npm - @openparachute/hub - Versions diffs - 0.7.6 → 0.7.7-rc.13 - Mend

@openparachute/hub 0.7.6 → 0.7.7-rc.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (83) hide show

package/README.md +7 -7
package/package.json +8 -13
package/src/__tests__/account-api.test.ts +798 -0
package/src/__tests__/account-session.test.ts +252 -0
package/src/__tests__/account-token.test.ts +316 -0
package/src/__tests__/admin-connections-credentials.test.ts +41 -0
package/src/__tests__/admin-handlers.test.ts +25 -0
package/src/__tests__/admin-lock.test.ts +3 -14
package/src/__tests__/admin-module-token.test.ts +10 -30
package/src/__tests__/admin-surfaces.test.ts +21 -0
package/src/__tests__/api-hub-upgrade.test.ts +11 -0
package/src/__tests__/api-mint-token.test.ts +25 -0
package/src/__tests__/api-modules-ops.test.ts +34 -29
package/src/__tests__/api-modules.test.ts +50 -58
package/src/__tests__/api-revoke-token.test.ts +23 -0
package/src/__tests__/api-settings-hub-origin.test.ts +12 -0
package/src/__tests__/api-settings-root-redirect.test.ts +159 -4
package/src/__tests__/api-tokens.test.ts +44 -0
package/src/__tests__/audience-gate.test.ts +24 -0
package/src/__tests__/bearer-scheme-casing.test.ts +110 -0
package/src/__tests__/chrome-strip.test.ts +18 -1
package/src/__tests__/doctor.test.ts +10 -17
package/src/__tests__/door-contract-parity.test.ts +46 -0
package/src/__tests__/hub-command.test.ts +70 -2
package/src/__tests__/hub-server.test.ts +322 -1
package/src/__tests__/hub-settings.test.ts +110 -6
package/src/__tests__/hub.test.ts +29 -0
package/src/__tests__/install.test.ts +359 -5
package/src/__tests__/migrate.test.ts +3 -1
package/src/__tests__/notes-serve.test.ts +216 -0
package/src/__tests__/oauth-handlers.test.ts +19 -8
package/src/__tests__/operator-token.test.ts +1 -2
package/src/__tests__/port-assign.test.ts +37 -17
package/src/__tests__/root-serve.test.ts +139 -0
package/src/__tests__/scope-explanations.test.ts +22 -2
package/src/__tests__/serve-boot.test.ts +25 -36
package/src/__tests__/service-spec-discovery.test.ts +30 -35
package/src/__tests__/services-manifest.test.ts +372 -132
package/src/__tests__/sessions.test.ts +75 -28
package/src/__tests__/setup-wizard.test.ts +7 -10
package/src/__tests__/setup.test.ts +13 -14
package/src/__tests__/status.test.ts +0 -5
package/src/__tests__/surface-notes-alias.test.ts +296 -0
package/src/account-api.ts +677 -0
package/src/account-session.ts +132 -0
package/src/account-token.ts +200 -0
package/src/admin-connections.ts +4 -2
package/src/admin-lock.ts +1 -2
package/src/admin-module-token.ts +13 -8
package/src/admin-surfaces.ts +2 -1
package/src/api-hub-upgrade.ts +2 -1
package/src/api-invites.ts +19 -0
package/src/api-mint-token.ts +2 -1
package/src/api-modules-ops.ts +2 -1
package/src/api-modules.ts +10 -8
package/src/api-revoke-token.ts +2 -1
package/src/api-settings-hub-origin.ts +2 -1
package/src/api-settings-root-redirect.ts +97 -20
package/src/api-tokens.ts +2 -1
package/src/audience-gate.ts +2 -1
package/src/chrome-strip.ts +16 -4
package/src/commands/hub.ts +104 -0
package/src/commands/install.ts +97 -8
package/src/commands/migrate.ts +5 -1
package/src/commands/setup.ts +9 -6
package/src/help.ts +6 -6
package/src/hub-server.ts +318 -55
package/src/hub-settings.ts +162 -1
package/src/hub.ts +64 -31
package/src/invites.ts +42 -0
package/src/module-ops-client.ts +2 -1
package/src/notes-serve.ts +73 -31
package/src/oauth-handlers.ts +1 -11
package/src/operator-token.ts +0 -1
package/src/origin-check.ts +2 -2
package/src/root-serve.ts +156 -0
package/src/scope-explanations.ts +35 -5
package/src/service-spec.ts +129 -74
package/src/services-manifest.ts +112 -52
package/src/sessions.ts +66 -30
package/src/surface-notes-alias.ts +126 -0
