groundmail 0.0.0-stage → 0.14.1

package/dist/chunk-IZYE7HGT.js

@@ -0,0 +1,1367 @@
+// src/errors.ts
+var GroundmailError = class _GroundmailError extends Error {
+  constructor(message, status, details, options) {
+    super(message);
+    this.name = "GroundmailError";
+    this.status = status;
+    this.details = details;
+    this.code = options?.code;
+    this.upgradeUrl = options?.upgradeUrl;
+  }
+  static fromResponse(status, body) {
+    const err = body.error;
+    const message = typeof err === "string" ? err : err?.message || `Request failed with status ${status}`;
+    const details = typeof err === "object" && err ? err.details : void 0;
+    const code = typeof err === "object" && err && "code" in err ? String(err.code) : void 0;
+    const upgradeUrl = typeof err === "object" && err && "upgrade_url" in err ? String(err.upgrade_url) : void 0;
+    return new _GroundmailError(message, status, details, { code, upgradeUrl });
+  }
+};
+
+// src/dns/spf.ts
+function mergeSpfInclude(existing, includeHost) {
+  const include = `include:${includeHost.replace(/^include:/i, "")}`;
+  const trimmed = existing?.trim();
+  if (!trimmed) {
+    return `v=spf1 ${include} ~all`;
+  }
+  if (trimmed.toLowerCase().includes(include.toLowerCase())) {
+    return trimmed;
+  }
+  if (!/^v=spf1\b/i.test(trimmed)) {
+    return `v=spf1 ${include} ~all`;
+  }
+  if (/\s[~?+\-]all\s*$/i.test(trimmed)) {
+    return trimmed.replace(/\s([~?+\-]all)\s*$/i, ` ${include} $1`);
+  }
+  return `${trimmed} ${include} ~all`;
+}
+function isSpfRecord(value) {
+  return value.trim().toLowerCase().startsWith("v=spf1");
+}
+
+// src/dns/cloudflare.ts
+function relativeName(fqdn, zone) {
+  const domain = zone.replace(/\.$/, "").toLowerCase();
+  const host = fqdn.replace(/\.$/, "").toLowerCase();
+  if (host === domain) return "@";
+  if (host.endsWith(`.${domain}`)) return host.slice(0, -(domain.length + 1));
+  return host;
+}
+function zoneNameCandidates(domain) {
+  const labels = domain.replace(/\.$/, "").toLowerCase().split(".").filter(Boolean);
+  const candidates = [];
+  for (let i = 0; i <= labels.length - 2; i++) {
+    candidates.push(labels.slice(i).join("."));
+  }
+  return candidates;
+}
+function createCloudflareProvider(options) {
+  const fetchImpl = options.fetchImpl || fetch;
+  const headers = {
+    Authorization: `Bearer ${options.apiToken}`,
+    "Content-Type": "application/json"
+  };
+  async function cf(path, init) {
+    const response = await fetchImpl(`https://api.cloudflare.com/client/v4${path}`, {
+      ...init,
+      headers: { ...headers, ...init?.headers || {} }
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok || body.success === false) {
+      const message = body.errors?.map((e) => e.message).filter(Boolean).join("; ") || `Cloudflare HTTP ${response.status}`;
+      throw new Error(message);
+    }
+    return body.result;
+  }
+  async function resolveZoneId(domain) {
+    if (options.zoneId) return options.zoneId;
+    for (const candidate of zoneNameCandidates(domain)) {
+      const zones = await cf(
+        `/zones?name=${encodeURIComponent(candidate)}&status=active`
+      );
+      const zone = zones?.[0];
+      if (zone) return zone.id;
+    }
+    throw new Error(`No active Cloudflare zone found for ${domain}`);
+  }
+  return {
+    name: "cloudflare",
+    async apply(domain, records) {
+      const zoneId = await resolveZoneId(domain);
+      const zoneName = domain.toLowerCase();
+      const results = [];
+      for (const record of records) {
+        const recordType = record.type.toUpperCase();
+        const name = relativeName(record.host, zoneName);
+        const absoluteName = name === "@" ? zoneName : `${name}.${zoneName}`;
+        if (recordType === "CNAME") {
+          const target = record.value.replace(/\.$/, "").toLowerCase();
+          const existingList2 = await cf(
+            `/zones/${zoneId}/dns_records?type=CNAME&name=${encodeURIComponent(absoluteName)}&per_page=100`
+          );
+          const existing = (existingList2 || [])[0];
+          if (existing && existing.content.replace(/\.$/, "").toLowerCase() === target) {
+            results.push({ purpose: record.purpose, host: record.host, action: "unchanged" });
+            continue;
+          }
+          if (existing) {
+            await cf(`/zones/${zoneId}/dns_records/${existing.id}`, {
+              method: "PUT",
+              body: JSON.stringify({
+                type: "CNAME",
+                name: absoluteName,
+                content: target,
+                ttl: 1,
+                proxied: false
+              })
+            });
+            results.push({ purpose: record.purpose, host: record.host, action: "updated" });
+          } else {
+            await cf(`/zones/${zoneId}/dns_records`, {
+              method: "POST",
+              body: JSON.stringify({
+                type: "CNAME",
+                name: absoluteName,
+                content: target,
+                ttl: 1,
+                proxied: false
+              })
+            });
+            results.push({ purpose: record.purpose, host: record.host, action: "created" });
+          }
+          continue;
+        }
+        if (recordType === "MX") {
+          const priority = record.priority ?? 10;
+          const target = record.value.replace(/\.$/, "").toLowerCase();
+          const existingList2 = await cf(
+            `/zones/${zoneId}/dns_records?type=MX&name=${encodeURIComponent(absoluteName)}&per_page=100`
+          );
+          const existing = (existingList2 || []).find(
+            (row) => row.content.replace(/\.$/, "").toLowerCase() === target && (row.priority ?? 10) === priority
+          );
+          if (existing) {
+            results.push({ purpose: record.purpose, host: record.host, action: "unchanged" });
+            continue;
+          }
+          const list = existingList2 || [];
+          await cf(`/zones/${zoneId}/dns_records`, {
+            method: "POST",
+            body: JSON.stringify({
+              type: "MX",
+              name: absoluteName,
+              content: target,
+              priority,
+              ttl: 1
+            })
+          });
+          results.push({
+            purpose: record.purpose,
+            host: record.host,
+            action: list.length > 0 ? "merged" : "created"
+          });
+          continue;
+        }
+        if (recordType !== "TXT") {
+          results.push({
+            purpose: record.purpose,
+            host: record.host,
+            action: "unchanged",
+            detail: `Skipped unsupported type ${record.type}`
+          });
+          continue;
