@openparachute/hub 0.7.2 → 0.7.3-rc.10

package/src/api-vault-caps.ts

@@ -0,0 +1,206 @@
+/**
+ * `/api/vault-caps*` — admin visibility + edit for per-vault storage caps
+ * (DEMO-PREP-2026-06-25 Workstream B5 / D-slice).
+ *
+ * PR #686 shipped the `vault_caps` table + `setVaultCap`/`getVaultCapBytes`
+ * (provision-time persistence) and a separate Phase-2 PR reads + ENFORCES the
+ * cap at upload time. This file is the OPERATOR-FACING seam in between: the
+ * admin SPA needs to SEE who has what cap and EDIT a cap live in the demo.
+ *
+ * Surfaces:
+ *
+ *   GET /api/vault-caps          list every vault (from services.json) joined
+ *                                with its persisted cap (host:admin)
+ *   PUT /api/vault-caps/:name    set/update a vault's cap to N bytes (host:admin)
+ *
+ * The list is the JOIN of "what vaults exist" (services.json, the canonical
+ * vault-name source) and "what caps are persisted" (`vault_caps`). A vault
+ * with no cap row appears with `cap_bytes: null` (uncapped) — the same
+ * "uncapped = no row" contract the Phase-2 enforcement reader relies on.
+ *
+ * Wire shape is snake_case (matches `/api/users`, `/api/invites`). Auth: same
+ * `parachute:host:admin` Bearer gate as every other `/api/*` admin surface;
+ * the SPA mints it from the session cookie via `/admin/host-admin-token`.
+ *
+ * Scope discipline: PUT only sets a cap on a vault that is REGISTERED in
+ * services.json (rejects a stale / typo name with 400 `vault_not_found`) so an
+ * operator can't seed a cap row for a vault that doesn't exist. Additive only —
+ * this never changes the provision-time cap-persistence from #686; it's a
+ * read + targeted-edit layer on the same table.
+ */
+import type { Database } from "bun:sqlite";
+import { type AdminAuthError, adminAuthErrorResponse, requireScope } from "./admin-auth.ts";
+import { HOST_ADMIN_SCOPE } from "./admin-vaults.ts";
+import { SERVICES_MANIFEST_PATH } from "./config.ts";
+import { getVaultCap, setVaultCap } from "./vault-caps.ts";
+import { listVaultNamesFromPath } from "./vault-names.ts";
+
+export interface ApiVaultCapsDeps {
+  db: Database;
+  /** Hub origin — JWT `iss` validation. */
+  issuer: string;
+  /** Override services.json path. Defaults to `~/.parachute/services.json`. */
+  manifestPath?: string;
+}
+
+/**
+ * One row in the `GET /api/vault-caps` response: a vault name + its cap. A
+ * vault with no persisted cap carries `cap_bytes: null` (uncapped); `created_at`
+ * / `updated_at` are null too in that case.
+ */
+export interface VaultCapWireShape {
+  vault_name: string;
+  cap_bytes: number | null;
+  created_at: string | null;
+  updated_at: string | null;
+}
+
+function jsonError(status: number, error: string, description: string): Response {
+  return new Response(JSON.stringify({ error, error_description: description }), {
+    status,
+    headers: { "content-type": "application/json" },
+  });
+}
+
+/**
+ * GET /api/vault-caps — every vault registered in services.json, joined with
+ * its persisted cap (null = uncapped). Ordered by vault name.
+ */
+export async function handleListVaultCaps(req: Request, deps: ApiVaultCapsDeps): Promise<Response> {
+  if (req.method !== "GET") {
+    return jsonError(405, "method_not_allowed", "use GET");
+  }
+  try {
+    await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.issuer);
+  } catch (err) {
+    return adminAuthErrorResponse(err as AdminAuthError);
+  }
+  const manifestPath = deps.manifestPath ?? SERVICES_MANIFEST_PATH;
+  const names = listVaultNamesFromPath(manifestPath);
+  const caps: VaultCapWireShape[] = names.map((vaultName) => {
+    const cap = getVaultCap(deps.db, vaultName);
+    return {
+      vault_name: vaultName,
+      cap_bytes: cap?.capBytes ?? null,
+      created_at: cap?.createdAt ?? null,
+      updated_at: cap?.updatedAt ?? null,
