@openparachute/hub 0.7.6 → 0.7.7-rc.13

package/src/account-session.ts

@@ -0,0 +1,132 @@
+/**
+ * `GET /account/session` — the same-origin boot oracle (hub-parity P1; the
+ * hub's twin of cloud `account-session.ts`). Returns `{ signed_in, csrf, ... }`
+ * so the same-origin `parachute-app` — served at the hub's own origin — can
+ * (a) decide whether to render the signed-in UI or the sign-in ceremony, and
+ * (b) echo `csrf` back as `__csrf` on its next same-origin `POST /account/token`
+ * mint (C2). The CSRF cookie is `HttpOnly` (csrf.ts), so the SPA can't read it
+ * directly; this hands the token over the same way a server-rendered form's
+ * hidden input does.
+ *
+ * PUBLIC — no Bearer, no scope gate. It drives the `parachute_hub_session`
+ * cookie directly, same as `/api/me`: a client with no account Bearer yet has
+ * nothing else to authenticate a read with, and this endpoint IS the
+ * bootstrap. Mounted ABOVE the force-change-password gate (hub-server.ts
+ * CHOKE POINT 1) — it's a pure state oracle, not a mutating surface, so a
+ * pre-rotation user must still be able to read it (the app needs `signed_in` +
+ * `csrf` to drive the rotation ceremony itself, not get walled off before it
+ * can even ask). `POST /account/token` stays BELOW the gate — a pre-rotation
+ * user hits its 403 `force_change_password` there, and the app is expected to
+ * weather that (P4).
+ *
+ * SAME-ORIGIN ONLY, by design — mirrors cloud's posture exactly: the response
+ * is CREDENTIALED (it reflects the session cookie and sets the CSRF cookie),
+ * so it carries NO CORS headers. A cross-origin caller simply gets no
+ * `access-control-allow-origin`, so the browser blocks it from reading the
+ * body — intended, not an oversight.
+ */
+import type { Database } from "bun:sqlite";
+import { ensureCsrfToken } from "./csrf.ts";
+import { isHttpsRequest } from "./request-protocol.ts";
+import {
+  SESSION_TTL_MS,
+  buildSessionCookie,
+  findActiveSession,
+  shouldSlideSession,
+  touchSession,
+} from "./sessions.ts";
+import { getUserById } from "./users.ts";
+
+export interface AccountSessionDeps {
+  db: Database;
+}
+
+/** Matches the `/account/*` 405 shape (`account-api.ts`'s `methodNotAllowed`)
+ * — same `{error, message}` body + `Allow` header, kept local to this file
+ * per the one-handler-one-file convention (`api-me.ts`, `account-token.ts`). */
+function methodNotAllowed(allow: string): Response {
+  return new Response(JSON.stringify({ error: "method_not_allowed", message: `use ${allow}` }), {
+    status: 405,
+    headers: { "content-type": "application/json", allow },
+  });
+}
+
+/**
+ * A credentialed JSON reply that can carry MULTIPLE Set-Cookie headers (the
+ * CSRF mint and the session slide's re-issue can coincide — a plain
+ * `Record`-keyed header init can't hold two `set-cookie` values). NO CORS
+ * headers (see the module note); `no-store` so a back/forward navigation
+ * never replays a stale csrf/session state. Mirrors cloud's `sessionJson`.
+ */
+function sessionJson(body: unknown, cookies: readonly string[]): Response {
+  const headers = new Headers({ "content-type": "application/json", "cache-control": "no-store" });
+  for (const c of cookies) headers.append("set-cookie", c);
