domain0 0.1.0

package/dist/contracts.mjs

@@ -0,0 +1,1627 @@
+import { z } from "zod";
+//#region src/contracts/primitives.ts
+const identifier = z.string().trim().min(1).max(200);
+const ConnectionIdSchema = identifier.brand().meta({ id: "ConnectionId" });
+const ApplicationIdSchema = identifier.brand().meta({ id: "ApplicationId" });
+const TenantIdSchema = identifier.brand().meta({ id: "TenantId" });
+const ProviderIdSchema = z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).brand().meta({ id: "ProviderId" });
+const CommandIdSchema = identifier.brand().meta({ id: "CommandId" });
+const DomainNameSchema = z.string().trim().toLowerCase().overwrite((value) => value.replace(/\.$/, "")).min(3).max(253).regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/).refine((value) => !/^\d+(?:\.\d+){3}$/.test(value), "IP addresses are not domain names").brand().meta({ id: "DomainName" });
+const IsoDateTimeSchema = z.iso.datetime({ offset: true }).meta({ id: "IsoDateTime" });
+//#endregion
+//#region src/contracts/dns.ts
+const RelativeDnsHostSchema = z.string().trim().toLowerCase().overwrite((value) => value.replace(/\.$/, "")).min(1).max(253).refine(isRelativeDnsHost, "Host must be @ or a valid relative DNS name");
+const caaValuePattern = /^([0-9]{1,3})[\t ]+([A-Za-z0-9-]{1,15})[\t ]+(?:"([^\r\n"]*)"|([^\r\n"]+))$/;
+const DnsRecordTypeSchema = z.enum([
+	"A",
+	"AAAA",
+	"CNAME",
+	"CAA",
+	"MX",
+	"TXT",
+	"NS"
+]).meta({ id: "DnsRecordType" });
+const DmarcTagNameSchema = z.string().regex(/^[a-z]{1,32}$/);
+const DmarcTagValueSchema = z.string().min(1).max(4096).refine((value) => value.trim() === value && /^[\x20-\x3a\x3c-\x7e]+$/.test(value), { message: "DMARC tag values must be trimmed printable ASCII without semicolons" });
+const DmarcTagMapSchema = z.record(DmarcTagNameSchema, DmarcTagValueSchema).refine((tags) => Object.keys(tags).length <= 32, "At most 32 DMARC tags are allowed");
+const AdvancedDmarcOptionsSchema = z.object({
+	inheritRootDmarc: z.boolean().default(false),
+	overrideTags: DmarcTagMapSchema.default({}),
+	removeTags: z.array(DmarcTagNameSchema).max(32).refine((tags) => new Set(tags).size === tags.length, "DMARC tags to remove must be unique").default([]),
+	addTagsIfNotExist: DmarcTagMapSchema.default({})
+}).strict().refine((options) => options.inheritRootDmarc || Object.keys(options.overrideTags).length > 0 || options.removeTags.length > 0 || Object.keys(options.addTagsIfNotExist).length > 0, "At least one advanced DMARC option is required").superRefine((options, context) => {
+	for (const [field, tags] of [["overrideTags", options.overrideTags], ["addTagsIfNotExist", options.addTagsIfNotExist]]) for (const [name, value] of Object.entries(tags)) if (!isValidKnownDmarcTag(name, value)) context.addIssue({
+		code: "custom",
+		path: [field, name],
+		message: `Invalid value for the ${name} DMARC tag`
+	});
+}).meta({ id: "AdvancedDmarcOptions" });
+const CoreDnsRecordSchema = z.object({
+	host: RelativeDnsHostSchema,
+	type: DnsRecordTypeSchema,
+	value: z.string().trim().min(1).max(65535),
+	ttl: z.number().int().min(1).max(2147483647).default(300),
+	priority: z.number().int().min(0).max(65535).optional(),
+	optional: z.boolean().default(false)
+}).strict().superRefine((record, context) => {
+	if (record.type === "MX" && record.priority === void 0) context.addIssue({
+		code: "custom",
+		path: ["priority"],
+		message: "MX records require a priority"
+	});
+	if (record.type !== "MX" && record.priority !== void 0) context.addIssue({
+		code: "custom",
+		path: ["priority"],
+		message: "Only MX records accept a priority"
+	});
+	if (record.type === "A" && !z.ipv4().safeParse(record.value).success) context.addIssue({
+		code: "custom",
+		path: ["value"],
+		message: "A records require an IPv4 address"
+	});
+	if (record.type === "AAAA" && !z.ipv6().safeParse(record.value).success) context.addIssue({
+		code: "custom",
+		path: ["value"],
+		message: "AAAA records require an IPv6 address"
+	});
+	if ([
+		"CNAME",
+		"MX",
+		"NS"
+	].includes(record.type) && !DomainNameSchema.safeParse(record.value).success) context.addIssue({
+		code: "custom",
+		path: ["value"],
+		message: `${record.type} records require a domain name`
+	});
+	if (record.type === "CAA") {
+		const match = caaValuePattern.exec(record.value);
+		if (match === null || Number(match[1]) > 255) context.addIssue({
+			code: "custom",
+			path: ["value"],
+			message: "CAA values must contain flags, a tag, and a quoted value"
+		});
+	}
+	if (record.type === "TXT" && /[\u0000\r\n]/.test(record.value)) context.addIssue({
+		code: "custom",
+		path: ["value"],
+		message: "TXT values cannot contain NUL or newlines"
+	});
+});
+const ResolvedDnsRecordSchema = CoreDnsRecordSchema.meta({ id: "ResolvedDnsRecord" });
+const DnsRecordSchema = CoreDnsRecordSchema.safeExtend({ advancedDmarcOptions: AdvancedDmarcOptionsSchema.optional() }).superRefine((record, context) => {
+	if (record.advancedDmarcOptions === void 0) return;
+	if (record.type !== "TXT" || record.host !== "_dmarc" && !record.host.startsWith("_dmarc.")) context.addIssue({
+		code: "custom",
+		path: ["advancedDmarcOptions"],
+		message: "Advanced DMARC options require a TXT record at a _dmarc host"
+	});
+	if (!isValidDmarcRecord(record.value)) context.addIssue({
+		code: "custom",
+		path: ["value"],
+		message: "Advanced DMARC options require a valid DMARC1 value with a policy tag"
+	});
+}).meta({ id: "DnsRecord" });
+const ExistingRecordPolicySchema = z.object({
+	validateDmarc: z.boolean().default(false),
+	validateCAA: z.boolean().default(false)
+}).strict().meta({ id: "ExistingRecordPolicy" });
+const DnsIntentSchema = z.object({
+	domain: DomainNameSchema,
+	records: z.array(DnsRecordSchema).min(1).max(100),
+	existingRecordPolicy: ExistingRecordPolicySchema.default({
+		validateDmarc: false,
+		validateCAA: false
+	})
+}).strict().meta({ id: "DnsIntent" });
+const ResolvedDnsIntentSchema = z.object({
+	domain: DomainNameSchema,
+	records: z.array(ResolvedDnsRecordSchema).max(100)
+}).strict().meta({ id: "ResolvedDnsIntent" });
+const CheckRecordsInputSchema = ResolvedDnsIntentSchema.meta({ id: "CheckRecordsInput" });
+const CheckedRecordSchema = z.object({
+	record: ResolvedDnsRecordSchema,
+	authoritativeServers: z.number().int().min(1).max(16),
+	matchingServers: z.number().int().min(0).max(16),
+	propagated: z.boolean()
+}).strict().superRefine((result, context) => {
+	if (result.matchingServers > result.authoritativeServers) context.addIssue({
+		code: "custom",
+		path: ["matchingServers"],
+		message: "Matching nameservers cannot exceed authoritative nameservers"
+	});
+	if (result.propagated !== (result.matchingServers === result.authoritativeServers)) context.addIssue({
+		code: "custom",
+		path: ["propagated"],
+		message: "Propagation state must match the authoritative nameserver counts"
+	});
+}).meta({ id: "CheckedRecord" });
+const CheckRecordsResponseSchema = z.object({
+	domain: DomainNameSchema,
+	allPropagated: z.boolean(),
+	records: z.array(CheckedRecordSchema).min(1).max(100)
+}).strict().superRefine((result, context) => {
+	if (result.allPropagated !== result.records.every((record) => record.propagated)) context.addIssue({
+		code: "custom",
+		path: ["allPropagated"],
+		message: "Overall propagation state must match every record result"
+	});
+}).meta({ id: "CheckRecordsResponse" });
+const ConflictPolicySchema = z.enum([
+	"preserve",
+	"replace_same_name_and_type",
+	"replace_all_at_name"
+]).meta({ id: "ConflictPolicy" });
+const SpfConflictPolicySchema = z.enum(["merge", "replace"]).meta({ id: "SpfConflictPolicy" });
+const ChangeActionSchema = z.enum([
+	"create",
+	"replace",
+	"delete"
+]).meta({ id: "ChangeAction" });
+const PlannedChangeSchema = z.object({
+	action: ChangeActionSchema,
+	before: ResolvedDnsRecordSchema.optional(),
+	after: ResolvedDnsRecordSchema.optional(),
+	destructive: z.boolean()
+}).strict().superRefine((change, context) => {
+	if (change.action === "create" && change.after === void 0) context.addIssue({
+		code: "custom",
+		path: ["after"],
+		message: "Create requires the resulting record"
+	});
+	if (change.action === "replace" && (change.before === void 0 || change.after === void 0)) context.addIssue({
+		code: "custom",
+		message: "Replace requires both current and resulting records"
+	});
+	if (change.action === "delete" && change.before === void 0) context.addIssue({
+		code: "custom",
+		path: ["before"],
+		message: "Delete requires the current record"
+	});
+}).meta({ id: "PlannedChange" });
+function isRelativeDnsHost(value) {
+	if (value === "@") return true;
+	return value.split(".").every((label, index) => {
+		if (label === "*") return index === 0;
+		return label.length >= 1 && label.length <= 63 && !label.startsWith("-") && !label.endsWith("-") && /^[a-z0-9_-]+$/.test(label);
+	});
+}
+function isValidDmarcRecord(value) {
+	const parts = value.split(";").map((part) => part.trim()).filter(Boolean);
+	const seen = /* @__PURE__ */ new Set();
+	if (parts.length < 2) return false;
+	for (const [index, part] of parts.entries()) {
+		const separator = part.indexOf("=");
+		if (separator <= 0) return false;
+		const name = part.slice(0, separator).trim().toLowerCase();
+		const tagValue = part.slice(separator + 1).trim();
+		if (!DmarcTagNameSchema.safeParse(name).success || !DmarcTagValueSchema.safeParse(tagValue).success || seen.has(name)) return false;
