@wtfalch/foundry 0.60.0 → 0.61.0

package/dist/catalogue/copy-en.js

@@ -0,0 +1,129 @@
+/**
+ * English copy for every key the catalogue uses. Foundry owns it; Boule prefers its own `@wtfalch/i18n`
+ * catalogue for a key and falls back to this text. A key without text fails the catalogue test.
+ */
+const I = 'foundry.integration';
+const S = 'foundry.system';
+const INTEGRATION_COPY = {
+    'sign-in': {
+        name: 'Sign-in',
+        summary: 'People sign up and sign in to the app.',
+        ours: 'Run by us',
+        outputs: { issuer: 'The address that signs people in.', 'client-id': "The app's sign-in id." },
+    },
+    assistants: {
+        name: 'Help for AI assistants',
+        summary: 'Customers connect an AI assistant that acts as them.',
+        ours: 'Run by us',
+        outputs: { 'mcp-url': 'The address AI assistants connect to.' },
+    },
+    workspaces: {
+        name: 'Workspaces',
+        summary: 'Customers make shared workspaces and invite people in.',
+        ours: 'Run by us',
+    },
+    database: {
+        name: 'Database',
+        summary: "A database for the app's own records, with daily backups.",
+        ours: 'Run by us',
+        byo: 'Your own database',
+        meters: { storage: 'Storage' },
+        outputs: {
+            address: 'The address the app uses to reach its database.',
+            'owner-address': 'The address used to change the database layout.',
+        },
+    },
+    audit: {
+        name: 'Audit log',
+        summary: 'A record of what happened that nobody can quietly change, sealed and time stamped by the platform.',
+        ours: 'Run by us',
+        meters: { entries: 'Entries' },
+        outputs: {},
+    },
+    'signed-records': {
+        name: 'Signed records',
+        summary: 'Records the app signs so anyone can check they were not changed.',
+        ours: 'Run by us',
+        meters: { signatures: 'Signatures' },
+        outputs: { 'registrar-url': 'The address that signs records for the app.' },
+    },
+    files: {
+        name: 'Files',
+        summary: 'Uploads and documents kept in folders only this app reaches.',
+        ours: 'Run by us',
+        byo: 'Your own Cloudflare',
+        meters: { storage: 'Storage', transfer: 'Downloads' },
+        outputs: { address: "The address of the app's file folders." },
+    },
+    email: {
+        name: 'Email',
+        summary: "The app sends email from your company's own address.",
+        ours: 'Run by us',
+        meters: { messages: 'Messages sent' },
+        outputs: { from: 'The address the app sends from.' },
+    },
+    jobs: {
+        name: 'Jobs in the background',
+        summary: 'Tasks that run on a schedule, and try again if they fail.',
+        ours: 'Run by us',
+        meters: { runs: 'Runs' },
+        outputs: { url: 'The address the scheduler calls.' },
+    },
+    ai: {
+        name: 'AI',
+        summary: 'The app uses AI to do work, such as writing a summary.',
+        ours: 'Run by us',
+        byo: 'Your own AI account',
+        meters: { tokens: 'AI use' },
+        outputs: { address: 'The address the app calls for AI tasks.' },
+    },
+    organisations: {
+        name: 'Sign-in for organisations',
+        summary: 'Companies sign their own people in to the app.',
+        ours: 'Run by us',
+    },
+};
+const SHARED_OUTPUTS = {
+    app: { url: "The app's web address.", host: "The app's host name.", name: "The app's name." },
+    company: {
+        id: "The company's id.",
+        name: "The company's name.",
+        slug: "The company's short name.",
+    },
+};
+const SYSTEM_COPY = {
+    blank: { name: 'Start empty', summary: 'An app with nothing turned on. Add what you need.' },
+    'members-area': {
+        name: 'Members area',
+        summary: 'A place where your members sign in and keep their own records.',
+        screens: { members: 'Members' },
+    },
+};
+function build() {
+    const copy = {};
+    for (const [id, row] of Object.entries(INTEGRATION_COPY)) {
+        copy[`${I}.${id}.name`] = row.name;
+        copy[`${I}.${id}.summary`] = row.summary;
+        if (row.ours)
+            copy[`${I}.${id}.provider.ours`] = row.ours;
+        if (row.byo)
+            copy[`${I}.${id}.provider.byo`] = row.byo;
+        for (const [m, text] of Object.entries(row.meters ?? {}))
+            copy[`${I}.${id}.meter.${m}`] = text;
+        for (const [o, text] of Object.entries(row.outputs ?? {}))
+            copy[`${I}.${id}.output.${o}`] = text;
+    }
+    for (const [owner, outputs] of Object.entries(SHARED_OUTPUTS)) {
+        for (const [o, text] of Object.entries(outputs))
+            copy[`${I}.${owner}.output.${o}`] = text;
+    }
+    for (const [id, row] of Object.entries(SYSTEM_COPY)) {
+        copy[`${S}.${id}.name`] = row.name;
+        copy[`${S}.${id}.summary`] = row.summary;
+        for (const [sc, text] of Object.entries(row.screens ?? {})) {
+            copy[`${S}.${id}.screen.${sc}`] = text;
+        }
+    }
+    return copy;
+}
+export const CATALOGUE_EN = Object.freeze(build());

