainName, _opts) {
+    return this.notImplemented("approveTransferOut");
+  }
+  rejectTransferOut(_domainName, _opts) {
+    return this.notImplemented("rejectTransferOut");
+  }
   getDnssec(_domainName, _opts) {
     return this.notImplemented("getDnssec");
   }
@@ -2333,11 +2354,16 @@ var DynadotRegistrar = class extends BaseRegistrar {
   ];
   static supportsSandbox = true;
   // api-sandbox.dynadot.com mirrors the API
-  // On top of core: transfer-out auth code, DNSSEC read/disable, and email +
-  // domain (URL) forwarding. All implemented on the v2 transport and verified in
-  // the Dynadot sandbox.
+  // On top of core: transfer-out auth code and approval, DNSSEC read/disable,
+  // and email + domain (URL) forwarding. All implemented on the v2 transport and
+  // verified in the Dynadot sandbox (transfer-out approval only up to "no such
+  // order": the sandbox can't create an outbound transfer; a real pending
+  // one's read was checked in production).
   static extendedFeatures = [
     Feature.GetAuthCode,
+    Feature.GetTransferOut,
+    Feature.ApproveTransferOut,
+    Feature.RejectTransferOut,
     Feature.GetDnssec,
     Feature.DisableDnssec,
     Feature.GetEmailForwarding,
@@ -2808,6 +2834,64 @@ ${bodyStr}`;
     );
     return data.auth_code ?? "";
   }
+  /**
+   * The domain's latest outbound transfer via GET .../transfer_status with
+   * `transfer_type=transfer_away`, which lists its transfer-away orders. Dynadot
+   * answers 404 when there are none (and for a domain not in the account), read
+   * here as null. An open order wins over a newer finished one, so approve and
+   * reject act on the order that can still be answered.
+   */
+  async getTransferOut(domainName, opts) {
+    let env;
+    try {
+      env = await this.signedRequest(
+        "GET",
+        `/restful/v2/domains/${encodeURIComponent(domainName)}/transfer_status?transfer_type=transfer_away`,
+        void 0,
+        opts
+      );
+    } catch (error) {
+      if (error instanceof NotFoundError) return null;
+      throw error;
+    }
+    if (env.code === 404) return null;
+    if (!isOk(env.code)) {
+      throw new Error(env.error?.description ?? env.message ?? "Dynadot request failed");
+    }
+    const transfers = (env.data?.domain_transfer_status_list ?? []).map(toTransferOut).sort((a, b) => (b.requestedDate?.getTime() ?? 0) - (a.requestedDate?.getTime() ?? 0));
+    return transfers.find((t) => OPEN_TRANSFER_OUT.has(t.status)) ?? transfers[0] ?? null;
+  }
+  /**
+   * Approves the pending outbound transfer, releasing the domain now instead of
+   * after Dynadot's 5-day wait. Answers the order `getTransferOut` reports.
+   */
+  async approveTransferOut(domainName, opts) {
+    return this.authorizeTransferAway(domainName, true, opts);
+  }
+  // Denies the pending outbound transfer; the domain stays in the account.
+  async rejectTransferOut(domainName, opts) {
+    return this.authorizeTransferAway(domainName, false, opts);
+  }
+  // POST /orders/{order_id}/authorize_transfer_away with `approve` true or
+  // false. Dynadot answers 409 when the order is no longer waiting on the owner.