+        }
+        if (record.purpose === "SPF") {
+          const allTxt = await cf(
+            `/zones/${zoneId}/dns_records?type=TXT&name=${encodeURIComponent(zoneName)}&per_page=100`
+          );
+          const spfRecords = (allTxt || []).filter((r) => isSpfRecord(r.content));
+          const existing = spfRecords[0];
+          const includeHost = record.value.match(/include:([^\s]+)/i)?.[1] || "spf.groundmail.dev";
+          const merged = mergeSpfInclude(existing?.content, includeHost);
+          if (existing) {
+            if (existing.content.trim() === merged.trim()) {
+              results.push({
+                purpose: record.purpose,
+                host: record.host,
+                action: "unchanged",
+                detail: "SPF already includes Groundmail"
+              });
+            } else {
+              await cf(`/zones/${zoneId}/dns_records/${existing.id}`, {
+                method: "PUT",
+                body: JSON.stringify({
+                  type: "TXT",
+                  name: zoneName,
+                  content: merged,
+                  ttl: 1
+                })
+              });
+              results.push({
+                purpose: record.purpose,
+                host: record.host,
+                action: "merged",
+                detail: merged
+              });
+            }
+          } else {
+            await cf(`/zones/${zoneId}/dns_records`, {
+              method: "POST",
+              body: JSON.stringify({
+                type: "TXT",
+                name: zoneName,
+                content: merged,
+                ttl: 1
+              })
+            });
+            results.push({
+              purpose: record.purpose,
+              host: record.host,
+              action: "created",
+              detail: merged
+            });
+          }
+          continue;
+        }
+        const existingList = await cf(
+          `/zones/${zoneId}/dns_records?type=TXT&name=${encodeURIComponent(absoluteName)}&per_page=100`
+        );
+        const match = (existingList || []).find((r) => r.content === record.value);
+        if (match) {
+          results.push({
+            purpose: record.purpose,
+            host: record.host,
+            action: "unchanged"
+          });
+          continue;
+        }
+        const replaceable = (existingList || []).find((r) => {
+          if (record.purpose === "Domain ownership") return r.content.includes("groundmail-verify=");
+          if (record.purpose === "DKIM") return r.content.toLowerCase().includes("v=dkim1");
+          if (record.purpose === "DMARC") return r.content.toLowerCase().includes("v=dmarc1");
+          return false;
+        });
+        if (replaceable) {
+          await cf(`/zones/${zoneId}/dns_records/${replaceable.id}`, {
+            method: "PUT",
+            body: JSON.stringify({
+              type: "TXT",
+              name: absoluteName,
+              content: record.value,
+              ttl: 1
+            })
+          });
+          results.push({ purpose: record.purpose, host: record.host, action: "updated" });
+        } else {
+          await cf(`/zones/${zoneId}/dns_records`, {
+            method: "POST",
+            body: JSON.stringify({
+              type: "TXT",
+              name: absoluteName,
+              content: record.value,
+              ttl: 1
+            })
+          });
+          results.push({ purpose: record.purpose, host: record.host, action: "created" });
+        }
+      }
+      return results;
+    }
+  };
+}
+
+// src/dns/godaddy.ts
+function relativeName2(fqdn, zone) {
+  const domain = zone.replace(/\.$/, "").toLowerCase();
+  const host = fqdn.replace(/\.$/, "").toLowerCase();
+  if (host === domain) return "@";
+  if (host.endsWith(`.${domain}`)) return host.slice(0, -(domain.length + 1));
+  return host;
+}
+function serializeGoDaddyMxRecords(name, rows) {
+  return rows.map((row) => ({
+    type: "MX",
+    name: row.name || name,
+    data: row.data,
+    priority: row.priority ?? 10,
+    ttl: Math.max(row.ttl || 600, 600)
+  }));
+}
+function createGoDaddyProvider(options) {
+  const fetchImpl = options.fetchImpl || fetch;
+  const headers = {
+    Authorization: `sso-key ${options.apiKey}:${options.apiSecret}`,
+    "Content-Type": "application/json",
+    Accept: "application/json"
+  };
+  async function gd(path, init) {
+    const response = await fetchImpl(`https://api.godaddy.com${path}`, {
+      ...init,
+      headers: { ...headers, ...init?.headers || {} }
+    });
+    if (response.status === 204) return void 0;
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      const message = body.message || (Array.isArray(body.errors) ? body.errors.map((e) => e.message).join("; ") : null) || `GoDaddy HTTP ${response.status}`;
+      throw new Error(message);
+    }
+    return body;
+  }
+  return {
+    name: "godaddy",
+    async apply(domain, records) {
+      const zone = domain.toLowerCase();
+      const results = [];
+      for (const record of records) {
+        const recordType = record.type.toUpperCase();
+        const name = relativeName2(record.host, zone);
+        if (recordType === "CNAME") {
+          const target = record.value.replace(/\.$/, "");
+          const existing2 = await gd(
+            `/v1/domains/${zone}/records/CNAME/${encodeURIComponent(name)}`
+          );
+          const list2 = existing2 || [];
+          const current = list2[0];
+          if (current && current.data.replace(/\.$/, "").toLowerCase() === target.toLowerCase()) {
+            results.push({ purpose: record.purpose, host: record.host, action: "unchanged" });
+            continue;
+          }
+          await gd(`/v1/domains/${zone}/records/CNAME/${encodeURIComponent(name)}`, {
+            method: "PUT",
+            body: JSON.stringify([{ type: "CNAME", name, data: target, ttl: 600 }])
+          });
+          results.push({
+            purpose: record.purpose,
+            host: record.host,
+            action: current ? "updated" : "created"
+          });
+          continue;
+        }
+        if (recordType === "MX") {
+          const priority = record.priority ?? 10;
+          const target = record.value.replace(/\.$/, "");
+          const existing2 = await gd(
+            `/v1/domains/${zone}/records/MX/${encodeURIComponent(name)}`
+          );
+          const list2 = existing2 || [];
+          const current = list2.find(
+            (row) => row.data.replace(/\.$/, "").toLowerCase() === target.toLowerCase() && (row.priority ?? 10) === priority
+          );
+          if (current) {
