@wraps.dev/cli 2.3.5 → 2.4.0

package/dist/cli.js

@@ -1989,9 +1989,11 @@ __export(prompts_exports, {
   getAvailableFeatures: () => getAvailableFeatures,
   promptConfigPreset: () => promptConfigPreset,
   promptConflictResolution: () => promptConflictResolution,
+  promptContinueManualDNS: () => promptContinueManualDNS,
   promptCustomConfig: () => promptCustomConfig,
   promptDNSConfirmation: () => promptDNSConfirmation,
   promptDNSManagement: () => promptDNSManagement,
+  promptDNSProvider: () => promptDNSProvider,
   promptDomain: () => promptDomain,
   promptEmailArchiving: () => promptEmailArchiving,
   promptEstimatedVolume: () => promptEstimatedVolume,
@@ -2713,6 +2715,58 @@ async function promptDNSManagement(domain) {
   }
   return manage;
 }
+async function promptDNSProvider(domain, availableProviders) {
+  const options = availableProviders.map((p) => {
+    let label;
+    let hint;
+    switch (p.provider) {
+      case "route53":
+        label = "AWS Route53";
+        hint = p.detected ? "Hosted zone detected" : "Requires Route53 hosted zone";
+        break;
+      case "vercel":
+        label = "Vercel DNS";
+        hint = p.detected ? "Token found" : "Requires VERCEL_TOKEN";
+        break;
+      case "cloudflare":
+        label = "Cloudflare";
+        hint = p.detected ? "Token found" : "Requires CLOUDFLARE_API_TOKEN";
+        break;
+      case "manual":
+        label = "Manual";
+        hint = "I'll add DNS records myself";
+        break;
+    }
+    if (p.detected && p.provider !== "manual") {
+      label = `${label} (Recommended)`;
+    }
+    return {
+      value: p.provider,
+      label,
+      hint: p.hint || hint
+    };
+  });
+  const provider = await clack3.select({
+    message: `Where do you manage DNS for ${pc4.cyan(domain)}?`,
+    options
+  });
+  if (clack3.isCancel(provider)) {
+    clack3.cancel("Operation cancelled.");
+    process.exit(0);
+  }
+  return provider;
+}
+async function promptContinueManualDNS() {
+  const continueManual = await clack3.confirm({
+    message: "Continue with manual DNS setup?",
+    initialValue: true
+  });
+  if (clack3.isCancel(continueManual)) {
+    clack3.cancel("Operation cancelled.");
+    process.exit(0);
+  }
+  return continueManual;
+}
 var DNS_CATEGORY_LABELS, DNS_STATUS_SYMBOLS;
 var init_prompts = __esm({
   "src/utils/shared/prompts.ts"() {
@@ -4433,6 +4487,929 @@ var init_mail_manager = __esm({
   }
 });
 
+// src/utils/dns/cloudflare.ts
+var CLOUDFLARE_API_BASE, CloudflareDNSClient;
+var init_cloudflare = __esm({
+  "src/utils/dns/cloudflare.ts"() {
+    "use strict";
+    init_esm_shims();
+    CLOUDFLARE_API_BASE = "https://api.cloudflare.com/client/v4";
+    CloudflareDNSClient = class {
+      zoneId;
+      apiToken;
+      constructor(zoneId, apiToken) {
+        this.zoneId = zoneId;
+        this.apiToken = apiToken;
+      }
+      async request(endpoint, method = "GET", body) {
+        const response = await fetch(
+          `${CLOUDFLARE_API_BASE}/zones/${this.zoneId}${endpoint}`,
+          {
+            method,
+            headers: {
+              Authorization: `Bearer ${this.apiToken}`,
+              "Content-Type": "application/json"
+            },
+            body: body ? JSON.stringify(body) : void 0
+          }
+        );
+        return response.json();
+      }
+      async createRecord(name, type, content, priority) {
+        const body = {
+          name,
+          type,
+          content,
+          ttl: 1800,
+          proxied: false
+          // Must not be proxied for email records
+        };
+        if (priority !== void 0) {
+          body.priority = priority;
+        }
+        const result = await this.request(
+          "/dns_records",
+          "POST",
+          body
+        );
+        return result.success;
+      }
+      async findRecord(name, type) {
+        const result = await this.request(
+          `/dns_records?name=${encodeURIComponent(name)}&type=${type}`
+        );
+        if (result.success && result.result.length > 0) {
+          return result.result[0];
+        }
+        return null;
+      }
+      async deleteRecord(recordId) {
+        const result = await this.request(
+          `/dns_records/${recordId}`,
+          "DELETE"
+        );
+        return result.success;
+      }
+      async createEmailRecords(data) {
+        const { domain, dkimTokens, mailFromDomain, region } = data;
+        const errors2 = [];
+        let recordsCreated = 0;
+        try {
+          for (const token of dkimTokens) {
+            const name = `${token}._domainkey.${domain}`;
+            const success = await this.createRecord(
+              name,
+              "CNAME",
+              `${token}.dkim.amazonses.com`
+            );
+            if (success) {
+              recordsCreated++;
+            } else {
+              errors2.push(`Failed to create DKIM record: ${name}`);
+            }
+          }
+          const spfSuccess = await this.createRecord(
+            domain,
+            "TXT",
+            "v=spf1 include:amazonses.com ~all"
+          );
+          if (spfSuccess) {
+            recordsCreated++;
+          } else {
+            errors2.push(`Failed to create SPF record for ${domain}`);
+          }
+          const dmarcSuccess = await this.createRecord(
+            `_dmarc.${domain}`,
+            "TXT",
+            `v=DMARC1; p=quarantine; rua=mailto:postmaster@${mailFromDomain || domain}`
+          );
+          if (dmarcSuccess) {
+            recordsCreated++;
+          } else {
+            errors2.push(`Failed to create DMARC record for ${domain}`);
+          }
+          if (mailFromDomain) {
+            const mxSuccess = await this.createRecord(
+              mailFromDomain,
+              "MX",
+              `feedback-smtp.${region}.amazonses.com`,
+              10
+            );
+            if (mxSuccess) {
+              recordsCreated++;
+            } else {
+              errors2.push(`Failed to create MX record for ${mailFromDomain}`);
+            }
