doomain 0.1.12 → 0.1.14

package/README.md

@@ -13,6 +13,7 @@ Use the interactive wizard when working by hand. Use explicit commands with `--j
 - Vercel project detection from `.vercel/project.json`.
 - DNS provider inference by longest matching configured zone.
 - Dry-run plans before writing changes.
+- Safety checks before replacing DNS records that point elsewhere.
 - DNS propagation and Vercel verification wait loop.
 - DNS provider support for Spaceship, Namecheap, Cloudflare, and Hostinger.
 
@@ -40,7 +41,8 @@ The wizard will:
 4. Connect a DNS provider if none is configured.
 5. List domains from configured DNS providers.
 6. Preview the Vercel and DNS changes.
-7. Apply the changes and request Vercel verification.
+7. Warn if the current DNS target points elsewhere and ask before overriding it.
+8. Apply the changes and request Vercel verification.
 
 If you already know the target project and domain, run the link command directly:
 
@@ -84,6 +86,8 @@ Apply it:
 doomain link app.example.com --project my-vercel-project --json
 ```
 
+If JSON mode returns `DNS_TARGET_CONFLICT`, the current DNS target appears to point to another project or site. Re-run with `--force` only when you intend to replace that DNS target.
+
 ## Provider Setup
 
 Doomain stores local credentials in `~/.doomain/config.json` with `0600` file permissions. Environment variables override saved config values.
@@ -257,8 +261,10 @@ DNS conflict rules:
 
 - Existing exact records are skipped.
 - TXT records can coexist at the same name.
-- Same-name, same-type conflicts require `--force`.
-- CNAME slot conflicts require `--force` because a CNAME cannot share a name with most other record types.
+- Same-name, same-type conflicts trigger an interactive override prompt or require `--force` in JSON/non-interactive mode.
+- CNAME slot conflicts trigger an interactive override prompt or require `--force` in JSON/non-interactive mode because a CNAME cannot share a name with most other record types.
+
+For real links, Doomain inspects the target `A` or `CNAME` DNS slot before adding the domain to Vercel. In interactive mode, it shows the existing and desired records and asks whether to override. In JSON mode, it fails with `DNS_TARGET_CONFLICT` instead of prompting.
 
 Use `--force` only when you intend to replace conflicting DNS records or move an existing Vercel alias:
 
@@ -268,6 +274,8 @@ doomain link app.example.com --project my-app --force
 
 `--force` can remove an existing Vercel alias from another project and add it to the target project.
 
+Confirming the interactive DNS override only forces DNS writes. If Vercel says the domain is already assigned to another project, re-run with `--force` to move that Vercel alias.
+
 Namecheap note: Namecheap's API writes DNS through `setHosts`, which replaces the full host list. Doomain reads all existing records first, applies planned changes in memory, preserves unrelated records, then submits the complete final record set.
 
 ## JSON And Agent Usage
@@ -333,7 +341,7 @@ Common flags:
 - `-p, --project <project>`: Vercel project id or name.
 - `--provider <id>`: DNS provider id.
 - `--dry-run`: preview without writing.
-- `--force`: overwrite DNS conflicts and allow Vercel alias moves.
+- `--force`: overwrite DNS conflicts without prompting and allow Vercel alias moves.
 - `--wait`, `--no-wait`: wait for DNS and Vercel verification. Default is `--wait`.
 - `--timeout <seconds>`: wait timeout. Default is `300`.
 - `--json`: output one JSON object.
@@ -345,6 +353,7 @@ doomain link app.example.com --project my-app
 doomain link --domain example.com --subdomain app --project my-app
 doomain link --domain example.com --apex --project my-app
 doomain link app.example.com --project my-app --dry-run --json
+doomain link app.example.com --project my-app --force
 ```
 
 ### `doomain auth vercel`
@@ -567,6 +576,10 @@ DNS propagation timeout
 
 The DNS records may have been saved even if Vercel verification timed out. Check the domain in Vercel, inspect records with `doomain domains list`, or re-run verification with `doomain verify`.
 
