@ima-jin/config 0.8.0 → 0.8.15

package/src/index.ts

@@ -1,5 +1,8 @@
 export { isAllowedOrigin, corsHeaders, corsOptions, withCors, validateOrigin, ALLOWED_FRAME_ORIGINS } from "./cors";
+export { standaloneDashboardMiddleware } from "./dashboard-redirect-middleware";
+export type { StandaloneDashboardMiddlewareOptions } from "./dashboard-redirect-middleware";
 export { tier1Headers, tier2Headers, tier3Headers } from './security-headers';
+export { APP_DISPLAY_NAME } from './brand';
 
 export {
   SERVICES,
@@ -31,6 +34,14 @@ export { apiFetch, apiUrl } from "./base-path";
 
 export { rateLimit, getClientIP } from "./rate-limit";
 
+export { getNodeSelf } from "./node-self";
+export type { NodeSelfInfo } from "./node-self";
+
+export { registryServiceUrl, hasRegistryServiceUrl } from "./registry-service-url";
+
+export { getForestScopeConfig } from "./forest-config";
+export type { ForestScopeConfig } from "./forest-config";
+
 export {
   HANDLE_PATTERN,
   HANDLE_INPUT_PATTERN,

package/src/node-self.ts

@@ -0,0 +1,45 @@
+import { registryServiceUrl } from './registry-service-url';
+
+/**
+ * Minimal public node metadata returned by GET /registry/api/node/self.
+ * Mirrors the subset of `relay.relay_config` the registry service exposes
+ * publicly — never the private config (profile artifact JWS, etc).
+ */
+export interface NodeSelfInfo {
+  /** This node's own DID (did:imajin:...). */
+  did: string;
+  /** DID of the human/entity operating this node, if configured. */
+  nodeOperatorDid: string | null;
+  /** Node fee, in basis points, applied to .fair settlements on this node. */
+  nodeFeeBps: number | null;
+  /** Buyer credit, in basis points, applied to .fair settlements on this node. */
+  buyerCreditBps: number | null;
+}
+
+/**
+ * Fetch this node's public identity + .fair fee config from the registry
+ * service (`GET /registry/api/node/self`, #2000).
+ *
+ * Replaces raw `relay.relay_config` SQL reads that were duplicated across
+ * coffee, learn, events, and market (audit item 8 of #1983). Returns null on
+ * any failure — network error, non-2xx response (e.g. 503 when the node
+ * identity hasn't been bootstrapped yet) — so callers can fall back to
+ * defaults exactly as they did when the raw SQL row was missing. A non-2xx
+ * response is logged with the URL actually hit (no secrets) so a
+ * misconfigured REGISTRY_SERVICE_URL prefix is visible instead of failing
+ * silently (#2046).
+ */
+export async function getNodeSelf(): Promise<NodeSelfInfo | null> {
+  const url = `${registryServiceUrl()}/api/node/self`;
+  try {
+    const res = await fetch(url);
+    if (!res.ok) {
+      console.warn(`[config] getNodeSelf: registry returned ${res.status} for ${url} — check REGISTRY_SERVICE_URL`);
+      return null;
+    }
+    return (await res.json()) as NodeSelfInfo;
+  } catch (err) {
+    console.warn(`[config] getNodeSelf: fetch failed for ${url} — ${err instanceof Error ? err.message : String(err)}`);
+    return null;
+  }
+}

