@openparachute/hub 0.7.6 → 0.7.7-rc.13

package/src/__tests__/admin-lock.test.ts

@@ -21,7 +21,7 @@ import { createHash, randomBytes } from "node:crypto";
 import { mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { handleAgentToken } from "../admin-agent-token.ts";
+
 import { handleHostAdminToken } from "../admin-host-admin-token.ts";
 import {
   DEFAULT_ADMIN_LOCK_IDLE_SECONDS,
@@ -239,10 +239,10 @@ describe("recordLoginUnlock", () => {
 });
 
 // ---------------------------------------------------------------------------
-// The cascade: a locked session refuses ALL four admin-token mints.
+// The cascade: a locked session refuses every admin-token mint.
 // ---------------------------------------------------------------------------
 
-describe("lock cascade through the four admin-token mints", () => {
+describe("lock cascade through the admin-token mints", () => {
   test("host-admin-token: 200 when no PIN, 423 when locked, 200 after unlock", async () => {
     const { cookie, sessionId } = await withAdmin();
     rotateSigningKey(harness.db);
@@ -262,17 +262,6 @@ describe("lock cascade through the four admin-token mints", () => {
     expect((await handleHostAdminToken(mk(), { db: harness.db, issuer: ISSUER })).status).toBe(200);
   });
 
-  test("agent-token cascades (423 when locked)", async () => {
-    const { cookie } = await withAdmin();
-    rotateSigningKey(harness.db);
-    await setPin(harness.db, "4827");
-    const res = await handleAgentToken(
-      new Request(`${ISSUER}/admin/agent-token`, { headers: { cookie } }),
-      { db: harness.db, issuer: ISSUER },
-    );
-    expect(res.status).toBe(423);
-  });
-
   test("vault-admin-token cascades (423 when locked)", async () => {
     const { cookie } = await withAdmin();
     rotateSigningKey(harness.db);

package/src/__tests__/admin-module-token.test.ts

@@ -7,7 +7,7 @@
  *   - 401 when the cookie names a deleted session.
  *   - 405 on POST.
  *   - 200 + JWT carrying `aud: "<short>"` and `<short>:admin` for known modules
- *     (scribe / surface / agent).
+ *     (scribe / surface).
  *   - 400 for `vault` (per-instance — points at /admin/vault-admin-token/<name>).
  *   - 404 for an unknown short.
  *   - First-admin gate: 403 for a signed-in non-first-admin (friend).
@@ -114,7 +114,7 @@ describe("handleModuleToken", () => {
   // `<short>:admin` with `aud: <short>`. (runner left this set with its
   // 2026-07-01 registry removal — a LEGACY install still mints via the
   // self-registration gate, pinned below.)
-  for (const short of ["scribe", "surface", "agent"]) {
+  for (const short of ["scribe", "surface"]) {
     test(`200 mints a JWT carrying aud:${short} + ${short}:admin`, async () => {
       const { cookie, userId } = await withSession();
       rotateSigningKey(harness.db);
@@ -321,7 +321,7 @@ describe("handleModuleToken", () => {
     expect(body.error).toBe("use_vault_admin_token");
   });
 
