@ima-jin/config 0.7.0 → 0.8.13

package/dist/index.js

@@ -1,153 +1,8 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  HANDLE_ALLOWED_CHARS: () => HANDLE_ALLOWED_CHARS,
-  HANDLE_ERROR: () => HANDLE_ERROR,
-  HANDLE_INPUT_PATTERN: () => HANDLE_INPUT_PATTERN,
-  HANDLE_PATTERN: () => HANDLE_PATTERN,
-  RESERVED_HANDLES: () => RESERVED_HANDLES,
-  SERVICES: () => SERVICES,
-  SERVICE_NAMES: () => SERVICE_NAMES,
-  SESSION_COOKIE_NAME: () => SESSION_COOKIE_NAME,
-  apiFetch: () => apiFetch,
-  apiUrl: () => apiUrl,
-  articleAuthorPath: () => articleAuthorPath,
-  articlePath: () => articlePath,
-  articlesPath: () => articlesPath,
-  authAgentsPath: () => authAgentsPath,
-  authAppsPath: () => authAppsPath,
-  authAttestationsPath: () => authAttestationsPath,
-  authAuthorizePath: () => authAuthorizePath,
-  authDeveloperAppPath: () => authDeveloperAppPath,
-  authDeveloperAppsPath: () => authDeveloperAppsPath,
-  authGroupSettingsPath: () => authGroupSettingsPath,
-  authGroupsPath: () => authGroupsPath,
-  authLoginPath: () => authLoginPath,
-  authMembersPath: () => authMembersPath,
-  authNewGroupPath: () => authNewGroupPath,
-  authNewStubPath: () => authNewStubPath,
-  authNotificationsPath: () => authNotificationsPath,
-  authOnboardPath: () => authOnboardPath,
-  authRegisterPath: () => authRegisterPath,
-  authSecurityPath: () => authSecurityPath,
-  authSettingsPath: () => authSettingsPath,
-  authStubsPath: () => authStubsPath,
-  bugsAdminPath: () => bugsAdminPath,
-  bugsPath: () => bugsPath,
-  buildPath: () => buildPath,
-  buildPublicUrl: () => buildPublicUrl,
-  buildServiceUrlMap: () => buildServiceUrlMap,
-  bumpPath: () => bumpPath,
-  chatConversationPath: () => chatConversationPath,
-  chatConversationsPath: () => chatConversationsPath,
-  chatPath: () => chatPath,
-  coffeeDashboardPath: () => coffeeDashboardPath,
-  coffeeEditPath: () => coffeeEditPath,
-  coffeeHandlePath: () => coffeeHandlePath,
-  coffeeSuccessPath: () => coffeeSuccessPath,
-  connectionsInvitePath: () => connectionsInvitePath,
-  connectionsPath: () => connectionsPath,
-  connectionsPodPath: () => connectionsPodPath,
-  corsHeaders: () => corsHeaders,
-  corsOptions: () => corsOptions,
-  developerGuidePath: () => developerGuidePath,
-  docsPath: () => docsPath,
-  dykilCreatePath: () => dykilCreatePath,
-  dykilDashboardPath: () => dykilDashboardPath,
-  dykilEmbedPath: () => dykilEmbedPath,
-  dykilHandlePath: () => dykilHandlePath,
-  dykilResultsPath: () => dykilResultsPath,
-  dykilSurveyPath: () => dykilSurveyPath,
-  eventAdminPath: () => eventAdminPath,
-  eventCheckoutSuccessPath: () => eventCheckoutSuccessPath,
-  eventEditPath: () => eventEditPath,
-  eventEditUrl: () => eventEditUrl,
-  eventMyTicketsPath: () => eventMyTicketsPath,
-  eventMyTicketsUrl: () => eventMyTicketsUrl,
-  eventPath: () => eventPath,
-  eventRegisterPath: () => eventRegisterPath,
-  eventRegisterUrl: () => eventRegisterUrl,
-  eventUrl: () => eventUrl,
-  eventsAdminListPath: () => eventsAdminListPath,
-  eventsCheckoutSuccessPath: () => eventsCheckoutSuccessPath,
-  eventsCreatePath: () => eventsCreatePath,
-  eventsDashboardPath: () => eventsDashboardPath,
-  getPort: () => getPort,
-  getPublicUrl: () => getPublicUrl,
-  getService: () => getService,
-  getServiceUrl: () => getServiceUrl,
-  getSessionCookieName: () => getSessionCookieName,
-  getSessionCookieOptions: () => getSessionCookieOptions,
-  healthPath: () => healthPath,
-  isAllowedOrigin: () => isAllowedOrigin,
