ninepm 0.78.0 → 0.81.0

package/README.md

@@ -217,7 +217,8 @@ Connect a domain you own to an app:
 This prints the DNS records to publish at your DNS provider, with names relative to your
 domain (`www`, `_acme-challenge.www`) and what DNS shows for each right now. When a TXT value
 is missing, add it as its own TXT record; other TXT values on that name can stay. The root of
-your domain (`@`) cannot hold a CNAME, so a root domain is shown as an `ALIAS` record: add it as
+your domain (`@`) cannot hold a CNAME, so a root domain is shown as an `ALIAS / ANAME` record when
+your DNS host is not one the CLI recognises (a recognised host's own name for it otherwise): add it as
 ALIAS or ANAME (or a CNAME your provider flattens). A correct ALIAS answers with addresses, which
 cannot be compared from outside, so that row follows the platform's own routing check. Then:
 
@@ -242,19 +243,50 @@ saying whether they are the certificate authority's),
 `issuing_certificate`, `failed` or `expired`. Each record's `ok` is `null` when the check cannot
 say, and its `check` says why (`not_checked`, or `apex_addresses`). A record whose value was found
 at the name with the domain typed twice (`_acme-challenge.www.example.com.example.com`) has
-`check: "doubled"` and `doubledAt`: enter only the short name shown. `advisories` lists hints that
+`check: "doubled"` and `doubledAt`: enter only the short name shown. Since 0.79.0, against a server
+that sends them: a record answered by a wildcard record of the DNS host (`*.example.com`) rather
+than one of its own has `check: "wildcard"` and `wildcard`, and the row says to add a record at that
+name (the wildcard can stay; a TXT value is always added beside the values already there);
+`resolvers` lists what each public resolver answered when two were asked, and when one shows the
+expected value and another does not, the record is `check: "resolvers_disagree"` with `ok: null`:
+neither cache proves which answer is current, so confirm the record at your DNS host and check again.
+A record that does not match carries `ttlSeconds`, how long that answer may stay cached. A root
+answering with addresses while routing is pending asks you to confirm the ALIAS or ANAME target,
+since a parking page answers with addresses too. With every record found, the text names the
+platform's next automatic check from `next.nextCheckAt`. `advisories` lists hints that
 the hostname may be a typo, such as a domain that is not in DNS; the domain is added either way.
 Since 0.78.0 each record also carries `typeAtProvider`, `nameAtProvider` (`""` means leave the Host
 field empty) and `valueAtProvider`: the record as a recognised DNS host's editor wants it.
 `typeAtProvider` is `null` for a root record the host cannot hold (GoDaddy, Route 53, IONOS, Wix);
 the text output then suggests connecting `www` instead. `list`, `status` and `wait`
-only read; `add`, `check`, `restart` and `remove` need permission to configure the app.
+only read; `add`, `check`, `restart`, `remove` and `move` need permission to configure the app.
+
+`9pm domains remove` prints only the records the API says the domain used, each to delete only if
+its value is unchanged: a name that now holds a different value (the domain points somewhere new, or
+another service's certificate check uses `_acme-challenge`) is not ours, so leave it. Against a server
+that sends no such list it prints no deletion advice at all. When the removal is still finishing
+upstream (the API answers `202` with `releasing: true`), it says so, names no record to delete, and
+prints the `9pm domains list` command: once the domain is no longer listed, it has stopped serving
+from 9pm. A removal that finishes in the background returns no record list, so the CLI cannot say
+which DNS records to delete for it. Such a domain shows as `removing`
+in `list` and `status` (`"removing": true` in `--json`), and `wait` on it exits `20`. Since 0.80.0.
+
+`9pm domains move <hostname> --to <app>` moves a domain to another app of the same account. It keeps
+its certificate and the DNS records already published, so nothing is validated again. Without a
+source app the CLI looks it up in the account; name it (`9pm domains move <app> <hostname> --to
+<app>`) to skip that. Each refusal is printed with what to do: the domain or the app is not found,
+the destination is at its custom-domain cap, a removal of the domain is still finishing, the domain
+was disconnected under a service-token app or was never provisioned (remove it and add it to the
+other app), or the destination is in another account. `remove --json` and `move --json` print the
+API's answer as it came. Since 0.80.0.
 
 Every `9pm deploy` lists the app's custom domains under its `Deployed` line: `Also serving at
 https://<domain>` for a live one, and for any other its state and the `9pm domains status`
 command to run. If the domains cannot be read within a few seconds, the deploy says so in one
 line instead; the deploy itself is never held back by it. `9pm delete` names the custom domains
-it removed.
+it removed and, since 0.80.0, the records the API says each one used (under the same
+value-unchanged rule); a domain still being released is reported as such, with no records to delete,
+and none can be listed for it later.
 
 ## Commands
 
@@ -283,7 +315,8 @@ it removed.
 9pm domains check <app> <hostname> [--json]
 9pm domains wait <app> <hostname> [--timeout 30m] [--interval 20s] [--json]
 9pm domains restart <app> <hostname>          # only after a certificate failed; record values may change
-9pm domains remove <app> <hostname> --confirm <hostname>
+9pm domains remove <app> <hostname> --confirm <hostname> [--json]
+9pm domains move [<app>] <hostname> --to <app> [--json]
 9pm access show <site>
 9pm access public <site> [--switch-mode]
 9pm access otp <site> [--switch-mode]

package/dist/dns-providers.d.ts

@@ -53,6 +53,12 @@ export interface DnsProviderProfile {
     /** The editor makes a hostname value relative unless it ends in a dot (Gandi). */
     valueNeedsTrailingDot?: true;
     notes: DnsProviderNote[];
+    /**
+     * The values the host's own help pages name as its default parking records. A routing record
+     * whose answer is one of these is the host's parking page, and only then is it named as such:
+     * knowing the host does not say what any one record at it is for.
+     */
+    parkingTargets?: string[];
     source: string;
 }
 export interface DnsProvider {
@@ -89,3 +95,27 @@ export declare function recordAtProvider(record: {
     value: string;
     apex: boolean;
 }, profile: DnsProviderProfile | undefined): RecordAtProvider;
+/** A DNS host's own parking record, as the live DNS check saw it. */
+export interface ParkingRecord {
+    /** The DNS host's display name. */
+    provider: string;
+    /** The parking value the record answered with. */
+    value: string;
+    /** Set when the answer came from a wildcard (`*.<parent>`): that wildcard is the parking record, the name has none. */
+    wildcard?: string;
+}
+/**
+ * Whether a routing record's answer is the DNS host's own default parking record. Every one of
+ * these must hold: the host is recognised and its help pages name the value (`parkingTargets`);
+ * the record is a CNAME, since a TXT or MX value is never a website record; the check found the
+ * record different from ours or answered by a wildcard (`check` as domain-state derives it, so
+ * a disagreement between resolvers, a doubled name or a root answering with addresses is never
+ * read as parking); and every value the check saw is that parking value. A value the owner set
+ * themselves at the same name, or a host the check did not recognise, gives null.
+ */
+export declare function parkingRecordFor(providerId: unknown, record: {
+    type: unknown;
+    check: unknown;
+    current: unknown;
+    wildcard?: unknown;
+}): ParkingRecord | null;

