ninepm 0.69.0 → 0.78.0

package/README.md

@@ -62,6 +62,8 @@ Deploy a static directory:
 9pm deploy . --name my-app --slug my-app
 ```
 
+Deploying again under the same slug replaces the live app. To try a change without touching it, deploy under a different slug, which creates a separate app at its own address. On Free, your one app slot can't also hold a separate preview app. Deploying to your existing app updates its live version. Practice mode rehearses the current app's workflow. Testing a changed version separately requires another app slot: a plan with more apps (Hobby allows 3).
+
 ### How long an app's address stays the same
 
 Check this before printing a link or QR code. The live URL is `<slug>-<suffix>.9pm.ai`, and the suffix comes from the app's internal id, not from the slug:
@@ -71,6 +73,19 @@ Check this before printing a link or QR code. The live URL is `<slug>-<suffix>.9
 - There is no rename: a different address means a different app.
 - A custom domain you own, added on the dashboard's Domains page, gives the app an address of your own. Not every plan includes custom domains.
 
+### Pages that do not exist
+
+A static site or `--entry` worker app answers a path that has no file in one of two ways. Every deploy prints which, as a `Missing pages:` line.
+
+- `--no-spa` (the default for new apps): the path returns status 404, with the deploy's own `404.html` when it has one. `/` still serves `index.html`, and extensionless links work: `/menu` serves `menu.html`, or redirects to `/menu/` when only `menu/index.html` exists, and `/menu/` serves `menu/index.html`. Right for a multi-page site, where a removed or mistyped page should say "not found" rather than show the homepage.
+- `--spa`: every path with no file serves `index.html`, so a single-page app that routes in the browser loads on a deep link or a refresh. That includes dotted paths such as `/users/jane.smith` and missing files such as `/missing.json`, which get the app's shell rather than a 404.
+
+```sh
+9pm deploy ./dist --name my-spa --spa
+```
+
+The app remembers the choice: a deploy without either flag keeps it, and a deploy that fails to publish leaves the previous choice in place. Apps created before this choice existed keep serving `index.html` for every unmatched path until a deploy passes one of the flags. A worker app's own `Response`, a 404 included, is always returned as it is. The flags do not apply to `--bundle` or container apps.
+
 Deploy a built framework output directory:
 
 ```sh
@@ -152,12 +167,14 @@ The app's address goes with it: creating an app again under the same slug gives
 
 Apps are public by default.
 
+Changing an app's access mode needs `--switch-mode`. Without it the command changes nothing and prints what the change would do (who loses access, what happens to the app's custom domains) and the command to re-run. Service-token mode locks every person out and removes the app's custom domains; leaving it sets them up again with new DNS records to publish. Creating another service token on an app already in service-token mode needs no flag.
+
 One-time PIN with email/domain allowlist:
 
 ```sh
 9pm access allow email my-app dev@example.com
 9pm access allow domain my-app example.com
-9pm access otp my-app
+9pm access otp my-app --switch-mode
 9pm access revoke email my-app dev@example.com
 9pm access revoke domain my-app example.com
 ```
@@ -165,19 +182,19 @@ One-time PIN with email/domain allowlist:
 Identity provider access:
 
 ```sh
-9pm access idp my-app --provider google
+9pm access idp my-app --provider google --switch-mode
 ```
 
 Machine access:
 
 ```sh
-9pm access service create my-app --name backend
+9pm access service create my-app --name backend --switch-mode
 ```
 
 Return to public:
 
 ```sh
-9pm access public my-app
+9pm access public my-app --switch-mode
 ```
 
 Create an app-scoped runtime token for server-side allowlist management:
@@ -189,11 +206,61 @@ Create an app-scoped runtime token for server-side allowlist management:
 Use `9pm_app_...` runtime tokens only from server-side code. They can list, add, and remove email/domain grants for one app. They cannot deploy, create databases, create API keys, or manage another app.
 Service token secrets returned by `access service create` are also server-side secrets.
