domain0 0.5.0 → 0.7.0

package/README.md

@@ -176,8 +176,9 @@ unsupported provider or credential kind fails before a request is sent.
 `getProviderHealth()` returns every reviewed provider and matches Entri's
 `enabled` compatibility field while adding strict `status`, `reason`,
 `observedAt`, and `refreshAfter` semantics. Enabled means that this Domain0
-deployment exposes an automatic, Domain Connect, or guided manual setup path.
-It is not an upstream uptime probe.
+deployment exposes a live-negotiated Domain Connect attempt or a guided
+fallback path. It does not claim exact-template acceptance and is not an
+upstream uptime probe.
 `checkRecords()` is an application-token-only, read-only authoritative DNS
 check. It does not create a connection, write provider state, or treat a
 recursive resolver answer as propagation proof; each result reports how many
@@ -192,6 +193,13 @@ that no conflict exists. Domain0 deliberately does not expose `registered` or
 The same union covers API tokens, access-key pairs, username/password,
 account/token, username/token, OVH AK/AS/CK, TransIP PEM keys, temporary AWS
 sessions with explicit expiry, and provider-scoped cPanel credentials.
+Providers with an official short-lived exchange use those same strictly typed
+forms as transient sign-in input. The SDK sends the material once and receives
+only a display-safe challenge or an authorized connection; it never receives
+the provider session secret. Provider responses include `authorizationInputs`,
+so the embedded UI renders the deployment's direct and provider-session forms
+from server-owned credential contracts instead of a second hard-coded provider
+map in the SDK.
 Cancellation is an idempotent, typed operation for non-terminal connections;
 it does not reverse DNS records that a provider may already have applied.
 Retry does not blindly repeat a provider mutation. It restores the exact
@@ -624,10 +632,16 @@ await domain0.loadSharedFlow({
 })
 ```
 
-For a provider whose evidence state is `domain_connect`, pass the integrating
-application's onboarded template as `domainConnectTemplate`. The backend
-checks support for that exact template and returns a reviewed provider handoff;
-the UI never treats the handoff or user return as propagation success.
+For a Domain Connect provider, Continue asks the backend to select an onboarded,
+application-scoped template from the connection's saved DNS intent. The default
+SDK mount does not need `domainConnectTemplate`; backend registrations must have
+an automatic selection profile. A missing SDK template option no longer skips
+directly to manual DNS. Advanced integrations can still pass an explicit
+registered `domainConnectTemplate`.
+
+The backend requires one exact match, checks the discovered provider's acceptance,
+and signs the reviewed template. Neither a matching UI nor a generated handoff
+proves live provider conformance; authoritative DNS remains the success signal.
 
 The package name is `domain0` and its license is Apache-2.0. Releases are
 versioned through reviewed Changesets pull requests and published from the

package/dist/contracts.cjs

@@ -1,2 +1,2 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("zod");const t=e.z.string().trim().min(1).max(200),n=t.brand().meta({id:`ConnectionId`}),r=t.brand().meta({id:`ApplicationId`}),i=t.brand().meta({id:`TenantId`}),a=e.z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).brand().meta({id:`ProviderId`}),o=t.brand().meta({id:`CommandId`}),s=e.z.string().trim().toLowerCase().overwrite(e=>e.replace(/\.$/,``)).min(3).max(253).regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/).refine(e=>!/^\d+(?:\.\d+){3}$/.test(e),`IP addresses are not domain names`).brand().meta({id:`DomainName`}),c=e.z.iso.datetime({offset:!0}).meta({id:`IsoDateTime`}),l=e.z.string().trim().toLowerCase().overwrite(e=>e.replace(/\.$/,``)).min(1).max(253).refine(ce,`Host must be @ or a valid relative DNS name`),u=/^([0-9]{1,3})[\t ]+([A-Za-z0-9-]{1,15})[\t ]+(?:"([^\r\n"]*)"|([^\r\n"]+))$/,d=e.z.enum([`A`,`AAAA`,`CNAME`,`CAA`,`MX`,`TXT`,`NS`]).meta({id:`DnsRecordType`}),f=e.z.string().regex(/^[a-z]{1,32}$/),p=e.z.string().min(1).max(4096).refine(e=>e.trim()===e&&/^[\x20-\x3a\x3c-\x7e]+$/.test(e),{message:`DMARC tag values must be trimmed printable ASCII without semicolons`}),ee=e.z.record(f,p).refine(e=>Object.keys(e).length<=32,`At most 32 DMARC tags are allowed`),m=e.z.object({inheritRootDmarc:e.z.boolean().default(!1),overrideTags:ee.default({}),removeTags:e.z.array(f).max(32).refine(e=>new Set(e).size===e.length,`DMARC tags to remove must be unique`).default([]),addTagsIfNotExist:ee.default({})}).strict().refine(e=>e.inheritRootDmarc||Object.keys(e.overrideTags).length>0||e.removeTags.length>0||Object.keys(e.addTagsIfNotExist).length>0,`At least one advanced DMARC option is required`).superRefine((e,t)=>{for(let[n,r]of[[`overrideTags`,e.overrideTags],[`addTagsIfNotExist`,e.addTagsIfNotExist]])for(let[e,i]of Object.entries(r))ue(e,i)||t.addIssue({code:`custom`,path:[n,e],message:`Invalid value for the ${e} DMARC tag`})}).meta({id:`AdvancedDmarcOptions`}),h=e.z.object({host:l,type:d,value:e.z.string().trim().min(1).max(65535),ttl:e.z.number().int().min(1).max(2147483647).default(300),priority:e.z.number().int().min(0).max(65535).optional(),optional:e.z.boolean().default(!1)}).strict().superRefine((t,n)=>{if(t.type===`MX`&&t.priority===void 0&&n.addIssue({code:`custom`,path:[`priority`],message:`MX records require a priority`}),t.type!==`MX`&&t.priority!==void 0&&n.addIssue({code:`custom`,path:[`priority`],message:`Only MX records accept a priority`}),t.type===`A`&&!e.z.ipv4().safeParse(t.value).success&&n.addIssue({code:`custom`,path:[`value`],message:`A records require an IPv4 address`}),t.type===`AAAA`&&!e.z.ipv6().safeParse(t.value).success&&n.addIssue({code:`custom`,path:[`value`],message:`AAAA records require an IPv6 address`}),[`CNAME`,`MX`,`NS`].includes(t.type)&&!s.safeParse(t.value).success&&n.addIssue({code:`custom`,path:[`value`],message:`${t.type} records require a domain name`}),t.type===`CAA`){let e=u.exec(t.value);(e===null||Number(e[1])>255)&&n.addIssue({code:`custom`,path:[`value`],message:`CAA values must contain flags, a tag, and a quoted value`})}t.type===`TXT`&&/[\u0000\r\n]/.test(t.value)&&n.addIssue({code:`custom`,path:[`value`],message:`TXT values cannot contain NUL or newlines`})}),g=h.meta({id:`ResolvedDnsRecord`}),_=h.safeExtend({advancedDmarcOptions:m.optional()}).superRefine((e,t)=>{e.advancedDmarcOptions!==void 0&&((e.type!==`TXT`||e.host!==`_dmarc`&&!e.host.startsWith(`_dmarc.`))&&t.addIssue({code:`custom`,path:[`advancedDmarcOptions`],message:`Advanced DMARC options require a TXT record at a _dmarc host`}),le(e.value)||t.addIssue({code:`custom`,path:[`value`],message:`Advanced DMARC options require a valid DMARC1 value with a policy tag`}))}).meta({id:`DnsRecord`}),v=e.z.object({validateDmarc:e.z.boolean().default(!1),validateCAA:e.z.boolean().default(!1)}).strict().meta({id:`ExistingRecordPolicy`}),y=e.z.object({domain:s,records:e.z.array(_).min(1).max(100),existingRecordPolicy:v.default({validateDmarc:!1,validateCAA:!1})}).strict().meta({id:`DnsIntent`}),b=e.z.object({domain:s,records:e.z.array(g).max(100)}).strict().meta({id:`ResolvedDnsIntent`}),te=b.meta({id:`CheckRecordsInput`}),ne=e.z.object({record:g,authoritativeServers:e.z.number().int().min(1).max(16),matchingServers:e.z.number().int().min(0).max(16),propagated:e.z.boolean()}).strict().superRefine((e,t)=>{e.matchingServers>e.authoritativeServers&&t.addIssue({code:`custom`,path:[`matchingServers`],message:`Matching nameservers cannot exceed authoritative nameservers`}),e.propagated!==(e.matchingServers===e.authoritativeServers)&&t.addIssue({code:`custom`,path:[`propagated`],message:`Propagation state must match the authoritative nameserver counts`})}).meta({id:`CheckedRecord`}),re=e.z.object({domain:s,allPropagated:e.z.boolean(),records:e.z.array(ne).min(1).max(100)}).strict().superRefine((e,t)=>{e.allPropagated!==e.records.every(e=>e.propagated)&&t.addIssue({code:`custom`,path:[`allPropagated`],message:`Overall propagation state must match every record result`})}).meta({id:`CheckRecordsResponse`}),ie=e.z.enum([`preserve`,`replace_same_name_and_type`,`replace_all_at_name`]).meta({id:`ConflictPolicy`}),ae=e.z.enum([`merge`,`replace`]).meta({id:`SpfConflictPolicy`}),oe=e.z.enum([`create`,`replace`,`delete`]).meta({id:`ChangeAction`}),se=e.z.object({action:oe,before:g.optional(),after:g.optional(),destructive:e.z.boolean()}).strict().superRefine((e,t)=>{e.action===`create`&&e.after===void 0&&t.addIssue({code:`custom`,path:[`after`],message:`Create requires the resulting record`}),e.action===`replace`&&(e.before===void 0||e.after===void 0)&&t.addIssue({code:`custom`,message:`Replace requires both current and resulting records`}),e.action===`delete`&&e.before===void 0&&t.addIssue({code:`custom`,path:[`before`],message:`Delete requires the current record`})}).meta({id:`PlannedChange`});function ce(e){return e===`@`||e.split(`.`).every((e,t)=>e===`*`?t===0:e.length>=1&&e.length<=63&&!e.startsWith(`-`)&&!e.endsWith(`-`)&&/^[a-z0-9_-]+$/.test(e))}function le(e){let t=e.split(`;`).map(e=>e.trim()).filter(Boolean),n=new Set;if(t.length<2)return!1;for(let[e,r]of t.entries()){let t=r.indexOf(`=`);if(t<=0)return!1;let i=r.slice(0,t).trim().toLowerCase(),a=r.slice(t+1).trim();if(!f.safeParse(i).success||!p.safeParse(a).success||n.has(i)||e===0&&(i!==`v`||a!==`DMARC1`)||!ue(i,a))return!1;n.add(i)}return n.has(`p`)}function ue(e,t){if(e===`v`)return t===`DMARC1`;if([`p`,`sp`,`np`].includes(e))return[`none`,`quarantine`,`reject`].includes(t);if([`adkim`,`aspf`].includes(e))return t===`r`||t===`s`;if(e===`pct`)return/^\d{1,3}$/.test(t)&&Number(t)<=100;if(e===`ri`)return/^[1-9]\d*$/.test(t);if(e===`rf`)return t===`afrf`;if(e===`fo`){let e=t.split(`:`);return e.length>0&&new Set(e).size===e.length&&e.every(e=>[`0`,`1`,`d`,`s`].includes(e))&&!(e.includes(`0`)&&e.includes(`1`))}return!0}const de=e.z.enum([`automatic`,`domain_connect`,`manual`]).meta({id:`ProviderImplementation`}),fe=e.z.enum([`oauth2_pkce`,`oauth2_authorization_code`,`api_token`,`api_key`,`basic`,`session`,`domain_connect`,`manual`]).meta({id:`AuthorizationMethod`}),pe=e.z.strictObject({rootNSModification:e.z.enum([`supported`,`unsupported`,`unverified`]),subdomainNSModification:e.z.enum([`supported`,`unsupported`,`unverified`]),wwwRedirect:e.z.enum([`supported`,`unsupported`,`unverified`]),cnameFlattening:e.z.enum([`supported`,`unsupported`,`unverified`]),wildcardRecords:e.z.enum([`supported`,`unsupported`,`unverified`]),caaRecords:e.z.enum([`supported`,`unsupported`,`unverified`]),spfRecords:e.z.enum([`supported`,`unsupported`,`unverified`]),socialLogin:e.z.enum([`supported`,`unsupported`,`unverified`])}).meta({id:`ProviderCapabilities`}),me=e.z.enum([`no_stable_public_provider_identity`]).meta({id:`ProviderDetectionUnavailableReasonCode`}),x=e.z.discriminatedUnion(`method`,[e.z.strictObject({method:e.z.enum([`nameserver`,`domain_connect`,`nameserver_or_domain_connect`])}),e.z.strictObject({method:e.z.literal(`manual`),reasonCode:me})]).meta({id:`ProviderDetection`}),he=e.z.url({protocol:/^https$/}).regex(/^https:\/\//,`Provider reference URL must use HTTPS`).refine(e=>{let t=new URL(e);return t.username===``&&t.password===``},`Provider reference URL must not contain credentials`).meta({format:`uri`}),S=e.z.object({id:a,name:e.z.string().trim().min(1),referenceUrl:he,implementation:de,availableAuthorizationMethods:e.z.array(fe).refine(e=>new Set(e).size===e.length,`Authorization methods must be unique`).describe(`Available methods ordered from highest to lowest provider autonomy.`),capabilities:pe,detection:x,limitations:e.z.array(e.z.string().min(1))}).strict().superRefine((e,t)=>{let n=e.availableAuthorizationMethods;(e.implementation===`automatic`?n[0]!==`domain_connect`&&n.some(e=>e!==`domain_connect`&&e!==`manual`)&&n.at(-1)===`manual`:e.implementation===`domain_connect`?n.length>=2&&n[0]===`domain_connect`&&n.at(-1)===`manual`:n.length===1&&n[0]===`manual`)||t.addIssue({code:`custom`,path:[`availableAuthorizationMethods`],message:`Authorization methods must match the runtime provider implementation`})}).meta({id:`Provider`}),ge=e.z.object({providers:e.z.array(S)}).strict().meta({id:`ListProvidersResponse`}),_e=e.z.enum([`operational`,`unavailable`]).meta({id:`ProviderHealthStatus`}),ve=e.z.enum([`automatic_ready`,`domain_connect_ready`,`runtime_authorization_unavailable`,`manual_only`]).meta({id:`ProviderHealthReason`}),C=e.z.object({providerId:a,providerName:e.z.string().trim().min(1).max(200),enabled:e.z.boolean(),status:_e,reason:ve}).strict().superRefine((e,t)=>{let n=e.reason===`automatic_ready`||e.reason===`domain_connect_ready`||e.reason===`manual_only`,r=e.enabled?e.status===`operational`:e.status===`unavailable`;(e.enabled!==n||!r)&&t.addIssue({code:`custom`,path:[`enabled`],message:`Enabled, status, and reason must describe the same provider health state`})}).meta({id:`ProviderHealth`}),ye=e.z.object({observedAt:c,refreshAfter:c,providers:e.z.array(C)}).strict().superRefine((e,t)=>{Date.parse(e.refreshAfter)<=Date.parse(e.observedAt)&&t.addIssue({code:`custom`,path:[`refreshAfter`],message:`Provider health refresh deadline must be after its observation time`});let n=e.providers.map(e=>e.providerId);new Set(n).size!