-  isReservedHandle: () => isReservedHandle,
-  isValidHandle: () => isValidHandle,
-  learnCourseDashboardPath: () => learnCourseDashboardPath,
-  learnCourseLessonPath: () => learnCourseLessonPath,
-  learnCoursePath: () => learnCoursePath,
-  learnCoursePresentPath: () => learnCoursePresentPath,
-  learnCourseStudentsPath: () => learnCourseStudentsPath,
-  learnDashboardPath: () => learnDashboardPath,
-  learnHandlePath: () => learnHandlePath,
-  linksDashboardPath: () => linksDashboardPath,
-  linksEditPath: () => linksEditPath,
-  linksHandlePath: () => linksHandlePath,
-  marketCheckoutSuccessPath: () => marketCheckoutSuccessPath,
-  marketDashboardPath: () => marketDashboardPath,
-  marketListingEditPath: () => marketListingEditPath,
-  marketListingPath: () => marketListingPath,
-  marketNewListingPath: () => marketNewListingPath,
-  marketSellerPath: () => marketSellerPath,
-  marketSettingsPath: () => marketSettingsPath,
-  mediaPath: () => mediaPath,
-  normalizeHandleInput: () => normalizeHandleInput,
-  notifyPath: () => notifyPath,
-  notifySettingsPath: () => notifySettingsPath,
-  payHistoryPath: () => payHistoryPath,
-  payPath: () => payPath,
-  payPayoutsPath: () => payPayoutsPath,
-  payTopupPath: () => payTopupPath,
-  payTopupSuccessPath: () => payTopupSuccessPath,
-  privacyPath: () => privacyPath,
-  profileEditPath: () => profileEditPath,
-  profileLoginPath: () => profileLoginPath,
-  profilePath: () => profilePath,
-  profileRegisterPath: () => profileRegisterPath,
-  profileUrl: () => profileUrl,
-  projectPath: () => projectPath,
-  registryDocsPath: () => registryDocsPath,
-  registryPath: () => registryPath,
-  servicesByTier: () => servicesByTier,
-  servicesByVisibility: () => servicesByVisibility,
-  subscribePath: () => subscribePath,
-  validateOrigin: () => validateOrigin,
-  whitepaperPath: () => whitepaperPath,
-  withCors: () => withCors
-});
-module.exports = __toCommonJS(index_exports);
-
 // src/cors.ts
-var import_server = require("next/server");
+import { NextResponse } from "next/server";
 var ORIGIN_PATTERN = /^https:\/\/(dev-)?[a-z-]+\.imajin\.ai$/;
 var LOCAL_PATTERN = /^http:\/\/localhost:\d+$/;
+var ALLOWED_FRAME_ORIGINS = "https://*.imajin.ai https://imajin.ai";
 function isAllowedOrigin(origin) {
   if (!origin) return false;
   if (ORIGIN_PATTERN.test(origin)) return true;
@@ -161,12 +16,12 @@ function corsHeaders(request) {
     "Access-Control-Allow-Origin": allowed ? origin : "",
     "Access-Control-Allow-Credentials": "true",
     "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Caller-DID",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, X-Caller-DID, X-App-DID, X-App-Authorization",
     "Vary": "Origin"
   };
 }
 function corsOptions(request) {
-  return new import_server.NextResponse(null, { status: 204, headers: corsHeaders(request) });
+  return new NextResponse(null, { status: 204, headers: corsHeaders(request) });
 }
 function withCors(response, request) {
   const headers = corsHeaders(request);
@@ -181,6 +36,9 @@ function validateOrigin(request) {
   return isAllowedOrigin(origin);
 }
 
+// src/dashboard-redirect-middleware.ts
+import { NextResponse as NextResponse2 } from "next/server";
+
 // src/services.ts
 var SERVICES = [
   // Kernel services — individually visible, all run on the kernel process (port 3000/7000)
@@ -193,6 +51,11 @@ var SERVICES = [
   { name: "media", label: "Media", icon: "\u{1F4C1}", description: "Files, images, and .fair attribution", devPort: 3e3, prodPort: 7e3, schema: "media", tier: "core", visibility: "authenticated", category: "kernel" },