+    };
+  });
+  return new Response(JSON.stringify({ vault_caps: caps }), {
+    status: 200,
+    headers: { "content-type": "application/json", "cache-control": "no-store" },
+  });
+}
+
+interface SetCapBody {
+  cap_bytes: number;
+}
+
+interface ParseErr {
+  ok: false;
+  status: number;
+  error: string;
+  description: string;
+}
+
+async function parseSetCapBody(req: Request): Promise<{ ok: true; body: SetCapBody } | ParseErr> {
+  const ctype = req.headers.get("content-type") ?? "";
+  if (!ctype.toLowerCase().includes("application/json")) {
+    return {
+      ok: false,
+      status: 400,
+      error: "invalid_request",
+      description: "Content-Type must be application/json",
+    };
+  }
+  let raw: unknown;
+  try {
+    raw = await req.json();
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      ok: false,
+      status: 400,
+      error: "invalid_request",
+      description: `invalid JSON body: ${msg}`,
+    };
+  }
+  if (!raw || typeof raw !== "object") {
+    return {
+      ok: false,
+      status: 400,
+      error: "invalid_request",
+      description: "request body must be a JSON object",
+    };
+  }
+  const obj = raw as Record<string, unknown>;
+  const capBytes = obj.cap_bytes;
+  // Positive integer only — the table's CHECK (cap_bytes > 0) is the at-rest
+  // backstop; this is the edge validation so the operator gets a clean 400
+  // instead of a sqlite constraint error. A fractional byte count (which a byte
+  // count can never be) is rejected rather than silently floored downstream.
+  if (typeof capBytes !== "number" || !Number.isInteger(capBytes) || capBytes <= 0) {
+    return {
+      ok: false,
+      status: 400,
+      error: "invalid_request",
+      description: '"cap_bytes" must be a positive integer number of bytes',
+    };
+  }
+  return { ok: true, body: { cap_bytes: capBytes } };
+}
+
+/**
+ * PUT /api/vault-caps/:name — set or update a vault's storage cap.
+ *
+ * Order of checks (mirrors the /api/users handlers):
+ *
+ *   1. Method gate (405 on non-PUT).
+ *   2. Bearer carries `parachute:host:admin` (401 / 403 via `requireScope`).
+ *   3. Parse + validate body (400 on shape / non-positive cap).
+ *   4. Vault is registered in services.json (400 `vault_not_found`) — refuse
+ *      to seed a cap for a vault that doesn't exist.
+ *   5. `setVaultCap` (upsert) — overwrites the cap, bumps `updated_at`,
+ *      preserves the original `created_at`.
+ *
+ * Response on success: `200 { vault_cap: <wire shape> }`.
+ */
+export async function handleSetVaultCap(
+  req: Request,
+  vaultName: string,
+  deps: ApiVaultCapsDeps,
+): Promise<Response> {
+  if (req.method !== "PUT") {
+    return jsonError(405, "method_not_allowed", "use PUT");
+  }
+  try {
+    await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.issuer);
+  } catch (err) {
+    return adminAuthErrorResponse(err as AdminAuthError);
+  }
+  const parsed = await parseSetCapBody(req);
+  if (!parsed.ok) {
+    return jsonError(parsed.status, parsed.error, parsed.description);
+  }
+  const manifestPath = deps.manifestPath ?? SERVICES_MANIFEST_PATH;
+  const known = new Set(listVaultNamesFromPath(manifestPath));
+  if (!known.has(vaultName)) {
+    return jsonError(
+      400,
+      "vault_not_found",
+      `vault "${vaultName}" is not registered in services.json`,
+    );
+  }
+  const cap = setVaultCap(deps.db, vaultName, parsed.body.cap_bytes);
+  console.log(`vault cap set: vault=${vaultName} cap_bytes=${cap.capBytes}`);
+  const wire: VaultCapWireShape = {
+    vault_name: cap.vaultName,
+    cap_bytes: cap.capBytes,
+    created_at: cap.createdAt,
+    updated_at: cap.updatedAt,
+  };
+  return new Response(JSON.stringify({ vault_cap: wire }), {
+    status: 200,
+    headers: { "content-type": "application/json", "cache-control": "no-store" },
+  });
+}