 
+## Custom Domains
+
+Connect a domain you own to an app:
+
+```sh
+9pm domains add my-app www.example.com
+```
+
+This prints the DNS records to publish at your DNS provider, with names relative to your
+domain (`www`, `_acme-challenge.www`) and what DNS shows for each right now. When a TXT value
+is missing, add it as its own TXT record; other TXT values on that name can stay. The root of
+your domain (`@`) cannot hold a CNAME, so a root domain is shown as an `ALIAS` record: add it as
+ALIAS or ANAME (or a CNAME your provider flattens). A correct ALIAS answers with addresses, which
+cannot be compared from outside, so that row follows the platform's own routing check. Then:
+
+```sh
+9pm domains wait my-app www.example.com
+```
+
+`wait` exits `0` once the domain is live, `10` if it timed out while you have something to do (a
+record is missing or could not be checked, or a CAA record blocks the certificate even though every
+record is found), `11` if it timed out with every record checked and found and nothing left for you
+(the platform is still finishing; wait again), `20` if the domain failed or expired, and `1` on a
+usage, sign-in or API error. Since 0.74.0 a CAA block exits `10`; earlier versions exited `11`. Since 0.77.0 a bare domain whose DNS host cannot point a root
+domain at a hostname (GoDaddy, Route 53, IONOS, Wix) makes `wait` stop at once with `10`: its `next`
+is `use_www` with the `www` hostname to add instead, since no record at the root can finish it.
+`9pm domains status <app> <hostname> --json` prints `{hostname, app, state, reason, next, routing,
+tls, provider, providerId, nameservers, zone, records, advisories, error, expiresAt, checkedAt}`, where `provider` is
+the DNS host (where the nameservers point, not necessarily where the domain was bought), `reason` says why
+(`reason.providerMessage` carries the provider's own words when it reported any, with `source`
+saying whether they are the certificate authority's),
+`next` says who acts next and what to do, and `state` is `live`,
+`waiting_for_dns`, `dns_unverified` (routing is active but the records could not be checked),
+`issuing_certificate`, `failed` or `expired`. Each record's `ok` is `null` when the check cannot
+say, and its `check` says why (`not_checked`, or `apex_addresses`). A record whose value was found
+at the name with the domain typed twice (`_acme-challenge.www.example.com.example.com`) has
+`check: "doubled"` and `doubledAt`: enter only the short name shown. `advisories` lists hints that
+the hostname may be a typo, such as a domain that is not in DNS; the domain is added either way.
+Since 0.78.0 each record also carries `typeAtProvider`, `nameAtProvider` (`""` means leave the Host
+field empty) and `valueAtProvider`: the record as a recognised DNS host's editor wants it.
+`typeAtProvider` is `null` for a root record the host cannot hold (GoDaddy, Route 53, IONOS, Wix);
+the text output then suggests connecting `www` instead. `list`, `status` and `wait`
+only read; `add`, `check`, `restart` and `remove` need permission to configure the app.
+
+Every `9pm deploy` lists the app's custom domains under its `Deployed` line: `Also serving at
+https://<domain>` for a live one, and for any other its state and the `9pm domains status`
+command to run. If the domains cannot be read within a few seconds, the deploy says so in one
+line instead; the deploy itself is never held back by it. `9pm delete` names the custom domains
+it removed.
+
 ## Commands
 
 ```sh
 9pm --version
-9pm deploy [directory] --name <name> [--slug <slug>] [--with-db]
+9pm deploy [directory] --name <name> [--slug <slug>] [--spa | --no-spa] [--with-db]
 9pm deploy [directory] --check [--runtime worker --entry <path> (--assets <dir> | --no-assets)]
 9pm deploy [directory] --runtime container --port 8080 [--health-path /health] [--region auto] [--with-db]
 9pm signup
@@ -208,17 +275,24 @@ Service token secrets returned by `access service create` are also server-side s
 9pm files get <file-id> [--output <path>] [--project <site>]
 9pm files share <file-id> [--expires 24h] [--public] [--project <site>]
 9pm files delete <file-id> [--project <site>]
-9pm deploy [directory] --runtime worker --entry <path> (--assets <dir> | --no-assets) [--with-db]
+9pm deploy [directory] --runtime worker --entry <path> (--assets <dir> | --no-assets) [--spa | --no-spa] [--with-db]
 9pm delete <site> --confirm <slug>