+  return new Response(JSON.stringify(body), { status: 200, headers });
+}
+
+export function handleAccountSession(req: Request, deps: AccountSessionDeps): Response {
+  if (req.method !== "GET") return methodNotAllowed("GET");
+
+  // CSRF token for BOTH branches (G2 — anonymous CSRF; the piece `api-me.ts`
+  // lacks, since it mints only when signed in). ensureCsrfToken reuses an
+  // existing CSRF cookie or mints one (setCookie only when it minted) — it
+  // works WITHOUT a session and authorizes NOTHING alone (it's one half of a
+  // double-submit that also needs the matching cookie + same-origin + a live
+  // session at the mint gate it protects). Returning it on the signed-OUT
+  // branch lets the app run the sign-in moment in-app.
+  const csrf = ensureCsrfToken(req);
+  const cookies: string[] = [];
+  if (csrf.setCookie) cookies.push(csrf.setCookie);
+
+  // findActiveSession is the single chokepoint: it refuses an expired row (a
+  // logged-out row is gone outright). Nothing below rolls or reads a
+  // dead/absent session.
+  const session = findActiveSession(deps.db, req);
+  if (!session) {
+    return sessionJson({ signed_in: false, csrf: csrf.token }, cookies);
+  }
+
+  // Bounded slide (the G3 twin, and the reason NOT to call bare
+  // `touchSession` unconditionally here): this endpoint is POLLED — the
+  // app's `/check-email` screen hits it every few seconds while it waits for
+  // a magic-link-style click — so sliding only past
+  // `SESSION_SLIDE_THRESHOLD_MS` of remaining life bounds the write (and the
+  // cookie re-issue) to ~once per threshold per session, not per request.
+  if (shouldSlideSession(session)) {
+    touchSession(deps.db, session.id);
+    cookies.push(
+      buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000), {
+        secure: isHttpsRequest(req),
+      }),
+    );
+  }
+
+  const user = getUserById(deps.db, session.userId);
+  if (!user) {
+    // Session row points at a deleted user — treat as signed-out (the
+    // `api-me.ts` precedent) rather than surface a stale identity. Any slide
+    // cookie computed above still rides along; it's harmless (the row is
+    // about to be orphaned regardless) and keeping the branch simple beats
+    // special-casing a cookie rollback for a should-never-happen state.
+    return sessionJson({ signed_in: false, csrf: csrf.token }, cookies);
+  }
+
+  return sessionJson(
+    {
+      signed_in: true,
+      csrf: csrf.token,
+      // users.email is null-by-history (migration v15) — username is always
+      // present, email only when the row has one (B2 signup capture).
+      username: user.username,
+      ...(user.email ? { email: user.email } : {}),
+      account_created_at: user.createdAt,
+      // HUB EXTRA — additive, not part of the door-contract pin
+      // (`checkAccountSessionResponse` tolerates extra fields): lets the app
+      // hop a temp-password user straight to the change-password ceremony
+      // instead of hitting the force-change-password 403 wall on their next
+      // `/account/*` call.
+      ...(user.passwordChanged === false ? { password_change_required: true } : {}),
+    },
+    cookies,
+  );
+}