+            results.push({ purpose: record.purpose, host: record.host, action: "unchanged" });
+            continue;
+          }
+          const next2 = [
+            ...list2,
+            { type: "MX", name, data: target, priority, ttl: 600 }
+          ];
+          await gd(`/v1/domains/${zone}/records/MX/${encodeURIComponent(name)}`, {
+            method: "PUT",
+            body: JSON.stringify(serializeGoDaddyMxRecords(name, next2))
+          });
+          results.push({
+            purpose: record.purpose,
+            host: record.host,
+            action: list2.length > 0 ? "merged" : "created"
+          });
+          continue;
+        }
+        if (recordType !== "TXT") {
+          results.push({
+            purpose: record.purpose,
+            host: record.host,
+            action: "unchanged",
+            detail: `Skipped unsupported type ${record.type}`
+          });
+          continue;
+        }
+        if (record.purpose === "SPF") {
+          const existing2 = await gd(`/v1/domains/${zone}/records/TXT/${encodeURIComponent(name)}`);
+          const list2 = existing2 || [];
+          const spfIndex = list2.findIndex((r) => isSpfRecord(r.data));
+          const includeHost = record.value.match(/include:([^\s]+)/i)?.[1] || "spf.groundmail.dev";
+          const currentSpf = spfIndex >= 0 ? list2[spfIndex].data : null;
+          const merged = mergeSpfInclude(currentSpf, includeHost);
+          if (spfIndex >= 0 && list2[spfIndex].data.trim() === merged.trim()) {
+            results.push({
+              purpose: record.purpose,
+              host: record.host,
+              action: "unchanged",
+              detail: "SPF already includes Groundmail"
+            });
+            continue;
+          }
+          const next2 = list2.map(
+            (r, i) => i === spfIndex ? { type: "TXT", name, data: merged, ttl: Math.max(r.ttl || 600, 600) } : r
+          );
+          if (spfIndex < 0) {
+            next2.push({ type: "TXT", name, data: merged, ttl: 600 });
+          }
+          await gd(`/v1/domains/${zone}/records/TXT/${encodeURIComponent(name)}`, {
+            method: "PUT",
+            body: JSON.stringify(next2.map(({ type, name: n, data, ttl }) => ({ type, name: n, data, ttl })))
+          });
+          results.push({
+            purpose: record.purpose,
+            host: record.host,
+            action: spfIndex >= 0 ? "merged" : "created",
+            detail: merged
+          });
+          continue;
+        }
+        const existing = await gd(`/v1/domains/${zone}/records/TXT/${encodeURIComponent(name)}`);
+        const list = existing || [];
+        const exact = list.find((r) => r.data === record.value);
+        if (exact) {
+          results.push({ purpose: record.purpose, host: record.host, action: "unchanged" });
+          continue;
+        }
+        const replaceableIndex = list.findIndex((r) => {
+          if (record.purpose === "Domain ownership") return r.data.includes("groundmail-verify=");
+          if (record.purpose === "DKIM") return r.data.toLowerCase().includes("v=dkim1");
+          if (record.purpose === "DMARC") return r.data.toLowerCase().includes("v=dmarc1");
+          return false;
+        });
+        const next = replaceableIndex >= 0 ? list.map(
+          (r, i) => i === replaceableIndex ? { type: "TXT", name, data: record.value, ttl: Math.max(r.ttl || 600, 600) } : r
+        ) : [...list, { type: "TXT", name, data: record.value, ttl: 600 }];
+        await gd(`/v1/domains/${zone}/records/TXT/${encodeURIComponent(name)}`, {
+          method: "PUT",
+          body: JSON.stringify(next.map(({ type, name: n, data, ttl }) => ({ type, name: n, data, ttl })))
+        });
+        results.push({
+          purpose: record.purpose,
+          host: record.host,
+          action: replaceableIndex >= 0 ? "updated" : "created"
+        });
+      }
+      return results;
+    }
+  };
+}
+
+// src/dns/vercel.ts
+function zoneNameCandidates2(domain) {
+  const labels = domain.replace(/\.$/, "").toLowerCase().split(".").filter(Boolean);
+  const candidates = [];
+  for (let i = 0; i <= labels.length - 2; i++) {
+    candidates.push(labels.slice(i).join("."));
+  }
+  return candidates;
+}
+function relativeName3(fqdn, zone) {
+  const domain = zone.replace(/\.$/, "").toLowerCase();
+  const host = fqdn.replace(/\.$/, "").toLowerCase();
+  if (host === domain) return "";
+  if (host.endsWith(`.${domain}`)) return host.slice(0, -(domain.length + 1));
+  return host;
+}
+function teamQuery(teamId) {
+  return teamId?.trim() ? `?teamId=${encodeURIComponent(teamId.trim())}` : "";
+}
+function createVercelProvider(options) {
+  const fetchImpl = options.fetchImpl || fetch;
+  const headers = {
+    Authorization: `Bearer ${options.apiToken}`,
+    "Content-Type": "application/json"
+  };
+  const teamQs = teamQuery(options.teamId);
+  async function vercel(path, init) {
+    const url = path.includes("?") ? `https://api.vercel.com${path}${options.teamId?.trim() ? `&teamId=${encodeURIComponent(options.teamId.trim())}` : ""}` : `https://api.vercel.com${path}${teamQs}`;
+    const response = await fetchImpl(url, {
+      ...init,
+      headers: { ...headers, ...init?.headers || {} }
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      const message = body.error?.message || body.message || `Vercel HTTP ${response.status}`;
+      throw new Error(message);
+    }
+    return body;
+  }
+  async function listRecords(domain) {
+    const all = [];
+    let until;
+    for (let page = 0; page < 20; page++) {
+      const qs = new URLSearchParams({ limit: "100" });
+      if (until != null) qs.set("until", String(until));
+      if (options.teamId?.trim()) qs.set("teamId", options.teamId.trim());
+      const body = await vercel(
+        `/v5/domains/${encodeURIComponent(domain)}/records?${qs.toString()}`
+      );
+      const records = body.records || [];
+      all.push(...records);
+      const next = body.pagination?.next;
+      if (next == null || records.length === 0) break;
+      until = next;
+    }
+    return all;
+  }
+  async function resolveDomain(domain) {
+    const errors = [];
+    for (const candidate of zoneNameCandidates2(domain)) {
+      try {
+        await listRecords(candidate);
+        return candidate;
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        errors.push(`${candidate}: ${message}`);
+      }
+    }
+    throw new Error(
+      `No Vercel DNS domain found for ${domain}. The domain must use Vercel nameservers. (${errors.join("; ")})`
+    );
+  }
+  return {
+    name: "vercel",
+    async apply(domain, records) {
+      const zone = await resolveDomain(domain);
+      const results = [];
