domain0 0.3.3 → 0.4.0

package/dist/server.cjs

@@ -1,103 +1,2 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_contracts = require("./contracts.cjs");
-const require_error = require("./error-BB4-lyc4.cjs");
-//#region src/server/connection-proxy.ts
-const connectionIdPattern = /^[A-Za-z0-9_-]{1,200}$/;
-const connectionActions = /* @__PURE__ */ new Set([
-	"cancellation",
-	"change-application",
-	"change-plan",
-	"credential-authorization",
-	"dkim-guidance",
-	"domain-connect-completion",
-	"domain-connect-handoff",
-	"manual-completion",
-	"manual-configuration",
-	"oauth-authorization",
-	"plan-confirmation",
-	"propagation-verification",
-	"provider-detection",
-	"provider-selection",
-	"retry"
-]);
-const maximumBodyBytes = 1048576;
-/**
-* Forwards only the browser-safe connection routes used by Domain0 Connect.
-* Cookies, API keys, and unrelated headers are never forwarded.
-*/
-async function forwardDomain0ConnectionRequest(options) {
-	const method = options.request.method.toUpperCase();
-	if (!isAllowedPath(method, options.path)) return jsonError(404, "This route is not exposed by the connection bridge.");
-	const authorization = options.request.headers.get("authorization");
-	if (authorization === null || authorization.length > 8200 || !/^Bearer [A-Za-z0-9._~+\/-]+=*$/.test(authorization)) return jsonError(401, "A valid connection token is required.");
-	const originResult = require_contracts.IssueConnectionTokenInputSchema.safeParse({ origin: options.origin ?? new URL(options.request.url).origin });
-	if (!originResult.success) throw new require_error.Domain0ProtocolError("The connection bridge origin is invalid", originResult.error);
-	const upstreamBaseUrl = parseBaseUrl(options.upstreamBaseUrl);
-	const fetchImplementation = options.fetch ?? globalThis.fetch;
-	if (fetchImplementation === void 0) throw new require_error.Domain0ProtocolError("No fetch implementation is available");
-	let body;
-	if (method === "POST") {
-		const contentLength = Number(options.request.headers.get("content-length") ?? 0);
-		if (Number.isFinite(contentLength) && contentLength > maximumBodyBytes) return jsonError(413, "The request body is too large.");
-		const bytes = await options.request.arrayBuffer();
-		if (bytes.byteLength > maximumBodyBytes) return jsonError(413, "The request body is too large.");
-		body = bytes;
-	}
-	let upstream;
-	try {
-		upstream = await fetchImplementation(new URL(options.path.map(encodeURIComponent).join("/"), upstreamBaseUrl), {
-			method,
-			headers: {
-				accept: "application/json",
-				authorization,
-				origin: originResult.data.origin,
-				...body === void 0 ? {} : { "content-type": "application/json" }
-			},
-			...body === void 0 ? {} : { body },
-			cache: "no-store"
-		});
-	} catch (cause) {
-		throw new require_error.Domain0TransportError(cause);
-	}
-	return new Response(upstream.body, {
-		status: upstream.status,
-		headers: {
-			"cache-control": "no-store",
-			"content-type": upstream.headers.get("content-type") ?? "application/json"
-		}
-	});
-}
-function isAllowedPath(method, path) {
-	if (method === "GET" && path[0] === "v1" && path[1] === "providers" && (path.length === 2 || path.length === 3 && path[2] === "health")) return true;
-	if (path[0] !== "v1" || path[1] !== "connections" || path[2] === void 0 || !connectionIdPattern.test(path[2])) return false;
-	if (method === "GET") return path.length === 3;
-	return method === "POST" && path.length === 4 && path[3] !== void 0 && connectionActions.has(path[3]);
-}
-function parseBaseUrl(value) {
-	let url;
-	try {
-		url = new URL(value);
-	} catch (error) {
-		throw new require_error.Domain0ProtocolError("Domain0 upstreamBaseUrl must be an absolute URL", error);
-	}
-	if (url.protocol !== "https:" && !isLoopback(url.hostname)) throw new require_error.Domain0ProtocolError("Domain0 upstreamBaseUrl must use HTTPS outside local development");
-	if (url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") throw new require_error.Domain0ProtocolError("Domain0 upstreamBaseUrl must not contain credentials, a query, or a fragment");
-	url.pathname = `${url.pathname.replace(/\/$/, "")}/`;
-	return url;
-}
-function isLoopback(hostname) {
-	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
-}
-function jsonError(status, message) {
-	return Response.json({ error: {
-		code: status === 401 ? "unauthorized" : "invalid_request",
-		message
-	} }, {
-		status,
-		headers: { "cache-control": "no-store" }
-	});
-}
-//#endregion
-exports.forwardDomain0ConnectionRequest = forwardDomain0ConnectionRequest;
-
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./contracts.cjs"),t=require("./error-1Gob8Pup.cjs"),n=/^[A-Za-z0-9_-]{1,200}$/,r=new Set([`cancellation`,`change-application`,`change-plan`,`credential-authorization`,`dkim-guidance`,`domain-connect-completion`,`domain-connect-handoff`,`manual-completion`,`manual-configuration`,`oauth-authorization`,`plan-confirmation`,`propagation-verification`,`provider-detection`,`provider-selection`,`retry`]),i=1048576;async function a(n){let r=n.request.method.toUpperCase();if(!o(r,n.path))return l(404,`This route is not exposed by the connection bridge.`);let a=n.request.headers.get(`authorization`);if(a===null||a.length>8200||!/^Bearer [A-Za-z0-9._~+\/-]+=*$/.test(a))return l(401,`A valid connection token is required.`);let c=e.IssueConnectionTokenInputSchema.safeParse({origin:n.origin??new URL(n.request.url).origin});if(!c.success)throw new t.n(`The connection bridge origin is invalid`,c.error);let u=s(n.upstreamBaseUrl),d=n.fetch??globalThis.fetch;if(d===void 0)throw new t.n(`No fetch implementation is available`);let f;if(r===`POST`){let e=Number(n.request.headers.get(`content-length`)??0);if(Number.isFinite(e)&&e>i)return l(413,`The request body is too large.`);let t=await n.request.arrayBuffer();if(t.byteLength>i)return l(413,`The request body is too large.`);f=t}let p;try{p=await d(new URL(n.path.map(encodeURIComponent).join(`/`),u),{method:r,headers:{accept:`application/json`,authorization:a,origin:c.data.origin,...f===void 0?{}:{"content-type":`application/json`}},...f===void 0?{}:{body:f},cache:`no-store`})}catch(e){throw new t.r(e)}return new Response(p.body,{status:p.status,headers:{"cache-control":`no-store`,"content-type":p.headers.get(`content-type`)??`application/json`}})}function o(e,t){return e===`GET`&&t[0]===`v1`&&t[1]===`providers`&&(t.length===2||t.length===3&&t[2]===`health`)?!0:t[0]!==`v1`||t[1]!==`connections`||t[2]===void 0||!n.test(t[2])?!1:e===`GET`?t.length===3:e===`POST`&&t.length===4&&t[3]!==void 0&&r.has(t[3])}function s(e){let n;try{n=new URL(e)}catch(e){throw new t.n(`Domain0 upstreamBaseUrl must be an absolute URL`,e)}if(n.protocol!==`https:`&&!c(n.hostname))throw new t.n(`Domain0 upstreamBaseUrl must use HTTPS outside local development`);if(n.username!==``||n.password!==``||n.search!==``||n.hash!==``)throw new t.n(`Domain0 upstreamBaseUrl must not contain credentials, a query, or a fragment`);return n.pathname=`${n.pathname.replace(/\/$/,``)}/`,n}function c(e){return e===`localhost`||e===`127.0.0.1`||e===`[::1]`}function l(e,t){return Response.json({error:{code:e===401?`unauthorized`:`invalid_request`,message:t}},{status:e,headers:{"cache-control":`no-store`}})}exports.forwardDomain0ConnectionRequest=a;
 //# sourceMappingURL=server.cjs.map

