@openparachute/hub 0.7.4-rc.20 → 0.7.4-rc.22

package/src/__tests__/sessions.test.ts

@@ -5,12 +5,14 @@ import { join } from "node:path";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import {
   SESSION_COOKIE_NAME,
+  SESSION_MAX_LIFETIME_MS,
   buildSessionClearCookie,
   buildSessionCookie,
   createSession,
   deleteSession,
   findSession,
   parseSessionCookie,
+  touchSession,
 } from "../sessions.ts";
 import { createUser } from "../users.ts";
 
@@ -67,6 +69,84 @@ describe("createSession + findSession", () => {
   });
 });
 
+describe("touchSession (sliding renewal)", () => {
+  const HOUR = 3600 * 1000;
+  const DAY = 24 * HOUR;
+
+  test("slides expires_at forward to now + TTL", async () => {
+    const { db, userId, cleanup } = await makeDb();
+    try {
+      const t0 = new Date("2026-01-01T00:00:00Z");
+      const s = createSession(db, { userId, now: () => t0 });
+      // Original expiry: t0 + 24h.
+      expect(new Date(s.expiresAt).getTime()).toBe(t0.getTime() + DAY);
+      // Touch 1h later → expiry becomes (t0 + 1h) + 24h.
+      const t1 = new Date(t0.getTime() + HOUR);
+      touchSession(db, s.id, () => t1);
+      const found = findSession(db, s.id, () => t1);
+      expect(new Date(found?.expiresAt ?? 0).getTime()).toBe(t1.getTime() + DAY);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("a touched session outlives the ORIGINAL 24h expiry", async () => {
+    const { db, userId, cleanup } = await makeDb();
+    try {
+      const t0 = new Date("2026-01-01T00:00:00Z");
+      const s = createSession(db, { userId, now: () => t0 });
+      // Activity at +12h slides expiry to +36h.
+      touchSession(db, s.id, () => new Date(t0.getTime() + 12 * HOUR));
+      // At +30h — PAST the original +24h — the session is still alive.
+      const at30h = new Date(t0.getTime() + 30 * HOUR);
+      expect(findSession(db, s.id, () => at30h)?.id).toBe(s.id);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("an UNtouched session still expires at the original 24h", async () => {
+    const { db, userId, cleanup } = await makeDb();
+    try {
+      const t0 = new Date("2026-01-01T00:00:00Z");
+      const s = createSession(db, { userId, now: () => t0 });
+      // No touch — at +25h it's gone (today's absolute-TTL behavior preserved
+      // for idle / closed tabs that stop re-minting).
+      const at25h = new Date(t0.getTime() + 25 * HOUR);
+      expect(findSession(db, s.id, () => at25h)).toBeNull();
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("caps at created_at + SESSION_MAX_LIFETIME_MS (sliding can't run forever)", async () => {
+    const { db, userId, cleanup } = await makeDb();
+    try {
+      const t0 = new Date("2026-01-01T00:00:00Z");
+      const s = createSession(db, { userId, now: () => t0 });
+      const ceiling = t0.getTime() + SESSION_MAX_LIFETIME_MS;
+      // A touch near the ceiling would slide to now + 24h, but the cap pins it.
+      const nearCeiling = new Date(ceiling - HOUR); // raw slide would be ceiling + 23h
+      touchSession(db, s.id, () => nearCeiling);
+      const found = findSession(db, s.id, () => nearCeiling);
+      expect(new Date(found?.expiresAt ?? 0).getTime()).toBe(ceiling);
+      // Past the ceiling the session is dead even though it was just "active".
+      expect(findSession(db, s.id, () => new Date(ceiling + 1000))).toBeNull();
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("no-op on an unknown session id (does not throw)", async () => {
+    const { db, cleanup } = await makeDb();
+    try {
+      expect(() => touchSession(db, "no-such-session")).not.toThrow();
+    } finally {
+      cleanup();
+    }
+  });
+});
+
 describe("deleteSession", () => {
   test("removes the session row", async () => {
     const { db, userId, cleanup } = await makeDb();

