@indigoai-us/hq-cli 5.345.197 → 5.345.198

package/dist/commands/deploy-domains.js

@@ -112,6 +112,9 @@ const SETTLED_PURCHASE_CODES = new Set([
     "INVALID_EXPECTED_PRICE",
     "INVALID_IDEMPOTENCY_KEY",
     "INVALID_REGISTRANT",
+    "CONSENT_REQUIRED",
+    "DOMAIN_LIMIT_REACHED",
+    "DOMAIN_SPEND_LIMIT_REACHED",
 ]);
 /** The sentence `buy` adds when the order's outcome is not known. */
 export function resumeOrderSentence(idempotencyKey) {
@@ -149,6 +152,9 @@ const PURCHASE_MESSAGES = {
     INVALID_EXPECTED_PRICE: "--price must be the first-year price shown by 'hq deploy domains search'.",
     INVALID_IDEMPOTENCY_KEY: "--idempotency-key must be 16 to 64 letters, digits, '-' or '_'.",
     INVALID_REGISTRANT: "The registrant details are missing or invalid. The file needs firstName, lastName, address1, city, state, zip, a 2-letter country, email, and phone in +15551234567 form.",
+    CONSENT_REQUIRED: "The purchase needs acceptance of the terms, ICANN consent, and the 60-day transfer lock. Run buy again and accept the confirmation.",
+    DOMAIN_LIMIT_REACHED: "This company already has the maximum of 10 purchased domains. Nothing was charged. Let one lapse before buying another.",
+    DOMAIN_SPEND_LIMIT_REACHED: "This purchase would pass the company's domain spending limit for the last 30 days. Nothing was charged. Wait until that window moves, or ask an owner to raise the limit, then run buy again.",
 };
 function apiCode(body, status) {
     const nested = body.error && typeof body.error === "object" ? body.error.code : undefined;
@@ -407,8 +413,12 @@ export function addOnConfirmQuestion(domain, environment, target, pricing) {
         : `Each custom domain is a monthly add-on billed to ${company}, unless its plan includes custom domains.`;
     return `Add ${displayText(domain)} to ${displayText(environment)} of app '${displayText(target.appLabel)}' in ${company}? ${price}`;
 }
-/** Shown in the buy prompt when GET /v1/pricing does not answer. */
-export const PURCHASE_TERMS_UNAVAILABLE = "The renewal and refund terms could not be loaded. Check them on the HQ pricing page before you buy.";
+/** Shown in the buy prompt when neither search nor GET /v1/pricing names a renewal price. */
+export const PURCHASE_TERMS_UNAVAILABLE = "The renewal price could not be loaded. Run 'hq deploy domains search' and check the renewal price before you buy.";
+/** Sandbox label. Every search and buy surface prints this when the server says testMode. */
+export const TEST_MODE_LABEL = "Test mode: sandbox prices. Nothing real is registered or charged.";
+export const TRANSFER_LOCK_NOTICE = "Domains cannot be transferred to another registrar for 60 days after purchase.";
+export const PURCHASES_ARE_FINAL = "Purchases are final.";
 /** The purchase terms published as usage.domains.purchase. Null when not published. */
 export function purchaseTermsLine(pricing) {
     const purchase = domainsBlock(pricing)?.purchase;
@@ -416,12 +426,11 @@ export function purchaseTermsLine(pricing) {
         return null;
     const p = purchase;
     const markup = typeof p.markupUsdPerYear === "number" ? p.markupUsdPerYear : null;
-    const grace = typeof p.refundGraceDays === "number" ? p.refundGraceDays : null;
-    if (markup === null || grace === null)
+    if (markup === null)
         return null;
     const renewal = p.renewal === "yearly" ? "yearly" : String(p.renewal ?? "yearly");
     const before = p.chargedBeforeRenewal === true ? ", charged before each renewal" : "";
-    return `It renews ${renewal} at the registrar's renewal price plus ${usd(markup)}${before}. There are no refunds after a ${grace}-day grace period.`;
+    return `It renews ${renewal} at the registrar's renewal price plus ${usd(markup)}${before}.`;
 }
 // ---------------------------------------------------------------------------
 // Output
@@ -475,15 +484,21 @@ async function run(json, action) {
         emitError(error, json === true);
     }
 }
-async function confirm(question, yes, what) {
+function requireConfirmable(yes, what) {
     if (yes)
         return;
     if (!deployDomainsPrompt.isInteractive()) {
         throw new DeployDomainsError(`Pass --yes to ${what}. Nothing was changed.`, "CONFIRMATION_REQUIRED");
     }
-    const answer = (await deployDomainsPrompt.ask(`${question} Type 'yes' to continue: `)).trim().toLowerCase();
-    if (answer !== "yes")
-        throw new DeployDomainsError("Cancelled. Nothing was changed.", "CANCELLED");
+}
+async function confirm(question, yes, what, accepted = ["yes"]) {
+    requireConfirmable(yes, what);
+    if (yes)
+        return;
+    const promptWord = accepted.includes("y") ? "y" : "yes";
+    const answer = (await deployDomainsPrompt.ask(`${question} Type '${promptWord}' to continue: `)).trim().toLowerCase();
+    if (!accepted.includes(answer))
+        throw new DeployDomainsError("Canceled. Nothing was changed.", "CANCELLED");
 }
 // ---------------------------------------------------------------------------
 // Actions
@@ -832,13 +847,13 @@ async function baseRemoveAction(options) {
     else if (billingRemovalPending)
         console.log("Its charge could not be stopped right away. HQ keeps retrying until the charge is removed.");
 }
-async function purchaseRequest(token, companyUid, suffix, body) {
+async function purchaseRequest(token, companyUid, suffix, body, method = "POST") {
     try {