+            const mailFromSpfSuccess = await this.createRecord(
+              mailFromDomain,
+              "TXT",
+              "v=spf1 include:amazonses.com ~all"
+            );
+            if (mailFromSpfSuccess) {
+              recordsCreated++;
+            } else {
+              errors2.push(`Failed to create SPF record for ${mailFromDomain}`);
+            }
+          }
+          return {
+            success: errors2.length === 0,
+            recordsCreated,
+            errors: errors2.length > 0 ? errors2 : void 0
+          };
+        } catch (error) {
+          return {
+            success: false,
+            recordsCreated,
+            errors: [
+              ...errors2,
+              error instanceof Error ? error.message : "Unknown error"
+            ]
+          };
+        }
+      }
+      async deleteEmailRecords(data) {
+        const { domain, dkimTokens, mailFromDomain } = data;
+        const errors2 = [];
+        let recordsCreated = 0;
+        try {
+          for (const token of dkimTokens) {
+            const name = `${token}._domainkey.${domain}`;
+            const record = await this.findRecord(name, "CNAME");
+            if (record) {
+              const success = await this.deleteRecord(record.id);
+              if (success) {
+                recordsCreated++;
+              } else {
+                errors2.push(`Failed to delete DKIM record: ${name}`);
+              }
+            }
+          }
+          const dmarcRecord = await this.findRecord(`_dmarc.${domain}`, "TXT");
+          if (dmarcRecord) {
+            const success = await this.deleteRecord(dmarcRecord.id);
+            if (success) {
+              recordsCreated++;
+            } else {
+              errors2.push("Failed to delete DMARC record");
+            }
+          }
+          if (mailFromDomain) {
+            const mxRecord = await this.findRecord(mailFromDomain, "MX");
+            if (mxRecord) {
+              const success = await this.deleteRecord(mxRecord.id);
+              if (success) {
+                recordsCreated++;
+              } else {
+                errors2.push(`Failed to delete MX record for ${mailFromDomain}`);
+              }
+            }
+            const spfRecord = await this.findRecord(mailFromDomain, "TXT");
+            if (spfRecord) {
+              const success = await this.deleteRecord(spfRecord.id);
+              if (success) {
+                recordsCreated++;
+              } else {
+                errors2.push(`Failed to delete SPF record for ${mailFromDomain}`);
+              }
+            }
+          }
+          return {
+            success: errors2.length === 0,
+            recordsCreated,
+            errors: errors2.length > 0 ? errors2 : void 0
+          };
+        } catch (error) {
+          return {
+            success: false,
+            recordsCreated,
+            errors: [
+              ...errors2,
+              error instanceof Error ? error.message : "Unknown error"
+            ]
+          };
+        }
+      }
+      async verifyRecords(data) {
+        const { domain, dkimTokens, mailFromDomain, region } = data;
+        const missing = [];
+        const incorrect = [];
+        for (const token of dkimTokens) {
+          const name = `${token}._domainkey.${domain}`;
+          const expectedValue = `${token}.dkim.amazonses.com`;
+          const record = await this.findRecord(name, "CNAME");
+          if (!record) {
+            missing.push(`DKIM: ${name}`);
+          } else if (record.content !== expectedValue) {
+            incorrect.push(`DKIM: ${name} (expected ${expectedValue})`);
+          }
+        }
+        const spfRecord = await this.findRecord(domain, "TXT");
+        if (!spfRecord) {
+          missing.push(`SPF: ${domain}`);
+        } else if (!spfRecord.content.includes("include:amazonses.com")) {
+          incorrect.push(`SPF: ${domain} (missing amazonses.com include)`);
+        }
+        const dmarcRecord = await this.findRecord(`_dmarc.${domain}`, "TXT");
+        if (!dmarcRecord) {
+          missing.push(`DMARC: _dmarc.${domain}`);
+        }
+        if (mailFromDomain) {
+          const mxRecord = await this.findRecord(mailFromDomain, "MX");
+          if (!mxRecord) {
+            missing.push(`MX: ${mailFromDomain}`);
+          } else if (!mxRecord.content.includes(`feedback-smtp.${region}.amazonses.com`)) {
+            incorrect.push(`MX: ${mailFromDomain}`);
+          }
+          const mailFromSpf = await this.findRecord(mailFromDomain, "TXT");
+          if (!mailFromSpf) {
+            missing.push(`SPF: ${mailFromDomain}`);
+          }
+        }
+        return {
+          verified: missing.length === 0 && incorrect.length === 0,
+          missing,
+          incorrect
+        };
+      }
+    };
+  }
+});
+
+// src/utils/dns/vercel.ts
+var VERCEL_API_BASE, VercelDNSClient;
+var init_vercel = __esm({
+  "src/utils/dns/vercel.ts"() {
+    "use strict";
+    init_esm_shims();
+    VERCEL_API_BASE = "https://api.vercel.com";
+    VercelDNSClient = class {
+      domain;
+      apiToken;
+      teamId;
+      constructor(domain, apiToken, teamId) {
+        this.domain = domain;
+        this.apiToken = apiToken;
+        this.teamId = teamId;
+      }
+      get teamParam() {
+        return this.teamId ? `&teamId=${this.teamId}` : "";
+      }
+      async request(endpoint, method = "GET", body) {
+        const url = `${VERCEL_API_BASE}${endpoint}${endpoint.includes("?") ? "&" : "?"}${this.teamParam.slice(1)}`;
+        const response = await fetch(url, {
+          method,
+          headers: {
+            Authorization: `Bearer ${this.apiToken}`,
+            "Content-Type": "application/json"
+          },
+          body: body ? JSON.stringify(body) : void 0
+        });
+        return response.json();
+      }
+      async createRecord(name, type, value, mxPriority) {
+        const relativeName = name === this.domain ? "@" : name.replace(`.${this.domain}`, "");
+        const body = {
+          name: relativeName,