package/src/__tests__/admin-agent-token.test.ts +0 -173
package/src/admin-agent-token.ts +0 -147

package/src/__tests__/hub-server.test.ts CHANGED Viewed

@@ -17,7 +17,7 @@ import {
   resolveClientIp,
   stripHopByHopHeaders,
 } from "../hub-server.ts";
-import { setNotesRedirectDisabled } from "../hub-settings.ts";
+import { setNotesRedirectDisabled, setRootMode } from "../hub-settings.ts";
 import { clearNotesRedirectLogState } from "../notes-redirect.ts";
 import { mintOperatorToken } from "../operator-token.ts";
 import { pidPath } from "../process-state.ts";
@@ -993,6 +993,29 @@ describe("hubFetch routing", () => {
     }
   });
+  test("retired Agent token endpoints neither mint nor redirect", async () => {
+    const h = makeHarness();
+    try {
+      const dist = join(h.dir, "dist");
+      mkdirIfMissing(dist);
+      writeFileSync(join(dist, "index.html"), "<!doctype html><title>admin shell</title>");
+      const fetcher = hubFetch(h.dir, { spaDistDir: dist });
+      for (const path of ["/admin/agent-token", "/admin/channel-token"]) {
+        const post = await fetcher(req(path, { method: "POST" }));
+        expect(post.status).toBe(405);
+        expect(post.headers.get("location")).toBeNull();
+        const get = await fetcher(req(path));
+        expect(get.status).toBe(200);
+        expect(get.headers.get("location")).toBeNull();
+        expect(await get.text()).toContain("admin shell");
+      }
+    } finally {
+      h.cleanup();
+    }
+  });
   // 301 back-compat redirects (closes hub#231): pre-rename SPA URLs
   // 301-redirect to the new /admin/* mount. Tests cover every entry in the
   // dispatch — operator bookmarks landing on any of these still work.
@@ -1249,6 +1272,20 @@ describe("hubFetch routing", () => {
     }
   });
+  test("retired /channel/* paths no longer redirect to /agent/*", async () => {
+    const h = makeHarness();
+    try {
+      writeManifest({ services: [] }, h.manifestPath);
+      const res = await hubFetch(h.dir, { manifestPath: h.manifestPath })(
+        req("/channel/mcp/default?q=1"),
+      );
+      expect(res.status).toBe(404);
+      expect(res.headers.get("location")).toBeNull();
+    } finally {
+      h.cleanup();
+    }
+  });
   test("/hub/<unknown> (no SPA mount anymore) → 404", async () => {
     const h = makeHarness();
     try {
@@ -6381,3 +6418,287 @@ describe("hubFetch proxied-page security headers (hub#643 Tier-1)", () => {
     }
   });
 });
+// root_mode = serve-app: the hub serves the installed app's dist AT `/`, with
+// the fresh-hub funnel + pre-admin 503 + every hub-owned route preempting it.
+describe("hubFetch — root_mode serve-app", () => {
+  // A fixture app dist (index.html + assets). Distinct marker text so a test can
+  // tell an app-served body from an admin-SPA / discovery body.
+  function makeAppDist(dir: string): string {
+    const dist = join(dir, "app-dist");
+    mkdirSync(join(dist, "assets"), { recursive: true });
+    writeFileSync(join(dist, "index.html"), "<!doctype html><title>PARACHUTE-APP-SHELL</title>");
+    writeFileSync(join(dist, "assets", "app-xyz.js"), "console.log('serve-app')");
+    writeFileSync(join(dist, "manifest.webmanifest"), '{"name":"Parachute"}');
+    return dist;
+  }
+  // A distinct admin-SPA fixture so `/admin` reachability is provable (its body
+  // must NOT be the app shell).
+  function makeAdminDist(dir: string): string {
+    const dist = join(dir, "admin-dist");
+    mkdirSync(dist, { recursive: true });
+    writeFileSync(join(dist, "index.html"), "<!doctype html><title>ADMIN-SPA</title>");
+    return dist;
+  }
+  // Seed admin + a vault so the fresh-hub wizard funnel is bypassed (the
+  // "setup complete" state where serve-app should actually engage).
