@ima-jin/config 0.8.22 → 0.8.24

package/dist/index.cjs

@@ -26,6 +26,7 @@ __export(index_exports, {
   HANDLE_ERROR: () => HANDLE_ERROR,
   HANDLE_INPUT_PATTERN: () => HANDLE_INPUT_PATTERN,
   HANDLE_PATTERN: () => HANDLE_PATTERN,
+  IDENTITY_CATEGORIES: () => IDENTITY_CATEGORIES,
   RESERVED_HANDLES: () => RESERVED_HANDLES,
   SERVICES: () => SERVICES,
   SERVICE_NAMES: () => SERVICE_NAMES,
@@ -210,17 +211,14 @@ var SERVICES = [
   { name: "media", label: "Media", icon: "\u{1F4C1}", description: "Files, images, and .fair attribution", devPort: 3e3, prodPort: 7e3, schema: "media", tier: "core", visibility: "authenticated", category: "kernel" },
   { name: "registry", label: "Registry", icon: "\u{1F4E1}", description: "Service registry and DFOS relay", devPort: 3e3, prodPort: 7e3, schema: "registry", tier: "core", visibility: "public", category: "kernel" },
   { name: "notify", label: "Notify", icon: "\u{1F514}", description: "Notifications and preferences", devPort: 3e3, prodPort: 7e3, schema: "notify", tier: "core", visibility: "internal", category: "kernel" },
-  { name: "usage", label: "Usage", icon: "\u{1F4CA}", description: "Inference cost ledger \u2014 incurred, billed, drift, signed rollup", devPort: 3e3, prodPort: 7e3, schema: "usage", tier: "core", visibility: "authenticated", category: "kernel" },
-  { name: "calendar", label: "Calendar", icon: "\u{1F4C5}", description: "Temporal entries \u2014 availability, meetings, events, and reminders", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "authenticated", category: "kernel" },
+  { name: "usage", label: "Usage", icon: "\u{1F4CA}", description: "Inference cost ledger \u2014 incurred, billed, drift, signed rollup", devPort: 3e3, prodPort: 7e3, schema: "usage", tier: "core", visibility: "internal", category: "kernel" },
+  { name: "calendar", label: "Calendar", icon: "\u{1F4C5}", description: "Temporal entries \u2014 availability, meetings, events, and reminders", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "internal", category: "kernel" },
   { name: "jin", label: "Jin", icon: "\u{1F9ED}", description: "Operator dashboard \u2014 signed approvals, proposals, and usage feed", devPort: 3e3, prodPort: 7e3, schema: "operator", tier: "core", visibility: "internal", category: "kernel" },
-  { name: "google", label: "Google Workspace", icon: "\u{1F4E8}", description: "Gmail/Calendar/Drive/Meet connector \u2014 OAuth2 auth-code, sealed refresh token", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "authenticated", category: "kernel" },
+  { name: "google", label: "Google Workspace", icon: "\u{1F4E8}", description: "Gmail/Calendar/Drive/Meet connector \u2014 OAuth2 auth-code, sealed refresh token", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "internal", category: "kernel" },
   { name: "vault", label: "Vault", icon: "\u{1F510}", description: "Sealed secrets, delegation grants, and vault-minted service credentials", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "internal", category: "kernel" },
-  // Core apps — separate processes
+  // Standalone URL/port contracts for non-nav callers (health probes,
+  // buildPublicUrlAbsolute, check-env). Registry placements decide nav.
   { name: "events", label: "Events", icon: "\u{1F3AB}", description: "Event creation, ticketing, and management", devPort: 3006, prodPort: 7006, schema: "events", tier: "core", visibility: "public", category: "core" },
-  // Imajin apps
-  { name: "coffee", label: "Coffee", icon: "\u2615", description: "Tipping and creator support pages", devPort: 3100, prodPort: 7100, schema: "coffee", tier: "imajin", visibility: "creator", category: "creator" },
-  { name: "dykil", label: "Surveys", icon: "\u{1F4CB}", description: "Surveys and do-you-know-if-I-like polls", devPort: 3101, prodPort: 7101, schema: "dykil", tier: "imajin", visibility: "creator", category: "creator" },
-  { name: "links", label: "Links", icon: "\u{1F517}", description: "Link-in-bio pages and click tracking", devPort: 3102, prodPort: 7102, schema: "links", tier: "imajin", visibility: "creator", category: "creator" },
   { name: "learn", label: "Learn", icon: "\u{1F4DA}", description: "Courses, lessons, and learning progress", devPort: 3103, prodPort: 7103, schema: "learn", tier: "imajin", visibility: "public", category: "core" },
   { name: "market", label: "Market", icon: "\u{1F3EA}", description: "Local commerce \u2014 buy and sell with trust", devPort: 3104, prodPort: 7104, schema: "market", tier: "imajin", visibility: "public", category: "core" },
   // Meta — project info and external resources surfaced in the launcher
@@ -355,6 +353,25 @@ function tier3Headers() {
 // src/brand.ts
 var APP_DISPLAY_NAME = "imajin (\u03B1)";
 