         return await vaultApiFetch({
             token,
             path: `/v1/billing/companies/${encodeURIComponent(companyUid)}/domain-purchase${suffix}`,
-            method: "POST",
-            body,
+            method,
+            ...(body === undefined ? {} : { body }),
         });
     }
     catch {
@@ -866,6 +881,72 @@ async function purchaseCompanyUid(token, slug) {
         throw new DeployDomainsError(`Could not look up the company '${displayText(slug)}'${cause ? `: ${cause}` : "."}`, "COMPANY_LOOKUP_FAILED");
     }
 }
+function availabilityOf(result) {
+    const raw = result.availability;
+    if (raw === "available" || raw === "taken" || raw === "delegated" || raw === "premium" || raw === "unsupported") {
+        return raw;
+    }
+    if (result.available === true)
+        return "available";
+    if (result.available === false)
+        return "legacy-unavailable";
+    return "unknown";
+}
+function availabilityLabel(kind) {
+    switch (kind) {
+        case "available": return "available";
+        case "taken": return "taken";
+        case "delegated": return "not available (already delegated)";
+        case "premium": return "premium";
+        case "unsupported": return "unsupported";
+        case "legacy-unavailable": return "not available";
+        default: return "not available";
+    }
+}
+/** Taken and delegated names are listed so the reason is visible, and never offered for purchase. */
+function isOfferable(kind) {
+    return kind === "available" || kind === "premium";
+}
+function moneyFromCents(cents, currency) {
+    if (typeof cents !== "number" || !Number.isFinite(cents) || cents < 0 || !Number.isInteger(cents))
+        return undefined;
+    const amount = cents / 100;
+    const text = Number.isInteger(amount) ? `$${amount}` : `$${amount.toFixed(2)}`;
+    if (typeof currency === "string" && currency !== "" && currency !== "USD")
+        return `${text} ${currency}`;
+    return text;
+}
+function quoteOf(result) {
+    const registrar = result.registrarPrice;
+    const block = registrar && typeof registrar === "object" ? registrar : undefined;
+    const currency = block?.currency;
+    const firstFromCents = moneyFromCents(block?.firstYearCents, currency);
+    const renewalFromCents = moneyFromCents(block?.renewalCents, currency);
+    const firstYearUsd = typeof block?.firstYearCents === "number"
+        ? block.firstYearCents / 100
+        : typeof result.priceUsd === "number" ? result.priceUsd : undefined;
+    return {
+        firstYear: firstFromCents ?? (typeof result.priceUsd === "number" ? usd(result.priceUsd) : undefined),
+        renewal: renewalFromCents ?? (typeof result.renewalPriceUsd === "number" ? usd(result.renewalPriceUsd) : undefined),
+        ...(firstYearUsd === undefined ? {} : { firstYearUsd }),
+    };
+}
+function requireObjectList(value, message) {
+    if (!Array.isArray(value)) {
+        throw new DeployDomainsError(message, "UNEXPECTED_RESPONSE");
+    }
+    return value.filter((item) => typeof item === "object" && item !== null);
+}
+function searchResultLine(result) {
+    const domain = displayText(result.domain);
+    const kind = availabilityOf(result);
+    const label = availabilityLabel(kind);
+    const quote = quoteOf(result);
+    if (!isOfferable(kind) || !quote.firstYear)
+        return `${domain}  |  ${label}`;
+    const renewal = quote.renewal ? `, renews at ${quote.renewal}/year` : "";
+    return `${domain}  |  ${label}  |  ${quote.firstYear} for the first year${renewal}`;
+}
 async function searchAction(query, options) {
     const token = await ensureCognitoToken();
     const companyUid = await purchaseCompanyUid(token, purchaseSlug(options.company));
@@ -873,26 +954,26 @@ async function searchAction(query, options) {
     if (!response.ok)
         throw await purchaseError(response);
     const body = await readBody(response);
-    const results = Array.isArray(body.results)
-        ? body.results.filter((item) => typeof item === "object" && item !== null)
-        : [];
+    const results = requireObjectList(body.results, "HQ did not return a list of domains. Run 'hq deploy domains search' again in a minute.");
     if (options.json) {
-        console.log(safeJson({ ok: true, results }));
+        console.log(safeJson(body));
         return;
     }
+    if (body.testMode === true)
+        console.log(TEST_MODE_LABEL);
     if (results.length === 0) {
         console.log("No domains found.");
         return;
     }
+    let offerable = 0;
     for (const result of results) {
-        if (result.available !== true || typeof result.priceUsd !== "number") {
-            console.log(`${displayText(result.domain)}  |  not available`);
-            continue;
-        }
-        const renewal = typeof result.renewalPriceUsd === "number" ? `, renews at ${usd(result.renewalPriceUsd)}/year` : "";
-        console.log(`${displayText(result.domain)}  |  ${usd(result.priceUsd)} for the first year${renewal}`);
+        if (isOfferable(availabilityOf(result)))
+            offerable += 1;
+        console.log(searchResultLine(result));
+    }
+    if (offerable > 0) {
+        console.log("To buy one: hq deploy domains buy <domain> --use app:<app-id>|base|hold --price <first-year price> --registrant-file <contact.json>");
     }
-    console.log("To buy one: hq deploy domains buy <domain> --price <first-year price> --registrant-file <contact.json>");