+		if (index === 0 && (name !== "v" || tagValue !== "DMARC1")) return false;
+		if (!isValidKnownDmarcTag(name, tagValue)) return false;
+		seen.add(name);
+	}
+	return seen.has("p");
+}
+function isValidKnownDmarcTag(name, value) {
+	if (name === "v") return value === "DMARC1";
+	if ([
+		"p",
+		"sp",
+		"np"
+	].includes(name)) return [
+		"none",
+		"quarantine",
+		"reject"
+	].includes(value);
+	if (["adkim", "aspf"].includes(name)) return value === "r" || value === "s";
+	if (name === "pct") return /^\d{1,3}$/.test(value) && Number(value) <= 100;
+	if (name === "ri") return /^[1-9]\d*$/.test(value);
+	if (name === "rf") return value === "afrf";
+	if (name === "fo") {
+		const options = value.split(":");
+		return options.length > 0 && new Set(options).size === options.length && options.every((option) => [
+			"0",
+			"1",
+			"d",
+			"s"
+		].includes(option)) && !(options.includes("0") && options.includes("1"));
+	}
+	return true;
+}
+//#endregion
+//#region src/contracts/provider.ts
+const ProviderImplementationSchema = z.enum([
+	"automatic",
+	"domain_connect",
+	"manual",
+	"unverified"
+]).meta({ id: "ProviderImplementation" });
+const AuthorizationMethodSchema = z.enum([
+	"oauth2_pkce",
+	"api_token",
+	"api_key",
+	"basic",
+	"session",
+	"domain_connect",
+	"manual"
+]).meta({ id: "AuthorizationMethod" });
+const ProviderCapabilitiesSchema = z.strictObject({ rootNSModification: z.enum([
+	"supported",
+	"unsupported",
+	"unverified"
+]) }).meta({ id: "ProviderCapabilities" });
+const ProviderDetectionUnavailableReasonCodeSchema = z.enum(["no_stable_public_provider_identity"]).meta({ id: "ProviderDetectionUnavailableReasonCode" });
+const ProviderDetectionSchema = z.discriminatedUnion("method", [z.strictObject({ method: z.enum([
+	"nameserver",
+	"domain_connect",
+	"nameserver_or_domain_connect"
+]) }), z.strictObject({
+	method: z.literal("manual"),
+	reasonCode: ProviderDetectionUnavailableReasonCodeSchema
+})]).meta({ id: "ProviderDetection" });
+const ProviderReferenceUrlSchema = z.url({ protocol: /^https$/ }).regex(/^https:\/\//, "Provider reference URL must use HTTPS").refine((value) => {
+	const url = new URL(value);
+	return url.username === "" && url.password === "";
+}, "Provider reference URL must not contain credentials").meta({ format: "uri" });
+const ProviderSchema = z.object({
+	id: ProviderIdSchema,
+	name: z.string().trim().min(1),
+	referenceUrl: ProviderReferenceUrlSchema,
+	implementation: ProviderImplementationSchema,
+	availableAuthorizationMethods: z.array(AuthorizationMethodSchema).refine((methods) => new Set(methods).size === methods.length, "Authorization methods must be unique"),
+	capabilities: ProviderCapabilitiesSchema,
+	detection: ProviderDetectionSchema,
+	limitations: z.array(z.string().min(1))
+}).strict().superRefine((provider, context) => {
+	const methods = provider.availableAuthorizationMethods;
+	if (!(provider.implementation === "automatic" ? methods.every((method) => method !== "domain_connect" && method !== "manual") : provider.implementation === "domain_connect" ? methods.every((method) => method === "domain_connect") : provider.implementation === "manual" ? methods.every((method) => method === "manual") : methods.length === 0)) context.addIssue({
+		code: "custom",
+		path: ["availableAuthorizationMethods"],
+		message: "Authorization methods must match the verified provider implementation"
+	});
+}).meta({ id: "Provider" });
+const ListProvidersResponseSchema = z.object({ providers: z.array(ProviderSchema) }).strict().meta({ id: "ListProvidersResponse" });
+const ProviderHealthStatusSchema = z.enum(["operational", "unavailable"]).meta({ id: "ProviderHealthStatus" });
+const ProviderHealthReasonSchema = z.enum([
+	"automatic_ready",
+	"domain_connect_ready",
+	"runtime_authorization_unavailable",
+	"manual_only",
+	"unverified"
+]).meta({ id: "ProviderHealthReason" });
+const ProviderHealthSchema = z.object({
+	providerId: ProviderIdSchema,
+	providerName: z.string().trim().min(1).max(200),
+	enabled: z.boolean(),
+	status: ProviderHealthStatusSchema,
+	reason: ProviderHealthReasonSchema
+}).strict().superRefine((health, context) => {
+	const readyReason = health.reason === "automatic_ready" || health.reason === "domain_connect_ready";
+	const matchingStatus = health.enabled ? health.status === "operational" : health.status === "unavailable";
+	if (health.enabled !== readyReason || !matchingStatus) context.addIssue({
+		code: "custom",
+		path: ["enabled"],
+		message: "Enabled, status, and reason must describe the same provider health state"
+	});
+}).meta({ id: "ProviderHealth" });
+const ProviderHealthResponseSchema = z.object({
+	observedAt: IsoDateTimeSchema,
+	refreshAfter: IsoDateTimeSchema,
+	providers: z.array(ProviderHealthSchema)
+}).strict().superRefine((report, context) => {
+	if (Date.parse(report.refreshAfter) <= Date.parse(report.observedAt)) context.addIssue({
+		code: "custom",
+		path: ["refreshAfter"],
+		message: "Provider health refresh deadline must be after its observation time"
+	});
+	const providerIds = report.providers.map((provider) => provider.providerId);
+	if (new Set(providerIds).size !== providerIds.length) context.addIssue({
+		code: "custom",
+		path: ["providers"],
+		message: "Provider health entries must have unique provider IDs"
+	});
+}).meta({ id: "ProviderHealthResponse" });
+//#endregion
+//#region src/contracts/connection.ts
+const ConnectionStateSchema = z.enum([
+	"requested",
+	"detecting_provider",
+	"provider_selected",
+	"domain_connect_pending",
+	"authorization_pending",
+	"authorized",
+	"planning",
+	"awaiting_confirmation",
+	"applying",
+	"propagation_pending",
+	"active",
+	"manual_required",
+	"failed_retryable",
+	"failed_terminal",
+	"cancelled"
+]).meta({ id: "ConnectionState" });
+const RetryResumeStateSchema = z.enum([
+	"authorized",
+	"awaiting_confirmation",
+	"applying"
+]).meta({ id: "RetryResumeState" });
+const ConnectionFailureCodeSchema = z.enum(["provider_snapshot_timeout", "provider_apply_timeout"]).meta({ id: "ConnectionFailureCode" });
+const ConnectionFailureSchema = z.object({
+	code: ConnectionFailureCodeSchema,
+	retryable: z.literal(true),
+	resumeState: RetryResumeStateSchema,
+	occurredAt: IsoDateTimeSchema
+}).strict().meta({ id: "ConnectionFailure" });
+const PlanWarningCodeSchema = z.enum(["spf_policy_replaced", "spf_policy_merged"]).meta({ id: "PlanWarningCode" });
+const ChangePlanSchema = z.object({
+	digest: z.string().regex(/^[a-f0-9]{64}$/),
+	changes: z.array(PlannedChangeSchema).min(1),
+	warnings: z.array(PlanWarningCodeSchema),
+	expiresAt: IsoDateTimeSchema
+}).strict().meta({ id: "ChangePlan" });
+const ConnectionSchema = z.object({
+	id: ConnectionIdSchema,
+	applicationId: ApplicationIdSchema,
+	tenantId: TenantIdSchema,
+	intent: DnsIntentSchema,
+	effectiveIntent: ResolvedDnsIntentSchema.optional(),
+	state: ConnectionStateSchema,
+	provider: ProviderSchema.optional(),
+	plan: ChangePlanSchema.optional(),
+	failure: ConnectionFailureSchema.optional(),
+	optionalFailures: z.array(z.string()),
+	createdAt: IsoDateTimeSchema,
+	updatedAt: IsoDateTimeSchema
+}).strict().superRefine((connection, context) => {
+	const requiresFailure = connection.state === "failed_retryable";
+	if (requiresFailure !== (connection.failure !== void 0)) context.addIssue({
+		code: "custom",
+		path: ["failure"],
+		message: requiresFailure ? "A retryable failure state requires failure details" : "Failure details are allowed only in a retryable failure state"
+	});
+	if (connection.effectiveIntent !== void 0 && connection.effectiveIntent.domain !== connection.intent.domain) context.addIssue({
+		code: "custom",
+		path: ["effectiveIntent", "domain"],
+		message: "Effective intent must use the requested intent domain"
+	});
+}).meta({ id: "Connection" });
+const CreateConnectionInputSchema = z.object({
+	applicationId: ApplicationIdSchema,
+	tenantId: TenantIdSchema,
+	intent: DnsIntentSchema,
+	commandId: CommandIdSchema
+}).strict().meta({ id: "CreateConnectionInput" });
+const CreateConnectionResponseSchema = z.object({ connection: ConnectionSchema }).strict().meta({ id: "ConnectionResponse" });
+const GetConnectionResponseSchema = CreateConnectionResponseSchema;
+const ProviderCandidateSchema = z.object({
+	provider: ProviderSchema,
+	confidence: z.number().min(0).max(1)
+}).strict().meta({ id: "ProviderCandidate" });
+const DetectProviderResponseSchema = z.object({
+	connection: ConnectionSchema,
+	candidates: z.array(ProviderCandidateSchema)
+}).strict().meta({ id: "DetectProviderResponse" });
+const SelectProviderInputSchema = z.object({
+	providerId: ProviderIdSchema,
+	commandId: CommandIdSchema
+}).strict().meta({ id: "SelectProviderInput" });
+const DomainConnectIdSchema = z.string().regex(/^[A-Za-z0-9._-]{1,63}$/);
+const DomainConnectPropertyNameSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,62}$/);
+const reservedDomainConnectProperties = /* @__PURE__ */ new Set([
+	"domain",
+	"host",
+	"groupId",
+	"providerName",
+	"serviceName",
+	"instanceId",
+	"redirect_uri",
+	"state",
+	"sig",
+	"key"
+]);
+const DomainConnectPropertiesSchema = z.record(DomainConnectPropertyNameSchema, z.string().min(1).max(4096).refine((value) => value.trim() === value && !/[\u0000\r\n]/.test(value), "Domain Connect property values must be trimmed and single-line")).refine((properties) => Object.keys(properties).length <= 64, "At most 64 Domain Connect properties are allowed").refine((properties) => Object.keys(properties).every((name) => !reservedDomainConnectProperties.has(name)), "Domain Connect properties must not override reserved protocol parameters");