package/dist/server.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"server.cjs","names":["IssueConnectionTokenInputSchema","Domain0ProtocolError","Domain0TransportError"],"sources":["../src/server/connection-proxy.ts"],"sourcesContent":["import { IssueConnectionTokenInputSchema } from '../contracts'\nimport { Domain0ProtocolError, Domain0TransportError } from '../client/error'\n\nconst connectionIdPattern = /^[A-Za-z0-9_-]{1,200}$/\nconst connectionActions = new Set([\n  'cancellation',\n  'change-application',\n  'change-plan',\n  'credential-authorization',\n  'dkim-guidance',\n  'domain-connect-completion',\n  'domain-connect-handoff',\n  'manual-completion',\n  'manual-configuration',\n  'oauth-authorization',\n  'plan-confirmation',\n  'propagation-verification',\n  'provider-detection',\n  'provider-selection',\n  'retry',\n])\nconst maximumBodyBytes = 1_048_576\n\nexport interface ForwardDomain0ConnectionRequestOptions {\n  request: Request\n  /** Catch-all route segments after the same-origin Domain0 bridge. */\n  path: readonly string[]\n  /** Hosted Domain0 platform API root. */\n  upstreamBaseUrl: string\n  /** Exact public origin that received the browser request. */\n  origin?: string\n  fetch?: typeof globalThis.fetch\n}\n\n/**\n * Forwards only the browser-safe connection routes used by Domain0 Connect.\n * Cookies, API keys, and unrelated headers are never forwarded.\n */\nexport async function forwardDomain0ConnectionRequest(\n  options: ForwardDomain0ConnectionRequestOptions,\n): Promise<Response> {\n  const method = options.request.method.toUpperCase()\n  if (!isAllowedPath(method, options.path)) {\n    return jsonError(404, 'This route is not exposed by the connection bridge.')\n  }\n\n  const authorization = options.request.headers.get('authorization')\n  if (\n    authorization === null ||\n    authorization.length > 8200 ||\n    !/^Bearer [A-Za-z0-9._~+\\/-]+=*$/.test(authorization)\n  ) {\n    return jsonError(401, 'A valid connection token is required.')\n  }\n\n  const originResult = IssueConnectionTokenInputSchema.safeParse({\n    origin: options.origin ?? new URL(options.request.url).origin,\n  })\n  if (!originResult.success) {\n    throw new Domain0ProtocolError('The connection bridge origin is invalid', originResult.error)\n  }\n\n  const upstreamBaseUrl = parseBaseUrl(options.upstreamBaseUrl)\n  const fetchImplementation = options.fetch ?? globalThis.fetch\n  if (fetchImplementation === undefined) {\n    throw new Domain0ProtocolError('No fetch implementation is available')\n  }\n\n  let body: ArrayBuffer | undefined\n  if (method === 'POST') {\n    const contentLength = Number(options.request.headers.get('content-length') ?? 0)\n    if (Number.isFinite(contentLength) && contentLength > maximumBodyBytes) {\n      return jsonError(413, 'The request body is too large.')\n    }\n    const bytes = await options.request.arrayBuffer()\n    if (bytes.byteLength > maximumBodyBytes) {\n      return jsonError(413, 'The request body is too large.')\n    }\n    body = bytes\n  }\n\n  let upstream: Response\n  try {\n    upstream = await fetchImplementation(\n      new URL(options.path.map(encodeURIComponent).join('/'), upstreamBaseUrl),\n      {\n        method,\n        headers: {\n          accept: 'application/json',\n          authorization,\n          origin: originResult.data.origin,\n          ...(body === undefined ? {} : { 'content-type': 'application/json' }),\n        },\n        ...(body === undefined ? {} : { body }),\n        cache: 'no-store',\n      },\n    )\n  } catch (cause) {\n    throw new Domain0TransportError(cause)\n  }\n\n  return new Response(upstream.body, {\n    status: upstream.status,\n    headers: {\n      'cache-control': 'no-store',\n      'content-type': upstream.headers.get('content-type') ?? 'application/json',\n    },\n  })\n}\n\nfunction isAllowedPath(method: string, path: readonly string[]): boolean {\n  if (\n    method === 'GET' &&\n    path[0] === 'v1' &&\n    path[1] === 'providers' &&\n    (path.length === 2 || (path.length === 3 && path[2] === 'health'))\n  ) {\n    return true\n  }\n  if (\n    path[0] !== 'v1' ||\n    path[1] !== 'connections' ||\n    path[2] === undefined ||\n    !connectionIdPattern.test(path[2])\n  ) {\n    return false\n  }\n  if (method === 'GET') return path.length === 3\n  return (\n    method === 'POST' &&\n    path.length === 4 &&\n    path[3] !== undefined &&\n    connectionActions.has(path[3])\n  )\n}\n\nfunction parseBaseUrl(value: string): URL {\n  let url: URL\n  try {\n    url = new URL(value)\n  } catch (error) {\n    throw new Domain0ProtocolError('Domain0 upstreamBaseUrl must be an absolute URL', error)\n  }\n  if (url.protocol !== 'https:' && !isLoopback(url.hostname)) {\n    throw new Domain0ProtocolError(\n      'Domain0 upstreamBaseUrl must use HTTPS outside local development',\n    )\n  }\n  if (url.username !== '' || url.password !== '' || url.search !== '' || url.hash !== '') {\n    throw new Domain0ProtocolError(\n      'Domain0 upstreamBaseUrl must not contain credentials, a query, or a fragment',\n    )\n  }\n  url.pathname = `${url.pathname.replace(/\\/$/, '')}/`\n  return url\n}\n\nfunction isLoopback(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'\n}\n\nfunction jsonError(status: number, message: string): Response {\n  return Response.json(\n    { error: { code: status === 401 ? 'unauthorized' : 'invalid_request', message } },\n    { status, headers: { 'cache-control': 'no-store' } },\n  )\n}\n"],"mappings":";;;;AAGA,MAAM,sBAAsB;AAC5B,MAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AACD,MAAM,mBAAmB;;;;;AAiBzB,eAAsB,gCACpB,SACmB;CACnB,MAAM,SAAS,QAAQ,QAAQ,OAAO,YAAY;CAClD,IAAI,CAAC,cAAc,QAAQ,QAAQ,IAAI,GACrC,OAAO,UAAU,KAAK,qDAAqD;CAG7E,MAAM,gBAAgB,QAAQ,QAAQ,QAAQ,IAAI,eAAe;CACjE,IACE,kBAAkB,QAClB,cAAc,SAAS,QACvB,CAAC,iCAAiC,KAAK,aAAa,GAEpD,OAAO,UAAU,KAAK,uCAAuC;CAG/D,MAAM,eAAeA,kBAAAA,gCAAgC,UAAU,EAC7D,QAAQ,QAAQ,UAAU,IAAI,IAAI,QAAQ,QAAQ,GAAG,CAAC,CAAC,OACzD,CAAC;CACD,IAAI,CAAC,aAAa,SAChB,MAAM,IAAIC,cAAAA,qBAAqB,2CAA2C,aAAa,KAAK;CAG9F,MAAM,kBAAkB,aAAa,QAAQ,eAAe;CAC5D,MAAM,sBAAsB,QAAQ,SAAS,WAAW;CACxD,IAAI,wBAAwB,KAAA,GAC1B,MAAM,IAAIA,cAAAA,qBAAqB,sCAAsC;CAGvE,IAAI;CACJ,IAAI,WAAW,QAAQ;EACrB,MAAM,gBAAgB,OAAO,QAAQ,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,CAAC;EAC/E,IAAI,OAAO,SAAS,aAAa,KAAK,gBAAgB,kBACpD,OAAO,UAAU,KAAK,gCAAgC;EAExD,MAAM,QAAQ,MAAM,QAAQ,QAAQ,YAAY;EAChD,IAAI,MAAM,aAAa,kBACrB,OAAO,UAAU,KAAK,gCAAgC;EAExD,OAAO;CACT;CAEA,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,oBACf,IAAI,IAAI,QAAQ,KAAK,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG,GAAG,eAAe,GACvE;GACE;GACA,SAAS;IACP,QAAQ;IACR;IACA,QAAQ,aAAa,KAAK;IAC1B,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;GACrE;GACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;GACrC,OAAO;EACT,CACF;CACF,SAAS,OAAO;EACd,MAAM,IAAIC,cAAAA,sBAAsB,KAAK;CACvC;CAEA,OAAO,IAAI,SAAS,SAAS,MAAM;EACjC,QAAQ,SAAS;EACjB,SAAS;GACP,iBAAiB;GACjB,gBAAgB,SAAS,QAAQ,IAAI,cAAc,KAAK;EAC1D;CACF,CAAC;AACH;AAEA,SAAS,cAAc,QAAgB,MAAkC;CACvE,IACE,WAAW,SACX,KAAK,OAAO,QACZ,KAAK,OAAO,gBACX,KAAK,WAAW,KAAM,KAAK,WAAW,KAAK,KAAK,OAAO,WAExD,OAAO;CAET,IACE,KAAK,OAAO,QACZ,KAAK,OAAO,iBACZ,KAAK,OAAO,KAAA,KACZ,CAAC,oBAAoB,KAAK,KAAK,EAAE,GAEjC,OAAO;CAET,IAAI,WAAW,OAAO,OAAO,KAAK,WAAW;CAC7C,OACE,WAAW,UACX,KAAK,WAAW,KAChB,KAAK,OAAO,KAAA,KACZ,kBAAkB,IAAI,KAAK,EAAE;AAEjC;AAEA,SAAS,aAAa,OAAoB;CACxC,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,SAAS,OAAO;EACd,MAAM,IAAID,cAAAA,qBAAqB,mDAAmD,KAAK;CACzF;CACA,IAAI,IAAI,aAAa,YAAY,CAAC,WAAW,IAAI,QAAQ,GACvD,MAAM,IAAIA,cAAAA,qBACR,kEACF;CAEF,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,MAAM,IAAI,WAAW,MAAM,IAAI,SAAS,IAClF,MAAM,IAAIA,cAAAA,qBACR,8EACF;CAEF,IAAI,WAAW,GAAG,IAAI,SAAS,QAAQ,OAAO,EAAE,EAAE;CAClD,OAAO;AACT;AAEA,SAAS,WAAW,UAA2B;CAC7C,OAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAC9E;AAEA,SAAS,UAAU,QAAgB,SAA2B;CAC5D,OAAO,SAAS,KACd,EAAE,OAAO;EAAE,MAAM,WAAW,MAAM,iBAAiB;EAAmB;CAAQ,EAAE,GAChF;EAAE;EAAQ,SAAS,EAAE,iBAAiB,WAAW;CAAE,CACrD;AACF"}
+{"version":3,"file":"server.cjs","names":["IssueConnectionTokenInputSchema","Domain0ProtocolError","Domain0TransportError"],"sources":["../src/server/connection-proxy.ts"],"sourcesContent":["import { IssueConnectionTokenInputSchema } from '../contracts'\nimport { Domain0ProtocolError, Domain0TransportError } from '../client/error'\n\nconst connectionIdPattern = /^[A-Za-z0-9_-]{1,200}$/\nconst connectionActions = new Set([\n  'cancellation',\n  'change-application',\n  'change-plan',\n  'credential-authorization',\n  'dkim-guidance',\n  'domain-connect-completion',\n  'domain-connect-handoff',\n  'manual-completion',\n  'manual-configuration',\n  'oauth-authorization',\n  'plan-confirmation',\n  'propagation-verification',\n  'provider-detection',\n  'provider-selection',\n  'retry',\n])\nconst maximumBodyBytes = 1_048_576\n\nexport interface ForwardDomain0ConnectionRequestOptions {\n  request: Request\n  /** Catch-all route segments after the same-origin Domain0 bridge. */\n  path: readonly string[]\n  /** Hosted Domain0 platform API root. */\n  upstreamBaseUrl: string\n  /** Exact public origin that received the browser request. */\n  origin?: string\n  fetch?: typeof globalThis.fetch\n}\n\n/**\n * Forwards only the browser-safe connection routes used by Domain0 Connect.\n * Cookies, API keys, and unrelated headers are never forwarded.\n */\nexport async function forwardDomain0ConnectionRequest(\n  options: ForwardDomain0ConnectionRequestOptions,\n): Promise<Response> {\n  const method = options.request.method.toUpperCase()\n  if (!isAllowedPath(method, options.path)) {\n    return jsonError(404, 'This route is not exposed by the connection bridge.')\n  }\n\n  const authorization = options.request.headers.get('authorization')\n  if (\n    authorization === null ||\n    authorization.length > 8200 ||\n    !/^Bearer [A-Za-z0-9._~+\\/-]+=*$/.test(authorization)\n  ) {\n    return jsonError(401, 'A valid connection token is required.')\n  }\n\n  const originResult = IssueConnectionTokenInputSchema.safeParse({\n    origin: options.origin ?? new URL(options.request.url).origin,\n  })\n  if (!originResult.success) {\n    throw new Domain0ProtocolError('The connection bridge origin is invalid', originResult.error)\n  }\n\n  const upstreamBaseUrl = parseBaseUrl(options.upstreamBaseUrl)\n  const fetchImplementation = options.fetch ?? globalThis.fetch\n  if (fetchImplementation === undefined) {\n    throw new Domain0ProtocolError('No fetch implementation is available')\n  }\n\n  let body: ArrayBuffer | undefined\n  if (method === 'POST') {\n    const contentLength = Number(options.request.headers.get('content-length') ?? 0)\n    if (Number.isFinite(contentLength) && contentLength > maximumBodyBytes) {\n      return jsonError(413, 'The request body is too large.')\n    }\n    const bytes = await options.request.arrayBuffer()\n    if (bytes.byteLength > maximumBodyBytes) {\n      return jsonError(413, 'The request body is too large.')\n    }\n    body = bytes\n  }\n\n  let upstream: Response\n  try {\n    upstream = await fetchImplementation(\n      new URL(options.path.map(encodeURIComponent).join('/'), upstreamBaseUrl),\n      {\n        method,\n        headers: {\n          accept: 'application/json',\n          authorization,\n          origin: originResult.data.origin,\n          ...(body === undefined ? {} : { 'content-type': 'application/json' }),\n        },\n        ...(body === undefined ? {} : { body }),\n        cache: 'no-store',\n      },\n    )\n  } catch (cause) {\n    throw new Domain0TransportError(cause)\n  }\n\n  return new Response(upstream.body, {\n    status: upstream.status,\n    headers: {\n      'cache-control': 'no-store',\n      'content-type': upstream.headers.get('content-type') ?? 'application/json',\n    },\n  })\n}\n\nfunction isAllowedPath(method: string, path: readonly string[]): boolean {\n  if (\n    method === 'GET' &&\n    path[0] === 'v1' &&\n    path[1] === 'providers' &&\n    (path.length === 2 || (path.length === 3 && path[2] === 'health'))\n  ) {\n    return true\n  }\n  if (\n    path[0] !== 'v1' ||\n    path[1] !== 'connections' ||\n    path[2] === undefined ||\n    !connectionIdPattern.test(path[2])\n  ) {\n    return false\n  }\n  if (method === 'GET') return path.length === 3\n  return (\n    method === 'POST' &&\n    path.length === 4 &&\n    path[3] !== undefined &&\n    connectionActions.has(path[3])\n  )\n}\n\nfunction parseBaseUrl(value: string): URL {\n  let url: URL\n  try {\n    url = new URL(value)\n  } catch (error) {\n    throw new Domain0ProtocolError('Domain0 upstreamBaseUrl must be an absolute URL', error)\n  }\n  if (url.protocol !== 'https:' && !isLoopback(url.hostname)) {\n    throw new Domain0ProtocolError(\n      'Domain0 upstreamBaseUrl must use HTTPS outside local development',\n    )\n  }\n  if (url.username !== '' || url.password !== '' || url.search !== '' || url.hash !== '') {\n    throw new Domain0ProtocolError(\n      'Domain0 upstreamBaseUrl must not contain credentials, a query, or a fragment',\n    )\n  }\n  url.pathname = `${url.pathname.replace(/\\/$/, '')}/`\n  return url\n}\n\nfunction isLoopback(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'\n}\n\nfunction jsonError(status: number, message: string): Response {\n  return Response.json(\n    { error: { code: status === 401 ? 'unauthorized' : 'invalid_request', message } },\n    { status, headers: { 'cache-control': 'no-store' } },\n  )\n}\n"],"mappings":"wIAGM,EAAsB,yBACtB,EAAoB,IAAI,IAAI,CAChC,eACA,qBACA,cACA,2BACA,gBACA,4BACA,yBACA,oBACA,uBACA,sBACA,oBACA,2BACA,qBACA,qBACA,OACF,CAAC,EACK,EAAmB,QAiBzB,eAAsB,EACpB,EACmB,CACnB,IAAM,EAAS,EAAQ,QAAQ,OAAO,YAAY,EAClD,GAAI,CAAC,EAAc,EAAQ,EAAQ,IAAI,EACrC,OAAO,EAAU,IAAK,qDAAqD,EAG7E,IAAM,EAAgB,EAAQ,QAAQ,QAAQ,IAAI,eAAe,EACjE,GACE,IAAkB,MAClB,EAAc,OAAS,MACvB,CAAC,iCAAiC,KAAK,CAAa,EAEpD,OAAO,EAAU,IAAK,uCAAuC,EAG/D,IAAM,EAAeA,EAAAA,gCAAgC,UAAU,CAC7D,OAAQ,EAAQ,QAAU,IAAI,IAAI,EAAQ,QAAQ,GAAG,CAAC,CAAC,MACzD,CAAC,EACD,GAAI,CAAC,EAAa,QAChB,MAAM,IAAIC,EAAAA,EAAqB,0CAA2C,EAAa,KAAK,EAG9F,IAAM,EAAkB,EAAa,EAAQ,eAAe,EACtD,EAAsB,EAAQ,OAAS,WAAW,MACxD,GAAI,IAAwB,IAAA,GAC1B,MAAM,IAAIA,EAAAA,EAAqB,sCAAsC,EAGvE,IAAI,EACJ,GAAI,IAAW,OAAQ,CACrB,IAAM,EAAgB,OAAO,EAAQ,QAAQ,QAAQ,IAAI,gBAAgB,GAAK,CAAC,EAC/E,GAAI,OAAO,SAAS,CAAa,GAAK,EAAgB,EACpD,OAAO,EAAU,IAAK,gCAAgC,EAExD,IAAM,EAAQ,MAAM,EAAQ,QAAQ,YAAY,EAChD,GAAI,EAAM,WAAa,EACrB,OAAO,EAAU,IAAK,gCAAgC,EAExD,EAAO,CACT,CAEA,IAAI,EACJ,GAAI,CACF,EAAW,MAAM,EACf,IAAI,IAAI,EAAQ,KAAK,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG,EAAG,CAAe,EACvE,CACE,SACA,QAAS,CACP,OAAQ,mBACR,gBACA,OAAQ,EAAa,KAAK,OAC1B,GAAI,IAAS,IAAA,GAAY,CAAC,EAAI,CAAE,eAAgB,kBAAmB,CACrE,EACA,GAAI,IAAS,IAAA,GAAY,CAAC,EAAI,CAAE,MAAK,EACrC,MAAO,UACT,CACF,CACF,OAAS,EAAO,CACd,MAAM,IAAIC,EAAAA,EAAsB,CAAK,CACvC,CAEA,OAAO,IAAI,SAAS,EAAS,KAAM,CACjC,OAAQ,EAAS,OACjB,QAAS,CACP,gBAAiB,WACjB,eAAgB,EAAS,QAAQ,IAAI,cAAc,GAAK,kBAC1D,CACF,CAAC,CACH,CAEA,SAAS,EAAc,EAAgB,EAAkC,CAkBvE,OAhBE,IAAW,OACX,EAAK,KAAO,MACZ,EAAK,KAAO,cACX,EAAK,SAAW,GAAM,EAAK,SAAW,GAAK,EAAK,KAAO,UAEjD,GAGP,EAAK,KAAO,MACZ,EAAK,KAAO,eACZ,EAAK,KAAO,IAAA,IACZ,CAAC,EAAoB,KAAK,EAAK,EAAE,EAE1B,GAEL,IAAW,MAAc,EAAK,SAAW,EAE3C,IAAW,QACX,EAAK,SAAW,GAChB,EAAK,KAAO,IAAA,IACZ,EAAkB,IAAI,EAAK,EAAE,CAEjC,CAEA,SAAS,EAAa,EAAoB,CACxC,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,OAAS,EAAO,CACd,MAAM,IAAID,EAAAA,EAAqB,kDAAmD,CAAK,CACzF,CACA,GAAI,EAAI,WAAa,UAAY,CAAC,EAAW,EAAI,QAAQ,EACvD,MAAM,IAAIA,EAAAA,EACR,kEACF,EAEF,GAAI,EAAI,WAAa,IAAM,EAAI,WAAa,IAAM,EAAI,SAAW,IAAM,EAAI,OAAS,GAClF,MAAM,IAAIA,EAAAA,EACR,8EACF,EAGF,MADA,GAAI,SAAW,GAAG,EAAI,SAAS,QAAQ,MAAO,EAAE,EAAE,GAC3C,CACT,CAEA,SAAS,EAAW,EAA2B,CAC7C,OAAO,IAAa,aAAe,IAAa,aAAe,IAAa,OAC9E,CAEA,SAAS,EAAU,EAAgB,EAA2B,CAC5D,OAAO,SAAS,KACd,CAAE,MAAO,CAAE,KAAM,IAAW,IAAM,eAAiB,kBAAmB,SAAQ,CAAE,EAChF,CAAE,SAAQ,QAAS,CAAE,gBAAiB,UAAW,CAAE,CACrD,CACF"}

