fix: error handling for CAA records during custom domains setup

internal/hostnames/common.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/supabase/cli/internal/utils"
 	"github.com/supabase/cli/pkg/api"
@@ -47,6 +48,9 @@ type RawResponse struct {
 				TxtName  string `json:"txt_name"`
 				TxtValue string `json:"txt_value"`
 			} `json:"validation_records"`
+			ValidationErrors []struct {
+				Message string `json:"message"`
+			} `json:"validation_errors"`
 			Status string `json:"status"`
 		}
 	} `json:"result"`
@@ -105,6 +109,17 @@ Please ensure that your custom domain is set up as a CNAME record to your Supaba
 		if res.Result.Ssl.Status == "initializing" {
 			return appendRawOutputIfNeeded("Custom hostname setup is being initialized; please request re-verification in a few seconds.\n", response, includeRawOutput), nil
 		}
+		if res.Result.Ssl.ValidationErrors != nil && len(res.Result.Ssl.ValidationErrors) > 0 {
+			var errorMessages []string
+			for _, valError := range res.Result.Ssl.ValidationErrors {
+				if strings.Contains(valError.Message, "caa_error") {
+					return appendRawOutputIfNeeded("CAA mismatch; please remove any existing CAA records on your domain, or add one for \"digicert.com\"\n", response, includeRawOutput), nil
+				}
+				errorMessages = append(errorMessages, valError.Message)
+			}
+			valErrors := strings.Join(errorMessages, "\n\t- ")
+			return appendRawOutputIfNeeded(fmt.Sprintf("SSL validation errors: \n\t- %s\n", valErrors), response, includeRawOutput), nil
+		}
 		if len(ssl) != 1 {
 			return "", fmt.Errorf("expected a single SSL verification record, received: %+v", ssl)
 		}