+          type,
+          value,
+          ttl: 1800
+        };
+        if (mxPriority !== void 0) {
+          body.mxPriority = mxPriority;
+        }
+        const result = await this.request(
+          `/v2/domains/${this.domain}/records`,
+          "POST",
+          body
+        );
+        return !result.error;
+      }
+      async findRecord(name, type) {
+        const result = await this.request(
+          `/v4/domains/${this.domain}/records`
+        );
+        if (result.error || !result.records) {
+          return null;
+        }
+        const relativeName = name === this.domain ? "@" : name.replace(`.${this.domain}`, "");
+        return result.records.find(
+          (r) => (r.name === relativeName || r.name === name) && r.type === type
+        ) || null;
+      }
+      async deleteRecord(recordId) {
+        const result = await this.request(
+          `/v2/domains/${this.domain}/records/${recordId}`,
+          "DELETE"
+        );
+        return !result.error;
+      }
+      async createEmailRecords(data) {
+        const { domain, dkimTokens, mailFromDomain, region } = data;
+        const errors2 = [];
+        let recordsCreated = 0;
+        try {
+          for (const token of dkimTokens) {
+            const name = `${token}._domainkey.${domain}`;
+            const success = await this.createRecord(
+              name,
+              "CNAME",
+              `${token}.dkim.amazonses.com`
+            );
+            if (success) {
+              recordsCreated++;
+            } else {
+              errors2.push(`Failed to create DKIM record: ${name}`);
+            }
+          }
+          const spfSuccess = await this.createRecord(
+            domain,
+            "TXT",
+            "v=spf1 include:amazonses.com ~all"
+          );
+          if (spfSuccess) {
+            recordsCreated++;
+          } else {
+            errors2.push(`Failed to create SPF record for ${domain}`);
+          }
+          const dmarcSuccess = await this.createRecord(
+            `_dmarc.${domain}`,
+            "TXT",
+            `v=DMARC1; p=quarantine; rua=mailto:postmaster@${mailFromDomain || domain}`
+          );
+          if (dmarcSuccess) {
+            recordsCreated++;
+          } else {
+            errors2.push(`Failed to create DMARC record for ${domain}`);
+          }
+          if (mailFromDomain) {
+            const mxSuccess = await this.createRecord(
+              mailFromDomain,
+              "MX",
+              `feedback-smtp.${region}.amazonses.com`,
+              10
+            );
+            if (mxSuccess) {
+              recordsCreated++;
+            } else {
+              errors2.push(`Failed to create MX record for ${mailFromDomain}`);
+            }
+            const mailFromSpfSuccess = await this.createRecord(
+              mailFromDomain,
+              "TXT",
+              "v=spf1 include:amazonses.com ~all"
+            );
+            if (mailFromSpfSuccess) {
+              recordsCreated++;
+            } else {
+              errors2.push(`Failed to create SPF record for ${mailFromDomain}`);
+            }
+          }
+          return {
+            success: errors2.length === 0,
+            recordsCreated,
+            errors: errors2.length > 0 ? errors2 : void 0
+          };
+        } catch (error) {
+          return {
+            success: false,
+            recordsCreated,
+            errors: [
+              ...errors2,
+              error instanceof Error ? error.message : "Unknown error"
+            ]
+          };
+        }
+      }
+      async deleteEmailRecords(data) {
+        const { domain, dkimTokens, mailFromDomain } = data;
+        const errors2 = [];
+        let recordsCreated = 0;
+        try {
+          for (const token of dkimTokens) {
+            const name = `${token}._domainkey.${domain}`;
+            const record = await this.findRecord(name, "CNAME");
+            if (record) {
+              const success = await this.deleteRecord(record.id);
+              if (success) {
+                recordsCreated++;
+              } else {
+                errors2.push(`Failed to delete DKIM record: ${name}`);
+              }
+            }
+          }
+          const dmarcRecord = await this.findRecord(`_dmarc.${domain}`, "TXT");
+          if (dmarcRecord) {
+            const success = await this.deleteRecord(dmarcRecord.id);
+            if (success) {
+              recordsCreated++;
+            } else {
+              errors2.push("Failed to delete DMARC record");
+            }
+          }
+          if (mailFromDomain) {
+            const mxRecord = await this.findRecord(mailFromDomain, "MX");
+            if (mxRecord) {
+              const success = await this.deleteRecord(mxRecord.id);
+              if (success) {
+                recordsCreated++;
+              } else {
+                errors2.push(`Failed to delete MX record for ${mailFromDomain}`);
+              }
+            }
+            const spfRecord = await this.findRecord(mailFromDomain, "TXT");
+            if (spfRecord) {
+              const success = await this.deleteRecord(spfRecord.id);
+              if (success) {
+                recordsCreated++;
+              } else {
+                errors2.push(`Failed to delete SPF record for ${mailFromDomain}`);
+              }
+            }
+          }
+          return {
+            success: errors2.length === 0,
+            recordsCreated,
+            errors: errors2.length > 0 ? errors2 : void 0
+          };
+        } catch (error) {
+          return {
+            success: false,
+            recordsCreated,
+            errors: [
+              ...errors2,
+              error instanceof Error ? error.message : "Unknown error"
+            ]
+          };
+        }
+      }
+      async verifyRecords(data) {
+        const { domain, dkimTokens, mailFromDomain, region } = data;
+        const missing = [];
+        const incorrect = [];
+        for (const token of dkimTokens) {
