@ima-jin/config 0.7.0 → 0.8.13

package/dist/{index.mjs → index.cjs}

@@ -1,7 +1,168 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ALLOWED_FRAME_ORIGINS: () => ALLOWED_FRAME_ORIGINS,
+  APP_DISPLAY_NAME: () => APP_DISPLAY_NAME,
+  HANDLE_ALLOWED_CHARS: () => HANDLE_ALLOWED_CHARS,
+  HANDLE_ERROR: () => HANDLE_ERROR,
+  HANDLE_INPUT_PATTERN: () => HANDLE_INPUT_PATTERN,
+  HANDLE_PATTERN: () => HANDLE_PATTERN,
+  RESERVED_HANDLES: () => RESERVED_HANDLES,
+  SERVICES: () => SERVICES,
+  SERVICE_NAMES: () => SERVICE_NAMES,
+  SESSION_COOKIE_NAME: () => SESSION_COOKIE_NAME,
+  apiFetch: () => apiFetch,
+  apiUrl: () => apiUrl,
+  articleAuthorPath: () => articleAuthorPath,
+  articlePath: () => articlePath,
+  articlesPath: () => articlesPath,
+  authAgentsPath: () => authAgentsPath,
+  authAppsPath: () => authAppsPath,
+  authAttestationsPath: () => authAttestationsPath,
+  authAuthorizePath: () => authAuthorizePath,
+  authDeveloperAppPath: () => authDeveloperAppPath,
+  authDeveloperAppsPath: () => authDeveloperAppsPath,
+  authGroupSettingsPath: () => authGroupSettingsPath,
+  authGroupsPath: () => authGroupsPath,
+  authLoginPath: () => authLoginPath,
+  authMembersPath: () => authMembersPath,
+  authNewGroupPath: () => authNewGroupPath,
+  authNewStubPath: () => authNewStubPath,
+  authNotificationsPath: () => authNotificationsPath,
+  authOnboardPath: () => authOnboardPath,
+  authRegisterPath: () => authRegisterPath,
+  authSecurityPath: () => authSecurityPath,
+  authSettingsPath: () => authSettingsPath,
+  authStubsPath: () => authStubsPath,
+  bugsAdminPath: () => bugsAdminPath,
+  bugsPath: () => bugsPath,
+  buildPath: () => buildPath,
+  buildPublicUrl: () => buildPublicUrl,
+  buildPublicUrlAbsolute: () => buildPublicUrlAbsolute,
+  buildServiceUrlMap: () => buildServiceUrlMap,
+  bumpPath: () => bumpPath,
+  chatConversationPath: () => chatConversationPath,
+  chatConversationsPath: () => chatConversationsPath,
+  chatPath: () => chatPath,
+  coffeeDashboardPath: () => coffeeDashboardPath,
+  coffeeEditPath: () => coffeeEditPath,
+  coffeeHandlePath: () => coffeeHandlePath,
+  coffeeSuccessPath: () => coffeeSuccessPath,
+  connectionsInvitePath: () => connectionsInvitePath,
+  connectionsPath: () => connectionsPath,
+  connectionsPodPath: () => connectionsPodPath,
+  corsHeaders: () => corsHeaders,
+  corsOptions: () => corsOptions,
+  developerGuidePath: () => developerGuidePath,
+  docsPath: () => docsPath,
+  dykilCreatePath: () => dykilCreatePath,
+  dykilDashboardPath: () => dykilDashboardPath,
+  dykilEmbedPath: () => dykilEmbedPath,
+  dykilHandlePath: () => dykilHandlePath,
+  dykilResultsPath: () => dykilResultsPath,
+  dykilSurveyPath: () => dykilSurveyPath,
+  eventAdminPath: () => eventAdminPath,
+  eventCheckoutSuccessPath: () => eventCheckoutSuccessPath,
+  eventEditPath: () => eventEditPath,
+  eventEditUrl: () => eventEditUrl,
+  eventMyTicketsPath: () => eventMyTicketsPath,
+  eventMyTicketsUrl: () => eventMyTicketsUrl,
+  eventPath: () => eventPath,
+  eventRegisterPath: () => eventRegisterPath,
+  eventRegisterUrl: () => eventRegisterUrl,
+  eventUrl: () => eventUrl,
+  eventsAdminListPath: () => eventsAdminListPath,
+  eventsCheckoutSuccessPath: () => eventsCheckoutSuccessPath,
+  eventsCreatePath: () => eventsCreatePath,
+  eventsDashboardPath: () => eventsDashboardPath,
+  getClientIP: () => getClientIP,
+  getForestScopeConfig: () => getForestScopeConfig,
+  getNodeSelf: () => getNodeSelf,
+  getPort: () => getPort,
+  getPublicUrl: () => getPublicUrl,
+  getService: () => getService,
+  getServiceUrl: () => getServiceUrl,
+  getSessionCookieName: () => getSessionCookieName,
+  getSessionCookieOptions: () => getSessionCookieOptions,