-  test("first-party row resolves through the manifest-name map (parachute-agent ↔ agent)", async () => {
+  test("retired Agent identifiers do not mint even when stale rows are supplied", async () => {
     const { cookie } = await withSession();
     rotateSigningKey(harness.db);
     const installDir = writeManifestDir("agent");
@@ -335,40 +335,20 @@ describe("handleModuleToken", () => {
           version: "0.1.0",
           installDir,
         },
-      ];
-      const req = new Request(urlFor("agent"), { headers: { cookie } });
-      const res = await handleModuleToken(req, "agent", depsWith(services));
-      expect(res.status).toBe(200);
-      const body = (await res.json()) as { scopes: string[] };
-      expect(body.scopes).toEqual(["agent:admin"]);
-    } finally {
-      rmSync(installDir, { recursive: true, force: true });
-    }
-  });
-
-  test("a legacy parachute-channel row still resolves to short `agent` (rename back-compat)", async () => {
-    // Un-upgraded operators carry a `parachute-channel` services.json row;
-    // LEGACY_MANIFEST_ALIASES maps it to short `agent` so the agent config UI
-    // can still mint its admin Bearer until the daemon re-registers.
-    const { cookie } = await withSession();
-    rotateSigningKey(harness.db);
-    const installDir = writeManifestDir("agent");
-    try {
-      const services: ServiceEntry[] = [
         {
           name: "parachute-channel",
-          port: 1941,
-          paths: ["/agent"],
+          port: 1942,
+          paths: ["/channel"],
           health: "/health",
           version: "0.1.0",
           installDir,
         },
       ];
-      const req = new Request(urlFor("agent"), { headers: { cookie } });
-      const res = await handleModuleToken(req, "agent", depsWith(services));
-      expect(res.status).toBe(200);
-      const body = (await res.json()) as { scopes: string[] };
-      expect(body.scopes).toEqual(["agent:admin"]);
+      for (const short of ["agent", "parachute-agent", "parachute-channel"]) {
+        const req = new Request(urlFor(short), { headers: { cookie } });
+        const res = await handleModuleToken(req, short, depsWith(services));
+        expect(res.status).toBe(404);
+      }
     } finally {
       rmSync(installDir, { recursive: true, force: true });
     }

package/src/__tests__/admin-surfaces.test.ts

@@ -151,6 +151,27 @@ describe("routeAdminSurfaces — register + list", () => {
     }
   });
 
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("lowercase bearer scheme authenticates identically to canonical Bearer", async () => {
+    const h = await makeHarness();
+    try {
+      const token = await mint(h, ["parachute:host:admin"]);
+      const res = await routeAdminSurfaces(
+        req(
+          "POST",
+          { authorization: `bearer ${token}`, "content-type": "application/json" },
+          { name: "brain", mount: "/surface/brain", mode: "prod" },
+        ),
+        deps(h),
+      );
+      expect(res?.status).toBe(200);
+      const body = (await res?.json()) as { ok: boolean };
+      expect(body.ok).toBe(true);
+    } finally {
+      h.cleanup();
+    }
+  });
+
   test("POST with a missing name → 400", async () => {
     const h = await makeHarness();
     try {

package/src/__tests__/api-hub-upgrade.test.ts

@@ -510,6 +510,17 @@ describe("GET /api/hub/upgrade/status", () => {
     const res = await handleHubUpgradeStatus(getStatusReq({}), deps);
     expect(res.status).toBe(401);
   });
+
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("lowercase bearer scheme authenticates identically to canonical Bearer (404, not 401)", async () => {
+    const bearer = await mintBearer(harness, ["parachute:host:admin"]);
+    const { deps } = baseDeps(harness);
+    const res = await handleHubUpgradeStatus(
+      getStatusReq({ authorization: `bearer ${bearer}` }),
+      deps,
+    );
+    expect(res.status).toBe(404);
+  });
 });
 
 describe("detectHubUpgradeMode — §5.3 heuristic", () => {

package/src/__tests__/api-mint-token.test.ts

@@ -172,6 +172,31 @@ describe("POST /api/auth/mint-token (hub#212 Phase 1)", () => {
     }
   });
 
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("lowercase bearer scheme authenticates identically to canonical Bearer", async () => {
+    const h = makeHarness();
+    try {
+      const { db, userId } = await bootstrap(h.dir);
+      try {
+        const op = await mintOperatorToken(db, userId, { issuer: ISSUER });
+        const resp = await handleApiMintToken(
+          jsonRequest(
+            { scope: "scribe:transcribe", expires_in: 3600 },
+            { authorization: `bearer ${op.token}` },
+          ),
+          { db, issuer: ISSUER },
+        );
+        expect(resp.status).toBe(200);
+        const body = (await resp.json()) as { scope: string };
+        expect(body.scope).toBe("scribe:transcribe");
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
   // hub#516 parity — the live "mint refused" after `parachute hub set-origin`.
   // An operator/agent credential minted under a PRIOR origin (still a member of
   // the hub's bound-origin set) must keep minting after the canonical issuer

package/src/__tests__/api-modules-ops.test.ts

@@ -208,21 +208,12 @@ describe("parseModulesPath", () => {
     });
   });
 
