@aoxborrow/registrar-client 0.10.1 → 0.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aoxborrow/registrar-client",
-  "version": "0.10.1",
+  "version": "0.12.0",
   "description": "One consistent, fully-typed TypeScript interface to many domain registrar APIs (GoDaddy, Cloudflare, Namecheap, Spaceship, Dynadot, Porkbun, and more) behind a single pluggable multi-provider client",
   "author": {
     "name": "Aaron Oxborrow",

package/src/features.ts

@@ -48,6 +48,9 @@ export const Feature = {
 
   // --- extended (opt-in; declared per provider) ---
   GetAuthCode: 'getAuthCode', // retrieve transfer auth/EPP code (transfer out)
+  GetTransferOut: 'getTransferOut', // read an outbound transfer another registrar requested
+  ApproveTransferOut: 'approveTransferOut', // release a pending outbound transfer now
+  RejectTransferOut: 'rejectTransferOut', // refuse a pending outbound transfer
   GetDnssec: 'getDnssec', // read whether DNSSEC is enabled (DS / key records)
   DisableDnssec: 'disableDnssec', // turn DNSSEC off (no enable / key management)
   GetEmailForwarding: 'getEmailForwarding', // read alias-style email forwarding rules
@@ -85,6 +88,9 @@ export const CORE_FEATURES = [
 // of these via its static `extendedFeatures`.
 export const EXTENDED_FEATURES = [
   Feature.GetAuthCode,
+  Feature.GetTransferOut,
+  Feature.ApproveTransferOut,
+  Feature.RejectTransferOut,
   Feature.GetDnssec,
   Feature.DisableDnssec,
   Feature.GetEmailForwarding,
@@ -137,6 +143,9 @@ export const FEATURE_CALLS: Record<
   getDnsRecords: { intent: 'read', optsIndex: 1 },
   setDnsRecords: { intent: 'write', optsIndex: 2 },
   getAuthCode: { intent: 'write', optsIndex: 1 },
+  getTransferOut: { intent: 'read', optsIndex: 1 },
+  approveTransferOut: { intent: 'write', optsIndex: 1 },
+  rejectTransferOut: { intent: 'write', optsIndex: 1 },
   getDnssec: { intent: 'read', optsIndex: 1 },
   disableDnssec: { intent: 'write', optsIndex: 1 },
   getEmailForwarding: { intent: 'read', optsIndex: 1 },

package/src/registrar.ts

@@ -23,6 +23,7 @@ import type {
   RequestOptions,
   TldPricing,
   TransferDomainInput,
+  TransferOut,
 } from './types';
 
 // pick the base URL for the requested environment. Throws if `sandbox` is
@@ -276,6 +277,18 @@ export abstract class BaseRegistrar implements Registrar {
     return this.notImplemented('getAuthCode');
   }
 
+  getTransferOut(_domainName: string, _opts?: RequestOptions): Promise<TransferOut | null> {
+    return this.notImplemented('getTransferOut');
+  }
+
+  approveTransferOut(_domainName: string, _opts?: RequestOptions): Promise<OperationResult> {
+    return this.notImplemented('approveTransferOut');
+  }
+
+  rejectTransferOut(_domainName: string, _opts?: RequestOptions): Promise<OperationResult> {
+    return this.notImplemented('rejectTransferOut');
+  }
+
   getDnssec(_domainName: string, _opts?: RequestOptions): Promise<DnssecStatus> {
     return this.notImplemented('getDnssec');
   }

package/src/registrars/dynadot.ts

@@ -16,6 +16,8 @@ import type {
   RequestOptions,
   TldPricing,
   TransferDomainInput,
+  TransferOut,
+  TransferOutStatus,
 } from '../types';
 import { REST_SAFE_METHODS } from '../http';
 import { createDomain, filterDomains, requireConsent, settableForwards } from '../utils';
@@ -79,6 +81,19 @@ interface V2DnssecInfo {
   digest?: string;
 }
 