+9pm domains list [<app>] [--owner <organisation>] [--json]
+9pm domains add <app> <hostname> [--json]
+9pm domains status <app> <hostname> [--json]
+9pm domains check <app> <hostname> [--json]
+9pm domains wait <app> <hostname> [--timeout 30m] [--interval 20s] [--json]
+9pm domains restart <app> <hostname>          # only after a certificate failed; record values may change
+9pm domains remove <app> <hostname> --confirm <hostname>
 9pm access show <site>
-9pm access public <site>
-9pm access otp <site>
-9pm access idp <site> [--provider google|github|entra]
+9pm access public <site> [--switch-mode]
+9pm access otp <site> [--switch-mode]
+9pm access idp <site> [--provider google|github|entra] [--switch-mode]
 9pm access allow email <site> <email>
 9pm access allow domain <site> <domain>
 9pm access revoke email <site> <email>
 9pm access revoke domain <site> <domain>
-9pm access service create <site> [--name <name>] [--duration 8760h]
+9pm access service create <site> [--name <name>] [--duration 8760h] [--switch-mode]
 9pm access service revoke <site> <service-token-id>
 9pm access token create <site> [--name <name>]
 9pm access token revoke <site> <token-id>
@@ -240,6 +314,8 @@ Options:
 - `--entry <path>` selects the Worker runtime server entry file
 - `--assets <dir>` makes only that directory of a worker deploy public (remembered for later deploys)
 - `--no-assets` makes no file of a worker deploy public (remembered for later deploys)
+- `--spa` serves `index.html` for every path that has no file, for single-page apps (remembered for later deploys)
+- `--no-spa` returns 404 for a path that has no file, with the deploy's `404.html` when present; the default for new apps (remembered for later deploys)
 - `--port <port>` selects the HTTP port exposed by a container app
 - `--health-path <path>` optionally lets 9pm.ai check container health before marking it healthy
 - `--region <region>` optionally selects provider-neutral container placement

package/dist/cli-types.d.ts

@@ -8,6 +8,7 @@ export type AppRuntime = "static" | "worker" | "container";
 export type ContainerRegion = "auto" | "us-east" | "us-west" | "europe" | "asia" | "south-america" | "middle-east" | "oceania" | "africa";
 export type ManagedFileScope = "user" | "project";
 export type ManagedFileShareMode = "public" | "login_required";
+export type MissingPagesMode = "legacy" | "spa" | "404";
 export interface Project {
     id: string;
     name: string;
@@ -16,6 +17,7 @@ export interface Project {
     createdAt: string;
     updatedAt: string;
     workerPublicAssets?: string | null;
+    missingPages?: MissingPagesMode;
 }
 export interface AppUserFilesUsage {
     usedBytes: number;

package/dist/dns-host.d.ts

@@ -0,0 +1,15 @@
+/** A best guess at the zone a custom hostname lives in: `www.tmrwtitans.com` -> `tmrwtitans.com`. */
+export declare function guessZoneApex(hostname: string): string;
+/**
+ * The record name the way most registrars' Host field wants it, relative to the zone:
+ * `www.tmrwtitans.com` -> `www`, the apex itself -> `@`. A name outside the zone stays whole.
+ */
+export declare function relativeRecordName(recordHost: string, apex: string): string;
+/**
+ * The zone a hostname's records go in: the zone the DNS check found by walking up to the first
+ * name that answers NS, when it has one, otherwise the guess. The found zone is used only when
+ * the hostname is inside it and it is no shorter than the guess: a shorter one (`co.uk`) means
+ * the walk climbed past a domain that does not exist, which says nothing about where its
+ * records would go.
+ */
+export declare function zoneApexFor(hostname: string, checkedZone?: unknown): string;

package/dist/dns-host.js

@@ -0,0 +1,43 @@
+// AUTO-GENERATED by scripts/generate-cli-package.mjs from the in-repo CLI source -- do not edit.
+// Edit src/cli or src/shared instead; this is regenerated on typecheck/test/build/pack.
+// Record names for a custom domain's DNS instructions, written the way a registrar's Host
+// field wants them. Read by the dashboard's DNS table and by `9pm domains`, and copied into
+// the CLI tarball by scripts/generate-cli-package.mjs, so it must import nothing.
+// Second-level labels that sit under a two-letter country code as part of the public suffix
+// (example.co.uk, example.com.au). Not a public suffix list: it covers the common shapes, and
+// the full name is always shown beside the short one for the cases it misses.