+DNS target conflict
+
+The domain already has a conflicting `A` or `CNAME` record, which usually means it points to another project or site. In interactive mode, confirm the override only if you intend to replace that target. In JSON mode, re-run `doomain link` with `--force` to overwrite DNS.
+
 Domain already assigned to another Vercel project
 
 If you intend to move it, re-run `doomain link` with `--force`. This can remove the alias from the previous Vercel project.

package/dist/commands/link.js

@@ -1,8 +1,32 @@
 import { Args, Command, Flags } from '@oclif/core';
+import * as p from '@clack/prompts';
 import { DoomainError } from '../lib/errors.js';
 import { accountFlag, apexFlag, domainFlag, jsonFlag, projectFlag, providerFlag, subdomainFlag } from '../lib/flags.js';
 import { linkDomain } from '../lib/link-domain.js';
 import { createOutput, outputError } from '../lib/output.js';
+function recordName(name) {
+    return name === '@' ? 'root' : name;
+}
+function recordLine(record) {
+    const details = [
+        record.priority === undefined ? undefined : `priority ${record.priority}`,
+        record.proxied === undefined ? undefined : `proxied ${record.proxied}`,
+        record.ttl === undefined ? undefined : `ttl ${record.ttl}`,
+    ].filter(Boolean);
+    return `${record.type} ${recordName(record.name)} -> ${record.value}${details.length > 0 ? ` (${details.join(', ')})` : ''}`;
+}
+function dnsOverrideNote(warning) {
+    const account = warning.account === 'default' ? warning.providerName : `${warning.providerName}/${warning.account}`;
+    return [
+        `${warning.domain} already has DNS records in ${account} (${warning.zoneDomain}) that do not match the Vercel target.`,
+        '',
+        'Existing:',
+        ...warning.conflicts.map((conflict) => `- ${recordLine(conflict.existing)}`),
+        '',
+        'Desired:',
+        ...warning.desired.map((record) => `- ${recordLine(record)}`),
+    ].join('\n');
+}
 export default class Link extends Command {
     static description = 'Link a Vercel project to a domain and create DNS records.';
     static examples = [
@@ -51,6 +75,22 @@ export default class Link extends Command {
             const result = await linkDomain({
                 ...flags,
                 domain,
+                confirmDnsOverride: out.json
+                    ? undefined
+                    : async (warning) => {
+                        spinner?.stop('Existing DNS target found');
+                        p.note(dnsOverrideNote(warning), 'DNS already points elsewhere');
+                        const confirmed = await p.confirm({
+                            message: `Override existing DNS records for ${warning.domain}?`,
+                            initialValue: false,
+                        });
+                        if (confirmed === true) {
+                            spinner?.start('Continuing domain link');
+                            return true;
+                        }
+                        spinner = undefined;
+                        return false;
+                    },
                 dryRun: false,
                 progress: out.json ? undefined : ({ message }) => spinner?.message(message),
                 timeoutSeconds: flags.timeout,