+      let cached = await listRecords(zone);
+      const refresh = async () => {
+        cached = await listRecords(zone);
+      };
+      for (const record of records) {
+        const recordType = record.type.toUpperCase();
+        const name = relativeName3(record.host, zone);
+        if (recordType === "CNAME") {
+          const target = record.value.replace(/\.$/, "").toLowerCase();
+          const existing = cached.find(
+            (row) => row.type === "CNAME" && row.name === name
+          );
+          if (existing && existing.value.replace(/\.$/, "").toLowerCase() === target) {
+            results.push({ purpose: record.purpose, host: record.host, action: "unchanged" });
+            continue;
+          }
+          if (existing) {
+            await vercel(`/v1/domains/records/${existing.id}`, {
+              method: "PATCH",
+              body: JSON.stringify({ type: "CNAME", name, value: target, ttl: 60 })
+            });
+            results.push({ purpose: record.purpose, host: record.host, action: "updated" });
+          } else {
+            await vercel(`/v2/domains/${encodeURIComponent(zone)}/records`, {
+              method: "POST",
+              body: JSON.stringify({ type: "CNAME", name, value: target, ttl: 60 })
+            });
+            results.push({ purpose: record.purpose, host: record.host, action: "created" });
+          }
+          await refresh();
+          continue;
+        }
+        if (recordType === "MX") {
+          const priority = record.priority ?? 10;
+          const target = record.value.replace(/\.$/, "").toLowerCase();
+          const existing = cached.find(
+            (row) => row.type === "MX" && row.name === name && row.value.replace(/\.$/, "").toLowerCase() === target && (row.mxPriority ?? 10) === priority
+          );
+          if (existing) {
+            results.push({ purpose: record.purpose, host: record.host, action: "unchanged" });
+            continue;
+          }
+          const sameName = cached.filter((row) => row.type === "MX" && row.name === name);
+          await vercel(`/v2/domains/${encodeURIComponent(zone)}/records`, {
+            method: "POST",
+            body: JSON.stringify({
+              type: "MX",
+              name,
+              value: target,
+              mxPriority: priority,
+              ttl: 60
+            })
+          });
+          results.push({
+            purpose: record.purpose,
+            host: record.host,
+            action: sameName.length > 0 ? "merged" : "created"
+          });
+          await refresh();
+          continue;
+        }
+        if (recordType !== "TXT") {
+          results.push({
+            purpose: record.purpose,
+            host: record.host,
+            action: "unchanged",
+            detail: `Skipped unsupported type ${record.type}`
+          });
+          continue;
+        }
+        if (record.purpose === "SPF") {
+          const spfRecords = cached.filter(
+            (row) => row.type === "TXT" && row.name === "" && isSpfRecord(row.value)
+          );
+          const existing = spfRecords[0];
+          const includeHost = record.value.match(/include:([^\s]+)/i)?.[1] || "spf.groundmail.dev";
+          const merged = mergeSpfInclude(existing?.value, includeHost);
+          if (existing) {
+            if (existing.value.trim() === merged.trim()) {
+              results.push({
+                purpose: record.purpose,
+                host: record.host,
+                action: "unchanged",
+                detail: "SPF already includes Groundmail"
+              });
+            } else {
+              await vercel(`/v1/domains/records/${existing.id}`, {
+                method: "PATCH",
+                body: JSON.stringify({ type: "TXT", name: "", value: merged, ttl: 60 })
+              });
+              results.push({
+                purpose: record.purpose,
+                host: record.host,
+                action: "merged",
+                detail: merged
+              });
+            }
+          } else {
+            await vercel(`/v2/domains/${encodeURIComponent(zone)}/records`, {
+              method: "POST",
+              body: JSON.stringify({ type: "TXT", name: "", value: merged, ttl: 60 })
+            });
+            results.push({
+              purpose: record.purpose,
+              host: record.host,
+              action: "created",
+              detail: merged
+            });
+          }
+          await refresh();
+          continue;
+        }
+        const existingList = cached.filter((row) => row.type === "TXT" && row.name === name);
+        const match = existingList.find((row) => row.value === record.value);
+        if (match) {
+          results.push({ purpose: record.purpose, host: record.host, action: "unchanged" });
+          continue;
+        }
+        const replaceable = existingList.find((row) => {
+          if (record.purpose === "Domain ownership") return row.value.includes("groundmail-verify=");
+          if (record.purpose === "DKIM") return row.value.toLowerCase().includes("v=dkim1");
+          if (record.purpose === "DMARC") return row.value.toLowerCase().includes("v=dmarc1");
+          return false;
+        });
+        if (replaceable) {
+          await vercel(`/v1/domains/records/${replaceable.id}`, {
+            method: "PATCH",
+            body: JSON.stringify({ type: "TXT", name, value: record.value, ttl: 60 })
+          });
+          results.push({ purpose: record.purpose, host: record.host, action: "updated" });
+        } else {
+          await vercel(`/v2/domains/${encodeURIComponent(zone)}/records`, {
+            method: "POST",
+            body: JSON.stringify({ type: "TXT", name, value: record.value, ttl: 60 })
+          });
+          results.push({ purpose: record.purpose, host: record.host, action: "created" });
+        }
+        await refresh();
+      }
+      return results;
+    }
+  };
+}
+
+// src/dns/apply.ts
+function createDnsProvider(provider, credentials, fetchImpl) {
+  if (provider === "cloudflare") {
+    const token = credentials.cloudflareApiToken;
+    if (!token) {
+      throw new Error("Missing Cloudflare token. Set CLOUDFLARE_API_TOKEN or pass cloudflareApiToken.");
+    }
+    return createCloudflareProvider({
+      apiToken: token,
+      zoneId: credentials.cloudflareZoneId,
+      fetchImpl
+    });
+  }
+  if (provider === "godaddy") {
+    const apiKey = credentials.godaddyApiKey;
+    const apiSecret = credentials.godaddyApiSecret;
+    if (!apiKey || !apiSecret) {
+      throw new Error(
+        "Missing GoDaddy credentials. Set GODADDY_API_KEY and GODADDY_API_SECRET."