+// src/identity-categories.ts
+var IDENTITY_CATEGORIES = [
+  "caf\xE9",
+  "restaurant",
+  "shop",
+  "venue",
+  "studio",
+  "bar",
+  "gallery",
+  "gym",
+  "contractor",
+  "trades",
+  "professional services",
+  "health",
+  "education",
+  "technology",
+  "nonprofit"
+];
+
 // src/session.ts
 function getSessionCookieName(env) {
   const resolved = env ?? (typeof process !== "undefined" && (process.env.IMAJIN_ENV === "dev" || process.env.NODE_ENV === "development") ? "dev" : "prod");
@@ -367,8 +384,7 @@ function isLocalhost() {
   return prefix.includes("localhost");
 }
 function isHostScoped() {
-  if (typeof process === "undefined") return false;
-  return process.env.SESSION_COOKIE_SCOPE === "host";
+  return typeof process === "undefined" || process.env.SESSION_COOKIE_SCOPE !== "domain";
 }
 function getSessionCookieOptions(env) {
   const local = isLocalhost();
@@ -649,6 +665,7 @@ var notifySettingsPath = () => `/notify/settings`;
   HANDLE_ERROR,
   HANDLE_INPUT_PATTERN,
   HANDLE_PATTERN,
+  IDENTITY_CATEGORIES,
   RESERVED_HANDLES,
   SERVICES,
   SERVICE_NAMES,

package/dist/index.d.cts

@@ -80,6 +80,14 @@ declare function tier3Headers(): HeaderEntry[];
  */
 declare const APP_DISPLAY_NAME = "imajin (\u03B1)";
 
+/**
+ * Shared organization/place category taxonomy.
+ * Values are persisted in profile metadata: keep existing spellings stable,
+ * especially `café`, and extend this vocabulary rather than individual pickers.
+ * This is a suggestion vocabulary, not a validator for historical custom values.
+ */
+declare const IDENTITY_CATEGORIES: readonly ["café", "restaurant", "shop", "venue", "studio", "bar", "gallery", "gym", "contractor", "trades", "professional services", "health", "education", "technology", "nonprofit"];
+
 /**
  * Canonical service manifest — infra/build-time topology for all Imajin
  * services (dev/prod ports, Postgres schema, deployment tier, Caddy/pm2
@@ -188,15 +196,14 @@ declare function buildServiceUrlMap(env: Record<string, string | undefined>, mod
 declare function getSessionCookieName(env?: "dev" | "prod"): string;
 /** Default cookie name — resolves at import time based on environment */
 declare const SESSION_COOKIE_NAME: string;
-/** Cookie options for cross-subdomain sessions.
+/** Cookie options for host-only sessions (with explicit domain rollback).
  *  When called with no argument, auto-detects from IMAJIN_ENV (same logic as getSessionCookieName).
  *  Accepts optional "dev" | "prod" override for explicit control.
  *
  *  Localhost-aware: when SERVICE_PREFIX contains "localhost", uses
  *  settings compatible with HTTP on localhost (no domain, not secure, lax sameSite).
  *
- *  See {@link isHostScoped} for the `SESSION_COOKIE_SCOPE=host` opt-in that
- *  narrows the deployed cookie to host-only instead of `.imajin.ai`.
+ *  `SESSION_COOKIE_SCOPE=domain` restores the deployed parent-domain cookie.
  */
 declare function getSessionCookieOptions(env?: "dev" | "prod"): {
     name: string;
@@ -481,4 +488,4 @@ declare const projectPath: () => string;
 declare const notifyPath: () => string;
 declare const notifySettingsPath: () => string;
 
