From 4d9e9d9d080d461ed8947dbfa0f703aa5528e764 Mon Sep 17 00:00:00 2001
From: hasna-drain <drain@hasna.xyz>
Date: Wed, 29 Jul 2026 12:40:00 +0000
Subject: [PATCH 1/2] chore: begin drain 63a87f71


From b3fb3017dd40acbf345167bd203c3000a8867cc1 Mon Sep 17 00:00:00 2001
From: hasna-drain <drain@hasna.xyz>
Date: Wed, 29 Jul 2026 12:41:23 +0000
Subject: [PATCH 2/2] =?UTF-8?q?63a87f71:=20BUG:=20attachments=20=E2=80=94?=
 =?UTF-8?q?=20'domain=20configure'=20is=20metadata-only;=20does=20not=20au?=
 =?UTF-8?q?t?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 README.md                       |  6 ++++--
 src/cli/commands/domain.test.ts | 17 +++++++++++++++++
 src/cli/commands/domain.ts      |  7 ++++++-
 3 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 96f6566..e913693 100644
--- a/README.md
+++ b/README.md
@@ -43,8 +43,10 @@ back to local object storage otherwise.
 ## Public Domains
 
 Domain support is declarative and does not depend on `@hasna/domains` at
-runtime. Configure a public base URL and export a DNS plan for manual,
-Cloudflare, OpenDomains, or other automation.
+runtime. `domain configure` only stores local metadata; it does not deploy DNS,
+Cloudflare Workers, or provider routes. Configure a public base URL, export a
+plan for manual, Cloudflare, OpenDomains, or other automation, deploy that plan,
+then use `domain verify` to check the public route.
 
 ```bash
 attachments domain configure \
diff --git a/src/cli/commands/domain.test.ts b/src/cli/commands/domain.test.ts
index f97a981..ed794af 100644
--- a/src/cli/commands/domain.test.ts
+++ b/src/cli/commands/domain.test.ts
@@ -42,6 +42,23 @@ async function runDomainCommand(args: string[]): Promise<string> {
 }
 
 describe("domain command", () => {
+  it("makes clear that configure only saves metadata and gives deployment next steps", async () => {
+    const output = await runDomainCommand([
+      "configure",
+      "--hostname",
+      "files.example.com",
+      "--provider",
+      "cloudflare",
+      "--attachments-origin",
+      "https://attachments-origin.example.com",
+    ]);
+
+    expect(output).toContain("Saved public-domain metadata for https://files.example.com/a.");
+    expect(output).toContain("No DNS records, Cloudflare Workers, or provider routes were deployed.");
+    expect(output).toContain("attachments domain plan --format cloudflare");
+    expect(output).toContain("attachments domain verify");
+  });
+
   it("stores path-routing origins and prints a Cloudflare route plan", async () => {
     await runDomainCommand([
       "configure",
diff --git a/src/cli/commands/domain.ts b/src/cli/commands/domain.ts
index 257ee8c..7665fee 100644
--- a/src/cli/commands/domain.ts
+++ b/src/cli/commands/domain.ts
@@ -66,7 +66,12 @@ function configureCommand(): Command {
         },
       });
 
-      process.stdout.write(`Configured ${baseUrl}${pathPrefix} as the attachment public route.\n`);
+      const planFormat = provider === "cloudflare" || provider === "opendomains" ? provider : "json";
+      process.stdout.write(
+        `Saved public-domain metadata for ${baseUrl}${pathPrefix}.\n` +
+          "No DNS records, Cloudflare Workers, or provider routes were deployed.\n" +
+          `Next: run \`attachments domain plan --format ${planFormat}\`, deploy the printed plan, then run \`attachments domain verify\`.\n`
+      );
     });
 }