==n.length&&t.addIssue({code:`custom`,path:[`providers`],message:`Provider health entries must have unique provider IDs`})}).meta({id:`ProviderHealthResponse`}),w=e.z.enum([`requested`,`detecting_provider`,`provider_selected`,`domain_connect_pending`,`authorization_pending`,`authorized`,`planning`,`awaiting_confirmation`,`applying`,`propagation_pending`,`active`,`manual_required`,`failed_retryable`,`failed_terminal`,`cancelled`]).meta({id:`ConnectionState`}),be=e.z.enum([`authorized`,`awaiting_confirmation`,`applying`]).meta({id:`RetryResumeState`}),xe=e.z.enum([`provider_snapshot_timeout`,`provider_apply_timeout`]).meta({id:`ConnectionFailureCode`}),T=e.z.object({code:xe,retryable:e.z.literal(!0),resumeState:be,occurredAt:c}).strict().meta({id:`ConnectionFailure`}),Se=e.z.enum([`spf_policy_replaced`,`spf_policy_merged`]).meta({id:`PlanWarningCode`}),Ce=e.z.object({digest:e.z.string().regex(/^[a-f0-9]{64}$/),changes:e.z.array(se).min(1),warnings:e.z.array(Se),expiresAt:c}).strict().meta({id:`ChangePlan`}),E=e.z.object({id:n,applicationId:r,tenantId:i,intent:y,effectiveIntent:b.optional(),state:w,provider:S.optional(),plan:Ce.optional(),failure:T.optional(),optionalFailures:e.z.array(e.z.string()),createdAt:c,updatedAt:c}).strict().superRefine((e,t)=>{let n=e.state===`failed_retryable`;n!==(e.failure!==void 0)&&t.addIssue({code:`custom`,path:[`failure`],message:n?`A retryable failure state requires failure details`:`Failure details are allowed only in a retryable failure state`}),e.effectiveIntent!==void 0&&e.effectiveIntent.domain!==e.intent.domain&&t.addIssue({code:`custom`,path:[`effectiveIntent`,`domain`],message:`Effective intent must use the requested intent domain`})}).meta({id:`Connection`}),we=e.z.object({applicationId:r,tenantId:i,intent:y,commandId:o}).strict().meta({id:`CreateConnectionInput`}),Te=e.z.object({connection:E}).strict().meta({id:`ConnectionResponse`}),Ee=Te,De=e.z.object({provider:S,confidence:e.z.number().min(0).max(1)}).strict().meta({id:`ProviderCandidate`}),Oe=e.z.object({connection:E,candidates:e.z.array(De)}).strict().meta({id:`DetectProviderResponse`}),ke=e.z.object({providerId:a,commandId:o}).strict().meta({id:`SelectProviderInput`}),D=e.z.string().regex(/^[A-Za-z0-9._-]{1,63}$/),Ae=e.z.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,62}$/),je=new Set([`domain`,`host`,`groupId`,`providerName`,`serviceName`,`instanceId`,`redirect_uri`,`state`,`sig`,`key`]),Me=e.z.record(Ae,e.z.string().min(1).max(4096).refine(e=>e.trim()===e&&!/[\u0000\r\n]/.test(e),`Domain Connect property values must be trimmed and single-line`)).refine(e=>Object.keys(e).length<=64,`At most 64 Domain Connect properties are allowed`).refine(e=>Object.keys(e).every(e=>!je.has(e)),`Domain Connect properties must not override reserved protocol parameters`),Ne=e.z.object({serviceProviderId:D,serviceId:D,host:e.z.string().max(253).regex(/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/).optional(),groupId:D.optional(),providerName:e.z.string().trim().min(1).max(200).optional(),serviceName:e.z.string().trim().min(1).max(200).optional(),instanceId:D.optional(),properties:Me}).strict().meta({id:`DomainConnectTemplate`}),Pe=Ne.extend({commandId:o}).strict().meta({id:`StartDomainConnectInput`}),Fe=e.z.url({protocol:/^https$/}).refine(e=>{let t=new URL(e);return t.username===``&&t.password===``&&t.hash===``},`Domain Connect handoff URL must be HTTPS without credentials or a fragment`),Ie=e.z.object({connection:E,handoffUrl:Fe}).strict().meta({id:`StartDomainConnectResponse`}),Le=e.z.object({commandId:o}).strict().meta({id:`SubmitDomainConnectCompletionInput`}),Re=e.z.object({digest:e.z.string().regex(/^[a-f0-9]{64}$/),allowDestructive:e.z.boolean(),commandId:o}).strict().meta({id:`ConfirmPlanInput`}),ze=e.z.object({commandId:o}).strict().meta({id:`StartOAuthInput`}),Be=e.z.object({connection:E,authorizationUrl:e.z.url({protocol:/^https$/}),expiresAt:c}).strict().meta({id:`StartOAuthResponse`}),O=e.z.string().min(1).max(16384).refine(e=>e.trim()===e,`Credential values must not have leading or trailing whitespace`).meta({format:`password`,writeOnly:!0}),k=e.z.object({kind:e.z.literal(`api_token`),token:O}).strict().meta({id:`ApiTokenCredentials`}),A=e.z.object({kind:e.z.literal(`access_key`),keyId:O,secret:O}).strict().meta({id:`AccessKeyCredentials`}),j=e.z.object({kind:e.z.literal(`username_password`),username:O,password:O}).strict().meta({id:`UsernamePasswordCredentials`}),M=e.z.object({kind:e.z.literal(`account_token`),accountId:O,token:O}).strict().meta({id:`AccountTokenCredentials`}),N=e.z.object({kind:e.z.literal(`username_token`),username:O,token:O}).strict().meta({id:`UsernameTokenCredentials`}),P=e.z.object({kind:e.z.literal(`ovh`),endpoint:e.z.enum([`ovh-eu`,`ovh-us`,`ovh-ca`,`kimsufi-eu`,`kimsufi-ca`,`soyoustart-eu`,`soyoustart-ca`]),applicationKey:O,applicationSecret:O,consumerKey:O}).strict().meta({id:`OvhCredentials`}),F=e.z.object({kind:e.z.literal(`private_key`),login:O,privateKey:O.refine(e=>/^(-----BEGIN (?:RSA )?PRIVATE KEY-----)[\s\S]+(-----END (?:RSA )?PRIVATE KEY-----)$/.test(e),`A PKCS#8 or PKCS#1 PEM private key is required`)}).strict().meta({id:`PrivateKeyCredentials`}),Ve=e.z.object({kind:e.z.literal(`aws_session`),keyId:O.regex(/^[A-Z0-9]{16,128}$/),secret:O,sessionToken:O,hostedZoneId:e.z.string().regex(/^Z[A-Z0-9]{1,63}$/),expiresAt:c}).strict().meta({id:`AwsSessionCredentials`}),He=e.z.url({protocol:/^https$/}).refine(e=>{let t=new URL(e);return t.port===`2083`&&t.username===``&&t.password===``&&(t.pathname===``||t.pathname===`/`)&&t.search===``&&t.hash===``},`cPanel endpoint must be an HTTPS origin on port 2083`),I=e.z.object({kind:e.z.literal(`cpanel`),endpoint:He,username:O,token:O}).strict().meta({id:`CPanelCredentials`}),Ue=e.z.object({kind:e.z.literal(`client_credentials`),clientId:O,clientSecret:O}).strict().meta({id:`ClientCredentials`});function L(t,n){return e.z.object({providerId:e.z.literal(t),credentials:n,commandId:o}).strict()}const We=[L(`alibaba-cloud`,A),L(`all-inkl`,j),L(`amazon-route-53`,Ve),L(`cloudflare`,k),L(`cloudns`,M),L(`digitalocean`,k),L(`dnsimple`,M),L(`dreamhost`,k),L(`dynadot`,A),L(`easydns`,A),L(`gandi`,k),L(`godaddy`,k),L(`hetzner`,k),L(`hostgator`,I),L(`hostinger`,k),L(`hosting-com`,I),L(`inmotion-hosting`,I),L(`ionos`,k),L(`name-com`,N),L(`namesilo`,k),L(`netlify`,k),L(`o2switch`,I),L(`openprovider`,k),L(`opensrs`,Ue),L(`ovh`,P),L(`porkbun`,A),L(`simply`,k),L(`spaceship`,A),L(`transip`,F),L(`united-domains`,k),L(`vercel`,k),L(`wix`,M)],Ge=Object.freeze(Object.fromEntries(We.map(e=>[e.shape.providerId.value,e.shape.credentials.shape.kind.value]))),Ke=e.z.discriminatedUnion(`providerId`,We).meta({id:`AuthorizeWithCredentialInput`}),qe=e.z.object({completed:e.z.literal(!0)}).strict().meta({id:`OAuthCallbackResponse`}),Je=e.z.object({conflictPolicy:ie,spfPolicy:ae.default(`merge`),commandId:o}).strict().meta({id:`PreparePlanInput`}),Ye=e.z.object({commandId:o}).strict().meta({id:`ApplyPlanInput`}),Xe=e.z.object({commandId:o}).strict().meta({id:`VerifyPropagationInput`}),Ze=e.z.object({commandId:o}).strict().meta({id:`StartManualConfigurationInput`}),Qe=e.z.object({commandId:o}).strict().meta({id:`SubmitManualCompletionInput`}),$e=e.z.object({commandId:o}).strict().meta({id:`CancelConnectionInput`}),et=e.z.object({commandId:o}).strict().meta({id:`RetryConnectionInput`}),tt=e.z.object({origin:e.z.url().refine(e=>{let t=new URL(e);return t.username===``&&t.password===``&&t.search===``&&t.hash===``&&(t.pathname===``||t.pathname===`/`)&&(t.protocol===`https:`||t.protocol===`http:`&&rt(t.hostname))},`Origin must be an HTTPS origin without a path, query, or fragment`)}).strict().meta({id:`IssueConnectionTokenInput`}),nt=e.z.object({accessToken:e.z.string().min(1).max(8192),tokenType:e.z.literal(`Bearer`),expiresAt:c}).strict().meta({id:`IssueConnectionTokenResponse`});function rt(e){return e===`localhost`||e===`127.0.0.1`||e===`[::1]`}const it=e.z.string().trim().min(1).max(200).meta({id:`ConnectionFlowId`}),at=e.z.strictObject({domain:e.z.array(_).min(1).max(100),subDomain:e.z.array(_).min(1).max(100).optional(),rootNS:e.z.array(_).min(1).max(100).optional()}).superRefine((e,t)=>{e.rootNS?.forEach((e,n)=>{(e.host!==`@`||e.type!==`NS`)&&t.addIssue({code:`custom`,path:[`rootNS`,n],message:`rootNS accepts only NS records at the zone apex`})})}).meta({id:`ConditionalDnsRecords`}),ot=e.z.strictObject({domain:s,records:e.z.array(_).min(1).max(100)}),st=e.z.strictObject({domain:s,conditionalRecords:at}),ct=e.z.union([ot,st]).meta({id:`ConnectionFlowTargetInput`}),lt=e.z.strictObject({applicationId:r,tenantId:i,existingRecordPolicy:v.default({validateDmarc:!1,validateCAA:!1}),targets:e.z.array(ct).min(2).max(100).superRefine((e,t)=>{let n=new Set;e.forEach((e,r)=>{n.has(e.domain)&&t.addIssue({code:`custom`,path:[r,`domain`],message:`Flow target domains must be unique`}),n.add(e.domain)})}),commandId:o}).meta({id:`CreateConnectionFlowInput`}),ut=e.z.strictObject({domain:s,state:e.z.enum([`pending`,`provisioned`]),connectionId:n.optional()}).superRefine((e,t)=>{e.state===`provisioned`!=(e.connectionId!==void 0)&&t.addIssue({code:`custom`,path:[`connectionId`],message:e.state===`provisioned`?`A provisioned target requires a connection id`:`A pending target cannot have a connection id`})}).meta({id:`ConnectionFlowTarget`}),dt=e.z.strictObject({id:it,applicationId:r,tenantId:i,state:e.z.enum([`provisioning`,`ready`]),targets:e.z.array(ut).min(2).max(100),createdAt:c,updatedAt:c}).superRefine((e,t)=>{let n=e.targets.every(e=>e.state===`provisioned`);e.state===`ready`!==n&&t.addIssue({code:`custom`,path:[`state`],message:`Flow state must match target provisioning state`})}).meta({id:`ConnectionFlow`}),ft=e.z.strictObject({flow:dt}).meta({id:`ConnectionFlowResponse`}),R=e.z.enum([`invalid_request`,`unauthorized`,`forbidden`,`not_found`,`conflict`,`rate_limited`,`dns_unavailable`,`provider_unavailable`,`provider_authorization_failed`,`provider_limitation`,`plan_expired`,`propagation_pending`,`internal_error`]).meta({id:`Domain0ErrorCode`}),pt=e.z.object({error:e.z.object({code:R,message:e.z.string().min(1),requestId:e.z.string().min(1),retryable:e.z.boolean(),details:e.z.record(e.z.string(),e.z.unknown()).optional()}).strict()}).strict().meta({id:`ErrorResponse`}),z=e.z.string().min(1).max(200).brand(),B=e.z.string().regex(/^[A-Za-z0-9_-]{43}$/).brand(),mt=e.z.strictObject({connectionId:n,expiresAt:c}),ht=e.z.strictObject({sharedFlowId:z,token:B,expiresAt:c}),gt=e.z.strictObject({token:B,origin:e.z.string().url().max(2048)}),_t=e.z.strictObject({sharedFlowId:z,connectionId:n,accessToken:e.z.string().min(1).max(8192),expiresAt:c}),vt=e.z.string().url().max(4096),V=vt.superRefine((e,t)=>{let n=new URL(e),r=n.protocol===`https:`,i=n.protocol===`http:`&&bt(n.hostname);!r&&!i&&t.addIssue({code:`custom`,message:`Shared-flow invitation URLs must use HTTPS, except on loopback development hosts`}),(n.username!==``||n.password!==``)&&t.addIssue({code:`custom`,message:`Shared-flow invitation URLs cannot contain user information`});let a=new URLSearchParams(n.hash.slice(1)),o=a.get(`domain0`);(a.size!==1||!B.safeParse(o).success)&&t.addIssue({code:`custom`,message:`Shared-flow invitation URLs require one valid domain0 capability in the fragment`})}).meta({id:`SharedFlowInvitationUrl`}),yt=e.z.object({sharedFlowId:z,url:V,expiresAt:c}).strict().meta({id:`SharedFlowInvitation`});function bt(e){let t=e.toLowerCase();return t===`localhost`||t===`[::1]`||/^127(?:\.[0-9]{1,3}){3}$/.test(t)}const H=e.z.string().trim().toLowerCase().min(1).max(63).regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/).brand().meta({id:`DkimSelector`}),xt=e.z.object({selectors:e.z.array(H).max(10).default([])}).strict().superRefine((e,t)=>{new Set(e.selectors).size!==e.selectors.length&&t.addIssue({code:`custom`,path:[`selectors`],message:`DKIM selectors must be unique`})}).meta({id:`DkimGuidanceInput`}),St=e.z.object({enableDkim:e.z.boolean().default(!1),dkimSelectors:e.z.array(H).max(10).default([])}).strict().superRefine((e,t)=>{new Set(e.dkimSelectors).size!==e.dkimSelectors.length&&t.addIssue({code:`custom`,path:[`dkimSelectors`],message:`DKIM selectors must be unique`})}).meta({id:`Domain0DkimGuidanceOptions`}),Ct=e.z.object({id:e.z.literal(`google_workspace`),name:e.z.literal(`Google Workspace`),guideUrl:e.z.literal(`https://support.google.com/a/answer/174124`)}).strict(),wt=e.z.object({id:e.z.literal(`microsoft_365`),name:e.z.literal(`Microsoft 365`),guideUrl:e.z.literal(`https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure`)}).strict(),Tt=e.z.object({id:e.z.literal(`zoho_mail`),name:e.z.literal(`Zoho Mail`),guideUrl:e.z.literal(`https://www.zoho.com/mail/help/adminconsole/dkim-configuration.html`)}).strict(),U=e.z.discriminatedUnion(`id`,[Ct,wt,Tt]).meta({id:`EmailProvider`}),Et=e.z.enum([`detected`,`ambiguous`,`unknown`]).meta({id:`EmailProviderDetectionStatus`}),Dt=e.z.enum([`TXT`,`CNAME`]).meta({id:`DkimDnsRecordType`}),Ot=e.z.enum([`record_observed`,`no_record_observed`,`not_checked`,`lookup_unavailable`]).meta({id:`DkimDnsEvidenceStatus`}),kt=e.z.object({selector:H,types:e.z.array(Dt).min(1).max(2).refine(e=>new Set(e).size===e.length,`Observed DKIM DNS record types must be unique`)}).strict().meta({id:`DkimDnsRecordEvidence`}),At=e.z.object({status:Ot,selectorsChecked:e.z.array(H).max(12).refine(e=>new Set(e).size===e.length,`Checked DKIM selectors must be unique`),records:e.z.array(kt).max(12)}).strict().superRefine((e,t)=>{let n=new Set(e.selectorsChecked);e.records.some(e=>!n.has(e.selector))&&t.addIssue({code:`custom`,path:[`records`],message:`Observed records must belong to checked selectors`}),e.status===`not_checked`&&(e.selectorsChecked.length!==0||e.records.length!==0)&&t.addIssue({code:`custom`,path:[`status`],message:`Not-checked evidence cannot include selector observations`}),e.status===`record_observed`&&e.records.length===0&&t.addIssue({code:`custom`,path:[`records`],message:`Observed status requires at least one DNS record`}),e.status!==`record_observed`&&e.records.length!==0&&t.addIssue({code:`custom`,path:[`records`],message:`Only observed status can include DNS records`}),[`no_record_observed`,`lookup_unavailable`].includes(e.status)&&e.selectorsChecked.length===0&&t.addIssue({code:`custom`,path:[`selectorsChecked`],message:`A DNS lookup status requires at least one checked selector`})}).meta({id:`DkimDnsEvidence`}),jt=e.z.object({domain:s,detectionStatus:Et,candidates:e.z.array(U).max(3),provider:U.optional(),mxHosts:e.z.array(s).max(20).refine(e=>new Set(e).size===e.length,`MX hosts must be unique`),dkimDns:At,observedAt:c}).strict().superRefine((e,t)=>{let n=e.candidates.map(e=>e.id);new Set(n).size!