domain0 0.3.2 → 0.4.0

package/dist/contracts.mjs

@@ -1,1666 +1,2 @@
-import { z } from "zod";
-//#region src/contracts/primitives.ts
-const identifier = z.string().trim().min(1).max(200);
-const ConnectionIdSchema = identifier.brand().meta({ id: "ConnectionId" });
-const ApplicationIdSchema = identifier.brand().meta({ id: "ApplicationId" });
-const TenantIdSchema = identifier.brand().meta({ id: "TenantId" });
-const ProviderIdSchema = z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).brand().meta({ id: "ProviderId" });
-const CommandIdSchema = identifier.brand().meta({ id: "CommandId" });
-const DomainNameSchema = z.string().trim().toLowerCase().overwrite((value) => value.replace(/\.$/, "")).min(3).max(253).regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/).refine((value) => !/^\d+(?:\.\d+){3}$/.test(value), "IP addresses are not domain names").brand().meta({ id: "DomainName" });
-const IsoDateTimeSchema = z.iso.datetime({ offset: true }).meta({ id: "IsoDateTime" });
-//#endregion
-//#region src/contracts/dns.ts
-const RelativeDnsHostSchema = z.string().trim().toLowerCase().overwrite((value) => value.replace(/\.$/, "")).min(1).max(253).refine(isRelativeDnsHost, "Host must be @ or a valid relative DNS name");
-const caaValuePattern = /^([0-9]{1,3})[\t ]+([A-Za-z0-9-]{1,15})[\t ]+(?:"([^\r\n"]*)"|([^\r\n"]+))$/;
-const DnsRecordTypeSchema = z.enum([
-	"A",
-	"AAAA",
-	"CNAME",
-	"CAA",
-	"MX",
-	"TXT",
-	"NS"
-]).meta({ id: "DnsRecordType" });
-const DmarcTagNameSchema = z.string().regex(/^[a-z]{1,32}$/);
-const DmarcTagValueSchema = z.string().min(1).max(4096).refine((value) => value.trim() === value && /^[\x20-\x3a\x3c-\x7e]+$/.test(value), { message: "DMARC tag values must be trimmed printable ASCII without semicolons" });
-const DmarcTagMapSchema = z.record(DmarcTagNameSchema, DmarcTagValueSchema).refine((tags) => Object.keys(tags).length <= 32, "At most 32 DMARC tags are allowed");
-const AdvancedDmarcOptionsSchema = z.object({
-	inheritRootDmarc: z.boolean().default(false),
-	overrideTags: DmarcTagMapSchema.default({}),
-	removeTags: z.array(DmarcTagNameSchema).max(32).refine((tags) => new Set(tags).size === tags.length, "DMARC tags to remove must be unique").default([]),
-	addTagsIfNotExist: DmarcTagMapSchema.default({})
-}).strict().refine((options) => options.inheritRootDmarc || Object.keys(options.overrideTags).length > 0 || options.removeTags.length > 0 || Object.keys(options.addTagsIfNotExist).length > 0, "At least one advanced DMARC option is required").superRefine((options, context) => {
-	for (const [field, tags] of [["overrideTags", options.overrideTags], ["addTagsIfNotExist", options.addTagsIfNotExist]]) for (const [name, value] of Object.entries(tags)) if (!isValidKnownDmarcTag(name, value)) context.addIssue({
-		code: "custom",
-		path: [field, name],
-		message: `Invalid value for the ${name} DMARC tag`
-	});
-}).meta({ id: "AdvancedDmarcOptions" });
-const CoreDnsRecordSchema = z.object({
-	host: RelativeDnsHostSchema,
-	type: DnsRecordTypeSchema,
-	value: z.string().trim().min(1).max(65535),
-	ttl: z.number().int().min(1).max(2147483647).default(300),
-	priority: z.number().int().min(0).max(65535).optional(),
-	optional: z.boolean().default(false)
-}).strict().superRefine((record, context) => {
-	if (record.type === "MX" && record.priority === void 0) context.addIssue({
-		code: "custom",
-		path: ["priority"],
-		message: "MX records require a priority"
-	});
-	if (record.type !== "MX" && record.priority !== void 0) context.addIssue({
-		code: "custom",
-		path: ["priority"],
-		message: "Only MX records accept a priority"
-	});
-	if (record.type === "A" && !z.ipv4().safeParse(record.value).success) context.addIssue({
-		code: "custom",
-		path: ["value"],
-		message: "A records require an IPv4 address"
-	});
-	if (record.type === "AAAA" && !z.ipv6().safeParse(record.value).success) context.addIssue({
-		code: "custom",
-		path: ["value"],
-		message: "AAAA records require an IPv6 address"
-	});
-	if ([
-		"CNAME",
-		"MX",
-		"NS"
-	].includes(record.type) && !DomainNameSchema.safeParse(record.value).success) context.addIssue({
-		code: "custom",
-		path: ["value"],
-		message: `${record.type} records require a domain name`
-	});
-	if (record.type === "CAA") {
-		const match = caaValuePattern.exec(record.value);
-		if (match === null || Number(match[1]) > 255) context.addIssue({
-			code: "custom",
-			path: ["value"],
-			message: "CAA values must contain flags, a tag, and a quoted value"
-		});
-	}
-	if (record.type === "TXT" && /[\u0000\r\n]/.test(record.value)) context.addIssue({
-		code: "custom",
-		path: ["value"],
-		message: "TXT values cannot contain NUL or newlines"
-	});
-});
-const ResolvedDnsRecordSchema = CoreDnsRecordSchema.meta({ id: "ResolvedDnsRecord" });
-const DnsRecordSchema = CoreDnsRecordSchema.safeExtend({ advancedDmarcOptions: AdvancedDmarcOptionsSchema.optional() }).superRefine((record, context) => {
-	if (record.advancedDmarcOptions === void 0) return;
-	if (record.type !== "TXT" || record.host !== "_dmarc" && !record.host.startsWith("_dmarc.")) context.addIssue({
-		code: "custom",
-		path: ["advancedDmarcOptions"],
-		message: "Advanced DMARC options require a TXT record at a _dmarc host"
-	});
-	if (!isValidDmarcRecord(record.value)) context.addIssue({
-		code: "custom",
-		path: ["value"],
-		message: "Advanced DMARC options require a valid DMARC1 value with a policy tag"
-	});
-}).meta({ id: "DnsRecord" });
-const ExistingRecordPolicySchema = z.object({
-	validateDmarc: z.boolean().default(false),
-	validateCAA: z.boolean().default(false)
-}).strict().meta({ id: "ExistingRecordPolicy" });
-const DnsIntentSchema = z.object({
-	domain: DomainNameSchema,
-	records: z.array(DnsRecordSchema).min(1).max(100),
-	existingRecordPolicy: ExistingRecordPolicySchema.default({
-		validateDmarc: false,
-		validateCAA: false
-	})
-}).strict().meta({ id: "DnsIntent" });
-const ResolvedDnsIntentSchema = z.object({
-	domain: DomainNameSchema,
-	records: z.array(ResolvedDnsRecordSchema).max(100)
-}).strict().meta({ id: "ResolvedDnsIntent" });
-const CheckRecordsInputSchema = ResolvedDnsIntentSchema.meta({ id: "CheckRecordsInput" });
-const CheckedRecordSchema = z.object({
-	record: ResolvedDnsRecordSchema,
-	authoritativeServers: z.number().int().min(1).max(16),
-	matchingServers: z.number().int().min(0).max(16),
-	propagated: z.boolean()
-}).strict().superRefine((result, context) => {
-	if (result.matchingServers > result.authoritativeServers) context.addIssue({
-		code: "custom",
-		path: ["matchingServers"],
-		message: "Matching nameservers cannot exceed authoritative nameservers"
-	});
-	if (result.propagated !== (result.matchingServers === result.authoritativeServers)) context.addIssue({
-		code: "custom",
-		path: ["propagated"],
-		message: "Propagation state must match the authoritative nameserver counts"
-	});
-}).meta({ id: "CheckedRecord" });
-const CheckRecordsResponseSchema = z.object({
-	domain: DomainNameSchema,
-	allPropagated: z.boolean(),
-	records: z.array(CheckedRecordSchema).min(1).max(100)
-}).strict().superRefine((result, context) => {
-	if (result.allPropagated !== result.records.every((record) => record.propagated)) context.addIssue({
-		code: "custom",
-		path: ["allPropagated"],
-		message: "Overall propagation state must match every record result"
-	});
-}).meta({ id: "CheckRecordsResponse" });
-const ConflictPolicySchema = z.enum([
-	"preserve",
-	"replace_same_name_and_type",
-	"replace_all_at_name"
-]).meta({ id: "ConflictPolicy" });
-const SpfConflictPolicySchema = z.enum(["merge", "replace"]).meta({ id: "SpfConflictPolicy" });
-const ChangeActionSchema = z.enum([
-	"create",
-	"replace",
-	"delete"
-]).meta({ id: "ChangeAction" });
-const PlannedChangeSchema = z.object({
-	action: ChangeActionSchema,
-	before: ResolvedDnsRecordSchema.optional(),
-	after: ResolvedDnsRecordSchema.optional(),
-	destructive: z.boolean()
-}).strict().superRefine((change, context) => {
-	if (change.action === "create" && change.after === void 0) context.addIssue({
-		code: "custom",
-		path: ["after"],
-		message: "Create requires the resulting record"
-	});
-	if (change.action === "replace" && (change.before === void 0 || change.after === void 0)) context.addIssue({
-		code: "custom",
-		message: "Replace requires both current and resulting records"
-	});
-	if (change.action === "delete" && change.before === void 0) context.addIssue({
-		code: "custom",
-		path: ["before"],
-		message: "Delete requires the current record"
-	});
-}).meta({ id: "PlannedChange" });
-function isRelativeDnsHost(value) {
-	if (value === "@") return true;
-	return value.split(".").every((label, index) => {
-		if (label === "*") return index === 0;
-		return label.length >= 1 && label.length <= 63 && !label.startsWith("-") && !label.endsWith("-") && /^[a-z0-9_-]+$/.test(label);
-	});
-}
-function isValidDmarcRecord(value) {
-	const parts = value.split(";").map((part) => part.trim()).filter(Boolean);
-	const seen = /* @__PURE__ */ new Set();
-	if (parts.length < 2) return false;
-	for (const [index, part] of parts.entries()) {
-		const separator = part.indexOf("=");
-		if (separator <= 0) return false;
-		const name = part.slice(0, separator).trim().toLowerCase();
-		const tagValue = part.slice(separator + 1).trim();
-		if (!DmarcTagNameSchema.safeParse(name).success || !DmarcTagValueSchema.safeParse(tagValue).success || seen.has(name)) return false;
-		if (index === 0 && (name !== "v" || tagValue !== "DMARC1")) return false;
-		if (!isValidKnownDmarcTag(name, tagValue)) return false;
-		seen.add(name);
-	}
-	return seen.has("p");
-}
-function isValidKnownDmarcTag(name, value) {
-	if (name === "v") return value === "DMARC1";
-	if ([
-		"p",
-		"sp",
-		"np"
-	].includes(name)) return [
-		"none",
-		"quarantine",
-		"reject"
-	].includes(value);
-	if (["adkim", "aspf"].includes(name)) return value === "r" || value === "s";
-	if (name === "pct") return /^\d{1,3}$/.test(value) && Number(value) <= 100;
-	if (name === "ri") return /^[1-9]\d*$/.test(value);
-	if (name === "rf") return value === "afrf";
-	if (name === "fo") {
-		const options = value.split(":");
-		return options.length > 0 && new Set(options).size === options.length && options.every((option) => [
-			"0",
-			"1",
-			"d",
-			"s"
-		].includes(option)) && !(options.includes("0") && options.includes("1"));
-	}
-	return true;
-}
-//#endregion
-//#region src/contracts/provider.ts
-const ProviderImplementationSchema = z.enum([
-	"automatic",
-	"domain_connect",
-	"manual",
-	"unverified"
-]).meta({ id: "ProviderImplementation" });
-const AuthorizationMethodSchema = z.enum([
-	"oauth2_pkce",
-	"oauth2_authorization_code",
-	"api_token",
-	"api_key",
-	"basic",
-	"session",
-	"domain_connect",
-	"manual"
-]).meta({ id: "AuthorizationMethod" });
-const ProviderCapabilitiesSchema = z.strictObject({
-	rootNSModification: z.enum([
-		"supported",
-		"unsupported",
-		"unverified"
-	]),
-	subdomainNSModification: z.enum([
-		"supported",
-		"unsupported",
-		"unverified"
-	]),
-	wwwRedirect: z.enum([
-		"supported",
-		"unsupported",
-		"unverified"
-	]),
-	cnameFlattening: z.enum([
-		"supported",
-		"unsupported",
-		"unverified"
-	]),
-	wildcardRecords: z.enum([
-		"supported",
-		"unsupported",
-		"unverified"
-	]),
-	caaRecords: z.enum([
-		"supported",
-		"unsupported",
-		"unverified"
-	]),
-	spfRecords: z.enum([
-		"supported",
-		"unsupported",
-		"unverified"
-	]),
-	socialLogin: z.enum([
-		"supported",
-		"unsupported",
-		"unverified"
-	])
-}).meta({ id: "ProviderCapabilities" });
-const ProviderDetectionUnavailableReasonCodeSchema = z.enum(["no_stable_public_provider_identity"]).meta({ id: "ProviderDetectionUnavailableReasonCode" });
-const ProviderDetectionSchema = z.discriminatedUnion("method", [z.strictObject({ method: z.enum([
-	"nameserver",
-	"domain_connect",
-	"nameserver_or_domain_connect"
-]) }), z.strictObject({
-	method: z.literal("manual"),
-	reasonCode: ProviderDetectionUnavailableReasonCodeSchema
-})]).meta({ id: "ProviderDetection" });
-const ProviderReferenceUrlSchema = z.url({ protocol: /^https$/ }).regex(/^https:\/\//, "Provider reference URL must use HTTPS").refine((value) => {
-	const url = new URL(value);
-	return url.username === "" && url.password === "";
-}, "Provider reference URL must not contain credentials").meta({ format: "uri" });
-const ProviderSchema = z.object({
-	id: ProviderIdSchema,
-	name: z.string().trim().min(1),
-	referenceUrl: ProviderReferenceUrlSchema,
-	implementation: ProviderImplementationSchema,
-	availableAuthorizationMethods: z.array(AuthorizationMethodSchema).refine((methods) => new Set(methods).size === methods.length, "Authorization methods must be unique").describe("Available methods ordered from highest to lowest provider autonomy."),
-	capabilities: ProviderCapabilitiesSchema,
-	detection: ProviderDetectionSchema,
-	limitations: z.array(z.string().min(1))
-}).strict().superRefine((provider, context) => {
-	const methods = provider.availableAuthorizationMethods;
-	if (!(provider.implementation === "automatic" ? methods.every((method) => method !== "domain_connect" && method !== "manual") : provider.implementation === "domain_connect" ? methods.every((method) => method === "domain_connect") : provider.implementation === "manual" ? methods.every((method) => method === "manual") : methods.length === 0)) context.addIssue({
-		code: "custom",
-		path: ["availableAuthorizationMethods"],
-		message: "Authorization methods must match the verified provider implementation"
-	});
-}).meta({ id: "Provider" });
-const ListProvidersResponseSchema = z.object({ providers: z.array(ProviderSchema) }).strict().meta({ id: "ListProvidersResponse" });
-const ProviderHealthStatusSchema = z.enum(["operational", "unavailable"]).meta({ id: "ProviderHealthStatus" });
-const ProviderHealthReasonSchema = z.enum([
-	"automatic_ready",
-	"domain_connect_ready",
-	"runtime_authorization_unavailable",
-	"manual_only",
-	"unverified"
-]).meta({ id: "ProviderHealthReason" });
-const ProviderHealthSchema = z.object({
-	providerId: ProviderIdSchema,
-	providerName: z.string().trim().min(1).max(200),
-	enabled: z.boolean(),
-	status: ProviderHealthStatusSchema,
-	reason: ProviderHealthReasonSchema
-}).strict().superRefine((health, context) => {
-	const readyReason = health.reason === "automatic_ready" || health.reason === "domain_connect_ready";
-	const matchingStatus = health.enabled ? health.status === "operational" : health.status === "unavailable";
-	if (health.enabled !== readyReason || !matchingStatus) context.addIssue({
-		code: "custom",
-		path: ["enabled"],
-		message: "Enabled, status, and reason must describe the same provider health state"
-	});
-}).meta({ id: "ProviderHealth" });
-const ProviderHealthResponseSchema = z.object({
-	observedAt: IsoDateTimeSchema,
-	refreshAfter: IsoDateTimeSchema,
-	providers: z.array(ProviderHealthSchema)
-}).strict().superRefine((report, context) => {
-	if (Date.parse(report.refreshAfter) <= Date.parse(report.observedAt)) context.addIssue({
-		code: "custom",
-		path: ["refreshAfter"],
-		message: "Provider health refresh deadline must be after its observation time"
-	});
-	const providerIds = report.providers.map((provider) => provider.providerId);
-	if (new Set(providerIds).size !== providerIds.length) context.addIssue({
-		code: "custom",
-		path: ["providers"],
-		message: "Provider health entries must have unique provider IDs"
-	});
-}).meta({ id: "ProviderHealthResponse" });
-//#endregion
-//#region src/contracts/connection.ts
-const ConnectionStateSchema = z.enum([
-	"requested",
-	"detecting_provider",
-	"provider_selected",
-	"domain_connect_pending",
-	"authorization_pending",
-	"authorized",
-	"planning",
-	"awaiting_confirmation",
-	"applying",
-	"propagation_pending",
-	"active",
-	"manual_required",
-	"failed_retryable",
-	"failed_terminal",
-	"cancelled"
-]).meta({ id: "ConnectionState" });
-const RetryResumeStateSchema = z.enum([