package/src/cli.ts

@@ -8,6 +8,7 @@
 
 import { MissingDependencyError } from "@openparachute/depcheck";
 import pkg from "../package.json" with { type: "json" };
+import { validateHubOrigin } from "./api-settings-hub-origin.ts";
 import { CloudflaredStateError } from "./cloudflare/state.ts";
 // Command-implementation modules are loaded LAZILY inside their switch arms (see
 // `loadCommand` + each `case`), so a module that throws at eval-time is isolated
@@ -360,7 +361,32 @@ async function main(argv: string[]): Promise<number> {
         console.log(initHelp());
         return 0;
       }
-      const exposeExtract = extractNamedFlag(rest, "--expose");
+      const originExtract = extractHubOrigin(rest);
+      if (originExtract.error) {
+        console.error(`parachute init: ${originExtract.error}`);
+        return 1;
+      }
+      // Validate --hub-origin to the SAME shape `hub set-origin` enforces — the
+      // value is persisted to hub_settings.hub_origin and stamps the OAuth `iss`
+      // claim on every minted token, so a malformed path/scheme/credential must
+      // never reach the DB. Strip a trailing slash first (browser copy-paste
+      // ergonomics), then validate; pass the normalized form downstream.
+      let validatedHubOrigin: string | undefined;
+      if (originExtract.hubOrigin !== undefined) {
+        const result = validateHubOrigin(originExtract.hubOrigin.replace(/\/+$/, ""));
+        if (!result.ok) {
+          console.error(`parachute init: invalid --hub-origin: ${result.description}`);
+          return 1;
+        }
+        if (result.normalized === null) {
+          console.error(
+            "parachute init: invalid --hub-origin: an empty value is not a valid public origin.",
+          );
+          return 1;
+        }
+        validatedHubOrigin = result.normalized;
+      }
+      const exposeExtract = extractNamedFlag(originExtract.rest, "--expose");
       if (exposeExtract.error) {
         console.error(`parachute init: ${exposeExtract.error}`);
         return 1;
@@ -392,6 +418,7 @@ async function main(argv: string[]): Promise<number> {
         console.error(
           "usage: parachute init [--no-browser] [--no-expose-prompt]\n" +
             "                     [--expose none|tailnet|cloudflare]\n" +
+            "                     [--hub-origin <url>]\n" +
             "                     [--cli-wizard | --browser-wizard]",
         );
         return 1;
@@ -403,6 +430,7 @@ async function main(argv: string[]): Promise<number> {
       const initOpts: Parameters<typeof init>[0] = {};
       if (noBrowser) initOpts.noBrowser = true;
       if (noExposePrompt) initOpts.noExposePrompt = true;
+      if (validatedHubOrigin) initOpts.hubOrigin = validatedHubOrigin;
       if (exposeExtract.value) {
         initOpts.exposeChoice = exposeExtract.value as "none" | "tailnet" | "cloudflare";
       }
@@ -931,6 +959,12 @@ async function main(argv: string[]): Promise<number> {
       return await mod.auth(rest);
     }
 
+    case "hub": {
+      const mod = await loadCommand("hub", () => import("./commands/hub.ts"));
+      if (!mod) return 1;
+      return await mod.hub(rest);
+    }
+
     case "vault": {
       const mod = await loadCommand("vault", () => import("./commands/vault.ts"));
       if (!mod) return 1;

