doomain 0.1.18 → 0.1.19

package/README.md

@@ -1,6 +1,6 @@
 # Doomain
 
-Doomain links Vercel projects and first-time Clerk production instances to custom domains from your terminal.
+Doomain points DNS records and links Vercel projects or first-time Clerk production instances to custom domains from your terminal.
 
 It handles the boring parts of custom-domain setup: selecting the Vercel project, finding the right DNS zone, adding the domain to Vercel, writing the Vercel DNS records, waiting for public DNS propagation, and asking Vercel to verify the domain.
 
@@ -12,6 +12,7 @@ Use the interactive wizard when working by hand. Use explicit commands with `--j
 - Script-friendly commands with one JSON object on stdout.
 - Vercel project detection from `.vercel/project.json`.
 - DNS provider inference by longest matching configured zone.
+- Generic DNS pointing for VPS, load balancer, and canonical-hostname targets.
 - Dry-run plans before writing changes.
 - Safety checks before replacing DNS records that point elsewhere.
 - DNS propagation and Vercel verification wait loop.
@@ -87,6 +88,12 @@ Apply it:
 doomain link app.example.com --project my-vercel-project --json
 ```
 
+Point a domain at non-Vercel infrastructure such as a VPS:
+
+```bash
+doomain dns point app.example.com --target 203.0.113.10 --json
+```
+
 Set up a Clerk application's first production instance and primary domain:
 
 ```bash
@@ -154,7 +161,7 @@ doomain providers connect cloudflare \
   --credential accountId=your_cloudflare_account_id
 ```
 
-Cloudflare records created for Vercel or Clerk `A`, `AAAA`, and `CNAME` targets are set to `proxied: false` so the service can validate the domain.
+Cloudflare `A`, `AAAA`, and `CNAME` records created by Doomain are set to `proxied: false` so targets remain directly verifiable.
 
 ### Hostinger
 
@@ -221,6 +228,39 @@ Use `-p` as shorthand for `--project`:
 doomain link app.example.com -p my-app
 ```
 
+## Pointing DNS At A VPS Or Hostname
+
+Use `dns point` when Doomain should only reconcile DNS, without adding the domain to Vercel or Clerk. It infers the configured provider account and longest matching zone in the same way as `link`.
+
+Point an apex or subdomain at an IPv4 or IPv6 address:
+
+```bash
+doomain dns point example.com --target 203.0.113.10
+doomain dns point app.example.com --target 2001:db8::10
+```
+
+Point a subdomain at a canonical hostname:
+
+```bash
+doomain dns point app.example.com --target origin.example.net
+```
+
+The record type is inferred as `A`, `AAAA`, or `CNAME`. Use `--type` to require a specific type, `--ttl` to change the default 300-second TTL, and `--provider`/`--account` to override provider inference.
+
+Canonical hostname targets use CNAME records. Doomain rejects an apex CNAME when the selected provider does not advertise apex-CNAME support; use an IPv4 or IPv6 target for that apex instead.
+
+Preview without writing:
+
+```bash
+doomain dns point app.example.com --target 203.0.113.10 --dry-run --json
+```
+
+The preview resolves the provider, account, zone, record name, type, and value without reading or writing current DNS records. Conflicts are checked when a real write is attempted.
+
+By default, a successful write waits up to 300 seconds for public DNS. Use `--no-wait` to return immediately or `--timeout <seconds>` to change the limit. Skipping the wait, a dry run, or reaching the timeout returns `propagated: false`; a propagation timeout does not turn a successful provider write into an error.
+
+Existing exact records are skipped. Conflicting records fail with `DNS_TARGET_CONFLICT` in JSON/non-interactive mode. Use `--force` only after approving replacement of the existing target.
+
 ## Clerk Production Domains
 
 `doomain clerk domains add` mirrors Clerk CLI's initial production deployment API. It creates a production instance by cloning the application's development instance, sets the requested primary domain, writes every CNAME returned by Clerk, and optionally waits for Clerk's DNS, SSL, and email DNS status.
@@ -335,6 +375,7 @@ Useful agent-safe commands:
 
 ```bash
 doomain link app.example.com --project my-app --json
+doomain dns point app.example.com --target 203.0.113.10 --json
 doomain providers list --json
 doomain providers status --no-verify --json
 doomain domains find hacktheandes.com --json
@@ -413,6 +454,28 @@ doomain auth vercel --token vercel_token
 doomain auth vercel --token vercel_token --team-id team_123 --json
 ```
 