   { name: "registry", label: "Registry", icon: "\u{1F4E1}", description: "Service registry and DFOS relay", devPort: 3e3, prodPort: 7e3, schema: "registry", tier: "core", visibility: "public", category: "kernel" },
   { name: "notify", label: "Notify", icon: "\u{1F514}", description: "Notifications and preferences", devPort: 3e3, prodPort: 7e3, schema: "notify", tier: "core", visibility: "internal", category: "kernel" },
+  { name: "usage", label: "Usage", icon: "\u{1F4CA}", description: "Inference cost ledger \u2014 incurred, billed, drift, signed rollup", devPort: 3e3, prodPort: 7e3, schema: "usage", tier: "core", visibility: "authenticated", category: "kernel" },
+  { name: "calendar", label: "Calendar", icon: "\u{1F4C5}", description: "Temporal entries \u2014 availability, meetings, events, and reminders", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "authenticated", category: "kernel" },
+  { name: "jin", label: "Jin", icon: "\u{1F9ED}", description: "Operator dashboard \u2014 signed approvals, proposals, and usage feed", devPort: 3e3, prodPort: 7e3, schema: "operator", tier: "core", visibility: "internal", category: "kernel" },
+  { name: "google", label: "Google Workspace", icon: "\u{1F4E8}", description: "Gmail/Calendar/Drive/Meet connector \u2014 OAuth2 auth-code, sealed refresh token", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "authenticated", category: "kernel" },
+  { name: "vault", label: "Vault", icon: "\u{1F510}", description: "Sealed secrets, delegation grants, and vault-minted service credentials", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "internal", category: "kernel" },
   // Core apps — separate processes
   { name: "events", label: "Events", icon: "\u{1F3AB}", description: "Event creation, ticketing, and management", devPort: 3006, prodPort: 7006, schema: "events", tier: "core", visibility: "public", category: "core" },
   // Imajin apps
@@ -204,7 +67,10 @@ var SERVICES = [
   // Meta — project info and external resources surfaced in the launcher
   { name: "project", label: "Project", icon: "\u{1F4D6}", description: "Thesis, whitepaper, essays, RFCs", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", wwwPath: "/project" },
   { name: "github", label: "GitHub", icon: "\u{1F419}", description: "Source code", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", externalUrl: "https://github.com/ima-jin/imajin-ai" },
-  { name: "docs", label: "Docs", icon: "\u{1F4C4}", description: "API documentation", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", wwwPath: "/developer-guide" }
+  { name: "docs", label: "Docs", icon: "\u{1F4C4}", description: "API documentation", devPort: 3e3, prodPort: 7e3, schema: "public", tier: "core", visibility: "public", category: "meta", wwwPath: "/developer-guide" },
+  // Daemon processes — not web apps, no HTTP port exposed
+  { name: "broker-agent", label: "Broker Agent", icon: "\u{1F916}", description: "Telegram broker agent \u2014 conversational surface for social coordination (#1101)", devPort: 0, prodPort: 0, schema: null, tier: "core", visibility: "internal", category: "infrastructure" },
+  { name: "corpus", label: "Corpus", icon: "\u{1F50E}", description: "Per-DID corpus indexing and BM25 search service (#1737)", devPort: 8013, prodPort: 8013, schema: null, tier: "core", visibility: "internal", category: "infrastructure" }
   // Connected apps (separate repos) will use the plugin architecture (#249).
