doomain 0.1.21 → 0.1.22

package/dist/lib/dns-propagation.d.ts

@@ -0,0 +1,45 @@
+import type { DnsRecordInput, DnsRecordType } from './providers/types.js';
+export interface DnsAnswer {
+    ttl?: number | null;
+    ttlUnavailableReason?: string;
+    value: string;
+}
+export interface DnsResolverObservation {
+    answers: DnsAnswer[];
+    elapsedMs: number;
+    error?: string;
+    errorCode?: string;
+    expected?: string;
+    kind: 'public' | 'system';
+    matches?: boolean;
+    resolver: string;
+    servers: string[];
+    type: DnsRecordType;
+}
+export type DnsPropagationStatus = 'local_or_vpn_cache_stale' | 'not_checked' | 'propagated' | 'public_propagation_pending' | 'system_resolver_unavailable';
+export interface DnsPropagationResult {
+    elapsedMs: number;
+    expected: string;
+    observations: DnsResolverObservation[];
+    status: DnsPropagationStatus;
+    timeoutReason?: string;
+}
+export interface DnsResolverSpec {
+    kind: 'public' | 'system';
+    name: string;
+    servers?: string[];
+}
+export declare const defaultDnsResolvers: DnsResolverSpec[];
+export declare function isNegativeDnsObservation(observation: DnsResolverObservation): boolean;
+type ResolveTarget = Pick<DnsRecordInput, 'type' | 'value'>;
+export declare function observeDnsRecord(fqdn: string, target: ResolveTarget, specs?: DnsResolverSpec[], elapsedMs?: number): Promise<DnsResolverObservation[]>;
+export declare function classifyDnsPropagation(observations: DnsResolverObservation[]): DnsPropagationStatus;
+export declare function waitForDnsPropagation(input: {
+    fqdn: string;
+    record: ResolveTarget;
+    timeoutSeconds: number;
+    observe?: (fqdn: string, target: ResolveTarget, elapsedMs: number) => Promise<DnsResolverObservation[]>;
+    now?: () => number;
+    sleep?: (milliseconds: number) => Promise<void>;
+}): Promise<DnsPropagationResult>;
+export {};