-export { ALLOWED_FRAME_ORIGINS, APP_DISPLAY_NAME, type ForestScopeConfig, HANDLE_ALLOWED_CHARS, HANDLE_ERROR, HANDLE_INPUT_PATTERN, HANDLE_PATTERN, type NodeSelfInfo, RESERVED_HANDLES, SERVICES, SERVICE_NAMES, SESSION_COOKIE_NAME, type ServiceCategory, type ServiceDefinition, type ServiceTier, type ServiceVisibility, type StandaloneDashboardMiddlewareOptions, apiFetch, apiUrl, articleAuthorPath, articlePath, articlesPath, authAgentsPath, authAppsPath, authAttestationsPath, authAuthorizePath, authDeveloperAppPath, authDeveloperAppsPath, authGroupSettingsPath, authGroupsPath, authLoginPath, authMembersPath, authNewGroupPath, authNewStubPath, authNotificationsPath, authOnboardPath, authRegisterPath, authSecurityPath, authSettingsPath, authStubsPath, bugsAdminPath, bugsPath, buildPath, buildPublicUrl, buildPublicUrlAbsolute, buildServiceUrlMap, bumpPath, chatConversationPath, chatConversationsPath, chatPath, coffeeDashboardPath, coffeeEditPath, coffeeHandlePath, coffeeSuccessPath, connectionsInvitePath, connectionsPath, connectionsPodPath, corsHeaders, corsOptions, developerGuidePath, docsPath, dykilCreatePath, dykilDashboardPath, dykilEmbedPath, dykilHandlePath, dykilResultsPath, dykilSurveyPath, eventAdminPath, eventCheckoutSuccessPath, eventEditPath, eventEditUrl, eventMyTicketsPath, eventMyTicketsUrl, eventPath, eventRegisterPath, eventRegisterUrl, eventUrl, eventsAdminListPath, eventsCheckoutSuccessPath, eventsCreatePath, eventsDashboardPath, getClientIP, getForestScopeConfig, getNodeSelf, getPort, getPublicUrl, getService, getServiceUrl, getSessionCookieName, getSessionCookieOptions, hasRegistryServiceUrl, healthPath, isAllowedOrigin, isReservedHandle, isValidHandle, learnCourseDashboardPath, learnCourseLessonPath, learnCoursePath, learnCoursePresentPath, learnCourseStudentsPath, learnDashboardPath, learnHandlePath, linksDashboardPath, linksEditPath, linksHandlePath, marketCheckoutSuccessPath, marketDashboardPath, marketListingEditPath, marketListingPath, marketNewListingPath, marketSellerPath, marketSettingsPath, mediaPath, normalizeHandleInput, notifyPath, notifySettingsPath, payHistoryPath, payPath, payTopupPath, payTopupSuccessPath, privacyPath, profileEditPath, profileLoginPath, profilePath, profileRegisterPath, profileUrl, projectPath, rateLimit, registryDocsPath, registryPath, registryServiceUrl, servicesByTier, servicesByVisibility, standaloneDashboardMiddleware, subscribePath, tier1Headers, tier2Headers, tier3Headers, validateOrigin, whitepaperPath, withCors };
+export { ALLOWED_FRAME_ORIGINS, APP_DISPLAY_NAME, type ForestScopeConfig, HANDLE_ALLOWED_CHARS, HANDLE_ERROR, HANDLE_INPUT_PATTERN, HANDLE_PATTERN, IDENTITY_CATEGORIES, type NodeSelfInfo, RESERVED_HANDLES, SERVICES, SERVICE_NAMES, SESSION_COOKIE_NAME, type ServiceCategory, type ServiceDefinition, type ServiceTier, type ServiceVisibility, type StandaloneDashboardMiddlewareOptions, apiFetch, apiUrl, articleAuthorPath, articlePath, articlesPath, authAgentsPath, authAppsPath, authAttestationsPath, authAuthorizePath, authDeveloperAppPath, authDeveloperAppsPath, authGroupSettingsPath, authGroupsPath, authLoginPath, authMembersPath, authNewGroupPath, authNewStubPath, authNotificationsPath, authOnboardPath, authRegisterPath, authSecurityPath, authSettingsPath, authStubsPath, bugsAdminPath, bugsPath, buildPath, buildPublicUrl, buildPublicUrlAbsolute, buildServiceUrlMap, bumpPath, chatConversationPath, chatConversationsPath, chatPath, coffeeDashboardPath, coffeeEditPath, coffeeHandlePath, coffeeSuccessPath, connectionsInvitePath, connectionsPath, connectionsPodPath, corsHeaders, corsOptions, developerGuidePath, docsPath, dykilCreatePath, dykilDashboardPath, dykilEmbedPath, dykilHandlePath, dykilResultsPath, dykilSurveyPath, eventAdminPath, eventCheckoutSuccessPath, eventEditPath, eventEditUrl, eventMyTicketsPath, eventMyTicketsUrl, eventPath, eventRegisterPath, eventRegisterUrl, eventUrl, eventsAdminListPath, eventsCheckoutSuccessPath, eventsCreatePath, eventsDashboardPath, getClientIP, getForestScopeConfig, getNodeSelf, getPort, getPublicUrl, getService, getServiceUrl, getSessionCookieName, getSessionCookieOptions, hasRegistryServiceUrl, healthPath, isAllowedOrigin, isReservedHandle, isValidHandle, learnCourseDashboardPath, learnCourseLessonPath, learnCoursePath, learnCoursePresentPath, learnCourseStudentsPath, learnDashboardPath, learnHandlePath, linksDashboardPath, linksEditPath, linksHandlePath, marketCheckoutSuccessPath, marketDashboardPath, marketListingEditPath, marketListingPath, marketNewListingPath, marketSellerPath, marketSettingsPath, mediaPath, normalizeHandleInput, notifyPath, notifySettingsPath, payHistoryPath, payPath, payTopupPath, payTopupSuccessPath, privacyPath, profileEditPath, profileLoginPath, profilePath, profileRegisterPath, profileUrl, projectPath, rateLimit, registryDocsPath, registryPath, registryServiceUrl, servicesByTier, servicesByVisibility, standaloneDashboardMiddleware, subscribePath, tier1Headers, tier2Headers, tier3Headers, validateOrigin, whitepaperPath, withCors };