package/dist/catalogue/index.d.ts

@@ -0,0 +1,9 @@
+import type { Catalogue } from './types.js';
+export type * from './types.js';
+export { CATALOGUE_EN } from './copy-en.js';
+export { OUTPUTS, referenceProblem } from '../modules/outputs.js';
+export { SYSTEMS } from './systems.js';
+/** The English text for a copy key; the key itself when it has none (a test keeps that from happening). */
+export declare function copyOf(key: string): string;
+/** The whole catalogue, JSON-safe, for Boule to render. A fresh copy on every call. */
+export declare function catalogue(): Catalogue;

package/dist/catalogue/index.js

@@ -0,0 +1,21 @@
+import { CATALOGUE_EN } from './copy-en.js';
+import { integrations, outputsOf } from './integrations.js';
+import { SYSTEMS } from './systems.js';
+export { CATALOGUE_EN } from './copy-en.js';
+export { OUTPUTS, referenceProblem } from '../modules/outputs.js';
+export { SYSTEMS } from './systems.js';
+/** The English text for a copy key; the key itself when it has none (a test keeps that from happening). */
+export function copyOf(key) {
+    return CATALOGUE_EN[key] ?? key;
+}
+/** The whole catalogue, JSON-safe, for Boule to render. A fresh copy on every call. */
+export function catalogue() {
+    return structuredClone({
+        v: 1,
+        integrations: integrations(),
+        systems: [...SYSTEMS],
+        shared: { app: outputsOf('app'), company: outputsOf('company') },
+        runtimePrice: { worker: 'free', server: 'premium' },
+        copy: { ...CATALOGUE_EN },
+    });
+}

package/dist/catalogue/integrations.d.ts

@@ -0,0 +1,4 @@
+import type { Integration, IntegrationOutput } from './types.js';
+export declare function outputsOf(owner: string): IntegrationOutput[];
+/** Every integration, one per app module, in the order modules are applied. */
+export declare function integrations(): Integration[];