package/dist/server.mjs

@@ -1,102 +1,2 @@
-import { IssueConnectionTokenInputSchema } from "./contracts.mjs";
-import { n as Domain0ProtocolError, r as Domain0TransportError } from "./error-Cyd6a9ay.mjs";
-//#region src/server/connection-proxy.ts
-const connectionIdPattern = /^[A-Za-z0-9_-]{1,200}$/;
-const connectionActions = /* @__PURE__ */ new Set([
-	"cancellation",
-	"change-application",
-	"change-plan",
-	"credential-authorization",
-	"dkim-guidance",
-	"domain-connect-completion",
-	"domain-connect-handoff",
-	"manual-completion",
-	"manual-configuration",
-	"oauth-authorization",
-	"plan-confirmation",
-	"propagation-verification",
-	"provider-detection",
-	"provider-selection",
-	"retry"
-]);
-const maximumBodyBytes = 1048576;
-/**
-* Forwards only the browser-safe connection routes used by Domain0 Connect.
-* Cookies, API keys, and unrelated headers are never forwarded.
-*/
-async function forwardDomain0ConnectionRequest(options) {
-	const method = options.request.method.toUpperCase();
-	if (!isAllowedPath(method, options.path)) return jsonError(404, "This route is not exposed by the connection bridge.");
-	const authorization = options.request.headers.get("authorization");
-	if (authorization === null || authorization.length > 8200 || !/^Bearer [A-Za-z0-9._~+\/-]+=*$/.test(authorization)) return jsonError(401, "A valid connection token is required.");
-	const originResult = IssueConnectionTokenInputSchema.safeParse({ origin: options.origin ?? new URL(options.request.url).origin });
-	if (!originResult.success) throw new Domain0ProtocolError("The connection bridge origin is invalid", originResult.error);
-	const upstreamBaseUrl = parseBaseUrl(options.upstreamBaseUrl);
-	const fetchImplementation = options.fetch ?? globalThis.fetch;
-	if (fetchImplementation === void 0) throw new Domain0ProtocolError("No fetch implementation is available");
-	let body;
-	if (method === "POST") {
-		const contentLength = Number(options.request.headers.get("content-length") ?? 0);
-		if (Number.isFinite(contentLength) && contentLength > maximumBodyBytes) return jsonError(413, "The request body is too large.");
-		const bytes = await options.request.arrayBuffer();
-		if (bytes.byteLength > maximumBodyBytes) return jsonError(413, "The request body is too large.");
-		body = bytes;
-	}
-	let upstream;
-	try {
-		upstream = await fetchImplementation(new URL(options.path.map(encodeURIComponent).join("/"), upstreamBaseUrl), {
-			method,
-			headers: {
-				accept: "application/json",
-				authorization,
-				origin: originResult.data.origin,
-				...body === void 0 ? {} : { "content-type": "application/json" }
-			},
-			...body === void 0 ? {} : { body },
-			cache: "no-store"
-		});
-	} catch (cause) {
-		throw new Domain0TransportError(cause);
-	}
-	return new Response(upstream.body, {
-		status: upstream.status,
-		headers: {
-			"cache-control": "no-store",
-			"content-type": upstream.headers.get("content-type") ?? "application/json"
-		}
-	});
-}
-function isAllowedPath(method, path) {
-	if (method === "GET" && path[0] === "v1" && path[1] === "providers" && (path.length === 2 || path.length === 3 && path[2] === "health")) return true;
-	if (path[0] !== "v1" || path[1] !== "connections" || path[2] === void 0 || !connectionIdPattern.test(path[2])) return false;
-	if (method === "GET") return path.length === 3;
-	return method === "POST" && path.length === 4 && path[3] !== void 0 && connectionActions.has(path[3]);
-}
-function parseBaseUrl(value) {
-	let url;
-	try {
-		url = new URL(value);
-	} catch (error) {
-		throw new Domain0ProtocolError("Domain0 upstreamBaseUrl must be an absolute URL", error);
-	}
-	if (url.protocol !== "https:" && !isLoopback(url.hostname)) throw new Domain0ProtocolError("Domain0 upstreamBaseUrl must use HTTPS outside local development");
-	if (url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") throw new Domain0ProtocolError("Domain0 upstreamBaseUrl must not contain credentials, a query, or a fragment");
-	url.pathname = `${url.pathname.replace(/\/$/, "")}/`;
-	return url;
-}
-function isLoopback(hostname) {
-	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
-}
-function jsonError(status, message) {
-	return Response.json({ error: {
-		code: status === 401 ? "unauthorized" : "invalid_request",
-		message
-	} }, {
-		status,
-		headers: { "cache-control": "no-store" }
-	});
-}
-//#endregion
-export { forwardDomain0ConnectionRequest };
-
+import{IssueConnectionTokenInputSchema as e}from"./contracts.mjs";import{n as t,r as n}from"./error-szz6-UFL.mjs";const r=/^[A-Za-z0-9_-]{1,200}$/,i=new Set([`cancellation`,`change-application`,`change-plan`,`credential-authorization`,`dkim-guidance`,`domain-connect-completion`,`domain-connect-handoff`,`manual-completion`,`manual-configuration`,`oauth-authorization`,`plan-confirmation`,`propagation-verification`,`provider-detection`,`provider-selection`,`retry`]),a=1048576;async function o(r){let i=r.request.method.toUpperCase();if(!s(i,r.path))return u(404,`This route is not exposed by the connection bridge.`);let o=r.request.headers.get(`authorization`);if(o===null||o.length>8200||!/^Bearer [A-Za-z0-9._~+\/-]+=*$/.test(o))return u(401,`A valid connection token is required.`);let l=e.safeParse({origin:r.origin??new URL(r.request.url).origin});if(!l.success)throw new t(`The connection bridge origin is invalid`,l.error);let d=c(r.upstreamBaseUrl),f=r.fetch??globalThis.fetch;if(f===void 0)throw new t(`No fetch implementation is available`);let p;if(i===`POST`){let e=Number(r.request.headers.get(`content-length`)??0);if(Number.isFinite(e)&&e>a)return u(413,`The request body is too large.`);let t=await r.request.arrayBuffer();if(t.byteLength>a)return u(413,`The request body is too large.`);p=t}let m;try{m=await f(new URL(r.path.map(encodeURIComponent).join(`/`),d),{method:i,headers:{accept:`application/json`,authorization:o,origin:l.data.origin,...p===void 0?{}:{"content-type":`application/json`}},...p===void 0?{}:{body:p},cache:`no-store`})}catch(e){throw new n(e)}return new Response(m.body,{status:m.status,headers:{"cache-control":`no-store`,"content-type":m.headers.get(`content-type`)??`application/json`}})}function s(e,t){return e===`GET`&&t[0]===`v1`&&t[1]===`providers`&&(t.length===2||t.length===3&&t[2]===`health`)?!0:t[0]!==`v1`||t[1]!==`connections`||t[2]===void 0||!r.test(t[2])?!1:e===`GET`?t.length===3:e===`POST`&&t.length===4&&t[3]!==void 0&&i.has(t[3])}function c(e){let n;try{n=new URL(e)}catch(e){throw new t(`Domain0 upstreamBaseUrl must be an absolute URL`,e)}if(n.protocol!==`https:`&&!l(n.hostname))throw new t(`Domain0 upstreamBaseUrl must use HTTPS outside local development`);if(n.username!==``||n.password!==``||n.search!==``||n.hash!==``)throw new t(`Domain0 upstreamBaseUrl must not contain credentials, a query, or a fragment`);return n.pathname=`${n.pathname.replace(/\/$/,``)}/`,n}function l(e){return e===`localhost`||e===`127.0.0.1`||e===`[::1]`}function u(e,t){return Response.json({error:{code:e===401?`unauthorized`:`invalid_request`,message:t}},{status:e,headers:{"cache-control":`no-store`}})}export{o as forwardDomain0ConnectionRequest};
 //# sourceMappingURL=server.mjs.map

