@sealkeeper/schema 0.4.4 → 0.4.6

package/dist/moderation.js

@@ -0,0 +1,547 @@
+import { z } from 'zod';
+// Moderation of the names an operator chooses, the operator slug and the
+// operator display name. The API runs these checks on every write and is
+// the only enforcement. The CLI and the web run the same checks for early
+// feedback. A name another operator already holds is the API's call, since
+// only the database knows (409 name_taken).
+// ---------------------------------------------------------------------------
+// Shapes
+export const OPERATOR_SLUG_MIN = 1;
+// 39, like a GitHub login. A 39 character slug, a slash and a 39 character
+// agent name make a 79 character handle, the AgentHandle cap that published
+// CLIs bundle.
+export const OPERATOR_SLUG_MAX = 39;
+export const OPERATOR_DISPLAY_NAME_MIN = 1;
+export const OPERATOR_DISPLAY_NAME_MAX = 64;
+const SLUG = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+// The operator's slug, the first half of every handle, as in alice/claude-code.
+// Lowercase letters, digits and single hyphens, starting and ending with a
+// letter or digit. Unique across SealKeeper. Reserved words and protected
+// names are refused by moderateSlug, not by this shape.
+export const OperatorSlug = z
+    .string()
+    .min(OPERATOR_SLUG_MIN)
+    .max(OPERATOR_SLUG_MAX)
+    .regex(SLUG, 'Use lowercase letters, digits and hyphens, starting and ending with a letter or digit')
+    .refine((slug) => !slug.includes('--'), 'No double hyphen');
+// Control, format, private use, unassigned and lone surrogate characters
+// (bidi overrides, zero width joiners and the like), and the line and
+// paragraph separators, which can hide, reorder or break what a reader sees.
+const HIDDEN = /[\p{C}\p{Zl}\p{Zp}]/u;
+const LETTER_OR_DIGIT = /[\p{L}\p{N}]/u;
+// The operator's display name. Free text, no control or format characters,
+// no space at either end, and at least one letter or digit, so its
+// normalised key is never empty. Protected names are refused by
+// moderateDisplayName.
+export const OperatorDisplayName = z
+    .string()
+    .min(OPERATOR_DISPLAY_NAME_MIN)
+    .max(OPERATOR_DISPLAY_NAME_MAX)
+    .refine((name) => !HIDDEN.test(name), 'No control characters')
+    .refine((name) => name === name.trim(), 'No space at the start or end')
+    .refine((name) => LETTER_OR_DIGIT.test(name), 'Use at least one letter or digit');
+// ---------------------------------------------------------------------------
+// Normalisation
+// Lookalikes, folded to the Latin letter they read as. Each row is a Latin
+// letter and the letters of other scripts that read as it, in the order
+// Greek, Cyrillic, Armenian, Cherokee, Canadian syllabics, Lisu, Latin,
+// Coptic, Tifinagh. The letters come from Unicode's confusables.txt, one
+// letter to one Latin letter, for these scripts only, plus the Latin small
+// capitals and a few Latin letters NFKD does not split into a base and a
+// mark. Coptic alfa and eie (Ⲁ, Ⲉ) are added by eye, they are not in the
+// list. Letters NFKC or
+// NFKD turn into another letter (the lunate sigma, the rho symbol, ё) are
+// left out, since they never reach the tables.
+function byLetter(rows) {
+    const table = {};
+    for (const [latin, lookalikes] of Object.entries(rows)) {
+        for (const ch of lookalikes) {
+            if (ch in table)
+                throw new Error(`${ch} is in two lookalike rows`);
+            table[ch] = latin;
+        }
+    }
+    return table;
+}
+// Capitals, and letters of scripts without case, that read as a Latin
+// capital. Folded before a letter is lowercased, since lowercasing first
+// would turn Greek capital Nu into nu, which reads as v, and a Cherokee
+// capital into a Cherokee small letter. So capital Nu is n here and small
+// nu is v in SMALL_LOOKALIKES.