package/dist/lib/dns-propagation.js

@@ -0,0 +1,114 @@
+import { getServers, Resolver, resolve4, resolve6, resolveCname } from 'node:dns/promises';
+import { normalizeDnsValue } from './dns-records.js';
+export const defaultDnsResolvers = [
+    { kind: 'system', name: 'system' },
+    { kind: 'public', name: 'cloudflare', servers: ['1.1.1.1', '1.0.0.1'] },
+    { kind: 'public', name: 'google', servers: ['8.8.8.8', '8.8.4.4'] },
+];
+const negativeAnswerCodes = new Set(['ENODATA', 'ENOTFOUND']);
+export function isNegativeDnsObservation(observation) {
+    return observation.errorCode !== undefined && negativeAnswerCodes.has(observation.errorCode);
+}
+function resolverFor(spec) {
+    if (!spec.servers)
+        return undefined;
+    const resolver = new Resolver();
+    resolver.setServers(spec.servers);
+    return resolver;
+}
+async function queryResolver(fqdn, type, resolver) {
+    if (type === 'A') {
+        const answers = resolver ? await resolver.resolve4(fqdn, { ttl: true }) : await resolve4(fqdn, { ttl: true });
+        return answers.map((answer) => ({ ttl: answer.ttl, value: answer.address }));
+    }
+    if (type === 'AAAA') {
+        const answers = resolver ? await resolver.resolve6(fqdn, { ttl: true }) : await resolve6(fqdn, { ttl: true });
+        return answers.map((answer) => ({ ttl: answer.ttl, value: answer.address }));
+    }
+    if (type === 'CNAME') {
+        const answers = resolver ? await resolver.resolveCname(fqdn) : await resolveCname(fqdn);
+        return answers.map((value) => ({
+            ttl: null,
+            ttlUnavailableReason: 'resolver_api_does_not_expose_cname_ttl',
+            value,
+        }));
+    }
+    throw new Error(`Resolver observation is not supported for ${type} records.`);
+}
+export async function observeDnsRecord(fqdn, target, specs = defaultDnsResolvers, elapsedMs = 0) {
+    return Promise.all(specs.map(async (spec) => {
+        const servers = spec.servers ?? getServers();
+        try {
+            const answers = await queryResolver(fqdn, target.type, resolverFor(spec));
+            return {
+                answers,
+                elapsedMs,
+                expected: target.value,
+                kind: spec.kind,
+                matches: answers.length > 0 &&
+                    answers.every((answer) => normalizeDnsValue(answer.value) === normalizeDnsValue(target.value)),
+                resolver: spec.name,
+                servers,
+                type: target.type,
+            };
+        }
+        catch (error) {
+            const errorCode = error && typeof error === 'object' && 'code' in error && typeof error.code === 'string'
+                ? error.code
+                : undefined;
+            return {
+                answers: [],
+                elapsedMs,
+                error: error instanceof Error ? error.message : String(error),
+                ...(errorCode ? { errorCode } : {}),
+                expected: target.value,
+                kind: spec.kind,
+                matches: false,
+                resolver: spec.name,
+                servers,
+                type: target.type,
+            };
+        }
+    }));
+}
+export function classifyDnsPropagation(observations) {
+    const publicResults = observations.filter((observation) => observation.kind === 'public' && (!observation.error || isNegativeDnsObservation(observation)));
+    const system = observations.find((observation) => observation.kind === 'system');
+    const publicMatches = publicResults.length > 0 && publicResults.every((observation) => observation.matches);
+    if (!publicMatches)
+        return 'public_propagation_pending';
+    if (!system || (system.error && !isNegativeDnsObservation(system)))
+        return 'system_resolver_unavailable';
+    if (!system.matches)
+        return 'local_or_vpn_cache_stale';
+    return 'propagated';
+}
+const sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+export async function waitForDnsPropagation(input) {
+    const now = input.now ?? Date.now;
+    const wait = input.sleep ?? sleep;
+    const started = now();
+    const deadline = started + input.timeoutSeconds * 1000;
+    let observations = [];
+    while (true) {
+        const elapsedMs = now() - started;
+        observations = input.observe
+            ? await input.observe(input.fqdn, input.record, elapsedMs)
+            : await observeDnsRecord(input.fqdn, input.record, defaultDnsResolvers, elapsedMs);
+        const status = classifyDnsPropagation(observations);
+        if (status === 'propagated' || status === 'local_or_vpn_cache_stale' || status === 'system_resolver_unavailable') {
+            return { elapsedMs, expected: input.record.value, observations, status };
+        }
+        const remaining = deadline - now();
+        if (remaining <= 0) {
+            return {
+                elapsedMs: now() - started,
+                expected: input.record.value,
+                observations,
+                status,
+                timeoutReason: 'public_resolvers_did_not_match_before_timeout',
+            };
+        }
+        await wait(Math.min(5000, remaining));
+    }
+}

package/dist/lib/dns-reconciliation.d.ts

@@ -0,0 +1,31 @@
+import { type DnsRecordSelector } from './dns-records.js';
+import type { DnsProvider, DnsRecord, DnsRecordInput, DnsZone } from './providers/types.js';
+interface RetryDependencies {
+    now?: () => number;
+    sleep?: (milliseconds: number) => Promise<void>;
+}
+export interface ReconciliationResult {
+    appliedChanges: number;
+    attempts: number;
+    observed: DnsRecord[];
+    reconciled: true;
+}
+export declare function reconcileDesiredRecord(input: {
+    desired: DnsRecordInput;
+    intervalMs?: number;
+    provider: DnsProvider;
+    timeoutMs?: number;
+    zone: DnsZone;
+    progress?: (message: string) => void;
+    dependencies?: RetryDependencies;
+}): Promise<ReconciliationResult>;
+export declare function reconcileRecordRemoval(input: {
+    intervalMs?: number;
+    provider: DnsProvider;
+    selector: DnsRecordSelector;
+    timeoutMs?: number;
+    zone: DnsZone;
+    progress?: (message: string) => void;
+    dependencies?: RetryDependencies;
+}): Promise<ReconciliationResult>;
+export {};