-  test("accepts any KNOWN module short — agent install now resolves (was the bug)", () => {
-    // Post-2026-06-09 (modular-UI architecture, P2) the install-path gate is
-    // `isKnownModuleShort` (KNOWN_MODULES ∪ FIRST_PARTY_FALLBACKS), NOT the old
-    // CURATED_MODULES whitelist. agent (renamed from channel 2026-06-17) is in
-    // KNOWN_MODULES, so its install path now resolves — fixing the
-    // running-but-uninstallable bug.
-    expect(parseModulesPath("/api/modules/agent/install")).toEqual({
-      short: "agent",
-      rest: "install",
-    });
-    // Other known modules (surface) resolve too.
+  test("accepts supported module shorts and rejects retired Agent", () => {
     expect(parseModulesPath("/api/modules/surface/install")).toEqual({
       short: "surface",
       rest: "install",
     });
+    expect(parseModulesPath("/api/modules/agent/install")).toBeUndefined();
   });
 
   test("rejects unknown shorts (the hub itself + genuinely third-party rows)", () => {
@@ -309,6 +300,29 @@ describe("POST /api/modules/:short/install", () => {
     expect(body.error_description).toContain("parachute:host:admin");
   });
 
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("lowercase bearer scheme authenticates identically to canonical Bearer", async () => {
+    const { supervisor } = makeIdleSupervisor();
+    const { run } = alwaysOkRun();
+    const bearer = await mintBearer(h, [API_MODULES_OPS_REQUIRED_SCOPE]);
+    const res = await handleInstall(
+      postReq("/api/modules/vault/install", { authorization: `bearer ${bearer}` }),
+      "vault",
+      {
+        db: h.db,
+        issuer: ISSUER,
+        manifestPath: h.manifestPath,
+        configDir: h.dir,
+        supervisor,
+        run,
+        isLinked: TEST_DEFAULT_NOT_LINKED,
+      },
+    );
+    expect(res.status).toBe(202);
+    const body = (await res.json()) as { operation_id: string };
+    expect(body.operation_id).toBeDefined();
+  });
+
   test("202 + operation_id, runs bun add + seeds services.json + spawns", async () => {
     const { supervisor, spawns } = makeIdleSupervisor();
     const { run, calls } = alwaysOkRun();
@@ -1019,16 +1033,12 @@ describe("POST /api/modules/:short/start", () => {
     expect(calls).toEqual([]);
   });
 
-  test("channel#41: start reconciles a drifted services.json port back to canonical (API path)", async () => {
-    // The live signature: the agent (then channel) row carried 19415 instead of
-    // canonical 1941. The API start path (admin SPA / `parachute start agent`)
-    // must apply the SAME reconcile the boot path does — otherwise an
-    // operator-triggered start re-strands the module on the dead port.
+  test("start reconciles a supported module's drifted port back to canonical", async () => {
     writeManifest(h.manifestPath, [
       {
-        name: "parachute-agent",
+        name: "parachute-scribe",
         port: 19415,
-        paths: ["/agent"],
+        paths: ["/scribe"],
         health: "/health",
         version: "0.0.0-linked",
       },
@@ -1038,8 +1048,8 @@ describe("POST /api/modules/:short/start", () => {
     const bearer = await mintBearer(h, [API_MODULES_OPS_REQUIRED_SCOPE]);
 
     const res = await handleStart(
-      postReq("/api/modules/agent/start", { authorization: `Bearer ${bearer}` }),
-      "agent",
+      postReq("/api/modules/scribe/start", { authorization: `Bearer ${bearer}` }),
+      "scribe",
       {
         db: h.db,
         issuer: ISSUER,
@@ -1051,20 +1061,15 @@ describe("POST /api/modules/:short/start", () => {
     );
 