package/src/commands/hub.ts

@@ -0,0 +1,173 @@
+/**
+ * `parachute hub <subcommand>` — hub-local configuration verbs that write
+ * `~/.parachute/hub.db`.
+ *
+ * Subcommands:
+ *   - `set-origin <url>` — persist the operator's canonical public hub origin
+ *     into `hub_settings.hub_origin`. That row is tier-1 in `resolveIssuer`
+ *     (hub-server.ts) — the OAuth `iss` claim hub stamps into every JWT — and,
+ *     since the onboarding-streamline 2026-06-25 boot-issuer fix, also seeds the
+ *     `PARACHUTE_HUB_ORIGINS` set hub injects into supervised modules
+ *     (vault/scribe) so they accept tokens minted under the public origin.
+ *
+ * The headline use case is the zero-SSH Caddy-direct DigitalOcean path: a bare
+ * droplet runs Caddy (Let's Encrypt TLS terminator + reverse proxy to the
+ * loopback hub), and the hub never does TLS. The hub binds loopback and reads
+ * its public origin from the DB. Before this verb the only way to set
+ * `hub_origin` was the admin SPA's `PUT /api/settings/hub-origin` — which needs
+ * a browser session you don't have on a freshly-provisioned headless box. The
+ * CLI verb closes that gap so a cloud-init script (or an operator over the DO
+ * console) can record the public origin without SSHing into the admin UI.
+ *
+ * Validation reuses `validateHubOrigin` (api-settings-hub-origin.ts) so the CLI
+ * and the SPA enforce the EXACT same shape: http(s) scheme, a hostname, no
+ * trailing slash / path / query / fragment / credentials. A loopback value is
+ * allowed (a dev/test box may legitimately set one) but warned about, since a
+ * loopback `hub_origin` would advertise a non-public issuer.
+ */
+
+import type { Database } from "bun:sqlite";
+import { validateHubOrigin } from "../api-settings-hub-origin.ts";
+import { CONFIG_DIR } from "../config.ts";
+import { hubDbPath, openHubDb } from "../hub-db.ts";
+import { setHubOrigin } from "../hub-settings.ts";
+import { isLoopbackOrigin } from "../vault-hub-origin-env.ts";
+
+export interface HubCommandDeps {
+  configDir?: string;
+  log?: (line: string) => void;
+  /**
+   * Test seam: open the hub DB. Production opens `hub.db` under the resolved
+   * `configDir` (running migrations). Tests pass an in-memory / temp DB so the
+   * write is exercised without touching the operator's live `~/.parachute`.
+   */
+  openDb?: (configDir: string) => Database;
+}
+
+/**
+ * `parachute hub set-origin <url>`. Validates + canonicalizes the URL, persists
+ * it to `hub_settings.hub_origin`, and prints the restart note (already-running
+ * supervised modules pick up the widened `PARACHUTE_HUB_ORIGINS` set only on
+ * their next `parachute restart`, because that set is injected at child-spawn
+ * time). Returns 0 on success, 1 on a validation / write failure.
+ */
+export async function hubSetOrigin(
+  args: readonly string[],
+  deps: HubCommandDeps = {},
+): Promise<number> {
+  const configDir = deps.configDir ?? CONFIG_DIR;
+  const log = deps.log ?? ((line) => console.log(line));
+  const err = (line: string) => console.error(line);
+  const openDb = deps.openDb ?? ((dir: string) => openHubDb(hubDbPath(dir)));
+
+  const positional = args.filter((a) => !a.startsWith("-"));
+  const raw = positional[0];
+  if (raw === undefined) {
+    err("usage: parachute hub set-origin <url>");
+    err("example: parachute hub set-origin https://box.sslip.io");
+    return 1;
+  }
+  if (positional.length > 1) {
+    err(`parachute hub set-origin: unexpected argument "${positional[1]}"`);
+    err("usage: parachute hub set-origin <url>");
+    return 1;
+  }
+
+  // Strip a trailing slash up front so the convenient `https://host/` form is
+  // accepted (the operator copy-pastes a browser URL). `validateHubOrigin`
+  // itself REJECTS a trailing slash (it's the SPA's PUT body validator, where a