+### `doomain dns point <domain>`
+
+Points an apex or subdomain at an IPv4 or IPv6 address, or a subdomain at a canonical hostname, using the matching configured DNS provider.
+
+```bash
+doomain dns point example.com --target 203.0.113.10
+doomain dns point app.example.com --target origin.example.net --no-wait --json
+doomain dns point app.example.com --target 203.0.113.10 --provider spaceship --account work --force --json
+```
+
+Common flags:
+
+- `--target <value>`: required IPv4, IPv6, or hostname target.
+- `--type <A|AAAA|CNAME>`: require a record type instead of inferring it.
+- `--provider <id>`, `--account <alias>`: select a configured provider account instead of inferring one.
+- `--ttl <seconds>`: DNS TTL. Default is `300`.
+- `--dry-run`: preview without writing.
+- `--force`: overwrite conflicting DNS records.
+- `--wait`, `--no-wait`: wait for public DNS propagation. Default is `--wait`.
+- `--timeout <seconds>`: propagation wait timeout. Default is `300`.
+- `--json`: output one JSON object.
+
 ### `doomain auth logout vercel`
 
 Removes saved Vercel credentials from the local config file.

package/dist/commands/dns/point.d.ts

@@ -0,0 +1,21 @@
+import { Command } from '@oclif/core';
+export default class DnsPoint extends Command {
+    static description: string;
+    static examples: string[];
+    static args: {
+        domain: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        account: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        provider: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        target: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        timeout: import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+        ttl: import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+        type: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        wait: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/dns/point.js

@@ -0,0 +1,123 @@
+import * as p from '@clack/prompts';
+import { Args, Command, Flags } from '@oclif/core';
+import { jsonFlag, providerFlag, accountFlag } from '../../lib/flags.js';
+import { outputError, createOutput } from '../../lib/output.js';
+import { pointDomain } from '../../lib/point-domain.js';
+function preview(result) {
+    return [
+        `Domain: ${result.domain}`,
+        `DNS provider: ${result.provider}/${result.account} (${result.zoneDomain})`,
+        `Record: ${result.record.type} ${result.record.name} -> ${result.record.value}`,
+    ].join('\n');
+}
+function conflictNote(warning) {
+    return [
+        `${warning.domain} already points somewhere else.`,
+        '',
+        'Existing:',
+        ...warning.conflicts.map((conflict) => `- ${conflict.existing.type} ${conflict.existing.name} -> ${conflict.existing.value}`),
+        '',
+        'Desired:',
+        ...warning.desired.map((record) => `- ${record.type} ${record.name} -> ${record.value}`),
+    ].join('\n');
+}
+function successMessages(result, waited) {
+    if (result.propagated) {
+        return {
+            outro: result.updated
+                ? `${result.domain} now points to ${result.record.value}.`
+                : `${result.domain} already points to ${result.record.value}.`,
+            spinner: 'DNS record is live',
+        };
+    }
+    if (!waited) {
+        return {
+            outro: result.updated
+                ? `${result.domain} was updated; propagation was not checked.`
+                : `${result.domain} was already configured; propagation was not checked.`,
+            spinner: result.updated ? 'DNS record saved; propagation not checked' : 'DNS record already configured',
+        };
+    }
+    return {
+        outro: result.updated
+            ? `${result.domain} was updated; propagation is still pending.`
+            : `${result.domain} was already configured; public DNS does not match yet.`,
+        spinner: result.updated ? 'DNS record saved' : 'DNS record already configured',
+    };
+}
+export default class DnsPoint extends Command {
+    static description = 'Point a DNS name at an IP address or canonical hostname.';
+    static examples = [
+        '<%= config.bin %> <%= command.id %> app.example.com --target 203.0.113.10 --json',
+        '<%= config.bin %> <%= command.id %> app.example.com --target origin.example.net --dry-run --json',
+        '<%= config.bin %> <%= command.id %> example.com --target 203.0.113.10 --provider spaceship --account work --force --json',
+    ];
+    static args = {
+        domain: Args.string({ description: 'Fully qualified domain to point.', required: true }),
+    };
+    static flags = {
+        account: accountFlag,
+        'dry-run': Flags.boolean({ description: 'Preview the DNS record without writing it.' }),
+        force: Flags.boolean({ description: 'Overwrite conflicting DNS records.' }),
+        json: jsonFlag,
+        provider: providerFlag,
+        target: Flags.string({ description: 'IPv4, IPv6, or hostname target.', required: true }),
+        timeout: Flags.integer({ default: 300, description: 'DNS propagation wait timeout in seconds.' }),
+        ttl: Flags.integer({ default: 300, description: 'DNS record TTL in seconds.' }),
+        type: Flags.string({
+            description: 'Record type. Inferred from the target when omitted.',
+            options: ['A', 'AAAA', 'CNAME'],
+        }),
+        wait: Flags.boolean({ allowNo: true, default: true, description: 'Wait for public DNS propagation.' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(DnsPoint);
+        const out = createOutput({ json: flags.json });
+        let spinner;
+        try {
+            if (!flags['dry-run']) {
+                out.intro('Doomain');
+                spinner = out.spinner();
+                spinner.start(`Pointing ${args.domain}`);
+            }
+            const result = await pointDomain({
+                account: flags.account,
+                confirmDnsOverride: out.json
+                    ? undefined
+                    : async (warning) => {
+                        spinner?.stop('Existing DNS target found');
+                        p.note(conflictNote(warning), 'DNS already points elsewhere');
+                        const confirmed = await p.confirm({ message: `Override DNS for ${warning.domain}?`, initialValue: false });
+                        if (confirmed === true)
+                            spinner?.start(`Pointing ${warning.domain}`);
+                        return confirmed === true;
+                    },
+                domain: args.domain,
+                dryRun: flags['dry-run'],
+                force: flags.force,
+                progress: out.json ? undefined : (message) => spinner?.message(message),
+                provider: flags.provider,
+                recordType: flags.type,
+                target: flags.target,
+                timeoutSeconds: flags.timeout,
+                ttl: flags.ttl,
+                wait: flags.wait,
+            });
+            if (flags['dry-run']) {
+                out.result(result);
+                if (!out.json)
+                    p.note(preview(result), 'Dry run');
+                return;
+            }
+            const messages = successMessages(result, flags.wait);
+            spinner?.stop(messages.spinner);
+            out.result(result);
+            out.outro(messages.outro);
+        }
+        catch (error) {
+            spinner?.error('DNS update failed');
+            outputError(out.json, error, 'DNS_POINT_FAILED');
+            this.exit(1);
+        }
+    }
+}