+      );
+    }
+    return createGoDaddyProvider({ apiKey, apiSecret, fetchImpl });
+  }
+  if (provider === "vercel") {
+    const apiToken = credentials.vercelApiToken;
+    if (!apiToken) {
+      throw new Error("Missing Vercel token. Set VERCEL_API_TOKEN or pass vercelApiToken.");
+    }
+    return createVercelProvider({
+      apiToken,
+      teamId: credentials.vercelTeamId,
+      fetchImpl
+    });
+  }
+  throw new Error(`Unsupported DNS provider: ${provider}`);
+}
+async function applyDnsRecords(input) {
+  const provider = createDnsProvider(input.provider, input.credentials, input.fetchImpl);
+  const results = await provider.apply(input.domain, input.records);
+  return {
+    provider: input.provider,
+    domain: input.domain,
+    results
+  };
+}
+
+// src/webhooks/verify.ts
+import { createHmac, timingSafeEqual } from "crypto";
+function signWebhookPayload(secret, payload, timestamp) {
+  const signed = `${timestamp}.${payload}`;
+  return createHmac("sha256", secret).update(signed).digest("hex");
+}
+function buildSignatureHeader(secret, payload, timestamp = Math.floor(Date.now() / 1e3)) {
+  const signature = signWebhookPayload(secret, payload, timestamp);
+  return `t=${timestamp},v1=${signature}`;
+}
+function verifyWebhookSignature(secret, payload, header, toleranceSec = 300) {
+  if (!header) return false;
+  const parts = Object.fromEntries(
+    header.split(",").map((part) => {
+      const [key, value] = part.trim().split("=");
+      return [key, value];
+    })
+  );
+  const timestamp = Number(parts.t);
+  const signature = parts.v1;
+  if (!timestamp || !signature) return false;
+  if (Math.abs(Math.floor(Date.now() / 1e3) - timestamp) > toleranceSec) return false;
+  const expected = signWebhookPayload(secret, payload, timestamp);
+  try {
+    return timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
+  } catch {
+    return false;
+  }
+}
+
+// src/automations.ts
+var AutomationsResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list() {
+    return this.client.request("/automations", { method: "GET" });
+  }
+  async get(id) {
+    return this.client.request(`/automations/${encodeURIComponent(id)}`, { method: "GET" });
+  }
+  async create(params) {
+    return this.client.request("/automations", {
+      method: "POST",
+      body: JSON.stringify(params)
+    });
+  }
+  async update(id, params) {
+    return this.client.request(`/automations/${encodeURIComponent(id)}`, {
+      method: "PATCH",
+      body: JSON.stringify(params)
+    });
+  }
+  async remove(id) {
+    return this.client.request(`/automations/${encodeURIComponent(id)}`, {
+      method: "DELETE"
+    });
+  }
+  async activate(id) {
+    return this.client.request(`/automations/${encodeURIComponent(id)}`, {
+      method: "POST",
+      body: JSON.stringify({ action: "activate" })
+    });
+  }
+  async pause(id) {
+    return this.client.request(`/automations/${encodeURIComponent(id)}`, {
+      method: "POST",
+      body: JSON.stringify({ action: "pause" })
+    });
+  }
+  async listRuns(params = {}) {
+    const search = new URLSearchParams();
+    if (params.automation_id) search.set("automation_id", params.automation_id);
+    const query = search.toString();
+    return this.client.request(`/automations/runs${query ? `?${query}` : ""}`, { method: "GET" });
+  }
+  async getRun(id) {
+    return this.client.request(`/automations/runs/${encodeURIComponent(id)}`, { method: "GET" });
+  }
+  async cancelRun(id) {
+    return this.client.request(`/automations/runs/${encodeURIComponent(id)}`, {
+      method: "POST",
+      body: JSON.stringify({ action: "cancel" })
+    });
+  }
+  async retryRun(id) {
+    return this.client.request(`/automations/runs/${encodeURIComponent(id)}`, {
+      method: "POST",
+      body: JSON.stringify({ action: "retry" })
+    });
+  }
+};
+
+// src/domains.ts
+var DomainsResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(params = {}) {
+    const search = new URLSearchParams();
+    if (params.limit != null) search.set("limit", String(params.limit));
+    if (params.cursor) search.set("cursor", params.cursor);
+    const inboundEnabled = params.inbound_enabled ?? params.inboundEnabled;
+    if (inboundEnabled !== void 0) search.set("inbound_enabled", String(inboundEnabled));
+    const query = search.toString();
+    return this.client.request(`/domains${query ? `?${query}` : ""}`, { method: "GET" });
+  }
+  async get(idOrName) {
+    return this.client.request(`/domains/${encodeURIComponent(idOrName)}`, { method: "GET" });
+  }
+  async create(params) {
+    const inboundEnabled = params.inbound_enabled ?? params.inboundEnabled;
+    return this.client.request("/domains", {
+      method: "POST",
+      body: JSON.stringify({
+        name: params.name,
+        ...inboundEnabled !== void 0 ? { inbound_enabled: inboundEnabled } : {}
+      })
+    });
+  }
+  async verify(idOrName) {
+    return this.client.request(`/domains/${encodeURIComponent(idOrName)}`, {
+      method: "POST",
+      body: JSON.stringify({ action: "verify" })
+    });
+  }
+  async update(idOrName, params) {
+    return this.client.request(`/domains/${encodeURIComponent(idOrName)}`, {
+      method: "PATCH",
+      body: JSON.stringify(params)
+    });
+  }
+  async delete(idOrName) {
+    return this.client.request(`/domains/${encodeURIComponent(idOrName)}`, {
+      method: "DELETE"
+    });
+  }
+  /**
+   * Apply DNS using the public API. Cloudflare, Vercel, and GoDaddy can use stored dashboard
+   * credentials; GoDaddy also accepts one-time credentials on the request.