+// one order from GET .../transfer_status. `transfer_status` is a display label
+// ("None", "Pre Sale Domain", …), and unset dates read back as -1. A
+// transfer-away order waiting on the owner reads "None", with no
+// expiration_date (production, 2026-10-31).
+interface V2TransferStatus {
+  order_id?: string | number;
+  transfer_status?: string;
+  failed_reason?: string;
+  expiration_date?: number;
+  order_created_date?: number;
+  order_completed_date?: number;
+}
+
 // Dynadot's default nameservers, used to switch a domain off URL forwarding
 // (there is no dedicated "clear forwarding" endpoint).
 const DYNADOT_DEFAULT_NS = ['ns1.dynadot.com', 'ns2.dynadot.com'];
@@ -193,11 +208,16 @@ export class DynadotRegistrar extends BaseRegistrar {
     { name: 'apiSecret', label: 'API Secret', type: 'password', required: true },
   ];
   static readonly supportsSandbox = true; // api-sandbox.dynadot.com mirrors the API
-  // On top of core: transfer-out auth code, DNSSEC read/disable, and email +
-  // domain (URL) forwarding. All implemented on the v2 transport and verified in
-  // the Dynadot sandbox.
+  // On top of core: transfer-out auth code and approval, DNSSEC read/disable,
+  // and email + domain (URL) forwarding. All implemented on the v2 transport and
+  // verified in the Dynadot sandbox (transfer-out approval only up to "no such
+  // order": the sandbox can't create an outbound transfer; a real pending
+  // one's read was checked in production).
   static readonly extendedFeatures: readonly RegistrarFeature[] = [
     Feature.GetAuthCode,
+    Feature.GetTransferOut,
+    Feature.ApproveTransferOut,
+    Feature.RejectTransferOut,
     Feature.GetDnssec,
     Feature.DisableDnssec,
     Feature.GetEmailForwarding,
@@ -781,6 +801,83 @@ export class DynadotRegistrar extends BaseRegistrar {
     return data.auth_code ?? '';
   }
 
+  /**
+   * The domain's latest outbound transfer via GET .../transfer_status with
+   * `transfer_type=transfer_away`, which lists its transfer-away orders. Dynadot
+   * answers 404 when there are none (and for a domain not in the account), read
+   * here as null. An open order wins over a newer finished one, so approve and
+   * reject act on the order that can still be answered.
+   */
+  override async getTransferOut(
+    domainName: string,
+    opts?: RequestOptions
+  ): Promise<TransferOut | null> {
+    let env: V2Envelope<{ domain_transfer_status_list?: V2TransferStatus[] }>;
+    try {
+      env = await this.signedRequest(
+        'GET',
+        `/restful/v2/domains/${encodeURIComponent(domainName)}/transfer_status?transfer_type=transfer_away`,
+        undefined,
+        opts
+      );
+    } catch (error) {
+      if (error instanceof NotFoundError) return null;
+      throw error;
+    }
+    if (env.code === 404) return null;
+    if (!isOk(env.code)) {
+      throw new Error(env.error?.description ?? env.message ?? 'Dynadot request failed');
+    }
+    const transfers = (env.data?.domain_transfer_status_list ?? [])
+      .map(toTransferOut)
+      .sort((a, b) => (b.requestedDate?.getTime() ?? 0) - (a.requestedDate?.getTime() ?? 0));
+    return transfers.find(t => OPEN_TRANSFER_OUT.has(t.status)) ?? transfers[0] ?? null;
+  }
+
+  /**
+   * Approves the pending outbound transfer, releasing the domain now instead of
+   * after Dynadot's 5-day wait. Answers the order `getTransferOut` reports.
+   */
+  override async approveTransferOut(
+    domainName: string,
+    opts?: RequestOptions
+  ): Promise<OperationResult> {
+    return this.authorizeTransferAway(domainName, true, opts);
+  }
+
+  // Denies the pending outbound transfer; the domain stays in the account.
+  override async rejectTransferOut(
+    domainName: string,
+    opts?: RequestOptions
+  ): Promise<OperationResult> {
+    return this.authorizeTransferAway(domainName, false, opts);
+  }
+
+  // POST /orders/{order_id}/authorize_transfer_away with `approve` true or
+  // false. Dynadot answers 409 when the order is no longer waiting on the owner.
+  private async authorizeTransferAway(
+    domainName: string,
+    approve: boolean,
+    opts?: RequestOptions
+  ): Promise<OperationResult> {
+    let transfer: TransferOut | null;
+    try {
+      transfer = await this.getTransferOut(domainName, opts);
+    } catch (error) {
+      return { success: false, message: toRegistrarError(error).message };
+    }
+    if (!transfer?.id) {
+      return { success: false, message: `No transfer-out of ${domainName} to answer` };
+    }
+    return this.mutate(
+      'POST',
+      `/restful/v2/orders/${encodeURIComponent(transfer.id)}/authorize_transfer_away`,
+      { domain_name: domainName, approve },
+      `Transfer of ${domainName} ${approve ? 'approved' : 'rejected'}`,
+      opts
+    );
+  }
+
   /**
    * DNSSEC status via GET .../dnssec, which returns a list of DS records
    * (`dnssec_info_list`); a non-empty list means DNSSEC is enabled. `algorithm`
@@ -962,6 +1059,43 @@ async function hmacSha256Base64(secret: string, message: string): Promise<string
 