+  hasRegistryServiceUrl: () => hasRegistryServiceUrl,
+  healthPath: () => healthPath,
+  isAllowedOrigin: () => isAllowedOrigin,
+  isReservedHandle: () => isReservedHandle,
+  isValidHandle: () => isValidHandle,
+  learnCourseDashboardPath: () => learnCourseDashboardPath,
+  learnCourseLessonPath: () => learnCourseLessonPath,
+  learnCoursePath: () => learnCoursePath,
+  learnCoursePresentPath: () => learnCoursePresentPath,
+  learnCourseStudentsPath: () => learnCourseStudentsPath,
+  learnDashboardPath: () => learnDashboardPath,
+  learnHandlePath: () => learnHandlePath,
+  linksDashboardPath: () => linksDashboardPath,
+  linksEditPath: () => linksEditPath,
+  linksHandlePath: () => linksHandlePath,
+  marketCheckoutSuccessPath: () => marketCheckoutSuccessPath,
+  marketDashboardPath: () => marketDashboardPath,
+  marketListingEditPath: () => marketListingEditPath,
+  marketListingPath: () => marketListingPath,
+  marketNewListingPath: () => marketNewListingPath,
+  marketSellerPath: () => marketSellerPath,
+  marketSettingsPath: () => marketSettingsPath,
+  mediaPath: () => mediaPath,
+  normalizeHandleInput: () => normalizeHandleInput,
+  notifyPath: () => notifyPath,
+  notifySettingsPath: () => notifySettingsPath,
+  payHistoryPath: () => payHistoryPath,
+  payPath: () => payPath,
+  payPayoutsPath: () => payPayoutsPath,
+  payTopupPath: () => payTopupPath,
+  payTopupSuccessPath: () => payTopupSuccessPath,
+  privacyPath: () => privacyPath,
+  profileEditPath: () => profileEditPath,
+  profileLoginPath: () => profileLoginPath,
+  profilePath: () => profilePath,
+  profileRegisterPath: () => profileRegisterPath,
+  profileUrl: () => profileUrl,
+  projectPath: () => projectPath,
+  rateLimit: () => rateLimit,
+  registryDocsPath: () => registryDocsPath,
+  registryPath: () => registryPath,
+  registryServiceUrl: () => registryServiceUrl,
+  servicesByTier: () => servicesByTier,
+  servicesByVisibility: () => servicesByVisibility,
+  standaloneDashboardMiddleware: () => standaloneDashboardMiddleware,
+  subscribePath: () => subscribePath,
+  tier1Headers: () => tier1Headers,
+  tier2Headers: () => tier2Headers,
+  tier3Headers: () => tier3Headers,
+  validateOrigin: () => validateOrigin,
+  whitepaperPath: () => whitepaperPath,
+  withCors: () => withCors
+});
+module.exports = __toCommonJS(index_exports);
+
 // src/cors.ts
-import { NextResponse } from "next/server";
+var import_server = require("next/server");
 var ORIGIN_PATTERN = /^https:\/\/(dev-)?[a-z-]+\.imajin\.ai$/;
 var LOCAL_PATTERN = /^http:\/\/localhost:\d+$/;
+var ALLOWED_FRAME_ORIGINS = "https://*.imajin.ai https://imajin.ai";
 function isAllowedOrigin(origin) {
   if (!origin) return false;
   if (ORIGIN_PATTERN.test(origin)) return true;
@@ -15,12 +176,12 @@ function corsHeaders(request) {
     "Access-Control-Allow-Origin": allowed ? origin : "",
     "Access-Control-Allow-Credentials": "true",
     "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Caller-DID",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Caller-DID, X-App-DID, X-App-Authorization",
     "Vary": "Origin"
   };
 }
 function corsOptions(request) {
-  return new NextResponse(null, { status: 204, headers: corsHeaders(request) });
+  return new import_server.NextResponse(null, { status: 204, headers: corsHeaders(request) });
 }
 function withCors(response, request) {
   const headers = corsHeaders(request);
@@ -35,6 +196,9 @@ function validateOrigin(request) {
   return isAllowedOrigin(origin);
 }
 
+// src/dashboard-redirect-middleware.ts
+var import_server2 = require("next/server");
+
 // src/services.ts
 var SERVICES = [
   // Kernel services — individually visible, all run on the kernel process (port 3000/7000)