+  // strict shape is wanted) — we canonicalize here, then validate the rest of
+  // the shape (scheme / hostname / no-path / no-credentials) through the shared
+  // validator so the CLI and SPA agree on everything else.
+  const trimmed = raw.replace(/\/+$/, "");
+  const result = validateHubOrigin(trimmed);
+  if (!result.ok) {
+    err(`parachute hub set-origin: ${result.description}`);
+    return 1;
+  }
+  // `validateHubOrigin` maps empty / null to `normalized: null` (clear the row).
+  // `set-origin` with an explicit non-empty arg should never land there — a
+  // present positional that normalizes to null means the operator passed an
+  // empty string, which is not a valid public origin for this verb.
+  if (result.normalized === null) {
+    err("parachute hub set-origin: a non-empty origin URL is required");
+    err("usage: parachute hub set-origin <url>");
+    return 1;
+  }
+  const origin = result.normalized;
+
+  // Loopback is allowed (a dev/test box may set one deliberately) but warned —
+  // a loopback hub_origin advertises a non-public issuer, so remote devices
+  // and supervised resource servers reached over a public URL would reject it.
+  if (isLoopbackOrigin(origin)) {
+    log(`⚠ ${origin} is a loopback origin — it won't be reachable from other devices.`);
+    log("  Set the box's PUBLIC URL (e.g. https://<droplet-ip>.sslip.io) for a real deploy.");
+  }
+
+  const db = openDb(configDir);
+  try {
+    setHubOrigin(db, origin);
+  } finally {
+    db.close();
+  }
+
+  log(`✓ Canonical hub origin set to ${origin}.`);
+  log("  Stored in hub_settings — the OAuth issuer (`iss`) hub stamps on every token,");
+  log("  and the origin set injected into supervised modules so they accept it.");
+  log("");
+  log("Already-running modules (vault, scribe) pick up the widened origin set only on");
+  log("their next restart (it's injected at spawn time). Restart them to apply now:");
+  log("  parachute restart vault");
+  log("  parachute restart scribe   # if installed");
+  return 0;
+}
+
+/**
+ * `parachute hub <subcommand>` dispatcher. Mirrors `auth`'s shape (a thin
+ * router over subcommand handlers, each catching its own errors).
+ */
+export async function hub(args: readonly string[], deps: HubCommandDeps = {}): Promise<number> {
+  const sub = args[0];
+  if (sub === undefined || sub === "--help" || sub === "-h" || sub === "help") {
+    console.log(hubHelp());
+    return 0;
+  }
+  if (sub === "set-origin") {
+    try {
+      return await hubSetOrigin(args.slice(1), deps);
+    } catch (err) {
+      console.error(
+        `parachute hub set-origin: ${err instanceof Error ? err.message : String(err)}`,
+      );
+      return 1;
+    }
+  }
+  console.error(`parachute hub: unknown subcommand "${sub}"`);
+  console.error("");
+  console.error(hubHelp());
+  return 1;
+}
+
+export function hubHelp(): string {
+  return `parachute hub — hub-local configuration
+
+Usage:
+  parachute hub set-origin <url>    set the canonical public hub origin
+
+Subcommands:
+  set-origin <url>    Persist the canonical public origin (OAuth issuer) to the
+                      hub DB. This is the URL the hub stamps as the \`iss\` claim
+                      on every token AND the origin it tells supervised modules
+                      (vault, scribe) to accept. Use it on a reverse-proxy /
+                      Caddy-direct box where the hub binds loopback but is reached
+                      over a public HTTPS URL — no admin browser session needed.
+
+                      The URL must be http(s), with a hostname and no trailing
+                      slash / path / query. After it's set, restart already-running
+                      modules so they pick up the widened origin set.
+
+Examples:
+  parachute hub set-origin https://box.sslip.io
+  parachute hub set-origin https://parachute.example.com
+`;
+}

