@openparachute/hub 0.7.2 → 0.7.3-rc.10

package/src/admin-login-ui.ts

@@ -175,7 +175,16 @@ export interface InviteSetupProps {
   role: string;
   /** Whether redemption provisions a vault at all (shows the vault row iff true). */
   provisionVault: boolean;
+  /**
+   * Whether to collect the redeemer's email (B2). True for public-signup
+   * (multi-use) links — the operator must be able to reach the stranger who
+   * signed up; false for legacy single-use admin/friends invites. Default
+   * false (omitted) preserves the friends flow's no-email form.
+   */
+  collectEmail?: boolean;
   username?: string;
+  /** Echoed email value on a re-render so the redeemer doesn't retype it. */
+  email?: string;
   vaultName?: string;
   errorMessage?: string;
 }
@@ -194,12 +203,28 @@ export function renderInviteSetup(props: InviteSetupProps): string {
     pinnedUsername,
     role,
     provisionVault,
+    collectEmail,
     username,
+    email,
     vaultName,
     errorMessage,
   } = props;
   const error = errorMessage ? `<p class="error-banner">${escapeHtml(errorMessage)}</p>` : "";
   const usernameAttr = username ? ` value="${escapeAttr(username)}"` : "";
+  const emailAttr = email ? ` value="${escapeAttr(email)}"` : "";
+
+  // Email row (B2): shown ONLY for public-signup (multi-use) links so the
+  // operator can reach the stranger who signed up. `type=email` gets the
+  // browser's built-in client-side format check (the server re-validates).
+  const emailRow = collectEmail
+    ? `
+        <label class="field">
+          <span class="field-label">Email</span>
+          <input type="email" name="email" autocomplete="email" required
+            spellcheck="false" autocapitalize="off"${emailAttr} />
+          <span class="field-hint">So your hub operator can reach you.</span>
+        </label>`
+    : "";
 
   // Username row: pre-named → read-only display (the server ENFORCES the
   // invite's username; the disabled input never submits and the handler
@@ -304,6 +329,7 @@ export function renderInviteSetup(props: InviteSetupProps): string {
       <form method="POST" action="/account/setup/${escapeAttr(token)}" class="auth-form">
         ${renderCsrfHiddenInput(csrfToken)}
         ${usernameRow}
+        ${emailRow}
         <label class="field">
           <span class="field-label">Password</span>
           <input type="password" name="password" autocomplete="new-password"
@@ -405,7 +431,7 @@ const STYLES = `
     letter-spacing: 0.01em;
     font-family: ${FONT_MONO};
   }
-  input[type=text], input[type=password] {
+  input[type=text], input[type=password], input[type=email] {
     font: inherit;
     width: 100%;
     padding: 0.6rem 0.75rem;
@@ -415,7 +441,7 @@ const STYLES = `
     color: ${PALETTE.fg};
     transition: border-color 0.15s ease, background 0.15s ease;
   }
-  input[type=text]:focus, input[type=password]:focus {
+  input[type=text]:focus, input[type=password]:focus, input[type=email]:focus {
     outline: none;
     border-color: ${PALETTE.accent};
     background: ${PALETTE.cardBg};
@@ -461,10 +487,10 @@ const STYLES = `
     .card { background: #25221d; border-color: #3a362f; box-shadow: 0 8px 24px rgba(0, 0, 0, 0.3); }
     h1 { color: #f0ece4; }
     .subtitle, .field-label { color: #a8a29a; }
-    input[type=text], input[type=password] {
+    input[type=text], input[type=password], input[type=email] {
       background: #1f1c18; border-color: #3a362f; color: #e8e4dc;
     }
-    input[type=text]:focus, input[type=password]:focus {
+    input[type=text]:focus, input[type=password]:focus, input[type=email]:focus {
       background: #25221d;
     }
     .brand-tag { border-color: #3a362f; color: #a8a29a; }

package/src/admin-vaults.ts

@@ -68,6 +68,7 @@ import { revokeTokensNamingVault, signAccessToken } from "./jwt-sign.ts";
 import { findService, type readManifest, readManifestLenient } from "./services-manifest.ts";
 import { enrichedPath } from "./spawn-path.ts";
 import { removeVaultAssignments } from "./users.ts";
+import { removeVaultCap } from "./vault-caps.ts";
 import { RESERVED_VAULT_NAMES, VAULT_NAME_CHARSET_RE } from "./vault-name.ts";
 import { type WellKnownVaultEntry, isVaultEntry, vaultInstanceNameFor } from "./well-known.ts";
 
