@openparachute/hub 0.7.1 → 0.7.2-rc.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (73) hide show
  1. package/README.md +13 -14
  2. package/package.json +1 -1
  3. package/src/__tests__/admin-agent-grants.test.ts +1547 -0
  4. package/src/__tests__/{admin-channel-token.test.ts → admin-agent-token.test.ts} +32 -32
  5. package/src/__tests__/admin-connections-credentials.test.ts +8 -4
  6. package/src/__tests__/admin-connections.test.ts +211 -57
  7. package/src/__tests__/admin-csrf-belt.test.ts +7 -7
  8. package/src/__tests__/admin-lock.test.ts +600 -0
  9. package/src/__tests__/admin-module-token.test.ts +36 -8
  10. package/src/__tests__/admin-vaults.test.ts +8 -8
  11. package/src/__tests__/api-modules-ops.test.ts +17 -16
  12. package/src/__tests__/api-modules.test.ts +35 -36
  13. package/src/__tests__/api-ready.test.ts +2 -2
  14. package/src/__tests__/clients.test.ts +91 -0
  15. package/src/__tests__/grants-store.test.ts +219 -0
  16. package/src/__tests__/hub-server.test.ts +9 -5
  17. package/src/__tests__/migrate.test.ts +1 -1
  18. package/src/__tests__/module-manifest.test.ts +11 -11
  19. package/src/__tests__/oauth-client.test.ts +446 -0
  20. package/src/__tests__/oauth-flows-store.test.ts +141 -0
  21. package/src/__tests__/oauth-handlers.test.ts +124 -26
  22. package/src/__tests__/operator-token.test.ts +2 -2
  23. package/src/__tests__/scope-explanations.test.ts +3 -3
  24. package/src/__tests__/serve-boot.test.ts +14 -14
  25. package/src/__tests__/serve.test.ts +26 -0
  26. package/src/__tests__/service-spec-discovery.test.ts +26 -18
  27. package/src/__tests__/services-manifest.test.ts +60 -48
  28. package/src/__tests__/setup-gate.test.ts +52 -3
  29. package/src/__tests__/setup-wizard.test.ts +86 -280
  30. package/src/__tests__/setup.test.ts +1 -1
  31. package/src/__tests__/upgrade.test.ts +276 -0
  32. package/src/__tests__/vault-remove.test.ts +393 -0
  33. package/src/admin-agent-grants.ts +1365 -0
  34. package/src/admin-agent-token.ts +147 -0
  35. package/src/admin-connections.ts +67 -50
  36. package/src/admin-host-admin-token.ts +14 -1
  37. package/src/admin-lock.ts +281 -0
  38. package/src/admin-module-token.ts +15 -7
  39. package/src/admin-vault-admin-token.ts +8 -1
  40. package/src/admin-vaults.ts +12 -12
  41. package/src/api-admin-lock.ts +335 -0
  42. package/src/api-modules-ops.ts +3 -2
  43. package/src/api-modules.ts +9 -9
  44. package/src/cli.ts +13 -1
  45. package/src/clients.ts +88 -0
  46. package/src/commands/install.ts +7 -0
  47. package/src/commands/serve-boot.ts +5 -4
  48. package/src/commands/serve.ts +45 -19
  49. package/src/commands/setup.ts +4 -3
  50. package/src/commands/upgrade.ts +118 -2
  51. package/src/commands/vault-remove.ts +361 -0
  52. package/src/commands/wizard.ts +4 -4
  53. package/src/connections-store.ts +3 -3
  54. package/src/grants-store.ts +272 -0
  55. package/src/help.ts +4 -1
  56. package/src/hub-server.ts +209 -27
  57. package/src/hub-settings.ts +23 -8
  58. package/src/jwt-sign.ts +5 -1
  59. package/src/module-manifest.ts +2 -2
  60. package/src/oauth-client.ts +497 -0
  61. package/src/oauth-flows-store.ts +163 -0
  62. package/src/oauth-handlers.ts +40 -13
  63. package/src/operator-token.ts +1 -1
  64. package/src/origin-check.ts +7 -2
  65. package/src/resource-binding.ts +4 -4
  66. package/src/scope-explanations.ts +3 -3
  67. package/src/service-spec.ts +56 -43
  68. package/src/setup-wizard.ts +56 -240
  69. package/web/ui/dist/assets/index-B5AUE359.js +61 -0
  70. package/web/ui/dist/assets/{index-E_9wqjEm.css → index-DR6R8EFf.css} +1 -1
  71. package/web/ui/dist/index.html +2 -2
  72. package/src/admin-channel-token.ts +0 -135
  73. package/web/ui/dist/assets/index-Cxtod68O.js +0 -61
package/README.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  `@openparachute/hub` — the local hub for the [Parachute](https://parachute.computer) ecosystem. The `parachute` binary is one of its surfaces.
4
4
 
5
- The hub coordinates the modules running on your machine: it installs them, supervises them as child processes (the hub itself runs under your platform's process manager — launchd / systemd / the container runtime), exposes them over Tailscale, serves the discovery document at `/.well-known/parachute.json`, and (soon) issues OAuth tokens. Each module (vault, app, scribe, …) stays a standalone package; the hub stitches them together.
5
+ The hub coordinates the modules running on your machine: it installs them, supervises them as child processes (the hub itself runs under your platform's process manager — launchd / systemd / the container runtime), exposes them over Tailscale, serves the discovery document at `/.well-known/parachute.json`, and (soon) issues OAuth tokens. Each module (vault, surface, scribe, …) stays a standalone package; the hub stitches them together.
6
6
 
