@ima-jin/config 0.7.0 → 0.8.0

package/dist/index.js

@@ -1,153 +1,8 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  HANDLE_ALLOWED_CHARS: () => HANDLE_ALLOWED_CHARS,
-  HANDLE_ERROR: () => HANDLE_ERROR,
-  HANDLE_INPUT_PATTERN: () => HANDLE_INPUT_PATTERN,
-  HANDLE_PATTERN: () => HANDLE_PATTERN,
-  RESERVED_HANDLES: () => RESERVED_HANDLES,
-  SERVICES: () => SERVICES,
-  SERVICE_NAMES: () => SERVICE_NAMES,
-  SESSION_COOKIE_NAME: () => SESSION_COOKIE_NAME,
-  apiFetch: () => apiFetch,
-  apiUrl: () => apiUrl,
-  articleAuthorPath: () => articleAuthorPath,
-  articlePath: () => articlePath,
-  articlesPath: () => articlesPath,
-  authAgentsPath: () => authAgentsPath,
-  authAppsPath: () => authAppsPath,
-  authAttestationsPath: () => authAttestationsPath,
-  authAuthorizePath: () => authAuthorizePath,
-  authDeveloperAppPath: () => authDeveloperAppPath,
-  authDeveloperAppsPath: () => authDeveloperAppsPath,
-  authGroupSettingsPath: () => authGroupSettingsPath,
-  authGroupsPath: () => authGroupsPath,
-  authLoginPath: () => authLoginPath,
-  authMembersPath: () => authMembersPath,
-  authNewGroupPath: () => authNewGroupPath,
-  authNewStubPath: () => authNewStubPath,
-  authNotificationsPath: () => authNotificationsPath,
-  authOnboardPath: () => authOnboardPath,
-  authRegisterPath: () => authRegisterPath,
-  authSecurityPath: () => authSecurityPath,
-  authSettingsPath: () => authSettingsPath,
-  authStubsPath: () => authStubsPath,
-  bugsAdminPath: () => bugsAdminPath,
-  bugsPath: () => bugsPath,
-  buildPath: () => buildPath,
-  buildPublicUrl: () => buildPublicUrl,
-  buildServiceUrlMap: () => buildServiceUrlMap,
-  bumpPath: () => bumpPath,
-  chatConversationPath: () => chatConversationPath,
-  chatConversationsPath: () => chatConversationsPath,
-  chatPath: () => chatPath,
-  coffeeDashboardPath: () => coffeeDashboardPath,
-  coffeeEditPath: () => coffeeEditPath,
-  coffeeHandlePath: () => coffeeHandlePath,
-  coffeeSuccessPath: () => coffeeSuccessPath,
-  connectionsInvitePath: () => connectionsInvitePath,
-  connectionsPath: () => connectionsPath,
-  connectionsPodPath: () => connectionsPodPath,
-  corsHeaders: () => corsHeaders,
-  corsOptions: () => corsOptions,
-  developerGuidePath: () => developerGuidePath,
-  docsPath: () => docsPath,
-  dykilCreatePath: () => dykilCreatePath,
-  dykilDashboardPath: () => dykilDashboardPath,
-  dykilEmbedPath: () => dykilEmbedPath,
-  dykilHandlePath: () => dykilHandlePath,
-  dykilResultsPath: () => dykilResultsPath,
-  dykilSurveyPath: () => dykilSurveyPath,
-  eventAdminPath: () => eventAdminPath,
-  eventCheckoutSuccessPath: () => eventCheckoutSuccessPath,
-  eventEditPath: () => eventEditPath,
-  eventEditUrl: () => eventEditUrl,
-  eventMyTicketsPath: () => eventMyTicketsPath,
-  eventMyTicketsUrl: () => eventMyTicketsUrl,
-  eventPath: () => eventPath,
-  eventRegisterPath: () => eventRegisterPath,
-  eventRegisterUrl: () => eventRegisterUrl,
-  eventUrl: () => eventUrl,
-  eventsAdminListPath: () => eventsAdminListPath,
-  eventsCheckoutSuccessPath: () => eventsCheckoutSuccessPath,
-  eventsCreatePath: () => eventsCreatePath,
