domain0 0.7.0 → 0.8.0

package/dist/contracts.cjs

@@ -1,2 +1,2 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("zod");const t=e.z.enum([`api_token`,`access_key`,`username_password`,`account_token`,`username_token`,`ovh`,`private_key`,`aws_session`,`cpanel`,`client_credentials`]).meta({id:`TransientCredentialKind`}),n=e.z.strictObject({directCredential:t.optional(),providerSession:t.optional()}).meta({id:`ProviderAuthorizationInputs`}),r=e.z.string().trim().min(1).max(200),i=r.brand().meta({id:`ConnectionId`}),a=r.brand().meta({id:`ApplicationId`}),o=r.brand().meta({id:`TenantId`}),s=e.z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).brand().meta({id:`ProviderId`}),c=r.brand().meta({id:`CommandId`}),l=e.z.string().trim().toLowerCase().overwrite(e=>e.replace(/\.$/,``)).min(3).max(253).regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/).refine(e=>!/^\d+(?:\.\d+){3}$/.test(e),`IP addresses are not domain names`).brand().meta({id:`DomainName`}),u=e.z.iso.datetime({offset:!0}).meta({id:`IsoDateTime`}),ee=e.z.string().trim().toLowerCase().overwrite(e=>e.replace(/\.$/,``)).min(1).max(253).refine(ue,`Host must be @ or a valid relative DNS name`),d=/^([0-9]{1,3})[\t ]+([A-Za-z0-9-]{1,15})[\t ]+(?:"([^\r\n"]*)"|([^\r\n"]+))$/,f=e.z.enum([`A`,`AAAA`,`CNAME`,`CAA`,`MX`,`TXT`,`NS`]).meta({id:`DnsRecordType`}),p=e.z.string().regex(/^[a-z]{1,32}$/),te=e.z.string().min(1).max(4096).refine(e=>e.trim()===e&&/^[\x20-\x3a\x3c-\x7e]+$/.test(e),{message:`DMARC tag values must be trimmed printable ASCII without semicolons`}),ne=e.z.record(p,te).refine(e=>Object.keys(e).length<=32,`At most 32 DMARC tags are allowed`),re=e.z.object({inheritRootDmarc:e.z.boolean().default(!1),overrideTags:ne.default({}),removeTags:e.z.array(p).max(32).refine(e=>new Set(e).size===e.length,`DMARC tags to remove must be unique`).default([]),addTagsIfNotExist:ne.default({})}).strict().refine(e=>e.inheritRootDmarc||Object.keys(e.overrideTags).length>0||e.removeTags.length>0||Object.keys(e.addTagsIfNotExist).length>0,`At least one advanced DMARC option is required`).superRefine((e,t)=>{for(let[n,r]of[[`overrideTags`,e.overrideTags],[`addTagsIfNotExist`,e.addTagsIfNotExist]])for(let[e,i]of Object.entries(r))fe(e,i)||t.addIssue({code:`custom`,path:[n,e],message:`Invalid value for the ${e} DMARC tag`})}).meta({id:`AdvancedDmarcOptions`}),ie=e.z.object({host:ee,type:f,value:e.z.string().trim().min(1).max(65535),ttl:e.z.number().int().min(1).max(2147483647).default(300),priority:e.z.number().int().min(0).max(65535).optional(),optional:e.z.boolean().default(!1)}).strict().superRefine((t,n)=>{if(t.type===`MX`&&t.priority===void 0&&n.addIssue({code:`custom`,path:[`priority`],message:`MX records require a priority`}),t.type!==`MX`&&t.priority!==void 0&&n.addIssue({code:`custom`,path:[`priority`],message:`Only MX records accept a priority`}),t.type===`A`&&!e.z.ipv4().safeParse(t.value).success&&n.addIssue({code:`custom`,path:[`value`],message:`A records require an IPv4 address`}),t.type===`AAAA`&&!e.z.ipv6().safeParse(t.value).success&&n.addIssue({code:`custom`,path:[`value`],message:`AAAA records require an IPv6 address`}),[`CNAME`,`MX`,`NS`].includes(t.type)&&!l.safeParse(t.value).success&&n.addIssue({code:`custom`,path:[`value`],message:`${t.type} records require a domain name`}),t.type===`CAA`){let e=d.exec(t.value);(e===null||Number(e[1])>255)&&n.addIssue({code:`custom`,path:[`value`],message:`CAA values must contain flags, a tag, and a quoted value`})}t.type===`TXT`&&/[\u0000\r\n]/.test(t.value)&&n.addIssue({code:`custom`,path:[`value`],message:`TXT values cannot contain NUL or newlines`})}),m=ie.meta({id:`ResolvedDnsRecord`}),h=ie.safeExtend({advancedDmarcOptions:re.optional()}).superRefine((e,t)=>{e.advancedDmarcOptions!==void 0&&((e.type!==`TXT`||e.host!==`_dmarc`&&!e.host.startsWith(`_dmarc.`))&&t.addIssue({code:`custom`,path:[`advancedDmarcOptions`],message:`Advanced DMARC options require a TXT record at a _dmarc host`}),de(e.value)||t.addIssue({code:`custom`,path:[`value`],message:`Advanced DMARC options require a valid DMARC1 value with a policy tag`}))}).meta({id:`DnsRecord`}),g=e.z.object({validateDmarc:e.z.boolean().default(!1),validateCAA:e.z.boolean().default(!1)}).strict().meta({id:`ExistingRecordPolicy`}),_=e.z.object({domain:l,records:e.z.array(h).min(1).max(100),existingRecordPolicy:g.default({validateDmarc:!1,validateCAA:!1})}).strict().meta({id:`DnsIntent`}),v=e.z.object({domain:l,records:e.z.array(m).max(100)}).strict().meta({id:`ResolvedDnsIntent`}),ae=v.meta({id:`CheckRecordsInput`}),oe=e.z.object({record:m,authoritativeServers:e.z.number().int().min(1).max(16),matchingServers:e.z.number().int().min(0).max(16),propagated:e.z.boolean()}).strict().superRefine((e,t)=>{e.matchingServers>e.authoritativeServers&&t.addIssue({code:`custom`,path:[`matchingServers`],message:`Matching nameservers cannot exceed authoritative nameservers`}),e.propagated!==(e.matchingServers===e.authoritativeServers)&&t.addIssue({code:`custom`,path:[`propagated`],message:`Propagation state must match the authoritative nameserver counts`})}).meta({id:`CheckedRecord`}),se=e.z.object({domain:l,allPropagated:e.z.boolean(),records:e.z.array(oe).min(1).max(100)}).strict().superRefine((e,t)=>{e.allPropagated!==e.records.every(e=>e.propagated)&&t.addIssue({code:`custom`,path:[`allPropagated`],message:`Overall propagation state must match every record result`})}).meta({id:`CheckRecordsResponse`}),y=e.z.enum([`preserve`,`replace_same_name_and_type`,`replace_all_at_name`]).meta({id:`ConflictPolicy`}),b=e.z.enum([`merge`,`replace`]).meta({id:`SpfConflictPolicy`}),ce=e.z.enum([`create`,`replace`,`delete`]).meta({id:`ChangeAction`}),le=e.z.object({action:ce,before:m.optional(),after:m.optional(),destructive:e.z.boolean()}).strict().superRefine((e,t)=>{e.action===`create`&&e.after===void 0&&t.addIssue({code:`custom`,path:[`after`],message:`Create requires the resulting record`}),e.action===`replace`&&(e.before===void 0||e.after===void 0)&&t.addIssue({code:`custom`,message:`Replace requires both current and resulting records`}),e.action===`delete`&&e.before===void 0&&t.addIssue({code:`custom`,path:[`before`],message:`Delete requires the current record`})}).meta({id:`PlannedChange`});function ue(e){return e===`@`||e.split(`.`).every((e,t)=>e===`*`?t===0:e.length>=1&&e.length<=63&&!e.startsWith(`-`)&&!e.endsWith(`-`)&&/^[a-z0-9_-]+$/.test(e))}function de(e){let t=e.split(`;`).map(e=>e.trim()).filter(Boolean),n=new Set;if(t.length<2)return!1;for(let[e,r]of t.entries()){let t=r.indexOf(`=`);if(t<=0)return!1;let i=r.slice(0,t).trim().toLowerCase(),a=r.slice(t+1).trim();if(!p.safeParse(i).success||!te.safeParse(a).success||n.has(i)||e===0&&(i!==`v`||a!==`DMARC1`)||!fe(i,a))return!1;n.add(i)}return n.has(`p`)}function fe(e,t){if(e===`v`)return t===`DMARC1`;if([`p`,`sp`,`np`].includes(e))return[`none`,`quarantine`,`reject`].includes(t);if([`adkim`,`aspf`].includes(e))return t===`r`||t===`s`;if(e===`pct`)return/^\d{1,3}$/.test(t)&&Number(t)<=100;if(e===`ri`)return/^[1-9]\d*$/.test(t);if(e===`rf`)return t===`afrf`;if(e===`fo`){let e=t.split(`:`);return e.length>0&&new Set(e).size===e.length&&e.every(e=>[`0`,`1`,`d`,`s`].includes(e))&&!(e.includes(`0`)&&e.includes(`1`))}return!0}const pe=e.z.enum([`automatic`,`domain_connect`,`manual`]).meta({id:`ProviderImplementation`}),me=e.z.enum([`oauth2_pkce`,`oauth2_authorization_code`,`provider_session`,`api_token`,`api_key`,`basic`,`session`,`domain_connect`,`manual`]).meta({id:`AuthorizationMethod`}),he=e.z.strictObject({rootNSModification:e.z.enum([`supported`,`unsupported`,`unverified`]),subdomainNSModification:e.z.enum([`supported`,`unsupported`,`unverified`]),wwwRedirect:e.z.enum([`supported`,`unsupported`,`unverified`]),cnameFlattening:e.z.enum([`supported`,`unsupported`,`unverified`]),wildcardRecords:e.z.enum([`supported`,`unsupported`,`unverified`]),caaRecords:e.z.enum([`supported`,`unsupported`,`unverified`]),spfRecords:e.z.enum([`supported`,`unsupported`,`unverified`]),socialLogin:e.z.enum([`supported`,`unsupported`,`unverified`])}).meta({id:`ProviderCapabilities`}),ge=e.z.enum([`no_stable_public_provider_identity`]).meta({id:`ProviderDetectionUnavailableReasonCode`}),_e=e.z.discriminatedUnion(`method`,[e.z.strictObject({method:e.z.enum([`nameserver`,`domain_connect`,`nameserver_or_domain_connect`])}),e.z.strictObject({method:e.z.literal(`manual`),reasonCode:ge})]).meta({id:`ProviderDetection`}),ve=e.z.url({protocol:/^https$/}).regex(/^https:\/\//,`Provider reference URL must use HTTPS`).refine(e=>{let t=new URL(e);return t.username===``&&t.password===``},`Provider reference URL must not contain credentials`).meta({format:`uri`}),x=e.z.object({id:s,name:e.z.string().trim().min(1),referenceUrl:ve,implementation:pe,availableAuthorizationMethods:e.z.array(me).refine(e=>new Set(e).size===e.length,`Authorization methods must be unique`).describe(`Available methods ordered from highest to lowest provider autonomy.`),authorizationInputs:n,capabilities:he,detection:_e,limitations:e.z.array(e.z.string().min(1))}).strict().superRefine((e,t)=>{let n=e.availableAuthorizationMethods;(e.implementation===`automatic`?n[0]!==`domain_connect`&&n.some(e=>e!==`domain_connect`&&e!==`manual`)&&n.at(-1)===`manual`:e.implementation===`domain_connect`?n.length===2&&n[0]===`domain_connect`&&n[1]===`manual`:n.length===1&&n[0]===`manual`)||t.addIssue({code:`custom`,path:[`availableAuthorizationMethods`],message:`Domain Connect providers may expose only Domain Connect and manual fallback`}),n.some(e=>e===`api_token`||e===`api_key`||e===`basic`||e===`session`)!==(e.authorizationInputs.directCredential!==void 0)&&t.addIssue({code:`custom`,path:[`authorizationInputs`,`directCredential`],message:`Direct credential input must match the advertised authorization methods`}),n.includes(`provider_session`)!==(e.authorizationInputs.providerSession!==void 0)&&t.addIssue({code:`custom`,path:[`authorizationInputs`,`providerSession`],message:`Provider-session input must match the advertised authorization methods`})}).meta({id:`Provider`}),ye=e.z.object({providers:e.z.array(x)}).strict().meta({id:`ListProvidersResponse`}),be=e.z.enum([`operational`,`unavailable`]).meta({id:`ProviderHealthStatus`}),S=e.z.enum([`automatic_ready`,`domain_connect_ready`,`runtime_authorization_unavailable`,`manual_only`]).meta({id:`ProviderHealthReason`}),xe=e.z.object({providerId:s,providerName:e.z.string().trim().min(1).max(200),enabled:e.z.boolean(),status:be,reason:S}).strict().superRefine((e,t)=>{let n=e.reason===`automatic_ready`||e.reason===`domain_connect_ready`||e.reason===`manual_only`,r=e.enabled?e.status===`operational`:e.status===`unavailable`;(e.enabled!==n||!r)&&t.addIssue({code:`custom`,path:[`enabled`],message:`Enabled, status, and reason must describe the same provider health state`})}).meta({id:`ProviderHealth`}),Se=e.z.object({observedAt:u,refreshAfter:u,providers:e.z.array(xe)}).strict().superRefine((e,t)=>{Date.parse(e.refreshAfter)<=Date.parse(e.observedAt)&&t.addIssue({code:`custom`,path:[`refreshAfter`],message:`Provider health refresh deadline must be after its observation time`});let n=e.providers.map(e=>e.providerId);new Set(n).size!==n.length&&t.addIssue({code:`custom`,path:[`providers`],message:`Provider health entries must have unique provider IDs`})}).meta({id:`ProviderHealthResponse`}),C=e.z.enum([`requested`,`detecting_provider`,`provider_selected`,`domain_connect_pending`,`authorization_pending`,`authorized`,`planning`,`awaiting_confirmation`,`applying`,`propagation_pending`,`active`,`manual_required`,`failed_retryable`,`failed_terminal`,`cancelled`]).meta({id:`ConnectionState`}),Ce=e.z.enum([`authorized`,`awaiting_confirmation`,`applying`]).meta({id:`RetryResumeState`}),we=e.z.enum([`provider_snapshot_timeout`,`provider_apply_timeout`]).meta({id:`ConnectionFailureCode`}),w=e.z.object({code:we,retryable:e.z.literal(!0),resumeState:Ce,occurredAt:u}).strict().meta({id:`ConnectionFailure`}),Te=e.z.enum([`spf_policy_replaced`,`spf_policy_merged`]).meta({id:`PlanWarningCode`}),Ee=e.z.object({digest:e.z.string().regex(/^[a-f0-9]{64}$/),changes:e.z.array(le).min(1),warnings:e.z.array(Te),expiresAt:u}).strict().meta({id:`ChangePlan`}),T=e.z.object({id:i,applicationId:a,tenantId:o,intent:_,effectiveIntent:v.optional(),state:C,provider:x.optional(),plan:Ee.optional(),failure:w.optional(),optionalFailures:e.z.array(e.z.string()),createdAt:u,updatedAt:u}).strict().superRefine((e,t)=>{let n=e.state===`failed_retryable`;n!==(e.failure!==void 0)&&t.addIssue({code:`custom`,path:[`failure`],message:n?`A retryable failure state requires failure details`:`Failure details are allowed only in a retryable failure state`}),e.effectiveIntent!==void 0&&e.effectiveIntent.domain!==e.intent.domain&&t.addIssue({code:`custom`,path:[`effectiveIntent`,`domain`],message:`Effective intent must use the requested intent domain`})}).meta({id:`Connection`}),De=e.z.object({applicationId:a,tenantId:o,intent:_,commandId:c}).strict().meta({id:`CreateConnectionInput`}),Oe=e.z.object({connection:T}).strict().meta({id:`ConnectionResponse`}),ke=Oe,Ae=e.z.object({provider:x,confidence:e.z.number().min(0).max(1)}).strict().meta({id:`ProviderCandidate`}),je=e.z.object({connection:T,candidates:e.z.array(Ae)}).strict().meta({id:`DetectProviderResponse`}),Me=e.z.object({providerId:s,commandId:c}).strict().meta({id:`SelectProviderInput`}),E=e.z.string().regex(/^[A-Za-z0-9._-]{1,63}$/),Ne=e.z.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,62}$/),Pe=new Set([`domain`,`host`,`fqdn`,`groupId`,`providerName`,`serviceName`,`instanceId`,`redirect_uri`,`state`,`sig`,`key`]),Fe=e.z.record(Ne,e.z.string().min(1).max(4096).refine(e=>e.trim()===e&&!