package/dist/lib/dns-reconciliation.js

@@ -0,0 +1,53 @@
+import { desiredSlotPostcondition, recordMatchesSelector } from './dns-records.js';
+import { DoomainError } from './errors.js';
+const sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+export async function reconcileDesiredRecord(input) {
+    const now = input.dependencies?.now ?? Date.now;
+    const wait = input.dependencies?.sleep ?? sleep;
+    const deadline = now() + (input.timeoutMs ?? 30_000);
+    let attempts = 0;
+    const appliedChanges = 0;
+    while (true) {
+        attempts += 1;
+        const records = await input.provider.listRecords(input.zone);
+        const state = desiredSlotPostcondition(records, input.desired);
+        if (state.reconciled)
+            return { appliedChanges, attempts, observed: state.observed, reconciled: true };
+        if (now() >= deadline) {
+            throw new DoomainError('DNS_RECONCILIATION_INCOMPLETE', `The DNS provider accepted the change, but the ${input.desired.type} ${input.desired.name} slot is not reconciled yet.`, {
+                attempts,
+                expected: input.desired,
+                observed: state.observed,
+                recovery: 'Retry the command. Do not treat the DNS change as complete until reconciled is true.',
+            });
+        }
+        input.progress?.('Waiting for the DNS provider to publish the accepted change');
+        const remaining = deadline - now();
+        await wait(Math.min(input.intervalMs ?? 1000, Math.max(0, remaining)));
+    }
+}
+export async function reconcileRecordRemoval(input) {
+    const now = input.dependencies?.now ?? Date.now;
+    const wait = input.dependencies?.sleep ?? sleep;
+    const deadline = now() + (input.timeoutMs ?? 30_000);
+    let attempts = 0;
+    const appliedChanges = 0;
+    while (true) {
+        attempts += 1;
+        const records = await input.provider.listRecords(input.zone);
+        const observed = records.filter((record) => recordMatchesSelector(record, input.selector));
+        if (observed.length === 0)
+            return { appliedChanges, attempts, observed, reconciled: true };
+        if (now() >= deadline) {
+            throw new DoomainError('DNS_RECONCILIATION_INCOMPLETE', `The DNS provider accepted the deletion, but ${observed.length} matching record${observed.length === 1 ? '' : 's'} remain.`, {
+                attempts,
+                observed,
+                selector: input.selector,
+                recovery: 'Retry the command. Do not treat the DNS deletion as complete until reconciled is true.',
+            });
+        }
+        input.progress?.('Waiting for the DNS provider to publish the accepted deletion');
+        const remaining = deadline - now();
+        await wait(Math.min(input.intervalMs ?? 1000, Math.max(0, remaining)));
+    }
+}

package/dist/lib/dns-records.d.ts

@@ -0,0 +1,18 @@
+import type { DnsRecord, DnsRecordInput } from './providers/types.js';
+export interface DnsRecordSelector {
+    name: string;
+    type: DnsRecord['type'];
+    value?: string;
+}
+export declare function normalizeDnsValue(value: string): string;
+export declare function inferAddressRecordType(target: string): 'A' | 'AAAA' | 'CNAME';
+export declare function normalizeAddressRecordTarget(recordType: 'A' | 'AAAA' | 'CNAME', value: string): string;
+export declare function dnsRecordNamesEqual(a: string, b: string): boolean;
+export declare function sameDnsRecordTarget(a: DnsRecord | DnsRecordInput, b: DnsRecord | DnsRecordInput): boolean;
+export declare function sameDnsRecordValue(a: DnsRecord | DnsRecordInput, b: DnsRecord | DnsRecordInput): boolean;
+export declare function recordsInNonTxtSlot(records: DnsRecord[], desired: DnsRecordInput): DnsRecord[];
+export declare function desiredSlotPostcondition(records: DnsRecord[], desired: DnsRecordInput): {
+    observed: DnsRecord[];
+    reconciled: boolean;
+};
+export declare function recordMatchesSelector(record: DnsRecord, selector: DnsRecordSelector): boolean;