package/src/registry-service-url.ts

@@ -0,0 +1,54 @@
+/**
+ * Single resolver for the registry service's base URL (#2061 — kernel was
+ * the last `REGISTRY_URL` holdout after #2048 established the
+ * `*_SERVICE_URL` convention).
+ *
+ * The returned value always includes the `/registry` path prefix, like
+ * every other `*_SERVICE_URL` (#2046) — callers append only the endpoint
+ * path (e.g. `/api/node/self`, `/relay/operations`).
+ *
+ * Precedence:
+ *   1. `REGISTRY_SERVICE_URL` — the current convention.
+ *   2. `REGISTRY_URL` — deprecated kernel-only legacy name. Used if set,
+ *      but logs a one-time deprecation warning per process.
+ *   3. `http://localhost:${PORT || 3000}/registry` — the mode-aware
+ *      fallback (PORT is 3000 in dev, 7000 in prod) that
+ *      `relay-well-known.ts` already used before this consolidation.
+ */
+
+let warnedAboutLegacyRegistryUrl = false;
+
+export function registryServiceUrl(): string {
+  if (process.env.REGISTRY_SERVICE_URL) return process.env.REGISTRY_SERVICE_URL;
+
+  if (process.env.REGISTRY_URL) {
+    if (!warnedAboutLegacyRegistryUrl) {
+      console.warn('REGISTRY_URL is deprecated — set REGISTRY_SERVICE_URL');
+      warnedAboutLegacyRegistryUrl = true;
+    }
+    return process.env.REGISTRY_URL;
+  }
+
+  return `http://localhost:${process.env.PORT || 3000}/registry`;
+}
+
+/**
+ * True when the registry URL is explicitly configured via either the
+ * current (`REGISTRY_SERVICE_URL`) or deprecated (`REGISTRY_URL`) env var.
+ *
+ * `registryServiceUrl()` always returns a value (it falls back to a
+ * localhost guess), so callers that previously guarded on
+ * `!process.env.REGISTRY_URL` to skip/no-op when the registry isn't
+ * configured should check this instead.
+ */
+export function hasRegistryServiceUrl(): boolean {
+  return Boolean(process.env.REGISTRY_SERVICE_URL || process.env.REGISTRY_URL);
+}
+
+/**
+ * Test-only: resets the one-time deprecation warning latch so each test
+ * can assert the warning fires exactly once for its own scenario.
+ */
+export function __resetRegistryServiceUrlWarningForTests(): void {
+  warnedAboutLegacyRegistryUrl = false;
+}

package/src/services.ts

@@ -1,7 +1,17 @@
 /**
- * Canonical service manifest — single source of truth for all Imajin services.
+ * Canonical service manifest — infra/build-time topology for all Imajin
+ * services (dev/prod ports, Postgres schema, deployment tier, Caddy/pm2
+ * routing, docs sync, `/registry/api/specs`). These consumers run without a
+ * live identity/DB context (build scripts, edge config, port-based
+ * routing), so this stays a static, synchronously-importable array.
  *
- * Consumers: registry specs, Caddy config, pm2 ecosystem, docs sync, shared nav.
+ * NOT the nav authority (#2425): which apps an authenticated identity sees
+ * in the kernel hub (auth submenu, launcher, home tiles) is now derived
+ * from `registry.apps` (#1990) via `apps/kernel/src/lib/kernel/app-nav.ts`,
+ * not from this file — a disabled/pruned app disappears from nav by
+ * flipping registry state, independent of whether it still has a row here
+ * for port/Caddy purposes. Consumers: registry specs, Caddy config, pm2
+ * ecosystem, docs sync.
  */
 
 export type ServiceTier = "core" | "imajin";
@@ -46,6 +56,11 @@ export const SERVICES: readonly ServiceDefinition[] = [
   { name: "media",       label: "Media",       icon: "📁", description: "Files, images, and .fair attribution",               devPort: 3000, prodPort: 7000, schema: "media",       tier: "core",   visibility: "authenticated", category: "kernel" },
   { name: "registry",    label: "Registry",    icon: "📡", description: "Service registry and DFOS relay",                    devPort: 3000, prodPort: 7000, schema: "registry",    tier: "core",   visibility: "public",        category: "kernel" },
   { name: "notify",      label: "Notify",      icon: "🔔", description: "Notifications and preferences",                     devPort: 3000, prodPort: 7000, schema: "notify",      tier: "core",   visibility: "internal",      category: "kernel" },
+  { name: "usage",       label: "Usage",       icon: "📊", description: "Inference cost ledger — incurred, billed, drift, signed rollup", devPort: 3000, prodPort: 7000, schema: "usage",       tier: "core",   visibility: "authenticated", category: "kernel" },
+  { name: "calendar",    label: "Calendar",    icon: "📅", description: "Temporal entries — availability, meetings, events, and reminders", devPort: 3000, prodPort: 7000, schema: null,          tier: "core",   visibility: "authenticated", category: "kernel" },
+  { name: "jin",         label: "Jin",         icon: "🧭", description: "Operator dashboard — signed approvals, proposals, and usage feed",  devPort: 3000, prodPort: 7000, schema: "operator",    tier: "core",   visibility: "internal",      category: "kernel" },
+  { name: "google",      label: "Google Workspace", icon: "📨", description: "Gmail/Calendar/Drive/Meet connector — OAuth2 auth-code, sealed refresh token", devPort: 3000, prodPort: 7000, schema: null,          tier: "core",   visibility: "authenticated", category: "kernel" },
+  { name: "vault",       label: "Vault",       icon: "🔐", description: "Sealed secrets, delegation grants, and vault-minted service credentials", devPort: 3000, prodPort: 7000, schema: null,          tier: "core",   visibility: "internal",      category: "kernel" },
 