@@ -577,6 +578,7 @@ interface CascadeSummary {
   grants_dropped: number;
   user_vaults_removed: number;
   invites_invalidated: number;
+  vault_cap_removed: boolean;
   connections_torn_down: number;
   /**
    * Vault-backed channel-daemon entries still referencing the deleted vault
@@ -596,6 +598,7 @@ function emptyCascadeSummary(): CascadeSummary {
     grants_dropped: 0,
     user_vaults_removed: 0,
     invites_invalidated: 0,
+    vault_cap_removed: false,
     connections_torn_down: 0,
     orphaned_channels: [],
     vault_removed: false,
@@ -648,7 +651,8 @@ function listVaultInstanceNames(manifestPath: string): Set<string> {
  *      it empties — a (user,client) grant can span multiple vaults);
  *   3. `user_vaults` rows;
  *   4. unredeemed invites pinned to the vault (redemption would resurrect
- *      the name);
+ *      the name); the per-vault storage-cap row (v15) so a re-created
+ *      same-name vault doesn't inherit a stale cap;
  *   5. connections whose source/provisioned vault is the deleted vault
  *      (via `teardownConnection`, which post-B0 also revokes the registered
  *      long-lived mints) + a report-only scan of the agent's `/api/channels`
@@ -753,6 +757,10 @@ export async function handleDeleteVault(
   // --- 4. Unredeemed invites pinned to the vault. ----------------------------
   summary.invites_invalidated = revokeInvitesForVault(deps.db, name, now);
 
+  // --- 4b. Per-vault storage cap row (v15). ----------------------------------
+  // A re-created same-name vault must not inherit a stale cap; drop it.
+  summary.vault_cap_removed = removeVaultCap(deps.db, name) > 0;
+
   // --- 5. Connections teardown (+ legacy channel scan, report-only). --------
   // Runs BEFORE the CLI remove so the vault daemon is still alive to accept
   // the trigger-deregister calls.

package/src/api-invites.ts

@@ -15,6 +15,18 @@
  *
  * Wire shape is snake_case (matches `/api/users`). An invite's raw token
  * NEVER appears in a GET/list response — only in the POST-create `url`.
+ *
+ * v15 (DEMO-PREP Workstream B) extends POST /api/invites with `max_uses`
+ * (multi-use public-signup links, default 1 = single-use) and
+ * `vault_cap_bytes` (per-vault storage cap stamped at provision, B4). A
+ * multi-use PROVISIONING link with no explicit `vault_cap_bytes` auto-defaults
+ * to ~1 GB (DEFAULT_VAULT_CAP_BYTES) so a public link never provisions
+ * uncapped by omission; single-use friends links stay uncapped unless opted
+ * in. The list/create wire shape gains `max_uses`, `used_count`, `email`
+ * (latest redeemer, B2), and `vault_cap_bytes`. `expires_in` already bounded
+ * the link lifetime (B1's expiry). A multi-use link can't pre-name a username
+ * or pin a single new vault name (every seat past the first would collide —
+ * rejected at mint).
  */
 import type { Database } from "bun:sqlite";
 import { type AdminAuthError, adminAuthErrorResponse, requireScope } from "./admin-auth.ts";
@@ -32,6 +44,7 @@ import {
   usernameReservedByPendingInvite,
 } from "./invites.ts";
 import { getUserByUsernameCI, validateUsername } from "./users.ts";
+import { DEFAULT_VAULT_CAP_BYTES } from "./vault-caps.ts";
 import { VAULT_NAME_CHARSET_RE } from "./vault-name.ts";
 import { listVaultNamesFromPath } from "./vault-names.ts";
 