+const SECOND_LEVEL = new Set(["co", "com", "net", "org", "gov", "ac", "edu", "ne", "or", "go"]);
+/** A best guess at the zone a custom hostname lives in: `www.tmrwtitans.com` -> `tmrwtitans.com`. */
+export function guessZoneApex(hostname) {
+    const labels = hostname.toLowerCase().replace(/\.$/, "").split(".");
+    if (labels.length >= 3 && SECOND_LEVEL.has(labels[labels.length - 2]) && labels[labels.length - 1].length === 2) {
+        return labels.slice(-3).join(".");
+    }
+    return labels.slice(-2).join(".");
+}
+/**
+ * The record name the way most registrars' Host field wants it, relative to the zone:
+ * `www.tmrwtitans.com` -> `www`, the apex itself -> `@`. A name outside the zone stays whole.
+ */
+export function relativeRecordName(recordHost, apex) {
+    const host = recordHost.toLowerCase().replace(/\.$/, "");
+    if (host === apex)
+        return "@";
+    return host.endsWith(`.${apex}`) ? host.slice(0, -(apex.length + 1)) : host;
+}
+/**
+ * The zone a hostname's records go in: the zone the DNS check found by walking up to the first
+ * name that answers NS, when it has one, otherwise the guess. The found zone is used only when
+ * the hostname is inside it and it is no shorter than the guess: a shorter one (`co.uk`) means
+ * the walk climbed past a domain that does not exist, which says nothing about where its
+ * records would go.
+ */
+export function zoneApexFor(hostname, checkedZone) {
+    const guess = guessZoneApex(hostname);
+    if (typeof checkedZone !== "string" || checkedZone === "")
+        return guess;
+    const host = hostname.toLowerCase().replace(/\.$/, "");
+    const zone = checkedZone.toLowerCase().replace(/\.$/, "");
+    const inside = host === zone || host.endsWith(`.${zone}`);
+    return inside && zone.split(".").length >= guess.split(".").length ? zone : guess;
+}

package/dist/dns-providers.d.ts

@@ -0,0 +1,91 @@
+export declare const DNS_PROVIDER_SOURCE = "registrars-and-dns-automation.md, 2026-10-09 (Route 53 rechecked 2026-10-13)";
+/** What can stand in for a root-domain record when the host cannot point the root at a hostname. */
+export type ApexFallback = 
+/** Connect www.<zone> to the app instead: an ordinary CNAME, always possible. */
+{
+    kind: "use_www";
+}
+/** The host's own forwarding of the root to www. Unverified: mentioned as a possibility, never as a step. */
+ | {
+    kind: "provider_forwarding";
+    verified: boolean;
+    https: "yes" | "unverified";
+}
+/** Route 53 only: an S3 redirect bucket behind CloudFront, aliased at the root. AWS-documented, not tested by us. */
+ | {
+    kind: "aws_redirect";
+}
+/** Move DNS hosting to a host that offers ALIAS or flattening, copying every existing record first. */
+ | {
+    kind: "move_dns_host";
+};
+export type ApexSupport = {
+    support: "alias";
+    typeLabel: "ALIAS" | "ANAME";
+    hostField: "blank" | "@";
+} | {
+    support: "cname_flattening";
+    typeLabel: "CNAME";
+    hostField: "@";
+}
+/**
+ * `fallbacks` is ordered and always starts with use_www. `hostField` is the root's Host
+ * convention where the source states one, used only when routing is already active and the
+ * root row is shown after all; absent means `@`.
+ */
+ | {
+    support: "none";
+    fallbacks: ApexFallback[];
+    hostField?: "blank";
+};
+/** A note shown under the "your DNS is at" line. Only verified notes are rendered. */
+export interface DnsProviderNote {
+    id: string;
+    verified: boolean;
+}
+export interface DnsProviderProfile {
+    apex: ApexSupport;
+    /**
+     * Whether the editor appends the zone to the name typed. True: the full name is never
+     * offered, since typing it creates `www.example.com.example.com`. "unknown" keeps showing it.
