@ima-jin/config 0.7.0 → 0.8.0

package/dist/{index.mjs → index.cjs}

@@ -1,7 +1,162 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ALLOWED_FRAME_ORIGINS: () => ALLOWED_FRAME_ORIGINS,
+  HANDLE_ALLOWED_CHARS: () => HANDLE_ALLOWED_CHARS,
+  HANDLE_ERROR: () => HANDLE_ERROR,
+  HANDLE_INPUT_PATTERN: () => HANDLE_INPUT_PATTERN,
+  HANDLE_PATTERN: () => HANDLE_PATTERN,
+  RESERVED_HANDLES: () => RESERVED_HANDLES,
+  SERVICES: () => SERVICES,
+  SERVICE_NAMES: () => SERVICE_NAMES,
+  SESSION_COOKIE_NAME: () => SESSION_COOKIE_NAME,
+  apiFetch: () => apiFetch,
+  apiUrl: () => apiUrl,
+  articleAuthorPath: () => articleAuthorPath,
+  articlePath: () => articlePath,
+  articlesPath: () => articlesPath,
+  authAgentsPath: () => authAgentsPath,
+  authAppsPath: () => authAppsPath,
+  authAttestationsPath: () => authAttestationsPath,
+  authAuthorizePath: () => authAuthorizePath,
+  authDeveloperAppPath: () => authDeveloperAppPath,
+  authDeveloperAppsPath: () => authDeveloperAppsPath,
+  authGroupSettingsPath: () => authGroupSettingsPath,
+  authGroupsPath: () => authGroupsPath,
+  authLoginPath: () => authLoginPath,
+  authMembersPath: () => authMembersPath,
+  authNewGroupPath: () => authNewGroupPath,
+  authNewStubPath: () => authNewStubPath,
+  authNotificationsPath: () => authNotificationsPath,
+  authOnboardPath: () => authOnboardPath,
+  authRegisterPath: () => authRegisterPath,
+  authSecurityPath: () => authSecurityPath,
+  authSettingsPath: () => authSettingsPath,
+  authStubsPath: () => authStubsPath,
+  bugsAdminPath: () => bugsAdminPath,
+  bugsPath: () => bugsPath,
+  buildPath: () => buildPath,
+  buildPublicUrl: () => buildPublicUrl,
+  buildPublicUrlAbsolute: () => buildPublicUrlAbsolute,
+  buildServiceUrlMap: () => buildServiceUrlMap,
+  bumpPath: () => bumpPath,
+  chatConversationPath: () => chatConversationPath,
+  chatConversationsPath: () => chatConversationsPath,
+  chatPath: () => chatPath,
+  coffeeDashboardPath: () => coffeeDashboardPath,
+  coffeeEditPath: () => coffeeEditPath,
+  coffeeHandlePath: () => coffeeHandlePath,
+  coffeeSuccessPath: () => coffeeSuccessPath,
+  connectionsInvitePath: () => connectionsInvitePath,
+  connectionsPath: () => connectionsPath,
+  connectionsPodPath: () => connectionsPodPath,
+  corsHeaders: () => corsHeaders,
+  corsOptions: () => corsOptions,
+  developerGuidePath: () => developerGuidePath,
+  docsPath: () => docsPath,
+  dykilCreatePath: () => dykilCreatePath,
+  dykilDashboardPath: () => dykilDashboardPath,
+  dykilEmbedPath: () => dykilEmbedPath,
+  dykilHandlePath: () => dykilHandlePath,
+  dykilResultsPath: () => dykilResultsPath,
+  dykilSurveyPath: () => dykilSurveyPath,
+  eventAdminPath: () => eventAdminPath,
+  eventCheckoutSuccessPath: () => eventCheckoutSuccessPath,
+  eventEditPath: () => eventEditPath,
+  eventEditUrl: () => eventEditUrl,
+  eventMyTicketsPath: () => eventMyTicketsPath,
+  eventMyTicketsUrl: () => eventMyTicketsUrl,
+  eventPath: () => eventPath,
+  eventRegisterPath: () => eventRegisterPath,
+  eventRegisterUrl: () => eventRegisterUrl,
+  eventUrl: () => eventUrl,
+  eventsAdminListPath: () => eventsAdminListPath,
+  eventsCheckoutSuccessPath: () => eventsCheckoutSuccessPath,
+  eventsCreatePath: () => eventsCreatePath,
+  eventsDashboardPath: () => eventsDashboardPath,
+  getClientIP: () => getClientIP,
+  getPort: () => getPort,
+  getPublicUrl: () => getPublicUrl,
+  getService: () => getService,
+  getServiceUrl: () => getServiceUrl,
+  getSessionCookieName: () => getSessionCookieName,
+  getSessionCookieOptions: () => getSessionCookieOptions,
+  healthPath: () => healthPath,
+  isAllowedOrigin: () => isAllowedOrigin,