package/dist/lib/command-schema.js

@@ -1,5 +1,38 @@
 import { listProviderStatuses } from './providers/status.js';
 export const commandSchemas = [
+    {
+        name: 'dns point',
+        description: 'Point a DNS name at an IP address or canonical hostname.',
+        examples: [
+            'doomain dns point app.example.com --target 203.0.113.10 --json',
+            'doomain dns point app.example.com --target origin.example.net --dry-run --json',
+            'doomain dns point example.com --target 203.0.113.10 --provider spaceship --account work --force --json',
+        ],
+        agentHint: 'Use this for non-Vercel infrastructure such as a VPS or load balancer. Run without --dry-run unless the user explicitly requests a preview; conflicts fail safely unless --force is explicit.',
+        agentInstructions: [
+            'When a user asks to point a domain at a VPS or hostname, run `doomain dns point <domain> --target <ip-or-hostname> --json`.',
+            'Pass --force only after the user has approved replacing an existing DNS target.',
+        ],
+        agentQuickstart: {
+            doNotPreflight: true,
+            preferredFirstCommand: 'doomain dns point <domain> --target <ip-or-hostname> --json',
+        },
+        mutates: true,
+        safeForAgents: true,
+        flags: [
+            { name: 'json', type: 'boolean', description: 'Output a single JSON object and never prompt.' },
+            { name: 'domain', type: 'string', description: 'Fully qualified apex or subdomain to point.', required: true },
+            { name: 'target', type: 'string', description: 'IPv4, IPv6, or hostname target.', required: true },
+            { name: 'type', type: 'string', description: 'A, AAAA, or CNAME. Inferred from the target when omitted.' },
+            { name: 'provider', type: 'string', description: 'DNS provider id. Inferred from the target domain when omitted.' },
+            { name: 'account', type: 'string', description: 'DNS provider profile/account alias.' },
+            { name: 'ttl', type: 'integer', description: 'DNS record TTL in seconds.', default: 300 },
+            { name: 'dry-run', type: 'boolean', description: 'Preview without writing.' },
+            { name: 'force', type: 'boolean', description: 'Overwrite conflicting DNS records.' },
+            { name: 'wait', type: 'boolean', description: 'Wait for public DNS propagation. Use --no-wait to skip.', default: true },
+            { name: 'timeout', type: 'integer', description: 'DNS propagation wait timeout in seconds.', default: 300 },
+        ],
+    },
     {
         name: 'link',
         description: 'Link a Vercel project to a domain and create DNS records.',
@@ -266,7 +299,7 @@ async function configuredProviders() {
     }));
 }
 function withProviderConnections(schema, providers) {
-    if (schema.name !== 'link' && schema.name !== 'clerk domains add')
+    if (schema.name !== 'link' && schema.name !== 'clerk domains add' && schema.name !== 'dns point')
         return schema;
     return { ...schema, configuredProviders: providers };
 }