==n.length&&t.addIssue({code:`custom`,path:[`candidates`],message:`Email provider candidates must be unique`}),e.detectionStatus===`detected`&&(e.candidates.length!==1||e.provider?.id!==e.candidates[0]?.id)&&t.addIssue({code:`custom`,path:[`provider`],message:`Detected status requires exactly one matching provider`}),e.detectionStatus===`ambiguous`&&(e.candidates.length<2||e.provider!==void 0)&&t.addIssue({code:`custom`,path:[`candidates`],message:`Ambiguous status requires multiple candidates and no resolved provider`}),e.detectionStatus===`unknown`&&(e.candidates.length!==0||e.provider!==void 0)&&t.addIssue({code:`custom`,path:[`candidates`],message:`Unknown status cannot include an email provider`})}).meta({id:`DkimGuidanceResponse`}),W=e.z.union([e.z.enum([`loading`,`provider_detection`,`provider_selection`,`cancellation_confirmation`]),w]).meta({id:`Domain0ConnectStep`}),Mt=e.z.enum([`close_button`,`escape`,`programmatic`,`destroyed`,`automatic`]).meta({id:`Domain0ConnectCloseTrigger`}),Nt=e.z.enum([`success`,`failure`,`cancelled`,`incomplete`]).meta({id:`Domain0ConnectOutcome`}),G=E.and(e.z.object({state:e.z.literal(`active`)})),Pt=E.and(e.z.object({state:e.z.literal(`manual_required`)})),Ft=e.z.union([E.and(e.z.object({state:e.z.literal(`failed_retryable`),failure:T})),E.and(e.z.object({state:e.z.literal(`failed_terminal`),failure:e.z.undefined().optional()}))]),K=e.z.discriminatedUnion(`source`,[e.z.object({source:e.z.literal(`configuration`),code:e.z.literal(`invalid_configuration`),retryable:e.z.literal(!1)}).strict(),e.z.object({source:e.z.literal(`api`),code:R,retryable:e.z.boolean(),requestId:e.z.string().min(1)}).strict(),e.z.object({source:e.z.literal(`transport`),code:e.z.literal(`transport_error`),retryable:e.z.literal(!0)}).strict(),e.z.object({source:e.z.literal(`protocol`),code:e.z.literal(`protocol_error`),retryable:e.z.literal(!1)}).strict(),e.z.object({source:e.z.literal(`unexpected`),code:e.z.literal(`unexpected_error`),retryable:e.z.literal(!1)}).strict()]).meta({id:`Domain0ConnectError`}),It=e.z.object({type:e.z.literal(`success`),connection:G}).strict().meta({id:`Domain0ConnectSuccessEvent`}),Lt=e.z.object({type:e.z.literal(`failure`),connection:Ft}).strict().meta({id:`Domain0ConnectFailureEvent`}),Rt=e.z.object({type:e.z.literal(`error`),error:K,connection:E.optional(),step:W.optional()}).strict().meta({id:`Domain0ConnectErrorEvent`}),zt=e.z.object({type:e.z.literal(`close`),trigger:Mt,outcome:Nt,connection:E.optional(),step:W.optional(),error:K.optional()}).strict().superRefine((e,t)=>{let n=Kt(e.connection,e.error);e.outcome!==n&&t.addIssue({code:`custom`,path:[`outcome`],message:`Close outcome must be ${n} for the supplied connection and error`})}).meta({id:`Domain0ConnectCloseEvent`}),Bt=e.z.object({type:e.z.literal(`step_change`),step:W,previousStep:W.optional(),connection:E.optional()}).strict().meta({id:`Domain0ConnectStepChangeEvent`}),Vt=e.z.object({type:e.z.literal(`manual_setup_documentation_click`),connection:Pt}).strict().meta({id:`Domain0ManualSetupDocumentationClickEvent`}),Ht=e.z.object({type:e.z.literal(`request_close`),connection:E.optional(),step:W}).strict().meta({id:`Domain0RequestCloseEvent`}),Ut=e.z.object({type:e.z.literal(`shared_flow_sent`),connection:Pt,sharedFlowId:z,url:V,expiresAt:c}).strict().meta({id:`Domain0SharedFlowSentEvent`}),Wt=e.z.object({type:e.z.literal(`dkim_setup_documentation_click`),connection:G,emailProvider:U}).strict().meta({id:`Domain0DkimSetupDocumentationClickEvent`}),Gt=e.z.discriminatedUnion(`type`,[It,Lt,Rt,zt,Bt,Vt,Ht,Ut,Wt]).meta({id:`Domain0ConnectEvent`});function Kt(e,t){return e?.state===`active`?`success`:t!==void 0||e?.state===`failed_retryable`||e?.state===`failed_terminal`?`failure`:e?.state===`cancelled`?`cancelled`:`incomplete`}const qt=e.z.object({mode:e.z.enum([`automatic`,`manual`]).default(`automatic`)}).strict(),Jt=/^#[0-9A-F]{6}$/,Yt=/^#[0-9A-F]{8}$/,q=e.z.string().trim().toUpperCase().regex(Jt,`Expected an opaque #RRGGBB color`),Xt=e.z.string().trim().toUpperCase().regex(Yt,`Expected a #RRGGBBAA backdrop color`),Zt=e.z.string().trim().min(1).max(500).refine(e=>!/[<>\u0000-\u001F\u007F]/.test(e),`White-label copy must be plain text without markup or control characters`),Qt=Zt.max(120).meta({id:`Domain0ApplicationName`}),$t=e.z.string().trim().min(1).max(2048).refine(e=>{try{let t=new URL(e);return t.protocol===`https:`&&t.username===``&&t.password===``}catch{return!1}},`Logo must be an HTTPS URL without embedded credentials`).meta({id:`Domain0WhiteLabelLogoUrl`});function J(...e){return Zt.refine(t=>{let n=e.reduce((e,t)=>e.replaceAll(t,``),t);return!/[{}]/.test(n)},`Only these placeholders are allowed: ${e.join(`, `)||`none`}`)}function Y(t){let n=e.z.object({en:t,es:t.optional(),pt:t.optional(),"pt-br":t.optional(),"pt-pt":t.optional(),fr:t.optional(),it:t.optional(),de:t.optional(),nl:t.optional(),pl:t.optional(),tr:t.optional(),ja:t.optional(),da:t.optional(),sv:t.optional()}).strict();return e.z.union([t.transform(e=>({en:e})),n])}function en(e,t){return tn(q.parse(e),q.parse(t))}function tn(e,t){let n=rn(e),r=rn(t),i=Math.max(n,r),a=Math.min(n,r);return(i+.05)/(a+.05)}function nn(e){let t=e.split(`,`);return t.length<=10&&t.every(e=>{let t=e.trim();if(t.length===0)return!1;let n=t.at(0);return n===`"`||n===`'`?t.at(-1)===n&&/^[A-Za-z0-9 -]+$/.test(t.slice(1,-1)):/^-?[A-Za-z][A-Za-z0-9 -]*$/.test(t)})}function rn(e){let[t,n,r]=[1,3,5].map(t=>Number.parseInt(e.slice(t,t+2),16)/255).map(e=>e<=.04045?e/12.92:((e+.055)/1.055)**2.4);return .2126*t+.7152*n+.0722*r}const an=[{foreground:`text`,background:`surface`,minimum:4.5,purpose:`body text`},{foreground:`mutedText`,background:`surface`,minimum:4.5,purpose:`secondary text`},{foreground:`onPrimary`,background:`primary`,minimum:4.5,purpose:`primary control text`},{foreground:`danger`,background:`surface`,minimum:4.5,purpose:`error text`},{foreground:`onDanger`,background:`danger`,minimum:4.5,purpose:`danger control text`},{foreground:`link`,background:`surface`,minimum:4.5,purpose:`link text`},{foreground:`border`,background:`surface`,minimum:3,purpose:`control boundaries`},{foreground:`primary`,background:`surface`,minimum:3,purpose:`primary control boundaries`},{foreground:`focus`,background:`surface`,minimum:3,purpose:`focus indicators`}],on={surface:`#FFFFFF`,text:`#0A0A0A`,mutedText:`#6B6B6B`,border:`#73737C`,primary:`#0A0A0A`,onPrimary:`#FFFFFF`,link:`#2B21FF`,focus:`#2B21FF`,danger:`#B3261E`,onDanger:`#FFFFFF`},sn={surface:`#111827`,text:`#F9FAFB`,mutedText:`#D1D5DB`,border:`#D1D5DB`,primary:`#BFDBFE`,onPrimary:`#172554`,link:`#BFDBFE`,focus:`#FBBF24`,danger:`#FCA5A5`,onDanger:`#450A0A`};function cn(t){return e.z.object({surface:q.default(t.surface),text:q.default(t.text),mutedText:q.default(t.mutedText),border:q.default(t.border),primary:q.default(t.primary),onPrimary:q.default(t.onPrimary),link:q.default(t.link),focus:q.default(t.focus),danger:q.default(t.danger),onDanger:q.default(t.onDanger)}).strict().superRefine((e,t)=>{for(let n of an){let r=tn(e[n.foreground],e[n.background]);r<n.minimum&&t.addIssue({code:`custom`,path:[n.foreground],message:`${n.purpose} requires ${n.minimum}:1 contrast against ${n.background}; received ${r.toFixed(2)}:1`})}})}const ln=cn(on),un=cn(sn),dn=e.z.object({colorMode:e.z.enum([`light`,`dark`,`system`]).default(`light`),light:ln.prefault({}),dark:un.prefault({}),backdrop:Xt.default(`#2B21FF26`),widthPx:e.z.number().int().min(320).max(960).default(520),dialogRadiusPx:e.z.number().int().min(0).max(48).default(20),buttonRadiusPx:e.z.number().int().min(0).max(999).default(999),inputRadiusPx:e.z.number().int().min(0).max(32).default(12),fontFamily:e.z.string().trim().min(1).max(200).refine(nn,`Use a comma-separated system font stack without URLs or CSS syntax`).default(`"PP Neue Montreal", "Inter Tight", ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif`),fontWeight:e.z.number().int().min(100).max(900).multipleOf(50).default(400),boldFontWeight:e.z.number().int().min(100).max(900).multipleOf(50).default(500)}).strict().superRefine((e,t)=>{e.boldFontWeight<e.fontWeight&&t.addIssue({code:`custom`,path:[`boldFontWeight`],message:`Bold font weight must be at least the normal font weight`})}),fn=e.z.object({initialSubtitle:Y(J()).optional(),providerLoginMessage:Y(J(`{PROVIDER}`)).optional(),successTitle:Y(J(`{DOMAIN}`)).optional(),successDescription:Y(J(`{DOMAIN}`)).optional(),successButton:Y(J()).optional(),manuallyScreen:e.z.object({disableManualSetupDocumentationLink:e.z.boolean().default(!1),stepByStepGuide:Y(J()).optional()}).strict().prefault({})}).strict(),pn=e.z.object({disable:e.z.boolean().default(!1)}).strict(),mn=e.z.object({manualConfiguration:e.z.object({disableScreen:e.z.boolean().default(!1)}).strict().prefault({}),providerLogin:e.z.object({forwardLink:pn.prefault({}),gotoManualLink:pn.prefault({})}).strict().prefault({})}).strict(),hn=e.z.object({theme:dn.prefault({}),copy:fn.prefault({}),logo:$t.optional(),logoBackgroundColor:q.optional(),removeLogoBorder:e.z.boolean().default(!1),hideCompanyLogo:e.z.boolean().default(!1),hideCompanyName:e.z.boolean().default(!1),removeShareLogin:e.z.boolean().default(!1),skipCongratulationsScreen:e.z.boolean().default(!1),customProperties:mn.prefault({})}).strict(),gn=e.z.url({protocol:/^https$/}).max(2048).refine(e=>{let t=new URL(e);return t.username===``&&t.password===``},`Manual setup documentation URL must not contain credentials`).brand().meta({id:`ManualSetupDocumentationUrl`}),_n=e.z.object({applicationName:Qt.optional(),whiteLabel:hn.prefault({}),setupPolicy:qt.prefault({}),dkim:St.prefault({}),manualSetupDocumentation:gn.optional()}).strict().superRefine((e,t)=>{let{customProperties:n}=e.whiteLabel,r=e.setupPolicy.mode===`manual`;r&&n.manualConfiguration.disableScreen&&t.addIssue({code:`custom`,path:[`whiteLabel`,`customProperties`,`manualConfiguration`,`disableScreen`],message:`Forced manual setup requires the manual configuration screen`}),r&&n.providerLogin.gotoManualLink.disable&&t.addIssue({code:`custom`,path:[`whiteLabel`,`customProperties`,`providerLogin`,`gotoManualLink`,`disable`],message:`Forced manual setup cannot disable entry into manual configuration`}),e.dkim.enableDkim&&e.whiteLabel.skipCongratulationsScreen&&t.addIssue({code:`custom`,path:[`whiteLabel`,`skipCongratulationsScreen`],message:`DKIM guidance requires the success screen`})}).meta({id:`Domain0ConnectConfiguration`}),vn=e.z.enum(`alibaba-cloud.all-inkl.amazon-route-53.cloudflare.cloudns.digitalocean.dnsimple.dreamhost.dynadot.easydns.gandi.godaddy.hetzner.hostgator.hostinger.hosting-com.inmotion-hosting.ionos.name-com.namecheap.namesilo.netlify.o2switch.openprovider.opensrs.ovh.porkbun.simply.spaceship.transip.united-domains.vercel.wix`.split(`.`)).meta({id:`CompiledProviderId`}),yn=e.z.enum([`authenticated_snapshot`,`reserved_name_available`,`create_sibling`,`create_target`,`rrset_sibling_preservation`,`idempotent_replay`,`replace_target`,`authoritative_propagation`,`delete_target`,`scoped_cleanup`]).meta({id:`ProviderConformanceCheckName`}),X=[`authenticated_snapshot`,`reserved_name_available`,`create_sibling`,`create_target`,`rrset_sibling_preservation`,`idempotent_replay`,`replace_target`,`authoritative_propagation`,`delete_target`,`scoped_cleanup`],bn=e.z.object({name:yn}).strict(),xn=e.z.union([e.z.literal(`unknown`),e.z.string().regex(/^[a-f0-9]{40,64}$/)]),Sn=e.z.object({schemaVersion:e.z.literal(1),providerId:vn,adapterVersion:e.z.string().min(1).max(200).refine(Tn),sourceRevision:xn,sourceModified:e.z.boolean(),binarySha256:e.z.string().regex(/^[a-f0-9]{64}$/),zone:s,runId:e.z.string().regex(/^[a-f0-9]{16,64}$/),host:e.z.string(),startedAt:c,completedAt:c,passed:e.z.boolean(),checks:e.z.array(bn).max(X.length),cleanupAttempted:e.z.boolean(),cleanupCompleted:e.z.boolean()}).strict().superRefine((e,t)=>{e.host!==`_domain0-conformance-${e.runId}`&&t.addIssue({code:`custom`,path:[`host`],message:`Conformance hostname must be derived from the random run ID`}),Date.parse(e.completedAt)<Date.parse(e.startedAt)&&t.addIssue({code:`custom`,path:[`completedAt`],message:`Conformance completion must not precede its start`});let n=e.checks.map(e=>e.name);wn(n)||t.addIssue({code:`custom`,path:[`checks`],message:`Conformance checks must be an ordered prefix followed optionally by scoped cleanup`});let r=n.includes(`scoped_cleanup`);(e.cleanupCompleted&&!e.cleanupAttempted||r!==e.cleanupCompleted)&&t.addIssue({code:`custom`,path:[`cleanupCompleted`],message:`Completed cleanup requires an attempted cleanup and the scoped-cleanup check`})}).meta({id:`ProviderConformanceEvidence`}),Cn=Sn.refine(e=>e.passed&&!e.sourceModified&&e.sourceRevision!==`unknown`&&e.cleanupAttempted&&e.cleanupCompleted&&e.checks.every((e,t)=>e.name===X[t])&&e.checks.length===X.length,`Verified live-suite evidence requires clean traceable source, every ordered check, and completed cleanup`).meta({id:`VerifiedProviderConformanceEvidence`});function wn(e){let t=0,n=!1;for(let r of e){if(r===`scoped_cleanup`){if(n)return!1;n=!0;continue}if(n||r!==X[t])return!1;t+=1}return!0}function Tn(e){return e.trim()===e&&!