domain0 0.1.0

package/dist/server.cjs

@@ -0,0 +1,103 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_contracts = require("./contracts.cjs");
+const require_error = require("./error-BB4-lyc4.cjs");
+//#region src/server/connection-proxy.ts
+const connectionIdPattern = /^[A-Za-z0-9_-]{1,200}$/;
+const connectionActions = /* @__PURE__ */ new Set([
+	"cancellation",
+	"change-application",
+	"change-plan",
+	"credential-authorization",
+	"dkim-guidance",
+	"domain-connect-completion",
+	"domain-connect-handoff",
+	"manual-completion",
+	"manual-configuration",
+	"oauth-authorization",
+	"plan-confirmation",
+	"propagation-verification",
+	"provider-detection",
+	"provider-selection",
+	"retry"
+]);
+const maximumBodyBytes = 1048576;
+/**
+* Forwards only the browser-safe connection routes used by Domain0 Connect.
+* Cookies, API keys, and unrelated headers are never forwarded.
+*/
+async function forwardDomain0ConnectionRequest(options) {
+	const method = options.request.method.toUpperCase();
+	if (!isAllowedPath(method, options.path)) return jsonError(404, "This route is not exposed by the connection bridge.");
+	const authorization = options.request.headers.get("authorization");
+	if (authorization === null || authorization.length > 8200 || !/^Bearer [A-Za-z0-9._~+\/-]+=*$/.test(authorization)) return jsonError(401, "A valid connection token is required.");
+	const originResult = require_contracts.IssueConnectionTokenInputSchema.safeParse({ origin: options.origin ?? new URL(options.request.url).origin });
+	if (!originResult.success) throw new require_error.Domain0ProtocolError("The connection bridge origin is invalid", originResult.error);
+	const upstreamBaseUrl = parseBaseUrl(options.upstreamBaseUrl);
+	const fetchImplementation = options.fetch ?? globalThis.fetch;
+	if (fetchImplementation === void 0) throw new require_error.Domain0ProtocolError("No fetch implementation is available");
+	let body;
+	if (method === "POST") {
+		const contentLength = Number(options.request.headers.get("content-length") ?? 0);
+		if (Number.isFinite(contentLength) && contentLength > maximumBodyBytes) return jsonError(413, "The request body is too large.");
+		const bytes = await options.request.arrayBuffer();
+		if (bytes.byteLength > maximumBodyBytes) return jsonError(413, "The request body is too large.");
+		body = bytes;
+	}
+	let upstream;
+	try {
+		upstream = await fetchImplementation(new URL(options.path.map(encodeURIComponent).join("/"), upstreamBaseUrl), {
+			method,
+			headers: {
+				accept: "application/json",
+				authorization,
+				origin: originResult.data.origin,
+				...body === void 0 ? {} : { "content-type": "application/json" }
+			},
+			...body === void 0 ? {} : { body },
+			cache: "no-store"
+		});
+	} catch (cause) {
+		throw new require_error.Domain0TransportError(cause);
+	}
+	return new Response(upstream.body, {
+		status: upstream.status,
+		headers: {
+			"cache-control": "no-store",
+			"content-type": upstream.headers.get("content-type") ?? "application/json"
+		}
+	});
+}
+function isAllowedPath(method, path) {
+	if (method === "GET" && path[0] === "v1" && path[1] === "providers" && (path.length === 2 || path.length === 3 && path[2] === "health")) return true;
+	if (path[0] !== "v1" || path[1] !== "connections" || path[2] === void 0 || !connectionIdPattern.test(path[2])) return false;
+	if (method === "GET") return path.length === 3;
+	return method === "POST" && path.length === 4 && path[3] !== void 0 && connectionActions.has(path[3]);
+}
+function parseBaseUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch (error) {
+		throw new require_error.Domain0ProtocolError("Domain0 upstreamBaseUrl must be an absolute URL", error);
+	}
+	if (url.protocol !== "https:" && !isLoopback(url.hostname)) throw new require_error.Domain0ProtocolError("Domain0 upstreamBaseUrl must use HTTPS outside local development");
+	if (url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") throw new require_error.Domain0ProtocolError("Domain0 upstreamBaseUrl must not contain credentials, a query, or a fragment");
+	url.pathname = `${url.pathname.replace(/\/$/, "")}/`;
+	return url;
+}
+function isLoopback(hostname) {
+	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function jsonError(status, message) {
+	return Response.json({ error: {
+		code: status === 401 ? "unauthorized" : "invalid_request",
+		message
+	} }, {
+		status,
+		headers: { "cache-control": "no-store" }
+	});
+}
+//#endregion
+exports.forwardDomain0ConnectionRequest = forwardDomain0ConnectionRequest;
+
+//# sourceMappingURL=server.cjs.map

package/dist/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.cjs","names":["IssueConnectionTokenInputSchema","Domain0ProtocolError","Domain0TransportError"],"sources":["../src/server/connection-proxy.ts"],"sourcesContent":["import { IssueConnectionTokenInputSchema } from '../contracts'\nimport { Domain0ProtocolError, Domain0TransportError } from '../client/error'\n\nconst connectionIdPattern = /^[A-Za-z0-9_-]{1,200}$/\nconst connectionActions = new Set([\n  'cancellation',\n  'change-application',\n  'change-plan',\n  'credential-authorization',\n  'dkim-guidance',\n  'domain-connect-completion',\n  'domain-connect-handoff',\n  'manual-completion',\n  'manual-configuration',\n  'oauth-authorization',\n  'plan-confirmation',\n  'propagation-verification',\n  'provider-detection',\n  'provider-selection',\n  'retry',\n])\nconst maximumBodyBytes = 1_048_576\n\nexport interface ForwardDomain0ConnectionRequestOptions {\n  request: Request\n  /** Catch-all route segments after the same-origin Domain0 bridge. */\n  path: readonly string[]\n  /** Hosted Domain0 platform API root. */\n  upstreamBaseUrl: string\n  /** Exact public origin that received the browser request. */\n  origin?: string\n  fetch?: typeof globalThis.fetch\n}\n\n/**\n * Forwards only the browser-safe connection routes used by Domain0 Connect.\n * Cookies, API keys, and unrelated headers are never forwarded.\n */\nexport async function forwardDomain0ConnectionRequest(\n  options: ForwardDomain0ConnectionRequestOptions,\n): Promise<Response> {\n  const method = options.request.method.toUpperCase()\n  if (!isAllowedPath(method, options.path)) {\n    return jsonError(404, 'This route is not exposed by the connection bridge.')\n  }\n\n  const authorization = options.request.headers.get('authorization')\n  if (\n    authorization === null ||\n    authorization.length > 8200 ||\n    !/^Bearer [A-Za-z0-9._~+\\/-]+=*$/.test(authorization)\n  ) {\n    return jsonError(401, 'A valid connection token is required.')