     expect(res.status).toBe(200);
-    // The supervisor child gets PORT=1941 (canonical), not the drifted 19415 —
-    // so it binds + the readiness probe checks the right port.
     expect(spawns.length).toBe(1);
-    expect(spawns[0]?.short).toBe("agent");
-    expect(spawns[0]?.env?.PORT).toBe("1941");
-    // services.json row is rewritten to 1941 → the reverse-proxy (which reads
-    // services.json) routes /agent/* to the live port.
+    expect(spawns[0]?.short).toBe("scribe");
+    expect(spawns[0]?.env?.PORT).toBe("1943");
     const onDisk = JSON.parse(readFileSync(h.manifestPath, "utf8")) as {
       services: { name: string; port: number }[];
     };
-    expect(onDisk.services.find((s) => s.name === "parachute-agent")?.port).toBe(1941);
-    // The reconcile event logged on the API path too (deps.log wired — #41 review).
+    expect(onDisk.services.find((s) => s.name === "parachute-scribe")?.port).toBe(1943);
     expect(
-      logs.some((l) => l.includes("reconciled") && l.includes("19415") && l.includes("1941")),
+      logs.some((l) => l.includes("reconciled") && l.includes("19415") && l.includes("1943")),
     ).toBe(true);
   });
 });

package/src/__tests__/api-modules.test.ts

@@ -175,6 +175,18 @@ describe("GET /api/modules", () => {
     expect(body.error).toBe("insufficient_scope");
   });
 
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("lowercase bearer scheme authenticates identically to canonical Bearer", async () => {
+    const bearer = await mintBearer(h, [API_MODULES_REQUIRED_SCOPE]);
+    const res = await handleApiModules(getReq({ authorization: `bearer ${bearer}` }), {
+      db: h.db,
+      issuer: ISSUER,
+      manifestPath: h.manifestPath,
+      fetchLatestVersion: async () => null,
+    });
+    expect(res.status).toBe(200);
+  });
+
   // hub#516: `parachute status` reads /api/modules on loopback presenting the
   // operator token, whose `iss` is the PUBLIC origin after `expose`. The
   // host-admin bearer's iss is validated against `knownIssuers` (loopback ∪
@@ -250,15 +262,11 @@ describe("GET /api/modules", () => {
     // The core tier leads, in the recommended install order (vault → scribe),
     // ahead of every experimental module, which lead the deprecated ones.
     expect(shorts.indexOf("vault")).toBeLessThan(shorts.indexOf("scribe"));
-    expect(shorts.indexOf("scribe")).toBeLessThan(shorts.indexOf("agent"));
-    // agent (experimental) sorts ahead of notes (deprecated).
-    expect(shorts.indexOf("agent")).toBeLessThan(shorts.indexOf("notes"));
-    // Every known module is discoverable — vault/scribe/surface (core),
-    // agent (experimental), notes (deprecated). runner is gone (2026-07-01
-    // registry removal) — a fresh box never sees it.
-    for (const s of ["vault", "scribe", "surface", "agent", "notes"]) {
+    expect(shorts.indexOf("scribe")).toBeLessThan(shorts.indexOf("notes"));
+    for (const s of ["vault", "scribe", "surface", "app", "notes"]) {
       expect(shorts).toContain(s);
     }
+    expect(shorts).not.toContain("agent");
     expect(shorts).not.toContain("runner");
     expect(shorts).not.toContain("parachute-runner");
     // Focus tier resolves from the default map.
@@ -266,7 +274,8 @@ describe("GET /api/modules", () => {
     expect(byShort.get("vault")?.focus).toBe("core");
     expect(byShort.get("scribe")?.focus).toBe("core");
     expect(byShort.get("surface")?.focus).toBe("core");
-    expect(byShort.get("agent")?.focus).toBe("experimental");
+    expect(byShort.get("app")?.focus).toBe("core");
+    expect(byShort.get("agent")).toBeUndefined();
     expect(byShort.get("notes")?.focus).toBe("deprecated");
     // `available` stays true for every known module (re-installable), but the
     // fresh-install OFFER (`available_to_install`) drops the deprecated tier —
@@ -275,7 +284,7 @@ describe("GET /api/modules", () => {
     expect(byShort.get("vault")?.available_to_install).toBe(true);
     expect(byShort.get("scribe")?.available_to_install).toBe(true);
     expect(byShort.get("surface")?.available_to_install).toBe(true);
-    expect(byShort.get("agent")?.available_to_install).toBe(true);
+    expect(byShort.get("app")?.available_to_install).toBe(true);
     expect(byShort.get("notes")?.available_to_install).toBe(false);
     expect(body.modules.every((m) => !m.installed)).toBe(true);
     expect(body.modules.every((m) => m.latest_version === "0.9.9")).toBe(true);
@@ -369,13 +378,7 @@ describe("GET /api/modules", () => {
     expect(scribe?.available).toBe(true);
   });
 