+          const name = `${token}._domainkey.${domain}`;
+          const expectedValue = `${token}.dkim.amazonses.com`;
+          const record = await this.findRecord(name, "CNAME");
+          if (!record) {
+            missing.push(`DKIM: ${name}`);
+          } else if (record.value !== expectedValue) {
+            incorrect.push(`DKIM: ${name} (expected ${expectedValue})`);
+          }
+        }
+        const spfRecord = await this.findRecord(domain, "TXT");
+        if (!spfRecord) {
+          missing.push(`SPF: ${domain}`);
+        } else if (!spfRecord.value.includes("include:amazonses.com")) {
+          incorrect.push(`SPF: ${domain} (missing amazonses.com include)`);
+        }
+        const dmarcRecord = await this.findRecord(`_dmarc.${domain}`, "TXT");
+        if (!dmarcRecord) {
+          missing.push(`DMARC: _dmarc.${domain}`);
+        }
+        if (mailFromDomain) {
+          const mxRecord = await this.findRecord(mailFromDomain, "MX");
+          if (!mxRecord) {
+            missing.push(`MX: ${mailFromDomain}`);
+          } else if (!mxRecord.value.includes(`feedback-smtp.${region}.amazonses.com`)) {
+            incorrect.push(`MX: ${mailFromDomain}`);
+          }
+          const mailFromSpf = await this.findRecord(mailFromDomain, "TXT");
+          if (!mailFromSpf) {
+            missing.push(`SPF: ${mailFromDomain}`);
+          }
+        }
+        return {
+          verified: missing.length === 0 && incorrect.length === 0,
+          missing,
+          incorrect
+        };
+      }
+    };
+  }
+});
+
+// src/utils/dns/create-records.ts
+function buildEmailDNSRecords(data) {
+  const { domain, dkimTokens, mailFromDomain, region } = data;
+  const records = [];
+  for (const token of dkimTokens) {
+    records.push({
+      name: `${token}._domainkey.${domain}`,
+      type: "CNAME",
+      value: `${token}.dkim.amazonses.com`,
+      category: "dkim"
+    });
+  }
+  records.push({
+    name: domain,
+    type: "TXT",
+    value: "v=spf1 include:amazonses.com ~all",
+    category: "spf"
+  });
+  const dmarcRuaDomain = mailFromDomain || domain;
+  records.push({
+    name: `_dmarc.${domain}`,
+    type: "TXT",
+    value: `v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}`,
+    category: "dmarc"
+  });
+  if (mailFromDomain) {
+    records.push({
+      name: mailFromDomain,
+      type: "MX",
+      value: `feedback-smtp.${region}.amazonses.com`,
+      priority: 10,
+      category: "mailfrom_mx"
+    });
+    records.push({
+      name: mailFromDomain,
+      type: "TXT",
+      value: "v=spf1 include:amazonses.com ~all",
+      category: "mailfrom_spf"
+    });
+  }
+  return records;
+}
+function formatDNSRecordsForDisplay(records) {
+  return records.map((r) => ({
+    name: r.name,
+    type: r.type,
+    value: r.priority ? `${r.priority} ${r.value}` : r.value
+  }));
+}
+async function createDNSRecordsForProvider(credentials, data, selectedCategories) {
+  switch (credentials.provider) {
+    case "route53": {
+      const categories = selectedCategories || /* @__PURE__ */ new Set([
+        "dkim",
+        "spf",
+        "dmarc",
+        "mailfrom_mx",
+        "mailfrom_spf"
+      ]);
+      try {
+        await createSelectedDNSRecords(
+          credentials.hostedZoneId,
+          data.domain,
+          data.dkimTokens,
+          data.region,
+          categories,
+          void 0,
+          // customTrackingDomain - not used here
+          data.mailFromDomain
+        );
+        let recordsCreated = 0;
+        if (categories.has("dkim")) recordsCreated += data.dkimTokens.length;
+        if (categories.has("spf")) recordsCreated += 1;
+        if (categories.has("dmarc")) recordsCreated += 1;
+        if (data.mailFromDomain) {
+          if (categories.has("mailfrom_mx")) recordsCreated += 1;
+          if (categories.has("mailfrom_spf")) recordsCreated += 1;
+        }
+        return {
+          success: true,
+          recordsCreated
+        };
+      } catch (error) {
+        return {
+          success: false,
+          recordsCreated: 0,
+          errors: [error instanceof Error ? error.message : "Unknown error"]
+        };
+      }
+    }
+    case "vercel": {
+      const client = new VercelDNSClient(
+        data.domain,
+        credentials.token,
+        credentials.teamId
+      );
+      return client.createEmailRecords(data);
+    }
+    case "cloudflare": {
+      const client = new CloudflareDNSClient(
+        credentials.zoneId,
+        credentials.token
+      );
+      return client.createEmailRecords(data);
+    }
+    case "manual": {
+      return {
+        success: true,
+        recordsCreated: 0
+      };
+    }
+  }
+}
+function getDNSProviderDisplayName(provider) {
+  switch (provider) {
+    case "route53":
+      return "AWS Route53";
+    case "vercel":
+      return "Vercel DNS";
+    case "cloudflare":
+      return "Cloudflare";
+    case "manual":
+      return "Manual";
+  }
+}
+function getDNSProviderTokenUrl(provider) {
+  switch (provider) {
+    case "vercel":
+      return "https://vercel.com/account/tokens";
+    case "cloudflare":
+      return "https://dash.cloudflare.com/profile/api-tokens";
+  }
+}
+var init_create_records = __esm({
+  "src/utils/dns/create-records.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_route53();
+    init_cloudflare();
+    init_vercel();
+  }
+});
+
+// src/utils/dns/credentials.ts
+function getDNSProviderEnvVars(provider) {
+  switch (provider) {
+    case "route53":
+      return [];
+    // Uses AWS credentials from environment/config
+    case "vercel":
+      return ["VERCEL_TOKEN"];
+    case "cloudflare":
+      return ["CLOUDFLARE_API_TOKEN"];
+    case "manual":
+      return [];
+  }
+}
+function getDNSProviderOptionalEnvVars(provider) {
+  switch (provider) {
+    case "vercel":
+      return ["VERCEL_TEAM_ID"];
+    case "cloudflare":
+      return ["CLOUDFLARE_ZONE_ID"];
+    default:
+      return [];
+  }
+}
+function hasVercelToken() {
+  return !!process.env.VERCEL_TOKEN;
+}
+function hasCloudflareToken() {