package/dist/commands/wizard.js

@@ -157,9 +157,31 @@ async function promptVercelToken(globalTokens) {
     }
     return promptRequired('Vercel token', { password: true });
 }
+function recordName(name) {
+    return name === '@' ? 'root' : name;
+}
+function recordLine(record) {
+    const details = [
+        record.priority === undefined ? undefined : `priority ${record.priority}`,
+        record.proxied === undefined ? undefined : `proxied ${record.proxied}`,
+        record.ttl === undefined ? undefined : `ttl ${record.ttl}`,
+    ].filter(Boolean);
+    return `${record.type} ${recordName(record.name)} -> ${record.value}${details.length > 0 ? ` (${details.join(', ')})` : ''}`;
+}
 function recordPreview(record, providerName) {
-    const name = record.name === '@' ? 'root' : record.name;
-    return `DNS: ${record.type} ${name} -> ${record.value} in ${providerName}`;
+    return `DNS: ${recordLine(record)} in ${providerName}`;
+}
+function dnsOverrideNote(warning) {
+    const account = warning.account === DEFAULT_PROVIDER_ACCOUNT ? warning.providerName : `${warning.providerName}/${warning.account}`;
+    return [
+        `${warning.domain} already has DNS records in ${account} (${warning.zoneDomain}) that do not match the Vercel target.`,
+        '',
+        'Existing:',
+        ...warning.conflicts.map((conflict) => `- ${recordLine(conflict.existing)}`),
+        '',
+        'Desired:',
+        ...warning.desired.map((record) => `- ${recordLine(record)}`),
+    ].join('\n');
 }
 export default class Wizard extends Command {
     static description = 'Interactive Vercel domain linker.';
@@ -389,6 +411,20 @@ export default class Wizard extends Command {
                 subdomain,
                 apex,
                 project,
+                confirmDnsOverride: async (warning) => {
+                    spinner.stop('Existing DNS target found');
+                    p.note(dnsOverrideNote(warning), 'DNS already points elsewhere');
+                    const confirmed = await p.confirm({
+                        message: `Override existing DNS records for ${warning.domain}?`,
+                        initialValue: false,
+                    });
+                    if (confirmed === true) {
+                        spinner.start('Continuing domain link');
+                        return true;
+                    }
+                    activeSpinner = undefined;
+                    return false;
+                },
                 progress: ({ message }) => spinner.message(message),
                 wait: true,
             });

package/dist/lib/errors.d.ts

@@ -1,4 +1,4 @@
-export type DoomainErrorCode = 'CONFIG_NOT_FOUND' | 'DOMAIN_LINK_FAILED' | 'DOMAIN_ALREADY_ASSIGNED' | 'DOMAIN_VERIFY_FAILED' | 'INVALID_INPUT' | 'MISSING_ARGUMENT' | 'MISSING_CREDENTIALS' | 'PROVIDER_API_ERROR' | 'PROVIDER_AUTH_FAILED' | 'PROVIDER_PERMISSION_DENIED' | 'PROVIDER_NOT_FOUND' | 'PROVIDER_RATE_LIMITED' | 'PROVIDER_RECORD_CONFLICT' | 'PROVIDER_UNSUPPORTED_RECORD' | 'PROVIDER_ZONE_AMBIGUOUS' | 'PROVIDER_ZONE_NOT_FOUND' | 'PROJECT_NOT_FOUND' | 'VERCEL_AUTH_FAILED' | 'VERCEL_PROJECT_NOT_LINKED';
+export type DoomainErrorCode = 'CONFIG_NOT_FOUND' | 'DNS_TARGET_CONFLICT' | 'DOMAIN_LINK_FAILED' | 'DOMAIN_ALREADY_ASSIGNED' | 'DOMAIN_VERIFY_FAILED' | 'INVALID_INPUT' | 'MISSING_ARGUMENT' | 'MISSING_CREDENTIALS' | 'PROVIDER_API_ERROR' | 'PROVIDER_AUTH_FAILED' | 'PROVIDER_PERMISSION_DENIED' | 'PROVIDER_NOT_FOUND' | 'PROVIDER_RATE_LIMITED' | 'PROVIDER_RECORD_CONFLICT' | 'PROVIDER_UNSUPPORTED_RECORD' | 'PROVIDER_ZONE_AMBIGUOUS' | 'PROVIDER_ZONE_NOT_FOUND' | 'PROJECT_NOT_FOUND' | 'VERCEL_AUTH_FAILED' | 'VERCEL_PROJECT_NOT_LINKED';
 export declare class DoomainError extends Error {
     readonly code: DoomainErrorCode;
     readonly details?: unknown;