package/src/account-setup.ts

@@ -62,6 +62,7 @@
  * scope-guard.
  */
 import type { Database } from "bun:sqlite";
+import { recordLoginUnlock } from "./admin-lock.ts";
 import { renderAdminError, renderInviteSetup } from "./admin-login-ui.ts";
 import { type RunResult, provisionVault } from "./admin-vaults.ts";
 import { SERVICES_MANIFEST_PATH } from "./config.ts";
@@ -528,6 +529,7 @@ export async function handleAccountSetupPost(
 
   // (6) Sign the invitee in + land them on /account/.
   const session = createSession(deps.db, { userId });
+  recordLoginUnlock(deps.db, session.id);
   const sessionCookie = buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000), {
     secure: isHttpsRequest(req),
   });

package/src/admin-agent-grants.ts

@@ -131,6 +131,16 @@ export interface AgentGrantsDeps {
    * (`<hubOrigin>/oauth/agent-grant/callback`).
    */
   hubOrigin: string;
+  /**
+   * SET of origins the hub answers on (loopback ∪ expose-state ∪ platform ∪
+   * per-request issuer), built via `buildHubBoundOrigins`. The module's
+   * host-admin bearer `iss` is validated against THIS set rather than the
+   * single `hubOrigin`, so the agent module's credential minted under a
+   * still-valid prior origin keeps working across an origin switch (hub#516
+   * parity). Minted tokens still carry `hubOrigin`. Absent → falls back to
+   * `[hubOrigin]` (the prior strict per-request behavior).
+   */
+  knownIssuers?: readonly string[];
   /** Absolute path to `agent-grants.json` in the hub state dir. */
   storePath: string;
   /** Absolute path to `agent-oauth-flows.json` (the in-flight OAuth consents, 4b-2). */
@@ -249,7 +259,12 @@ async function requireModuleAuth(
   deps: AgentGrantsDeps,
 ): Promise<AdminAuthContext | Response> {
   try {
-    return await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.hubOrigin);
+    return await requireScope(
+      deps.db,
+      req,
+      HOST_ADMIN_SCOPE,
+      deps.knownIssuers ?? [deps.hubOrigin],
+    );
   } catch (err) {
     return adminAuthErrorResponse(err as AdminAuthError);
   }

package/src/admin-auth.ts

@@ -59,15 +59,24 @@ export function extractBearerToken(req: Request): string {
  * and check it carries `requiredScope`. Returns surfaced claims on success;
  * throws `AdminAuthError` (401 or 403) otherwise.
  *
- * `expectedIssuer` MUST be the hub's own origin — the same value baked into
- * tokens we sign. Defense in depth: even though we can only verify our own
- * keys, the `iss` mismatch reject keeps cross-issuer confusion impossible.
+ * `expectedIssuer` is the hub's own origin(s) — the same value(s) baked into
+ * tokens we sign. Pass a single string for a single-origin hub, or the SET of
+ * origins the hub legitimately answers on (`buildHubBoundOrigins`: loopback ∪
+ * expose-state ∪ platform ∪ per-request issuer) so a credential minted under
+ * a still-valid prior origin keeps validating across an origin switch — the
+ * same multi-origin posture the OAuth path and `validateHostAdminToken`
+ * already use. Defense in depth: even though we can only verify our own keys,
+ * the `iss`-∈-set reject keeps cross-issuer confusion impossible. SECURITY:
+ * the set is ONLY an additive `iss` membership relaxation — `validateAccessToken`
+ * verifies the signature against the hub's own key FIRST, so only tokens this
+ * hub minted ever reach the `iss` check; never pass a raw request Host, only a
+ * `buildHubBoundOrigins`-derived set.
  */
 export async function requireScope(
   db: Database,
   req: Request,
   requiredScope: string,
-  expectedIssuer: string,
+  expectedIssuer: string | readonly string[],
 ): Promise<AdminAuthContext> {
   const token = extractBearerToken(req);
 