\n  }\n\n  const originResult = IssueConnectionTokenInputSchema.safeParse({\n    origin: options.origin ?? new URL(options.request.url).origin,\n  })\n  if (!originResult.success) {\n    throw new Domain0ProtocolError('The connection bridge origin is invalid', originResult.error)\n  }\n\n  const upstreamBaseUrl = parseBaseUrl(options.upstreamBaseUrl)\n  const fetchImplementation = options.fetch ?? globalThis.fetch\n  if (fetchImplementation === undefined) {\n    throw new Domain0ProtocolError('No fetch implementation is available')\n  }\n\n  let body: ArrayBuffer | undefined\n  if (method === 'POST') {\n    const contentLength = Number(options.request.headers.get('content-length') ?? 0)\n    if (Number.isFinite(contentLength) && contentLength > maximumBodyBytes) {\n      return jsonError(413, 'The request body is too large.')\n    }\n    const bytes = await options.request.arrayBuffer()\n    if (bytes.byteLength > maximumBodyBytes) {\n      return jsonError(413, 'The request body is too large.')\n    }\n    body = bytes\n  }\n\n  let upstream: Response\n  try {\n    upstream = await fetchImplementation(\n      new URL(options.path.map(encodeURIComponent).join('/'), upstreamBaseUrl),\n      {\n        method,\n        headers: {\n          accept: 'application/json',\n          authorization,\n          origin: originResult.data.origin,\n          ...(body === undefined ? {} : { 'content-type': 'application/json' }),\n        },\n        ...(body === undefined ? {} : { body }),\n        cache: 'no-store',\n      },\n    )\n  } catch (cause) {\n    throw new Domain0TransportError(cause)\n  }\n\n  return new Response(upstream.body, {\n    status: upstream.status,\n    headers: {\n      'cache-control': 'no-store',\n      'content-type': upstream.headers.get('content-type') ?? 'application/json',\n    },\n  })\n}\n\nfunction isAllowedPath(method: string, path: readonly string[]): boolean {\n  if (\n    method === 'GET' &&\n    path[0] === 'v1' &&\n    path[1] === 'providers' &&\n    (path.length === 2 || (path.length === 3 && path[2] === 'health'))\n  ) {\n    return true\n  }\n  if (\n    path[0] !== 'v1' ||\n    path[1] !== 'connections' ||\n    path[2] === undefined ||\n    !connectionIdPattern.test(path[2])\n  ) {\n    return false\n  }\n  if (method === 'GET') return path.length === 3\n  return (\n    method === 'POST' &&\n    path.length === 4 &&\n    path[3] !== undefined &&\n    connectionActions.has(path[3])\n  )\n}\n\nfunction parseBaseUrl(value: string): URL {\n  let url: URL\n  try {\n    url = new URL(value)\n  } catch (error) {\n    throw new Domain0ProtocolError('Domain0 upstreamBaseUrl must be an absolute URL', error)\n  }\n  if (url.protocol !== 'https:' && !isLoopback(url.hostname)) {\n    throw new Domain0ProtocolError(\n      'Domain0 upstreamBaseUrl must use HTTPS outside local development',\n    )\n  }\n  if (url.username !== '' || url.password !== '' || url.search !== '' || url.hash !== '') {\n    throw new Domain0ProtocolError(\n      'Domain0 upstreamBaseUrl must not contain credentials, a query, or a fragment',\n    )\n  }\n  url.pathname = `${url.pathname.replace(/\\/$/, '')}/`\n  return url\n}\n\nfunction isLoopback(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'\n}\n\nfunction jsonError(status: number, message: string): Response {\n  return Response.json(\n    { error: { code: status === 401 ? 'unauthorized' : 'invalid_request', message } },\n    { status, headers: { 'cache-control': 'no-store' } },\n  )\n}\n"],"mappings":";;;;AAGA,MAAM,sBAAsB;AAC5B,MAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AACD,MAAM,mBAAmB;;;;;AAiBzB,eAAsB,gCACpB,SACmB;CACnB,MAAM,SAAS,QAAQ,QAAQ,OAAO,YAAY;CAClD,IAAI,CAAC,cAAc,QAAQ,QAAQ,IAAI,GACrC,OAAO,UAAU,KAAK,qDAAqD;CAG7E,MAAM,gBAAgB,QAAQ,QAAQ,QAAQ,IAAI,eAAe;CACjE,IACE,kBAAkB,QAClB,cAAc,SAAS,QACvB,CAAC,iCAAiC,KAAK,aAAa,GAEpD,OAAO,UAAU,KAAK,uCAAuC;CAG/D,MAAM,eAAeA,kBAAAA,gCAAgC,UAAU,EAC7D,QAAQ,QAAQ,UAAU,IAAI,IAAI,QAAQ,QAAQ,GAAG,CAAC,CAAC,OACzD,CAAC;CACD,IAAI,CAAC,aAAa,SAChB,MAAM,IAAIC,cAAAA,qBAAqB,2CAA2C,aAAa,KAAK;CAG9F,MAAM,kBAAkB,aAAa,QAAQ,eAAe;CAC5D,MAAM,sBAAsB,QAAQ,SAAS,WAAW;CACxD,IAAI,wBAAwB,KAAA,GAC1B,MAAM,IAAIA,cAAAA,qBAAqB,sCAAsC;CAGvE,IAAI;CACJ,IAAI,WAAW,QAAQ;EACrB,MAAM,gBAAgB,OAAO,QAAQ,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,CAAC;EAC/E,IAAI,OAAO,SAAS,aAAa,KAAK,gBAAgB,kBACpD,OAAO,UAAU,KAAK,gCAAgC;EAExD,MAAM,QAAQ,MAAM,QAAQ,QAAQ,YAAY;EAChD,IAAI,MAAM,aAAa,kBACrB,OAAO,UAAU,KAAK,gCAAgC;EAExD,OAAO;CACT;CAEA,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,oBACf,IAAI,IAAI,QAAQ,KAAK,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG,GAAG,eAAe,GACvE;GACE;GACA,SAAS;IACP,QAAQ;IACR;IACA,QAAQ,aAAa,KAAK;IAC1B,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;GACrE;GACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;GACrC,OAAO;EACT,CACF;CACF,SAAS,OAAO;EACd,MAAM,IAAIC,cAAAA,sBAAsB,KAAK;CACvC;CAEA,OAAO,IAAI,SAAS,SAAS,MAAM;EACjC,QAAQ,SAAS;EACjB,SAAS;GACP,iBAAiB;GACjB,gBAAgB,SAAS,QAAQ,IAAI,cAAc,KAAK;EAC1D;CACF,CAAC;AACH;AAEA,SAAS,cAAc,QAAgB,MAAkC;CACvE,IACE,WAAW,SACX,KAAK,OAAO,QACZ,KAAK,OAAO,gBACX,KAAK,WAAW,KAAM,KAAK,WAAW,KAAK,KAAK,OAAO,WAExD,OAAO;CAET,IACE,KAAK,OAAO,QACZ,KAAK,OAAO,iBACZ,KAAK,OAAO,KAAA,KACZ,CAAC,oBAAoB,KAAK,KAAK,EAAE,GAEjC,OAAO;CAET,IAAI,WAAW,OAAO,OAAO,KAAK,WAAW;CAC7C,OACE,WAAW,UACX,KAAK,WAAW,KAChB,KAAK,OAAO,KAAA,KACZ,kBAAkB,IAAI,KAAK,EAAE;AAEjC;AAEA,SAAS,aAAa,OAAoB;CACxC,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,SAAS,OAAO;EACd,MAAM,IAAID,cAAAA,qBAAqB,mDAAmD,KAAK;CACzF;CACA,IAAI,IAAI,aAAa,YAAY,CAAC,WAAW,IAAI,QAAQ,GACvD,MAAM,IAAIA,cAAAA,qBACR,kEACF;CAEF,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,MAAM,IAAI,WAAW,MAAM,IAAI,SAAS,IAClF,MAAM,IAAIA,cAAAA,qBACR,8EACF;CAEF,IAAI,WAAW,GAAG,IAAI,SAAS,QAAQ,OAAO,EAAE,EAAE;CAClD,OAAO;AACT;AAEA,SAAS,WAAW,UAA2B;CAC7C,OAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAC9E;AAEA,SAAS,UAAU,QAAgB,SAA2B;CAC5D,OAAO,SAAS,KACd,EAAE,OAAO;EAAE,MAAM,WAAW,MAAM,iBAAiB;EAAmB;CAAQ,EAAE,GAChF;EAAE;EAAQ,SAAS,EAAE,iBAAiB,WAAW;CAAE,CACrD;AACF"}

package/dist/server.d.cts

@@ -0,0 +1,19 @@
+//#region src/server/connection-proxy.d.ts
+interface ForwardDomain0ConnectionRequestOptions {
+  request: Request;
+  /** Catch-all route segments after the same-origin Domain0 bridge. */
+  path: readonly string[];
+  /** Hosted Domain0 platform API root. */
+  upstreamBaseUrl: string;
+  /** Exact public origin that received the browser request. */
+  origin?: string;
+  fetch?: typeof globalThis.fetch;
+}
+/**
+ * Forwards only the browser-safe connection routes used by Domain0 Connect.