package/src/account-token.ts

@@ -0,0 +1,200 @@
+/**
+ * `POST /account/token` — exchange a valid admin session cookie for a
+ * short-lived JWT carrying the ACCOUNT credential: the superset
+ *
+ *   { account:self:admin, parachute:host:admin, parachute:host:auth }
+ *
+ * with `aud="account"`. This is the self-host door's half of the Parachute App
+ * campaign's `/account/*` contract (Phase 2, H1) — the same shape the cloud
+ * door mints from its own session cookie.
+ *
+ * Why a SUPERSET (SCOPE-b). The account bearer must drive both the net-new
+ * `/account/*` REST surface (H2, gated on `account:self:admin`) AND — on a
+ * single-operator self-host box — the EXISTING hub admin endpoints it wraps
+ * (`POST /vaults`, `/api/auth/*`, caps), all gated on `parachute:host:admin` /
+ * `parachute:host:auth` via `requireScope`. Carrying all three scopes means no
+ * existing hub endpoint needs rewiring: `requireScope` checks the scope claim +
+ * signature + `iss` and does NOT pin `aud` (admin-auth.ts), so the `aud="account"`
+ * token validates unchanged on the host-scoped surfaces. This is the "relabel a
+ * semantics that ships" path — it reuses the `admin-host-admin-token.ts` mint
+ * and adds the `account:self:admin` string on top of the host superset.
+ *
+ * Why `aud="account"` (SCOPE-a). The account token is minted with an explicit
+ * `aud="account"` (not the `inferAudience` fallback) so the `/account/*`
+ * validator can pin the audience and a vault RS's strict `aud=vault.<name>`
+ * check refuses it outright — an account token can never be spent as a vault
+ * token.
+ *
+ * Authorization — the same spine as `/admin/host-admin-token`:
+ *   1. **Session.** A valid, unexpired `parachute_hub_session` cookie (set by
+ *      `/login` after a password check). No session → 401.
+ *   2. **CSRF.** Unlike the GET host-admin mint, this is a POST that performs a
+ *      privileged mint, so it carries the double-submit CSRF token
+ *      (`__csrf` in the JSON body, same `verifyCsrfToken` as `/api/account/*`).
+ *      Missing/mismatched → 403. The hub-server dispatcher additionally applies
+ *      the strict same-origin Origin belt (`assertSameOriginForCookieMutation`)
+ *      before this handler runs — belt-and-suspenders on the cookie path.
+ *   3. **First-admin gate.** A valid session is necessary but NOT sufficient: it
+ *      must belong to the hub admin (earliest-created user row). Without this a
+ *      signed-in friend account could mint a full host-admin superset — a
+ *      privesc. On a single-operator box first-admin ≡ the account ≡ the box
+ *      (the ratified "operator ≡ account ≡ box"), so the first-admin gate is the
+ *      account gate. Non-first-admin session → 403.
+ *   4. **Admin screen-lock.** When the optional idle-lock PIN is set and this
+ *      session isn't in an unlock window, refuse (423) — same as the host-admin
+ *      mint (the account token is at least as powerful, so it inherits the gate).
+ *
+ * Statelessness + revocation (SCOPE-d). Like the host-admin token, the account
+ * token is deliberately NOT persisted in the `tokens` table — no registry row,
+ * no per-jti revocation. It is short-lived (10 min) and re-minted from the live
+ * session; revocation is by logout (kills the cookie → no re-mint) plus the
+ * read-time session-expiry chokepoint. A stateless mint avoids a DB write on
+ * every re-mint.
+ */
+import type { Database } from "bun:sqlite";
+import { HOST_ADMIN_SCOPES } from "./admin-host-admin-token.ts";
+import { lockedResponse, requireUnlocked } from "./admin-lock.ts";
+import { CSRF_FIELD_NAME, verifyCsrfToken } from "./csrf.ts";
+import { signAccessToken } from "./jwt-sign.ts";
+import { isHttpsRequest } from "./request-protocol.ts";
+import { ACCOUNT_SELF_ADMIN_SCOPE } from "./scope-explanations.ts";
+import {
+  SESSION_TTL_MS,
+  buildSessionCookie,
+  findSession,
+  parseSessionCookie,
+  touchSession,
+} from "./sessions.ts";
+import { isFirstAdmin } from "./users.ts";
+
+/** Short TTL — page-snapshot threats can't carry the token forever. Matches the
+ * host-admin mint's 10-min window; the app re-mints when it's about to lapse. */
+export const ACCOUNT_TOKEN_TTL_SECONDS = 10 * 60;
+/** Explicit account audience (SCOPE-a) — pinned by the `/account/*` validator;
+ * a vault RS's strict `aud=vault.<name>` check refuses it. */
+export const ACCOUNT_TOKEN_AUDIENCE = "account";
+/** First-party browser client id for the account credential (matches the
+ * `parachute-account` id the friend vault-token mints already use). */
+export const ACCOUNT_TOKEN_CLIENT_ID = "parachute-account";
+/** The superset the account bearer carries (SCOPE-b): the account scope plus