+  return !!process.env.CLOUDFLARE_API_TOKEN;
+}
+async function validateVercelCredentials(token) {
+  try {
+    const response = await fetch("https://api.vercel.com/v2/user", {
+      headers: {
+        Authorization: `Bearer ${token}`
+      }
+    });
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+async function checkVercelDomain(token, domain, teamId) {
+  try {
+    const teamParam = teamId ? `&teamId=${teamId}` : "";
+    const response = await fetch(
+      `https://api.vercel.com/v5/domains/${domain}?${teamParam}`,
+      {
+        headers: {
+          Authorization: `Bearer ${token}`
+        }
+      }
+    );
+    return response.ok;
+  } catch {
+    return false;
+  }
+}
+async function validateCloudflareCredentials(token) {
+  try {
+    const response = await fetch(
+      "https://api.cloudflare.com/client/v4/user/tokens/verify",
+      {
+        headers: {
+          Authorization: `Bearer ${token}`
+        }
+      }
+    );
+    const data = await response.json();
+    return data.success === true;
+  } catch {
+    return false;
+  }
+}
+async function findCloudflareZoneId(token, domain) {
+  try {
+    const response = await fetch(
+      `https://api.cloudflare.com/client/v4/zones?name=${encodeURIComponent(domain)}`,
+      {
+        headers: {
+          Authorization: `Bearer ${token}`,
+          "Content-Type": "application/json"
+        }
+      }
+    );
+    const data = await response.json();
+    if (data.success && data.result.length > 0) {
+      return data.result[0].id;
+    }
+    const parts = domain.split(".");
+    if (parts.length > 2) {
+      const parentDomain = parts.slice(-2).join(".");
+      const parentResponse = await fetch(
+        `https://api.cloudflare.com/client/v4/zones?name=${encodeURIComponent(parentDomain)}`,
+        {
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json"
+          }
+        }
+      );
+      const parentData = await parentResponse.json();
+      if (parentData.success && parentData.result.length > 0) {
+        return parentData.result[0].id;
+      }
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function getDNSCredentials(provider, domain, region) {
+  switch (provider) {
+    case "route53": {
+      const hostedZone = await findHostedZone(domain, region);
+      if (hostedZone) {
+        return {
+          valid: true,
+          credentials: { provider: "route53", hostedZoneId: hostedZone.id }
+        };
+      }
+      return {
+        valid: false,
+        error: `No Route53 hosted zone found for ${domain}`
+      };
+    }
+    case "vercel": {
+      const token = process.env.VERCEL_TOKEN;
+      if (!token) {
+        return {
+          valid: false,
+          error: "VERCEL_TOKEN environment variable is not set"
+        };
+      }
+      const isValid = await validateVercelCredentials(token);
+      if (!isValid) {
+        return {
+          valid: false,
+          error: "Invalid VERCEL_TOKEN - authentication failed"
+        };
+      }
+      const teamId = process.env.VERCEL_TEAM_ID;
+      const hasDomain = await checkVercelDomain(token, domain, teamId);
+      if (!hasDomain) {
+        return {
+          valid: false,
+          error: `Domain ${domain} not found in Vercel DNS`
+        };
+      }
+      return {
+        valid: true,
+        credentials: { provider: "vercel", token, teamId }
+      };
+    }
+    case "cloudflare": {
+      const token = process.env.CLOUDFLARE_API_TOKEN;
+      if (!token) {
+        return {
+          valid: false,
+          error: "CLOUDFLARE_API_TOKEN environment variable is not set"
+        };
+      }
+      const isValid = await validateCloudflareCredentials(token);
+      if (!isValid) {
+        return {
+          valid: false,
+          error: "Invalid CLOUDFLARE_API_TOKEN - authentication failed"
+        };
+      }
+      let zoneId = process.env.CLOUDFLARE_ZONE_ID;
+      if (!zoneId) {
+        const detectedZoneId = await findCloudflareZoneId(token, domain);
+        zoneId = detectedZoneId ?? void 0;
+      }
+      if (!zoneId) {
+        return {
+          valid: false,
+          error: `Could not find Cloudflare zone for ${domain}. Set CLOUDFLARE_ZONE_ID if the domain uses a different zone.`
+        };
+      }
+      return {
+        valid: true,
+        credentials: { provider: "cloudflare", token, zoneId }
+      };
+    }
+    case "manual":
+      return {
+        valid: true,
+        credentials: { provider: "manual" }
+      };
+  }
+}
+async function detectAvailableDNSProviders(domain, region) {
+  const providers = [];
+  const hostedZone = await findHostedZone(domain, region);
+  providers.push({
+    provider: "route53",
+    detected: !!hostedZone,
+    hint: hostedZone ? "Hosted zone detected" : void 0
+  });
+  const vercelToken = process.env.VERCEL_TOKEN;
+  if (vercelToken) {
+    const teamId = process.env.VERCEL_TEAM_ID;
+    const hasDomain = await checkVercelDomain(vercelToken, domain, teamId);
+    providers.push({
+      provider: "vercel",
+      detected: hasDomain,
+      hint: hasDomain ? "Domain found in Vercel DNS" : "Token found"
+    });
+  } else {
+    providers.push({
+      provider: "vercel",
+      detected: false
+    });
+  }
+  const cfToken = process.env.CLOUDFLARE_API_TOKEN;
+  if (cfToken) {
+    const zoneId = process.env.CLOUDFLARE_ZONE_ID || await findCloudflareZoneId(cfToken, domain);
+    providers.push({
+      provider: "cloudflare",
+      detected: !!zoneId,
+      hint: zoneId ? "Zone found" : "Token found"
+    });
+  } else {
+    providers.push({
+      provider: "cloudflare",
+      detected: false
+    });
+  }
+  providers.push({
+    provider: "manual",
+    detected: true,
+    hint: "I'll add DNS records myself"
+  });
+  return providers.sort((a, b) => {
+    if (a.provider === "manual") return 1;
+    if (b.provider === "manual") return -1;
+    if (a.detected && !b.detected) return -1;
+    if (!a.detected && b.detected) return 1;
+    return 0;
+  });
+}
+var init_credentials = __esm({