+ * Cookies, API keys, and unrelated headers are never forwarded.
+ */
+declare function forwardDomain0ConnectionRequest(options: ForwardDomain0ConnectionRequestOptions): Promise<Response>;
+//#endregion
+export { ForwardDomain0ConnectionRequestOptions, forwardDomain0ConnectionRequest };
+//# sourceMappingURL=server.d.cts.map

package/dist/server.d.mts

@@ -0,0 +1,19 @@
+//#region src/server/connection-proxy.d.ts
+interface ForwardDomain0ConnectionRequestOptions {
+  request: Request;
+  /** Catch-all route segments after the same-origin Domain0 bridge. */
+  path: readonly string[];
+  /** Hosted Domain0 platform API root. */
+  upstreamBaseUrl: string;
+  /** Exact public origin that received the browser request. */
+  origin?: string;
+  fetch?: typeof globalThis.fetch;
+}
+/**
+ * Forwards only the browser-safe connection routes used by Domain0 Connect.
+ * Cookies, API keys, and unrelated headers are never forwarded.
+ */
+declare function forwardDomain0ConnectionRequest(options: ForwardDomain0ConnectionRequestOptions): Promise<Response>;
+//#endregion
+export { ForwardDomain0ConnectionRequestOptions, forwardDomain0ConnectionRequest };
+//# sourceMappingURL=server.d.mts.map

package/dist/server.mjs

@@ -0,0 +1,102 @@
+import { IssueConnectionTokenInputSchema } from "./contracts.mjs";
+import { n as Domain0ProtocolError, r as Domain0TransportError } from "./error-Cyd6a9ay.mjs";
+//#region src/server/connection-proxy.ts
+const connectionIdPattern = /^[A-Za-z0-9_-]{1,200}$/;
+const connectionActions = /* @__PURE__ */ new Set([
+	"cancellation",
+	"change-application",
+	"change-plan",
+	"credential-authorization",
+	"dkim-guidance",
+	"domain-connect-completion",
+	"domain-connect-handoff",
+	"manual-completion",
+	"manual-configuration",
+	"oauth-authorization",
+	"plan-confirmation",
+	"propagation-verification",
+	"provider-detection",
+	"provider-selection",
+	"retry"
+]);
+const maximumBodyBytes = 1048576;
+/**
+* Forwards only the browser-safe connection routes used by Domain0 Connect.
+* Cookies, API keys, and unrelated headers are never forwarded.
+*/
+async function forwardDomain0ConnectionRequest(options) {
+	const method = options.request.method.toUpperCase();
+	if (!isAllowedPath(method, options.path)) return jsonError(404, "This route is not exposed by the connection bridge.");
+	const authorization = options.request.headers.get("authorization");
+	if (authorization === null || authorization.length > 8200 || !/^Bearer [A-Za-z0-9._~+\/-]+=*$/.test(authorization)) return jsonError(401, "A valid connection token is required.");
+	const originResult = IssueConnectionTokenInputSchema.safeParse({ origin: options.origin ?? new URL(options.request.url).origin });
+	if (!originResult.success) throw new Domain0ProtocolError("The connection bridge origin is invalid", originResult.error);
+	const upstreamBaseUrl = parseBaseUrl(options.upstreamBaseUrl);
+	const fetchImplementation = options.fetch ?? globalThis.fetch;
+	if (fetchImplementation === void 0) throw new Domain0ProtocolError("No fetch implementation is available");
+	let body;
+	if (method === "POST") {
+		const contentLength = Number(options.request.headers.get("content-length") ?? 0);
+		if (Number.isFinite(contentLength) && contentLength > maximumBodyBytes) return jsonError(413, "The request body is too large.");
+		const bytes = await options.request.arrayBuffer();
+		if (bytes.byteLength > maximumBodyBytes) return jsonError(413, "The request body is too large.");
+		body = bytes;
+	}
+	let upstream;
+	try {
+		upstream = await fetchImplementation(new URL(options.path.map(encodeURIComponent).join("/"), upstreamBaseUrl), {
+			method,
+			headers: {
+				accept: "application/json",
+				authorization,
+				origin: originResult.data.origin,
+				...body === void 0 ? {} : { "content-type": "application/json" }
+			},
+			...body === void 0 ? {} : { body },
+			cache: "no-store"
+		});
+	} catch (cause) {
+		throw new Domain0TransportError(cause);
+	}
+	return new Response(upstream.body, {
+		status: upstream.status,
+		headers: {
+			"cache-control": "no-store",
+			"content-type": upstream.headers.get("content-type") ?? "application/json"
+		}
+	});
+}
+function isAllowedPath(method, path) {
+	if (method === "GET" && path[0] === "v1" && path[1] === "providers" && (path.length === 2 || path.length === 3 && path[2] === "health")) return true;
+	if (path[0] !== "v1" || path[1] !== "connections" || path[2] === void 0 || !connectionIdPattern.test(path[2])) return false;
+	if (method === "GET") return path.length === 3;
+	return method === "POST" && path.length === 4 && path[3] !== void 0 && connectionActions.has(path[3]);
+}
+function parseBaseUrl(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch (error) {
+		throw new Domain0ProtocolError("Domain0 upstreamBaseUrl must be an absolute URL", error);
+	}
+	if (url.protocol !== "https:" && !isLoopback(url.hostname)) throw new Domain0ProtocolError("Domain0 upstreamBaseUrl must use HTTPS outside local development");
+	if (url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") throw new Domain0ProtocolError("Domain0 upstreamBaseUrl must not contain credentials, a query, or a fragment");
+	url.pathname = `${url.pathname.replace(/\/$/, "")}/`;
+	return url;
+}
+function isLoopback(hostname) {
+	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function jsonError(status, message) {
+	return Response.json({ error: {
+		code: status === 401 ? "unauthorized" : "invalid_request",
+		message
+	} }, {
+		status,
+		headers: { "cache-control": "no-store" }
+	});
+}
+//#endregion
+export { forwardDomain0ConnectionRequest };
+
+//# sourceMappingURL=server.mjs.map