/[\u0000\r\n]/.test(e),`Domain Connect property values must be trimmed and single-line`)).refine(e=>Object.keys(e).length<=64,`At most 64 Domain Connect properties are allowed`).refine(e=>Object.keys(e).every(e=>!Pe.has(e)),`Domain Connect properties must not override reserved protocol parameters`),Ie=e.z.object({serviceProviderId:E,serviceId:E,host:e.z.string().max(253).regex(/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/).optional(),groupId:e.z.string().max(4095).regex(/^[A-Za-z0-9._-]{1,63}(?:,[A-Za-z0-9._-]{1,63})*$/).optional(),providerName:e.z.string().trim().min(1).max(200).optional(),serviceName:e.z.string().trim().min(1).max(200).optional(),instanceId:E.optional(),properties:Fe}).strict().meta({id:`DomainConnectTemplate`}),Le=Ie.extend({commandId:c}).strict().meta({id:`ExplicitDomainConnectInput`}),Re=e.z.object({commandId:c}).strict().meta({id:`AutomaticDomainConnectInput`}),ze=e.z.union([Le,Re]).meta({id:`StartDomainConnectInput`}),Be=e.z.url({protocol:/^https$/}).refine(e=>{let t=new URL(e);return t.username===``&&t.password===``&&t.hash===``},`Domain Connect handoff URL must be HTTPS without credentials or a fragment`),Ve=e.z.object({connection:T,handoffUrl:Be}).strict().meta({id:`StartDomainConnectResponse`}),He=e.z.object({commandId:c}).strict().meta({id:`SubmitDomainConnectCompletionInput`}),Ue=e.z.object({digest:e.z.string().regex(/^[a-f0-9]{64}$/),allowDestructive:e.z.boolean(),commandId:c}).strict().meta({id:`ConfirmPlanInput`}),We=e.z.object({commandId:c}).strict().meta({id:`StartOAuthInput`}),Ge=e.z.object({connection:T,authorizationUrl:e.z.url({protocol:/^https$/}),expiresAt:u}).strict().meta({id:`StartOAuthResponse`}),D=e.z.string().min(1).max(16384).refine(e=>e.trim()===e,`Credential values must not have leading or trailing whitespace`).meta({format:`password`,writeOnly:!0}),Ke=e.z.enum([`otp`,`security_answer`]).meta({id:`ProviderSessionChallengeKind`}),qe=e.z.object({kind:Ke,prompt:e.z.string().max(500),destination:e.z.string().max(200)}).strict().meta({id:`ProviderSessionChallenge`}),Je=e.z.object({status:e.z.literal(`authorized`),connection:T}).strict().meta({id:`ProviderSessionAuthorizedResponse`}),Ye=e.z.object({status:e.z.literal(`challenge`),connection:T,attemptId:e.z.string().min(16).max(2048),challenge:qe,expiresAt:u}).strict().meta({id:`ProviderSessionChallengeResponse`}),Xe=e.z.discriminatedUnion(`status`,[Je,Ye]).meta({id:`ProviderSessionResponse`}),Ze=e.z.object({response:D,commandId:c}).strict().meta({id:`ContinueProviderSessionInput`}),O=e.z.object({kind:e.z.literal(`api_token`),token:D}).strict().meta({id:`ApiTokenCredentials`}),k=e.z.object({kind:e.z.literal(`access_key`),keyId:D,secret:D}).strict().meta({id:`AccessKeyCredentials`}),A=e.z.object({kind:e.z.literal(`username_password`),username:D,password:D}).strict().meta({id:`UsernamePasswordCredentials`}),j=e.z.object({kind:e.z.literal(`account_token`),accountId:D,token:D}).strict().meta({id:`AccountTokenCredentials`}),M=e.z.object({kind:e.z.literal(`username_token`),username:D,token:D}).strict().meta({id:`UsernameTokenCredentials`}),N=e.z.object({kind:e.z.literal(`ovh`),endpoint:e.z.enum([`ovh-eu`,`ovh-us`,`ovh-ca`,`kimsufi-eu`,`kimsufi-ca`,`soyoustart-eu`,`soyoustart-ca`]),applicationKey:D,applicationSecret:D,consumerKey:D}).strict().meta({id:`OvhCredentials`}),P=e.z.object({kind:e.z.literal(`private_key`),login:D,privateKey:D.refine(e=>/^(-----BEGIN (?:RSA )?PRIVATE KEY-----)[\s\S]+(-----END (?:RSA )?PRIVATE KEY-----)$/.test(e),`A PKCS#8 or PKCS#1 PEM private key is required`)}).strict().meta({id:`PrivateKeyCredentials`}),F=e.z.object({kind:e.z.literal(`aws_session`),keyId:D.regex(/^[A-Z0-9]{16,128}$/),secret:D,sessionToken:D,hostedZoneId:e.z.string().regex(/^Z[A-Z0-9]{1,63}$/),expiresAt:u}).strict().meta({id:`AwsSessionCredentials`}),Qe=e.z.url({protocol:/^https$/}).refine(e=>{let t=new URL(e);return t.port===`2083`&&t.username===``&&t.password===``&&(t.pathname===``||t.pathname===`/`)&&t.search===``&&t.hash===``},`cPanel endpoint must be an HTTPS origin on port 2083`),I=e.z.object({kind:e.z.literal(`cpanel`),endpoint:Qe,username:D,token:D}).strict().meta({id:`CPanelCredentials`}),L=e.z.object({kind:e.z.literal(`client_credentials`),clientId:D,clientSecret:D}).strict().meta({id:`ClientCredentials`}),$e=e.z.discriminatedUnion(`kind`,[O,k,A,j,M,N,P,F,I,L]).meta({id:`DirectCredentials`}),et=e.z.object({credentials:$e,commandId:c}).strict().meta({id:`StartProviderSessionInput`});function R(t,n){return e.z.object({providerId:e.z.literal(t),credentials:n,commandId:c}).strict()}const tt=[R(`alibaba-cloud`,k),R(`all-inkl`,A),R(`amazon-route-53`,F),R(`cloudns`,j),R(`digitalocean`,O),R(`dnsimple`,j),R(`dreamhost`,O),R(`dynadot`,k),R(`easydns`,k),R(`gandi`,O),R(`hetzner`,O),R(`hostgator`,I),R(`hostinger`,O),R(`hosting-com`,I),R(`inmotion-hosting`,I),R(`name-com`,M),R(`netlify`,O),R(`o2switch`,I),R(`openprovider`,O),R(`opensrs`,L),R(`ovh`,N),R(`porkbun`,k),R(`simply`,O),R(`spaceship`,k),R(`transip`,P),R(`united-domains`,O),R(`wix`,j)],nt=Object.freeze(Object.fromEntries(tt.map(e=>[e.shape.providerId.value,e.shape.credentials.shape.kind.value]))),rt=e.z.discriminatedUnion(`providerId`,tt).meta({id:`AuthorizeWithCredentialInput`}),it=e.z.object({completed:e.z.literal(!0)}).strict().meta({id:`OAuthCallbackResponse`}),at=e.z.object({conflictPolicy:y,spfPolicy:b.default(`merge`),commandId:c}).strict().meta({id:`PreparePlanInput`}),ot=e.z.object({commandId:c}).strict().meta({id:`ApplyPlanInput`}),st=e.z.object({commandId:c}).strict().meta({id:`VerifyPropagationInput`}),ct=e.z.object({commandId:c}).strict().meta({id:`StartManualConfigurationInput`}),lt=e.z.object({commandId:c}).strict().meta({id:`SubmitManualCompletionInput`}),ut=e.z.object({commandId:c}).strict().meta({id:`CancelConnectionInput`}),dt=e.z.object({commandId:c}).strict().meta({id:`RetryConnectionInput`}),ft=e.z.object({origin:e.z.url().refine(e=>{let t=new URL(e);return t.username===``&&t.password===``&&t.search===``&&t.hash===``&&(t.pathname===``||t.pathname===`/`)&&(t.protocol===`https:`||t.protocol===`http:`&&mt(t.hostname))},`Origin must be an HTTPS origin without a path, query, or fragment`)}).strict().meta({id:`IssueConnectionTokenInput`}),pt=e.z.object({accessToken:e.z.string().min(1).max(8192),tokenType:e.z.literal(`Bearer`),expiresAt:u}).strict().meta({id:`IssueConnectionTokenResponse`});function mt(e){return e===`localhost`||e===`127.0.0.1`||e===`[::1]`}const ht=e.z.string().trim().min(1).max(200).meta({id:`ConnectionFlowId`}),gt=e.z.strictObject({domain:e.z.array(h).min(1).max(100),subDomain:e.z.array(h).min(1).max(100).optional(),rootNS:e.z.array(h).min(1).max(100).optional()}).superRefine((e,t)=>{e.rootNS?.forEach((e,n)=>{(e.host!==`@`||e.type!==`NS`)&&t.addIssue({code:`custom`,path:[`rootNS`,n],message:`rootNS accepts only NS records at the zone apex`})})}).meta({id:`ConditionalDnsRecords`}),_t=e.z.strictObject({domain:l,records:e.z.array(h).min(1).max(100)}),vt=e.z.strictObject({domain:l,conditionalRecords:gt}),yt=e.z.union([_t,vt]).meta({id:`ConnectionFlowTargetInput`}),bt=e.z.strictObject({applicationId:a,tenantId:o,existingRecordPolicy:g.default({validateDmarc:!1,validateCAA:!1}),targets:e.z.array(yt).min(2).max(100).superRefine((e,t)=>{let n=new Set;e.forEach((e,r)=>{n.has(e.domain)&&t.addIssue({code:`custom`,path:[r,`domain`],message:`Flow target domains must be unique`}),n.add(e.domain)})}),commandId:c}).meta({id:`CreateConnectionFlowInput`}),xt=e.z.strictObject({domain:l,state:e.z.enum([`pending`,`provisioned`]),connectionId:i.optional()}).superRefine((e,t)=>{e.state===`provisioned`!=(e.connectionId!==void 0)&&t.addIssue({code:`custom`,path:[`connectionId`],message:e.state===`provisioned`?`A provisioned target requires a connection id`:`A pending target cannot have a connection id`})}).meta({id:`ConnectionFlowTarget`}),St=e.z.strictObject({id:ht,applicationId:a,tenantId:o,state:e.z.enum([`provisioning`,`ready`]),targets:e.z.array(xt).min(2).max(100),createdAt:u,updatedAt:u}).superRefine((e,t)=>{let n=e.targets.every(e=>e.state===`provisioned`);e.state===`ready`!==n&&t.addIssue({code:`custom`,path:[`state`],message:`Flow state must match target provisioning state`})}).meta({id:`ConnectionFlow`}),Ct=e.z.strictObject({flow:St}).meta({id:`ConnectionFlowResponse`}),z=e.z.enum([`invalid_request`,`unauthorized`,`forbidden`,`not_found`,`conflict`,`rate_limited`,`dns_unavailable`,`provider_unavailable`,`provider_authorization_failed`,`provider_limitation`,`plan_expired`,`propagation_pending`,`internal_error`]).meta({id:`Domain0ErrorCode`}),wt=e.z.object({error:e.z.object({code:z,message:e.z.string().min(1),requestId:e.z.string().min(1),retryable:e.z.boolean(),details:e.z.record(e.z.string(),e.z.unknown()).optional()}).strict()}).strict().meta({id:`ErrorResponse`}),B=e.z.string().min(1).max(200).brand(),V=e.z.string().regex(/^[A-Za-z0-9_-]{43}$/).brand(),Tt=e.z.strictObject({connectionId:i,expiresAt:u}),Et=e.z.strictObject({sharedFlowId:B,token:V,expiresAt:u}),Dt=e.z.strictObject({token:V,origin:e.z.string().url().max(2048)}),Ot=e.z.strictObject({sharedFlowId:B,connectionId:i,accessToken:e.z.string().min(1).max(8192),expiresAt:u}),kt=e.z.string().url().max(4096),H=kt.superRefine((e,t)=>{let n=new URL(e),r=n.protocol===`https:`,i=n.protocol===`http:`&&jt(n.hostname);!r&&!i&&t.addIssue({code:`custom`,message:`Shared-flow invitation URLs must use HTTPS, except on loopback development hosts`}),(n.username!==``||n.password!==``)&&t.addIssue({code:`custom`,message:`Shared-flow invitation URLs cannot contain user information`});let a=new URLSearchParams(n.hash.slice(1)),o=a.get(`domain0`);(a.size!==1||!V.safeParse(o).success)&&t.addIssue({code:`custom`,message:`Shared-flow invitation URLs require one valid domain0 capability in the fragment`})}).meta({id:`SharedFlowInvitationUrl`}),At=e.z.object({sharedFlowId:B,url:H,expiresAt:u}).strict().meta({id:`SharedFlowInvitation`});function jt(e){let t=e.toLowerCase();return t===`localhost`||t===`[::1]`||/^127(?:\.[0-9]{1,3}){3}$/.test(t)}const U=e.z.string().trim().toLowerCase().min(1).max(63).regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/).brand().meta({id:`DkimSelector`}),Mt=e.z.object({selectors:e.z.array(U).max(10).default([])}).strict().superRefine((e,t)=>{new Set(e.selectors).size!==e.selectors.length&&t.addIssue({code:`custom`,path:[`selectors`],message:`DKIM selectors must be unique`})}).meta({id:`DkimGuidanceInput`}),Nt=e.z.object({enableDkim:e.z.boolean().default(!1),dkimSelectors:e.z.array(U).max(10).default([])}).strict().superRefine((e,t)=>{new Set(e.dkimSelectors).size!==e.dkimSelectors.length&&t.addIssue({code:`custom`,path:[`dkimSelectors`],message:`DKIM selectors must be unique`})}).meta({id:`Domain0DkimGuidanceOptions`}),Pt=e.z.object({id:e.z.literal(`google_workspace`),name:e.z.literal(`Google Workspace`),guideUrl:e.z.literal(`https://support.google.com/a/answer/174124`)}).strict(),Ft=e.z.object({id:e.z.literal(`microsoft_365`),name:e.z.literal(`Microsoft 365`),guideUrl:e.z.literal(`https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure`)}).strict(),It=e.z.object({id:e.z.literal(`zoho_mail`),name:e.z.literal(`Zoho Mail`),guideUrl:e.z.literal(`https://www.zoho.com/mail/help/adminconsole/dkim-configuration.html`)}).strict(),W=e.z.discriminatedUnion(`id`,[Pt,Ft,It]).meta({id:`EmailProvider`}),Lt=e.z.enum([`detected`,`ambiguous`,`unknown`]).meta({id:`EmailProviderDetectionStatus`}),Rt=e.z.enum([`TXT`,`CNAME`]).meta({id:`DkimDnsRecordType`}),zt=e.z.enum([`record_observed`,`no_record_observed`,`not_checked`,`lookup_unavailable`]).meta({id:`DkimDnsEvidenceStatus`}),Bt=e.z.object({selector:U,types:e.z.array(Rt).min(1).max(2).refine(e=>new Set(e).size===e.length,`Observed DKIM DNS record types must be unique`)}).strict().meta({id:`DkimDnsRecordEvidence`}),Vt=e.z.object({status:zt,selectorsChecked:e.z.array(U).max(12).refine(e=>new Set(e).size===e.length,`Checked DKIM selectors must be unique`),records:e.z.array(Bt).max(12)}).strict().superRefine((e,t)=>{let n=new Set(e.selectorsChecked);e.records.some(e=>!n.has(e.selector))&&t.addIssue({code:`custom`,path:[`records`],message:`Observed records must belong to checked selectors`}),e.status===`not_checked`&&(e.selectorsChecked.length!==0||e.records.length!==0)&&t.addIssue({code:`custom`,path:[`status`],message:`Not-checked evidence cannot include selector observations`}),e.status===`record_observed`&&e.records.length===0&&t.addIssue({code:`custom`,path:[`records`],message:`Observed status requires at least one DNS record`}),e.status!==`record_observed`&&e.records.length!==0&&t.addIssue({code:`custom`,path:[`records`],message:`Only observed status can include DNS records`}),[`no_record_observed`,`lookup_unavailable`].includes(e.status)&&e.selectorsChecked.length===0&&t.addIssue({code:`custom`,path:[`selectorsChecked`],message:`A DNS lookup status requires at least one checked selector`})}).meta({id:`DkimDnsEvidence`}),Ht=e.z.object({domain:l,detectionStatus:Lt,candidates:e.z.array(W).max(3),provider:W.optional(),mxHosts:e.z.array(l).max(20).refine(e=>new Set(e).size===e.length,`MX hosts must be unique`),dkimDns:Vt,observedAt:u}).strict().superRefine((e,t)=>{let n=e.candidates.map(e=>e.id);new Set(n).size!==n.length&&t.addIssue({code:`custom`,path:[`candidates`],message:`Email provider candidates must be unique`}),e.detectionStatus===`detected`&&(e.candidates.length!==1||e.provider?.id!==e.candidates[0]?.id)&&t.addIssue({code:`custom`,path:[`provider`],message:`Detected status requires exactly one matching provider`}),e.detectionStatus===`ambiguous`&&(e.candidates.length<2||e.provider!==void 0)&&t.addIssue({code:`custom`,path:[`candidates`],message:`Ambiguous status requires multiple candidates and no resolved provider`}),e.detectionStatus===`unknown`&&(e.candidates.length!==0||e.provider!