package/dist/dns-providers.js

@@ -77,9 +77,23 @@ export const DNS_PROVIDERS = [
         id: "porkbun",
         name: "Porkbun",
         nameservers: [/(^|\.)porkbun\.com$/],
-        // Documented: host blank for the root, "enter only the subdomain".
+        // Documented: host blank for the root, "enter only the subdomain"; the record editor is
+        // reached from ACCOUNT > Domain Management, then the domain's "DNS" button (231) or
+        // "Details" > "DNS Records" (68). Rechecked 2026-10-14.
         // https://kb.porkbun.com/article/231-how-to-add-dns-records-on-porkbun
-        profile: { apex: { support: "alias", typeLabel: "ALIAS", hostField: "blank" }, appendsZone: true, notes: [], source: DNS_PROVIDER_SOURCE },
+        // https://kb.porkbun.com/article/68-how-do-i-edit-dns
+        // Parking: "These records will have a value of 'pixie.porkbun.com'. They're in control of the
+        // default parking page", and Porkbun says to delete them once the site is hosted elsewhere.
+        // The page names neither record types nor hosts, so only the value is used. uixie.porkbun.com
+        // has been seen answering too, but no Porkbun page names it, so it is not listed.
+        // https://kb.porkbun.com/article/239-cname-alias-record-with-that-host-already-exists-error
+        profile: {
+            apex: { support: "alias", typeLabel: "ALIAS", hostField: "blank" },
+            appendsZone: true,
+            notes: [{ id: "porkbunDnsScreen", verified: true }],
+            parkingTargets: ["pixie.porkbun.com"],
+            source: DNS_PROVIDER_SOURCE,
+        },
     },
     {
         id: "namecom",
@@ -192,3 +206,36 @@ export function recordAtProvider(record, profile) {
         return { type: null, name: apex.hostField === "blank" ? "" : "@", value };
     return { type: apex.typeLabel, name: apex.hostField === "blank" ? "" : "@", value };
 }
+/**
+ * Whether a routing record's answer is the DNS host's own default parking record. Every one of
+ * these must hold: the host is recognised and its help pages name the value (`parkingTargets`);
+ * the record is a CNAME, since a TXT or MX value is never a website record; the check found the
+ * record different from ours or answered by a wildcard (`check` as domain-state derives it, so
+ * a disagreement between resolvers, a doubled name or a root answering with addresses is never
+ * read as parking); and every value the check saw is that parking value. A value the owner set
+ * themselves at the same name, or a host the check did not recognise, gives null.
+ */
+export function parkingRecordFor(providerId, record) {
+    if (typeof providerId !== "string" || providerId === "")
+        return null;
+    const provider = DNS_PROVIDERS.find((entry) => entry.id === providerId);
+    const targets = provider?.profile?.parkingTargets;
+    if (!provider || !targets || targets.length === 0)
+        return null;
+    if (typeof record.type !== "string" || record.type.toUpperCase() !== "CNAME")
+        return null;
+    if (record.check !== "different" && record.check !== "wildcard")
+        return null;
+    if (!Array.isArray(record.current) || record.current.length === 0)
+        return null;
+    const seen = record.current.map((value) => (typeof value === "string" ? value.trim().toLowerCase().replace(/\.$/, "") : null));
+    const first = seen[0];
+    if (typeof first !== "string" || !targets.includes(first) || seen.some((value) => value !== first))
+        return null;
+    if (record.check === "wildcard") {
+        if (typeof record.wildcard !== "string" || record.wildcard === "")
+            return null;
+        return { provider: provider.name, value: first, wildcard: record.wildcard };
+    }
+    return { provider: provider.name, value: first };
+}

package/dist/domain-state.d.ts

@@ -29,16 +29,32 @@ export interface DomainStateDnsCheck {
     nameservers: string[];
     /** The zone the records go in, as the check found it. Absent from older servers and when no name answered NS. */
     zone?: string;
-    records: Array<{
-        type: string;
-        host: string;
-        expected: string;
-        current: string[];
-        matches: boolean;
-        doubledAt?: string;
-    }>;
+    records: DomainStateDnsRecord[];
     caa?: DomainStateCaaCheck;
 }
+/** What one public resolver answered for a record (#1991). */
+export interface DomainStateResolverAnswer {
+    resolver: string;
+    current: string[];
+    matches: boolean;
+    /** Seconds it may go on serving this answer from its cache. */
+    ttlSeconds?: number;
+}
+export interface DomainStateDnsRecord {
+    type: string;
+    host: string;
+    expected: string;
+    current: string[];
+    matches: boolean;
+    /** The value is published at `<host>.<zone>` instead, the provider having added the zone twice. */
+    doubledAt?: string;
+    /** The answer is a wildcard's (`*.<parent>`): the name has no record of its own. */
+    wildcard?: string;
+    /** Seconds `current` may still be served from a resolver's cache; set only when it does not match. */
+    ttlSeconds?: number;
+    /** Each public resolver's answer, when a second one was asked. `matches` above is the first resolver's, so a disagreement is never a match. */
+    resolvers?: DomainStateResolverAnswer[];
+}
 /** What the derivation reads: a domain as any of the domain endpoints returns it. */
 export interface DomainStateInput {
     hostname: string;
@@ -53,7 +69,7 @@ export interface DomainStateInput {
     providerMessageSource?: string | null;
 }
 export type DomainState = "live" | "waiting_for_dns" | "dns_unverified" | "issuing_certificate" | "failed" | "expired";
-export type DomainRecordCheck = "found" | "missing" | "different" | "doubled" | "not_checked" | "apex_addresses";
+export type DomainRecordCheck = "found" | "missing" | "different" | "doubled" | "wildcard" | "resolvers_disagree" | "not_checked" | "apex_addresses";
 export interface DomainRecordStatus {
     type: string;
     name: string;
@@ -63,10 +79,23 @@ export interface DomainRecordStatus {
     ok: boolean | null;
     check: DomainRecordCheck;
     doubledAt?: string;
+    wildcard?: string;
+    ttlSeconds?: number;
+    resolvers?: DomainStateResolverAnswer[];
     apex: boolean;
     optional: boolean;
 }
 export declare function domainRecordStatuses(domain: DomainStateInput): DomainRecordStatus[];
+export declare function domainRecordCheck(seen: DomainStateDnsRecord | undefined, atApex: boolean): DomainRecordCheck;
+/**
+ * Each resolver's answer as the server reported it, with malformed entries dropped, so a bad entry
+ * neither breaks a row nor counts towards a disagreement.
+ */
+export declare function resolverAnswers(seen: DomainStateDnsRecord | undefined): DomainStateResolverAnswer[];
+/** Whether one resolver shows the expected value while another shows something else. */
+export declare function resolversDisagree(seen: DomainStateDnsRecord | undefined): boolean;
+/** A cache's time left in whole minutes, at least one: "up to N min". */
+export declare function cacheMinutes(ttlSeconds: number): number;
 /**
  * The `www.<domain>` to connect instead, when this hostname is a bare domain whose DNS host
  * cannot point a root at a hostname at all (#1996): GoDaddy, Route 53, IONOS, Wix. Read only
@@ -85,7 +114,7 @@ export declare function showsUseWww(next: {
     action?: string;
 } | null | undefined): boolean;
 export declare function deriveDomainState(domain: DomainStateInput, records?: DomainRecordStatus[]): DomainState;
-export type DomainReasonCode = "records_missing" | "record_points_elsewhere" | "dns_changed_after_live" | "dns_not_checked" | "apex_unverifiable" | "dns_host_cannot_point_root" | "caa_blocks" | "certificate_pending" | "certificate_failed" | "hostname_failed" | "service_mode" | "claimed_elsewhere" | "platform_not_configured" | "provider_error" | "expired";
+export type DomainReasonCode = "records_missing" | "record_points_elsewhere" | "dns_changed_after_live" | "dns_not_checked" | "apex_unverifiable" | "dns_resolvers_disagree" | "dns_host_cannot_point_root" | "caa_blocks" | "certificate_pending" | "certificate_failed" | "hostname_failed" | "service_mode" | "claimed_elsewhere" | "platform_not_configured" | "provider_error" | "expired";
 export interface DomainReason {
     code: DomainReasonCode;
     /**