package/dist/lib/errors.d.ts

@@ -1,4 +1,4 @@
-export type DoomainErrorCode = 'CONFIG_NOT_FOUND' | 'CLERK_AUTH_FAILED' | 'CLERK_PRODUCTION_EXISTS' | 'DNS_TARGET_CONFLICT' | 'DOMAIN_LINK_FAILED' | 'DOMAIN_PROVIDER_DISCOVERY_FAILED' | 'DOMAIN_ALREADY_ASSIGNED' | 'DOMAIN_VERIFY_FAILED' | 'INVALID_INPUT' | 'MISSING_ARGUMENT' | 'MISSING_CREDENTIALS' | 'PROVIDER_API_ERROR' | 'PROVIDER_AUTH_FAILED' | 'PROVIDER_PERMISSION_DENIED' | 'PROVIDER_NOT_FOUND' | 'PROVIDER_RATE_LIMITED' | 'PROVIDER_RECORD_CONFLICT' | 'PROVIDER_UNSUPPORTED_RECORD' | 'PROVIDER_ZONE_AMBIGUOUS' | 'PROVIDER_ZONE_NOT_FOUND' | 'PROJECT_NOT_FOUND' | 'VERCEL_AUTH_FAILED' | 'VERCEL_PROJECT_NOT_LINKED';
+export type DoomainErrorCode = 'CONFIG_NOT_FOUND' | 'CLERK_AUTH_FAILED' | 'CLERK_PRODUCTION_EXISTS' | 'DNS_POINT_FAILED' | 'DNS_TARGET_CONFLICT' | 'DOMAIN_LINK_FAILED' | 'DOMAIN_PROVIDER_DISCOVERY_FAILED' | 'DOMAIN_ALREADY_ASSIGNED' | 'DOMAIN_VERIFY_FAILED' | 'INVALID_INPUT' | 'MISSING_ARGUMENT' | 'MISSING_CREDENTIALS' | 'PROVIDER_API_ERROR' | 'PROVIDER_AUTH_FAILED' | 'PROVIDER_PERMISSION_DENIED' | 'PROVIDER_NOT_FOUND' | 'PROVIDER_RATE_LIMITED' | 'PROVIDER_RECORD_CONFLICT' | 'PROVIDER_UNSUPPORTED_RECORD' | 'PROVIDER_ZONE_AMBIGUOUS' | 'PROVIDER_ZONE_NOT_FOUND' | 'PROJECT_NOT_FOUND' | 'VERCEL_AUTH_FAILED' | 'VERCEL_PROJECT_NOT_LINKED';
 export declare class DoomainError extends Error {
     readonly code: DoomainErrorCode;
     readonly details?: unknown;

package/dist/lib/point-domain.d.ts

@@ -0,0 +1,50 @@
+import { type ResolvedDnsTarget } from './domain-provider.js';
+import { type DnsOverrideWarning } from './link-domain.js';
+import type { DnsProvider, DnsRecordInput } from './providers/types.js';
+export type PointRecordType = 'A' | 'AAAA' | 'CNAME';
+export interface PointDomainInput {
+    account?: string;
+    domain: string;
+    dryRun?: boolean;
+    force?: boolean;
+    provider?: string;
+    recordType?: PointRecordType;
+    target: string;
+    timeoutSeconds?: number;
+    ttl?: number;
+    wait?: boolean;
+    confirmDnsOverride?: (warning: DnsOverrideWarning) => Promise<boolean>;
+    progress?: (message: string) => void;
+}
+export interface PointDomainResult {
+    account: string;
+    accountInferred: boolean;
+    domain: string;
+    dryRun: boolean;
+    isDefaultAccount: boolean;
+    provider: string;
+    providerInferred: boolean;
+    propagated: boolean;
+    record: DnsRecordInput;
+    skipped: DnsRecordInput[];
+    updated: boolean;
+    zoneDomain: string;
+}
+interface PointDomainDependencies {
+    createProvider: (provider: string, opts: {
+        account?: string;
+    }) => Promise<DnsProvider>;
+    resolve4?: (hostname: string) => Promise<string[]>;
+    resolve6?: (hostname: string) => Promise<string[]>;
+    resolveCname?: (hostname: string) => Promise<string[]>;
+    resolveTarget: (input: Pick<PointDomainInput, 'account' | 'domain' | 'provider'>) => Promise<ResolvedDnsTarget>;
+}
+export declare function createPointRecord(input: {
+    provider: string;
+    recordName: string;
+    recordType?: PointRecordType;
+    target: string;
+    ttl?: number;
+}): DnsRecordInput;
+export declare function pointDomain(input: PointDomainInput, dependencies?: PointDomainDependencies): Promise<PointDomainResult>;
+export {};