package/dist/index.d.ts

@@ -80,6 +80,14 @@ declare function tier3Headers(): HeaderEntry[];
  */
 declare const APP_DISPLAY_NAME = "imajin (\u03B1)";
 
+/**
+ * Shared organization/place category taxonomy.
+ * Values are persisted in profile metadata: keep existing spellings stable,
+ * especially `café`, and extend this vocabulary rather than individual pickers.
+ * This is a suggestion vocabulary, not a validator for historical custom values.
+ */
+declare const IDENTITY_CATEGORIES: readonly ["café", "restaurant", "shop", "venue", "studio", "bar", "gallery", "gym", "contractor", "trades", "professional services", "health", "education", "technology", "nonprofit"];
+
 /**
  * Canonical service manifest — infra/build-time topology for all Imajin
  * services (dev/prod ports, Postgres schema, deployment tier, Caddy/pm2
@@ -188,15 +196,14 @@ declare function buildServiceUrlMap(env: Record<string, string | undefined>, mod
 declare function getSessionCookieName(env?: "dev" | "prod"): string;
 /** Default cookie name — resolves at import time based on environment */
 declare const SESSION_COOKIE_NAME: string;
-/** Cookie options for cross-subdomain sessions.
+/** Cookie options for host-only sessions (with explicit domain rollback).
  *  When called with no argument, auto-detects from IMAJIN_ENV (same logic as getSessionCookieName).
  *  Accepts optional "dev" | "prod" override for explicit control.
  *
  *  Localhost-aware: when SERVICE_PREFIX contains "localhost", uses
  *  settings compatible with HTTP on localhost (no domain, not secure, lax sameSite).
  *
- *  See {@link isHostScoped} for the `SESSION_COOKIE_SCOPE=host` opt-in that
- *  narrows the deployed cookie to host-only instead of `.imajin.ai`.
+ *  `SESSION_COOKIE_SCOPE=domain` restores the deployed parent-domain cookie.
  */
 declare function getSessionCookieOptions(env?: "dev" | "prod"): {
     name: string;
@@ -481,4 +488,4 @@ declare const projectPath: () => string;
 declare const notifyPath: () => string;
 declare const notifySettingsPath: () => string;
 
