ninepm 0.81.0 → 0.83.0

package/README.md

@@ -163,6 +163,8 @@ Delete an app, its managed database, managed container app, and retained image:
 
 The app's address goes with it: creating an app again under the same slug gives it a new address, so printed links and QR codes stop working. `9pm delete` prints this warning before it deletes anything.
 
+For a static or Worker app with no custom domain, `9pm delete` also prints `Its address stops serving the app within about a minute.` It prints nothing about timing for a container app or an app with a custom domain: how long those keep serving after a delete has not been measured, so check the address yourself.
+
 ## Access Modes
 
 Apps are public by default.
@@ -271,6 +273,19 @@ from 9pm. A removal that finishes in the background returns no record list, so t
 which DNS records to delete for it. Such a domain shows as `removing`
 in `list` and `status` (`"removing": true` in `--json`), and `wait` on it exits `20`. Since 0.80.0.
 
+Since 0.83.0, `9pm domains cleanup <app> <hostname>` lists the setup TXT records 9pm issued for a
+live domain and no longer needs, such as an earlier `_acme-challenge` value or the
+`_cf-custom-hostname` ownership record (`--json` prints the API's answer). Each may be deleted only
+while it still has the value shown; a different value at that name is not ours. The list is checked
+against the certificate provider when you run the command: a value the provider still asks for is
+never in it, a domain that is not live lists nothing, and if the provider cannot be read, or the
+domain changes while it is being checked, the command fails and lists nothing; run it again. Only values the API issued are candidates, never anything read from public
+DNS. `9pm domains status` on a live domain prints the command. `9pm domains remove` lists these values
+with the rest of the domain's records, since once the domain is removed none of them is needed.
+After `9pm domains restart`, the values it says no longer count are worded the same way. Against a
+server without the route, `cleanup` says it can't list any and exits `1`. Values replaced before the
+server kept them cannot be listed.
+
 `9pm domains move <hostname> --to <app>` moves a domain to another app of the same account. It keeps
 its certificate and the DNS records already published, so nothing is validated again. Without a
 source app the CLI looks it up in the account; name it (`9pm domains move <app> <hostname> --to

package/dist/index.d.ts

@@ -112,6 +112,8 @@ export interface DeletedSiteResult {
     customDomainsReleasing?: unknown;
     containerApplications?: number;
     containerImages?: number;
+    flyTeardownsQueued?: number;
+    workerScripts?: unknown;
     accessApps: number;
     serviceTokens: number;
     databases: number;
@@ -130,7 +132,7 @@ export interface CreatedServiceToken {
     clientSecret: string;
 }
 export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-export declare const CLI_VERSION = "0.81.0";
+export declare const CLI_VERSION = "0.83.0";
 type CredentialBackend = "macos-keychain" | "windows-dpapi" | "linux-secret-service" | "file-plaintext" | "none";
 export interface StoredCredentialEntry {
     token: string;
@@ -355,6 +357,8 @@ export declare function listSites(options: ApiOptions & {
     owner?: string;
 }): Promise<ListSitesResult>;
 export declare function deleteWarningLines(slug: string): string[];
+export declare const DELETE_SERVING_BOUND_LINE = "Its address stops serving the app within about a minute.";
+export declare function deletedAppStopsServingQuickly(deleted: Pick<DeletedSiteResult, "workerScripts" | "containerApplications" | "flyTeardownsQueued" | "customDomains" | "customDomainsReleasing" | "errors">): boolean;
 export declare function deleteSite(options: DeleteSiteOptions): Promise<DeletedSiteResult>;
 export interface DeviceAuthFeedbackOptions {
     progressStream?: NodeJS.WriteStream;
@@ -648,6 +652,11 @@ type CliCommand = {
         kind: "restart";
         site: string;
         hostname: string;
+    } | {
+        kind: "cleanup";
+        site: string;
+        hostname: string;
+        json: boolean;
     } | {
         kind: "remove";
         site: string;
@@ -866,6 +875,11 @@ export interface DomainCleanup {
 }
 export declare function parseDomainCleanup(value: unknown): DomainCleanup | null;
 export declare function domainCleanupLines(cleanup: DomainCleanup): string[];
+export declare function getDomainSetupCleanup(options: DomainCommandOptions & {
+    hostname: string;
+}): Promise<unknown>;
+export declare function domainSetupCleanupLines(body: unknown, hostname: string): string[];
+export declare function setupCleanupLines(hostname: string, records: DomainCleanupRecord[]): string[];
 export declare function domainRemovalPendingLines(hostname: string, app: string, options: DomainFormatOptions): string[];
 export interface DomainMove {
     body: unknown;