+     */
+    appendsZone: true | false | "unknown";
+    /** The editor makes a hostname value relative unless it ends in a dot (Gandi). */
+    valueNeedsTrailingDot?: true;
+    notes: DnsProviderNote[];
+    source: string;
+}
+export interface DnsProvider {
+    /** Stable key, sent as `dnsCheck.providerId`; the display name may change. */
+    id: string;
+    /** What `dnsCheck.provider` says. */
+    name: string;
+    nameservers: RegExp[];
+    /** Absent for a host nobody has researched: it is named, and gets the generic instructions. */
+    profile?: DnsProviderProfile;
+}
+export declare const DNS_PROVIDERS: readonly DnsProvider[];
+/** The DNS host a zone's nameservers belong to, or null for one not in the table. Entries that are not names are skipped. */
+export declare function dnsProviderForNameservers(nameservers: readonly unknown[]): DnsProvider | null;
+/** The profile for a `dnsCheck.providerId`; undefined for an unknown id or a host with no profile. */
+export declare function dnsProviderProfile(providerId: unknown): DnsProviderProfile | undefined;
+/** How one routing or TXT record is entered at a given host. */
+export interface RecordAtProvider {
+    /** The record type the host's editor calls it; null when the host cannot hold it at all (a root record at a no-ALIAS host). */
+    type: string | null;
+    /** The name to type; "" means leave the Host field empty. */
+    name: string;
+    /** The value to type, with a trailing dot where the editor needs one. */
+    value: string;
+}
+/**
+ * The record as the host's editor wants it. `apex` is whether this is the routing record at
+ * the zone root; `name` is the relative name (`@` at the root). Without a profile this is the
+ * record unchanged, with the root's type named the way every host that can hold it does.
+ */
+export declare function recordAtProvider(record: {
+    type: string;
+    name: string;
+    value: string;
+    apex: boolean;
+}, profile: DnsProviderProfile | undefined): RecordAtProvider;

package/dist/dns-providers.js

@@ -0,0 +1,194 @@
+// AUTO-GENERATED by scripts/generate-cli-package.mjs from the in-repo CLI source -- do not edit.
+// Edit src/cli or src/shared instead; this is regenerated on typecheck/test/build/pack.
+// DNS hosts: how each is recognised from the nameservers a custom domain's zone answers with,
+// and, for the ones researched, how its record editor wants the records we ask for. Detection
+// and profiles live in one table so a host can never be named without the rules that follow
+// from it. Read by the control plane's DNS check, the dashboard and `9pm domains`, and copied
+// into the CLI tarball by scripts/generate-cli-package.mjs, so it must import nothing.
+//
+// Every rule is a property of the DNS HOST (where the nameservers point), never the registrar:
+// records only take effect at the host, whoever sold the domain.
+//
+// Facts come from the BYOD walkthrough's research note (registrars-and-dns-automation.md,
+// researched 2026-10-09 from each provider's help center; the Route 53 row rechecked against
+// AWS's docs on 2026-10-13). That note is not in this repository, so each row cites the
+// provider's own page it relied on, and keeps the note's verified/unverified marks. A fact the note marks unverified or
+// inferred is used only where being wrong is harmless: it never removes information (an
+// "unknown" appendsZone keeps the full-name line) and never becomes a button or a step.
+// Re-check the source before widening any row.
+export const DNS_PROVIDER_SOURCE = "registrars-and-dns-automation.md, 2026-10-09 (Route 53 rechecked 2026-10-13)";
+// Order matters only where two patterns could match one nameserver; none do today.
+export const DNS_PROVIDERS = [
+    {
+        id: "namecheap",
+        name: "Namecheap",
+        nameservers: [/(^|\.)registrar-servers\.com$/],
+        // Documented: "ALIAS Record", host @; "enter your subdomain just like mysubdomain and not like mysubdomain.domain.tld".
+        // https://www.namecheap.com/support/knowledgebase/article.aspx/10128/2237/how-to-create-an-alias-record
+        // https://www.namecheap.com/support/knowledgebase/article.aspx/9646/2237/how-to-create-a-cname-record-for-your-domain
+        profile: { apex: { support: "alias", typeLabel: "ALIAS", hostField: "@" }, appendsZone: true, notes: [], source: DNS_PROVIDER_SOURCE },
+    },
+    {
+        id: "godaddy",
+        name: "GoDaddy",
+        nameservers: [/(^|\.)domaincontrol\.com$/],
+        // No ALIAS/ANAME; a CNAME Name "cannot be the @ symbol". Forwarding exists (GoDaddy's own
+        // pages); whether it answers over HTTPS is unverified. appendsZone is inferred from the
+        // Name rules, so true is used only to hide the full-name line, which GoDaddy would double.