package/src/admin-clients.ts

@@ -64,6 +64,15 @@ export interface AdminClientsDeps {
   db: Database;
   /** Hub origin — passed through to JWT validation as the expected `iss`. */
   issuer: string;
+  /**
+   * SET of origins the hub answers on (loopback ∪ expose-state ∪ platform ∪
+   * per-request `issuer`), built via `buildHubBoundOrigins`. The bearer's
+   * `iss` is validated against THIS set rather than the single `issuer`, so a
+   * credential minted under a still-valid prior origin keeps working across an
+   * origin switch (hub#516 parity). Absent → falls back to `[issuer]` (the
+   * prior strict per-request behavior; tests/non-HTTP callers unaffected).
+   */
+  knownIssuers?: readonly string[];
 }
 
 export interface AdminClientView {
@@ -93,7 +102,7 @@ export async function handleGetClient(
     return jsonError(405, "method_not_allowed", "use GET");
   }
   try {
-    await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.issuer);
+    await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.knownIssuers ?? [deps.issuer]);
   } catch (err) {
     return adminAuthErrorResponse(err as AdminAuthError);
   }
@@ -129,7 +138,7 @@ export async function handleApproveClient(
   }
   let ctx: AdminAuthContext;
   try {
-    ctx = await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.issuer);
+    ctx = await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.knownIssuers ?? [deps.issuer]);
   } catch (err) {
     return adminAuthErrorResponse(err as AdminAuthError);
   }
@@ -212,7 +221,7 @@ export async function handleDeleteClient(
   }
   let ctx: AdminAuthContext;
   try {
-    ctx = await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.issuer);
+    ctx = await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.knownIssuers ?? [deps.issuer]);
   } catch (err) {
     return adminAuthErrorResponse(err as AdminAuthError);
   }

package/src/admin-grants.ts

@@ -38,6 +38,15 @@ export interface AdminGrantsDeps {
   db: Database;
   /** Hub origin — passed through to JWT validation as the expected `iss`. */
   issuer: string;
+  /**
+   * SET of origins the hub answers on (loopback ∪ expose-state ∪ platform ∪
+   * per-request `issuer`), built via `buildHubBoundOrigins`. The bearer's
+   * `iss` is validated against THIS set rather than the single `issuer`, so a
+   * credential minted under a still-valid prior origin keeps working across an
+   * origin switch (hub#516 parity). Absent → falls back to `[issuer]` (the
+   * prior strict per-request behavior; tests/non-HTTP callers unaffected).
+   */
+  knownIssuers?: readonly string[];
 }
 
 export interface AdminGrantListing {
@@ -55,7 +64,7 @@ export async function handleListGrants(req: Request, deps: AdminGrantsDeps): Pro
   }
   let ctx: AdminAuthContext;
   try {
-    ctx = await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.issuer);
+    ctx = await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.knownIssuers ?? [deps.issuer]);
   } catch (err) {
     return adminAuthErrorResponse(err as AdminAuthError);
   }
@@ -111,7 +120,7 @@ export async function handleRevokeGrant(
   }
   let ctx: AdminAuthContext;
   try {
-    ctx = await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.issuer);
+    ctx = await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.knownIssuers ?? [deps.issuer]);
   } catch (err) {
     return adminAuthErrorResponse(err as AdminAuthError);
   }