package/dist/domain-state.js

@@ -49,15 +49,20 @@ export function domainRecordStatuses(domain) {
         const seen = domain.dnsCheck?.records.find((entry) => entry.type.toUpperCase() === type && normalizeDnsName(entry.host) === fqdn && entry.expected === expected);
         const atApex = type === "CNAME" && fqdn === apex;
         const check = domainRecordCheck(seen, atApex);
+        const resolvers = resolverAnswers(seen);
+        const ttl = seen?.ttlSeconds;
         return {
             type,
             name: relativeRecordName(fqdn, apex),
             fqdn,
             expected: instruction.value,
             current: seen ? seen.current : null,
-            ok: check === "found" ? true : check === "missing" || check === "different" || check === "doubled" ? false : null,
+            ok: check === "found" ? true : check === "missing" || check === "different" || check === "doubled" || check === "wildcard" ? false : null,
             check,
             ...(check === "doubled" && seen?.doubledAt ? { doubledAt: seen.doubledAt } : {}),
+            ...(check === "wildcard" && seen?.wildcard ? { wildcard: seen.wildcard } : {}),
+            ...(check !== "found" && typeof ttl === "number" && Number.isFinite(ttl) && ttl >= 0 ? { ttlSeconds: ttl } : {}),
+            ...(resolvers.length > 0 ? { resolvers } : {}),
             apex: atApex,
             optional: instruction.optional === true,
         };
@@ -67,10 +72,14 @@ const IP_ADDRESS = /^(\d{1,3}(\.\d{1,3}){3}|[0-9a-f:]*:[0-9a-f:.]+)$/i;
 // The server looks a CNAME up and, finding none, falls back to the name's A records. At the
 // zone root that is exactly what a correct ALIAS/ANAME or flattened CNAME answers: addresses,
 // never the target name. So addresses at the apex are not evidence of a wrong record; they
-// cannot be compared from outside at all.
-function domainRecordCheck(seen, atApex) {
+// cannot be compared from outside at all. Exported so a client that renders records without a
+// full status (the dashboard's table) reads the same verdict per row.
+export function domainRecordCheck(seen, atApex) {
     if (!seen)
         return "not_checked";
+    // Ahead of `matches`, so no shape of answer turns a disagreement between caches into "found".
+    if (resolversDisagree(seen))
+        return "resolvers_disagree";
     if (seen.matches)
         return "found";
     if (seen.doubledAt)
@@ -79,8 +88,37 @@ function domainRecordCheck(seen, atApex) {
         return "missing";
     if (atApex && seen.current.every((value) => IP_ADDRESS.test(value.trim())))
         return "apex_addresses";
+    if (typeof seen.wildcard === "string" && seen.wildcard !== "")
+        return "wildcard";
     return "different";
 }
+/**
+ * Each resolver's answer as the server reported it, with malformed entries dropped, so a bad entry
+ * neither breaks a row nor counts towards a disagreement.
+ */
+export function resolverAnswers(seen) {
+    if (!seen || !Array.isArray(seen.resolvers))
+        return [];
+    return seen.resolvers.flatMap((answer) => {
+        if (answer === null || typeof answer !== "object")
+            return [];
+        const entry = answer;
+        if (typeof entry.resolver !== "string" || typeof entry.matches !== "boolean" || !Array.isArray(entry.current))
+            return [];
+        const current = entry.current.filter((value) => typeof value === "string");
+        const ttl = entry.ttlSeconds;
+        return [{ resolver: entry.resolver, current, matches: entry.matches, ...(typeof ttl === "number" && Number.isFinite(ttl) && ttl >= 0 ? { ttlSeconds: ttl } : {}) }];
+    });
+}
+/** Whether one resolver shows the expected value while another shows something else. */
+export function resolversDisagree(seen) {
+    const answers = resolverAnswers(seen);
+    return answers.some((answer) => answer.matches) && answers.some((answer) => !answer.matches);
+}
+/** A cache's time left in whole minutes, at least one: "up to N min". */
+export function cacheMinutes(ttlSeconds) {
+    return Math.max(1, Math.ceil(ttlSeconds / 60));
+}
 // Unproven is decided by `ok`, not by listing check values: a check this code does not know yet
 // carries ok null and so reads as unknown, never as found. The one exception is an apex
 // answering with addresses, which the platform's own active routing vouches for.
@@ -232,7 +270,14 @@ export function deriveDomainStatus(domain, options = {}) {
         }
         const routingActive = domain.routingStatus === "active";
         const unproven = required.filter((record) => isUnproven(record, routingActive));
-        const code = unproven.length > 0 && unproven.every((record) => record.check === "apex_addresses") ? "apex_unverifiable" : "dns_not_checked";
+        // A disagreement is named only when every unproven record is one, or an apex that cannot be
+        // compared from outside: a record nobody could read still makes it "not checked".
+        const explained = unproven.length > 0 && unproven.every((record) => record.check === "apex_addresses" || record.check === "resolvers_disagree");
+        const code = !explained
+            ? "dns_not_checked"
+            : unproven.some((record) => record.check === "resolvers_disagree")
+                ? "dns_resolvers_disagree"
+                : "apex_unverifiable";
         return {
             state,
             reason: withMessage(code),

package/dist/index.d.ts

@@ -108,6 +108,8 @@ export interface DeletedSiteResult {
     workers: number;
     customDomains: number;
     customDomainNames?: string[];
+    customDomainCleanup?: unknown;
+    customDomainsReleasing?: unknown;
     containerApplications?: number;
     containerImages?: number;
     accessApps: number;
@@ -118,6 +120,7 @@ export interface DeletedSiteResult {
     metadata: boolean;
     errors?: string[];
 }
+export declare function deletedDomainLines(deleted: Pick<DeletedSiteResult, "customDomainCleanup" | "customDomainsReleasing">): string[];
 export interface CreatedRuntimeToken {
     token: string;
     appAccessToken: AppAccessToken;
@@ -127,7 +130,7 @@ export interface CreatedServiceToken {
     clientSecret: string;
 }
 export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-export declare const CLI_VERSION = "0.78.0";
+export declare const CLI_VERSION = "0.81.0";
 type CredentialBackend = "macos-keychain" | "windows-dpapi" | "linux-secret-service" | "file-plaintext" | "none";
 export interface StoredCredentialEntry {
     token: string;
@@ -649,6 +652,13 @@ type CliCommand = {
         kind: "remove";
         site: string;
         hostname: string;
+        json: boolean;
+    } | {
+        kind: "move";
+        site?: string;
+        hostname: string;
+        to: string;
+        json: boolean;
     };
     apiUrl: string;
     token: string;
@@ -753,6 +763,8 @@ export interface CliDomain extends DomainStateInput {
     state?: string;
     reason?: DomainReason | null;
     next?: DomainNext;
+    releasingAt?: string | null;
+    releaseIntent?: string | null;
 }
 export interface DomainRecordStatusJson extends DomainRecordStatus {
     typeAtProvider: string | null;
@@ -779,6 +791,7 @@ export interface DomainStatusJson {
     checkedAt: string;
     reason: DomainReason | null;
     next: DomainNext;
+    removing: boolean;
 }
 export declare const DOMAIN_WAIT_EXIT: {
     readonly live: 0;
@@ -789,6 +802,7 @@ export declare const DOMAIN_WAIT_EXIT: {
 export declare function domainStatusJson(domain: CliDomain, app: string, checkedAt: string): DomainStatusJson;
 export declare function domainStateLabel(state: string): string;
 export declare function domainWaitExitCode(status: Pick<DomainStatusJson, "state" | "next">): number;
+export declare function nextCheckText(nextCheckAt: unknown): string | null;
 export interface DomainFormatOptions {
     owner?: string;
     target?: AccessApiTarget;
@@ -800,7 +814,8 @@ export declare function formatDomainsList(statuses: DomainStatusJson[]): string[
 export declare class DomainsApiError extends Error {
     readonly status: number;
     readonly code: string | null;
-    constructor(message: string, status: number, code: string | null);
+    readonly reason: string | null;
+    constructor(message: string, status: number, code: string | null, reason?: string | null);
 }
 export declare function domainsApiError(status: number, text: string): DomainsApiError;
 export interface DomainCommandOptions extends ApiOptions {
@@ -829,9 +844,48 @@ export declare function restartDomain(options: DomainCommandOptions & {
     domain: CliDomain;
     replacedInstructions: CliDnsInstruction[];
 }>;
+export interface DomainRemoval {
+    body: unknown;
+    hostname: string;
+    releasing: boolean;
+    cleanup: DomainCleanup | null;
+}
 export declare function removeDomain(options: DomainCommandOptions & {
     hostname: string;
-}): Promise<CliDomain | null>;
+}): Promise<DomainRemoval>;
+export declare function removalFromResponse(status: number, body: unknown, requested: string): DomainRemoval;
+export interface DomainCleanupRecord {
+    type: string;
+    host: string;
+    value: string;
+    purpose: string;
+}
+export interface DomainCleanup {
+    hostname: string;
+    records: DomainCleanupRecord[];
+}
+export declare function parseDomainCleanup(value: unknown): DomainCleanup | null;
+export declare function domainCleanupLines(cleanup: DomainCleanup): string[];
+export declare function domainRemovalPendingLines(hostname: string, app: string, options: DomainFormatOptions): string[];
+export interface DomainMove {
+    body: unknown;
+    hostname: string;
+    from: string | null;
+    to: string | null;
+}
+export declare function moveDomain(options: DomainCommandOptions & {
+    hostname: string;
+    to: string;
+}): Promise<DomainMove>;
+export declare function findDomainApp(options: ApiOptions & {
+    owner?: string;
+    hostname: string;
+}): Promise<string | null>;
+export declare function domainMoveRefusalLines(error: DomainsApiError, move: {
+    site: string;
+    hostname: string;
+    to: string;
+}, options: DomainFormatOptions): string[];
 export declare const DEPLOY_DOMAINS_TIMEOUT_MS = 4500;
 export declare function deployCustomDomainStatuses(options: ApiOptions & {
     projectId: string;