+ * the host superset, so the same token drives both the `/account/*` surface and
+ * the host-scoped endpoints it wraps without rewiring any existing gate. */
+export const ACCOUNT_TOKEN_SCOPES = [ACCOUNT_SELF_ADMIN_SCOPE, ...HOST_ADMIN_SCOPES] as const;
+
+export interface MintAccountTokenDeps {
+  db: Database;
+  /** Hub origin — written into JWT `iss`. */
+  issuer: string;
+}
+
+export async function handleAccountToken(
+  req: Request,
+  deps: MintAccountTokenDeps,
+): Promise<Response> {
+  if (req.method !== "POST") {
+    return jsonError(405, "method_not_allowed", "use POST");
+  }
+
+  // Gate 1 — session. No identity, no mint.
+  const sid = parseSessionCookie(req.headers.get("cookie"));
+  const session = sid ? findSession(deps.db, sid) : null;
+  if (!session || !sid) {
+    return jsonError(401, "unauthenticated", "no admin session — sign in at /login first");
+  }
+
+  // Gate 2 — CSRF double-submit. This is a POST mint, so a cross-site forged
+  // submission must be refused before any privileged work. The token rides the
+  // JSON body's `__csrf` field, same shape + helper as `/api/account/*`. The
+  // dispatcher's Origin belt already ran; this is the double-submit half.
+  const csrfToken = await readCsrfToken(req);
+  if (!verifyCsrfToken(req, csrfToken)) {
+    return jsonError(403, "csrf_failed", "missing or invalid CSRF token");
+  }
+
+  // Gate 3 — first-admin. A friend account (non-first-admin) holds a valid
+  // session but must not mint the account superset (host:admin + host:auth is a
+  // full-admin privesc). On a single-operator box first-admin ≡ the account, so
+  // this gate IS the account gate. Mirror the host-admin mint's 403 shape.
+  if (!isFirstAdmin(deps.db, session.userId)) {
+    return jsonError(
+      403,
+      "not_admin",
+      "account token mint is restricted to the hub admin — your account home is at /account/",
+    );
+  }
+
+  // Gate 4 — admin screen-lock (optional, off by default). When a lock PIN is
+  // set AND this session isn't within an unlock window, refuse. Same PURE-CHECK
+  // posture as the host-admin mint: it does NOT slide the idle window (sliding
+  // is heartbeat-only), so a background re-mint can't keep an idle tab unlocked.
+  if (!requireUnlocked(deps.db, sid).ok) {
+    return lockedResponse();
+  }
+
+  const minted = await signAccessToken(deps.db, {
+    sub: session.userId,
+    scopes: [...ACCOUNT_TOKEN_SCOPES],
+    audience: ACCOUNT_TOKEN_AUDIENCE,
+    clientId: ACCOUNT_TOKEN_CLIENT_ID,
+    issuer: deps.issuer,
+    ttlSeconds: ACCOUNT_TOKEN_TTL_SECONDS,
+    // No per-user vault pin — the account bearer talks to hub-scoped account +
+    // provisioning endpoints, not a single vault. Empty `vault_scope` is the
+    // "no per-user restriction" sentinel, matching the host-admin mint.
+    vaultScope: [],
+  });
+
+  // Sliding session renewal — a successful mint pushes the session's expiry
+  // forward and re-issues the cookie with the EXACT attributes creation uses,
+  // so an app re-minting ~every 10 min keeps the operator signed in without
+  // broadening the cookie. Identical to the host-admin mint.
+  touchSession(deps.db, sid);
+  const sessionCookie = buildSessionCookie(sid, Math.floor(SESSION_TTL_MS / 1000), {
+    secure: isHttpsRequest(req),
+  });
+
+  return new Response(
+    JSON.stringify({
+      token: minted.token,
+      expires_at: minted.expiresAt,
+      scopes: ACCOUNT_TOKEN_SCOPES,
+      aud: ACCOUNT_TOKEN_AUDIENCE,
+    }),
+    {
+      status: 200,
+      headers: {
+        "content-type": "application/json",
+        // No browser cache — the token rotates per-mint; a stale 200 from a
+        // back/forward navigation could hand the app a long-expired JWT.
+        "cache-control": "no-store",
+        "set-cookie": sessionCookie,
+      },
+    },
+  );
+}
+
+/**
+ * Pull the double-submit CSRF token from the JSON request body's `__csrf`
+ * field. Tolerant of an absent/malformed body (returns null → the verify
+ * fails closed with a 403), matching `readJsonBody` + `checkCsrf` in
+ * `api-account-2fa.ts`.
+ */
+async function readCsrfToken(req: Request): Promise<string | null> {
+  try {
+    const body = (await req.json()) as unknown;
+    if (body && typeof body === "object") {
+      const token = (body as Record<string, unknown>)[CSRF_FIELD_NAME];
+      return typeof token === "string" ? token : null;
+    }
+  } catch {
+    // Empty or non-JSON body — no token.
+  }
+  return null;
+}
+
+function jsonError(status: number, error: string, description: string): Response {
+  return new Response(JSON.stringify({ error, error_description: description }), {
+    status,
+    headers: { "content-type": "application/json", "cache-control": "no-store" },
+  });
+}

