ninepm 0.78.0 → 0.79.0

package/README.md

@@ -242,7 +242,17 @@ saying whether they are the certificate authority's),
 `issuing_certificate`, `failed` or `expired`. Each record's `ok` is `null` when the check cannot
 say, and its `check` says why (`not_checked`, or `apex_addresses`). A record whose value was found
 at the name with the domain typed twice (`_acme-challenge.www.example.com.example.com`) has
-`check: "doubled"` and `doubledAt`: enter only the short name shown. `advisories` lists hints that
+`check: "doubled"` and `doubledAt`: enter only the short name shown. Since 0.79.0, against a server
+that sends them: a record answered by a wildcard record of the DNS host (`*.example.com`) rather
+than one of its own has `check: "wildcard"` and `wildcard`, and the row says to add a record at that
+name (the wildcard can stay; a TXT value is always added beside the values already there);
+`resolvers` lists what each public resolver answered when two were asked, and when one shows the
+expected value and another does not, the record is `check: "resolvers_disagree"` with `ok: null`:
+neither cache proves which answer is current, so confirm the record at your DNS host and check again.
+A record that does not match carries `ttlSeconds`, how long that answer may stay cached. A root
+answering with addresses while routing is pending asks you to confirm the ALIAS or ANAME target,
+since a parking page answers with addresses too. With every record found, the text names the
+platform's next automatic check from `next.nextCheckAt`. `advisories` lists hints that
 the hostname may be a typo, such as a domain that is not in DNS; the domain is added either way.
 Since 0.78.0 each record also carries `typeAtProvider`, `nameAtProvider` (`""` means leave the Host
 field empty) and `valueAtProvider`: the record as a recognised DNS host's editor wants it.

package/dist/domain-state.d.ts

@@ -29,16 +29,32 @@ export interface DomainStateDnsCheck {
     nameservers: string[];
     /** The zone the records go in, as the check found it. Absent from older servers and when no name answered NS. */
     zone?: string;
-    records: Array<{
-        type: string;
-        host: string;
-        expected: string;
-        current: string[];
-        matches: boolean;
-        doubledAt?: string;
-    }>;
+    records: DomainStateDnsRecord[];
     caa?: DomainStateCaaCheck;
 }
+/** What one public resolver answered for a record (#1991). */
+export interface DomainStateResolverAnswer {
+    resolver: string;
+    current: string[];
+    matches: boolean;
+    /** Seconds it may go on serving this answer from its cache. */
+    ttlSeconds?: number;
+}
+export interface DomainStateDnsRecord {
+    type: string;
+    host: string;
+    expected: string;
+    current: string[];
+    matches: boolean;
+    /** The value is published at `<host>.<zone>` instead, the provider having added the zone twice. */
+    doubledAt?: string;
+    /** The answer is a wildcard's (`*.<parent>`): the name has no record of its own. */
+    wildcard?: string;
+    /** Seconds `current` may still be served from a resolver's cache; set only when it does not match. */
+    ttlSeconds?: number;