+  async authorizeTransferAway(domainName, approve, opts) {
+    let transfer;
+    try {
+      transfer = await this.getTransferOut(domainName, opts);
+    } catch (error) {
+      return { success: false, message: toRegistrarError(error).message };
+    }
+    if (!transfer?.id) {
+      return { success: false, message: `No transfer-out of ${domainName} to answer` };
+    }
+    return this.mutate(
+      "POST",
+      `/restful/v2/orders/${encodeURIComponent(transfer.id)}/authorize_transfer_away`,
+      { domain_name: domainName, approve },
+      `Transfer of ${domainName} ${approve ? "approved" : "rejected"}`,
+      opts
+    );
+  }
   /**
    * DNSSEC status via GET .../dnssec, which returns a list of DS records
    * (`dnssec_info_list`); a non-empty list means DNSSEC is enabled. `algorithm`
@@ -2956,6 +3040,32 @@ async function hmacSha256Base64(secret, message) {
   for (const byte of new Uint8Array(signature)) binary += String.fromCharCode(byte);
   return btoa(binary);
 }
+var OPEN_TRANSFER_OUT = /* @__PURE__ */ new Set(["pending", "unknown"]);
+function toTransferOut(t) {
+  const rawStatus = t.transfer_status ?? "";
+  let status = transferOutStatus(rawStatus);
+  if (status === "unknown" && msDate(t.order_completed_date)) status = "completed";
+  return {
+    status,
+    rawStatus,
+    id: str(t.order_id) || void 0,
+    requestedDate: msDate(t.order_created_date),
+    expirationDate: msDate(t.expiration_date),
+    completedDate: msDate(t.order_completed_date)
+  };
+}
+function transferOutStatus(label) {
+  const s = label.toLowerCase();
+  if (/den(y|ied)|reject|refus|not approved|nack/.test(s)) return "rejected";
+  if (/cancel|fail|expire|time ?out|abort/.test(s)) return "cancelled";
+  if (/complete|transferr?ed|success/.test(s)) return "completed";
+  if (/pend|wait|await|need|request|none|new|process|hold|review/.test(s)) return "pending";
+  if (/approv|authori[sz]|accept/.test(s)) return "approved";
+  return "unknown";
+}
+function msDate(ms) {
+  return typeof ms === "number" && ms > 0 ? new Date(ms) : null;
+}
 function isOk(code) {
   return code != null && code >= 200 && code < 300;
 }
@@ -3102,9 +3212,9 @@ var GandiRegistrar = class extends BaseRegistrar {
   ];
   // Gandi's v5 API offers a sandbox at api.sandbox.gandi.net (separate account)
   static supportsSandbox = true;
-  // On top of core: transfer-out auth code (`authinfo`), DNSSEC read/disable
-  // (LiveDNS keys), email forwarding, and web/URL forwarding (webredirs;
-  // per host, apex included). Note core `setPrivacy` disabling is a no-op for
+  // On top of core: transfer-out auth code (`authinfo`) and approval, DNSSEC
+  // read/disable (LiveDNS keys), email forwarding, and web/URL forwarding
+  // (webredirs; per host, apex included). Note core `setPrivacy` disabling is a no-op for
   // individual (natural-person) registrants — Gandi keeps WHOIS obfuscation on
   // for GDPR regardless of the request.
   static extendedFeatures = [
@@ -3114,7 +3224,10 @@ var GandiRegistrar = class extends BaseRegistrar {
     Feature.GetEmailForwarding,
     Feature.SetEmailForwarding,
     Feature.GetDomainForwarding,
-    Feature.SetDomainForwarding
+    Feature.SetDomainForwarding,
+    Feature.GetTransferOut,
+    Feature.ApproveTransferOut,
+    Feature.RejectTransferOut
   ];
   constructor(credentials, options) {
     super(
@@ -3366,6 +3479,58 @@ var GandiRegistrar = class extends BaseRegistrar {
     });
     return d.authinfo ?? "";
   }
+  /**
+   * The domain's pending outbound transfer. Gandi has no transfer-out resource
+   * to read: a domain in the account carries the documented `pendingTransfer`
+   * EPP status while another registrar's request waits (inbound transfers live
+   * under /domain/transferin, so on a domain you hold it's outbound — inferred,
+   * not documented). Gandi reports no dates for it, and nothing once it's
+   * answered or done, so this reads `pending` or null.
+   */
+  async getTransferOut(domainName, opts) {
+    const d = await this.http.request({
+      path: `/domain/domains/${domainName}`,
+      ...opts
+    });
+    return pendingTransferOut(d);
+  }
+  /**
+   * Approves the pending outbound transfer, releasing the domain now instead of
+   * after Gandi's five days: POST .../transferout with `accept: true` and the
+   * domain's current auth code, which Gandi requires back (→ 202).
+   */
+  async approveTransferOut(domainName, opts) {
+    return this.answerTransferOut(domainName, true, opts);
+  }
+  // Declines the pending outbound transfer (`accept: false`, no reason); the
+  // domain stays in the account.