 }
 function readRegistrant(file) {
     let parsed;
@@ -921,23 +1002,189 @@ export function parsePrice(raw) {
     }
     return value;
 }
+/** What the purchase is for. `app:<id>` attaches to that deployment, `base` is the company domain, `hold` registers only. */
+export function parseUse(raw) {
+    const trimmed = raw.trim();
+    if (trimmed === "base")
+        return { kind: "base" };
+    if (trimmed === "hold")
+        return { kind: "hold" };
+    const match = /^app:(.+)$/.exec(trimmed);
+    if (match && APP_ID_PATTERN.test(match[1]))
+        return { kind: "app", appId: match[1] };
+    throw new DeployDomainsError("Pass --use app:<app id>, base, or hold. For an app, use the id from 'hq deploy list', for example --use app:app_123.", "INVALID_USE");
+}
+function useBody(use) {
+    return use.kind === "app" ? { kind: "app", appId: use.appId } : { kind: use.kind };
+}
+function useLabel(use) {
+    if (!use || typeof use !== "object")
+        return "unknown";
+    const record = use;
+    if (record.kind === "app" && typeof record.appId === "string")
+        return `app ${record.appId}`;
+    if (record.kind === "base" || record.kind === "hold")
+        return record.kind;
+    return "unknown";
+}
+/** Hosting tier, separate from the registrar price. Hold is register-only. */
+export function hostingTierLine(use, pricing) {
+    if (use.kind === "hold")
+        return "Hosting: $0 per month (register only).";
+    if (use.kind === "base") {
+        const premium = domainsBlock(pricing)?.premiumUsd;
+        const amount = typeof premium === "number" && premium >= 0 ? premium : 500;
+        return `Hosting: ${usd(amount)} per month (company base domain).`;
+    }
+    const standard = domainsBlock(pricing)?.standardUsd;
+    const amount = typeof standard === "number" && standard >= 0 ? standard : 20;
+    return `Hosting: ${usd(amount)} per month (app domain).`;
+}
+function sameUsd(left, right) {
+    return Math.round(left * 100) === Math.round(right * 100);
+}
+function registrarCurrency(result) {
+    const registrar = result.registrarPrice;
+    if (!registrar || typeof registrar !== "object")
+        return undefined;
+    const currency = registrar.currency;
+    return typeof currency === "string" && currency !== "" ? currency : undefined;
+}
+/** First-year amount comparable to --price. A quote in another currency is not one. */
+function usdFirstYearAmount(result) {
+    const currency = registrarCurrency(result);
+    if (currency !== undefined && currency !== "USD")
+        return undefined;
+    const registrar = result.registrarPrice;
+    const block = registrar && typeof registrar === "object" ? registrar : undefined;
+    const cents = block?.firstYearCents;
+    if (typeof cents === "number" && Number.isInteger(cents) && cents >= 0)
+        return cents / 100;
+    const price = result.priceUsd;
+    if (typeof price === "number" && Number.isFinite(price) && price >= 0)
+        return price;
+    return undefined;
+}
+function assertMatchingUsdPrice(match, quote, expectedPriceUsd) {
+    const currency = registrarCurrency(match);
+    if (currency !== undefined && currency !== "USD") {
+        const shown = quote.firstYear
+            ? `The registrar's first-year price is ${quote.firstYear}, not US dollars.`
+            : "The registrar's first-year price is not in US dollars.";
+        throw new DeployDomainsError(`${shown} Nothing was charged. Run 'hq deploy domains search' and buy a name priced in USD.`, "PRICE_CHANGED");
+    }
+    const amount = usdFirstYearAmount(match);
+    if (amount === undefined) {
+        throw new DeployDomainsError("The registrar did not give a US dollar first-year price. Nothing was charged. Run 'hq deploy domains search' and buy a name that shows a price.", "PRICE_CHANGED");
+    }
+    if (!sameUsd(amount, expectedPriceUsd)) {
+        throw new DeployDomainsError(`The registrar's first-year price is ${quote.firstYear ?? usd(amount)}. Nothing was charged. Run buy again with --price ${usdFlag(amount)}.`, "PRICE_CHANGED");
+    }
+}
+function usdFlag(value) {
+    const cents = Math.round(value * 100);
+    const text = (cents / 100).toFixed(2);
+    return text.endsWith(".00") ? String(cents / 100) : text;
+}
+const PURCHASE_CONSENT = {
+    termsAccepted: true,
+    icannConsent: true,
+    transferLockNoticeShown: true,
+};
+async function loadBuyQuote(token, companyUid, domain, expectedPriceUsd, replay) {
+    let response;
+    try {
+        response = await purchaseRequest(token, companyUid, "/search", { query: domain });
+    }
+    catch {
+        throw new DeployDomainsError("Could not reach HQ to check the domain. Nothing was charged. Run 'hq deploy domains search' and try buy again.", "NETWORK");
+    }
+    if (!response.ok)
+        throw await purchaseError(response);
+    const body = await readBody(response);
+    const results = Array.isArray(body.results)
+        ? body.results.filter((item) => typeof item === "object" && item !== null)
+        : [];
+    const match = results.find((item) => typeof item.domain === "string" && item.domain.toLowerCase() === domain);
+    // After the registrar has the name, search reports it missing or taken, and
+    // often has no fresh USD quote. A retry with --idempotency-key still confirms,
+    // then POSTs that same key so hq-pro can replay the order.