package/dist/server.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"server.mjs","names":[],"sources":["../src/server/connection-proxy.ts"],"sourcesContent":["import { IssueConnectionTokenInputSchema } from '../contracts'\nimport { Domain0ProtocolError, Domain0TransportError } from '../client/error'\n\nconst connectionIdPattern = /^[A-Za-z0-9_-]{1,200}$/\nconst connectionActions = new Set([\n  'cancellation',\n  'change-application',\n  'change-plan',\n  'credential-authorization',\n  'dkim-guidance',\n  'domain-connect-completion',\n  'domain-connect-handoff',\n  'manual-completion',\n  'manual-configuration',\n  'oauth-authorization',\n  'plan-confirmation',\n  'propagation-verification',\n  'provider-detection',\n  'provider-selection',\n  'retry',\n])\nconst maximumBodyBytes = 1_048_576\n\nexport interface ForwardDomain0ConnectionRequestOptions {\n  request: Request\n  /** Catch-all route segments after the same-origin Domain0 bridge. */\n  path: readonly string[]\n  /** Hosted Domain0 platform API root. */\n  upstreamBaseUrl: string\n  /** Exact public origin that received the browser request. */\n  origin?: string\n  fetch?: typeof globalThis.fetch\n}\n\n/**\n * Forwards only the browser-safe connection routes used by Domain0 Connect.\n * Cookies, API keys, and unrelated headers are never forwarded.\n */\nexport async function forwardDomain0ConnectionRequest(\n  options: ForwardDomain0ConnectionRequestOptions,\n): Promise<Response> {\n  const method = options.request.method.toUpperCase()\n  if (!isAllowedPath(method, options.path)) {\n    return jsonError(404, 'This route is not exposed by the connection bridge.')\n  }\n\n  const authorization = options.request.headers.get('authorization')\n  if (\n    authorization === null ||\n    authorization.length > 8200 ||\n    !/^Bearer [A-Za-z0-9._~+\\/-]+=*$/.test(authorization)\n  ) {\n    return jsonError(401, 'A valid connection token is required.')\n  }\n\n  const originResult = IssueConnectionTokenInputSchema.safeParse({\n    origin: options.origin ?? new URL(options.request.url).origin,\n  })\n  if (!originResult.success) {\n    throw new Domain0ProtocolError('The connection bridge origin is invalid', originResult.error)\n  }\n\n  const upstreamBaseUrl = parseBaseUrl(options.upstreamBaseUrl)\n  const fetchImplementation = options.fetch ?? globalThis.fetch\n  if (fetchImplementation === undefined) {\n    throw new Domain0ProtocolError('No fetch implementation is available')\n  }\n\n  let body: ArrayBuffer | undefined\n  if (method === 'POST') {\n    const contentLength = Number(options.request.headers.get('content-length') ?? 0)\n    if (Number.isFinite(contentLength) && contentLength > maximumBodyBytes) {\n      return jsonError(413, 'The request body is too large.')\n    }\n    const bytes = await options.request.arrayBuffer()\n    if (bytes.byteLength > maximumBodyBytes) {\n      return jsonError(413, 'The request body is too large.')\n    }\n    body = bytes\n  }\n\n  let upstream: Response\n  try {\n    upstream = await fetchImplementation(\n      new URL(options.path.map(encodeURIComponent).join('/'), upstreamBaseUrl),\n      {\n        method,\n        headers: {\n          accept: 'application/json',\n          authorization,\n          origin: originResult.data.origin,\n          ...(body === undefined ? {} : { 'content-type': 'application/json' }),\n        },\n        ...(body === undefined ? {} : { body }),\n        cache: 'no-store',\n      },\n    )\n  } catch (cause) {\n    throw new Domain0TransportError(cause)\n  }\n\n  return new Response(upstream.body, {\n    status: upstream.status,\n    headers: {\n      'cache-control': 'no-store',\n      'content-type': upstream.headers.get('content-type') ?? 'application/json',\n    },\n  })\n}\n\nfunction isAllowedPath(method: string, path: readonly string[]): boolean {\n  if (\n    method === 'GET' &&\n    path[0] === 'v1' &&\n    path[1] === 'providers' &&\n    (path.length === 2 || (path.length === 3 && path[2] === 'health'))\n  ) {\n    return true\n  }\n  if (\n    path[0] !== 'v1' ||\n    path[1] !== 'connections' ||\n    path[2] === undefined ||\n    !connectionIdPattern.test(path[2])\n  ) {\n    return false\n  }\n  if (method === 'GET') return path.length === 3\n  return (\n    method === 'POST' &&\n    path.length === 4 &&\n    path[3] !== undefined &&\n    connectionActions.has(path[3])\n  )\n}\n\nfunction parseBaseUrl(value: string): URL {\n  let url: URL\n  try {\n    url = new URL(value)\n  } catch (error) {\n    throw new Domain0ProtocolError('Domain0 upstreamBaseUrl must be an absolute URL', error)\n  }\n  if (url.protocol !== 'https:' && !isLoopback(url.hostname)) {\n    throw new Domain0ProtocolError(\n      'Domain0 upstreamBaseUrl must use HTTPS outside local development',\n    )\n  }\n  if (url.username !== '' || url.password !== '' || url.search !== '' || url.hash !== '') {\n    throw new Domain0ProtocolError(\n      'Domain0 upstreamBaseUrl must not contain credentials, a query, or a fragment',\n    )\n  }\n  url.pathname = `${url.pathname.replace(/\\/$/, '')}/`\n  return url\n}\n\nfunction isLoopback(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'\n}\n\nfunction jsonError(status: number, message: string): Response {\n  return Response.json(\n    { error: { code: status === 401 ? 'unauthorized' : 'invalid_request', message } },\n    { status, headers: { 'cache-control': 'no-store' } },\n  )\n}\n"],"mappings":";;;AAGA,MAAM,sBAAsB;AAC5B,MAAM,oCAAoB,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AACD,MAAM,mBAAmB;;;;;AAiBzB,eAAsB,gCACpB,SACmB;CACnB,MAAM,SAAS,QAAQ,QAAQ,OAAO,YAAY;CAClD,IAAI,CAAC,cAAc,QAAQ,QAAQ,IAAI,GACrC,OAAO,UAAU,KAAK,qDAAqD;CAG7E,MAAM,gBAAgB,QAAQ,QAAQ,QAAQ,IAAI,eAAe;CACjE,IACE,kBAAkB,QAClB,cAAc,SAAS,QACvB,CAAC,iCAAiC,KAAK,aAAa,GAEpD,OAAO,UAAU,KAAK,uCAAuC;CAG/D,MAAM,eAAe,gCAAgC,UAAU,EAC7D,QAAQ,QAAQ,UAAU,IAAI,IAAI,QAAQ,QAAQ,GAAG,CAAC,CAAC,OACzD,CAAC;CACD,IAAI,CAAC,aAAa,SAChB,MAAM,IAAI,qBAAqB,2CAA2C,aAAa,KAAK;CAG9F,MAAM,kBAAkB,aAAa,QAAQ,eAAe;CAC5D,MAAM,sBAAsB,QAAQ,SAAS,WAAW;CACxD,IAAI,wBAAwB,KAAA,GAC1B,MAAM,IAAI,qBAAqB,sCAAsC;CAGvE,IAAI;CACJ,IAAI,WAAW,QAAQ;EACrB,MAAM,gBAAgB,OAAO,QAAQ,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,CAAC;EAC/E,IAAI,OAAO,SAAS,aAAa,KAAK,gBAAgB,kBACpD,OAAO,UAAU,KAAK,gCAAgC;EAExD,MAAM,QAAQ,MAAM,QAAQ,QAAQ,YAAY;EAChD,IAAI,MAAM,aAAa,kBACrB,OAAO,UAAU,KAAK,gCAAgC;EAExD,OAAO;CACT;CAEA,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,oBACf,IAAI,IAAI,QAAQ,KAAK,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG,GAAG,eAAe,GACvE;GACE;GACA,SAAS;IACP,QAAQ;IACR;IACA,QAAQ,aAAa,KAAK;IAC1B,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;GACrE;GACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;GACrC,OAAO;EACT,CACF;CACF,SAAS,OAAO;EACd,MAAM,IAAI,sBAAsB,KAAK;CACvC;CAEA,OAAO,IAAI,SAAS,SAAS,MAAM;EACjC,QAAQ,SAAS;EACjB,SAAS;GACP,iBAAiB;GACjB,gBAAgB,SAAS,QAAQ,IAAI,cAAc,KAAK;EAC1D;CACF,CAAC;AACH;AAEA,SAAS,cAAc,QAAgB,MAAkC;CACvE,IACE,WAAW,SACX,KAAK,OAAO,QACZ,KAAK,OAAO,gBACX,KAAK,WAAW,KAAM,KAAK,WAAW,KAAK,KAAK,OAAO,WAExD,OAAO;CAET,IACE,KAAK,OAAO,QACZ,KAAK,OAAO,iBACZ,KAAK,OAAO,KAAA,KACZ,CAAC,oBAAoB,KAAK,KAAK,EAAE,GAEjC,OAAO;CAET,IAAI,WAAW,OAAO,OAAO,KAAK,WAAW;CAC7C,OACE,WAAW,UACX,KAAK,WAAW,KAChB,KAAK,OAAO,KAAA,KACZ,kBAAkB,IAAI,KAAK,EAAE;AAEjC;AAEA,SAAS,aAAa,OAAoB;CACxC,IAAI;CACJ,IAAI;EACF,MAAM,IAAI,IAAI,KAAK;CACrB,SAAS,OAAO;EACd,MAAM,IAAI,qBAAqB,mDAAmD,KAAK;CACzF;CACA,IAAI,IAAI,aAAa,YAAY,CAAC,WAAW,IAAI,QAAQ,GACvD,MAAM,IAAI,qBACR,kEACF;CAEF,IAAI,IAAI,aAAa,MAAM,IAAI,aAAa,MAAM,IAAI,WAAW,MAAM,IAAI,SAAS,IAClF,MAAM,IAAI,qBACR,8EACF;CAEF,IAAI,WAAW,GAAG,IAAI,SAAS,QAAQ,OAAO,EAAE,EAAE;CAClD,OAAO;AACT;AAEA,SAAS,WAAW,UAA2B;CAC7C,OAAO,aAAa,eAAe,aAAa,eAAe,aAAa;AAC9E;AAEA,SAAS,UAAU,QAAgB,SAA2B;CAC5D,OAAO,SAAS,KACd,EAAE,OAAO;EAAE,MAAM,WAAW,MAAM,iBAAiB;EAAmB;CAAQ,EAAE,GAChF;EAAE;EAAQ,SAAS,EAAE,iBAAiB,WAAW;CAAE,CACrD;AACF"}