-export { ALLOWED_FRAME_ORIGINS, APP_DISPLAY_NAME, type ForestScopeConfig, HANDLE_ALLOWED_CHARS, HANDLE_ERROR, HANDLE_INPUT_PATTERN, HANDLE_PATTERN, type NodeSelfInfo, RESERVED_HANDLES, SERVICES, SERVICE_NAMES, SESSION_COOKIE_NAME, type ServiceCategory, type ServiceDefinition, type ServiceTier, type ServiceVisibility, type StandaloneDashboardMiddlewareOptions, apiFetch, apiUrl, articleAuthorPath, articlePath, articlesPath, authAgentsPath, authAppsPath, authAttestationsPath, authAuthorizePath, authDeveloperAppPath, authDeveloperAppsPath, authGroupSettingsPath, authGroupsPath, authLoginPath, authMembersPath, authNewGroupPath, authNewStubPath, authNotificationsPath, authOnboardPath, authRegisterPath, authSecurityPath, authSettingsPath, authStubsPath, bugsAdminPath, bugsPath, buildPath, buildPublicUrl, buildPublicUrlAbsolute, buildServiceUrlMap, bumpPath, chatConversationPath, chatConversationsPath, chatPath, coffeeDashboardPath, coffeeEditPath, coffeeHandlePath, coffeeSuccessPath, connectionsInvitePath, connectionsPath, connectionsPodPath, corsHeaders, corsOptions, developerGuidePath, docsPath, dykilCreatePath, dykilDashboardPath, dykilEmbedPath, dykilHandlePath, dykilResultsPath, dykilSurveyPath, eventAdminPath, eventCheckoutSuccessPath, eventEditPath, eventEditUrl, eventMyTicketsPath, eventMyTicketsUrl, eventPath, eventRegisterPath, eventRegisterUrl, eventUrl, eventsAdminListPath, eventsCheckoutSuccessPath, eventsCreatePath, eventsDashboardPath, getClientIP, getForestScopeConfig, getNodeSelf, getPort, getPublicUrl, getService, getServiceUrl, getSessionCookieName, getSessionCookieOptions, hasRegistryServiceUrl, healthPath, isAllowedOrigin, isReservedHandle, isValidHandle, learnCourseDashboardPath, learnCourseLessonPath, learnCoursePath, learnCoursePresentPath, learnCourseStudentsPath, learnDashboardPath, learnHandlePath, linksDashboardPath, linksEditPath, linksHandlePath, marketCheckoutSuccessPath, marketDashboardPath, marketListingEditPath, marketListingPath, marketNewListingPath, marketSellerPath, marketSettingsPath, mediaPath, normalizeHandleInput, notifyPath, notifySettingsPath, payHistoryPath, payPath, payTopupPath, payTopupSuccessPath, privacyPath, profileEditPath, profileLoginPath, profilePath, profileRegisterPath, profileUrl, projectPath, rateLimit, registryDocsPath, registryPath, registryServiceUrl, servicesByTier, servicesByVisibility, standaloneDashboardMiddleware, subscribePath, tier1Headers, tier2Headers, tier3Headers, validateOrigin, whitepaperPath, withCors };
+export { ALLOWED_FRAME_ORIGINS, APP_DISPLAY_NAME, type ForestScopeConfig, HANDLE_ALLOWED_CHARS, HANDLE_ERROR, HANDLE_INPUT_PATTERN, HANDLE_PATTERN, IDENTITY_CATEGORIES, type NodeSelfInfo, RESERVED_HANDLES, SERVICES, SERVICE_NAMES, SESSION_COOKIE_NAME, type ServiceCategory, type ServiceDefinition, type ServiceTier, type ServiceVisibility, type StandaloneDashboardMiddlewareOptions, apiFetch, apiUrl, articleAuthorPath, articlePath, articlesPath, authAgentsPath, authAppsPath, authAttestationsPath, authAuthorizePath, authDeveloperAppPath, authDeveloperAppsPath, authGroupSettingsPath, authGroupsPath, authLoginPath, authMembersPath, authNewGroupPath, authNewStubPath, authNotificationsPath, authOnboardPath, authRegisterPath, authSecurityPath, authSettingsPath, authStubsPath, bugsAdminPath, bugsPath, buildPath, buildPublicUrl, buildPublicUrlAbsolute, buildServiceUrlMap, bumpPath, chatConversationPath, chatConversationsPath, chatPath, coffeeDashboardPath, coffeeEditPath, coffeeHandlePath, coffeeSuccessPath, connectionsInvitePath, connectionsPath, connectionsPodPath, corsHeaders, corsOptions, developerGuidePath, docsPath, dykilCreatePath, dykilDashboardPath, dykilEmbedPath, dykilHandlePath, dykilResultsPath, dykilSurveyPath, eventAdminPath, eventCheckoutSuccessPath, eventEditPath, eventEditUrl, eventMyTicketsPath, eventMyTicketsUrl, eventPath, eventRegisterPath, eventRegisterUrl, eventUrl, eventsAdminListPath, eventsCheckoutSuccessPath, eventsCreatePath, eventsDashboardPath, getClientIP, getForestScopeConfig, getNodeSelf, getPort, getPublicUrl, getService, getServiceUrl, getSessionCookieName, getSessionCookieOptions, hasRegistryServiceUrl, healthPath, isAllowedOrigin, isReservedHandle, isValidHandle, learnCourseDashboardPath, learnCourseLessonPath, learnCoursePath, learnCoursePresentPath, learnCourseStudentsPath, learnDashboardPath, learnHandlePath, linksDashboardPath, linksEditPath, linksHandlePath, marketCheckoutSuccessPath, marketDashboardPath, marketListingEditPath, marketListingPath, marketNewListingPath, marketSellerPath, marketSettingsPath, mediaPath, normalizeHandleInput, notifyPath, notifySettingsPath, payHistoryPath, payPath, payTopupPath, payTopupSuccessPath, privacyPath, profileEditPath, profileLoginPath, profilePath, profileRegisterPath, profileUrl, projectPath, rateLimit, registryDocsPath, registryPath, registryServiceUrl, servicesByTier, servicesByVisibility, standaloneDashboardMiddleware, subscribePath, tier1Headers, tier2Headers, tier3Headers, validateOrigin, whitepaperPath, withCors };

