ninepm 0.79.0 → 0.81.0

package/README.md

@@ -217,7 +217,8 @@ Connect a domain you own to an app:
 This prints the DNS records to publish at your DNS provider, with names relative to your
 domain (`www`, `_acme-challenge.www`) and what DNS shows for each right now. When a TXT value
 is missing, add it as its own TXT record; other TXT values on that name can stay. The root of
-your domain (`@`) cannot hold a CNAME, so a root domain is shown as an `ALIAS` record: add it as
+your domain (`@`) cannot hold a CNAME, so a root domain is shown as an `ALIAS / ANAME` record when
+your DNS host is not one the CLI recognises (a recognised host's own name for it otherwise): add it as
 ALIAS or ANAME (or a CNAME your provider flattens). A correct ALIAS answers with addresses, which
 cannot be compared from outside, so that row follows the platform's own routing check. Then:
 
@@ -258,13 +259,34 @@ Since 0.78.0 each record also carries `typeAtProvider`, `nameAtProvider` (`""` m
 field empty) and `valueAtProvider`: the record as a recognised DNS host's editor wants it.
 `typeAtProvider` is `null` for a root record the host cannot hold (GoDaddy, Route 53, IONOS, Wix);
 the text output then suggests connecting `www` instead. `list`, `status` and `wait`
-only read; `add`, `check`, `restart` and `remove` need permission to configure the app.
+only read; `add`, `check`, `restart`, `remove` and `move` need permission to configure the app.
+
+`9pm domains remove` prints only the records the API says the domain used, each to delete only if
+its value is unchanged: a name that now holds a different value (the domain points somewhere new, or
+another service's certificate check uses `_acme-challenge`) is not ours, so leave it. Against a server
+that sends no such list it prints no deletion advice at all. When the removal is still finishing
+upstream (the API answers `202` with `releasing: true`), it says so, names no record to delete, and
+prints the `9pm domains list` command: once the domain is no longer listed, it has stopped serving
+from 9pm. A removal that finishes in the background returns no record list, so the CLI cannot say
+which DNS records to delete for it. Such a domain shows as `removing`
+in `list` and `status` (`"removing": true` in `--json`), and `wait` on it exits `20`. Since 0.80.0.
+
+`9pm domains move <hostname> --to <app>` moves a domain to another app of the same account. It keeps
+its certificate and the DNS records already published, so nothing is validated again. Without a
+source app the CLI looks it up in the account; name it (`9pm domains move <app> <hostname> --to
+<app>`) to skip that. Each refusal is printed with what to do: the domain or the app is not found,
+the destination is at its custom-domain cap, a removal of the domain is still finishing, the domain
+was disconnected under a service-token app or was never provisioned (remove it and add it to the
+other app), or the destination is in another account. `remove --json` and `move --json` print the
+API's answer as it came. Since 0.80.0.
 
 Every `9pm deploy` lists the app's custom domains under its `Deployed` line: `Also serving at
 https://<domain>` for a live one, and for any other its state and the `9pm domains status`
 command to run. If the domains cannot be read within a few seconds, the deploy says so in one
 line instead; the deploy itself is never held back by it. `9pm delete` names the custom domains
-it removed.
+it removed and, since 0.80.0, the records the API says each one used (under the same
+value-unchanged rule); a domain still being released is reported as such, with no records to delete,
+and none can be listed for it later.
 
 ## Commands
 
@@ -293,7 +315,8 @@ it removed.
 9pm domains check <app> <hostname> [--json]
 9pm domains wait <app> <hostname> [--timeout 30m] [--interval 20s] [--json]
 9pm domains restart <app> <hostname>          # only after a certificate failed; record values may change
-9pm domains remove <app> <hostname> --confirm <hostname>
+9pm domains remove <app> <hostname> --confirm <hostname> [--json]
+9pm domains move [<app>] <hostname> --to <app> [--json]
 9pm access show <site>
 9pm access public <site> [--switch-mode]
 9pm access otp <site> [--switch-mode]

package/dist/dns-providers.d.ts

@@ -53,6 +53,12 @@ export interface DnsProviderProfile {
     /** The editor makes a hostname value relative unless it ends in a dot (Gandi). */
     valueNeedsTrailingDot?: true;
     notes: DnsProviderNote[];
+    /**
+     * The values the host's own help pages name as its default parking records. A routing record
+     * whose answer is one of these is the host's parking page, and only then is it named as such:
+     * knowing the host does not say what any one record at it is for.
+     */
+    parkingTargets?: string[];
     source: string;
 }
 export interface DnsProvider {
@@ -89,3 +95,27 @@ export declare function recordAtProvider(record: {
     value: string;
     apex: boolean;
 }, profile: DnsProviderProfile | undefined): RecordAtProvider;
+/** A DNS host's own parking record, as the live DNS check saw it. */
+export interface ParkingRecord {
+    /** The DNS host's display name. */
+    provider: string;
+    /** The parking value the record answered with. */
+    value: string;
+    /** Set when the answer came from a wildcard (`*.<parent>`): that wildcard is the parking record, the name has none. */
+    wildcard?: string;
+}
+/**
+ * Whether a routing record's answer is the DNS host's own default parking record. Every one of
+ * these must hold: the host is recognised and its help pages name the value (`parkingTargets`);
+ * the record is a CNAME, since a TXT or MX value is never a website record; the check found the
+ * record different from ours or answered by a wildcard (`check` as domain-state derives it, so
+ * a disagreement between resolvers, a doubled name or a root answering with addresses is never
+ * read as parking); and every value the check saw is that parking value. A value the owner set
+ * themselves at the same name, or a host the check did not recognise, gives null.
+ */
+export declare function parkingRecordFor(providerId: unknown, record: {
+    type: unknown;
+    check: unknown;
+    current: unknown;
+    wildcard?: unknown;
+}): ParkingRecord | null;