package/src/admin-handlers.ts

@@ -11,6 +11,7 @@
  * (`parachute_hub_csrf` cookie + `__csrf` form field, constant-time compare).
  */
 import type { Database } from "bun:sqlite";
+import { recordLoginUnlock } from "./admin-lock.ts";
 import { renderAdminError, renderAdminLogin, renderTotpChallenge } from "./admin-login-ui.ts";
 import { CSRF_FIELD_NAME, ensureCsrfToken, verifyCsrfToken } from "./csrf.ts";
 import {
@@ -283,6 +284,7 @@ function mintSessionAndRedirect(
   extraCookies: string[] = [],
 ): Response {
   const session = createSession(db, { userId: user.id });
+  recordLoginUnlock(db, session.id);
   const sessionCookie = buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000), {
     secure: isHttpsRequest(req),
   });

package/src/admin-host-admin-token.ts

@@ -49,7 +49,14 @@
 import type { Database } from "bun:sqlite";
 import { lockedResponse, requireUnlocked } from "./admin-lock.ts";
 import { signAccessToken } from "./jwt-sign.ts";
-import { findSession, parseSessionCookie } from "./sessions.ts";
+import { isHttpsRequest } from "./request-protocol.ts";
+import {
+  SESSION_TTL_MS,
+  buildSessionCookie,
+  findSession,
+  parseSessionCookie,
+  touchSession,
+} from "./sessions.ts";
 import { isFirstAdmin } from "./users.ts";
 
 /** Short TTL — page-snapshot threats can't carry the token forever. */
@@ -115,6 +122,21 @@ export async function handleHostAdminToken(
     // sentinel matching admin OAuth tokens.
     vaultScope: [],
   });
+  // Sliding session renewal (THE frequent-re-login fix). The SPA re-mints here
+  // roughly every ~10 min while a tab is open; each successful mint pushes the
+  // session's `expires_at` forward, so an active operator isn't hard-logged-out
+  // at the 24h mark. A closed tab stops minting and still expires; the absolute
+  // ceiling in `touchSession` bounds a left-open-but-idle tab. The renewed
+  // Set-Cookie keeps the EXACT attributes session creation uses — HttpOnly,
+  // Secure-when-https, SameSite=Lax, Path=/, host-only (no Domain) — so the
+  // cookie's Max-Age tracks the extended expiry without broadening the cookie.
+  // This does NOT touch the admin-lock idle window (sliding there is
+  // heartbeat-only, by design — see admin-lock.ts); the two windows are
+  // independent.
+  touchSession(deps.db, sid);
+  const sessionCookie = buildSessionCookie(sid, Math.floor(SESSION_TTL_MS / 1000), {
+    secure: isHttpsRequest(req),
+  });
   return new Response(
     JSON.stringify({
       token: minted.token,
@@ -128,6 +150,7 @@ export async function handleHostAdminToken(
         // No browser cache — token rotates per-fetch, and a stale 200 from a
         // back/forward navigation could hand the SPA a long-expired JWT.
         "cache-control": "no-store",
+        "set-cookie": sessionCookie,
       },
     },
   );

package/src/admin-lock.ts

@@ -174,6 +174,22 @@ export function recordUnlock(
   unlockedUntil.set(sessionId, now + idleSeconds * 1000);
 }
 
+/**
+ * Open an unlock window for a session that JUST completed a full auth
+ * (password + any 2FA). The PIN's threat model is the idle/grabbed tab, NOT a
+ * third gate the instant after the auth boundary — re-prompting for the PIN
+ * the moment after a successful login is pure friction with no security gain
+ * (the user just proved a stronger factor). No-op when the lock feature is off.
+ *
+ * Called from every session-mint point (password login, OAuth login,
+ * account-setup, setup-wizard) so a freshly-authenticated session always lands
+ * working, never on the lock screen. Idle re-entry still re-locks as before.
+ */
+export function recordLoginUnlock(db: Database, sessionId: string, now: number = Date.now()): void {
+  if (!isLockConfigured(db)) return;
+  recordUnlock(sessionId, getIdleSeconds(db), now);
+}
+
 /**
  * Slide the unlock window forward by `idleSeconds` IF the session is currently
  * unlocked. Called on admin activity (heartbeat + every successful mint) so an