package/dist/catalogue/integrations.js

@@ -0,0 +1,104 @@
+import { MODULES } from '../modules/index.js';
+import { OUTPUTS, SECRET_OUTPUTS } from '../modules/outputs.js';
+const K = 'foundry.integration';
+export function outputsOf(owner) {
+    return (OUTPUTS[owner] ?? []).map((id) => ({
+        id,
+        secret: SECRET_OUTPUTS.has(`${owner}.${id}`),
+        summaryKey: `${K}.${owner}.output.${id}`,
+    }));
+}
+const ours = (integration) => ({
+    kind: 'ours',
+    nameKey: `${K}.${integration}.provider.ours`,
+});
+const byo = (integration) => ({
+    kind: 'byo',
+    nameKey: `${K}.${integration}.provider.byo`,
+    advanced: true,
+});
+const meter = (integration, id, unit) => ({
+    id,
+    nameKey: `${K}.${integration}.meter.${id}`,
+    unit,
+});
+const EXTRA = {
+    'sign-in': {
+        providers: [ours('sign-in')],
+        price: { class: 'free', meters: [] },
+        advanced: [],
+    },
+    assistants: {
+        providers: [ours('assistants')],
+        price: { class: 'free', meters: [] },
+        advanced: [],
+    },
+    workspaces: {
+        providers: [ours('workspaces')],
+        price: { class: 'free', meters: [] },
+        advanced: [],
+    },
+    database: {
+        providers: [ours('database'), byo('database')],
+        price: { class: 'usage', meters: [meter('database', 'storage', 'GB')] },
+        advanced: [],
+    },
+    'signed-records': {
+        providers: [ours('signed-records')],
+        price: { class: 'usage', meters: [meter('signed-records', 'signatures', 'signatures')] },
+        advanced: [],
+    },
+    files: {
+        providers: [ours('files'), byo('files')],
+        price: {
+            class: 'usage',
+            meters: [meter('files', 'storage', 'GB'), meter('files', 'transfer', 'GB')],
+        },
+        advanced: [],
+    },
+    email: {
+        providers: [ours('email')],
+        price: { class: 'usage', meters: [meter('email', 'messages', 'messages')] },
+        advanced: [],
+    },
+    jobs: {
+        providers: [ours('jobs')],
+        price: { class: 'usage', meters: [meter('jobs', 'runs', 'runs')] },
+        advanced: [],
+    },
+    ai: {
+        providers: [ours('ai'), byo('ai')],
+        price: { class: 'usage', meters: [meter('ai', 'tokens', 'tokens')] },
+        advanced: [],
+    },
+    audit: {
+        providers: [ours('audit')],
+        price: { class: 'usage', meters: [meter('audit', 'entries', 'entries')] },
+        advanced: [],
+    },
+    organisations: {
+        providers: [ours('organisations')],
+        price: { class: 'free', meters: [] },
+        advanced: [],
+    },
+};
+/** Every integration, one per app module, in the order modules are applied. */
+export function integrations() {
+    return MODULES.map(({ view }) => {
+        const extra = EXTRA[view.id];
+        if (!extra)
+            throw new Error(`The catalogue has no entry for the module "${view.id}".`);
+        return structuredClone({
+            id: view.id,
+            nameKey: `${K}.${view.id}.name`,
+            summaryKey: `${K}.${view.id}.summary`,
+            category: view.category,
+            icon: view.icon,
+            runtimes: view.runtimes,
+            requires: view.requires,
+            availability: view.availability,
+            ...extra,
+            outputs: outputsOf(view.id),
+        });
+    });
+}

package/dist/catalogue/systems.d.ts

@@ -0,0 +1,7 @@
+import type { System } from './types.js';
+/**
+ * The first systems, as recipes on top of the integrations (estate#219). A system names the integrations it
+ * turns on with the values it starts from, the questions the quickstart asks, and the Boule screens it adds.
+ * More systems come in waves.
+ */
+export declare const SYSTEMS: readonly System[];

package/dist/catalogue/systems.js

@@ -0,0 +1,31 @@
+const S = 'foundry.system';
+/**
+ * The first systems, as recipes on top of the integrations (estate#219). A system names the integrations it
+ * turns on with the values it starts from, the questions the quickstart asks, and the Boule screens it adds.
+ * More systems come in waves.
+ */
+export const SYSTEMS = [
+    {
+        id: 'blank',
+        nameKey: `${S}.blank.name`,
+        summaryKey: `${S}.blank.summary`,
+        icon: 'app',
+        runtime: 'worker',
+        presets: [],
+        asks: [],
+        screens: [],
+    },
+    {
+        id: 'members-area',
+        nameKey: `${S}.members-area.name`,
+        summaryKey: `${S}.members-area.summary`,
+        icon: 'users',
+        runtime: 'worker',
+        presets: [
+            { integration: 'sign-in', values: {} },
+            { integration: 'database', values: {} },
+        ],
+        asks: [],
+        screens: [{ id: 'members', nameKey: `${S}.members-area.screen.members` }],
+    },
+];