@@ -47,6 +60,18 @@ export interface ApiInvitesDeps {
 const ALLOWED_ROLES = new Set(["read", "write"]);
 /** Cap an invite TTL so a typo can't mint a ~forever link. 90 days. */
 const MAX_INVITE_TTL_SECONDS = 90 * 24 * 60 * 60;
+/**
+ * Cap `max_uses` (v15) so a typo can't mint a runaway public-signup link on a
+ * shared box. 1000 is comfortably above any demo cohort while still bounding
+ * the abuse surface. The DEMO-PREP shared box uses small values (tens of seats).
+ */
+const MAX_INVITE_USES = 1000;
+/**
+ * Ceiling on a per-vault cap an invite may carry (v15, B4). 100 GiB — far
+ * above the ~1 GB default, but bounds a fat-finger that would make the cap
+ * meaningless on a shared box. The minimum is 1 byte (a positive integer).
+ */
+const MAX_VAULT_CAP_BYTES = 100 * 1024 * 1024 * 1024;
 
 interface InviteWireShape {
   /** sha256 hash — the stable id for list/revoke. NOT the raw token. */
@@ -57,6 +82,14 @@ interface InviteWireShape {
   role: string;
   provision_vault: boolean;
   default_mirror: string | null;
+  /** v15 — how many accounts this link may create (1 = single-use). */
+  max_uses: number;
+  /** v15 — how many it has created so far. */
+  used_count: number;
+  /** v15 — most-recent redeemer's email (B2), or null. */
+  email: string | null;
+  /** v15 — per-vault storage cap to stamp at provision (B4), or null (uncapped). */
+  vault_cap_bytes: number | null;
   expires_at: string;
   used_at: string | null;
   redeemed_user_id: string | null;
@@ -73,6 +106,10 @@ function toWire(invite: Invite, status: InviteStatus): InviteWireShape {
     role: invite.role,
     provision_vault: invite.provisionVault,
     default_mirror: invite.defaultMirror,
+    max_uses: invite.maxUses,
+    used_count: invite.usedCount,
+    email: invite.email,
+    vault_cap_bytes: invite.vaultCapBytes,
     expires_at: invite.expiresAt,
     used_at: invite.usedAt,
     redeemed_user_id: invite.redeemedUserId,
@@ -100,6 +137,10 @@ interface CreateInviteBody {
   provisionVault: boolean;
   defaultMirror: string | null;
   expiresInSeconds: number;
+  /** v15 — how many accounts the link may create (default 1 = single-use). */
+  maxUses: number;
+  /** v15 — per-vault storage cap (bytes) to stamp at provision, or null (uncapped). */
+  vaultCapBytes: number | null;
 }
 
 interface ParseErr {
@@ -283,9 +324,71 @@ async function parseCreateBody(
     expiresInSeconds = Math.floor(rawExpiry);
   }
 
+  // max_uses — v15. Default 1 (single-use, the legacy shape). A positive
+  // integer ≤ MAX_INVITE_USES. >1 = a multi-use public-signup link.
+  let maxUses = 1;
+  const rawMaxUses =
+    Object.hasOwn(obj, "max_uses") && obj.max_uses !== undefined
+      ? obj.max_uses
+      : Object.hasOwn(obj, "maxUses") && obj.maxUses !== undefined
+        ? obj.maxUses
+        : undefined;
+  if (rawMaxUses !== undefined && rawMaxUses !== null) {
+    if (
+      typeof rawMaxUses !== "number" ||
+      !Number.isInteger(rawMaxUses) ||
+      rawMaxUses < 1 ||
+      rawMaxUses > MAX_INVITE_USES
+    ) {
+      return {
+        ok: false,
+        status: 400,
+        error: "invalid_request",
+        description: `"max_uses" must be an integer between 1 and ${MAX_INVITE_USES}`,
+      };
+    }
+    maxUses = rawMaxUses;
+  }
+
+  // vault_cap_bytes — v15, B4. Optional per-vault storage cap stamped at
+  // provision. null/omitted = uncapped (legacy). A positive integer
+  // ≤ MAX_VAULT_CAP_BYTES.
+  let vaultCapBytes: number | null = null;
+  const rawCap =
+    Object.hasOwn(obj, "vault_cap_bytes") && obj.vault_cap_bytes !== undefined
+      ? obj.vault_cap_bytes
+      : Object.hasOwn(obj, "vaultCapBytes") && obj.vaultCapBytes !== undefined
+        ? obj.vaultCapBytes
+        : undefined;
+  if (rawCap !== undefined && rawCap !== null) {
+    if (
+      typeof rawCap !== "number" ||
+      !Number.isInteger(rawCap) ||
+      rawCap < 1 ||
+      rawCap > MAX_VAULT_CAP_BYTES
+    ) {
+      return {
+        ok: false,
+        status: 400,
+        error: "invalid_request",
+        description: `"vault_cap_bytes" must be a positive integer ≤ ${MAX_VAULT_CAP_BYTES} (100 GiB)`,
+      };
+    }
+    vaultCapBytes = rawCap;
+  }
+
   return {
     ok: true,
-    body: { vaultName, username, role, provisionVault, defaultMirror, expiresInSeconds },
+    body: {
+      vaultName,
+      username,
+      role,
+      provisionVault,
+      defaultMirror,
+      expiresInSeconds,
+      maxUses,
+      vaultCapBytes,
+    },
   };
 }
 