/[\u0000\r\n]/.test(e)}const En=e.z.enum([`delegated`,`undelegated`,`unknown`]).meta({id:`DomainDelegationStatus`}),Dn=e.z.enum([`automatic`,`manual`,`unavailable`,`ambiguous`,`unknown`]).meta({id:`DomainSetupSupport`}),On=e.z.enum([`same_name_and_type`,`cname_collision`,`mx_set_collision`,`spf_collision`,`ns_delegation`]).meta({id:`RecordConflictReason`}),kn=e.z.object({domain:s,records:e.z.array(g).max(100).default([]),checkConflicts:e.z.boolean().default(!1)}).strict().superRefine((e,t)=>{e.checkConflicts&&e.records.length===0&&t.addIssue({code:`custom`,path:[`records`],message:`Record conflict analysis requires at least one requested record`})}).meta({id:`CheckDomainInput`}),An=e.z.object({provider:S,confidence:e.z.number().min(0).max(1),exact:e.z.boolean()}).strict().meta({id:`DomainProviderCandidate`}),jn=e.z.object({requested:g,existing:e.z.array(g).max(1e3),reasons:e.z.array(On).min(1).max(5).refine(e=>new Set(e).size===e.length,`Conflict reasons must be unique`)}).strict().meta({id:`DomainRecordConflict`}),Mn=e.z.object({status:e.z.enum([`not_requested`,`complete`,`partial`]),authoritativeServers:e.z.number().int().min(0).max(16),respondingServers:e.z.number().int().min(0).max(16),conflicts:e.z.array(jn).max(100)}).strict().superRefine((e,t)=>{e.respondingServers>e.authoritativeServers&&t.addIssue({code:`custom`,path:[`respondingServers`],message:`Responding nameservers cannot exceed authoritative nameservers`}),e.status===`complete`&&e.respondingServers!==e.authoritativeServers&&t.addIssue({code:`custom`,path:[`status`],message:`Complete analysis requires every authoritative nameserver to respond`}),e.status===`partial`&&(e.respondingServers===0||e.respondingServers>=e.authoritativeServers)&&t.addIssue({code:`custom`,path:[`status`],message:`Partial analysis requires some but not all authoritative nameservers to respond`}),e.status===`not_requested`&&e.conflicts.length!==0&&t.addIssue({code:`custom`,path:[`conflicts`],message:`Conflict results cannot exist when analysis was not requested`})}).meta({id:`ConflictAnalysis`}),Nn=e.z.object({domain:s,delegationStatus:En,candidates:e.z.array(An).max(65),provider:S.optional(),setupSupport:Dn,conflictAnalysis:Mn}).strict().superRefine((e,t)=>{let n=e.candidates.map(e=>e.provider.id);new Set(n).size!==n.length&&t.addIssue({code:`custom`,path:[`candidates`],message:`Provider candidates must be unique`}),e.delegationStatus===`undelegated`&&(e.candidates.length!==0||e.provider!==void 0||e.setupSupport!==`unavailable`)&&t.addIssue({code:`custom`,path:[`delegationStatus`],message:`Undelegated domains cannot have provider support`}),e.provider!==void 0&&!e.candidates.some(t=>t.exact&&t.provider.id===e.provider?.id)&&t.addIssue({code:`custom`,path:[`provider`],message:`Resolved provider must be an exact provider candidate`}),[`automatic`,`manual`].includes(e.setupSupport)&&e.provider===void 0&&t.addIssue({code:`custom`,path:[`setupSupport`],message:`Available setup support requires a resolved provider`}),e.setupSupport===`automatic`&&!e.provider?.availableAuthorizationMethods.some(e=>e!==`manual`)&&t.addIssue({code:`custom`,path:[`setupSupport`],message:`Automatic setup requires a configured non-manual authorization method`}),e.setupSupport===`manual`&&(e.provider?.availableAuthorizationMethods.length!==1||e.provider.availableAuthorizationMethods[0]!==`manual`)&&t.addIssue({code:`custom`,path:[`setupSupport`],message:`Manual setup requires the manual authorization method`}),e.setupSupport===`ambiguous`&&e.candidates.length===0&&t.addIssue({code:`custom`,path:[`candidates`],message:`Ambiguous setup requires provider candidates`}),e.setupSupport===`unknown`&&e.candidates.length!==0&&t.addIssue({code:`custom`,path:[`candidates`],message:`Unknown setup cannot include provider candidates`}),[`ambiguous`,`unknown`].includes(e.setupSupport)&&e.provider!==void 0&&t.addIssue({code:`custom`,path:[`provider`],message:`Ambiguous or unknown support cannot resolve one provider`})}).meta({id:`CheckDomainResponse`}),Pn=[`en`,`es`,`pt`,`pt-br`,`pt-pt`,`fr`,`it`,`de`,`nl`,`pl`,`tr`,`ja`,`da`,`sv`],Fn=e.z.enum(Pn).meta({id:`Domain0Locale`}),In=e.z.strictObject({intent:y}).meta({id:`PlatformCreateConnectionInput`}),Ln=e.z.enum([`connection.requested`,`provider.detection_started`,`provider.selected`,`authorization.required`,`domain_connect.started`,`domain_connect.submitted`,`authorization.completed`,`connection.planning_started`,`connection.plan_prepared`,`connection.planning_restarted`,`connection.already_configured`,`connection.plan_confirmed`,`connection.changes_applied`,`connection.propagation_checked`,`connection.propagation_timed_out`,`connection.activated`,`connection.manual_required`,`connection.manual_submitted`,`connection.failed_retryable`,`connection.retry_started`,`connection.cancelled`]).meta({id:`Domain0WebhookEventType`}),Z=e.z.string().regex(/^[0-9a-f]{64}$/).brand().meta({id:`Domain0WebhookEventId`}),Rn=e.z.record(e.z.string().min(1).max(100),e.z.string().max(4e3)).superRefine((e,t)=>{Object.keys(e).length>64&&t.addIssue({code:`custom`,message:`Webhook attributes must contain at most 64 entries`})}).meta({id:`Domain0WebhookAttributes`}),zn=e.z.strictObject({schemaVersion:e.z.literal(1),eventId:Z,type:Ln,connectionId:n,applicationId:r,tenantId:i,sequence:e.z.number().int().positive().max(2**53-1),occurredAt:c,attributes:Rn}).meta({id:`Domain0WebhookEvent`}),Bn=e.z.enum([`invalid_headers`,`stale_timestamp`,`invalid_signature`,`invalid_payload`,`crypto_unavailable`]).meta({id:`Domain0WebhookVerificationErrorCode`});var Vn=class extends Error{code;name=`Domain0WebhookVerificationError`;constructor(e,t,n){super(t,n),this.code=e}};const Q={eventId:`x-domain0-event-id`,eventType:`x-domain0-event-type`,deliveryAttempt:`x-domain0-delivery-attempt`,schemaVersion:`x-domain0-schema-version`,signatureKeyId:`x-domain0-signature-key-id`,timestamp:`x-domain0-timestamp`,signature:`x-domain0-signature`},Hn=e.z.strictObject({eventId:Z,eventType:e.z.string().regex(/^domain0\.[a-z_]+\.[a-z_]+$/).max(100),deliveryAttempt:e.z.string().regex(/^[1-9][0-9]{0,8}$/).transform(Number),schemaVersion:e.z.literal(`1`),signatureKeyId:e.z.string().regex(/^[A-Za-z0-9._-]{1,64}$/),timestamp:e.z.string().regex(/^[0-9]{1,12}$/).transform(Number),signature:e.z.string().regex(/^v1=[0-9a-f]{64}$/)}),Un=new TextEncoder;async function Wn(e){let t=typeof e.body==`string`?Un.encode(e.body):new Uint8Array(e.body),n=Kn(e.maxBodyBytes??1048576,16777216);if(!(t instanceof Uint8Array)||t.byteLength===0||t.byteLength>n)throw $(`invalid_payload`,`Webhook body is empty or exceeds the configured limit`);let r=Gn(e.headers),i=qn(e.nowUnixSeconds??Math.floor(Date.now()/1e3),2**53-1),a=Kn(e.maxAgeSeconds??300,86400);if(Math.abs(i-r.timestamp)>a)throw $(`stale_timestamp`,`Webhook timestamp is outside the accepted replay window`);let o=Object.prototype.hasOwnProperty.call(e.secretKeyring,r.signatureKeyId)?e.secretKeyring[r.signatureKeyId]:void 0;if(!(o instanceof Uint8Array)||o.byteLength!==32)throw $(`invalid_signature`,`Webhook signature is invalid`);let s=e.crypto??globalThis.crypto;if(s?.subtle===void 0)throw $(`crypto_unavailable`,`Web Crypto is unavailable`);let c=Jn(r.signature.slice(3)),l=Un.encode(`v1.${r.signatureKeyId}.${r.timestamp}.`),u=new Uint8Array(l.byteLength+t.byteLength);u.set(l),u.set(t,l.byteLength);let d=await s.subtle.importKey(`raw`,new Uint8Array(o),{name:`HMAC`,hash:`SHA-256`},!1,[`verify`]);if(!await s.subtle.verify(`HMAC`,d,new Uint8Array(c),u))throw $(`invalid_signature`,`Webhook signature is invalid`);let f;try{let e=new TextDecoder(`utf-8`,{fatal:!0}).decode(t);f=JSON.parse(e)}catch(e){throw $(`invalid_payload`,`Verified webhook body is not valid UTF-8 JSON`,e)}let p=zn.safeParse(f);if(!p.success)throw $(`invalid_payload`,`Verified webhook body does not match schema version 1`,p.error);if(p.data.eventId!==r.eventId||`domain0.${p.data.type}`!==r.eventType||String(p.data.schemaVersion)!==r.schemaVersion)throw $(`invalid_payload`,`Verified webhook headers do not match the event body`);return p.data}function Gn(e){let t={eventId:void 0,eventType:void 0,deliveryAttempt:void 0,schemaVersion:void 0,signatureKeyId:void 0,timestamp:void 0,signature:void 0};if(`get`in e&&typeof e.get==`function`)for(let[n,r]of Object.entries(Q))t[n]=e.get(r)??void 0;else{let n=new Map;for(let e of Object.keys(Q))n.set(Q[e],e);let r=new Set;for(let[i,a]of Object.entries(e)){let e=i.toLowerCase(),o=n.get(e);if(o!==void 0){if(r.has(e)||typeof a!=`string`)throw $(`invalid_headers`,`Webhook headers are missing, duplicated, or malformed`);r.add(e),t[o]=a}}}let n=Hn.safeParse(t);if(!n.success)throw $(`invalid_headers`,`Webhook headers are missing, duplicated, or malformed`,n.error);return n.data}function Kn(e,t){if(!Number.isSafeInteger(e)||e<1||e>t)throw $(`invalid_headers`,`Webhook verification limits are invalid`);return e}function qn(e,t){if(!Number.isSafeInteger(e)||e<0||e>t)throw $(`invalid_headers`,`Webhook verification time is invalid`);return e}function Jn(e){let t=new Uint8Array(e.length/2);for(let n=0;n<e.length;n+=2)t[n/2]=Number.parseInt(e.slice(n,n+2),16);return t}function $(e,t,n){return new Vn(e,t,n===void 0?void 0:{cause:n})}exports.AccessKeyCredentialsSchema=A,exports.AccountTokenCredentialsSchema=M,exports.AdvancedDmarcOptionsSchema=m,exports.ApiTokenCredentialsSchema=k,exports.ApplicationIdSchema=r,exports.ApplyPlanInputSchema=Ye,exports.AuthorizationMethodSchema=fe,exports.AuthorizeWithCredentialInputSchema=Ke,exports.AwsSessionCredentialsSchema=Ve,exports.CPanelCredentialsSchema=I,exports.CancelConnectionInputSchema=$e,exports.ChangeActionSchema=oe,exports.ChangePlanSchema=Ce,exports.CheckDomainInputSchema=kn,exports.CheckDomainResponseSchema=Nn,exports.CheckRecordsInputSchema=te,exports.CheckRecordsResponseSchema=re,exports.CheckedRecordSchema=ne,exports.ClientCredentialsSchema=Ue,exports.CommandIdSchema=o,exports.CompiledProviderIdSchema=vn,exports.ConditionalDnsRecordsSchema=at,exports.ConfirmPlanInputSchema=Re,exports.ConflictAnalysisSchema=Mn,exports.ConflictPolicySchema=ie,exports.ConnectionFailureCodeSchema=xe,exports.ConnectionFailureSchema=T,exports.ConnectionFlowIdSchema=it,exports.ConnectionFlowResponseSchema=ft,exports.ConnectionFlowSchema=dt,exports.ConnectionFlowTargetInputSchema=ct,exports.ConnectionFlowTargetSchema=ut,exports.ConnectionIdSchema=n,exports.ConnectionSchema=E,exports.ConnectionStateSchema=w,exports.CreateConnectionFlowInputSchema=lt,exports.CreateConnectionInputSchema=we,exports.CreateConnectionResponseSchema=Te,exports.CreateSharedFlowInputSchema=mt,exports.CreateSharedFlowResponseSchema=ht,exports.DOMAIN0_WEBHOOK_HEADER_NAMES=Q,exports.DetectProviderResponseSchema=Oe,exports.DkimDnsEvidenceSchema=At,exports.DkimDnsEvidenceStatusSchema=Ot,exports.DkimDnsRecordEvidenceSchema=kt,exports.DkimDnsRecordTypeSchema=Dt,exports.DkimGuidanceInputSchema=xt,exports.DkimGuidanceResponseSchema=jt,exports.DkimSelectorSchema=H,exports.DnsIntentSchema=y,exports.DnsRecordSchema=_,exports.DnsRecordTypeSchema=d,exports.Domain0ApplicationNameSchema=Qt,exports.Domain0ConnectCloseEventSchema=zt,exports.Domain0ConnectCloseTriggerSchema=Mt,exports.Domain0ConnectConfigurationSchema=_n,exports.Domain0ConnectErrorEventSchema=Rt,exports.Domain0ConnectErrorSchema=K,exports.Domain0ConnectEventSchema=Gt,exports.Domain0ConnectFailureEventSchema=Lt,exports.Domain0ConnectOutcomeSchema=Nt,exports.Domain0ConnectStepChangeEventSchema=Bt,exports.Domain0ConnectStepSchema=W,exports.Domain0ConnectSuccessEventSchema=It,exports.Domain0DkimGuidanceOptionsSchema=St,exports.Domain0DkimSetupDocumentationClickEventSchema=Wt,exports.Domain0ErrorCodeSchema=R,exports.Domain0ErrorResponseSchema=pt,exports.Domain0LocaleSchema=Fn,exports.Domain0ManualSetupDocumentationClickEventSchema=Vt,exports.Domain0RequestCloseEventSchema=Ht,exports.Domain0SetupPolicySchema=qt,exports.Domain0SharedFlowSentEventSchema=Ut,exports.Domain0WebhookAttributesSchema=Rn,exports.Domain0WebhookEventIdSchema=Z,exports.Domain0WebhookEventSchema=zn,exports.Domain0WebhookEventTypeSchema=Ln,exports.Domain0WebhookVerificationError=Vn,exports.Domain0WebhookVerificationErrorCodeSchema=Bn,exports.Domain0WhiteLabelCopySchema=fn,exports.Domain0WhiteLabelCustomPropertiesSchema=mn,exports.Domain0WhiteLabelLogoUrlSchema=$t,exports.Domain0WhiteLabelSchema=hn,exports.Domain0WhiteLabelThemeSchema=dn,exports.DomainConnectTemplateSchema=Ne,exports.DomainDelegationStatusSchema=En,exports.DomainNameSchema=s,exports.DomainProviderCandidateSchema=An,exports.DomainRecordConflictSchema=jn,exports.DomainSetupSupportSchema=Dn,exports.EmailProviderDetectionStatusSchema=Et,exports.EmailProviderSchema=U,exports.ExistingRecordPolicySchema=v,exports.GetConnectionResponseSchema=Ee,exports.IsoDateTimeSchema=c,exports.IssueConnectionTokenInputSchema=tt,exports.IssueConnectionTokenResponseSchema=nt,exports.ListProvidersResponseSchema=ge,exports.ManualSetupDocumentationUrlSchema=gn,exports.OAuthCallbackResponseSchema=qe,exports.OvhCredentialsSchema=P,exports.PlanWarningCodeSchema=Se,exports.PlannedChangeSchema=se,exports.PlatformCreateConnectionInputSchema=In,exports.PreparePlanInputSchema=Je,exports.PrivateKeyCredentialsSchema=F,exports.ProviderCandidateSchema=De,exports.ProviderCapabilitiesSchema=pe,exports.ProviderConformanceCheckNameSchema=yn,exports.ProviderConformanceEvidenceSchema=Sn,exports.ProviderDetectionSchema=x,exports.ProviderDetectionUnavailableReasonCodeSchema=me,exports.ProviderHealthReasonSchema=ve,exports.ProviderHealthResponseSchema=ye,exports.ProviderHealthSchema=C,exports.ProviderHealthStatusSchema=_e,exports.ProviderIdSchema=a,exports.ProviderImplementationSchema=de,exports.ProviderSchema=S,exports.RecordConflictReasonSchema=On,exports.ResolveSharedFlowInputSchema=gt,exports.ResolveSharedFlowResponseSchema=_t,exports.ResolvedDnsIntentSchema=b,exports.ResolvedDnsRecordSchema=g,exports.RetryConnectionInputSchema=et,exports.RetryResumeStateSchema=be,exports.SelectProviderInputSchema=ke,exports.SharedFlowIdSchema=z,exports.SharedFlowInvitationSchema=yt,exports.SharedFlowInvitationUrlSchema=V,exports.SharedFlowTokenSchema=B,exports.SharedFlowUrlSchema=vt,exports.SpfConflictPolicySchema=ae,exports.StartDomainConnectInputSchema=Pe,exports.StartDomainConnectResponseSchema=Ie,exports.StartManualConfigurationInputSchema=Ze,exports.StartOAuthInputSchema=ze,exports.StartOAuthResponseSchema=Be,exports.SubmitDomainConnectCompletionInputSchema=Le,exports.SubmitManualCompletionInputSchema=Qe,exports.TenantIdSchema=i,exports.UsernamePasswordCredentialsSchema=j,exports.UsernameTokenCredentialsSchema=N,exports.VerifiedProviderConformanceEvidenceSchema=Cn,exports.VerifyPropagationInputSchema=Xe,exports.colorContrastRatio=en,exports.directCredentialKindByProvider=Ge,exports.domain0Locales=Pn,exports.expectedProviderConformanceChecks=X,exports.verifyDomain0Webhook=Wn;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("zod");const t=e.z.enum([`api_token`,`access_key`,`username_password`,`account_token`,`username_token`,`ovh`,`private_key`,`aws_session`,`cpanel`,`client_credentials`]).meta({id:`TransientCredentialKind`}),n=e.z.strictObject({directCredential:t.optional(),providerSession:t.optional()}).meta({id:`ProviderAuthorizationInputs`}),r=e.z.string().trim().min(1).max(200),i=r.brand().meta({id:`ConnectionId`}),a=r.brand().meta({id:`ApplicationId`}),o=r.brand().meta({id:`TenantId`}),s=e.z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).brand().meta({id:`ProviderId`}),c=r.brand().meta({id:`CommandId`}),l=e.z.string().trim().toLowerCase().overwrite(e=>e.replace(/\.