-	"authorized",
-	"awaiting_confirmation",
-	"applying"
-]).meta({ id: "RetryResumeState" });
-const ConnectionFailureCodeSchema = z.enum(["provider_snapshot_timeout", "provider_apply_timeout"]).meta({ id: "ConnectionFailureCode" });
-const ConnectionFailureSchema = z.object({
-	code: ConnectionFailureCodeSchema,
-	retryable: z.literal(true),
-	resumeState: RetryResumeStateSchema,
-	occurredAt: IsoDateTimeSchema
-}).strict().meta({ id: "ConnectionFailure" });
-const PlanWarningCodeSchema = z.enum(["spf_policy_replaced", "spf_policy_merged"]).meta({ id: "PlanWarningCode" });
-const ChangePlanSchema = z.object({
-	digest: z.string().regex(/^[a-f0-9]{64}$/),
-	changes: z.array(PlannedChangeSchema).min(1),
-	warnings: z.array(PlanWarningCodeSchema),
-	expiresAt: IsoDateTimeSchema
-}).strict().meta({ id: "ChangePlan" });
-const ConnectionSchema = z.object({
-	id: ConnectionIdSchema,
-	applicationId: ApplicationIdSchema,
-	tenantId: TenantIdSchema,
-	intent: DnsIntentSchema,
-	effectiveIntent: ResolvedDnsIntentSchema.optional(),
-	state: ConnectionStateSchema,
-	provider: ProviderSchema.optional(),
-	plan: ChangePlanSchema.optional(),
-	failure: ConnectionFailureSchema.optional(),
-	optionalFailures: z.array(z.string()),
-	createdAt: IsoDateTimeSchema,
-	updatedAt: IsoDateTimeSchema
-}).strict().superRefine((connection, context) => {
-	const requiresFailure = connection.state === "failed_retryable";
-	if (requiresFailure !== (connection.failure !== void 0)) context.addIssue({
-		code: "custom",
-		path: ["failure"],
-		message: requiresFailure ? "A retryable failure state requires failure details" : "Failure details are allowed only in a retryable failure state"
-	});
-	if (connection.effectiveIntent !== void 0 && connection.effectiveIntent.domain !== connection.intent.domain) context.addIssue({
-		code: "custom",
-		path: ["effectiveIntent", "domain"],
-		message: "Effective intent must use the requested intent domain"
-	});
-}).meta({ id: "Connection" });
-const CreateConnectionInputSchema = z.object({
-	applicationId: ApplicationIdSchema,
-	tenantId: TenantIdSchema,
-	intent: DnsIntentSchema,
-	commandId: CommandIdSchema
-}).strict().meta({ id: "CreateConnectionInput" });
-const CreateConnectionResponseSchema = z.object({ connection: ConnectionSchema }).strict().meta({ id: "ConnectionResponse" });
-const GetConnectionResponseSchema = CreateConnectionResponseSchema;
-const ProviderCandidateSchema = z.object({
-	provider: ProviderSchema,
-	confidence: z.number().min(0).max(1)
-}).strict().meta({ id: "ProviderCandidate" });
-const DetectProviderResponseSchema = z.object({
-	connection: ConnectionSchema,
-	candidates: z.array(ProviderCandidateSchema)
-}).strict().meta({ id: "DetectProviderResponse" });
-const SelectProviderInputSchema = z.object({
-	providerId: ProviderIdSchema,
-	commandId: CommandIdSchema
-}).strict().meta({ id: "SelectProviderInput" });
-const DomainConnectIdSchema = z.string().regex(/^[A-Za-z0-9._-]{1,63}$/);
-const DomainConnectPropertyNameSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,62}$/);
-const reservedDomainConnectProperties = /* @__PURE__ */ new Set([
-	"domain",
-	"host",
-	"groupId",
-	"providerName",
-	"serviceName",
-	"instanceId",
-	"redirect_uri",
-	"state",
-	"sig",
-	"key"
-]);
-const DomainConnectPropertiesSchema = z.record(DomainConnectPropertyNameSchema, z.string().min(1).max(4096).refine((value) => value.trim() === value && !/[\u0000\r\n]/.test(value), "Domain Connect property values must be trimmed and single-line")).refine((properties) => Object.keys(properties).length <= 64, "At most 64 Domain Connect properties are allowed").refine((properties) => Object.keys(properties).every((name) => !reservedDomainConnectProperties.has(name)), "Domain Connect properties must not override reserved protocol parameters");
-const DomainConnectTemplateSchema = z.object({
-	serviceProviderId: DomainConnectIdSchema,
-	serviceId: DomainConnectIdSchema,
-	host: z.string().max(253).regex(/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/).optional(),
-	groupId: DomainConnectIdSchema.optional(),
-	providerName: z.string().trim().min(1).max(200).optional(),
-	serviceName: z.string().trim().min(1).max(200).optional(),
-	instanceId: DomainConnectIdSchema.optional(),
-	properties: DomainConnectPropertiesSchema
-}).strict().meta({ id: "DomainConnectTemplate" });
-const StartDomainConnectInputSchema = DomainConnectTemplateSchema.extend({ commandId: CommandIdSchema }).strict().meta({ id: "StartDomainConnectInput" });
-const DomainConnectHandoffUrlSchema = z.url({ protocol: /^https$/ }).refine((value) => {
-	const url = new URL(value);
-	return url.username === "" && url.password === "" && url.hash === "";
-}, "Domain Connect handoff URL must be HTTPS without credentials or a fragment");
-const StartDomainConnectResponseSchema = z.object({
-	connection: ConnectionSchema,
-	handoffUrl: DomainConnectHandoffUrlSchema
-}).strict().meta({ id: "StartDomainConnectResponse" });
-const SubmitDomainConnectCompletionInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "SubmitDomainConnectCompletionInput" });
-const ConfirmPlanInputSchema = z.object({
-	digest: z.string().regex(/^[a-f0-9]{64}$/),
-	allowDestructive: z.boolean(),
-	commandId: CommandIdSchema
-}).strict().meta({ id: "ConfirmPlanInput" });
-const StartOAuthInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "StartOAuthInput" });
-const StartOAuthResponseSchema = z.object({
-	connection: ConnectionSchema,
-	authorizationUrl: z.url({ protocol: /^https$/ }),
-	expiresAt: IsoDateTimeSchema
-}).strict().meta({ id: "StartOAuthResponse" });
-const SecretSchema = z.string().min(1).max(16384).refine((value) => value.trim() === value, "Credential values must not have leading or trailing whitespace").meta({
-	format: "password",
-	writeOnly: true
-});
-const ApiTokenCredentialsSchema = z.object({
-	kind: z.literal("api_token"),
-	token: SecretSchema
-}).strict().meta({ id: "ApiTokenCredentials" });
-const AccessKeyCredentialsSchema = z.object({
-	kind: z.literal("access_key"),
-	keyId: SecretSchema,
-	secret: SecretSchema
-}).strict().meta({ id: "AccessKeyCredentials" });
-const UsernamePasswordCredentialsSchema = z.object({
-	kind: z.literal("username_password"),
-	username: SecretSchema,
-	password: SecretSchema
-}).strict().meta({ id: "UsernamePasswordCredentials" });
-const AccountTokenCredentialsSchema = z.object({
-	kind: z.literal("account_token"),
-	accountId: SecretSchema,
-	token: SecretSchema
-}).strict().meta({ id: "AccountTokenCredentials" });
-const UsernameTokenCredentialsSchema = z.object({
-	kind: z.literal("username_token"),
-	username: SecretSchema,
-	token: SecretSchema
-}).strict().meta({ id: "UsernameTokenCredentials" });
-const OvhCredentialsSchema = z.object({
-	kind: z.literal("ovh"),
-	endpoint: z.enum([
-		"ovh-eu",
-		"ovh-us",
-		"ovh-ca",
-		"kimsufi-eu",
-		"kimsufi-ca",
-		"soyoustart-eu",
-		"soyoustart-ca"
-	]),
-	applicationKey: SecretSchema,
-	applicationSecret: SecretSchema,
-	consumerKey: SecretSchema
-}).strict().meta({ id: "OvhCredentials" });
-const PrivateKeyCredentialsSchema = z.object({
-	kind: z.literal("private_key"),
-	login: SecretSchema,
-	privateKey: SecretSchema.refine((value) => /^(-----BEGIN (?:RSA )?PRIVATE KEY-----)[\s\S]+(-----END (?:RSA )?PRIVATE KEY-----)$/.test(value), "A PKCS#8 or PKCS#1 PEM private key is required")
-}).strict().meta({ id: "PrivateKeyCredentials" });
-const AwsSessionCredentialsSchema = z.object({
-	kind: z.literal("aws_session"),
-	keyId: SecretSchema.regex(/^[A-Z0-9]{16,128}$/),
-	secret: SecretSchema,
-	sessionToken: SecretSchema,
-	hostedZoneId: z.string().regex(/^Z[A-Z0-9]{1,63}$/),
-	expiresAt: IsoDateTimeSchema
-}).strict().meta({ id: "AwsSessionCredentials" });
-const CPanelEndpointSchema = z.url({ protocol: /^https$/ }).refine((value) => {
-	const url = new URL(value);
-	return url.port === "2083" && url.username === "" && url.password === "" && (url.pathname === "" || url.pathname === "/") && url.search === "" && url.hash === "";
-}, "cPanel endpoint must be an HTTPS origin on port 2083");
-const CPanelCredentialsSchema = z.object({
-	kind: z.literal("cpanel"),
-	endpoint: CPanelEndpointSchema,
-	username: SecretSchema,
-	token: SecretSchema
-}).strict().meta({ id: "CPanelCredentials" });
-const ClientCredentialsSchema = z.object({
-	kind: z.literal("client_credentials"),
-	clientId: SecretSchema,
-	clientSecret: SecretSchema
-}).strict().meta({ id: "ClientCredentials" });
-function credentialInput(providerId, credentials) {
-	return z.object({
-		providerId: z.literal(providerId),
-		credentials,
-		commandId: CommandIdSchema
-	}).strict();
-}
-const directCredentialAuthorizationOptions = [
-	credentialInput("alibaba-cloud", AccessKeyCredentialsSchema),
-	credentialInput("all-inkl", UsernamePasswordCredentialsSchema),
-	credentialInput("amazon-route-53", AwsSessionCredentialsSchema),
-	credentialInput("cloudflare", ApiTokenCredentialsSchema),
-	credentialInput("cloudns", AccountTokenCredentialsSchema),
-	credentialInput("digitalocean", ApiTokenCredentialsSchema),
-	credentialInput("dnsimple", AccountTokenCredentialsSchema),
-	credentialInput("dreamhost", ApiTokenCredentialsSchema),
-	credentialInput("dynadot", AccessKeyCredentialsSchema),
-	credentialInput("easydns", AccessKeyCredentialsSchema),
-	credentialInput("gandi", ApiTokenCredentialsSchema),
-	credentialInput("godaddy", ApiTokenCredentialsSchema),
-	credentialInput("hetzner", ApiTokenCredentialsSchema),
-	credentialInput("hostgator", CPanelCredentialsSchema),
-	credentialInput("hostinger", ApiTokenCredentialsSchema),
-	credentialInput("hosting-com", CPanelCredentialsSchema),
-	credentialInput("inmotion-hosting", CPanelCredentialsSchema),
-	credentialInput("ionos", ApiTokenCredentialsSchema),
-	credentialInput("name-com", UsernameTokenCredentialsSchema),
-	credentialInput("namesilo", ApiTokenCredentialsSchema),
-	credentialInput("netlify", ApiTokenCredentialsSchema),
-	credentialInput("o2switch", CPanelCredentialsSchema),
-	credentialInput("openprovider", ApiTokenCredentialsSchema),
-	credentialInput("opensrs", ClientCredentialsSchema),
-	credentialInput("ovh", OvhCredentialsSchema),
-	credentialInput("porkbun", AccessKeyCredentialsSchema),
-	credentialInput("simply", ApiTokenCredentialsSchema),
-	credentialInput("spaceship", AccessKeyCredentialsSchema),
-	credentialInput("transip", PrivateKeyCredentialsSchema),
-	credentialInput("united-domains", ApiTokenCredentialsSchema),
-	credentialInput("vercel", ApiTokenCredentialsSchema),
-	credentialInput("wix", AccountTokenCredentialsSchema)
-];
-const directCredentialKindByProvider = Object.freeze(Object.fromEntries(directCredentialAuthorizationOptions.map((option) => [option.shape.providerId.value, option.shape.credentials.shape.kind.value])));
-const AuthorizeWithCredentialInputSchema = z.discriminatedUnion("providerId", directCredentialAuthorizationOptions).meta({ id: "AuthorizeWithCredentialInput" });
-const OAuthCallbackResponseSchema = z.object({ completed: z.literal(true) }).strict().meta({ id: "OAuthCallbackResponse" });
-const PreparePlanInputSchema = z.object({
-	conflictPolicy: ConflictPolicySchema,
-	spfPolicy: SpfConflictPolicySchema.default("merge"),
-	commandId: CommandIdSchema
-}).strict().meta({ id: "PreparePlanInput" });
-const ApplyPlanInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "ApplyPlanInput" });
-const VerifyPropagationInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "VerifyPropagationInput" });
-const StartManualConfigurationInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "StartManualConfigurationInput" });
-const SubmitManualCompletionInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "SubmitManualCompletionInput" });
-const CancelConnectionInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "CancelConnectionInput" });
-const RetryConnectionInputSchema = z.object({ commandId: CommandIdSchema }).strict().meta({ id: "RetryConnectionInput" });
-const IssueConnectionTokenInputSchema = z.object({ origin: z.url().refine((value) => {
-	const url = new URL(value);
-	return url.username === "" && url.password === "" && url.search === "" && url.hash === "" && (url.pathname === "" || url.pathname === "/") && (url.protocol === "https:" || url.protocol === "http:" && isLoopbackHost(url.hostname));
-}, "Origin must be an HTTPS origin without a path, query, or fragment") }).strict().meta({ id: "IssueConnectionTokenInput" });
-const IssueConnectionTokenResponseSchema = z.object({
-	accessToken: z.string().min(1).max(8192),
-	tokenType: z.literal("Bearer"),
-	expiresAt: IsoDateTimeSchema
-}).strict().meta({ id: "IssueConnectionTokenResponse" });
-function isLoopbackHost(hostname) {
-	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
-}
-//#endregion
-//#region src/contracts/connection-flow.ts
-const ConnectionFlowIdSchema = z.string().trim().min(1).max(200).meta({ id: "ConnectionFlowId" });
-const ConditionalDnsRecordsSchema = z.strictObject({
-	domain: z.array(DnsRecordSchema).min(1).max(100),
-	subDomain: z.array(DnsRecordSchema).min(1).max(100).optional(),
-	rootNS: z.array(DnsRecordSchema).min(1).max(100).optional()
-}).superRefine((records, context) => {
-	records.rootNS?.forEach((record, index) => {
-		if (record.host !== "@" || record.type !== "NS") context.addIssue({
-			code: "custom",
-			path: ["rootNS", index],
-			message: "rootNS accepts only NS records at the zone apex"
-		});
-	});
-}).meta({ id: "ConditionalDnsRecords" });
-const DirectConnectionFlowTargetInputSchema = z.strictObject({
-	domain: DomainNameSchema,
-	records: z.array(DnsRecordSchema).min(1).max(100)
-});
-const ConditionalConnectionFlowTargetInputSchema = z.strictObject({
-	domain: DomainNameSchema,
-	conditionalRecords: ConditionalDnsRecordsSchema
-});
-const ConnectionFlowTargetInputSchema = z.union([DirectConnectionFlowTargetInputSchema, ConditionalConnectionFlowTargetInputSchema]).meta({ id: "ConnectionFlowTargetInput" });
-const CreateConnectionFlowInputSchema = z.strictObject({
-	applicationId: ApplicationIdSchema,
-	tenantId: TenantIdSchema,
-	existingRecordPolicy: ExistingRecordPolicySchema.default({
-		validateDmarc: false,
-		validateCAA: false
-	}),
-	targets: z.array(ConnectionFlowTargetInputSchema).min(2).max(100).superRefine((targets, context) => {
-		const seen = /* @__PURE__ */ new Set();
-		targets.forEach((target, index) => {
-			if (seen.has(target.domain)) context.addIssue({
-				code: "custom",
-				path: [index, "domain"],
-				message: "Flow target domains must be unique"
-			});
-			seen.add(target.domain);
-		});
-	}),
-	commandId: CommandIdSchema
-}).meta({ id: "CreateConnectionFlowInput" });
-const ConnectionFlowTargetSchema = z.strictObject({
-	domain: DomainNameSchema,
-	state: z.enum(["pending", "provisioned"]),
-	connectionId: ConnectionIdSchema.optional()
-}).superRefine((target, context) => {
-	if (target.state === "provisioned" !== (target.connectionId !== void 0)) context.addIssue({
-		code: "custom",
-		path: ["connectionId"],
-		message: target.state === "provisioned" ? "A provisioned target requires a connection id" : "A pending target cannot have a connection id"
-	});
-}).meta({ id: "ConnectionFlowTarget" });
-const ConnectionFlowSchema = z.strictObject({
-	id: ConnectionFlowIdSchema,
-	applicationId: ApplicationIdSchema,
-	tenantId: TenantIdSchema,
-	state: z.enum(["provisioning", "ready"]),
-	targets: z.array(ConnectionFlowTargetSchema).min(2).max(100),
-	createdAt: IsoDateTimeSchema,
-	updatedAt: IsoDateTimeSchema
-}).superRefine((flow, context) => {
-	const allProvisioned = flow.targets.every((target) => target.state === "provisioned");
-	if (flow.state === "ready" !== allProvisioned) context.addIssue({
-		code: "custom",
-		path: ["state"],
-		message: "Flow state must match target provisioning state"
-	});
-}).meta({ id: "ConnectionFlow" });
-const ConnectionFlowResponseSchema = z.strictObject({ flow: ConnectionFlowSchema }).meta({ id: "ConnectionFlowResponse" });
-//#endregion
