@aoxborrow/registrar-client 0.11.0 → 0.12.0

package/README.md

@@ -187,9 +187,9 @@ are the guaranteed contract; **extended** methods are opt-in per provider.
 | Extended method       | CF  | DY  | GA  | GD  | NB  | NC  | NS  | PB  | SP  | NM  | 101 |
 | --------------------- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
 | `getAuthCode`         | ✗   | ✓   | ✓   | ✓   | ✓   | ✗ⁱ  | ✗ⁱ  | ✗   | ✓   | ✓   | ✗   |
-| `getTransferOut`      | ✗   | ✓ⁿ  | ✗   | ✗ⁿ  | ✗   | ✗   | ✗   | ✗   | ✗   | ✗   | ✗   |
-| `approveTransferOut`  | ✗   | ✓ⁿ  | ✗ⁿ  | ✗ⁿ  | ✗   | ✗   | ✗   | ✗   | ✗   | ✗   | ✗   |
-| `rejectTransferOut`   | ✗   | ✓ⁿ  | ✗ⁿ  | ✗ⁿ  | ✗   | ✗   | ✗   | ✗   | ✗   | ✗ⁿ  | ✗   |
+| `getTransferOut`      | ✗   | ✓ⁿ  | ✓ⁿ  | ✓ⁿ  | ✗   | ✗   | ✗   | ✗   | ✗   | ✗   | ✗   |
+| `approveTransferOut`  | ✗   | ✓ⁿ  | ✓ⁿ  | ✓ⁿ  | ✗   | ✗   | ✗   | ✗   | ✗   | ✗   | ✗   |
+| `rejectTransferOut`   | ✗   | ✓ⁿ  | ✓ⁿ  | ✓ⁿ  | ✗   | ✗   | ✗   | ✗   | ✗   | ✗ⁿ  | ✗   |
 | `getDnssec`           | ✗   | ✓   | ✓   | ✗   | ✗   | ✗   | ✓   | ✓   | ✗   | ✗ᵐ  | ✗   |
 | `disableDnssec`       | ✗   | ✓   | ✓   | ✗   | ✗   | ✗   | ✓   | ✓   | ✗   | ✗ᵐ  | ✗   |
 | `getEmailForwarding`  | ✓   | ✓   | ✓   | ✗   | ✗   | ✓   | ✓   | ✗   | ✗   | ✗ᵐ  | ✗   |
@@ -238,10 +238,13 @@ not a claim of available API endpoints. See [101domain](docs/registrars/101domai
 - **ⁿ** Transfer-out approval answers a transfer another registrar requested with
   the auth code. Dynadot's is sandbox-verified only up to "no such order" (its
   sandbox can't start an outbound transfer); a real pending one's read was
-  checked in production. GoDaddy (v2, needs a `customerId`)
-  and Gandi have approve and reject endpoints, and Name.com a reject, none wired
-  up yet; the rest leave it to the dashboard or the transfer email, and release
-  the domain after about 5 days. See each registrar's doc.
+  checked in production. GoDaddy's uses the v2 customer-scoped API, so it needs a
+  `customerId` as forwarding does (ˡ); it reads the domain's recent actions, with
+  no expiry date. Gandi has no transfer-out to read: a `pendingTransfer` status
+  reads as pending, with no dates, and approving sends the current auth code
+  back. Neither has been tried on a real transfer yet. Name.com can only reject
+  (not wired up); the rest leave it to the dashboard or the transfer email, and
+  release the domain after about 5 days. See each registrar's doc.
 - **ˡ** GoDaddy domain forwarding uses the v2 customer-scoped API, so it requires
   a `customerId` (the customer UUID, or a numeric shopper ID the client resolves to
   the UUID via an sso-key-only lookup); the old v1 forwarding route was removed.

package/dist/index.cjs

@@ -3212,9 +3212,9 @@ var GandiRegistrar = class extends BaseRegistrar {
   ];
   // Gandi's v5 API offers a sandbox at api.sandbox.gandi.net (separate account)
   static supportsSandbox = true;
-  // On top of core: transfer-out auth code (`authinfo`), DNSSEC read/disable
-  // (LiveDNS keys), email forwarding, and web/URL forwarding (webredirs;
-  // per host, apex included). Note core `setPrivacy` disabling is a no-op for
+  // On top of core: transfer-out auth code (`authinfo`) and approval, DNSSEC
+  // read/disable (LiveDNS keys), email forwarding, and web/URL forwarding
+  // (webredirs; per host, apex included). Note core `setPrivacy` disabling is a no-op for
   // individual (natural-person) registrants — Gandi keeps WHOIS obfuscation on
   // for GDPR regardless of the request.