package/src/admin-vaults.ts

@@ -129,6 +129,15 @@ export interface CreateVaultDeps {
   db: Database;
   /** Hub origin used to validate JWT `iss` and to build the response `url`. */
   issuer: string;
+  /**
+   * SET of origins the hub legitimately answers on (loopback ∪ expose-state ∪
+   * platform ∪ per-request `issuer`), built via `buildHubBoundOrigins`. The
+   * admin bearer's `iss` is validated against THIS set rather than the single
+   * `issuer`, so a host-admin credential minted under a still-valid prior
+   * origin keeps working across an origin switch (hub#516 parity). Absent →
+   * falls back to `[issuer]` (the prior strict per-request behavior).
+   */
+  knownIssuers?: readonly string[];
   /** Override the services.json path. Defaults to `~/.parachute/services.json`. */
   manifestPath?: string;
   /**
@@ -442,7 +451,7 @@ export async function handleCreateVault(req: Request, deps: CreateVaultDeps): Pr
   // Auth gate: parachute:host:admin scope. Maps an AdminAuthError straight
   // to an RFC 6750 401/403 — the route handler doesn't care which.
   try {
-    await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.issuer);
+    await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.knownIssuers ?? [deps.issuer]);
   } catch (err) {
     return adminAuthErrorResponse(err as AdminAuthError);
   }
@@ -530,6 +539,15 @@ export interface DeleteVaultDeps {
   db: Database;
   /** Hub origin — JWT `iss` validation + cascade mint issuer. */
   issuer: string;
+  /**
+   * SET of origins the hub legitimately answers on (loopback ∪ expose-state ∪
+   * platform ∪ per-request `issuer`), built via `buildHubBoundOrigins`. The
+   * admin bearer's `iss` is validated against THIS set rather than the single
+   * `issuer`, so a host-admin credential minted under a still-valid prior
+   * origin keeps working across an origin switch (hub#516 parity). Absent →
+   * falls back to `[issuer]` (the prior strict per-request behavior).
+   */
+  knownIssuers?: readonly string[];
   /** Override the services.json path. Defaults to `~/.parachute/services.json`. */
   manifestPath?: string;
   /** Absolute path to `connections.json` in the hub state dir. */
@@ -693,7 +711,12 @@ export async function handleDeleteVault(
   // Auth gate: parachute:host:admin — the same gate as POST /vaults.
   let adminSub: string;
   try {
-    const auth = await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.issuer);
+    const auth = await requireScope(
+      deps.db,
+      req,
+      HOST_ADMIN_SCOPE,
+      deps.knownIssuers ?? [deps.issuer],
+    );
     adminSub = auth.sub;
   } catch (err) {
     return adminAuthErrorResponse(err as AdminAuthError);

package/src/api-hub-upgrade.ts

@@ -107,6 +107,15 @@ export interface ApiHubUpgradeDeps {
   db: Database;
   /** Hub origin — validates the bearer's `iss`. */
   issuer: string;
+  /**
+   * SET of origins the hub answers on (loopback ∪ expose-state ∪ platform ∪
+   * per-request `issuer`), built via `buildHubBoundOrigins`. The bearer's
+   * `iss` is validated against THIS set rather than the single `issuer`, so a
+   * credential minted under a still-valid prior origin keeps working across an
+   * origin switch (hub#516 parity). Absent → falls back to `[issuer]` (the
+   * prior strict per-request behavior; tests/non-HTTP callers unaffected).
+   */
+  knownIssuers?: readonly string[];
   /** PARACHUTE_HOME — where the status file is read/written. */
   configDir: string;
   /**
@@ -155,7 +164,11 @@ async function authorize(req: Request, deps: ApiHubUpgradeDeps): Promise<Respons
   const bearer = auth.slice("Bearer ".length).trim();
   if (!bearer) return jsonError(401, "unauthenticated", "empty bearer token");
   try {
-    const validated = await validateAccessToken(deps.db, bearer, deps.issuer);
+    const validated = await validateAccessToken(
+      deps.db,
+      bearer,
+      deps.knownIssuers ?? [deps.issuer],
+    );
     if (typeof validated.payload.sub !== "string" || validated.payload.sub.length === 0) {
       return jsonError(401, "unauthenticated", "bearer token has no sub claim");
     }