+  "src/utils/dns/credentials.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_route53();
+  }
+});
+
+// src/utils/dns/index.ts
+var dns_exports = {};
+__export(dns_exports, {
+  CloudflareDNSClient: () => CloudflareDNSClient,
+  VercelDNSClient: () => VercelDNSClient,
+  buildEmailDNSRecords: () => buildEmailDNSRecords,
+  createDNSRecordsForProvider: () => createDNSRecordsForProvider,
+  detectAvailableDNSProviders: () => detectAvailableDNSProviders,
+  findCloudflareZoneId: () => findCloudflareZoneId,
+  formatDNSRecordsForDisplay: () => formatDNSRecordsForDisplay,
+  getDNSCredentials: () => getDNSCredentials,
+  getDNSProviderDisplayName: () => getDNSProviderDisplayName,
+  getDNSProviderEnvVars: () => getDNSProviderEnvVars,
+  getDNSProviderOptionalEnvVars: () => getDNSProviderOptionalEnvVars,
+  getDNSProviderTokenUrl: () => getDNSProviderTokenUrl,
+  hasCloudflareToken: () => hasCloudflareToken,
+  hasVercelToken: () => hasVercelToken
+});
+var init_dns = __esm({
+  "src/utils/dns/index.ts"() {
+    "use strict";
+    init_esm_shims();
+    init_cloudflare();
+    init_create_records();
+    init_credentials();
+    init_vercel();
+  }
+});
+
 // src/utils/shared/assume-role.ts
 var assume_role_exports = {};
 __export(assume_role_exports, {
@@ -14978,51 +15955,149 @@ ${pc18.yellow(pc18.bold("Configuration Warnings:"))}`);
   await saveConnectionMetadata(metadata);
   progress.info("Connection metadata saved for upgrade and restore capability");
   let dnsAutoCreated = false;
+  let dnsProvider;
   if (outputs.domain && outputs.dkimTokens && outputs.dkimTokens.length > 0) {
-    const { findHostedZone: findHostedZone2, previewDNSChanges: previewDNSChanges2, createSelectedDNSRecords: createSelectedDNSRecords2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
-    const { promptDNSManagement: promptDNSManagement2, promptDNSConfirmation: promptDNSConfirmation2 } = await Promise.resolve().then(() => (init_prompts(), prompts_exports));
-    const hostedZone = await findHostedZone2(outputs.domain, region);
-    if (hostedZone) {
-      const manageDNS = await promptDNSManagement2(outputs.domain);
-      if (manageDNS) {
-        try {
-          progress.start("Checking existing DNS records");
-          const dnsPreview = await previewDNSChanges2(
-            hostedZone.id,
-            outputs.domain,
-            outputs.dkimTokens,
-            region,
-            outputs.customTrackingDomain,
-            outputs.mailFromDomain
-          );
-          progress.stop();
-          const { shouldCreate, selectedCategories } = await promptDNSConfirmation2(dnsPreview);
-          if (shouldCreate && selectedCategories.size > 0) {
-            progress.start("Creating selected DNS records in Route53");
-            await createSelectedDNSRecords2(
-              hostedZone.id,
+    const {
+      detectAvailableDNSProviders: detectAvailableDNSProviders2,
+      getDNSCredentials: getDNSCredentials2,
+      createDNSRecordsForProvider: createDNSRecordsForProvider2,
+      getDNSProviderDisplayName: getDNSProviderDisplayName2,
+      getDNSProviderTokenUrl: getDNSProviderTokenUrl2,
+      buildEmailDNSRecords: buildEmailDNSRecords2
+    } = await Promise.resolve().then(() => (init_dns(), dns_exports));
+    const {
+      promptDNSProvider: promptDNSProvider2,
+      promptDNSConfirmation: promptDNSConfirmation2,
+      promptContinueManualDNS: promptContinueManualDNS2
+    } = await Promise.resolve().then(() => (init_prompts(), prompts_exports));
+    const { previewDNSChanges: previewDNSChanges2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
+    progress.start("Detecting DNS providers");
+    const availableProviders = await detectAvailableDNSProviders2(
+      outputs.domain,
+      region
+    );
+    progress.stop();
+    const selectedProvider = await promptDNSProvider2(
+      outputs.domain,
+      availableProviders
+    );
+    dnsProvider = selectedProvider;
+    if (selectedProvider !== "manual") {
+      progress.start(
+        `Validating ${getDNSProviderDisplayName2(selectedProvider)} credentials`
+      );
+      const credentialResult2 = await getDNSCredentials2(
+        selectedProvider,
+        outputs.domain,
+        region
+      );
+      progress.stop();
+      if (credentialResult2.valid && credentialResult2.credentials) {
+        const credentials = credentialResult2.credentials;
+        if (credentials.provider === "route53") {
+          try {
+            progress.start("Checking existing DNS records");
+            const dnsPreview = await previewDNSChanges2(
+              credentials.hostedZoneId,
               outputs.domain,
               outputs.dkimTokens,
               region,
-              selectedCategories,
               outputs.customTrackingDomain,
               outputs.mailFromDomain
             );
+            progress.stop();
+            const { shouldCreate, selectedCategories } = await promptDNSConfirmation2(dnsPreview);
+            if (shouldCreate && selectedCategories.size > 0) {
+              progress.start("Creating selected DNS records in Route53");
+              const result = await createDNSRecordsForProvider2(
+                credentials,
+                {
+                  domain: outputs.domain,
+                  dkimTokens: outputs.dkimTokens,
+                  mailFromDomain: outputs.mailFromDomain,
+                  region
+                },
+                selectedCategories
+              );
+              if (result.success) {
+                progress.succeed(
+                  `Created ${selectedCategories.size} DNS record group(s) in Route53`
+                );
+                dnsAutoCreated = true;
+              } else {
+                progress.fail("Failed to create some DNS records");
+                if (result.errors) {
+                  for (const error of result.errors) {
+                    clack17.log.warn(error);
+                  }
+                }
+              }
+            } else {
+              clack17.log.info(
+                "Skipping DNS record creation. You can add them manually."