+const DomainConnectTemplateSchema = z.object({
+	serviceProviderId: DomainConnectIdSchema,
+	serviceId: DomainConnectIdSchema,
+	host: z.string().max(253).regex(/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/).optional(),
+	groupId: DomainConnectIdSchema.optional(),
+	providerName: z.string().trim().min(1).max(200).optional(),
+	serviceName: z.string().trim().min(1).max(200).optional(),
+	instanceId: DomainConnectIdSchema.optional(),
+	properties: DomainConnectPropertiesSchema
+}).strict().meta({ id: "DomainConnectTemplate" });
+const StartDomainConnectInputSchema = DomainConnectTemplateSchema.extend({ commandId: CommandIdSchema }).strict().meta({ id: "StartDomainConnectInput" });
+const DomainConnectHandoffUrlSchema = z.url({ protocol: /^https$/ }).refine((value) => {
+	const url = new URL(value);
+	return url.username === "" && url.password === "" && url.hash === "";
+}, "Domain Connect handoff URL must be HTTPS without credentials or a fragment");
+const StartDomainConnectResponseSchema = z.object({
+	connection: ConnectionSchema,
+	handoffUrl: DomainConnectHandoffUrlSchema
+}).strict().meta({ id: "StartDomainConnectResponse" });
+const SubmitDomainConnectCompletionInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "SubmitDomainConnectCompletionInput" });
+const ConfirmPlanInputSchema = z.object({
+	digest: z.string().regex(/^[a-f0-9]{64}$/),
+	allowDestructive: z.boolean(),
+	commandId: CommandIdSchema
+}).strict().meta({ id: "ConfirmPlanInput" });
+const StartOAuthInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "StartOAuthInput" });
+const StartOAuthResponseSchema = z.object({
+	connection: ConnectionSchema,
+	authorizationUrl: z.url({ protocol: /^https$/ }),
+	expiresAt: IsoDateTimeSchema
+}).strict().meta({ id: "StartOAuthResponse" });
+const SecretSchema = z.string().min(1).max(16384).refine((value) => value.trim() === value, "Credential values must not have leading or trailing whitespace").meta({
+	format: "password",
+	writeOnly: true
+});
+const ApiTokenCredentialsSchema = z.object({
+	kind: z.literal("api_token"),
+	token: SecretSchema
+}).strict().meta({ id: "ApiTokenCredentials" });
+const AccessKeyCredentialsSchema = z.object({
+	kind: z.literal("access_key"),
+	keyId: SecretSchema,
+	secret: SecretSchema
+}).strict().meta({ id: "AccessKeyCredentials" });
+const UsernamePasswordCredentialsSchema = z.object({
+	kind: z.literal("username_password"),
+	username: SecretSchema,
+	password: SecretSchema
+}).strict().meta({ id: "UsernamePasswordCredentials" });
+const AccountTokenCredentialsSchema = z.object({
+	kind: z.literal("account_token"),
+	accountId: SecretSchema,
+	token: SecretSchema
+}).strict().meta({ id: "AccountTokenCredentials" });
+const UsernameTokenCredentialsSchema = z.object({
+	kind: z.literal("username_token"),
+	username: SecretSchema,
+	token: SecretSchema
+}).strict().meta({ id: "UsernameTokenCredentials" });
+const OvhCredentialsSchema = z.object({
+	kind: z.literal("ovh"),
+	endpoint: z.enum([
+		"ovh-eu",
+		"ovh-us",
+		"ovh-ca",
+		"kimsufi-eu",
+		"kimsufi-ca",
+		"soyoustart-eu",
+		"soyoustart-ca"
+	]),
+	applicationKey: SecretSchema,
+	applicationSecret: SecretSchema,
+	consumerKey: SecretSchema
+}).strict().meta({ id: "OvhCredentials" });
+const PrivateKeyCredentialsSchema = z.object({
+	kind: z.literal("private_key"),
+	login: SecretSchema,
+	privateKey: SecretSchema.refine((value) => /^(-----BEGIN (?:RSA )?PRIVATE KEY-----)[\s\S]+(-----END (?:RSA )?PRIVATE KEY-----)$/.test(value), "A PKCS#8 or PKCS#1 PEM private key is required")
+}).strict().meta({ id: "PrivateKeyCredentials" });
+const AwsSessionCredentialsSchema = z.object({
+	kind: z.literal("aws_session"),
+	keyId: SecretSchema.regex(/^[A-Z0-9]{16,128}$/),
+	secret: SecretSchema,
+	sessionToken: SecretSchema,
+	hostedZoneId: z.string().regex(/^Z[A-Z0-9]{1,63}$/),
+	expiresAt: IsoDateTimeSchema
+}).strict().meta({ id: "AwsSessionCredentials" });
+const CPanelEndpointSchema = z.url({ protocol: /^https$/ }).refine((value) => {
+	const url = new URL(value);
+	return url.port === "2083" && url.username === "" && url.password === "" && (url.pathname === "" || url.pathname === "/") && url.search === "" && url.hash === "";
+}, "cPanel endpoint must be an HTTPS origin on port 2083");
+const CPanelCredentialsSchema = z.object({
+	kind: z.literal("cpanel"),
+	endpoint: CPanelEndpointSchema,
+	username: SecretSchema,
+	token: SecretSchema
+}).strict().meta({ id: "CPanelCredentials" });
+const ClientCredentialsSchema = z.object({
+	kind: z.literal("client_credentials"),
+	clientId: SecretSchema,
+	clientSecret: SecretSchema
+}).strict().meta({ id: "ClientCredentials" });
+function credentialInput(providerId, credentials) {
+	return z.object({
+		providerId: z.literal(providerId),
+		credentials,
+		commandId: CommandIdSchema
+	}).strict();
+}
+const directCredentialAuthorizationOptions = [
+	credentialInput("alibaba-cloud", AccessKeyCredentialsSchema),
+	credentialInput("all-inkl", UsernamePasswordCredentialsSchema),
+	credentialInput("amazon-route-53", AwsSessionCredentialsSchema),
+	credentialInput("cloudflare", ApiTokenCredentialsSchema),
+	credentialInput("cloudns", AccountTokenCredentialsSchema),
+	credentialInput("digitalocean", ApiTokenCredentialsSchema),
+	credentialInput("dnsimple", AccountTokenCredentialsSchema),
+	credentialInput("dreamhost", ApiTokenCredentialsSchema),
+	credentialInput("dynadot", AccessKeyCredentialsSchema),
+	credentialInput("easydns", AccessKeyCredentialsSchema),
+	credentialInput("gandi", ApiTokenCredentialsSchema),
+	credentialInput("godaddy", ApiTokenCredentialsSchema),
+	credentialInput("hetzner", ApiTokenCredentialsSchema),
+	credentialInput("hostgator", CPanelCredentialsSchema),
+	credentialInput("hostinger", ApiTokenCredentialsSchema),
+	credentialInput("hosting-com", CPanelCredentialsSchema),
+	credentialInput("inmotion-hosting", CPanelCredentialsSchema),
+	credentialInput("ionos", ApiTokenCredentialsSchema),
+	credentialInput("name-com", UsernameTokenCredentialsSchema),
+	credentialInput("namesilo", ApiTokenCredentialsSchema),
+	credentialInput("netlify", ApiTokenCredentialsSchema),
+	credentialInput("o2switch", CPanelCredentialsSchema),
+	credentialInput("openprovider", ApiTokenCredentialsSchema),
+	credentialInput("opensrs", ClientCredentialsSchema),
+	credentialInput("ovh", OvhCredentialsSchema),
+	credentialInput("porkbun", AccessKeyCredentialsSchema),
+	credentialInput("simply", ApiTokenCredentialsSchema),
+	credentialInput("spaceship", AccessKeyCredentialsSchema),
+	credentialInput("transip", PrivateKeyCredentialsSchema),
+	credentialInput("united-domains", ApiTokenCredentialsSchema),
+	credentialInput("vercel", ApiTokenCredentialsSchema),
+	credentialInput("wix", AccountTokenCredentialsSchema)
+];
+const directCredentialKindByProvider = Object.freeze(Object.fromEntries(directCredentialAuthorizationOptions.map((option) => [option.shape.providerId.value, option.shape.credentials.shape.kind.value])));
+const AuthorizeWithCredentialInputSchema = z.discriminatedUnion("providerId", directCredentialAuthorizationOptions).meta({ id: "AuthorizeWithCredentialInput" });
+const OAuthCallbackResponseSchema = z.object({ completed: z.literal(true) }).strict().meta({ id: "OAuthCallbackResponse" });
+const PreparePlanInputSchema = z.object({
+	conflictPolicy: ConflictPolicySchema,
+	spfPolicy: SpfConflictPolicySchema.default("merge"),
+	commandId: CommandIdSchema
+}).strict().meta({ id: "PreparePlanInput" });
+const ApplyPlanInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "ApplyPlanInput" });
+const VerifyPropagationInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "VerifyPropagationInput" });
+const StartManualConfigurationInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "StartManualConfigurationInput" });
+const SubmitManualCompletionInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "SubmitManualCompletionInput" });
+const CancelConnectionInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "CancelConnectionInput" });
+const RetryConnectionInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "RetryConnectionInput" });
+const IssueConnectionTokenInputSchema = z.object({ origin: z.url().refine((value) => {
+	const url = new URL(value);
+	return url.username === "" && url.password === "" && url.search === "" && url.hash === "" && (url.pathname === "" || url.pathname === "/") && (url.protocol === "https:" || url.protocol === "http:" && isLoopbackHost(url.hostname));
+}, "Origin must be an HTTPS origin without a path, query, or fragment") }).strict().meta({ id: "IssueConnectionTokenInput" });
+const IssueConnectionTokenResponseSchema = z.object({
+	accessToken: z.string().min(1).max(8192),
+	tokenType: z.literal("Bearer"),
+	expiresAt: IsoDateTimeSchema
+}).strict().meta({ id: "IssueConnectionTokenResponse" });
+function isLoopbackHost(hostname) {
+	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+//#endregion
+//#region src/contracts/connection-flow.ts
+const ConnectionFlowIdSchema = z.string().trim().min(1).max(200).meta({ id: "ConnectionFlowId" });
+const ConditionalDnsRecordsSchema = z.strictObject({
+	domain: z.array(DnsRecordSchema).min(1).max(100),
+	subDomain: z.array(DnsRecordSchema).min(1).max(100).optional(),
+	rootNS: z.array(DnsRecordSchema).min(1).max(100).optional()