==void 0)&&t.addIssue({code:`custom`,path:[`candidates`],message:`Unknown status cannot include an email provider`})}).meta({id:`DkimGuidanceResponse`}),G=e.z.union([e.z.enum([`loading`,`provider_detection`,`provider_selection`,`cancellation_confirmation`]),C]).meta({id:`Domain0ConnectStep`}),Ut=e.z.enum([`close_button`,`escape`,`programmatic`,`destroyed`,`automatic`]).meta({id:`Domain0ConnectCloseTrigger`}),Wt=e.z.enum([`success`,`failure`,`cancelled`,`incomplete`]).meta({id:`Domain0ConnectOutcome`}),Gt=T.and(e.z.object({state:e.z.literal(`active`)})),Kt=T.and(e.z.object({state:e.z.literal(`manual_required`)})),qt=e.z.union([T.and(e.z.object({state:e.z.literal(`failed_retryable`),failure:w})),T.and(e.z.object({state:e.z.literal(`failed_terminal`),failure:e.z.undefined().optional()}))]),K=e.z.discriminatedUnion(`source`,[e.z.object({source:e.z.literal(`configuration`),code:e.z.literal(`invalid_configuration`),retryable:e.z.literal(!1)}).strict(),e.z.object({source:e.z.literal(`api`),code:z,retryable:e.z.boolean(),requestId:e.z.string().min(1)}).strict(),e.z.object({source:e.z.literal(`transport`),code:e.z.literal(`transport_error`),retryable:e.z.literal(!0)}).strict(),e.z.object({source:e.z.literal(`protocol`),code:e.z.literal(`protocol_error`),retryable:e.z.literal(!1)}).strict(),e.z.object({source:e.z.literal(`unexpected`),code:e.z.literal(`unexpected_error`),retryable:e.z.literal(!1)}).strict()]).meta({id:`Domain0ConnectError`}),Jt=e.z.object({type:e.z.literal(`success`),connection:Gt}).strict().meta({id:`Domain0ConnectSuccessEvent`}),Yt=e.z.object({type:e.z.literal(`failure`),connection:qt}).strict().meta({id:`Domain0ConnectFailureEvent`}),Xt=e.z.object({type:e.z.literal(`error`),error:K,connection:T.optional(),step:G.optional()}).strict().meta({id:`Domain0ConnectErrorEvent`}),Zt=e.z.object({type:e.z.literal(`close`),trigger:Ut,outcome:Wt,connection:T.optional(),step:G.optional(),error:K.optional()}).strict().superRefine((e,t)=>{let n=an(e.connection,e.error);e.outcome!==n&&t.addIssue({code:`custom`,path:[`outcome`],message:`Close outcome must be ${n} for the supplied connection and error`})}).meta({id:`Domain0ConnectCloseEvent`}),Qt=e.z.object({type:e.z.literal(`step_change`),step:G,previousStep:G.optional(),connection:T.optional()}).strict().meta({id:`Domain0ConnectStepChangeEvent`}),$t=e.z.object({type:e.z.literal(`manual_setup_documentation_click`),connection:Kt}).strict().meta({id:`Domain0ManualSetupDocumentationClickEvent`}),en=e.z.object({type:e.z.literal(`request_close`),connection:T.optional(),step:G}).strict().meta({id:`Domain0RequestCloseEvent`}),tn=e.z.object({type:e.z.literal(`shared_flow_sent`),connection:Kt,sharedFlowId:B,url:H,expiresAt:u}).strict().meta({id:`Domain0SharedFlowSentEvent`}),nn=e.z.object({type:e.z.literal(`dkim_setup_documentation_click`),connection:Gt,emailProvider:W}).strict().meta({id:`Domain0DkimSetupDocumentationClickEvent`}),rn=e.z.discriminatedUnion(`type`,[Jt,Yt,Xt,Zt,Qt,$t,en,tn,nn]).meta({id:`Domain0ConnectEvent`});function an(e,t){return e?.state===`active`?`success`:t!==void 0||e?.state===`failed_retryable`||e?.state===`failed_terminal`?`failure`:e?.state===`cancelled`?`cancelled`:`incomplete`}const on=e.z.object({mode:e.z.enum([`automatic`,`manual`]).default(`automatic`),conflictPolicy:y.default(`replace_same_name_and_type`),spfPolicy:b.default(`merge`)}).strict(),sn=/^#[0-9A-F]{6}$/,cn=/^#[0-9A-F]{8}$/,q=e.z.string().trim().toUpperCase().regex(sn,`Expected an opaque #RRGGBB color`),ln=e.z.string().trim().toUpperCase().regex(cn,`Expected a #RRGGBBAA backdrop color`),un=e.z.string().trim().min(1).max(500).refine(e=>!/[<>\u0000-\u001F\u007F]/.test(e),`White-label copy must be plain text without markup or control characters`),dn=un.max(120).meta({id:`Domain0ApplicationName`}),fn=e.z.string().trim().min(1).max(2048).refine(e=>{try{let t=new URL(e);return t.protocol===`https:`&&t.username===``&&t.password===``}catch{return!1}},`Logo must be an HTTPS URL without embedded credentials`).meta({id:`Domain0WhiteLabelLogoUrl`});function J(...e){return un.refine(t=>{let n=e.reduce((e,t)=>e.replaceAll(t,``),t);return!/[{}]/.test(n)},`Only these placeholders are allowed: ${e.join(`, `)||`none`}`)}function Y(t){let n=e.z.object({en:t,es:t.optional(),pt:t.optional(),"pt-br":t.optional(),"pt-pt":t.optional(),fr:t.optional(),it:t.optional(),de:t.optional(),nl:t.optional(),pl:t.optional(),tr:t.optional(),ja:t.optional(),da:t.optional(),sv:t.optional()}).strict();return e.z.union([t.transform(e=>({en:e})),n])}function pn(e,t){return mn(q.parse(e),q.parse(t))}function mn(e,t){let n=gn(e),r=gn(t),i=Math.max(n,r),a=Math.min(n,r);return(i+.05)/(a+.05)}function hn(e){let t=e.split(`,`);return t.length<=10&&t.every(e=>{let t=e.trim();if(t.length===0)return!1;let n=t.at(0);return n===`"`||n===`'`?t.at(-1)===n&&/^[A-Za-z0-9 -]+$/.test(t.slice(1,-1)):/^-?[A-Za-z][A-Za-z0-9 -]*$/.test(t)})}function gn(e){let[t,n,r]=[1,3,5].map(t=>Number.parseInt(e.slice(t,t+2),16)/255).map(e=>e<=.04045?e/12.92:((e+.055)/1.055)**2.4);return .2126*t+.7152*n+.0722*r}const _n=[{foreground:`text`,background:`surface`,minimum:4.5,purpose:`body text`},{foreground:`mutedText`,background:`surface`,minimum:4.5,purpose:`secondary text`},{foreground:`onPrimary`,background:`primary`,minimum:4.5,purpose:`primary control text`},{foreground:`danger`,background:`surface`,minimum:4.5,purpose:`error text`},{foreground:`onDanger`,background:`danger`,minimum:4.5,purpose:`danger control text`},{foreground:`link`,background:`surface`,minimum:4.5,purpose:`link text`},{foreground:`border`,background:`surface`,minimum:3,purpose:`control boundaries`},{foreground:`primary`,background:`surface`,minimum:3,purpose:`primary control boundaries`},{foreground:`focus`,background:`surface`,minimum:3,purpose:`focus indicators`}],vn={surface:`#FFFFFF`,text:`#0A0A0A`,mutedText:`#6B6B6B`,border:`#73737C`,primary:`#0A0A0A`,onPrimary:`#FFFFFF`,link:`#2B21FF`,focus:`#2B21FF`,danger:`#B3261E`,onDanger:`#FFFFFF`},yn={surface:`#111827`,text:`#F9FAFB`,mutedText:`#D1D5DB`,border:`#D1D5DB`,primary:`#BFDBFE`,onPrimary:`#172554`,link:`#BFDBFE`,focus:`#FBBF24`,danger:`#FCA5A5`,onDanger:`#450A0A`};function bn(t){return e.z.object({surface:q.default(t.surface),text:q.default(t.text),mutedText:q.default(t.mutedText),border:q.default(t.border),primary:q.default(t.primary),onPrimary:q.default(t.onPrimary),link:q.default(t.link),focus:q.default(t.focus),danger:q.default(t.danger),onDanger:q.default(t.onDanger)}).strict().superRefine((e,t)=>{for(let n of _n){let r=mn(e[n.foreground],e[n.background]);r<n.minimum&&t.addIssue({code:`custom`,path:[n.foreground],message:`${n.purpose} requires ${n.minimum}:1 contrast against ${n.background}; received ${r.toFixed(2)}:1`})}})}const xn=bn(vn),Sn=bn(yn),Cn=e.z.object({colorMode:e.z.enum([`light`,`dark`,`system`]).default(`light`),light:xn.prefault({}),dark:Sn.prefault({}),backdrop:ln.default(`#2B21FF26`),widthPx:e.z.number().int().min(320).max(960).default(520),dialogRadiusPx:e.z.number().int().min(0).max(48).default(20),buttonRadiusPx:e.z.number().int().min(0).max(999).default(999),inputRadiusPx:e.z.number().int().min(0).max(32).default(12),fontFamily:e.z.string().trim().min(1).max(200).refine(hn,`Use a comma-separated system font stack without URLs or CSS syntax`).default(`"PP Neue Montreal", "Inter Tight", ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif`),fontWeight:e.z.number().int().min(100).max(900).multipleOf(50).default(400),boldFontWeight:e.z.number().int().min(100).max(900).multipleOf(50).default(500)}).strict().superRefine((e,t)=>{e.boldFontWeight<e.fontWeight&&t.addIssue({code:`custom`,path:[`boldFontWeight`],message:`Bold font weight must be at least the normal font weight`})}),wn=e.z.object({initialSubtitle:Y(J()).optional(),providerLoginMessage:Y(J(`{PROVIDER}`)).optional(),successTitle:Y(J(`{DOMAIN}`)).optional(),successDescription:Y(J(`{DOMAIN}`)).optional(),successButton:Y(J()).optional(),manuallyScreen:e.z.object({disableManualSetupDocumentationLink:e.z.boolean().default(!1),stepByStepGuide:Y(J()).optional()}).strict().prefault({})}).strict(),Tn=e.z.object({disable:e.z.boolean().default(!1)}).strict(),En=e.z.object({manualConfiguration:e.z.object({disableScreen:e.z.boolean().default(!1)}).strict().prefault({}),providerLogin:e.z.object({forwardLink:Tn.prefault({}),gotoManualLink:Tn.prefault({})}).strict().prefault({})}).strict(),Dn=e.z.object({theme:Cn.prefault({}),copy:wn.prefault({}),logo:fn.optional(),logoBackgroundColor:q.optional(),removeLogoBorder:e.z.boolean().default(!1),hideCompanyLogo:e.z.boolean().default(!1),hideCompanyName:e.z.boolean().default(!1),removeShareLogin:e.z.boolean().default(!1),skipCongratulationsScreen:e.z.boolean().default(!1),customProperties:En.prefault({})}).strict(),On=e.z.url({protocol:/^https$/}).max(2048).refine(e=>{let t=new URL(e);return t.username===``&&t.password===``},`Manual setup documentation URL must not contain credentials`).brand().meta({id:`ManualSetupDocumentationUrl`}),kn=e.z.object({applicationName:dn.optional(),whiteLabel:Dn.prefault({}),setupPolicy:on.prefault({}),dkim:Nt.prefault({}),manualSetupDocumentation:On.optional()}).strict().superRefine((e,t)=>{let{customProperties:n}=e.whiteLabel,r=e.setupPolicy.mode===`manual`;r&&n.manualConfiguration.disableScreen&&t.addIssue({code:`custom`,path:[`whiteLabel`,`customProperties`,`manualConfiguration`,`disableScreen`],message:`Forced manual setup requires the manual configuration screen`}),r&&n.providerLogin.gotoManualLink.disable&&t.addIssue({code:`custom`,path:[`whiteLabel`,`customProperties`,`providerLogin`,`gotoManualLink`,`disable`],message:`Forced manual setup cannot disable entry into manual configuration`}),e.dkim.enableDkim&&e.whiteLabel.skipCongratulationsScreen&&t.addIssue({code:`custom`,path:[`whiteLabel`,`skipCongratulationsScreen`],message:`DKIM guidance requires the success screen`})}).meta({id:`Domain0ConnectConfiguration`}),An=e.z.enum(`alibaba-cloud.all-inkl.amazon-route-53.cloudns.digitalocean.dnsimple.dreamhost.dynadot.easydns.gandi.hetzner.hostgator.hostinger.hosting-com.inmotion-hosting.name-com.namecheap.netlify.o2switch.openprovider.opensrs.ovh.porkbun.simply.spaceship.transip.united-domains.wix`.split(`.`)).meta({id:`CompiledProviderId`}),jn=e.z.enum([`authenticated_snapshot`,`reserved_name_available`,`create_sibling`,`create_target`,`rrset_sibling_preservation`,`idempotent_replay`,`replace_target`,`authoritative_propagation`,`delete_target`,`scoped_cleanup`]).meta({id:`ProviderConformanceCheckName`}),X=[`authenticated_snapshot`,`reserved_name_available`,`create_sibling`,`create_target`,`rrset_sibling_preservation`,`idempotent_replay`,`replace_target`,`authoritative_propagation`,`delete_target`,`scoped_cleanup`],Mn=e.z.object({name:jn}).strict(),Nn=e.z.union([e.z.literal(`unknown`),e.z.string().regex(/^[a-f0-9]{40,64}$/)]),Pn=e.z.object({schemaVersion:e.z.literal(1),providerId:An,adapterVersion:e.z.string().min(1).max(200).refine(Ln),sourceRevision:Nn,sourceModified:e.z.boolean(),binarySha256:e.z.string().regex(/^[a-f0-9]{64}$/),zone:l,runId:e.z.string().regex(/^[a-f0-9]{16,64}$/),host:e.z.string(),startedAt:u,completedAt:u,passed:e.z.boolean(),checks:e.z.array(Mn).max(X.length),cleanupAttempted:e.z.boolean(),cleanupCompleted:e.z.boolean()}).strict().superRefine((e,t)=>{e.host!==`_domain0-conformance-${e.runId}`&&t.addIssue({code:`custom`,path:[`host`],message:`Conformance hostname must be derived from the random run ID`}),Date.parse(e.completedAt)<Date.parse(e.startedAt)&&t.addIssue({code:`custom`,path:[`completedAt`],message:`Conformance completion must not precede its start`});let n=e.checks.map(e=>e.name);In(n)||t.addIssue({code:`custom`,path:[`checks`],message:`Conformance checks must be an ordered prefix followed optionally by scoped cleanup`});let r=n.includes(`scoped_cleanup`);(e.cleanupCompleted&&!e.cleanupAttempted||r!==e.cleanupCompleted)&&t.addIssue({code:`custom`,path:[`cleanupCompleted`],message:`Completed cleanup requires an attempted cleanup and the scoped-cleanup check`})}).meta({id:`ProviderConformanceEvidence`}),Fn=Pn.refine(e=>e.passed&&!e.sourceModified&&e.sourceRevision!==`unknown`&&e.cleanupAttempted&&e.cleanupCompleted&&e.checks.every((e,t)=>e.name===X[t])&&e.checks.length===X.length,`Verified live-suite evidence requires clean traceable source, every ordered check, and completed cleanup`).meta({id:`VerifiedProviderConformanceEvidence`});function In(e){let t=0,n=!1;for(let r of e){if(r===`scoped_cleanup`){if(n)return!1;n=!0;continue}if(n||r!==X[t])return!1;t+=1}return!0}function Ln(e){return e.trim()===e&&!/[\u0000\r\n]/.test(e)}const Rn=e.z.enum([`delegated`,`undelegated`,`unknown`]).meta({id:`DomainDelegationStatus`}),zn=e.z.enum([`automatic`,`manual`,`unavailable`,`ambiguous`,`unknown`]).meta({id:`DomainSetupSupport`}),Bn=e.z.enum([`same_name_and_type`,`cname_collision`,`mx_set_collision`,`spf_collision`,`ns_delegation`]).meta({id:`RecordConflictReason`}),Vn=e.z.object({domain:l,records:e.z.array(m).max(100).default([]),checkConflicts:e.z.boolean().default(!1)}).strict().superRefine((e,t)=>{e.checkConflicts&&e.records.length===0&&t.addIssue({code:`custom`,path:[`records`],message:`Record conflict analysis requires at least one requested record`})}).meta({id:`CheckDomainInput`}),Hn=e.z.object({provider:x,confidence:e.z.number().min(0).max(1),exact:e.z.boolean()}).strict().meta({id:`DomainProviderCandidate`}),Un=e.z.object({requested:m,existing:e.z.array(m).max(1e3),reasons:e.z.array(Bn).min(1).max(5).refine(e=>new Set(e).size===e.length,`Conflict reasons must be unique`)}).strict().meta({id:`DomainRecordConflict`}),Wn=e.z.object({status:e.z.enum([`not_requested`,`complete`,`partial`]),authoritativeServers:e.z.number().int().min(0).max(16),respondingServers:e.z.number().int().min(0).max(16),conflicts:e.z.array(Un).max(100)}).strict().superRefine((e,t)=>{e.respondingServers>e.authoritativeServers&&t.addIssue({code:`custom`,path:[`respondingServers`],message:`Responding nameservers cannot exceed authoritative nameservers`}),e.status===`complete`&&e.respondingServers!