package/src/api-hub.ts

@@ -52,6 +52,15 @@ export interface ApiHubDeps {
   db: Database;
   /** Hub origin — used to validate the bearer's `iss`. */
   issuer: string;
+  /**
+   * SET of origins the hub answers on (loopback ∪ expose-state ∪ platform ∪
+   * per-request `issuer`), built via `buildHubBoundOrigins`. The bearer's
+   * `iss` is validated against THIS set rather than the single `issuer`, so a
+   * credential minted under a still-valid prior origin keeps working across an
+   * origin switch (hub#516 parity). Absent → falls back to `[issuer]` (the
+   * prior strict per-request behavior; tests/non-HTTP callers unaffected).
+   */
+  knownIssuers?: readonly string[];
   /**
    * Override the directory used to locate the hub's package.json and to
    * classify install source. Defaults to `dirname(import.meta.url)` —
@@ -96,7 +105,7 @@ export async function handleApiHub(req: Request, deps: ApiHubDeps): Promise<Resp
   // Bearer-gate on `parachute:host:admin`. Same shape as the other admin
   // endpoints — SPA mints via /admin/host-admin-token.
   try {
-    await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.issuer);
+    await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.knownIssuers ?? [deps.issuer]);
   } catch (err) {
     return adminAuthErrorResponse(err);
   }

package/src/api-invites.ts

@@ -52,6 +52,16 @@ export interface ApiInvitesDeps {
   db: Database;
   /** Hub origin — JWT `iss` validation AND the base for the redemption URL. */
   issuer: string;
+  /**
+   * SET of origins the hub answers on (loopback ∪ expose-state ∪ platform ∪
+   * per-request `issuer`), built via `buildHubBoundOrigins`. The bearer's
+   * `iss` is validated against THIS set rather than the single `issuer`, so a
+   * credential minted under a still-valid prior origin keeps working across an
+   * origin switch (hub#516 parity). The redemption URL still uses the single
+   * canonical `issuer`. Absent → falls back to `[issuer]` (the prior strict
+   * per-request behavior; tests/non-HTTP callers unaffected).
+   */
+  knownIssuers?: readonly string[];
   manifestPath?: string;
   now?: () => Date;
 }
@@ -399,7 +409,12 @@ export async function handleCreateInvite(req: Request, deps: ApiInvitesDeps): Pr
   try {
     // `requireScope` returns the validated claims; the admin's `sub` is the
     // `created_by` audit anchor (guaranteed present — it throws otherwise).
-    const auth = await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.issuer);
+    const auth = await requireScope(
+      deps.db,
+      req,
+      HOST_ADMIN_SCOPE,
+      deps.knownIssuers ?? [deps.issuer],
+    );
     authUserId = auth.sub;
   } catch (err) {
     return adminAuthErrorResponse(err as AdminAuthError);
@@ -544,7 +559,7 @@ export async function handleCreateInvite(req: Request, deps: ApiInvitesDeps): Pr
 export async function handleListInvites(req: Request, deps: ApiInvitesDeps): Promise<Response> {
   if (req.method !== "GET") return jsonError(405, "method_not_allowed", "use GET");
   try {
-    await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.issuer);
+    await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.knownIssuers ?? [deps.issuer]);
   } catch (err) {
     return adminAuthErrorResponse(err as AdminAuthError);
   }
@@ -564,7 +579,7 @@ export async function handleRevokeInvite(
 ): Promise<Response> {
   if (req.method !== "DELETE") return jsonError(405, "method_not_allowed", "use DELETE");
   try {
-    await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.issuer);
+    await requireScope(deps.db, req, HOST_ADMIN_SCOPE, deps.knownIssuers ?? [deps.issuer]);
   } catch (err) {
     return adminAuthErrorResponse(err as AdminAuthError);
   }