package/dist/index.js

@@ -14,8 +14,8 @@ import { MAX_DEPLOY_DESCRIPTION_LENGTH, normalizeDeployDescription } from "./dep
 import { managedHostnamesIn, siblingCallWarning, siblingsOf } from "./sibling-hostnames.js";
 import { MAX_STATIC_ASSET_FILE_BYTES, MAX_WORKER_ENTRY_COMPRESSED_BYTES, MAX_WORKER_SCRIPT_COMPRESSED_BYTES, WORKER_ENTRY_COMPRESSED_WARN_BYTES, assetFileTooLargeMessage, formatMebibytes, formatMegabytes, oversizedAssets, workerBundleNearLimitMessage, workerBundleTooLargeMessage, workerEntryNearLimitMessage, workerEntryTooLargeMessage, } from "./deploy-limits.js";
 import { guessZoneApex, relativeRecordName, zoneApexFor } from "./dns-host.js";
-import { dnsProviderProfile, recordAtProvider } from "./dns-providers.js";
-import { deriveDomainStatus, domainRecordStatuses, showsUseWww, } from "./domain-state.js";
+import { dnsProviderProfile, parkingRecordFor, recordAtProvider } from "./dns-providers.js";
+import { cacheMinutes, deriveDomainStatus, domainRecordStatuses, showsUseWww, } from "./domain-state.js";
 import { buildFileManifest, readManifestFile } from "./manifest.js";
 import { NO_PUBLIC_ASSETS, normalizeAssetsDirectory, privateLookingPaths, publicAssetPath } from "./public-assets.js";
 import { API_KEY_HELP, API_URL_HELP, CLI_CLIENT_ID, DEFAULT_API_URL, reportCliError } from "./cli-config.js";
@@ -52,7 +52,33 @@ export function deployDatabaseClause(databases) {
     const listed = databases.map((database) => (database.name ? `${database.bindingName}:${database.name}` : database.bindingName)).join(", ");
     return `${databases.length === 1 ? "database" : "databases"} ${listed}`;
 }
-export const CLI_VERSION = "0.78.0";
+// What `9pm delete` says about the app's custom domains beyond the count: the records the API
+// says each removed one used, under the same value-conditional rule as `domains remove`, and the
+// ones still being released, which get no deletion advice. Never throws: the delete has already
+// happened, so a malformed entry costs that entry's advice, not the command.
+export function deletedDomainLines(deleted) {
+    const lines = [];
+    try {
+        const releasing = Array.isArray(deleted.customDomainsReleasing)
+            ? deleted.customDomainsReleasing.filter((hostname) => typeof hostname === "string" && hostname !== "")
+            : [];
+        const cleanups = Array.isArray(deleted.customDomainCleanup) ? deleted.customDomainCleanup.map(parseDomainCleanup) : [];
+        for (const cleanup of cleanups) {
+            // A domain that is also reported as still releasing keeps its records, whatever else says otherwise.
+            if (!cleanup || releasing.includes(cleanup.hostname))
+                continue;
+            lines.push(...domainCleanupLines(cleanup));
+        }
+        for (const hostname of releasing) {
+            lines.push(`${hostname} has stopped serving, but removing it upstream is still finishing; it finishes on its own. ${DOMAIN_RELEASE_NO_CLEANUP}`);
+        }
+    }
+    catch {
+        return lines;
+    }
+    return lines;
+}
+export const CLI_VERSION = "0.81.0";
 const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
 const TOKEN_SERVICE = "9pm";
 const TOKEN_ACCOUNT = "default";
@@ -3267,8 +3293,12 @@ export function domainStatusJson(domain, app, checkedAt) {
         checkedAt,
         reason: fromServer ? (domain.reason ?? null) : derived.reason,
         next: fromServer ? (domain.next ?? derived.next) : derived.next,
+        removing: isRemoving(domain),
     };
 }
+function isRemoving(domain) {
+    return typeof domain.releasingAt === "string" && domain.releasingAt !== "" && domain.releaseIntent === "remove";
+}
 const DOMAIN_STATE_LABELS = {
     live: "live",
     waiting_for_dns: "waiting for DNS records",
@@ -3328,9 +3358,33 @@ function providerMessageLine(reason) {
     return `${who} reported (${message.seenAt}): ${message.text}`;
 }
 const TXT_KEEP_OTHERS = "add this value as its own TXT record; other TXT values can stay";
-function recordStateText(record, routing) {
+// The server's next background check as "HH:MM UTC" (UTC so the line reads the same on any
+// machine); null when there is none or it is not a date, so no time is promised from it.
+export function nextCheckText(nextCheckAt) {
+    if (typeof nextCheckAt !== "string" || nextCheckAt === "")
+        return null;
+    const at = new Date(nextCheckAt);
+    return Number.isNaN(at.getTime()) ? null : `${at.toISOString().slice(11, 16)} UTC`;
+}
+// "up to N min" for a cache's time left, or nothing when the resolver did not say.
+function forUpTo(ttlSeconds) {
+    return typeof ttlSeconds === "number" ? ` for up to ${cacheMinutes(ttlSeconds)} min` : "";
+}
+function answerText(current) {
+    return current.length > 0 ? current.join(", ") : "nothing";
+}
+function recordStateText(record, routing, parking = null) {
     if (record.ok === true)
         return "found";
+    if (record.check === "resolvers_disagree") {
+        // Two caches that disagree prove neither answer current: no "found", no "replace", and neither answer called old.
+        const answers = record.resolvers ?? [];
+        const seeing = answers.filter((answer) => answer.matches).map((answer) => answer.resolver);
+        const others = answers
+            .filter((answer) => !answer.matches)
+            .map((answer) => `${answer.resolver} sees ${answerText(answer.current)}${typeof answer.ttlSeconds === "number" ? ` (and may keep that answer${forUpTo(answer.ttlSeconds)})` : ""}`);
+        return `public resolvers disagree: ${seeing.join(" and ")} ${seeing.length > 1 ? "see" : "sees"} the value shown, ${others.join("; ")}. That usually means a recent change is still spreading; make sure your DNS host shows the value shown, then check again`;
+    }
     if (record.check === "doubled") {
         // The same name the NAME column shows, so the hint never contradicts the host's convention.
         const name = record.nameAtProvider ?? record.name;
@@ -3342,17 +3396,41 @@ function recordStateText(record, routing) {
     if (record.check === "apex_addresses") {
         return routing === "active"
             ? "looks connected: the root answers with addresses, as an ALIAS does, and routing is active"
-            : `answers with addresses (${(record.current ?? []).join(", ")}); an ALIAS can't be verified from outside, so this waits on the platform's routing check`;
+            : // A parking page answers with addresses too, so nothing here says the record is right: the owner confirms it.
+                `answers with addresses (${(record.current ?? []).join(", ")}); an ALIAS can't be verified from outside, and a parking page answers with addresses too: make sure the ALIAS or ANAME record at the root points at the value shown. The platform's routing check confirms it`;
     }
     if (record.ok === null || record.current === null)
         return "not checked: couldn't read your DNS just now";
+    // TXT before wildcard: a name may hold several TXT values another certificate still needs, so a
+    // TXT value is always added beside them, never "changed", whatever answers at the name.
     if (record.type === "TXT") {
-        const now = record.current.length === 0 ? "not published yet" : `currently ${record.current.join(", ")}`;
+        const from = record.check === "wildcard" && record.wildcard ? ` (from the wildcard ${record.wildcard})` : "";
+        const now = record.current.length === 0 ? "not published yet" : `currently ${record.current.join(", ")}${from}`;
         return `${now}: ${TXT_KEEP_OTHERS}`;
     }
+    if (record.check === "wildcard") {
+        const name = record.nameAtProvider ?? record.name;
+        // A name holding a CNAME can hold nothing else, so an explicit record equal to the wildcard's answer is changed, not joined.
+        return `no ${record.type} record of its own yet: your DNS host's wildcard ${record.wildcard ?? ""} answers for it (${record.current.join(", ")}). Add one at ${name === "" ? "the root" : name} with the value shown; the wildcard can stay. If your DNS host already lists a record at this name, change that one instead${parkingText(parking)}`;
+    }
     if (record.current.length === 0)
         return "not published yet";
-    return `currently ${record.current.join(", ")}: point it at the value shown`;
+    // A changed record can keep its old answer in public caches for its TTL, which is said so the owner does not change it twice.
+    const recent = typeof record.ttlSeconds === "number" ? ` (if you changed it in the last ${cacheMinutes(record.ttlSeconds)} min, this may be the old answer still cached)` : "";
+    // Two resolvers can each hold a different old answer; both are shown, as neither is the expected value.
+    const shown = record.current.join(", ");
+    const others = (record.resolvers ?? []).filter((answer) => answer.current.join(", ") !== shown);
+    const also = others.map((answer) => `; ${answer.resolver} answers ${answerText(answer.current)}`).join("");
+    return `currently ${shown}${also}${recent}: point it at the value shown${parkingText(parking)}`;