==e.authoritativeServers&&t.addIssue({code:`custom`,path:[`status`],message:`Complete analysis requires every authoritative nameserver to respond`}),e.status===`partial`&&(e.respondingServers===0||e.respondingServers>=e.authoritativeServers)&&t.addIssue({code:`custom`,path:[`status`],message:`Partial analysis requires some but not all authoritative nameservers to respond`}),e.status===`not_requested`&&e.conflicts.length!==0&&t.addIssue({code:`custom`,path:[`conflicts`],message:`Conflict results cannot exist when analysis was not requested`})}).meta({id:`ConflictAnalysis`}),Gn=e.z.object({domain:l,delegationStatus:Rn,candidates:e.z.array(Hn).max(65),provider:x.optional(),setupSupport:zn,conflictAnalysis:Wn}).strict().superRefine((e,t)=>{let n=e.candidates.map(e=>e.provider.id);new Set(n).size!==n.length&&t.addIssue({code:`custom`,path:[`candidates`],message:`Provider candidates must be unique`}),e.delegationStatus===`undelegated`&&(e.candidates.length!==0||e.provider!==void 0||e.setupSupport!==`unavailable`)&&t.addIssue({code:`custom`,path:[`delegationStatus`],message:`Undelegated domains cannot have provider support`}),e.provider!==void 0&&!e.candidates.some(t=>t.exact&&t.provider.id===e.provider?.id)&&t.addIssue({code:`custom`,path:[`provider`],message:`Resolved provider must be an exact provider candidate`}),[`automatic`,`manual`].includes(e.setupSupport)&&e.provider===void 0&&t.addIssue({code:`custom`,path:[`setupSupport`],message:`Available setup support requires a resolved provider`}),e.setupSupport===`automatic`&&!e.provider?.availableAuthorizationMethods.some(e=>e!==`manual`)&&t.addIssue({code:`custom`,path:[`setupSupport`],message:`Automatic setup requires a configured non-manual authorization method`}),e.setupSupport===`manual`&&(e.provider?.availableAuthorizationMethods.length!==1||e.provider.availableAuthorizationMethods[0]!==`manual`)&&t.addIssue({code:`custom`,path:[`setupSupport`],message:`Manual setup requires the manual authorization method`}),e.setupSupport===`ambiguous`&&e.candidates.length===0&&t.addIssue({code:`custom`,path:[`candidates`],message:`Ambiguous setup requires provider candidates`}),e.setupSupport===`unknown`&&e.candidates.length!==0&&t.addIssue({code:`custom`,path:[`candidates`],message:`Unknown setup cannot include provider candidates`}),[`ambiguous`,`unknown`].includes(e.setupSupport)&&e.provider!==void 0&&t.addIssue({code:`custom`,path:[`provider`],message:`Ambiguous or unknown support cannot resolve one provider`})}).meta({id:`CheckDomainResponse`}),Kn=[`en`,`es`,`pt`,`pt-br`,`pt-pt`,`fr`,`it`,`de`,`nl`,`pl`,`tr`,`ja`,`da`,`sv`],qn=e.z.enum(Kn).meta({id:`Domain0Locale`}),Jn=e.z.strictObject({intent:_}).meta({id:`PlatformCreateConnectionInput`}),Yn=e.z.enum([`connection.requested`,`provider.detection_started`,`provider.selected`,`authorization.required`,`domain_connect.started`,`domain_connect.submitted`,`authorization.completed`,`connection.planning_started`,`connection.plan_prepared`,`connection.planning_restarted`,`connection.already_configured`,`connection.plan_confirmed`,`connection.changes_applied`,`connection.propagation_checked`,`connection.propagation_timed_out`,`connection.activated`,`connection.manual_required`,`connection.manual_submitted`,`connection.failed_retryable`,`connection.retry_started`,`connection.cancelled`]).meta({id:`Domain0WebhookEventType`}),Z=e.z.string().regex(/^[0-9a-f]{64}$/).brand().meta({id:`Domain0WebhookEventId`}),Xn=e.z.record(e.z.string().min(1).max(100),e.z.string().max(4e3)).superRefine((e,t)=>{Object.keys(e).length>64&&t.addIssue({code:`custom`,message:`Webhook attributes must contain at most 64 entries`})}).meta({id:`Domain0WebhookAttributes`}),Zn=e.z.strictObject({schemaVersion:e.z.literal(1),eventId:Z,type:Yn,connectionId:i,applicationId:a,tenantId:o,sequence:e.z.number().int().positive().max(2**53-1),occurredAt:u,attributes:Xn}).meta({id:`Domain0WebhookEvent`}),Qn=e.z.enum([`invalid_headers`,`stale_timestamp`,`invalid_signature`,`invalid_payload`,`crypto_unavailable`]).meta({id:`Domain0WebhookVerificationErrorCode`});var $n=class extends Error{code;name=`Domain0WebhookVerificationError`;constructor(e,t,n){super(t,n),this.code=e}};const Q={eventId:`x-domain0-event-id`,eventType:`x-domain0-event-type`,deliveryAttempt:`x-domain0-delivery-attempt`,schemaVersion:`x-domain0-schema-version`,signatureKeyId:`x-domain0-signature-key-id`,timestamp:`x-domain0-timestamp`,signature:`x-domain0-signature`},er=e.z.strictObject({eventId:Z,eventType:e.z.string().regex(/^domain0\.[a-z_]+\.[a-z_]+$/).max(100),deliveryAttempt:e.z.string().regex(/^[1-9][0-9]{0,8}$/).transform(Number),schemaVersion:e.z.literal(`1`),signatureKeyId:e.z.string().regex(/^[A-Za-z0-9._-]{1,64}$/),timestamp:e.z.string().regex(/^[0-9]{1,12}$/).transform(Number),signature:e.z.string().regex(/^v1=[0-9a-f]{64}$/)}),tr=new TextEncoder;async function nr(e){let t=typeof e.body==`string`?tr.encode(e.body):new Uint8Array(e.body),n=ir(e.maxBodyBytes??1048576,16777216);if(!(t instanceof Uint8Array)||t.byteLength===0||t.byteLength>n)throw $(`invalid_payload`,`Webhook body is empty or exceeds the configured limit`);let r=rr(e.headers),i=ar(e.nowUnixSeconds??Math.floor(Date.now()/1e3),2**53-1),a=ir(e.maxAgeSeconds??300,86400);if(Math.abs(i-r.timestamp)>a)throw $(`stale_timestamp`,`Webhook timestamp is outside the accepted replay window`);let o=Object.prototype.hasOwnProperty.call(e.secretKeyring,r.signatureKeyId)?e.secretKeyring[r.signatureKeyId]:void 0;if(!(o instanceof Uint8Array)||o.byteLength!==32)throw $(`invalid_signature`,`Webhook signature is invalid`);let s=e.crypto??globalThis.crypto;if(s?.subtle===void 0)throw $(`crypto_unavailable`,`Web Crypto is unavailable`);let c=or(r.signature.slice(3)),l=tr.encode(`v1.${r.signatureKeyId}.${r.timestamp}.`),u=new Uint8Array(l.byteLength+t.byteLength);u.set(l),u.set(t,l.byteLength);let ee=await s.subtle.importKey(`raw`,new Uint8Array(o),{name:`HMAC`,hash:`SHA-256`},!1,[`verify`]);if(!await s.subtle.verify(`HMAC`,ee,new Uint8Array(c),u))throw $(`invalid_signature`,`Webhook signature is invalid`);let d;try{let e=new TextDecoder(`utf-8`,{fatal:!0}).decode(t);d=JSON.parse(e)}catch(e){throw $(`invalid_payload`,`Verified webhook body is not valid UTF-8 JSON`,e)}let f=Zn.safeParse(d);if(!f.success)throw $(`invalid_payload`,`Verified webhook body does not match schema version 1`,f.error);if(f.data.eventId!==r.eventId||`domain0.${f.data.type}`!==r.eventType||String(f.data.schemaVersion)!==r.schemaVersion)throw $(`invalid_payload`,`Verified webhook headers do not match the event body`);return f.data}function rr(e){let t={eventId:void 0,eventType:void 0,deliveryAttempt:void 0,schemaVersion:void 0,signatureKeyId:void 0,timestamp:void 0,signature:void 0};if(`get`in e&&typeof e.get==`function`)for(let[n,r]of Object.entries(Q))t[n]=e.get(r)??void 0;else{let n=new Map;for(let e of Object.keys(Q))n.set(Q[e],e);let r=new Set;for(let[i,a]of Object.entries(e)){let e=i.toLowerCase(),o=n.get(e);if(o!==void 0){if(r.has(e)||typeof a!=`string`)throw $(`invalid_headers`,`Webhook headers are missing, duplicated, or malformed`);r.add(e),t[o]=a}}}let n=er.safeParse(t);if(!n.success)throw $(`invalid_headers`,`Webhook headers are missing, duplicated, or malformed`,n.error);return n.data}function ir(e,t){if(!Number.isSafeInteger(e)||e<1||e>t)throw $(`invalid_headers`,`Webhook verification limits are invalid`);return e}function ar(e,t){if(!Number.isSafeInteger(e)||e<0||e>t)throw $(`invalid_headers`,`Webhook verification time is invalid`);return e}function or(e){let t=new Uint8Array(e.length/2);for(let n=0;n<e.length;n+=2)t[n/2]=Number.parseInt(e.slice(n,n+2),16);return t}function $(e,t,n){return new $n(e,t,n===void 0?void 0:{cause:n})}exports.AccessKeyCredentialsSchema=k,exports.AccountTokenCredentialsSchema=j,exports.AdvancedDmarcOptionsSchema=re,exports.ApiTokenCredentialsSchema=O,exports.ApplicationIdSchema=a,exports.ApplyPlanInputSchema=ot,exports.AuthorizationMethodSchema=me,exports.AuthorizeWithCredentialInputSchema=rt,exports.AutomaticDomainConnectInputSchema=Re,exports.AwsSessionCredentialsSchema=F,exports.CPanelCredentialsSchema=I,exports.CancelConnectionInputSchema=ut,exports.ChangeActionSchema=ce,exports.ChangePlanSchema=Ee,exports.CheckDomainInputSchema=Vn,exports.CheckDomainResponseSchema=Gn,exports.CheckRecordsInputSchema=ae,exports.CheckRecordsResponseSchema=se,exports.CheckedRecordSchema=oe,exports.ClientCredentialsSchema=L,exports.CommandIdSchema=c,exports.CompiledProviderIdSchema=An,exports.ConditionalDnsRecordsSchema=gt,exports.ConfirmPlanInputSchema=Ue,exports.ConflictAnalysisSchema=Wn,exports.ConflictPolicySchema=y,exports.ConnectionFailureCodeSchema=we,exports.ConnectionFailureSchema=w,exports.ConnectionFlowIdSchema=ht,exports.ConnectionFlowResponseSchema=Ct,exports.ConnectionFlowSchema=St,exports.ConnectionFlowTargetInputSchema=yt,exports.ConnectionFlowTargetSchema=xt,exports.ConnectionIdSchema=i,exports.ConnectionSchema=T,exports.ConnectionStateSchema=C,exports.ContinueProviderSessionInputSchema=Ze,exports.CreateConnectionFlowInputSchema=bt,exports.CreateConnectionInputSchema=De,exports.CreateConnectionResponseSchema=Oe,exports.CreateSharedFlowInputSchema=Tt,exports.CreateSharedFlowResponseSchema=Et,exports.DOMAIN0_WEBHOOK_HEADER_NAMES=Q,exports.DetectProviderResponseSchema=je,exports.DirectCredentialsSchema=$e,exports.DkimDnsEvidenceSchema=Vt,exports.DkimDnsEvidenceStatusSchema=zt,exports.DkimDnsRecordEvidenceSchema=Bt,exports.DkimDnsRecordTypeSchema=Rt,exports.DkimGuidanceInputSchema=Mt,exports.DkimGuidanceResponseSchema=Ht,exports.DkimSelectorSchema=U,exports.DnsIntentSchema=_,exports.DnsRecordSchema=h,exports.DnsRecordTypeSchema=f,exports.Domain0ApplicationNameSchema=dn,exports.Domain0ConnectCloseEventSchema=Zt,exports.Domain0ConnectCloseTriggerSchema=Ut,exports.Domain0ConnectConfigurationSchema=kn,exports.Domain0ConnectErrorEventSchema=Xt,exports.Domain0ConnectErrorSchema=K,exports.Domain0ConnectEventSchema=rn,exports.Domain0ConnectFailureEventSchema=Yt,exports.Domain0ConnectOutcomeSchema=Wt,exports.Domain0ConnectStepChangeEventSchema=Qt,exports.Domain0ConnectStepSchema=G,exports.Domain0ConnectSuccessEventSchema=Jt,exports.Domain0DkimGuidanceOptionsSchema=Nt,exports.Domain0DkimSetupDocumentationClickEventSchema=nn,exports.Domain0ErrorCodeSchema=z,exports.Domain0ErrorResponseSchema=wt,exports.Domain0LocaleSchema=qn,exports.Domain0ManualSetupDocumentationClickEventSchema=$t,exports.Domain0RequestCloseEventSchema=en,exports.Domain0SetupPolicySchema=on,exports.Domain0SharedFlowSentEventSchema=tn,exports.Domain0WebhookAttributesSchema=Xn,exports.Domain0WebhookEventIdSchema=Z,exports.Domain0WebhookEventSchema=Zn,exports.Domain0WebhookEventTypeSchema=Yn,exports.Domain0WebhookVerificationError=$n,exports.Domain0WebhookVerificationErrorCodeSchema=Qn,exports.Domain0WhiteLabelCopySchema=wn,exports.Domain0WhiteLabelCustomPropertiesSchema=En,exports.Domain0WhiteLabelLogoUrlSchema=fn,exports.Domain0WhiteLabelSchema=Dn,exports.Domain0WhiteLabelThemeSchema=Cn,exports.DomainConnectTemplateSchema=Ie,exports.DomainDelegationStatusSchema=Rn,exports.DomainNameSchema=l,exports.DomainProviderCandidateSchema=Hn,exports.DomainRecordConflictSchema=Un,exports.DomainSetupSupportSchema=zn,exports.EmailProviderDetectionStatusSchema=Lt,exports.EmailProviderSchema=W,exports.ExistingRecordPolicySchema=g,exports.ExplicitDomainConnectInputSchema=Le,exports.GetConnectionResponseSchema=ke,exports.IsoDateTimeSchema=u,exports.IssueConnectionTokenInputSchema=ft,exports.IssueConnectionTokenResponseSchema=pt,exports.ListProvidersResponseSchema=ye,exports.ManualSetupDocumentationUrlSchema=On,exports.OAuthCallbackResponseSchema=it,exports.OvhCredentialsSchema=N,exports.PlanWarningCodeSchema=Te,exports.PlannedChangeSchema=le,exports.PlatformCreateConnectionInputSchema=Jn,exports.PreparePlanInputSchema=at,exports.PrivateKeyCredentialsSchema=P,exports.ProviderAuthorizationInputsSchema=n,exports.ProviderCandidateSchema=Ae,exports.ProviderCapabilitiesSchema=he,exports.ProviderConformanceCheckNameSchema=jn,exports.ProviderConformanceEvidenceSchema=Pn,exports.ProviderDetectionSchema=_e,exports.ProviderDetectionUnavailableReasonCodeSchema=ge,exports.ProviderHealthReasonSchema=S,exports.ProviderHealthResponseSchema=Se,exports.ProviderHealthSchema=xe,exports.ProviderHealthStatusSchema=be,exports.ProviderIdSchema=s,exports.ProviderImplementationSchema=pe,exports.ProviderSchema=x,exports.ProviderSessionChallengeKindSchema=Ke,exports.ProviderSessionChallengeSchema=qe,exports.ProviderSessionResponseSchema=Xe,exports.RecordConflictReasonSchema=Bn,exports.ResolveSharedFlowInputSchema=Dt,exports.ResolveSharedFlowResponseSchema=Ot,exports.ResolvedDnsIntentSchema=v,exports.ResolvedDnsRecordSchema=m,exports.RetryConnectionInputSchema=dt,exports.RetryResumeStateSchema=Ce,exports.SelectProviderInputSchema=Me,exports.SharedFlowIdSchema=B,exports.SharedFlowInvitationSchema=At,exports.SharedFlowInvitationUrlSchema=H,exports.SharedFlowTokenSchema=V,exports.SharedFlowUrlSchema=kt,exports.SpfConflictPolicySchema=b,exports.StartDomainConnectInputSchema=ze,exports.StartDomainConnectResponseSchema=Ve,exports.StartManualConfigurationInputSchema=ct,exports.StartOAuthInputSchema=We,exports.StartOAuthResponseSchema=Ge,exports.StartProviderSessionInputSchema=et,exports.SubmitDomainConnectCompletionInputSchema=He,exports.SubmitManualCompletionInputSchema=lt,exports.TenantIdSchema=o,exports.TransientCredentialKindSchema=t,exports.UsernamePasswordCredentialsSchema=A,exports.UsernameTokenCredentialsSchema=M,exports.VerifiedProviderConformanceEvidenceSchema=Fn,exports.VerifyPropagationInputSchema=st,exports.colorContrastRatio=pn,exports.directCredentialKindByProvider=nt,exports.domain0Locales=Kn,exports.expectedProviderConformanceChecks=X,exports.verifyDomain0Webhook=nr;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("zod");const t=e.z.enum([`api_token`,`api_endpoint_token`,`access_key`,`username_password`,`account_token`,`sub_account_token`,`username_token`,`ovh`,`private_key`,`aws_session`,`cpanel`,`client_credentials`]).meta({id:`TransientCredentialKind`}),n=e.z.strictObject({directCredential:t.optional(),providerSession:t.optional()}).meta({id:`ProviderAuthorizationInputs`}),r=e.z.string().trim().min(1).max(200),i=r.brand().meta({id:`ConnectionId`}),a=r.brand().meta({id:`ApplicationId`}),o=r.brand().meta({id:`TenantId`}),s=e.z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).brand().meta({id:`ProviderId`}),c=r.brand().meta({id:`CommandId`}),l=e.z.string().trim().toLowerCase().overwrite(e=>e.replace(/\.