package/dist/dns-providers.js

@@ -77,9 +77,23 @@ export const DNS_PROVIDERS = [
         id: "porkbun",
         name: "Porkbun",
         nameservers: [/(^|\.)porkbun\.com$/],
-        // Documented: host blank for the root, "enter only the subdomain".
+        // Documented: host blank for the root, "enter only the subdomain"; the record editor is
+        // reached from ACCOUNT > Domain Management, then the domain's "DNS" button (231) or
+        // "Details" > "DNS Records" (68). Rechecked 2026-10-14.
         // https://kb.porkbun.com/article/231-how-to-add-dns-records-on-porkbun
-        profile: { apex: { support: "alias", typeLabel: "ALIAS", hostField: "blank" }, appendsZone: true, notes: [], source: DNS_PROVIDER_SOURCE },
+        // https://kb.porkbun.com/article/68-how-do-i-edit-dns
+        // Parking: "These records will have a value of 'pixie.porkbun.com'. They're in control of the
+        // default parking page", and Porkbun says to delete them once the site is hosted elsewhere.
+        // The page names neither record types nor hosts, so only the value is used. uixie.porkbun.com
+        // has been seen answering too, but no Porkbun page names it, so it is not listed.
+        // https://kb.porkbun.com/article/239-cname-alias-record-with-that-host-already-exists-error
+        profile: {
+            apex: { support: "alias", typeLabel: "ALIAS", hostField: "blank" },
+            appendsZone: true,
+            notes: [{ id: "porkbunDnsScreen", verified: true }],
+            parkingTargets: ["pixie.porkbun.com"],
+            source: DNS_PROVIDER_SOURCE,
+        },
     },
     {
         id: "namecom",
@@ -192,3 +206,36 @@ export function recordAtProvider(record, profile) {
         return { type: null, name: apex.hostField === "blank" ? "" : "@", value };
     return { type: apex.typeLabel, name: apex.hostField === "blank" ? "" : "@", value };
 }
+/**
+ * Whether a routing record's answer is the DNS host's own default parking record. Every one of
+ * these must hold: the host is recognised and its help pages name the value (`parkingTargets`);
+ * the record is a CNAME, since a TXT or MX value is never a website record; the check found the
+ * record different from ours or answered by a wildcard (`check` as domain-state derives it, so
+ * a disagreement between resolvers, a doubled name or a root answering with addresses is never
+ * read as parking); and every value the check saw is that parking value. A value the owner set
+ * themselves at the same name, or a host the check did not recognise, gives null.
+ */
+export function parkingRecordFor(providerId, record) {
+    if (typeof providerId !== "string" || providerId === "")
+        return null;
+    const provider = DNS_PROVIDERS.find((entry) => entry.id === providerId);
+    const targets = provider?.profile?.parkingTargets;
+    if (!provider || !targets || targets.length === 0)
+        return null;
+    if (typeof record.type !== "string" || record.type.toUpperCase() !== "CNAME")
+        return null;
+    if (record.check !== "different" && record.check !== "wildcard")
+        return null;
+    if (!Array.isArray(record.current) || record.current.length === 0)
+        return null;
+    const seen = record.current.map((value) => (typeof value === "string" ? value.trim().toLowerCase().replace(/\.$/, "") : null));
+    const first = seen[0];
+    if (typeof first !== "string" || !targets.includes(first) || seen.some((value) => value !== first))
+        return null;
+    if (record.check === "wildcard") {
+        if (typeof record.wildcard !== "string" || record.wildcard === "")
+            return null;
+        return { provider: provider.name, value: first, wildcard: record.wildcard };
+    }
+    return { provider: provider.name, value: first };
+}