package/dist/server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.mjs","names":[],"sources":["../src/server/connection-proxy.ts"],"sourcesContent":["import { IssueConnectionTokenInputSchema } from '../contracts'\nimport { Domain0ProtocolError, Domain0TransportError } from '../client/error'\n\nconst connectionIdPattern = /^[A-Za-z0-9_-]{1,200}$/\nconst connectionActions = new Set([\n  'cancellation',\n  'change-application',\n  'change-plan',\n  'credential-authorization',\n  'dkim-guidance',\n  'domain-connect-completion',\n  'domain-connect-handoff',\n  'manual-completion',\n  'manual-configuration',\n  'oauth-authorization',\n  'plan-confirmation',\n  'propagation-verification',\n  'provider-detection',\n  'provider-selection',\n  'retry',\n])\nconst maximumBodyBytes = 1_048_576\n\nexport interface ForwardDomain0ConnectionRequestOptions {\n  request: Request\n  /** Catch-all route segments after the same-origin Domain0 bridge. */\n  path: readonly string[]\n  /** Hosted Domain0 platform API root. */\n  upstreamBaseUrl: string\n  /** Exact public origin that received the browser request. */\n  origin?: string\n  fetch?: typeof globalThis.fetch\n}\n\n/**\n * Forwards only the browser-safe connection routes used by Domain0 Connect.\n * Cookies, API keys, and unrelated headers are never forwarded.\n */\nexport async function forwardDomain0ConnectionRequest(\n  options: ForwardDomain0ConnectionRequestOptions,\n): Promise<Response> {\n  const method = options.request.method.toUpperCase()\n  if (!isAllowedPath(method, options.path)) {\n    return jsonError(404, 'This route is not exposed by the connection bridge.')\n  }\n\n  const authorization = options.request.headers.get('authorization')\n  if (\n    authorization === null ||\n    authorization.length > 8200 ||\n    !/^Bearer [A-Za-z0-9._~+\\/-]+=*$/.test(authorization)\n  ) {\n    return jsonError(401, 'A valid connection token is required.')\n  }\n\n  const originResult = IssueConnectionTokenInputSchema.safeParse({\n    origin: options.origin ?? new URL(options.request.url).origin,\n  })\n  if (!originResult.success) {\n    throw new Domain0ProtocolError('The connection bridge origin is invalid', originResult.error)\n  }\n\n  const upstreamBaseUrl = parseBaseUrl(options.upstreamBaseUrl)\n  const fetchImplementation = options.fetch ?? globalThis.fetch\n  if (fetchImplementation === undefined) {\n    throw new Domain0ProtocolError('No fetch implementation is available')\n  }\n\n  let body: ArrayBuffer | undefined\n  if (method === 'POST') {\n    const contentLength = Number(options.request.headers.get('content-length') ?? 0)\n    if (Number.isFinite(contentLength) && contentLength > maximumBodyBytes) {\n      return jsonError(413, 'The request body is too large.')\n    }\n    const bytes = await options.request.arrayBuffer()\n    if (bytes.byteLength > maximumBodyBytes) {\n      return jsonError(413, 'The request body is too large.')\n    }\n    body = bytes\n  }\n\n  let upstream: Response\n  try {\n    upstream = await fetchImplementation(\n      new URL(options.path.map(encodeURIComponent).join('/'), upstreamBaseUrl),\n      {\n        method,\n        headers: {\n          accept: 'application/json',\n          authorization,\n          origin: originResult.data.origin,\n          ...(body === undefined ? {} : { 'content-type': 'application/json' }),\n        },\n        ...(body === undefined ? {} : { body }),\n        cache: 'no-store',\n      },\n    )\n  } catch (cause) {\n    throw new Domain0TransportError(cause)\n  }\n\n  return new Response(upstream.body, {\n    status: upstream.status,\n    headers: {\n      'cache-control': 'no-store',\n      'content-type': upstream.headers.get('content-type') ?? 'application/json',\n    },\n  })\n}\n\nfunction isAllowedPath(method: string, path: readonly string[]): boolean {\n  if (\n    method === 'GET' &&\n    path[0] === 'v1' &&\n    path[1] === 'providers' &&\n    (path.length === 2 || (path.length === 3 && path[2] === 'health'))\n  ) {\n    return true\n  }\n  if (\n    path[0] !== 'v1' ||\n    path[1] !== 'connections' ||\n    path[2] === undefined ||\n    !connectionIdPattern.test(path[2])\n  ) {\n    return false\n  }\n  if (method === 'GET') return path.length === 3\n  return (\n    method === 'POST' &&\n    path.length === 4 &&\n    path[3] !== undefined &&\n    connectionActions.has(path[3])\n  )\n}\n\nfunction parseBaseUrl(value: string): URL {\n  let url: URL\n  try {\n    url = new URL(value)\n  } catch (error) {\n    throw new Domain0ProtocolError('Domain0 upstreamBaseUrl must be an absolute URL', error)\n  }\n  if (url.protocol !== 'https:' && !isLoopback(url.hostname)) {\n    throw new Domain0ProtocolError(\n      'Domain0 upstreamBaseUrl must use HTTPS outside local development',\n    )\n  }\n  if (url.username !== '' || url.password !== '' || url.search !== '' || url.hash !== '') {\n    throw new Domain0ProtocolError(\n      'Domain0 upstreamBaseUrl must not contain credentials, a query, or a fragment',\n    )\n  }\n  url.pathname = `${url.pathname.replace(/\\/$/, '')}/`\n  return url\n}\n\nfunction isLoopback(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'\n}\n\nfunction jsonError(status: number, message: string): Response {\n  return Response.json(\n    { error: { code: status === 401 ? 'unauthorized' : 'invalid_request', message } },\n    { status, headers: { 'cache-control': 'no-store' } },\n  )\n}\n"],"mappings":";;;AAGA,MAAM,sBAAsB;AAC5B,MAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AACD,MAAM,mBAAmB;;;;;AAiBzB,eAAsB,gCACpB,SACmB;CACnB,MAAM,SAAS,QAAQ,QAAQ,OAAO,YAAY;CAClD,IAAI,CAAC,cAAc,QAAQ,QAAQ,IAAI,GACrC,OAAO,UAAU,KAAK,qDAAqD;CAG7E,MAAM,gBAAgB,QAAQ,QAAQ,QAAQ,IAAI,eAAe;CACjE,IACE,kBAAkB,QAClB,cAAc,SAAS,QACvB,CAAC,iCAAiC,KAAK,aAAa,GAEpD,OAAO,UAAU,KAAK,uCAAuC;CAG/D,MAAM,eAAe,gCAAgC,UAAU,EAC7D,QAAQ,QAAQ,UAAU,IAAI,IAAI,QAAQ,QAAQ,GAAG,CAAC,CAAC,OACzD,CAAC;CACD,IAAI,CAAC,aAAa,SAChB,MAAM,IAAI,qBAAqB,2CAA2C,aAAa,KAAK;CAG9F,MAAM,kBAAkB,aAAa,QAAQ,eAAe;CAC5D,MAAM,sBAAsB,QAAQ,SAAS,WAAW;CACxD,IAAI,wBAAwB,KAAA,GAC1B,MAAM,IAAI,qBAAqB,sCAAsC;CAGvE,IAAI;CACJ,IAAI,WAAW,QAAQ;EACrB,MAAM,gBAAgB,OAAO,QAAQ,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,CAAC;EAC/E,IAAI,OAAO,SAAS,aAAa,KAAK,gBAAgB,kBACpD,OAAO,UAAU,KAAK,gCAAgC;EAExD,MAAM,QAAQ,MAAM,QAAQ,QAAQ,YAAY;EAChD,IAAI,MAAM,aAAa,kBACrB,OAAO,UAAU,KAAK,gCAAgC;EAExD,OAAO;CACT;CAEA,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,oBACf,IAAI,IAAI,QAAQ,KAAK,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG,GAAG,eAAe,GACvE;GACE;GACA,SAAS;IACP,QAAQ;IACR;IACA,QAAQ,aAAa,KAAK;IAC1B,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;GACrE;GACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;GACrC,OAAO;EACT,CACF;CACF,SAAS,OAAO;EACd,MAAM,IAAI,sBAAsB,KAAK;CACvC;CAEA,OAAO,IAAI,SAAS,SAAS,MAAM;EACjC,QAAQ,SAAS;EACjB,SAAS;GACP,iBAAiB;GACjB,gBAAgB,SAAS,QAAQ,IAAI,cAAc,KAAK;EAC1D;CACF,CAAC;AACH;AAEA,SAAS,cAAc,QAAgB,MAAkC;CACvE,IACE,WAAW,SACX,KAAK,OAAO,QACZ,KAAK,OAAO,gBACX,KAAK,WAAW,KAAM,KAAK,WAAW,KAAK,KAAK,OAAO,WAExD,OAAO;CAET,IACE,KAAK,OAAO,QACZ,KAAK,OAAO,iBACZ,KAAK,OAAO,KAAA,KACZ,CAAC,oBAAoB,KAAK,KAAK,EAAE,GAEjC,OAAO;CAET,IAAI,WAAW,OAAO,OAAO,KAAK,WAAW;CAC7C,OACE,WAAW,UACX,KAAK,WAAW,KAChB,KAAK,OAAO,KAAA,KACZ,kBAAkB,IAAI,KAAK,EAAE;AAEjC;AAEA,SAAS,aAAa,OAAoB;CACxC,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,SAAS,OAAO;EACd,MAAM,IAAI,qBAAqB,mDAAmD,KAAK;CACzF;CACA,IAAI,IAAI,aAAa,YAAY,CAAC,WAAW,IAAI,QAAQ,GACvD,MAAM,IAAI,qBACR,kEACF;CAEF,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,MAAM,IAAI,WAAW,MAAM,IAAI,SAAS,IAClF,MAAM,IAAI,qBACR,8EACF;CAEF,IAAI,WAAW,GAAG,IAAI,SAAS,QAAQ,OAAO,EAAE,EAAE;CAClD,OAAO;AACT;AAEA,SAAS,WAAW,UAA2B;CAC7C,OAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAC9E;AAEA,SAAS,UAAU,QAAgB,SAA2B;CAC5D,OAAO,SAAS,KACd,EAAE,OAAO;EAAE,MAAM,WAAW,MAAM,iBAAiB;EAAmB;CAAQ,EAAE,GAChF;EAAE;EAAQ,SAAS,EAAE,iBAAiB,WAAW;CAAE,CACrD;AACF"}

package/dist/ui.cjs

@@ -0,0 +1,12 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_sdk = require("./sdk-C0q5dV-6.cjs");
+exports.applyWhiteLabel = require_sdk.applyWhiteLabel;
+exports.createDomain0 = require_sdk.createDomain0;
+exports.createDomain0Localizer = require_sdk.createDomain0Localizer;
+exports.domain0 = require_sdk.domain0;
+exports.domain0TranslatedLocales = require_sdk.domain0TranslatedLocales;
+exports.interpolateWhiteLabelCopy = require_sdk.interpolateWhiteLabelCopy;
+exports.localizedCopy = require_sdk.localizedCopy;
+exports.mountDomain0Connect = require_sdk.mountDomain0Connect;
+exports.mountDomain0ConnectionFlow = require_sdk.mountDomain0ConnectionFlow;
+exports.mountDomain0SharedFlow = require_sdk.mountDomain0SharedFlow;

package/dist/ui.d.cts

@@ -0,0 +1,286 @@
+import { Hi as PlanWarningCode, Kt as Domain0ErrorCode, Ut as Domain0Locale, pt as ProviderDetectionUnavailableReasonCode, xi as ConnectionState, y as Domain0WhiteLabel } from "./index-CtQn01os.cjs";
+import { C as Domain0RequestCloseEvent, E as mountDomain0Connect, S as Domain0ManualSetupDocumentationClickEvent, T as Domain0SharedFlowSentEvent, _ as Domain0ConnectStep, a as createDomain0, b as Domain0CreateSharedFlowRequest, c as mountDomain0SharedFlow, d as mountDomain0ConnectionFlow, f as Domain0ActiveConnection, g as Domain0ConnectOptions, h as Domain0ConnectController, i as Domain0SDK, l as Domain0ConnectionFlowController, m as Domain0ConnectCloseReason, n as Domain0ConnectDomainsOptions, o as domain0, p as Domain0ConnectCloseEvent, r as Domain0LoadSharedFlowOptions, s as Domain0SharedFlowOptions, t as Domain0ConnectDomainOptions, u as Domain0ConnectionFlowOptions, v as Domain0ConnectStepChangeEvent, w as Domain0SharedFlowGateway, x as Domain0DkimSetupDocumentationClickEvent, y as Domain0ConnectSuccessEvent } from "./sdk-BKtsupNk.cjs";
+//#region src/ui/localization.d.ts
+declare const englishMessages: {
+  readonly triggerConnectDomain: "Connect domain";
+  readonly headingConnectDomain: "Connect your domain";
+  readonly headingConnectDomains: "Connect your domains";
+  readonly initialSubtitle: "Choose your DNS provider. Domain0 will show the verified connection path available for it.";
+  readonly cancelConnection: "Cancel connection";
+  readonly close: "Close";
+  readonly loadingConnection: "Loading connection details…";
+  readonly detectingProvider: "Detecting your DNS provider…";
+  readonly detectionUnavailable: "Automatic provider detection is temporarily unavailable. Choose your DNS provider below.";
+  readonly connectionStatus: (state: string) => string;
+  readonly manualInstructionsReady: "Guided manual DNS instructions are ready.";
+  readonly forcedManualBlocked: "This connection already entered an automatic provider workflow. Forced manual mode will not resume or advance it. Cancel this connection and create a new manual connection.";
+  readonly forcedManualIncompatible: "The existing connection is incompatible with forced manual setup";
+  readonly missingConfirmationPlan: "The server returned a confirmation state without a change plan";
+  readonly missingApplyingPlan: "The server returned an applying state without a confirmed plan";
+  readonly missingFailureDetails: "The server returned a retryable state without failure details";
+  readonly successDescription: (domain: string) => string;
+  readonly dkimHeading: "Secure outgoing email with DKIM";
+  readonly dkimCheckingProvider: "Checking public MX and selector-specific DKIM DNS records…";
+  readonly dkimGuidanceUnavailable: "Email-provider detection is temporarily unavailable. No DNS changes were made.";
+  readonly dkimDomainMismatch: "The server returned DKIM guidance for a different domain";
+  readonly dkimProviderDetected: (provider: string) => string;
+  readonly dkimProviderAmbiguous: "MX records point to more than one supported email provider. Review the mail routing before changing DKIM.";
+  readonly dkimProviderUnknown: "Domain0 could not identify Google Workspace, Microsoft 365, or Zoho Mail from the public MX records.";
+  readonly dkimRecordObserved: (selectors: string) => string;
+  readonly dkimNoRecordObserved: (selectors: string) => string;
+  readonly dkimNotChecked: "This provider uses an account-defined DKIM selector, so no selector record was checked automatically.";
+  readonly dkimLookupUnavailable: "The selector-specific DKIM DNS check was temporarily unavailable.";
+  readonly dkimEvidenceBoundary: "A published DNS record does not prove that outgoing mail is being signed. Verify the final DKIM status in the email provider admin.";
+  readonly dkimOpenGuide: (provider: string) => string;
+  readonly cancelledDescription: (domain: string) => string;
+  readonly selectedProvider: (provider: string, support: string) => string;
+  readonly currentState: (state: string) => string;
+  readonly refreshConnection: "Refresh connection";
+  readonly domainConnectHeading: "Connect through Domain Connect";