+}
+// Said only when the check saw the host's documented parking value (parkingRecordFor), and
+// conditionally even then: the record may have been changed since the check.
+function parkingText(parking) {
+    if (!parking)
+        return "";
+    return parking.wildcard
+        ? `. If ${parking.wildcard} still points at ${parking.value}, it is ${parking.provider}'s default parking record and can be removed; the record shown works either way`
+        : `. If this record still points at ${parking.value}, it is ${parking.provider}'s default parking record and can be replaced: that only takes down ${parking.provider}'s parking page`;
 }
 // A printed command carries --owner and, when the destination is not the built-in default,
 // --api-url: pasted into a shell without NINEPM_API_URL it would otherwise act on production.
@@ -3365,6 +3443,7 @@ function domainCommand(subcommand, app, hostname, options) {
 export const DNS_PROVIDER_NOTES = {
     gandiLiveDns: "At Gandi, an ALIAS works only with LiveDNS, and no A or AAAA record may stay at @ beside it.",
     hostingerCnameAtRoot: "At Hostinger, add the root record as a CNAME with name @: Hostinger shows it as ALIAS. A domain can have only one.",
+    porkbunDnsScreen: "At Porkbun, edit these in the domain's own DNS records: ACCOUNT > Domain Management, then DNS next to the domain. Not in a tool that changes several domains at once.",
     // Unverified, so never printed; its text is here so a leak would show.
     route53TxtQuotes: "In the Route 53 console, a TXT value may need to be entered in quotes.",
 };
@@ -3405,6 +3484,9 @@ function renderColumns(rows) {
         .trimEnd());
 }
 export function formatDomainStatus(status, options = {}) {
+    if (status.removing) {
+        return [`${status.hostname} (app ${status.app}): being removed`, ...domainRemovalPendingLines(status.hostname, status.app, options)];
+    }
     const lines = [`${status.hostname} (app ${status.app}): ${domainStateLabel(status.state)}`];
     if (status.state === "live") {
         lines.push(`Serving at https://${status.hostname}`);
@@ -3446,10 +3528,12 @@ export function formatDomainStatus(status, options = {}) {
                 ["TYPE", "NAME", "VALUE", "STATE"],
                 ...shown.map((record) => [
                     // null: a root the host has no record type for, shown only once routing is already active.
-                    record.typeAtProvider ?? "-",
+                    // A host with no profile may call the root record either name, so the table gives both;
+                    // --json keeps its single `typeAtProvider` value.
+                    record.apex && !profile && record.typeAtProvider === "ALIAS" ? "ALIAS / ANAME" : (record.typeAtProvider ?? "-"),
                     record.nameAtProvider === "" ? "(leave empty)" : record.nameAtProvider,
                     record.valueAtProvider,
-                    recordStateText(record, status.routing),
+                    recordStateText(record, status.routing, profile ? parkingRecordFor(status.providerId, record) : null),
                 ]),
             ];
             lines.push(...renderColumns(rows).map((line) => `  ${line}`));
@@ -3510,6 +3594,10 @@ export function formatDomainStatus(status, options = {}) {
     }
     else if (status.state === "issuing_certificate") {
         lines.push("Every required record is published. The platform finishes on its own, usually within minutes.");
+        const nextCheck = nextCheckText(status.next?.nextCheckAt);
+        // A restart is not offered here: nothing measured says it speeds issuance up.
+        if (nextCheck)
+            lines.push(`The platform checks it again around ${nextCheck} on its own; nothing needs restarting.`);
     }
     lines.push(`Then run: ${domainCommand("wait", status.app, status.hostname, options)}`);
     return lines;
@@ -3525,12 +3613,16 @@ export function domainWaitTimeoutMessage(status) {
         return "Timed out: a CAA record stops the certificate from being issued. Change it as described above, then wait again.";
     }
     if (status.state === "issuing_certificate") {
-        return "Timed out: the records are published and the platform is still finishing. Wait again; nothing needs changing.";
+        const nextCheck = nextCheckText(status.next?.nextCheckAt);
+        return `Timed out: the records are published and the platform is still finishing. Wait again; nothing needs changing.${nextCheck ? ` Its next automatic check is around ${nextCheck}.` : ""}`;
     }
     const required = status.records.filter((record) => !record.optional);
     if (required.some((record) => record.ok === false)) {
         return "Timed out: records above are still missing. Publish them, then wait again.";
     }
+    if (required.some((record) => record.check === "resolvers_disagree")) {
+        return "Timed out: public resolvers still disagree about a record above. Make sure your DNS host shows the value shown, then wait again.";
+    }
     return "Timed out: the DNS records could not be checked. Make sure they are published as shown, then wait again.";
 }
 export function formatDomainsList(statuses) {
@@ -3539,17 +3631,20 @@ export function formatDomainsList(statuses) {
     }
     return renderColumns([
         ["HOSTNAME", "APP", "STATE", "ROUTING", "TLS"],
-        ...statuses.map((status) => [status.hostname, status.app, status.state, status.routing, status.tls]),
+        ...statuses.map((status) => [status.hostname, status.app, status.removing ? "removing" : status.state, status.routing, status.tls]),
     ]);
 }
 export class DomainsApiError extends Error {
     status;
     code;
-    constructor(message, status, code) {
+    // The refusal's `details.reason`, where it carries one.
+    reason;
+    constructor(message, status, code, reason = null) {
         super(message);
         this.name = "DomainsApiError";
         this.status = status;
         this.code = code;
+        this.reason = reason;
     }
 }
 // The API's own message and code, plus `details.reason` where the refusal carries one
@@ -3572,9 +3667,14 @@ export function domainsApiError(status, text) {
     const reason = details && typeof details === "object" && typeof details.reason === "string"
         ? details.reason
         : null;
-    return new DomainsApiError(`${message} (${code}${reason ? `, reason: ${reason}` : ""})`, status, code);
+    return new DomainsApiError(`${message} (${code}${reason ? `, reason: ${reason}` : ""})`, status, code, reason);
 }
 async function domainsRequest(options, route, init = { method: "GET" }) {
+    return (await domainsResponse(options, route, init)).body;
+}
+// The body with the status beside it, for an answer whose status carries meaning of its own
+// (a removal still finishing answers 202).
+async function domainsResponse(options, route, init = { method: "GET" }) {
     const fetchFn = options.fetchFn ?? fetch;
     const headers = new Headers(init.headers);
     headers.set("authorization", `Bearer ${options.token}`);
@@ -3586,7 +3686,7 @@ async function domainsRequest(options, route, init = { method: "GET" }) {
     if (!response.ok) {
         throw domainsApiError(response.status, await response.text());
     }
-    return (await response.json());
+    return { status: response.status, body: (await response.json()) };
 }
 function ownerQuery(owner) {
     return owner ? `?owner=${encodeURIComponent(owner)}` : "";
@@ -3631,10 +3731,177 @@ export async function restartDomain(options) {
     return domainsRequest(options, siteDomainsRoute(options, normalizeDomainArg(options.hostname), "restart"), { method: "POST" });
 }
 export async function removeDomain(options) {
-    const result = await domainsRequest(options, siteDomainsRoute(options, normalizeDomainArg(options.hostname)), {
-        method: "DELETE",
+    const requested = normalizeDomainArg(options.hostname);
+    const { status, body } = await domainsResponse(options, siteDomainsRoute(options, requested), { method: "DELETE" });
+    return removalFromResponse(status, body, requested);
+}
+// Never throws: the removal has happened by the time this reads the answer, so a malformed body
+// costs the advice, not the command.
+export function removalFromResponse(status, body, requested) {
+    try {
+        const fields = body && typeof body === "object" ? body : {};
+        const domain = fields.domain && typeof fields.domain === "object" ? fields.domain : null;
+        const hostname = typeof domain?.hostname === "string" && domain.hostname !== "" ? domain.hostname : requested;
+        const releasing = status === 202 || fields.releasing === true;
+        return { body, hostname, releasing, cleanup: releasing ? null : parseDomainCleanup(fields.cleanup) };
+    }
+    catch {
+        return { body, hostname: requested, releasing: status === 202, cleanup: null };
+    }
+}
+// The server's `cleanup` (or one `customDomainCleanup` entry), kept only as far as it is well
+// formed: a malformed record is dropped, never guessed at, and a malformed whole is null.