+{"version":3,"file":"server.mjs","names":[],"sources":["../src/server/connection-proxy.ts"],"sourcesContent":["import { IssueConnectionTokenInputSchema } from '../contracts'\nimport { Domain0ProtocolError, Domain0TransportError } from '../client/error'\n\nconst connectionIdPattern = /^[A-Za-z0-9_-]{1,200}$/\nconst connectionActions = new Set([\n  'cancellation',\n  'change-application',\n  'change-plan',\n  'credential-authorization',\n  'dkim-guidance',\n  'domain-connect-completion',\n  'domain-connect-handoff',\n  'manual-completion',\n  'manual-configuration',\n  'oauth-authorization',\n  'plan-confirmation',\n  'propagation-verification',\n  'provider-detection',\n  'provider-selection',\n  'retry',\n])\nconst maximumBodyBytes = 1_048_576\n\nexport interface ForwardDomain0ConnectionRequestOptions {\n  request: Request\n  /** Catch-all route segments after the same-origin Domain0 bridge. */\n  path: readonly string[]\n  /** Hosted Domain0 platform API root. */\n  upstreamBaseUrl: string\n  /** Exact public origin that received the browser request. */\n  origin?: string\n  fetch?: typeof globalThis.fetch\n}\n\n/**\n * Forwards only the browser-safe connection routes used by Domain0 Connect.\n * Cookies, API keys, and unrelated headers are never forwarded.\n */\nexport async function forwardDomain0ConnectionRequest(\n  options: ForwardDomain0ConnectionRequestOptions,\n): Promise<Response> {\n  const method = options.request.method.toUpperCase()\n  if (!isAllowedPath(method, options.path)) {\n    return jsonError(404, 'This route is not exposed by the connection bridge.')\n  }\n\n  const authorization = options.request.headers.get('authorization')\n  if (\n    authorization === null ||\n    authorization.length > 8200 ||\n    !/^Bearer [A-Za-z0-9._~+\\/-]+=*$/.test(authorization)\n  ) {\n    return jsonError(401, 'A valid connection token is required.')\n  }\n\n  const originResult = IssueConnectionTokenInputSchema.safeParse({\n    origin: options.origin ?? new URL(options.request.url).origin,\n  })\n  if (!originResult.success) {\n    throw new Domain0ProtocolError('The connection bridge origin is invalid', originResult.error)\n  }\n\n  const upstreamBaseUrl = parseBaseUrl(options.upstreamBaseUrl)\n  const fetchImplementation = options.fetch ?? globalThis.fetch\n  if (fetchImplementation === undefined) {\n    throw new Domain0ProtocolError('No fetch implementation is available')\n  }\n\n  let body: ArrayBuffer | undefined\n  if (method === 'POST') {\n    const contentLength = Number(options.request.headers.get('content-length') ?? 0)\n    if (Number.isFinite(contentLength) && contentLength > maximumBodyBytes) {\n      return jsonError(413, 'The request body is too large.')\n    }\n    const bytes = await options.request.arrayBuffer()\n    if (bytes.byteLength > maximumBodyBytes) {\n      return jsonError(413, 'The request body is too large.')\n    }\n    body = bytes\n  }\n\n  let upstream: Response\n  try {\n    upstream = await fetchImplementation(\n      new URL(options.path.map(encodeURIComponent).join('/'), upstreamBaseUrl),\n      {\n        method,\n        headers: {\n          accept: 'application/json',\n          authorization,\n          origin: originResult.data.origin,\n          ...(body === undefined ? {} : { 'content-type': 'application/json' }),\n        },\n        ...(body === undefined ? {} : { body }),\n        cache: 'no-store',\n      },\n    )\n  } catch (cause) {\n    throw new Domain0TransportError(cause)\n  }\n\n  return new Response(upstream.body, {\n    status: upstream.status,\n    headers: {\n      'cache-control': 'no-store',\n      'content-type': upstream.headers.get('content-type') ?? 'application/json',\n    },\n  })\n}\n\nfunction isAllowedPath(method: string, path: readonly string[]): boolean {\n  if (\n    method === 'GET' &&\n    path[0] === 'v1' &&\n    path[1] === 'providers' &&\n    (path.length === 2 || (path.length === 3 && path[2] === 'health'))\n  ) {\n    return true\n  }\n  if (\n    path[0] !== 'v1' ||\n    path[1] !== 'connections' ||\n    path[2] === undefined ||\n    !connectionIdPattern.test(path[2])\n  ) {\n    return false\n  }\n  if (method === 'GET') return path.length === 3\n  return (\n    method === 'POST' &&\n    path.length === 4 &&\n    path[3] !== undefined &&\n    connectionActions.has(path[3])\n  )\n}\n\nfunction parseBaseUrl(value: string): URL {\n  let url: URL\n  try {\n    url = new URL(value)\n  } catch (error) {\n    throw new Domain0ProtocolError('Domain0 upstreamBaseUrl must be an absolute URL', error)\n  }\n  if (url.protocol !== 'https:' && !isLoopback(url.hostname)) {\n    throw new Domain0ProtocolError(\n      'Domain0 upstreamBaseUrl must use HTTPS outside local development',\n    )\n  }\n  if (url.username !== '' || url.password !== '' || url.search !== '' || url.hash !== '') {\n    throw new Domain0ProtocolError(\n      'Domain0 upstreamBaseUrl must not contain credentials, a query, or a fragment',\n    )\n  }\n  url.pathname = `${url.pathname.replace(/\\/$/, '')}/`\n  return url\n}\n\nfunction isLoopback(hostname: string): boolean {\n  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]'\n}\n\nfunction jsonError(status: number, message: string): Response {\n  return Response.json(\n    { error: { code: status === 401 ? 'unauthorized' : 'invalid_request', message } },\n    { status, headers: { 'cache-control': 'no-store' } },\n  )\n}\n"],"mappings":"kHAGA,MAAM,EAAsB,yBACtB,EAAoB,IAAI,IAAI,CAChC,eACA,qBACA,cACA,2BACA,gBACA,4BACA,yBACA,oBACA,uBACA,sBACA,oBACA,2BACA,qBACA,qBACA,OACF,CAAC,EACK,EAAmB,QAiBzB,eAAsB,EACpB,EACmB,CACnB,IAAM,EAAS,EAAQ,QAAQ,OAAO,YAAY,EAClD,GAAI,CAAC,EAAc,EAAQ,EAAQ,IAAI,EACrC,OAAO,EAAU,IAAK,qDAAqD,EAG7E,IAAM,EAAgB,EAAQ,QAAQ,QAAQ,IAAI,eAAe,EACjE,GACE,IAAkB,MAClB,EAAc,OAAS,MACvB,CAAC,iCAAiC,KAAK,CAAa,EAEpD,OAAO,EAAU,IAAK,uCAAuC,EAG/D,IAAM,EAAe,EAAgC,UAAU,CAC7D,OAAQ,EAAQ,QAAU,IAAI,IAAI,EAAQ,QAAQ,GAAG,CAAC,CAAC,MACzD,CAAC,EACD,GAAI,CAAC,EAAa,QAChB,MAAM,IAAI,EAAqB,0CAA2C,EAAa,KAAK,EAG9F,IAAM,EAAkB,EAAa,EAAQ,eAAe,EACtD,EAAsB,EAAQ,OAAS,WAAW,MACxD,GAAI,IAAwB,IAAA,GAC1B,MAAM,IAAI,EAAqB,sCAAsC,EAGvE,IAAI,EACJ,GAAI,IAAW,OAAQ,CACrB,IAAM,EAAgB,OAAO,EAAQ,QAAQ,QAAQ,IAAI,gBAAgB,GAAK,CAAC,EAC/E,GAAI,OAAO,SAAS,CAAa,GAAK,EAAgB,EACpD,OAAO,EAAU,IAAK,gCAAgC,EAExD,IAAM,EAAQ,MAAM,EAAQ,QAAQ,YAAY,EAChD,GAAI,EAAM,WAAa,EACrB,OAAO,EAAU,IAAK,gCAAgC,EAExD,EAAO,CACT,CAEA,IAAI,EACJ,GAAI,CACF,EAAW,MAAM,EACf,IAAI,IAAI,EAAQ,KAAK,IAAI,kBAAkB,CAAC,CAAC,KAAK,GAAG,EAAG,CAAe,EACvE,CACE,SACA,QAAS,CACP,OAAQ,mBACR,gBACA,OAAQ,EAAa,KAAK,OAC1B,GAAI,IAAS,IAAA,GAAY,CAAC,EAAI,CAAE,eAAgB,kBAAmB,CACrE,EACA,GAAI,IAAS,IAAA,GAAY,CAAC,EAAI,CAAE,MAAK,EACrC,MAAO,UACT,CACF,CACF,OAAS,EAAO,CACd,MAAM,IAAI,EAAsB,CAAK,CACvC,CAEA,OAAO,IAAI,SAAS,EAAS,KAAM,CACjC,OAAQ,EAAS,OACjB,QAAS,CACP,gBAAiB,WACjB,eAAgB,EAAS,QAAQ,IAAI,cAAc,GAAK,kBAC1D,CACF,CAAC,CACH,CAEA,SAAS,EAAc,EAAgB,EAAkC,CAkBvE,OAhBE,IAAW,OACX,EAAK,KAAO,MACZ,EAAK,KAAO,cACX,EAAK,SAAW,GAAM,EAAK,SAAW,GAAK,EAAK,KAAO,UAEjD,GAGP,EAAK,KAAO,MACZ,EAAK,KAAO,eACZ,EAAK,KAAO,IAAA,IACZ,CAAC,EAAoB,KAAK,EAAK,EAAE,EAE1B,GAEL,IAAW,MAAc,EAAK,SAAW,EAE3C,IAAW,QACX,EAAK,SAAW,GAChB,EAAK,KAAO,IAAA,IACZ,EAAkB,IAAI,EAAK,EAAE,CAEjC,CAEA,SAAS,EAAa,EAAoB,CACxC,IAAI,EACJ,GAAI,CACF,EAAM,IAAI,IAAI,CAAK,CACrB,OAAS,EAAO,CACd,MAAM,IAAI,EAAqB,kDAAmD,CAAK,CACzF,CACA,GAAI,EAAI,WAAa,UAAY,CAAC,EAAW,EAAI,QAAQ,EACvD,MAAM,IAAI,EACR,kEACF,EAEF,GAAI,EAAI,WAAa,IAAM,EAAI,WAAa,IAAM,EAAI,SAAW,IAAM,EAAI,OAAS,GAClF,MAAM,IAAI,EACR,8EACF,EAGF,MADA,GAAI,SAAW,GAAG,EAAI,SAAS,QAAQ,MAAO,EAAE,EAAE,GAC3C,CACT,CAEA,SAAS,EAAW,EAA2B,CAC7C,OAAO,IAAa,aAAe,IAAa,aAAe,IAAa,OAC9E,CAEA,SAAS,EAAU,EAAgB,EAA2B,CAC5D,OAAO,SAAS,KACd,CAAE,MAAO,CAAE,KAAM,IAAW,IAAM,eAAiB,kBAAmB,SAAQ,CAAE,EAChF,CAAE,SAAQ,QAAS,CAAE,gBAAiB,UAAW,CAAE,CACrD,CACF"}