$/,``)).min(3).max(253).regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/).refine(e=>!/^\d+(?:\.\d+){3}$/.test(e),`IP addresses are not domain names`).brand().meta({id:`DomainName`}),u=e.z.iso.datetime({offset:!0}).meta({id:`IsoDateTime`}),ee=e.z.string().trim().toLowerCase().overwrite(e=>e.replace(/\.$/,``)).min(1).max(253).refine(ue,`Host must be @ or a valid relative DNS name`),d=/^([0-9]{1,3})[\t ]+([A-Za-z0-9-]{1,15})[\t ]+(?:"([^\r\n"]*)"|([^\r\n"]+))$/,f=e.z.enum([`A`,`AAAA`,`CNAME`,`CAA`,`MX`,`TXT`,`NS`]).meta({id:`DnsRecordType`}),p=e.z.string().regex(/^[a-z]{1,32}$/),te=e.z.string().min(1).max(4096).refine(e=>e.trim()===e&&/^[\x20-\x3a\x3c-\x7e]+$/.test(e),{message:`DMARC tag values must be trimmed printable ASCII without semicolons`}),ne=e.z.record(p,te).refine(e=>Object.keys(e).length<=32,`At most 32 DMARC tags are allowed`),re=e.z.object({inheritRootDmarc:e.z.boolean().default(!1),overrideTags:ne.default({}),removeTags:e.z.array(p).max(32).refine(e=>new Set(e).size===e.length,`DMARC tags to remove must be unique`).default([]),addTagsIfNotExist:ne.default({})}).strict().refine(e=>e.inheritRootDmarc||Object.keys(e.overrideTags).length>0||e.removeTags.length>0||Object.keys(e.addTagsIfNotExist).length>0,`At least one advanced DMARC option is required`).superRefine((e,t)=>{for(let[n,r]of[[`overrideTags`,e.overrideTags],[`addTagsIfNotExist`,e.addTagsIfNotExist]])for(let[e,i]of Object.entries(r))fe(e,i)||t.addIssue({code:`custom`,path:[n,e],message:`Invalid value for the ${e} DMARC tag`})}).meta({id:`AdvancedDmarcOptions`}),ie=e.z.object({host:ee,type:f,value:e.z.string().trim().min(1).max(65535),ttl:e.z.number().int().min(1).max(2147483647).default(300),priority:e.z.number().int().min(0).max(65535).optional(),optional:e.z.boolean().default(!1)}).strict().superRefine((t,n)=>{if(t.type===`MX`&&t.priority===void 0&&n.addIssue({code:`custom`,path:[`priority`],message:`MX records require a priority`}),t.type!==`MX`&&t.priority!==void 0&&n.addIssue({code:`custom`,path:[`priority`],message:`Only MX records accept a priority`}),t.type===`A`&&!e.z.ipv4().safeParse(t.value).success&&n.addIssue({code:`custom`,path:[`value`],message:`A records require an IPv4 address`}),t.type===`AAAA`&&!e.z.ipv6().safeParse(t.value).success&&n.addIssue({code:`custom`,path:[`value`],message:`AAAA records require an IPv6 address`}),[`CNAME`,`MX`,`NS`].includes(t.type)&&!l.safeParse(t.value).success&&n.addIssue({code:`custom`,path:[`value`],message:`${t.type} records require a domain name`}),t.type===`CAA`){let e=d.exec(t.value);(e===null||Number(e[1])>255)&&n.addIssue({code:`custom`,path:[`value`],message:`CAA values must contain flags, a tag, and a quoted value`})}t.type===`TXT`&&/[\u0000\r\n]/.test(t.value)&&n.addIssue({code:`custom`,path:[`value`],message:`TXT values cannot contain NUL or newlines`})}),m=ie.meta({id:`ResolvedDnsRecord`}),h=ie.safeExtend({advancedDmarcOptions:re.optional()}).superRefine((e,t)=>{e.advancedDmarcOptions!==void 0&&((e.type!==`TXT`||e.host!==`_dmarc`&&!e.host.startsWith(`_dmarc.`))&&t.addIssue({code:`custom`,path:[`advancedDmarcOptions`],message:`Advanced DMARC options require a TXT record at a _dmarc host`}),de(e.value)||t.addIssue({code:`custom`,path:[`value`],message:`Advanced DMARC options require a valid DMARC1 value with a policy tag`}))}).meta({id:`DnsRecord`}),g=e.z.object({validateDmarc:e.z.boolean().default(!1),validateCAA:e.z.boolean().default(!1)}).strict().meta({id:`ExistingRecordPolicy`}),_=e.z.object({domain:l,records:e.z.array(h).min(1).max(100),existingRecordPolicy:g.default({validateDmarc:!1,validateCAA:!1})}).strict().meta({id:`DnsIntent`}),v=e.z.object({domain:l,records:e.z.array(m).max(100)}).strict().meta({id:`ResolvedDnsIntent`}),ae=v.meta({id:`CheckRecordsInput`}),oe=e.z.object({record:m,authoritativeServers:e.z.number().int().min(1).max(16),matchingServers:e.z.number().int().min(0).max(16),propagated:e.z.boolean()}).strict().superRefine((e,t)=>{e.matchingServers>e.authoritativeServers&&t.addIssue({code:`custom`,path:[`matchingServers`],message:`Matching nameservers cannot exceed authoritative nameservers`}),e.propagated!==(e.matchingServers===e.authoritativeServers)&&t.addIssue({code:`custom`,path:[`propagated`],message:`Propagation state must match the authoritative nameserver counts`})}).meta({id:`CheckedRecord`}),se=e.z.object({domain:l,allPropagated:e.z.boolean(),records:e.z.array(oe).min(1).max(100)}).strict().superRefine((e,t)=>{e.allPropagated!==e.records.every(e=>e.propagated)&&t.addIssue({code:`custom`,path:[`allPropagated`],message:`Overall propagation state must match every record result`})}).meta({id:`CheckRecordsResponse`}),y=e.z.enum([`preserve`,`replace_same_name_and_type`,`replace_all_at_name`]).meta({id:`ConflictPolicy`}),b=e.z.enum([`merge`,`replace`]).meta({id:`SpfConflictPolicy`}),ce=e.z.enum([`create`,`replace`,`delete`]).meta({id:`ChangeAction`}),le=e.z.object({action:ce,before:m.optional(),after:m.optional(),destructive:e.z.boolean()}).strict().superRefine((e,t)=>{e.action===`create`&&e.after===void 0&&t.addIssue({code:`custom`,path:[`after`],message:`Create requires the resulting record`}),e.action===`replace`&&(e.before===void 0||e.after===void 0)&&t.addIssue({code:`custom`,message:`Replace requires both current and resulting records`}),e.action===`delete`&&e.before===void 0&&t.addIssue({code:`custom`,path:[`before`],message:`Delete requires the current record`})}).meta({id:`PlannedChange`});function ue(e){return e===`@`||e.split(`.`).every((e,t)=>e===`*`?t===0:e.length>=1&&e.length<=63&&!e.startsWith(`-`)&&!e.endsWith(`-`)&&/^[a-z0-9_-]+$/.test(e))}function de(e){let t=e.split(`;`).map(e=>e.trim()).filter(Boolean),n=new Set;if(t.length<2)return!1;for(let[e,r]of t.entries()){let t=r.indexOf(`=`);if(t<=0)return!1;let i=r.slice(0,t).trim().toLowerCase(),a=r.slice(t+1).trim();if(!p.safeParse(i).success||!te.safeParse(a).success||n.has(i)||e===0&&(i!==`v`||a!==`DMARC1`)||!fe(i,a))return!1;n.add(i)}return n.has(`p`)}function fe(e,t){if(e===`v`)return t===`DMARC1`;if([`p`,`sp`,`np`].includes(e))return[`none`,`quarantine`,`reject`].includes(t);if([`adkim`,`aspf`].includes(e))return t===`r`||t===`s`;if(e===`pct`)return/^\d{1,3}$/.test(t)&&Number(t)<=100;if(e===`ri`)return/^[1-9]\d*$/.test(t);if(e===`rf`)return t===`afrf`;if(e===`fo`){let e=t.split(`:`);return e.length>0&&new Set(e).size===e.length&&e.every(e=>[`0`,`1`,`d`,`s`].includes(e))&&!(e.includes(`0`)&&e.includes(`1`))}return!0}const pe=e.z.enum([`automatic`,`domain_connect`,`manual`]).meta({id:`ProviderImplementation`}),me=e.z.enum([`oauth2_pkce`,`oauth2_authorization_code`,`provider_session`,`api_token`,`api_key`,`basic`,`session`,`domain_connect`,`manual`]).meta({id:`AuthorizationMethod`}),he=e.z.strictObject({rootNSModification:e.z.enum([`supported`,`unsupported`,`unverified`]),subdomainNSModification:e.z.enum([`supported`,`unsupported`,`unverified`]),wwwRedirect:e.z.enum([`supported`,`unsupported`,`unverified`]),cnameFlattening:e.z.enum([`supported`,`unsupported`,`unverified`]),wildcardRecords:e.z.enum([`supported`,`unsupported`,`unverified`]),caaRecords:e.z.enum([`supported`,`unsupported`,`unverified`]),spfRecords:e.z.enum([`supported`,`unsupported`,`unverified`]),socialLogin:e.z.enum([`supported`,`unsupported`,`unverified`])}).meta({id:`ProviderCapabilities`}),ge=e.z.enum([`no_stable_public_provider_identity`]).meta({id:`ProviderDetectionUnavailableReasonCode`}),_e=e.z.discriminatedUnion(`method`,[e.z.strictObject({method:e.z.enum([`nameserver`,`domain_connect`,`nameserver_or_domain_connect`])}),e.z.strictObject({method:e.z.literal(`manual`),reasonCode:ge})]).meta({id:`ProviderDetection`}),ve=e.z.url({protocol:/^https$/}).regex(/^https:\/\//,`Provider reference URL must use HTTPS`).refine(e=>{let t=new URL(e);return t.username===``&&t.password===``},`Provider reference URL must not contain credentials`).meta({format:`uri`}),x=e.z.object({id:s,name:e.z.string().trim().min(1),referenceUrl:ve,implementation:pe,availableAuthorizationMethods:e.z.array(me).refine(e=>new Set(e).size===e.length,`Authorization methods must be unique`).describe(`Available methods ordered from highest to lowest provider autonomy.`),authorizationInputs:n,capabilities:he,detection:_e,limitations:e.z.array(e.z.string().min(1))}).strict().superRefine((e,t)=>{let n=e.availableAuthorizationMethods;(e.implementation===`automatic`?n[0]!==`domain_connect`&&n.some(e=>e!==`domain_connect`&&e!==`manual`)&&n.at(-1)===`manual`:e.implementation===`domain_connect`?n.length===2&&n[0]===`domain_connect`&&n[1]===`manual`:n.length===1&&n[0]===`manual`)||t.addIssue({code:`custom`,path:[`availableAuthorizationMethods`],message:`Domain Connect providers may expose only Domain Connect and manual fallback`}),n.some(e=>e===`api_token`||e===`api_key`||e===`basic`||e===`session`)!==(e.authorizationInputs.directCredential!==void 0)&&t.addIssue({code:`custom`,path:[`authorizationInputs`,`directCredential`],message:`Direct credential input must match the advertised authorization methods`}),n.includes(`provider_session`)!==(e.authorizationInputs.providerSession!==void 0)&&t.addIssue({code:`custom`,path:[`authorizationInputs`,`providerSession`],message:`Provider-session input must match the advertised authorization methods`})}).meta({id:`Provider`}),ye=e.z.object({providers:e.z.array(x)}).strict().meta({id:`ListProvidersResponse`}),be=e.z.enum([`operational`,`unavailable`]).meta({id:`ProviderHealthStatus`}),S=e.z.enum([`automatic_ready`,`domain_connect_ready`,`runtime_authorization_unavailable`,`manual_only`]).meta({id:`ProviderHealthReason`}),xe=e.z.object({providerId:s,providerName:e.z.string().trim().min(1).max(200),enabled:e.z.boolean(),status:be,reason:S}).strict().superRefine((e,t)=>{let n=e.reason===`automatic_ready`||e.reason===`domain_connect_ready`||e.reason===`manual_only`,r=e.enabled?e.status===`operational`:e.status===`unavailable`;(e.enabled!==n||!r)&&t.addIssue({code:`custom`,path:[`enabled`],message:`Enabled, status, and reason must describe the same provider health state`})}).meta({id:`ProviderHealth`}),Se=e.z.object({observedAt:u,refreshAfter:u,providers:e.z.array(xe)}).strict().superRefine((e,t)=>{Date.parse(e.refreshAfter)<=Date.parse(e.observedAt)&&t.addIssue({code:`custom`,path:[`refreshAfter`],message:`Provider health refresh deadline must be after its observation time`});let n=e.providers.map(e=>e.providerId);new Set(n).size!==n.length&&t.addIssue({code:`custom`,path:[`providers`],message:`Provider health entries must have unique provider IDs`})}).meta({id:`ProviderHealthResponse`}),C=e.z.enum([`requested`,`detecting_provider`,`provider_selected`,`domain_connect_pending`,`authorization_pending`,`authorized`,`planning`,`awaiting_confirmation`,`applying`,`propagation_pending`,`active`,`manual_required`,`failed_retryable`,`failed_terminal`,`cancelled`]).meta({id:`ConnectionState`}),Ce=e.z.enum([`authorized`,`awaiting_confirmation`,`applying`]).meta({id:`RetryResumeState`}),we=e.z.enum([`provider_snapshot_timeout`,`provider_apply_timeout`]).meta({id:`ConnectionFailureCode`}),w=e.z.object({code:we,retryable:e.z.literal(!0),resumeState:Ce,occurredAt:u}).strict().meta({id:`ConnectionFailure`}),Te=e.z.enum([`spf_policy_replaced`,`spf_policy_merged`]).meta({id:`PlanWarningCode`}),Ee=e.z.object({digest:e.z.string().regex(/^[a-f0-9]{64}$/),changes:e.z.array(le).min(1),warnings:e.z.array(Te),expiresAt:u}).strict().meta({id:`ChangePlan`}),T=e.z.object({id:i,applicationId:a,tenantId:o,intent:_,effectiveIntent:v.optional(),state:C,provider:x.optional(),plan:Ee.optional(),failure:w.optional(),optionalFailures:e.z.array(e.z.string()),createdAt:u,updatedAt:u}).strict().superRefine((e,t)=>{let n=e.state===`failed_retryable`;n!==(e.failure!==void 0)&&t.addIssue({code:`custom`,path:[`failure`],message:n?`A retryable failure state requires failure details`:`Failure details are allowed only in a retryable failure state`}),e.effectiveIntent!==void 0&&e.effectiveIntent.domain!==e.intent.domain&&t.addIssue({code:`custom`,path:[`effectiveIntent`,`domain`],message:`Effective intent must use the requested intent domain`})}).meta({id:`Connection`}),De=e.z.object({applicationId:a,tenantId:o,intent:_,commandId:c}).strict().meta({id:`CreateConnectionInput`}),Oe=e.z.object({connection:T}).strict().meta({id:`ConnectionResponse`}),ke=Oe,Ae=e.z.object({provider:x,confidence:e.z.number().min(0).max(1)}).strict().meta({id:`ProviderCandidate`}),je=e.z.object({connection:T,candidates:e.z.array(Ae)}).strict().meta({id:`DetectProviderResponse`}),Me=e.z.object({providerId:s,commandId:c}).strict().meta({id:`SelectProviderInput`}),E=e.z.string().regex(/^[A-Za-z0-9._-]{1,63}$/),Ne=e.z.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,62}$/),Pe=new Set([`domain`,`host`,`fqdn`,`groupId`,`providerName`,`serviceName`,`instanceId`,`redirect_uri`,`state`,`sig`,`key`]),Fe=e.z.record(Ne,e.z.string().min(1).max(4096).refine(e=>e.trim()===e&&!