package/dist/lib/dns-records.js

@@ -0,0 +1,73 @@
+import { isIP } from 'node:net';
+import { DoomainError } from './errors.js';
+import { normalizeDomain } from './validate.js';
+function normalizeIpv6(value) {
+    try {
+        return new URL(`http://[${value}]`).hostname.slice(1, -1);
+    }
+    catch {
+        return value.toLowerCase();
+    }
+}
+export function normalizeDnsValue(value) {
+    const cleaned = value.trim().toLowerCase().replace(/\.$/, '');
+    return isIP(cleaned) === 6 ? normalizeIpv6(cleaned) : cleaned;
+}
+export function inferAddressRecordType(target) {
+    const version = isIP(target);
+    if (version === 4)
+        return 'A';
+    if (version === 6)
+        return 'AAAA';
+    return 'CNAME';
+}
+export function normalizeAddressRecordTarget(recordType, value) {
+    const target = value.trim().replace(/\.$/, '');
+    if (!target)
+        throw new DoomainError('MISSING_ARGUMENT', 'A DNS target is required.');
+    const version = isIP(target);
+    if (recordType === 'A' && version !== 4)
+        throw new DoomainError('INVALID_INPUT', 'A records require an IPv4 target.');
+    if (recordType === 'AAAA' && version !== 6)
+        throw new DoomainError('INVALID_INPUT', 'AAAA records require an IPv6 target.');
+    if (recordType === 'CNAME' && version !== 0)
+        throw new DoomainError('INVALID_INPUT', 'CNAME records require a hostname target.');
+    return recordType === 'CNAME' ? normalizeDomain(target) : target;
+}
+export function dnsRecordNamesEqual(a, b) {
+    return a.trim().toLowerCase().replace(/\.$/, '') === b.trim().toLowerCase().replace(/\.$/, '');
+}
+function comparableRecordValue(type, value) {
+    return type === 'TXT' ? value : normalizeDnsValue(value);
+}
+export function sameDnsRecordTarget(a, b) {
+    return (dnsRecordNamesEqual(a.name, b.name) &&
+        a.type === b.type &&
+        comparableRecordValue(a.type, a.value) === comparableRecordValue(b.type, b.value));
+}
+export function sameDnsRecordValue(a, b) {
+    return (sameDnsRecordTarget(a, b) &&
+        (b.ttl === undefined || a.ttl === b.ttl) &&
+        (b.priority === undefined || a.priority === b.priority) &&
+        (b.proxied === undefined || a.proxied === b.proxied));
+}
+export function recordsInNonTxtSlot(records, desired) {
+    if (desired.type === 'TXT')
+        return records.filter((record) => dnsRecordNamesEqual(record.name, desired.name) && record.type === 'TXT');
+    return records.filter((record) => dnsRecordNamesEqual(record.name, desired.name) &&
+        record.type !== 'TXT' &&
+        (record.type === desired.type || record.type === 'CNAME' || desired.type === 'CNAME'));
+}
+export function desiredSlotPostcondition(records, desired) {
+    const observed = recordsInNonTxtSlot(records, desired);
+    return {
+        observed,
+        reconciled: observed.length === 1 && sameDnsRecordValue(observed[0], desired),
+    };
+}
+export function recordMatchesSelector(record, selector) {
+    return (dnsRecordNamesEqual(record.name, selector.name) &&
+        record.type === selector.type &&
+        (selector.value === undefined ||
+            comparableRecordValue(record.type, record.value) === comparableRecordValue(selector.type, selector.value)));
+}