package/src/admin-connections.ts

@@ -1082,7 +1082,8 @@ async function renewCredentialConnection(
   }
 
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(
       401,
       "unauthenticated",
@@ -1257,7 +1258,8 @@ async function claimCredentialConnection(
   }
 
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(
       401,
       "unauthenticated",

package/src/admin-lock.ts

@@ -24,11 +24,10 @@
  * The admin SPA + every module config UI get their working Bearer from one of
  * the cookie-gated mint endpoints:
  *   - `GET /admin/host-admin-token`        (the SPA's own Bearer)
- *   - `GET /admin/agent-token`             (agent chat + config UIs)
  *   - `GET /admin/vault-admin-token/<name>`(per-vault admin SPA)
  *   - `GET /admin/module-token/<short>`    (generic module config UI Bearer)
  *
- * All four share the exact `parseSessionCookie → findSession → [isFirstAdmin]
+ * All three share the exact `parseSessionCookie → findSession → [isFirstAdmin]
  * → signAccessToken` shape. Inserting {@link requireUnlocked} into each makes
  * the lock cascade to EVERY admin surface with no per-module changes: when
  * locked, the mint returns 423 and the relevant UI shows the lock screen / its

package/src/admin-module-token.ts

@@ -8,15 +8,14 @@
  * hub frames/links those surfaces consistently (the Modules page "Configure"
  * action). Each module-owned config UI, served behind the hub proxy to a
  * logged-in portal operator, needs an admin-scoped hub Bearer to call its own
- * `<short>:admin`-gated endpoints — the same shape the agent config UI gets
- * from `/admin/agent-token` and the vault admin SPA gets from
- * `/admin/vault-admin-token/<name>`. This is the GENERIC mint that covers every
- * other self-registered single-audience module, so the hub doesn't grow a
+ * `<short>:admin`-gated endpoints. This generic mint covers every
+ * self-registered single-audience module, while the vault admin SPA uses
+ * `/admin/vault-admin-token/<name>`, so the hub doesn't grow a
  * bespoke per-module mint endpoint as each module ships a config UI.
  *
  * Scope + audience: `<short>:admin`, audience = `<short>` (the bare service
  * prefix). Modules validate the JWT's `aud` against their literal short name
- * (`scribe`, `surface`, `agent`) — the same shape `inferAudience`
+ * (`scribe`, `surface`, or a third-party short) — the same shape `inferAudience`
  * stamps for the public OAuth flow, so a hub-minted and an OAuth-minted admin
  * token are indistinguishable to the module. This mirrors the per-request
  * `<short>:admin` proxy token `api-modules-config.ts` used to mint; the
@@ -32,7 +31,7 @@
  *
  * Gate: the session must belong to the first admin (the single hub admin under
  * the Phase 1 multi-user model — `users.ts:isFirstAdmin`), exactly like
- * host-admin-token / vault-admin-token / agent-token. A friend account holds
+ * host-admin-token and vault-admin-token. A friend account holds
  * a valid session but must not mint a module admin Bearer.
  *
  * Tokens are short-lived (10 min — matches the sibling admin-token mints); the
@@ -45,12 +44,12 @@ import {
   type ModuleManifest,
   readModuleManifest as defaultReadModuleManifest,
 } from "./module-manifest.ts";
-import { findServiceByShort, isKnownModuleShort } from "./service-spec.ts";
+import { RETIRED_MODULES, findServiceByShort, isKnownModuleShort } from "./service-spec.ts";
 import type { ServiceEntry } from "./services-manifest.ts";
 import { findSession, parseSessionCookie } from "./sessions.ts";
 import { isFirstAdmin } from "./users.ts";
 