$/,``)).min(3).max(253).regex(/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/).refine(e=>!/^\d+(?:\.\d+){3}$/.test(e),`IP addresses are not domain names`).brand().meta({id:`DomainName`}),u=e.z.iso.datetime({offset:!0}).meta({id:`IsoDateTime`}),ee=e.z.string().trim().toLowerCase().overwrite(e=>e.replace(/\.$/,``)).min(1).max(253).refine(de,`Host must be @ or a valid relative DNS name`),d=/^([0-9]{1,3})[\t ]+([A-Za-z0-9-]{1,15})[\t ]+(?:"([^\r\n"]*)"|([^\r\n"]+))$/,f=e.z.enum([`A`,`AAAA`,`CNAME`,`CAA`,`MX`,`TXT`,`NS`]).meta({id:`DnsRecordType`}),p=e.z.string().regex(/^[a-z]{1,32}$/),te=e.z.string().min(1).max(4096).refine(e=>e.trim()===e&&/^[\x20-\x3a\x3c-\x7e]+$/.test(e),{message:`DMARC tag values must be trimmed printable ASCII without semicolons`}),ne=e.z.record(p,te).refine(e=>Object.keys(e).length<=32,`At most 32 DMARC tags are allowed`),re=e.z.object({inheritRootDmarc:e.z.boolean().default(!1),overrideTags:ne.default({}),removeTags:e.z.array(p).max(32).refine(e=>new Set(e).size===e.length,`DMARC tags to remove must be unique`).default([]),addTagsIfNotExist:ne.default({})}).strict().refine(e=>e.inheritRootDmarc||Object.keys(e.overrideTags).length>0||e.removeTags.length>0||Object.keys(e.addTagsIfNotExist).length>0,`At least one advanced DMARC option is required`).superRefine((e,t)=>{for(let[n,r]of[[`overrideTags`,e.overrideTags],[`addTagsIfNotExist`,e.addTagsIfNotExist]])for(let[e,i]of Object.entries(r))pe(e,i)||t.addIssue({code:`custom`,path:[n,e],message:`Invalid value for the ${e} DMARC tag`})}).meta({id:`AdvancedDmarcOptions`}),ie=e.z.object({host:ee,type:f,value:e.z.string().trim().min(1).max(65535),ttl:e.z.number().int().min(1).max(2147483647).default(300),priority:e.z.number().int().min(0).max(65535).optional(),optional:e.z.boolean().default(!1)}).strict().superRefine((t,n)=>{if(t.type===`MX`&&t.priority===void 0&&n.addIssue({code:`custom`,path:[`priority`],message:`MX records require a priority`}),t.type!==`MX`&&t.priority!==void 0&&n.addIssue({code:`custom`,path:[`priority`],message:`Only MX records accept a priority`}),t.type===`A`&&!e.z.ipv4().safeParse(t.value).success&&n.addIssue({code:`custom`,path:[`value`],message:`A records require an IPv4 address`}),t.type===`AAAA`&&!e.z.ipv6().safeParse(t.value).success&&n.addIssue({code:`custom`,path:[`value`],message:`AAAA records require an IPv6 address`}),[`CNAME`,`MX`,`NS`].includes(t.type)&&!l.safeParse(t.value).success&&n.addIssue({code:`custom`,path:[`value`],message:`${t.type} records require a domain name`}),t.type===`CAA`){let e=d.exec(t.value);(e===null||Number(e[1])>255)&&n.addIssue({code:`custom`,path:[`value`],message:`CAA values must contain flags, a tag, and a quoted value`})}t.type===`TXT`&&/[\u0000\r\n]/.test(t.value)&&n.addIssue({code:`custom`,path:[`value`],message:`TXT values cannot contain NUL or newlines`})}),m=ie.meta({id:`ResolvedDnsRecord`}),h=ie.safeExtend({advancedDmarcOptions:re.optional()}).superRefine((e,t)=>{e.advancedDmarcOptions!==void 0&&((e.type!==`TXT`||e.host!==`_dmarc`&&!e.host.startsWith(`_dmarc.`))&&t.addIssue({code:`custom`,path:[`advancedDmarcOptions`],message:`Advanced DMARC options require a TXT record at a _dmarc host`}),fe(e.value)||t.addIssue({code:`custom`,path:[`value`],message:`Advanced DMARC options require a valid DMARC1 value with a policy tag`}))}).meta({id:`DnsRecord`}),g=e.z.object({validateDmarc:e.z.boolean().default(!1),validateCAA:e.z.boolean().default(!1)}).strict().meta({id:`ExistingRecordPolicy`}),_=e.z.object({domain:l,records:e.z.array(h).min(1).max(100),existingRecordPolicy:g.default({validateDmarc:!1,validateCAA:!1})}).strict().meta({id:`DnsIntent`}),ae=e.z.object({domain:l,records:e.z.array(m).max(100)}).strict().meta({id:`ResolvedDnsIntent`}),oe=ae.meta({id:`CheckRecordsInput`}),se=e.z.object({record:m,authoritativeServers:e.z.number().int().min(1).max(16),matchingServers:e.z.number().int().min(0).max(16),propagated:e.z.boolean()}).strict().superRefine((e,t)=>{e.matchingServers>e.authoritativeServers&&t.addIssue({code:`custom`,path:[`matchingServers`],message:`Matching nameservers cannot exceed authoritative nameservers`}),e.propagated!==(e.matchingServers===e.authoritativeServers)&&t.addIssue({code:`custom`,path:[`propagated`],message:`Propagation state must match the authoritative nameserver counts`})}).meta({id:`CheckedRecord`}),ce=e.z.object({domain:l,allPropagated:e.z.boolean(),records:e.z.array(se).min(1).max(100)}).strict().superRefine((e,t)=>{e.allPropagated!==e.records.every(e=>e.propagated)&&t.addIssue({code:`custom`,path:[`allPropagated`],message:`Overall propagation state must match every record result`})}).meta({id:`CheckRecordsResponse`}),v=e.z.enum([`preserve`,`replace_same_name_and_type`,`replace_all_at_name`]).meta({id:`ConflictPolicy`}),y=e.z.enum([`merge`,`replace`]).meta({id:`SpfConflictPolicy`}),le=e.z.enum([`create`,`replace`,`delete`]).meta({id:`ChangeAction`}),ue=e.z.object({action:le,before:m.optional(),after:m.optional(),destructive:e.z.boolean()}).strict().superRefine((e,t)=>{e.action===`create`&&e.after===void 0&&t.addIssue({code:`custom`,path:[`after`],message:`Create requires the resulting record`}),e.action===`replace`&&(e.before===void 0||e.after===void 0)&&t.addIssue({code:`custom`,message:`Replace requires both current and resulting records`}),e.action===`delete`&&e.before===void 0&&t.addIssue({code:`custom`,path:[`before`],message:`Delete requires the current record`})}).meta({id:`PlannedChange`});function de(e){return e===`@`||e.split(`.`).every((e,t)=>e===`*`?t===0:e.length>=1&&e.length<=63&&!e.startsWith(`-`)&&!e.endsWith(`-`)&&/^[a-z0-9_-]+$/.test(e))}function fe(e){let t=e.split(`;`).map(e=>e.trim()).filter(Boolean),n=new Set;if(t.length<2)return!1;for(let[e,r]of t.entries()){let t=r.indexOf(`=`);if(t<=0)return!1;let i=r.slice(0,t).trim().toLowerCase(),a=r.slice(t+1).trim();if(!p.safeParse(i).success||!te.safeParse(a).success||n.has(i)||e===0&&(i!==`v`||a!==`DMARC1`)||!pe(i,a))return!1;n.add(i)}return n.has(`p`)}function pe(e,t){if(e===`v`)return t===`DMARC1`;if([`p`,`sp`,`np`].includes(e))return[`none`,`quarantine`,`reject`].includes(t);if([`adkim`,`aspf`].includes(e))return t===`r`||t===`s`;if(e===`pct`)return/^\d{1,3}$/.test(t)&&Number(t)<=100;if(e===`ri`)return/^[1-9]\d*$/.test(t);if(e===`rf`)return t===`afrf`;if(e===`fo`){let e=t.split(`:`);return e.length>0&&new Set(e).size===e.length&&e.every(e=>[`0`,`1`,`d`,`s`].includes(e))&&!(e.includes(`0`)&&e.includes(`1`))}return!0}const me=e.z.enum([`automatic`,`domain_connect`,`manual`]).meta({id:`ProviderImplementation`}),he=e.z.enum([`oauth2_pkce`,`oauth2_authorization_code`,`provider_session`,`api_token`,`api_key`,`basic`,`session`,`domain_connect`,`manual`]).meta({id:`AuthorizationMethod`}),ge=e.z.strictObject({rootNSModification:e.z.enum([`supported`,`unsupported`,`unverified`]),subdomainNSModification:e.z.enum([`supported`,`unsupported`,`unverified`]),wwwRedirect:e.z.enum([`supported`,`unsupported`,`unverified`]),cnameFlattening:e.z.enum([`supported`,`unsupported`,`unverified`]),wildcardRecords:e.z.enum([`supported`,`unsupported`,`unverified`]),caaRecords:e.z.enum([`supported`,`unsupported`,`unverified`]),spfRecords:e.z.enum([`supported`,`unsupported`,`unverified`]),socialLogin:e.z.enum([`supported`,`unsupported`,`unverified`])}).meta({id:`ProviderCapabilities`}),_e=e.z.enum([`no_stable_public_provider_identity`]).meta({id:`ProviderDetectionUnavailableReasonCode`}),ve=e.z.discriminatedUnion(`method`,[e.z.strictObject({method:e.z.enum([`nameserver`,`domain_connect`,`nameserver_or_domain_connect`])}),e.z.strictObject({method:e.z.literal(`manual`),reasonCode:_e})]).meta({id:`ProviderDetection`}),ye=e.z.url({protocol:/^https$/}).regex(/^https:\/\//,`Provider reference URL must use HTTPS`).refine(e=>{let t=new URL(e);return t.username===``&&t.password===``},`Provider reference URL must not contain credentials`).meta({format:`uri`}),b=e.z.object({id:s,name:e.z.string().trim().min(1),referenceUrl:ye,implementation:me,availableAuthorizationMethods:e.z.array(he).refine(e=>new Set(e).size===e.length,`Authorization methods must be unique`).describe(`Available methods ordered from highest to lowest provider autonomy.`),authorizationInputs:n,capabilities:ge,detection:ve,limitations:e.z.array(e.z.string().min(1))}).strict().superRefine((e,t)=>{let n=e.availableAuthorizationMethods;(e.implementation===`automatic`?n[0]!==`domain_connect`&&n.some(e=>e!==`domain_connect`&&e!==`manual`)&&n.at(-1)===`manual`:e.implementation===`domain_connect`?n.length===2&&n[0]===`domain_connect`&&n[1]===`manual`:n.length===1&&n[0]===`manual`)||t.addIssue({code:`custom`,path:[`availableAuthorizationMethods`],message:`Domain Connect providers may expose only Domain Connect and manual fallback`}),n.some(e=>e===`api_token`||e===`api_key`||e===`basic`||e===`session`)!==(e.authorizationInputs.directCredential!==void 0)&&t.addIssue({code:`custom`,path:[`authorizationInputs`,`directCredential`],message:`Direct credential input must match the advertised authorization methods`}),n.includes(`provider_session`)!==(e.authorizationInputs.providerSession!==void 0)&&t.addIssue({code:`custom`,path:[`authorizationInputs`,`providerSession`],message:`Provider-session input must match the advertised authorization methods`})}).meta({id:`Provider`}),be=e.z.object({providers:e.z.array(b)}).strict().meta({id:`ListProvidersResponse`}),xe=e.z.enum([`operational`,`unavailable`]).meta({id:`ProviderHealthStatus`}),Se=e.z.enum([`automatic_ready`,`domain_connect_ready`,`runtime_authorization_unavailable`,`manual_only`]).meta({id:`ProviderHealthReason`}),Ce=e.z.object({providerId:s,providerName:e.z.string().trim().min(1).max(200),enabled:e.z.boolean(),status:xe,reason:Se}).strict().superRefine((e,t)=>{let n=e.reason===`automatic_ready`||e.reason===`domain_connect_ready`||e.reason===`manual_only`,r=e.enabled?e.status===`operational`:e.status===`unavailable`;(e.enabled!==n||!r)&&t.addIssue({code:`custom`,path:[`enabled`],message:`Enabled, status, and reason must describe the same provider health state`})}).meta({id:`ProviderHealth`}),we=e.z.object({observedAt:u,refreshAfter:u,providers:e.z.array(Ce)}).strict().superRefine((e,t)=>{Date.parse(e.refreshAfter)<=Date.parse(e.observedAt)&&t.addIssue({code:`custom`,path:[`refreshAfter`],message:`Provider health refresh deadline must be after its observation time`});let n=e.providers.map(e=>e.providerId);new Set(n).size!==n.length&&t.addIssue({code:`custom`,path:[`providers`],message:`Provider health entries must have unique provider IDs`})}).meta({id:`ProviderHealthResponse`}),x=e.z.enum([`requested`,`detecting_provider`,`provider_selected`,`domain_connect_pending`,`authorization_pending`,`authorized`,`planning`,`awaiting_confirmation`,`applying`,`propagation_pending`,`active`,`manual_required`,`failed_retryable`,`failed_terminal`,`cancelled`]).meta({id:`ConnectionState`}),Te=e.z.enum([`authorized`,`awaiting_confirmation`,`applying`]).meta({id:`RetryResumeState`}),Ee=e.z.enum([`provider_snapshot_timeout`,`provider_apply_timeout`]).meta({id:`ConnectionFailureCode`}),S=e.z.object({code:Ee,retryable:e.z.literal(!0),resumeState:Te,occurredAt:u}).strict().meta({id:`ConnectionFailure`}),De=e.z.enum([`spf_policy_replaced`,`spf_policy_merged`]).meta({id:`PlanWarningCode`}),Oe=e.z.object({digest:e.z.string().regex(/^[a-f0-9]{64}$/),changes:e.z.array(ue).min(1),warnings:e.z.array(De),expiresAt:u}).strict().meta({id:`ChangePlan`}),C=e.z.object({id:i,applicationId:a,tenantId:o,intent:_,effectiveIntent:ae.optional(),state:x,provider:b.optional(),plan:Oe.optional(),failure:S.optional(),optionalFailures:e.z.array(e.z.string()),createdAt:u,updatedAt:u}).strict().superRefine((e,t)=>{let n=e.state===`failed_retryable`;n!==(e.failure!==void 0)&&t.addIssue({code:`custom`,path:[`failure`],message:n?`A retryable failure state requires failure details`:`Failure details are allowed only in a retryable failure state`}),e.effectiveIntent!==void 0&&e.effectiveIntent.domain!==e.intent.domain&&t.addIssue({code:`custom`,path:[`effectiveIntent`,`domain`],message:`Effective intent must use the requested intent domain`})}).meta({id:`Connection`}),ke=e.z.object({applicationId:a,tenantId:o,intent:_,commandId:c}).strict().meta({id:`CreateConnectionInput`}),Ae=e.z.object({connection:C}).strict().meta({id:`ConnectionResponse`}),je=Ae,Me=e.z.object({provider:b,confidence:e.z.number().min(0).max(1)}).strict().meta({id:`ProviderCandidate`}),Ne=e.z.object({connection:C,candidates:e.z.array(Me)}).strict().meta({id:`DetectProviderResponse`}),Pe=e.z.object({providerId:s,commandId:c}).strict().meta({id:`SelectProviderInput`}),w=e.z.string().regex(/^[A-Za-z0-9._-]{1,63}$/),Fe=e.z.string().regex(/^[A-Za-z][A-Za-z0-9_-]{0,62}$/),Ie=new Set([`domain`,`host`,`fqdn`,`groupId`,`providerName`,`serviceName`,`instanceId`,`redirect_uri`,`state`,`sig`,`key`]),Le=e.z.record(Fe,e.z.string().min(1).max(4096).refine(e=>e.trim()===e&&!/[\u0000\r\n]/.test(e),`Domain Connect property values must be trimmed and single-line`)).refine(e=>Object.keys(e).length<=64,`At most 64 Domain Connect properties are allowed`).refine(e=>Object.keys(e).every(e=>!Ie.has(e)),`Domain Connect properties must not override reserved protocol parameters`),Re=e.z.object({serviceProviderId:w,serviceId:w,host:e.z.string().max(253).regex(/^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)(?:\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?))