package/dist/lib/point-domain.js

@@ -0,0 +1,212 @@
+import { resolve4, resolve6, resolveCname } from 'node:dns/promises';
+import { isIP } from 'node:net';
+import { resolveProviderTarget } from './domain-provider.js';
+import { DoomainError } from './errors.js';
+import { withProviderRecordOptions } from './link-domain.js';
+import { createProvider } from './providers/registry.js';
+import { normalizeDomain } from './validate.js';
+const defaultDependencies = {
+    createProvider,
+    resolveTarget: resolveProviderTarget,
+};
+function cleanTarget(value) {
+    return value.trim().replace(/\.$/, '');
+}
+function inferredRecordType(target) {
+    const version = isIP(target);
+    if (version === 4)
+        return 'A';
+    if (version === 6)
+        return 'AAAA';
+    return 'CNAME';
+}
+function validateTarget(recordType, target) {
+    const version = isIP(target);
+    if (recordType === 'A' && version !== 4)
+        throw new DoomainError('INVALID_INPUT', 'A records require an IPv4 target.');
+    if (recordType === 'AAAA' && version !== 6)
+        throw new DoomainError('INVALID_INPUT', 'AAAA records require an IPv6 target.');
+    if (recordType === 'CNAME' && version !== 0)
+        throw new DoomainError('INVALID_INPUT', 'CNAME records require a hostname target.');
+}
+export function createPointRecord(input) {
+    const target = cleanTarget(input.target);
+    if (!target)
+        throw new DoomainError('MISSING_ARGUMENT', 'A DNS target is required.');
+    const recordType = input.recordType ?? inferredRecordType(target);
+    validateTarget(recordType, target);
+    return withProviderRecordOptions(input.provider, {
+        name: input.recordName,
+        ttl: input.ttl ?? 300,
+        type: recordType,
+        value: recordType === 'CNAME' ? normalizeDomain(target) : target,
+    });
+}
+function recordFqdn(record, zoneDomain) {
+    return record.name === '@' ? zoneDomain : `${record.name}.${zoneDomain}`;
+}
+function cleanDnsValue(value) {
+    return value.toLowerCase().replace(/\.$/, '');
+}
+function normalizeIpv6(value) {
+    return new URL(`http://[${value}]`).hostname.slice(1, -1);
+}
+async function isPropagated(record, zoneDomain, dependencies) {
+    const fqdn = recordFqdn(record, zoneDomain);
+    try {
+        if (record.type === 'A')
+            return (await (dependencies.resolve4 ?? resolve4)(fqdn)).includes(record.value);
+        if (record.type === 'AAAA') {
+            const expected = normalizeIpv6(record.value);
+            return (await (dependencies.resolve6 ?? resolve6)(fqdn)).some((value) => normalizeIpv6(value) === expected);
+        }
+        if (record.type === 'CNAME') {
+            return (await (dependencies.resolveCname ?? resolveCname)(fqdn))
+                .map(cleanDnsValue)
+                .includes(cleanDnsValue(record.value));
+        }
+    }
+    catch {
+        return false;
+    }
+    return false;
+}
+async function waitForPropagation(record, zoneDomain, timeoutSeconds, dependencies) {
+    const deadline = Date.now() + timeoutSeconds * 1000;
+    while (true) {
+        if (await isPropagated(record, zoneDomain, dependencies))
+            return true;
+        const remaining = deadline - Date.now();
+        if (remaining <= 0)
+            return false;
+        await new Promise((resolve) => setTimeout(resolve, Math.min(5000, remaining)));
+    }
+}
+function conflictWarning(resolved, provider, record, conflicts) {
+    return {
+        account: resolved.account,
+        conflicts,
+        desired: [record],
+        domain: resolved.target.fullDomain,
+        provider: resolved.provider,
+        providerName: provider.name,
+        recordName: resolved.target.recordName,
+        zoneDomain: resolved.target.zoneDomain,
+    };
+}
+function dnsTargetConflictError(warning) {
+    const account = warning.account === 'default' ? '' : ` --account ${warning.account}`;
+    const target = warning.desired[0]?.value ?? '<ip-or-hostname>';
+    return new DoomainError('DNS_TARGET_CONFLICT', `${warning.domain} already has DNS records that point somewhere else. Re-run with --force to overwrite them.`, {
+        ...warning,
+        recovery: 'Re-run with --force to overwrite conflicting DNS records, or confirm the DNS override in interactive mode.',
+        suggestedCommands: [
+            `doomain dns point ${warning.domain} --target ${target} --provider ${warning.provider}${account} --force --json`,
+        ],
+    });
+}
+function providerResolutionError(error, input) {
+    if (error.code !== 'CONFIG_NOT_FOUND' && error.code !== 'PROVIDER_ZONE_NOT_FOUND')
+        return error;
+    const details = error.details && typeof error.details === 'object' ? error.details : {};