+    const replayDespiteSearch = replay && (!match || availabilityOf(match) === "taken");
+    if (!match && !replayDespiteSearch) {
+        throw new DeployDomainsError(`${displayText(domain)} was not in the search results. Nothing was charged. Run 'hq deploy domains search ${displayText(domain)}' and buy a name it lists.`, "DOMAIN_NOT_AVAILABLE");
+    }
+    const kind = match ? availabilityOf(match) : undefined;
+    if (match && kind && !replayDespiteSearch && !isOfferable(kind)) {
+        const reason = kind === "delegated"
+            ? `${displayText(domain)} is not available (already delegated).`
+            : kind === "taken" || kind === "legacy-unavailable"
+                ? `${displayText(domain)} is not available to buy.`
+                : `${displayText(domain)} is not supported for purchase.`;
+        throw new DeployDomainsError(`${reason} Nothing was charged. Run 'hq deploy domains search' and pick an available name.`, "DOMAIN_NOT_AVAILABLE");
+    }
+    const quote = match ? quoteOf(match) : {};
+    if (match && !replayDespiteSearch)
+        assertMatchingUsdPrice(match, quote, expectedPriceUsd);
+    return {
+        testMode: body.testMode === true,
+        ...(quote.renewal ? { renewal: quote.renewal } : {}),
+    };
+}
+function buySummary(domain, slug, expectedPriceUsd, use, pricing, quote, terms) {
+    const renewal = quote.renewal
+        ? `Renewal: ${quote.renewal} per year`
+        : `Renewal: ${terms ?? PURCHASE_TERMS_UNAVAILABLE}`;
+    const lines = [
+        `Buy ${displayText(domain)} for the company '${slug}'?`,
+        `Registrar, first year: ${usd(expectedPriceUsd)}`,
+        renewal,
+        terms ?? PURCHASE_TERMS_UNAVAILABLE,
+        hostingTierLine(use, pricing),
+        TRANSFER_LOCK_NOTICE,
+        PURCHASES_ARE_FINAL,
+    ];
+    if (quote.testMode)
+        lines.push(TEST_MODE_LABEL);
+    return lines.join("\n");
+}
+function printReceiptNotices(testMode) {
+    console.log(TRANSFER_LOCK_NOTICE);
+    console.log(PURCHASES_ARE_FINAL);
+    if (testMode)
+        console.log(TEST_MODE_LABEL);
+}
 async function buyAction(domainArg, options) {
     const domain = normalizeDomain(domainArg);
     const expectedPriceUsd = parsePrice(options.price);
+    const use = parseUse(options.use);
     if (options.idempotencyKey !== undefined && !IDEMPOTENCY_KEY_PATTERN.test(options.idempotencyKey)) {
         throw new DeployDomainsError(PURCHASE_MESSAGES.INVALID_IDEMPOTENCY_KEY, "INVALID_IDEMPOTENCY_KEY");
     }
     const registrant = readRegistrant(options.registrantFile);
-    const idempotencyKey = options.idempotencyKey ?? `cli_${randomUUID().replace(/-/g, "")}`;
     // Resolve the paying company before the prompt so the approval names it.
     const slug = purchaseSlug(options.company);
     const token = await ensureCognitoToken();
     const companyUid = await purchaseCompanyUid(token, slug);
-    const terms = purchaseTermsLine(await fetchPricingBody());
-    await confirm(`Buy ${displayText(domain)} for ${usd(expectedPriceUsd)} for the first year, charged to the card on file for '${slug}'? ${terms ?? PURCHASE_TERMS_UNAVAILABLE}`, options.yes, "buy the domain");
+    // A non-interactive buy without --yes must stop before the price check, so nothing is called.
+    requireConfirmable(options.yes, "buy the domain");
+    const pricing = await fetchPricingBody();
+    const terms = purchaseTermsLine(pricing);
+    const quote = await loadBuyQuote(token, companyUid, domain, expectedPriceUsd, options.idempotencyKey !== undefined);
+    const summary = buySummary(domain, slug, expectedPriceUsd, use, pricing, quote, terms);
+    if (options.yes)
+        console.error(summary);
+    await confirm(summary, options.yes, "buy the domain", ["y", "yes"]);
+    const idempotencyKey = options.idempotencyKey ?? `cli_${randomUUID().replace(/-/g, "")}`;
     let response;
     try {
-        response = await purchaseRequest(token, companyUid, "", { domain, expectedPriceUsd, idempotencyKey, registrant });
+        response = await purchaseRequest(token, companyUid, "", {
+            domain,
+            expectedPriceUsd,
+            idempotencyKey,
+            registrant,
+            use: useBody(use),
+            consent: { ...PURCHASE_CONSENT },
+        });
     }
     catch (error) {
         // The request may have reached hq-pro, so the order's key is the only safe retry.
@@ -948,10 +1195,15 @@ async function buyAction(domainArg, options) {
         throw await purchaseError(response, idempotencyKey);
     const body = await readBody(response);
     if (options.json) {
-        console.log(safeJson({ ok: true, idempotencyKey, ...body }));
+        console.log(safeJson({ ok: true, idempotencyKey, ...body, approvedTerms: terms ?? PURCHASE_TERMS_UNAVAILABLE }));
         return;
     }
     const expires = typeof body.expiresAt === "string" ? ` It is registered until ${displayText(body.expiresAt)}.` : "";
+    const testMode = body.testMode === true || quote.testMode;
+    const hostingCents = body.hostingPriceCents;
+    const hosting = typeof hostingCents === "number" && Number.isFinite(hostingCents) && hostingCents >= 0
+        ? `Hosting: ${moneyFromCents(hostingCents, "USD")} per month.`
+        : hostingTierLine(use, pricing);
     if (body.replayed === true) {
         console.log(`${displayText(domain)} was already bought by this order.${expires}`);
     }
@@ -961,13 +1213,407 @@ async function buyAction(domainArg, options) {
         // registration for this order and captures again (hq-pro domain-purchase.ts).