package/dist/index.js

@@ -51,17 +51,14 @@ var SERVICES = [
   { name: "media", label: "Media", icon: "\u{1F4C1}", description: "Files, images, and .fair attribution", devPort: 3e3, prodPort: 7e3, schema: "media", tier: "core", visibility: "authenticated", category: "kernel" },
   { name: "registry", label: "Registry", icon: "\u{1F4E1}", description: "Service registry and DFOS relay", devPort: 3e3, prodPort: 7e3, schema: "registry", tier: "core", visibility: "public", category: "kernel" },
   { name: "notify", label: "Notify", icon: "\u{1F514}", description: "Notifications and preferences", devPort: 3e3, prodPort: 7e3, schema: "notify", tier: "core", visibility: "internal", category: "kernel" },
-  { name: "usage", label: "Usage", icon: "\u{1F4CA}", description: "Inference cost ledger \u2014 incurred, billed, drift, signed rollup", devPort: 3e3, prodPort: 7e3, schema: "usage", tier: "core", visibility: "authenticated", category: "kernel" },
-  { name: "calendar", label: "Calendar", icon: "\u{1F4C5}", description: "Temporal entries \u2014 availability, meetings, events, and reminders", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "authenticated", category: "kernel" },
+  { name: "usage", label: "Usage", icon: "\u{1F4CA}", description: "Inference cost ledger \u2014 incurred, billed, drift, signed rollup", devPort: 3e3, prodPort: 7e3, schema: "usage", tier: "core", visibility: "internal", category: "kernel" },
+  { name: "calendar", label: "Calendar", icon: "\u{1F4C5}", description: "Temporal entries \u2014 availability, meetings, events, and reminders", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "internal", category: "kernel" },
   { name: "jin", label: "Jin", icon: "\u{1F9ED}", description: "Operator dashboard \u2014 signed approvals, proposals, and usage feed", devPort: 3e3, prodPort: 7e3, schema: "operator", tier: "core", visibility: "internal", category: "kernel" },
-  { name: "google", label: "Google Workspace", icon: "\u{1F4E8}", description: "Gmail/Calendar/Drive/Meet connector \u2014 OAuth2 auth-code, sealed refresh token", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "authenticated", category: "kernel" },
+  { name: "google", label: "Google Workspace", icon: "\u{1F4E8}", description: "Gmail/Calendar/Drive/Meet connector \u2014 OAuth2 auth-code, sealed refresh token", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "internal", category: "kernel" },
   { name: "vault", label: "Vault", icon: "\u{1F510}", description: "Sealed secrets, delegation grants, and vault-minted service credentials", devPort: 3e3, prodPort: 7e3, schema: null, tier: "core", visibility: "internal", category: "kernel" },
-  // Core apps — separate processes
+  // Standalone URL/port contracts for non-nav callers (health probes,
+  // buildPublicUrlAbsolute, check-env). Registry placements decide nav.
   { name: "events", label: "Events", icon: "\u{1F3AB}", description: "Event creation, ticketing, and management", devPort: 3006, prodPort: 7006, schema: "events", tier: "core", visibility: "public", category: "core" },
-  // Imajin apps
-  { name: "coffee", label: "Coffee", icon: "\u2615", description: "Tipping and creator support pages", devPort: 3100, prodPort: 7100, schema: "coffee", tier: "imajin", visibility: "creator", category: "creator" },
-  { name: "dykil", label: "Surveys", icon: "\u{1F4CB}", description: "Surveys and do-you-know-if-I-like polls", devPort: 3101, prodPort: 7101, schema: "dykil", tier: "imajin", visibility: "creator", category: "creator" },
-  { name: "links", label: "Links", icon: "\u{1F517}", description: "Link-in-bio pages and click tracking", devPort: 3102, prodPort: 7102, schema: "links", tier: "imajin", visibility: "creator", category: "creator" },
   { name: "learn", label: "Learn", icon: "\u{1F4DA}", description: "Courses, lessons, and learning progress", devPort: 3103, prodPort: 7103, schema: "learn", tier: "imajin", visibility: "public", category: "core" },
   { name: "market", label: "Market", icon: "\u{1F3EA}", description: "Local commerce \u2014 buy and sell with trust", devPort: 3104, prodPort: 7104, schema: "market", tier: "imajin", visibility: "public", category: "core" },
   // Meta — project info and external resources surfaced in the launcher
@@ -196,6 +193,25 @@ function tier3Headers() {
 // src/brand.ts
 var APP_DISPLAY_NAME = "imajin (\u03B1)";
 