+}).superRefine((records, context) => {
+	records.rootNS?.forEach((record, index) => {
+		if (record.host !== "@" || record.type !== "NS") context.addIssue({
+			code: "custom",
+			path: ["rootNS", index],
+			message: "rootNS accepts only NS records at the zone apex"
+		});
+	});
+}).meta({ id: "ConditionalDnsRecords" });
+const DirectConnectionFlowTargetInputSchema = z.strictObject({
+	domain: DomainNameSchema,
+	records: z.array(DnsRecordSchema).min(1).max(100)
+});
+const ConditionalConnectionFlowTargetInputSchema = z.strictObject({
+	domain: DomainNameSchema,
+	conditionalRecords: ConditionalDnsRecordsSchema
+});
+const ConnectionFlowTargetInputSchema = z.union([DirectConnectionFlowTargetInputSchema, ConditionalConnectionFlowTargetInputSchema]).meta({ id: "ConnectionFlowTargetInput" });
+const CreateConnectionFlowInputSchema = z.strictObject({
+	applicationId: ApplicationIdSchema,
+	tenantId: TenantIdSchema,
+	existingRecordPolicy: ExistingRecordPolicySchema.default({
+		validateDmarc: false,
+		validateCAA: false
+	}),
+	targets: z.array(ConnectionFlowTargetInputSchema).min(2).max(100).superRefine((targets, context) => {
+		const seen = /* @__PURE__ */ new Set();
+		targets.forEach((target, index) => {
+			if (seen.has(target.domain)) context.addIssue({
+				code: "custom",
+				path: [index, "domain"],
+				message: "Flow target domains must be unique"
+			});
+			seen.add(target.domain);
+		});
+	}),
+	commandId: CommandIdSchema
+}).meta({ id: "CreateConnectionFlowInput" });
+const ConnectionFlowTargetSchema = z.strictObject({
+	domain: DomainNameSchema,
+	state: z.enum(["pending", "provisioned"]),
+	connectionId: ConnectionIdSchema.optional()
+}).superRefine((target, context) => {
+	if (target.state === "provisioned" !== (target.connectionId !== void 0)) context.addIssue({
+		code: "custom",
+		path: ["connectionId"],
+		message: target.state === "provisioned" ? "A provisioned target requires a connection id" : "A pending target cannot have a connection id"
+	});
+}).meta({ id: "ConnectionFlowTarget" });
+const ConnectionFlowSchema = z.strictObject({
+	id: ConnectionFlowIdSchema,
+	applicationId: ApplicationIdSchema,
+	tenantId: TenantIdSchema,
+	state: z.enum(["provisioning", "ready"]),
+	targets: z.array(ConnectionFlowTargetSchema).min(2).max(100),
+	createdAt: IsoDateTimeSchema,
+	updatedAt: IsoDateTimeSchema
+}).superRefine((flow, context) => {
+	const allProvisioned = flow.targets.every((target) => target.state === "provisioned");
+	if (flow.state === "ready" !== allProvisioned) context.addIssue({
+		code: "custom",
+		path: ["state"],
+		message: "Flow state must match target provisioning state"
+	});
+}).meta({ id: "ConnectionFlow" });
+const ConnectionFlowResponseSchema = z.strictObject({ flow: ConnectionFlowSchema }).meta({ id: "ConnectionFlowResponse" });
+//#endregion
+//#region src/contracts/shared-flow.ts
+const SharedFlowIdSchema = z.string().min(1).max(200).brand();
+const SharedFlowTokenSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/).brand();
+const CreateSharedFlowInputSchema = z.strictObject({
+	connectionId: ConnectionIdSchema,
+	expiresAt: IsoDateTimeSchema
+});
+const CreateSharedFlowResponseSchema = z.strictObject({
+	sharedFlowId: SharedFlowIdSchema,
+	token: SharedFlowTokenSchema,
+	expiresAt: IsoDateTimeSchema
+});
+const ResolveSharedFlowInputSchema = z.strictObject({
+	token: SharedFlowTokenSchema,
+	origin: z.string().url().max(2048)
+});
+const ResolveSharedFlowResponseSchema = z.strictObject({
+	sharedFlowId: SharedFlowIdSchema,
+	connectionId: ConnectionIdSchema,
+	accessToken: z.string().min(1).max(8192),
+	expiresAt: IsoDateTimeSchema
+});
+const SharedFlowUrlSchema = z.string().url().max(4096);
+const SharedFlowInvitationUrlSchema = SharedFlowUrlSchema.superRefine((value, context) => {
+	const url = new URL(value);
+	const secure = url.protocol === "https:";
+	const loopback = url.protocol === "http:" && isLoopbackHostname(url.hostname);
+	if (!secure && !loopback) context.addIssue({
+		code: "custom",
+		message: "Shared-flow invitation URLs must use HTTPS, except on loopback development hosts"
+	});
+	if (url.username !== "" || url.password !== "") context.addIssue({
+		code: "custom",
+		message: "Shared-flow invitation URLs cannot contain user information"
+	});
+	const fragment = new URLSearchParams(url.hash.slice(1));
+	const token = fragment.get("domain0");
+	if (fragment.size !== 1 || !SharedFlowTokenSchema.safeParse(token).success) context.addIssue({
+		code: "custom",
+		message: "Shared-flow invitation URLs require one valid domain0 capability in the fragment"
+	});
+}).meta({ id: "SharedFlowInvitationUrl" });
+const SharedFlowInvitationSchema = z.object({
+	sharedFlowId: SharedFlowIdSchema,
+	url: SharedFlowInvitationUrlSchema,
+	expiresAt: IsoDateTimeSchema
+}).strict().meta({ id: "SharedFlowInvitation" });
+function isLoopbackHostname(hostname) {
+	const normalized = hostname.toLowerCase();
+	return normalized === "localhost" || normalized === "[::1]" || /^127(?:\.[0-9]{1,3}){3}$/.test(normalized);
+}
+//#endregion
+//#region src/contracts/dkim-guidance.ts
+const DkimSelectorSchema = z.string().trim().toLowerCase().min(1).max(63).regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/).brand().meta({ id: "DkimSelector" });
+const DkimGuidanceInputSchema = z.object({ selectors: z.array(DkimSelectorSchema).max(10).default([]) }).strict().superRefine((input, context) => {
+	if (new Set(input.selectors).size !== input.selectors.length) context.addIssue({
+		code: "custom",
+		path: ["selectors"],
+		message: "DKIM selectors must be unique"
+	});
+}).meta({ id: "DkimGuidanceInput" });
+const Domain0DkimGuidanceOptionsSchema = z.object({
+	enableDkim: z.boolean().default(false),
+	dkimSelectors: z.array(DkimSelectorSchema).max(10).default([])
+}).strict().superRefine((input, context) => {
+	if (new Set(input.dkimSelectors).size !== input.dkimSelectors.length) context.addIssue({
+		code: "custom",
+		path: ["dkimSelectors"],
+		message: "DKIM selectors must be unique"
+	});
+}).meta({ id: "Domain0DkimGuidanceOptions" });
+const GoogleWorkspaceEmailProviderSchema = z.object({
+	id: z.literal("google_workspace"),
+	name: z.literal("Google Workspace"),
+	guideUrl: z.literal("https://support.google.com/a/answer/174124")
+}).strict();
+const Microsoft365EmailProviderSchema = z.object({
+	id: z.literal("microsoft_365"),
+	name: z.literal("Microsoft 365"),
+	guideUrl: z.literal("https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure")
+}).strict();
+const ZohoMailEmailProviderSchema = z.object({
+	id: z.literal("zoho_mail"),
+	name: z.literal("Zoho Mail"),
+	guideUrl: z.literal("https://www.zoho.com/mail/help/adminconsole/dkim-configuration.html")
+}).strict();
+const EmailProviderSchema = z.discriminatedUnion("id", [
+	GoogleWorkspaceEmailProviderSchema,
+	Microsoft365EmailProviderSchema,
+	ZohoMailEmailProviderSchema
+]).meta({ id: "EmailProvider" });
+const EmailProviderDetectionStatusSchema = z.enum([
+	"detected",
+	"ambiguous",
+	"unknown"
+]).meta({ id: "EmailProviderDetectionStatus" });
+const DkimDnsRecordTypeSchema = z.enum(["TXT", "CNAME"]).meta({ id: "DkimDnsRecordType" });
+const DkimDnsEvidenceStatusSchema = z.enum([
+	"record_observed",
+	"no_record_observed",
+	"not_checked",
+	"lookup_unavailable"
+]).meta({ id: "DkimDnsEvidenceStatus" });
+const DkimDnsRecordEvidenceSchema = z.object({
+	selector: DkimSelectorSchema,
+	types: z.array(DkimDnsRecordTypeSchema).min(1).max(2).refine((types) => new Set(types).size === types.length, "Observed DKIM DNS record types must be unique")
+}).strict().meta({ id: "DkimDnsRecordEvidence" });
+const DkimDnsEvidenceSchema = z.object({
+	status: DkimDnsEvidenceStatusSchema,
+	selectorsChecked: z.array(DkimSelectorSchema).max(12).refine((selectors) => new Set(selectors).size === selectors.length, "Checked DKIM selectors must be unique"),
+	records: z.array(DkimDnsRecordEvidenceSchema).max(12)
+}).strict().superRefine((evidence, context) => {
+	const checked = new Set(evidence.selectorsChecked);
+	if (evidence.records.some((record) => !checked.has(record.selector))) context.addIssue({
+		code: "custom",
+		path: ["records"],
+		message: "Observed records must belong to checked selectors"
+	});
+	if (evidence.status === "not_checked" && (evidence.selectorsChecked.length !== 0 || evidence.records.length !== 0)) context.addIssue({
+		code: "custom",
+		path: ["status"],
+		message: "Not-checked evidence cannot include selector observations"
+	});
+	if (evidence.status === "record_observed" && evidence.records.length === 0) context.addIssue({
+		code: "custom",
+		path: ["records"],
+		message: "Observed status requires at least one DNS record"
+	});
+	if (evidence.status !== "record_observed" && evidence.records.length !== 0) context.addIssue({
+		code: "custom",
+		path: ["records"],
+		message: "Only observed status can include DNS records"
+	});
+	if (["no_record_observed", "lookup_unavailable"].includes(evidence.status) && evidence.selectorsChecked.length === 0) context.addIssue({
+		code: "custom",
+		path: ["selectorsChecked"],
+		message: "A DNS lookup status requires at least one checked selector"
+	});
+}).meta({ id: "DkimDnsEvidence" });
+const DkimGuidanceResponseSchema = z.object({
+	domain: DomainNameSchema,
+	detectionStatus: EmailProviderDetectionStatusSchema,
+	candidates: z.array(EmailProviderSchema).max(3),
+	provider: EmailProviderSchema.optional(),