+    /** Each public resolver's answer, when a second one was asked. `matches` above is the first resolver's, so a disagreement is never a match. */
+    resolvers?: DomainStateResolverAnswer[];
+}
 /** What the derivation reads: a domain as any of the domain endpoints returns it. */
 export interface DomainStateInput {
     hostname: string;
@@ -53,7 +69,7 @@ export interface DomainStateInput {
     providerMessageSource?: string | null;
 }
 export type DomainState = "live" | "waiting_for_dns" | "dns_unverified" | "issuing_certificate" | "failed" | "expired";
-export type DomainRecordCheck = "found" | "missing" | "different" | "doubled" | "not_checked" | "apex_addresses";
+export type DomainRecordCheck = "found" | "missing" | "different" | "doubled" | "wildcard" | "resolvers_disagree" | "not_checked" | "apex_addresses";
 export interface DomainRecordStatus {
     type: string;
     name: string;
@@ -63,10 +79,23 @@ export interface DomainRecordStatus {
     ok: boolean | null;
     check: DomainRecordCheck;
     doubledAt?: string;
+    wildcard?: string;
+    ttlSeconds?: number;
+    resolvers?: DomainStateResolverAnswer[];
     apex: boolean;
     optional: boolean;
 }
 export declare function domainRecordStatuses(domain: DomainStateInput): DomainRecordStatus[];
+export declare function domainRecordCheck(seen: DomainStateDnsRecord | undefined, atApex: boolean): DomainRecordCheck;
+/**
+ * Each resolver's answer as the server reported it, with malformed entries dropped, so a bad entry
+ * neither breaks a row nor counts towards a disagreement.
+ */
+export declare function resolverAnswers(seen: DomainStateDnsRecord | undefined): DomainStateResolverAnswer[];
+/** Whether one resolver shows the expected value while another shows something else. */
+export declare function resolversDisagree(seen: DomainStateDnsRecord | undefined): boolean;
+/** A cache's time left in whole minutes, at least one: "up to N min". */
+export declare function cacheMinutes(ttlSeconds: number): number;
 /**
  * The `www.<domain>` to connect instead, when this hostname is a bare domain whose DNS host
  * cannot point a root at a hostname at all (#1996): GoDaddy, Route 53, IONOS, Wix. Read only
@@ -85,7 +114,7 @@ export declare function showsUseWww(next: {
     action?: string;
 } | null | undefined): boolean;
 export declare function deriveDomainState(domain: DomainStateInput, records?: DomainRecordStatus[]): DomainState;
-export type DomainReasonCode = "records_missing" | "record_points_elsewhere" | "dns_changed_after_live" | "dns_not_checked" | "apex_unverifiable" | "dns_host_cannot_point_root" | "caa_blocks" | "certificate_pending" | "certificate_failed" | "hostname_failed" | "service_mode" | "claimed_elsewhere" | "platform_not_configured" | "provider_error" | "expired";
+export type DomainReasonCode = "records_missing" | "record_points_elsewhere" | "dns_changed_after_live" | "dns_not_checked" | "apex_unverifiable" | "dns_resolvers_disagree" | "dns_host_cannot_point_root" | "caa_blocks" | "certificate_pending" | "certificate_failed" | "hostname_failed" | "service_mode" | "claimed_elsewhere" | "platform_not_configured" | "provider_error" | "expired";
 export interface DomainReason {
     code: DomainReasonCode;
     /**