+// src/identity-categories.ts
+var IDENTITY_CATEGORIES = [
+  "caf\xE9",
+  "restaurant",
+  "shop",
+  "venue",
+  "studio",
+  "bar",
+  "gallery",
+  "gym",
+  "contractor",
+  "trades",
+  "professional services",
+  "health",
+  "education",
+  "technology",
+  "nonprofit"
+];
+
 // src/session.ts
 function getSessionCookieName(env) {
   const resolved = env ?? (typeof process !== "undefined" && (process.env.IMAJIN_ENV === "dev" || process.env.NODE_ENV === "development") ? "dev" : "prod");
@@ -208,8 +224,7 @@ function isLocalhost() {
   return prefix.includes("localhost");
 }
 function isHostScoped() {
-  if (typeof process === "undefined") return false;
-  return process.env.SESSION_COOKIE_SCOPE === "host";
+  return typeof process === "undefined" || process.env.SESSION_COOKIE_SCOPE !== "domain";
 }
 function getSessionCookieOptions(env) {
   const local = isLocalhost();
@@ -489,6 +504,7 @@ export {
   HANDLE_ERROR,
   HANDLE_INPUT_PATTERN,
   HANDLE_PATTERN,
+  IDENTITY_CATEGORIES,
   RESERVED_HANDLES,
   SERVICES,
   SERVICE_NAMES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ima-jin/config",
-  "version": "0.8.22",
+  "version": "0.8.24",
   "description": "Shared configuration for Imajin services — CORS, service routing, session config, handle validation, and route helpers",
   "license": "MIT",
   "repository": {

package/src/identity-categories.ts

@@ -0,0 +1,23 @@
+/**
+ * Shared organization/place category taxonomy.
+ * Values are persisted in profile metadata: keep existing spellings stable,
+ * especially `café`, and extend this vocabulary rather than individual pickers.
+ * This is a suggestion vocabulary, not a validator for historical custom values.
+ */
+export const IDENTITY_CATEGORIES = [
+  'café',
+  'restaurant',
+  'shop',
+  'venue',
+  'studio',
+  'bar',
+  'gallery',
+  'gym',
+  'contractor',
+  'trades',
+  'professional services',
+  'health',
+  'education',
+  'technology',
+  'nonprofit',
+] as const;

package/src/index.ts

@@ -3,6 +3,7 @@ export { standaloneDashboardMiddleware } from "./dashboard-redirect-middleware";
 export type { StandaloneDashboardMiddlewareOptions } from "./dashboard-redirect-middleware";
 export { tier1Headers, tier2Headers, tier3Headers } from './security-headers';
 export { APP_DISPLAY_NAME } from './brand';
+export { IDENTITY_CATEGORIES } from './identity-categories';
 
 export {
   SERVICES,

package/src/services.ts

@@ -56,19 +56,16 @@ export const SERVICES: readonly ServiceDefinition[] = [
   { name: "media",       label: "Media",       icon: "📁", description: "Files, images, and .fair attribution",               devPort: 3000, prodPort: 7000, schema: "media",       tier: "core",   visibility: "authenticated", category: "kernel" },
   { name: "registry",    label: "Registry",    icon: "📡", description: "Service registry and DFOS relay",                    devPort: 3000, prodPort: 7000, schema: "registry",    tier: "core",   visibility: "public",        category: "kernel" },
   { name: "notify",      label: "Notify",      icon: "🔔", description: "Notifications and preferences",                     devPort: 3000, prodPort: 7000, schema: "notify",      tier: "core",   visibility: "internal",      category: "kernel" },
-  { name: "usage",       label: "Usage",       icon: "📊", description: "Inference cost ledger — incurred, billed, drift, signed rollup", devPort: 3000, prodPort: 7000, schema: "usage",       tier: "core",   visibility: "authenticated", category: "kernel" },
-  { name: "calendar",    label: "Calendar",    icon: "📅", description: "Temporal entries — availability, meetings, events, and reminders", devPort: 3000, prodPort: 7000, schema: null,          tier: "core",   visibility: "authenticated", category: "kernel" },
+  { name: "usage",       label: "Usage",       icon: "📊", description: "Inference cost ledger — incurred, billed, drift, signed rollup", devPort: 3000, prodPort: 7000, schema: "usage",       tier: "core",   visibility: "internal",      category: "kernel" },
+  { name: "calendar",    label: "Calendar",    icon: "📅", description: "Temporal entries — availability, meetings, events, and reminders", devPort: 3000, prodPort: 7000, schema: null,          tier: "core",   visibility: "internal",      category: "kernel" },
   { name: "jin",         label: "Jin",         icon: "🧭", description: "Operator dashboard — signed approvals, proposals, and usage feed",  devPort: 3000, prodPort: 7000, schema: "operator",    tier: "core",   visibility: "internal",      category: "kernel" },
-  { name: "google",      label: "Google Workspace", icon: "📨", description: "Gmail/Calendar/Drive/Meet connector — OAuth2 auth-code, sealed refresh token", devPort: 3000, prodPort: 7000, schema: null,          tier: "core",   visibility: "authenticated", category: "kernel" },
+  { name: "google",      label: "Google Workspace", icon: "📨", description: "Gmail/Calendar/Drive/Meet connector — OAuth2 auth-code, sealed refresh token", devPort: 3000, prodPort: 7000, schema: null,          tier: "core",   visibility: "internal",      category: "kernel" },
   { name: "vault",       label: "Vault",       icon: "🔐", description: "Sealed secrets, delegation grants, and vault-minted service credentials", devPort: 3000, prodPort: 7000, schema: null,          tier: "core",   visibility: "internal",      category: "kernel" },
 