package/dist/ui.cjs

@@ -1,12 +1 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_sdk = require("./sdk-DJqGGxgC.cjs");
-exports.applyWhiteLabel = require_sdk.applyWhiteLabel;
-exports.createDomain0 = require_sdk.createDomain0;
-exports.createDomain0Localizer = require_sdk.createDomain0Localizer;
-exports.domain0 = require_sdk.domain0;
-exports.domain0TranslatedLocales = require_sdk.domain0TranslatedLocales;
-exports.interpolateWhiteLabelCopy = require_sdk.interpolateWhiteLabelCopy;
-exports.localizedCopy = require_sdk.localizedCopy;
-exports.mountDomain0Connect = require_sdk.mountDomain0Connect;
-exports.mountDomain0ConnectionFlow = require_sdk.mountDomain0ConnectionFlow;
-exports.mountDomain0SharedFlow = require_sdk.mountDomain0SharedFlow;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./sdk-Dv22iteS.cjs");exports.applyWhiteLabel=e.o,exports.createDomain0=e.t,exports.createDomain0Localizer=e.c,exports.domain0=e.n,exports.domain0TranslatedLocales=e.l,exports.interpolateWhiteLabelCopy=e.s,exports.localizedCopy=e.u,exports.mountDomain0Connect=e.a,exports.mountDomain0ConnectionFlow=e.i,exports.mountDomain0SharedFlow=e.r;