package/dist/index.d.ts

@@ -108,6 +108,8 @@ export interface DeletedSiteResult {
     workers: number;
     customDomains: number;
     customDomainNames?: string[];
+    customDomainCleanup?: unknown;
+    customDomainsReleasing?: unknown;
     containerApplications?: number;
     containerImages?: number;
     accessApps: number;
@@ -118,6 +120,7 @@ export interface DeletedSiteResult {
     metadata: boolean;
     errors?: string[];
 }
+export declare function deletedDomainLines(deleted: Pick<DeletedSiteResult, "customDomainCleanup" | "customDomainsReleasing">): string[];
 export interface CreatedRuntimeToken {
     token: string;
     appAccessToken: AppAccessToken;
@@ -127,7 +130,7 @@ export interface CreatedServiceToken {
     clientSecret: string;
 }
 export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-export declare const CLI_VERSION = "0.79.0";
+export declare const CLI_VERSION = "0.81.0";
 type CredentialBackend = "macos-keychain" | "windows-dpapi" | "linux-secret-service" | "file-plaintext" | "none";
 export interface StoredCredentialEntry {
     token: string;
@@ -649,6 +652,13 @@ type CliCommand = {
         kind: "remove";
         site: string;
         hostname: string;
+        json: boolean;
+    } | {
+        kind: "move";
+        site?: string;
+        hostname: string;
+        to: string;
+        json: boolean;
     };
     apiUrl: string;
     token: string;
@@ -753,6 +763,8 @@ export interface CliDomain extends DomainStateInput {
     state?: string;
     reason?: DomainReason | null;
     next?: DomainNext;
+    releasingAt?: string | null;
+    releaseIntent?: string | null;
 }
 export interface DomainRecordStatusJson extends DomainRecordStatus {
     typeAtProvider: string | null;
@@ -779,6 +791,7 @@ export interface DomainStatusJson {
     checkedAt: string;
     reason: DomainReason | null;
     next: DomainNext;
+    removing: boolean;
 }
 export declare const DOMAIN_WAIT_EXIT: {
     readonly live: 0;
@@ -801,7 +814,8 @@ export declare function formatDomainsList(statuses: DomainStatusJson[]): string[
 export declare class DomainsApiError extends Error {
     readonly status: number;
     readonly code: string | null;
-    constructor(message: string, status: number, code: string | null);
+    readonly reason: string | null;
+    constructor(message: string, status: number, code: string | null, reason?: string | null);
 }
 export declare function domainsApiError(status: number, text: string): DomainsApiError;
 export interface DomainCommandOptions extends ApiOptions {
@@ -830,9 +844,48 @@ export declare function restartDomain(options: DomainCommandOptions & {
     domain: CliDomain;
     replacedInstructions: CliDnsInstruction[];
 }>;
+export interface DomainRemoval {
+    body: unknown;
+    hostname: string;
+    releasing: boolean;
+    cleanup: DomainCleanup | null;
+}
 export declare function removeDomain(options: DomainCommandOptions & {
     hostname: string;
-}): Promise<CliDomain | null>;
+}): Promise<DomainRemoval>;
+export declare function removalFromResponse(status: number, body: unknown, requested: string): DomainRemoval;
+export interface DomainCleanupRecord {
+    type: string;
+    host: string;
+    value: string;
+    purpose: string;
+}
+export interface DomainCleanup {
+    hostname: string;
+    records: DomainCleanupRecord[];
+}
+export declare function parseDomainCleanup(value: unknown): DomainCleanup | null;
+export declare function domainCleanupLines(cleanup: DomainCleanup): string[];
+export declare function domainRemovalPendingLines(hostname: string, app: string, options: DomainFormatOptions): string[];
+export interface DomainMove {
+    body: unknown;
+    hostname: string;
+    from: string | null;
+    to: string | null;
+}
+export declare function moveDomain(options: DomainCommandOptions & {
+    hostname: string;
+    to: string;
+}): Promise<DomainMove>;
+export declare function findDomainApp(options: ApiOptions & {
+    owner?: string;
+    hostname: string;
+}): Promise<string | null>;
+export declare function domainMoveRefusalLines(error: DomainsApiError, move: {
+    site: string;
+    hostname: string;
+    to: string;
+}, options: DomainFormatOptions): string[];
 export declare const DEPLOY_DOMAINS_TIMEOUT_MS = 4500;
 export declare function deployCustomDomainStatuses(options: ApiOptions & {
     projectId: string;