+  async rejectTransferOut(domainName, opts) {
+    return this.answerTransferOut(domainName, false, opts);
+  }
+  // One read for both the pending status and the auth code the answer needs.
+  async answerTransferOut(domainName, accept, opts) {
+    let d;
+    try {
+      d = await this.http.request({
+        path: `/domain/domains/${domainName}`,
+        ...opts
+      });
+    } catch (error) {
+      return { success: false, message: toRegistrarError(error).message };
+    }
+    if (!pendingTransferOut(d)) {
+      return { success: false, message: `No transfer-out of ${domainName} to answer` };
+    }
+    return this.mutate(
+      {
+        method: "POST",
+        path: `/domain/domains/${domainName}/transferout`,
+        body: { accept, authinfo: d.authinfo ?? "" }
+      },
+      `Transfer of ${domainName} ${accept ? "approved" : "rejected"}`,
+      opts
+    );
+  }
   /**
    * DNSSEC status via Gandi LiveDNS keys (GET /livedns/domains/{fqdn}/keys). A
    * non-deleted key means DNSSEC is enabled; each key's `ds` field is the full DS
@@ -3733,6 +3898,17 @@ var GandiRegistrar = class extends BaseRegistrar {
     }
   }
 };
+function pendingTransferOut(d) {
+  const statuses = Array.isArray(d.status) ? d.status : d.status ? [d.status] : [];
+  if (!statuses.includes("pendingTransfer")) return null;
+  return {
+    status: "pending",
+    rawStatus: "pendingTransfer",
+    requestedDate: null,
+    expirationDate: null,
+    completedDate: null
+  };
+}
 function toGandiContact(c) {
   const contact = {
     given: c.firstName,
@@ -3873,17 +4049,22 @@ var GoDaddyRegistrar = class _GoDaddyRegistrar extends BaseRegistrar {
   ];
   // GoDaddy's OTE ("Operational Test Environment") is its sandbox
   static supportsSandbox = true;
-  // Beyond core: domain forwarding and transfer-out auth code (the `authCode`
-  // field on the v1 domain-detail response). Forwarding uses the v2
-  // customer-scoped route /v2/customers/{customerId}/domains/forwards/{fqdn}
-  // (the old v1 /v1/domains/forwards routes now 404); it requires `customerId`
-  // to be configured — verified live 2026-08-29. DNSSEC has no dedicated
+  // Beyond core: domain forwarding, transfer-out auth code (the `authCode`
+  // field on the v1 domain-detail response) and transfer-out approval.
+  // Forwarding uses the v2 customer-scoped route
+  // /v2/customers/{customerId}/domains/forwards/{fqdn} (the old v1
+  // /v1/domains/forwards routes now 404); it requires `customerId` to be
+  // configured — verified live 2026-08-29. Transfer-out approval is v2
+  // customer-scoped too, so it needs `customerId` as well. DNSSEC has no dedicated
   // endpoint (DS records go through the generic DNS API), and there's no
   // glue-record, email, or push-webhook API.
   static extendedFeatures = [
     Feature.GetAuthCode,
     Feature.GetDomainForwarding,
-    Feature.SetDomainForwarding
+    Feature.SetDomainForwarding,
+    Feature.GetTransferOut,
+    Feature.ApproveTransferOut,
+    Feature.RejectTransferOut
   ];
   // true → prefer the v3 API (production + PAT). false → all calls use v1
   // (sso-key auth, or OTE/sandbox where v3 does not exist).