+   */
+  async apply(idOrName, options = {}) {
+    return this.client.request(`/domains/${encodeURIComponent(idOrName)}`, {
+      method: "POST",
+      body: JSON.stringify({
+        action: "apply",
+        provider: options.provider || "cloudflare",
+        ...options.credentials ? { credentials: options.credentials } : {}
+      })
+    });
+  }
+  /**
+   * Fetch Groundmail DNS records, then write them at Cloudflare, Vercel, or GoDaddy
+   * using the caller's provider credentials (never sent to Groundmail).
+   */
+  async applyDns(params) {
+    const detail = await this.get(params.idOrName);
+    const records = [
+      ...detail.records,
+      ...detail.domain.inbound_enabled ? detail.inbound_records || [] : []
+    ];
+    return applyDnsRecords({
+      provider: params.provider,
+      domain: detail.domain.name,
+      records,
+      credentials: {
+        cloudflareApiToken: params.cloudflareApiToken,
+        cloudflareZoneId: params.cloudflareZoneId,
+        godaddyApiKey: params.godaddyApiKey,
+        godaddyApiSecret: params.godaddyApiSecret,
+        vercelApiToken: params.vercelApiToken,
+        vercelTeamId: params.vercelTeamId
+      },
+      fetchImpl: this.client.fetchImpl
+    });
+  }
+};
+
+// src/react-email.ts
+async function renderReactEmail(react) {
+  let render;
+  try {
+    const mod = await import("@react-email/render");
+    render = mod.render ?? mod.default?.render;
+  } catch {
+    throw new Error(
+      "The `react` option requires peer dependency `@react-email/render`. Install it with: npm install @react-email/render react"
+    );
+  }
+  if (typeof render !== "function") {
+    throw new Error(
+      "Could not load `render` from `@react-email/render`. Ensure a compatible version is installed."
+    );
+  }
+  return render(react);
+}
+
+// src/emails.ts
+var EmailsResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(params = {}) {
+    const search = new URLSearchParams();
+    if (params.limit != null) search.set("limit", String(params.limit));
+    if (params.cursor) search.set("cursor", params.cursor);
+    const query = search.toString();
+    return this.client.request(`/emails${query ? `?${query}` : ""}`, {
+      method: "GET"
+    });
+  }
+  async get(id) {
+    return this.client.request(`/emails/${encodeURIComponent(id)}`, {
+      method: "GET"
+    });
+  }
+  async insights(window = "30d") {
+    const search = new URLSearchParams({ window });
+    return this.client.request(`/deliverability?${search.toString()}`, {
+      method: "GET"
+    });
+  }
+  async send(params) {
+    const payload = await this.serializeSendParams(params);
+    const headers = {};
+    if (params.idempotencyKey) {
+      headers["Idempotency-Key"] = params.idempotencyKey;
+    }
+    return this.client.request("/emails", {
+      method: "POST",
+      headers,
+      body: JSON.stringify(payload)
+    });
+  }
+  async batch(emails) {
+    const serialized = await Promise.all(emails.map((email) => this.serializeSendParams(email)));
+    return this.client.request("/emails/batch", {
+      method: "POST",
+      body: JSON.stringify({ emails: serialized })
+    });
+  }
+  async update(id, params) {
+    const payload = {};
+    if (params.cancel !== void 0) payload.cancel = params.cancel;
+    const scheduledAt = params.scheduledAt ?? params.scheduled_at;
+    if (scheduledAt !== void 0) {
+      payload.scheduled_at = scheduledAt instanceof Date ? scheduledAt.toISOString() : scheduledAt;
+    }
+    return this.client.request(`/emails/${encodeURIComponent(id)}`, {
+      method: "PATCH",
+      body: JSON.stringify(payload)
+    });
+  }
+  async cancel(id) {
+    return this.update(id, { cancel: true });
+  }
+  /** Create a new send from a previously stored email (new `msg_…` id). */
+  async resend(id) {
+    return this.client.request(`/emails/${encodeURIComponent(id)}/resend`, {
+      method: "POST"
+    });
+  }
+  /** Simulate a webhook event for CI / local testing (`POST /emails/test`). */
+  async testWebhook(params) {
+    return this.client.request("/emails/test", {
+      method: "POST",
+      body: JSON.stringify({
+        event: params.event,
+        ...params.email_id !== void 0 ? { email_id: params.email_id } : {},
+        ...params.webhook_id !== void 0 ? { webhook_id: params.webhook_id } : {},
+        ...params.sync !== void 0 ? { sync: params.sync } : {},
+        ...params.deliver !== void 0 ? { deliver: params.deliver } : {}
+      })
+    });
+  }
+  async serializeSendParams(params) {
+    const hasReact = params.react !== void 0;
+    const hasHtml = params.html !== void 0;
+    const hasText = params.text !== void 0;
+    const hasTemplate = params.template !== void 0;
+    if (hasReact && (hasHtml || hasText || hasTemplate)) {
+      throw new Error("`react` cannot be combined with `html`, `text`, or `template`");
+    }
+    if (hasTemplate && (hasHtml || hasText)) {
+      throw new Error("`template` cannot be combined with `html` or `text`");
+    }
+    const payload = {
+      from: params.from,
+      to: params.to
+    };
+    if (params.subject !== void 0) payload.subject = params.subject;
+    if (hasReact) {
+      payload.html = await renderReactEmail(params.react);
+    } else {
+      const html = params.html ?? params.htmlBody ?? params.html_body;
+      const text = params.text ?? params.textBody ?? params.text_body ?? params.plain_body;
+      if (html !== void 0) payload.html = html;
+      if (text !== void 0) payload.text = text;
+    }
+    if (params.template !== void 0) {
+      payload.template = params.template;