   // Not included here — they authenticate via delegated sessions, not the monorepo manifest.
 ];
@@ -213,7 +79,8 @@ function getService(name) {
 }
 function getPort(name, env = "dev") {
   const svc = getService(name);
-  return svc ? env === "prod" ? svc.prodPort : svc.devPort : void 0;
+  if (!svc) return void 0;
+  return env === "prod" ? svc.prodPort : svc.devPort;
 }
 function getServiceUrl(name, env = "dev") {
   const port = getPort(name, env);
@@ -221,18 +88,18 @@ function getServiceUrl(name, env = "dev") {
 }
 function getPublicUrl(name, options) {
   const svc = SERVICES.find((s) => s.name === name);
-  if (svc == null ? void 0 : svc.externalUrl) return svc.externalUrl;
-  const domain = (options == null ? void 0 : options.domain) || "imajin.ai";
-  const prefix = options == null ? void 0 : options.prefix;
-  if (svc == null ? void 0 : svc.wwwPath) {
+  if (svc?.externalUrl) return svc.externalUrl;
+  const domain = options?.domain || "imajin.ai";
+  const prefix = options?.prefix;
+  if (svc?.wwwPath) {
     const wwwUrl = getPublicUrl("www", options);
     return `${wwwUrl}${svc.wwwPath}`;
   }
-  if (domain.includes("localhost") || (prefix == null ? void 0 : prefix.includes("localhost"))) {
+  if (domain.includes("localhost") || prefix?.includes("localhost")) {
     const port = getPort(name, "dev");
     return port ? `http://localhost:${port}` : `http://localhost:3000`;
   }
-  if (prefix && prefix.includes(".")) {
+  if (prefix?.includes(".")) {
     const base = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
     if (name === "www" || name === "kernel") return `https://${base}`;
     return `https://${base}/${name}`;
@@ -246,8 +113,8 @@ function buildPublicUrl(name, servicePrefix, domain) {
     const explicit = process.env[envKey];
     if (explicit) return explicit;
   }
-  const p = servicePrefix ?? (typeof process !== "undefined" ? process.env.NEXT_PUBLIC_SERVICE_PREFIX : void 0) ?? "https://";
-  const d = domain ?? (typeof process !== "undefined" ? process.env.NEXT_PUBLIC_DOMAIN : void 0) ?? "imajin.ai";
+  const p = servicePrefix ?? (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_SERVICE_PREFIX) ?? "https://";
+  const d = domain ?? (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_DOMAIN) ?? "imajin.ai";
   if (p.includes("localhost") || d.includes("localhost")) {
     const port = getPort(name, "dev");
     return port ? `http://localhost:${port}` : `http://localhost:3000`;
@@ -258,6 +125,20 @@ function buildPublicUrl(name, servicePrefix, domain) {
   const match = p.replace(/^https?:\/\//, "").replace(/-$/, "") || void 0;
   return getPublicUrl(name, { prefix: match, domain: d });
 }
+function buildPublicUrlAbsolute(name) {
+  if (typeof process !== "undefined") {
+    const explicit = process.env[`NEXT_PUBLIC_${name.toUpperCase()}_URL`];
+    if (explicit && /^https?:\/\//.test(explicit)) return explicit;
+  }
+  const prefix = (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_SERVICE_PREFIX) ?? "https://";
+  const domain = (typeof process === "undefined" ? void 0 : process.env.NEXT_PUBLIC_DOMAIN) ?? "imajin.ai";
+  if (prefix.includes("localhost") || domain.includes("localhost")) {