package/dist/catalogue/types.d.ts

@@ -0,0 +1,110 @@
+import type { ModuleCategory, ModuleRuntime } from '../modules/types.js';
+/**
+ * The catalogue contract (`@wtfalch/foundry/catalogue`). Boule renders every integration and system from it,
+ * with no code per integration. Everything is JSON-safe.
+ *
+ * Copy: each entry carries `@wtfalch/i18n` copy keys. `CATALOGUE_EN` holds the English text for every key
+ * (foundry owns this copy); `copyOf` turns a key into its English fallback. Boule prefers its own catalogue
+ * for a key and falls back to English.
+ */
+/** How a price shows: free with the app, a Premium part, or priced by use. */
+export type PriceClass = 'free' | 'premium' | 'usage';
+/** Who runs the integration. `ours`: us, per company (the default). `byo`: the company's own account. */
+export type ProviderKind = 'ours' | 'byo';
+export interface CopyKeys {
+    nameKey: string;
+    summaryKey: string;
+}
+export interface IntegrationProvider {
+    kind: ProviderKind;
+    /** Copy key for the provider's name, such as "Run by us" or "Your own Cloudflare". */
+    nameKey: string;
+    /** Present only for `byo`: an Advanced option. */
+    advanced?: boolean;
+}
+/** What a meter counts. The meter ids are the ones the usage tail reports. */
+export interface PriceMeter {
+    id: string;
+    /** Copy key for the meter's name, such as "Storage". */
+    nameKey: string;
+    unit: string;
+}
+export interface IntegrationPrice {
+    class: PriceClass;
+    meters: PriceMeter[];
+}
+/** A value an app can read with a `reference` in `company-app.json`: `<integration id>.<output id>`. */
+export interface IntegrationOutput {
+    id: string;
+    /** Always held as a secret by whoever reads it. */
+    secret: boolean;
+    /** Copy key for one plain sentence on what it is. */
+    summaryKey: string;
+}
+/** One option under "Advanced", beyond bring-your-own. */
+export interface AdvancedOption {
+    id: string;
+    nameKey: string;
+    summaryKey: string;
+}
+export interface Integration extends CopyKeys {
+    /** The id of the app module that turns it on. */
+    id: string;
+    category: ModuleCategory;
+    icon: string;
+    runtimes: ModuleRuntime[];
+    requires: string[];
+    availability: 'ready' | 'soon';
+    /** The first is the default and is always `ours`. */
+    providers: IntegrationProvider[];
+    price: IntegrationPrice;
+    outputs: IntegrationOutput[];
+    advanced: AdvancedOption[];
+}
+/** An integration a system turns on, with the module values it starts from. */
+export interface SystemPreset {
+    integration: string;
+    /** Module values the system sets. The company may change them unless `locked`. */
+    values: Record<string, string | number | boolean | string[]>;
+    locked?: boolean;
+}
+/** A question the quickstart asks before it builds the system. */
+export interface SystemAsk {
+    key: string;
+    nameKey: string;
+    helpKey?: string;
+    required: boolean;
+    /** Where the answer goes: a field of a preset integration. */
+    into?: {
+        integration: string;
+        field: string;
+    };
+    default?: string;
+}
+/** A screen of Boule that belongs to the system once installed. */
+export interface SystemScreen {
+    id: string;
+    nameKey: string;
+}
+export interface System extends CopyKeys {
+    id: string;
+    icon: string;
+    runtime: ModuleRuntime;
+    presets: SystemPreset[];
+    asks: SystemAsk[];
+    screens: SystemScreen[];
+}
+export interface Catalogue {
+    v: 1;
+    integrations: Integration[];
+    systems: System[];
+    /** Outputs every app can read: `app.<id>` and `company.<id>`. */
+    shared: {
+        app: IntegrationOutput[];
+        company: IntegrationOutput[];
+    };
+    /** Price class of running on a server (a container) or as a Worker. */
+    runtimePrice: Record<ModuleRuntime, PriceClass>;
+    /** Copy key -> English text, for every key above. */
+    copy: Record<string, string>;
+}

package/dist/catalogue/types.js

@@ -0,0 +1 @@
+export {};