+              );
+            }
+          } catch (error) {
+            progress.stop();
+            clack17.log.warn(`Could not manage DNS records: ${error.message}`);
+          }
+        } else {
+          const recordData = {
+            domain: outputs.domain,
+            dkimTokens: outputs.dkimTokens,
+            mailFromDomain: outputs.mailFromDomain,
+            region
+          };
+          const records = buildEmailDNSRecords2(recordData);
+          clack17.log.info(pc18.bold("DNS records to create:"));
+          for (const record of records) {
+            clack17.log.info(
+              pc18.dim(`  ${record.type} ${record.name} \u2192 ${record.value}`)
+            );
+          }
+          progress.start(
+            `Creating DNS records in ${getDNSProviderDisplayName2(credentials.provider)}`
+          );
+          const result = await createDNSRecordsForProvider2(
+            credentials,
+            recordData
+          );
+          if (result.success) {
             progress.succeed(
-              `Created ${selectedCategories.size} DNS record group(s) in Route53`
+              `Created ${result.recordsCreated} DNS records in ${getDNSProviderDisplayName2(credentials.provider)}`
             );
             dnsAutoCreated = true;
           } else {
-            clack17.log.info(
-              "Skipping DNS record creation. You can add them manually."
-            );
+            progress.fail("Failed to create some DNS records");
+            if (result.errors) {
+              for (const error of result.errors) {
+                clack17.log.warn(error);
+              }
+            }
           }
-        } catch (error) {
-          progress.stop();
-          clack17.log.warn(`Could not manage DNS records: ${error.message}`);
+        }
+      } else {
+        clack17.log.warn(
+          credentialResult2.error || "Could not validate credentials"
+        );
+        if (selectedProvider === "vercel" || selectedProvider === "cloudflare") {
+          clack17.log.info(
+            `Set the ${selectedProvider === "vercel" ? "VERCEL_TOKEN" : "CLOUDFLARE_API_TOKEN"} environment variable to enable automatic DNS management.`
+          );
+          clack17.log.info(
+            `You can create a token at: ${pc18.cyan(getDNSProviderTokenUrl2(selectedProvider))}`
+          );
+        }
+        const continueManual = await promptContinueManualDNS2();
+        if (continueManual) {
+          dnsProvider = "manual";
         }
       }
     }
+    if (dnsProvider && metadata.services.email) {
+      metadata.services.email.dnsProvider = dnsProvider;
+      await saveConnectionMetadata(metadata);
+    }
   }
   const dnsRecords = [];
   if (outputs.domain && outputs.dkimTokens && outputs.dkimTokens.length > 0 && !dnsAutoCreated) {
@@ -15380,6 +16455,8 @@ import * as clack20 from "@clack/prompts";
 import * as pulumi18 from "@pulumi/pulumi";
 import pc21 from "picocolors";
 init_events();
+init_create_records();
+init_credentials();
 init_costs();
 init_presets();
 init_aws();
@@ -15820,35 +16897,54 @@ ${pc21.bold("Current Configuration:")}
             "This ensures all tracking links use secure HTTPS connections."
           )
         );
-        const { findHostedZone: findHostedZone2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
-        const hostedZone = await progress.execute(
-          "Checking for Route53 hosted zone",
-          async () => await findHostedZone2(trackingDomain || config2.domain, region)
-        );
-        if (hostedZone) {
-          progress.info(
-            `Found Route53 hosted zone: ${pc21.cyan(hostedZone.name)} ${pc21.green("\u2713")}`
-          );
-          clack20.log.info(
-            pc21.dim(
-              "DNS records (SSL certificate validation + CloudFront) will be created automatically."
-            )
-          );
+        let trackingDnsProvider = metadata.services.email?.dnsProvider;
+        let canAutomateDNS = false;
+        if (trackingDnsProvider) {
+          canAutomateDNS = trackingDnsProvider !== "manual";
+          if (canAutomateDNS) {
+            progress.info(
+              `Will use ${pc21.cyan(getDNSProviderDisplayName(trackingDnsProvider))} for DNS records ${pc21.green("\u2713")}`
+            );
+          }
         } else {
-          clack20.log.warn(
-            `No Route53 hosted zone found for ${pc21.cyan(trackingDomain || config2.domain)}`
-          );
-          clack20.log.info(
-            pc21.dim(
-              "You'll need to manually create DNS records for SSL certificate validation and CloudFront."
+          const availableProviders = await progress.execute(
+            "Detecting available DNS providers",
+            async () => await detectAvailableDNSProviders(
+              trackingDomain || config2.domain,
+              region
             )
           );
-          clack20.log.info(
-            pc21.dim("DNS record details will be shown after deployment.")
+          const detectedProvider = availableProviders.find(
+            (p) => p.detected && p.provider !== "manual"
           );
+          if (detectedProvider) {
+            trackingDnsProvider = detectedProvider.provider;
+            canAutomateDNS = true;
+            progress.info(
+              `Found ${pc21.cyan(getDNSProviderDisplayName(detectedProvider.provider))} ${pc21.green("\u2713")}`
+            );
+            clack20.log.info(
+              pc21.dim(
+                "DNS records (SSL certificate validation + CloudFront) will be created automatically."