package/dist/index.js

@@ -78,7 +78,7 @@ export function deletedDomainLines(deleted) {
     }
     return lines;
 }
-export const CLI_VERSION = "0.81.0";
+export const CLI_VERSION = "0.83.0";
 const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
 const TOKEN_SERVICE = "9pm";
 const TOKEN_ACCOUNT = "default";
@@ -1441,6 +1441,29 @@ export function deleteWarningLines(slug) {
         "Its deployments, files and managed database (if it has one) are deleted with it and cannot be recovered.",
     ];
 }
+// Printed after a delete of the one shape that was measured (#1969): an app whose namespace
+// script was replaced with the deleted-app Worker, with no container and no custom domain.
+// Measured from outside on 2026-10-14 (staging) and 2026-10-15 (production) for a static
+// app: the old content stopped within ~20 s of starting the delete and did not come back
+// over ~15 min. "About a minute" leaves margin for a single location's measurement;
+// re-measure before tightening it, and measure a shape before adding it below.
+export const DELETE_SERVING_BOUND_LINE = "Its address stops serving the app within about a minute.";
+// Whether DELETE_SERVING_BOUND_LINE is true of this delete. Read from what the server says it
+// did, not from what the app was: the tombstone is the mechanism the measurement covers. A
+// container app's teardown is queued and gets no tombstone, a custom domain stops through the
+// fallback Worker, and a failed cleanup step may have left something serving - none of those
+// were measured, so they get no promise. An older server sends no `workerScripts`, so neither.
+export function deletedAppStopsServingQuickly(deleted) {
+    const scripts = Array.isArray(deleted.workerScripts) ? deleted.workerScripts : [];
+    const tombstoned = scripts.some((script) => typeof script === "object" && script !== null && script.tombstoned === true);
+    const releasing = Array.isArray(deleted.customDomainsReleasing) && deleted.customDomainsReleasing.length > 0;
+    return (tombstoned &&
+        (deleted.containerApplications ?? 0) === 0 &&
+        (deleted.flyTeardownsQueued ?? 0) === 0 &&
+        deleted.customDomains === 0 &&
+        !releasing &&
+        (deleted.errors ?? []).length === 0);
+}
 export async function deleteSite(options) {
     const route = `/v1/sites/${encodeURIComponent(options.site)}${options.owner ? `?owner=${encodeURIComponent(options.owner)}` : ""}`;
     const payload = await apiRequest(options, route, {
@@ -3490,6 +3513,8 @@ export function formatDomainStatus(status, options = {}) {
     const lines = [`${status.hostname} (app ${status.app}): ${domainStateLabel(status.state)}`];
     if (status.state === "live") {
         lines.push(`Serving at https://${status.hostname}`);
+        // #2089: which setup records can go is asked of the provider when wanted, not inferred here.
+        lines.push(`Setup records you may no longer need: ${domainCommand("cleanup", status.app, status.hostname, options)}`);
         return lines;
     }
     if (status.state === "expired") {
@@ -3802,6 +3827,50 @@ export function domainCleanupLines(cleanup) {
         "Delete a record only while it still has the value shown. If one of these names now holds a different value, for example because the domain points somewhere new, that record is not ours: leave it.",
     ];
 }
+export async function getDomainSetupCleanup(options) {
+    return domainsRequest(options, siteDomainsRoute(options, normalizeDomainArg(options.hostname), "cleanup"));
+}
+// What `9pm domains cleanup` prints for the server's answer (#2089). Never throws: anything it
+// cannot read is reported as nothing listed, never as something to delete.
+export function domainSetupCleanupLines(body, hostname) {
+    try {
+        const fields = body && typeof body === "object" ? body : {};
+        const name = typeof fields.hostname === "string" && fields.hostname !== "" ? fields.hostname : hostname;
+        if (fields.live !== true) {
+            return [`${name} isn't live with its certificate right now, so no setup record is listed for deletion.`];
+        }
+        const cleanup = parseDomainCleanup(fields.cleanup);
+        if (!cleanup)
+            return [`Couldn't read which setup records ${name} no longer needs, so none is listed for deletion.`];
+        if (cleanup.records.length === 0)
+            return [`9pm lists no setup records to delete for ${name}.`];
+        return setupCleanupLines(name, cleanup.records);
+    }
+    catch {
+        return [`Couldn't read which setup records ${hostname} no longer needs, so none is listed for deletion.`];
+    }
+}
+// A live domain's leftovers from setup (#2089): only values the API says it issued and that the
+// provider, read just now, no longer asks for. Each is conditional on its value for the same
+// reason as after a removal: a name like `_acme-challenge` can hold another service's token, and
+// only the value tells ours apart.
+export function setupCleanupLines(hostname, records) {
+    const apex = guessZoneApex(hostname);
+    const rows = [
+        ["TYPE", "NAME", "VALUE", "WAS FOR"],
+        ...records.map((record) => [
+            record.type.toUpperCase(),
+            relativeRecordName(record.host, apex),
+            record.value,
+            Object.hasOwn(CLEANUP_PURPOSES, record.purpose) ? (CLEANUP_PURPOSES[record.purpose] ?? "") : "",
+        ]),
+    ];
+    return [
+        `9pm no longer needs these setup records for ${hostname}, checked just now. You can delete each one where your domain's DNS is managed, only while it still has the value shown:`,