@@ -47,6 +211,11 @@ var SERVICES = [
   { name: "media", label: "Media", icon: "\u{1F4C1}", description: "Files, images, and .fair attribution", devPort: 3e3, prodPort: 7e3, schema: "media", tier: "core", visibility: "authenticated", category: "kernel" },
   { name: "registry", label: "Registry", icon: "\u{1F4E1}", description: "Service registry and DFOS relay", devPort: 3e3, prodPort: 7e3, schema: "registry", tier: "core", visibility: "public", category: "kernel" },
   { name: "notify", label: "Notify", icon: "\u{1F514}", description: "Notifications and preferences", devPort: 3e3, prodPort: 7e3, schema: "notify", tier: "core", visibility: "internal", category: "kernel" },
+  { name: "usage", label: "Usage", icon: "\u{1F4CA}", description: "Inference cost ledger \u2014 incurred, billed, drift, signed rollup", devPort: 3e3, prodPort: 7e3, schema: "usage", tier: "core", visibility: "authenticated", category: "kernel" },
+  { name: "calendar", label: "Calendar", icon: "\u{1F4C5}", description: "Temporal entries \u2014 availability, meetings, events, and reminders", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "authenticated", category: "kernel" },
+  { name: "jin", label: "Jin", icon: "\u{1F9ED}", description: "Operator dashboard \u2014 signed approvals, proposals, and usage feed", devPort: 3e3, prodPort: 7e3, schema: "operator", tier: "core", visibility: "internal", category: "kernel" },
+  { name: "google", label: "Google Workspace", icon: "\u{1F4E8}", description: "Gmail/Calendar/Drive/Meet connector \u2014 OAuth2 auth-code, sealed refresh token", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "authenticated", category: "kernel" },
+  { name: "vault", label: "Vault", icon: "\u{1F510}", description: "Sealed secrets, delegation grants, and vault-minted service credentials", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "internal", category: "kernel" },
   // Core apps — separate processes
   { name: "events", label: "Events", icon: "\u{1F3AB}", description: "Event creation, ticketing, and management", devPort: 3006, prodPort: 7006, schema: "events", tier: "core", visibility: "public", category: "core" },
   // Imajin apps
@@ -58,7 +227,10 @@ var SERVICES = [
   // Meta — project info and external resources surfaced in the launcher
   { name: "project", label: "Project", icon: "\u{1F4D6}", description: "Thesis, whitepaper, essays, RFCs", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", wwwPath: "/project" },
   { name: "github", label: "GitHub", icon: "\u{1F419}", description: "Source code", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", externalUrl: "https://github.com/ima-jin/imajin-ai" },
-  { name: "docs", label: "Docs", icon: "\u{1F4C4}", description: "API documentation", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", wwwPath: "/developer-guide" }
+  { name: "docs", label: "Docs", icon: "\u{1F4C4}", description: "API documentation", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", wwwPath: "/developer-guide" },
+  // Daemon processes — not web apps, no HTTP port exposed
+  { name: "broker-agent", label: "Broker Agent", icon: "\u{1F916}", description: "Telegram broker agent \u2014 conversational surface for social coordination (#1101)", devPort: 0, prodPort: 0, schema: null, tier: "core", visibility: "internal", category: "infrastructure" },
+  { name: "corpus", label: "Corpus", icon: "\u{1F50E}", description: "Per-DID corpus indexing and BM25 search service (#1737)", devPort: 8013, prodPort: 8013, schema: null, tier: "core", visibility: "internal", category: "infrastructure" }
   // Connected apps (separate repos) will use the plugin architecture (#249).
   // Not included here — they authenticate via delegated sessions, not the monorepo manifest.