package/dist/domain-state.js

@@ -49,15 +49,20 @@ export function domainRecordStatuses(domain) {
         const seen = domain.dnsCheck?.records.find((entry) => entry.type.toUpperCase() === type && normalizeDnsName(entry.host) === fqdn && entry.expected === expected);
         const atApex = type === "CNAME" && fqdn === apex;
         const check = domainRecordCheck(seen, atApex);
+        const resolvers = resolverAnswers(seen);
+        const ttl = seen?.ttlSeconds;
         return {
             type,
             name: relativeRecordName(fqdn, apex),
             fqdn,
             expected: instruction.value,
             current: seen ? seen.current : null,
-            ok: check === "found" ? true : check === "missing" || check === "different" || check === "doubled" ? false : null,
+            ok: check === "found" ? true : check === "missing" || check === "different" || check === "doubled" || check === "wildcard" ? false : null,
             check,
             ...(check === "doubled" && seen?.doubledAt ? { doubledAt: seen.doubledAt } : {}),
+            ...(check === "wildcard" && seen?.wildcard ? { wildcard: seen.wildcard } : {}),
+            ...(check !== "found" && typeof ttl === "number" && Number.isFinite(ttl) && ttl >= 0 ? { ttlSeconds: ttl } : {}),
+            ...(resolvers.length > 0 ? { resolvers } : {}),
             apex: atApex,
             optional: instruction.optional === true,
         };
@@ -67,10 +72,14 @@ const IP_ADDRESS = /^(\d{1,3}(\.\d{1,3}){3}|[0-9a-f:]*:[0-9a-f:.]+)$/i;
 // The server looks a CNAME up and, finding none, falls back to the name's A records. At the
 // zone root that is exactly what a correct ALIAS/ANAME or flattened CNAME answers: addresses,
 // never the target name. So addresses at the apex are not evidence of a wrong record; they
-// cannot be compared from outside at all.
-function domainRecordCheck(seen, atApex) {
+// cannot be compared from outside at all. Exported so a client that renders records without a
+// full status (the dashboard's table) reads the same verdict per row.
+export function domainRecordCheck(seen, atApex) {
     if (!seen)
         return "not_checked";
+    // Ahead of `matches`, so no shape of answer turns a disagreement between caches into "found".
+    if (resolversDisagree(seen))
+        return "resolvers_disagree";
     if (seen.matches)
         return "found";
     if (seen.doubledAt)
@@ -79,8 +88,37 @@ function domainRecordCheck(seen, atApex) {
         return "missing";
     if (atApex && seen.current.every((value) => IP_ADDRESS.test(value.trim())))
         return "apex_addresses";
+    if (typeof seen.wildcard === "string" && seen.wildcard !== "")
+        return "wildcard";
     return "different";
 }
+/**
+ * Each resolver's answer as the server reported it, with malformed entries dropped, so a bad entry
+ * neither breaks a row nor counts towards a disagreement.
+ */
+export function resolverAnswers(seen) {
+    if (!seen || !Array.isArray(seen.resolvers))
+        return [];
+    return seen.resolvers.flatMap((answer) => {
+        if (answer === null || typeof answer !== "object")
+            return [];
+        const entry = answer;
+        if (typeof entry.resolver !== "string" || typeof entry.matches !== "boolean" || !Array.isArray(entry.current))
+            return [];
+        const current = entry.current.filter((value) => typeof value === "string");
+        const ttl = entry.ttlSeconds;
+        return [{ resolver: entry.resolver, current, matches: entry.matches, ...(typeof ttl === "number" && Number.isFinite(ttl) && ttl >= 0 ? { ttlSeconds: ttl } : {}) }];
+    });
+}
+/** Whether one resolver shows the expected value while another shows something else. */
+export function resolversDisagree(seen) {
+    const answers = resolverAnswers(seen);
+    return answers.some((answer) => answer.matches) && answers.some((answer) => !answer.matches);
+}
+/** A cache's time left in whole minutes, at least one: "up to N min". */
+export function cacheMinutes(ttlSeconds) {
+    return Math.max(1, Math.ceil(ttlSeconds / 60));
+}
 // Unproven is decided by `ok`, not by listing check values: a check this code does not know yet
 // carries ok null and so reads as unknown, never as found. The one exception is an apex
 // answering with addresses, which the platform's own active routing vouches for.
@@ -232,7 +270,14 @@ export function deriveDomainStatus(domain, options = {}) {
         }
         const routingActive = domain.routingStatus === "active";
         const unproven = required.filter((record) => isUnproven(record, routingActive));
-        const code = unproven.length > 0 && unproven.every((record) => record.check === "apex_addresses") ? "apex_unverifiable" : "dns_not_checked";
+        // A disagreement is named only when every unproven record is one, or an apex that cannot be
+        // compared from outside: a record nobody could read still makes it "not checked".
+        const explained = unproven.length > 0 && unproven.every((record) => record.check === "apex_addresses" || record.check === "resolvers_disagree");
+        const code = !explained
+            ? "dns_not_checked"
+            : unproven.some((record) => record.check === "resolvers_disagree")
+                ? "dns_resolvers_disagree"
+                : "apex_unverifiable";
         return {
             state,
             reason: withMessage(code),

package/dist/index.d.ts

@@ -127,7 +127,7 @@ export interface CreatedServiceToken {
     clientSecret: string;
 }
 export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-export declare const CLI_VERSION = "0.78.0";
+export declare const CLI_VERSION = "0.79.0";
 type CredentialBackend = "macos-keychain" | "windows-dpapi" | "linux-secret-service" | "file-plaintext" | "none";
 export interface StoredCredentialEntry {
     token: string;
@@ -789,6 +789,7 @@ export declare const DOMAIN_WAIT_EXIT: {
 export declare function domainStatusJson(domain: CliDomain, app: string, checkedAt: string): DomainStatusJson;
 export declare function domainStateLabel(state: string): string;
 export declare function domainWaitExitCode(status: Pick<DomainStatusJson, "state" | "next">): number;
+export declare function nextCheckText(nextCheckAt: unknown): string | null;
 export interface DomainFormatOptions {
     owner?: string;
     target?: AccessApiTarget;