package/dist/entry-rules.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The shape rules of a hosting entry that both the entry's validation (`org.ts`, `worker-app-config.ts`) and the
+ * app modules (`modules/`) read. Pure: no imports, so `@wtfalch/foundry/modules` can use them in a browser.
+ */
+/** The MCP endpoint path: absolute, plain characters, no dot segments, no query. */
+export declare const MCP_PATH: RegExp;
+/** `uses.auth.mcp.onboardingPath` and `uses.auth.workspaces.invitePath`: their longest value. */
+export declare const ONBOARDING_PATH_MAX_LENGTH = 200;
+/**
+ * A page path on the app's own host: starts with one `/`, no `..`, `?`, `#`, `\`, spaces or control characters,
+ * at most {@link ONBOARDING_PATH_MAX_LENGTH} characters.
+ */
+export declare function isPagePath(value: unknown): value is string;
+/** The most roles an entry may offer, as the broker allows. */
+export declare const WORKSPACE_ROLES_MAX = 20;
+/** A role name is the role's key in the broker's store. */
+export declare const WORKSPACE_ROLE: RegExp;
+/** Longest value of each `uses.auth.room` text field. */
+export declare const ROOM_TEXT_MAX: {
+    readonly name: 40;
+    readonly headline: 120;
+    readonly line: 200;
+    readonly title: 60;
+    readonly description: 200;
+};
+export declare const ROOM_STEPS_MIN = 2;
+export declare const ROOM_STEPS_MAX = 9;
+export declare const ROOM_UNSAFE_TEXT: RegExp;
+/** What an entry's ai key may hold: the most the org's own key holds. */
+export declare const AI_ENTRY_PERMISSIONS: readonly ["ai.offerings:invoke", "ai.runs:create"];
+/** `uses.ai.webhookPath`. */
+export declare const AI_WEBHOOK_PATH: RegExp;
+/** What an entry's files key may hold: read and write on its collections, and the most the org's own key holds besides minting. */
+export declare const FILES_ENTRY_PERMISSIONS: readonly ["files.collections:read", "files.files:read", "files.files:download", "files.files:upload", "files.files:replace", "files.files:delete"];
+/** A `uses.files.collections` name. */
+export declare const FILES_COLLECTION_NAME: RegExp;
+/** The secret that carries a `keysCustody` source: the custody Worker credential. */
+export declare const WORKER_APP_KEYS_SECRET = "KEYS_CREDENTIAL";
+/**
+ * Names foundry writes into a Worker app's environment itself, so a
+ * declaration may not use them as a binding, secret or var.
+ */
+export declare const WORKER_APP_RESERVED_NAMES: RegExp;
+/** A var name that looks like a secret's. */
+export declare const SECRET_LIKE_NAME: RegExp;
+/** A Worker app binding, secret or var name. */
+export declare const WORKER_APP_ENV_NAME: RegExp;
+/** The most tables `database.appendOnly` may name, and the shape of one name (`table` or `schema.table`). */
+export declare const WORKER_APP_APPEND_ONLY_MAX = 100;
+export declare const WORKER_APP_TABLE_NAME: RegExp;
+/** The most functions `database.grants` may name, and the shape of one signature. It is spliced into SQL, so nothing else passes. */
+export declare const WORKER_APP_GRANTS_MAX = 100;
+export declare const WORKER_APP_FUNCTION_SIGNATURE: RegExp;