 ];
@@ -67,7 +239,8 @@ function getService(name) {
 }
 function getPort(name, env = "dev") {
   const svc = getService(name);
-  return svc ? env === "prod" ? svc.prodPort : svc.devPort : void 0;
+  if (!svc) return void 0;
+  return env === "prod" ? svc.prodPort : svc.devPort;
 }
 function getServiceUrl(name, env = "dev") {
   const port = getPort(name, env);
@@ -75,18 +248,18 @@ function getServiceUrl(name, env = "dev") {
 }
 function getPublicUrl(name, options) {
   const svc = SERVICES.find((s) => s.name === name);
-  if (svc == null ? void 0 : svc.externalUrl) return svc.externalUrl;
-  const domain = (options == null ? void 0 : options.domain) || "imajin.ai";
-  const prefix = options == null ? void 0 : options.prefix;
-  if (svc == null ? void 0 : svc.wwwPath) {
+  if (svc?.externalUrl) return svc.externalUrl;
+  const domain = options?.domain || "imajin.ai";
+  const prefix = options?.prefix;
+  if (svc?.wwwPath) {
     const wwwUrl = getPublicUrl("www", options);
     return `${wwwUrl}${svc.wwwPath}`;
   }
-  if (domain.includes("localhost") || (prefix == null ? void 0 : prefix.includes("localhost"))) {
+  if (domain.includes("localhost") || prefix?.includes("localhost")) {
     const port = getPort(name, "dev");
     return port ? `http://localhost:${port}` : `http://localhost:3000`;
   }
-  if (prefix && prefix.includes(".")) {
+  if (prefix?.includes(".")) {
     const base = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
     if (name === "www" || name === "kernel") return `https://${base}`;
     return `https://${base}/${name}`;
@@ -100,8 +273,8 @@ function buildPublicUrl(name, servicePrefix, domain) {
     const explicit = process.env[envKey];
     if (explicit) return explicit;
   }
-  const p = servicePrefix ?? (typeof process !== "undefined" ? process.env.NEXT_PUBLIC_SERVICE_PREFIX : void 0) ?? "https://";
-  const d = domain ?? (typeof process !== "undefined" ? process.env.NEXT_PUBLIC_DOMAIN : void 0) ?? "imajin.ai";
+  const p = servicePrefix ?? (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_SERVICE_PREFIX) ?? "https://";
+  const d = domain ?? (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_DOMAIN) ?? "imajin.ai";
   if (p.includes("localhost") || d.includes("localhost")) {
     const port = getPort(name, "dev");
     return port ? `http://localhost:${port}` : `http://localhost:3000`;
@@ -112,6 +285,20 @@ function buildPublicUrl(name, servicePrefix, domain) {
   const match = p.replace(/^https?:\/\//, "").replace(/-$/, "") || void 0;
   return getPublicUrl(name, { prefix: match, domain: d });
 }
+function buildPublicUrlAbsolute(name) {
+  if (typeof process !== "undefined") {
+    const explicit = process.env[`NEXT_PUBLIC_${name.toUpperCase()}_URL`];
+    if (explicit && /^https?:\/\//.test(explicit)) return explicit;
+  }
+  const prefix = (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_SERVICE_PREFIX) ?? "https://";
+  const domain = (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_DOMAIN) ?? "imajin.ai";
+  if (prefix.includes("localhost") || domain.includes("localhost")) {
+    const port = getPort(name, "dev");
+    return port ? `http://localhost:${port}` : "http://localhost:3000";
+  }
+  const match = prefix.replace(/^https?:\/\//, "").replace(/-$/, "") || void 0;
+  return getPublicUrl(name, { prefix: match, domain });
+}
 var SERVICE_NAMES = SERVICES.map((s) => s.name);
 function servicesByTier(tier) {
   return SERVICES.filter((s) => s.tier === tier);
@@ -129,6 +316,46 @@ function buildServiceUrlMap(env, mode = "dev") {
   return map;
 }
 
+// src/dashboard-redirect-middleware.ts