+    const provider = input.provider ? ` --provider ${input.provider}` : '';
+    const account = input.account ? ` --account ${input.account}` : '';
+    const retry = `doomain dns point ${input.domain} --target ${input.target}${provider}${account} --json`;
+    return new DoomainError(error.code, error.message, {
+        ...details,
+        recovery: `Connect or repair the DNS provider account that owns this domain, then retry \`${retry}\`.`,
+        suggestedCommands: ['doomain providers connect', retry],
+    });
+}
+function validateTtl(provider, ttl) {
+    if (ttl === undefined)
+        return;
+    const { maxTtl, minTtl } = provider.capabilities;
+    if (!Number.isInteger(ttl) || ttl <= 0) {
+        throw new DoomainError('INVALID_INPUT', 'DNS record TTL must be a positive integer.');
+    }
+    if (minTtl !== undefined && maxTtl !== undefined && (ttl < minTtl || ttl > maxTtl)) {
+        throw new DoomainError('INVALID_INPUT', `${provider.name} requires a TTL between ${minTtl} and ${maxTtl} seconds.`);
+    }
+    if (minTtl !== undefined && ttl < minTtl) {
+        throw new DoomainError('INVALID_INPUT', `${provider.name} requires a TTL of at least ${minTtl} seconds.`);
+    }
+    if (maxTtl !== undefined && ttl > maxTtl) {
+        throw new DoomainError('INVALID_INPUT', `${provider.name} requires a TTL no greater than ${maxTtl} seconds.`);
+    }
+}
+export async function pointDomain(input, dependencies = defaultDependencies) {
+    let resolved;
+    try {
+        resolved = await dependencies.resolveTarget(input);
+    }
+    catch (error) {
+        if (error instanceof DoomainError)
+            throw providerResolutionError(error, input);
+        throw error;
+    }
+    const record = createPointRecord({
+        provider: resolved.provider,
+        recordName: resolved.target.recordName,
+        recordType: input.recordType,
+        target: input.target,
+        ttl: input.ttl,
+    });
+    const provider = await dependencies.createProvider(resolved.provider, { account: resolved.account });
+    validateTtl(provider, record.ttl);
+    if (!provider.capabilities.recordTypes.includes(record.type)) {
+        throw new DoomainError('PROVIDER_UNSUPPORTED_RECORD', `${provider.name} does not support ${record.type} records.`);
+    }
+    if (resolved.target.isApex && record.type === 'CNAME' && !provider.capabilities.supportsApexCname) {
+        throw new DoomainError('PROVIDER_UNSUPPORTED_RECORD', `${provider.name} does not support CNAME records at the zone apex. Use an A or AAAA target instead.`);
+    }
+    if (input.dryRun) {
+        return {
+            account: resolved.account,
+            accountInferred: resolved.accountInferred,
+            domain: resolved.target.fullDomain,
+            dryRun: true,
+            isDefaultAccount: resolved.isDefaultAccount,
+            provider: resolved.provider,
+            providerInferred: resolved.providerInferred,
+            propagated: false,
+            record,
+            skipped: [],
+            updated: false,
+            zoneDomain: resolved.target.zoneDomain,
+        };
+    }
+    const zone = await provider.getZone(resolved.target.zoneDomain);
+    if (!zone)
+        throw new DoomainError('PROVIDER_ZONE_NOT_FOUND', `${provider.name} does not have a DNS zone for ${resolved.target.zoneDomain}.`);
+    input.progress?.(`Planning DNS change in ${provider.name}`);
+    let force = Boolean(input.force);
+    let plan = await provider.planChanges(zone, [record], { force });
+    if (!force && plan.conflicts.length > 0) {
+        const warning = conflictWarning(resolved, provider, record, plan.conflicts);
+        force = (await input.confirmDnsOverride?.(warning)) === true;
+        if (!force)
+            throw dnsTargetConflictError(warning);
+        plan = await provider.planChanges(zone, [record], { force: true });
+    }
+    input.progress?.(`Pointing ${resolved.target.fullDomain} to ${record.value}`);
+    const result = await provider.applyChanges(zone, plan, { force });
+    const shouldWait = input.wait ?? true;
+    const propagated = shouldWait
+        ? await waitForPropagation(record, resolved.target.zoneDomain, input.timeoutSeconds ?? 300, dependencies)
+        : false;
+    return {
+        account: resolved.account,
+        accountInferred: resolved.accountInferred,
+        domain: resolved.target.fullDomain,
+        dryRun: false,
+        isDefaultAccount: resolved.isDefaultAccount,
+        provider: resolved.provider,
+        providerInferred: resolved.providerInferred,
+        propagated,
+        record,
+        skipped: result.skipped,
+        updated: result.applied.length > 0,
+        zoneDomain: resolved.target.zoneDomain,
+    };
+}