-  eventsDashboardPath: () => eventsDashboardPath,
-  getPort: () => getPort,
-  getPublicUrl: () => getPublicUrl,
-  getService: () => getService,
-  getServiceUrl: () => getServiceUrl,
-  getSessionCookieName: () => getSessionCookieName,
-  getSessionCookieOptions: () => getSessionCookieOptions,
-  healthPath: () => healthPath,
-  isAllowedOrigin: () => isAllowedOrigin,
-  isReservedHandle: () => isReservedHandle,
-  isValidHandle: () => isValidHandle,
-  learnCourseDashboardPath: () => learnCourseDashboardPath,
-  learnCourseLessonPath: () => learnCourseLessonPath,
-  learnCoursePath: () => learnCoursePath,
-  learnCoursePresentPath: () => learnCoursePresentPath,
-  learnCourseStudentsPath: () => learnCourseStudentsPath,
-  learnDashboardPath: () => learnDashboardPath,
-  learnHandlePath: () => learnHandlePath,
-  linksDashboardPath: () => linksDashboardPath,
-  linksEditPath: () => linksEditPath,
-  linksHandlePath: () => linksHandlePath,
-  marketCheckoutSuccessPath: () => marketCheckoutSuccessPath,
-  marketDashboardPath: () => marketDashboardPath,
-  marketListingEditPath: () => marketListingEditPath,
-  marketListingPath: () => marketListingPath,
-  marketNewListingPath: () => marketNewListingPath,
-  marketSellerPath: () => marketSellerPath,
-  marketSettingsPath: () => marketSettingsPath,
-  mediaPath: () => mediaPath,
-  normalizeHandleInput: () => normalizeHandleInput,
-  notifyPath: () => notifyPath,
-  notifySettingsPath: () => notifySettingsPath,
-  payHistoryPath: () => payHistoryPath,
-  payPath: () => payPath,
-  payPayoutsPath: () => payPayoutsPath,
-  payTopupPath: () => payTopupPath,
-  payTopupSuccessPath: () => payTopupSuccessPath,
-  privacyPath: () => privacyPath,
-  profileEditPath: () => profileEditPath,
-  profileLoginPath: () => profileLoginPath,
-  profilePath: () => profilePath,
-  profileRegisterPath: () => profileRegisterPath,
-  profileUrl: () => profileUrl,
-  projectPath: () => projectPath,
-  registryDocsPath: () => registryDocsPath,
-  registryPath: () => registryPath,
-  servicesByTier: () => servicesByTier,
-  servicesByVisibility: () => servicesByVisibility,
-  subscribePath: () => subscribePath,
-  validateOrigin: () => validateOrigin,
-  whitepaperPath: () => whitepaperPath,
-  withCors: () => withCors
-});
-module.exports = __toCommonJS(index_exports);
-
 // src/cors.ts
-var import_server = require("next/server");
+import { NextResponse } from "next/server";
 var ORIGIN_PATTERN = /^https:\/\/(dev-)?[a-z-]+\.imajin\.ai$/;
 var LOCAL_PATTERN = /^http:\/\/localhost:\d+$/;
+var ALLOWED_FRAME_ORIGINS = "https://*.imajin.ai https://imajin.ai";
 function isAllowedOrigin(origin) {
   if (!origin) return false;
   if (ORIGIN_PATTERN.test(origin)) return true;
@@ -166,7 +21,7 @@ function corsHeaders(request) {
   };
 }
 function corsOptions(request) {
-  return new import_server.NextResponse(null, { status: 204, headers: corsHeaders(request) });
+  return new NextResponse(null, { status: 204, headers: corsHeaders(request) });
 }
 function withCors(response, request) {
   const headers = corsHeaders(request);
@@ -181,6 +36,27 @@ function validateOrigin(request) {
   return isAllowedOrigin(origin);
 }
 