+	mxHosts: z.array(DomainNameSchema).max(20).refine((hosts) => new Set(hosts).size === hosts.length, "MX hosts must be unique"),
+	dkimDns: DkimDnsEvidenceSchema,
+	observedAt: IsoDateTimeSchema
+}).strict().superRefine((result, context) => {
+	const candidateIds = result.candidates.map((candidate) => candidate.id);
+	if (new Set(candidateIds).size !== candidateIds.length) context.addIssue({
+		code: "custom",
+		path: ["candidates"],
+		message: "Email provider candidates must be unique"
+	});
+	if (result.detectionStatus === "detected" && (result.candidates.length !== 1 || result.provider?.id !== result.candidates[0]?.id)) context.addIssue({
+		code: "custom",
+		path: ["provider"],
+		message: "Detected status requires exactly one matching provider"
+	});
+	if (result.detectionStatus === "ambiguous" && (result.candidates.length < 2 || result.provider !== void 0)) context.addIssue({
+		code: "custom",
+		path: ["candidates"],
+		message: "Ambiguous status requires multiple candidates and no resolved provider"
+	});
+	if (result.detectionStatus === "unknown" && (result.candidates.length !== 0 || result.provider !== void 0)) context.addIssue({
+		code: "custom",
+		path: ["candidates"],
+		message: "Unknown status cannot include an email provider"
+	});
+}).meta({ id: "DkimGuidanceResponse" });
+//#endregion
+//#region src/contracts/connect-events.ts
+const Domain0ConnectStepSchema = z.union([z.enum([
+	"loading",
+	"provider_detection",
+	"provider_selection",
+	"cancellation_confirmation"
+]), ConnectionStateSchema]).meta({ id: "Domain0ConnectStep" });
+const Domain0ConnectCloseReasonSchema = z.enum([
+	"close_button",
+	"escape",
+	"programmatic",
+	"destroyed",
+	"success"
+]).meta({ id: "Domain0ConnectCloseReason" });
+const ActiveConnectionSchema = ConnectionSchema.and(z.object({ state: z.literal("active") }));
+const ManualConnectionSchema = ConnectionSchema.and(z.object({ state: z.literal("manual_required") }));
+const Domain0ConnectSuccessEventSchema = z.object({
+	type: z.literal("success"),
+	connection: ActiveConnectionSchema
+}).strict().meta({ id: "Domain0ConnectSuccessEvent" });
+const Domain0ConnectCloseEventSchema = z.object({
+	type: z.literal("close"),
+	reason: Domain0ConnectCloseReasonSchema,
+	connection: ConnectionSchema.optional(),
+	step: Domain0ConnectStepSchema.optional()
+}).strict().meta({ id: "Domain0ConnectCloseEvent" });
+const Domain0ConnectStepChangeEventSchema = z.object({
+	type: z.literal("step_change"),
+	step: Domain0ConnectStepSchema,
+	previousStep: Domain0ConnectStepSchema.optional(),
+	connection: ConnectionSchema.optional()
+}).strict().meta({ id: "Domain0ConnectStepChangeEvent" });
+const Domain0ManualSetupDocumentationClickEventSchema = z.object({
+	type: z.literal("manual_setup_documentation_click"),
+	connection: ManualConnectionSchema
+}).strict().meta({ id: "Domain0ManualSetupDocumentationClickEvent" });
+const Domain0RequestCloseEventSchema = z.object({
+	type: z.literal("request_close"),
+	connection: ConnectionSchema.optional(),
+	step: Domain0ConnectStepSchema
+}).strict().meta({ id: "Domain0RequestCloseEvent" });
+const Domain0SharedFlowSentEventSchema = z.object({
+	type: z.literal("shared_flow_sent"),
+	connection: ManualConnectionSchema,
+	sharedFlowId: SharedFlowIdSchema,
+	url: SharedFlowInvitationUrlSchema,
+	expiresAt: IsoDateTimeSchema
+}).strict().meta({ id: "Domain0SharedFlowSentEvent" });
+const Domain0DkimSetupDocumentationClickEventSchema = z.object({
+	type: z.literal("dkim_setup_documentation_click"),
+	connection: ActiveConnectionSchema,
+	emailProvider: EmailProviderSchema
+}).strict().meta({ id: "Domain0DkimSetupDocumentationClickEvent" });
+const Domain0ConnectEventSchema = z.discriminatedUnion("type", [
+	Domain0ConnectSuccessEventSchema,
+	Domain0ConnectCloseEventSchema,
+	Domain0ConnectStepChangeEventSchema,
+	Domain0ManualSetupDocumentationClickEventSchema,
+	Domain0RequestCloseEventSchema,
+	Domain0SharedFlowSentEventSchema,
+	Domain0DkimSetupDocumentationClickEventSchema
+]).meta({ id: "Domain0ConnectEvent" });
+//#endregion
+//#region src/contracts/setup-policy.ts
+const Domain0SetupPolicySchema = z.object({ mode: z.enum(["automatic", "manual"]).default("automatic") }).strict();
+//#endregion
+//#region src/contracts/white-label.ts
+const opaqueHexColorPattern = /^#[0-9A-F]{6}$/;
+const backdropHexColorPattern = /^#[0-9A-F]{8}$/;
+const OpaqueHexColorSchema = z.string().trim().toUpperCase().regex(opaqueHexColorPattern, "Expected an opaque #RRGGBB color");
+const BackdropHexColorSchema = z.string().trim().toUpperCase().regex(backdropHexColorPattern, "Expected a #RRGGBBAA backdrop color");
+const WhiteLabelTextSchema = z.string().trim().min(1).max(500).refine((value) => !/[<>\u0000-\u001F\u007F]/.test(value), "White-label copy must be plain text without markup or control characters");
+const Domain0ApplicationNameSchema = WhiteLabelTextSchema.max(120).meta({ id: "Domain0ApplicationName" });
+const Domain0WhiteLabelLogoUrlSchema = z.string().trim().min(1).max(2048).refine((value) => {
+	try {
+		const parsed = new URL(value);
+		return parsed.protocol === "https:" && parsed.username === "" && parsed.password === "";
+	} catch {
+		return false;
+	}
+}, "Logo must be an HTTPS URL without embedded credentials").meta({ id: "Domain0WhiteLabelLogoUrl" });
+function copyWithPlaceholders(...allowed) {
+	return WhiteLabelTextSchema.refine((value) => {
+		const withoutAllowedPlaceholders = allowed.reduce((copy, placeholder) => copy.replaceAll(placeholder, ""), value);
+		return !/[{}]/.test(withoutAllowedPlaceholders);
+	}, `Only these placeholders are allowed: ${allowed.join(", ") || "none"}`);
+}
+function localizedCopy(message) {
+	const localized = z.object({
+		en: message,
+		es: message.optional(),
+		pt: message.optional(),
+		"pt-br": message.optional(),
+		"pt-pt": message.optional(),
+		fr: message.optional(),
+		it: message.optional(),
+		de: message.optional(),
+		nl: message.optional(),
+		pl: message.optional(),
+		tr: message.optional(),
+		ja: message.optional(),
+		da: message.optional(),
+		sv: message.optional()
+	}).strict();
+	return z.union([message.transform((en) => ({ en })), localized]);
+}
+function colorContrastRatio(foreground, background) {
+	return parsedColorContrastRatio(OpaqueHexColorSchema.parse(foreground), OpaqueHexColorSchema.parse(background));
+}
+function parsedColorContrastRatio(foreground, background) {
+	const foregroundLuminance = relativeLuminance(foreground);
+	const backgroundLuminance = relativeLuminance(background);
+	const lighter = Math.max(foregroundLuminance, backgroundLuminance);
+	const darker = Math.min(foregroundLuminance, backgroundLuminance);
+	return (lighter + .05) / (darker + .05);
+}
+function isSafeFontFamilyStack(value) {
+	const families = value.split(",");
+	return families.length <= 10 && families.every((family) => {
+		const trimmed = family.trim();
+		if (trimmed.length === 0) return false;
+		const quote = trimmed.at(0);
+		if (quote === "\"" || quote === "'") return trimmed.at(-1) === quote && /^[A-Za-z0-9 -]+$/.test(trimmed.slice(1, -1));
+		return /^-?[A-Za-z][A-Za-z0-9 -]*$/.test(trimmed);
+	});
+}
+function relativeLuminance(color) {
+	const [red, green, blue] = [
+		1,
+		3,
+		5
+	].map((start) => Number.parseInt(color.slice(start, start + 2), 16) / 255).map((channel) => channel <= .04045 ? channel / 12.92 : ((channel + .055) / 1.055) ** 2.4);
+	return .2126 * red + .7152 * green + .0722 * blue;
+}
+const contrastPairs = [
+	{
+		foreground: "text",
+		background: "surface",
+		minimum: 4.5,
+		purpose: "body text"
+	},
+	{
+		foreground: "mutedText",
+		background: "surface",
+		minimum: 4.5,
+		purpose: "secondary text"
+	},
+	{
+		foreground: "onPrimary",
+		background: "primary",
+		minimum: 4.5,
+		purpose: "primary control text"
+	},
+	{
+		foreground: "danger",
+		background: "surface",
+		minimum: 4.5,
+		purpose: "error text"
+	},
+	{
+		foreground: "onDanger",
+		background: "danger",
+		minimum: 4.5,
+		purpose: "danger control text"
+	},
+	{
+		foreground: "link",
+		background: "surface",
+		minimum: 4.5,
+		purpose: "link text"
+	},
+	{
+		foreground: "border",
+		background: "surface",
+		minimum: 3,
+		purpose: "control boundaries"
+	},
+	{
+		foreground: "primary",
+		background: "surface",
+		minimum: 3,
+		purpose: "primary control boundaries"
+	},
+	{
+		foreground: "focus",
+		background: "surface",
+		minimum: 3,
+		purpose: "focus indicators"
+	}
+];
+const lightPaletteDefaults = {
+	surface: "#FFFFFF",
+	text: "#0A0A0A",
+	mutedText: "#6B6B6B",
+	border: "#73737C",
+	primary: "#0A0A0A",
+	onPrimary: "#FFFFFF",
+	link: "#2B21FF",
+	focus: "#2B21FF",
+	danger: "#B3261E",
+	onDanger: "#FFFFFF"
+};
+const darkPaletteDefaults = {
+	surface: "#111827",
+	text: "#F9FAFB",
+	mutedText: "#D1D5DB",
+	border: "#D1D5DB",
+	primary: "#BFDBFE",
+	onPrimary: "#172554",
+	link: "#BFDBFE",
+	focus: "#FBBF24",
+	danger: "#FCA5A5",
+	onDanger: "#450A0A"
+};
+function themePaletteSchema(defaults) {
+	return z.object({
+		surface: OpaqueHexColorSchema.default(defaults.surface),
+		text: OpaqueHexColorSchema.default(defaults.text),
+		mutedText: OpaqueHexColorSchema.default(defaults.mutedText),
+		border: OpaqueHexColorSchema.default(defaults.border),
+		primary: OpaqueHexColorSchema.default(defaults.primary),
+		onPrimary: OpaqueHexColorSchema.default(defaults.onPrimary),
+		link: OpaqueHexColorSchema.default(defaults.link),
+		focus: OpaqueHexColorSchema.default(defaults.focus),