package/dist/ui.d.cts

@@ -1,5 +1,5 @@
-import { Hi as PlanWarningCode, Kt as Domain0ErrorCode, Ut as Domain0Locale, pt as ProviderDetectionUnavailableReasonCode, xi as ConnectionState, y as Domain0WhiteLabel } from "./index-sSrRFTnm.cjs";
-import { C as Domain0RequestCloseEvent, E as mountDomain0Connect, S as Domain0ManualSetupDocumentationClickEvent, T as Domain0SharedFlowSentEvent, _ as Domain0ConnectStep, a as createDomain0, b as Domain0CreateSharedFlowRequest, c as mountDomain0SharedFlow, d as mountDomain0ConnectionFlow, f as Domain0ActiveConnection, g as Domain0ConnectOptions, h as Domain0ConnectController, i as Domain0SDK, l as Domain0ConnectionFlowController, m as Domain0ConnectCloseReason, n as Domain0ConnectDomainsOptions, o as domain0, p as Domain0ConnectCloseEvent, r as Domain0LoadSharedFlowOptions, s as Domain0SharedFlowOptions, t as Domain0ConnectDomainOptions, u as Domain0ConnectionFlowOptions, v as Domain0ConnectStepChangeEvent, w as Domain0SharedFlowGateway, x as Domain0DkimSetupDocumentationClickEvent, y as Domain0ConnectSuccessEvent } from "./sdk-DYR5Itru.cjs";
+import { Kt as Domain0ErrorCode, Ut as Domain0Locale, Xi as PlanWarningCode, ki as ConnectionState, pt as ProviderDetectionUnavailableReasonCode, y as Domain0WhiteLabel } from "./index-DzGqFq0D.cjs";
+import { C as Domain0DkimSetupDocumentationClickEvent, D as Domain0SharedFlowSentEvent, E as Domain0SharedFlowGateway, O as mountDomain0Connect, S as Domain0CreateSharedFlowRequest, T as Domain0RequestCloseEvent, _ as Domain0ConnectFailureEvent, a as createDomain0, b as Domain0ConnectStepChangeEvent, c as mountDomain0SharedFlow, d as mountDomain0ConnectionFlow, f as Domain0ActiveConnection, g as Domain0ConnectErrorEvent, h as Domain0ConnectController, i as Domain0SDK, l as Domain0ConnectionFlowController, m as Domain0ConnectCloseTrigger, n as Domain0ConnectDomainsOptions, o as domain0, p as Domain0ConnectCloseEvent, r as Domain0LoadSharedFlowOptions, s as Domain0SharedFlowOptions, t as Domain0ConnectDomainOptions, u as Domain0ConnectionFlowOptions, v as Domain0ConnectOptions, w as Domain0ManualSetupDocumentationClickEvent, x as Domain0ConnectSuccessEvent, y as Domain0ConnectStep } from "./sdk-CkEDIlsq.cjs";
 //#region src/ui/localization.d.ts
 declare const englishMessages: {
   readonly triggerConnectDomain: "Connect domain";
@@ -10,6 +10,9 @@ declare const englishMessages: {
   readonly close: "Close";
   readonly loadingConnection: "Loading connection details…";
   readonly detectingProvider: "Detecting your DNS provider…";
+  readonly checkingDomain: (domain: string) => string;
+  readonly nameserverDetectionGuidance: "Reading the nameservers to find who runs this domain's DNS.";
+  readonly resolvingNameservers: "Resolving nameservers";
   readonly detectionUnavailable: "Automatic provider detection is temporarily unavailable. Choose your DNS provider below.";
   readonly connectionStatus: (state: string) => string;
   readonly manualInstructionsReady: "Guided manual DNS instructions are ready.";
@@ -19,6 +22,10 @@ declare const englishMessages: {
   readonly missingApplyingPlan: "The server returned an applying state without a confirmed plan";
   readonly missingFailureDetails: "The server returned a retryable state without failure details";
   readonly successDescription: (domain: string) => string;
+  readonly connectedHeading: (domain: string) => string;
+  readonly verifiedEveryNameserver: "Verified on every nameserver";
+  readonly successRecordsUntouched: "These records are live. Nothing else on the domain was touched.";
+  readonly backToApplication: (application: string) => string;
   readonly dkimHeading: "Secure outgoing email with DKIM";
   readonly dkimCheckingProvider: "Checking public MX and selector-specific DKIM DNS records…";
   readonly dkimGuidanceUnavailable: "Email-provider detection is temporarily unavailable. No DNS changes were made.";
@@ -149,9 +156,14 @@ declare const englishMessages: {
   readonly planConfirmed: "Plan confirmed. DNS changes have not been applied yet.";
   readonly applyDnsChanges: "Apply DNS changes";
   readonly applyingDnsChanges: "Applying the confirmed DNS changes…";
+  readonly applyingVerifiedChanges: "Applying verified changes";
+  readonly connectingDomain: (domain: string) => string;
+  readonly applyingProgressGuidance: "Domain0 is updating only the requested DNS records. You can safely leave this open.";
+  readonly waitingForProvider: "Waiting for provider";
   readonly dnsChangesApplied: "DNS changes were applied. Ready to verify authoritative propagation.";
   readonly detectionReasonNoStablePublicProviderIdentity: "This provider does not publish a stable public identity that Domain0 can safely detect from DNS.";
   readonly manualGuidance: "Use guided manual setup to add the exact required DNS records without sharing provider credentials.";
+  readonly manualSetupLabel: "Manual setup";
   readonly manualSetupUnavailableHeading: "Manual setup unavailable";
   readonly manualSetupUnavailableDescription: "Manual DNS setup is disabled by this application. Use another available verified path, or cancel or close this connection.";
   readonly showDnsRecords: "Show DNS records";
@@ -180,6 +192,8 @@ declare const englishMessages: {
   readonly requiredRecordsActive: "Required DNS records are active.";
   readonly propagationPending: "DNS changes have not reached every authoritative nameserver yet. You can check again.";
   readonly providerFailureHeading: "Provider operation needs attention";
+  readonly needsAttention: "Needs attention";
+  readonly connectionNeedsAttention: (domain: string) => string;
   readonly snapshotTimeout: "Domain0 timed out while reading provider DNS records. No DNS changes were made. Retry restores the prior review step so you can request a fresh snapshot.";
   readonly applyTimeout: "The provider did not confirm the DNS update before the deadline, so the outcome is ambiguous. Retry restores the confirmed application step; Domain0 reconciles current provider records before another write.";
   readonly timeoutRecorded: "The timeout was recorded at {DATE}.";
@@ -203,6 +217,11 @@ declare const englishMessages: {
   readonly preparingProviderSelection: "Preparing provider selection…";
   readonly providerDetected: (provider: string) => string;
   readonly providerSelected: (provider: string) => string;
+  readonly detectedFromNameservers: "Detected from nameservers";
+  readonly providerSelectedEyebrow: "Provider selected";
+  readonly providerConnectHeading: (provider: string) => string;
+  readonly hostApplication: "This application";
+  readonly providerApprovalGuidance: (provider: string, application: string) => string;
   readonly preparingManualInstructions: "Preparing guided manual DNS instructions…";
   readonly manualSetupNotEntered: "The server did not enter guided manual setup";
   readonly noProviderDetected: "No provider was identified automatically. Choose your DNS provider below.";
@@ -283,5 +302,5 @@ declare function localizedCopy(copy: Readonly<{
 declare function applyWhiteLabel(root: HTMLElement, whiteLabel: Domain0WhiteLabel): void;
 declare function interpolateWhiteLabelCopy(template: string, replacements: Readonly<Record<string, string>>): string;
 //#endregion
-export { Domain0ActiveConnection, Domain0ConnectCloseEvent, Domain0ConnectCloseReason, Domain0ConnectController, Domain0ConnectDomainOptions, Domain0ConnectDomainsOptions, Domain0ConnectOptions, Domain0ConnectStep, Domain0ConnectStepChangeEvent, Domain0ConnectSuccessEvent, Domain0ConnectionFlowController, Domain0ConnectionFlowOptions, Domain0CreateSharedFlowRequest, Domain0DkimSetupDocumentationClickEvent, Domain0LoadSharedFlowOptions, Domain0Localizer, Domain0ManualSetupDocumentationClickEvent, Domain0Messages, Domain0RequestCloseEvent, Domain0SDK, Domain0SharedFlowGateway, Domain0SharedFlowOptions, Domain0SharedFlowSentEvent, Domain0TranslatedLocale, applyWhiteLabel, createDomain0, createDomain0Localizer, domain0, domain0TranslatedLocales, interpolateWhiteLabelCopy, localizedCopy, mountDomain0Connect, mountDomain0ConnectionFlow, mountDomain0SharedFlow };
+export { Domain0ActiveConnection, Domain0ConnectCloseEvent, Domain0ConnectCloseTrigger, Domain0ConnectController, Domain0ConnectDomainOptions, Domain0ConnectDomainsOptions, Domain0ConnectErrorEvent, Domain0ConnectFailureEvent, Domain0ConnectOptions, Domain0ConnectStep, Domain0ConnectStepChangeEvent, Domain0ConnectSuccessEvent, Domain0ConnectionFlowController, Domain0ConnectionFlowOptions, Domain0CreateSharedFlowRequest, Domain0DkimSetupDocumentationClickEvent, Domain0LoadSharedFlowOptions, Domain0Localizer, Domain0ManualSetupDocumentationClickEvent, Domain0Messages, Domain0RequestCloseEvent, Domain0SDK, Domain0SharedFlowGateway, Domain0SharedFlowOptions, Domain0SharedFlowSentEvent, Domain0TranslatedLocale, applyWhiteLabel, createDomain0, createDomain0Localizer, domain0, domain0TranslatedLocales, interpolateWhiteLabelCopy, localizedCopy, mountDomain0Connect, mountDomain0ConnectionFlow, mountDomain0SharedFlow };
 //# sourceMappingURL=ui.d.cts.map