package/dist/index.js

@@ -14,7 +14,7 @@ import { MAX_DEPLOY_DESCRIPTION_LENGTH, normalizeDeployDescription } from "./dep
 import { managedHostnamesIn, siblingCallWarning, siblingsOf } from "./sibling-hostnames.js";
 import { MAX_STATIC_ASSET_FILE_BYTES, MAX_WORKER_ENTRY_COMPRESSED_BYTES, MAX_WORKER_SCRIPT_COMPRESSED_BYTES, WORKER_ENTRY_COMPRESSED_WARN_BYTES, assetFileTooLargeMessage, formatMebibytes, formatMegabytes, oversizedAssets, workerBundleNearLimitMessage, workerBundleTooLargeMessage, workerEntryNearLimitMessage, workerEntryTooLargeMessage, } from "./deploy-limits.js";
 import { guessZoneApex, relativeRecordName, zoneApexFor } from "./dns-host.js";
-import { dnsProviderProfile, recordAtProvider } from "./dns-providers.js";
+import { dnsProviderProfile, parkingRecordFor, recordAtProvider } from "./dns-providers.js";
 import { cacheMinutes, deriveDomainStatus, domainRecordStatuses, showsUseWww, } from "./domain-state.js";
 import { buildFileManifest, readManifestFile } from "./manifest.js";
 import { NO_PUBLIC_ASSETS, normalizeAssetsDirectory, privateLookingPaths, publicAssetPath } from "./public-assets.js";
@@ -52,7 +52,33 @@ export function deployDatabaseClause(databases) {
     const listed = databases.map((database) => (database.name ? `${database.bindingName}:${database.name}` : database.bindingName)).join(", ");
     return `${databases.length === 1 ? "database" : "databases"} ${listed}`;
 }
-export const CLI_VERSION = "0.79.0";
+// What `9pm delete` says about the app's custom domains beyond the count: the records the API
+// says each removed one used, under the same value-conditional rule as `domains remove`, and the
+// ones still being released, which get no deletion advice. Never throws: the delete has already
+// happened, so a malformed entry costs that entry's advice, not the command.
+export function deletedDomainLines(deleted) {
+    const lines = [];
+    try {
+        const releasing = Array.isArray(deleted.customDomainsReleasing)
+            ? deleted.customDomainsReleasing.filter((hostname) => typeof hostname === "string" && hostname !== "")
+            : [];
+        const cleanups = Array.isArray(deleted.customDomainCleanup) ? deleted.customDomainCleanup.map(parseDomainCleanup) : [];
+        for (const cleanup of cleanups) {
+            // A domain that is also reported as still releasing keeps its records, whatever else says otherwise.
+            if (!cleanup || releasing.includes(cleanup.hostname))
+                continue;
+            lines.push(...domainCleanupLines(cleanup));
+        }
+        for (const hostname of releasing) {
+            lines.push(`${hostname} has stopped serving, but removing it upstream is still finishing; it finishes on its own. ${DOMAIN_RELEASE_NO_CLEANUP}`);
+        }
+    }
+    catch {
+        return lines;
+    }
+    return lines;
+}
+export const CLI_VERSION = "0.81.0";
 const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
 const TOKEN_SERVICE = "9pm";
 const TOKEN_ACCOUNT = "default";
@@ -3267,8 +3293,12 @@ export function domainStatusJson(domain, app, checkedAt) {
         checkedAt,
         reason: fromServer ? (domain.reason ?? null) : derived.reason,
         next: fromServer ? (domain.next ?? derived.next) : derived.next,
+        removing: isRemoving(domain),
     };
 }
+function isRemoving(domain) {
+    return typeof domain.releasingAt === "string" && domain.releasingAt !== "" && domain.releaseIntent === "remove";
+}
 const DOMAIN_STATE_LABELS = {
     live: "live",
     waiting_for_dns: "waiting for DNS records",
@@ -3343,7 +3373,7 @@ function forUpTo(ttlSeconds) {
 function answerText(current) {
     return current.length > 0 ? current.join(", ") : "nothing";
 }
-function recordStateText(record, routing) {
+function recordStateText(record, routing, parking = null) {
     if (record.ok === true)
         return "found";
     if (record.check === "resolvers_disagree") {
@@ -3381,7 +3411,7 @@ function recordStateText(record, routing) {
     if (record.check === "wildcard") {
         const name = record.nameAtProvider ?? record.name;
         // A name holding a CNAME can hold nothing else, so an explicit record equal to the wildcard's answer is changed, not joined.
-        return `no ${record.type} record of its own yet: your DNS host's wildcard ${record.wildcard ?? ""} answers for it (${record.current.join(", ")}). Add one at ${name === "" ? "the root" : name} with the value shown; the wildcard can stay. If your DNS host already lists a record at this name, change that one instead`;
+        return `no ${record.type} record of its own yet: your DNS host's wildcard ${record.wildcard ?? ""} answers for it (${record.current.join(", ")}). Add one at ${name === "" ? "the root" : name} with the value shown; the wildcard can stay. If your DNS host already lists a record at this name, change that one instead${parkingText(parking)}`;
     }
     if (record.current.length === 0)
         return "not published yet";
@@ -3391,7 +3421,16 @@ function recordStateText(record, routing) {
     const shown = record.current.join(", ");
     const others = (record.resolvers ?? []).filter((answer) => answer.current.join(", ") !== shown);
     const also = others.map((answer) => `; ${answer.resolver} answers ${answerText(answer.current)}`).join("");
-    return `currently ${shown}${also}${recent}: point it at the value shown`;
+    return `currently ${shown}${also}${recent}: point it at the value shown${parkingText(parking)}`;
+}
+// Said only when the check saw the host's documented parking value (parkingRecordFor), and
+// conditionally even then: the record may have been changed since the check.
+function parkingText(parking) {
+    if (!parking)
+        return "";
+    return parking.wildcard
+        ? `. If ${parking.wildcard} still points at ${parking.value}, it is ${parking.provider}'s default parking record and can be removed; the record shown works either way`
+        : `. If this record still points at ${parking.value}, it is ${parking.provider}'s default parking record and can be replaced: that only takes down ${parking.provider}'s parking page`;
 }
 // A printed command carries --owner and, when the destination is not the built-in default,
 // --api-url: pasted into a shell without NINEPM_API_URL it would otherwise act on production.
@@ -3404,6 +3443,7 @@ function domainCommand(subcommand, app, hostname, options) {
 export const DNS_PROVIDER_NOTES = {
     gandiLiveDns: "At Gandi, an ALIAS works only with LiveDNS, and no A or AAAA record may stay at @ beside it.",
     hostingerCnameAtRoot: "At Hostinger, add the root record as a CNAME with name @: Hostinger shows it as ALIAS. A domain can have only one.",
+    porkbunDnsScreen: "At Porkbun, edit these in the domain's own DNS records: ACCOUNT > Domain Management, then DNS next to the domain. Not in a tool that changes several domains at once.",
     // Unverified, so never printed; its text is here so a leak would show.
     route53TxtQuotes: "In the Route 53 console, a TXT value may need to be entered in quotes.",
 };
@@ -3444,6 +3484,9 @@ function renderColumns(rows) {
         .trimEnd());
 }
 export function formatDomainStatus(status, options = {}) {
+    if (status.removing) {
+        return [`${status.hostname} (app ${status.app}): being removed`, ...domainRemovalPendingLines(status.hostname, status.app, options)];
+    }
     const lines = [`${status.hostname} (app ${status.app}): ${domainStateLabel(status.state)}`];
     if (status.state === "live") {
         lines.push(`Serving at https://${status.hostname}`);
@@ -3485,10 +3528,12 @@ export function formatDomainStatus(status, options = {}) {
                 ["TYPE", "NAME", "VALUE", "STATE"],