-  test("agent (running + self-registered) appears as installed + experimental — regression for the channel-not-installed bug", async () => {
-    // THE bug this PR fixes (2026-06-09 modular-UI architecture, P2): agent (renamed from channel 2026-06-17)
-    // was running, proxied, supervised, and self-registered in services.json
-    // yet invisible on the Modules screen — because the old CURATED_MODULES =
-    // ["vault","scribe"] whitelist gated discovery. Now discovery is driven by
-    // self-registration ∪ the known registries, so a self-registered agent
-    // row surfaces as installed, in the experimental tier, with its run-state.
+  test("retired Agent rows do not surface in the module catalog", async () => {
     writeManifest(h.manifestPath, [
       {
         name: "parachute-agent",
@@ -385,32 +388,16 @@ describe("GET /api/modules", () => {
         version: "0.3.1",
       },
     ]);
-    const { supervisor } = makeIdleSupervisor();
-    await supervisor.start({ short: "agent", cmd: ["parachute-agent"] });
-
     const bearer = await mintBearer(h, [API_MODULES_REQUIRED_SCOPE]);
     const res = await handleApiModules(getReq({ authorization: `Bearer ${bearer}` }), {
       db: h.db,
       issuer: ISSUER,
       manifestPath: h.manifestPath,
-      supervisor,
       fetchLatestVersion: async () => null,
     });
-    const body = (await res.json()) as {
-      modules: Array<{
-        short: string;
-        focus: "core" | "experimental";
-        installed: boolean;
-        installed_version: string | null;
-        supervisor_status: string | null;
-      }>;
-    };
-    const agent = body.modules.find((m) => m.short === "agent");
-    expect(agent).toBeDefined();
-    expect(agent?.installed).toBe(true);
-    expect(agent?.installed_version).toBe("0.3.1");
-    expect(agent?.focus).toBe("experimental");
-    expect(agent?.supervisor_status).toBe("running");
+    const body = (await res.json()) as { modules: Array<{ short: string }> };
+    expect(body.modules.find((m) => m.short === "agent")).toBeUndefined();
+    expect(body.modules.find((m) => m.short === "parachute-agent")).toBeUndefined();
   });
 
   test("every self-registered + known module appears in `modules` — no running-but-invisible class", async () => {
@@ -834,20 +821,15 @@ describe("GET /api/modules", () => {
     expect(vault?.management_url).toBe("/vault/default/admin");
   });
 
-  test("populates config_ui_url from a module's configUiUrl (2026-06-09 modular-UI P3)", async () => {
-    // Agent declares `configUiUrl: "/agent/admin"` (a single-instance,
-    // origin-absolute path) + `uiUrl: "/agent/ui"`. The hub surfaces
-    // both: `config_ui_url` drives the Modules page Configure action,
-    // `management_url` drives Open. configUiUrl resolves identically to
-    // managementUrl (same B4 unified semantics).
+  test("populates config_ui_url from a third-party module manifest", async () => {
     writeManifest(h.manifestPath, [
       {
-        name: "agent",
-        port: 1941,
-        paths: ["/agent"],
+        name: "widgets",
+        port: 1947,
+        paths: ["/widgets"],
         health: "/health",
         version: "0.1.0",
-        installDir: "/install/dir/agent",
+        installDir: "/install/dir/widgets",
       },
     ]);
     const bearer = await mintBearer(h, [API_MODULES_REQUIRED_SCOPE]);
@@ -857,17 +839,17 @@ describe("GET /api/modules", () => {
       manifestPath: h.manifestPath,
       fetchLatestVersion: async () => null,
       readModuleManifest: async (installDir) => {
-        if (installDir === "/install/dir/agent") {
+        if (installDir === "/install/dir/widgets") {
           return {
-            name: "agent",
-            manifestName: "parachute-agent",
-            displayName: "Agent",
+            name: "widgets",
+            manifestName: "widgets",
+            displayName: "Widgets",
             tagline: "",
-            port: 1941,
-            paths: ["/agent"],
+            port: 1947,
+            paths: ["/widgets"],
             health: "/health",
-            uiUrl: "/agent/ui",
-            configUiUrl: "/agent/admin",
+            uiUrl: "/widgets/ui",
+            configUiUrl: "/widgets/admin",
           } as unknown as Awaited<
             ReturnType<typeof import("../module-manifest.ts").readModuleManifest>
           >;
@@ -883,11 +865,9 @@ describe("GET /api/modules", () => {
         management_url: string | null;
       }>;
     };
-    const agent = body.modules.find((m) => m.short === "agent");
-    // Origin-absolute — verbatim, never double-prepends `/agent`.
-    expect(agent?.config_ui_url).toBe("/agent/admin");
-    // uiUrl (no managementUrl) drives the Open action's management_url.
-    expect(agent?.management_url).toBe("/agent/ui");
+    const widgets = body.modules.find((m) => m.short === "widgets");
+    expect(widgets?.config_ui_url).toBe("/widgets/admin");
+    expect(widgets?.management_url).toBe("/widgets/ui");
   });
 