+  readonly domainConnectGuidance: "Your DNS provider will show the exact service template and ask for consent before applying it.";
+  readonly domainConnectResumeUnavailable: "This host application must provide the same Domain Connect service template to resume this handoff.";
+  readonly domainConnectUnavailable: "This host application has not configured its Domain Connect service template. Guided manual setup remains available.";
+  readonly continueSecurely: (provider: string) => string;
+  readonly continueSecurelyNewTab: (provider: string) => string;
+  readonly completedDomainConnect: "I completed Domain Connect";
+  readonly preparingAuthoritativeVerification: "Preparing authoritative DNS verification…";
+  readonly readyToVerifyPropagation: "Ready to verify DNS propagation.";
+  readonly resumeDomainConnect: (provider: string) => string;
+  readonly connectWithProvider: (provider: string) => string;
+  readonly checkingDomainConnectTemplate: "Checking that your DNS provider supports this exact service template…";
+  readonly domainConnectReady: "Domain Connect is ready. Continue with your DNS provider in a new tab.";
+  readonly followProviderGuide: (provider: string) => string;
+  readonly openApplicationManualSetupGuide: "Open this application's step-by-step DNS guide";
+  readonly requestManualSetupHelp: "Get step-by-step DNS help";
+  readonly openProviderReference: (provider: string) => string;
+  readonly opensInNewTab: (label: string) => string;
+  readonly sharedFlowHeading: "Ask someone else to finish setup";
+  readonly sharedFlowGuidance: "Copy a time-limited link for a trusted person who can update this domain. The link grants access only to this connection.";
+  readonly copySecureSetupLink: "Copy secure setup link";
+  readonly creatingSecureSetupLink: "Creating a secure setup link…";
+  readonly secureSetupLinkCopied: "Secure setup link copied.";
+  readonly copySetupLinkAgain: "Copy setup link again";
+  readonly expiredSharedFlow: "The host returned an expired shared-flow invitation";
+  readonly clipboardUnavailable: "Clipboard access is unavailable; configure sharedFlowGateway.copy";
+  readonly oauthHeading: "Authorize securely with the provider";
+  readonly oauthGuidance: "Domain0 uses OAuth with PKCE. Your provider password is never shared with Domain0.";
+  readonly continueToProvider: (provider: string) => string;
+  readonly authorizationExpires: "This authorization link expires at {DATE}.";
+  readonly completedAuthorization: "I completed authorization";
+  readonly resumeAuthorization: (provider: string) => string;
+  readonly authorizeWithProvider: (provider: string) => string;
+  readonly authorizeProviderCredentials: (provider: string) => string;
+  readonly preparingAuthorizationLink: "Preparing a secure provider authorization link…";
+  readonly authorizationLinkReady: "Authorization link ready. Continue with the provider in a new tab.";
+  readonly credentialGuidance: "Use a minimally scoped provider credential. Domain0 encrypts it server-side and never returns it to the browser.";
+  readonly credentialHeadingApiToken: "Authorize with an API token";
+  readonly credentialHeadingAccessKey: "Authorize with API keys";
+  readonly credentialHeadingUsernamePassword: "Authorize with provider credentials";
+  readonly credentialHeadingAccountToken: "Authorize with an account token";
+  readonly credentialHeadingUsernameToken: "Authorize with a user token";
+  readonly credentialHeadingOvh: "Authorize with OVH API credentials";
+  readonly credentialHeadingPrivateKey: "Authorize with a private key";
+  readonly credentialHeadingAwsSession: "Authorize with a temporary AWS session";
+  readonly credentialHeadingCpanel: "Authorize with a cPanel API token";
+  readonly credentialHeadingClientCredentials: "Authorize with OpenSRS Storefront credentials";
+  readonly fieldApiToken: "API token";
+  readonly fieldAccessKeyId: "Access key ID";
+  readonly fieldApiSecret: "API secret";
+  readonly fieldUsername: "Username";
+  readonly fieldPassword: "Password";
+  readonly fieldAccountId: "Account ID";
+  readonly fieldOvhRegion: "OVH API region";
+  readonly fieldApplicationKey: "Application key";
+  readonly fieldApplicationSecret: "Application secret";
+  readonly fieldConsumerKey: "Consumer key";
+  readonly fieldProviderLogin: "Provider login";
+  readonly fieldPemPrivateKey: "PEM private key";
+  readonly fieldAwsAccessKeyId: "AWS access key ID";
+  readonly fieldAwsSecretAccessKey: "AWS secret access key";
+  readonly fieldAwsSessionToken: "AWS session token";
+  readonly fieldRoute53ZoneId: "Route 53 hosted zone ID";
+  readonly fieldSessionExpiration: "Session expiration";
+  readonly fieldCpanelEndpoint: "cPanel HTTPS endpoint";
+  readonly fieldCpanelUsername: "cPanel username";
+  readonly fieldCpanelApiToken: "cPanel API token";
+  readonly fieldStorefrontClientId: "Storefront client ID";
+  readonly fieldStorefrontClientSecret: "Storefront client secret";
+  readonly regionOvhEurope: "OVH Europe";
+  readonly regionOvhUnitedStates: "OVH United States";
+  readonly regionOvhCanada: "OVH Canada";
+  readonly regionKimsufiEurope: "Kimsufi Europe";
+  readonly regionKimsufiCanada: "Kimsufi Canada";
+  readonly regionSoYouStartEurope: "So You Start Europe";
+  readonly regionSoYouStartCanada: "So You Start Canada";
+  readonly authorizeApiToken: "Authorize API token";
+  readonly encryptingAuthorization: "Encrypting and validating provider authorization…";
+  readonly authorizationCompleted: "Provider authorization completed.";
+  readonly existingRecordPolicy: "Existing DNS record policy";
+  readonly existingRecordPolicyHelp: "Preserve is safest. Replacement policies may propose destructive changes that require separate confirmation.";
+  readonly preserveExistingRecords: "Preserve existing records";
+  readonly replaceSameNameAndType: "Replace records with the same host and type";
+  readonly replaceAllAtName: "Replace all conflicting records at the host";
+  readonly replaceSpf: "Replace an existing SPF policy instead of merging it";