                 ...shown.map((record) => [
                     // null: a root the host has no record type for, shown only once routing is already active.
-                    record.typeAtProvider ?? "-",
+                    // A host with no profile may call the root record either name, so the table gives both;
+                    // --json keeps its single `typeAtProvider` value.
+                    record.apex && !profile && record.typeAtProvider === "ALIAS" ? "ALIAS / ANAME" : (record.typeAtProvider ?? "-"),
                     record.nameAtProvider === "" ? "(leave empty)" : record.nameAtProvider,
                     record.valueAtProvider,
-                    recordStateText(record, status.routing),
+                    recordStateText(record, status.routing, profile ? parkingRecordFor(status.providerId, record) : null),
                 ]),
             ];
             lines.push(...renderColumns(rows).map((line) => `  ${line}`));
@@ -3586,17 +3631,20 @@ export function formatDomainsList(statuses) {
     }
     return renderColumns([
         ["HOSTNAME", "APP", "STATE", "ROUTING", "TLS"],
-        ...statuses.map((status) => [status.hostname, status.app, status.state, status.routing, status.tls]),
+        ...statuses.map((status) => [status.hostname, status.app, status.removing ? "removing" : status.state, status.routing, status.tls]),
     ]);
 }
 export class DomainsApiError extends Error {
     status;
     code;
-    constructor(message, status, code) {
+    // The refusal's `details.reason`, where it carries one.
+    reason;
+    constructor(message, status, code, reason = null) {
         super(message);
         this.name = "DomainsApiError";
         this.status = status;
         this.code = code;
+        this.reason = reason;
     }
 }
 // The API's own message and code, plus `details.reason` where the refusal carries one
@@ -3619,9 +3667,14 @@ export function domainsApiError(status, text) {
     const reason = details && typeof details === "object" && typeof details.reason === "string"
         ? details.reason
         : null;
-    return new DomainsApiError(`${message} (${code}${reason ? `, reason: ${reason}` : ""})`, status, code);
+    return new DomainsApiError(`${message} (${code}${reason ? `, reason: ${reason}` : ""})`, status, code, reason);
 }
 async function domainsRequest(options, route, init = { method: "GET" }) {
+    return (await domainsResponse(options, route, init)).body;
+}
+// The body with the status beside it, for an answer whose status carries meaning of its own
+// (a removal still finishing answers 202).
+async function domainsResponse(options, route, init = { method: "GET" }) {
     const fetchFn = options.fetchFn ?? fetch;
     const headers = new Headers(init.headers);
     headers.set("authorization", `Bearer ${options.token}`);
@@ -3633,7 +3686,7 @@ async function domainsRequest(options, route, init = { method: "GET" }) {
     if (!response.ok) {
         throw domainsApiError(response.status, await response.text());
     }
-    return (await response.json());
+    return { status: response.status, body: (await response.json()) };
 }
 function ownerQuery(owner) {
     return owner ? `?owner=${encodeURIComponent(owner)}` : "";
@@ -3678,10 +3731,177 @@ export async function restartDomain(options) {
     return domainsRequest(options, siteDomainsRoute(options, normalizeDomainArg(options.hostname), "restart"), { method: "POST" });
 }
 export async function removeDomain(options) {
-    const result = await domainsRequest(options, siteDomainsRoute(options, normalizeDomainArg(options.hostname)), {
-        method: "DELETE",
+    const requested = normalizeDomainArg(options.hostname);
+    const { status, body } = await domainsResponse(options, siteDomainsRoute(options, requested), { method: "DELETE" });
+    return removalFromResponse(status, body, requested);
+}
+// Never throws: the removal has happened by the time this reads the answer, so a malformed body
+// costs the advice, not the command.
+export function removalFromResponse(status, body, requested) {
+    try {
+        const fields = body && typeof body === "object" ? body : {};
+        const domain = fields.domain && typeof fields.domain === "object" ? fields.domain : null;
+        const hostname = typeof domain?.hostname === "string" && domain.hostname !== "" ? domain.hostname : requested;
+        const releasing = status === 202 || fields.releasing === true;
+        return { body, hostname, releasing, cleanup: releasing ? null : parseDomainCleanup(fields.cleanup) };
+    }
+    catch {
+        return { body, hostname: requested, releasing: status === 202, cleanup: null };
+    }
+}
+// The server's `cleanup` (or one `customDomainCleanup` entry), kept only as far as it is well
+// formed: a malformed record is dropped, never guessed at, and a malformed whole is null.
+export function parseDomainCleanup(value) {
+    try {
+        if (!value || typeof value !== "object")
+            return null;
+        const { hostname, records } = value;
+        if (typeof hostname !== "string" || hostname === "" || !Array.isArray(records))
+            return null;
+        const kept = [];
+        for (const record of records) {
+            if (!record || typeof record !== "object")
+                continue;
+            const { type, host, value: recordValue, purpose } = record;
+            if (typeof type !== "string" || typeof host !== "string" || typeof recordValue !== "string" || type === "" || host === "" || recordValue === "")
+                continue;
+            kept.push({ type, host, value: recordValue, purpose: typeof purpose === "string" ? purpose : "" });
+        }
+        return { hostname, records: kept };
+    }
+    catch {
+        return null;
+    }
+}
+const CLEANUP_PURPOSES = {
+    routing: "pointed the domain at 9pm",
+    certificate: "validated the certificate",
+    ownership: "proved ownership; only there if you added it",
+};
+// The records a finished removal frees, each conditional on its value: a name can hold another
+// service's record by now (the domain pointed somewhere new, or `_acme-challenge` serving another
+// certificate), and the value is the only thing that tells ours apart. Nothing here is checked
+// against live DNS, so nothing is ever called safe to delete outright.
+export function domainCleanupLines(cleanup) {
+    if (cleanup.records.length === 0) {
+        return [`There are no DNS records of ours to delete for ${cleanup.hostname}.`];
+    }
+    const apex = guessZoneApex(cleanup.hostname);
+    const rows = [
+        ["TYPE", "NAME", "VALUE", "WAS FOR"],
+        ...cleanup.records.map((record) => [
+            record.type.toUpperCase(),
+            relativeRecordName(record.host, apex),
+            record.value,
+            Object.hasOwn(CLEANUP_PURPOSES, record.purpose) ? (CLEANUP_PURPOSES[record.purpose] ?? "") : "",
+        ]),
+    ];
+    return [
+        `You can now delete these DNS records for ${cleanup.hostname} where your domain's DNS is managed, each only if its value is unchanged:`,
+        ...renderColumns(rows).map((line) => `  ${line}`),
+        "Delete a record only while it still has the value shown. If one of these names now holds a different value, for example because the domain points somewhere new, that record is not ours: leave it.",
+    ];
+}
+// Said wherever a removal is left to finish in the background: only the API's own cleanup may
+// name records to delete, and a removal that finishes there produces none.
+const DOMAIN_RELEASE_NO_CLEANUP = "Leave its DNS records in place for now. The CLI cannot list which DNS records to delete for a removal that finishes in the background.";