+    const port = getPort(name, "dev");
+    return port ? `http://localhost:${port}` : "http://localhost:3000";
+  }
+  const match = prefix.replace(/^https?:\/\//, "").replace(/-$/, "") || void 0;
+  return getPublicUrl(name, { prefix: match, domain });
+}
 var SERVICE_NAMES = SERVICES.map((s) => s.name);
 function servicesByTier(tier) {
   return SERVICES.filter((s) => s.tier === tier);
@@ -275,6 +156,46 @@ function buildServiceUrlMap(env, mode = "dev") {
   return map;
 }
 
+// src/dashboard-redirect-middleware.ts
+function standaloneDashboardMiddleware(request, { service, cors = true }) {
+  if (request.nextUrl.pathname === "/dashboard") {
+    const hubUrl = new URL(`${buildPublicUrlAbsolute("kernel")}/auth/${service}`);
+    hubUrl.search = request.nextUrl.search;
+    return NextResponse2.redirect(hubUrl, 308);
+  }
+  if (!cors) {
+    return NextResponse2.next();
+  }
+  if (request.method === "OPTIONS") {
+    return new NextResponse2(null, { status: 204, headers: corsHeaders(request) });
+  }
+  return withCors(NextResponse2.next(), request);
+}
+
+// src/security-headers.ts
+function buildFrameAncestors() {
+  const local = process.env.NODE_ENV !== "production" ? " http://localhost:*" : "";
+  return `frame-ancestors 'self' ${ALLOWED_FRAME_ORIGINS}${local}`;
+}
+function tier1Headers() {
+  return [
+    { key: "Content-Security-Policy", value: "frame-ancestors 'none'" },
+    { key: "X-Frame-Options", value: "DENY" }
+  ];
+}
+function tier2Headers() {
+  return [{ key: "Content-Security-Policy", value: buildFrameAncestors() }];
+}
+function tier3Headers() {
+  return [
+    { key: "X-Content-Type-Options", value: "nosniff" },
+    { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" }
+  ];
+}
+
+// src/brand.ts
+var APP_DISPLAY_NAME = "imajin (\u03B1)";
+
 // src/session.ts
 function getSessionCookieName(env) {
   const resolved = env ?? (typeof process !== "undefined" && (process.env.IMAJIN_ENV === "dev" || process.env.NODE_ENV === "development") ? "dev" : "prod");
@@ -286,8 +207,13 @@ function isLocalhost() {
   const prefix = process.env.NEXT_PUBLIC_SERVICE_PREFIX ?? "";
   return prefix.includes("localhost");
 }
+function isHostScoped() {
+  if (typeof process === "undefined") return false;
+  return process.env.SESSION_COOKIE_SCOPE === "host";
+}
 function getSessionCookieOptions(env) {
   const local = isLocalhost();
+  const omitDomain = local || isHostScoped();
   return {
     name: getSessionCookieName(env),
     options: {
@@ -295,7 +221,7 @@ function getSessionCookieOptions(env) {
       secure: !local,
       sameSite: local ? "lax" : "none",
       path: "/",
-      ...local ? {} : { domain: ".imajin.ai" },
+      ...omitDomain ? {} : { domain: ".imajin.ai" },
       maxAge: 60 * 60 * 24
       // 24 hours
     }
@@ -319,11 +245,102 @@ function apiFetch(path, init) {
   return fetch(apiUrl(path), init);
 }
 
+// src/rate-limit.ts
+var store = /* @__PURE__ */ new Map();
+var lastGlobalCleanup = Date.now();
+function pruneStore(now) {
+  if (now - lastGlobalCleanup < 6e4) return;
+  store.forEach((entry, key) => {
+    if (now - entry.lastSeen > 12e4) {
+      store.delete(key);
+    }
+  });
+  lastGlobalCleanup = now;