+    }
+    const replyTo = params.replyTo ?? params.reply_to;
+    if (replyTo !== void 0) payload.reply_to = replyTo;
+    if (params.cc !== void 0) payload.cc = params.cc;
+    if (params.bcc !== void 0) payload.bcc = params.bcc;
+    if (params.tags !== void 0) payload.tags = params.tags;
+    if (params.headers !== void 0) payload.headers = params.headers;
+    if (params.tag !== void 0) payload.tag = params.tag;
+    if (params.attachments !== void 0) {
+      payload.attachments = params.attachments.map((attachment) => ({
+        name: attachment.name ?? attachment.filename,
+        content_type: attachment.content_type ?? attachment.contentType,
+        data: attachment.data ?? attachment.content,
+        ...attachment.content_id ?? attachment.contentId ? { content_id: attachment.content_id ?? attachment.contentId } : {}
+      }));
+    }
+    const scheduledAt = params.scheduledAt ?? params.scheduled_at;
+    if (scheduledAt !== void 0) {
+      payload.scheduled_at = scheduledAt instanceof Date ? scheduledAt.toISOString() : scheduledAt;
+    }
+    if (params.unsubscribe !== void 0) payload.unsubscribe = params.unsubscribe;
+    if (params.category !== void 0) payload.category = params.category;
+    return payload;
+  }
+};
+
+// src/events.ts
+var EventsResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async trigger(params) {
+    const headers = {};
+    if (params.idempotencyKey) {
+      headers["Idempotency-Key"] = params.idempotencyKey;
+    }
+    const payload = {};
+    if (params.name !== void 0) payload.name = params.name;
+    if (params.type !== void 0) payload.type = params.type;
+    const userId = params.user_id ?? params.userId;
+    if (userId !== void 0) payload.user_id = userId;
+    if (params.email !== void 0) payload.email = params.email;
+    if (params.data !== void 0) payload.data = params.data;
+    return this.client.request("/events", {
+      method: "POST",
+      headers,
+      body: JSON.stringify(payload)
+    });
+  }
+};
+
+// src/integrations.ts
+var IntegrationsResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async getTwilio() {
+    return this.client.request("/integrations/twilio", { method: "GET" });
+  }
+  async connectTwilio(params) {
+    return this.client.request("/integrations/twilio", {
+      method: "PUT",
+      body: JSON.stringify(params)
+    });
+  }
+  async disconnectTwilio() {
+    return this.client.request("/integrations/twilio", { method: "DELETE" });
+  }
+};
+
+// src/keys.ts
+var KeysResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(params = {}) {
+    const search = new URLSearchParams();
+    if (params.limit != null) search.set("limit", String(params.limit));
+    if (params.cursor) search.set("cursor", params.cursor);
+    const query = search.toString();
+    return this.client.request(`/api-keys${query ? `?${query}` : ""}`, {
+      method: "GET"
+    });
+  }
+  async create(params = {}) {
+    return this.client.request("/api-keys", {
+      method: "POST",
+      body: JSON.stringify({
+        ...params.name ? { name: params.name } : {},
+        ...params.scope ? { scope: params.scope } : {}
+      })
+    });
+  }
+  async remove(id) {
+    return this.client.request(`/api-keys/${encodeURIComponent(id)}`, {
+      method: "DELETE"
+    });
+  }
+};
+
+// src/smtp-credentials.ts
+var SmtpCredentialsResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(params = {}) {
+    const search = new URLSearchParams();
+    if (params.limit != null) search.set("limit", String(params.limit));
+    if (params.cursor) search.set("cursor", params.cursor);
+    const query = search.toString();
+    return this.client.request(
+      `/smtp-credentials${query ? `?${query}` : ""}`,
+      { method: "GET" }
+    );
+  }
+  async create(params = {}) {
+    return this.client.request("/smtp-credentials", {
+      method: "POST",
+      body: JSON.stringify({
+        ...params.name ? { name: params.name } : {}
+      })
+    });
+  }
+  async remove(id) {
+    return this.client.request(`/smtp-credentials/${encodeURIComponent(id)}`, {
+      method: "DELETE"
+    });
+  }
+};
+
+// src/received-emails.ts
+var ReceivedEmailsResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(params = {}) {
+    const search = new URLSearchParams();
+    if (params.limit != null) search.set("limit", String(params.limit));
+    if (params.cursor) search.set("cursor", params.cursor);
+    if (params.domain) search.set("domain", params.domain);
+    const query = search.toString();
+    return this.client.request(
+      `/received-emails${query ? `?${query}` : ""}`,
+      {
+        method: "GET"
+      }
+    );
+  }
+  async get(id) {
+    return this.client.request(
+      `/received-emails/${encodeURIComponent(id)}`,
+      {
+        method: "GET"
+      }
+    );
+  }
+};
+
+// src/suppressions.ts
+var SuppressionsResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(params = {}) {
+    const search = new URLSearchParams();
+    if (params.limit != null) search.set("limit", String(params.limit));
+    if (params.cursor) search.set("cursor", params.cursor);
+    if (params.email) search.set("email", params.email);
+    const query = search.toString();
+    return this.client.request(`/suppressions${query ? `?${query}` : ""}`, { method: "GET" });
+  }
+  async create(params) {
+    return this.client.request("/suppressions", {
+      method: "POST",
+      body: JSON.stringify(params)
+    });
+  }
+  /** Remove by suppression id or email address. */
+  async remove(idOrEmail) {
+    if (idOrEmail.includes("@")) {