package/dist/lib/providers/core/planner.js

@@ -5,6 +5,10 @@ function cleanDnsValue(value) {
 function sameRecord(a, b) {
     if (b.proxied !== undefined && a.proxied !== b.proxied)
         return false;
+    if (b.priority !== undefined && a.priority !== b.priority)
+        return false;
+    if (b.ttl !== undefined && a.ttl !== b.ttl)
+        return false;
     return a.type === b.type && a.name === b.name && cleanDnsValue(a.value) === cleanDnsValue(b.value);
 }
 function sameDnsValue(a, b) {
@@ -13,6 +17,11 @@ function sameDnsValue(a, b) {
 function sameSlot(a, b) {
     return a.type === b.type && a.name === b.name;
 }
+function recordOptionsDiffer(a, b) {
+    return ((b.proxied !== undefined && a.proxied !== b.proxied) ||
+        (b.priority !== undefined && a.priority !== b.priority) ||
+        (b.ttl !== undefined && a.ttl !== b.ttl));
+}
 function cnameSlotConflict(a, b) {
     return a.name === b.name && (a.type === 'CNAME' || b.type === 'CNAME');
 }
@@ -21,38 +30,27 @@ export function planDnsChanges(input) {
     const conflicts = [];
     for (const record of input.desired) {
         const exact = input.existing.find((existing) => sameRecord(existing, record));
-        if (exact) {
-            changes.push({ action: 'skip', existing: exact, reason: 'already_exists', record });
-            continue;
-        }
         const sameValue = input.existing.find((existing) => sameDnsValue(existing, record));
-        if (sameValue && record.proxied !== undefined && sameValue.proxied !== record.proxied) {
-            changes.push({ action: 'update', existing: sameValue, record });
+        if (record.type === 'TXT') {
+            changes.push(exact ? { action: 'skip', existing: exact, reason: 'already_exists', record } : { action: 'create', record });
             continue;
         }
-        if (record.type === 'TXT') {
-            changes.push({ action: 'create', record });
+        const sameTyped = input.existing.filter((existing) => sameSlot(existing, record) && !sameDnsValue(existing, record));
+        const cnameConflicts = input.existing.filter((existing) => cnameSlotConflict(existing, record) && !sameSlot(existing, record));
+        if (!input.force && (sameTyped.length > 0 || cnameConflicts.length > 0)) {
+            conflicts.push(...sameTyped.map((existing) => ({ existing, reason: 'same_type_record_exists', record })), ...cnameConflicts.map((existing) => ({ existing, reason: 'cname_slot_conflict', record })));
             continue;
         }
-        const sameTyped = input.existing.find((existing) => sameSlot(existing, record));
-        if (sameTyped) {
-            if (input.force)
-                changes.push({ action: 'update', existing: sameTyped, record });
-            else
-                conflicts.push({ existing: sameTyped, reason: 'same_type_record_exists', record });
+        if (exact) {
+            changes.push(...sameTyped.map((existing) => ({ action: 'delete', existing, reason: 'same_type_record_exists' })), ...cnameConflicts.map((existing) => ({ action: 'delete', existing, reason: 'cname_slot_conflict' })), { action: 'skip', existing: exact, reason: 'already_exists', record });
             continue;
         }
-        const cnameConflict = input.existing.find((existing) => cnameSlotConflict(existing, record));
-        if (cnameConflict) {
-            if (input.force) {
-                changes.push({ action: 'delete', existing: cnameConflict, reason: 'cname_slot_conflict' }, { action: 'create', record });
-            }
-            else {
-                conflicts.push({ existing: cnameConflict, reason: 'cname_slot_conflict', record });
-            }
+        if (sameValue && recordOptionsDiffer(sameValue, record)) {
+            changes.push(...sameTyped.map((existing) => ({ action: 'delete', existing, reason: 'same_type_record_exists' })), ...cnameConflicts.map((existing) => ({ action: 'delete', existing, reason: 'cname_slot_conflict' })), { action: 'update', existing: sameValue, record });
             continue;
         }
-        changes.push({ action: 'create', record });
+        const [replace, ...remainingSameTyped] = sameTyped;
+        changes.push(...(replace ? [{ action: 'update', existing: replace, record }] : []), ...remainingSameTyped.map((existing) => ({ action: 'delete', existing, reason: 'same_type_record_exists' })), ...cnameConflicts.map((existing) => ({ action: 'delete', existing, reason: 'cname_slot_conflict' })), ...(replace ? [] : [{ action: 'create', record }]));
     }
     return { changes, conflicts, desired: input.desired, existing: input.existing, zone: input.zone };
 }