 // --- mapping helpers ---
 
+// transfer-out states that can still be approved or rejected
+const OPEN_TRANSFER_OUT: ReadonlySet<TransferOutStatus> = new Set(['pending', 'unknown']);
+
+// map a transfer-away order to the normalized TransferOut shape
+function toTransferOut(t: V2TransferStatus): TransferOut {
+  const rawStatus = t.transfer_status ?? '';
+  let status = transferOutStatus(rawStatus);
+  if (status === 'unknown' && msDate(t.order_completed_date)) status = 'completed';
+  return {
+    status,
+    rawStatus,
+    id: str(t.order_id) || undefined,
+    requestedDate: msDate(t.order_created_date),
+    expirationDate: msDate(t.expiration_date),
+    completedDate: msDate(t.order_completed_date),
+  };
+}
+
+// Dynadot documents its transfer statuses only as display labels, and none for
+// transfer-away; a waiting one reads "None", the rest are unseen. So match on
+// words. Negatives first: "Not Approved" is a rejection, and pending before
+// approved: "Waiting For Approval" still waits.
+function transferOutStatus(label: string): TransferOutStatus {
+  const s = label.toLowerCase();
+  if (/den(y|ied)|reject|refus|not approved|nack/.test(s)) return 'rejected';
+  if (/cancel|fail|expire|time ?out|abort/.test(s)) return 'cancelled';
+  if (/complete|transferr?ed|success/.test(s)) return 'completed';
+  if (/pend|wait|await|need|request|none|new|process|hold|review/.test(s)) return 'pending';
+  if (/approv|authori[sz]|accept/.test(s)) return 'approved';
+  return 'unknown';
+}
+
+// a Unix-millisecond date, or null for Dynadot's unset (-1 / 0 / missing)
+function msDate(ms: number | undefined): Date | null {
+  return typeof ms === 'number' && ms > 0 ? new Date(ms) : null;
+}
+
 // whether a v2 envelope `code` (which mirrors the HTTP status) is a success —
 // 2xx, so it covers 200 and transfer_in's 202 Accepted
 function isOk(code: number | undefined): boolean {

package/src/registrars/gandi.ts

@@ -19,6 +19,7 @@ import type {
   RequestOptions,
   TldPricing,
   TransferDomainInput,
+  TransferOut,
 } from '../types';
 import { REST_SAFE_METHODS } from '../http';
 import {
@@ -78,6 +79,8 @@ interface GandiDomain {
   contacts?: GandiContacts;
   nameserver?: { current?: string; hosts?: string[] };
   nameservers?: string[];
+  // the transfer auth code (detail endpoint only)
+  authinfo?: string;
 }
 