   static extendedFeatures = [
@@ -3224,7 +3224,10 @@ var GandiRegistrar = class extends BaseRegistrar {
     Feature.GetEmailForwarding,
     Feature.SetEmailForwarding,
     Feature.GetDomainForwarding,
-    Feature.SetDomainForwarding
+    Feature.SetDomainForwarding,
+    Feature.GetTransferOut,
+    Feature.ApproveTransferOut,
+    Feature.RejectTransferOut
   ];
   constructor(credentials, options) {
     super(
@@ -3476,6 +3479,58 @@ var GandiRegistrar = class extends BaseRegistrar {
     });
     return d.authinfo ?? "";
   }
+  /**
+   * The domain's pending outbound transfer. Gandi has no transfer-out resource
+   * to read: a domain in the account carries the documented `pendingTransfer`
+   * EPP status while another registrar's request waits (inbound transfers live
+   * under /domain/transferin, so on a domain you hold it's outbound — inferred,
+   * not documented). Gandi reports no dates for it, and nothing once it's
+   * answered or done, so this reads `pending` or null.
+   */
+  async getTransferOut(domainName, opts) {
+    const d = await this.http.request({
+      path: `/domain/domains/${domainName}`,
+      ...opts
+    });
+    return pendingTransferOut(d);
+  }
+  /**
+   * Approves the pending outbound transfer, releasing the domain now instead of
+   * after Gandi's five days: POST .../transferout with `accept: true` and the
+   * domain's current auth code, which Gandi requires back (→ 202).
+   */
+  async approveTransferOut(domainName, opts) {
+    return this.answerTransferOut(domainName, true, opts);
+  }
+  // Declines the pending outbound transfer (`accept: false`, no reason); the
+  // domain stays in the account.
+  async rejectTransferOut(domainName, opts) {
+    return this.answerTransferOut(domainName, false, opts);
+  }
+  // One read for both the pending status and the auth code the answer needs.
+  async answerTransferOut(domainName, accept, opts) {
+    let d;
+    try {
+      d = await this.http.request({
+        path: `/domain/domains/${domainName}`,
+        ...opts
+      });
+    } catch (error) {
+      return { success: false, message: toRegistrarError(error).message };
+    }
+    if (!pendingTransferOut(d)) {
+      return { success: false, message: `No transfer-out of ${domainName} to answer` };
+    }
+    return this.mutate(
+      {
+        method: "POST",
+        path: `/domain/domains/${domainName}/transferout`,
+        body: { accept, authinfo: d.authinfo ?? "" }
+      },
+      `Transfer of ${domainName} ${accept ? "approved" : "rejected"}`,
+      opts
+    );
+  }
   /**
    * DNSSEC status via Gandi LiveDNS keys (GET /livedns/domains/{fqdn}/keys). A
    * non-deleted key means DNSSEC is enabled; each key's `ds` field is the full DS
@@ -3843,6 +3898,17 @@ var GandiRegistrar = class extends BaseRegistrar {
     }
   }
 };
+function pendingTransferOut(d) {
+  const statuses = Array.isArray(d.status) ? d.status : d.status ? [d.status] : [];
+  if (!statuses.includes("pendingTransfer")) return null;
+  return {
+    status: "pending",
+    rawStatus: "pendingTransfer",
+    requestedDate: null,
+    expirationDate: null,
+    completedDate: null
+  };
+}
 function toGandiContact(c) {
   const contact = {
     given: c.firstName,
@@ -3983,17 +4049,22 @@ var GoDaddyRegistrar = class _GoDaddyRegistrar extends BaseRegistrar {
   ];
   // GoDaddy's OTE ("Operational Test Environment") is its sandbox
   static supportsSandbox = true;
-  // Beyond core: domain forwarding and transfer-out auth code (the `authCode`
-  // field on the v1 domain-detail response). Forwarding uses the v2
-  // customer-scoped route /v2/customers/{customerId}/domains/forwards/{fqdn}
-  // (the old v1 /v1/domains/forwards routes now 404); it requires `customerId`
-  // to be configured — verified live 2026-08-29. DNSSEC has no dedicated
+  // Beyond core: domain forwarding, transfer-out auth code (the `authCode`
+  // field on the v1 domain-detail response) and transfer-out approval.
+  // Forwarding uses the v2 customer-scoped route
+  // /v2/customers/{customerId}/domains/forwards/{fqdn} (the old v1
+  // /v1/domains/forwards routes now 404); it requires `customerId` to be
+  // configured — verified live 2026-08-29. Transfer-out approval is v2
+  // customer-scoped too, so it needs `customerId` as well. DNSSEC has no dedicated
   // endpoint (DS records go through the generic DNS API), and there's no
   // glue-record, email, or push-webhook API.
   static extendedFeatures = [
     Feature.GetAuthCode,
     Feature.GetDomainForwarding,
-    Feature.SetDomainForwarding
+    Feature.SetDomainForwarding,
+    Feature.GetTransferOut,
+    Feature.ApproveTransferOut,
+    Feature.RejectTransferOut
   ];
   // true → prefer the v3 API (production + PAT). false → all calls use v1
   // (sso-key auth, or OTE/sandbox where v3 does not exist).