-  // Core apps — separate processes
+  // Standalone URL/port contracts for non-nav callers (health probes,
+  // buildPublicUrlAbsolute, check-env). Registry placements decide nav.
   { name: "events",      label: "Events",      icon: "🎫", description: "Event creation, ticketing, and management",         devPort: 3006, prodPort: 7006, schema: "events",      tier: "core",   visibility: "public",        category: "core" },
 
-  // Imajin apps
-  { name: "coffee",      label: "Coffee",      icon: "☕", description: "Tipping and creator support pages",                 devPort: 3100, prodPort: 7100, schema: "coffee",      tier: "imajin", visibility: "creator",       category: "creator" },
-  { name: "dykil",       label: "Surveys",     icon: "📋", description: "Surveys and do-you-know-if-I-like polls",           devPort: 3101, prodPort: 7101, schema: "dykil",       tier: "imajin", visibility: "creator",       category: "creator" },
-  { name: "links",       label: "Links",       icon: "🔗", description: "Link-in-bio pages and click tracking",              devPort: 3102, prodPort: 7102, schema: "links",       tier: "imajin", visibility: "creator",       category: "creator" },
   { name: "learn",       label: "Learn",       icon: "📚", description: "Courses, lessons, and learning progress",           devPort: 3103, prodPort: 7103, schema: "learn",       tier: "imajin", visibility: "public",        category: "core" },
   { name: "market",      label: "Market",      icon: "🏪", description: "Local commerce — buy and sell with trust",          devPort: 3104, prodPort: 7104, schema: "market",      tier: "imajin", visibility: "public",        category: "core" },
 

package/src/session.ts

@@ -28,37 +28,27 @@ function isLocalhost(): boolean {
 }
 
 /**
- * Cookie domain scope (#1069 Phase 1).
+ * Cookie domain scope (#1069 Phase 2).
  *
  * `SESSION_COOKIE_SCOPE` controls whether the deployed session cookie is a
  * shared parent-domain cookie or a host-only cookie:
- *   - unset / "domain" (default): current behavior — `domain: ".imajin.ai"`,
- *     readable by every `*.imajin.ai` subdomain. Nothing changes unless this
- *     is explicitly set.
- *   - "host": omit the `domain` attribute entirely, so the cookie is scoped
- *     to the exact host that set it and is NOT sent to other subdomains.
- *     Apps that relied on reading the shared cookie must adopt scoped app
- *     tokens first (see `requireSessionOrAppToken` in `@ima-jin/auth` and
- *     `docs/security/cookie-isolation.md`) before this is flipped for real.
- *
- * This flag is a primitive for the staged rollout described in
- * `docs/security/cookie-isolation.md` — flipping it is a separate, later
- * phase, not part of shipping the primitive itself.
+ *   - unset / "host" (default): omit Domain; only the setting host receives it.
+ *   - "domain": restore the legacy `.imajin.ai` scope for rollback.
+ * Unknown values fail narrow. Same-origin path-proxied apps still receive
+ * the cookie; see `docs/security/cookie-isolation.md` for the phase 3 gap.
  */
 function isHostScoped(): boolean {
-  if (typeof process === "undefined") return false;
-  return process.env.SESSION_COOKIE_SCOPE === "host";
+  return typeof process === "undefined" || process.env.SESSION_COOKIE_SCOPE !== "domain";
 }
 
-/** Cookie options for cross-subdomain sessions.
+/** Cookie options for host-only sessions (with explicit domain rollback).
  *  When called with no argument, auto-detects from IMAJIN_ENV (same logic as getSessionCookieName).
  *  Accepts optional "dev" | "prod" override for explicit control.
  *
  *  Localhost-aware: when SERVICE_PREFIX contains "localhost", uses
  *  settings compatible with HTTP on localhost (no domain, not secure, lax sameSite).
  *
- *  See {@link isHostScoped} for the `SESSION_COOKIE_SCOPE=host` opt-in that
- *  narrows the deployed cookie to host-only instead of `.imajin.ai`.
+ *  `SESSION_COOKIE_SCOPE=domain` restores the deployed parent-domain cookie.
  */
 export function getSessionCookieOptions(env?: "dev" | "prod") {
   const local = isLocalhost();