-//#region src/contracts/shared-flow.ts
-const SharedFlowIdSchema = z.string().min(1).max(200).brand();
-const SharedFlowTokenSchema = z.string().regex(/^[A-Za-z0-9_-]{43}$/).brand();
-const CreateSharedFlowInputSchema = z.strictObject({
-	connectionId: ConnectionIdSchema,
-	expiresAt: IsoDateTimeSchema
-});
-const CreateSharedFlowResponseSchema = z.strictObject({
-	sharedFlowId: SharedFlowIdSchema,
-	token: SharedFlowTokenSchema,
-	expiresAt: IsoDateTimeSchema
-});
-const ResolveSharedFlowInputSchema = z.strictObject({
-	token: SharedFlowTokenSchema,
-	origin: z.string().url().max(2048)
-});
-const ResolveSharedFlowResponseSchema = z.strictObject({
-	sharedFlowId: SharedFlowIdSchema,
-	connectionId: ConnectionIdSchema,
-	accessToken: z.string().min(1).max(8192),
-	expiresAt: IsoDateTimeSchema
-});
-const SharedFlowUrlSchema = z.string().url().max(4096);
-const SharedFlowInvitationUrlSchema = SharedFlowUrlSchema.superRefine((value, context) => {
-	const url = new URL(value);
-	const secure = url.protocol === "https:";
-	const loopback = url.protocol === "http:" && isLoopbackHostname(url.hostname);
-	if (!secure && !loopback) context.addIssue({
-		code: "custom",
-		message: "Shared-flow invitation URLs must use HTTPS, except on loopback development hosts"
-	});
-	if (url.username !== "" || url.password !== "") context.addIssue({
-		code: "custom",
-		message: "Shared-flow invitation URLs cannot contain user information"
-	});
-	const fragment = new URLSearchParams(url.hash.slice(1));
-	const token = fragment.get("domain0");
-	if (fragment.size !== 1 || !SharedFlowTokenSchema.safeParse(token).success) context.addIssue({
-		code: "custom",
-		message: "Shared-flow invitation URLs require one valid domain0 capability in the fragment"
-	});
-}).meta({ id: "SharedFlowInvitationUrl" });
-const SharedFlowInvitationSchema = z.object({
-	sharedFlowId: SharedFlowIdSchema,
-	url: SharedFlowInvitationUrlSchema,
-	expiresAt: IsoDateTimeSchema
-}).strict().meta({ id: "SharedFlowInvitation" });
-function isLoopbackHostname(hostname) {
-	const normalized = hostname.toLowerCase();
-	return normalized === "localhost" || normalized === "[::1]" || /^127(?:\.[0-9]{1,3}){3}$/.test(normalized);
-}
-//#endregion
-//#region src/contracts/dkim-guidance.ts
-const DkimSelectorSchema = z.string().trim().toLowerCase().min(1).max(63).regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/).brand().meta({ id: "DkimSelector" });
-const DkimGuidanceInputSchema = z.object({ selectors: z.array(DkimSelectorSchema).max(10).default([]) }).strict().superRefine((input, context) => {
-	if (new Set(input.selectors).size !== input.selectors.length) context.addIssue({
-		code: "custom",
-		path: ["selectors"],
-		message: "DKIM selectors must be unique"
-	});
-}).meta({ id: "DkimGuidanceInput" });
-const Domain0DkimGuidanceOptionsSchema = z.object({
-	enableDkim: z.boolean().default(false),
-	dkimSelectors: z.array(DkimSelectorSchema).max(10).default([])
-}).strict().superRefine((input, context) => {
-	if (new Set(input.dkimSelectors).size !== input.dkimSelectors.length) context.addIssue({
-		code: "custom",
-		path: ["dkimSelectors"],
-		message: "DKIM selectors must be unique"
-	});
-}).meta({ id: "Domain0DkimGuidanceOptions" });
-const GoogleWorkspaceEmailProviderSchema = z.object({
-	id: z.literal("google_workspace"),
-	name: z.literal("Google Workspace"),
-	guideUrl: z.literal("https://support.google.com/a/answer/174124")
-}).strict();
-const Microsoft365EmailProviderSchema = z.object({
-	id: z.literal("microsoft_365"),
-	name: z.literal("Microsoft 365"),
-	guideUrl: z.literal("https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure")
-}).strict();
-const ZohoMailEmailProviderSchema = z.object({
-	id: z.literal("zoho_mail"),
-	name: z.literal("Zoho Mail"),
-	guideUrl: z.literal("https://www.zoho.com/mail/help/adminconsole/dkim-configuration.html")
-}).strict();
-const EmailProviderSchema = z.discriminatedUnion("id", [
-	GoogleWorkspaceEmailProviderSchema,
-	Microsoft365EmailProviderSchema,
-	ZohoMailEmailProviderSchema
-]).meta({ id: "EmailProvider" });
-const EmailProviderDetectionStatusSchema = z.enum([
-	"detected",
-	"ambiguous",
-	"unknown"
-]).meta({ id: "EmailProviderDetectionStatus" });
-const DkimDnsRecordTypeSchema = z.enum(["TXT", "CNAME"]).meta({ id: "DkimDnsRecordType" });
-const DkimDnsEvidenceStatusSchema = z.enum([
-	"record_observed",
-	"no_record_observed",
-	"not_checked",
-	"lookup_unavailable"
-]).meta({ id: "DkimDnsEvidenceStatus" });
-const DkimDnsRecordEvidenceSchema = z.object({
-	selector: DkimSelectorSchema,
-	types: z.array(DkimDnsRecordTypeSchema).min(1).max(2).refine((types) => new Set(types).size === types.length, "Observed DKIM DNS record types must be unique")
-}).strict().meta({ id: "DkimDnsRecordEvidence" });
-const DkimDnsEvidenceSchema = z.object({
-	status: DkimDnsEvidenceStatusSchema,
-	selectorsChecked: z.array(DkimSelectorSchema).max(12).refine((selectors) => new Set(selectors).size === selectors.length, "Checked DKIM selectors must be unique"),
-	records: z.array(DkimDnsRecordEvidenceSchema).max(12)
-}).strict().superRefine((evidence, context) => {
-	const checked = new Set(evidence.selectorsChecked);
-	if (evidence.records.some((record) => !checked.has(record.selector))) context.addIssue({
-		code: "custom",
-		path: ["records"],
-		message: "Observed records must belong to checked selectors"
-	});
-	if (evidence.status === "not_checked" && (evidence.selectorsChecked.length !== 0 || evidence.records.length !== 0)) context.addIssue({
-		code: "custom",
-		path: ["status"],
-		message: "Not-checked evidence cannot include selector observations"
-	});
-	if (evidence.status === "record_observed" && evidence.records.length === 0) context.addIssue({
-		code: "custom",
-		path: ["records"],
-		message: "Observed status requires at least one DNS record"
-	});
-	if (evidence.status !== "record_observed" && evidence.records.length !== 0) context.addIssue({
-		code: "custom",
-		path: ["records"],
-		message: "Only observed status can include DNS records"
-	});
-	if (["no_record_observed", "lookup_unavailable"].includes(evidence.status) && evidence.selectorsChecked.length === 0) context.addIssue({
-		code: "custom",
-		path: ["selectorsChecked"],
-		message: "A DNS lookup status requires at least one checked selector"
-	});
-}).meta({ id: "DkimDnsEvidence" });
-const DkimGuidanceResponseSchema = z.object({
-	domain: DomainNameSchema,
-	detectionStatus: EmailProviderDetectionStatusSchema,
-	candidates: z.array(EmailProviderSchema).max(3),
-	provider: EmailProviderSchema.optional(),
-	mxHosts: z.array(DomainNameSchema).max(20).refine((hosts) => new Set(hosts).size === hosts.length, "MX hosts must be unique"),
-	dkimDns: DkimDnsEvidenceSchema,
-	observedAt: IsoDateTimeSchema
-}).strict().superRefine((result, context) => {
-	const candidateIds = result.candidates.map((candidate) => candidate.id);
-	if (new Set(candidateIds).size !== candidateIds.length) context.addIssue({
-		code: "custom",
-		path: ["candidates"],
-		message: "Email provider candidates must be unique"
-	});
-	if (result.detectionStatus === "detected" && (result.candidates.length !== 1 || result.provider?.id !== result.candidates[0]?.id)) context.addIssue({
-		code: "custom",
-		path: ["provider"],
-		message: "Detected status requires exactly one matching provider"
-	});
-	if (result.detectionStatus === "ambiguous" && (result.candidates.length < 2 || result.provider !== void 0)) context.addIssue({
-		code: "custom",
-		path: ["candidates"],
-		message: "Ambiguous status requires multiple candidates and no resolved provider"
-	});
-	if (result.detectionStatus === "unknown" && (result.candidates.length !== 0 || result.provider !== void 0)) context.addIssue({
-		code: "custom",
-		path: ["candidates"],
-		message: "Unknown status cannot include an email provider"
-	});
-}).meta({ id: "DkimGuidanceResponse" });
-//#endregion
-//#region src/contracts/connect-events.ts
-const Domain0ConnectStepSchema = z.union([z.enum([
-	"loading",
-	"provider_detection",
-	"provider_selection",
-	"cancellation_confirmation"
-]), ConnectionStateSchema]).meta({ id: "Domain0ConnectStep" });
-const Domain0ConnectCloseReasonSchema = z.enum([
-	"close_button",
-	"escape",
-	"programmatic",
-	"destroyed",
-	"success"
-]).meta({ id: "Domain0ConnectCloseReason" });
-const ActiveConnectionSchema = ConnectionSchema.and(z.object({ state: z.literal("active") }));
-const ManualConnectionSchema = ConnectionSchema.and(z.object({ state: z.literal("manual_required") }));
-const Domain0ConnectSuccessEventSchema = z.object({
-	type: z.literal("success"),
-	connection: ActiveConnectionSchema
-}).strict().meta({ id: "Domain0ConnectSuccessEvent" });
-const Domain0ConnectCloseEventSchema = z.object({
-	type: z.literal("close"),
-	reason: Domain0ConnectCloseReasonSchema,
-	connection: ConnectionSchema.optional(),
-	step: Domain0ConnectStepSchema.optional()
-}).strict().meta({ id: "Domain0ConnectCloseEvent" });
-const Domain0ConnectStepChangeEventSchema = z.object({
-	type: z.literal("step_change"),
-	step: Domain0ConnectStepSchema,
-	previousStep: Domain0ConnectStepSchema.optional(),
-	connection: ConnectionSchema.optional()
-}).strict().meta({ id: "Domain0ConnectStepChangeEvent" });
-const Domain0ManualSetupDocumentationClickEventSchema = z.object({
-	type: z.literal("manual_setup_documentation_click"),
-	connection: ManualConnectionSchema
-}).strict().meta({ id: "Domain0ManualSetupDocumentationClickEvent" });
-const Domain0RequestCloseEventSchema = z.object({
-	type: z.literal("request_close"),
-	connection: ConnectionSchema.optional(),
-	step: Domain0ConnectStepSchema
-}).strict().meta({ id: "Domain0RequestCloseEvent" });
-const Domain0SharedFlowSentEventSchema = z.object({
-	type: z.literal("shared_flow_sent"),
-	connection: ManualConnectionSchema,
-	sharedFlowId: SharedFlowIdSchema,
-	url: SharedFlowInvitationUrlSchema,
-	expiresAt: IsoDateTimeSchema
-}).strict().meta({ id: "Domain0SharedFlowSentEvent" });
-const Domain0DkimSetupDocumentationClickEventSchema = z.object({
-	type: z.literal("dkim_setup_documentation_click"),
-	connection: ActiveConnectionSchema,
-	emailProvider: EmailProviderSchema
-}).strict().meta({ id: "Domain0DkimSetupDocumentationClickEvent" });
-const Domain0ConnectEventSchema = z.discriminatedUnion("type", [
-	Domain0ConnectSuccessEventSchema,
-	Domain0ConnectCloseEventSchema,
-	Domain0ConnectStepChangeEventSchema,
-	Domain0ManualSetupDocumentationClickEventSchema,
-	Domain0RequestCloseEventSchema,
-	Domain0SharedFlowSentEventSchema,
-	Domain0DkimSetupDocumentationClickEventSchema
-]).meta({ id: "Domain0ConnectEvent" });
-//#endregion
-//#region src/contracts/setup-policy.ts
-const Domain0SetupPolicySchema = z.object({ mode: z.enum(["automatic", "manual"]).default("automatic") }).strict();
-//#endregion
-//#region src/contracts/white-label.ts
-const opaqueHexColorPattern = /^#[0-9A-F]{6}$/;
-const backdropHexColorPattern = /^#[0-9A-F]{8}$/;
-const OpaqueHexColorSchema = z.string().trim().toUpperCase().regex(opaqueHexColorPattern, "Expected an opaque #RRGGBB color");
-const BackdropHexColorSchema = z.string().trim().toUpperCase().regex(backdropHexColorPattern, "Expected a #RRGGBBAA backdrop color");
-const WhiteLabelTextSchema = z.string().trim().min(1).max(500).refine((value) => !/[<>\u0000-\u001F\u007F]/.test(value), "White-label copy must be plain text without markup or control characters");
-const Domain0ApplicationNameSchema = WhiteLabelTextSchema.max(120).meta({ id: "Domain0ApplicationName" });
-const Domain0WhiteLabelLogoUrlSchema = z.string().trim().min(1).max(2048).refine((value) => {
-	try {
-		const parsed = new URL(value);
-		return parsed.protocol === "https:" && parsed.username === "" && parsed.password === "";
-	} catch {
-		return false;
-	}
-}, "Logo must be an HTTPS URL without embedded credentials").meta({ id: "Domain0WhiteLabelLogoUrl" });
-function copyWithPlaceholders(...allowed) {
-	return WhiteLabelTextSchema.refine((value) => {
-		const withoutAllowedPlaceholders = allowed.reduce((copy, placeholder) => copy.replaceAll(placeholder, ""), value);
-		return !/[{}]/.test(withoutAllowedPlaceholders);
-	}, `Only these placeholders are allowed: ${allowed.join(", ") || "none"}`);
-}
-function localizedCopy(message) {
-	const localized = z.object({
-		en: message,
-		es: message.optional(),
-		pt: message.optional(),
-		"pt-br": message.optional(),
-		"pt-pt": message.optional(),
-		fr: message.optional(),
-		it: message.optional(),
-		de: message.optional(),
-		nl: message.optional(),
-		pl: message.optional(),
-		tr: message.optional(),
-		ja: message.optional(),
-		da: message.optional(),
-		sv: message.optional()
-	}).strict();
-	return z.union([message.transform((en) => ({ en })), localized]);
-}
-function colorContrastRatio(foreground, background) {
-	return parsedColorContrastRatio(OpaqueHexColorSchema.parse(foreground), OpaqueHexColorSchema.parse(background));
-}
-function parsedColorContrastRatio(foreground, background) {
-	const foregroundLuminance = relativeLuminance(foreground);
-	const backgroundLuminance = relativeLuminance(background);
-	const lighter = Math.max(foregroundLuminance, backgroundLuminance);
-	const darker = Math.min(foregroundLuminance, backgroundLuminance);
-	return (lighter + .05) / (darker + .05);
-}
-function isSafeFontFamilyStack(value) {
-	const families = value.split(",");
-	return families.length <= 10 && families.every((family) => {
-		const trimmed = family.trim();
-		if (trimmed.length === 0) return false;
-		const quote = trimmed.at(0);
-		if (quote === "\"" || quote === "'") return trimmed.at(-1) === quote && /^[A-Za-z0-9 -]+$/.test(trimmed.slice(1, -1));
-		return /^-?[A-Za-z][A-Za-z0-9 -]*$/.test(trimmed);
-	});
-}
-function relativeLuminance(color) {
-	const [red, green, blue] = [
-		1,
-		3,
-		5
-	].map((start) => Number.parseInt(color.slice(start, start + 2), 16) / 255).map((channel) => channel <= .04045 ? channel / 12.92 : ((channel + .055) / 1.055) ** 2.4);
-	return .2126 * red + .7152 * green + .0722 * blue;
-}
-const contrastPairs = [
-	{
-		foreground: "text",
-		background: "surface",
-		minimum: 4.5,
-		purpose: "body text"
-	},
-	{
-		foreground: "mutedText",
-		background: "surface",
-		minimum: 4.5,
-		purpose: "secondary text"
-	},
-	{
-		foreground: "onPrimary",
-		background: "primary",
-		minimum: 4.5,
-		purpose: "primary control text"
-	},
-	{
-		foreground: "danger",
-		background: "surface",
-		minimum: 4.5,
-		purpose: "error text"
-	},
-	{
-		foreground: "onDanger",
-		background: "danger",
-		minimum: 4.5,
-		purpose: "danger control text"
-	},
-	{
-		foreground: "link",
-		background: "surface",
-		minimum: 4.5,
-		purpose: "link text"
-	},
-	{
-		foreground: "border",
-		background: "surface",
-		minimum: 3,
-		purpose: "control boundaries"
-	},
-	{
-		foreground: "primary",
-		background: "surface",
-		minimum: 3,
-		purpose: "primary control boundaries"
-	},
-	{
-		foreground: "focus",
-		background: "surface",
-		minimum: 3,
-		purpose: "focus indicators"
-	}
-];
-const lightPaletteDefaults = {
-	surface: "#FFFFFF",
-	text: "#0A0A0A",
-	mutedText: "#6B6B6B",
-	border: "#73737C",
-	primary: "#0A0A0A",
-	onPrimary: "#FFFFFF",
-	link: "#2B21FF",
-	focus: "#2B21FF",
-	danger: "#B3261E",
-	onDanger: "#FFFFFF"
-};
-const darkPaletteDefaults = {
-	surface: "#111827",
-	text: "#F9FAFB",
-	mutedText: "#D1D5DB",
-	border: "#D1D5DB",
-	primary: "#BFDBFE",
-	onPrimary: "#172554",
-	link: "#BFDBFE",
-	focus: "#FBBF24",
-	danger: "#FCA5A5",
-	onDanger: "#450A0A"
-};
-function themePaletteSchema(defaults) {
-	return z.object({
-		surface: OpaqueHexColorSchema.default(defaults.surface),
-		text: OpaqueHexColorSchema.default(defaults.text),
-		mutedText: OpaqueHexColorSchema.default(defaults.mutedText),
-		border: OpaqueHexColorSchema.default(defaults.border),
-		primary: OpaqueHexColorSchema.default(defaults.primary),
-		onPrimary: OpaqueHexColorSchema.default(defaults.onPrimary),