+  isReservedHandle: () => isReservedHandle,
+  isValidHandle: () => isValidHandle,
+  learnCourseDashboardPath: () => learnCourseDashboardPath,
+  learnCourseLessonPath: () => learnCourseLessonPath,
+  learnCoursePath: () => learnCoursePath,
+  learnCoursePresentPath: () => learnCoursePresentPath,
+  learnCourseStudentsPath: () => learnCourseStudentsPath,
+  learnDashboardPath: () => learnDashboardPath,
+  learnHandlePath: () => learnHandlePath,
+  linksDashboardPath: () => linksDashboardPath,
+  linksEditPath: () => linksEditPath,
+  linksHandlePath: () => linksHandlePath,
+  marketCheckoutSuccessPath: () => marketCheckoutSuccessPath,
+  marketDashboardPath: () => marketDashboardPath,
+  marketListingEditPath: () => marketListingEditPath,
+  marketListingPath: () => marketListingPath,
+  marketNewListingPath: () => marketNewListingPath,
+  marketSellerPath: () => marketSellerPath,
+  marketSettingsPath: () => marketSettingsPath,
+  mediaPath: () => mediaPath,
+  normalizeHandleInput: () => normalizeHandleInput,
+  notifyPath: () => notifyPath,
+  notifySettingsPath: () => notifySettingsPath,
+  payHistoryPath: () => payHistoryPath,
+  payPath: () => payPath,
+  payPayoutsPath: () => payPayoutsPath,
+  payTopupPath: () => payTopupPath,
+  payTopupSuccessPath: () => payTopupSuccessPath,
+  privacyPath: () => privacyPath,
+  profileEditPath: () => profileEditPath,
+  profileLoginPath: () => profileLoginPath,
+  profilePath: () => profilePath,
+  profileRegisterPath: () => profileRegisterPath,
+  profileUrl: () => profileUrl,
+  projectPath: () => projectPath,
+  rateLimit: () => rateLimit,
+  registryDocsPath: () => registryDocsPath,
+  registryPath: () => registryPath,
+  servicesByTier: () => servicesByTier,
+  servicesByVisibility: () => servicesByVisibility,
+  subscribePath: () => subscribePath,
+  tier1Headers: () => tier1Headers,
+  tier2Headers: () => tier2Headers,
+  tier3Headers: () => tier3Headers,
+  validateOrigin: () => validateOrigin,
+  whitepaperPath: () => whitepaperPath,
+  withCors: () => withCors
+});
+module.exports = __toCommonJS(index_exports);
+
 // src/cors.ts
-import { NextResponse } from "next/server";
+var import_server = require("next/server");
 var ORIGIN_PATTERN = /^https:\/\/(dev-)?[a-z-]+\.imajin\.ai$/;
 var LOCAL_PATTERN = /^http:\/\/localhost:\d+$/;
+var ALLOWED_FRAME_ORIGINS = "https://*.imajin.ai https://imajin.ai";
 function isAllowedOrigin(origin) {
   if (!origin) return false;
   if (ORIGIN_PATTERN.test(origin)) return true;
@@ -20,7 +175,7 @@ function corsHeaders(request) {
   };
 }
 function corsOptions(request) {
-  return new NextResponse(null, { status: 204, headers: corsHeaders(request) });
+  return new import_server.NextResponse(null, { status: 204, headers: corsHeaders(request) });
 }
 function withCors(response, request) {
   const headers = corsHeaders(request);
@@ -35,6 +190,27 @@ function validateOrigin(request) {
   return isAllowedOrigin(origin);
 }
 
+// src/security-headers.ts
+function buildFrameAncestors() {
+  const local = process.env.NODE_ENV !== "production" ? " http://localhost:*" : "";
+  return `frame-ancestors 'self' ${ALLOWED_FRAME_ORIGINS}${local}`;
+}
+function tier1Headers() {
+  return [
+    { key: "Content-Security-Policy", value: "frame-ancestors 'none'" },
+    { key: "X-Frame-Options", value: "DENY" }
+  ];
+}
+function tier2Headers() {
+  return [{ key: "Content-Security-Policy", value: buildFrameAncestors() }];
+}
+function tier3Headers() {
+  return [
+    { key: "X-Content-Type-Options", value: "nosniff" },
+    { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" }
+  ];
+}
+
 // src/services.ts
 var SERVICES = [
   // Kernel services — individually visible, all run on the kernel process (port 3000/7000)