package/dist/lib/domain-provider.js

@@ -151,7 +151,7 @@ async function loadConfiguredProviderZones(providerId, accountInput, toleratePro
                 : ['doomain providers connect', 'doomain link <domain> --json'],
         });
     }
-    const results = await Promise.all(providerAccounts.map(({ definition, ref }) => loadProviderZonesSafely(definition, ref)));
+    const results = await Promise.all(providerAccounts.map(({ definition, ref }) => tolerateProviderAccountErrors ? loadProviderZonesSafely(definition, ref) : loadProviderZones(definition, ref)));
     return {
         accountInferred: account === undefined,
         candidates: results.flatMap((result) => result.candidates),

package/dist/lib/errors.d.ts

@@ -1,4 +1,4 @@
-export type DoomainErrorCode = 'CONFIG_NOT_FOUND' | 'CLERK_AUTH_FAILED' | 'CLERK_PRODUCTION_EXISTS' | 'DNS_POINT_FAILED' | 'DNS_TARGET_CONFLICT' | 'DOMAIN_LINK_FAILED' | 'DOMAIN_PROVIDER_DISCOVERY_FAILED' | 'DOMAIN_ALREADY_ASSIGNED' | 'DOMAIN_VERIFY_FAILED' | 'INVALID_INPUT' | 'MISSING_ARGUMENT' | 'MISSING_CREDENTIALS' | 'PROVIDER_API_ERROR' | 'PROVIDER_AUTH_FAILED' | 'PROVIDER_PERMISSION_DENIED' | 'PROVIDER_NOT_FOUND' | 'PROVIDER_RATE_LIMITED' | 'PROVIDER_RECORD_CONFLICT' | 'PROVIDER_UNSUPPORTED_RECORD' | 'PROVIDER_ZONE_AMBIGUOUS' | 'PROVIDER_ZONE_NOT_FOUND' | 'PROJECT_NOT_FOUND' | 'SELF_UPDATE_FAILED' | 'VERCEL_AUTH_FAILED' | 'VERCEL_PROJECT_NOT_LINKED';
+export type DoomainErrorCode = 'CONFIG_NOT_FOUND' | 'CLERK_AUTH_FAILED' | 'CLERK_PRODUCTION_EXISTS' | 'DNS_POINT_FAILED' | 'DNS_REMOVE_FAILED' | 'DNS_DELETE_AMBIGUOUS' | 'DNS_DIAGNOSE_FAILED' | 'DNS_RECONCILIATION_INCOMPLETE' | 'DNS_TARGET_CONFLICT' | 'DOMAIN_LINK_FAILED' | 'DOMAIN_PROVIDER_DISCOVERY_FAILED' | 'DOMAIN_ALREADY_ASSIGNED' | 'DOMAIN_VERIFY_FAILED' | 'INVALID_INPUT' | 'MISSING_ARGUMENT' | 'MISSING_CREDENTIALS' | 'PROVIDER_API_ERROR' | 'PROVIDER_AUTH_FAILED' | 'PROVIDER_PERMISSION_DENIED' | 'PROVIDER_NOT_FOUND' | 'PROVIDER_RATE_LIMITED' | 'PROVIDER_RECORD_CONFLICT' | 'PROVIDER_UNSUPPORTED_RECORD' | 'PROVIDER_ZONE_AMBIGUOUS' | 'PROVIDER_ZONE_NOT_FOUND' | 'PROJECT_NOT_FOUND' | 'SELF_UPDATE_FAILED' | 'VERCEL_AUTH_FAILED' | 'VERCEL_PROJECT_NOT_LINKED';
 export declare class DoomainError extends Error {
     readonly code: DoomainErrorCode;
     readonly details?: unknown;