package/dist/index.js

@@ -15,7 +15,7 @@ import { managedHostnamesIn, siblingCallWarning, siblingsOf } from "./sibling-ho
 import { MAX_STATIC_ASSET_FILE_BYTES, MAX_WORKER_ENTRY_COMPRESSED_BYTES, MAX_WORKER_SCRIPT_COMPRESSED_BYTES, WORKER_ENTRY_COMPRESSED_WARN_BYTES, assetFileTooLargeMessage, formatMebibytes, formatMegabytes, oversizedAssets, workerBundleNearLimitMessage, workerBundleTooLargeMessage, workerEntryNearLimitMessage, workerEntryTooLargeMessage, } from "./deploy-limits.js";
 import { guessZoneApex, relativeRecordName, zoneApexFor } from "./dns-host.js";
 import { dnsProviderProfile, recordAtProvider } from "./dns-providers.js";
-import { deriveDomainStatus, domainRecordStatuses, showsUseWww, } from "./domain-state.js";
+import { cacheMinutes, deriveDomainStatus, domainRecordStatuses, showsUseWww, } from "./domain-state.js";
 import { buildFileManifest, readManifestFile } from "./manifest.js";
 import { NO_PUBLIC_ASSETS, normalizeAssetsDirectory, privateLookingPaths, publicAssetPath } from "./public-assets.js";
 import { API_KEY_HELP, API_URL_HELP, CLI_CLIENT_ID, DEFAULT_API_URL, reportCliError } from "./cli-config.js";
@@ -52,7 +52,7 @@ export function deployDatabaseClause(databases) {
     const listed = databases.map((database) => (database.name ? `${database.bindingName}:${database.name}` : database.bindingName)).join(", ");
     return `${databases.length === 1 ? "database" : "databases"} ${listed}`;
 }
-export const CLI_VERSION = "0.78.0";
+export const CLI_VERSION = "0.79.0";
 const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
 const TOKEN_SERVICE = "9pm";
 const TOKEN_ACCOUNT = "default";
@@ -3328,9 +3328,33 @@ function providerMessageLine(reason) {
     return `${who} reported (${message.seenAt}): ${message.text}`;
 }
 const TXT_KEEP_OTHERS = "add this value as its own TXT record; other TXT values can stay";
+// The server's next background check as "HH:MM UTC" (UTC so the line reads the same on any
+// machine); null when there is none or it is not a date, so no time is promised from it.
+export function nextCheckText(nextCheckAt) {
+    if (typeof nextCheckAt !== "string" || nextCheckAt === "")
+        return null;
+    const at = new Date(nextCheckAt);
+    return Number.isNaN(at.getTime()) ? null : `${at.toISOString().slice(11, 16)} UTC`;
+}
+// "up to N min" for a cache's time left, or nothing when the resolver did not say.
+function forUpTo(ttlSeconds) {
+    return typeof ttlSeconds === "number" ? ` for up to ${cacheMinutes(ttlSeconds)} min` : "";
+}
+function answerText(current) {
+    return current.length > 0 ? current.join(", ") : "nothing";
+}
 function recordStateText(record, routing) {
     if (record.ok === true)
         return "found";
+    if (record.check === "resolvers_disagree") {
+        // Two caches that disagree prove neither answer current: no "found", no "replace", and neither answer called old.
+        const answers = record.resolvers ?? [];
+        const seeing = answers.filter((answer) => answer.matches).map((answer) => answer.resolver);
+        const others = answers
+            .filter((answer) => !answer.matches)
+            .map((answer) => `${answer.resolver} sees ${answerText(answer.current)}${typeof answer.ttlSeconds === "number" ? ` (and may keep that answer${forUpTo(answer.ttlSeconds)})` : ""}`);
+        return `public resolvers disagree: ${seeing.join(" and ")} ${seeing.length > 1 ? "see" : "sees"} the value shown, ${others.join("; ")}. That usually means a recent change is still spreading; make sure your DNS host shows the value shown, then check again`;
+    }
     if (record.check === "doubled") {
         // The same name the NAME column shows, so the hint never contradicts the host's convention.
         const name = record.nameAtProvider ?? record.name;
@@ -3342,17 +3366,32 @@ function recordStateText(record, routing) {
     if (record.check === "apex_addresses") {
         return routing === "active"
             ? "looks connected: the root answers with addresses, as an ALIAS does, and routing is active"
-            : `answers with addresses (${(record.current ?? []).join(", ")}); an ALIAS can't be verified from outside, so this waits on the platform's routing check`;
+            : // A parking page answers with addresses too, so nothing here says the record is right: the owner confirms it.
+                `answers with addresses (${(record.current ?? []).join(", ")}); an ALIAS can't be verified from outside, and a parking page answers with addresses too: make sure the ALIAS or ANAME record at the root points at the value shown. The platform's routing check confirms it`;