         console.log(`Registered ${displayText(domain)}.${expires} The card was authorized for ${usd(expectedPriceUsd)}, ` +
             `but the charge did not complete. ${retryChargeSentence(idempotencyKey)}`);
+        console.log(terms ?? PURCHASE_TERMS_UNAVAILABLE);
+        printReceiptNotices(testMode);
+        return;
     }
     else {
         console.log(`Bought ${displayText(domain)} for ${usd(expectedPriceUsd)}.${expires}`);
     }
-    if (terms)
-        console.log(terms);
-    console.log(`To serve an app on it: hq deploy domains add ${displayText(domain)} --app <app>`);
+    if (quote.renewal)
+        console.log(`Renewal: ${quote.renewal} per year.`);
+    console.log(terms ?? PURCHASE_TERMS_UNAVAILABLE);
+    console.log(hosting);
+    console.log(`Use: ${useLabel(useBody(use))}.`);
+    printReceiptNotices(testMode);
+    if (use.kind === "hold") {
+        console.log(`Registered only. To serve an app on it later: hq deploy domains add ${displayText(domain)} --app <app>`);
+    }
+    else {
+        console.log(`Check it with: hq deploy domains show ${displayText(domain)}`);
+    }
+}
+// ---------------------------------------------------------------------------
+// Purchased domains: list, detail, auto-renew (hq-pro)
+function ownedLine(row) {
+    const expires = typeof row.expiresAt === "string" ? displayText(row.expiresAt) : "unknown";
+    const renew = row.autoRenew === true ? "auto-renew on" : "auto-renew off";
+    const testMode = row.testMode === true ? "test mode on" : "test mode off";
+    return [
+        displayText(row.domain),
+        displayText(row.status ?? "unknown"),
+        useLabel(row.use),
+        expires,
+        renew,
+        testMode,
+    ].join("  |  ");
+}
+function eventLine(event) {
+    if (typeof event === "string")
+        return displayText(event);
+    if (!event || typeof event !== "object")
+        return "";
+    const record = event;
+    const kind = record.type ?? record.kind ?? record.event ?? "event";
+    const at = record.at ?? record.createdAt ?? record.date ?? "";
+    const detail = record.message ?? record.detail ?? "";
+    return [kind, at, detail]
+        .filter((part) => typeof part === "string" && part !== "")
+        .map((part) => displayText(part))
+        .join("  ");
+}
+function attachedLine(attached) {
+    if (!attached || typeof attached !== "object")
+        return "Attached: not attached";
+    const record = attached;
+    if (record.kind !== "app" && record.kind !== "base")
+        return "Attached: not attached";
+    const appId = typeof record.appId === "string" && record.appId !== "" ? displayText(record.appId) : undefined;
+    const hostname = typeof record.hostname === "string" && record.hostname !== "" ? displayText(record.hostname) : undefined;
+    if (appId && hostname)
+        return `Attached: ${record.kind} ${appId} (${hostname})`;
+    if (appId)
+        return `Attached: ${record.kind} ${appId}`;
+    if (hostname)
+        return `Attached: ${record.kind} ${hostname}`;
+    return `Attached: ${record.kind}`;
+}
+function registrarNameserversLine(value) {
+    if (value === true)
+        return "Registrar nameservers: set";
+    if (value === false)
+        return "Registrar nameservers: not set";
+    return "Registrar nameservers: unknown";
+}
+function printDomainDetail(body) {
+    console.log(ownedLine(body));
+    console.log(attachedLine(body.attached));
+    console.log(registrarNameserversLine(body.registrarNameserversSet));
+    const nameservers = Array.isArray(body.nameservers)
+        ? body.nameservers.filter((item) => typeof item === "string")
+        : [];
+    console.log(nameservers.length === 0 ? "Nameservers: none" : "Nameservers:");
+    for (const nameserver of nameservers)
+        console.log(`  ${displayText(nameserver)}`);
+    const events = Array.isArray(body.events) ? body.events : [];
+    console.log(events.length === 0 ? "Events: none" : "Events:");
+    for (const event of events) {
+        const line = eventLine(event);
+        if (line)
+            console.log(`  ${line}`);
+    }
+    if (body.testMode === true)
+        console.log(TEST_MODE_LABEL);
+}
+async function ownedDomainError(response, domain) {
+    const error = await purchaseError(response);
+    if (response.status === 404) {
+        return new DeployDomainsError(`This company does not own ${displayText(domain)}. Run 'hq deploy domains owned' to see purchased domains.`, error.code === "HTTP_404" ? "DOMAIN_NOT_OWNED" : error.code, response.status);
+    }
+    return error;
+}
+async function ownedAction(options) {
+    const token = await ensureCognitoToken();
+    const companyUid = await purchaseCompanyUid(token, purchaseSlug(options.company));
+    const response = await purchaseRequest(token, companyUid, "/domains", undefined, "GET");
+    if (!response.ok)
+        throw await purchaseError(response);
+    const body = await readBody(response);
+    const domains = requireObjectList(body.domains, "HQ did not return the purchased-domain list. Run 'hq deploy domains owned' again in a minute.");
+    if (options.json) {
+        console.log(safeJson(body));
+        return;
+    }
+    if (domains.some((item) => item.testMode === true))
+        console.log(TEST_MODE_LABEL);
+    if (domains.length === 0) {
+        console.log("No purchased domains.");
+        return;
+    }
+    for (const domain of domains)
+        console.log(ownedLine(domain));
+}
+async function showAction(domainArg, options) {
+    const domain = normalizeDomain(domainArg);
+    const token = await ensureCognitoToken();
+    const companyUid = await purchaseCompanyUid(token, purchaseSlug(options.company));
+    const response = await purchaseRequest(token, companyUid, `/domains/${encodeURIComponent(domain)}`, undefined, "GET");
+    if (!response.ok)
+        throw await ownedDomainError(response, domain);
+    const body = await readBody(response);
+    if (options.json) {
+        console.log(safeJson(body));
+        return;
+    }
+    printDomainDetail(body);
+}
+async function renewAction(domainArg, autoRenew, options) {
+    const domain = normalizeDomain(domainArg);
+    const slug = purchaseSlug(options.company);
+    requireConfirmable(options.yes, "change automatic renewal");
+    const token = await ensureCognitoToken();
+    const companyUid = await purchaseCompanyUid(token, slug);
+    const detailResponse = await purchaseRequest(token, companyUid, "/domains/" + encodeURIComponent(domain), undefined, "GET");
+    if (!detailResponse.ok)
+        throw await ownedDomainError(detailResponse, domain);