package/dist/lib/providers/hostinger/index.js

@@ -67,6 +67,28 @@ function toHostingerRecord(record) {
 function deleteFilter(record) {
     return { name: record.name, type: record.type };
 }
+function sameRecordSet(record, desired) {
+    return record.name === desired.name && record.type === desired.type;
+}
+function collapseRecordSetWrites(plan) {
+    let changes = plan.changes;
+    for (const desired of plan.desired) {
+        const existing = plan.existing.filter((record) => sameRecordSet(record, desired));
+        if (existing.length === 0)
+            continue;
+        const rewritesRecordSet = changes.some((change) => (change.action === 'delete' && sameRecordSet(change.existing, desired)) ||
+            (change.action === 'update' && sameRecordSet(change.record, desired)));
+        if (!rewritesRecordSet)
+            continue;
+        changes = changes.filter((change) => {
+            if (change.action === 'delete')
+                return !sameRecordSet(change.existing, desired);
+            return !sameRecordSet(change.record, desired);
+        });
+        changes.push({ action: 'update', existing: existing[0], record: desired });
+    }
+    return { ...plan, changes };
+}
 export class HostingerProvider {
     capabilities = capabilities;
     id = 'hostinger';
@@ -107,7 +129,8 @@ export class HostingerProvider {
         return records.flatMap((record) => toDnsRecords(record, zone));
     }
     async planChanges(zone, desired, opts = {}) {
-        return planDnsChanges({ desired, existing: await this.listRecords(zone), force: opts.force, providerId: this.id, zone });
+        const plan = planDnsChanges({ desired, existing: await this.listRecords(zone), force: opts.force, providerId: this.id, zone });
+        return collapseRecordSetWrites(plan);
     }
     async applyChanges(zone, plan) {
         assertNoConflicts(this.id, plan);

package/oclif.manifest.json

@@ -312,6 +312,113 @@
         "vercel.js"
       ]
     },
+    "dns:point": {
+      "aliases": [],
+      "args": {
+        "domain": {
+          "description": "Fully qualified domain to point.",
+          "name": "domain",
+          "required": true
+        }
+      },
+      "description": "Point a DNS name at an IP address or canonical hostname.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %> app.example.com --target 203.0.113.10 --json",
+        "<%= config.bin %> <%= command.id %> app.example.com --target origin.example.net --dry-run --json",
+        "<%= config.bin %> <%= command.id %> example.com --target 203.0.113.10 --provider spaceship --account work --force --json"
+      ],
+      "flags": {
+        "account": {
+          "description": "DNS provider profile/account alias. Defaults to the provider default account.",
+          "name": "account",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "dry-run": {
+          "description": "Preview the DNS record without writing it.",
+          "name": "dry-run",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "force": {
+          "description": "Overwrite conflicting DNS records.",
+          "name": "force",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "json": {
+          "description": "Output a single JSON object and never prompt.",
+          "name": "json",
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "provider": {
+          "description": "DNS provider id. Inferred from the target domain when omitted.",
+          "name": "provider",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "target": {
+          "description": "IPv4, IPv6, or hostname target.",
+          "name": "target",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "timeout": {
+          "description": "DNS propagation wait timeout in seconds.",
+          "name": "timeout",
+          "default": 300,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "ttl": {
+          "description": "DNS record TTL in seconds.",
+          "name": "ttl",
+          "default": 300,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "type": {
+          "description": "Record type. Inferred from the target when omitted.",
+          "name": "type",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "A",
+            "AAAA",
+            "CNAME"
+          ],
+          "type": "option"
+        },
+        "wait": {
+          "description": "Wait for public DNS propagation.",
+          "name": "wait",
+          "allowNo": true,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "dns:point",
+      "pluginAlias": "doomain",
+      "pluginName": "doomain",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "dns",
+        "point.js"
+      ]
+    },
     "domains:find": {
       "aliases": [],
       "args": {
@@ -894,5 +1001,5 @@
       ]
     }
   },
-  "version": "0.1.18"
+  "version": "0.1.19"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "doomain",
-  "description": "Configure Vercel and Clerk production domains in seconds",
-  "version": "0.1.18",
+  "description": "Configure production domains and DNS records in seconds",
+  "version": "0.1.19",
   "author": "Crafter Station",
   "packageManager": "bun@1.3.13",
   "bin": {
@@ -64,6 +64,9 @@
       "domains": {
         "description": "Inspect DNS domains"
       },
+      "dns": {
+        "description": "Manage DNS records"
+      },
       "projects": {
         "description": "Inspect Vercel projects"
       },