+  async function setupCompleteDb(h: Harness): Promise<ReturnType<typeof openHubDb>> {
+    writeManifest({ services: [vaultEntry("default")] }, h.manifestPath);
+    const db = openHubDb(hubDbPath(h.dir));
+    await createUser(db, "owner", "pw");
+    return db;
+  }
+  test("serves the app index.html at `/` (200, text/html, no redirect, no chrome)", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/"));
+      expect(res.status).toBe(200);
+      expect(res.headers.get("content-type")).toContain("text/html");
+      const body = await res.text();
+      expect(body).toContain("PARACHUTE-APP-SHELL");
+      // No identity chrome injected on the root-served app HTML.
+      expect(body).not.toContain('class="auth-indicator"');
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+  test("serves an app asset from dist (/assets/*) with an inferred content-type", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/assets/app-xyz.js", { headers: { accept: "*/*" } }));
+      expect(res.status).toBe(200);
+      expect(res.headers.get("content-type") ?? "").toMatch(/javascript/);
+      expect(await res.text()).toContain("serve-app");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+  test("SPA-fallback: an unclaimed HTML deep link gets the app shell", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/some/app/deep/link", { headers: { accept: "text/html" } }));
+      expect(res.status).toBe(200);
+      expect(await res.text()).toContain("PARACHUTE-APP-SHELL");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+  test("a non-HTML unclaimed path keeps the branded 404 (not the app shell)", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/definitely/not/a/file.json", { headers: { accept: "application/json" } }));
+      expect(res.status).toBe(404);
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+  test("a malformed percent-encoded asset path 404s (not 500) through the real dispatch", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      // `%ZZ` is an invalid escape — decodeURIComponent throws. Without the
+      // guard in serveAppAtRoot this escapes to the dispatch outer catch → 500.
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/assets/%ZZ", { headers: { accept: "text/html" } }));
+      expect(res.status).toBe(404);
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+  test("app-not-installed falls back to the redirect (with resolveAppDist → null)", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => null, // app not installed
+      })(req("/"));
+      // Falls through to the redirect (default /admin).
+      expect(res.status).toBe(302);
+      expect(res.headers.get("location")).toBe("/admin");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+  // --- Precedence: the funnels + hub-owned routes preempt serve-app ---------
+  test("fresh-hub wizard funnel WINS over serve-app (no admin → `/` 302 /admin/setup)", async () => {
+    const h = makeHarness();
+    // NO admin user, NO vault → needsWizard. serve-app is set + app resolvable.
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/"));
+      expect(res.status).toBe(302);
+      expect(res.headers.get("location")).toBe("/admin/setup");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+  test("pre-admin 503 lockout WINS over serve-app (no admin → /api/* 503 setup_required)", async () => {
+    const h = makeHarness();
+    const db = openHubDb(hubDbPath(h.dir)); // no admin
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/api/hub"));
+      expect(res.status).toBe(503);
+      const body = (await res.json()) as { error?: string };
+      expect(body.error).toBe("setup_required");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+  test("/admin stays reachable in serve-app mode (dispatched before the tail, not the app shell)", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const appDist = makeAppDist(h.dir);
+      const adminDist = makeAdminDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        spaDistDir: adminDist,
+        resolveAppDist: () => appDist,
+      })(req("/admin"));
+      expect(res.status).toBe(200);
+      const body = await res.text();
+      expect(body).toContain("ADMIN-SPA");
+      expect(body).not.toContain("PARACHUTE-APP-SHELL");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+  test("reserved /api|/oauth|/.well-known unclaimed paths keep the branded 404 (not the app shell)", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const handler = hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      });
+      // A browser navigation (Accept: text/html) to an unmatched /api path must
+      // NOT be shelled — it keeps the branded 404 for the API namespace.
+      const res = await handler(req("/api/nonexistent", { headers: { accept: "text/html" } }));
+      expect(res.status).toBe(404);
+      expect(await res.text()).not.toContain("PARACHUTE-APP-SHELL");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+  // --- Regression pin: redirect mode is byte-identical to before ------------
+  test("redirect mode (default) is inert even with resolveAppDist wired — `/` still 302s /admin", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h); // no root_mode set → default redirect
+    try {
+      const dist = makeAppDist(h.dir);
+      const handler = hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist, // wired but must stay inert in redirect mode
+      });
+      const rootRes = await handler(req("/"));
+      expect(rootRes.status).toBe(302);
+      expect(rootRes.headers.get("location")).toBe("/admin");
+      // The 404 tail is unchanged too: an unclaimed HTML path is the branded
+      // 404 page, NOT the app shell.