-/** Short TTL — matches host/vault/agent admin-token. UI re-fetches on near-expiry. */
+/** Short TTL — matches sibling admin-token mints. UI re-fetches on near-expiry. */
 export const MODULE_TOKEN_TTL_SECONDS = 10 * 60;
 const MODULE_TOKEN_CLIENT_ID = "parachute-hub-spa";
 
@@ -115,6 +114,12 @@ export async function handleModuleToken(
   if (!MODULE_SHORT_RE.test(short)) {
     return jsonError(400, "invalid_request", `module short "${short}" is not a valid identifier`);
   }
+  // Retirement wins over the generic self-registration trust path. Otherwise a
+  // stale row plus readable module.json could keep minting after Hub support is
+  // deliberately removed.
+  if (RETIRED_MODULES[short]) {
+    return jsonError(404, "not_found", `no module "${short}" known to this hub`);
+  }
   // Vault is per-instance — its admin scope needs a vault name. Route the caller
   // to the dedicated per-vault endpoint rather than minting a useless bare
   // `vault:admin` (no vault validates that audience).

package/src/admin-surfaces.ts

@@ -61,7 +61,8 @@ function jsonError(status: number, error: string, description: string): Response
 /** Validate the operator bearer + require the surfaces scope. Mirrors api-modules-ops. */
 async function authorize(req: Request, deps: AdminSurfacesDeps): Promise<Response | undefined> {
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();

package/src/api-hub-upgrade.ts

@@ -158,7 +158,8 @@ interface ParsedBody {
 
 async function authorize(req: Request, deps: ApiHubUpgradeDeps): Promise<Response | undefined> {
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();

package/src/api-invites.ts

@@ -32,6 +32,7 @@ import type { Database } from "bun:sqlite";
 import { type AdminAuthError, adminAuthErrorResponse, requireScope } from "./admin-auth.ts";
 import { HOST_ADMIN_SCOPE } from "./admin-vaults.ts";
 import { SERVICES_MANIFEST_PATH } from "./config.ts";
+import { setSetting } from "./hub-settings.ts";
 import {
   DEFAULT_INVITE_TTL_SECONDS,
   type Invite,
@@ -543,6 +544,24 @@ export async function handleCreateInvite(req: Request, deps: ApiInvitesDeps): Pr
     vaultCapBytes: effectiveVaultCapBytes,
     ...(deps.now !== undefined ? { now: deps.now } : {}),
   });
+  // Q2 (hub-parity P2, the raw-token reality): a multi-use PROVISIONING link
+  // IS the public signup page (the operator mints it to broadcast, and each
+  // redeemer gets their OWN new vault) — persisting ITS raw token so the
+  // account descriptor can advertise `signup_path` does NOT weaken the
+  // hash-only posture of single-use friend invites, which never write this row.
+  // The `provisionVault` guard is load-bearing security, not cosmetic: a
+  // multi-use SHARED-vault invite (`provision_vault=false` + an existing
+  // vault_name — "many users join one team vault", coherent per the mint gates
+  // above) must NEVER be auto-published on the anonymous, wildcard-CORS
+  // descriptor, or its team-vault-write link leaks to anyone who fetches the
+  // exposed hub. Only multi-use + provisioning = genuine public signup (the
+  // same conjunction the vault-cap heuristic above already treats as such).
+  // The newest public link wins (overwrites any prior value);
+  // `activePublicSignupPath` (invites.ts) re-validates liveness on every read
+  // and lazily clears a revoked/exhausted/expired one.
+  if (maxUses > 1 && provisionVault) {
+    setSetting(deps.db, "public_signup_token", issued.rawToken, deps.now ?? (() => new Date()));
+  }
   const status = inviteStatus(issued.invite, now);
   return new Response(
     JSON.stringify({