*$/).optional(),groupId:e.z.string().max(4095).regex(/^[A-Za-z0-9._-]{1,63}(?:,[A-Za-z0-9._-]{1,63})*$/).optional(),providerName:e.z.string().trim().min(1).max(200).optional(),serviceName:e.z.string().trim().min(1).max(200).optional(),instanceId:w.optional(),properties:Le}).strict().meta({id:`DomainConnectTemplate`}),ze=Re.extend({commandId:c}).strict().meta({id:`ExplicitDomainConnectInput`}),Be=e.z.object({commandId:c}).strict().meta({id:`AutomaticDomainConnectInput`}),Ve=e.z.union([ze,Be]).meta({id:`StartDomainConnectInput`}),He=e.z.url({protocol:/^https$/}).refine(e=>{let t=new URL(e);return t.username===``&&t.password===``&&t.hash===``},`Domain Connect handoff URL must be HTTPS without credentials or a fragment`),Ue=e.z.object({connection:C,handoffUrl:He}).strict().meta({id:`StartDomainConnectResponse`}),We=e.z.object({commandId:c}).strict().meta({id:`SubmitDomainConnectCompletionInput`}),Ge=e.z.object({digest:e.z.string().regex(/^[a-f0-9]{64}$/),allowDestructive:e.z.boolean(),commandId:c}).strict().meta({id:`ConfirmPlanInput`}),Ke=e.z.object({commandId:c}).strict().meta({id:`StartOAuthInput`}),qe=e.z.object({connection:C,authorizationUrl:e.z.url({protocol:/^https$/}),expiresAt:u}).strict().meta({id:`StartOAuthResponse`}),T=e.z.string().min(1).max(16384).refine(e=>e.trim()===e,`Credential values must not have leading or trailing whitespace`).meta({format:`password`,writeOnly:!0}),Je=e.z.enum([`otp`,`security_answer`]).meta({id:`ProviderSessionChallengeKind`}),Ye=e.z.object({kind:Je,prompt:e.z.string().max(500),destination:e.z.string().max(200)}).strict().meta({id:`ProviderSessionChallenge`}),Xe=e.z.object({status:e.z.literal(`authorized`),connection:C}).strict().meta({id:`ProviderSessionAuthorizedResponse`}),Ze=e.z.object({status:e.z.literal(`challenge`),connection:C,attemptId:e.z.string().min(16).max(2048),challenge:Ye,expiresAt:u}).strict().meta({id:`ProviderSessionChallengeResponse`}),Qe=e.z.discriminatedUnion(`status`,[Xe,Ze]).meta({id:`ProviderSessionResponse`}),$e=e.z.object({response:T,commandId:c}).strict().meta({id:`ContinueProviderSessionInput`}),E=e.z.object({kind:e.z.literal(`api_token`),token:T}).strict().meta({id:`ApiTokenCredentials`}),D=E.extend({kind:e.z.literal(`api_endpoint_token`),endpoint:e.z.url({protocol:/^https$/})}).meta({id:`ApiEndpointTokenCredentials`}),O=e.z.object({kind:e.z.literal(`access_key`),keyId:T,secret:T}).strict().meta({id:`AccessKeyCredentials`}),k=e.z.object({kind:e.z.literal(`username_password`),username:T,password:T}).strict().meta({id:`UsernamePasswordCredentials`}),A=e.z.object({kind:e.z.literal(`account_token`),accountId:T,token:T}).strict().meta({id:`AccountTokenCredentials`}),j=A.extend({kind:e.z.literal(`sub_account_token`)}).meta({id:`SubAccountTokenCredentials`}),M=e.z.object({kind:e.z.literal(`username_token`),username:T,token:T}).strict().meta({id:`UsernameTokenCredentials`}),N=e.z.object({kind:e.z.literal(`ovh`),endpoint:e.z.enum([`ovh-eu`,`ovh-us`,`ovh-ca`,`kimsufi-eu`,`kimsufi-ca`,`soyoustart-eu`,`soyoustart-ca`]),applicationKey:T,applicationSecret:T,consumerKey:T}).strict().meta({id:`OvhCredentials`}),P=e.z.object({kind:e.z.literal(`private_key`),login:T,privateKey:T.refine(e=>/^(-----BEGIN (?:RSA )?PRIVATE KEY-----)[\s\S]+(-----END (?:RSA )?PRIVATE KEY-----)$/.test(e),`A PKCS#8 or PKCS#1 PEM private key is required`)}).strict().meta({id:`PrivateKeyCredentials`}),F=e.z.object({kind:e.z.literal(`aws_session`),keyId:T.regex(/^[A-Z0-9]{16,128}$/),secret:T,sessionToken:T,hostedZoneId:e.z.string().regex(/^Z[A-Z0-9]{1,63}$/),expiresAt:u}).strict().meta({id:`AwsSessionCredentials`}),et=e.z.url({protocol:/^https$/}).refine(e=>{let t=new URL(e);return t.port===`2083`&&t.username===``&&t.password===``&&(t.pathname===``||t.pathname===`/`)&&t.search===``&&t.hash===``},`cPanel endpoint must be an HTTPS origin on port 2083`),I=e.z.object({kind:e.z.literal(`cpanel`),endpoint:et,username:T,token:T}).strict().meta({id:`CPanelCredentials`}),L=e.z.object({kind:e.z.literal(`client_credentials`),clientId:T,clientSecret:T}).strict().meta({id:`ClientCredentials`}),tt=e.z.discriminatedUnion(`kind`,[j,E,D,O,k,A,M,N,P,F,I,L]).meta({id:`DirectCredentials`}),nt=e.z.object({credentials:tt,commandId:c}).strict().meta({id:`StartProviderSessionInput`});function R(t,n){return e.z.object({providerId:e.z.literal(t),credentials:n,commandId:c}).strict()}const rt=[R(`alibaba-cloud`,O),R(`all-inkl`,k),R(`amazon-route-53`,F),R(`cloudns`,e.z.discriminatedUnion(`kind`,[A,j])),R(`digitalocean`,E),R(`dnsimple`,A),R(`dreamhost`,E),R(`dynadot`,O),R(`easydns`,O),R(`gandi`,E),R(`hetzner`,e.z.discriminatedUnion(`kind`,[E,D.extend({endpoint:e.z.literal(`https://api.hetzner.cloud/v1`)})])),R(`hostgator`,I),R(`hostinger`,E),R(`hosting-com`,I),R(`inmotion-hosting`,I),R(`name-com`,M),R(`netlify`,E),R(`o2switch`,I),R(`openprovider`,E),R(`opensrs`,L),R(`ovh`,N),R(`porkbun`,O),R(`simply`,E),R(`spaceship`,O),R(`transip`,P),R(`united-domains`,E),R(`wix`,A)],it=Object.freeze(Object.fromEntries(rt.map(t=>{let n=t.shape.credentials,r=n instanceof e.z.ZodDiscriminatedUnion?n.options[0]:n;return[t.shape.providerId.value,r.shape.kind.value]}))),at=e.z.discriminatedUnion(`providerId`,rt).meta({id:`AuthorizeWithCredentialInput`}),ot=e.z.object({completed:e.z.literal(!0)}).strict().meta({id:`OAuthCallbackResponse`}),st=e.z.object({conflictPolicy:v,spfPolicy:y.default(`merge`),commandId:c}).strict().meta({id:`PreparePlanInput`}),ct=e.z.object({commandId:c}).strict().meta({id:`ApplyPlanInput`}),lt=e.z.object({commandId:c}).strict().meta({id:`VerifyPropagationInput`}),ut=e.z.object({commandId:c}).strict().meta({id:`StartManualConfigurationInput`}),dt=e.z.object({commandId:c}).strict().meta({id:`SubmitManualCompletionInput`}),ft=e.z.object({commandId:c}).strict().meta({id:`CancelConnectionInput`}),pt=e.z.object({commandId:c}).strict().meta({id:`RetryConnectionInput`}),mt=e.z.object({origin:e.z.url().refine(e=>{let t=new URL(e);return t.username===``&&t.password===``&&t.search===``&&t.hash===``&&(t.pathname===``||t.pathname===`/`)&&(t.protocol===`https:`||t.protocol===`http:`&&gt(t.hostname))},`Origin must be an HTTPS origin without a path, query, or fragment`)}).strict().meta({id:`IssueConnectionTokenInput`}),ht=e.z.object({accessToken:e.z.string().min(1).max(8192),tokenType:e.z.literal(`Bearer`),expiresAt:u}).strict().meta({id:`IssueConnectionTokenResponse`});function gt(e){return e===`localhost`||e===`127.0.0.1`||e===`[::1]`}const _t=e.z.string().trim().min(1).max(200).meta({id:`ConnectionFlowId`}),vt=e.z.strictObject({domain:e.z.array(h).min(1).max(100),subDomain:e.z.array(h).min(1).max(100).optional(),rootNS:e.z.array(h).min(1).max(100).optional()}).superRefine((e,t)=>{e.rootNS?.forEach((e,n)=>{(e.host!==`@`||e.type!==`NS`)&&t.addIssue({code:`custom`,path:[`rootNS`,n],message:`rootNS accepts only NS records at the zone apex`})})}).meta({id:`ConditionalDnsRecords`}),yt=e.z.strictObject({domain:l,records:e.z.array(h).min(1).max(100)}),bt=e.z.strictObject({domain:l,conditionalRecords:vt}),xt=e.z.union([yt,bt]).meta({id:`ConnectionFlowTargetInput`}),St=e.z.strictObject({applicationId:a,tenantId:o,existingRecordPolicy:g.default({validateDmarc:!1,validateCAA:!1}),targets:e.z.array(xt).min(2).max(100).superRefine((e,t)=>{let n=new Set;e.forEach((e,r)=>{n.has(e.domain)&&t.addIssue({code:`custom`,path:[r,`domain`],message:`Flow target domains must be unique`}),n.add(e.domain)})}),commandId:c}).meta({id:`CreateConnectionFlowInput`}),Ct=e.z.strictObject({domain:l,state:e.z.enum([`pending`,`provisioned`]),connectionId:i.optional()}).superRefine((e,t)=>{e.state===`provisioned`!=(e.connectionId!==void 0)&&t.addIssue({code:`custom`,path:[`connectionId`],message:e.state===`provisioned`?`A provisioned target requires a connection id`:`A pending target cannot have a connection id`})}).meta({id:`ConnectionFlowTarget`}),wt=e.z.strictObject({id:_t,applicationId:a,tenantId:o,state:e.z.enum([`provisioning`,`ready`]),targets:e.z.array(Ct).min(2).max(100),createdAt:u,updatedAt:u}).superRefine((e,t)=>{let n=e.targets.every(e=>e.state===`provisioned`);e.state===`ready`!==n&&t.addIssue({code:`custom`,path:[`state`],message:`Flow state must match target provisioning state`})}).meta({id:`ConnectionFlow`}),Tt=e.z.strictObject({flow:wt}).meta({id:`ConnectionFlowResponse`}),z=e.z.enum([`invalid_request`,`unauthorized`,`forbidden`,`not_found`,`conflict`,`rate_limited`,`dns_unavailable`,`provider_unavailable`,`provider_authorization_failed`,`provider_limitation`,`plan_expired`,`propagation_pending`,`internal_error`]).meta({id:`Domain0ErrorCode`}),Et=e.z.object({error:e.z.object({code:z,message:e.z.string().min(1),requestId:e.z.string().min(1),retryable:e.z.boolean(),details:e.z.record(e.z.string(),e.z.unknown()).optional()}).strict()}).strict().meta({id:`ErrorResponse`}),B=e.z.string().min(1).max(200).brand(),V=e.z.string().regex(/^[A-Za-z0-9_-]{43}$/).brand(),Dt=e.z.strictObject({connectionId:i,expiresAt:u}),Ot=e.z.strictObject({sharedFlowId:B,token:V,expiresAt:u}),kt=e.z.strictObject({token:V,origin:e.z.string().url().max(2048)}),At=e.z.strictObject({sharedFlowId:B,connectionId:i,accessToken:e.z.string().min(1).max(8192),expiresAt:u}),jt=e.z.string().url().max(4096),H=jt.superRefine((e,t)=>{let n=new URL(e),r=n.protocol===`https:`,i=n.protocol===`http:`&&Nt(n.hostname);!r&&!i&&t.addIssue({code:`custom`,message:`Shared-flow invitation URLs must use HTTPS, except on loopback development hosts`}),(n.username!==``||n.password!==``)&&t.addIssue({code:`custom`,message:`Shared-flow invitation URLs cannot contain user information`});let a=new URLSearchParams(n.hash.slice(1)),o=a.get(`domain0`);(a.size!==1||!V.safeParse(o).success)&&t.addIssue({code:`custom`,message:`Shared-flow invitation URLs require one valid domain0 capability in the fragment`})}).meta({id:`SharedFlowInvitationUrl`}),Mt=e.z.object({sharedFlowId:B,url:H,expiresAt:u}).strict().meta({id:`SharedFlowInvitation`});function Nt(e){let t=e.toLowerCase();return t===`localhost`||t===`[::1]`||/^127(?:\.[0-9]{1,3}){3}$/.test(t)}const U=e.z.string().trim().toLowerCase().min(1).max(63).regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/).brand().meta({id:`DkimSelector`}),Pt=e.z.object({selectors:e.z.array(U).max(10).default([])}).strict().superRefine((e,t)=>{new Set(e.selectors).size!==e.selectors.length&&t.addIssue({code:`custom`,path:[`selectors`],message:`DKIM selectors must be unique`})}).meta({id:`DkimGuidanceInput`}),Ft=e.z.object({enableDkim:e.z.boolean().default(!1),dkimSelectors:e.z.array(U).max(10).default([])}).strict().superRefine((e,t)=>{new Set(e.dkimSelectors).size!==e.dkimSelectors.length&&t.addIssue({code:`custom`,path:[`dkimSelectors`],message:`DKIM selectors must be unique`})}).meta({id:`Domain0DkimGuidanceOptions`}),It=e.z.object({id:e.z.literal(`google_workspace`),name:e.z.literal(`Google Workspace`),guideUrl:e.z.literal(`https://support.google.com/a/answer/174124`)}).strict(),Lt=e.z.object({id:e.z.literal(`microsoft_365`),name:e.z.literal(`Microsoft 365`),guideUrl:e.z.literal(`https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure`)}).strict(),Rt=e.z.object({id:e.z.literal(`zoho_mail`),name:e.z.literal(`Zoho Mail`),guideUrl:e.z.literal(`https://www.zoho.com/mail/help/adminconsole/dkim-configuration.html`)}).strict(),W=e.z.discriminatedUnion(`id`,[It,Lt,Rt]).meta({id:`EmailProvider`}),zt=e.z.enum([`detected`,`ambiguous`,`unknown`]).meta({id:`EmailProviderDetectionStatus`}),Bt=e.z.enum([`TXT`,`CNAME`]).meta({id:`DkimDnsRecordType`}),Vt=e.z.enum([`record_observed`,`no_record_observed`,`not_checked`,`lookup_unavailable`]).meta({id:`DkimDnsEvidenceStatus`}),Ht=e.z.object({selector:U,types:e.z.array(Bt).min(1).max(2).refine(e=>new Set(e).size===e.length,`Observed DKIM DNS record types must be unique`)}).strict().meta({id:`DkimDnsRecordEvidence`}),Ut=e.z.object({status:Vt,selectorsChecked:e.z.array(U).max(12).refine(e=>new Set(e).size===e.length,`Checked DKIM selectors must be unique`),records:e.z.array(Ht).max(12)}).strict().superRefine((e,t)=>{let n=new Set(e.selectorsChecked);e.records.some(e=>!n.has(e.selector))&&t.addIssue({code:`custom`,path:[`records`],message:`Observed records must belong to checked selectors`}),e.status===`not_checked`&&(e.selectorsChecked.length!==0||e.records.length!==0)&&t.addIssue({code:`custom`,path:[`status`],message:`Not-checked evidence cannot include selector observations`}),e.status===`record_observed`&&e.records.length===0&&t.addIssue({code:`custom`,path:[`records`],message:`Observed status requires at least one DNS record`}),e.status!==`record_observed`&&e.records.length!==0&&t.addIssue({code:`custom`,path:[`records`],message:`Only observed status can include DNS records`}),[`no_record_observed`,`lookup_unavailable`].includes(e.status)&&e.selectorsChecked.length===0&&t.addIssue({code:`custom`,path:[`selectorsChecked`],message:`A DNS lookup status requires at least one checked selector`})}).meta({id:`DkimDnsEvidence`}),Wt=e.z.object({domain:l,detectionStatus:zt,candidates:e.z.array(W).max(3),provider:W.optional(),mxHosts:e.z.array(l).max(20).refine(e=>new Set(e).size===e.length,`MX hosts must be unique`),dkimDns:Ut,observedAt:u}).strict().superRefine((e,t)=>{let n=e.candidates.map(e=>e.id);new Set(n).size!==n.length&&t.addIssue({code:`custom`,path:[`candidates`],message:`Email provider candidates must be unique`}),e.detectionStatus===`detected`&&(e.candidates.length!==1||e.provider?.id!==e.candidates[0]?.id)&&t.addIssue({code:`custom`,path:[`provider`],message:`Detected status requires exactly one matching provider`}),e.detectionStatus===`ambiguous`&&(e.candidates.length<2||e.provider!==void 0)&&t.addIssue({code:`custom`,path:[`candidates`],message:`Ambiguous status requires multiple candidates and no resolved provider`}),e.detectionStatus===`unknown`&&(e.candidates.length!==0||e.provider!