7
7
  > Previously published as `@openparachute/cli`. Renamed 2026-04-26 to better reflect the role — see [parachute-patterns/hub-as-issuer](https://github.com/ParachuteComputer/parachute-patterns/blob/main/patterns/hub-as-issuer.md). The `parachute` binary name is unchanged.
8
8
 
@@ -55,7 +55,7 @@ Config in `fly.toml`. CLI-first ops; bring your own `flyctl`.
55
55
 
56
56
  #### Both platforms
57
57
 
58
- Pre-configured with `PARACHUTE_INSTALL_CHANNEL=latest` so modules you install via the admin SPA (vault, app, scribe, runner) pull stable releases by default. Flip to `rc` in your platform's env vars for the pre-release cascade.
58
+ Pre-configured with `PARACHUTE_INSTALL_CHANNEL=latest` so modules you install via the admin SPA (vault, surface, scribe, runner) pull stable releases by default. Flip to `rc` in your platform's env vars for the pre-release cascade.
59
59
 
60
60
  Operators who want env-var-driven seeding (CI, scripted deploys) can still set `PARACHUTE_INITIAL_ADMIN_USERNAME` + `PARACHUTE_INITIAL_ADMIN_PASSWORD` manually — hub honors them on both platforms.
61
61
 
@@ -292,7 +292,7 @@ Every service mounts under a path on a single canonical hostname. The root `/` i
292
292
  ```
293
293
  https://parachute.<tailnet>.ts.net/ → hub (service directory)
294
294
  https://parachute.<tailnet>.ts.net/vault/default → parachute-vault API
295
- https://parachute.<tailnet>.ts.net/lens → parachute-lens
295
+ https://parachute.<tailnet>.ts.net/surface → parachute-surface
296
296
  https://parachute.<tailnet>.ts.net/scribe → parachute-scribe
297
297
  https://parachute.<tailnet>.ts.net/.well-known/parachute.json ← discovery
298
298
  ```
@@ -319,14 +319,13 @@ The `/.well-known/parachute.json` document is an always-present descriptor — f
319
319
  "infoUrl": "https://parachute.taildf9ce2.ts.net/vault/default/.parachute/info"
320
320
  },
321
321
  {
322
- "name": "parachute-lens",
323
- "url": "https://parachute.taildf9ce2.ts.net/lens",
324
- "path": "/lens",
325
- "version": "0.0.1",
326
- "infoUrl": "https://parachute.taildf9ce2.ts.net/lens/.parachute/info"
322
+ "name": "parachute-surface",
323
+ "url": "https://parachute.taildf9ce2.ts.net/surface",
324
+ "path": "/surface",
325
+ "version": "0.3.2",
326
+ "infoUrl": "https://parachute.taildf9ce2.ts.net/surface/.parachute/info"
327
327
  }
328
- ],
329
- "lens": { "url": "https://parachute.taildf9ce2.ts.net/lens", "version": "0.0.1" }
328
+ ]
330
329
  }
331
330
  ```
332
331
 
@@ -343,12 +342,12 @@ Parachute services reserve a block of loopback ports in the canonical range **19
343
342
  | ---- | ------------------ |
344
343
  | 1939 | parachute-hub (internal proxy + static) |
345
344
  | 1940 | parachute-vault |
346
- | 1941 | parachute-channel |
347
- | 1942 | parachute-notes *(deprecating — see [notes#154](https://github.com/ParachuteComputer/parachute-notes/issues/154); folds into parachute-app at 1946)* |
345
+ | 1941 | parachute-agent *(renamed from parachute-channel 2026-06-17)* |
346
+ | 1942 | *parachute-notes (archived 2026-05-24 notes-daemon retired; Notes now bundled in parachute-surface. Slot reclaimable; see [`parachute-notes/DEPRECATED.md`](https://github.com/ParachuteComputer/parachute-notes/blob/main/DEPRECATED.md))* |
348
347
  | 1943 | parachute-scribe |
349
- | 1944 | *parachute-agent (retired 2026-05-20; slot held — see [`parachute-agent/DEPRECATED.md`](https://github.com/ParachuteComputer/parachute-agent/blob/main/DEPRECATED.md))* |
348
+ | 1944 | *parachute-agent-legacy (the Claude-in-containers module retired 2026-05-20; slot held — NOT the 1941 agent module, which is the renamed channel)* |
350
349
  | 1945 | parachute-runner *(shipped; exploration-tier, not committed-core)* |
351
- | 1946 | parachute-app *(committed core; UI host, ships Notes as canonical first app)* |
350
+ | 1946 | parachute-surface *(committed core; UI host bundles Notes, hosts custom surfaces)* |
352
351
  | 1947–1949 | *unassigned (CLI fallback range)* |
353
352
 
354
353
  The hub pins 1939 — no fallback. If something else is on 1939 when you run `parachute expose`, the command fails with a pointer to `lsof -iTCP:1939` rather than walking up into another service's slot.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@openparachute/hub",
3
- "version": "0.7.1",
3
+ "version": "0.7.2-rc.1",
4
4
  "description": "parachute — the local hub for the Parachute ecosystem (discovery, ports, lifecycle, soon OAuth).",
5
5
  "license": "AGPL-3.0",
6
6
  "publishConfig": {