 // one record set from `GET /v5/livedns/domains/{fqdn}/records`; a set can hold
@@ -192,9 +195,9 @@ export class GandiRegistrar extends BaseRegistrar {
   ];
   // Gandi's v5 API offers a sandbox at api.sandbox.gandi.net (separate account)
   static readonly supportsSandbox = true;
-  // On top of core: transfer-out auth code (`authinfo`), DNSSEC read/disable
-  // (LiveDNS keys), email forwarding, and web/URL forwarding (webredirs;
-  // per host, apex included). Note core `setPrivacy` disabling is a no-op for
+  // On top of core: transfer-out auth code (`authinfo`) and approval, DNSSEC
+  // read/disable (LiveDNS keys), email forwarding, and web/URL forwarding
+  // (webredirs; per host, apex included). Note core `setPrivacy` disabling is a no-op for
   // individual (natural-person) registrants — Gandi keeps WHOIS obfuscation on
   // for GDPR regardless of the request.
   static readonly extendedFeatures: readonly RegistrarFeature[] = [
@@ -205,6 +208,9 @@ export class GandiRegistrar extends BaseRegistrar {
     Feature.SetEmailForwarding,
     Feature.GetDomainForwarding,
     Feature.SetDomainForwarding,
+    Feature.GetTransferOut,
+    Feature.ApproveTransferOut,
+    Feature.RejectTransferOut,
   ];
 
   constructor(credentials: RegistrarCredentials, options?: RegistrarOptions) {
@@ -500,6 +506,75 @@ export class GandiRegistrar extends BaseRegistrar {
     return d.authinfo ?? '';
   }
 
+  /**
+   * The domain's pending outbound transfer. Gandi has no transfer-out resource
+   * to read: a domain in the account carries the documented `pendingTransfer`
+   * EPP status while another registrar's request waits (inbound transfers live
+   * under /domain/transferin, so on a domain you hold it's outbound — inferred,
+   * not documented). Gandi reports no dates for it, and nothing once it's
+   * answered or done, so this reads `pending` or null.
+   */
+  override async getTransferOut(
+    domainName: string,
+    opts?: RequestOptions
+  ): Promise<TransferOut | null> {
+    const d = await this.http.request<GandiDomain>({
+      path: `/domain/domains/${domainName}`,
+      ...opts,
+    });
+    return pendingTransferOut(d);
+  }
+
+  /**
+   * Approves the pending outbound transfer, releasing the domain now instead of
+   * after Gandi's five days: POST .../transferout with `accept: true` and the
+   * domain's current auth code, which Gandi requires back (→ 202).
+   */
+  override async approveTransferOut(
+    domainName: string,
+    opts?: RequestOptions
+  ): Promise<OperationResult> {
+    return this.answerTransferOut(domainName, true, opts);
+  }
+
+  // Declines the pending outbound transfer (`accept: false`, no reason); the
+  // domain stays in the account.
+  override async rejectTransferOut(
+    domainName: string,
+    opts?: RequestOptions
+  ): Promise<OperationResult> {
+    return this.answerTransferOut(domainName, false, opts);
+  }
+
+  // One read for both the pending status and the auth code the answer needs.
+  private async answerTransferOut(
+    domainName: string,
+    accept: boolean,
+    opts?: RequestOptions
+  ): Promise<OperationResult> {
+    let d: GandiDomain;
+    try {
+      d = await this.http.request<GandiDomain>({
+        path: `/domain/domains/${domainName}`,
+        ...opts,
+      });
+    } catch (error) {
+      return { success: false, message: toRegistrarError(error).message };
+    }
+    if (!pendingTransferOut(d)) {
+      return { success: false, message: `No transfer-out of ${domainName} to answer` };
+    }
+    return this.mutate(
+      {
+        method: 'POST',
+        path: `/domain/domains/${domainName}/transferout`,
+        body: { accept, authinfo: d.authinfo ?? '' },
+      },
+      `Transfer of ${domainName} ${accept ? 'approved' : 'rejected'}`,
+      opts
+    );
+  }
+
   /**
    * DNSSEC status via Gandi LiveDNS keys (GET /livedns/domains/{fqdn}/keys). A
    * non-deleted key means DNSSEC is enabled; each key's `ds` field is the full DS
@@ -939,6 +1014,19 @@ export class GandiRegistrar extends BaseRegistrar {
   }
 }
 