+// src/security-headers.ts
+function buildFrameAncestors() {
+  const local = process.env.NODE_ENV !== "production" ? " http://localhost:*" : "";
+  return `frame-ancestors 'self' ${ALLOWED_FRAME_ORIGINS}${local}`;
+}
+function tier1Headers() {
+  return [
+    { key: "Content-Security-Policy", value: "frame-ancestors 'none'" },
+    { key: "X-Frame-Options", value: "DENY" }
+  ];
+}
+function tier2Headers() {
+  return [{ key: "Content-Security-Policy", value: buildFrameAncestors() }];
+}
+function tier3Headers() {
+  return [
+    { key: "X-Content-Type-Options", value: "nosniff" },
+    { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" }
+  ];
+}
+
 // src/services.ts
 var SERVICES = [
   // Kernel services — individually visible, all run on the kernel process (port 3000/7000)
@@ -204,7 +80,9 @@ var SERVICES = [
   // Meta — project info and external resources surfaced in the launcher
   { name: "project", label: "Project", icon: "\u{1F4D6}", description: "Thesis, whitepaper, essays, RFCs", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", wwwPath: "/project" },
   { name: "github", label: "GitHub", icon: "\u{1F419}", description: "Source code", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", externalUrl: "https://github.com/ima-jin/imajin-ai" },
-  { name: "docs", label: "Docs", icon: "\u{1F4C4}", description: "API documentation", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", wwwPath: "/developer-guide" }
+  { name: "docs", label: "Docs", icon: "\u{1F4C4}", description: "API documentation", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", wwwPath: "/developer-guide" },
+  // Daemon processes — not web apps, no HTTP port exposed
+  { name: "broker-agent", label: "Broker Agent", icon: "\u{1F916}", description: "Telegram broker agent \u2014 conversational surface for social coordination (#1101)", devPort: 0, prodPort: 0, schema: null, tier: "core", visibility: "internal", category: "infrastructure" }
   // Connected apps (separate repos) will use the plugin architecture (#249).
   // Not included here — they authenticate via delegated sessions, not the monorepo manifest.
 ];
@@ -213,7 +91,8 @@ function getService(name) {
 }
 function getPort(name, env = "dev") {
   const svc = getService(name);
-  return svc ? env === "prod" ? svc.prodPort : svc.devPort : void 0;
+  if (!svc) return void 0;
+  return env === "prod" ? svc.prodPort : svc.devPort;
 }
 function getServiceUrl(name, env = "dev") {
   const port = getPort(name, env);
@@ -221,18 +100,18 @@ function getServiceUrl(name, env = "dev") {
 }
 function getPublicUrl(name, options) {
   const svc = SERVICES.find((s) => s.name === name);
-  if (svc == null ? void 0 : svc.externalUrl) return svc.externalUrl;
-  const domain = (options == null ? void 0 : options.domain) || "imajin.ai";
-  const prefix = options == null ? void 0 : options.prefix;
-  if (svc == null ? void 0 : svc.wwwPath) {
+  if (svc?.externalUrl) return svc.externalUrl;
+  const domain = options?.domain || "imajin.ai";
+  const prefix = options?.prefix;
+  if (svc?.wwwPath) {
     const wwwUrl = getPublicUrl("www", options);
     return `${wwwUrl}${svc.wwwPath}`;
   }
-  if (domain.includes("localhost") || (prefix == null ? void 0 : prefix.includes("localhost"))) {
+  if (domain.includes("localhost") || prefix?.includes("localhost")) {
     const port = getPort(name, "dev");
     return port ? `http://localhost:${port}` : `http://localhost:3000`;
   }
-  if (prefix && prefix.includes(".")) {
+  if (prefix?.includes(".")) {
     const base = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
     if (name === "www" || name === "kernel") return `https://${base}`;
     return `https://${base}/${name}`;
@@ -246,8 +125,8 @@ function buildPublicUrl(name, servicePrefix, domain) {
     const explicit = process.env[envKey];
     if (explicit) return explicit;
   }
-  const p = servicePrefix ?? (typeof process !== "undefined" ? process.env.NEXT_PUBLIC_SERVICE_PREFIX : void 0) ?? "https://";
-  const d = domain ?? (typeof process !== "undefined" ? process.env.NEXT_PUBLIC_DOMAIN : void 0) ?? "imajin.ai";
+  const p = servicePrefix ?? (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_SERVICE_PREFIX) ?? "https://";
+  const d = domain ?? (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_DOMAIN) ?? "imajin.ai";
   if (p.includes("localhost") || d.includes("localhost")) {
     const port = getPort(name, "dev");
     return port ? `http://localhost:${port}` : `http://localhost:3000`;
@@ -258,6 +137,20 @@ function buildPublicUrl(name, servicePrefix, domain) {
   const match = p.replace(/^https?:\/\//, "").replace(/-$/, "") || void 0;
   return getPublicUrl(name, { prefix: match, domain: d });
 }
+function buildPublicUrlAbsolute(name) {
+  if (typeof process !== "undefined") {
+    const explicit = process.env[`NEXT_PUBLIC_${name.toUpperCase()}_URL`];
+    if (explicit && /^https?:\/\//.test(explicit)) return explicit;
+  }
+  const prefix = (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_SERVICE_PREFIX) ?? "https://";
+  const domain = (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_DOMAIN) ?? "imajin.ai";
+  if (prefix.includes("localhost") || domain.includes("localhost")) {
+    const port = getPort(name, "dev");
+    return port ? `http://localhost:${port}` : "http://localhost:3000";
+  }
+  const match = prefix.replace(/^https?:\/\//, "").replace(/-$/, "") || void 0;
+  return getPublicUrl(name, { prefix: match, domain });
+}
 var SERVICE_NAMES = SERVICES.map((s) => s.name);
 function servicesByTier(tier) {
   return SERVICES.filter((s) => s.tier === tier);
@@ -319,10 +212,45 @@ function apiFetch(path, init) {
   return fetch(apiUrl(path), init);
 }
 