@@ -4594,7 +4665,7 @@ var GoDaddyRegistrar = class _GoDaddyRegistrar extends BaseRegistrar {
     const configured = this.credentials.customerId?.trim();
     if (!configured) {
       throw new ConfigurationError(
-        `${this.name}: domain forwarding uses the v2 customer-scoped API, which requires a customer ID. Set \`customerId\` to your GoDaddy customer UUID (or your numeric shopper/account ID, which will be resolved to the UUID).`
+        `${this.name}: domain forwarding and transfer-out approval use the v2 customer-scoped API, which requires a customer ID. Set \`customerId\` to your GoDaddy customer UUID (or your numeric shopper/account ID, which will be resolved to the UUID).`
       );
     }
     if (UUID_RE.test(configured)) return configured;
@@ -4694,6 +4765,52 @@ var GoDaddyRegistrar = class _GoDaddyRegistrar extends BaseRegistrar {
   forwardPath(customerId, fqdn) {
     return `/v2/customers/${encodeURIComponent(customerId)}/domains/forwards/${encodeURIComponent(fqdn)}`;
   }
+  // the v2 customer-scoped path for a domain
+  domainPathV2(customerId, domainName) {
+    return `/v2/customers/${encodeURIComponent(customerId)}/domains/${encodeURIComponent(domainName)}`;
+  }
+  /**
+   * The domain's latest outbound transfer, read from its recent actions
+   * (GET /v2/customers/{customerId}/domains/{domain}/actions): the TRANSFER_OUT
+   * action, and an accept or reject logged after it. Null when there is no
+   * TRANSFER_OUT on record. GoDaddy reports no expiry; left alone, it releases
+   * the domain within seven days. Shapes from the published v2 spec; a real
+   * transfer-out is not yet seen live.
+   */
+  async getTransferOut(domainName, opts) {
+    const customerId = await this.resolveCustomerId(opts);
+    const actions = await this.http.request({
+      path: `${this.domainPathV2(customerId, domainName)}/actions`,
+      ...opts
+    });
+    return toTransferOut2(Array.isArray(actions) ? actions : []);
+  }
+  /**
+   * Approves the pending outbound transfer, releasing the domain now
+   * (POST .../transferOutAccept → 202). GoDaddy answers 409 when none is
+   * pending.
+   */
+  async approveTransferOut(domainName, opts) {
+    return this.answerTransferOut(domainName, "transferOutAccept", "approved", opts);
+  }
+  // Rejects the pending outbound transfer (POST .../transferOutReject, with no
+  // reason); the domain stays in the account.
+  async rejectTransferOut(domainName, opts) {
+    return this.answerTransferOut(domainName, "transferOutReject", "rejected", opts);
+  }
+  async answerTransferOut(domainName, action, answer, opts) {
+    let customerId;
+    try {
+      customerId = await this.resolveCustomerId(opts);
+    } catch (error) {
+      return { success: false, message: toRegistrarError(error).message };
+    }
+    return this.mutate(
+      { method: "POST", path: `${this.domainPathV2(customerId, domainName)}/${action}` },
+      `Transfer of ${domainName} ${answer}`,
+      opts
+    );
+  }
   /**
    * Transfer authorization (EPP) code. GoDaddy exposes it as the `authCode`
    * field on the v1 domain-detail response; transfers were never moved to v3,
@@ -4750,6 +4867,41 @@ var GoDaddyRegistrar = class _GoDaddyRegistrar extends BaseRegistrar {
     }
   }
 };
+function toTransferOut2(actions) {
+  const time = (a) => parseDate(a.createdAt)?.getTime() ?? 0;
+  const byLatest = (types) => actions.filter((a) => types.includes(a.type ?? "")).sort((a, b) => time(b) - time(a));
+  const transfer = byLatest(["TRANSFER_OUT"])[0];
+  if (!transfer) return null;
+  const answer = byLatest(["TRANSFER_OUT_ACCEPT", "TRANSFER_OUT_REJECT"]).find(
+    (a) => time(a) >= time(transfer) && !/^(FAILED|CANCELLED)$/i.test(a.status ?? "")
+  );
+  const rejected = answer?.type === "TRANSFER_OUT_REJECT";
+  const rawStatus = transfer.status ?? "";
+  let status;
+  switch (rawStatus.toUpperCase()) {
+    case "ACCEPTED":
+    case "AWAITING":
+    case "PENDING":
+      status = !answer ? "pending" : rejected ? "rejected" : "approved";
+      break;
+    case "SUCCESS":
+      status = "completed";
+      break;
+    case "FAILED":
+    case "CANCELLED":
+      status = rejected ? "rejected" : "cancelled";
+      break;
+    default:
+      status = "unknown";
+  }
+  return {
+    status,
+    rawStatus,
+    requestedDate: parseDate(transfer.createdAt),
+    expirationDate: null,
+    completedDate: status === "completed" ? parseDate(transfer.completedAt) : null
+  };
+}
 function fromGoDaddyContact(c) {
   if (!c) return void 0;
   const a = c.addressMailing ?? {};