/[\u0000\r\n]/.test(e),`Domain Connect property values must be trimmed and single-line`)).refine(e=>Object.keys(e).length<=64,`At most 64 Domain Connect properties are allowed`).refine(e=>Object.keys(e).every(e=>!Pe.has(e)),`Domain Connect properties must not override reserved protocol parameters`),Ie=e.z.object({serviceProviderId:E,serviceId:E,host:e.z.string().max(253).regex(/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/).optional(),groupId:e.z.string().max(4095).regex(/^[A-Za-z0-9._-]{1,63}(?:,[A-Za-z0-9._-]{1,63})*$/).optional(),providerName:e.z.string().trim().min(1).max(200).optional(),serviceName:e.z.string().trim().min(1).max(200).optional(),instanceId:E.optional(),properties:Fe}).strict().meta({id:`DomainConnectTemplate`}),Le=Ie.extend({commandId:c}).strict().meta({id:`ExplicitDomainConnectInput`}),Re=e.z.object({commandId:c}).strict().meta({id:`AutomaticDomainConnectInput`}),ze=e.z.union([Le,Re]).meta({id:`StartDomainConnectInput`}),Be=e.z.url({protocol:/^https$/}).refine(e=>{let t=new URL(e);return t.username===``&&t.password===``&&t.hash===``},`Domain Connect handoff URL must be HTTPS without credentials or a fragment`),Ve=e.z.object({connection:T,handoffUrl:Be}).strict().meta({id:`StartDomainConnectResponse`}),He=e.z.object({commandId:c}).strict().meta({id:`SubmitDomainConnectCompletionInput`}),Ue=e.z.object({digest:e.z.string().regex(/^[a-f0-9]{64}$/),allowDestructive:e.z.boolean(),commandId:c}).strict().meta({id:`ConfirmPlanInput`}),We=e.z.object({commandId:c}).strict().meta({id:`StartOAuthInput`}),Ge=e.z.object({connection:T,authorizationUrl:e.z.url({protocol:/^https$/}),expiresAt:u}).strict().meta({id:`StartOAuthResponse`}),D=e.z.string().min(1).max(16384).refine(e=>e.trim()===e,`Credential values must not have leading or trailing whitespace`).meta({format:`password`,writeOnly:!0}),Ke=e.z.enum([`otp`,`security_answer`]).meta({id:`ProviderSessionChallengeKind`}),qe=e.z.object({kind:Ke,prompt:e.z.string().max(500),destination:e.z.string().max(200)}).strict().meta({id:`ProviderSessionChallenge`}),Je=e.z.object({status:e.z.literal(`authorized`),connection:T}).strict().meta({id:`ProviderSessionAuthorizedResponse`}),Ye=e.z.object({status:e.z.literal(`challenge`),connection:T,attemptId:e.z.string().min(16).max(2048),challenge:qe,expiresAt:u}).strict().meta({id:`ProviderSessionChallengeResponse`}),Xe=e.z.discriminatedUnion(`status`,[Je,Ye]).meta({id:`ProviderSessionResponse`}),Ze=e.z.object({response:D,commandId:c}).strict().meta({id:`ContinueProviderSessionInput`}),O=e.z.object({kind:e.z.literal(`api_token`),token:D}).strict().meta({id:`ApiTokenCredentials`}),k=e.z.object({kind:e.z.literal(`access_key`),keyId:D,secret:D}).strict().meta({id:`AccessKeyCredentials`}),A=e.z.object({kind:e.z.literal(`username_password`),username:D,password:D}).strict().meta({id:`UsernamePasswordCredentials`}),j=e.z.object({kind:e.z.literal(`account_token`),accountId:D,token:D}).strict().meta({id:`AccountTokenCredentials`}),M=e.z.object({kind:e.z.literal(`username_token`),username:D,token:D}).strict().meta({id:`UsernameTokenCredentials`}),N=e.z.object({kind:e.z.literal(`ovh`),endpoint:e.z.enum([`ovh-eu`,`ovh-us`,`ovh-ca`,`kimsufi-eu`,`kimsufi-ca`,`soyoustart-eu`,`soyoustart-ca`]),applicationKey:D,applicationSecret:D,consumerKey:D}).strict().meta({id:`OvhCredentials`}),P=e.z.object({kind:e.z.literal(`private_key`),login:D,privateKey:D.refine(e=>/^(-----BEGIN (?:RSA )?PRIVATE KEY-----)[\s\S]+(-----END (?:RSA )?PRIVATE KEY-----)$/.test(e),`A PKCS#8 or PKCS#1 PEM private key is required`)}).strict().meta({id:`PrivateKeyCredentials`}),F=e.z.object({kind:e.z.literal(`aws_session`),keyId:D.regex(/^[A-Z0-9]{16,128}$/),secret:D,sessionToken:D,hostedZoneId:e.z.string().regex(/^Z[A-Z0-9]{1,63}$/),expiresAt:u}).strict().meta({id:`AwsSessionCredentials`}),Qe=e.z.url({protocol:/^https$/}).refine(e=>{let t=new URL(e);return t.port===`2083`&&t.username===``&&t.password===``&&(t.pathname===``||t.pathname===`/`)&&t.search===``&&t.hash===``},`cPanel endpoint must be an HTTPS origin on port 2083`),I=e.z.object({kind:e.z.literal(`cpanel`),endpoint:Qe,username:D,token:D}).strict().meta({id:`CPanelCredentials`}),L=e.z.object({kind:e.z.literal(`client_credentials`),clientId:D,clientSecret:D}).strict().meta({id:`ClientCredentials`}),$e=e.z.discriminatedUnion(`kind`,[O,k,A,j,M,N,P,F,I,L]).meta({id:`DirectCredentials`}),et=e.z.object({credentials:$e,commandId:c}).strict().meta({id:`StartProviderSessionInput`});function R(t,n){return e.z.object({providerId:e.z.literal(t),credentials:n,commandId:c}).strict()}const tt=[R(`alibaba-cloud`,k),R(`all-inkl`,A),R(`amazon-route-53`,F),R(`cloudns`,j),R(`digitalocean`,O),R(`dnsimple`,j),R(`dreamhost`,O),R(`dynadot`,k),R(`easydns`,k),R(`gandi`,O),R(`hetzner`,O),R(`hostgator`,I),R(`hostinger`,O),R(`hosting-com`,I),R(`inmotion-hosting`,I),R(`name-com`,M),R(`netlify`,O),R(`o2switch`,I),R(`openprovider`,O),R(`opensrs`,L),R(`ovh`,N),R(`porkbun`,k),R(`simply`,O),R(`spaceship`,k),R(`transip`,P),R(`united-domains`,O),R(`wix`,j)],nt=Object.freeze(Object.fromEntries(tt.map(e=>[e.shape.providerId.value,e.shape.credentials.shape.kind.value]))),rt=e.z.discriminatedUnion(`providerId`,tt).meta({id:`AuthorizeWithCredentialInput`}),it=e.z.object({completed:e.z.literal(!0)}).strict().meta({id:`OAuthCallbackResponse`}),at=e.z.object({conflictPolicy:y,spfPolicy:b.default(`merge`),commandId:c}).strict().meta({id:`PreparePlanInput`}),ot=e.z.object({commandId:c}).strict().meta({id:`ApplyPlanInput`}),st=e.z.object({commandId:c}).strict().meta({id:`VerifyPropagationInput`}),ct=e.z.object({commandId:c}).strict().meta({id:`StartManualConfigurationInput`}),lt=e.z.object({commandId:c}).strict().meta({id:`SubmitManualCompletionInput`}),ut=e.z.object({commandId:c}).strict().meta({id:`CancelConnectionInput`}),dt=e.z.object({commandId:c}).strict().meta({id:`RetryConnectionInput`}),ft=e.z.object({origin:e.z.url().refine(e=>{let t=new URL(e);return t.username===``&&t.password===``&&t.search===``&&t.hash===``&&(t.pathname===``||t.pathname===`/`)&&(t.protocol===`https:`||t.protocol===`http:`&&mt(t.hostname))},`Origin must be an HTTPS origin without a path, query, or fragment`)}).strict().meta({id:`IssueConnectionTokenInput`}),pt=e.z.object({accessToken:e.z.string().min(1).max(8192),tokenType:e.z.literal(`Bearer`),expiresAt:u}).strict().meta({id:`IssueConnectionTokenResponse`});function mt(e){return e===`localhost`||e===`127.0.0.1`||e===`[::1]`}const ht=e.z.string().trim().min(1).max(200).meta({id:`ConnectionFlowId`}),gt=e.z.strictObject({domain:e.z.array(h).min(1).max(100),subDomain:e.z.array(h).min(1).max(100).optional(),rootNS:e.z.array(h).min(1).max(100).optional()}).superRefine((e,t)=>{e.rootNS?.forEach((e,n)=>{(e.host!==`@`||e.type!==`NS`)&&t.addIssue({code:`custom`,path:[`rootNS`,n],message:`rootNS accepts only NS records at the zone apex`})})}).meta({id:`ConditionalDnsRecords`}),_t=e.z.strictObject({domain:l,records:e.z.array(h).min(1).max(100)}),vt=e.z.strictObject({domain:l,conditionalRecords:gt}),yt=e.z.union([_t,vt]).meta({id:`ConnectionFlowTargetInput`}),bt=e.z.strictObject({applicationId:a,tenantId:o,existingRecordPolicy:g.default({validateDmarc:!1,validateCAA:!1}),targets:e.z.array(yt).min(2).max(100).superRefine((e,t)=>{let n=new Set;e.forEach((e,r)=>{n.has(e.domain)&&t.addIssue({code:`custom`,path:[r,`domain`],message:`Flow target domains must be unique`}),n.add(e.domain)})}),commandId:c}).meta({id:`CreateConnectionFlowInput`}),xt=e.z.strictObject({domain:l,state:e.z.enum([`pending`,`provisioned`]),connectionId:i.optional()}).superRefine((e,t)=>{e.state===`provisioned`!=(e.connectionId!==void 0)&&t.addIssue({code:`custom`,path:[`connectionId`],message:e.state===`provisioned`?`A provisioned target requires a connection id`:`A pending target cannot have a connection id`})}).meta({id:`ConnectionFlowTarget`}),St=e.z.strictObject({id:ht,applicationId:a,tenantId:o,state:e.z.enum([`provisioning`,`ready`]),targets:e.z.array(xt).min(2).max(100),createdAt:u,updatedAt:u}).superRefine((e,t)=>{let n=e.targets.every(e=>e.state===`provisioned`);e.state===`ready`!==n&&t.addIssue({code:`custom`,path:[`state`],message:`Flow state must match target provisioning state`})}).meta({id:`ConnectionFlow`}),Ct=e.z.strictObject({flow:St}).meta({id:`ConnectionFlowResponse`}),z=e.z.enum([`invalid_request`,`unauthorized`,`forbidden`,`not_found`,`conflict`,`rate_limited`,`dns_unavailable`,`provider_unavailable`,`provider_authorization_failed`,`provider_limitation`,`plan_expired`,`propagation_pending`,`internal_error`]).meta({id:`Domain0ErrorCode`}),wt=e.z.object({error:e.z.object({code:z,message:e.z.string().min(1),requestId:e.z.string().min(1),retryable:e.z.boolean(),details:e.z.record(e.z.string(),e.z.unknown()).optional()}).strict()}).strict().meta({id:`ErrorResponse`}),B=e.z.string().min(1).max(200).brand(),V=e.z.string().regex(/^[A-Za-z0-9_-]{43}$/).brand(),Tt=e.z.strictObject({connectionId:i,expiresAt:u}),Et=e.z.strictObject({sharedFlowId:B,token:V,expiresAt:u}),Dt=e.z.strictObject({token:V,origin:e.z.string().url().max(2048)}),Ot=e.z.strictObject({sharedFlowId:B,connectionId:i,accessToken:e.z.string().min(1).max(8192),expiresAt:u}),kt=e.z.string().url().max(4096),H=kt.superRefine((e,t)=>{let n=new URL(e),r=n.protocol===`https:`,i=n.protocol===`http:`&&jt(n.hostname);!r&&!i&&t.addIssue({code:`custom`,message:`Shared-flow invitation URLs must use HTTPS, except on loopback development hosts`}),(n.username!==``||n.password!==``)&&t.addIssue({code:`custom`,message:`Shared-flow invitation URLs cannot contain user information`});let a=new URLSearchParams(n.hash.slice(1)),o=a.get(`domain0`);(a.size!==1||!V.safeParse(o).success)&&t.addIssue({code:`custom`,message:`Shared-flow invitation URLs require one valid domain0 capability in the fragment`})}).meta({id:`SharedFlowInvitationUrl`}),At=e.z.object({sharedFlowId:B,url:H,expiresAt:u}).strict().meta({id:`SharedFlowInvitation`});function jt(e){let t=e.toLowerCase();return t===`localhost`||t===`[::1]`||/^127(?:\.[0-9]{1,3}){3}$/.test(t)}const U=e.z.string().trim().toLowerCase().min(1).max(63).regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/).brand().meta({id:`DkimSelector`}),Mt=e.z.object({selectors:e.z.array(U).max(10).default([])}).strict().superRefine((e,t)=>{new Set(e.selectors).size!==e.selectors.length&&t.addIssue({code:`custom`,path:[`selectors`],message:`DKIM selectors must be unique`})}).meta({id:`DkimGuidanceInput`}),Nt=e.z.object({enableDkim:e.z.boolean().default(!1),dkimSelectors:e.z.array(U).max(10).default([])}).strict().superRefine((e,t)=>{new Set(e.dkimSelectors).size!==e.dkimSelectors.length&&t.addIssue({code:`custom`,path:[`dkimSelectors`],message:`DKIM selectors must be unique`})}).meta({id:`Domain0DkimGuidanceOptions`}),Pt=e.z.object({id:e.z.literal(`google_workspace`),name:e.z.literal(`Google Workspace`),guideUrl:e.z.literal(`https://support.google.com/a/answer/174124`)}).strict(),Ft=e.z.object({id:e.z.literal(`microsoft_365`),name:e.z.literal(`Microsoft 365`),guideUrl:e.z.literal(`https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure`)}).strict(),It=e.z.object({id:e.z.literal(`zoho_mail`),name:e.z.literal(`Zoho Mail`),guideUrl:e.z.literal(`https://www.zoho.com/mail/help/adminconsole/dkim-configuration.html`)}).strict(),W=e.z.discriminatedUnion(`id`,[Pt,Ft,It]).meta({id:`EmailProvider`}),Lt=e.z.enum([`detected`,`ambiguous`,`unknown`]).meta({id:`EmailProviderDetectionStatus`}),Rt=e.z.enum([`TXT`,`CNAME`]).meta({id:`DkimDnsRecordType`}),zt=e.z.enum([`record_observed`,`no_record_observed`,`not_checked`,`lookup_unavailable`]).meta({id:`DkimDnsEvidenceStatus`}),Bt=e.z.object({selector:U,types:e.z.array(Rt).min(1).max(2).refine(e=>new Set(e).size===e.length,`Observed DKIM DNS record types must be unique`)}).strict().meta({id:`DkimDnsRecordEvidence`}),Vt=e.z.object({status:zt,selectorsChecked:e.z.array(U).max(12).refine(e=>new Set(e).size===e.length,`Checked DKIM selectors must be unique`),records:e.z.array(Bt).max(12)}).strict().superRefine((e,t)=>{let n=new Set(e.selectorsChecked);e.records.some(e=>!n.has(e.selector))&&t.addIssue({code:`custom`,path:[`records`],message:`Observed records must belong to checked selectors`}),e.status===`not_checked`&&(e.selectorsChecked.length!==0||e.records.length!==0)&&t.addIssue({code:`custom`,path:[`status`],message:`Not-checked evidence cannot include selector observations`}),e.status===`record_observed`&&e.records.length===0&&t.addIssue({code:`custom`,path:[`records`],message:`Observed status requires at least one DNS record`}),e.status!==`record_observed`&&e.records.length!==0&&t.addIssue({code:`custom`,path:[`records`],message:`Only observed status can include DNS records`}),[`no_record_observed`,`lookup_unavailable`].includes(e.status)&&e.selectorsChecked.length===0&&t.addIssue({code:`custom`,path:[`selectorsChecked`],message:`A DNS lookup status requires at least one checked selector`})}).meta({id:`DkimDnsEvidence`}),Ht=e.z.object({domain:l,detectionStatus:Lt,candidates:e.z.array(W).max(3),provider:W.optional(),mxHosts:e.z.array(l).max(20).refine(e=>new Set(e).size===e.length,`MX hosts must be unique`),dkimDns:Vt,observedAt:u}).strict().superRefine((e,t)=>{let n=e.candidates.map(e=>e.id);new Set(n).size!==n.length&&t.addIssue({code:`custom`,path:[`candidates`],message:`Email provider candidates must be unique`}),e.detectionStatus===`detected`&&(e.candidates.length!==1||e.provider?.id!==e.candidates[0]?.id)&&t.addIssue({code:`custom`,path:[`provider`],message:`Detected status requires exactly one matching provider`}),e.detectionStatus===`ambiguous`&&(e.candidates.length<2||e.provider!==void 0)&&t.addIssue({code:`custom`,path:[`candidates`],message:`Ambiguous status requires multiple candidates and no resolved provider`}),e.detectionStatus===`unknown`&&(e.candidates.length!==0||e.provider!