+      const tailRes = await handler(req("/random/unclaimed", { headers: { accept: "text/html" } }));
+      expect(tailRes.status).toBe(404);
+      expect(await tailRes.text()).not.toContain("PARACHUTE-APP-SHELL");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+  test("a non-GET `/` in serve-app mode keeps its 302 (only GET serves the app)", async () => {
+    const h = makeHarness();
+    const db = await setupCompleteDb(h);
+    try {
+      setRootMode(db, "serve-app");
+      const dist = makeAppDist(h.dir);
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: h.manifestPath,
+        resolveAppDist: () => dist,
+      })(req("/", { method: "POST" }));
+      expect(res.status).toBe(302);
+      expect(res.headers.get("location")).toBe("/admin");
+    } finally {
+      db.close();
+      h.cleanup();
+    }
+  });
+});

package/src/__tests__/hub-settings.test.ts CHANGED Viewed

@@ -12,30 +12,38 @@ import { join } from "node:path";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import {
   DEFAULT_MODULE_INSTALL_CHANNEL,
+  DEFAULT_ROOT_MODE,
   DEFAULT_ROOT_REDIRECT,
   FIRST_CLIENT_AUTO_APPROVE_WINDOW_MS,
   MODULE_INSTALL_CHANNELS,
+  PARACHUTE_HUB_ROOT_MODE_ENV,
   PARACHUTE_HUB_ROOT_REDIRECT_ENV,
   PARACHUTE_INSTALL_CHANNEL_ENV,
   PARACHUTE_MODULE_CHANNEL_ENV,
+  ROOT_MODES,
   SETUP_EXPOSE_MODES,
   consumeFirstClientAutoApproveWindow,
   deleteSetting,
   getHubOrigin,
   getModuleInstallChannel,
+  getRootMode,
   getRootRedirect,
   getSetting,
   isFirstClientAutoApproveWindowOpen,
   isModuleInstallChannel,
   isNotesRedirectDisabled,
+  isRootMode,
   isSafeRedirectPath,
   isSetupExposeMode,
   openFirstClientAutoApproveWindow,
+  resolveRootMode,
+  resolveRootModeDetailed,
   resolveRootRedirect,
   resolveRootRedirectDetailed,
   setHubOrigin,
   setModuleInstallChannel,
   setNotesRedirectDisabled,
+  setRootMode,
   setRootRedirect,
   setSetting,
 } from "../hub-settings.ts";
@@ -363,9 +371,9 @@ describe("hub-settings — module install channel bootstrap", () => {
       // First read with env=rc — env wins, returns "rc". DB stays empty
       // (no auto-write to DB when env is set, per the design that
       // preserves the SPA's last-write as the env-unset fallback).
-      expect(
-        getModuleInstallChannel(db, { env: { [PARACHUTE_INSTALL_CHANNEL_ENV]: "rc" } }),
-      ).toBe("rc");
+      expect(getModuleInstallChannel(db, { env: { [PARACHUTE_INSTALL_CHANNEL_ENV]: "rc" } })).toBe(
+        "rc",
+      );
       // Second read with env=latest — env wins again (would have returned
       // "rc" under the old DB-after-first-seed behavior).
       expect(
@@ -386,9 +394,9 @@ describe("hub-settings — module install channel bootstrap", () => {
     const db = openHubDb(hubDbPath(dir));
     try {
       // PARACHUTE_INSTALL_CHANNEL — canonical name (matches install.ts).
-      expect(
-        getModuleInstallChannel(db, { env: { [PARACHUTE_INSTALL_CHANNEL_ENV]: "rc" } }),
-      ).toBe("rc");
+      expect(getModuleInstallChannel(db, { env: { [PARACHUTE_INSTALL_CHANNEL_ENV]: "rc" } })).toBe(
+        "rc",
+      );
       // PARACHUTE_MODULE_CHANNEL — legacy alias, still recognized.