@@ -303,8 +406,16 @@ export async function handleCreateInvite(req: Request, deps: ApiInvitesDeps): Pr
   }
   const parsed = await parseCreateBody(req);
   if (!parsed.ok) return jsonError(parsed.status, parsed.error, parsed.description);
-  const { vaultName, username, role, provisionVault, defaultMirror, expiresInSeconds } =
-    parsed.body;
+  const {
+    vaultName,
+    username,
+    role,
+    provisionVault,
+    defaultMirror,
+    expiresInSeconds,
+    maxUses,
+    vaultCapBytes,
+  } = parsed.body;
   const now = (deps.now ?? (() => new Date()))();
 
   // Shape gates over the three supported invite shapes:
@@ -330,6 +441,42 @@ export async function handleCreateInvite(req: Request, deps: ApiInvitesDeps): Pr
       'a provisioned vault\'s sole user must hold write — use role "write", or share an existing vault (provision_vault=false + vault_name) for read-only access',
     );
   }
+
+  // Multi-use coherence gates (v15). A link that creates many accounts can't:
+  //   - pre-name a username (one name can't be reused across redeemers), or
+  //   - pin a single NEW vault name (every redeemer would collide on it —
+  //     the redeem path's freshly-created invariant rejects the 2nd onward).
+  // Either combination would make every seat past the first dead-on-arrival,
+  // so reject at mint. (A multi-use SHARED-vault invite — provision_vault=false
+  // + an existing vault_name — IS coherent: many users joining one vault; it's
+  // not blocked here.)
+  if (maxUses > 1) {
+    if (username !== null) {
+      return jsonError(
+        400,
+        "invalid_request",
+        "a multi-use link (max_uses > 1) can't pre-name a username — one username can't be shared across signups. Omit \"username\".",
+      );
+    }
+    if (provisionVault && vaultName !== null) {
+      return jsonError(
+        400,
+        "invalid_request",
+        'a multi-use provisioning link (max_uses > 1) can\'t pin a single vault name — every signup would collide on it. Omit "vault_name" so each signup names their own vault.',
+      );
+    }
+  }
+
+  // A per-vault cap only applies to a vault THIS link provisions. Pinning a
+  // cap on a non-provisioning invite (account-only or shared-existing-vault)
+  // has nothing to stamp — reject the contradiction at mint.
+  if (vaultCapBytes !== null && !provisionVault) {
+    return jsonError(
+      400,
+      "invalid_request",
+      '"vault_cap_bytes" only applies to a provisioning invite (provision_vault=true) — a non-provisioning link has no vault to cap',
+    );
+  }
   if (vaultName !== null && !provisionVault) {
     const manifestPath = deps.manifestPath ?? SERVICES_MANIFEST_PATH;
     const known = new Set(listVaultNamesFromPath(manifestPath));
@@ -358,6 +505,17 @@ export async function handleCreateInvite(req: Request, deps: ApiInvitesDeps): Pr
     }
   }
 
+  // Auto-apply the ~1 GB default cap to a PUBLIC-SIGNUP (multi-use,
+  // provisioning) link when the admin didn't set one explicitly — the
+  // DEMO-PREP decision is "1 GB per vault, configurable," so a multi-use
+  // signup link on a shared box should never provision UNcapped by omission.
+  // An explicit cap (any value, validated above) is honored as-is; a
+  // single-use friends link stays uncapped unless the admin opts in.
+  const effectiveVaultCapBytes =
+    vaultCapBytes === null && maxUses > 1 && provisionVault
+      ? DEFAULT_VAULT_CAP_BYTES
+      : vaultCapBytes;
+
   const issued = issueInvite(deps.db, {
     createdBy: authUserId,
     vaultName,
@@ -366,6 +524,8 @@ export async function handleCreateInvite(req: Request, deps: ApiInvitesDeps): Pr
     provisionVault,
     defaultMirror,
     expiresInSeconds,
+    maxUses,
+    vaultCapBytes: effectiveVaultCapBytes,
     ...(deps.now !== undefined ? { now: deps.now } : {}),
   });
   const status = inviteStatus(issued.invite, now);