package/dist/entry-rules.js

@@ -0,0 +1,71 @@
+/**
+ * The shape rules of a hosting entry that both the entry's validation (`org.ts`, `worker-app-config.ts`) and the
+ * app modules (`modules/`) read. Pure: no imports, so `@wtfalch/foundry/modules` can use them in a browser.
+ */
+/** The MCP endpoint path: absolute, plain characters, no dot segments, no query. */
+export const MCP_PATH = /^\/[A-Za-z0-9_~-]+(\/[A-Za-z0-9_~-]+)*$|^\/$/;
+/** `uses.auth.mcp.onboardingPath` and `uses.auth.workspaces.invitePath`: their longest value. */
+export const ONBOARDING_PATH_MAX_LENGTH = 200;
+/**
+ * A page path on the app's own host: starts with one `/`, no `..`, `?`, `#`, `\`, spaces or control characters,
+ * at most {@link ONBOARDING_PATH_MAX_LENGTH} characters.
+ */
+export function isPagePath(value) {
+    return (typeof value === 'string' &&
+        value.startsWith('/') &&
+        !value.startsWith('//') &&
+        !value.includes('..') &&
+        !value.includes('?') &&
+        !value.includes('#') &&
+        !value.includes('\\') &&
+        !/[\s\p{Cc}]/u.test(value) &&
+        value.length <= ONBOARDING_PATH_MAX_LENGTH);
+}
+/** The most roles an entry may offer, as the broker allows. */
+export const WORKSPACE_ROLES_MAX = 20;
+/** A role name is the role's key in the broker's store. */
+export const WORKSPACE_ROLE = /^[a-z][a-z0-9_-]{0,63}$/;
+/** Longest value of each `uses.auth.room` text field. */
+export const ROOM_TEXT_MAX = {
+    name: 40,
+    headline: 120,
+    line: 200,
+    title: 60,
+    description: 200,
+};
+export const ROOM_STEPS_MIN = 2;
+export const ROOM_STEPS_MAX = 9;
+// biome-ignore lint/suspicious/noControlCharactersInRegex: the point is to refuse them
+export const ROOM_UNSAFE_TEXT = /[\u0000-\u001f\u007f<>]/;
+/** What an entry's ai key may hold: the most the org's own key holds. */
+export const AI_ENTRY_PERMISSIONS = ['ai.offerings:invoke', 'ai.runs:create'];
+/** `uses.ai.webhookPath`. */
+export const AI_WEBHOOK_PATH = /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]{0,199}$/;
+/** What an entry's files key may hold: read and write on its collections, and the most the org's own key holds besides minting. */
+export const FILES_ENTRY_PERMISSIONS = [
+    'files.collections:read',
+    'files.files:read',
+    'files.files:download',
+    'files.files:upload',
+    'files.files:replace',
+    'files.files:delete',
+];
+/** A `uses.files.collections` name. */
+export const FILES_COLLECTION_NAME = /^[A-Z][A-Z0-9_]*$/;
+/** The secret that carries a `keysCustody` source: the custody Worker credential. */
+export const WORKER_APP_KEYS_SECRET = 'KEYS_CREDENTIAL';
+/**
+ * Names foundry writes into a Worker app's environment itself, so a
+ * declaration may not use them as a binding, secret or var.
+ */
+export const WORKER_APP_RESERVED_NAMES = /^(AUTH_.*|KEYS_.*|MCP_.*|HYPERDRIVE)$/;
+/** A var name that looks like a secret's. */
+export const SECRET_LIKE_NAME = /_(KEY|SECRET|TOKEN|PASSWORD)$/;
+/** A Worker app binding, secret or var name. */
+export const WORKER_APP_ENV_NAME = /^[A-Z][A-Z0-9_]{0,63}$/;
+/** The most tables `database.appendOnly` may name, and the shape of one name (`table` or `schema.table`). */
+export const WORKER_APP_APPEND_ONLY_MAX = 100;
+export const WORKER_APP_TABLE_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,62}(\.[A-Za-z_][A-Za-z0-9_]{0,62})?$/;
+/** The most functions `database.grants` may name, and the shape of one signature. It is spliced into SQL, so nothing else passes. */
+export const WORKER_APP_GRANTS_MAX = 100;
+export const WORKER_APP_FUNCTION_SIGNATURE = /^[A-Za-z_][A-Za-z0-9_]{0,62}(\.[A-Za-z_][A-Za-z0-9_]{0,62})?\(([a-z][a-z0-9_]*( [a-z][a-z0-9_]*)?(, [a-z][a-z0-9_]*( [a-z][a-z0-9_]*)?)*)?\)$/;