+  readonly replaceSpfHelp: "Merging is the safe default. Replacement removes the provider's current SPF mechanisms and always requires destructive-change confirmation.";
+  readonly readingRecords: "Reading current provider records and preparing a change plan…";
+  readonly recordsAlreadyExist: "The required DNS records already exist. Ready to verify propagation.";
+  readonly reviewChanges: "Review the proposed DNS changes before confirmation.";
+  readonly reviewDnsChanges: "Review DNS changes";
+  readonly recalculateChangePlan: "Recalculate change plan";
+  readonly proposedChangesRegion: "Proposed DNS changes";
+  readonly proposedChangesCaption: (domain: string) => string;
+  readonly columnAction: "Action";
+  readonly columnCurrentRecord: "Current record";
+  readonly columnResultingRecord: "Resulting record";
+  readonly columnRisk: "Risk";
+  readonly changeCreate: "Create";
+  readonly changeUpdate: "Update";
+  readonly changeDelete: "Delete";
+  readonly destructive: "Destructive";
+  readonly nonDestructive: "Non-destructive";
+  readonly planWarnings: "Plan warnings";
+  readonly planWarningSpfPolicyReplaced: "The existing SPF policy will be replaced by the requested SPF policy.";
+  readonly planWarningSpfPolicyMerged: "The existing SPF policy was merged into the requested SPF record.";
+  readonly planExpires: "This plan expires at {DATE}.";
+  readonly destructiveAcknowledgement: "I understand that the marked existing DNS records will be replaced or deleted.";
+  readonly confirmChangePlan: "Confirm change plan";
+  readonly confirmingChangePlan: "Confirming this exact change plan…";
+  readonly planConfirmed: "Plan confirmed. DNS changes have not been applied yet.";
+  readonly applyDnsChanges: "Apply DNS changes";
+  readonly applyingDnsChanges: "Applying the confirmed DNS changes…";
+  readonly dnsChangesApplied: "DNS changes were applied. Ready to verify authoritative propagation.";
+  readonly detectionReasonNoStablePublicProviderIdentity: "This provider does not publish a stable public identity that Domain0 can safely detect from DNS.";
+  readonly manualGuidance: "Use guided manual setup to add the exact required DNS records without sharing provider credentials.";
+  readonly manualSetupUnavailableHeading: "Manual setup unavailable";
+  readonly manualSetupUnavailableDescription: "Manual DNS setup is disabled by this application. Use another available verified path, or cancel or close this connection.";
+  readonly showDnsRecords: "Show DNS records";
+  readonly preparingDnsInstructions: "Preparing DNS instructions…";
+  readonly dnsInstructionsReady: "DNS instructions are ready.";
+  readonly addResolvedRecords: "Add these resolved records in your DNS provider, then continue.";
+  readonly authoritativeRecordGuidance: "These are the records Domain0 checks directly on every authoritative nameserver.";
+  readonly dnsRecordsRegion: "DNS records";
+  readonly dnsRecordsCaption: (domain: string) => string;
+  readonly thisDomain: "this domain";
+  readonly columnType: "Type";
+  readonly columnHost: "Host";
+  readonly columnValue: "Value";
+  readonly columnTtl: "TTL";
+  readonly columnPriority: "Priority";
+  readonly columnRequirement: "Requirement";
+  readonly optional: "Optional";
+  readonly required: "Required";
+  readonly noRecordChanges: "The existing DNS policy satisfies this request. No DNS record changes are required.";
+  readonly addedRecords: "I added these records";
+  readonly continue: "Continue";
+  readonly savingConfirmation: "Saving your confirmation…";
+  readonly verifyDnsRecords: "Verify DNS records";
+  readonly finishConnection: "Finish connection";
+  readonly checkingNameservers: "Checking authoritative nameservers…";
+  readonly requiredRecordsActive: "Required DNS records are active.";
+  readonly propagationPending: "DNS changes have not reached every authoritative nameserver yet. You can check again.";
+  readonly providerFailureHeading: "Provider operation needs attention";
+  readonly snapshotTimeout: "Domain0 timed out while reading provider DNS records. No DNS changes were made. Retry restores the prior review step so you can request a fresh snapshot.";
+  readonly applyTimeout: "The provider did not confirm the DNS update before the deadline, so the outcome is ambiguous. Retry restores the confirmed application step; Domain0 reconciles current provider records before another write.";
+  readonly timeoutRecorded: "The timeout was recorded at {DATE}.";
+  readonly retryConnection: "Retry connection";
+  readonly restoringConnection: "Restoring the connection to its pre-failure state…";
+  readonly connectionRestored: (state: string) => string;
+  readonly cancelHeading: "Cancel this connection?";
+  readonly cancelGuidance: "Cancellation stops this Domain0 workflow. It does not remove DNS records that were already applied.";
+  readonly keepConnection: "Keep connection";
+  readonly confirmCancellation: "Confirm cancellation";
+  readonly cancellingConnection: "Cancelling connection…";
+  readonly connectionCancelled: "Connection cancelled.";
+  readonly dnsProvider: "DNS provider";
+  readonly providerHelp: "Select the company where you manage DNS records for this domain.";
+  readonly detectedProviderHelp: "Domain0 found possible providers from public DNS information. Confirm the company where you manage DNS records.";
+  readonly chooseProvider: "Choose a provider";
+  readonly suggestedFromDns: "Suggested from DNS";
+  readonly allOtherProviders: "All other providers";
+  readonly continueWithProvider: "Continue with provider";
+  readonly savingProviderSelection: "Saving provider selection…";
+  readonly preparingProviderSelection: "Preparing provider selection…";
+  readonly providerDetected: (provider: string) => string;
+  readonly providerSelected: (provider: string) => string;
+  readonly preparingManualInstructions: "Preparing guided manual DNS instructions…";
+  readonly manualSetupNotEntered: "The server did not enter guided manual setup";
+  readonly noProviderDetected: "No provider was identified automatically. Choose your DNS provider below.";
+  readonly possibleProviderFound: "1 possible DNS provider was found. Confirm your provider below.";