+const CAPITAL_LOOKALIKES = byLetter({
+    a: 'ΑАᎪᗅꓮⲀ',
+    b: 'ΒВЬᏏᏴᗷꓐⲂ',
+    c: 'СᏟꓚⲤ',
+    d: 'ᎠᏧᗞᗪꓓ',
+    e: 'ΕЕᎬꓰⲈⴹ',
+    f: 'Ϝᖴꓝ',
+    g: 'ԌᏀᏳꓖ',
+    h: 'ΗНҺᎻᏂᕼꓧⲎ',
+    i: 'ΙІᎥ',
+    j: 'ͿЈᎫᒍꓙ',
+    k: 'ΚКᏦꓗⲔ',
+    l: 'ӀᏞᒪꓡꓲǀⲒⳐⵏ',
+    m: 'ΜϺМᎷᗰꓟⲘ',
+    n: 'Ν𑪾ꓠⲚ',
+    o: 'ΟОՕꓳⲞⵔ',
+    p: 'ΡРᏢᑭꓑⲢⳎ',
+    q: 'Ԛⵕ',
+    r: 'ᎡᏒᖇꓣ',
+    s: 'ЅՏᏕᏚꓢ',
+    t: 'ΤТᎢꓔⲦ',
+    u: 'Սᑌꓴ',
+    v: 'ѴᏙᐯꓦ',
+    w: 'ԜᎳᏔꓪ',
+    x: 'ΧХꓫⲬⵝ',
+    y: 'ΥУҮᎩᎽꓬ',
+    z: 'ΖᏃ𑪼ꓜ',
+});
+// Small letters that read as a Latin letter. Cherokee small letters are the
+// Cherokee capitals above, smaller, so they are added from that table.
+const SMALL_LOOKALIKES = byLetter({
+    a: 'αаɑᴀⲁ',
+    b: 'βвᑲᖯʙⲃ',
+    c: 'сᲃᴄⲥ',
+    d: 'ԁᑯꓒđᴅ',
+    e: 'εеҽᴇⲉ',
+    f: 'քꜰ',
+    g: 'ցɡɢ',
+    h: 'һнհħʜⲏ',
+    i: 'ιіꙇւıɪɩⲓ',
+    j: 'ϳјյȷᴊ',
+    k: 'κкᴋⲕ',
+    l: 'ӏłʟⳑ',
+    m: 'мᴍ',
+    n: 'ηпոռɴⲛ',
+    o: 'οоᲂօøᴏⲟϭ',
+    p: 'ρϸрᴘⲣⳏ',
+    q: 'ԛգզꞯ',
+    r: 'ᴦгʀⲅ',
+    s: 'ѕꜱ',
+    t: 'τтŧᴛⲧ',
+    u: 'μυսᴜ',
+    v: 'νѵᴠ',
+    w: 'ωшԝѡաᴡꟺⲽ',
+    x: 'χхᕁᕽⲭ',
+    y: 'уүʏⲩ',
+    z: 'ᴢ',
+    ss: 'ß',
+    ae: 'æ',
+    oe: 'œ',
+});
+for (const [ch, latin] of Object.entries(CAPITAL_LOOKALIKES)) {
+    const small = ch.toLowerCase();
+    if (small !== ch && /\p{Script=Cherokee}/u.test(ch)) {
+        SMALL_LOOKALIKES[small] = latin;
+    }
+}
+// Digits and symbols used as letters.
+const DIGIT_SWAPS = {
+    '0': 'o',
+    '1': 'l',
+    '3': 'e',
+    '4': 'a',
+    '5': 's',
+    '7': 't',
+    '8': 'b',
+    '@': 'a',
+    $: 's',
+    '|': 'l',
+    '!': 'l',
+};
+// One letter folded. A capital by the capital it looks like, else the
+// letter lowercased and folded by the small letter it looks like.
+function foldLetter(ch) {
+    const capital = CAPITAL_LOOKALIKES[ch];
+    if (capital !== undefined)
+        return capital;
+    const small = ch.toLowerCase();
+    return SMALL_LOOKALIKES[small] ?? DIGIT_SWAPS[small] ?? small;
+}
+// i and l look alike in many fonts (GoogIe with a capital I), so both fold
+// to l. Run after the lookalikes, so a Cyrillic і, a Greek ι or a dotless
+// ı, which fold to i there, fold on to l as well.
+const I_AS_L = /i/g;
+const MARKS = /\p{M}/gu;
+const NOT_LETTER_OR_DIGIT = /[^\p{L}\p{N}]/gu;
+// The form two names are compared in. NFKC, accents dropped, lookalikes of
+// other scripts and digit swaps folded by shape and the rest lowercased,
+// everything but letters and digits dropped, then letter pairs that read
+// as one letter (rn as m, vv as w) folded. Open-AI, OPENAI and 0penai all
+// give the same key, and so does OPENAI with a Greek capital Omicron.