+// src/rate-limit.ts
+var store = /* @__PURE__ */ new Map();
+var lastGlobalCleanup = Date.now();
+function pruneStore(now) {
+  if (now - lastGlobalCleanup < 6e4) return;
+  store.forEach((entry, key) => {
+    if (now - entry.lastSeen > 12e4) {
+      store.delete(key);
+    }
+  });
+  lastGlobalCleanup = now;
+}
+function rateLimit(key, limit, windowMs) {
+  const now = Date.now();
+  pruneStore(now);
+  const windowStart = now - windowMs;
+  const entry = store.get(key) ?? { timestamps: [], lastSeen: now };
+  entry.timestamps = entry.timestamps.filter((t) => t > windowStart);
+  entry.lastSeen = now;
+  if (entry.timestamps.length >= limit) {
+    const oldest = entry.timestamps[0];
+    const retryAfter = Math.ceil((oldest + windowMs - now) / 1e3);
+    store.set(key, entry);
+    return { limited: true, retryAfter: Math.max(1, retryAfter) };
+  }
+  entry.timestamps.push(now);
+  store.set(key, entry);
+  return { limited: false, retryAfter: 0 };
+}
+function getClientIP(request) {
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) return forwarded.split(",")[0].trim();
+  return "127.0.0.1";
+}
+
 // src/handles.ts
 var HANDLE_PATTERN = /^[a-z0-9._-]{3,30}$/;
-var HANDLE_EDGE = /^[.\-]|[.\-]$/;
-var HANDLE_CONSECUTIVE = /[.\-]{2}/;
+var HANDLE_EDGE = /^[.-]|[.-]$/;
+var HANDLE_CONSECUTIVE = /[.-]{2}/;
 var HANDLE_INPUT_PATTERN = "[a-z0-9._\\-]{3,30}";
 var HANDLE_ALLOWED_CHARS = /[^a-z0-9._-]/g;
 var RESERVED_HANDLES = /* @__PURE__ */ new Set([
@@ -466,8 +394,8 @@ var docsPath = () => `/docs`;
 var projectPath = () => `/project`;
 var notifyPath = () => `/notify`;
 var notifySettingsPath = () => `/notify/settings`;
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
+export {
+  ALLOWED_FRAME_ORIGINS,
   HANDLE_ALLOWED_CHARS,
   HANDLE_ERROR,
   HANDLE_INPUT_PATTERN,
@@ -503,6 +431,7 @@ var notifySettingsPath = () => `/notify/settings`;
   bugsPath,
   buildPath,
   buildPublicUrl,
+  buildPublicUrlAbsolute,
   buildServiceUrlMap,
   bumpPath,
   chatConversationPath,
@@ -539,6 +468,7 @@ var notifySettingsPath = () => `/notify/settings`;
   eventsCheckoutSuccessPath,
   eventsCreatePath,
   eventsDashboardPath,
+  getClientIP,
   getPort,
   getPublicUrl,
   getService,
@@ -582,12 +512,16 @@ var notifySettingsPath = () => `/notify/settings`;
   profileRegisterPath,
   profileUrl,
   projectPath,
+  rateLimit,
   registryDocsPath,
   registryPath,
   servicesByTier,
   servicesByVisibility,
   subscribePath,
+  tier1Headers,
+  tier2Headers,
+  tier3Headers,
   validateOrigin,
   whitepaperPath,
   withCors
-});
+};