+// A removal that has stopped serving but is still finishing upstream: nothing is called removed
+// and no record is offered for deletion. A removal the background sweep finishes deletes the row
+// and returns no cleanup to anyone, so no later command is promised to list the records either.
+export function domainRemovalPendingLines(hostname, app, options) {
+    const owner = options.owner ? ` --owner ${quoteSiteArg(options.owner)}` : "";
+    return [
+        `${app} no longer serves ${hostname}, but removing it upstream is taking longer than usual. It finishes on its own.`,
+        `Once ${hostname} is no longer in this list, it has stopped serving from 9pm: 9pm domains list ${quoteSiteArg(app)}${owner}${apiUrlFlagFor(options.target)}`,
+        DOMAIN_RELEASE_NO_CLEANUP,
+    ];
+}
+export async function moveDomain(options) {
+    const hostname = normalizeDomainArg(options.hostname);
+    const body = await domainsRequest(options, siteDomainsRoute(options, hostname, "move"), {
+        method: "POST",
+        body: JSON.stringify({ toSiteId: options.to.trim() }),
     });
-    return result.domain;
+    const fields = body && typeof body === "object" ? body : {};
+    const slugOf = (side) => {
+        const slug = side && typeof side === "object" ? side.slug : undefined;
+        return typeof slug === "string" && slug !== "" ? slug : null;
+    };
+    return { body, hostname, from: slugOf(fields.from), to: slugOf(fields.to) };
+}
+// The app holding a hostname in this account, for `move` without a source app. From the stored
+// list (`reconcile=0`), so finding it costs no provider call; null when the account has no such
+// domain. Throws when the list cannot be read, which is not the same answer as "none".
+export async function findDomainApp(options) {
+    const hostname = normalizeDomainArg(options.hostname);
+    const query = new URLSearchParams({ reconcile: "0", ...(options.owner ? { owner: options.owner } : {}) });
+    const result = await domainsRequest(options, `/v1/domains?${query.toString()}`);
+    if (!Array.isArray(result?.domains))
+        throw new Error("the domains list came back in a shape this CLI does not read");
+    for (const entry of result.domains) {
+        if (!entry || typeof entry !== "object")
+            continue;
+        const domain = entry;
+        if (typeof domain.hostname !== "string" || normalizeDnsName(domain.hostname) !== hostname)
+            continue;
+        const slug = domain.app && typeof domain.app === "object" ? domain.app.slug : undefined;
+        if (typeof slug !== "string" || slug === "")
+            throw new Error(`the domains list names no app for ${hostname}`);
+        return slug;
+    }
+    return null;
+}
+// What to do about each move refusal, beside the server's own message. Printed commands carry
+// --owner and a non-default --api-url, never a credential.
+export function domainMoveRefusalLines(error, move, options) {
+    const owner = options.owner ? ` --owner ${quoteSiteArg(options.owner)}` : "";
+    const apiUrl = apiUrlFlagFor(options.target);
+    const host = normalizeDomainArg(move.hostname);
+    const list = (app) => `9pm domains list${app ? ` ${quoteSiteArg(app)}` : ""}${owner}${apiUrl}`;
+    const removeHere = `9pm domains remove ${quoteSiteArg(move.site)} ${host} --confirm ${host}${owner}${apiUrl}`;
+    const addThere = domainCommand("add", move.to, host, options);
+    switch (error.code) {
+        case "custom_domain_not_found":
+            return [`${host} is not a custom domain of ${move.site}. See which app holds it: ${list()}`];
+        case "project_not_found":
+            return [`No app ${move.to} that you can open was found. List the apps: 9pm apps${owner}${apiUrl}`];
+        case "custom_domain_quota_exceeded":
+            return [`${move.to} already has as many custom domains as the plan allows. Remove one from it first: ${list(move.to)}`];
+        case "plan_custom_domains_unavailable":
+            return ["The plan this account is on includes no custom domains, so no app in it can take one."];
+        case "custom_domain_release_pending":
+            return [`A removal of ${host} is still finishing, so it can't move until that is done. Try again in a few minutes; see where it stands: ${list(move.site)}`];
+        case "custom_domain_move_not_provisioned":
+            if (error.reason === "source_service_mode") {
+                return [
+                    `${move.site} uses service tokens, so ${host} was disconnected and has nothing to move. Remove it there, then add it to ${move.to}; it gets new DNS records to publish:`,
+                    `  ${removeHere}`,
+                    `  ${addThere}`,
+                ];
+            }
+            return [
+                `${host} isn't provisioned yet, so there is no certificate to move. Remove it here and add it to ${move.to} instead; it gets new DNS records to publish:`,
+                `  ${removeHere}`,
+                `  ${addThere}`,
+            ];
+        case "custom_domain_move_cross_account":
+            return [
+                `${move.to} is in another account, and a domain moves only between apps of one account. Remove it here, then add it from that account; it gets new DNS records to publish:`,
+                `  ${removeHere}`,
+            ];
+        case "custom_domains_public_only":
+            return [`${move.to} uses service tokens, which can't hold a custom domain. Choose another app, or change its access mode first.`];
+        case "custom_domain_redeploy_required":
+            return [`Redeploy ${move.to} once, then run the move again.`];
+        case "custom_domain_expired":
+            return [`${host} expired before its DNS records were published. Add it to ${move.to} instead: ${addThere}`];
+        case "custom_domain_move_conflict":
+            return [`Something changed while the domain was moving. See where it is now: ${list()}`];
+        case "custom_domain_move_same_app":
+            return [`${host} already belongs to ${move.site}; nothing to move.`];
+        default:
+            return [];
+    }
 }
 // The domains read is a reconcile plus a DNS lookup per record, so it can be slow; the deploy
 // has already succeeded and must not wait on it for longer than this.
@@ -3743,6 +3963,9 @@ export function deployCustomDomainLines(statuses, slug, owner, target) {
         ];
     }
     return statuses.map((status) => {
+        // A removal still finishing reads as whatever state the row last held, "live" included.
+        if (status.removing)
+            return `Custom domain ${status.hostname} is being removed.`;
         if (status.state === "live")
             return `Also serving at https://${status.hostname}`;
         const notLive = status.state === "failed" || status.state === "expired" ? "is not live" : "is not live yet";
@@ -3762,6 +3985,9 @@ export async function waitForDomain(options) {
             const status = await getDomainStatus(options);
             last = status;
             options.onStatus?.(status);
+            // Being removed: it will not go live, whatever state the row last held.
+            if (status.removing)
+                return { status, exitCode: DOMAIN_WAIT_EXIT.failed, timedOut: false };
             if (status.state === "live")
                 return { status, exitCode: DOMAIN_WAIT_EXIT.live, timedOut: false };
             if (status.state === "failed" || status.state === "expired")
@@ -3787,7 +4013,7 @@ export async function waitForDomain(options) {
         await sleepFn(Math.min(options.intervalMs, remaining));
     }
 }