+// Letters of scripts with no Latin lookalike are kept, so a display name
+// in another script still has a key of its own.
+export function normaliseName(text) {
+    const folded = Array.from(text.normalize('NFKC').normalize('NFKD').replace(MARKS, ''), foldLetter)
+        .join('')
+        .replace(I_AS_L, 'l');
+    return folded
+        .replace(NOT_LETTER_OR_DIGIT, '')
+        .replace(/rn/g, 'm')
+        .replace(/vv/g, 'w');
+}
+// The display_name_key column. Unique across operators, so two display
+// names that read the same cannot both be held.
+export const displayNameKey = normaliseName;
+// ---------------------------------------------------------------------------
+// Protected names
+// The top AI and technology companies and products. A slug or display name
+// that normalises to one of these, with or without a common suffix, is
+// refused. Written as the name reads. The list protects the distinctive
+// form only, so Stability AI protects stabilityai (and stability-ai-labs)
+// but not the plain word stability. Products that are also common first
+// names (Devin, Alexa, Siri) are left out, since a login such as devin
+// would otherwise lose its slug. Claude is the one exception.
+export const PROTECTED_NAMES = [
+    // SealKeeper itself
+    'SealKeeper',
+    'Vouched',
+    // AI labs and model makers
+    'Anthropic',
+    'Claude',
+    'OpenAI',
+    'ChatGPT',
+    'GPT',
+    'Codex',
+    'DALL-E',
+    'Google',
+    'Alphabet',
+    'DeepMind',
+    'Gemini',
+    'Microsoft',
+    'Copilot',
+    'Bing',
+    'Azure',
+    'Meta',
+    'Facebook',
+    'Instagram',
+    'WhatsApp',
+    'Llama',
+    'xAI',
+    'Grok',
+    'Twitter',
+    'Mistral',
+    'Le Chat',
+    'Cohere',
+    'DeepSeek',
+    'Qwen',
+    'Alibaba',
+    'Zhipu',
+    'Baidu',
+    'ByteDance',
+    'TikTok',
+    'Tencent',
+    'Perplexity',
+    'Character AI',
+    'Stability AI',
+    'Midjourney',
+    'ElevenLabs',
+    'Hugging Face',
+    'Scale AI',
+    'AI21',
+    'Nous Research',
+    'Together AI',
+    'Groq',
+    'Cerebras',
+    'Ollama',
+    'LangChain',
+    'LlamaIndex',
+    'CrewAI',
+    'AutoGPT',
+    'Mastra',
+    'OpenClaw',
+    // Coding agents and developer tools
+    'Cursor',
+    'Anysphere',
+    'Windsurf',
+    'Codeium',
+    'Replit',
+    'Lovable',
+    'StackBlitz',
+    'Vercel',
+    'Sourcegraph',
+    'Tabnine',
+    'JetBrains',
+    'GitHub',
+    'GitLab',
+    'Bitbucket',
+    'Atlassian',
+    'Notion',
+    'Slack',
+    'Discord',
+    'Figma',
+    'Stripe',
+    'Supabase',
+    'Cloudflare',
+    'Netlify',
+    'Docker',
+    'npm',
+    // Platforms and hardware
+    'Apple',
+    'Amazon',
+    'AWS',
+    'Nvidia',
+    'AMD',
+    'Intel',
+    'IBM',
+    'Oracle',
+    'Salesforce',
+    'Samsung',
+    'Adobe',
+    'Netflix',
+    'Uber',
+    'Palantir',
+    'Databricks',
+    'Snowflake',
+    'Zapier',
+];
+// Suffixes an impersonator adds to a protected name. Stripped one at a time
+// from the end, and the rest compared again.
+export const PROTECTED_SUFFIXES = [
+    'inc',
+    'labs',
+    'ai',
+    'hq',
+    'official',
+    'team',
+];
+// Prefixes an impersonator puts in front, as in the-real-openai. Stripped
+// from the start the same way.