package/dist/lib/point-domain.d.ts

@@ -1,3 +1,4 @@
+import { type DnsPropagationResult, type DnsResolverObservation } from './dns-propagation.js';
 import { type ResolvedDnsTarget } from './domain-provider.js';
 import { type DnsOverrideWarning } from './link-domain.js';
 import type { DnsProvider, DnsRecordInput } from './providers/types.js';
@@ -13,6 +14,7 @@ export interface PointDomainInput {
     timeoutSeconds?: number;
     ttl?: number;
     wait?: boolean;
+    reconcileTimeoutSeconds?: number;
     confirmDnsOverride?: (warning: DnsOverrideWarning) => Promise<boolean>;
     progress?: (message: string) => void;
 }
@@ -25,6 +27,9 @@ export interface PointDomainResult {
     provider: string;
     providerInferred: boolean;
     propagated: boolean;
+    propagation: DnsPropagationResult;
+    reconciled: boolean;
+    reconciliationAttempts: number;
     record: DnsRecordInput;
     skipped: DnsRecordInput[];
     updated: boolean;
@@ -34,9 +39,7 @@ interface PointDomainDependencies {
     createProvider: (provider: string, opts: {
         account?: string;
     }) => Promise<DnsProvider>;
-    resolve4?: (hostname: string) => Promise<string[]>;
-    resolve6?: (hostname: string) => Promise<string[]>;
-    resolveCname?: (hostname: string) => Promise<string[]>;
+    observeDns?: (fqdn: string, target: Pick<DnsRecordInput, 'type' | 'value'>, elapsedMs: number) => Promise<DnsResolverObservation[]>;
     resolveTarget: (input: Pick<PointDomainInput, 'account' | 'domain' | 'provider'>) => Promise<ResolvedDnsTarget>;
 }
 export declare function createPointRecord(input: {