+        // https://www.godaddy.com/en/help/add-a-cname-record-19236
+        // https://www.godaddy.com/resources/news/beyond-cname-flattening
+        profile: {
+            apex: { support: "none", fallbacks: [{ kind: "use_www" }, { kind: "provider_forwarding", verified: true, https: "unverified" }] },
+            appendsZone: true,
+            notes: [],
+            source: DNS_PROVIDER_SOURCE,
+        },
+    },
+    {
+        id: "cloudflare",
+        name: "Cloudflare",
+        nameservers: [/(^|\.)ns\.cloudflare\.com$/],
+        // A CNAME at the root is flattened. Both name forms are accepted (inferred), so the full
+        // name stays visible. No DCV advice until #1990 settles the _acme-challenge question.
+        // https://developers.cloudflare.com/dns/cname-flattening/
+        // https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-zone-apex/
+        profile: { apex: { support: "cname_flattening", typeLabel: "CNAME", hostField: "@" }, appendsZone: "unknown", notes: [], source: DNS_PROVIDER_SOURCE },
+    },
+    {
+        id: "route53",
+        name: "Amazon Route 53",
+        nameservers: [/awsdns-\d+\./],
+        // ALIAS targets only AWS resources or same-zone records, and Route 53 has no forwarding
+        // service: so www, a redirect the owner runs inside AWS, or another DNS host. The root's
+        // record name is left blank; "@" outside a zone-file import creates a literal label.
+        // https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-choosing-alias-non-alias.html
+        // https://repost.aws/questions/QUt4eylJxXQ5On1SEzH09USQ/route-53-records
+        profile: {
+            apex: { support: "none", fallbacks: [{ kind: "use_www" }, { kind: "aws_redirect" }, { kind: "move_dns_host" }], hostField: "blank" },
+            appendsZone: "unknown",
+            notes: [{ id: "route53TxtQuotes", verified: false }],
+            source: DNS_PROVIDER_SOURCE,
+        },
+    },
+    // `googledomains.com` may be Squarespace Domains rather than Google Cloud DNS (unverified), so no profile.
+    { id: "google-cloud-dns", name: "Google Cloud DNS", nameservers: [/(^|\.)googledomains\.com$/] },
+    { id: "squarespace", name: "Squarespace", nameservers: [/(^|\.)squarespacedns\.com$/] },
+    {
+        id: "porkbun",
+        name: "Porkbun",
+        nameservers: [/(^|\.)porkbun\.com$/],
+        // Documented: host blank for the root, "enter only the subdomain".
+        // https://kb.porkbun.com/article/231-how-to-add-dns-records-on-porkbun
+        profile: { apex: { support: "alias", typeLabel: "ALIAS", hostField: "blank" }, appendsZone: true, notes: [], source: DNS_PROVIDER_SOURCE },
+    },
+    {
+        id: "namecom",
+        name: "Name.com",
+        nameservers: [/(^|\.)name\.com$/],
+        // https://www.name.com/support/articles/115010493967-adding-an-aname-alias-record
+        profile: { apex: { support: "alias", typeLabel: "ANAME", hostField: "blank" }, appendsZone: true, notes: [], source: DNS_PROVIDER_SOURCE },
+    },
+    {
+        id: "gandi",
+        name: "Gandi",
+        nameservers: [/(^|\.)gandi\.net$/],
+        // LiveDNS only; the value needs a trailing dot or the zone is appended to it; no A/AAAA may
+        // stay at @ beside the ALIAS.
+        // https://docs.gandi.net/en/domain_names/faq/record_types/alias_record.html
+        profile: {
+            apex: { support: "alias", typeLabel: "ALIAS", hostField: "@" },
+            appendsZone: true,
+            valueNeedsTrailingDot: true,
+            notes: [{ id: "gandiLiveDns", verified: true }],
+            source: DNS_PROVIDER_SOURCE,
+        },
+    },
+    { id: "ovhcloud", name: "OVHcloud", nameservers: [/(^|\.)ovh\.net$/] },
+    {
+        id: "ionos",
+        name: "IONOS",
+        nameservers: [/(^|\.)ui-dns\.(com|de|org|biz)$/],
+        // "CNAME only on subdomains" is IONOS's own; "only HTTP forwarding" for the root is one
+        // integrator's report, so forwarding is unverified and rendered as a possibility only.