-		link: OpaqueHexColorSchema.default(defaults.link),
-		focus: OpaqueHexColorSchema.default(defaults.focus),
-		danger: OpaqueHexColorSchema.default(defaults.danger),
-		onDanger: OpaqueHexColorSchema.default(defaults.onDanger)
-	}).strict().superRefine((palette, context) => {
-		for (const pair of contrastPairs) {
-			const ratio = parsedColorContrastRatio(palette[pair.foreground], palette[pair.background]);
-			if (ratio < pair.minimum) context.addIssue({
-				code: "custom",
-				path: [pair.foreground],
-				message: `${pair.purpose} requires ${pair.minimum}:1 contrast against ${pair.background}; received ${ratio.toFixed(2)}:1`
-			});
-		}
-	});
-}
-const LightThemePaletteSchema = themePaletteSchema(lightPaletteDefaults);
-const DarkThemePaletteSchema = themePaletteSchema(darkPaletteDefaults);
-const Domain0WhiteLabelThemeSchema = z.object({
-	colorMode: z.enum([
-		"light",
-		"dark",
-		"system"
-	]).default("light"),
-	light: LightThemePaletteSchema.prefault({}),
-	dark: DarkThemePaletteSchema.prefault({}),
-	backdrop: BackdropHexColorSchema.default("#2B21FF26"),
-	widthPx: z.number().int().min(320).max(960).default(672),
-	dialogRadiusPx: z.number().int().min(0).max(48).default(20),
-	buttonRadiusPx: z.number().int().min(0).max(999).default(999),
-	inputRadiusPx: z.number().int().min(0).max(32).default(12),
-	fontFamily: z.string().trim().min(1).max(200).refine(isSafeFontFamilyStack, "Use a comma-separated system font stack without URLs or CSS syntax").default("\"PP Neue Montreal\", \"Inter Tight\", ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, \"Segoe UI\", sans-serif"),
-	fontWeight: z.number().int().min(100).max(900).multipleOf(50).default(400),
-	boldFontWeight: z.number().int().min(100).max(900).multipleOf(50).default(500)
-}).strict().superRefine((theme, context) => {
-	if (theme.boldFontWeight < theme.fontWeight) context.addIssue({
-		code: "custom",
-		path: ["boldFontWeight"],
-		message: "Bold font weight must be at least the normal font weight"
-	});
-});
-const Domain0WhiteLabelCopySchema = z.object({
-	initialSubtitle: localizedCopy(copyWithPlaceholders()).optional(),
-	providerLoginMessage: localizedCopy(copyWithPlaceholders("{PROVIDER}")).optional(),
-	successTitle: localizedCopy(copyWithPlaceholders("{DOMAIN}")).optional(),
-	successDescription: localizedCopy(copyWithPlaceholders("{DOMAIN}")).optional(),
-	successButton: localizedCopy(copyWithPlaceholders()).optional(),
-	manuallyScreen: z.object({
-		disableManualSetupDocumentationLink: z.boolean().default(false),
-		stepByStepGuide: localizedCopy(copyWithPlaceholders()).optional()
-	}).strict().prefault({})
-}).strict();
-const DisabledControlSchema = z.object({ disable: z.boolean().default(false) }).strict();
-const Domain0WhiteLabelCustomPropertiesSchema = z.object({
-	manualConfiguration: z.object({ disableScreen: z.boolean().default(false) }).strict().prefault({}),
-	providerLogin: z.object({
-		forwardLink: DisabledControlSchema.prefault({}),
-		gotoManualLink: DisabledControlSchema.prefault({})
-	}).strict().prefault({})
-}).strict();
-const Domain0WhiteLabelSchema = z.object({
-	theme: Domain0WhiteLabelThemeSchema.prefault({}),
-	copy: Domain0WhiteLabelCopySchema.prefault({}),
-	logo: Domain0WhiteLabelLogoUrlSchema.optional(),
-	logoBackgroundColor: OpaqueHexColorSchema.optional(),
-	removeLogoBorder: z.boolean().default(false),
-	hideCompanyLogo: z.boolean().default(false),
-	hideCompanyName: z.boolean().default(false),
-	removeShareLogin: z.boolean().default(false),
-	skipCongratulationsScreen: z.boolean().default(false),
-	customProperties: Domain0WhiteLabelCustomPropertiesSchema.prefault({})
-}).strict();
-//#endregion
-//#region src/contracts/manual-setup-documentation.ts
-const ManualSetupDocumentationUrlSchema = z.url({ protocol: /^https$/ }).max(2048).refine((value) => {
-	const url = new URL(value);
-	return url.username === "" && url.password === "";
-}, "Manual setup documentation URL must not contain credentials").brand().meta({ id: "ManualSetupDocumentationUrl" });
-//#endregion
-//#region src/contracts/connect-configuration.ts
-const Domain0ConnectConfigurationSchema = z.object({
-	applicationName: Domain0ApplicationNameSchema.optional(),
-	whiteLabel: Domain0WhiteLabelSchema.prefault({}),
-	setupPolicy: Domain0SetupPolicySchema.prefault({}),
-	dkim: Domain0DkimGuidanceOptionsSchema.prefault({}),
-	manualSetupDocumentation: ManualSetupDocumentationUrlSchema.optional()
-}).strict().superRefine((configuration, context) => {
-	const { customProperties } = configuration.whiteLabel;
-	const forcedManual = configuration.setupPolicy.mode === "manual";
-	if (forcedManual && customProperties.manualConfiguration.disableScreen) context.addIssue({
-		code: "custom",
-		path: [
-			"whiteLabel",
-			"customProperties",
-			"manualConfiguration",
-			"disableScreen"
-		],
-		message: "Forced manual setup requires the manual configuration screen"
-	});
-	if (forcedManual && customProperties.providerLogin.gotoManualLink.disable) context.addIssue({
-		code: "custom",
-		path: [
-			"whiteLabel",
-			"customProperties",
-			"providerLogin",
-			"gotoManualLink",
-			"disable"
-		],
-		message: "Forced manual setup cannot disable entry into manual configuration"
-	});
-	if (configuration.dkim.enableDkim && configuration.whiteLabel.skipCongratulationsScreen) context.addIssue({
-		code: "custom",
-		path: ["whiteLabel", "skipCongratulationsScreen"],
-		message: "DKIM guidance requires the success screen"
-	});
-}).meta({ id: "Domain0ConnectConfiguration" });
-//#endregion
-//#region src/contracts/conformance.ts
-const CompiledProviderIdSchema = z.enum([
-	"alibaba-cloud",
-	"all-inkl",
-	"amazon-route-53",
-	"cloudflare",
-	"cloudns",
-	"digitalocean",
-	"dnsimple",
-	"dreamhost",
-	"dynadot",
-	"easydns",
-	"gandi",
-	"godaddy",
-	"hetzner",
-	"hostgator",
-	"hostinger",
-	"hosting-com",
-	"inmotion-hosting",
-	"ionos",
-	"name-com",
-	"namecheap",
-	"namesilo",
-	"netlify",
-	"o2switch",
-	"openprovider",
-	"opensrs",
-	"ovh",
-	"porkbun",
-	"simply",
-	"spaceship",
-	"transip",
-	"united-domains",
-	"vercel",
-	"wix"
-]).meta({ id: "CompiledProviderId" });
-const ProviderConformanceCheckNameSchema = z.enum([
-	"authenticated_snapshot",
-	"reserved_name_available",
-	"create_sibling",
-	"create_target",
-	"rrset_sibling_preservation",
-	"idempotent_replay",
-	"replace_target",
-	"authoritative_propagation",
-	"delete_target",
-	"scoped_cleanup"
-]).meta({ id: "ProviderConformanceCheckName" });
-const expectedProviderConformanceChecks = [
-	"authenticated_snapshot",
-	"reserved_name_available",
-	"create_sibling",
-	"create_target",
-	"rrset_sibling_preservation",
-	"idempotent_replay",
-	"replace_target",
-	"authoritative_propagation",
-	"delete_target",
-	"scoped_cleanup"
-];
-const ProviderConformanceCheckSchema = z.object({ name: ProviderConformanceCheckNameSchema }).strict();
-const SourceRevisionSchema = z.union([z.literal("unknown"), z.string().regex(/^[a-f0-9]{40,64}$/)]);
-const ProviderConformanceEvidenceSchema = z.object({
-	schemaVersion: z.literal(1),
-	providerId: CompiledProviderIdSchema,
-	adapterVersion: z.string().min(1).max(200).refine(isTrimmedSingleLine),
-	sourceRevision: SourceRevisionSchema,
-	sourceModified: z.boolean(),
-	binarySha256: z.string().regex(/^[a-f0-9]{64}$/),
-	zone: DomainNameSchema,
-	runId: z.string().regex(/^[a-f0-9]{16,64}$/),
-	host: z.string(),
-	startedAt: IsoDateTimeSchema,
-	completedAt: IsoDateTimeSchema,
-	passed: z.boolean(),
-	checks: z.array(ProviderConformanceCheckSchema).max(expectedProviderConformanceChecks.length),
-	cleanupAttempted: z.boolean(),
-	cleanupCompleted: z.boolean()
-}).strict().superRefine((evidence, context) => {
-	if (evidence.host !== `_domain0-conformance-${evidence.runId}`) context.addIssue({
-		code: "custom",
-		path: ["host"],
-		message: "Conformance hostname must be derived from the random run ID"
-	});
-	if (Date.parse(evidence.completedAt) < Date.parse(evidence.startedAt)) context.addIssue({
-		code: "custom",
-		path: ["completedAt"],
-		message: "Conformance completion must not precede its start"
-	});
-	const names = evidence.checks.map((check) => check.name);
-	if (!validCheckSequence(names)) context.addIssue({
-		code: "custom",
-		path: ["checks"],
-		message: "Conformance checks must be an ordered prefix followed optionally by scoped cleanup"
-	});
-	const cleanupCheck = names.includes("scoped_cleanup");
-	if (evidence.cleanupCompleted && !evidence.cleanupAttempted || cleanupCheck !== evidence.cleanupCompleted) context.addIssue({
-		code: "custom",
-		path: ["cleanupCompleted"],
-		message: "Completed cleanup requires an attempted cleanup and the scoped-cleanup check"
-	});
-}).meta({ id: "ProviderConformanceEvidence" });
-const VerifiedProviderConformanceEvidenceSchema = ProviderConformanceEvidenceSchema.refine((evidence) => evidence.passed && !evidence.sourceModified && evidence.sourceRevision !== "unknown" && evidence.cleanupAttempted && evidence.cleanupCompleted && evidence.checks.every((check, index) => check.name === expectedProviderConformanceChecks[index]) && evidence.checks.length === expectedProviderConformanceChecks.length, "Verified live-suite evidence requires clean traceable source, every ordered check, and completed cleanup").meta({ id: "VerifiedProviderConformanceEvidence" });
-function validCheckSequence(checks) {
-	let position = 0;
-	let cleanupSeen = false;
-	for (const check of checks) {
-		if (check === "scoped_cleanup") {
-			if (cleanupSeen) return false;
-			cleanupSeen = true;
-			continue;
-		}
-		if (cleanupSeen || check !== expectedProviderConformanceChecks[position]) return false;
-		position += 1;
-	}
-	return true;
-}
-function isTrimmedSingleLine(value) {
-	return value.trim() === value && !/[\u0000\r\n]/.test(value);
-}
-//#endregion
-//#region src/contracts/domain-check.ts
-const DomainDelegationStatusSchema = z.enum([
-	"delegated",
-	"undelegated",
-	"unknown"
-]).meta({ id: "DomainDelegationStatus" });
-const DomainSetupSupportSchema = z.enum([
-	"automatic",
-	"manual",
-	"unavailable",
-	"ambiguous",
-	"unknown"
-]).meta({ id: "DomainSetupSupport" });
-const RecordConflictReasonSchema = z.enum([
-	"same_name_and_type",
-	"cname_collision",
-	"mx_set_collision",
-	"spf_collision",
-	"ns_delegation"
-]).meta({ id: "RecordConflictReason" });
-const CheckDomainInputSchema = z.object({
-	domain: DomainNameSchema,
-	records: z.array(ResolvedDnsRecordSchema).max(100).default([]),
-	checkConflicts: z.boolean().default(false)
-}).strict().superRefine((input, context) => {
-	if (input.checkConflicts && input.records.length === 0) context.addIssue({
-		code: "custom",
-		path: ["records"],
-		message: "Record conflict analysis requires at least one requested record"
-	});
-}).meta({ id: "CheckDomainInput" });
-const DomainProviderCandidateSchema = z.object({
-	provider: ProviderSchema,
-	confidence: z.number().min(0).max(1),
-	exact: z.boolean()
-}).strict().meta({ id: "DomainProviderCandidate" });
-const DomainRecordConflictSchema = z.object({
-	requested: ResolvedDnsRecordSchema,
-	existing: z.array(ResolvedDnsRecordSchema).max(1e3),
-	reasons: z.array(RecordConflictReasonSchema).min(1).max(5).refine((reasons) => new Set(reasons).size === reasons.length, "Conflict reasons must be unique")
-}).strict().meta({ id: "DomainRecordConflict" });
-const ConflictAnalysisSchema = z.object({
-	status: z.enum([
-		"not_requested",
-		"complete",
-		"partial"
-	]),
-	authoritativeServers: z.number().int().min(0).max(16),
-	respondingServers: z.number().int().min(0).max(16),
-	conflicts: z.array(DomainRecordConflictSchema).max(100)
-}).strict().superRefine((analysis, context) => {
-	if (analysis.respondingServers > analysis.authoritativeServers) context.addIssue({
-		code: "custom",
-		path: ["respondingServers"],
-		message: "Responding nameservers cannot exceed authoritative nameservers"
-	});
-	if (analysis.status === "complete" && analysis.respondingServers !== analysis.authoritativeServers) context.addIssue({
-		code: "custom",
-		path: ["status"],
-		message: "Complete analysis requires every authoritative nameserver to respond"
-	});
-	if (analysis.status === "partial" && (analysis.respondingServers === 0 || analysis.respondingServers >= analysis.authoritativeServers)) context.addIssue({
-		code: "custom",
-		path: ["status"],
-		message: "Partial analysis requires some but not all authoritative nameservers to respond"
-	});
-	if (analysis.status === "not_requested" && analysis.conflicts.length !== 0) context.addIssue({
-		code: "custom",
-		path: ["conflicts"],
-		message: "Conflict results cannot exist when analysis was not requested"
-	});
-}).meta({ id: "ConflictAnalysis" });
-const CheckDomainResponseSchema = z.object({
-	domain: DomainNameSchema,
-	delegationStatus: DomainDelegationStatusSchema,
-	candidates: z.array(DomainProviderCandidateSchema).max(65),
-	provider: ProviderSchema.optional(),
-	setupSupport: DomainSetupSupportSchema,
-	conflictAnalysis: ConflictAnalysisSchema
-}).strict().superRefine((result, context) => {
-	const candidateIds = result.candidates.map((candidate) => candidate.provider.id);
-	if (new Set(candidateIds).size !== candidateIds.length) context.addIssue({
-		code: "custom",
-		path: ["candidates"],
-		message: "Provider candidates must be unique"
-	});
-	if (result.delegationStatus === "undelegated" && (result.candidates.length !== 0 || result.provider !== void 0 || result.setupSupport !== "unavailable")) context.addIssue({
-		code: "custom",
-		path: ["delegationStatus"],
-		message: "Undelegated domains cannot have provider support"
-	});
-	if (result.provider !== void 0 && !result.candidates.some((candidate) => candidate.exact && candidate.provider.id === result.provider?.id)) context.addIssue({
-		code: "custom",
-		path: ["provider"],
-		message: "Resolved provider must be an exact provider candidate"
-	});
-	if (["automatic", "manual"].includes(result.setupSupport) && result.provider === void 0) context.addIssue({
-		code: "custom",
-		path: ["setupSupport"],
-		message: "Available setup support requires a resolved provider"
-	});
-	if (result.setupSupport === "automatic" && !result.provider?.availableAuthorizationMethods.some((method) => method !== "manual")) context.addIssue({
-		code: "custom",
-		path: ["setupSupport"],
-		message: "Automatic setup requires a configured non-manual authorization method"
-	});
-	if (result.setupSupport === "manual" && (result.provider?.availableAuthorizationMethods.length !== 1 || result.provider.availableAuthorizationMethods[0] !== "manual")) context.addIssue({
-		code: "custom",
-		path: ["setupSupport"],
-		message: "Manual setup requires the manual authorization method"
-	});
-	if (result.setupSupport === "ambiguous" && result.candidates.length === 0) context.addIssue({
-		code: "custom",
-		path: ["candidates"],
-		message: "Ambiguous setup requires provider candidates"
-	});
-	if (result.setupSupport === "unknown" && result.candidates.length !== 0) context.addIssue({
-		code: "custom",
-		path: ["candidates"],
-		message: "Unknown setup cannot include provider candidates"
-	});
-	if (["ambiguous", "unknown"].includes(result.setupSupport) && result.provider !== void 0) context.addIssue({
-		code: "custom",
-		path: ["provider"],
-		message: "Ambiguous or unknown support cannot resolve one provider"
-	});
-}).meta({ id: "CheckDomainResponse" });
-//#endregion
-//#region src/contracts/error.ts
-const Domain0ErrorCodeSchema = z.enum([
-	"invalid_request",
-	"unauthorized",
-	"forbidden",
-	"not_found",
-	"conflict",
-	"rate_limited",
-	"dns_unavailable",
-	"provider_unavailable",
-	"provider_authorization_failed",
-	"provider_limitation",
-	"plan_expired",
-	"propagation_pending",
-	"internal_error"
-]).meta({ id: "Domain0ErrorCode" });
-const Domain0ErrorResponseSchema = z.object({ error: z.object({
-	code: Domain0ErrorCodeSchema,
-	message: z.string().min(1),
-	requestId: z.string().min(1),
-	retryable: z.boolean(),