+export function parseDomainCleanup(value) {
+    try {
+        if (!value || typeof value !== "object")
+            return null;
+        const { hostname, records } = value;
+        if (typeof hostname !== "string" || hostname === "" || !Array.isArray(records))
+            return null;
+        const kept = [];
+        for (const record of records) {
+            if (!record || typeof record !== "object")
+                continue;
+            const { type, host, value: recordValue, purpose } = record;
+            if (typeof type !== "string" || typeof host !== "string" || typeof recordValue !== "string" || type === "" || host === "" || recordValue === "")
+                continue;
+            kept.push({ type, host, value: recordValue, purpose: typeof purpose === "string" ? purpose : "" });
+        }
+        return { hostname, records: kept };
+    }
+    catch {
+        return null;
+    }
+}
+const CLEANUP_PURPOSES = {
+    routing: "pointed the domain at 9pm",
+    certificate: "validated the certificate",
+    ownership: "proved ownership; only there if you added it",
+};
+// The records a finished removal frees, each conditional on its value: a name can hold another
+// service's record by now (the domain pointed somewhere new, or `_acme-challenge` serving another
+// certificate), and the value is the only thing that tells ours apart. Nothing here is checked
+// against live DNS, so nothing is ever called safe to delete outright.
+export function domainCleanupLines(cleanup) {
+    if (cleanup.records.length === 0) {
+        return [`There are no DNS records of ours to delete for ${cleanup.hostname}.`];
+    }
+    const apex = guessZoneApex(cleanup.hostname);
+    const rows = [
+        ["TYPE", "NAME", "VALUE", "WAS FOR"],
+        ...cleanup.records.map((record) => [
+            record.type.toUpperCase(),
+            relativeRecordName(record.host, apex),
+            record.value,
+            Object.hasOwn(CLEANUP_PURPOSES, record.purpose) ? (CLEANUP_PURPOSES[record.purpose] ?? "") : "",
+        ]),
+    ];
+    return [
+        `You can now delete these DNS records for ${cleanup.hostname} where your domain's DNS is managed, each only if its value is unchanged:`,
+        ...renderColumns(rows).map((line) => `  ${line}`),
+        "Delete a record only while it still has the value shown. If one of these names now holds a different value, for example because the domain points somewhere new, that record is not ours: leave it.",
+    ];
+}
+// Said wherever a removal is left to finish in the background: only the API's own cleanup may
+// name records to delete, and a removal that finishes there produces none.
+const DOMAIN_RELEASE_NO_CLEANUP = "Leave its DNS records in place for now. The CLI cannot list which DNS records to delete for a removal that finishes in the background.";
+// A removal that has stopped serving but is still finishing upstream: nothing is called removed
+// and no record is offered for deletion. A removal the background sweep finishes deletes the row
+// and returns no cleanup to anyone, so no later command is promised to list the records either.
+export function domainRemovalPendingLines(hostname, app, options) {
+    const owner = options.owner ? ` --owner ${quoteSiteArg(options.owner)}` : "";
+    return [
+        `${app} no longer serves ${hostname}, but removing it upstream is taking longer than usual. It finishes on its own.`,
+        `Once ${hostname} is no longer in this list, it has stopped serving from 9pm: 9pm domains list ${quoteSiteArg(app)}${owner}${apiUrlFlagFor(options.target)}`,
+        DOMAIN_RELEASE_NO_CLEANUP,
+    ];
+}
+export async function moveDomain(options) {
+    const hostname = normalizeDomainArg(options.hostname);
+    const body = await domainsRequest(options, siteDomainsRoute(options, hostname, "move"), {
+        method: "POST",
+        body: JSON.stringify({ toSiteId: options.to.trim() }),
     });
-    return result.domain;
+    const fields = body && typeof body === "object" ? body : {};
+    const slugOf = (side) => {
+        const slug = side && typeof side === "object" ? side.slug : undefined;
+        return typeof slug === "string" && slug !== "" ? slug : null;
+    };
+    return { body, hostname, from: slugOf(fields.from), to: slugOf(fields.to) };
+}
+// The app holding a hostname in this account, for `move` without a source app. From the stored
+// list (`reconcile=0`), so finding it costs no provider call; null when the account has no such
+// domain. Throws when the list cannot be read, which is not the same answer as "none".
+export async function findDomainApp(options) {
+    const hostname = normalizeDomainArg(options.hostname);
+    const query = new URLSearchParams({ reconcile: "0", ...(options.owner ? { owner: options.owner } : {}) });
+    const result = await domainsRequest(options, `/v1/domains?${query.toString()}`);
+    if (!Array.isArray(result?.domains))
+        throw new Error("the domains list came back in a shape this CLI does not read");
+    for (const entry of result.domains) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const domain = entry;
+        if (typeof domain.hostname !== "string" || normalizeDnsName(domain.hostname) !== hostname)
+            continue;
+        const slug = domain.app && typeof domain.app === "object" ? domain.app.slug : undefined;
+        if (typeof slug !== "string" || slug === "")
+            throw new Error(`the domains list names no app for ${hostname}`);
+        return slug;
+    }
+    return null;
+}
+// What to do about each move refusal, beside the server's own message. Printed commands carry
+// --owner and a non-default --api-url, never a credential.
+export function domainMoveRefusalLines(error, move, options) {
+    const owner = options.owner ? ` --owner ${quoteSiteArg(options.owner)}` : "";
+    const apiUrl = apiUrlFlagFor(options.target);
+    const host = normalizeDomainArg(move.hostname);
+    const list = (app) => `9pm domains list${app ? ` ${quoteSiteArg(app)}` : ""}${owner}${apiUrl}`;
+    const removeHere = `9pm domains remove ${quoteSiteArg(move.site)} ${host} --confirm ${host}${owner}${apiUrl}`;
+    const addThere = domainCommand("add", move.to, host, options);
+    switch (error.code) {
+        case "custom_domain_not_found":
+            return [`${host} is not a custom domain of ${move.site}. See which app holds it: ${list()}`];
+        case "project_not_found":
+            return [`No app ${move.to} that you can open was found. List the apps: 9pm apps${owner}${apiUrl}`];
+        case "custom_domain_quota_exceeded":
+            return [`${move.to} already has as many custom domains as the plan allows. Remove one from it first: ${list(move.to)}`];
+        case "plan_custom_domains_unavailable":
+            return ["The plan this account is on includes no custom domains, so no app in it can take one."];
+        case "custom_domain_release_pending":
+            return [`A removal of ${host} is still finishing, so it can't move until that is done. Try again in a few minutes; see where it stands: ${list(move.site)}`];
+        case "custom_domain_move_not_provisioned":
+            if (error.reason === "source_service_mode") {
+                return [
+                    `${move.site} uses service tokens, so ${host} was disconnected and has nothing to move. Remove it there, then add it to ${move.to}; it gets new DNS records to publish:`,
+                    `  ${removeHere}`,
+                    `  ${addThere}`,
+                ];
+            }
+            return [
+                `${host} isn't provisioned yet, so there is no certificate to move. Remove it here and add it to ${move.to} instead; it gets new DNS records to publish:`,
+                `  ${removeHere}`,
+                `  ${addThere}`,
+            ];
+        case "custom_domain_move_cross_account":
+            return [
+                `${move.to} is in another account, and a domain moves only between apps of one account. Remove it here, then add it from that account; it gets new DNS records to publish:`,
+                `  ${removeHere}`,
+            ];
+        case "custom_domains_public_only":
+            return [`${move.to} uses service tokens, which can't hold a custom domain. Choose another app, or change its access mode first.`];
+        case "custom_domain_redeploy_required":
+            return [`Redeploy ${move.to} once, then run the move again.`];
+        case "custom_domain_expired":
+            return [`${host} expired before its DNS records were published. Add it to ${move.to} instead: ${addThere}`];
+        case "custom_domain_move_conflict":
+            return [`Something changed while the domain was moving. See where it is now: ${list()}`];
+        case "custom_domain_move_same_app":
+            return [`${host} already belongs to ${move.site}; nothing to move.`];
+        default:
+            return [];
+    }
 }
 // The domains read is a reconcile plus a DNS lookup per record, so it can be slow; the deploy
