Add naia.today pages template

[arielvdl]

Description

Adds the Domain Connect template for naia Pages (https://naia.today), a Generative Engine Optimization platform. naia Pages publishes customer content on a brand subdomain; this template sets up the CNAME needed to point that subdomain at the naia Pages host, plus a second CNAME (_acme-challenge) that authorizes issuance of the managed TLS certificate (Google Certificate Manager DNS-01 authorization).

• providerId: naia.today
• serviceId: pages
• hostRequired: true, sync flow only, requests signed RS256, public key published at _dcpubkeyv1.naia.today
• Both CNAME records carry "essential": "OnApply" so a manual edit by the domain owner (DNS provider migration, typo fix, etc.) on either record is not treated as a conflict that removes the whole template. This matters most for _acme-challenge, which needs to keep existing for certificate renewal. Follows the pattern of the existing advancedsending.com.cname.json template in this repo.
• syncRedirectDomain: naia.today. No apex records.

Type of change

Please mark options that are relevant.

• New template
• Bug fix (non-breaking change which fixes an issue in the template)
• New feature (non-breaking change which adds functionality to the template)
• Breaking change (fix or feature that would cause existing template behavior to be not backward compatible)

How Has This Been Tested?

Please mark the following checks done

• Template functionality checked using Online Editor
• Template file name follows the pattern <providerId>.<serviceId>.json
• resource URL provided with logoUrl is actually served by a webserver (https://cdn.naia.today/naia-logos/bimi/naia.svg returns HTTP 200, image/svg+xml)

Checklist of common problems

Mark all the checkboxes after conducting the check. Comment on any point which is not fulfilled.
See Template Quality Guidelines for details and rationale on each rule.

• syncPubKeyDomain is set — this is mandatory; omitting it requires explicit justification in the PR description or the PR will be rejected
• warnPhishing is not set alongside syncPubKeyDomain — the two must not appear together
• syncRedirectDomain is set whenever the template uses redirect_uri in the synchronous flow — not used by this template; syncRedirectDomain: naia.today is set anyway (harmless)
• no TXT record contains SPF content ("v=spf1 ...") — use the SPFM record type instead — no TXT records in this template
• txtConflictMatchingMode is set on every TXT record that must be unique per label or content prefix (e.g. DMARC) — no TXT records in this template
• no variable is used as a bare full record value (e.g. @ TXT "%foo%") unless necessary — prefer @ TXT "service-foo=%foo%"; if bare, justify in the PR description — both records are CNAME pointsTo, not TXT; %target%/%acmetarget% are computed server-side by naia's signed apply request, never typed by the domain owner, same pattern as the existing advancedsending.com.cname.json template
• no bare variable is used as the full host label — the non-variable parts are fixed to limit misuse (e.g. %dkimkey%._domainkey, not %dkimhost%); if bare, justify in the PR description — both host fields are fixed literals (@, _acme-challenge), no variables in host
• no variable is used in the host field to create a subdomain — use the host parameter or multiInstance instead — the subdomain comes from the protocol's own host parameter via hostRequired: true
• %host% does not appear explicitly in any host attribute
• essential is set to OnApply on records the end user may need to modify or remove without breaking the template (e.g. DMARC) — set on both CNAME records

Online Editor test results

Editor test link(s):
Test naia.today/pages example.com/insights

Test performed: Check template (extended schema/consistency check, no errors), then Test apply template with Domain: example.com, Host: insights, target: demo.artefacto.naia.today, acmetarget: 11111111-2222-3333-4444-555555555555.authorize.certificatemanager.goog. (representative format matching what our backend generates via Google Certificate Manager's DnsAuthorization API). Result: both CNAME records applied correctly (insights.example.com. -> demo.artefacto.naia.today, _acme-challenge.insights.example.com. -> ...authorize.certificatemanager.goog.). Apex test not included, exempted by hostRequired: true per the instructions above.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01KsMFhRDrA3TtiBoqdT1JYZ

[github-actions]

✅ JSON Filename Check Passed

[github-actions]

✅ JSON Schema Validation Passed

[github-actions]

Linter OK

naia.today.pages.json

Level	Code	Note

[github-actions]

PR Description Check Passed

All required sections are filled in correctly.

Details

  OK  Type of change: 1/4 checkboxes ticked
  OK  How Has This Been Tested?: all 3 checkboxes ticked
  OK  Checklist of common problems: 10/10 checkboxes ticked
  OK  Online Editor test results: 1 link(s) found
  OK  Template coverage: all 1 template(s) covered
Labels to remove: Checklist of common problems not complete, Forged editor links, PR description incomplete, Test links missing

PR description check PASSED

[github-actions]

Thanks @arielvdl for contributing to the template. 🎉

This template has been reviewed and merged by @pawel-kow. 🙌

This template repository and its review process are maintained by independent individuals in their spare time, not as part of a paid role. If you or your company benefit from this protocol and its tools, please show your appreciation by buying a beer for @pawel-kow: https://github.com/sponsors/pawel-kow