package/dist/lib/link-domain.d.ts

@@ -1,4 +1,4 @@
-import type { DnsRecordInput } from './providers/types.js';
+import type { DnsConflict, DnsRecordInput } from './providers/types.js';
 export interface LinkDomainInput {
     provider?: string;
     account?: string;
@@ -11,14 +11,25 @@ export interface LinkDomainInput {
     wait?: boolean;
     timeoutSeconds?: number;
     progress?: LinkDomainProgressCallback;
+    confirmDnsOverride?: (warning: DnsOverrideWarning) => Promise<boolean>;
 }
 export type LinkDomainProjectSource = 'config' | 'env' | 'flag' | 'packageJson' | 'vercelProjectFile';
-export type LinkDomainProgressStage = 'dns:apply' | 'dns:plan' | 'dns:resolve-zone' | 'dns:wait' | 'vercel:add-domain' | 'vercel:get-domain' | 'vercel:get-target' | 'vercel:verify';
+export type LinkDomainProgressStage = 'dns:apply' | 'dns:inspect' | 'dns:override-confirm' | 'dns:plan' | 'dns:resolve-zone' | 'dns:wait' | 'vercel:add-domain' | 'vercel:get-domain' | 'vercel:get-target' | 'vercel:verify';
 export interface LinkDomainProgress {
     message: string;
     stage: LinkDomainProgressStage;
 }
 export type LinkDomainProgressCallback = (progress: LinkDomainProgress) => void;
+export interface DnsOverrideWarning {
+    account: string;
+    conflicts: DnsConflict[];
+    desired: DnsRecordInput[];
+    domain: string;
+    provider: string;
+    providerName: string;
+    recordName: string;
+    zoneDomain: string;
+}
 export interface LinkDomainPlan {
     provider: string;
     providerInferred: boolean;

package/dist/lib/link-domain.js

@@ -459,6 +459,41 @@ async function waitForVercelDomainReady(opts) {
 function reportProgress(input, stage, message) {
     input.progress?.({ message, stage });
 }
+function dnsTargetConflictError(warning) {
+    return new DoomainError('DNS_TARGET_CONFLICT', `${warning.domain} already has DNS records that point somewhere else. Re-run with --force to overwrite them.`, {
+        account: warning.account,
+        conflicts: warning.conflicts,
+        desired: warning.desired,
+        domain: warning.domain,
+        provider: warning.provider,
+        providerName: warning.providerName,
+        recovery: 'Confirm the DNS override in interactive mode, or re-run with --force to overwrite conflicting DNS records.',
+        recordName: warning.recordName,
+        suggestedCommands: [`doomain link ${warning.domain} --project <project> --force --json`],
+        zoneDomain: warning.zoneDomain,
+    });
+}
+async function resolveDnsForce(input, opts) {
+    reportProgress(input, 'dns:inspect', `Checking existing DNS records in ${opts.provider.name}`);
+    const dnsPlan = await opts.provider.planChanges(opts.zone, [opts.baseRecord], { force: input.force });
+    if (input.force || dnsPlan.conflicts.length === 0)
+        return Boolean(input.force);
+    const warning = {
+        account: opts.plan.account,
+        conflicts: dnsPlan.conflicts,
+        desired: [opts.baseRecord],
+        domain: opts.plan.domain,
+        provider: opts.plan.provider,
+        providerName: opts.provider.name,
+        recordName: opts.plan.recordName,
+        zoneDomain: opts.plan.zoneDomain,
+    };
+    reportProgress(input, 'dns:override-confirm', `Existing DNS records point ${opts.plan.domain} somewhere else`);
+    const confirmed = await input.confirmDnsOverride?.(warning);
+    if (!confirmed)
+        throw dnsTargetConflictError(warning);
+    return true;
+}
 export async function createLinkPlan(input) {
     const project = await resolveProject(input.project);
     const resolved = await resolveProviderTarget(input);
@@ -495,22 +530,23 @@ export async function linkDomain(input) {
     const provider = await createProvider(plan.provider, { account: plan.account });
     reportProgress(input, 'dns:resolve-zone', `Finding ${provider.name} DNS zone`);
     const zone = await resolveZone(provider, plan.zoneDomain);
-    reportProgress(input, 'vercel:add-domain', 'Adding domain to Vercel');
-    const addResult = await vercel.addDomainToProject(plan.project, plan.domain, { force: input.force });
     reportProgress(input, 'vercel:get-target', 'Reading Vercel DNS target');
     const cname = plan.isApex ? undefined : await vercel.getRecommendedCname(plan.domain);
+    const baseRecord = planBaseRecord({ isApex: plan.isApex, provider: plan.provider, recordName: plan.recordName, cname });
+    const forceDns = await resolveDnsForce(input, { baseRecord, plan, provider, zone });
+    reportProgress(input, 'vercel:add-domain', 'Adding domain to Vercel');
+    const addResult = await vercel.addDomainToProject(plan.project, plan.domain, { force: input.force });
     reportProgress(input, 'vercel:get-domain', 'Reading Vercel verification records');
     const projectDomain = await vercel.getProjectDomain(plan.project, plan.domain);
-    const baseRecord = planBaseRecord({ isApex: plan.isApex, provider: plan.provider, recordName: plan.recordName, cname });
     const verificationDnsRecords = uniqueRecords([
         ...planVerificationRecords(plan.provider, addResult.raw, plan.zoneDomain),
         ...planVerificationRecords(plan.provider, projectDomain, plan.zoneDomain),
     ]);
     const records = [baseRecord, ...verificationDnsRecords];
     reportProgress(input, 'dns:plan', `Reading ${provider.name} DNS records`);
-    const dnsPlan = await provider.planChanges(zone, records, { force: input.force });
+    const dnsPlan = await provider.planChanges(zone, records, { force: forceDns });
     reportProgress(input, 'dns:apply', `Updating DNS records in ${provider.name}`);
-    const dnsResult = await provider.applyChanges(zone, dnsPlan, { force: input.force });
+    const dnsResult = await provider.applyChanges(zone, dnsPlan, { force: forceDns });
     const shouldWait = input.wait ?? true;
     if (shouldWait) {
         reportProgress(input, 'dns:wait', verificationDnsRecords.length > 0 ? 'DNS records saved; asking Vercel to verify ownership' : 'DNS records saved; asking Vercel to verify');
@@ -518,7 +554,7 @@ export async function linkDomain(input) {
     const waitResult = shouldWait
         ? await waitForVercelDomainReady({
             domain: plan.domain,
-            force: input.force,
+            force: forceDns,
             input,
             project: plan.project,
             provider,