==void 0)&&t.addIssue({code:`custom`,path:[`candidates`],message:`Unknown status cannot include an email provider`})}).meta({id:`DkimGuidanceResponse`}),G=e.z.union([e.z.enum([`loading`,`provider_detection`,`provider_selection`,`cancellation_confirmation`]),x]).meta({id:`Domain0ConnectStep`}),Gt=e.z.enum([`close_button`,`escape`,`programmatic`,`destroyed`,`automatic`]).meta({id:`Domain0ConnectCloseTrigger`}),Kt=e.z.enum([`success`,`failure`,`cancelled`,`incomplete`]).meta({id:`Domain0ConnectOutcome`}),qt=C.and(e.z.object({state:e.z.literal(`active`)})),Jt=C.and(e.z.object({state:e.z.literal(`manual_required`)})),Yt=e.z.union([C.and(e.z.object({state:e.z.literal(`failed_retryable`),failure:S})),C.and(e.z.object({state:e.z.literal(`failed_terminal`),failure:e.z.undefined().optional()}))]),K=e.z.discriminatedUnion(`source`,[e.z.object({source:e.z.literal(`configuration`),code:e.z.literal(`invalid_configuration`),retryable:e.z.literal(!1)}).strict(),e.z.object({source:e.z.literal(`api`),code:z,retryable:e.z.boolean(),requestId:e.z.string().min(1)}).strict(),e.z.object({source:e.z.literal(`transport`),code:e.z.literal(`transport_error`),retryable:e.z.literal(!0)}).strict(),e.z.object({source:e.z.literal(`protocol`),code:e.z.literal(`protocol_error`),retryable:e.z.literal(!1)}).strict(),e.z.object({source:e.z.literal(`unexpected`),code:e.z.literal(`unexpected_error`),retryable:e.z.literal(!1)}).strict()]).meta({id:`Domain0ConnectError`}),Xt=e.z.object({type:e.z.literal(`success`),connection:qt}).strict().meta({id:`Domain0ConnectSuccessEvent`}),Zt=e.z.object({type:e.z.literal(`failure`),connection:Yt}).strict().meta({id:`Domain0ConnectFailureEvent`}),Qt=e.z.object({type:e.z.literal(`error`),error:K,connection:C.optional(),step:G.optional()}).strict().meta({id:`Domain0ConnectErrorEvent`}),$t=e.z.object({type:e.z.literal(`close`),trigger:Gt,outcome:Kt,connection:C.optional(),step:G.optional(),error:K.optional()}).strict().superRefine((e,t)=>{let n=sn(e.connection,e.error);e.outcome!==n&&t.addIssue({code:`custom`,path:[`outcome`],message:`Close outcome must be ${n} for the supplied connection and error`})}).meta({id:`Domain0ConnectCloseEvent`}),en=e.z.object({type:e.z.literal(`step_change`),step:G,previousStep:G.optional(),connection:C.optional()}).strict().meta({id:`Domain0ConnectStepChangeEvent`}),tn=e.z.object({type:e.z.literal(`manual_setup_documentation_click`),connection:Jt}).strict().meta({id:`Domain0ManualSetupDocumentationClickEvent`}),nn=e.z.object({type:e.z.literal(`request_close`),connection:C.optional(),step:G}).strict().meta({id:`Domain0RequestCloseEvent`}),rn=e.z.object({type:e.z.literal(`shared_flow_sent`),connection:Jt,sharedFlowId:B,url:H,expiresAt:u}).strict().meta({id:`Domain0SharedFlowSentEvent`}),an=e.z.object({type:e.z.literal(`dkim_setup_documentation_click`),connection:qt,emailProvider:W}).strict().meta({id:`Domain0DkimSetupDocumentationClickEvent`}),on=e.z.discriminatedUnion(`type`,[Xt,Zt,Qt,$t,en,tn,nn,rn,an]).meta({id:`Domain0ConnectEvent`});function sn(e,t){return e?.state===`active`?`success`:t!==void 0||e?.state===`failed_retryable`||e?.state===`failed_terminal`?`failure`:e?.state===`cancelled`?`cancelled`:`incomplete`}const cn=e.z.object({mode:e.z.enum([`automatic`,`manual`]).default(`automatic`),conflictPolicy:v.default(`replace_same_name_and_type`),spfPolicy:y.default(`merge`)}).strict(),ln=/^#[0-9A-F]{6}$/,un=/^#[0-9A-F]{8}$/,q=e.z.string().trim().toUpperCase().regex(ln,`Expected an opaque #RRGGBB color`),dn=e.z.string().trim().toUpperCase().regex(un,`Expected a #RRGGBBAA backdrop color`),fn=e.z.string().trim().min(1).max(500).refine(e=>!/[<>\u0000-\u001F\u007F]/.test(e),`White-label copy must be plain text without markup or control characters`),pn=fn.max(120).meta({id:`Domain0ApplicationName`}),mn=e.z.string().trim().min(1).max(2048).refine(e=>{try{let t=new URL(e);return t.protocol===`https:`&&t.username===``&&t.password===``}catch{return!1}},`Logo must be an HTTPS URL without embedded credentials`).meta({id:`Domain0WhiteLabelLogoUrl`});function J(...e){return fn.refine(t=>{let n=e.reduce((e,t)=>e.replaceAll(t,``),t);return!/[{}]/.test(n)},`Only these placeholders are allowed: ${e.join(`, `)||`none`}`)}function Y(t){let n=e.z.object({en:t,es:t.optional(),pt:t.optional(),"pt-br":t.optional(),"pt-pt":t.optional(),fr:t.optional(),it:t.optional(),de:t.optional(),nl:t.optional(),pl:t.optional(),tr:t.optional(),ja:t.optional(),da:t.optional(),sv:t.optional()}).strict();return e.z.union([t.transform(e=>({en:e})),n])}function hn(e,t){return gn(q.parse(e),q.parse(t))}function gn(e,t){let n=vn(e),r=vn(t),i=Math.max(n,r),a=Math.min(n,r);return(i+.05)/(a+.05)}function _n(e){let t=e.split(`,`);return t.length<=10&&t.every(e=>{let t=e.trim();if(t.length===0)return!1;let n=t.at(0);return n===`"`||n===`'`?t.at(-1)===n&&/^[A-Za-z0-9 -]+$/.test(t.slice(1,-1)):/^-?[A-Za-z][A-Za-z0-9 -]*$/.test(t)})}function vn(e){let[t,n,r]=[1,3,5].map(t=>Number.parseInt(e.slice(t,t+2),16)/255).map(e=>e<=.04045?e/12.92:((e+.055)/1.055)**2.4);return .2126*t+.7152*n+.0722*r}const yn=[{foreground:`text`,background:`surface`,minimum:4.5,purpose:`body text`},{foreground:`mutedText`,background:`surface`,minimum:4.5,purpose:`secondary text`},{foreground:`onPrimary`,background:`primary`,minimum:4.5,purpose:`primary control text`},{foreground:`danger`,background:`surface`,minimum:4.5,purpose:`error text`},{foreground:`onDanger`,background:`danger`,minimum:4.5,purpose:`danger control text`},{foreground:`link`,background:`surface`,minimum:4.5,purpose:`link text`},{foreground:`border`,background:`surface`,minimum:3,purpose:`control boundaries`},{foreground:`primary`,background:`surface`,minimum:3,purpose:`primary control boundaries`},{foreground:`focus`,background:`surface`,minimum:3,purpose:`focus indicators`}],bn={surface:`#FFFFFF`,text:`#0A0A0A`,mutedText:`#6B6B6B`,border:`#73737C`,primary:`#0A0A0A`,onPrimary:`#FFFFFF`,link:`#2B21FF`,focus:`#2B21FF`,danger:`#B3261E`,onDanger:`#FFFFFF`},xn={surface:`#111827`,text:`#F9FAFB`,mutedText:`#D1D5DB`,border:`#D1D5DB`,primary:`#BFDBFE`,onPrimary:`#172554`,link:`#BFDBFE`,focus:`#FBBF24`,danger:`#FCA5A5`,onDanger:`#450A0A`};function Sn(t){return e.z.object({surface:q.default(t.surface),text:q.default(t.text),mutedText:q.default(t.mutedText),border:q.default(t.border),primary:q.default(t.primary),onPrimary:q.default(t.onPrimary),link:q.default(t.link),focus:q.default(t.focus),danger:q.default(t.danger),onDanger:q.default(t.onDanger)}).strict().superRefine((e,t)=>{for(let n of yn){let r=gn(e[n.foreground],e[n.background]);r<n.minimum&&t.addIssue({code:`custom`,path:[n.foreground],message:`${n.purpose} requires ${n.minimum}:1 contrast against ${n.background}; received ${r.toFixed(2)}:1`})}})}const Cn=Sn(bn),wn=Sn(xn),Tn=e.z.object({colorMode:e.z.enum([`light`,`dark`,`system`]).default(`light`),light:Cn.prefault({}),dark:wn.prefault({}),backdrop:dn.default(`#2B21FF26`),widthPx:e.z.number().int().min(320).max(960).default(520),dialogRadiusPx:e.z.number().int().min(0).max(48).default(20),buttonRadiusPx:e.z.number().int().min(0).max(999).default(999),inputRadiusPx:e.z.number().int().min(0).max(32).default(12),fontFamily:e.z.string().trim().min(1).max(200).refine(_n,`Use a comma-separated system font stack without URLs or CSS syntax`).default(`"PP Neue Montreal", "Inter Tight", ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif`),fontWeight:e.z.number().int().min(100).max(900).multipleOf(50).default(400),boldFontWeight:e.z.number().int().min(100).max(900).multipleOf(50).default(500)}).strict().superRefine((e,t)=>{e.boldFontWeight<e.fontWeight&&t.addIssue({code:`custom`,path:[`boldFontWeight`],message:`Bold font weight must be at least the normal font weight`})}),En=e.z.object({initialSubtitle:Y(J()).optional(),providerLoginMessage:Y(J(`{PROVIDER}`)).optional(),successTitle:Y(J(`{DOMAIN}`)).optional(),successDescription:Y(J(`{DOMAIN}`)).optional(),successButton:Y(J()).optional(),manuallyScreen:e.z.object({disableManualSetupDocumentationLink:e.z.boolean().default(!1),stepByStepGuide:Y(J()).optional()}).strict().prefault({})}).strict(),Dn=e.z.object({disable:e.z.boolean().default(!1)}).strict(),On=e.z.object({manualConfiguration:e.z.object({disableScreen:e.z.boolean().default(!1)}).strict().prefault({}),providerLogin:e.z.object({forwardLink:Dn.prefault({}),gotoManualLink:Dn.prefault({})}).strict().prefault({})}).strict(),kn=e.z.object({theme:Tn.prefault({}),copy:En.prefault({}),logo:mn.optional(),logoBackgroundColor:q.optional(),removeLogoBorder:e.z.boolean().default(!1),hideCompanyLogo:e.z.boolean().default(!1),hideCompanyName:e.z.boolean().default(!1),removeShareLogin:e.z.boolean().default(!1),skipCongratulationsScreen:e.z.boolean().default(!1),customProperties:On.prefault({})}).strict(),An=e.z.url({protocol:/^https$/}).max(2048).refine(e=>{let t=new URL(e);return t.username===``&&t.password===``},`Manual setup documentation URL must not contain credentials`).brand().meta({id:`ManualSetupDocumentationUrl`}),jn=e.z.object({applicationName:pn.optional(),whiteLabel:kn.prefault({}),setupPolicy:cn.prefault({}),dkim:Ft.prefault({}),manualSetupDocumentation:An.optional()}).strict().superRefine((e,t)=>{let{customProperties:n}=e.whiteLabel,r=e.setupPolicy.mode===`manual`;r&&n.manualConfiguration.disableScreen&&t.addIssue({code:`custom`,path:[`whiteLabel`,`customProperties`,`manualConfiguration`,`disableScreen`],message:`Forced manual setup requires the manual configuration screen`}),r&&n.providerLogin.gotoManualLink.disable&&t.addIssue({code:`custom`,path:[`whiteLabel`,`customProperties`,`providerLogin`,`gotoManualLink`,`disable`],message:`Forced manual setup cannot disable entry into manual configuration`}),e.dkim.enableDkim&&e.whiteLabel.skipCongratulationsScreen&&t.addIssue({code:`custom`,path:[`whiteLabel`,`skipCongratulationsScreen`],message:`DKIM guidance requires the success screen`})}).meta({id:`Domain0ConnectConfiguration`}),Mn=e.z.enum(`alibaba-cloud.all-inkl.amazon-route-53.cloudns.digitalocean.dnsimple.dreamhost.dynadot.easydns.gandi.hetzner.hostgator.hostinger.hosting-com.inmotion-hosting.name-com.namecheap.netlify.o2switch.openprovider.opensrs.ovh.porkbun.simply.spaceship.transip.united-domains.wix`.split(`.`)).meta({id:`CompiledProviderId`}),Nn=e.z.enum([`authenticated_snapshot`,`reserved_name_available`,`create_sibling`,`create_target`,`rrset_sibling_preservation`,`idempotent_replay`,`replace_target`,`authoritative_propagation`,`delete_target`,`scoped_cleanup`]).meta({id:`ProviderConformanceCheckName`}),X=[`authenticated_snapshot`,`reserved_name_available`,`create_sibling`,`create_target`,`rrset_sibling_preservation`,`idempotent_replay`,`replace_target`,`authoritative_propagation`,`delete_target`,`scoped_cleanup`],Pn=e.z.object({name:Nn}).strict(),Fn=e.z.union([e.z.literal(`unknown`),e.z.string().regex(/^[a-f0-9]{40,64}$/)]),In=e.z.object({schemaVersion:e.z.literal(1),providerId:Mn,adapterVersion:e.z.string().min(1).max(200).refine(zn),sourceRevision:Fn,sourceModified:e.z.boolean(),binarySha256:e.z.string().regex(/^[a-f0-9]{64}$/),zone:l,runId:e.z.string().regex(/^[a-f0-9]{16,64}$/),host:e.z.string(),startedAt:u,completedAt:u,passed:e.z.boolean(),checks:e.z.array(Pn).max(X.length),cleanupAttempted:e.z.boolean(),cleanupCompleted:e.z.boolean()}).strict().superRefine((e,t)=>{e.host!==`_domain0-conformance-${e.runId}`&&t.addIssue({code:`custom`,path:[`host`],message:`Conformance hostname must be derived from the random run ID`}),Date.parse(e.completedAt)<Date.parse(e.startedAt)&&t.addIssue({code:`custom`,path:[`completedAt`],message:`Conformance completion must not precede its start`});let n=e.checks.map(e=>e.name);Rn(n)||t.addIssue({code:`custom`,path:[`checks`],message:`Conformance checks must be an ordered prefix followed optionally by scoped cleanup`});let r=n.includes(`scoped_cleanup`);(e.cleanupCompleted&&!e.cleanupAttempted||r!==e.cleanupCompleted)&&t.addIssue({code:`custom`,path:[`cleanupCompleted`],message:`Completed cleanup requires an attempted cleanup and the scoped-cleanup check`})}).meta({id:`ProviderConformanceEvidence`}),Ln=In.refine(e=>e.passed&&!e.sourceModified&&e.sourceRevision!==`unknown`&&e.cleanupAttempted&&e.cleanupCompleted&&e.checks.every((e,t)=>e.name===X[t])&&e.checks.length===X.length,`Verified live-suite evidence requires clean traceable source, every ordered check, and completed cleanup`).meta({id:`VerifiedProviderConformanceEvidence`});function Rn(e){let t=0,n=!1;for(let r of e){if(r===`scoped_cleanup`){if(n)return!1;n=!0;continue}if(n||r!==X[t])return!1;t+=1}return!0}function zn(e){return e.trim()===e&&!/[\u0000\r\n]/.test(e)}const Bn=e.z.enum([`delegated`,`undelegated`,`unknown`]).meta({id:`DomainDelegationStatus`}),Vn=e.z.enum([`automatic`,`manual`,`unavailable`,`ambiguous`,`unknown`]).meta({id:`DomainSetupSupport`}),Hn=e.z.enum([`same_name_and_type`,`cname_collision`,`mx_set_collision`,`spf_collision`,`ns_delegation`]).meta({id:`RecordConflictReason`}),Un=e.z.object({domain:l,records:e.z.array(m).max(100).default([]),checkConflicts:e.z.boolean().default(!1)}).strict().superRefine((e,t)=>{e.checkConflicts&&e.records.length===0&&t.addIssue({code:`custom`,path:[`records`],message:`Record conflict analysis requires at least one requested record`})}).meta({id:`CheckDomainInput`}),Wn=e.z.object({provider:b,confidence:e.z.number().min(0).max(1),exact:e.z.boolean()}).strict().meta({id:`DomainProviderCandidate`}),Gn=e.z.object({requested:m,existing:e.z.array(m).max(1e3),reasons:e.z.array(Hn).min(1).max(5).refine(e=>new Set(e).size===e.length,`Conflict reasons must be unique`)}).strict().meta({id:`DomainRecordConflict`}),Kn=e.z.object({status:e.z.enum([`not_requested`,`complete`,`partial`]),authoritativeServers:e.z.number().int().min(0).max(16),respondingServers:e.z.number().int().min(0).max(16),conflicts:e.z.array(Gn).max(100)}).strict().superRefine((e,t)=>{e.respondingServers>e.authoritativeServers&&t.addIssue({code:`custom`,path:[`respondingServers`],message:`Responding nameservers cannot exceed authoritative nameservers`}),e.status===`complete`&&e.respondingServers!