multica/packages/core/paths/reserved-slugs.ts

// AUTO-GENERATED by scripts/generate-reserved-slugs.mjs.
// Do not edit by hand — edit server/internal/handler/reserved_slugs.json
// and run `pnpm generate:reserved-slugs`.

/**
 * Slugs reserved because they collide with frontend top-level routes,
 * platform features, or web standards.
 *
 * Single source of truth: `server/internal/handler/reserved_slugs.json`.
 * The Go backend embeds that JSON; this file is regenerated from it.
 *
 * Convention for new global routes (CLAUDE.md): use a single word
 * (`/login`, `/inbox`) or `/{noun}/{verb}` (`/workspaces/new`). Hyphenated
 * root-level word groups (`/new-workspace`, `/create-team`) collide with
 * common user workspace names — see PR for full discussion.
 */
export const RESERVED_SLUGS: ReadonlySet<string> = new Set([
  // Auth flow
  // `onboarding` is historical, kept reserved post-removal of the route.
  "login",
  "logout",
  "signin",
  "signout",
  "signup",
  "auth",
  "oauth",
  "callback",
  "invite",
  "invitations",
  "verify",
  "reset",
  "password",
  "onboarding",

  // Platform / marketing routes (current + likely-future)
  // `multica` is reserved as the brand name to block impersonation workspaces.
  // `www`, `new`, `home`, `homepage`, `dashboard` are confusables or
  // likely-future global landing/entry routes; `homepage` matches the existing
  // `/homepage` landing variant in apps/web.
  "api",
  "admin",
  "multica",
  "www",
  "new",
  "home",
  "homepage",
  "dashboard",
  "help",
  "about",
  "pricing",
  "changelog",
  "docs",
  "support",
  "status",
  "legal",
  "privacy",
  "terms",
  "security",
  "contact",
  "blog",
  "careers",
  "press",
  "download",

  // Account / billing (likely-future global routes in the avatar menu)
  "profile",
  "account",
  "billing",
  "notifications",
  "search",
  "members",

  // Workspace route segments
  // Reserving each segment name prevents `/{slug}/{view}` from being visually
  // ambiguous (e.g. a workspace named `issues` would make `/issues/abc` mean two
  // things). `workspaces` covers the global `/workspaces/new` workspace-creation
  // page; `teams` is reserved for future team management.
  "issues",
  "projects",
  "autopilots",
  "agents",
  "squads",
  "inbox",
  "my-issues",
  "usage",
  "runtimes",
  "skills",
  "settings",
  "workspaces",
  "teams",

  // API / integration prefixes
  // `api` above already covers `/api/*`; these guard against future top-level
  // API alias routes (e.g. `/v1`, `/graphql`) and against accidental workspace
  // slugs that read like API identifiers.
  "v1",
  "v2",
  "graphql",
  "webhooks",
  "sdk",
  "tokens",
  "cli",

  // Backend ops / observability
  // `/health`, `/readyz`, `/healthz`, and `/ws` exist on the backend host;
  // reserving them on the workspace slug space prevents naming confusion if/when
  // these paths are ever proxied through the web origin.
  "health",
  "readyz",
  "healthz",
  "ws",
  "metrics",
  "ping",

  // RFC 2142 — privileged email mailboxes
  // Allowing user workspaces with these slugs would let attackers spoof system
  // messaging.
  "postmaster",
  "abuse",
  "noreply",
  "webmaster",
  "hostmaster",

  // Hostname / subdomain confusables
  // Even on path-based routing these names attract phishing and
  // subdomain-takeover attempts.
  "mail",
  "ftp",
  "static",
  "cdn",
  "assets",
  "public",
  "files",
  "uploads",

  // Next.js / web standards
  // These entries contain characters (dots, underscores) that today's slug regex
  // `^[a-z0-9]+(?:-[a-z0-9]+)*$` already rejects at the format-validation step —
  // so `isReservedSlug` never actually matches them. They are kept as
  // defense-in-depth so that if the slug regex is ever relaxed (e.g. to support
  // dotted corporate slugs like `acme.io`), these system paths stay protected.
  "_next",
  "favicon.ico",
  "robots.txt",
  "sitemap.xml",
  "manifest.json",
  ".well-known",
]);

export function isReservedSlug(slug: string): boolean {
  return RESERVED_SLUGS.has(slug);
}