+export const PROTECTED_PREFIXES = [
+    'official',
+    'real',
+    'the',
+    'team',
+];
+const PROTECTED_KEYS = new Map(PROTECTED_NAMES.map((name) => [normaliseName(name), name]));
+const SUFFIX_KEYS = PROTECTED_SUFFIXES.map(normaliseName);
+const PREFIX_KEYS = PROTECTED_PREFIXES.map(normaliseName);
+// Every form of a key a protected name could hide in. The key itself, then
+// the key with every combination of prefixes and suffixes stripped. Never
+// empty.
+function keyForms(key) {
+    const forms = new Set();
+    const queue = [key];
+    while (queue.length > 0) {
+        const form = queue.pop();
+        if (form === '' || forms.has(form))
+            continue;
+        forms.add(form);
+        for (const suffix of SUFFIX_KEYS) {
+            if (form.length > suffix.length && form.endsWith(suffix)) {
+                queue.push(form.slice(0, -suffix.length));
+            }
+        }
+        for (const prefix of PREFIX_KEYS) {
+            if (form.length > prefix.length && form.startsWith(prefix)) {
+                queue.push(form.slice(prefix.length));
+            }
+        }
+    }
+    return [...forms];
+}
+// The protected name a text impersonates, as written in PROTECTED_NAMES, or
+// null when it impersonates none.
+export function protectedNameOf(text) {
+    for (const form of keyForms(normaliseName(text))) {
+        const name = PROTECTED_KEYS.get(form);
+        if (name !== undefined)
+            return name;
+    }
+    return null;
+}
+// ---------------------------------------------------------------------------
+// Reserved words
+// Route and product words a slug would collide with or read as part of the
+// site. Slugs only, a display name is never part of a URL.
+export const RESERVED_WORDS = [
+    'about',
+    'account',
+    'accounts',
+    'admin',
+    'administrator',
+    'agent',
+    'agents',
+    'anonymous',
+    'api',
+    'app',
+    'assets',
+    'auth',
+    'avatar',
+    'avatars',
+    'badge',
+    'badges',
+    'blog',
+    'callback',
+    'check',
+    'cli',
+    'dashboard',
+    'directory',
+    'docs',
+    'feed',
+    'help',
+    'home',
+    'join',
+    'leaderboard',
+    'legal',
+    'login',
+    'logout',
+    'me',
+    'moderator',
+    'new',
+    'null',
+    'oauth',
+    'official',
+    'operator',
+    'operators',
+    'privacy',
+    'profile',
+    'prove',
+    'register',
+    'root',
+    'search',
+    'seal',
+    'seals',
+    'sealkeeper',
+    'security',
+    'settings',
+    'signin',
+    'signout',
+    'signup',
+    'staff',
+    'static',
+    'status',
+    'support',
+    'system',
+    'task',
+    'tasks',
+    'terms',
+    'undefined',
+    'v1',
+    'verify',
+    'vouched',
+    'well-known',
+    'what-is-shared',
+    'www',
+];
+// Compared in normalised form, so adm1n and a-p-i are refused as well.
+const RESERVED_KEYS = new Set(RESERVED_WORDS.map(normaliseName));
+export function isReservedWord(text) {
+    return RESERVED_KEYS.has(normaliseName(text));
+}
+function protectedRefusal(text) {
+    const name = protectedNameOf(text);
+    return name === null
+        ? null
+        : {
+            code: 'name_protected',
+            message: `${text} reads as ${name}, which is a protected name. Pick another.`,
+        };
+}
+// The refusal for an operator slug, or null when it may be used. The shape
+// is OperatorSlug's job, this checks reserved words and protected names.
+export function moderateSlug(slug) {
+    if (isReservedWord(slug)) {
+        return {
+            code: 'name_reserved',
+            message: `${slug} is reserved by SealKeeper. Pick another.`,
+        };
+    }
+    return protectedRefusal(slug);
+}
+// Scripts a name in Latin letters may mix with, the mixes Unicode's highly
+// restrictive profile (UTS 39) allows. Han, Hiragana, Katakana, Hangul and
+// Bopomofo, plus Common and Inherited, which hold letters every script
+// shares. Any other script mixed with Latin is how a lookalike hides (Nvidia
+// with a Greek capital Nu, Google with Armenian o, OpenAI with a Coptic O),
+// so it is refused outright, whatever the tables above fold. A script not
+// listed here is refused by default, so a new lookalike script needs no row.
+// A name written in any one script alone is fine.