package/oclif.manifest.json

@@ -316,41 +316,6 @@
         "list.js"
       ]
     },
-    "projects:list": {
-      "aliases": [],
-      "args": {},
-      "description": "List Vercel projects.",
-      "flags": {
-        "json": {
-          "description": "Output a single JSON object and never prompt.",
-          "name": "json",
-          "allowNo": false,
-          "type": "boolean"
-        },
-        "search": {
-          "description": "Filter projects by search term.",
-          "name": "search",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "projects:list",
-      "pluginAlias": "doomain",
-      "pluginName": "doomain",
-      "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": false,
-      "isESM": true,
-      "relativePath": [
-        "dist",
-        "commands",
-        "projects",
-        "list.js"
-      ]
-    },
     "providers:add": {
       "aliases": [],
       "args": {
@@ -639,6 +604,41 @@
         "verify.js"
       ]
     },
+    "projects:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List Vercel projects.",
+      "flags": {
+        "json": {
+          "description": "Output a single JSON object and never prompt.",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "search": {
+          "description": "Filter projects by search term.",
+          "name": "search",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "projects:list",
+      "pluginAlias": "doomain",
+      "pluginName": "doomain",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "projects",
+        "list.js"
+      ]
+    },
     "auth:logout:vercel": {
       "aliases": [],
       "args": {},
@@ -673,5 +673,5 @@
       ]
     }
   },
-  "version": "0.1.12"
+  "version": "0.1.14"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "doomain",
   "description": "Link your vercel project and domain in seconds",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "author": "Crafter Station",
   "packageManager": "bun@1.3.13",
   "bin": {