package/next-headers.cjs

@@ -0,0 +1,57 @@
+'use strict';
+
+/**
+ * Security-header helpers for next.config.js (CommonJS bridge).
+ *
+ * The frame-ancestors value is derived from ALLOWED_FRAME_ORIGINS in src/cors.ts
+ * and the localhost dev behaviour mirrors isAllowedOrigin() in the same file.
+ * If the allowed-origin set changes, update src/cors.ts (ORIGIN_PATTERN +
+ * ALLOWED_FRAME_ORIGINS) and the constant below together.
+ */
+
+// Mirrors ALLOWED_FRAME_ORIGINS in src/cors.ts
+const ALLOWED_FRAME_ORIGINS = 'https://*.imajin.ai https://imajin.ai';
+
+/**
+ * Build the frame-ancestors directive value.
+ * Adds localhost:* in non-prod, mirroring isAllowedOrigin().
+ */
+function buildFrameAncestors() {
+  const local = process.env.NODE_ENV !== 'production' ? ' http://localhost:*' : '';
+  return `frame-ancestors 'self' ${ALLOWED_FRAME_ORIGINS}${local}`;
+}
+
+/**
+ * Tier 1 — hard deny framing.
+ * Use on credential and auth-sensitive pages that must never be embedded.
+ * @returns {Array<{key: string, value: string}>}
+ */
+function tier1Headers() {
+  return [
+    { key: 'Content-Security-Policy', value: "frame-ancestors 'none'" },
+    { key: 'X-Frame-Options', value: 'DENY' },
+  ];
+}
+
+/**
+ * Tier 2 — allow framing by Imajin origins only.
+ * Use on routes embedded by the auth hub (service dashboards, document viewer, surveys).
+ * Intentionally omits X-Frame-Options — it cannot express an allow-list.
+ * @returns {Array<{key: string, value: string}>}
+ */
+function tier2Headers() {
+  return [{ key: 'Content-Security-Policy', value: buildFrameAncestors() }];
+}
+
+/**
+ * Tier 3 — baseline hardening. Safe to apply on every route in every app.
+ * @returns {Array<{key: string, value: string}>}
+ */
+function tier3Headers() {
+  return [
+    { key: 'X-Content-Type-Options', value: 'nosniff' },
+    { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+  ];
+}
+
+module.exports = { tier1Headers, tier2Headers, tier3Headers };