+function standaloneDashboardMiddleware(request, { service, cors = true }) {
+  if (request.nextUrl.pathname === "/dashboard") {
+    const hubUrl = new URL(`${buildPublicUrlAbsolute("kernel")}/auth/${service}`);
+    hubUrl.search = request.nextUrl.search;
+    return import_server2.NextResponse.redirect(hubUrl, 308);
+  }
+  if (!cors) {
+    return import_server2.NextResponse.next();
+  }
+  if (request.method === "OPTIONS") {
+    return new import_server2.NextResponse(null, { status: 204, headers: corsHeaders(request) });
+  }
+  return withCors(import_server2.NextResponse.next(), request);
+}
+
+// src/security-headers.ts
+function buildFrameAncestors() {
+  const local = process.env.NODE_ENV !== "production" ? " http://localhost:*" : "";
+  return `frame-ancestors 'self' ${ALLOWED_FRAME_ORIGINS}${local}`;
+}
+function tier1Headers() {
+  return [
+    { key: "Content-Security-Policy", value: "frame-ancestors 'none'" },
+    { key: "X-Frame-Options", value: "DENY" }
+  ];
+}
+function tier2Headers() {
+  return [{ key: "Content-Security-Policy", value: buildFrameAncestors() }];
+}
+function tier3Headers() {
+  return [
+    { key: "X-Content-Type-Options", value: "nosniff" },
+    { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" }
+  ];
+}
+
+// src/brand.ts
+var APP_DISPLAY_NAME = "imajin (\u03B1)";
+
 // src/session.ts
 function getSessionCookieName(env) {
   const resolved = env ?? (typeof process !== "undefined" && (process.env.IMAJIN_ENV === "dev" || process.env.NODE_ENV === "development") ? "dev" : "prod");
@@ -140,8 +367,13 @@ function isLocalhost() {
   const prefix = process.env.NEXT_PUBLIC_SERVICE_PREFIX ?? "";
   return prefix.includes("localhost");
 }
+function isHostScoped() {
+  if (typeof process === "undefined") return false;
+  return process.env.SESSION_COOKIE_SCOPE === "host";
+}
 function getSessionCookieOptions(env) {
   const local = isLocalhost();
+  const omitDomain = local || isHostScoped();
   return {
     name: getSessionCookieName(env),
     options: {
@@ -149,7 +381,7 @@ function getSessionCookieOptions(env) {
       secure: !local,
       sameSite: local ? "lax" : "none",
       path: "/",
-      ...local ? {} : { domain: ".imajin.ai" },
+      ...omitDomain ? {} : { domain: ".imajin.ai" },
       maxAge: 60 * 60 * 24
       // 24 hours
     }
@@ -173,11 +405,102 @@ function apiFetch(path, init) {
   return fetch(apiUrl(path), init);
 }
 
+// src/rate-limit.ts
+var store = /* @__PURE__ */ new Map();
+var lastGlobalCleanup = Date.now();
+function pruneStore(now) {
+  if (now - lastGlobalCleanup < 6e4) return;
+  store.forEach((entry, key) => {
+    if (now - entry.lastSeen > 12e4) {
+      store.delete(key);
+    }
+  });
+  lastGlobalCleanup = now;
+}
+function rateLimit(key, limit, windowMs) {
+  const now = Date.now();
+  pruneStore(now);
+  const windowStart = now - windowMs;
+  const entry = store.get(key) ?? { timestamps: [], lastSeen: now };
+  entry.timestamps = entry.timestamps.filter((t) => t > windowStart);
+  entry.lastSeen = now;
+  if (entry.timestamps.length >= limit) {
+    const oldest = entry.timestamps[0];
+    const retryAfter = Math.ceil((oldest + windowMs - now) / 1e3);
+    store.set(key, entry);
+    return { limited: true, retryAfter: Math.max(1, retryAfter) };
+  }
+  entry.timestamps.push(now);
+  store.set(key, entry);
+  return { limited: false, retryAfter: 0 };
+}
+function getClientIP(request) {
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) return forwarded.split(",")[0].trim();
+  return "127.0.0.1";
+}
+
+// src/registry-service-url.ts
+var warnedAboutLegacyRegistryUrl = false;
+function registryServiceUrl() {