package/src/api-mint-token.ts

@@ -87,6 +87,17 @@ export interface ApiMintTokenDeps {
   db: Database;
   /** Hub origin — written into the JWT `iss` of minted tokens AND used to validate the bearer. */
   issuer: string;
+  /**
+   * SET of origins the hub legitimately answers on (loopback ∪ expose-state ∪
+   * platform ∪ per-request `issuer`), built via `buildHubBoundOrigins`. The
+   * caller's bearer `iss` is validated against THIS set rather than the single
+   * `issuer`, so a credential minted under a still-valid prior origin keeps
+   * minting across an origin switch (hub#516 parity — the live "mint refused"
+   * after `set-origin`). Minted tokens still carry the single canonical
+   * `issuer` as their `iss`. Absent → falls back to `[issuer]` (the prior
+   * strict per-request behavior; tests/non-HTTP callers unaffected).
+   */
+  knownIssuers?: readonly string[];
   /**
    * Names of vault instances currently registered in services.json (item D /
    * hub#450). When provided, a `vault:<name>:admin` mint whose `<name>` is not
@@ -133,7 +144,11 @@ export async function handleApiMintToken(req: Request, deps: ApiMintTokenDeps):
   let bearerSub: string;
   let bearerScopes: string[];
   try {
-    const validated = await validateAccessToken(deps.db, bearer, deps.issuer);
+    const validated = await validateAccessToken(
+      deps.db,
+      bearer,
+      deps.knownIssuers ?? [deps.issuer],
+    );
     const sub = validated.payload.sub;
     if (typeof sub !== "string" || sub.length === 0) {
       return jsonError(401, "unauthenticated", "bearer token has no sub claim");

package/src/api-modules.ts

@@ -759,6 +759,15 @@ export const API_MODULES_CHANNEL_REQUIRED_SCOPE = "parachute:host:admin";
 export interface ApiModulesChannelDeps {
   db: Database;
   issuer: string;
+  /**
+   * SET of origins the hub answers on (loopback ∪ expose-state ∪ platform ∪
+   * per-request `issuer`), built via `buildHubBoundOrigins` — same posture as
+   * {@link ApiModulesDeps.knownIssuers}. The bearer's `iss` is validated
+   * against THIS set rather than the single `issuer`, so the operator token
+   * (public `iss` after `expose`) is accepted on loopback. Absent → falls back
+   * to `[issuer]` (the prior strict per-request behavior).
+   */
+  knownIssuers?: readonly string[];
 }
 
 export async function handleApiModulesChannel(
@@ -781,7 +790,11 @@ export async function handleApiModulesChannel(
 
   // Bearer validation + scope check.
   try {
-    const validated = await validateAccessToken(deps.db, bearer, deps.issuer);
+    const validated = await validateAccessToken(
+      deps.db,
+      bearer,
+      deps.knownIssuers ?? [deps.issuer],
+    );
     if (typeof validated.payload.sub !== "string" || validated.payload.sub.length === 0) {
       return jsonError(401, "unauthenticated", "bearer token has no sub claim");
     }