-	details: z.record(z.string(), z.unknown()).optional()
-}).strict() }).strict().meta({ id: "ErrorResponse" });
-//#endregion
-//#region src/contracts/localization.ts
-/** Locale identifiers supported by Entri Connect's public configuration contract. */
-const domain0Locales = [
-	"en",
-	"es",
-	"pt",
-	"pt-br",
-	"pt-pt",
-	"fr",
-	"it",
-	"de",
-	"nl",
-	"pl",
-	"tr",
-	"ja",
-	"da",
-	"sv"
-];
-const Domain0LocaleSchema = z.enum(domain0Locales).meta({ id: "Domain0Locale" });
-//#endregion
-//#region src/contracts/platform.ts
-/** Public platform request. Application and tenant identity come from the API key. */
-const PlatformCreateConnectionInputSchema = z.strictObject({ intent: DnsIntentSchema }).meta({ id: "PlatformCreateConnectionInput" });
-//#endregion
-//#region src/contracts/webhook.ts
-const Domain0WebhookEventTypeSchema = z.enum([
-	"connection.requested",
-	"provider.detection_started",
-	"provider.selected",
-	"authorization.required",
-	"domain_connect.started",
-	"domain_connect.submitted",
-	"authorization.completed",
-	"connection.planning_started",
-	"connection.plan_prepared",
-	"connection.planning_restarted",
-	"connection.already_configured",
-	"connection.plan_confirmed",
-	"connection.changes_applied",
-	"connection.propagation_checked",
-	"connection.propagation_timed_out",
-	"connection.activated",
-	"connection.manual_required",
-	"connection.manual_submitted",
-	"connection.failed_retryable",
-	"connection.retry_started",
-	"connection.cancelled"
-]).meta({ id: "Domain0WebhookEventType" });
-const Domain0WebhookEventIdSchema = z.string().regex(/^[0-9a-f]{64}$/).brand().meta({ id: "Domain0WebhookEventId" });
-const Domain0WebhookAttributesSchema = z.record(z.string().min(1).max(100), z.string().max(4e3)).superRefine((attributes, context) => {
-	if (Object.keys(attributes).length > 64) context.addIssue({
-		code: "custom",
-		message: "Webhook attributes must contain at most 64 entries"
-	});
-}).meta({ id: "Domain0WebhookAttributes" });
-const Domain0WebhookEventSchema = z.strictObject({
-	schemaVersion: z.literal(1),
-	eventId: Domain0WebhookEventIdSchema,
-	type: Domain0WebhookEventTypeSchema,
-	connectionId: ConnectionIdSchema,
-	applicationId: ApplicationIdSchema,
-	tenantId: TenantIdSchema,
-	sequence: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-	occurredAt: IsoDateTimeSchema,
-	attributes: Domain0WebhookAttributesSchema
-}).meta({ id: "Domain0WebhookEvent" });
-const Domain0WebhookVerificationErrorCodeSchema = z.enum([
-	"invalid_headers",
-	"stale_timestamp",
-	"invalid_signature",
-	"invalid_payload",
-	"crypto_unavailable"
-]).meta({ id: "Domain0WebhookVerificationErrorCode" });
-var Domain0WebhookVerificationError = class extends Error {
-	code;
-	name = "Domain0WebhookVerificationError";
-	constructor(code, message, options) {
-		super(message, options);
-		this.code = code;
-	}
-};
-const DOMAIN0_WEBHOOK_HEADER_NAMES = {
-	eventId: "x-domain0-event-id",
-	eventType: "x-domain0-event-type",
-	deliveryAttempt: "x-domain0-delivery-attempt",
-	schemaVersion: "x-domain0-schema-version",
-	signatureKeyId: "x-domain0-signature-key-id",
-	timestamp: "x-domain0-timestamp",
-	signature: "x-domain0-signature"
-};
-const normalizedHeadersSchema = z.strictObject({
-	eventId: Domain0WebhookEventIdSchema,
-	eventType: z.string().regex(/^domain0\.[a-z_]+\.[a-z_]+$/).max(100),
-	deliveryAttempt: z.string().regex(/^[1-9][0-9]{0,8}$/).transform(Number),
-	schemaVersion: z.literal("1"),
-	signatureKeyId: z.string().regex(/^[A-Za-z0-9._-]{1,64}$/),
-	timestamp: z.string().regex(/^[0-9]{1,12}$/).transform(Number),
-	signature: z.string().regex(/^v1=[0-9a-f]{64}$/)
-});
-const textEncoder = new TextEncoder();
-async function verifyDomain0Webhook(input) {
-	const body = typeof input.body === "string" ? textEncoder.encode(input.body) : new Uint8Array(input.body);
-	const maxBodyBytes = boundedPositiveInteger(input.maxBodyBytes ?? 1048576, 16777216);
-	if (!(body instanceof Uint8Array) || body.byteLength === 0 || body.byteLength > maxBodyBytes) throw verificationError("invalid_payload", "Webhook body is empty or exceeds the configured limit");
-	const headers = parseHeaders(input.headers);
-	const now = boundedNonNegativeInteger(input.nowUnixSeconds ?? Math.floor(Date.now() / 1e3), Number.MAX_SAFE_INTEGER);
-	const maxAgeSeconds = boundedPositiveInteger(input.maxAgeSeconds ?? 300, 86400);
-	if (Math.abs(now - headers.timestamp) > maxAgeSeconds) throw verificationError("stale_timestamp", "Webhook timestamp is outside the accepted replay window");
-	const secret = Object.prototype.hasOwnProperty.call(input.secretKeyring, headers.signatureKeyId) ? input.secretKeyring[headers.signatureKeyId] : void 0;
-	if (!(secret instanceof Uint8Array) || secret.byteLength !== 32) throw verificationError("invalid_signature", "Webhook signature is invalid");
-	const crypto = input.crypto ?? globalThis.crypto;
-	if (crypto?.subtle === void 0) throw verificationError("crypto_unavailable", "Web Crypto is unavailable");
-	const signature = hexToBytes(headers.signature.slice(3));
-	const prefix = textEncoder.encode(`v1.${headers.signatureKeyId}.${headers.timestamp}.`);
-	const signedBytes = new Uint8Array(prefix.byteLength + body.byteLength);
-	signedBytes.set(prefix);
-	signedBytes.set(body, prefix.byteLength);
-	const key = await crypto.subtle.importKey("raw", new Uint8Array(secret), {
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["verify"]);
-	if (!await crypto.subtle.verify("HMAC", key, new Uint8Array(signature), signedBytes)) throw verificationError("invalid_signature", "Webhook signature is invalid");
-	let decoded;
-	try {
-		const text = new TextDecoder("utf-8", { fatal: true }).decode(body);
-		decoded = JSON.parse(text);
-	} catch (error) {
-		throw verificationError("invalid_payload", "Verified webhook body is not valid UTF-8 JSON", error);
-	}
-	const parsed = Domain0WebhookEventSchema.safeParse(decoded);
-	if (!parsed.success) throw verificationError("invalid_payload", "Verified webhook body does not match schema version 1", parsed.error);
-	if (parsed.data.eventId !== headers.eventId || `domain0.${parsed.data.type}` !== headers.eventType || String(parsed.data.schemaVersion) !== headers.schemaVersion) throw verificationError("invalid_payload", "Verified webhook headers do not match the event body");
-	return parsed.data;
-}
-function parseHeaders(source) {
-	const values = {
-		eventId: void 0,
-		eventType: void 0,
-		deliveryAttempt: void 0,
-		schemaVersion: void 0,
-		signatureKeyId: void 0,
-		timestamp: void 0,
-		signature: void 0
-	};
-	if ("get" in source && typeof source.get === "function") for (const [key, name] of Object.entries(DOMAIN0_WEBHOOK_HEADER_NAMES)) values[key] = source.get(name) ?? void 0;
-	else {
-		const accepted = /* @__PURE__ */ new Map();
-		for (const key of Object.keys(DOMAIN0_WEBHOOK_HEADER_NAMES)) accepted.set(DOMAIN0_WEBHOOK_HEADER_NAMES[key], key);
-		const observed = /* @__PURE__ */ new Set();
-		for (const [providedName, providedValue] of Object.entries(source)) {
-			const name = providedName.toLowerCase();
-			const key = accepted.get(name);
-			if (key === void 0) continue;
-			if (observed.has(name) || typeof providedValue !== "string") throw verificationError("invalid_headers", "Webhook headers are missing, duplicated, or malformed");
-			observed.add(name);
-			values[key] = providedValue;
-		}
-	}
-	const parsed = normalizedHeadersSchema.safeParse(values);
-	if (!parsed.success) throw verificationError("invalid_headers", "Webhook headers are missing, duplicated, or malformed", parsed.error);
-	return parsed.data;
-}
-function boundedPositiveInteger(value, maximum) {
-	if (!Number.isSafeInteger(value) || value < 1 || value > maximum) throw verificationError("invalid_headers", "Webhook verification limits are invalid");
-	return value;
-}
-function boundedNonNegativeInteger(value, maximum) {
-	if (!Number.isSafeInteger(value) || value < 0 || value > maximum) throw verificationError("invalid_headers", "Webhook verification time is invalid");
-	return value;
-}
-function hexToBytes(value) {
-	const result = new Uint8Array(value.length / 2);
-	for (let index = 0; index < value.length; index += 2) result[index / 2] = Number.parseInt(value.slice(index, index + 2), 16);
-	return result;
-}
-function verificationError(code, message, cause) {
-	return new Domain0WebhookVerificationError(code, message, cause === void 0 ? void 0 : { cause });
-}
-//#endregion
-export { AccessKeyCredentialsSchema, AccountTokenCredentialsSchema, AdvancedDmarcOptionsSchema, ApiTokenCredentialsSchema, ApplicationIdSchema, ApplyPlanInputSchema, AuthorizationMethodSchema, AuthorizeWithCredentialInputSchema, AwsSessionCredentialsSchema, CPanelCredentialsSchema, CancelConnectionInputSchema, ChangeActionSchema, ChangePlanSchema, CheckDomainInputSchema, CheckDomainResponseSchema, CheckRecordsInputSchema, CheckRecordsResponseSchema, CheckedRecordSchema, ClientCredentialsSchema, CommandIdSchema, CompiledProviderIdSchema, ConditionalDnsRecordsSchema, ConfirmPlanInputSchema, ConflictAnalysisSchema, ConflictPolicySchema, ConnectionFailureCodeSchema, ConnectionFailureSchema, ConnectionFlowIdSchema, ConnectionFlowResponseSchema, ConnectionFlowSchema, ConnectionFlowTargetInputSchema, ConnectionFlowTargetSchema, ConnectionIdSchema, ConnectionSchema, ConnectionStateSchema, CreateConnectionFlowInputSchema, CreateConnectionInputSchema, CreateConnectionResponseSchema, CreateSharedFlowInputSchema, CreateSharedFlowResponseSchema, DOMAIN0_WEBHOOK_HEADER_NAMES, DetectProviderResponseSchema, DkimDnsEvidenceSchema, DkimDnsEvidenceStatusSchema, DkimDnsRecordEvidenceSchema, DkimDnsRecordTypeSchema, DkimGuidanceInputSchema, DkimGuidanceResponseSchema, DkimSelectorSchema, DnsIntentSchema, DnsRecordSchema, DnsRecordTypeSchema, Domain0ApplicationNameSchema, Domain0ConnectCloseEventSchema, Domain0ConnectCloseReasonSchema, Domain0ConnectConfigurationSchema, Domain0ConnectEventSchema, Domain0ConnectStepChangeEventSchema, Domain0ConnectStepSchema, Domain0ConnectSuccessEventSchema, Domain0DkimGuidanceOptionsSchema, Domain0DkimSetupDocumentationClickEventSchema, Domain0ErrorCodeSchema, Domain0ErrorResponseSchema, Domain0LocaleSchema, Domain0ManualSetupDocumentationClickEventSchema, Domain0RequestCloseEventSchema, Domain0SetupPolicySchema, Domain0SharedFlowSentEventSchema, Domain0WebhookAttributesSchema, Domain0WebhookEventIdSchema, Domain0WebhookEventSchema, Domain0WebhookEventTypeSchema, Domain0WebhookVerificationError, Domain0WebhookVerificationErrorCodeSchema, Domain0WhiteLabelCopySchema, Domain0WhiteLabelCustomPropertiesSchema, Domain0WhiteLabelLogoUrlSchema, Domain0WhiteLabelSchema, Domain0WhiteLabelThemeSchema, DomainConnectTemplateSchema, DomainDelegationStatusSchema, DomainNameSchema, DomainProviderCandidateSchema, DomainRecordConflictSchema, DomainSetupSupportSchema, EmailProviderDetectionStatusSchema, EmailProviderSchema, ExistingRecordPolicySchema, GetConnectionResponseSchema, IsoDateTimeSchema, IssueConnectionTokenInputSchema, IssueConnectionTokenResponseSchema, ListProvidersResponseSchema, ManualSetupDocumentationUrlSchema, OAuthCallbackResponseSchema, OvhCredentialsSchema, PlanWarningCodeSchema, PlannedChangeSchema, PlatformCreateConnectionInputSchema, PreparePlanInputSchema, PrivateKeyCredentialsSchema, ProviderCandidateSchema, ProviderCapabilitiesSchema, ProviderConformanceCheckNameSchema, ProviderConformanceEvidenceSchema, ProviderDetectionSchema, ProviderDetectionUnavailableReasonCodeSchema, ProviderHealthReasonSchema, ProviderHealthResponseSchema, ProviderHealthSchema, ProviderHealthStatusSchema, ProviderIdSchema, ProviderImplementationSchema, ProviderSchema, RecordConflictReasonSchema, ResolveSharedFlowInputSchema, ResolveSharedFlowResponseSchema, ResolvedDnsIntentSchema, ResolvedDnsRecordSchema, RetryConnectionInputSchema, RetryResumeStateSchema, SelectProviderInputSchema, SharedFlowIdSchema, SharedFlowInvitationSchema, SharedFlowInvitationUrlSchema, SharedFlowTokenSchema, SharedFlowUrlSchema, SpfConflictPolicySchema, StartDomainConnectInputSchema, StartDomainConnectResponseSchema, StartManualConfigurationInputSchema, StartOAuthInputSchema, StartOAuthResponseSchema, SubmitDomainConnectCompletionInputSchema, SubmitManualCompletionInputSchema, TenantIdSchema, UsernamePasswordCredentialsSchema, UsernameTokenCredentialsSchema, VerifiedProviderConformanceEvidenceSchema, VerifyPropagationInputSchema, colorContrastRatio, directCredentialKindByProvider, domain0Locales, expectedProviderConformanceChecks, verifyDomain0Webhook };
-
+import{z as e}from"zod";const t=e.string().trim().min(1).max(200),n=t.brand().meta({id:`ConnectionId`}),r=t.brand().meta({id:`ApplicationId`}),i=t.brand().meta({id:`TenantId`}),a=e.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).brand().meta({id:`ProviderId`}),o=t.brand().meta({id:`CommandId`}),s=e.string().trim().toLowerCase().overwrite(e=>e.replace(/\.$/,``)).min(3).max(253).regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/).refine(e=>!/^\d+(?:\.\d+){3}$/.test(e),`IP addresses are not domain names`).brand().meta({id:`DomainName`}),c=e.iso.datetime({offset:!0}).meta({id:`IsoDateTime`}),l=e.string().trim().toLowerCase().overwrite(e=>e.replace(/\.$/,``)).min(1).max(253).refine(ce,`Host must be @ or a valid relative DNS name`),u=/^([0-9]{1,3})[\t ]+([A-Za-z0-9-]{1,15})[\t ]+(?:"([^\r\n"]*)"|([^\r\n"]+))$/,d=e.enum([`A`,`AAAA`,`CNAME`,`CAA`,`MX`,`TXT`,`NS`]).meta({id:`DnsRecordType`}),f=e.string().regex(/^[a-z]{1,32}$/),p=e.string().min(1).max(4096).refine(e=>e.trim()===e&&/^[\x20-\x3a\x3c-\x7e]+$/.test(e),{message:`DMARC tag values must be trimmed printable ASCII without semicolons`}),ee=e.record(f,p).refine(e=>Object.keys(e).length<=32,`At most 32 DMARC tags are allowed`),m=e.object({inheritRootDmarc:e.boolean().default(!1),overrideTags:ee.default({}),removeTags:e.array(f).max(32).refine(e=>new Set(e).size===e.length,`DMARC tags to remove must be unique`).default([]),addTagsIfNotExist:ee.default({})}).strict().refine(e=>e.inheritRootDmarc||Object.keys(e.overrideTags).length>0||e.removeTags.length>0||Object.keys(e.addTagsIfNotExist).length>0,`At least one advanced DMARC option is required`).superRefine((e,t)=>{for(let[n,r]of[[`overrideTags`,e.overrideTags],[`addTagsIfNotExist`,e.addTagsIfNotExist]])for(let[e,i]of Object.entries(r))ue(e,i)||t.addIssue({code:`custom`,path:[n,e],message:`Invalid value for the ${e} DMARC tag`})}).meta({id:`AdvancedDmarcOptions`}),h=e.object({host:l,type:d,value:e.string().trim().min(1).max(65535),ttl:e.number().int().min(1).max(2147483647).default(300),priority:e.number().int().min(0).max(65535).optional(),optional:e.boolean().default(!1)}).strict().superRefine((t,n)=>{if(t.type===`MX`&&t.priority===void 0&&n.addIssue({code:`custom`,path:[`priority`],message:`MX records require a priority`}),t.type!==`MX`&&t.priority!==void 0&&n.addIssue({code:`custom`,path:[`priority`],message:`Only MX records accept a priority`}),t.type===`A`&&!e.ipv4().safeParse(t.value).success&&n.addIssue({code:`custom`,path:[`value`],message:`A records require an IPv4 address`}),t.type===`AAAA`&&!e.ipv6().safeParse(t.value).success&&n.addIssue({code:`custom`,path:[`value`],message:`AAAA records require an IPv6 address`}),[`CNAME`,`MX`,`NS`].includes(t.type)&&!s.safeParse(t.value).success&&n.addIssue({code:`custom`,path:[`value`],message:`${t.type} records require a domain name`}),t.type===`CAA`){let e=u.exec(t.value);(e===null||Number(e[1])>255)&&n.addIssue({code:`custom`,path:[`value`],message:`CAA values must contain flags, a tag, and a quoted value`})}t.type===`TXT`&&/[\u0000\r\n]/.test(t.value)&&n.addIssue({code:`custom`,path:[`value`],message:`TXT values cannot contain NUL or newlines`})}),g=h.meta({id:`ResolvedDnsRecord`}),_=h.safeExtend({advancedDmarcOptions:m.optional()}).superRefine((e,t)=>{e.advancedDmarcOptions!==void 0&&((e.type!==`TXT`||e.host!==`_dmarc`&&!e.host.startsWith(`_dmarc.