+// A pending outbound transfer, from the domain's `pendingTransfer` EPP status.
+function pendingTransferOut(d: GandiDomain): TransferOut | null {
+  const statuses = Array.isArray(d.status) ? d.status : d.status ? [d.status] : [];
+  if (!statuses.includes('pendingTransfer')) return null;
+  return {
+    status: 'pending',
+    rawStatus: 'pendingTransfer',
+    requestedDate: null,
+    expirationDate: null,
+    completedDate: null,
+  };
+}
+
 // map a Gandi contact into the normalized Contact shape. Gandi has no distinct
 // second address line, so `address2` is left undefined.
 // map the normalized Contact to Gandi's contact shape (given/family/streetaddr/…).

package/src/registrars/godaddy.ts

@@ -16,9 +16,11 @@ import type {
   RequestOptions,
   TldPricing,
   TransferDomainInput,
+  TransferOut,
+  TransferOutStatus,
 } from '../types';
 import { REST_SAFE_METHODS } from '../http';
-import { createDomain, filterDomains, settableForwards } from '../utils';
+import { createDomain, filterDomains, parseDate, settableForwards } from '../utils';
 import {
   ConfigurationError,
   ConsentRequiredError,
@@ -112,6 +114,19 @@ interface GoDaddyForward {
   mask?: { title?: string; description?: string; keywords?: string };
 }
 
+// One entry of the v2 recent-actions list,
+// GET /v2/customers/{customerId}/domains/{domain}/actions (`[]` when there are
+// none, verified live 2026-10-31). An outbound transfer shows as a TRANSFER_OUT
+// action while it's in progress; answering it logs TRANSFER_OUT_ACCEPT or
+// TRANSFER_OUT_REJECT. `status` is ACCEPTED / AWAITING / PENDING / SUCCESS /
+// FAILED / CANCELLED.
+interface GoDaddyAction {
+  type?: string;
+  status?: string;
+  createdAt?: string;
+  completedAt?: string;
+}
+
 // normalized DomainForwardType → the token the v2 write endpoint expects
 const GD_FORWARD_TYPE: Record<'temporary' | 'permanent', string> = {
   permanent: 'REDIRECT_PERMANENT',
@@ -299,17 +314,22 @@ export class GoDaddyRegistrar extends BaseRegistrar {
   ];
   // GoDaddy's OTE ("Operational Test Environment") is its sandbox
   static readonly supportsSandbox = true;
-  // Beyond core: domain forwarding and transfer-out auth code (the `authCode`
-  // field on the v1 domain-detail response). Forwarding uses the v2
-  // customer-scoped route /v2/customers/{customerId}/domains/forwards/{fqdn}
-  // (the old v1 /v1/domains/forwards routes now 404); it requires `customerId`
-  // to be configured — verified live 2026-08-29. DNSSEC has no dedicated
+  // Beyond core: domain forwarding, transfer-out auth code (the `authCode`
+  // field on the v1 domain-detail response) and transfer-out approval.
+  // Forwarding uses the v2 customer-scoped route
+  // /v2/customers/{customerId}/domains/forwards/{fqdn} (the old v1
+  // /v1/domains/forwards routes now 404); it requires `customerId` to be
+  // configured — verified live 2026-08-29. Transfer-out approval is v2
+  // customer-scoped too, so it needs `customerId` as well. DNSSEC has no dedicated
   // endpoint (DS records go through the generic DNS API), and there's no
   // glue-record, email, or push-webhook API.
   static readonly extendedFeatures: readonly RegistrarFeature[] = [
     Feature.GetAuthCode,
     Feature.GetDomainForwarding,
     Feature.SetDomainForwarding,
+    Feature.GetTransferOut,
+    Feature.ApproveTransferOut,
+    Feature.RejectTransferOut,
   ];
 