package/dist/lib/point-domain.js

@@ -1,87 +1,27 @@
-import { resolve4, resolve6, resolveCname } from 'node:dns/promises';
-import { isIP } from 'node:net';
+import { waitForDnsPropagation } from './dns-propagation.js';
+import { reconcileDesiredRecord } from './dns-reconciliation.js';
+import { inferAddressRecordType, normalizeAddressRecordTarget } from './dns-records.js';
 import { resolveProviderTarget } from './domain-provider.js';
 import { DoomainError } from './errors.js';
 import { withProviderRecordOptions } from './link-domain.js';
 import { createProvider } from './providers/registry.js';
-import { normalizeDomain } from './validate.js';
 const defaultDependencies = {
     createProvider,
     resolveTarget: resolveProviderTarget,
 };
-function cleanTarget(value) {
-    return value.trim().replace(/\.$/, '');
-}
-function inferredRecordType(target) {
-    const version = isIP(target);
-    if (version === 4)
-        return 'A';
-    if (version === 6)
-        return 'AAAA';
-    return 'CNAME';
-}
-function validateTarget(recordType, target) {
-    const version = isIP(target);
-    if (recordType === 'A' && version !== 4)
-        throw new DoomainError('INVALID_INPUT', 'A records require an IPv4 target.');
-    if (recordType === 'AAAA' && version !== 6)
-        throw new DoomainError('INVALID_INPUT', 'AAAA records require an IPv6 target.');
-    if (recordType === 'CNAME' && version !== 0)
-        throw new DoomainError('INVALID_INPUT', 'CNAME records require a hostname target.');
-}
 export function createPointRecord(input) {
-    const target = cleanTarget(input.target);
-    if (!target)
-        throw new DoomainError('MISSING_ARGUMENT', 'A DNS target is required.');
-    const recordType = input.recordType ?? inferredRecordType(target);
-    validateTarget(recordType, target);
+    const recordType = input.recordType ?? inferAddressRecordType(input.target.trim());
+    const target = normalizeAddressRecordTarget(recordType, input.target);
     return withProviderRecordOptions(input.provider, {
         name: input.recordName,
         ttl: input.ttl ?? 300,
         type: recordType,
-        value: recordType === 'CNAME' ? normalizeDomain(target) : target,
+        value: target,
     });
 }
 function recordFqdn(record, zoneDomain) {
     return record.name === '@' ? zoneDomain : `${record.name}.${zoneDomain}`;
 }
-function cleanDnsValue(value) {
-    return value.toLowerCase().replace(/\.$/, '');
-}
-function normalizeIpv6(value) {
-    return new URL(`http://[${value}]`).hostname.slice(1, -1);
-}
-async function isPropagated(record, zoneDomain, dependencies) {
-    const fqdn = recordFqdn(record, zoneDomain);
-    try {
-        if (record.type === 'A')
-            return (await (dependencies.resolve4 ?? resolve4)(fqdn)).includes(record.value);
-        if (record.type === 'AAAA') {
-            const expected = normalizeIpv6(record.value);
-            return (await (dependencies.resolve6 ?? resolve6)(fqdn)).some((value) => normalizeIpv6(value) === expected);
-        }
-        if (record.type === 'CNAME') {
-            return (await (dependencies.resolveCname ?? resolveCname)(fqdn))
-                .map(cleanDnsValue)
-                .includes(cleanDnsValue(record.value));
-        }
-    }
-    catch {
-        return false;
-    }
-    return false;
-}
-async function waitForPropagation(record, zoneDomain, timeoutSeconds, dependencies) {
-    const deadline = Date.now() + timeoutSeconds * 1000;
-    while (true) {
-        if (await isPropagated(record, zoneDomain, dependencies))
-            return true;
-        const remaining = deadline - Date.now();
-        if (remaining <= 0)
-            return false;
-        await new Promise((resolve) => setTimeout(resolve, Math.min(5000, remaining)));
-    }
-}
 function conflictWarning(resolved, provider, record, conflicts) {
     return {
         account: resolved.account,
@@ -170,6 +110,14 @@ export async function pointDomain(input, dependencies = defaultDependencies) {
             provider: resolved.provider,
             providerInferred: resolved.providerInferred,
             propagated: false,
+            propagation: {
+                elapsedMs: 0,
+                expected: record.value,
+                observations: [],
+                status: 'not_checked',
+            },
+            reconciled: false,
+            reconciliationAttempts: 0,
             record,
             skipped: [],
             updated: false,
@@ -191,10 +139,25 @@ export async function pointDomain(input, dependencies = defaultDependencies) {
     }
     input.progress?.(`Pointing ${resolved.target.fullDomain} to ${record.value}`);
     const result = await provider.applyChanges(zone, plan, { force });
+    const reconciliation = await reconcileDesiredRecord({
+        desired: record,
+        progress: input.progress,
+        provider,
+        timeoutMs: (input.reconcileTimeoutSeconds ?? 30) * 1000,
+        zone,
+    });
     const shouldWait = input.wait ?? true;
-    const propagated = shouldWait
-        ? await waitForPropagation(record, resolved.target.zoneDomain, input.timeoutSeconds ?? 300, dependencies)
-        : false;
+    const propagation = shouldWait
+        ? await waitForDnsPropagation({
+            fqdn: recordFqdn(record, resolved.target.zoneDomain),
+            observe: dependencies.observeDns,
+            record,
+            timeoutSeconds: input.timeoutSeconds ?? 300,
+        })
+        : { elapsedMs: 0, expected: record.value, observations: [], status: 'not_checked' };
+    const propagated = propagation.status === 'propagated' ||
+        propagation.status === 'local_or_vpn_cache_stale' ||
+        propagation.status === 'system_resolver_unavailable';
     return {
         account: resolved.account,
         accountInferred: resolved.accountInferred,
@@ -204,9 +167,12 @@ export async function pointDomain(input, dependencies = defaultDependencies) {
         provider: resolved.provider,
         providerInferred: resolved.providerInferred,
         propagated,
+        propagation,
+        reconciled: reconciliation.reconciled,
+        reconciliationAttempts: reconciliation.attempts,
         record,
         skipped: result.skipped,
-        updated: result.applied.length > 0,
+        updated: result.applied.length > 0 || reconciliation.appliedChanges > 0,
         zoneDomain: resolved.target.zoneDomain,
     };
 }