package/src/commands/init.ts

@@ -41,6 +41,7 @@ import { type ExposeState, readExposeState } from "../expose-state.ts";
 import { type EnsureHubOpts, HUB_DEFAULT_PORT, HUB_SVC, readHubPort } from "../hub-control.ts";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import { deriveHubOrigin } from "../hub-origin.ts";
+import { setHubOrigin } from "../hub-settings.ts";
 import {
   type EnsureHubVersionMatchesResult,
   ensureHubUnit,
@@ -172,7 +173,11 @@ export interface InitOpts {
    * Test seam: shim for the CLI wizard chain (hub#168 Cut 3). Production
    * lazy-imports `runCliWizard` from `./wizard.ts`. Tests pass a stub.
    */
-  runCliWizardImpl?: (opts: { hubUrl: string; log: (l: string) => void }) => Promise<number>;
+  runCliWizardImpl?: (opts: {
+    hubUrl: string;
+    log: (l: string) => void;
+    configDir?: string;
+  }) => Promise<number>;
   /**
    * Skip the "browser or CLI?" wizard-choice prompt (hub#168 Cut 4). Used
    * by pre-Cut-4 tests that don't expect the new prompt + by the
@@ -180,6 +185,27 @@ export interface InitOpts {
    * already known so there's no question to ask).
    */
   noWizardPrompt?: boolean;
+  /**
+   * Canonical public hub origin (the OAuth issuer / `iss` claim). Persisted to
+   * `hub_settings.hub_origin` BEFORE the hub unit starts + modules spawn, so
+   * supervised vault/scribe come up with the public origin already in their
+   * `PARACHUTE_HUB_ORIGINS` set in ONE pass — no restart needed. The headline
+   * use case is the zero-SSH Caddy-direct path: a cloud-init script passes
+   * `--hub-origin https://<droplet-ip>.sslip.io` so a reverse-proxied box
+   * records its public origin without an admin browser session. Validated +
+   * canonicalized by the CLI before it reaches here; persisted via the
+   * `setHubOriginImpl` seam. Loopback / non-http(s) values never reach this far
+   * (the CLI rejects them via `validateHubOrigin`). Absent → no-op (the laptop /
+   * loopback path is unchanged).
+   */
+  hubOrigin?: string;
+  /**
+   * Test seam: persist the canonical hub origin to `hub_settings.hub_origin`.
+   * Production opens `hub.db` (running migrations) and calls `setHubOrigin`.
+   * Tests pass a stub to assert the write happens BEFORE `ensureHub` without
+   * touching the operator's live DB. Receives the resolved configDir + origin.
+   */
+  setHubOriginImpl?: (configDir: string, origin: string) => void;
   /**
    * Test seam: probe the running hub for its first-claim bootstrap token
    * (hub#576). Production hits `GET http://127.0.0.1:<port>/admin/setup` with
@@ -387,6 +413,25 @@ async function defaultEnsureHubViaUnit(opts: EnsureHubOpts): Promise<{
   throw new Error(result.messages.join("\n") || `hub unit bringup failed (${result.outcome}).`);
 }
 
+/**
+ * Default impl for the `--hub-origin` persistence step. Opens `hub.db` (running
+ * migrations on a fresh box) and writes `hub_settings.hub_origin`. Runs BEFORE
+ * the hub unit starts so the boot-time issuer resolution + child-spawn env
+ * (`PARACHUTE_HUB_ORIGINS`) pick up the public origin in one pass. The DB is an
+ * on-disk SQLite file shared with the (not-yet-started) serve process, so a
+ * write here is visible to the unit when it boots. The CLI has already
+ * validated + canonicalized the URL via `validateHubOrigin`, so this trusts the
+ * input (mirrors `setHubOrigin`'s typed-callsite contract).
+ */
+function defaultSetHubOrigin(configDir: string, origin: string): void {
+  const db = openHubDb(hubDbPath(configDir));
+  try {
+    setHubOrigin(db, origin);
+  } finally {
+    db.close();
+  }
+}
+
 /**
  * Resolve the issuer to mint the operator token under. At init time the hub is
  * reachable on loopback (just installed); prefer the live expose-state origin
@@ -485,6 +530,7 @@ async function defaultInstallVaultModule(configDir: string, manifestPath: string
 async function defaultRunCliWizard(opts: {
   hubUrl: string;
   log: (l: string) => void;
+  configDir?: string;
 }): Promise<number> {
   const { runCliWizard } = await import("./wizard.ts");
   return await runCliWizard(opts);
@@ -624,10 +670,32 @@ export async function init(opts: InitOpts = {}): Promise<number> {
   const installVaultModuleImpl = opts.installVaultModuleImpl ?? defaultInstallVaultModule;
   const runCliWizardImpl = opts.runCliWizardImpl ?? defaultRunCliWizard;
   const fetchBootstrapTokenImpl = opts.fetchBootstrapTokenImpl ?? defaultFetchBootstrapToken;
+  const setHubOriginImpl = opts.setHubOriginImpl ?? defaultSetHubOrigin;
 
   log("Parachute init — getting your hub set up.");
   log("");
 