package/package.json

@@ -1,21 +1,31 @@
 {
   "name": "@ima-jin/config",
-  "version": "0.7.0",
+  "version": "0.8.0",
+  "description": "Shared configuration for Imajin services — CORS, service routing, session config, handle validation, and route helpers",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ima-jin/imajin-ai.git",
+    "directory": "packages/config"
+  },
+  "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "import": "./dist/index.mjs",
-      "require": "./dist/index.js",
-      "types": "./dist/index.d.ts"
-    }
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./next-headers": "./next-headers.cjs"
   },
   "files": [
     "dist/",
-    "src/"
+    "src/",
+    "next-headers.cjs"
   ],
   "dependencies": {
-    "@ima-jin/tokens": "^0.6.1"
+    "@ima-jin/tokens": "^0.8.0"
   },
   "peerDependencies": {
     "next": ">=14"

package/src/base-path.ts

@@ -4,20 +4,20 @@
  * Next.js `basePath` auto-prefixes <Link> and router.push() but NOT:
  *   - fetch() calls
  *   - <a href=""> tags
- *   - window.location assignments
+ *   - globalThis.location assignments
  *
  * These utilities read NEXT_PUBLIC_BASE_PATH (set automatically by Next.js
  * when basePath is configured) and prepend it where needed.
  *
  * Usage:
- *   import { apiFetch, apiUrl } from '@imajin/config';
+ *   import { apiFetch, apiUrl } from '@ima-jin/config';
  *
  *   // Instead of: fetch('/api/listings')
  *   apiFetch('/api/listings')
  *
- *   // For <a> tags or window.location:
+ *   // For <a> tags or globalThis.location:
  *   <a href={apiUrl('/dashboard')}>Dashboard</a>
- *   window.location.href = apiUrl('/dashboard');
+ *   globalThis.location.href = apiUrl('/dashboard');
  */
 
 /**

package/src/cors.ts

@@ -4,6 +4,13 @@ import { NextRequest, NextResponse } from "next/server";
 const ORIGIN_PATTERN = /^https:\/\/(dev-)?[a-z-]+\.imajin\.ai$/;
 const LOCAL_PATTERN = /^http:\/\/localhost:\d+$/;
 
+/**
+ * CSP host-source list corresponding to ORIGIN_PATTERN (prod).
+ * Used by security-headers.ts to build frame-ancestors directives.
+ * If the allowed-origin set changes, update ORIGIN_PATTERN and this constant together.
+ */
+export const ALLOWED_FRAME_ORIGINS = 'https://*.imajin.ai https://imajin.ai';
+
 export function isAllowedOrigin(origin: string | null): boolean {
   if (!origin) return false;
   if (ORIGIN_PATTERN.test(origin)) return true;

package/src/handles.ts

@@ -10,10 +10,10 @@
 export const HANDLE_PATTERN = /^[a-z0-9._-]{3,30}$/;
 
 /** Regex: disallowed leading/trailing characters */
-const HANDLE_EDGE = /^[.\-]|[.\-]$/;
+const HANDLE_EDGE = /^[.-]|[.-]$/;
 
 /** Regex: consecutive dots or hyphens */
-const HANDLE_CONSECUTIVE = /[.\-]{2}/;
+const HANDLE_CONSECUTIVE = /[.-]{2}/;
 
 /** HTML input pattern attribute (no anchors, no flags) */
 export const HANDLE_INPUT_PATTERN = '[a-z0-9._\\-]{3,30}';

package/src/index.ts

@@ -1,4 +1,5 @@
-export { isAllowedOrigin, corsHeaders, corsOptions, withCors, validateOrigin } from "./cors";
+export { isAllowedOrigin, corsHeaders, corsOptions, withCors, validateOrigin, ALLOWED_FRAME_ORIGINS } from "./cors";
+export { tier1Headers, tier2Headers, tier3Headers } from './security-headers';
 
 export {
   SERVICES,
@@ -8,6 +9,7 @@ export {
   getServiceUrl,
   getPublicUrl,
   buildPublicUrl,
+  buildPublicUrlAbsolute,
   servicesByTier,
   servicesByVisibility,
   buildServiceUrlMap,
@@ -27,6 +29,8 @@ export {
 
 export { apiFetch, apiUrl } from "./base-path";
 