+}
+function rateLimit(key, limit, windowMs) {
+  const now = Date.now();
+  pruneStore(now);
+  const windowStart = now - windowMs;
+  const entry = store.get(key) ?? { timestamps: [], lastSeen: now };
+  entry.timestamps = entry.timestamps.filter((t) => t > windowStart);
+  entry.lastSeen = now;
+  if (entry.timestamps.length >= limit) {
+    const oldest = entry.timestamps[0];
+    const retryAfter = Math.ceil((oldest + windowMs - now) / 1e3);
+    store.set(key, entry);
+    return { limited: true, retryAfter: Math.max(1, retryAfter) };
+  }
+  entry.timestamps.push(now);
+  store.set(key, entry);
+  return { limited: false, retryAfter: 0 };
+}
+function getClientIP(request) {
+  const forwarded = request.headers.get("x-forwarded-for");
+  if (forwarded) return forwarded.split(",")[0].trim();
+  return "127.0.0.1";
+}
+
+// src/registry-service-url.ts
+var warnedAboutLegacyRegistryUrl = false;
+function registryServiceUrl() {
+  if (process.env.REGISTRY_SERVICE_URL) return process.env.REGISTRY_SERVICE_URL;
+  if (process.env.REGISTRY_URL) {
+    if (!warnedAboutLegacyRegistryUrl) {
+      console.warn("REGISTRY_URL is deprecated \u2014 set REGISTRY_SERVICE_URL");
+      warnedAboutLegacyRegistryUrl = true;
+    }
+    return process.env.REGISTRY_URL;
+  }
+  return `http://localhost:${process.env.PORT || 3e3}/registry`;
+}
+function hasRegistryServiceUrl() {
+  return Boolean(process.env.REGISTRY_SERVICE_URL || process.env.REGISTRY_URL);
+}
+
+// src/node-self.ts
+async function getNodeSelf() {
+  const url = `${registryServiceUrl()}/api/node/self`;
+  try {
+    const res = await fetch(url);
+    if (!res.ok) {
+      console.warn(`[config] getNodeSelf: registry returned ${res.status} for ${url} \u2014 check REGISTRY_SERVICE_URL`);
+      return null;
+    }
+    return await res.json();
+  } catch (err) {
+    console.warn(`[config] getNodeSelf: fetch failed for ${url} \u2014 ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+}
+
+// src/forest-config.ts
+function profileBaseUrl() {
+  if (process.env.PROFILE_SERVICE_URL) return process.env.PROFILE_SERVICE_URL;
+  const mode = process.env.NODE_ENV === "production" ? "prod" : "dev";
+  const base = getServiceUrl("profile", mode) ?? "http://localhost:3000";
+  return `${base}/profile`;
+}
+async function getForestScopeConfig(groupDid) {
+  const url = `${profileBaseUrl()}/api/forest/${encodeURIComponent(groupDid)}/config/public`;
+  try {
+    const res = await fetch(url);
+    if (!res.ok) {
+      console.warn(`[config] getForestScopeConfig: profile service returned ${res.status} for ${url}`);
+      return null;
+    }
+    const data = await res.json();
+    return { scopeFeeBps: typeof data?.scopeFeeBps === "number" ? data.scopeFeeBps : null };
+  } catch (err) {
+    console.warn(`[config] getForestScopeConfig: fetch failed for ${url} \u2014 ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+}
+
 // src/handles.ts
 var HANDLE_PATTERN = /^[a-z0-9._-]{3,30}$/;
-var HANDLE_EDGE = /^[.\-]|[.\-]$/;
-var HANDLE_CONSECUTIVE = /[.\-]{2}/;
-var HANDLE_INPUT_PATTERN = "[a-z0-9._\\-]{3,30}";
+var HANDLE_EDGE = /^[.-]|[.-]$/;
+var HANDLE_CONSECUTIVE = /[.-]{2}/;