+  // Step 0: persist `--hub-origin` BEFORE the hub unit starts (below). The
+  // boot-time issuer resolution + child-spawn env (`PARACHUTE_HUB_ORIGINS`)
+  // both read `hub_settings.hub_origin`, so writing it now means vault/scribe
+  // come up with the public origin already in their accepted-`iss` set in ONE
+  // pass — no restart needed (the Caddy-direct zero-SSH path). A failure here
+  // is non-fatal: warn + continue (the operator can re-run `parachute hub
+  // set-origin` later), since init's contract is hub up → wizard regardless.
+  if (opts.hubOrigin) {
+    try {
+      setHubOriginImpl(configDir, opts.hubOrigin);
+      log(`✓ Canonical hub origin set to ${opts.hubOrigin} (OAuth issuer).`);
+      log("");
+    } catch (err) {
+      const detail = err instanceof Error ? err.message : String(err);
+      log(
+        `⚠ Couldn't persist the hub origin (${detail}); set it later with \`parachute hub set-origin <url>\`.`,
+      );
+      log("");
+    }
+  }
+
   // Step 1: hub running?
   // NB: under the Phase 3a unit-managed hub there is no pidfile, so
   // `processState(HUB_SVC)` reports not-running on EVERY init re-run even when
@@ -895,7 +963,10 @@ export async function init(opts: InitOpts = {}): Promise<number> {
     // (the loopback-gated GET /admin/setup probe) — the operator never has to
     // copy the token out of the startup logs.
     const cliWizardUrl = `http://127.0.0.1:${hubPort}`;
-    return await runCliWizardImpl({ hubUrl: cliWizardUrl, log });
+    // Pass the resolved configDir so the CLI wizard's transcription step can
+    // write scribe's config (onboarding-streamline hub PR1). Without it the
+    // step is skipped.
+    return await runCliWizardImpl({ hubUrl: cliWizardUrl, log, configDir });
   }
 
   // Step 5: offer to open the browser. Skip in non-TTY shells (CI),

package/src/commands/serve-boot.ts

@@ -18,7 +18,7 @@
 
 import { join } from "node:path";
 import { readEnvFileValues } from "../env-file.ts";
-import { HUB_ORIGIN_ENV } from "../hub-origin.ts";
+import { HUB_ORIGINS_ENV, HUB_ORIGIN_ENV } from "../hub-origin.ts";
 import { ModuleManifestError } from "../module-manifest.ts";
 import {
   type ServiceSpec,
@@ -30,6 +30,7 @@ import {
 import { type ServiceEntry, readManifestLenient, upsertService } from "../services-manifest.ts";
 import { enrichedPath } from "../spawn-path.ts";
 import type { Supervisor } from "../supervisor.ts";
+import { buildHubOriginsEnvValue } from "../vault-hub-origin-env.ts";
 
 export interface BootOpts {
   /** Path to services.json. */
@@ -197,7 +198,20 @@ export function buildModuleSpawnRequest(
     PORT: String(entry.port),
     ...fileEnvSansPort,
   };
-  if (opts.hubOrigin) env[HUB_ORIGIN_ENV] = opts.hubOrigin;
+  if (opts.hubOrigin) {
+    env[HUB_ORIGIN_ENV] = opts.hubOrigin;
+    // Multi-origin iss-set (onboarding-streamline 2026-06-25): alongside the
+    // single canonical origin, inject the SET of origins this hub legitimately
+    // answers on (issuer ∪ loopback aliases ∪ expose-state ∪ platform). A
+    // resource server on scope-guard ≥0.5.0 widens its accepted-`iss` check to
+    // this set, so a token minted under one URL of a multi-URL box validates
+    // when the resource is reached via another URL of the SAME box. SECURITY:
+    // the set is hub-controlled config/disk state only, NEVER a request Host —
+    // see `buildHubOriginsEnvValue`. The single `PARACHUTE_HUB_ORIGIN` above
+    // stays for back-compat with older scope-guard.
+    const originsValue = buildHubOriginsEnvValue(opts.configDir, opts.hubOrigin);
+    if (originsValue) env[HUB_ORIGINS_ENV] = originsValue;
+  }
   if (opts.extraEnv) Object.assign(env, opts.extraEnv);
 
   const req: SpawnReqShape = { short, cmd };