+export { rateLimit, getClientIP } from "./rate-limit";
+
 export {
   HANDLE_PATTERN,
   HANDLE_INPUT_PATTERN,

package/src/rate-limit.ts

@@ -0,0 +1,54 @@
+/**
+ * Simple sliding-window in-memory rate limiter.
+ * Safe for single-process Next.js. Per-worker in multi-worker setups (acceptable).
+ */
+
+interface RateLimitEntry {
+  timestamps: number[];
+  lastSeen: number;
+}
+
+const store = new Map<string, RateLimitEntry>();
+let lastGlobalCleanup = Date.now();
+
+function pruneStore(now: number) {
+  if (now - lastGlobalCleanup < 60_000) return;
+  store.forEach((entry, key) => {
+    if (now - entry.lastSeen > 120_000) {
+      store.delete(key);
+    }
+  });
+  lastGlobalCleanup = now;
+}
+
+export function rateLimit(
+  key: string,
+  limit: number,
+  windowMs: number
+): { limited: boolean; retryAfter: number } {
+  const now = Date.now();
+  pruneStore(now);
+
+  const windowStart = now - windowMs;
+  const entry = store.get(key) ?? { timestamps: [], lastSeen: now };
+
+  entry.timestamps = entry.timestamps.filter((t) => t > windowStart);
+  entry.lastSeen = now;
+
+  if (entry.timestamps.length >= limit) {
+    const oldest = entry.timestamps[0];
+    const retryAfter = Math.ceil((oldest + windowMs - now) / 1000);
+    store.set(key, entry);
+    return { limited: true, retryAfter: Math.max(1, retryAfter) };
+  }
+
+  entry.timestamps.push(now);
+  store.set(key, entry);
+  return { limited: false, retryAfter: 0 };
+}
+
+export function getClientIP(request: Request): string {
+  const forwarded = request.headers.get('x-forwarded-for');
+  if (forwarded) return forwarded.split(',')[0].trim();
+  return '127.0.0.1';
+}

package/src/security-headers.ts

@@ -0,0 +1,45 @@
+import { ALLOWED_FRAME_ORIGINS } from './cors';
+
+type HeaderEntry = { key: string; value: string };
+
+/**
+ * Build the frame-ancestors directive value.
+ * Mirrors isAllowedOrigin(): includes localhost:* in non-prod so local
+ * hub-iframe development works without disabling frame protection.
+ */
+function buildFrameAncestors(): string {
+  const local = process.env.NODE_ENV !== 'production' ? ' http://localhost:*' : '';
+  return `frame-ancestors 'self' ${ALLOWED_FRAME_ORIGINS}${local}`;
+}
+
+/**
+ * Tier 1 — hard deny framing.
+ * Use on credential and auth-sensitive pages that must never be embedded.
+ */
+export function tier1Headers(): HeaderEntry[] {
+  return [
+    { key: 'Content-Security-Policy', value: "frame-ancestors 'none'" },
+    { key: 'X-Frame-Options', value: 'DENY' },
+  ];
+}
+
+/**
+ * Tier 2 — allow framing by Imajin origins only.
+ * Use on routes embedded by the auth hub (service dashboards, document viewer, surveys).
+ * Does not include X-Frame-Options — it cannot express an allow-list, and SAMEORIGIN
+ * would break cross-subdomain framing. CSP frame-ancestors does the work here.
+ */
+export function tier2Headers(): HeaderEntry[] {
+  return [{ key: 'Content-Security-Policy', value: buildFrameAncestors() }];
+}
+
+/**
+ * Tier 3 — baseline hardening.
+ * Safe to apply on every route in every app.
+ */
+export function tier3Headers(): HeaderEntry[] {
+  return [
+    { key: 'X-Content-Type-Options', value: 'nosniff' },
+    { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+  ];
+}