   test("config_ui_url is null when the module declares no configUiUrl", async () => {
@@ -1498,6 +1478,18 @@ describe("PUT /api/modules/channel — hub#275 channel toggle", () => {
     expect(res.status).toBe(401);
   });
 
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("lowercase bearer scheme authenticates identically to canonical Bearer", async () => {
+    const bearer = await mintBearer(h, [API_MODULES_CHANNEL_REQUIRED_SCOPE]);
+    const res = await handleApiModulesChannel(
+      putReq({ channel: "rc" }, { authorization: `bearer ${bearer}` }),
+      { db: h.db, issuer: ISSUER },
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { channel: string };
+    expect(body.channel).toBe("rc");
+  });
+
   test("403 on bearer without parachute:host:admin", async () => {
     // `:host:auth` reads the GET catalog — it must NOT be allowed to
     // flip the install channel. Boundary matches install/upgrade/uninstall.

package/src/__tests__/api-revoke-token.test.ts

@@ -263,6 +263,29 @@ describe("POST /api/auth/revoke-token (closes hub#220)", () => {
     }
   });
 
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("lowercase bearer scheme authenticates identically to canonical Bearer", async () => {
+    const h = makeHarness();
+    try {
+      const { db, userId } = await bootstrap(h.dir);
+      try {
+        const op = await mintOperatorToken(db, userId, { issuer: ISSUER });
+        const jti = await seedToken(db, userId);
+        const resp = await handleApiRevokeToken(
+          jsonRequest({ jti }, { authorization: `bearer ${op.token}` }),
+          { db, issuer: ISSUER },
+        );
+        expect(resp.status).toBe(200);
+        const body = (await resp.json()) as { jti: string };
+        expect(body.jti).toBe(jti);
+      } finally {
+        db.close();
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
+
   test("idempotent: re-revoking returns 200 with the original revoked_at", async () => {
     const h = makeHarness();
     try {

package/src/__tests__/api-settings-hub-origin.test.ts

@@ -258,6 +258,18 @@ describe("GET /api/settings/hub-origin", () => {
     expect(body.resolved_issuer).toBe("http://localhost"); // request origin from getReq()
   });
 
+  // H1.1 — Bearer scheme is case-insensitive per RFC 7235 (V1.4/C1.3 parity).
+  test("lowercase bearer scheme authenticates identically to canonical Bearer", async () => {
+    const bearer = await mintBearer(h, [API_SETTINGS_HUB_ORIGIN_REQUIRED_SCOPE]);
+    const res = await handleApiSettingsHubOrigin(
+      getReq({ authorization: `bearer ${bearer}` }),
+      deps(h),
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { hub_origin: string | null };
+    expect(body.hub_origin).toBeNull();
+  });
+
   test("returns env source + env-resolved issuer when configuredIssuer is set", async () => {
     const bearer = await mintBearer(h, [API_SETTINGS_HUB_ORIGIN_REQUIRED_SCOPE]);
     const res = await handleApiSettingsHubOrigin(getReq({ authorization: `Bearer ${bearer}` }), {