==void 0)&&t.addIssue({code:`custom`,path:[`candidates`],message:`Unknown status cannot include an email provider`})}).meta({id:`DkimGuidanceResponse`}),G=e.z.union([e.z.enum([`loading`,`provider_detection`,`provider_selection`,`cancellation_confirmation`]),C]).meta({id:`Domain0ConnectStep`}),Ut=e.z.enum([`close_button`,`escape`,`programmatic`,`destroyed`,`automatic`]).meta({id:`Domain0ConnectCloseTrigger`}),Wt=e.z.enum([`success`,`failure`,`cancelled`,`incomplete`]).meta({id:`Domain0ConnectOutcome`}),Gt=T.and(e.z.object({state:e.z.literal(`active`)})),Kt=T.and(e.z.object({state:e.z.literal(`manual_required`)})),qt=e.z.union([T.and(e.z.object({state:e.z.literal(`failed_retryable`),failure:w})),T.and(e.z.object({state:e.z.literal(`failed_terminal`),failure:e.z.undefined().optional()}))]),K=e.z.discriminatedUnion(`source`,[e.z.object({source:e.z.literal(`configuration`),code:e.z.literal(`invalid_configuration`),retryable:e.z.literal(!1)}).strict(),e.z.object({source:e.z.literal(`api`),code:z,retryable:e.z.boolean(),requestId:e.z.string().min(1)}).strict(),e.z.object({source:e.z.literal(`transport`),code:e.z.literal(`transport_error`),retryable:e.z.literal(!0)}).strict(),e.z.object({source:e.z.literal(`protocol`),code:e.z.literal(`protocol_error`),retryable:e.z.literal(!1)}).strict(),e.z.object({source:e.z.literal(`unexpected`),code:e.z.literal(`unexpected_error`),retryable:e.z.literal(!1)}).strict()]).meta({id:`Domain0ConnectError`}),Jt=e.z.object({type:e.z.literal(`success`),connection:Gt}).strict().meta({id:`Domain0ConnectSuccessEvent`}),Yt=e.z.object({type:e.z.literal(`failure`),connection:qt}).strict().meta({id:`Domain0ConnectFailureEvent`}),Xt=e.z.object({type:e.z.literal(`error`),error:K,connection:T.optional(),step:G.optional()}).strict().meta({id:`Domain0ConnectErrorEvent`}),Zt=e.z.object({type:e.z.literal(`close`),trigger:Ut,outcome:Wt,connection:T.optional(),step:G.optional(),error:K.optional()}).strict().superRefine((e,t)=>{let n=an(e.connection,e.error);e.outcome!==n&&t.addIssue({code:`custom`,path:[`outcome`],message:`Close outcome must be ${n} for the supplied connection and error`})}).meta({id:`Domain0ConnectCloseEvent`}),Qt=e.z.object({type:e.z.literal(`step_change`),step:G,previousStep:G.optional(),connection:T.optional()}).strict().meta({id:`Domain0ConnectStepChangeEvent`}),$t=e.z.object({type:e.z.literal(`manual_setup_documentation_click`),connection:Kt}).strict().meta({id:`Domain0ManualSetupDocumentationClickEvent`}),en=e.z.object({type:e.z.literal(`request_close`),connection:T.optional(),step:G}).strict().meta({id:`Domain0RequestCloseEvent`}),tn=e.z.object({type:e.z.literal(`shared_flow_sent`),connection:Kt,sharedFlowId:B,url:H,expiresAt:u}).strict().meta({id:`Domain0SharedFlowSentEvent`}),nn=e.z.object({type:e.z.literal(`dkim_setup_documentation_click`),connection:Gt,emailProvider:W}).strict().meta({id:`Domain0DkimSetupDocumentationClickEvent`}),rn=e.z.discriminatedUnion(`type`,[Jt,Yt,Xt,Zt,Qt,$t,en,tn,nn]).meta({id:`Domain0ConnectEvent`});function an(e,t){return e?.state===`active`?`success`:t!==void 0||e?.state===`failed_retryable`||e?.state===`failed_terminal`?`failure`:e?.state===`cancelled`?`cancelled`:`incomplete`}const on=e.z.object({mode:e.z.enum([`automatic`,`manual`]).default(`automatic`),conflictPolicy:y.default(`replace_same_name_and_type`),spfPolicy:b.default(`merge`)}).strict(),sn=/^#[0-9A-F]{6}$/,cn=/^#[0-9A-F]{8}$/,q=e.z.string().trim().toUpperCase().regex(sn,`Expected an opaque #RRGGBB color`),ln=e.z.string().trim().toUpperCase().regex(cn,`Expected a #RRGGBBAA backdrop color`),un=e.z.string().trim().min(1).max(500).refine(e=>!/[<>\u0000-\u001F\u007F]/.test(e),`White-label copy must be plain text without markup or control characters`),dn=un.max(120).meta({id:`Domain0ApplicationName`}),fn=e.z.string().trim().min(1).max(2048).refine(e=>{try{let t=new URL(e);return t.protocol===`https:`&&t.username===``&&t.password===``}catch{return!1}},`Logo must be an HTTPS URL without embedded credentials`).meta({id:`Domain0WhiteLabelLogoUrl`});function J(...e){return un.refine(t=>{let n=e.reduce((e,t)=>e.replaceAll(t,``),t);return!/[{}]/.test(n)},`Only these placeholders are allowed: ${e.join(`, `)||`none`}`)}function Y(t){let n=e.z.object({en:t,es:t.optional(),pt:t.optional(),"pt-br":t.optional(),"pt-pt":t.optional(),fr:t.optional(),it:t.optional(),de:t.optional(),nl:t.optional(),pl:t.optional(),tr:t.optional(),ja:t.optional(),da:t.optional(),sv:t.optional()}).strict();return e.z.union([t.transform(e=>({en:e})),n])}function pn(e,t){return mn(q.parse(e),q.parse(t))}function mn(e,t){let n=gn(e),r=gn(t),i=Math.max(n,r),a=Math.min(n,r);return(i+.05)/(a+.05)}function hn(e){let t=e.split(`,`);return t.length<=10&&t.every(e=>{let t=e.trim();if(t.length===0)return!1;let n=t.at(0);return n===`"`||n===`'`?t.at(-1)===n&&/^[A-Za-z0-9 -]+$/.test(t.slice(1,-1)):/^-?[A-Za-z][A-Za-z0-9 -]*$/.test(t)})}function gn(e){let[t,n,r]=[1,3,5].map(t=>Number.parseInt(e.slice(t,t+2),16)/255).map(e=>e<=.04045?e/12.92:((e+.055)/1.055)**2.4);return .2126*t+.7152*n+.0722*r}const _n=[{foreground:`text`,background:`surface`,minimum:4.5,purpose:`body text`},{foreground:`mutedText`,background:`surface`,minimum:4.5,purpose:`secondary text`},{foreground:`onPrimary`,background:`primary`,minimum:4.5,purpose:`primary control text`},{foreground:`danger`,background:`surface`,minimum:4.5,purpose:`error text`},{foreground:`onDanger`,background:`danger`,minimum:4.5,purpose:`danger control text`},{foreground:`link`,background:`surface`,minimum:4.5,purpose:`link text`},{foreground:`border`,background:`surface`,minimum:3,purpose:`control boundaries`},{foreground:`primary`,background:`surface`,minimum:3,purpose:`primary control boundaries`},{foreground:`focus`,background:`surface`,minimum:3,purpose:`focus indicators`}],vn={surface:`#FFFFFF`,text:`#0A0A0A`,mutedText:`#6B6B6B`,border:`#73737C`,primary:`#0A0A0A`,onPrimary:`#FFFFFF`,link:`#2B21FF`,focus:`#2B21FF`,danger:`#B3261E`,onDanger:`#FFFFFF`},yn={surface:`#111827`,text:`#F9FAFB`,mutedText:`#D1D5DB`,border:`#D1D5DB`,primary:`#BFDBFE`,onPrimary:`#172554`,link:`#BFDBFE`,focus:`#FBBF24`,danger:`#FCA5A5`,onDanger:`#450A0A`};function bn(t){return e.z.object({surface:q.default(t.surface),text:q.default(t.text),mutedText:q.default(t.mutedText),border:q.default(t.border),primary:q.default(t.primary),onPrimary:q.default(t.onPrimary),link:q.default(t.link),focus:q.default(t.focus),danger:q.default(t.danger),onDanger:q.default(t.onDanger)}).strict().superRefine((e,t)=>{for(let n of _n){let r=mn(e[n.foreground],e[n.background]);r<n.minimum&&t.addIssue({code:`custom`,path:[n.foreground],message:`${n.purpose} requires ${n.minimum}:1 contrast against ${n.background}; received ${r.toFixed(2)}:1`})}})}const xn=bn(vn),Sn=bn(yn),Cn=e.z.object({colorMode:e.z.enum([`light`,`dark`,`system`]).default(`light`),light:xn.prefault({}),dark:Sn.prefault({}),backdrop:ln.default(`#2B21FF26`),widthPx:e.z.number().int().min(320).max(960).default(520),dialogRadiusPx:e.z.number().int().min(0).max(48).default(20),buttonRadiusPx:e.z.number().int().min(0).max(999).default(999),inputRadiusPx:e.z.number().int().min(0).max(32).default(12),fontFamily:e.z.string().trim().min(1).max(200).refine(hn,`Use a comma-separated system font stack without URLs or CSS syntax`).default(`"PP Neue Montreal", "Inter Tight", ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif`),fontWeight:e.z.number().int().min(100).max(900).multipleOf(50).default(400),boldFontWeight:e.z.number().int().min(100).max(900).multipleOf(50).default(500)}).strict().superRefine((e,t)=>{e.boldFontWeight<e.fontWeight&&t.addIssue({code:`custom`,path:[`boldFontWeight`],message:`Bold font weight must be at least the normal font weight`})}),wn=e.z.object({initialSubtitle:Y(J()).optional(),providerLoginMessage:Y(J(`{PROVIDER}`)).optional(),successTitle:Y(J(`{DOMAIN}`)).optional(),successDescription:Y(J(`{DOMAIN}`)).optional(),successButton:Y(J()).optional(),manuallyScreen:e.z.object({disableManualSetupDocumentationLink:e.z.boolean().default(!1),stepByStepGuide:Y(J()).optional()}).strict().prefault({})}).strict(),Tn=e.z.object({disable:e.z.boolean().default(!1)}).strict(),En=e.z.object({manualConfiguration:e.z.object({disableScreen:e.z.boolean().default(!1)}).strict().prefault({}),providerLogin:e.z.object({forwardLink:Tn.prefault({}),gotoManualLink:Tn.prefault({})}).strict().prefault({})}).strict(),Dn=e.z.object({theme:Cn.prefault({}),copy:wn.prefault({}),logo:fn.optional(),logoBackgroundColor:q.optional(),removeLogoBorder:e.z.boolean().default(!1),hideCompanyLogo:e.z.boolean().default(!1),hideCompanyName:e.z.boolean().default(!1),removeShareLogin:e.z.boolean().default(!1),skipCongratulationsScreen:e.z.boolean().default(!1),customProperties:En.prefault({})}).strict(),On=e.z.url({protocol:/^https$/}).max(2048).refine(e=>{let t=new URL(e);return t.username===``&&t.password===``},`Manual setup documentation URL must not contain credentials`).brand().meta({id:`ManualSetupDocumentationUrl`}),kn=e.z.object({applicationName:dn.optional(),whiteLabel:Dn.prefault({}),setupPolicy:on.prefault({}),dkim:Nt.prefault({}),manualSetupDocumentation:On.optional()}).strict().superRefine((e,t)=>{let{customProperties:n}=e.whiteLabel,r=e.setupPolicy.mode===`manual`;r&&n.manualConfiguration.disableScreen&&t.addIssue({code:`custom`,path:[`whiteLabel`,`customProperties`,`manualConfiguration`,`disableScreen`],message:`Forced manual setup requires the manual configuration screen`}),r&&n.providerLogin.gotoManualLink.disable&&t.addIssue({code:`custom`,path:[`whiteLabel`,`customProperties`,`providerLogin`,`gotoManualLink`,`disable`],message:`Forced manual setup cannot disable entry into manual configuration`}),e.dkim.enableDkim&&e.whiteLabel.skipCongratulationsScreen&&t.addIssue({code:`custom`,path:[`whiteLabel`,`skipCongratulationsScreen`],message:`DKIM guidance requires the success screen`})}).meta({id:`Domain0ConnectConfiguration`}),An=e.z.enum(`alibaba-cloud.all-inkl.amazon-route-53.cloudns.digitalocean.dnsimple.dreamhost.dynadot.easydns.gandi.hetzner.hostgator.hostinger.hosting-com.inmotion-hosting.name-com.namecheap.netlify.o2switch.openprovider.opensrs.ovh.porkbun.simply.spaceship.transip.united-domains.wix`.split(`.`)).meta({id:`CompiledProviderId`}),jn=e.z.enum([`authenticated_snapshot`,`reserved_name_available`,`create_sibling`,`create_target`,`rrset_sibling_preservation`,`idempotent_replay`,`replace_target`,`authoritative_propagation`,`delete_target`,`scoped_cleanup`]).meta({id:`ProviderConformanceCheckName`}),X=[`authenticated_snapshot`,`reserved_name_available`,`create_sibling`,`create_target`,`rrset_sibling_preservation`,`idempotent_replay`,`replace_target`,`authoritative_propagation`,`delete_target`,`scoped_cleanup`],Mn=e.z.object({name:jn}).strict(),Nn=e.z.union([e.z.literal(`unknown`),e.z.string().regex(/^[a-f0-9]{40,64}$/)]),Pn=e.z.object({schemaVersion:e.z.literal(1),providerId:An,adapterVersion:e.z.string().min(1).max(200).refine(Ln),sourceRevision:Nn,sourceModified:e.z.boolean(),binarySha256:e.z.string().regex(/^[a-f0-9]{64}$/),zone:l,runId:e.z.string().regex(/^[a-f0-9]{16,64}$/),host:e.z.string(),startedAt:u,completedAt:u,passed:e.z.boolean(),checks:e.z.array(Mn).max(X.length),cleanupAttempted:e.z.boolean(),cleanupCompleted:e.z.boolean()}).strict().superRefine((e,t)=>{e.host!==`_domain0-conformance-${e.runId}`&&t.addIssue({code:`custom`,path:[`host`],message:`Conformance hostname must be derived from the random run ID`}),Date.parse(e.completedAt)<Date.parse(e.startedAt)&&t.addIssue({code:`custom`,path:[`completedAt`],message:`Conformance completion must not precede its start`});let n=e.checks.map(e=>e.name);In(n)||t.addIssue({code:`custom`,path:[`checks`],message:`Conformance checks must be an ordered prefix followed optionally by scoped cleanup`});let r=n.includes(`scoped_cleanup`);(e.cleanupCompleted&&!e.cleanupAttempted||r!==e.cleanupCompleted)&&t.addIssue({code:`custom`,path:[`cleanupCompleted`],message:`Completed cleanup requires an attempted cleanup and the scoped-cleanup check`})}).meta({id:`ProviderConformanceEvidence`}),Fn=Pn.refine(e=>e.passed&&!e.sourceModified&&e.sourceRevision!==`unknown`&&e.cleanupAttempted&&e.cleanupCompleted&&e.checks.every((e,t)=>e.name===X[t])&&e.checks.length===X.length,`Verified live-suite evidence requires clean traceable source, every ordered check, and completed cleanup`).meta({id:`VerifiedProviderConformanceEvidence`});function In(e){let t=0,n=!1;for(let r of e){if(r===`scoped_cleanup`){if(n)return!1;n=!0;continue}if(n||r!==X[t])return!1;t+=1}return!0}function Ln(e){return e.trim()===e&&!/[\u0000\r\n]/.test(e)}const Rn=e.z.enum([`delegated`,`undelegated`,`unknown`]).meta({id:`DomainDelegationStatus`}),zn=e.z.enum([`automatic`,`manual`,`unavailable`,`ambiguous`,`unknown`]).meta({id:`DomainSetupSupport`}),Bn=e.z.enum([`same_name_and_type`,`cname_collision`,`mx_set_collision`,`spf_collision`,`ns_delegation`]).meta({id:`RecordConflictReason`}),Vn=e.z.object({domain:l,records:e.z.array(m).max(100).default([]),checkConflicts:e.z.boolean().default(!1)}).strict().superRefine((e,t)=>{e.checkConflicts&&e.records.length===0&&t.addIssue({code:`custom`,path:[`records`],message:`Record conflict analysis requires at least one requested record`})}).meta({id:`CheckDomainInput`}),Hn=e.z.object({provider:x,confidence:e.z.number().min(0).max(1),exact:e.z.boolean()}).strict().meta({id:`DomainProviderCandidate`}),Un=e.z.object({requested:m,existing:e.z.array(m).max(1e3),reasons:e.z.array(Bn).min(1).max(5).refine(e=>new Set(e).size===e.length,`Conflict reasons must be unique`)}).strict().meta({id:`DomainRecordConflict`}),Wn=e.z.object({status:e.z.enum([`not_requested`,`complete`,`partial`]),authoritativeServers:e.z.number().int().min(0).max(16),respondingServers:e.z.number().int().min(0).max(16),conflicts:e.z.array(Un).max(100)}).strict().superRefine((e,t)=>{e.respondingServers>e.authoritativeServers&&t.addIssue({code:`custom`,path:[`respondingServers`],message:`Responding nameservers cannot exceed authoritative nameservers`}),e.status===`complete`&&e.respondingServers!