+const MIXES_WITH_LATIN = /[\p{Script=Latin}\p{Script=Han}\p{Script=Hiragana}\p{Script=Katakana}\p{Script=Hangul}\p{Script=Bopomofo}\p{Script=Common}\p{Script=Inherited}]/u;
+// Names for the refusal message, for the scripts with the most Latin
+// lookalikes. Any other script is "letters of another script".
+const SCRIPT_NAMES = [
+    ['Greek letters', /\p{Script=Greek}/u],
+    ['Cyrillic letters', /\p{Script=Cyrillic}/u],
+    ['Armenian letters', /\p{Script=Armenian}/u],
+    ['Cherokee letters', /\p{Script=Cherokee}/u],
+    ['Lisu letters', /\p{Script=Lisu}/u],
+    ['Canadian syllabics', /\p{Script=Canadian_Aboriginal}/u],
+    ['Coptic letters', /\p{Script=Coptic}/u],
+    ['Tifinagh letters', /\p{Script=Tifinagh}/u],
+];
+const LATIN = /\p{Script=Latin}/u;
+const LETTER = /\p{L}/u;
+// The micro sign and the ohm sign. NFKC turns them into Greek mu and
+// Omega, and the ohm sign is Greek already, so they are dropped before the
+// script check. 10kΩ Audio is a unit, not a Greek letter.
+const UNIT_SIGNS = /[\u00B5\u2126]/gu;
+// The script a text mixes with Latin letters, as the refusal names it, or
+// null when it mixes none it may not. Read after NFKC, so fullwidth and
+// styled Latin letters count as Latin.
+export function mixedScriptOf(text) {
+    const letters = Array.from(text.replace(UNIT_SIGNS, '').normalize('NFKC')).filter((ch) => LETTER.test(ch));
+    if (!letters.some((ch) => LATIN.test(ch)))
+        return null;
+    const other = letters.find((ch) => !MIXES_WITH_LATIN.test(ch));
+    if (other === undefined)
+        return null;
+    const named = SCRIPT_NAMES.find(([, pattern]) => pattern.test(other));
+    return named ? named[0] : 'letters of another script';
+}
+// The refusal for an operator display name, or null when it may be used.
+// The shape is OperatorDisplayName's job. Protected names first, then Latin
+// mixed with a script it may not mix with. Whether another operator holds
+// the same key is the API's check against display_name_key. Slugs need no
+// script check, OperatorSlug allows a to z, digits and hyphens only.
+export function moderateDisplayName(name) {
+    const refusal = protectedRefusal(name);
+    if (refusal)
+        return refusal;
+    const script = mixedScriptOf(name);
+    return script === null
+        ? null
+        : {
+            code: 'name_mixed_script',
+            message: `${name} mixes Latin letters with ${script}, so it can pass for another name. Use one script.`,
+        };
+}
+// ---------------------------------------------------------------------------
+// Default slugs
+// A login as a slug. Lowercase, every run of characters other than a to z
+// and 0 to 9 made one hyphen, hyphens trimmed from the ends, since an old
+// GitHub login can end in one. A login is not always letters, digits and
+// hyphens (an Enterprise Managed User login ends in _shortcode), and a
+// slug must be. The same rule as sk_base in migration 0025. The API's
+// default slug for a new operator starts from it.
+export function slugBase(login) {
+    const base = login
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-|-$/g, '')
+        .slice(0, OPERATOR_SLUG_MAX)
+        .replace(/-$/, '');
+    return base === '' ? 'operator' : base;
+}
+// base with -n on the end, cut so the whole stays within the slug limit.
+export const suffixedSlug = (base, n) => `${base.slice(0, OPERATOR_SLUG_MAX - `-${n}`.length).replace(/-+$/, '')}-${n}`;
+// The reason the slug is the login's slug with a -2, -3 and so on, or null
+// when it is not. A slug the operator chose, or one left behind by a GitHub
+// login change, is not of that form and gives null. The caller also checks
+// that the slug never changed, since an operator can pick a suffixed slug.
+// reserved and protected are read from today's lists, taken is the rest.