+    const detail = await readBody(detailResponse);
+    const pricing = await fetchPricingBody();
+    const terms = purchaseTermsLine(pricing);
+    const cents = detail.renewalPriceCents;
+    const currency = detail.currency;
+    const amount = moneyFromCents(cents, currency);
+    if (typeof cents !== "number" || !Number.isSafeInteger(cents) || cents < 0 || currency !== "USD" || !amount || !terms) {
+        throw new DeployDomainsError("Could not load complete USD renewal terms. Nothing was changed. Try again later.", "RENEWAL_TERMS_UNAVAILABLE");
+    }
+    const nextRenewal = detail.nextRenewalAt ?? detail.expiresAt;
+    const summary = [
+        "Turn auto-renew " + (autoRenew ? "on" : "off") + " for " + displayText(domain) + " for the company '" + displayText(slug) + "'?",
+        "Registrar renewal: " + amount + " USD per year.",
+        terms,
+        typeof nextRenewal === "string" ? "Next renewal: " + displayText(nextRenewal) : "Next renewal date: unavailable.",
+    ].join("\n");
+    if (options.yes)
+        console.error(summary);
+    await confirm(summary, options.yes, "change automatic renewal", ["y", "yes"]);
+    const response = await purchaseRequest(token, companyUid, `/domains/${encodeURIComponent(domain)}`, { autoRenew }, "PATCH");
+    if (!response.ok)
+        throw await ownedDomainError(response, domain);
+    const body = await readBody(response);
+    if (options.json) {
+        console.log(safeJson(body));
+        return;
+    }
+    console.log(autoRenew
+        ? `Auto-renew is on for ${displayText(domain)}.`
+        : `Auto-renew is off for ${displayText(domain)}. It will not renew.`);
+}
+// ---------------------------------------------------------------------------
+// DNS records on a purchased zone (hq-deploy)
+const RECORD_TYPES = new Set(["A", "AAAA", "CNAME", "MX", "TXT", "SRV", "CAA"]);
+const RECORD_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/;
+function collectRepeated(value, previous) {
+    return [...previous, value];
+}
+function parseRecordType(raw) {
+    const type = raw.trim().toUpperCase();
+    if (!RECORD_TYPES.has(type)) {
+        throw new DeployDomainsError("Record type must be A, AAAA, CNAME, MX, TXT, SRV, or CAA. Check the type and run the command again.", "RECORD_INVALID");
+    }
+    return type;
+}
+function parseRecordName(raw) {
+    const name = raw.trim();
+    if (!name || /[\s/\\]/.test(name) || name.length > 253) {
+        throw new DeployDomainsError("Pass a DNS name, such as www or the full domain. It cannot contain spaces. Check the name and run the command again.", "RECORD_INVALID");
+    }
+    return name;
+}
+function parseTtl(raw) {
+    if (raw === undefined)
+        return undefined;
+    if (!/^\d+$/.test(raw.trim())) {
+        throw new DeployDomainsError("--ttl must be a whole number of seconds, from 0 to 2147483647. Check it and run the command again.", "RECORD_INVALID");
+    }
+    const ttl = Number(raw.trim());
+    if (ttl > 2_147_483_647) {
+        throw new DeployDomainsError("--ttl must be a whole number of seconds, from 0 to 2147483647. Check it and run the command again.", "RECORD_INVALID");
+    }
+    return ttl;
+}
+function parseRecordValues(values, required) {
+    if (!required && (!values || values.length === 0))
+        return undefined;
+    const parsed = (values ?? []).map((value) => value.trim()).filter((value) => value.length > 0);
+    if (parsed.length === 0) {
+        throw new DeployDomainsError("Pass at least one --value. Check the record and run the command again.", "RECORD_INVALID");
+    }
+    return parsed;
+}
+function parseRecordId(raw) {
+    const id = raw.trim();
+    if (!RECORD_ID_PATTERN.test(id)) {
+        throw new DeployDomainsError("That record id is not valid. Run 'hq deploy domains records list <domain>' and pass --record with an id from the list.", "RECORD_INVALID");
+    }
+    return id;
+}
+function recordsRoute(orgSlug, domain, recordId) {
+    const base = `/api/orgs/${encodeURIComponent(orgSlug)}/purchased-domains/${encodeURIComponent(domain)}/records`;
+    return recordId ? `${base}/${encodeURIComponent(recordId)}` : base;
+}
+async function recordsError(response, orgSlug, domain) {
+    const body = await readBody(response.clone());
+    const code = apiCode(body, response.status);
+    const serverMessage = apiField(body, "message");
+    if (code === "RECORD_LOCKED") {
+        return new DeployDomainsError("That record is locked by HQ because it serves the domain or validates the certificate. It cannot be changed. Add a different name, or edit a record you created.", code, response.status);
+    }
+    if (code === "APEX_CNAME") {
+        return new DeployDomainsError("A CNAME cannot be added at the domain itself. Use an A or AAAA record at the apex, or add the CNAME on a name under the domain.", code, response.status);
+    }
+    if (code === "RECORD_EXISTS") {
+        return new DeployDomainsError("That record already exists. Edit it with records set, or delete it first.", code, response.status);
+    }
+    if (code === "RECORD_INVALID") {
+        const detail = typeof serverMessage === "string" && serverMessage.trim()
+            ? displayText(serverMessage.trim())
+            : "That record is not valid.";
+        const message = /try again|run the command/i.test(detail)
+            ? detail
+            : `${detail} Check the type, name, and value, then run the command again.`;
+        return new DeployDomainsError(message, code, response.status);
+    }
+    if (response.status === 404) {
+        return new DeployDomainsError(`HQ could not find ${displayText(domain)} or that record in '${orgSlug}'. Run 'hq deploy domains owned' to see purchased domains, or 'hq deploy domains records list ${displayText(domain)}' to see records.`, code === "HTTP_404" ? "DOMAIN_NOT_OWNED" : code, response.status);
+    }
+    if (response.status === 401) {
+        return new DeployDomainsError("hq-deploy rejected your sign-in. Run 'hq login' and retry.", code, response.status);
+    }
+    if (response.status === 403) {
+        return new DeployDomainsError("Only a company owner or admin can change DNS records on a purchased domain. Ask an admin to do it.", code, response.status);
+    }
+    return new DeployDomainsError(`The DNS record request failed (HTTP ${response.status}). Try again in a minute.`, code, response.status);
+}
+function lockMarker(record) {
+    if (record.locked !== true)
+        return "";
+    if (record.lockedReason === "serving" || record.lockedReason === "validation") {