==e.authoritativeServers&&t.addIssue({code:`custom`,path:[`status`],message:`Complete analysis requires every authoritative nameserver to respond`}),e.status===`partial`&&(e.respondingServers===0||e.respondingServers>=e.authoritativeServers)&&t.addIssue({code:`custom`,path:[`status`],message:`Partial analysis requires some but not all authoritative nameservers to respond`}),e.status===`not_requested`&&e.conflicts.length!==0&&t.addIssue({code:`custom`,path:[`conflicts`],message:`Conflict results cannot exist when analysis was not requested`})}).meta({id:`ConflictAnalysis`}),Gn=e.z.object({domain:l,delegationStatus:Rn,candidates:e.z.array(Hn).max(65),provider:x.optional(),setupSupport:zn,conflictAnalysis:Wn}).strict().superRefine((e,t)=>{let n=e.candidates.map(e=>e.provider.id);new Set(n).size!==n.length&&t.addIssue({code:`custom`,path:[`candidates`],message:`Provider candidates must be unique`}),e.delegationStatus===`undelegated`&&(e.candidates.length!==0||e.provider!==void 0||e.setupSupport!==`unavailable`)&&t.addIssue({code:`custom`,path:[`delegationStatus`],message:`Undelegated domains cannot have provider support`}),e.provider!==void 0&&!e.candidates.some(t=>t.exact&&t.provider.id===e.provider?.id)&&t.addIssue({code:`custom`,path:[`provider`],message:`Resolved provider must be an exact provider candidate`}),[`automatic`,`manual`].includes(e.setupSupport)&&e.provider===void 0&&t.addIssue({code:`custom`,path:[`setupSupport`],message:`Available setup support requires a resolved provider`}),e.setupSupport===`automatic`&&!e.provider?.availableAuthorizationMethods.some(e=>e!==`manual`)&&t.addIssue({code:`custom`,path:[`setupSupport`],message:`Automatic setup requires a configured non-manual authorization method`}),e.setupSupport===`manual`&&(e.provider?.availableAuthorizationMethods.length!==1||e.provider.availableAuthorizationMethods[0]!==`manual`)&&t.addIssue({code:`custom`,path:[`setupSupport`],message:`Manual setup requires the manual authorization method`}),e.setupSupport===`ambiguous`&&e.candidates.length===0&&t.addIssue({code:`custom`,path:[`candidates`],message:`Ambiguous setup requires provider candidates`}),e.setupSupport===`unknown`&&e.candidates.length!==0&&t.addIssue({code:`custom`,path:[`candidates`],message:`Unknown setup cannot include provider candidates`}),[`ambiguous`,`unknown`].includes(e.setupSupport)&&e.provider!==void 0&&t.addIssue({code:`custom`,path:[`provider`],message:`Ambiguous or unknown support cannot resolve one provider`})}).meta({id:`CheckDomainResponse`}),Kn=[`en`,`es`,`pt`,`pt-br`,`pt-pt`,`fr`,`it`,`de`,`nl`,`pl`,`tr`,`ja`,`da`,`sv`],qn=e.z.enum(Kn).meta({id:`Domain0Locale`}),Jn=e.z.strictObject({intent:_}).meta({id:`PlatformCreateConnectionInput`}),Yn=e.z.enum([`connection.requested`,`provider.detection_started`,`provider.selected`,`authorization.required`,`domain_connect.started`,`domain_connect.submitted`,`authorization.completed`,`connection.planning_started`,`connection.plan_prepared`,`connection.planning_restarted`,`connection.already_configured`,`connection.plan_confirmed`,`connection.changes_applied`,`connection.propagation_checked`,`connection.propagation_timed_out`,`connection.activated`,`connection.manual_required`,`connection.manual_submitted`,`connection.failed_retryable`,`connection.retry_started`,`connection.cancelled`]).meta({id:`Domain0WebhookEventType`}),Z=e.z.string().regex(/^[0-9a-f]{64}$/).brand().meta({id:`Domain0WebhookEventId`}),Xn=e.z.record(e.z.string().min(1).max(100),e.z.string().max(4e3)).superRefine((e,t)=>{Object.keys(e).length>64&&t.addIssue({code:`custom`,message:`Webhook attributes must contain at most 64 entries`})}).meta({id:`Domain0WebhookAttributes`}),Zn=e.z.strictObject({schemaVersion:e.z.literal(1),eventId:Z,type:Yn,connectionId:i,applicationId:a,tenantId:o,sequence:e.z.number().int().positive().max(2**53-1),occurredAt:u,attributes:Xn}).meta({id:`Domain0WebhookEvent`}),Qn=e.z.enum([`invalid_headers`,`stale_timestamp`,`invalid_signature`,`invalid_payload`,`crypto_unavailable`]).meta({id:`Domain0WebhookVerificationErrorCode`});var $n=class extends Error{code;name=`Domain0WebhookVerificationError`;constructor(e,t,n){super(t,n),this.code=e}};const Q={eventId:`x-domain0-event-id`,eventType:`x-domain0-event-type`,deliveryAttempt:`x-domain0-delivery-attempt`,schemaVersion:`x-domain0-schema-version`,signatureKeyId:`x-domain0-signature-key-id`,timestamp:`x-domain0-timestamp`,signature:`x-domain0-signature`},er=e.z.strictObject({eventId:Z,eventType:e.z.string().regex(/^domain0\.[a-z_]+\.[a-z_]+$/).max(100),deliveryAttempt:e.z.string().regex(/^[1-9][0-9]{0,8}$/).transform(Number),schemaVersion:e.z.literal(`1`),signatureKeyId:e.z.string().regex(/^[A-Za-z0-9._-]{1,64}$/),timestamp:e.z.string().regex(/^[0-9]{1,12}$/).transform(Number),signature:e.z.string().regex(/^v1=[0-9a-f]{64}$/)}),tr=new TextEncoder;async function nr(e){let t=typeof e.body==`string`?tr.encode(e.body):new Uint8Array(e.body),n=ir(e.maxBodyBytes??1048576,16777216);if(!(t instanceof Uint8Array)||t.byteLength===0||t.byteLength>n)throw $(`invalid_payload`,`Webhook body is empty or exceeds the configured limit`);let r=rr(e.headers),i=ar(e.nowUnixSeconds??Math.floor(Date.now()/1e3),2**53-1),a=ir(e.maxAgeSeconds??300,86400);if(Math.abs(i-r.timestamp)>a)throw $(`stale_timestamp`,`Webhook timestamp is outside the accepted replay window`);let o=Object.prototype.hasOwnProperty.call(e.secretKeyring,r.signatureKeyId)?e.secretKeyring[r.signatureKeyId]:void 0;if(!(o instanceof Uint8Array)||o.byteLength!==32)throw $(`invalid_signature`,`Webhook signature is invalid`);let s=e.crypto??globalThis.crypto;if(s?.subtle===void 0)throw $(`crypto_unavailable`,`Web Crypto is unavailable`);let c=or(r.signature.slice(3)),l=tr.encode(`v1.${r.signatureKeyId}.${r.timestamp}.`),u=new Uint8Array(l.byteLength+t.byteLength);u.set(l),u.set(t,l.byteLength);let ee=await s.subtle.importKey(`raw`,new Uint8Array(o),{name:`HMAC`,hash:`SHA-256`},!1,[`verify`]);if(!await s.subtle.verify(`HMAC`,ee,new Uint8Array(c),u))throw $(`invalid_signature`,`Webhook signature is invalid`);let d;try{let e=new TextDecoder(`utf-8`,{fatal:!0}).decode(t);d=JSON.parse(e)}catch(e){throw $(`invalid_payload`,`Verified webhook body is not valid UTF-8 JSON`,e)}let f=Zn.safeParse(d);if(!f.success)throw $(`invalid_payload`,`Verified webhook body does not match schema version 1`,f.error);if(f.data.eventId!==r.eventId||`domain0.${f.data.type}`!==r.eventType||String(f.data.schemaVersion)!==r.schemaVersion)throw $(`invalid_payload`,`Verified webhook headers do not match the event body`);return f.data}function rr(e){let t={eventId:void 0,eventType:void 0,deliveryAttempt:void 0,schemaVersion:void 0,signatureKeyId:void 0,timestamp:void 0,signature:void 0};if(`get`in e&&typeof e.get==`function`)for(let[n,r]of Object.entries(Q))t[n]=e.get(r)??void 0;else{let n=new Map;for(let e of Object.keys(Q))n.set(Q[e],e);let r=new Set;for(let[i,a]of Object.entries(e)){let e=i.toLowerCase(),o=n.get(e);if(o!==void 0){if(r.has(e)||typeof a!=`string`)throw $(`invalid_headers`,`Webhook headers are missing, duplicated, or malformed`);r.add(e),t[o]=a}}}let n=er.safeParse(t);if(!n.success)throw $(`invalid_headers`,`Webhook headers are missing, duplicated, or malformed`,n.error);return n.data}function ir(e,t){if(!Number.isSafeInteger(e)||e<1||e>t)throw $(`invalid_headers`,`Webhook verification limits are invalid`);return e}function ar(e,t){if(!Number.isSafeInteger(e)||e<0||e>t)throw $(`invalid_headers`,`Webhook verification time is invalid`);return e}function or(e){let t=new Uint8Array(e.length/2);for(let n=0;n<e.length;n+=2)t[n/2]=Number.parseInt(e.slice(n,n+2),16);return t}function $(e,t,n){return new $n(e,t,n===void 0?void 0:{cause:n})}exports.AccessKeyCredentialsSchema=k,exports.AccountTokenCredentialsSchema=j,exports.AdvancedDmarcOptionsSchema=re,exports.ApiTokenCredentialsSchema=O,exports.ApplicationIdSchema=a,exports.ApplyPlanInputSchema=ot,exports.AuthorizationMethodSchema=me,exports.AuthorizeWithCredentialInputSchema=rt,exports.AutomaticDomainConnectInputSchema=Re,exports.AwsSessionCredentialsSchema=F,exports.CPanelCredentialsSchema=I,exports.CancelConnectionInputSchema=ut,exports.ChangeActionSchema=ce,exports.ChangePlanSchema=Ee,exports.CheckDomainInputSchema=Vn,exports.CheckDomainResponseSchema=Gn,exports.CheckRecordsInputSchema=ae,exports.CheckRecordsResponseSchema=se,exports.CheckedRecordSchema=oe,exports.ClientCredentialsSchema=L,exports.CommandIdSchema=c,exports.CompiledProviderIdSchema=An,exports.ConditionalDnsRecordsSchema=gt,exports.ConfirmPlanInputSchema=Ue,exports.ConflictAnalysisSchema=Wn,exports.ConflictPolicySchema=y,exports.ConnectionFailureCodeSchema=we,exports.ConnectionFailureSchema=w,exports.ConnectionFlowIdSchema=ht,exports.ConnectionFlowResponseSchema=Ct,exports.ConnectionFlowSchema=St,exports.ConnectionFlowTargetInputSchema=yt,exports.ConnectionFlowTargetSchema=xt,exports.ConnectionIdSchema=i,exports.ConnectionSchema=T,exports.ConnectionStateSchema=C,exports.ContinueProviderSessionInputSchema=Ze,exports.CreateConnectionFlowInputSchema=bt,exports.CreateConnectionInputSchema=De,exports.CreateConnectionResponseSchema=Oe,exports.CreateSharedFlowInputSchema=Tt,exports.CreateSharedFlowResponseSchema=Et,exports.DOMAIN0_WEBHOOK_HEADER_NAMES=Q,exports.DetectProviderResponseSchema=je,exports.DirectCredentialsSchema=$e,exports.DkimDnsEvidenceSchema=Vt,exports.DkimDnsEvidenceStatusSchema=zt,exports.DkimDnsRecordEvidenceSchema=Bt,exports.DkimDnsRecordTypeSchema=Rt,exports.DkimGuidanceInputSchema=Mt,exports.DkimGuidanceResponseSchema=Ht,exports.DkimSelectorSchema=U,exports.DnsIntentSchema=_,exports.DnsRecordSchema=h,exports.DnsRecordTypeSchema=f,exports.Domain0ApplicationNameSchema=dn,exports.Domain0ConnectCloseEventSchema=Zt,exports.Domain0ConnectCloseTriggerSchema=Ut,exports.Domain0ConnectConfigurationSchema=kn,exports.Domain0ConnectErrorEventSchema=Xt,exports.Domain0ConnectErrorSchema=K,exports.Domain0ConnectEventSchema=rn,exports.Domain0ConnectFailureEventSchema=Yt,exports.Domain0ConnectOutcomeSchema=Wt,exports.Domain0ConnectStepChangeEventSchema=Qt,exports.Domain0ConnectStepSchema=G,exports.Domain0ConnectSuccessEventSchema=Jt,exports.Domain0DkimGuidanceOptionsSchema=Nt,exports.Domain0DkimSetupDocumentationClickEventSchema=nn,exports.Domain0ErrorCodeSchema=z,exports.Domain0ErrorResponseSchema=wt,exports.Domain0LocaleSchema=qn,exports.Domain0ManualSetupDocumentationClickEventSchema=$t,exports.Domain0RequestCloseEventSchema=en,exports.Domain0SetupPolicySchema=on,exports.Domain0SharedFlowSentEventSchema=tn,exports.Domain0WebhookAttributesSchema=Xn,exports.Domain0WebhookEventIdSchema=Z,exports.Domain0WebhookEventSchema=Zn,exports.Domain0WebhookEventTypeSchema=Yn,exports.Domain0WebhookVerificationError=$n,exports.Domain0WebhookVerificationErrorCodeSchema=Qn,exports.Domain0WhiteLabelCopySchema=wn,exports.Domain0WhiteLabelCustomPropertiesSchema=En,exports.Domain0WhiteLabelLogoUrlSchema=fn,exports.Domain0WhiteLabelSchema=Dn,exports.Domain0WhiteLabelThemeSchema=Cn,exports.DomainConnectTemplateSchema=Ie,exports.DomainDelegationStatusSchema=Rn,exports.DomainNameSchema=l,exports.DomainProviderCandidateSchema=Hn,exports.DomainRecordConflictSchema=Un,exports.DomainSetupSupportSchema=zn,exports.EmailProviderDetectionStatusSchema=Lt,exports.EmailProviderSchema=W,exports.ExistingRecordPolicySchema=g,exports.ExplicitDomainConnectInputSchema=Le,exports.GetConnectionResponseSchema=ke,exports.IsoDateTimeSchema=u,exports.IssueConnectionTokenInputSchema=ft,exports.IssueConnectionTokenResponseSchema=pt,exports.ListProvidersResponseSchema=ye,exports.ManualSetupDocumentationUrlSchema=On,exports.OAuthCallbackResponseSchema=it,exports.OvhCredentialsSchema=N,exports.PlanWarningCodeSchema=Te,exports.PlannedChangeSchema=le,exports.PlatformCreateConnectionInputSchema=Jn,exports.PreparePlanInputSchema=at,exports.PrivateKeyCredentialsSchema=P,exports.ProviderAuthorizationInputsSchema=n,exports.ProviderCandidateSchema=Ae,exports.ProviderCapabilitiesSchema=he,exports.ProviderConformanceCheckNameSchema=jn,exports.ProviderConformanceEvidenceSchema=Pn,exports.ProviderDetectionSchema=_e,exports.ProviderDetectionUnavailableReasonCodeSchema=ge,exports.ProviderHealthReasonSchema=S,exports.ProviderHealthResponseSchema=Se,exports.ProviderHealthSchema=xe,exports.ProviderHealthStatusSchema=be,exports.ProviderIdSchema=s,exports.ProviderImplementationSchema=pe,exports.ProviderSchema=x,exports.ProviderSessionChallengeKindSchema=Ke,exports.ProviderSessionChallengeSchema=qe,exports.ProviderSessionResponseSchema=Xe,exports.RecordConflictReasonSchema=Bn,exports.ResolveSharedFlowInputSchema=Dt,exports.ResolveSharedFlowResponseSchema=Ot,exports.ResolvedDnsIntentSchema=v,exports.ResolvedDnsRecordSchema=m,exports.RetryConnectionInputSchema=dt,exports.RetryResumeStateSchema=Ce,exports.SelectProviderInputSchema=Me,exports.SharedFlowIdSchema=B,exports.SharedFlowInvitationSchema=At,exports.SharedFlowInvitationUrlSchema=H,exports.SharedFlowTokenSchema=V,exports.SharedFlowUrlSchema=kt,exports.SpfConflictPolicySchema=b,exports.StartDomainConnectInputSchema=ze,exports.StartDomainConnectResponseSchema=Ve,exports.StartManualConfigurationInputSchema=ct,exports.StartOAuthInputSchema=We,exports.StartOAuthResponseSchema=Ge,exports.StartProviderSessionInputSchema=et,exports.SubmitDomainConnectCompletionInputSchema=He,exports.SubmitManualCompletionInputSchema=lt,exports.TenantIdSchema=o,exports.TransientCredentialKindSchema=t,exports.UsernamePasswordCredentialsSchema=A,exports.UsernameTokenCredentialsSchema=M,exports.VerifiedProviderConformanceEvidenceSchema=Fn,exports.VerifyPropagationInputSchema=st,exports.colorContrastRatio=pn,exports.directCredentialKindByProvider=nt,exports.domain0Locales=Kn,exports.expectedProviderConformanceChecks=X,exports.verifyDomain0Webhook=nr;
 //# sourceMappingURL=contracts.cjs.map