-const DOMAINS_VALUE_FLAGS = new Set(["token", "api-url", "owner", "timeout", "interval", "confirm"]);
+const DOMAINS_VALUE_FLAGS = new Set(["token", "api-url", "owner", "timeout", "interval", "confirm", "to"]);
 const DOMAINS_BOOLEAN_FLAGS = new Set(["json"]);
 function domainsPositionals(argv) {
     const positionals = [];
@@ -3813,7 +4039,8 @@ const DOMAINS_USAGE = {
     check: "9pm domains check <app> <hostname> [--owner <organisation>] [--json]",
     wait: "9pm domains wait <app> <hostname> [--timeout 30m] [--interval 20s] [--owner <organisation>] [--json]",
     restart: "9pm domains restart <app> <hostname> [--owner <organisation>]  (for a failed certificate; the record values may change)",
-    remove: "9pm domains remove <app> <hostname> --confirm <hostname> [--owner <organisation>]",
+    remove: "9pm domains remove <app> <hostname> --confirm <hostname> [--owner <organisation>] [--json]",
+    move: "9pm domains move [<app>] <hostname> --to <app> [--owner <organisation>] [--json]",
 };
 function parseDomainsArgs(argv) {
     const subcommand = argv[0] === "ls" ? "list" : argv[0] === "rm" ? "remove" : argv[0];
@@ -3841,6 +4068,13 @@ function parseDomainsArgs(argv) {
         const site = positionals[0];
         return withBase({ kind: "list", json, ...(site ? { site } : {}) });
     }
+    if (subcommand === "move") {
+        const to = readStringFlag(flags, "to");
+        const [first, second] = positionals;
+        if (!to || !first || positionals.length > 2)
+            throw new Error(`Usage: ${usage}`);
+        return withBase(second === undefined ? { kind: "move", hostname: first, to, json } : { kind: "move", site: first, hostname: second, to, json });
+    }
     const [site, hostname] = positionals;
     if (!site || !hostname || positionals.length > 2) {
         throw new Error(`Usage: ${usage}`);
@@ -3864,7 +4098,7 @@ function parseDomainsArgs(argv) {
     if (!confirm || normalizeDomainArg(confirm) !== normalizeDomainArg(hostname)) {
         throw new Error(`Removing a domain stops it serving at once. Pass --confirm ${normalizeDomainArg(hostname)} to remove it.`);
     }
-    return withBase({ kind: "remove", site, hostname });
+    return withBase({ kind: "remove", site, hostname, json });
 }
 function printDomainStatus(status, json, options, heading) {
     if (json) {
@@ -3897,6 +4131,10 @@ async function runDomainsCommand(command) {
             console.log(line);
         return;
     }
+    if (action.kind === "move") {
+        await runDomainMove(action, base, format);
+        return;
+    }
     const target = { ...base, site: action.site, hostname: action.hostname };
     if (action.kind === "add") {
         const added = await addDomain(target);
@@ -3962,15 +4200,63 @@ async function runDomainsCommand(command) {
             console.log(line);
         return;
     }
-    const removed = await removeDomain(target);
-    const hostname = removed?.hostname ?? normalizeDomainArg(action.hostname);
-    console.log(`Removed ${hostname} from ${action.site}. It stops serving within seconds.`);
-    if (removed && removed.dnsInstructions.length > 0) {
-        console.log("You can now delete these records at your DNS provider, if nothing else uses them:");
-        for (const line of instructionLines(removed.dnsInstructions, hostname))
+    const removal = await removeDomain(target);
+    if (action.json) {
+        console.log(JSON.stringify(removal.body, null, 2));
+        return;
+    }
+    if (removal.releasing) {
+        console.log(`Removing ${removal.hostname} from ${action.site} is still finishing.`);
+        for (const line of domainRemovalPendingLines(removal.hostname, action.site, format))
+            console.log(line);
+        return;
+    }
+    console.log(`Removed ${removal.hostname} from ${action.site}. It stops serving within seconds.`);
+    if (removal.cleanup) {
+        for (const line of domainCleanupLines(removal.cleanup))
             console.log(line);
     }
 }
+async function runDomainMove(action, base, format) {
+    const hostname = normalizeDomainArg(action.hostname);
+    const owner = format.owner ? ` --owner ${quoteSiteArg(format.owner)}` : "";
+    const apiUrl = apiUrlFlagFor(format.target);
+    let site = action.site;
+    if (!site) {
+        let found;
+        try {
+            found = await findDomainApp({ ...base, hostname });
+        }
+        catch (error) {
+            // Finding the app is a convenience in front of the move, which has not been tried.
+            throw new Error(`Couldn't look up which app holds ${hostname} (${error instanceof Error ? error.message : String(error)}). Nothing was moved. Name the app it is on: 9pm domains move <app> ${hostname} --to ${quoteSiteArg(action.to)}${owner}${apiUrl}`);
+        }
+        if (!found) {
+            throw new DomainsApiError(`${hostname} is not a custom domain in this account (custom_domain_not_found). See the account's domains: 9pm domains list${owner}${apiUrl}`, 404, "custom_domain_not_found");
+        }
+        site = found;
+    }
+    let moved;
+    try {
+        moved = await moveDomain({ ...base, site, hostname, to: action.to });
+    }
+    catch (error) {
+        if (error instanceof DomainsApiError) {
+            const advice = domainMoveRefusalLines(error, { site, hostname, to: action.to }, format);
+            if (advice.length > 0)
+                throw new DomainsApiError([error.message, ...advice].join("\n"), error.status, error.code, error.reason);
+        }
+        throw error;
+    }
+    if (action.json) {
+        console.log(JSON.stringify(moved.body, null, 2));
+        return;
+    }
+    const to = moved.to ?? action.to;
+    console.log(`Moved ${moved.hostname} from ${moved.from ?? site} to ${to}.`);
+    console.log("It keeps its certificate and the DNS records you published, so nothing has to be validated again. Leave those records as they are.");
+    console.log(`Check it: ${domainCommand("status", to, moved.hostname, format)}`);
+}
 // #807 step 5: the claim behind a health verdict, in words. A bare `unknown` reads
 // as "fine"; the reason says which statement the platform is actually making.
 export function healthWithReason(status, reason) {
@@ -5586,6 +5872,8 @@ async function main() {
             if (deleted.customDomainNames && deleted.customDomainNames.length > 0) {
                 console.log(`Removed custom domain(s): ${deleted.customDomainNames.join(", ")}.`);
             }
+            for (const line of deletedDomainLines(deleted))
+                console.log(line);
             // #722: a partial external-cleanup failure never fails the delete, and used to be
             // silently discarded here — visible only in the raw JSON, if a caller happened to
             // read it. Surfacing it is the whole reason a human running this command manually
@@ -5985,7 +6273,8 @@ function printUsage() {
   9pm domains check <app> <hostname> [--json]      re-check now, then print the status
   9pm domains wait <app> <hostname> [--timeout 30m] [--interval 20s] [--json]
   9pm domains restart <app> <hostname>             for a failed certificate only: start validation over; record values may change
-  9pm domains remove <app> <hostname> --confirm <hostname>
+  9pm domains remove <app> <hostname> --confirm <hostname> [--json]   prints the DNS records you can then delete
+  9pm domains move [<app>] <hostname> --to <app> [--json]           to another app of the same account; keeps its certificate and records
   9pm access show <site>
   9pm access public <site> [--switch-mode]
   9pm access otp <site> [--switch-mode]
@@ -6038,10 +6327,10 @@ Missing pages (static sites and --entry worker apps):
 