package/src/api-revoke-token.ts

@@ -73,6 +73,15 @@ export interface ApiRevokeTokenDeps {
   db: Database;
   /** Hub origin — used to validate the bearer's `iss`. */
   issuer: string;
+  /**
+   * SET of origins the hub answers on (loopback ∪ expose-state ∪ platform ∪
+   * per-request `issuer`), built via `buildHubBoundOrigins`. The bearer's
+   * `iss` is validated against THIS set rather than the single `issuer`, so a
+   * credential minted under a still-valid prior origin keeps working across an
+   * origin switch (hub#516 parity). Absent → falls back to `[issuer]` (the
+   * prior strict per-request behavior; tests/non-HTTP callers unaffected).
+   */
+  knownIssuers?: readonly string[];
   /** Test seam for time. */
   now?: () => Date;
 }
@@ -102,7 +111,11 @@ export async function handleApiRevokeToken(
   // 2. Bearer validation (signature, issuer, expiry, hub-side revocation).
   let bearerScopes: string[];
   try {
-    const validated = await validateAccessToken(deps.db, bearer, deps.issuer);
+    const validated = await validateAccessToken(
+      deps.db,
+      bearer,
+      deps.knownIssuers ?? [deps.issuer],
+    );
     if (typeof validated.payload.sub !== "string" || validated.payload.sub.length === 0) {
       return jsonError(401, "unauthenticated", "bearer token has no sub claim");
     }

package/src/api-settings-hub-origin.ts

@@ -47,6 +47,15 @@ export const API_SETTINGS_HUB_ORIGIN_REQUIRED_SCOPE = "parachute:host:admin";
 export interface ApiSettingsHubOriginDeps {
   db: Database;
   issuer: string;
+  /**
+   * SET of origins the hub answers on (loopback ∪ expose-state ∪ platform ∪
+   * per-request `issuer`), built via `buildHubBoundOrigins`. The bearer's
+   * `iss` is validated against THIS set rather than the single `issuer`, so a
+   * credential minted under a still-valid prior origin keeps working across an
+   * origin switch (hub#516 parity). Absent → falls back to `[issuer]` (the
+   * prior strict per-request behavior; tests/non-HTTP callers unaffected).
+   */
+  knownIssuers?: readonly string[];
   /**
    * The currently-resolved issuer + its source layer. Computed by the
    * dispatcher (which has the request + `configuredIssuer` already in
@@ -186,7 +195,11 @@ export async function handleApiSettingsHubOrigin(
 
   // Bearer validation + scope check.
   try {
-    const validated = await validateAccessToken(deps.db, bearer, deps.issuer);
+    const validated = await validateAccessToken(
+      deps.db,
+      bearer,
+      deps.knownIssuers ?? [deps.issuer],
+    );
     if (typeof validated.payload.sub !== "string" || validated.payload.sub.length === 0) {
       return jsonError(401, "unauthenticated", "bearer token has no sub claim");
     }

package/src/api-settings-root-redirect.ts

@@ -44,6 +44,15 @@ export interface ApiSettingsRootRedirectDeps {
   db: Database;
   /** Issuer the bearer token must validate against (the hub's resolved issuer). */
   issuer: string;
+  /**
+   * SET of origins the hub answers on (loopback ∪ expose-state ∪ platform ∪
+   * per-request `issuer`), built via `buildHubBoundOrigins`. The bearer's
+   * `iss` is validated against THIS set rather than the single `issuer`, so a
+   * credential minted under a still-valid prior origin keeps working across an
+   * origin switch (hub#516 parity). Absent → falls back to `[issuer]` (the
+   * prior strict per-request behavior; tests/non-HTTP callers unaffected).
+   */
+  knownIssuers?: readonly string[];
   /**
    * Env seam for the resolver's env layer. Defaults to `process.env`. Threaded
    * so the dispatcher (and tests) can resolve `PARACHUTE_HUB_ROOT_REDIRECT`
@@ -120,7 +129,11 @@ export async function handleApiSettingsRootRedirect(
 
   // Bearer validation + scope check.
   try {
-    const validated = await validateAccessToken(deps.db, bearer, deps.issuer);
+    const validated = await validateAccessToken(
+      deps.db,
+      bearer,
+      deps.knownIssuers ?? [deps.issuer],
+    );
     if (typeof validated.payload.sub !== "string" || validated.payload.sub.length === 0) {
       return jsonError(401, "unauthenticated", "bearer token has no sub claim");
     }