package/src/api-mint-token.ts

@@ -132,7 +132,8 @@ export async function handleApiMintToken(req: Request, deps: ApiMintTokenDeps):
 
   // 1. Bearer presence + parsing.
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();

package/src/api-modules-ops.ts

@@ -308,7 +308,8 @@ export function parseModulesPath(pathname: string): PathMatch | undefined {
 
 async function authorize(req: Request, deps: ApiModulesOpsDeps): Promise<Response | undefined> {
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();

package/src/api-modules.ts

@@ -82,7 +82,7 @@ import type { ModuleStartError, ModuleState, Supervisor } from "./supervisor.ts"
 
 /**
  * Resolve a known module to the display + install bootstrap data the admin SPA
- * renders. Reads from FIRST_PARTY_FALLBACKS (notes) first,
+ * renders. Reads from FIRST_PARTY_FALLBACKS (notes / app) first,
  * KNOWN_MODULES (vault / scribe / agent / surface) second.
  *
  * Returns `undefined` if the short is in neither table — a genuinely
@@ -351,15 +351,15 @@ interface ModuleWireShape {
    * `.parachute/module.json` `configUiUrl`, joined against its mount path the
    * same way `management_url` resolves `managementUrl`/`uiUrl`. Drives the
    * Modules page's consistent **Configure** action — clicking lands the
-   * operator on the module's own config UI (agent `/agent/admin`, scribe
-   * `/scribe/admin`, …), which mints its admin Bearer from the hub's
-   * cookie-gated `/admin/module-token/<short>` (or `/admin/agent-token`).
+   * operator on the module's own config UI (for example `/scribe/admin`),
+   * which mints its admin Bearer from the hub's cookie-gated
+   * `/admin/module-token/<short>`.
    *
    * Null when the module hasn't declared `configUiUrl` — the SPA omits the
    * Configure action for that module rather than rendering a dead button.
    * Distinct from `management_url`: a module may declare one, both, or
-   * neither. Agent declares `configUiUrl: "/agent/admin"` + `uiUrl`;
-   * vault declares `managementUrl` (its admin SPA is the config surface).
+   * neither. Vault declares `managementUrl` (its admin SPA is the config
+   * surface).
    */
   config_ui_url: string | null;
 }
@@ -462,7 +462,8 @@ export async function handleApiModules(req: Request, deps: ApiModulesDeps): Prom
 
   // Bearer presence + parsing.
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();
@@ -780,7 +781,8 @@ export async function handleApiModulesChannel(
 
   // Bearer presence + parsing.
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();

package/src/api-revoke-token.ts

@@ -100,7 +100,8 @@ export async function handleApiRevokeToken(
 
   // 1. Bearer presence + parsing.
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();

package/src/api-settings-hub-origin.ts

@@ -185,7 +185,8 @@ export async function handleApiSettingsHubOrigin(
   // Bearer presence + parsing — identical shape to api-modules
   // for consistency across hub-internal admin endpoints.
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();