@@ -4484,7 +4665,7 @@ var GoDaddyRegistrar = class _GoDaddyRegistrar extends BaseRegistrar {
     const configured = this.credentials.customerId?.trim();
     if (!configured) {
       throw new ConfigurationError(
-        `${this.name}: domain forwarding uses the v2 customer-scoped API, which requires a customer ID. Set \`customerId\` to your GoDaddy customer UUID (or your numeric shopper/account ID, which will be resolved to the UUID).`
+        `${this.name}: domain forwarding and transfer-out approval use the v2 customer-scoped API, which requires a customer ID. Set \`customerId\` to your GoDaddy customer UUID (or your numeric shopper/account ID, which will be resolved to the UUID).`
       );
     }
     if (UUID_RE.test(configured)) return configured;
@@ -4584,6 +4765,52 @@ var GoDaddyRegistrar = class _GoDaddyRegistrar extends BaseRegistrar {
   forwardPath(customerId, fqdn) {
     return `/v2/customers/${encodeURIComponent(customerId)}/domains/forwards/${encodeURIComponent(fqdn)}`;
   }
+  // the v2 customer-scoped path for a domain
+  domainPathV2(customerId, domainName) {
+    return `/v2/customers/${encodeURIComponent(customerId)}/domains/${encodeURIComponent(domainName)}`;
+  }
+  /**
+   * The domain's latest outbound transfer, read from its recent actions
+   * (GET /v2/customers/{customerId}/domains/{domain}/actions): the TRANSFER_OUT
+   * action, and an accept or reject logged after it. Null when there is no
+   * TRANSFER_OUT on record. GoDaddy reports no expiry; left alone, it releases
+   * the domain within seven days. Shapes from the published v2 spec; a real
+   * transfer-out is not yet seen live.
+   */
+  async getTransferOut(domainName, opts) {
+    const customerId = await this.resolveCustomerId(opts);
+    const actions = await this.http.request({
+      path: `${this.domainPathV2(customerId, domainName)}/actions`,
+      ...opts
+    });
+    return toTransferOut2(Array.isArray(actions) ? actions : []);
+  }
+  /**
+   * Approves the pending outbound transfer, releasing the domain now
+   * (POST .../transferOutAccept → 202). GoDaddy answers 409 when none is
+   * pending.
+   */
+  async approveTransferOut(domainName, opts) {
+    return this.answerTransferOut(domainName, "transferOutAccept", "approved", opts);
+  }
+  // Rejects the pending outbound transfer (POST .../transferOutReject, with no
+  // reason); the domain stays in the account.
+  async rejectTransferOut(domainName, opts) {
+    return this.answerTransferOut(domainName, "transferOutReject", "rejected", opts);
+  }
+  async answerTransferOut(domainName, action, answer, opts) {
+    let customerId;
+    try {
+      customerId = await this.resolveCustomerId(opts);
+    } catch (error) {
+      return { success: false, message: toRegistrarError(error).message };
+    }
+    return this.mutate(
+      { method: "POST", path: `${this.domainPathV2(customerId, domainName)}/${action}` },
+      `Transfer of ${domainName} ${answer}`,
+      opts
+    );
+  }
   /**
    * Transfer authorization (EPP) code. GoDaddy exposes it as the `authCode`
    * field on the v1 domain-detail response; transfers were never moved to v3,
@@ -4640,6 +4867,41 @@ var GoDaddyRegistrar = class _GoDaddyRegistrar extends BaseRegistrar {
     }
   }
 };
+function toTransferOut2(actions) {
+  const time = (a) => parseDate(a.createdAt)?.getTime() ?? 0;
+  const byLatest = (types) => actions.filter((a) => types.includes(a.type ?? "")).sort((a, b) => time(b) - time(a));
+  const transfer = byLatest(["TRANSFER_OUT"])[0];
+  if (!transfer) return null;
+  const answer = byLatest(["TRANSFER_OUT_ACCEPT", "TRANSFER_OUT_REJECT"]).find(
+    (a) => time(a) >= time(transfer) && !/^(FAILED|CANCELLED)$/i.test(a.status ?? "")
+  );
+  const rejected = answer?.type === "TRANSFER_OUT_REJECT";
+  const rawStatus = transfer.status ?? "";
+  let status;
+  switch (rawStatus.toUpperCase()) {
+    case "ACCEPTED":
+    case "AWAITING":
+    case "PENDING":
+      status = !answer ? "pending" : rejected ? "rejected" : "approved";
+      break;
+    case "SUCCESS":
+      status = "completed";
+      break;
+    case "FAILED":
+    case "CANCELLED":
+      status = rejected ? "rejected" : "cancelled";
+      break;
+    default:
+      status = "unknown";
+  }
+  return {
+    status,
+    rawStatus,
+    requestedDate: parseDate(transfer.createdAt),
+    expirationDate: null,
+    completedDate: status === "completed" ? parseDate(transfer.completedAt) : null
+  };
+}
 function fromGoDaddyContact(c) {
   if (!c) return void 0;
   const a = c.addressMailing ?? {};