+        return `  [locked: ${record.lockedReason}]`;
+    }
+    return "  [locked]";
+}
+function recordValuesText(record) {
+    if (!Array.isArray(record.values))
+        return "";
+    return record.values
+        .filter((value) => typeof value === "string")
+        .map((value) => displayText(value))
+        .join(", ");
+}
+async function recordsListAction(domainArg, options) {
+    const domain = normalizeDomain(domainArg);
+    const token = await ensureCognitoToken();
+    const orgSlug = purchaseSlug(options.company);
+    const response = await request(token, orgSlug, recordsRoute(orgSlug, domain), "GET");
+    if (!response.ok)
+        throw await recordsError(response, orgSlug, domain);
+    const body = await readBody(response);
+    const records = requireObjectList(body.records, `HQ did not return the DNS records for ${displayText(domain)}. Run 'hq deploy domains records list ${displayText(domain)}' again in a minute.`);
+    if (options.json) {
+        console.log(safeJson(body));
+        return;
+    }
+    const nameservers = Array.isArray(body.nameservers)
+        ? body.nameservers.filter((item) => typeof item === "string")
+        : [];
+    if (nameservers.length > 0) {
+        console.log("Nameservers:");
+        for (const nameserver of nameservers)
+            console.log(`  ${displayText(nameserver)}`);
+    }
+    if (records.length === 0) {
+        console.log("No DNS records on this domain.");
+        return;
+    }
+    for (const record of records) {
+        const id = typeof record.id === "string" && record.id !== "" ? `${displayText(record.id)}  ` : "";
+        console.log(`  ${id}${displayText(record.type)}  ${displayText(record.name)}  ->  ${recordValuesText(record)}${lockMarker(record)}`);
+    }
+}
+async function recordsAddAction(domainArg, options) {
+    const domain = normalizeDomain(domainArg);
+    if (!options.type || !options.name) {
+        throw new DeployDomainsError("Pass --type and --name. Example: hq deploy domains records add example.com --type TXT --name _verify --value hello", "RECORD_INVALID");
+    }
+    const type = parseRecordType(options.type);
+    const name = parseRecordName(options.name);
+    const values = parseRecordValues(options.value, true);
+    const ttl = parseTtl(options.ttl);
+    const token = await ensureCognitoToken();
+    const orgSlug = purchaseSlug(options.company);
+    const response = await request(token, orgSlug, recordsRoute(orgSlug, domain), "POST", {
+        name,
+        type,
+        values,
+        ...(ttl === undefined ? {} : { ttl }),
+    });
+    if (!response.ok)
+        throw await recordsError(response, orgSlug, domain);
+    const body = await readBody(response);
+    if (options.json) {
+        console.log(safeJson(body));
+        return;
+    }
+    console.log(`Added ${type} ${displayText(name)} to ${displayText(domain)}.`);
+}
+async function resolveRecordId(token, orgSlug, domain, options) {
+    if (options.record && (options.name || options.type)) {
+        throw new DeployDomainsError("Pass either --record or --name with --type, not both. Nothing was changed.", "RECORD_INVALID");
+    }
+    if (options.record)
+        return parseRecordId(options.record);
+    if (!options.name || !options.type) {
+        throw new DeployDomainsError("Pass --record <id>, or both --name and --type. Run 'hq deploy domains records list <domain>' to see ids.", "RECORD_INVALID");
+    }
+    const type = parseRecordType(options.type);
+    const name = parseRecordName(options.name);
+    const response = await request(token, orgSlug, recordsRoute(orgSlug, domain), "GET");
+    if (!response.ok)
+        throw await recordsError(response, orgSlug, domain);
+    const body = await readBody(response);
+    const records = Array.isArray(body.records)
+        ? body.records.filter((item) => typeof item === "object" && item !== null)
+        : [];
+    const matches = records.filter((record) => String(record.type ?? "").toUpperCase() === type
+        && String(record.name ?? "").toLowerCase() === name.toLowerCase());
+    if (matches.length === 0) {
+        throw new DeployDomainsError(`No ${type} record named ${displayText(name)} on ${displayText(domain)}. Run 'hq deploy domains records list ${displayText(domain)}' to see records.`, "RECORD_NOT_FOUND");
+    }
+    if (matches.length > 1) {
+        throw new DeployDomainsError(`More than one ${type} record is named ${displayText(name)}. Pass --record <id> from 'hq deploy domains records list ${displayText(domain)}'.`, "RECORD_AMBIGUOUS");
+    }
+    const id = matches[0]?.id;
+    if (typeof id !== "string" || !RECORD_ID_PATTERN.test(id)) {
+        throw new DeployDomainsError("HQ could not read that record's id. Run 'hq deploy domains records list' and pass --record <id>.", "RECORD_INVALID");
+    }
+    return id;
+}
+async function recordsSetAction(domainArg, options) {
+    const domain = normalizeDomain(domainArg);
+    const ttl = parseTtl(options.ttl);
+    const values = parseRecordValues(options.value, false);
+    if (ttl === undefined && values === undefined) {
+        throw new DeployDomainsError("Pass --ttl or at least one --value to change the record. Nothing was changed.", "RECORD_INVALID");
+    }
+    const token = await ensureCognitoToken();
+    const orgSlug = purchaseSlug(options.company);
+    const recordId = await resolveRecordId(token, orgSlug, domain, options);
+    const response = await request(token, orgSlug, recordsRoute(orgSlug, domain, recordId), "PATCH", {
+        ...(ttl === undefined ? {} : { ttl }),
+        ...(values === undefined ? {} : { values }),
+    });
+    if (!response.ok)
+        throw await recordsError(response, orgSlug, domain);
+    const body = await readBody(response);
+    if (options.json) {
+        console.log(safeJson(body));
+        return;
+    }
+    console.log(`Updated record ${displayText(recordId)} on ${displayText(domain)}.`);
+}
+async function recordsDeleteAction(domainArg, options) {
+    const domain = normalizeDomain(domainArg);
+    const token = await ensureCognitoToken();
+    const orgSlug = purchaseSlug(options.company);
+    const recordId = await resolveRecordId(token, orgSlug, domain, options);
+    const response = await request(token, orgSlug, recordsRoute(orgSlug, domain, recordId), "DELETE");
+    if (!response.ok)
+        throw await recordsError(response, orgSlug, domain);
+    if (options.json) {
+        const body = await readBody(response);
+        console.log(safeJson({ ok: true, recordId, ...body }));
+        return;
+    }