@@ -58,7 +234,9 @@ var SERVICES = [
   // Meta — project info and external resources surfaced in the launcher
   { name: "project", label: "Project", icon: "\u{1F4D6}", description: "Thesis, whitepaper, essays, RFCs", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", wwwPath: "/project" },
   { name: "github", label: "GitHub", icon: "\u{1F419}", description: "Source code", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", externalUrl: "https://github.com/ima-jin/imajin-ai" },
-  { name: "docs", label: "Docs", icon: "\u{1F4C4}", description: "API documentation", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", wwwPath: "/developer-guide" }
+  { name: "docs", label: "Docs", icon: "\u{1F4C4}", description: "API documentation", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", wwwPath: "/developer-guide" },
+  // Daemon processes — not web apps, no HTTP port exposed
+  { name: "broker-agent", label: "Broker Agent", icon: "\u{1F916}", description: "Telegram broker agent \u2014 conversational surface for social coordination (#1101)", devPort: 0, prodPort: 0, schema: null, tier: "core", visibility: "internal", category: "infrastructure" }
   // Connected apps (separate repos) will use the plugin architecture (#249).
   // Not included here — they authenticate via delegated sessions, not the monorepo manifest.
 ];
@@ -67,7 +245,8 @@ function getService(name) {
 }
 function getPort(name, env = "dev") {
   const svc = getService(name);
-  return svc ? env === "prod" ? svc.prodPort : svc.devPort : void 0;
+  if (!svc) return void 0;
+  return env === "prod" ? svc.prodPort : svc.devPort;
 }
 function getServiceUrl(name, env = "dev") {
   const port = getPort(name, env);
@@ -75,18 +254,18 @@ function getServiceUrl(name, env = "dev") {
 }
 function getPublicUrl(name, options) {
   const svc = SERVICES.find((s) => s.name === name);
-  if (svc == null ? void 0 : svc.externalUrl) return svc.externalUrl;
-  const domain = (options == null ? void 0 : options.domain) || "imajin.ai";
-  const prefix = options == null ? void 0 : options.prefix;
-  if (svc == null ? void 0 : svc.wwwPath) {
+  if (svc?.externalUrl) return svc.externalUrl;
+  const domain = options?.domain || "imajin.ai";
+  const prefix = options?.prefix;
+  if (svc?.wwwPath) {
     const wwwUrl = getPublicUrl("www", options);
     return `${wwwUrl}${svc.wwwPath}`;
   }
-  if (domain.includes("localhost") || (prefix == null ? void 0 : prefix.includes("localhost"))) {
+  if (domain.includes("localhost") || prefix?.includes("localhost")) {
     const port = getPort(name, "dev");
     return port ? `http://localhost:${port}` : `http://localhost:3000`;
   }
-  if (prefix && prefix.includes(".")) {
+  if (prefix?.includes(".")) {
     const base = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
     if (name === "www" || name === "kernel") return `https://${base}`;
     return `https://${base}/${name}`;
@@ -100,8 +279,8 @@ function buildPublicUrl(name, servicePrefix, domain) {
     const explicit = process.env[envKey];
     if (explicit) return explicit;
   }
-  const p = servicePrefix ?? (typeof process !== "undefined" ? process.env.NEXT_PUBLIC_SERVICE_PREFIX : void 0) ?? "https://";
-  const d = domain ?? (typeof process !== "undefined" ? process.env.NEXT_PUBLIC_DOMAIN : void 0) ?? "imajin.ai";
+  const p = servicePrefix ?? (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_SERVICE_PREFIX) ?? "https://";
+  const d = domain ?? (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_DOMAIN) ?? "imajin.ai";
   if (p.includes("localhost") || d.includes("localhost")) {
     const port = getPort(name, "dev");