   // true → prefer the v3 API (production + PAT). false → all calls use v1
@@ -1046,8 +1066,9 @@ export class GoDaddyRegistrar extends BaseRegistrar {
     const configured = this.credentials.customerId?.trim();
     if (!configured) {
       throw new ConfigurationError(
-        `${this.name}: domain forwarding uses the v2 customer-scoped API, which ` +
-          'requires a customer ID. Set `customerId` to your GoDaddy customer UUID ' +
+        `${this.name}: domain forwarding and transfer-out approval use the v2 ` +
+          'customer-scoped API, which requires a customer ID. Set `customerId` to ' +
+          'your GoDaddy customer UUID ' +
           '(or your numeric shopper/account ID, which will be resolved to the UUID).'
       );
     }
@@ -1167,6 +1188,71 @@ export class GoDaddyRegistrar extends BaseRegistrar {
     return `/v2/customers/${encodeURIComponent(customerId)}/domains/forwards/${encodeURIComponent(fqdn)}`;
   }
 
+  // the v2 customer-scoped path for a domain
+  private domainPathV2(customerId: string, domainName: string): string {
+    return `/v2/customers/${encodeURIComponent(customerId)}/domains/${encodeURIComponent(domainName)}`;
+  }
+
+  /**
+   * The domain's latest outbound transfer, read from its recent actions
+   * (GET /v2/customers/{customerId}/domains/{domain}/actions): the TRANSFER_OUT
+   * action, and an accept or reject logged after it. Null when there is no
+   * TRANSFER_OUT on record. GoDaddy reports no expiry; left alone, it releases
+   * the domain within seven days. Shapes from the published v2 spec; a real
+   * transfer-out is not yet seen live.
+   */
+  override async getTransferOut(
+    domainName: string,
+    opts?: RequestOptions
+  ): Promise<TransferOut | null> {
+    const customerId = await this.resolveCustomerId(opts);
+    const actions = await this.http.request<GoDaddyAction[]>({
+      path: `${this.domainPathV2(customerId, domainName)}/actions`,
+      ...opts,
+    });
+    return toTransferOut(Array.isArray(actions) ? actions : []);
+  }
+
+  /**
+   * Approves the pending outbound transfer, releasing the domain now
+   * (POST .../transferOutAccept → 202). GoDaddy answers 409 when none is
+   * pending.
+   */
+  override async approveTransferOut(
+    domainName: string,
+    opts?: RequestOptions
+  ): Promise<OperationResult> {
+    return this.answerTransferOut(domainName, 'transferOutAccept', 'approved', opts);
+  }
+
+  // Rejects the pending outbound transfer (POST .../transferOutReject, with no
+  // reason); the domain stays in the account.
+  override async rejectTransferOut(
+    domainName: string,
+    opts?: RequestOptions
+  ): Promise<OperationResult> {
+    return this.answerTransferOut(domainName, 'transferOutReject', 'rejected', opts);
+  }
+
+  private async answerTransferOut(
+    domainName: string,
+    action: 'transferOutAccept' | 'transferOutReject',
+    answer: string,
+    opts?: RequestOptions
+  ): Promise<OperationResult> {
+    let customerId: string;
+    try {
+      customerId = await this.resolveCustomerId(opts);
+    } catch (error) {
+      return { success: false, message: toRegistrarError(error).message };
+    }
+    return this.mutate(
+      { method: 'POST', path: `${this.domainPathV2(customerId, domainName)}/${action}` },
+      `Transfer of ${domainName} ${answer}`,
+      opts
+    );
+  }
+
   /**
    * Transfer authorization (EPP) code. GoDaddy exposes it as the `authCode`
    * field on the v1 domain-detail response; transfers were never moved to v3,
@@ -1231,6 +1317,48 @@ export class GoDaddyRegistrar extends BaseRegistrar {
   }
 }
 