package/src/api-modules-ops.ts

@@ -55,6 +55,7 @@ import {
 import { findService, readManifestLenient, removeService } from "./services-manifest.ts";
 import { enrichedPath } from "./spawn-path.ts";
 import type { ModuleState, SpawnRequest, Supervisor } from "./supervisor.ts";
+import { buildHubOriginsEnvValue } from "./vault-hub-origin-env.ts";
 import { WELL_KNOWN_PATH, type regenerateWellKnown } from "./well-known.ts";
 
 /**
@@ -609,10 +610,21 @@ async function spawnSupervised(
   // `process.env.PATH` may ALREADY be enriched by serve startup (serve.ts);
   // re-enriching here is a harmless no-op — `enrichedPath` is idempotent
   // (dedupe + append-only), so double-enrichment can't duplicate or reorder.
+  // PARACHUTE_HUB_ORIGINS (multi-origin iss-set, onboarding-streamline
+  // 2026-06-25): alongside the single canonical PARACHUTE_HUB_ORIGIN, inject
+  // the SET of origins the hub legitimately answers on (issuer ∪ loopback ∪
+  // expose-state ∪ platform). A resource server on scope-guard ≥0.5.0 widens
+  // its accepted-`iss` check to this set so a token minted under one URL of a
+  // multi-URL box validates via another URL of the SAME box. Mirrors
+  // buildModuleSpawnRequest (serve-boot.ts) — keep the two in sync. SECURITY:
+  // the set is hub-controlled config/disk state ONLY, never a request Host
+  // (see buildHubOriginsEnvValue). `deps.spawnEnv` still wins.
+  const hubOrigins = deps.issuer ? buildHubOriginsEnvValue(deps.configDir, deps.issuer) : undefined;
   const childEnv: Record<string, string> = {
     PATH: enrichedPath(),
     PORT: String(entry.port),
     ...(deps.issuer ? { PARACHUTE_HUB_ORIGIN: deps.issuer } : {}),
+    ...(hubOrigins ? { PARACHUTE_HUB_ORIGINS: hubOrigins } : {}),
     ...(deps.spawnEnv ?? {}),
   };
   const req: SpawnRequest = {