+        // https://www.ionos.com/help/domains/configuring-cname-records-for-subdomains/configuring-a-cname-record-for-a-subdomain/
+        profile: {
+            apex: { support: "none", fallbacks: [{ kind: "use_www" }, { kind: "provider_forwarding", verified: false, https: "unverified" }] },
+            appendsZone: true,
+            notes: [],
+            source: DNS_PROVIDER_SOURCE,
+        },
+    },
+    {
+        id: "hostinger",
+        name: "Hostinger",
+        nameservers: [/(^|\.)dns-parking\.com$/],
+        // A CNAME at @ is shown as ALIAS, one per zone; "@ is appended by default".
+        // https://www.hostinger.com/support/10085192-cname-vs-alias-records-at-hostinger/
+        profile: {
+            apex: { support: "alias", typeLabel: "ALIAS", hostField: "@" },
+            appendsZone: true,
+            notes: [{ id: "hostingerCnameAtRoot", verified: true }],
+            source: DNS_PROVIDER_SOURCE,
+        },
+    },
+    { id: "hover", name: "Hover", nameservers: [/(^|\.)hover\.com$/] },
+    {
+        id: "wix",
+        name: "Wix",
+        nameservers: [/(^|\.)wixdns\.net$/],
+        // No ALIAS found and no forwarding researched, so no forwarding is offered. Wix's own
+        // instruction is to leave the Host blank wherever another one says "@".
+        // https://support.wix.com/en/article/adding-or-updating-cname-records-in-your-wix-account
+        profile: {
+            apex: { support: "none", fallbacks: [{ kind: "use_www" }, { kind: "move_dns_host" }], hostField: "blank" },
+            appendsZone: true,
+            notes: [],
+            source: DNS_PROVIDER_SOURCE,
+        },
+    },
+    { id: "vercel", name: "Vercel", nameservers: [/(^|\.)vercel-dns\.com$/] },
+    { id: "ns1", name: "NS1", nameservers: [/(^|\.)nsone\.net$/] },
+    { id: "digitalocean", name: "DigitalOcean", nameservers: [/(^|\.)digitalocean\.com$/] },
+    { id: "azure", name: "Azure DNS", nameservers: [/azure-dns\./] },
+    { id: "hetzner", name: "Hetzner", nameservers: [/(^|\.)hetzner\.(com|de)$/] },
+    // ALIAS support is second-hand and the host convention unknown, so no profile yet.
+    { id: "dnsimple", name: "DNSimple", nameservers: [/(^|\.)dnsimple\.com$/] },
+    { id: "netlify", name: "Netlify", nameservers: [/(^|\.)netlify\.com$/] },
+];
+/** The DNS host a zone's nameservers belong to, or null for one not in the table. Entries that are not names are skipped. */
+export function dnsProviderForNameservers(nameservers) {
+    if (!Array.isArray(nameservers))
+        return null;
+    for (const ns of nameservers) {
+        if (typeof ns !== "string")
+            continue;
+        const name = ns.toLowerCase().replace(/\.$/, "");
+        const hit = DNS_PROVIDERS.find((provider) => provider.nameservers.some((pattern) => pattern.test(name)));
+        if (hit)
+            return hit;
+    }
+    return null;
+}
+/** The profile for a `dnsCheck.providerId`; undefined for an unknown id or a host with no profile. */
+export function dnsProviderProfile(providerId) {
+    if (typeof providerId !== "string" || providerId === "")
+        return undefined;
+    return DNS_PROVIDERS.find((provider) => provider.id === providerId)?.profile;
+}
+/**
+ * The record as the host's editor wants it. `apex` is whether this is the routing record at
+ * the zone root; `name` is the relative name (`@` at the root). Without a profile this is the
+ * record unchanged, with the root's type named the way every host that can hold it does.
+ */
+export function recordAtProvider(record, profile) {
+    const type = String(record.type).toUpperCase();
+    const value = profile?.valueNeedsTrailingDot && typeof record.value === "string" && type === "CNAME" && !record.value.endsWith(".") ? `${record.value}.` : record.value;
+    if (!record.apex)
+        return { type, name: record.name, value };
+    if (!profile)
+        return { type: "ALIAS", name: record.name, value };
+    const apex = profile.apex;
+    if (apex.support === "none")
+        return { type: null, name: apex.hostField === "blank" ? "" : "@", value };
+    return { type: apex.typeLabel, name: apex.hostField === "blank" ? "" : "@", value };
+}