+		danger: OpaqueHexColorSchema.default(defaults.danger),
+		onDanger: OpaqueHexColorSchema.default(defaults.onDanger)
+	}).strict().superRefine((palette, context) => {
+		for (const pair of contrastPairs) {
+			const ratio = parsedColorContrastRatio(palette[pair.foreground], palette[pair.background]);
+			if (ratio < pair.minimum) context.addIssue({
+				code: "custom",
+				path: [pair.foreground],
+				message: `${pair.purpose} requires ${pair.minimum}:1 contrast against ${pair.background}; received ${ratio.toFixed(2)}:1`
+			});
+		}
+	});
+}
+const LightThemePaletteSchema = themePaletteSchema(lightPaletteDefaults);
+const DarkThemePaletteSchema = themePaletteSchema(darkPaletteDefaults);
+const Domain0WhiteLabelThemeSchema = z.object({
+	colorMode: z.enum([
+		"light",
+		"dark",
+		"system"
+	]).default("system"),
+	light: LightThemePaletteSchema.prefault({}),
+	dark: DarkThemePaletteSchema.prefault({}),
+	backdrop: BackdropHexColorSchema.default("#111827B8"),
+	widthPx: z.number().int().min(320).max(960).default(672),
+	dialogRadiusPx: z.number().int().min(0).max(48).default(20),
+	buttonRadiusPx: z.number().int().min(0).max(999).default(999),
+	inputRadiusPx: z.number().int().min(0).max(32).default(12),
+	fontFamily: z.string().trim().min(1).max(200).refine(isSafeFontFamilyStack, "Use a comma-separated system font stack without URLs or CSS syntax").default("\"PP Neue Montreal\", \"Inter Tight\", ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif"),
+	fontWeight: z.number().int().min(100).max(900).multipleOf(50).default(400),
+	boldFontWeight: z.number().int().min(100).max(900).multipleOf(50).default(500)
+}).strict().superRefine((theme, context) => {
+	if (theme.boldFontWeight < theme.fontWeight) context.addIssue({
+		code: "custom",
+		path: ["boldFontWeight"],
+		message: "Bold font weight must be at least the normal font weight"
+	});
+});
+const Domain0WhiteLabelCopySchema = z.object({
+	initialSubtitle: localizedCopy(copyWithPlaceholders()).optional(),
+	providerLoginMessage: localizedCopy(copyWithPlaceholders("{PROVIDER}")).optional(),
+	successTitle: localizedCopy(copyWithPlaceholders("{DOMAIN}")).optional(),
+	successDescription: localizedCopy(copyWithPlaceholders("{DOMAIN}")).optional(),
+	successButton: localizedCopy(copyWithPlaceholders()).optional(),
+	manuallyScreen: z.object({
+		disableManualSetupDocumentationLink: z.boolean().default(false),
+		stepByStepGuide: localizedCopy(copyWithPlaceholders()).optional()
+	}).strict().prefault({})
+}).strict();
+const DisabledControlSchema = z.object({ disable: z.boolean().default(false) }).strict();
+const Domain0WhiteLabelCustomPropertiesSchema = z.object({
+	manualConfiguration: z.object({ disableScreen: z.boolean().default(false) }).strict().prefault({}),
+	providerLogin: z.object({
+		forwardLink: DisabledControlSchema.prefault({}),
+		gotoManualLink: DisabledControlSchema.prefault({})
+	}).strict().prefault({})
+}).strict();
+const Domain0WhiteLabelSchema = z.object({
+	theme: Domain0WhiteLabelThemeSchema.prefault({}),
+	copy: Domain0WhiteLabelCopySchema.prefault({}),
+	logo: Domain0WhiteLabelLogoUrlSchema.optional(),
+	logoBackgroundColor: OpaqueHexColorSchema.optional(),
+	removeLogoBorder: z.boolean().default(false),
+	hideCompanyLogo: z.boolean().default(false),
+	hideCompanyName: z.boolean().default(false),
+	removeShareLogin: z.boolean().default(false),
+	skipCongratulationsScreen: z.boolean().default(false),
+	customProperties: Domain0WhiteLabelCustomPropertiesSchema.prefault({})
+}).strict();
+//#endregion
+//#region src/contracts/manual-setup-documentation.ts
+const ManualSetupDocumentationUrlSchema = z.url({ protocol: /^https$/ }).max(2048).refine((value) => {
+	const url = new URL(value);
+	return url.username === "" && url.password === "";
+}, "Manual setup documentation URL must not contain credentials").brand().meta({ id: "ManualSetupDocumentationUrl" });
+//#endregion
+//#region src/contracts/connect-configuration.ts
+const Domain0ConnectConfigurationSchema = z.object({
+	applicationName: Domain0ApplicationNameSchema.optional(),
+	whiteLabel: Domain0WhiteLabelSchema.prefault({}),
+	setupPolicy: Domain0SetupPolicySchema.prefault({}),
+	dkim: Domain0DkimGuidanceOptionsSchema.prefault({}),
+	manualSetupDocumentation: ManualSetupDocumentationUrlSchema.optional()
+}).strict().superRefine((configuration, context) => {
+	const { customProperties } = configuration.whiteLabel;
+	const forcedManual = configuration.setupPolicy.mode === "manual";
+	if (forcedManual && customProperties.manualConfiguration.disableScreen) context.addIssue({
+		code: "custom",
+		path: [
+			"whiteLabel",
+			"customProperties",
+			"manualConfiguration",
+			"disableScreen"
+		],
+		message: "Forced manual setup requires the manual configuration screen"
+	});
+	if (forcedManual && customProperties.providerLogin.gotoManualLink.disable) context.addIssue({
+		code: "custom",
+		path: [
+			"whiteLabel",
+			"customProperties",
+			"providerLogin",
+			"gotoManualLink",
+			"disable"
+		],
+		message: "Forced manual setup cannot disable entry into manual configuration"
+	});
+	if (configuration.dkim.enableDkim && configuration.whiteLabel.skipCongratulationsScreen) context.addIssue({
+		code: "custom",
+		path: ["whiteLabel", "skipCongratulationsScreen"],
+		message: "DKIM guidance requires the success screen"
+	});
+}).meta({ id: "Domain0ConnectConfiguration" });
+//#endregion
+//#region src/contracts/conformance.ts
+const CompiledProviderIdSchema = z.enum([
+	"alibaba-cloud",
+	"all-inkl",
+	"amazon-route-53",
+	"cloudflare",
+	"cloudns",
+	"digitalocean",
+	"dnsimple",
+	"dreamhost",
+	"dynadot",
+	"easydns",
+	"gandi",
+	"godaddy",
+	"hetzner",
+	"hostgator",
+	"hostinger",
+	"hosting-com",
+	"inmotion-hosting",
+	"ionos",
+	"name-com",
+	"namecheap",
+	"namesilo",
+	"netlify",
+	"o2switch",
+	"openprovider",
+	"opensrs",
+	"ovh",
+	"porkbun",
+	"simply",
+	"spaceship",
+	"transip",
+	"united-domains",
+	"vercel",
+	"wix"
+]).meta({ id: "CompiledProviderId" });
+const ProviderConformanceCheckNameSchema = z.enum([
+	"authenticated_snapshot",
+	"reserved_name_available",
+	"create_sibling",
+	"create_target",
+	"rrset_sibling_preservation",
+	"idempotent_replay",
+	"replace_target",
+	"authoritative_propagation",
+	"delete_target",
+	"scoped_cleanup"
+]).meta({ id: "ProviderConformanceCheckName" });
+const expectedProviderConformanceChecks = [
+	"authenticated_snapshot",
+	"reserved_name_available",
+	"create_sibling",
+	"create_target",
+	"rrset_sibling_preservation",
+	"idempotent_replay",
+	"replace_target",
+	"authoritative_propagation",
+	"delete_target",
+	"scoped_cleanup"
+];
+const ProviderConformanceCheckSchema = z.object({ name: ProviderConformanceCheckNameSchema }).strict();
+const SourceRevisionSchema = z.union([z.literal("unknown"), z.string().regex(/^[a-f0-9]{40,64}$/)]);
+const ProviderConformanceEvidenceSchema = z.object({
+	schemaVersion: z.literal(1),
+	providerId: CompiledProviderIdSchema,
+	adapterVersion: z.string().min(1).max(200).refine(isTrimmedSingleLine),
+	sourceRevision: SourceRevisionSchema,
+	sourceModified: z.boolean(),
+	binarySha256: z.string().regex(/^[a-f0-9]{64}$/),
+	zone: DomainNameSchema,
+	runId: z.string().regex(/^[a-f0-9]{16,64}$/),
+	host: z.string(),
+	startedAt: IsoDateTimeSchema,
+	completedAt: IsoDateTimeSchema,
+	passed: z.boolean(),
+	checks: z.array(ProviderConformanceCheckSchema).max(expectedProviderConformanceChecks.length),
+	cleanupAttempted: z.boolean(),
+	cleanupCompleted: z.boolean()
+}).strict().superRefine((evidence, context) => {
+	if (evidence.host !== `_domain0-conformance-${evidence.runId}`) context.addIssue({
+		code: "custom",
+		path: ["host"],
+		message: "Conformance hostname must be derived from the random run ID"
+	});
+	if (Date.parse(evidence.completedAt) < Date.parse(evidence.startedAt)) context.addIssue({
+		code: "custom",
+		path: ["completedAt"],
+		message: "Conformance completion must not precede its start"
+	});
+	const names = evidence.checks.map((check) => check.name);
+	if (!validCheckSequence(names)) context.addIssue({
+		code: "custom",
+		path: ["checks"],
+		message: "Conformance checks must be an ordered prefix followed optionally by scoped cleanup"
+	});
+	const cleanupCheck = names.includes("scoped_cleanup");
+	if (evidence.cleanupCompleted && !evidence.cleanupAttempted || cleanupCheck !== evidence.cleanupCompleted) context.addIssue({
+		code: "custom",
+		path: ["cleanupCompleted"],
+		message: "Completed cleanup requires an attempted cleanup and the scoped-cleanup check"
+	});
+}).meta({ id: "ProviderConformanceEvidence" });
+const VerifiedProviderConformanceEvidenceSchema = ProviderConformanceEvidenceSchema.refine((evidence) => evidence.passed && !evidence.sourceModified && evidence.sourceRevision !== "unknown" && evidence.cleanupAttempted && evidence.cleanupCompleted && evidence.checks.every((check, index) => check.name === expectedProviderConformanceChecks[index]) && evidence.checks.length === expectedProviderConformanceChecks.length, "Verified live-suite evidence requires clean traceable source, every ordered check, and completed cleanup").meta({ id: "VerifiedProviderConformanceEvidence" });
+function validCheckSequence(checks) {
+	let position = 0;
+	let cleanupSeen = false;
+	for (const check of checks) {
+		if (check === "scoped_cleanup") {
+			if (cleanupSeen) return false;
+			cleanupSeen = true;
+			continue;
+		}