     return port ? `http://localhost:${port}` : `http://localhost:3000`;
@@ -112,6 +291,20 @@ function buildPublicUrl(name, servicePrefix, domain) {
   const match = p.replace(/^https?:\/\//, "").replace(/-$/, "") || void 0;
   return getPublicUrl(name, { prefix: match, domain: d });
 }
+function buildPublicUrlAbsolute(name) {
+  if (typeof process !== "undefined") {
+    const explicit = process.env[`NEXT_PUBLIC_${name.toUpperCase()}_URL`];
+    if (explicit && /^https?:\/\//.test(explicit)) return explicit;
+  }
+  const prefix = (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_SERVICE_PREFIX) ?? "https://";
+  const domain = (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_DOMAIN) ?? "imajin.ai";
+  if (prefix.includes("localhost") || domain.includes("localhost")) {
+    const port = getPort(name, "dev");
+    return port ? `http://localhost:${port}` : "http://localhost:3000";
+  }
+  const match = prefix.replace(/^https?:\/\//, "").replace(/-$/, "") || void 0;
+  return getPublicUrl(name, { prefix: match, domain });
+}
 var SERVICE_NAMES = SERVICES.map((s) => s.name);
 function servicesByTier(tier) {
   return SERVICES.filter((s) => s.tier === tier);
@@ -173,10 +366,45 @@ function apiFetch(path, init) {
   return fetch(apiUrl(path), init);
 }
 
+// src/rate-limit.ts
+var store = /* @__PURE__ */ new Map();
+var lastGlobalCleanup = Date.now();
+function pruneStore(now) {
+  if (now - lastGlobalCleanup < 6e4) return;
+  store.forEach((entry, key) => {
+    if (now - entry.lastSeen > 12e4) {
+      store.delete(key);
+    }
+  });
+  lastGlobalCleanup = now;
+}
+function rateLimit(key, limit, windowMs) {
+  const now = Date.now();
+  pruneStore(now);
+  const windowStart = now - windowMs;
+  const entry = store.get(key) ?? { timestamps: [], lastSeen: now };
+  entry.timestamps = entry.timestamps.filter((t) => t > windowStart);
+  entry.lastSeen = now;
+  if (entry.timestamps.length >= limit) {
+    const oldest = entry.timestamps[0];
+    const retryAfter = Math.ceil((oldest + windowMs - now) / 1e3);
+    store.set(key, entry);
+    return { limited: true, retryAfter: Math.max(1, retryAfter) };
+  }
+  entry.timestamps.push(now);
+  store.set(key, entry);
+  return { limited: false, retryAfter: 0 };
+}
+function getClientIP(request) {
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) return forwarded.split(",")[0].trim();
+  return "127.0.0.1";
+}
+
 // src/handles.ts
 var HANDLE_PATTERN = /^[a-z0-9._-]{3,30}$/;
-var HANDLE_EDGE = /^[.\-]|[.\-]$/;
-var HANDLE_CONSECUTIVE = /[.\-]{2}/;
+var HANDLE_EDGE = /^[.-]|[.-]$/;
+var HANDLE_CONSECUTIVE = /[.-]{2}/;
 var HANDLE_INPUT_PATTERN = "[a-z0-9._\\-]{3,30}";
 var HANDLE_ALLOWED_CHARS = /[^a-z0-9._-]/g;
 var RESERVED_HANDLES = /* @__PURE__ */ new Set([
@@ -320,7 +548,9 @@ var docsPath = () => `/docs`;
 var projectPath = () => `/project`;
 var notifyPath = () => `/notify`;
 var notifySettingsPath = () => `/notify/settings`;
-export {
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ALLOWED_FRAME_ORIGINS,
   HANDLE_ALLOWED_CHARS,
   HANDLE_ERROR,
   HANDLE_INPUT_PATTERN,
@@ -356,6 +586,7 @@ export {
   bugsPath,
   buildPath,
   buildPublicUrl,
+  buildPublicUrlAbsolute,
   buildServiceUrlMap,
   bumpPath,
   chatConversationPath,
@@ -392,6 +623,7 @@ export {
   eventsCheckoutSuccessPath,
   eventsCreatePath,
   eventsDashboardPath,
+  getClientIP,
   getPort,
   getPublicUrl,
   getService,
@@ -435,12 +667,16 @@ export {
   profileRegisterPath,
   profileUrl,
   projectPath,
+  rateLimit,
   registryDocsPath,
   registryPath,
   servicesByTier,
   servicesByVisibility,
   subscribePath,
+  tier1Headers,
+  tier2Headers,
+  tier3Headers,
   validateOrigin,
   whitepaperPath,
   withCors
-};
+});