==e.authoritativeServers&&t.addIssue({code:`custom`,path:[`status`],message:`Complete analysis requires every authoritative nameserver to respond`}),e.status===`partial`&&(e.respondingServers===0||e.respondingServers>=e.authoritativeServers)&&t.addIssue({code:`custom`,path:[`status`],message:`Partial analysis requires some but not all authoritative nameservers to respond`}),e.status===`not_requested`&&e.conflicts.length!==0&&t.addIssue({code:`custom`,path:[`conflicts`],message:`Conflict results cannot exist when analysis was not requested`})}).meta({id:`ConflictAnalysis`}),qn=e.z.object({domain:l,delegationStatus:Bn,candidates:e.z.array(Wn).max(65),provider:b.optional(),setupSupport:Vn,conflictAnalysis:Kn}).strict().superRefine((e,t)=>{let n=e.candidates.map(e=>e.provider.id);new Set(n).size!==n.length&&t.addIssue({code:`custom`,path:[`candidates`],message:`Provider candidates must be unique`}),e.delegationStatus===`undelegated`&&(e.candidates.length!==0||e.provider!==void 0||e.setupSupport!==`unavailable`)&&t.addIssue({code:`custom`,path:[`delegationStatus`],message:`Undelegated domains cannot have provider support`}),e.provider!==void 0&&!e.candidates.some(t=>t.exact&&t.provider.id===e.provider?.id)&&t.addIssue({code:`custom`,path:[`provider`],message:`Resolved provider must be an exact provider candidate`}),[`automatic`,`manual`].includes(e.setupSupport)&&e.provider===void 0&&t.addIssue({code:`custom`,path:[`setupSupport`],message:`Available setup support requires a resolved provider`}),e.setupSupport===`automatic`&&!e.provider?.availableAuthorizationMethods.some(e=>e!==`manual`)&&t.addIssue({code:`custom`,path:[`setupSupport`],message:`Automatic setup requires a configured non-manual authorization method`}),e.setupSupport===`manual`&&(e.provider?.availableAuthorizationMethods.length!==1||e.provider.availableAuthorizationMethods[0]!==`manual`)&&t.addIssue({code:`custom`,path:[`setupSupport`],message:`Manual setup requires the manual authorization method`}),e.setupSupport===`ambiguous`&&e.candidates.length===0&&t.addIssue({code:`custom`,path:[`candidates`],message:`Ambiguous setup requires provider candidates`}),e.setupSupport===`unknown`&&e.candidates.length!==0&&t.addIssue({code:`custom`,path:[`candidates`],message:`Unknown setup cannot include provider candidates`}),[`ambiguous`,`unknown`].includes(e.setupSupport)&&e.provider!==void 0&&t.addIssue({code:`custom`,path:[`provider`],message:`Ambiguous or unknown support cannot resolve one provider`})}).meta({id:`CheckDomainResponse`}),Jn=[`en`,`es`,`pt`,`pt-br`,`pt-pt`,`fr`,`it`,`de`,`nl`,`pl`,`tr`,`ja`,`da`,`sv`],Yn=e.z.enum(Jn).meta({id:`Domain0Locale`}),Xn=e.z.strictObject({intent:_}).meta({id:`PlatformCreateConnectionInput`}),Zn=e.z.enum([`connection.requested`,`provider.detection_started`,`provider.selected`,`authorization.required`,`domain_connect.started`,`domain_connect.submitted`,`authorization.completed`,`connection.planning_started`,`connection.plan_prepared`,`connection.planning_restarted`,`connection.already_configured`,`connection.plan_confirmed`,`connection.changes_applied`,`connection.propagation_checked`,`connection.propagation_timed_out`,`connection.activated`,`connection.manual_required`,`connection.manual_submitted`,`connection.failed_retryable`,`connection.retry_started`,`connection.cancelled`]).meta({id:`Domain0WebhookEventType`}),Z=e.z.string().regex(/^[0-9a-f]{64}$/).brand().meta({id:`Domain0WebhookEventId`}),Qn=e.z.record(e.z.string().min(1).max(100),e.z.string().max(4e3)).superRefine((e,t)=>{Object.keys(e).length>64&&t.addIssue({code:`custom`,message:`Webhook attributes must contain at most 64 entries`})}).meta({id:`Domain0WebhookAttributes`}),$n=e.z.strictObject({schemaVersion:e.z.literal(1),eventId:Z,type:Zn,connectionId:i,applicationId:a,tenantId:o,sequence:e.z.number().int().positive().max(2**53-1),occurredAt:u,attributes:Qn}).meta({id:`Domain0WebhookEvent`}),er=e.z.enum([`invalid_headers`,`stale_timestamp`,`invalid_signature`,`invalid_payload`,`crypto_unavailable`]).meta({id:`Domain0WebhookVerificationErrorCode`});var tr=class extends Error{code;name=`Domain0WebhookVerificationError`;constructor(e,t,n){super(t,n),this.code=e}};const Q={eventId:`x-domain0-event-id`,eventType:`x-domain0-event-type`,deliveryAttempt:`x-domain0-delivery-attempt`,schemaVersion:`x-domain0-schema-version`,signatureKeyId:`x-domain0-signature-key-id`,timestamp:`x-domain0-timestamp`,signature:`x-domain0-signature`},nr=e.z.strictObject({eventId:Z,eventType:e.z.string().regex(/^domain0\.[a-z_]+\.[a-z_]+$/).max(100),deliveryAttempt:e.z.string().regex(/^[1-9][0-9]{0,8}$/).transform(Number),schemaVersion:e.z.literal(`1`),signatureKeyId:e.z.string().regex(/^[A-Za-z0-9._-]{1,64}$/),timestamp:e.z.string().regex(/^[0-9]{1,12}$/).transform(Number),signature:e.z.string().regex(/^v1=[0-9a-f]{64}$/)}),rr=new TextEncoder;async function ir(e){let t=typeof e.body==`string`?rr.encode(e.body):new Uint8Array(e.body),n=or(e.maxBodyBytes??1048576,16777216);if(!(t instanceof Uint8Array)||t.byteLength===0||t.byteLength>n)throw $(`invalid_payload`,`Webhook body is empty or exceeds the configured limit`);let r=ar(e.headers),i=sr(e.nowUnixSeconds??Math.floor(Date.now()/1e3),2**53-1),a=or(e.maxAgeSeconds??300,86400);if(Math.abs(i-r.timestamp)>a)throw $(`stale_timestamp`,`Webhook timestamp is outside the accepted replay window`);let o=Object.prototype.hasOwnProperty.call(e.secretKeyring,r.signatureKeyId)?e.secretKeyring[r.signatureKeyId]:void 0;if(!(o instanceof Uint8Array)||o.byteLength!==32)throw $(`invalid_signature`,`Webhook signature is invalid`);let s=e.crypto??globalThis.crypto;if(s?.subtle===void 0)throw $(`crypto_unavailable`,`Web Crypto is unavailable`);let c=cr(r.signature.slice(3)),l=rr.encode(`v1.${r.signatureKeyId}.${r.timestamp}.`),u=new Uint8Array(l.byteLength+t.byteLength);u.set(l),u.set(t,l.byteLength);let ee=await s.subtle.importKey(`raw`,new Uint8Array(o),{name:`HMAC`,hash:`SHA-256`},!1,[`verify`]);if(!await s.subtle.verify(`HMAC`,ee,new Uint8Array(c),u))throw $(`invalid_signature`,`Webhook signature is invalid`);let d;try{let e=new TextDecoder(`utf-8`,{fatal:!0}).decode(t);d=JSON.parse(e)}catch(e){throw $(`invalid_payload`,`Verified webhook body is not valid UTF-8 JSON`,e)}let f=$n.safeParse(d);if(!f.success)throw $(`invalid_payload`,`Verified webhook body does not match schema version 1`,f.error);if(f.data.eventId!==r.eventId||`domain0.${f.data.type}`!==r.eventType||String(f.data.schemaVersion)!==r.schemaVersion)throw $(`invalid_payload`,`Verified webhook headers do not match the event body`);return f.data}function ar(e){let t={eventId:void 0,eventType:void 0,deliveryAttempt:void 0,schemaVersion:void 0,signatureKeyId:void 0,timestamp:void 0,signature:void 0};if(`get`in e&&typeof e.get==`function`)for(let[n,r]of Object.entries(Q))t[n]=e.get(r)??void 0;else{let n=new Map;for(let e of Object.keys(Q))n.set(Q[e],e);let r=new Set;for(let[i,a]of Object.entries(e)){let e=i.toLowerCase(),o=n.get(e);if(o!==void 0){if(r.has(e)||typeof a!=`string`)throw $(`invalid_headers`,`Webhook headers are missing, duplicated, or malformed`);r.add(e),t[o]=a}}}let n=nr.safeParse(t);if(!n.success)throw $(`invalid_headers`,`Webhook headers are missing, duplicated, or malformed`,n.error);return n.data}function or(e,t){if(!Number.isSafeInteger(e)||e<1||e>t)throw $(`invalid_headers`,`Webhook verification limits are invalid`);return e}function sr(e,t){if(!Number.isSafeInteger(e)||e<0||e>t)throw $(`invalid_headers`,`Webhook verification time is invalid`);return e}function cr(e){let t=new Uint8Array(e.length/2);for(let n=0;n<e.length;n+=2)t[n/2]=Number.parseInt(e.slice(n,n+2),16);return t}function $(e,t,n){return new tr(e,t,n===void 0?void 0:{cause:n})}exports.AccessKeyCredentialsSchema=O,exports.AccountTokenCredentialsSchema=A,exports.AdvancedDmarcOptionsSchema=re,exports.ApiEndpointTokenCredentialsSchema=D,exports.ApiTokenCredentialsSchema=E,exports.ApplicationIdSchema=a,exports.ApplyPlanInputSchema=ct,exports.AuthorizationMethodSchema=he,exports.AuthorizeWithCredentialInputSchema=at,exports.AutomaticDomainConnectInputSchema=Be,exports.AwsSessionCredentialsSchema=F,exports.CPanelCredentialsSchema=I,exports.CancelConnectionInputSchema=ft,exports.ChangeActionSchema=le,exports.ChangePlanSchema=Oe,exports.CheckDomainInputSchema=Un,exports.CheckDomainResponseSchema=qn,exports.CheckRecordsInputSchema=oe,exports.CheckRecordsResponseSchema=ce,exports.CheckedRecordSchema=se,exports.ClientCredentialsSchema=L,exports.CommandIdSchema=c,exports.CompiledProviderIdSchema=Mn,exports.ConditionalDnsRecordsSchema=vt,exports.ConfirmPlanInputSchema=Ge,exports.ConflictAnalysisSchema=Kn,exports.ConflictPolicySchema=v,exports.ConnectionFailureCodeSchema=Ee,exports.ConnectionFailureSchema=S,exports.ConnectionFlowIdSchema=_t,exports.ConnectionFlowResponseSchema=Tt,exports.ConnectionFlowSchema=wt,exports.ConnectionFlowTargetInputSchema=xt,exports.ConnectionFlowTargetSchema=Ct,exports.ConnectionIdSchema=i,exports.ConnectionSchema=C,exports.ConnectionStateSchema=x,exports.ContinueProviderSessionInputSchema=$e,exports.CreateConnectionFlowInputSchema=St,exports.CreateConnectionInputSchema=ke,exports.CreateConnectionResponseSchema=Ae,exports.CreateSharedFlowInputSchema=Dt,exports.CreateSharedFlowResponseSchema=Ot,exports.DOMAIN0_WEBHOOK_HEADER_NAMES=Q,exports.DetectProviderResponseSchema=Ne,exports.DirectCredentialsSchema=tt,exports.DkimDnsEvidenceSchema=Ut,exports.DkimDnsEvidenceStatusSchema=Vt,exports.DkimDnsRecordEvidenceSchema=Ht,exports.DkimDnsRecordTypeSchema=Bt,exports.DkimGuidanceInputSchema=Pt,exports.DkimGuidanceResponseSchema=Wt,exports.DkimSelectorSchema=U,exports.DnsIntentSchema=_,exports.DnsRecordSchema=h,exports.DnsRecordTypeSchema=f,exports.Domain0ApplicationNameSchema=pn,exports.Domain0ConnectCloseEventSchema=$t,exports.Domain0ConnectCloseTriggerSchema=Gt,exports.Domain0ConnectConfigurationSchema=jn,exports.Domain0ConnectErrorEventSchema=Qt,exports.Domain0ConnectErrorSchema=K,exports.Domain0ConnectEventSchema=on,exports.Domain0ConnectFailureEventSchema=Zt,exports.Domain0ConnectOutcomeSchema=Kt,exports.Domain0ConnectStepChangeEventSchema=en,exports.Domain0ConnectStepSchema=G,exports.Domain0ConnectSuccessEventSchema=Xt,exports.Domain0DkimGuidanceOptionsSchema=Ft,exports.Domain0DkimSetupDocumentationClickEventSchema=an,exports.Domain0ErrorCodeSchema=z,exports.Domain0ErrorResponseSchema=Et,exports.Domain0LocaleSchema=Yn,exports.Domain0ManualSetupDocumentationClickEventSchema=tn,exports.Domain0RequestCloseEventSchema=nn,exports.Domain0SetupPolicySchema=cn,exports.Domain0SharedFlowSentEventSchema=rn,exports.Domain0WebhookAttributesSchema=Qn,exports.Domain0WebhookEventIdSchema=Z,exports.Domain0WebhookEventSchema=$n,exports.Domain0WebhookEventTypeSchema=Zn,exports.Domain0WebhookVerificationError=tr,exports.Domain0WebhookVerificationErrorCodeSchema=er,exports.Domain0WhiteLabelCopySchema=En,exports.Domain0WhiteLabelCustomPropertiesSchema=On,exports.Domain0WhiteLabelLogoUrlSchema=mn,exports.Domain0WhiteLabelSchema=kn,exports.Domain0WhiteLabelThemeSchema=Tn,exports.DomainConnectTemplateSchema=Re,exports.DomainDelegationStatusSchema=Bn,exports.DomainNameSchema=l,exports.DomainProviderCandidateSchema=Wn,exports.DomainRecordConflictSchema=Gn,exports.DomainSetupSupportSchema=Vn,exports.EmailProviderDetectionStatusSchema=zt,exports.EmailProviderSchema=W,exports.ExistingRecordPolicySchema=g,exports.ExplicitDomainConnectInputSchema=ze,exports.GetConnectionResponseSchema=je,exports.IsoDateTimeSchema=u,exports.IssueConnectionTokenInputSchema=mt,exports.IssueConnectionTokenResponseSchema=ht,exports.ListProvidersResponseSchema=be,exports.ManualSetupDocumentationUrlSchema=An,exports.OAuthCallbackResponseSchema=ot,exports.OvhCredentialsSchema=N,exports.PlanWarningCodeSchema=De,exports.PlannedChangeSchema=ue,exports.PlatformCreateConnectionInputSchema=Xn,exports.PreparePlanInputSchema=st,exports.PrivateKeyCredentialsSchema=P,exports.ProviderAuthorizationInputsSchema=n,exports.ProviderCandidateSchema=Me,exports.ProviderCapabilitiesSchema=ge,exports.ProviderConformanceCheckNameSchema=Nn,exports.ProviderConformanceEvidenceSchema=In,exports.ProviderDetectionSchema=ve,exports.ProviderDetectionUnavailableReasonCodeSchema=_e,exports.ProviderHealthReasonSchema=Se,exports.ProviderHealthResponseSchema=we,exports.ProviderHealthSchema=Ce,exports.ProviderHealthStatusSchema=xe,exports.ProviderIdSchema=s,exports.ProviderImplementationSchema=me,exports.ProviderSchema=b,exports.ProviderSessionChallengeKindSchema=Je,exports.ProviderSessionChallengeSchema=Ye,exports.ProviderSessionResponseSchema=Qe,exports.RecordConflictReasonSchema=Hn,exports.ResolveSharedFlowInputSchema=kt,exports.ResolveSharedFlowResponseSchema=At,exports.ResolvedDnsIntentSchema=ae,exports.ResolvedDnsRecordSchema=m,exports.RetryConnectionInputSchema=pt,exports.RetryResumeStateSchema=Te,exports.SelectProviderInputSchema=Pe,exports.SharedFlowIdSchema=B,exports.SharedFlowInvitationSchema=Mt,exports.SharedFlowInvitationUrlSchema=H,exports.SharedFlowTokenSchema=V,exports.SharedFlowUrlSchema=jt,exports.SpfConflictPolicySchema=y,exports.StartDomainConnectInputSchema=Ve,exports.StartDomainConnectResponseSchema=Ue,exports.StartManualConfigurationInputSchema=ut,exports.StartOAuthInputSchema=Ke,exports.StartOAuthResponseSchema=qe,exports.StartProviderSessionInputSchema=nt,exports.SubAccountTokenCredentialsSchema=j,exports.SubmitDomainConnectCompletionInputSchema=We,exports.SubmitManualCompletionInputSchema=dt,exports.TenantIdSchema=o,exports.TransientCredentialKindSchema=t,exports.UsernamePasswordCredentialsSchema=k,exports.UsernameTokenCredentialsSchema=M,exports.VerifiedProviderConformanceEvidenceSchema=Ln,exports.VerifyPropagationInputSchema=lt,exports.colorContrastRatio=hn,exports.directCredentialKindByProvider=it,exports.domain0Locales=Jn,exports.expectedProviderConformanceChecks=X,exports.verifyDomain0Webhook=ir;
 //# sourceMappingURL=contracts.cjs.map