+        ...renderColumns(rows).map((line) => `  ${line}`),
+        "If one of these names now holds a different value, that record is not ours: leave it. Keep the record that points the domain at 9pm.",
+    ];
+}
 // Said wherever a removal is left to finish in the background: only the API's own cleanup may
 // name records to delete, and a removal that finishes there produces none.
 const DOMAIN_RELEASE_NO_CLEANUP = "Leave its DNS records in place for now. The CLI cannot list which DNS records to delete for a removal that finishes in the background.";
@@ -4039,6 +4108,7 @@ const DOMAINS_USAGE = {
     check: "9pm domains check <app> <hostname> [--owner <organisation>] [--json]",
     wait: "9pm domains wait <app> <hostname> [--timeout 30m] [--interval 20s] [--owner <organisation>] [--json]",
     restart: "9pm domains restart <app> <hostname> [--owner <organisation>]  (for a failed certificate; the record values may change)",
+    cleanup: "9pm domains cleanup <app> <hostname> [--owner <organisation>] [--json]  (setup records a live domain no longer needs)",
     remove: "9pm domains remove <app> <hostname> --confirm <hostname> [--owner <organisation>] [--json]",
     move: "9pm domains move [<app>] <hostname> --to <app> [--owner <organisation>] [--json]",
 };
@@ -4094,6 +4164,9 @@ function parseDomainsArgs(argv) {
     if (subcommand === "restart") {
         return withBase({ kind: "restart", site, hostname });
     }
+    if (subcommand === "cleanup") {
+        return withBase({ kind: "cleanup", site, hostname, json });
+    }
     const confirm = readStringFlag(flags, "confirm");
     if (!confirm || normalizeDomainArg(confirm) !== normalizeDomainArg(hostname)) {
         throw new Error(`Removing a domain stops it serving at once. Pass --confirm ${normalizeDomainArg(hostname)} to remove it.`);
@@ -4153,6 +4226,28 @@ async function runDomainsCommand(command) {
         printDomainStatus(await getDomainStatus(target), action.json, format);
         return;
     }
+    if (action.kind === "cleanup") {
+        let body;
+        try {
+            body = await getDomainSetupCleanup(target);
+        }
+        catch (error) {
+            // A server from before #2089 has no such route; it lists nothing, so neither does this.
+            if (error instanceof DomainsApiError && error.status === 404 && error.code === "not_found") {
+                console.error("This server can't list setup records to delete yet, so none is listed.");
+                process.exitCode = 1;
+                return;
+            }
+            throw error;
+        }
+        if (action.json) {
+            console.log(JSON.stringify(body, null, 2));
+            return;
+        }
+        for (const line of domainSetupCleanupLines(body, normalizeDomainArg(action.hostname)))
+            console.log(line);
+        return;
+    }
     if (action.kind === "check") {
         await recheckDomain(target);
         printDomainStatus(await getDomainStatus(target), action.json, format);
@@ -4188,7 +4283,7 @@ async function runDomainsCommand(command) {
         const restarted = await restartDomain(target);
         console.log(`Started validation for ${restarted.domain.hostname} over.`);
         if (restarted.replacedInstructions.length > 0) {
-            console.log("These values no longer count; delete them at your DNS provider:");
+            console.log("These values no longer count. At your DNS provider, delete each one only while it still has the value shown; a different value at that name is not ours:");
             for (const line of instructionLines(restarted.replacedInstructions, restarted.domain.hostname))
                 console.log(line);
         }
@@ -5868,6 +5963,9 @@ async function main() {
                 confirmSlug: command.confirmSlug,
             });
             console.log(`Deleted ${deleted.slug}.`);
+            if (deletedAppStopsServingQuickly(deleted)) {
+                console.log(DELETE_SERVING_BOUND_LINE);
+            }
             console.log(`Removed ${deleted.workers} Worker(s), ${deleted.databases} database(s), ${deleted.files} file(s), ${deleted.customDomains} custom domain(s), ${deleted.containerImages ?? 0} container image(s), ${deleted.accessApps} access app(s), and ${deleted.serviceTokens} service token(s). Queued ${deleted.containerApplications ?? 0} container app(s) for teardown.`);
             if (deleted.customDomainNames && deleted.customDomainNames.length > 0) {
                 console.log(`Removed custom domain(s): ${deleted.customDomainNames.join(", ")}.`);
@@ -6273,6 +6371,7 @@ function printUsage() {
   9pm domains check <app> <hostname> [--json]      re-check now, then print the status
   9pm domains wait <app> <hostname> [--timeout 30m] [--interval 20s] [--json]
   9pm domains restart <app> <hostname>             for a failed certificate only: start validation over; record values may change
+  9pm domains cleanup <app> <hostname> [--json]    on a live domain: setup records 9pm no longer needs, checked with the provider now
   9pm domains remove <app> <hostname> --confirm <hostname> [--json]   prints the DNS records you can then delete
   9pm domains move [<app>] <hostname> --to <app> [--json]           to another app of the same account; keeps its certificate and records
   9pm access show <site>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ninepm",
-  "version": "0.81.0",
+  "version": "0.83.0",
   "description": "CLI for deploying built apps to 9pm.ai.",
   "homepage": "https://9pm.ai",
   "keywords": [