+              )
+            );
+          } else {
+            canAutomateDNS = false;
+            clack20.log.warn(
+              `No automatic DNS provider detected for ${pc21.cyan(trackingDomain || config2.domain)}`
+            );
+            clack20.log.info(
+              pc21.dim(
+                "You'll need to manually create DNS records for SSL certificate validation and CloudFront."
+              )
+            );
+            clack20.log.info(
+              pc21.dim("DNS record details will be shown after deployment.")
+            );
+          }
         }
         const confirmHttps = await clack20.confirm({
-          message: hostedZone ? "Proceed with automatic HTTPS setup?" : "Proceed with manual HTTPS setup (requires DNS configuration)?",
+          message: canAutomateDNS ? "Proceed with automatic HTTPS setup?" : "Proceed with manual HTTPS setup (requires DNS configuration)?",
           initialValue: true
         });
         if (clack20.isCancel(confirmHttps) || !confirmHttps) {
@@ -16660,31 +17756,103 @@ ${pc21.bold("Cost Impact:")}`);
     trackError("UPGRADE_FAILED", "email:upgrade", { step: "deploy" });
     throw new Error(`Pulumi upgrade failed: ${error.message}`);
   }
+  let dnsAutoCreated = false;
   if (outputs.domain && outputs.dkimTokens && outputs.dkimTokens.length > 0) {
-    const { findHostedZone: findHostedZone2, createDNSRecords: createDNSRecords2 } = await Promise.resolve().then(() => (init_route53(), route53_exports));
-    const hostedZone = await findHostedZone2(outputs.domain, region);
-    if (hostedZone) {
-      try {
-        progress.start("Creating DNS records in Route53");
-        const mailFromDomain = updatedConfig.mailFromDomain || `mail.${outputs.domain}`;
-        await createDNSRecords2(
-          hostedZone.id,
+    let dnsProvider = metadata.services.email?.dnsProvider;
+    if (!dnsProvider) {
+      const availableProviders = await progress.execute(
+        "Detecting available DNS providers",
+        async () => await detectAvailableDNSProviders(outputs.domain, region)
+      );
+      const detectedProvider = availableProviders.find(
+        (p) => p.detected && p.provider !== "manual"
+      );
+      if (detectedProvider) {
+        dnsProvider = await promptDNSProvider(
           outputs.domain,
-          outputs.dkimTokens,
-          region,
-          outputs.customTrackingDomain,
-          mailFromDomain,
-          outputs.cloudFrontDomain
+          availableProviders
         );
-        progress.succeed("DNS records created in Route53");
-      } catch (error) {
-        progress.fail(
-          `Failed to create DNS records automatically: ${error.message}`
-        );
-        progress.info(
-          "You can manually add the required DNS records shown below"
+        if (dnsProvider && dnsProvider !== "manual" && metadata.services.email) {
+          metadata.services.email.dnsProvider = dnsProvider;
+        }
+      }
+    }
+    if (dnsProvider && dnsProvider !== "manual") {
+      const credResult = await progress.execute(
+        `Validating ${getDNSProviderDisplayName(dnsProvider)} credentials`,
+        async () => await getDNSCredentials(dnsProvider, outputs.domain, region)
+      );
+      if (credResult.valid && credResult.credentials) {
+        const mailFromDomain = updatedConfig.mailFromDomain || `mail.${outputs.domain}`;
+        const dnsData = {
+          domain: outputs.domain,
+          dkimTokens: outputs.dkimTokens,
+          mailFromDomain,
+          region
+        };
+        try {
+          progress.start(
+            `Creating DNS records in ${getDNSProviderDisplayName(dnsProvider)}`
+          );
+          const result = await createDNSRecordsForProvider(
+            credResult.credentials,
+            dnsData
+          );
+          if (result.success) {
+            progress.succeed(
+              `Created ${result.recordsCreated} DNS records in ${getDNSProviderDisplayName(dnsProvider)}`
+            );
+            dnsAutoCreated = true;
+          } else {
+            progress.fail(
+              `Failed to create some DNS records: ${result.errors?.join(", ")}`
+            );
+            progress.info(
+              "You can manually add the required DNS records shown below"
+            );
+          }
+        } catch (error) {
+          progress.fail(
+            `Failed to create DNS records automatically: ${error.message}`
+          );
+          progress.info(
+            "You can manually add the required DNS records shown below"
+          );
+        }
+      } else {
+        clack20.log.warn(
+          credResult.error || `Unable to validate ${getDNSProviderDisplayName(dnsProvider)} credentials`
         );
+        if (dnsProvider === "vercel" || dnsProvider === "cloudflare") {
+          clack20.log.info(
+            `Set ${dnsProvider === "vercel" ? "VERCEL_TOKEN" : "CLOUDFLARE_API_TOKEN"} to enable automatic DNS management.`
+          );
+          clack20.log.info(
+            `You can create a token at: ${pc21.cyan(getDNSProviderTokenUrl(dnsProvider))}`
+          );
+        }
+      }
+    }
+    if (!dnsAutoCreated) {
+      const mailFromDomain = updatedConfig.mailFromDomain || `mail.${outputs.domain}`;
+      const dnsData = {
+        domain: outputs.domain,
+        dkimTokens: outputs.dkimTokens,
+        mailFromDomain,
+        region
+      };
+      const dnsRecords = buildEmailDNSRecords(dnsData);
+      const displayRecords = formatDNSRecordsForDisplay(dnsRecords);
+      console.log(
+        `
+${pc21.bold("Add these DNS records to your DNS provider:")}
+`
+      );
+      for (const record of displayRecords) {
+        console.log(`  ${pc21.cyan(record.type)} ${record.name}`);
+        console.log(`       ${pc21.dim(record.value)}`);
       }
+      console.log("");
     }
   }
   updateEmailConfig(metadata, updatedConfig);