 // has already succeeded and must not wait on it for longer than this.
@@ -3696,6 +3963,9 @@ export function deployCustomDomainLines(statuses, slug, owner, target) {
         ];
     }
     return statuses.map((status) => {
+        // A removal still finishing reads as whatever state the row last held, "live" included.
+        if (status.removing)
+            return `Custom domain ${status.hostname} is being removed.`;
         if (status.state === "live")
             return `Also serving at https://${status.hostname}`;
         const notLive = status.state === "failed" || status.state === "expired" ? "is not live" : "is not live yet";
@@ -3715,6 +3985,9 @@ export async function waitForDomain(options) {
             const status = await getDomainStatus(options);
             last = status;
             options.onStatus?.(status);
+            // Being removed: it will not go live, whatever state the row last held.
+            if (status.removing)
+                return { status, exitCode: DOMAIN_WAIT_EXIT.failed, timedOut: false };
             if (status.state === "live")
                 return { status, exitCode: DOMAIN_WAIT_EXIT.live, timedOut: false };
             if (status.state === "failed" || status.state === "expired")
@@ -3740,7 +4013,7 @@ export async function waitForDomain(options) {
         await sleepFn(Math.min(options.intervalMs, remaining));
     }
 }
-const DOMAINS_VALUE_FLAGS = new Set(["token", "api-url", "owner", "timeout", "interval", "confirm"]);
+const DOMAINS_VALUE_FLAGS = new Set(["token", "api-url", "owner", "timeout", "interval", "confirm", "to"]);
 const DOMAINS_BOOLEAN_FLAGS = new Set(["json"]);
 function domainsPositionals(argv) {
     const positionals = [];
@@ -3766,7 +4039,8 @@ const DOMAINS_USAGE = {
     check: "9pm domains check <app> <hostname> [--owner <organisation>] [--json]",
     wait: "9pm domains wait <app> <hostname> [--timeout 30m] [--interval 20s] [--owner <organisation>] [--json]",
     restart: "9pm domains restart <app> <hostname> [--owner <organisation>]  (for a failed certificate; the record values may change)",
-    remove: "9pm domains remove <app> <hostname> --confirm <hostname> [--owner <organisation>]",
+    remove: "9pm domains remove <app> <hostname> --confirm <hostname> [--owner <organisation>] [--json]",
+    move: "9pm domains move [<app>] <hostname> --to <app> [--owner <organisation>] [--json]",
 };
 function parseDomainsArgs(argv) {
     const subcommand = argv[0] === "ls" ? "list" : argv[0] === "rm" ? "remove" : argv[0];
@@ -3794,6 +4068,13 @@ function parseDomainsArgs(argv) {
         const site = positionals[0];
         return withBase({ kind: "list", json, ...(site ? { site } : {}) });
     }
+    if (subcommand === "move") {
+        const to = readStringFlag(flags, "to");
+        const [first, second] = positionals;
+        if (!to || !first || positionals.length > 2)
+            throw new Error(`Usage: ${usage}`);
+        return withBase(second === undefined ? { kind: "move", hostname: first, to, json } : { kind: "move", site: first, hostname: second, to, json });
+    }
     const [site, hostname] = positionals;
     if (!site || !hostname || positionals.length > 2) {
         throw new Error(`Usage: ${usage}`);
@@ -3817,7 +4098,7 @@ function parseDomainsArgs(argv) {
     if (!confirm || normalizeDomainArg(confirm) !== normalizeDomainArg(hostname)) {
         throw new Error(`Removing a domain stops it serving at once. Pass --confirm ${normalizeDomainArg(hostname)} to remove it.`);
     }
-    return withBase({ kind: "remove", site, hostname });
+    return withBase({ kind: "remove", site, hostname, json });
 }
 function printDomainStatus(status, json, options, heading) {
     if (json) {
@@ -3850,6 +4131,10 @@ async function runDomainsCommand(command) {
             console.log(line);
         return;
     }
+    if (action.kind === "move") {
+        await runDomainMove(action, base, format);
+        return;
+    }
     const target = { ...base, site: action.site, hostname: action.hostname };
     if (action.kind === "add") {
         const added = await addDomain(target);
@@ -3915,15 +4200,63 @@ async function runDomainsCommand(command) {
             console.log(line);
         return;
     }
-    const removed = await removeDomain(target);
-    const hostname = removed?.hostname ?? normalizeDomainArg(action.hostname);
-    console.log(`Removed ${hostname} from ${action.site}. It stops serving within seconds.`);
-    if (removed && removed.dnsInstructions.length > 0) {
-        console.log("You can now delete these records at your DNS provider, if nothing else uses them:");
-        for (const line of instructionLines(removed.dnsInstructions, hostname))
+    const removal = await removeDomain(target);
+    if (action.json) {
+        console.log(JSON.stringify(removal.body, null, 2));
+        return;
+    }
+    if (removal.releasing) {
+        console.log(`Removing ${removal.hostname} from ${action.site} is still finishing.`);
+        for (const line of domainRemovalPendingLines(removal.hostname, action.site, format))
+            console.log(line);
+        return;
+    }
+    console.log(`Removed ${removal.hostname} from ${action.site}. It stops serving within seconds.`);
+    if (removal.cleanup) {
+        for (const line of domainCleanupLines(removal.cleanup))
             console.log(line);
     }
 }
+async function runDomainMove(action, base, format) {
+    const hostname = normalizeDomainArg(action.hostname);
+    const owner = format.owner ? ` --owner ${quoteSiteArg(format.owner)}` : "";
+    const apiUrl = apiUrlFlagFor(format.target);
+    let site = action.site;
+    if (!site) {
+        let found;
+        try {
+            found = await findDomainApp({ ...base, hostname });
+        }
+        catch (error) {
+            // Finding the app is a convenience in front of the move, which has not been tried.
+            throw new Error(`Couldn't look up which app holds ${hostname} (${error instanceof Error ? error.message : String(error)}). Nothing was moved. Name the app it is on: 9pm domains move <app> ${hostname} --to ${quoteSiteArg(action.to)}${owner}${apiUrl}`);
+        }
+        if (!found) {
+            throw new DomainsApiError(`${hostname} is not a custom domain in this account (custom_domain_not_found). See the account's domains: 9pm domains list${owner}${apiUrl}`, 404, "custom_domain_not_found");
+        }
+        site = found;
+    }
+    let moved;
+    try {
+        moved = await moveDomain({ ...base, site, hostname, to: action.to });
+    }
+    catch (error) {
+        if (error instanceof DomainsApiError) {
+            const advice = domainMoveRefusalLines(error, { site, hostname, to: action.to }, format);
+            if (advice.length > 0)
+                throw new DomainsApiError([error.message, ...advice].join("\n"), error.status, error.code, error.reason);
+        }
+        throw error;
+    }
+    if (action.json) {
+        console.log(JSON.stringify(moved.body, null, 2));
+        return;
+    }
+    const to = moved.to ?? action.to;
+    console.log(`Moved ${moved.hostname} from ${moved.from ?? site} to ${to}.`);
+    console.log("It keeps its certificate and the DNS records you published, so nothing has to be validated again. Leave those records as they are.");
+    console.log(`Check it: ${domainCommand("status", to, moved.hostname, format)}`);
+}
 // #807 step 5: the claim behind a health verdict, in words. A bare `unknown` reads
 // as "fine"; the reason says which statement the platform is actually making.
 export function healthWithReason(status, reason) {
@@ -5539,6 +5872,8 @@ async function main() {
             if (deleted.customDomainNames && deleted.customDomainNames.length > 0) {
                 console.log(`Removed custom domain(s): ${deleted.customDomainNames.join(", ")}.`);
             }
+            for (const line of deletedDomainLines(deleted))
+                console.log(line);
             // #722: a partial external-cleanup failure never fails the delete, and used to be
             // silently discarded here — visible only in the raw JSON, if a caller happened to
             // read it. Surfacing it is the whole reason a human running this command manually
@@ -5938,7 +6273,8 @@ function printUsage() {
   9pm domains check <app> <hostname> [--json]      re-check now, then print the status
   9pm domains wait <app> <hostname> [--timeout 30m] [--interval 20s] [--json]
   9pm domains restart <app> <hostname>             for a failed certificate only: start validation over; record values may change
-  9pm domains remove <app> <hostname> --confirm <hostname>
+  9pm domains remove <app> <hostname> --confirm <hostname> [--json]   prints the DNS records you can then delete
+  9pm domains move [<app>] <hostname> --to <app> [--json]           to another app of the same account; keeps its certificate and records
   9pm access show <site>
   9pm access public <site> [--switch-mode]
   9pm access otp <site> [--switch-mode]
@@ -5991,10 +6327,10 @@ Missing pages (static sites and --entry worker apps):
 