+var HANDLE_INPUT_PATTERN = String.raw`[a-z0-9._\-]{3,30}`;
 var HANDLE_ALLOWED_CHARS = /[^a-z0-9._-]/g;
 var RESERVED_HANDLES = /* @__PURE__ */ new Set([
   "admin",
@@ -466,8 +483,9 @@ var docsPath = () => `/docs`;
 var projectPath = () => `/project`;
 var notifyPath = () => `/notify`;
 var notifySettingsPath = () => `/notify/settings`;
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
+export {
+  ALLOWED_FRAME_ORIGINS,
+  APP_DISPLAY_NAME,
   HANDLE_ALLOWED_CHARS,
   HANDLE_ERROR,
   HANDLE_INPUT_PATTERN,
@@ -503,6 +521,7 @@ var notifySettingsPath = () => `/notify/settings`;
   bugsPath,
   buildPath,
   buildPublicUrl,
+  buildPublicUrlAbsolute,
   buildServiceUrlMap,
   bumpPath,
   chatConversationPath,
@@ -539,12 +558,16 @@ var notifySettingsPath = () => `/notify/settings`;
   eventsCheckoutSuccessPath,
   eventsCreatePath,
   eventsDashboardPath,
+  getClientIP,
+  getForestScopeConfig,
+  getNodeSelf,
   getPort,
   getPublicUrl,
   getService,
   getServiceUrl,
   getSessionCookieName,
   getSessionCookieOptions,
+  hasRegistryServiceUrl,
   healthPath,
   isAllowedOrigin,
   isReservedHandle,
@@ -582,12 +605,18 @@ var notifySettingsPath = () => `/notify/settings`;
   profileRegisterPath,
   profileUrl,
   projectPath,
+  rateLimit,
   registryDocsPath,
   registryPath,
+  registryServiceUrl,
   servicesByTier,
   servicesByVisibility,
+  standaloneDashboardMiddleware,
   subscribePath,
+  tier1Headers,
+  tier2Headers,
+  tier3Headers,
   validateOrigin,
   whitepaperPath,
   withCors
-});
+};

package/next-headers.cjs

@@ -0,0 +1,57 @@
+'use strict';
+
+/**
+ * Security-header helpers for next.config.js (CommonJS bridge).
+ *
+ * The frame-ancestors value is derived from ALLOWED_FRAME_ORIGINS in src/cors.ts
+ * and the localhost dev behaviour mirrors isAllowedOrigin() in the same file.
+ * If the allowed-origin set changes, update src/cors.ts (ORIGIN_PATTERN +
+ * ALLOWED_FRAME_ORIGINS) and the constant below together.
+ */
+
+// Mirrors ALLOWED_FRAME_ORIGINS in src/cors.ts
+const ALLOWED_FRAME_ORIGINS = 'https://*.imajin.ai https://imajin.ai';
+
+/**
+ * Build the frame-ancestors directive value.
+ * Adds localhost:* in non-prod, mirroring isAllowedOrigin().
+ */
+function buildFrameAncestors() {
+  const local = process.env.NODE_ENV !== 'production' ? ' http://localhost:*' : '';
+  return `frame-ancestors 'self' ${ALLOWED_FRAME_ORIGINS}${local}`;
+}
+
+/**
+ * Tier 1 — hard deny framing.
+ * Use on credential and auth-sensitive pages that must never be embedded.
+ * @returns {Array<{key: string, value: string}>}
+ */
+function tier1Headers() {
+  return [
+    { key: 'Content-Security-Policy', value: "frame-ancestors 'none'" },
+    { key: 'X-Frame-Options', value: 'DENY' },
+  ];
+}
+
+/**
+ * Tier 2 — allow framing by Imajin origins only.
+ * Use on routes embedded by the auth hub (service dashboards, document viewer, surveys).
+ * Intentionally omits X-Frame-Options — it cannot express an allow-list.
+ * @returns {Array<{key: string, value: string}>}
+ */
+function tier2Headers() {
+  return [{ key: 'Content-Security-Policy', value: buildFrameAncestors() }];
+}
+
+/**
+ * Tier 3 — baseline hardening. Safe to apply on every route in every app.