package/dist/lib/providers/hostinger/index.d.ts

@@ -19,5 +19,6 @@ export declare class HostingerProvider implements DnsProvider {
     upsertRecord(zone: DnsZone, record: DnsRecordInput): Promise<DnsRecord>;
     deleteRecord(zone: DnsZone, record: DnsRecord): Promise<void>;
     private putRecords;
+    private putHostingerRecordSets;
 }
 export declare const hostingerProviderDefinition: DnsProviderDefinition;

package/dist/lib/providers/hostinger/index.js

@@ -47,7 +47,7 @@ function toDnsRecords(record, zone) {
             return [];
         return [
             {
-                metadata: { hostinger: { ...record, records: [item] } },
+                metadata: { hostinger: record },
                 name,
                 ttl: record.ttl,
                 type,
@@ -56,12 +56,13 @@ function toDnsRecords(record, zone) {
         ];
     });
 }
-function toHostingerRecord(record) {
+function toHostingerRecordSet(records) {
+    const first = records[0];
     return {
-        name: record.name,
-        records: [{ content: record.value }],
-        ttl: record.ttl ?? capabilities.defaultTtl,
-        type: record.type,
+        name: first.name,
+        records: records.map((record) => ({ content: record.value })),
+        ttl: first.ttl ?? capabilities.defaultTtl,
+        type: first.type,
     };
 }
 function deleteFilter(record) {
@@ -142,15 +143,40 @@ export class HostingerProvider {
         assertNoConflicts(this.id, plan);
         const applied = [];
         const skipped = [];
+        const deletionSets = new Map();
+        for (const change of plan.changes) {
+            if (change.action !== 'delete')
+                continue;
+            const key = `${change.existing.type}\0${change.existing.name}`;
+            const records = deletionSets.get(key) ?? [];
+            records.push(change.existing);
+            deletionSets.set(key, records);
+        }
+        for (const deleted of deletionSets.values()) {
+            const sample = deleted[0];
+            const source = sample.metadata?.hostinger;
+            const deletedValues = new Set(deleted.map((record) => record.value));
+            const sourceRecords = source?.records?.filter((record) => record.is_disabled || !record.content || !deletedValues.has(record.content));
+            if (source && sourceRecords && sourceRecords.length > 0) {
+                await this.putHostingerRecordSets(zone, [{ ...source, records: sourceRecords }], true);
+            }
+            else {
+                const remaining = plan.existing.filter((record) => sameRecordSet(record, sample) && !deleted.includes(record));
+                if (remaining.length > 0)
+                    await this.putRecords(zone, remaining, true);
+                else
+                    await this.deleteRecord(zone, sample);
+            }
+            applied.push(...plan.changes.filter((change) => change.action === 'delete' && deleted.includes(change.existing)));
+        }
         for (const change of plan.changes) {
             if (change.action === 'skip') {
                 skipped.push(change.record);
                 continue;
             }
             if (change.action === 'delete')
-                await this.deleteRecord(zone, change.existing);
-            else
-                await this.putRecords(zone, [change.record], change.action === 'update');
+                continue;
+            await this.putRecords(zone, [change.record], change.action === 'update');
             applied.push(change);
         }
         return { applied, skipped };
@@ -166,8 +192,18 @@ export class HostingerProvider {
         });
     }
     async putRecords(zone, records, overwrite) {
+        const recordSets = new Map();
+        for (const record of records) {
+            const key = `${record.type}\0${record.name}`;
+            const values = recordSets.get(key) ?? [];
+            values.push(record);
+            recordSets.set(key, values);
+        }
+        await this.putHostingerRecordSets(zone, [...recordSets.values()].map(toHostingerRecordSet), overwrite);
+    }
+    async putHostingerRecordSets(zone, recordSets, overwrite) {
         await this.http.request(`/api/dns/v1/zones/${encodeURIComponent(zone.name)}`, {
-            body: { overwrite, zone: records.map(toHostingerRecord) },
+            body: { overwrite, zone: recordSets },
             method: 'PUT',
         });
     }