+// --- transfer-out mapping ---
+
+// GoDaddy's recent actions → the domain's latest transfer-out. The TRANSFER_OUT
+// action carries the transfer; while it's open, the latest accept or reject
+// logged after it (unless that failed) says how it was answered.
+function toTransferOut(actions: GoDaddyAction[]): TransferOut | null {
+  const time = (a: GoDaddyAction) => parseDate(a.createdAt)?.getTime() ?? 0;
+  const byLatest = (types: string[]) =>
+    actions.filter(a => types.includes(a.type ?? '')).sort((a, b) => time(b) - time(a));
+  const transfer = byLatest(['TRANSFER_OUT'])[0];
+  if (!transfer) return null;
+  const answer = byLatest(['TRANSFER_OUT_ACCEPT', 'TRANSFER_OUT_REJECT']).find(
+    a => time(a) >= time(transfer) && !/^(FAILED|CANCELLED)$/i.test(a.status ?? '')
+  );
+  const rejected = answer?.type === 'TRANSFER_OUT_REJECT';
+  const rawStatus = transfer.status ?? '';
+  let status: TransferOutStatus;
+  switch (rawStatus.toUpperCase()) {
+    case 'ACCEPTED':
+    case 'AWAITING':
+    case 'PENDING':
+      status = !answer ? 'pending' : rejected ? 'rejected' : 'approved';
+      break;
+    case 'SUCCESS':
+      status = 'completed';
+      break;
+    case 'FAILED':
+    case 'CANCELLED':
+      status = rejected ? 'rejected' : 'cancelled';
+      break;
+    default:
+      status = 'unknown';
+  }
+  return {
+    status,
+    rawStatus,
+    requestedDate: parseDate(transfer.createdAt),
+    expirationDate: null,
+    completedDate: status === 'completed' ? parseDate(transfer.completedAt) : null,
+  };
+}
+
 // --- contact mapping between GoDaddy's shape and the normalized Contact ---
 
 function fromGoDaddyContact(c: GoDaddyContact | undefined): Contact | undefined {

package/src/types.ts

@@ -343,6 +343,33 @@ export interface DnssecStatus {
   dsRecords: DsRecord[];
 }
 
+// Where an outbound transfer stands at the losing registrar. A transfer-out
+// starts when another registrar requests the domain with its auth code:
+//   pending   — waiting on the owner: approve it to release the domain now, or
+//               reject it. Left alone, most registrars release it after 5 days.
+//   approved  — released to the gaining registrar, not yet completed
+//   rejected  — refused by the owner or the registrar
+//   completed — the domain has left the account
+//   cancelled — withdrawn, failed or timed out on the gaining side
+//   unknown   — a status label this library doesn't recognise (see `rawStatus`)
+export type TransferOutStatus =
+  'pending' | 'approved' | 'rejected' | 'completed' | 'cancelled' | 'unknown';
+
+// An outbound transfer of a domain, as the losing registrar reports it.
+export interface TransferOut {
+  status: TransferOutStatus;
+  // the registrar's own status label, verbatim
+  rawStatus: string;
+  // the registrar's reference for the transfer (Dynadot: the order id)
+  id?: string;
+  // the registrar taking the domain, when reported
+  gainingRegistrar?: string;
+  requestedDate: Date | null;
+  // when the transfer request lapses or is released without action
+  expirationDate: Date | null;
+  completedDate: Date | null;
+}
+
 // The core interface every registrar implementation fulfils. `BaseRegistrar`
 // (src/registrar.ts) provides the shared plumbing and `NotImplementedError`
 // defaults; concrete providers under src/registrars/ extend it.
@@ -478,6 +505,17 @@ export interface Registrar {
   // domain away to another registrar
   getAuthCode(domainName: string, opts?: RequestOptions): Promise<string>;
 
+  // read the domain's most recent outbound transfer (one another registrar
+  // requested with the auth code); null when there is none on record
+  getTransferOut(domainName: string, opts?: RequestOptions): Promise<TransferOut | null>;
+
+  // approve a pending outbound transfer, releasing the domain to the gaining
+  // registrar now instead of after the registrar's waiting period
+  approveTransferOut(domainName: string, opts?: RequestOptions): Promise<OperationResult>;
+
+  // reject (deny) a pending outbound transfer; the domain stays put
+  rejectTransferOut(domainName: string, opts?: RequestOptions): Promise<OperationResult>;
+
   // read DNSSEC status for a domain (whether it's enabled, plus any DS records)
   getDnssec(domainName: string, opts?: RequestOptions): Promise<DnssecStatus>;