+    console.log(`Deleted record ${displayText(recordId)} on ${displayText(domain)}.`);
 }
 // ---------------------------------------------------------------------------
 // Registration
@@ -981,9 +1627,9 @@ function targetOptions(command) {
 export function registerDeployDomainsCommand(deploy) {
     const domains = deploy
         .command("domains")
-        .description("Manage custom domains on your deployed apps, and buy domains")
-        .addHelpText("after", "\nadd, remove and buy ask for approval in an interactive terminal. Without one (a script, CI, " +
-        "or a Windows shell that does not report a terminal, such as Git Bash under mintty), pass --yes.");
+        .description("Manage custom domains on your deployed apps, buy domains, and edit their DNS")
+        .addHelpText("after", "\nadd, remove and buy ask for approval in an interactive terminal. buy accepts y or --yes. " +
+        "Without a terminal (a script, CI, or a Windows shell that does not report a terminal, such as Git Bash under mintty), pass --yes.");
     targetOptions(domains.command("list").description("List the custom domains on an app"))
         .action((options) => run(options.json, () => listAction(options)));
     targetOptions(domains
@@ -1019,21 +1665,59 @@ export function registerDeployDomainsCommand(deploy) {
         .command("remove")
         .description("Release the company deploy domain")
         .option("--yes", "remove without a prompt")).action((options) => run(options.json, () => baseRemoveAction(options)));
-    domains
-        .command("search <query>")
-        .description("Check whether a domain can be bought, and its price")
+    const purchaseOptions = (command) => command
         .option("--company <slug>", "use this company instead of the active company")
-        .option("--json", "print machine-readable JSON")
-        .action((query, options) => run(options.json, () => searchAction(query, options)));
+        .option("--json", "print machine-readable JSON");
+    purchaseOptions(domains
+        .command("search <query>")
+        .description("Check whether a domain can be bought, with availability and registrar prices")).action((query, options) => run(options.json, () => searchAction(query, options)));
     domains
         .command("buy <domain>")
-        .description("Buy a domain for the company (owner or admin)")
-        .requiredOption("--price <usd>", "first-year price shown by 'hq deploy domains search'")
+        .description("Buy a domain for the company and say what it is for (owner or admin)")
+        .requiredOption("--use <use>", "what the domain is for: app:<app id>, base, or hold")
+        .requiredOption("--price <usd>", "first-year registrar price shown by 'hq deploy domains search'")
         .requiredOption("--registrant-file <path>", "JSON file with the registrant contact")
         .option("--idempotency-key <key>", "retry an earlier order that did not finish")
         .option("--company <slug>", "use this company instead of the active company")
-        .option("--yes", "buy without a prompt")
+        .option("--yes", "buy without a prompt, after you have read the transfer lock and final-purchase notice")
         .option("--json", "print machine-readable JSON")
         .action((domain, options) => run(options.json, () => buyAction(domain, options)));
+    purchaseOptions(domains.command("owned").description("List domains this company bought")).action((options) => run(options.json, () => ownedAction(options)));
+    purchaseOptions(domains
+        .command("show <domain>")
+        .description("Show one purchased domain, including nameservers and events")).action((domain, options) => run(options.json, () => showAction(domain, options)));
+    const renew = domains
+        .command("renew")
+        .description("Turn automatic renewal off or back on for a purchased domain");
+    purchaseOptions(renew.command("cancel <domain>").description("Stop automatic renewal for a purchased domain").option("--yes", "Confirm the billing setting change")).action((domain, options) => run(options.json, () => renewAction(domain, false, options)));
+    purchaseOptions(renew.command("resume <domain>").description("Turn automatic renewal back on for a purchased domain").option("--yes", "Confirm the billing setting change")).action((domain, options) => run(options.json, () => renewAction(domain, true, options)));
+    const records = domains
+        .command("records")
+        .description("Manage DNS records on a domain this company bought");
+    const recordOptions = (command) => command
+        .option("--company <slug>", "use this company instead of the active company")
+        .option("--json", "print machine-readable JSON");
+    recordOptions(records.command("list <domain>").description("List DNS records, marking the ones HQ has locked")).action((domain, options) => run(options.json, () => recordsListAction(domain, options)));
+    recordOptions(records
+        .command("add <domain>")
+        .description("Add a DNS record")
+        .requiredOption("--type <type>", "A, AAAA, CNAME, MX, TXT, SRV, or CAA")
+        .requiredOption("--name <name>", "record name, such as www or the full domain")
+        .option("--value <value>", "record value (repeat for more than one)", collectRepeated, [])
+        .option("--ttl <seconds>", "time to live in seconds")).action((domain, options) => run(options.json, () => recordsAddAction(domain, options)));
+    recordOptions(records
+        .command("set <domain>")
+        .description("Change a DNS record by id, or by name and type")
+        .option("--record <id>", "record id from 'hq deploy domains records list'")
+        .option("--name <name>", "record name, together with --type")
+        .option("--type <type>", "record type, together with --name")
+        .option("--value <value>", "replacement value (repeat for more than one)", collectRepeated, [])
+        .option("--ttl <seconds>", "replacement time to live in seconds")).action((domain, options) => run(options.json, () => recordsSetAction(domain, options)));
+    recordOptions(records
+        .command("delete <domain>")
+        .description("Delete a DNS record by id, or by name and type")
+        .option("--record <id>", "record id from 'hq deploy domains records list'")
+        .option("--name <name>", "record name, together with --type")
+        .option("--type <type>", "record type, together with --name")).action((domain, options) => run(options.json, () => recordsDeleteAction(domain, options)));
 }
 //# sourceMappingURL=deploy-domains.js.map