   // Core apps — separate processes
   { name: "events",      label: "Events",      icon: "🎫", description: "Event creation, ticketing, and management",         devPort: 3006, prodPort: 7006, schema: "events",      tier: "core",   visibility: "public",        category: "core" },
@@ -64,6 +79,7 @@ export const SERVICES: readonly ServiceDefinition[] = [
 
   // Daemon processes — not web apps, no HTTP port exposed
   { name: 'broker-agent', label: 'Broker Agent', icon: '🤖', description: 'Telegram broker agent — conversational surface for social coordination (#1101)', devPort: 0, prodPort: 0, schema: null, tier: 'core', visibility: 'internal', category: 'infrastructure' },
+  { name: 'corpus',       label: 'Corpus',       icon: '🔎', description: 'Per-DID corpus indexing and BM25 search service (#1737)',                    devPort: 8013, prodPort: 8013, schema: null, tier: 'core', visibility: 'internal', category: 'infrastructure' },
 
   // Connected apps (separate repos) will use the plugin architecture (#249).
   // Not included here — they authenticate via delegated sessions, not the monorepo manifest.

package/src/session.ts

@@ -27,15 +27,42 @@ function isLocalhost(): boolean {
   return prefix.includes("localhost");
 }
 
+/**
+ * Cookie domain scope (#1069 Phase 1).
+ *
+ * `SESSION_COOKIE_SCOPE` controls whether the deployed session cookie is a
+ * shared parent-domain cookie or a host-only cookie:
+ *   - unset / "domain" (default): current behavior — `domain: ".imajin.ai"`,
+ *     readable by every `*.imajin.ai` subdomain. Nothing changes unless this
+ *     is explicitly set.
+ *   - "host": omit the `domain` attribute entirely, so the cookie is scoped
+ *     to the exact host that set it and is NOT sent to other subdomains.
+ *     Apps that relied on reading the shared cookie must adopt scoped app
+ *     tokens first (see `requireSessionOrAppToken` in `@ima-jin/auth` and
+ *     `docs/security/cookie-isolation.md`) before this is flipped for real.
+ *
+ * This flag is a primitive for the staged rollout described in
+ * `docs/security/cookie-isolation.md` — flipping it is a separate, later
+ * phase, not part of shipping the primitive itself.
+ */
+function isHostScoped(): boolean {
+  if (typeof process === "undefined") return false;
+  return process.env.SESSION_COOKIE_SCOPE === "host";
+}
+
 /** Cookie options for cross-subdomain sessions.
  *  When called with no argument, auto-detects from IMAJIN_ENV (same logic as getSessionCookieName).
  *  Accepts optional "dev" | "prod" override for explicit control.
  *
  *  Localhost-aware: when SERVICE_PREFIX contains "localhost", uses
  *  settings compatible with HTTP on localhost (no domain, not secure, lax sameSite).
+ *
+ *  See {@link isHostScoped} for the `SESSION_COOKIE_SCOPE=host` opt-in that
+ *  narrows the deployed cookie to host-only instead of `.imajin.ai`.
  */
 export function getSessionCookieOptions(env?: "dev" | "prod") {
   const local = isLocalhost();
+  const omitDomain = local || isHostScoped();
   return {
     name: getSessionCookieName(env),
     options: {
@@ -43,7 +70,7 @@ export function getSessionCookieOptions(env?: "dev" | "prod") {
       secure: !local,
       sameSite: local ? ("lax" as const) : ("none" as const),
       path: "/",
-      ...(local ? {} : { domain: ".imajin.ai" }),
+      ...(omitDomain ? {} : { domain: ".imajin.ai" }),
       maxAge: 60 * 60 * 24, // 24 hours
     },
   };