package/src/api-modules.ts

@@ -15,11 +15,21 @@
  *     / `crashed` / `starting` / `restarting`) + pid. Absent when the
  *     hub is in CLI mode (no supervisor injected through HubFetchDeps).
  *
- * `focus` ("core" | "experimental") comes from each module's `module.json`
- * when declared, else `focusForShort`'s default map. The SPA groups core first
- * + de-emphasizes experimental — it NEVER hides a module. This is what makes a
- * running, self-registered module (channel) visible + installable; the old
- * `CURATED_MODULES = ["vault","scribe"]` whitelist made it invisible.
+ * `focus` ("core" | "experimental" | "deprecated") comes from each module's
+ * `module.json` when declared, else `focusForShort`'s default map. The SPA
+ * groups core first, de-emphasizes experimental, and de-emphasizes
+ * `deprecated` (notes-daemon / runner) further — it NEVER hides an installed
+ * module (so an existing operator can still manage / uninstall a deprecated
+ * one). This is what makes a running, self-registered module (channel) visible
+ * + installable; the old `CURATED_MODULES = ["vault","scribe"]` whitelist made
+ * it invisible.
+ *
+ * `available_to_install` is the fresh-install OFFER (2026-06-25): a module the
+ * hub will push as a new install. It's `available && focus !== "deprecated"`
+ * — so a `deprecated` module that is ALREADY installed still surfaces (via the
+ * `modules` union + `installed: true`) and is manageable, but a deprecated
+ * module is never offered as a fresh install. `agent` (`experimental`) stays
+ * offered.
  *
  * Bearer-gated on `parachute:host:auth` to match the rest of `/api/auth/*`
  * and `/api/grants` — the admin SPA mints this scope via
@@ -199,14 +209,33 @@ interface ModuleWireShape {
   display_name: string;
   tagline: string;
   /**
-   * Discovery tier (2026-06-09 modular-UI architecture). `core` modules render
-   * in the headline group; `experimental` modules render in a de-emphasized
-   * "Experimental" group below — never hidden. Resolved from the module's
-   * `module.json` `focus` when declared, else `focusForShort`'s default map
-   * (vault/scribe/hub/surface → core, channel/runner/others → experimental).
+   * Discovery tier (2026-06-09 modular-UI architecture; `deprecated` added
+   * 2026-06-25). `core` modules render in the headline group; `experimental`
+   * modules render in a de-emphasized "Experimental" group; `deprecated`
+   * modules (notes-daemon / runner) render in a further-de-emphasized
+   * "Deprecated" group — never hidden when installed. Resolved from the
+   * module's `module.json` `focus` when declared, else `focusForShort`'s
+   * default map (vault/scribe/hub/surface → core, notes/runner → deprecated,
+   * others → experimental).
    */
   focus: ModuleFocus;
+  /**
+   * True iff the hub knows how to install this module (`package`/`manifest`
+   * resolvable). Historically "in the curated install catalog". Still set for
+   * every known module; a purely third-party services.json row is false.
+   * NOTE: this is NOT the fresh-install OFFER — a `deprecated` module is still
+   * `available: true` (it's installable for back-compat / re-install) but is
+   * excluded from `available_to_install`.
+   */
   available: boolean;
+  /**
+   * The fresh-install OFFER (2026-06-25): whether the hub presents this module
+   * in the "available to install fresh" set. `available && focus !==
+   * "deprecated"`. The SPA's "Install a module" catalog filters on this so
+   * notes-daemon / runner aren't pushed on a fresh box; an already-installed
+   * deprecated module still surfaces (in the Installed section) for management.
+   */
+  available_to_install: boolean;
   installed: boolean;
   installed_version: string | null;
   latest_version: string | null;
@@ -562,8 +591,8 @@ export async function handleApiModules(req: Request, deps: ApiModulesDeps): Prom
   // module's manifest-declared `focus` (when installed + declared) wins; else
   // the `focusForShort` default map. Sort: `core` group first (with the
   // CURATED_MODULES recommended-install order floated to the top of that
-  // group), then `experimental` — the SPA renders the two groups; `focus`
-  // never hides a module.
+  // group), then `experimental`, then `deprecated` (notes / runner) last — the
+  // SPA renders the groups; `focus` never hides an installed module.
   const recommendedOrder = new Map<string, number>(
     (CURATED_MODULES as readonly string[]).map((s, i) => [s, i]),
   );
@@ -585,6 +614,11 @@ export async function handleApiModules(req: Request, deps: ApiModulesDeps): Prom
       // known modules; a purely third-party services.json row (no install
       // package) is not hub-installable → false.
       available: m !== undefined,
+      // Fresh-install OFFER (2026-06-25): installable AND not deprecated. A
+      // deprecated short (notes / runner) stays `available` (re-installable
+      // for back-compat) but is dropped from the offer set so the SPA's
+      // "Install a module" catalog doesn't push it on a fresh box.
+      available_to_install: m !== undefined && focus !== "deprecated",
       installed: installed !== undefined,
       installed_version: installed?.version ?? null,
       latest_version: latestByShort.get(short) ?? null,
@@ -598,7 +632,7 @@ export async function handleApiModules(req: Request, deps: ApiModulesDeps): Prom
     };
     return row;
   });
-  const focusRank = (f: ModuleFocus): number => (f === "core" ? 0 : 1);
+  const focusRank = (f: ModuleFocus): number => (f === "core" ? 0 : f === "experimental" ? 1 : 2);
   rows.sort((a, b) => {
     if (a.focus !== b.focus) return focusRank(a.focus) - focusRank(b.focus);
     const ai = recommendedOrder.get(a.short) ?? Number.POSITIVE_INFINITY;

package/src/api-users.ts

@@ -88,6 +88,8 @@ export interface UserWireShape {
   id: string;
   username: string;
   password_changed: boolean;
+  /** Contactable email captured at signup (v15, B2), or null. Visible to admin. */
+  email: string | null;
   assigned_vaults: string[];
   created_at: string;
 }
@@ -97,6 +99,7 @@ function toWire(u: User): UserWireShape {
     id: u.id,
     username: u.username,
     password_changed: u.passwordChanged,
+    email: u.email,
     assigned_vaults: [...u.assignedVaults],
     created_at: u.createdAt,
   };