 Custom domains:
   Every domains command takes --owner <organisation> for an organisation's app. list, status and
-  wait only read; add, check, restart and remove need the configure role on the app.
+  wait only read; add, check, restart, remove and move need the configure role on the app.
   --json prints {hostname, app, state, reason, next, routing, tls, provider, nameservers,
   records[{type, name, fqdn, expected, current, ok, check, apex, optional}], error, expiresAt,
-  checkedAt}. state is one of live, waiting_for_dns, dns_unverified (routing is active but the
+  checkedAt, removing}. state is one of live, waiting_for_dns, dns_unverified (routing is active but the
   records could not be checked), issuing_certificate (every required record checked and found),
   failed, expired. reason says why (reason.providerMessage is the provider's own text, when it
   reported any, and its source: certificate_authority or hostname); next says who acts next (owner or platform) and what to do.
@@ -6051,7 +6340,11 @@ Custom domains:
   wait exits 0 when live, 10 on timeout with something for the owner to do (records missing or
   unverified, or a CAA record blocking the certificate), 11 on timeout with every record found and
   nothing for the owner to do (the platform is still finishing), 20 when the domain failed or
-  expired, and 1 on a usage, auth or API error.
+  expired, and 1 on a usage, auth or API error. A domain whose removal is still finishing shows
+  as removing ("removing": true in --json), and wait on it exits 20.
+  remove prints only the records the API says this domain used, each to delete only if its value
+  is unchanged; while the removal is still finishing (a 202) it prints none. remove and move
+  --json print the API's answer as it came.
 
 Container deploys:
   Requires Docker locally. The CLI builds linux/amd64, exports the image, uploads it through a short-lived session, then finalizes a queued deployment.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ninepm",
-  "version": "0.79.0",
+  "version": "0.81.0",
   "description": "CLI for deploying built apps to 9pm.ai.",
   "homepage": "https://9pm.ai",
   "keywords": [