+ * @returns {Array<{key: string, value: string}>}
+ */
+function tier3Headers() {
+  return [
+    { key: 'X-Content-Type-Options', value: 'nosniff' },
+    { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+  ];
+}
+
+module.exports = { tier1Headers, tier2Headers, tier3Headers };

package/package.json

@@ -1,24 +1,31 @@
 {
   "name": "@ima-jin/config",
-  "version": "0.7.0",
+  "version": "0.8.13",
+  "description": "Shared configuration for Imajin services — CORS, service routing, session config, handle validation, and route helpers",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ima-jin/imajin-ai.git",
+    "directory": "packages/config"
+  },
+  "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
     ".": {
-      "import": "./dist/index.mjs",
-      "require": "./dist/index.js",
-      "types": "./dist/index.d.ts"
-    }
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./next-headers": "./next-headers.cjs"
   },
   "files": [
     "dist/",
-    "src/"
+    "src/",
+    "next-headers.cjs"
   ],
-  "dependencies": {
-    "@ima-jin/tokens": "^0.6.1"
-  },
   "peerDependencies": {
-    "next": ">=14"
+    "next": ">=15.5.24"
   },
   "publishConfig": {
     "access": "public"

package/src/base-path.ts

@@ -4,20 +4,20 @@
  * Next.js `basePath` auto-prefixes <Link> and router.push() but NOT:
  *   - fetch() calls
  *   - <a href=""> tags
- *   - window.location assignments
+ *   - globalThis.location assignments
  *
  * These utilities read NEXT_PUBLIC_BASE_PATH (set automatically by Next.js
  * when basePath is configured) and prepend it where needed.
  *
  * Usage:
- *   import { apiFetch, apiUrl } from '@imajin/config';
+ *   import { apiFetch, apiUrl } from '@ima-jin/config';
  *
  *   // Instead of: fetch('/api/listings')
  *   apiFetch('/api/listings')
  *
- *   // For <a> tags or window.location:
+ *   // For <a> tags or globalThis.location:
  *   <a href={apiUrl('/dashboard')}>Dashboard</a>
- *   window.location.href = apiUrl('/dashboard');
+ *   globalThis.location.href = apiUrl('/dashboard');
  */
 
 /**
@@ -52,17 +52,17 @@ export function apiUrl(path: string): string {
  *
  * Absolute URLs (http://, https://) are passed through unchanged.
  *
- * TODO(WO2/correlation): For server-side service-to-service calls, callers should
- * forward the X-Correlation-Id header so the full request chain shares one ID.
- * apiFetch is browser-side too, so we can't read headers here automatically —
- * instead, pass it explicitly via init.headers when calling from a withLogger handler:
+ * For server-side service-to-service calls, forward the X-Correlation-Id header
+ * so the full request chain shares one ID. apiFetch is browser-side too, so it
+ * can't read headers here automatically — pass it explicitly via init.headers
+ * when calling from a withLogger handler:
  *
  *   apiFetch('/api/something', {
  *     headers: { 'x-correlation-id': correlationId },
  *   });
  *
- * When WO3 instruments services, each withLogger handler receives correlationId in
- * ctx and should forward it on any outbound apiFetch/fetch calls.
+ * see: automatic correlationId forwarding on outbound apiFetch/fetch calls from
+ * withLogger handlers is not yet wired up.
  */
 export function apiFetch(path: string, init?: RequestInit): Promise<Response> {
   // Don't prefix absolute URLs

package/src/brand.ts

@@ -0,0 +1,12 @@
+/**
+ * Human-facing product display name.
+ *
+ * This is the ONLY place the "(α)" (alpha) stage marker lives — flip it here
+ * (e.g. to "(β)" or drop it for GA) and every consumer (BuildInfo, nav bars,
+ * page titles/metadata, auth screens, email templates, etc.) picks it up.
+ *
+ * Do NOT use this for DIDs, URLs, package names, event names, localStorage
+ * keys, env vars, or any other code identifier — those stay as literal
+ * 'imajin' strings. This constant is display-text only.
+ */
+export const APP_DISPLAY_NAME = "imajin (α)";