`))&&t.addIssue({code:`custom`,path:[`advancedDmarcOptions`],message:`Advanced DMARC options require a TXT record at a _dmarc host`}),le(e.value)||t.addIssue({code:`custom`,path:[`value`],message:`Advanced DMARC options require a valid DMARC1 value with a policy tag`}))}).meta({id:`DnsRecord`}),v=e.object({validateDmarc:e.boolean().default(!1),validateCAA:e.boolean().default(!1)}).strict().meta({id:`ExistingRecordPolicy`}),y=e.object({domain:s,records:e.array(_).min(1).max(100),existingRecordPolicy:v.default({validateDmarc:!1,validateCAA:!1})}).strict().meta({id:`DnsIntent`}),b=e.object({domain:s,records:e.array(g).max(100)}).strict().meta({id:`ResolvedDnsIntent`}),te=b.meta({id:`CheckRecordsInput`}),ne=e.object({record:g,authoritativeServers:e.number().int().min(1).max(16),matchingServers:e.number().int().min(0).max(16),propagated:e.boolean()}).strict().superRefine((e,t)=>{e.matchingServers>e.authoritativeServers&&t.addIssue({code:`custom`,path:[`matchingServers`],message:`Matching nameservers cannot exceed authoritative nameservers`}),e.propagated!==(e.matchingServers===e.authoritativeServers)&&t.addIssue({code:`custom`,path:[`propagated`],message:`Propagation state must match the authoritative nameserver counts`})}).meta({id:`CheckedRecord`}),re=e.object({domain:s,allPropagated:e.boolean(),records:e.array(ne).min(1).max(100)}).strict().superRefine((e,t)=>{e.allPropagated!==e.records.every(e=>e.propagated)&&t.addIssue({code:`custom`,path:[`allPropagated`],message:`Overall propagation state must match every record result`})}).meta({id:`CheckRecordsResponse`}),ie=e.enum([`preserve`,`replace_same_name_and_type`,`replace_all_at_name`]).meta({id:`ConflictPolicy`}),ae=e.enum([`merge`,`replace`]).meta({id:`SpfConflictPolicy`}),oe=e.enum([`create`,`replace`,`delete`]).meta({id:`ChangeAction`}),se=e.object({action:oe,before:g.optional(),after:g.optional(),destructive:e.boolean()}).strict().superRefine((e,t)=>{e.action===`create`&&e.after===void 0&&t.addIssue({code:`custom`,path:[`after`],message:`Create requires the resulting record`}),e.action===`replace`&&(e.before===void 0||e.after===void 0)&&t.addIssue({code:`custom`,message:`Replace requires both current and resulting records`}),e.action===`delete`&&e.before===void 0&&t.addIssue({code:`custom`,path:[`before`],message:`Delete requires the current record`})}).meta({id:`PlannedChange`});function ce(e){return e===`@`||e.split(`.`).every((e,t)=>e===`*`?t===0:e.length>=1&&e.length<=63&&!e.startsWith(`-`)&&!e.endsWith(`-`)&&/^[a-z0-9_-]+$/.test(e))}function le(e){let t=e.split(`;`).map(e=>e.trim()).filter(Boolean),n=new Set;if(t.length<2)return!1;for(let[e,r]of t.entries()){let t=r.indexOf(`=`);if(t<=0)return!1;let i=r.slice(0,t).trim().toLowerCase(),a=r.slice(t+1).trim();if(!f.safeParse(i).success||!p.safeParse(a).success||n.has(i)||e===0&&(i!==`v`||a!==`DMARC1`)||!ue(i,a))return!1;n.add(i)}return n.has(`p`)}function ue(e,t){if(e===`v`)return t===`DMARC1`;if([`p`,`sp`,`np`].includes(e))return[`none`,`quarantine`,`reject`].includes(t);if([`adkim`,`aspf`].includes(e))return t===`r`||t===`s`;if(e===`pct`)return/^\d{1,3}$/.test(t)&&Number(t)<=100;if(e===`ri`)return/^[1-9]\d*$/.test(t);if(e===`rf`)return t===`afrf`;if(e===`fo`){let e=t.split(`:`);return e.length>0&&new Set(e).size===e.length&&e.every(e=>[`0`,`1`,`d`,`s`].includes(e))&&!(e.includes(`0`)&&e.includes(`1`))}return!0}const de=e.enum([`automatic`,`domain_connect`,`manual`,`unverified`]).meta({id:`ProviderImplementation`}),fe=e.enum([`oauth2_pkce`,`oauth2_authorization_code`,`api_token`,`api_key`,`basic`,`session`,`domain_connect`,`manual`]).meta({id:`AuthorizationMethod`}),pe=e.strictObject({rootNSModification:e.enum([`supported`,`unsupported`,`unverified`]),subdomainNSModification:e.enum([`supported`,`unsupported`,`unverified`]),wwwRedirect:e.enum([`supported`,`unsupported`,`unverified`]),cnameFlattening:e.enum([`supported`,`unsupported`,`unverified`]),wildcardRecords:e.enum([`supported`,`unsupported`,`unverified`]),caaRecords:e.enum([`supported`,`unsupported`,`unverified`]),spfRecords:e.enum([`supported`,`unsupported`,`unverified`]),socialLogin:e.enum([`supported`,`unsupported`,`unverified`])}).meta({id:`ProviderCapabilities`}),me=e.enum([`no_stable_public_provider_identity`]).meta({id:`ProviderDetectionUnavailableReasonCode`}),x=e.discriminatedUnion(`method`,[e.strictObject({method:e.enum([`nameserver`,`domain_connect`,`nameserver_or_domain_connect`])}),e.strictObject({method:e.literal(`manual`),reasonCode:me})]).meta({id:`ProviderDetection`}),he=e.url({protocol:/^https$/}).regex(/^https:\/\//,`Provider reference URL must use HTTPS`).refine(e=>{let t=new URL(e);return t.username===``&&t.password===``},`Provider reference URL must not contain credentials`).meta({format:`uri`}),S=e.object({id:a,name:e.string().trim().min(1),referenceUrl:he,implementation:de,availableAuthorizationMethods:e.array(fe).refine(e=>new Set(e).size===e.length,`Authorization methods must be unique`).describe(`Available methods ordered from highest to lowest provider autonomy.`),capabilities:pe,detection:x,limitations:e.array(e.string().min(1))}).strict().superRefine((e,t)=>{let n=e.availableAuthorizationMethods;(e.implementation===`automatic`?n.every(e=>e!==`domain_connect`&&e!==`manual`):e.implementation===`domain_connect`?n.every(e=>e===`domain_connect`):e.implementation===`manual`?n.every(e=>e===`manual`):n.length===0)||t.addIssue({code:`custom`,path:[`availableAuthorizationMethods`],message:`Authorization methods must match the verified provider implementation`})}).meta({id:`Provider`}),ge=e.object({providers:e.array(S)}).strict().meta({id:`ListProvidersResponse`}),_e=e.enum([`operational`,`unavailable`]).meta({id:`ProviderHealthStatus`}),ve=e.enum([`automatic_ready`,`domain_connect_ready`,`runtime_authorization_unavailable`,`manual_only`,`unverified`]).meta({id:`ProviderHealthReason`}),C=e.object({providerId:a,providerName:e.string().trim().min(1).max(200),enabled:e.boolean(),status:_e,reason:ve}).strict().superRefine((e,t)=>{let n=e.reason===`automatic_ready`||e.reason===`domain_connect_ready`,r=e.enabled?e.status===`operational`:e.status===`unavailable`;(e.enabled!==n||!r)&&t.addIssue({code:`custom`,path:[`enabled`],message:`Enabled, status, and reason must describe the same provider health state`})}).meta({id:`ProviderHealth`}),ye=e.object({observedAt:c,refreshAfter:c,providers:e.array(C)}).strict().superRefine((e,t)=>{Date.parse(e.refreshAfter)<=Date.parse(e.observedAt)&&t.addIssue({code:`custom`,path:[`refreshAfter`],message:`Provider health refresh deadline must be after its observation time`});let n=e.providers.map(e=>e.providerId);new Set(n).size!==n.length&&t.addIssue({code:`custom`,path:[`providers`],message:`Provider health entries must have unique provider IDs`})}).meta({id:`ProviderHealthResponse`}),w=e.enum([`requested`,`detecting_provider`,`provider_selected`,`domain_connect_pending`,`authorization_pending`,`authorized`,`planning`,`awaiting_confirmation`,`applying`,`propagation_pending`,`active`,`manual_required`,`failed_retryable`,`failed_terminal`,`cancelled`]).meta({id:`ConnectionState`}),be=e.enum([`authorized`,`awaiting_confirmation`,`applying`]).meta({id:`RetryResumeState`}),xe=e.enum([`provider_snapshot_timeout`,`provider_apply_timeout`]).meta({id:`ConnectionFailureCode`}),T=e.object({code:xe,retryable:e.literal(!0),resumeState:be,occurredAt:c}).strict().meta({id:`ConnectionFailure`}),Se=e.enum([`spf_policy_replaced`,`spf_policy_merged`]).meta({id:`PlanWarningCode`}),Ce=e.object({digest:e.string().regex(/^[a-f0-9]{64}$/),changes:e.array(se).min(1),warnings:e.array(Se),expiresAt:c}).strict().meta({id:`ChangePlan`}),E=e.object({id:n,applicationId:r,tenantId:i,intent:y,effectiveIntent:b.optional(),state:w,provider:S.optional(),plan:Ce.optional(),failure:T.optional(),optionalFailures:e.array(e.string()),createdAt:c,updatedAt:c}).strict().superRefine((e,t)=>{let n=e.state===`failed_retryable`;n!==(e.failure!==void 0)&&t.addIssue({code:`custom`,path:[`failure`],message:n?`A retryable failure state requires failure details`:`Failure details are allowed only in a retryable failure state`}),e.effectiveIntent!==void 0&&e.effectiveIntent.domain!==e.intent.domain&&t.addIssue({code:`custom`,path:[`effectiveIntent`,`domain`],message:`Effective intent must use the requested intent domain`})}).meta({id:`Connection`}),we=e.object({applicationId:r,tenantId:i,intent:y,commandId:o}).strict().meta({id:`CreateConnectionInput`}),Te=e.object({connection:E}).strict().meta({id:`ConnectionResponse`}),Ee=Te,De=e.object({provider:S,confidence:e.number().min(0).max(1)}).strict().meta({id:`ProviderCandidate`}),Oe=e.object({connection:E,candidates:e.array(De)}).strict().meta({id:`DetectProviderResponse`}),ke=e.object({providerId:a,commandId:o}).strict().meta({id:`SelectProviderInput`}),D=e.string().regex(/^[A-Za-z0-9._-]{1,63}$/),Ae=e.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,62}$/),je=new Set([`domain`,`host`,`groupId`,`providerName`,`serviceName`,`instanceId`,`redirect_uri`,`state`,`sig`,`key`]),Me=e.record(Ae,e.string().min(1).max(4096).refine(e=>e.trim()===e&&!/[\u0000\r\n]/.test(e),`Domain Connect property values must be trimmed and single-line`)).refine(e=>Object.keys(e).length<=64,`At most 64 Domain Connect properties are allowed`).refine(e=>Object.keys(e).every(e=>!je.has(e)),`Domain Connect properties must not override reserved protocol parameters`),Ne=e.object({serviceProviderId:D,serviceId:D,host:e.string().max(253).regex(/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/).optional(),groupId:D.optional(),providerName:e.string().trim().min(1).max(200).optional(),serviceName:e.string().trim().min(1).max(200).optional(),instanceId:D.optional(),properties:Me}).strict().meta({id:`DomainConnectTemplate`}),Pe=Ne.extend({commandId:o}).strict().meta({id:`StartDomainConnectInput`}),Fe=e.url({protocol:/^https$/}).refine(e=>{let t=new URL(e);return t.username===``&&t.password===``&&t.hash===``},`Domain Connect handoff URL must be HTTPS without credentials or a fragment`),Ie=e.object({connection:E,handoffUrl:Fe}).strict().meta({id:`StartDomainConnectResponse`}),Le=e.object({commandId:o}).strict().meta({id:`SubmitDomainConnectCompletionInput`}),Re=e.object({digest:e.string().regex(/^[a-f0-9]{64}$/),allowDestructive:e.boolean(),commandId:o}).strict().meta({id:`ConfirmPlanInput`}),ze=e.object({commandId:o}).strict().meta({id:`StartOAuthInput`}),Be=e.object({connection:E,authorizationUrl:e.url({protocol:/^https$/}),expiresAt:c}).strict().meta({id:`StartOAuthResponse`}),O=e.string().min(1).max(16384).refine(e=>e.trim()===e,`Credential values must not have leading or trailing whitespace`).meta({format:`password`,writeOnly:!0}),k=e.object({kind:e.literal(`api_token`),token:O}).strict().meta({id:`ApiTokenCredentials`}),A=e.object({kind:e.literal(`access_key`),keyId:O,secret:O}).strict().meta({id:`AccessKeyCredentials`}),j=e.object({kind:e.literal(`username_password`),username:O,password:O}).strict().meta({id:`UsernamePasswordCredentials`}),M=e.object({kind:e.literal(`account_token`),accountId:O,token:O}).strict().meta({id:`AccountTokenCredentials`}),N=e.object({kind:e.literal(`username_token`),username:O,token:O}).strict().meta({id:`UsernameTokenCredentials`}),P=e.object({kind:e.literal(`ovh`),endpoint:e.enum([`ovh-eu`,`ovh-us`,`ovh-ca`,`kimsufi-eu`,`kimsufi-ca`,`soyoustart-eu`,`soyoustart-ca`]),applicationKey:O,applicationSecret:O,consumerKey:O}).strict().meta({id:`OvhCredentials`}),F=e.object({kind:e.literal(`private_key`),login:O,privateKey:O.refine(e=>/^(-----BEGIN (?:RSA )?PRIVATE KEY-----)[\s\S]+(-----END (?:RSA )?PRIVATE KEY-----)$/.test(e),`A PKCS#8 or PKCS#1 PEM private key is required`)}).strict().meta({id:`PrivateKeyCredentials`}),Ve=e.object({kind:e.literal(`aws_session`),keyId:O.regex(/^[A-Z0-9]{16,128}$/),secret:O,sessionToken:O,hostedZoneId:e.string().regex(/^Z[A-Z0-9]{1,63}$/),expiresAt:c}).strict().meta({id:`AwsSessionCredentials`}),He=e.url({protocol:/^https$/}).refine(e=>{let t=new URL(e);return t.port===`2083`&&t.username===``&&t.password===``&&(t.pathname===``||t.pathname===`/`)&&t.search===``&&t.hash===``},`cPanel endpoint must be an HTTPS origin on port 2083`),I=e.object({kind:e.literal(`cpanel`),endpoint:He,username:O,token:O}).strict().meta({id:`CPanelCredentials`}),Ue=e.object({kind:e.literal(`client_credentials`),clientId:O,clientSecret:O}).strict().meta({id:`ClientCredentials`});function L(t,n){return e.object({providerId:e.literal(t),credentials:n,commandId:o}).strict()}const We=[L(`alibaba-cloud`,A),L(`all-inkl`,j),L(`amazon-route-53`,Ve),L(`cloudflare`,k),L(`cloudns`,M),L(`digitalocean`,k),L(`dnsimple`,M),L(`dreamhost`,k),L(`dynadot`,A),L(`easydns`,A),L(`gandi`,k),L(`godaddy`,k),L(`hetzner`,k),L(`hostgator`,I),L(`hostinger`,k),L(`hosting-com`,I),L(`inmotion-hosting`,I),L(`ionos`,k),L(`name-com`,N),L(`namesilo`,k),L(`netlify`,k),L(`o2switch`,I),L(`openprovider`,k),L(`opensrs`,Ue),L(`ovh`,P),L(`porkbun`,A),L(`simply`,k),L(`spaceship`,A),L(`transip`,F),L(`united-domains`,k),L(`vercel`,k),L(`wix`,M)],Ge=Object.freeze(Object.fromEntries(We.map(e=>[e.shape.providerId.value,e.shape.credentials.shape.kind.value]))),Ke=e.discriminatedUnion(`providerId`,We).meta({id:`AuthorizeWithCredentialInput`}),qe=e.object({completed:e.literal(!0)}).strict().meta({id:`OAuthCallbackResponse`}),Je=e.object({conflictPolicy:ie,spfPolicy:ae.default(`merge`),commandId:o}).strict().meta({id:`PreparePlanInput`}),Ye=e.object({commandId:o}).strict().meta({id:`ApplyPlanInput`}),Xe=e.object({commandId:o}).strict().meta({id:`VerifyPropagationInput`}),Ze=e.object({commandId:o}).strict().meta({id:`StartManualConfigurationInput`}),Qe=e.object({commandId:o}).strict().meta({id:`SubmitManualCompletionInput`}),$e=e.object({commandId:o}).strict().meta({id:`CancelConnectionInput`}),et=e.object({commandId:o}).strict().meta({id:`RetryConnectionInput`}),tt=e.object({origin:e.url().refine(e=>{let t=new URL(e);return t.username===``&&t.password===``&&t.search===``&&t.hash===``&&(t.pathname===``||t.pathname===`/`)&&(t.protocol===`https:`||t.protocol===`http:`&&rt(t.hostname))},`Origin must be an HTTPS origin without a path, query, or fragment`)}).strict().meta({id:`IssueConnectionTokenInput`}),nt=e.object({accessToken:e.string().min(1).max(8192),tokenType:e.literal(`Bearer`),expiresAt:c}).strict().meta({id:`IssueConnectionTokenResponse`});function rt(e){return e===`localhost`||e===`127.0.0.1`||e===`[::1]`}const it=e.string().trim().min(1).max(200).meta({id:`ConnectionFlowId`}),at=e.strictObject({domain:e.array(_).min(1).max(100),subDomain:e.array(_).min(1).max(100).optional(),rootNS:e.array(_).min(1).max(100).optional()}).superRefine((e,t)=>{e.rootNS?.forEach((e,n)=>{(e.host!==`@`||e.type!==`NS`)&&t.addIssue({code:`custom`,path:[`rootNS`,n],message:`rootNS accepts only NS records at the zone apex`})})}).meta({id:`ConditionalDnsRecords`}),ot=e.strictObject({domain:s,records:e.array(_).min(1).max(100)}),st=e.strictObject({domain:s,conditionalRecords:at}),ct=e.union([ot,st]).meta({id:`ConnectionFlowTargetInput`}),lt=e.strictObject({applicationId:r,tenantId:i,existingRecordPolicy:v.default({validateDmarc:!1,validateCAA:!1}),targets:e.array(ct).min(2).max(100).superRefine((e,t)=>{let n=new Set;e.forEach((e,r)=>{n.has(e.domain)&&t.addIssue({code:`custom`,path:[r,`domain`],message:`Flow target domains must be unique`}),n.add(e.domain)})}),commandId:o}).meta({id:`CreateConnectionFlowInput`}),ut=e.strictObject({domain:s,state:e.enum([`pending`,`provisioned`]),connectionId:n.optional()}).superRefine((e,t)=>{e.state===`provisioned`!=(e.connectionId!==void 0)&&t.addIssue({code:`custom`,path:[`connectionId`],message:e.state===`provisioned`?`A provisioned target requires a connection id`:`A pending target cannot have a connection id`})}).meta({id:`ConnectionFlowTarget`}),dt=e.strictObject({id:it,applicationId:r,tenantId:i,state:e.enum([`provisioning`,`ready`]),targets:e.array(ut).min(2).max(100),createdAt:c,updatedAt:c}).superRefine((e,t)=>{let n=e.targets.every(e=>e.state===`provisioned`);e.state===`ready`!