 Custom domains:
   Every domains command takes --owner <organisation> for an organisation's app. list, status and
-  wait only read; add, check, restart and remove need the configure role on the app.
+  wait only read; add, check, restart, remove and move need the configure role on the app.
   --json prints {hostname, app, state, reason, next, routing, tls, provider, nameservers,
   records[{type, name, fqdn, expected, current, ok, check, apex, optional}], error, expiresAt,
-  checkedAt}. state is one of live, waiting_for_dns, dns_unverified (routing is active but the
+  checkedAt, removing}. state is one of live, waiting_for_dns, dns_unverified (routing is active but the
   records could not be checked), issuing_certificate (every required record checked and found),
   failed, expired. reason says why (reason.providerMessage is the provider's own text, when it
   reported any, and its source: certificate_authority or hostname); next says who acts next (owner or platform) and what to do.
@@ -6004,7 +6340,11 @@ Custom domains:
   wait exits 0 when live, 10 on timeout with something for the owner to do (records missing or
   unverified, or a CAA record blocking the certificate), 11 on timeout with every record found and
   nothing for the owner to do (the platform is still finishing), 20 when the domain failed or
-  expired, and 1 on a usage, auth or API error.
+  expired, and 1 on a usage, auth or API error. A domain whose removal is still finishing shows
+  as removing ("removing": true in --json), and wait on it exits 20.
+  remove prints only the records the API says this domain used, each to delete only if its value
+  is unchanged; while the removal is still finishing (a 202) it prints none. remove and move
+  --json print the API's answer as it came.
 
 Container deploys:
   Requires Docker locally. The CLI builds linux/amd64, exports the image, uploads it through a short-lived session, then finalizes a queued deployment.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ninepm",
-  "version": "0.78.0",
+  "version": "0.81.0",
   "description": "CLI for deploying built apps to 9pm.ai.",
   "homepage": "https://9pm.ai",
   "keywords": [