+  if (process.env.REGISTRY_SERVICE_URL) return process.env.REGISTRY_SERVICE_URL;
+  if (process.env.REGISTRY_URL) {
+    if (!warnedAboutLegacyRegistryUrl) {
+      console.warn("REGISTRY_URL is deprecated \u2014 set REGISTRY_SERVICE_URL");
+      warnedAboutLegacyRegistryUrl = true;
+    }
+    return process.env.REGISTRY_URL;
+  }
+  return `http://localhost:${process.env.PORT || 3e3}/registry`;
+}
+function hasRegistryServiceUrl() {
+  return Boolean(process.env.REGISTRY_SERVICE_URL || process.env.REGISTRY_URL);
+}
+
+// src/node-self.ts
+async function getNodeSelf() {
+  const url = `${registryServiceUrl()}/api/node/self`;
+  try {
+    const res = await fetch(url);
+    if (!res.ok) {
+      console.warn(`[config] getNodeSelf: registry returned ${res.status} for ${url} \u2014 check REGISTRY_SERVICE_URL`);
+      return null;
+    }
+    return await res.json();
+  } catch (err) {
+    console.warn(`[config] getNodeSelf: fetch failed for ${url} \u2014 ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+}
+
+// src/forest-config.ts
+function profileBaseUrl() {
+  if (process.env.PROFILE_SERVICE_URL) return process.env.PROFILE_SERVICE_URL;
+  const mode = process.env.NODE_ENV === "production" ? "prod" : "dev";
+  const base = getServiceUrl("profile", mode) ?? "http://localhost:3000";
+  return `${base}/profile`;
+}
+async function getForestScopeConfig(groupDid) {
+  const url = `${profileBaseUrl()}/api/forest/${encodeURIComponent(groupDid)}/config/public`;
+  try {
+    const res = await fetch(url);
+    if (!res.ok) {
+      console.warn(`[config] getForestScopeConfig: profile service returned ${res.status} for ${url}`);
+      return null;
+    }
+    const data = await res.json();
+    return { scopeFeeBps: typeof data?.scopeFeeBps === "number" ? data.scopeFeeBps : null };
+  } catch (err) {
+    console.warn(`[config] getForestScopeConfig: fetch failed for ${url} \u2014 ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+}
+
 // src/handles.ts
 var HANDLE_PATTERN = /^[a-z0-9._-]{3,30}$/;
-var HANDLE_EDGE = /^[.\-]|[.\-]$/;
-var HANDLE_CONSECUTIVE = /[.\-]{2}/;
-var HANDLE_INPUT_PATTERN = "[a-z0-9._\\-]{3,30}";
+var HANDLE_EDGE = /^[.-]|[.-]$/;
+var HANDLE_CONSECUTIVE = /[.-]{2}/;
+var HANDLE_INPUT_PATTERN = String.raw`[a-z0-9._\-]{3,30}`;
 var HANDLE_ALLOWED_CHARS = /[^a-z0-9._-]/g;
 var RESERVED_HANDLES = /* @__PURE__ */ new Set([
   "admin",
@@ -320,7 +643,10 @@ var docsPath = () => `/docs`;
 var projectPath = () => `/project`;
 var notifyPath = () => `/notify`;
 var notifySettingsPath = () => `/notify/settings`;
-export {
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ALLOWED_FRAME_ORIGINS,
+  APP_DISPLAY_NAME,
   HANDLE_ALLOWED_CHARS,
   HANDLE_ERROR,
   HANDLE_INPUT_PATTERN,
@@ -356,6 +682,7 @@ export {
   bugsPath,
   buildPath,
   buildPublicUrl,
+  buildPublicUrlAbsolute,
   buildServiceUrlMap,
   bumpPath,
   chatConversationPath,
@@ -392,12 +719,16 @@ export {
   eventsCheckoutSuccessPath,
   eventsCreatePath,
   eventsDashboardPath,
+  getClientIP,
+  getForestScopeConfig,
+  getNodeSelf,
   getPort,
   getPublicUrl,
   getService,
   getServiceUrl,
   getSessionCookieName,
   getSessionCookieOptions,
+  hasRegistryServiceUrl,
   healthPath,
   isAllowedOrigin,
   isReservedHandle,
@@ -435,12 +766,18 @@ export {
   profileRegisterPath,
   profileUrl,
   projectPath,
+  rateLimit,
   registryDocsPath,
   registryPath,
+  registryServiceUrl,
   servicesByTier,
   servicesByVisibility,
+  standaloneDashboardMiddleware,
   subscribePath,
+  tier1Headers,
+  tier2Headers,
+  tier3Headers,
   validateOrigin,
   whitepaperPath,
   withCors
-};
+});