==n&&t.addIssue({code:`custom`,path:[`state`],message:`Flow state must match target provisioning state`})}).meta({id:`ConnectionFlow`}),ft=e.strictObject({flow:dt}).meta({id:`ConnectionFlowResponse`}),R=e.enum([`invalid_request`,`unauthorized`,`forbidden`,`not_found`,`conflict`,`rate_limited`,`dns_unavailable`,`provider_unavailable`,`provider_authorization_failed`,`provider_limitation`,`plan_expired`,`propagation_pending`,`internal_error`]).meta({id:`Domain0ErrorCode`}),pt=e.object({error:e.object({code:R,message:e.string().min(1),requestId:e.string().min(1),retryable:e.boolean(),details:e.record(e.string(),e.unknown()).optional()}).strict()}).strict().meta({id:`ErrorResponse`}),z=e.string().min(1).max(200).brand(),B=e.string().regex(/^[A-Za-z0-9_-]{43}$/).brand(),mt=e.strictObject({connectionId:n,expiresAt:c}),ht=e.strictObject({sharedFlowId:z,token:B,expiresAt:c}),gt=e.strictObject({token:B,origin:e.string().url().max(2048)}),_t=e.strictObject({sharedFlowId:z,connectionId:n,accessToken:e.string().min(1).max(8192),expiresAt:c}),vt=e.string().url().max(4096),V=vt.superRefine((e,t)=>{let n=new URL(e),r=n.protocol===`https:`,i=n.protocol===`http:`&&bt(n.hostname);!r&&!i&&t.addIssue({code:`custom`,message:`Shared-flow invitation URLs must use HTTPS, except on loopback development hosts`}),(n.username!==``||n.password!==``)&&t.addIssue({code:`custom`,message:`Shared-flow invitation URLs cannot contain user information`});let a=new URLSearchParams(n.hash.slice(1)),o=a.get(`domain0`);(a.size!==1||!B.safeParse(o).success)&&t.addIssue({code:`custom`,message:`Shared-flow invitation URLs require one valid domain0 capability in the fragment`})}).meta({id:`SharedFlowInvitationUrl`}),yt=e.object({sharedFlowId:z,url:V,expiresAt:c}).strict().meta({id:`SharedFlowInvitation`});function bt(e){let t=e.toLowerCase();return t===`localhost`||t===`[::1]`||/^127(?:\.[0-9]{1,3}){3}$/.test(t)}const H=e.string().trim().toLowerCase().min(1).max(63).regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/).brand().meta({id:`DkimSelector`}),xt=e.object({selectors:e.array(H).max(10).default([])}).strict().superRefine((e,t)=>{new Set(e.selectors).size!==e.selectors.length&&t.addIssue({code:`custom`,path:[`selectors`],message:`DKIM selectors must be unique`})}).meta({id:`DkimGuidanceInput`}),St=e.object({enableDkim:e.boolean().default(!1),dkimSelectors:e.array(H).max(10).default([])}).strict().superRefine((e,t)=>{new Set(e.dkimSelectors).size!==e.dkimSelectors.length&&t.addIssue({code:`custom`,path:[`dkimSelectors`],message:`DKIM selectors must be unique`})}).meta({id:`Domain0DkimGuidanceOptions`}),Ct=e.object({id:e.literal(`google_workspace`),name:e.literal(`Google Workspace`),guideUrl:e.literal(`https://support.google.com/a/answer/174124`)}).strict(),wt=e.object({id:e.literal(`microsoft_365`),name:e.literal(`Microsoft 365`),guideUrl:e.literal(`https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure`)}).strict(),Tt=e.object({id:e.literal(`zoho_mail`),name:e.literal(`Zoho Mail`),guideUrl:e.literal(`https://www.zoho.com/mail/help/adminconsole/dkim-configuration.html`)}).strict(),U=e.discriminatedUnion(`id`,[Ct,wt,Tt]).meta({id:`EmailProvider`}),Et=e.enum([`detected`,`ambiguous`,`unknown`]).meta({id:`EmailProviderDetectionStatus`}),Dt=e.enum([`TXT`,`CNAME`]).meta({id:`DkimDnsRecordType`}),Ot=e.enum([`record_observed`,`no_record_observed`,`not_checked`,`lookup_unavailable`]).meta({id:`DkimDnsEvidenceStatus`}),kt=e.object({selector:H,types:e.array(Dt).min(1).max(2).refine(e=>new Set(e).size===e.length,`Observed DKIM DNS record types must be unique`)}).strict().meta({id:`DkimDnsRecordEvidence`}),At=e.object({status:Ot,selectorsChecked:e.array(H).max(12).refine(e=>new Set(e).size===e.length,`Checked DKIM selectors must be unique`),records:e.array(kt).max(12)}).strict().superRefine((e,t)=>{let n=new Set(e.selectorsChecked);e.records.some(e=>!n.has(e.selector))&&t.addIssue({code:`custom`,path:[`records`],message:`Observed records must belong to checked selectors`}),e.status===`not_checked`&&(e.selectorsChecked.length!==0||e.records.length!==0)&&t.addIssue({code:`custom`,path:[`status`],message:`Not-checked evidence cannot include selector observations`}),e.status===`record_observed`&&e.records.length===0&&t.addIssue({code:`custom`,path:[`records`],message:`Observed status requires at least one DNS record`}),e.status!==`record_observed`&&e.records.length!==0&&t.addIssue({code:`custom`,path:[`records`],message:`Only observed status can include DNS records`}),[`no_record_observed`,`lookup_unavailable`].includes(e.status)&&e.selectorsChecked.length===0&&t.addIssue({code:`custom`,path:[`selectorsChecked`],message:`A DNS lookup status requires at least one checked selector`})}).meta({id:`DkimDnsEvidence`}),jt=e.object({domain:s,detectionStatus:Et,candidates:e.array(U).max(3),provider:U.optional(),mxHosts:e.array(s).max(20).refine(e=>new Set(e).size===e.length,`MX hosts must be unique`),dkimDns:At,observedAt:c}).strict().superRefine((e,t)=>{let n=e.candidates.map(e=>e.id);new Set(n).size!==n.length&&t.addIssue({code:`custom`,path:[`candidates`],message:`Email provider candidates must be unique`}),e.detectionStatus===`detected`&&(e.candidates.length!==1||e.provider?.id!==e.candidates[0]?.id)&&t.addIssue({code:`custom`,path:[`provider`],message:`Detected status requires exactly one matching provider`}),e.detectionStatus===`ambiguous`&&(e.candidates.length<2||e.provider!==void 0)&&t.addIssue({code:`custom`,path:[`candidates`],message:`Ambiguous status requires multiple candidates and no resolved provider`}),e.detectionStatus===`unknown`&&(e.candidates.length!==0||e.provider!==void 0)&&t.addIssue({code:`custom`,path:[`candidates`],message:`Unknown status cannot include an email provider`})}).meta({id:`DkimGuidanceResponse`}),W=e.union([e.enum([`loading`,`provider_detection`,`provider_selection`,`cancellation_confirmation`]),w]).meta({id:`Domain0ConnectStep`}),Mt=e.enum([`close_button`,`escape`,`programmatic`,`destroyed`,`automatic`]).meta({id:`Domain0ConnectCloseTrigger`}),Nt=e.enum([`success`,`failure`,`cancelled`,`incomplete`]).meta({id:`Domain0ConnectOutcome`}),G=E.and(e.object({state:e.literal(`active`)})),Pt=E.and(e.object({state:e.literal(`manual_required`)})),Ft=e.union([E.and(e.object({state:e.literal(`failed_retryable`),failure:T})),E.and(e.object({state:e.literal(`failed_terminal`),failure:e.undefined().optional()}))]),K=e.discriminatedUnion(`source`,[e.object({source:e.literal(`configuration`),code:e.literal(`invalid_configuration`),retryable:e.literal(!1)}).strict(),e.object({source:e.literal(`api`),code:R,retryable:e.boolean(),requestId:e.string().min(1)}).strict(),e.object({source:e.literal(`transport`),code:e.literal(`transport_error`),retryable:e.literal(!0)}).strict(),e.object({source:e.literal(`protocol`),code:e.literal(`protocol_error`),retryable:e.literal(!1)}).strict(),e.object({source:e.literal(`unexpected`),code:e.literal(`unexpected_error`),retryable:e.literal(!1)}).strict()]).meta({id:`Domain0ConnectError`}),It=e.object({type:e.literal(`success`),connection:G}).strict().meta({id:`Domain0ConnectSuccessEvent`}),Lt=e.object({type:e.literal(`failure`),connection:Ft}).strict().meta({id:`Domain0ConnectFailureEvent`}),Rt=e.object({type:e.literal(`error`),error:K,connection:E.optional(),step:W.optional()}).strict().meta({id:`Domain0ConnectErrorEvent`}),zt=e.object({type:e.literal(`close`),trigger:Mt,outcome:Nt,connection:E.optional(),step:W.optional(),error:K.optional()}).strict().superRefine((e,t)=>{let n=Kt(e.connection,e.error);e.outcome!==n&&t.addIssue({code:`custom`,path:[`outcome`],message:`Close outcome must be ${n} for the supplied connection and error`})}).meta({id:`Domain0ConnectCloseEvent`}),Bt=e.object({type:e.literal(`step_change`),step:W,previousStep:W.optional(),connection:E.optional()}).strict().meta({id:`Domain0ConnectStepChangeEvent`}),Vt=e.object({type:e.literal(`manual_setup_documentation_click`),connection:Pt}).strict().meta({id:`Domain0ManualSetupDocumentationClickEvent`}),Ht=e.object({type:e.literal(`request_close`),connection:E.optional(),step:W}).strict().meta({id:`Domain0RequestCloseEvent`}),Ut=e.object({type:e.literal(`shared_flow_sent`),connection:Pt,sharedFlowId:z,url:V,expiresAt:c}).strict().meta({id:`Domain0SharedFlowSentEvent`}),Wt=e.object({type:e.literal(`dkim_setup_documentation_click`),connection:G,emailProvider:U}).strict().meta({id:`Domain0DkimSetupDocumentationClickEvent`}),Gt=e.discriminatedUnion(`type`,[It,Lt,Rt,zt,Bt,Vt,Ht,Ut,Wt]).meta({id:`Domain0ConnectEvent`});function Kt(e,t){return e?.state===`active`?`success`:t!==void 0||e?.state===`failed_retryable`||e?.state===`failed_terminal`?`failure`:e?.state===`cancelled`?`cancelled`:`incomplete`}const qt=e.object({mode:e.enum([`automatic`,`manual`]).default(`automatic`)}).strict(),Jt=/^#[0-9A-F]{6}$/,Yt=/^#[0-9A-F]{8}$/,q=e.string().trim().toUpperCase().regex(Jt,`Expected an opaque #RRGGBB color`),Xt=e.string().trim().toUpperCase().regex(Yt,`Expected a #RRGGBBAA backdrop color`),Zt=e.string().trim().min(1).max(500).refine(e=>!/[<>\u0000-\u001F\u007F]/.test(e),`White-label copy must be plain text without markup or control characters`),Qt=Zt.max(120).meta({id:`Domain0ApplicationName`}),$t=e.string().trim().min(1).max(2048).refine(e=>{try{let t=new URL(e);return t.protocol===`https:`&&t.username===``&&t.password===``}catch{return!1}},`Logo must be an HTTPS URL without embedded credentials`).meta({id:`Domain0WhiteLabelLogoUrl`});function J(...e){return Zt.refine(t=>{let n=e.reduce((e,t)=>e.replaceAll(t,``),t);return!/[{}]/.test(n)},`Only these placeholders are allowed: ${e.join(`, `)||`none`}`)}function Y(t){let n=e.object({en:t,es:t.optional(),pt:t.optional(),"pt-br":t.optional(),"pt-pt":t.optional(),fr:t.optional(),it:t.optional(),de:t.optional(),nl:t.optional(),pl:t.optional(),tr:t.optional(),ja:t.optional(),da:t.optional(),sv:t.optional()}).strict();return e.union([t.transform(e=>({en:e})),n])}function en(e,t){return tn(q.parse(e),q.parse(t))}function tn(e,t){let n=rn(e),r=rn(t),i=Math.max(n,r),a=Math.min(n,r);return(i+.05)/(a+.05)}function nn(e){let t=e.split(`,`);return t.length<=10&&t.every(e=>{let t=e.trim();if(t.length===0)return!1;let n=t.at(0);return n===`"`||n===`'`?t.at(-1)===n&&/^[A-Za-z0-9 -]+$/.test(t.slice(1,-1)):/^-?[A-Za-z][A-Za-z0-9 -]*$/.test(t)})}function rn(e){let[t,n,r]=[1,3,5].map(t=>Number.parseInt(e.slice(t,t+2),16)/255).map(e=>e<=.04045?e/12.92:((e+.055)/1.055)**2.4);return .2126*t+.7152*n+.0722*r}const an=[{foreground:`text`,background:`surface`,minimum:4.5,purpose:`body text`},{foreground:`mutedText`,background:`surface`,minimum:4.5,purpose:`secondary text`},{foreground:`onPrimary`,background:`primary`,minimum:4.5,purpose:`primary control text`},{foreground:`danger`,background:`surface`,minimum:4.5,purpose:`error text`},{foreground:`onDanger`,background:`danger`,minimum:4.5,purpose:`danger control text`},{foreground:`link`,background:`surface`,minimum:4.5,purpose:`link text`},{foreground:`border`,background:`surface`,minimum:3,purpose:`control boundaries`},{foreground:`primary`,background:`surface`,minimum:3,purpose:`primary control boundaries`},{foreground:`focus`,background:`surface`,minimum:3,purpose:`focus indicators`}],on={surface:`#FFFFFF`,text:`#0A0A0A`,mutedText:`#6B6B6B`,border:`#73737C`,primary:`#0A0A0A`,onPrimary:`#FFFFFF`,link:`#2B21FF`,focus:`#2B21FF`,danger:`#B3261E`,onDanger:`#FFFFFF`},sn={surface:`#111827`,text:`#F9FAFB`,mutedText:`#D1D5DB`,border:`#D1D5DB`,primary:`#BFDBFE`,onPrimary:`#172554`,link:`#BFDBFE`,focus:`#FBBF24`,danger:`#FCA5A5`,onDanger:`#450A0A`};function cn(t){return e.object({surface:q.default(t.surface),text:q.default(t.text),mutedText:q.default(t.mutedText),border:q.default(t.border),primary:q.default(t.primary),onPrimary:q.default(t.onPrimary),link:q.default(t.link),focus:q.default(t.focus),danger:q.default(t.danger),onDanger:q.default(t.onDanger)}).strict().superRefine((e,t)=>{for(let n of an){let r=tn(e[n.foreground],e[n.background]);r<n.minimum&&t.addIssue({code:`custom`,path:[n.foreground],message:`${n.purpose} requires ${n.minimum}:1 contrast against ${n.background}; received ${r.toFixed(2)}:1`})}})}const ln=cn(on),un=cn(sn),dn=e.object({colorMode:e.enum([`light`,`dark`,`system`]).default(`light`),light:ln.prefault({}),dark:un.prefault({}),backdrop:Xt.default(`#2B21FF26`),widthPx:e.number().int().min(320).max(960).default(520),dialogRadiusPx:e.number().int().min(0).max(48).default(20),buttonRadiusPx:e.number().int().min(0).max(999).default(999),inputRadiusPx:e.number().int().min(0).max(32).default(12),fontFamily:e.string().trim().min(1).max(200).refine(nn,`Use a comma-separated system font stack without URLs or CSS syntax`).default(`"PP Neue Montreal", "Inter Tight", ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif`),fontWeight:e.number().int().min(100).max(900).multipleOf(50).default(400),boldFontWeight:e.number().int().min(100).max(900).multipleOf(50).default(500)}).strict().superRefine((e,t)=>{e.boldFontWeight<e.fontWeight&&t.addIssue({code:`custom`,path:[`boldFontWeight`],message:`Bold font weight must be at least the normal font weight`})}),fn=e.object({initialSubtitle:Y(J()).optional(),providerLoginMessage:Y(J(`{PROVIDER}`)).optional(),successTitle:Y(J(`{DOMAIN}`)).optional(),successDescription:Y(J(`{DOMAIN}`)).optional(),successButton:Y(J()).optional(),manuallyScreen:e.object({disableManualSetupDocumentationLink:e.boolean().default(!1),stepByStepGuide:Y(J()).optional()}).strict().prefault({})}).strict(),pn=e.object({disable:e.boolean().default(!1)}).strict(),mn=e.object({manualConfiguration:e.object({disableScreen:e.boolean().default(!1)}).strict().prefault({}),providerLogin:e.object({forwardLink:pn.prefault({}),gotoManualLink:pn.prefault({})}).strict().prefault({})}).strict(),hn=e.object({theme:dn.prefault({}),copy:fn.prefault({}),logo:$t.optional(),logoBackgroundColor:q.optional(),removeLogoBorder:e.boolean().default(!1),hideCompanyLogo:e.boolean().default(!1),hideCompanyName:e.boolean().default(!1),removeShareLogin:e.boolean().default(!1),skipCongratulationsScreen:e.boolean().default(!1),customProperties:mn.prefault({})}).strict(),gn=e.url({protocol:/^https$/}).max(2048).refine(e=>{let t=new URL(e);return t.username===``&&t.password===``},`Manual setup documentation URL must not contain credentials`).brand().meta({id:`ManualSetupDocumentationUrl`}),_n=e.object({applicationName:Qt.optional(),whiteLabel:hn.prefault({}),setupPolicy:qt.prefault({}),dkim:St.prefault({}),manualSetupDocumentation:gn.optional()}).strict().superRefine((e,t)=>{let{customProperties:n}=e.whiteLabel,r=e.setupPolicy.mode===`manual`;r&&n.manualConfiguration.disableScreen&&t.addIssue({code:`custom`,path:[`whiteLabel`,`customProperties`,`manualConfiguration`,`disableScreen`],message:`Forced manual setup requires the manual configuration screen`}),r&&n.providerLogin.gotoManualLink.disable&&t.addIssue({code:`custom`,path:[`whiteLabel`,`customProperties`,`providerLogin`,`gotoManualLink`,`disable`],message:`Forced manual setup cannot disable entry into manual configuration`}),e.dkim.enableDkim&&e.whiteLabel.skipCongratulationsScreen&&t.addIssue({code:`custom`,path:[`whiteLabel`,`skipCongratulationsScreen`],message:`DKIM guidance requires the success screen`})}).meta({id:`Domain0ConnectConfiguration`}),vn=e.enum(`alibaba-cloud.all-inkl.amazon-route-53.cloudflare.cloudns.digitalocean.dnsimple.dreamhost.dynadot.easydns.gandi.godaddy.hetzner.hostgator.hostinger.hosting-com.inmotion-hosting.ionos.name-com.namecheap.namesilo.netlify.o2switch.openprovider.opensrs.ovh.porkbun.simply.spaceship.transip.united-domains.vercel.wix`.split(`.