+  readonly possibleProvidersFound: (count: string) => string;
+  readonly supportAutomatic: "automatic";
+  readonly supportDomainConnect: "Domain Connect";
+  readonly supportManual: "guided manual";
+  readonly supportUnverified: "not yet verified";
+  readonly supportAutomaticDescription: "Its automatic adapter is verified; guided manual setup is also available.";
+  readonly supportDomainConnectDescription: "Its Domain Connect path is verified; guided manual setup is also available.";
+  readonly supportManualDescription: "Its guided manual path is verified.";
+  readonly supportUnverifiedDescription: "Provider-specific automation is not verified; guided manual setup remains available.";
+  readonly recordSummary: (type: string, host: string, value: string, ttl: string, priority: string) => string;
+  readonly recordPriority: (priority: string) => string;
+  readonly errorPrefix: (message: string) => string;
+  readonly unknownError: "Unknown error";
+  readonly transportError: "Domain0 could not be reached. Check your connection and try again.";
+  readonly protocolError: "Domain0 returned an invalid response. Try again or contact the application operator.";
+  readonly apiErrorInvalidRequest: "The request is invalid.";
+  readonly apiErrorUnauthorized: "Authentication failed. Reopen the connection flow and try again.";
+  readonly apiErrorForbidden: "You are not allowed to perform this operation.";
+  readonly apiErrorNotFound: "The requested connection resource was not found or has expired.";
+  readonly apiErrorConflict: "The connection changed before this operation completed. Refresh and try again.";
+  readonly apiErrorRateLimited: "Too many requests were made. Wait briefly and try again.";
+  readonly apiErrorDnsUnavailable: "Authoritative DNS is temporarily unavailable. Try again.";
+  readonly apiErrorProviderUnavailable: "The DNS provider is temporarily unavailable. Try again.";
+  readonly apiErrorProviderAuthorizationFailed: "The DNS provider authorization failed or expired.";
+  readonly apiErrorProviderLimitation: "The selected provider cannot complete this operation automatically.";
+  readonly apiErrorPlanExpired: "The DNS change plan expired. Prepare and review a new plan.";
+  readonly apiErrorPropagationPending: "The DNS changes have not reached every authoritative nameserver yet.";
+  readonly apiErrorInternal: "Domain0 encountered an unexpected error. Try again.";
+  readonly loadingFlow: "Loading domain connection flow…";
+  readonly flowNotReady: "Domain connections are still being prepared. Reopen this flow to retry.";
+  readonly flowStep: (index: string, domain: string) => string;
+  readonly flowStepConnected: (index: string, domain: string) => string;
+  readonly allDomainsConnected: (count: string) => string;
+  readonly domainProgress: (index: string, total: string, domain: string) => string;
+  readonly connectionStateRequested: "requested";
+  readonly connectionStateDetectingProvider: "detecting provider";
+  readonly connectionStateProviderSelected: "provider selected";
+  readonly connectionStateDomainConnectPending: "Domain Connect pending";
+  readonly connectionStateAuthorizationPending: "authorization pending";
+  readonly connectionStateAuthorized: "authorized";
+  readonly connectionStatePlanning: "planning";
+  readonly connectionStateAwaitingConfirmation: "awaiting confirmation";
+  readonly connectionStateApplying: "applying";
+  readonly connectionStatePropagationPending: "propagation pending";
+  readonly connectionStateActive: "active";
+  readonly connectionStateManualRequired: "manual setup required";
+  readonly connectionStateFailedRetryable: "temporarily failed";
+  readonly connectionStateFailedTerminal: "failed";
+  readonly connectionStateCancelled: "cancelled";
+};
+type WidenMessage<T> = T extends ((...arguments_: infer Arguments) => string) ? (...arguments_: Arguments) => string : string;
+type Domain0Messages = { readonly [Key in keyof typeof englishMessages]: WidenMessage<(typeof englishMessages)[Key]>; };
+declare const domain0TranslatedLocales: readonly ["en", "es", "pt-br", "pt-pt", "fr", "de"];
+type Domain0TranslatedLocale = (typeof domain0TranslatedLocales)[number];
+interface Domain0Localizer {
+  readonly locale: Domain0Locale;
+  readonly translatedLocale: Domain0TranslatedLocale;
+  readonly languageTag: string;
+  readonly direction: 'ltr';
+  readonly messages: Domain0Messages;
+  formatInteger(value: number): string;
+  formatDateTime(value: string): string;
+  connectionState(state: ConnectionState): string;
+  providerDetectionReason(code: ProviderDetectionUnavailableReasonCode): string;
+  planWarning(code: PlanWarningCode): string;
+  apiError(code: Domain0ErrorCode): string;
+}
+declare function createDomain0Localizer(input?: unknown): Domain0Localizer;
+declare function localizedCopy(copy: Readonly<{
+  en: string;
+} & Partial<Record<Domain0Locale, string | undefined>>> | undefined, locale: Domain0Locale): string | undefined;
+//#endregion
+//#region src/ui/white-label.d.ts
+declare function applyWhiteLabel(root: HTMLElement, whiteLabel: Domain0WhiteLabel): void;
+declare function interpolateWhiteLabelCopy(template: string, replacements: Readonly<Record<string, string>>): string;
+//#endregion
+export { Domain0ActiveConnection, Domain0ConnectCloseEvent, Domain0ConnectCloseReason, Domain0ConnectController, Domain0ConnectDomainOptions, Domain0ConnectDomainsOptions, Domain0ConnectOptions, Domain0ConnectStep, Domain0ConnectStepChangeEvent, Domain0ConnectSuccessEvent, Domain0ConnectionFlowController, Domain0ConnectionFlowOptions, Domain0CreateSharedFlowRequest, Domain0DkimSetupDocumentationClickEvent, Domain0LoadSharedFlowOptions, Domain0Localizer, Domain0ManualSetupDocumentationClickEvent, Domain0Messages, Domain0RequestCloseEvent, Domain0SDK, Domain0SharedFlowGateway, Domain0SharedFlowOptions, Domain0SharedFlowSentEvent, Domain0TranslatedLocale, applyWhiteLabel, createDomain0, createDomain0Localizer, domain0, domain0TranslatedLocales, interpolateWhiteLabelCopy, localizedCopy, mountDomain0Connect, mountDomain0ConnectionFlow, mountDomain0SharedFlow };
+//# sourceMappingURL=ui.d.cts.map