     }
     if (record.ok === null || record.current === null)
         return "not checked: couldn't read your DNS just now";
+    // TXT before wildcard: a name may hold several TXT values another certificate still needs, so a
+    // TXT value is always added beside them, never "changed", whatever answers at the name.
     if (record.type === "TXT") {
-        const now = record.current.length === 0 ? "not published yet" : `currently ${record.current.join(", ")}`;
+        const from = record.check === "wildcard" && record.wildcard ? ` (from the wildcard ${record.wildcard})` : "";
+        const now = record.current.length === 0 ? "not published yet" : `currently ${record.current.join(", ")}${from}`;
         return `${now}: ${TXT_KEEP_OTHERS}`;
     }
+    if (record.check === "wildcard") {
+        const name = record.nameAtProvider ?? record.name;
+        // A name holding a CNAME can hold nothing else, so an explicit record equal to the wildcard's answer is changed, not joined.
+        return `no ${record.type} record of its own yet: your DNS host's wildcard ${record.wildcard ?? ""} answers for it (${record.current.join(", ")}). Add one at ${name === "" ? "the root" : name} with the value shown; the wildcard can stay. If your DNS host already lists a record at this name, change that one instead`;
+    }
     if (record.current.length === 0)
         return "not published yet";
-    return `currently ${record.current.join(", ")}: point it at the value shown`;
+    // A changed record can keep its old answer in public caches for its TTL, which is said so the owner does not change it twice.
+    const recent = typeof record.ttlSeconds === "number" ? ` (if you changed it in the last ${cacheMinutes(record.ttlSeconds)} min, this may be the old answer still cached)` : "";
+    // Two resolvers can each hold a different old answer; both are shown, as neither is the expected value.
+    const shown = record.current.join(", ");
+    const others = (record.resolvers ?? []).filter((answer) => answer.current.join(", ") !== shown);
+    const also = others.map((answer) => `; ${answer.resolver} answers ${answerText(answer.current)}`).join("");
+    return `currently ${shown}${also}${recent}: point it at the value shown`;
 }
 // A printed command carries --owner and, when the destination is not the built-in default,
 // --api-url: pasted into a shell without NINEPM_API_URL it would otherwise act on production.
@@ -3510,6 +3549,10 @@ export function formatDomainStatus(status, options = {}) {
     }
     else if (status.state === "issuing_certificate") {
         lines.push("Every required record is published. The platform finishes on its own, usually within minutes.");
+        const nextCheck = nextCheckText(status.next?.nextCheckAt);
+        // A restart is not offered here: nothing measured says it speeds issuance up.
+        if (nextCheck)
+            lines.push(`The platform checks it again around ${nextCheck} on its own; nothing needs restarting.`);
     }
     lines.push(`Then run: ${domainCommand("wait", status.app, status.hostname, options)}`);
     return lines;
@@ -3525,12 +3568,16 @@ export function domainWaitTimeoutMessage(status) {
         return "Timed out: a CAA record stops the certificate from being issued. Change it as described above, then wait again.";
     }
     if (status.state === "issuing_certificate") {
-        return "Timed out: the records are published and the platform is still finishing. Wait again; nothing needs changing.";
+        const nextCheck = nextCheckText(status.next?.nextCheckAt);
+        return `Timed out: the records are published and the platform is still finishing. Wait again; nothing needs changing.${nextCheck ? ` Its next automatic check is around ${nextCheck}.` : ""}`;
     }
     const required = status.records.filter((record) => !record.optional);
     if (required.some((record) => record.ok === false)) {
         return "Timed out: records above are still missing. Publish them, then wait again.";
     }
+    if (required.some((record) => record.check === "resolvers_disagree")) {
+        return "Timed out: public resolvers still disagree about a record above. Make sure your DNS host shows the value shown, then wait again.";
+    }
     return "Timed out: the DNS records could not be checked. Make sure they are published as shown, then wait again.";
 }
 export function formatDomainsList(statuses) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ninepm",
-  "version": "0.78.0",
+  "version": "0.79.0",
   "description": "CLI for deploying built apps to 9pm.ai.",
   "homepage": "https://9pm.ai",
   "keywords": [