<!-- source-hash: 571de537c275f3d8b2eefb0fa68e0454 -->
Defines and exports Zod validation schemas, type-safe option constants, and API response types for all contact-style forms across the Flamingo platform.

## Key Components

| Export | Type | Description |
|--------|------|-------------|
| `companySizeOptions` | `const` tuple | Allowed company size values for Select widgets |
| `referralSourceOptions` | `const` tuple | Allowed referral source values for Select widgets |
| `defaultHelpCategoryOptions` | `const` tuple | Fallback help category options when none are supplied by the embedder |
| `LinkedInUrlSchema` | `z.ZodSchema` | Reusable LinkedIn URL validator with hostname-exact matching (prevents substring injection) |
| `ContactBaseSchema` | `z.ZodObject` | Shared base schema for all contact-style forms (contact, TMCG join, data-room, etc.) |
| `ContactSchema` | `z.ZodObject` | Extends `ContactBaseSchema` with dropdown-constrained `companySize` and `referralSource` fields |
| `ContactFormData` | `type` | Inferred TypeScript type from `ContactSchema` |
| `ContactApiResponse` | `interface` | Shape of the `POST /api/contact` JSON response |

## Usage Example

```typescript
import {
  ContactSchema,
  ContactBaseSchema,
  LinkedInUrlSchema,
  type ContactFormData,
  defaultHelpCategoryOptions,
} from './contact-schema';

// Validate a generic contact form submission
const result = ContactSchema.safeParse(req.body);
if (!result.success) {
  return res.status(400).json({ error: result.error.flatten() });
}
const data: ContactFormData = result.data;

// Extend the base schema for a custom form
const JoinSchema = ContactBaseSchema.extend({
  companyName: z.string().min(2),
  linkedin_url: LinkedInUrlSchema,
});

// Use option constants in a Select component
<Select options={defaultHelpCategoryOptions} name="helpCategory" />
```

> **Note:** Always reference `LinkedInUrlSchema` directly rather than duplicating LinkedIn URL validation logic. Hostname-exact matching (`host === 'linkedin.com'` or `host.endsWith('.linkedin.com')`) is intentional — substring checks would accept adversarial inputs like `https://evil.com/linkedin.com/path`.