+      return this.client.request(`/suppressions?email=${encodeURIComponent(idOrEmail)}`, {
+        method: "DELETE"
+      });
+    }
+    return this.client.request(`/suppressions/${encodeURIComponent(idOrEmail)}`, {
+      method: "DELETE"
+    });
+  }
+};
+
+// src/templates.ts
+var TemplatesResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(params = {}) {
+    const search = new URLSearchParams();
+    if (params.limit != null) search.set("limit", String(params.limit));
+    if (params.cursor) search.set("cursor", params.cursor);
+    if (params.status) search.set("status", params.status);
+    const query = search.toString();
+    return this.client.request(`/templates${query ? `?${query}` : ""}`, { method: "GET" });
+  }
+  async get(idOrAlias) {
+    return this.client.request(`/templates/${encodeURIComponent(idOrAlias)}`, { method: "GET" });
+  }
+  async create(params) {
+    return this.client.request("/templates", {
+      method: "POST",
+      body: JSON.stringify(params)
+    });
+  }
+  async update(idOrAlias, params) {
+    return this.client.request(`/templates/${encodeURIComponent(idOrAlias)}`, {
+      method: "PATCH",
+      body: JSON.stringify(params)
+    });
+  }
+  async remove(idOrAlias) {
+    return this.client.request(`/templates/${encodeURIComponent(idOrAlias)}`, {
+      method: "DELETE"
+    });
+  }
+  async publish(idOrAlias) {
+    return this.client.request(`/templates/${encodeURIComponent(idOrAlias)}`, {
+      method: "POST",
+      body: JSON.stringify({ action: "publish" })
+    });
+  }
+  async duplicate(idOrAlias, params = {}) {
+    return this.client.request(`/templates/${encodeURIComponent(idOrAlias)}`, {
+      method: "POST",
+      body: JSON.stringify({ action: "duplicate", ...params })
+    });
+  }
+  async listStarters() {
+    return this.client.request("/templates/starters", { method: "GET" });
+  }
+  async fromStarter(alias) {
+    return this.client.request("/templates/from-starter", {
+      method: "POST",
+      body: JSON.stringify({ alias })
+    });
+  }
+  async listVersions(idOrAlias) {
+    return this.client.request(`/templates/${encodeURIComponent(idOrAlias)}/versions`, {
+      method: "GET"
+    });
+  }
+  async restoreVersion(idOrAlias, version) {
+    return this.client.request(
+      `/templates/${encodeURIComponent(idOrAlias)}/versions/${version}`,
+      {
+        method: "POST",
+        body: JSON.stringify({ action: "restore" })
+      }
+    );
+  }
+  async testSend(idOrAlias, params) {
+    return this.client.request(`/templates/${encodeURIComponent(idOrAlias)}/test-send`, {
+      method: "POST",
+      body: JSON.stringify(params)
+    });
+  }
+};
+
+// src/webhooks/index.ts
+var WebhooksResource = class {
+  constructor(client) {
+    this.client = client;
+  }
+  async list(params = {}) {
+    const search = new URLSearchParams();
+    if (params.limit != null) search.set("limit", String(params.limit));
+    if (params.cursor) search.set("cursor", params.cursor);
+    const query = search.toString();
+    return this.client.request(`/webhooks${query ? `?${query}` : ""}`, { method: "GET" });
+  }
+  async get(id) {
+    return this.client.request(`/webhooks/${encodeURIComponent(id)}`, { method: "GET" });
+  }
+  async create(params) {
+    return this.client.request("/webhooks", {
+      method: "POST",
+      body: JSON.stringify(params)
+    });
+  }
+  async update(id, params) {
+    return this.client.request(`/webhooks/${encodeURIComponent(id)}`, {
+      method: "PATCH",
+      body: JSON.stringify(params)
+    });
+  }
+  async delete(id) {
+    return this.client.request(`/webhooks/${id}`, { method: "DELETE" });
+  }
+  /** Verify an incoming webhook signature (same as `verifyWebhookSignature`). */
+  verify(secret, payload, header, toleranceSec = 300) {
+    return verifyWebhookSignature(secret, payload, header, toleranceSec);
+  }
+};
+
+// src/client.ts
+var DEFAULT_API_BASE_URL = "https://api.groundmail.dev";
+var Groundmail = class {
+  constructor(apiKey, options = {}) {
+    this.apiKey = apiKey;
+    this.options = options;
+    if (!apiKey?.startsWith("gm_")) {
+      throw new Error("Groundmail API key must start with gm_");
+    }
+    this.domains = new DomainsResource(this);
+    this.emails = new EmailsResource(this);
+    this.receivedEmails = new ReceivedEmailsResource(this);
+    this.events = new EventsResource(this);
+    this.automations = new AutomationsResource(this);
+    this.webhooks = new WebhooksResource(this);
+    this.integrations = new IntegrationsResource(this);
+    this.apiKeys = new KeysResource(this);
+    this.smtpCredentials = new SmtpCredentialsResource(this);
+    this.suppressions = new SuppressionsResource(this);
+    this.templates = new TemplatesResource(this);
+  }
+  get baseUrl() {
+    return (this.options.baseUrl || DEFAULT_API_BASE_URL).replace(/\/$/, "");
+  }
+  get fetchImpl() {
+    return this.options.fetch || fetch;
+  }
+  async request(path, init) {
+    const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+      ...init,
+      headers: {
+        Authorization: `Bearer ${this.apiKey}`,
+        "Content-Type": "application/json",
+        ...init.headers || {}
+      }
+    });
+    const body = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      throw GroundmailError.fromResponse(response.status, body);
+    }
+    return body;
+  }
+};
+
+export {
+  GroundmailError,
+  mergeSpfInclude,
+  applyDnsRecords,
+  signWebhookPayload,
+  buildSignatureHeader,
+  verifyWebhookSignature,
+  DEFAULT_API_BASE_URL,
+  Groundmail
+};