+		if (cleanupSeen || check !== expectedProviderConformanceChecks[position]) return false;
+		position += 1;
+	}
+	return true;
+}
+function isTrimmedSingleLine(value) {
+	return value.trim() === value && !/[\u0000\r\n]/.test(value);
+}
+//#endregion
+//#region src/contracts/domain-check.ts
+const DomainDelegationStatusSchema = z.enum([
+	"delegated",
+	"undelegated",
+	"unknown"
+]).meta({ id: "DomainDelegationStatus" });
+const DomainSetupSupportSchema = z.enum([
+	"automatic",
+	"manual",
+	"unavailable",
+	"ambiguous",
+	"unknown"
+]).meta({ id: "DomainSetupSupport" });
+const RecordConflictReasonSchema = z.enum([
+	"same_name_and_type",
+	"cname_collision",
+	"mx_set_collision",
+	"spf_collision",
+	"ns_delegation"
+]).meta({ id: "RecordConflictReason" });
+const CheckDomainInputSchema = z.object({
+	domain: DomainNameSchema,
+	records: z.array(ResolvedDnsRecordSchema).max(100).default([]),
+	checkConflicts: z.boolean().default(false)
+}).strict().superRefine((input, context) => {
+	if (input.checkConflicts && input.records.length === 0) context.addIssue({
+		code: "custom",
+		path: ["records"],
+		message: "Record conflict analysis requires at least one requested record"
+	});
+}).meta({ id: "CheckDomainInput" });
+const DomainProviderCandidateSchema = z.object({
+	provider: ProviderSchema,
+	confidence: z.number().min(0).max(1),
+	exact: z.boolean()
+}).strict().meta({ id: "DomainProviderCandidate" });
+const DomainRecordConflictSchema = z.object({
+	requested: ResolvedDnsRecordSchema,
+	existing: z.array(ResolvedDnsRecordSchema).max(1e3),
+	reasons: z.array(RecordConflictReasonSchema).min(1).max(5).refine((reasons) => new Set(reasons).size === reasons.length, "Conflict reasons must be unique")
+}).strict().meta({ id: "DomainRecordConflict" });
+const ConflictAnalysisSchema = z.object({
+	status: z.enum([
+		"not_requested",
+		"complete",
+		"partial"
+	]),
+	authoritativeServers: z.number().int().min(0).max(16),
+	respondingServers: z.number().int().min(0).max(16),
+	conflicts: z.array(DomainRecordConflictSchema).max(100)
+}).strict().superRefine((analysis, context) => {
+	if (analysis.respondingServers > analysis.authoritativeServers) context.addIssue({
+		code: "custom",
+		path: ["respondingServers"],
+		message: "Responding nameservers cannot exceed authoritative nameservers"
+	});
+	if (analysis.status === "complete" && analysis.respondingServers !== analysis.authoritativeServers) context.addIssue({
+		code: "custom",
+		path: ["status"],
+		message: "Complete analysis requires every authoritative nameserver to respond"
+	});
+	if (analysis.status === "partial" && (analysis.respondingServers === 0 || analysis.respondingServers >= analysis.authoritativeServers)) context.addIssue({
+		code: "custom",
+		path: ["status"],
+		message: "Partial analysis requires some but not all authoritative nameservers to respond"
+	});
+	if (analysis.status === "not_requested" && analysis.conflicts.length !== 0) context.addIssue({
+		code: "custom",
+		path: ["conflicts"],
+		message: "Conflict results cannot exist when analysis was not requested"
+	});
+}).meta({ id: "ConflictAnalysis" });
+const CheckDomainResponseSchema = z.object({
+	domain: DomainNameSchema,
+	delegationStatus: DomainDelegationStatusSchema,
+	candidates: z.array(DomainProviderCandidateSchema).max(65),
+	provider: ProviderSchema.optional(),
+	setupSupport: DomainSetupSupportSchema,
+	conflictAnalysis: ConflictAnalysisSchema
+}).strict().superRefine((result, context) => {
+	const candidateIds = result.candidates.map((candidate) => candidate.provider.id);
+	if (new Set(candidateIds).size !== candidateIds.length) context.addIssue({
+		code: "custom",
+		path: ["candidates"],
+		message: "Provider candidates must be unique"
+	});
+	if (result.delegationStatus === "undelegated" && (result.candidates.length !== 0 || result.provider !== void 0 || result.setupSupport !== "unavailable")) context.addIssue({
+		code: "custom",
+		path: ["delegationStatus"],
+		message: "Undelegated domains cannot have provider support"
+	});
+	if (result.provider !== void 0 && !result.candidates.some((candidate) => candidate.exact && candidate.provider.id === result.provider?.id)) context.addIssue({
+		code: "custom",
+		path: ["provider"],
+		message: "Resolved provider must be an exact provider candidate"
+	});
+	if (["automatic", "manual"].includes(result.setupSupport) && result.provider === void 0) context.addIssue({
+		code: "custom",
+		path: ["setupSupport"],
+		message: "Available setup support requires a resolved provider"
+	});
+	if (result.setupSupport === "automatic" && !result.provider?.availableAuthorizationMethods.some((method) => method !== "manual")) context.addIssue({
+		code: "custom",
+		path: ["setupSupport"],
+		message: "Automatic setup requires a configured non-manual authorization method"
+	});
+	if (result.setupSupport === "manual" && (result.provider?.availableAuthorizationMethods.length !== 1 || result.provider.availableAuthorizationMethods[0] !== "manual")) context.addIssue({
+		code: "custom",
+		path: ["setupSupport"],
+		message: "Manual setup requires the manual authorization method"
+	});
+	if (result.setupSupport === "ambiguous" && result.candidates.length === 0) context.addIssue({
+		code: "custom",
+		path: ["candidates"],
+		message: "Ambiguous setup requires provider candidates"
+	});
+	if (result.setupSupport === "unknown" && result.candidates.length !== 0) context.addIssue({
+		code: "custom",
+		path: ["candidates"],
+		message: "Unknown setup cannot include provider candidates"
+	});
+	if (["ambiguous", "unknown"].includes(result.setupSupport) && result.provider !== void 0) context.addIssue({
+		code: "custom",
+		path: ["provider"],
+		message: "Ambiguous or unknown support cannot resolve one provider"
+	});
+}).meta({ id: "CheckDomainResponse" });
+//#endregion
+//#region src/contracts/error.ts
+const Domain0ErrorCodeSchema = z.enum([
+	"invalid_request",
+	"unauthorized",
+	"forbidden",
+	"not_found",
+	"conflict",
+	"rate_limited",
+	"dns_unavailable",
+	"provider_unavailable",
+	"provider_authorization_failed",
+	"provider_limitation",
+	"plan_expired",
+	"propagation_pending",
+	"internal_error"
+]).meta({ id: "Domain0ErrorCode" });
+const Domain0ErrorResponseSchema = z.object({ error: z.object({
+	code: Domain0ErrorCodeSchema,
+	message: z.string().min(1),
+	requestId: z.string().min(1),
+	retryable: z.boolean(),
+	details: z.record(z.string(), z.unknown()).optional()
+}).strict() }).strict().meta({ id: "ErrorResponse" });
+//#endregion
+//#region src/contracts/localization.ts
+/** Locale identifiers supported by Entri Connect's public configuration contract. */
+const domain0Locales = [
+	"en",
+	"es",
+	"pt",
+	"pt-br",
+	"pt-pt",
+	"fr",
+	"it",
+	"de",
+	"nl",
+	"pl",
+	"tr",
+	"ja",
+	"da",
+	"sv"
+];
+const Domain0LocaleSchema = z.enum(domain0Locales).meta({ id: "Domain0Locale" });
+//#endregion
+//#region src/contracts/platform.ts
+/** Public platform request. Application and tenant identity come from the API key. */
+const PlatformCreateConnectionInputSchema = z.strictObject({ intent: DnsIntentSchema }).meta({ id: "PlatformCreateConnectionInput" });
+//#endregion
+//#region src/contracts/webhook.ts
+const Domain0WebhookEventTypeSchema = z.enum([
+	"connection.requested",
+	"provider.detection_started",
+	"provider.selected",
+	"authorization.required",
+	"domain_connect.started",
+	"domain_connect.submitted",
+	"authorization.completed",
+	"connection.planning_started",
+	"connection.plan_prepared",
+	"connection.planning_restarted",
+	"connection.already_configured",
+	"connection.plan_confirmed",
+	"connection.changes_applied",
+	"connection.propagation_checked",
+	"connection.activated",
+	"connection.manual_required",
+	"connection.manual_submitted",
+	"connection.failed_retryable",
+	"connection.retry_started",
+	"connection.cancelled"
+]).meta({ id: "Domain0WebhookEventType" });
+const Domain0WebhookEventIdSchema = z.string().regex(/^[0-9a-f]{64}$/).brand().meta({ id: "Domain0WebhookEventId" });
+const Domain0WebhookAttributesSchema = z.record(z.string().min(1).max(100), z.string().max(4e3)).superRefine((attributes, context) => {
+	if (Object.keys(attributes).length > 64) context.addIssue({
+		code: "custom",
+		message: "Webhook attributes must contain at most 64 entries"
+	});
+}).meta({ id: "Domain0WebhookAttributes" });
+const Domain0WebhookEventSchema = z.strictObject({
+	schemaVersion: z.literal(1),
+	eventId: Domain0WebhookEventIdSchema,
+	type: Domain0WebhookEventTypeSchema,
+	connectionId: ConnectionIdSchema,
+	applicationId: ApplicationIdSchema,
+	tenantId: TenantIdSchema,
+	sequence: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+	occurredAt: IsoDateTimeSchema,
+	attributes: Domain0WebhookAttributesSchema
+}).meta({ id: "Domain0WebhookEvent" });
+const Domain0WebhookVerificationErrorCodeSchema = z.enum([
+	"invalid_headers",
+	"stale_timestamp",
+	"invalid_signature",
+	"invalid_payload",
+	"crypto_unavailable"
+]).meta({ id: "Domain0WebhookVerificationErrorCode" });
+var Domain0WebhookVerificationError = class extends Error {
+	code;
+	name = "Domain0WebhookVerificationError";
+	constructor(code, message, options) {
+		super(message, options);
+		this.code = code;
+	}
+};
+const DOMAIN0_WEBHOOK_HEADER_NAMES = {
+	eventId: "x-domain0-event-id",
+	eventType: "x-domain0-event-type",
+	deliveryAttempt: "x-domain0-delivery-attempt",
+	schemaVersion: "x-domain0-schema-version",
+	signatureKeyId: "x-domain0-signature-key-id",