package/dist/ui.d.mts

@@ -1,5 +1,5 @@
-import { Hi as PlanWarningCode, Kt as Domain0ErrorCode, Ut as Domain0Locale, pt as ProviderDetectionUnavailableReasonCode, xi as ConnectionState, y as Domain0WhiteLabel } from "./index-sSrRFTnm.mjs";
-import { C as Domain0RequestCloseEvent, E as mountDomain0Connect, S as Domain0ManualSetupDocumentationClickEvent, T as Domain0SharedFlowSentEvent, _ as Domain0ConnectStep, a as createDomain0, b as Domain0CreateSharedFlowRequest, c as mountDomain0SharedFlow, d as mountDomain0ConnectionFlow, f as Domain0ActiveConnection, g as Domain0ConnectOptions, h as Domain0ConnectController, i as Domain0SDK, l as Domain0ConnectionFlowController, m as Domain0ConnectCloseReason, n as Domain0ConnectDomainsOptions, o as domain0, p as Domain0ConnectCloseEvent, r as Domain0LoadSharedFlowOptions, s as Domain0SharedFlowOptions, t as Domain0ConnectDomainOptions, u as Domain0ConnectionFlowOptions, v as Domain0ConnectStepChangeEvent, w as Domain0SharedFlowGateway, x as Domain0DkimSetupDocumentationClickEvent, y as Domain0ConnectSuccessEvent } from "./sdk-B10fN-QP.mjs";
+import { Kt as Domain0ErrorCode, Ut as Domain0Locale, Xi as PlanWarningCode, ki as ConnectionState, pt as ProviderDetectionUnavailableReasonCode, y as Domain0WhiteLabel } from "./index-DzGqFq0D.mjs";
+import { C as Domain0DkimSetupDocumentationClickEvent, D as Domain0SharedFlowSentEvent, E as Domain0SharedFlowGateway, O as mountDomain0Connect, S as Domain0CreateSharedFlowRequest, T as Domain0RequestCloseEvent, _ as Domain0ConnectFailureEvent, a as createDomain0, b as Domain0ConnectStepChangeEvent, c as mountDomain0SharedFlow, d as mountDomain0ConnectionFlow, f as Domain0ActiveConnection, g as Domain0ConnectErrorEvent, h as Domain0ConnectController, i as Domain0SDK, l as Domain0ConnectionFlowController, m as Domain0ConnectCloseTrigger, n as Domain0ConnectDomainsOptions, o as domain0, p as Domain0ConnectCloseEvent, r as Domain0LoadSharedFlowOptions, s as Domain0SharedFlowOptions, t as Domain0ConnectDomainOptions, u as Domain0ConnectionFlowOptions, v as Domain0ConnectOptions, w as Domain0ManualSetupDocumentationClickEvent, x as Domain0ConnectSuccessEvent, y as Domain0ConnectStep } from "./sdk-D2QNoMIg.mjs";
 //#region src/ui/localization.d.ts
 declare const englishMessages: {
   readonly triggerConnectDomain: "Connect domain";
@@ -10,6 +10,9 @@ declare const englishMessages: {
   readonly close: "Close";
   readonly loadingConnection: "Loading connection details…";
   readonly detectingProvider: "Detecting your DNS provider…";
+  readonly checkingDomain: (domain: string) => string;
+  readonly nameserverDetectionGuidance: "Reading the nameservers to find who runs this domain's DNS.";
+  readonly resolvingNameservers: "Resolving nameservers";
   readonly detectionUnavailable: "Automatic provider detection is temporarily unavailable. Choose your DNS provider below.";
   readonly connectionStatus: (state: string) => string;
   readonly manualInstructionsReady: "Guided manual DNS instructions are ready.";
@@ -19,6 +22,10 @@ declare const englishMessages: {
   readonly missingApplyingPlan: "The server returned an applying state without a confirmed plan";
   readonly missingFailureDetails: "The server returned a retryable state without failure details";
   readonly successDescription: (domain: string) => string;
+  readonly connectedHeading: (domain: string) => string;
+  readonly verifiedEveryNameserver: "Verified on every nameserver";
+  readonly successRecordsUntouched: "These records are live. Nothing else on the domain was touched.";
+  readonly backToApplication: (application: string) => string;
   readonly dkimHeading: "Secure outgoing email with DKIM";
   readonly dkimCheckingProvider: "Checking public MX and selector-specific DKIM DNS records…";
   readonly dkimGuidanceUnavailable: "Email-provider detection is temporarily unavailable. No DNS changes were made.";
@@ -149,9 +156,14 @@ declare const englishMessages: {
   readonly planConfirmed: "Plan confirmed. DNS changes have not been applied yet.";
   readonly applyDnsChanges: "Apply DNS changes";
   readonly applyingDnsChanges: "Applying the confirmed DNS changes…";
+  readonly applyingVerifiedChanges: "Applying verified changes";
+  readonly connectingDomain: (domain: string) => string;
+  readonly applyingProgressGuidance: "Domain0 is updating only the requested DNS records. You can safely leave this open.";
+  readonly waitingForProvider: "Waiting for provider";
   readonly dnsChangesApplied: "DNS changes were applied. Ready to verify authoritative propagation.";
   readonly detectionReasonNoStablePublicProviderIdentity: "This provider does not publish a stable public identity that Domain0 can safely detect from DNS.";
   readonly manualGuidance: "Use guided manual setup to add the exact required DNS records without sharing provider credentials.";
+  readonly manualSetupLabel: "Manual setup";
   readonly manualSetupUnavailableHeading: "Manual setup unavailable";
   readonly manualSetupUnavailableDescription: "Manual DNS setup is disabled by this application. Use another available verified path, or cancel or close this connection.";
   readonly showDnsRecords: "Show DNS records";
@@ -180,6 +192,8 @@ declare const englishMessages: {
   readonly requiredRecordsActive: "Required DNS records are active.";
   readonly propagationPending: "DNS changes have not reached every authoritative nameserver yet. You can check again.";
   readonly providerFailureHeading: "Provider operation needs attention";
+  readonly needsAttention: "Needs attention";
+  readonly connectionNeedsAttention: (domain: string) => string;
   readonly snapshotTimeout: "Domain0 timed out while reading provider DNS records. No DNS changes were made. Retry restores the prior review step so you can request a fresh snapshot.";
   readonly applyTimeout: "The provider did not confirm the DNS update before the deadline, so the outcome is ambiguous. Retry restores the confirmed application step; Domain0 reconciles current provider records before another write.";
   readonly timeoutRecorded: "The timeout was recorded at {DATE}.";
@@ -203,6 +217,11 @@ declare const englishMessages: {
   readonly preparingProviderSelection: "Preparing provider selection…";
   readonly providerDetected: (provider: string) => string;
   readonly providerSelected: (provider: string) => string;
+  readonly detectedFromNameservers: "Detected from nameservers";
+  readonly providerSelectedEyebrow: "Provider selected";
+  readonly providerConnectHeading: (provider: string) => string;
+  readonly hostApplication: "This application";
+  readonly providerApprovalGuidance: (provider: string, application: string) => string;
   readonly preparingManualInstructions: "Preparing guided manual DNS instructions…";
   readonly manualSetupNotEntered: "The server did not enter guided manual setup";
   readonly noProviderDetected: "No provider was identified automatically. Choose your DNS provider below.";
@@ -283,5 +302,5 @@ declare function localizedCopy(copy: Readonly<{
 declare function applyWhiteLabel(root: HTMLElement, whiteLabel: Domain0WhiteLabel): void;
 declare function interpolateWhiteLabelCopy(template: string, replacements: Readonly<Record<string, string>>): string;
 //#endregion
-export { Domain0ActiveConnection, Domain0ConnectCloseEvent, Domain0ConnectCloseReason, Domain0ConnectController, Domain0ConnectDomainOptions, Domain0ConnectDomainsOptions, Domain0ConnectOptions, Domain0ConnectStep, Domain0ConnectStepChangeEvent, Domain0ConnectSuccessEvent, Domain0ConnectionFlowController, Domain0ConnectionFlowOptions, Domain0CreateSharedFlowRequest, Domain0DkimSetupDocumentationClickEvent, Domain0LoadSharedFlowOptions, Domain0Localizer, Domain0ManualSetupDocumentationClickEvent, Domain0Messages, Domain0RequestCloseEvent, Domain0SDK, Domain0SharedFlowGateway, Domain0SharedFlowOptions, Domain0SharedFlowSentEvent, Domain0TranslatedLocale, applyWhiteLabel, createDomain0, createDomain0Localizer, domain0, domain0TranslatedLocales, interpolateWhiteLabelCopy, localizedCopy, mountDomain0Connect, mountDomain0ConnectionFlow, mountDomain0SharedFlow };
+export { Domain0ActiveConnection, Domain0ConnectCloseEvent, Domain0ConnectCloseTrigger, Domain0ConnectController, Domain0ConnectDomainOptions, Domain0ConnectDomainsOptions, Domain0ConnectErrorEvent, Domain0ConnectFailureEvent, Domain0ConnectOptions, Domain0ConnectStep, Domain0ConnectStepChangeEvent, Domain0ConnectSuccessEvent, Domain0ConnectionFlowController, Domain0ConnectionFlowOptions, Domain0CreateSharedFlowRequest, Domain0DkimSetupDocumentationClickEvent, Domain0LoadSharedFlowOptions, Domain0Localizer, Domain0ManualSetupDocumentationClickEvent, Domain0Messages, Domain0RequestCloseEvent, Domain0SDK, Domain0SharedFlowGateway, Domain0SharedFlowOptions, Domain0SharedFlowSentEvent, Domain0TranslatedLocale, applyWhiteLabel, createDomain0, createDomain0Localizer, domain0, domain0TranslatedLocales, interpolateWhiteLabelCopy, localizedCopy, mountDomain0Connect, mountDomain0ConnectionFlow, mountDomain0SharedFlow };
 //# sourceMappingURL=ui.d.mts.map

package/dist/ui.mjs

@@ -1,2 +1 @@
-import { a as mountDomain0Connect, c as localizedCopy, i as mountDomain0ConnectionFlow, l as applyWhiteLabel, n as domain0, o as createDomain0Localizer, r as mountDomain0SharedFlow, s as domain0TranslatedLocales, t as createDomain0, u as interpolateWhiteLabelCopy } from "./sdk-CoOrU3ZT.mjs";
-export { applyWhiteLabel, createDomain0, createDomain0Localizer, domain0, domain0TranslatedLocales, interpolateWhiteLabelCopy, localizedCopy, mountDomain0Connect, mountDomain0ConnectionFlow, mountDomain0SharedFlow };
+import{a as e,c as t,i as n,l as r,n as i,o as a,r as o,s,t as c,u as l}from"./sdk-BbUuEwzs.mjs";export{a as applyWhiteLabel,c as createDomain0,t as createDomain0Localizer,i as domain0,r as domain0TranslatedLocales,s as interpolateWhiteLabelCopy,l as localizedCopy,e as mountDomain0Connect,n as mountDomain0ConnectionFlow,o as mountDomain0SharedFlow};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domain0",
-  "version": "0.3.3",
+  "version": "0.4.0",
   "description": "Type-safe SDK and embeddable UI for the open-source Domain0 domain connection platform",
   "author": "Domain0",
   "license": "Apache-2.0",
@@ -93,6 +93,10 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "react": "19.2.8",
+    "react-dom": "19.2.8",
     "zod": "^4.4.3"
   },
   "devDependencies": {
@@ -100,6 +104,8 @@
     "@asteasolutions/zod-to-openapi": "^9.1.0",
     "@playwright/test": "1.62.1",
     "@types/node": "^26.4.0",
+    "@types/react": "^19.2.14",
+    "@types/react-dom": "^19.2.3",
     "axe-core": "^4.13.0",
     "fast-check": "^4.9.0",
     "jsdom": "^30.0.1",

package/dist/error-BB4-lyc4.cjs

@@ -1,48 +0,0 @@
-//#region src/client/error.ts
-var Domain0Error = class extends Error {
-	status;
-	response;
-	constructor(status, response) {
-		super(response.error.message);
-		this.name = "Domain0Error";
-		this.status = status;
-		this.response = response;
-	}
-};
-var Domain0ProtocolError = class extends Error {
-	cause;
-	constructor(message, cause) {
-		super(message);
-		this.name = "Domain0ProtocolError";
-		this.cause = cause;
-	}
-};
-var Domain0TransportError = class extends Error {
-	cause;
-	constructor(cause) {
-		super("The Domain0 API could not be reached");
-		this.name = "Domain0TransportError";
-		this.cause = cause;
-	}
-};
-//#endregion
-Object.defineProperty(exports, "Domain0Error", {
-	enumerable: true,
-	get: function() {
-		return Domain0Error;
-	}
-});
-Object.defineProperty(exports, "Domain0ProtocolError", {
-	enumerable: true,
-	get: function() {
-		return Domain0ProtocolError;
-	}
-});
-Object.defineProperty(exports, "Domain0TransportError", {
-	enumerable: true,
-	get: function() {
-		return Domain0TransportError;
-	}
-});
-
-//# sourceMappingURL=error-BB4-lyc4.cjs.map

package/dist/error-Cyd6a9ay.mjs

@@ -1,31 +0,0 @@
-//#region src/client/error.ts
-var Domain0Error = class extends Error {
-	status;
-	response;
-	constructor(status, response) {
-		super(response.error.message);
-		this.name = "Domain0Error";
-		this.status = status;
-		this.response = response;
-	}
-};
-var Domain0ProtocolError = class extends Error {
-	cause;
-	constructor(message, cause) {
-		super(message);
-		this.name = "Domain0ProtocolError";
-		this.cause = cause;
-	}
-};
-var Domain0TransportError = class extends Error {
-	cause;
-	constructor(cause) {
-		super("The Domain0 API could not be reached");
-		this.name = "Domain0TransportError";
-		this.cause = cause;
-	}
-};
-//#endregion
-export { Domain0ProtocolError as n, Domain0TransportError as r, Domain0Error as t };
-
-//# sourceMappingURL=error-Cyd6a9ay.mjs.map