+export function slugSuffixReason(login, slug) {
+    const base = slugBase(login);
+    const n = /-([0-9]+)$/.exec(slug)?.[1];
+    if (n === undefined || slug === base)
+        return null;
+    const k = Number(n);
+    if (k < 2 || suffixedSlug(base, k) !== slug)
+        return null;
+    const refusal = moderateSlug(base);
+    if (refusal?.code === 'name_reserved')
+        return 'reserved';
+    if (refusal?.code === 'name_protected')
+        return 'protected';
+    return 'taken';
+}

package/dist/operator-domains.d.ts

@@ -0,0 +1,104 @@
+import { z } from 'zod';
+export declare const DNS_RECORD_LABEL = "_sealkeeper";
+export declare const DNS_RECORD_PREFIX = "sealkeeper-verify=";
+export declare const DNS_IDENTITY_KIND = "https://sealkeeper.run/seal/identity/dns";
+export declare const DNS_IDENTITY_PROVIDER = "https://sealkeeper.run";
+export declare const OPERATOR_VERIFICATION: {
+    readonly graceDays: 14;
+    readonly recheckHours: 24;
+    readonly maxDomains: 5;
+};
+export declare const DomainName: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+export type DomainName = z.infer<typeof DomainName>;
+export declare const AddDomainRequest: z.ZodObject<{
+    domain: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+}, z.core.$strict>;
+export type AddDomainRequest = z.infer<typeof AddDomainRequest>;
+export declare const DomainParams: z.ZodObject<{
+    id: z.ZodUUID;
+}, z.core.$strict>;
+export type DomainParams = z.infer<typeof DomainParams>;
+export declare const DomainStatus: z.ZodEnum<{
+    lapsed: "lapsed";
+    lapsing: "lapsing";
+    pending: "pending";
+    verified: "verified";
+}>;
+export type DomainStatus = z.infer<typeof DomainStatus>;
+export declare const OperatorDomain: z.ZodObject<{
+    id: z.ZodUUID;
+    domain: z.ZodString;
+    record: z.ZodObject<{
+        name: z.ZodString;
+        value: z.ZodString;
+    }, z.core.$strict>;
+    status: z.ZodEnum<{
+        lapsed: "lapsed";
+        lapsing: "lapsing";
+        pending: "pending";
+        verified: "verified";
+    }>;
+    verifiedAt: z.ZodNullable<z.ZodISODateTime>;
+    lastCheckedAt: z.ZodNullable<z.ZodISODateTime>;
+    lapsedAt: z.ZodNullable<z.ZodISODateTime>;
+    graceEndsAt: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strict>;
+export type OperatorDomain = z.infer<typeof OperatorDomain>;
+export declare const DomainsResponse: z.ZodObject<{
+    domains: z.ZodArray<z.ZodObject<{
+        id: z.ZodUUID;
+        domain: z.ZodString;
+        record: z.ZodObject<{
+            name: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strict>;
+        status: z.ZodEnum<{
+            lapsed: "lapsed";
+            lapsing: "lapsing";
+            pending: "pending";
+            verified: "verified";
+        }>;
+        verifiedAt: z.ZodNullable<z.ZodISODateTime>;
+        lastCheckedAt: z.ZodNullable<z.ZodISODateTime>;
+        lapsedAt: z.ZodNullable<z.ZodISODateTime>;
+        graceEndsAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strict>>;
+    graceDays: z.ZodInt;
+}, z.core.$strict>;
+export type DomainsResponse = z.infer<typeof DomainsResponse>;
+export declare const DomainLookup: z.ZodEnum<{
+    failed: "failed";
+    found: "found";
+    missing: "missing";
+}>;
+export type DomainLookup = z.infer<typeof DomainLookup>;
+export declare const DomainCheckResponse: z.ZodObject<{
+    domain: z.ZodObject<{
+        id: z.ZodUUID;
+        domain: z.ZodString;
+        record: z.ZodObject<{
+            name: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strict>;
+        status: z.ZodEnum<{
+            lapsed: "lapsed";
+            lapsing: "lapsing";
+            pending: "pending";
+            verified: "verified";
+        }>;
+        verifiedAt: z.ZodNullable<z.ZodISODateTime>;
+        lastCheckedAt: z.ZodNullable<z.ZodISODateTime>;
+        lapsedAt: z.ZodNullable<z.ZodISODateTime>;
+        graceEndsAt: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strict>;
+    lookup: z.ZodEnum<{
+        failed: "failed";
+        found: "found";
+        missing: "missing";
+    }>;
+}, z.core.$strict>;
+export type DomainCheckResponse = z.infer<typeof DomainCheckResponse>;
+export declare const domainRecord: (domain: string, token: string) => {
+    name: string;
+    value: string;
+};