+	timestamp: "x-domain0-timestamp",
+	signature: "x-domain0-signature"
+};
+const normalizedHeadersSchema = z.strictObject({
+	eventId: Domain0WebhookEventIdSchema,
+	eventType: z.string().regex(/^domain0\.[a-z_]+\.[a-z_]+$/).max(100),
+	deliveryAttempt: z.string().regex(/^[1-9][0-9]{0,8}$/).transform(Number),
+	schemaVersion: z.literal("1"),
+	signatureKeyId: z.string().regex(/^[A-Za-z0-9._-]{1,64}$/),
+	timestamp: z.string().regex(/^[0-9]{1,12}$/).transform(Number),
+	signature: z.string().regex(/^v1=[0-9a-f]{64}$/)
+});
+const textEncoder = new TextEncoder();
+async function verifyDomain0Webhook(input) {
+	const body = typeof input.body === "string" ? textEncoder.encode(input.body) : new Uint8Array(input.body);
+	const maxBodyBytes = boundedPositiveInteger(input.maxBodyBytes ?? 1048576, 16777216);
+	if (!(body instanceof Uint8Array) || body.byteLength === 0 || body.byteLength > maxBodyBytes) throw verificationError("invalid_payload", "Webhook body is empty or exceeds the configured limit");
+	const headers = parseHeaders(input.headers);
+	const now = boundedNonNegativeInteger(input.nowUnixSeconds ?? Math.floor(Date.now() / 1e3), Number.MAX_SAFE_INTEGER);
+	const maxAgeSeconds = boundedPositiveInteger(input.maxAgeSeconds ?? 300, 86400);
+	if (Math.abs(now - headers.timestamp) > maxAgeSeconds) throw verificationError("stale_timestamp", "Webhook timestamp is outside the accepted replay window");
+	const secret = Object.prototype.hasOwnProperty.call(input.secretKeyring, headers.signatureKeyId) ? input.secretKeyring[headers.signatureKeyId] : void 0;
+	if (!(secret instanceof Uint8Array) || secret.byteLength !== 32) throw verificationError("invalid_signature", "Webhook signature is invalid");
+	const crypto = input.crypto ?? globalThis.crypto;
+	if (crypto?.subtle === void 0) throw verificationError("crypto_unavailable", "Web Crypto is unavailable");
+	const signature = hexToBytes(headers.signature.slice(3));
+	const prefix = textEncoder.encode(`v1.${headers.signatureKeyId}.${headers.timestamp}.`);
+	const signedBytes = new Uint8Array(prefix.byteLength + body.byteLength);
+	signedBytes.set(prefix);
+	signedBytes.set(body, prefix.byteLength);
+	const key = await crypto.subtle.importKey("raw", new Uint8Array(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["verify"]);
+	if (!await crypto.subtle.verify("HMAC", key, new Uint8Array(signature), signedBytes)) throw verificationError("invalid_signature", "Webhook signature is invalid");
+	let decoded;
+	try {
+		const text = new TextDecoder("utf-8", { fatal: true }).decode(body);
+		decoded = JSON.parse(text);
+	} catch (error) {
+		throw verificationError("invalid_payload", "Verified webhook body is not valid UTF-8 JSON", error);
+	}
+	const parsed = Domain0WebhookEventSchema.safeParse(decoded);
+	if (!parsed.success) throw verificationError("invalid_payload", "Verified webhook body does not match schema version 1", parsed.error);
+	if (parsed.data.eventId !== headers.eventId || `domain0.${parsed.data.type}` !== headers.eventType || String(parsed.data.schemaVersion) !== headers.schemaVersion) throw verificationError("invalid_payload", "Verified webhook headers do not match the event body");
+	return parsed.data;
+}
+function parseHeaders(source) {
+	const values = {
+		eventId: void 0,
+		eventType: void 0,
+		deliveryAttempt: void 0,
+		schemaVersion: void 0,
+		signatureKeyId: void 0,
+		timestamp: void 0,
+		signature: void 0
+	};
+	if ("get" in source && typeof source.get === "function") for (const [key, name] of Object.entries(DOMAIN0_WEBHOOK_HEADER_NAMES)) values[key] = source.get(name) ?? void 0;
+	else {
+		const accepted = /* @__PURE__ */ new Map();
+		for (const key of Object.keys(DOMAIN0_WEBHOOK_HEADER_NAMES)) accepted.set(DOMAIN0_WEBHOOK_HEADER_NAMES[key], key);
+		const observed = /* @__PURE__ */ new Set();
+		for (const [providedName, providedValue] of Object.entries(source)) {
+			const name = providedName.toLowerCase();
+			const key = accepted.get(name);
+			if (key === void 0) continue;
+			if (observed.has(name) || typeof providedValue !== "string") throw verificationError("invalid_headers", "Webhook headers are missing, duplicated, or malformed");
+			observed.add(name);
+			values[key] = providedValue;
+		}
+	}
+	const parsed = normalizedHeadersSchema.safeParse(values);
+	if (!parsed.success) throw verificationError("invalid_headers", "Webhook headers are missing, duplicated, or malformed", parsed.error);
+	return parsed.data;
+}
+function boundedPositiveInteger(value, maximum) {
+	if (!Number.isSafeInteger(value) || value < 1 || value > maximum) throw verificationError("invalid_headers", "Webhook verification limits are invalid");
+	return value;
+}
+function boundedNonNegativeInteger(value, maximum) {
+	if (!Number.isSafeInteger(value) || value < 0 || value > maximum) throw verificationError("invalid_headers", "Webhook verification time is invalid");
+	return value;
+}
+function hexToBytes(value) {
+	const result = new Uint8Array(value.length / 2);
+	for (let index = 0; index < value.length; index += 2) result[index / 2] = Number.parseInt(value.slice(index, index + 2), 16);
+	return result;
+}
+function verificationError(code, message, cause) {
+	return new Domain0WebhookVerificationError(code, message, cause === void 0 ? void 0 : { cause });
+}
+//#endregion
+export { AccessKeyCredentialsSchema, AccountTokenCredentialsSchema, AdvancedDmarcOptionsSchema, ApiTokenCredentialsSchema, ApplicationIdSchema, ApplyPlanInputSchema, AuthorizationMethodSchema, AuthorizeWithCredentialInputSchema, AwsSessionCredentialsSchema, CPanelCredentialsSchema, CancelConnectionInputSchema, ChangeActionSchema, ChangePlanSchema, CheckDomainInputSchema, CheckDomainResponseSchema, CheckRecordsInputSchema, CheckRecordsResponseSchema, CheckedRecordSchema, ClientCredentialsSchema, CommandIdSchema, CompiledProviderIdSchema, ConditionalDnsRecordsSchema, ConfirmPlanInputSchema, ConflictAnalysisSchema, ConflictPolicySchema, ConnectionFailureCodeSchema, ConnectionFailureSchema, ConnectionFlowIdSchema, ConnectionFlowResponseSchema, ConnectionFlowSchema, ConnectionFlowTargetInputSchema, ConnectionFlowTargetSchema, ConnectionIdSchema, ConnectionSchema, ConnectionStateSchema, CreateConnectionFlowInputSchema, CreateConnectionInputSchema, CreateConnectionResponseSchema, CreateSharedFlowInputSchema, CreateSharedFlowResponseSchema, DOMAIN0_WEBHOOK_HEADER_NAMES, DetectProviderResponseSchema, DkimDnsEvidenceSchema, DkimDnsEvidenceStatusSchema, DkimDnsRecordEvidenceSchema, DkimDnsRecordTypeSchema, DkimGuidanceInputSchema, DkimGuidanceResponseSchema, DkimSelectorSchema, DnsIntentSchema, DnsRecordSchema, DnsRecordTypeSchema, Domain0ApplicationNameSchema, Domain0ConnectCloseEventSchema, Domain0ConnectCloseReasonSchema, Domain0ConnectConfigurationSchema, Domain0ConnectEventSchema, Domain0ConnectStepChangeEventSchema, Domain0ConnectStepSchema, Domain0ConnectSuccessEventSchema, Domain0DkimGuidanceOptionsSchema, Domain0DkimSetupDocumentationClickEventSchema, Domain0ErrorCodeSchema, Domain0ErrorResponseSchema, Domain0LocaleSchema, Domain0ManualSetupDocumentationClickEventSchema, Domain0RequestCloseEventSchema, Domain0SetupPolicySchema, Domain0SharedFlowSentEventSchema, Domain0WebhookAttributesSchema, Domain0WebhookEventIdSchema, Domain0WebhookEventSchema, Domain0WebhookEventTypeSchema, Domain0WebhookVerificationError, Domain0WebhookVerificationErrorCodeSchema, Domain0WhiteLabelCopySchema, Domain0WhiteLabelCustomPropertiesSchema, Domain0WhiteLabelLogoUrlSchema, Domain0WhiteLabelSchema, Domain0WhiteLabelThemeSchema, DomainConnectTemplateSchema, DomainDelegationStatusSchema, DomainNameSchema, DomainProviderCandidateSchema, DomainRecordConflictSchema, DomainSetupSupportSchema, EmailProviderDetectionStatusSchema, EmailProviderSchema, ExistingRecordPolicySchema, GetConnectionResponseSchema, IsoDateTimeSchema, IssueConnectionTokenInputSchema, IssueConnectionTokenResponseSchema, ListProvidersResponseSchema, ManualSetupDocumentationUrlSchema, OAuthCallbackResponseSchema, OvhCredentialsSchema, PlanWarningCodeSchema, PlannedChangeSchema, PlatformCreateConnectionInputSchema, PreparePlanInputSchema, PrivateKeyCredentialsSchema, ProviderCandidateSchema, ProviderCapabilitiesSchema, ProviderConformanceCheckNameSchema, ProviderConformanceEvidenceSchema, ProviderDetectionSchema, ProviderDetectionUnavailableReasonCodeSchema, ProviderHealthReasonSchema, ProviderHealthResponseSchema, ProviderHealthSchema, ProviderHealthStatusSchema, ProviderIdSchema, ProviderImplementationSchema, ProviderSchema, RecordConflictReasonSchema, ResolveSharedFlowInputSchema, ResolveSharedFlowResponseSchema, ResolvedDnsIntentSchema, ResolvedDnsRecordSchema, RetryConnectionInputSchema, RetryResumeStateSchema, SelectProviderInputSchema, SharedFlowIdSchema, SharedFlowInvitationSchema, SharedFlowInvitationUrlSchema, SharedFlowTokenSchema, SharedFlowUrlSchema, SpfConflictPolicySchema, StartDomainConnectInputSchema, StartDomainConnectResponseSchema, StartManualConfigurationInputSchema, StartOAuthInputSchema, StartOAuthResponseSchema, SubmitDomainConnectCompletionInputSchema, SubmitManualCompletionInputSchema, TenantIdSchema, UsernamePasswordCredentialsSchema, UsernameTokenCredentialsSchema, VerifiedProviderConformanceEvidenceSchema, VerifyPropagationInputSchema, colorContrastRatio, directCredentialKindByProvider, domain0Locales, expectedProviderConformanceChecks, verifyDomain0Webhook };
+
+//# sourceMappingURL=contracts.mjs.map