`)).meta({id:`CompiledProviderId`}),yn=e.enum([`authenticated_snapshot`,`reserved_name_available`,`create_sibling`,`create_target`,`rrset_sibling_preservation`,`idempotent_replay`,`replace_target`,`authoritative_propagation`,`delete_target`,`scoped_cleanup`]).meta({id:`ProviderConformanceCheckName`}),X=[`authenticated_snapshot`,`reserved_name_available`,`create_sibling`,`create_target`,`rrset_sibling_preservation`,`idempotent_replay`,`replace_target`,`authoritative_propagation`,`delete_target`,`scoped_cleanup`],bn=e.object({name:yn}).strict(),xn=e.union([e.literal(`unknown`),e.string().regex(/^[a-f0-9]{40,64}$/)]),Sn=e.object({schemaVersion:e.literal(1),providerId:vn,adapterVersion:e.string().min(1).max(200).refine(Tn),sourceRevision:xn,sourceModified:e.boolean(),binarySha256:e.string().regex(/^[a-f0-9]{64}$/),zone:s,runId:e.string().regex(/^[a-f0-9]{16,64}$/),host:e.string(),startedAt:c,completedAt:c,passed:e.boolean(),checks:e.array(bn).max(X.length),cleanupAttempted:e.boolean(),cleanupCompleted:e.boolean()}).strict().superRefine((e,t)=>{e.host!==`_domain0-conformance-${e.runId}`&&t.addIssue({code:`custom`,path:[`host`],message:`Conformance hostname must be derived from the random run ID`}),Date.parse(e.completedAt)<Date.parse(e.startedAt)&&t.addIssue({code:`custom`,path:[`completedAt`],message:`Conformance completion must not precede its start`});let n=e.checks.map(e=>e.name);wn(n)||t.addIssue({code:`custom`,path:[`checks`],message:`Conformance checks must be an ordered prefix followed optionally by scoped cleanup`});let r=n.includes(`scoped_cleanup`);(e.cleanupCompleted&&!e.cleanupAttempted||r!==e.cleanupCompleted)&&t.addIssue({code:`custom`,path:[`cleanupCompleted`],message:`Completed cleanup requires an attempted cleanup and the scoped-cleanup check`})}).meta({id:`ProviderConformanceEvidence`}),Cn=Sn.refine(e=>e.passed&&!e.sourceModified&&e.sourceRevision!==`unknown`&&e.cleanupAttempted&&e.cleanupCompleted&&e.checks.every((e,t)=>e.name===X[t])&&e.checks.length===X.length,`Verified live-suite evidence requires clean traceable source, every ordered check, and completed cleanup`).meta({id:`VerifiedProviderConformanceEvidence`});function wn(e){let t=0,n=!1;for(let r of e){if(r===`scoped_cleanup`){if(n)return!1;n=!0;continue}if(n||r!==X[t])return!1;t+=1}return!0}function Tn(e){return e.trim()===e&&!/[\u0000\r\n]/.test(e)}const En=e.enum([`delegated`,`undelegated`,`unknown`]).meta({id:`DomainDelegationStatus`}),Dn=e.enum([`automatic`,`manual`,`unavailable`,`ambiguous`,`unknown`]).meta({id:`DomainSetupSupport`}),On=e.enum([`same_name_and_type`,`cname_collision`,`mx_set_collision`,`spf_collision`,`ns_delegation`]).meta({id:`RecordConflictReason`}),kn=e.object({domain:s,records:e.array(g).max(100).default([]),checkConflicts:e.boolean().default(!1)}).strict().superRefine((e,t)=>{e.checkConflicts&&e.records.length===0&&t.addIssue({code:`custom`,path:[`records`],message:`Record conflict analysis requires at least one requested record`})}).meta({id:`CheckDomainInput`}),An=e.object({provider:S,confidence:e.number().min(0).max(1),exact:e.boolean()}).strict().meta({id:`DomainProviderCandidate`}),jn=e.object({requested:g,existing:e.array(g).max(1e3),reasons:e.array(On).min(1).max(5).refine(e=>new Set(e).size===e.length,`Conflict reasons must be unique`)}).strict().meta({id:`DomainRecordConflict`}),Mn=e.object({status:e.enum([`not_requested`,`complete`,`partial`]),authoritativeServers:e.number().int().min(0).max(16),respondingServers:e.number().int().min(0).max(16),conflicts:e.array(jn).max(100)}).strict().superRefine((e,t)=>{e.respondingServers>e.authoritativeServers&&t.addIssue({code:`custom`,path:[`respondingServers`],message:`Responding nameservers cannot exceed authoritative nameservers`}),e.status===`complete`&&e.respondingServers!==e.authoritativeServers&&t.addIssue({code:`custom`,path:[`status`],message:`Complete analysis requires every authoritative nameserver to respond`}),e.status===`partial`&&(e.respondingServers===0||e.respondingServers>=e.authoritativeServers)&&t.addIssue({code:`custom`,path:[`status`],message:`Partial analysis requires some but not all authoritative nameservers to respond`}),e.status===`not_requested`&&e.conflicts.length!==0&&t.addIssue({code:`custom`,path:[`conflicts`],message:`Conflict results cannot exist when analysis was not requested`})}).meta({id:`ConflictAnalysis`}),Nn=e.object({domain:s,delegationStatus:En,candidates:e.array(An).max(65),provider:S.optional(),setupSupport:Dn,conflictAnalysis:Mn}).strict().superRefine((e,t)=>{let n=e.candidates.map(e=>e.provider.id);new Set(n).size!==n.length&&t.addIssue({code:`custom`,path:[`candidates`],message:`Provider candidates must be unique`}),e.delegationStatus===`undelegated`&&(e.candidates.length!==0||e.provider!==void 0||e.setupSupport!==`unavailable`)&&t.addIssue({code:`custom`,path:[`delegationStatus`],message:`Undelegated domains cannot have provider support`}),e.provider!==void 0&&!e.candidates.some(t=>t.exact&&t.provider.id===e.provider?.id)&&t.addIssue({code:`custom`,path:[`provider`],message:`Resolved provider must be an exact provider candidate`}),[`automatic`,`manual`].includes(e.setupSupport)&&e.provider===void 0&&t.addIssue({code:`custom`,path:[`setupSupport`],message:`Available setup support requires a resolved provider`}),e.setupSupport===`automatic`&&!e.provider?.availableAuthorizationMethods.some(e=>e!==`manual`)&&t.addIssue({code:`custom`,path:[`setupSupport`],message:`Automatic setup requires a configured non-manual authorization method`}),e.setupSupport===`manual`&&(e.provider?.availableAuthorizationMethods.length!==1||e.provider.availableAuthorizationMethods[0]!==`manual`)&&t.addIssue({code:`custom`,path:[`setupSupport`],message:`Manual setup requires the manual authorization method`}),e.setupSupport===`ambiguous`&&e.candidates.length===0&&t.addIssue({code:`custom`,path:[`candidates`],message:`Ambiguous setup requires provider candidates`}),e.setupSupport===`unknown`&&e.candidates.length!==0&&t.addIssue({code:`custom`,path:[`candidates`],message:`Unknown setup cannot include provider candidates`}),[`ambiguous`,`unknown`].includes(e.setupSupport)&&e.provider!==void 0&&t.addIssue({code:`custom`,path:[`provider`],message:`Ambiguous or unknown support cannot resolve one provider`})}).meta({id:`CheckDomainResponse`}),Pn=[`en`,`es`,`pt`,`pt-br`,`pt-pt`,`fr`,`it`,`de`,`nl`,`pl`,`tr`,`ja`,`da`,`sv`],Fn=e.enum(Pn).meta({id:`Domain0Locale`}),In=e.strictObject({intent:y}).meta({id:`PlatformCreateConnectionInput`}),Ln=e.enum([`connection.requested`,`provider.detection_started`,`provider.selected`,`authorization.required`,`domain_connect.started`,`domain_connect.submitted`,`authorization.completed`,`connection.planning_started`,`connection.plan_prepared`,`connection.planning_restarted`,`connection.already_configured`,`connection.plan_confirmed`,`connection.changes_applied`,`connection.propagation_checked`,`connection.propagation_timed_out`,`connection.activated`,`connection.manual_required`,`connection.manual_submitted`,`connection.failed_retryable`,`connection.retry_started`,`connection.cancelled`]).meta({id:`Domain0WebhookEventType`}),Z=e.string().regex(/^[0-9a-f]{64}$/).brand().meta({id:`Domain0WebhookEventId`}),Rn=e.record(e.string().min(1).max(100),e.string().max(4e3)).superRefine((e,t)=>{Object.keys(e).length>64&&t.addIssue({code:`custom`,message:`Webhook attributes must contain at most 64 entries`})}).meta({id:`Domain0WebhookAttributes`}),zn=e.strictObject({schemaVersion:e.literal(1),eventId:Z,type:Ln,connectionId:n,applicationId:r,tenantId:i,sequence:e.number().int().positive().max(2**53-1),occurredAt:c,attributes:Rn}).meta({id:`Domain0WebhookEvent`}),Bn=e.enum([`invalid_headers`,`stale_timestamp`,`invalid_signature`,`invalid_payload`,`crypto_unavailable`]).meta({id:`Domain0WebhookVerificationErrorCode`});var Vn=class extends Error{code;name=`Domain0WebhookVerificationError`;constructor(e,t,n){super(t,n),this.code=e}};const Q={eventId:`x-domain0-event-id`,eventType:`x-domain0-event-type`,deliveryAttempt:`x-domain0-delivery-attempt`,schemaVersion:`x-domain0-schema-version`,signatureKeyId:`x-domain0-signature-key-id`,timestamp:`x-domain0-timestamp`,signature:`x-domain0-signature`},Hn=e.strictObject({eventId:Z,eventType:e.string().regex(/^domain0\.[a-z_]+\.[a-z_]+$/).max(100),deliveryAttempt:e.string().regex(/^[1-9][0-9]{0,8}$/).transform(Number),schemaVersion:e.literal(`1`),signatureKeyId:e.string().regex(/^[A-Za-z0-9._-]{1,64}$/),timestamp:e.string().regex(/^[0-9]{1,12}$/).transform(Number),signature:e.string().regex(/^v1=[0-9a-f]{64}$/)}),Un=new TextEncoder;async function Wn(e){let t=typeof e.body==`string`?Un.encode(e.body):new Uint8Array(e.body),n=Kn(e.maxBodyBytes??1048576,16777216);if(!(t instanceof Uint8Array)||t.byteLength===0||t.byteLength>n)throw $(`invalid_payload`,`Webhook body is empty or exceeds the configured limit`);let r=Gn(e.headers),i=qn(e.nowUnixSeconds??Math.floor(Date.now()/1e3),2**53-1),a=Kn(e.maxAgeSeconds??300,86400);if(Math.abs(i-r.timestamp)>a)throw $(`stale_timestamp`,`Webhook timestamp is outside the accepted replay window`);let o=Object.prototype.hasOwnProperty.call(e.secretKeyring,r.signatureKeyId)?e.secretKeyring[r.signatureKeyId]:void 0;if(!(o instanceof Uint8Array)||o.byteLength!==32)throw $(`invalid_signature`,`Webhook signature is invalid`);let s=e.crypto??globalThis.crypto;if(s?.subtle===void 0)throw $(`crypto_unavailable`,`Web Crypto is unavailable`);let c=Jn(r.signature.slice(3)),l=Un.encode(`v1.${r.signatureKeyId}.${r.timestamp}.`),u=new Uint8Array(l.byteLength+t.byteLength);u.set(l),u.set(t,l.byteLength);let d=await s.subtle.importKey(`raw`,new Uint8Array(o),{name:`HMAC`,hash:`SHA-256`},!1,[`verify`]);if(!await s.subtle.verify(`HMAC`,d,new Uint8Array(c),u))throw $(`invalid_signature`,`Webhook signature is invalid`);let f;try{let e=new TextDecoder(`utf-8`,{fatal:!0}).decode(t);f=JSON.parse(e)}catch(e){throw $(`invalid_payload`,`Verified webhook body is not valid UTF-8 JSON`,e)}let p=zn.safeParse(f);if(!p.success)throw $(`invalid_payload`,`Verified webhook body does not match schema version 1`,p.error);if(p.data.eventId!==r.eventId||`domain0.${p.data.type}`!==r.eventType||String(p.data.schemaVersion)!==r.schemaVersion)throw $(`invalid_payload`,`Verified webhook headers do not match the event body`);return p.data}function Gn(e){let t={eventId:void 0,eventType:void 0,deliveryAttempt:void 0,schemaVersion:void 0,signatureKeyId:void 0,timestamp:void 0,signature:void 0};if(`get`in e&&typeof e.get==`function`)for(let[n,r]of Object.entries(Q))t[n]=e.get(r)??void 0;else{let n=new Map;for(let e of Object.keys(Q))n.set(Q[e],e);let r=new Set;for(let[i,a]of Object.entries(e)){let e=i.toLowerCase(),o=n.get(e);if(o!==void 0){if(r.has(e)||typeof a!=`string`)throw $(`invalid_headers`,`Webhook headers are missing, duplicated, or malformed`);r.add(e),t[o]=a}}}let n=Hn.safeParse(t);if(!n.success)throw $(`invalid_headers`,`Webhook headers are missing, duplicated, or malformed`,n.error);return n.data}function Kn(e,t){if(!Number.isSafeInteger(e)||e<1||e>t)throw $(`invalid_headers`,`Webhook verification limits are invalid`);return e}function qn(e,t){if(!Number.isSafeInteger(e)||e<0||e>t)throw $(`invalid_headers`,`Webhook verification time is invalid`);return e}function Jn(e){let t=new Uint8Array(e.length/2);for(let n=0;n<e.length;n+=2)t[n/2]=Number.parseInt(e.slice(n,n+2),16);return t}function $(e,t,n){return new Vn(e,t,n===void 0?void 0:{cause:n})}export{A as AccessKeyCredentialsSchema,M as AccountTokenCredentialsSchema,m as AdvancedDmarcOptionsSchema,k as ApiTokenCredentialsSchema,r as ApplicationIdSchema,Ye as ApplyPlanInputSchema,fe as AuthorizationMethodSchema,Ke as AuthorizeWithCredentialInputSchema,Ve as AwsSessionCredentialsSchema,I as CPanelCredentialsSchema,$e as CancelConnectionInputSchema,oe as ChangeActionSchema,Ce as ChangePlanSchema,kn as CheckDomainInputSchema,Nn as CheckDomainResponseSchema,te as CheckRecordsInputSchema,re as CheckRecordsResponseSchema,ne as CheckedRecordSchema,Ue as ClientCredentialsSchema,o as CommandIdSchema,vn as CompiledProviderIdSchema,at as ConditionalDnsRecordsSchema,Re as ConfirmPlanInputSchema,Mn as ConflictAnalysisSchema,ie as ConflictPolicySchema,xe as ConnectionFailureCodeSchema,T as ConnectionFailureSchema,it as ConnectionFlowIdSchema,ft as ConnectionFlowResponseSchema,dt as ConnectionFlowSchema,ct as ConnectionFlowTargetInputSchema,ut as ConnectionFlowTargetSchema,n as ConnectionIdSchema,E as ConnectionSchema,w as ConnectionStateSchema,lt as CreateConnectionFlowInputSchema,we as CreateConnectionInputSchema,Te as CreateConnectionResponseSchema,mt as CreateSharedFlowInputSchema,ht as CreateSharedFlowResponseSchema,Q as DOMAIN0_WEBHOOK_HEADER_NAMES,Oe as DetectProviderResponseSchema,At as DkimDnsEvidenceSchema,Ot as DkimDnsEvidenceStatusSchema,kt as DkimDnsRecordEvidenceSchema,Dt as DkimDnsRecordTypeSchema,xt as DkimGuidanceInputSchema,jt as DkimGuidanceResponseSchema,H as DkimSelectorSchema,y as DnsIntentSchema,_ as DnsRecordSchema,d as DnsRecordTypeSchema,Qt as Domain0ApplicationNameSchema,zt as Domain0ConnectCloseEventSchema,Mt as Domain0ConnectCloseTriggerSchema,_n as Domain0ConnectConfigurationSchema,Rt as Domain0ConnectErrorEventSchema,K as Domain0ConnectErrorSchema,Gt as Domain0ConnectEventSchema,Lt as Domain0ConnectFailureEventSchema,Nt as Domain0ConnectOutcomeSchema,Bt as Domain0ConnectStepChangeEventSchema,W as Domain0ConnectStepSchema,It as Domain0ConnectSuccessEventSchema,St as Domain0DkimGuidanceOptionsSchema,Wt as Domain0DkimSetupDocumentationClickEventSchema,R as Domain0ErrorCodeSchema,pt as Domain0ErrorResponseSchema,Fn as Domain0LocaleSchema,Vt as Domain0ManualSetupDocumentationClickEventSchema,Ht as Domain0RequestCloseEventSchema,qt as Domain0SetupPolicySchema,Ut as Domain0SharedFlowSentEventSchema,Rn as Domain0WebhookAttributesSchema,Z as Domain0WebhookEventIdSchema,zn as Domain0WebhookEventSchema,Ln as Domain0WebhookEventTypeSchema,Vn as Domain0WebhookVerificationError,Bn as Domain0WebhookVerificationErrorCodeSchema,fn as Domain0WhiteLabelCopySchema,mn as Domain0WhiteLabelCustomPropertiesSchema,$t as Domain0WhiteLabelLogoUrlSchema,hn as Domain0WhiteLabelSchema,dn as Domain0WhiteLabelThemeSchema,Ne as DomainConnectTemplateSchema,En as DomainDelegationStatusSchema,s as DomainNameSchema,An as DomainProviderCandidateSchema,jn as DomainRecordConflictSchema,Dn as DomainSetupSupportSchema,Et as EmailProviderDetectionStatusSchema,U as EmailProviderSchema,v as ExistingRecordPolicySchema,Ee as GetConnectionResponseSchema,c as IsoDateTimeSchema,tt as IssueConnectionTokenInputSchema,nt as IssueConnectionTokenResponseSchema,ge as ListProvidersResponseSchema,gn as ManualSetupDocumentationUrlSchema,qe as OAuthCallbackResponseSchema,P as OvhCredentialsSchema,Se as PlanWarningCodeSchema,se as PlannedChangeSchema,In as PlatformCreateConnectionInputSchema,Je as PreparePlanInputSchema,F as PrivateKeyCredentialsSchema,De as ProviderCandidateSchema,pe as ProviderCapabilitiesSchema,yn as ProviderConformanceCheckNameSchema,Sn as ProviderConformanceEvidenceSchema,x as ProviderDetectionSchema,me as ProviderDetectionUnavailableReasonCodeSchema,ve as ProviderHealthReasonSchema,ye as ProviderHealthResponseSchema,C as ProviderHealthSchema,_e as ProviderHealthStatusSchema,a as ProviderIdSchema,de as ProviderImplementationSchema,S as ProviderSchema,On as RecordConflictReasonSchema,gt as ResolveSharedFlowInputSchema,_t as ResolveSharedFlowResponseSchema,b as ResolvedDnsIntentSchema,g as ResolvedDnsRecordSchema,et as RetryConnectionInputSchema,be as RetryResumeStateSchema,ke as SelectProviderInputSchema,z as SharedFlowIdSchema,yt as SharedFlowInvitationSchema,V as SharedFlowInvitationUrlSchema,B as SharedFlowTokenSchema,vt as SharedFlowUrlSchema,ae as SpfConflictPolicySchema,Pe as StartDomainConnectInputSchema,Ie as StartDomainConnectResponseSchema,Ze as StartManualConfigurationInputSchema,ze as StartOAuthInputSchema,Be as StartOAuthResponseSchema,Le as SubmitDomainConnectCompletionInputSchema,Qe as SubmitManualCompletionInputSchema,i as TenantIdSchema,j as UsernamePasswordCredentialsSchema,N as UsernameTokenCredentialsSchema,Cn as VerifiedProviderConformanceEvidenceSchema,Xe as VerifyPropagationInputSchema,en as colorContrastRatio,Ge as directCredentialKindByProvider,Pn as domain0Locales,X as expectedProviderConformanceChecks,Wn as verifyDomain0Webhook};
 //# sourceMappingURL=contracts.mjs.map