package/dist/hosted-label.d.ts

@@ -0,0 +1,13 @@
+export type HostedLabelRefusal = {
+    code: 'invalid' | 'barred' | 'locked';
+    message: string;
+};
+/** The first-label prefix of every workspace host (`work-<slug>-<key>`). */
+export declare const WORKSPACE_HOST_PREFIX = "work-";
+/** The first-label prefix of every test inbox host (`inbox-<slug>`). */
+export declare const INBOX_HOST_PREFIX = "inbox-";
+/**
+ * Why `label` may not be the first label of an app address (`<label>.companyincluded.app`), or `null`
+ * when it may. The message is for a person: it never repeats a refused word back.
+ */
+export declare function hostedLabelRefusal(label: string): HostedLabelRefusal | null;

package/dist/hosted-label.js

@@ -0,0 +1,81 @@
+import { checkName } from '@wtfalch/auth/names';
+import { FOUNDRY_SERVICE_LABELS } from './service-labels.js';
+import { RESERVED_SLUGS, RESERVED_SLUG_PREFIX, hasBarredSlugSuffix } from './slug.js';
+/** The first-label prefix of every workspace host (`work-<slug>-<key>`). */
+export const WORKSPACE_HOST_PREFIX = 'work-';
+/** The first-label prefix of every test inbox host (`inbox-<slug>`). */
+export const INBOX_HOST_PREFIX = 'inbox-';
+const DNS_LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+/** Words that make a name look like a bank, a sign-in page or a big brand. Matched as whole dash-separated words. */
+const LOOKALIKE_WORDS = [
+    'bank',
+    'login',
+    'signin',
+    'sign-in',
+    'password',
+    'vipps',
+    'bankid',
+    'paypal',
+    'apple',
+    'google',
+    'microsoft',
+    'support',
+    'secure',
+    'verify',
+    'wallet',
+];
+/**
+ * The auth name check with its length and letter rules loosened: only its profanity verdict (`disallowed`) applies
+ * to a label. Its `reserved` verdict is not used: `@wtfalch/auth/names` merges the generic reserved-usernames list
+ * (`shop`, `blog`, ...) with the system names and does not export them apart.
+ */
+const ANY_TEXT = { minLength: 0, maxLength: Number.MAX_SAFE_INTEGER, pattern: /^/ };
+function containsWord(label, word) {
+    return `-${label}-`.includes(`-${word}-`);
+}
+/**
+ * Why `label` may not be the first label of an app address (`<label>.companyincluded.app`), or `null`
+ * when it may. The message is for a person: it never repeats a refused word back.
+ */
+export function hostedLabelRefusal(label) {
+    if (!DNS_LABEL.test(label) || label.slice(2, 4) === '--') {
+        return {
+            code: 'invalid',
+            message: 'An app address can use only lowercase letters, numbers and dashes, from 1 to 63 characters. It cannot start or end with a dash, or have two dashes in a row after the second character.',
+        };
+    }
+    if (LOOKALIKE_WORDS.some((word) => containsWord(label, word))) {
+        return {
+            code: 'barred',
+            message: 'That address could be mistaken for a bank, a sign-in page or a well-known company. Choose a name that is clearly your own.',
+        };
+    }
+    if (FOUNDRY_SERVICE_LABELS.has(label) ||
+        RESERVED_SLUGS.has(label) ||
+        label.startsWith(RESERVED_SLUG_PREFIX)) {
+        return {
+            code: 'locked',
+            message: 'That address is used by the platform itself. Choose a different one.',
+        };
+    }
+    if (label.startsWith(WORKSPACE_HOST_PREFIX) || label.startsWith(INBOX_HOST_PREFIX)) {
+        return {
+            code: 'barred',
+            message: 'App addresses cannot start with work- or inbox-. Those names are kept for private workspaces and test inboxes. Choose a different one.',
+        };
+    }
+    if (hasBarredSlugSuffix(label)) {
+        return {
+            code: 'barred',
+            message: 'That address ends in a word the platform keeps for its own addresses, such as stage, calls or auth. Choose a different ending.',
+        };
+    }
+    const verdict = checkName(label, ANY_TEXT);
+    if (!verdict.ok && verdict.reason === 'disallowed') {
+        return {
+            code: 'barred',
+            message: 'That address is not allowed. Choose a different one.',
+        };
+    }
+    return null;
+}