       const db2 = openHubDb(join(mkdtempSync(join(tmpdir(), "phub-hsalt-")), "hub.db"));
       try {
@@ -801,3 +809,99 @@ describe("hub-settings — root_redirect storage + resolution", () => {
     expect(resolveRootRedirect(null, { env })).toBe("/surface/from-env");
   });
 });
+describe("hub-settings — root_mode storage + resolution", () => {
+  let dir: string;
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "hub-settings-root-mode-"));
+  });
+  afterEach(() => rmSync(dir, { recursive: true, force: true }));
+  const noEnv: NodeJS.ProcessEnv = {};
+  const silent = () => {};
+  test("isRootMode + ROOT_MODES", () => {
+    expect(ROOT_MODES).toEqual(["redirect", "serve-app"]);
+    expect(isRootMode("redirect")).toBe(true);
+    expect(isRootMode("serve-app")).toBe(true);
+    expect(isRootMode("serveapp")).toBe(false);
+    expect(isRootMode(42)).toBe(false);
+  });
+  test("getRootMode round-trips serve-app via setRootMode", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      expect(getRootMode(db)).toBeNull();
+      setRootMode(db, "serve-app");
+      expect(getRootMode(db)).toBe("serve-app");
+    } finally {
+      db.close();
+    }
+  });
+  test("setRootMode(null) and setRootMode('redirect') both clear the row (default = absence)", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      setRootMode(db, "serve-app");
+      setRootMode(db, null);
+      expect(getRootMode(db)).toBeNull();
+      setRootMode(db, "serve-app");
+      setRootMode(db, "redirect"); // the default is stored as absence
+      expect(getRootMode(db)).toBeNull();
+      expect(getSetting(db, "root_mode")).toBeUndefined();
+    } finally {
+      db.close();
+    }
+  });
+  test("resolves to the redirect default when neither DB nor env is set", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      expect(resolveRootMode(db, { env: noEnv })).toBe(DEFAULT_ROOT_MODE);
+      expect(resolveRootModeDetailed(db, { env: noEnv })).toEqual({
+        value: "redirect",
+        source: "default",
+      });
+    } finally {
+      db.close();
+    }
+  });
+  test("env override applies when no DB row; DB overrides env (DB is tier-1)", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      const env = { [PARACHUTE_HUB_ROOT_MODE_ENV]: "serve-app" };
+      expect(resolveRootModeDetailed(db, { env })).toEqual({ value: "serve-app", source: "env" });
+      setRootMode(db, "serve-app");
+      // A DB "serve-app" over an env "redirect" resolves to db.
+      expect(
+        resolveRootModeDetailed(db, { env: { [PARACHUTE_HUB_ROOT_MODE_ENV]: "redirect" } }),
+      ).toEqual({ value: "serve-app", source: "db" });
+    } finally {
+      db.close();
+    }
+  });
+  test("an invalid DB row / env value is ignored → falls back to the redirect default", () => {
+    const db = openHubDb(hubDbPath(dir));
+    try {
+      setSetting(db, "root_mode", "bogus"); // hand-edited row bypassing write validation
+      expect(resolveRootMode(db, { env: noEnv, warn: silent })).toBe("redirect");
+      expect(getRootMode(db)).toBeNull(); // getRootMode also guards the invalid value
+      const env = { [PARACHUTE_HUB_ROOT_MODE_ENV]: "nonsense" };
+      expect(resolveRootModeDetailed(db, { env, warn: silent })).toEqual({
+        value: "redirect",
+        source: "default",
+      });
+    } finally {
+      db.close();
+    }
+  });
+  test("a null db (no state) resolves from env / default only", () => {
+    expect(resolveRootMode(null, { env: noEnv })).toBe("redirect");
+    expect(resolveRootMode(null, { env: { [PARACHUTE_HUB_ROOT_MODE_ENV]: "serve-app" } })).toBe(
+      "serve-app",
+    );
+  });
+});

package/src/__tests__/hub.test.ts CHANGED Viewed

@@ -239,6 +239,35 @@ describe("renderHub — signed-out slimming (operator feedback)", () => {
   });
 });
+describe("renderHub — Get started tiles are uis[]-driven (W2-12)", () => {
+  // The tile logic runs client-side inside the discovery IIFE; these pins
+  // assert the emitted script's SHAPE (the JS-parses check above guards its
+  // validity). The section is uis[]-driven — one tile per active uis[]
+  // sub-unit, whichever mount identity (/surface/notes or
+  // /surface/parachute) an install serves — with the pre-W2-12 hardcoded
+  // "Open Notes" tile demoted to a fallback for surface-host rows that
+  // predate uis{} self-registration.
+  const html = renderHub({
+    session: { displayName: "operator", csrfToken: "csrf-w212" },
+  });
+  test("the discovery script iterates uis[] sub-units", () => {
+    expect(html).toContain("svc.uis");
+    // Inactive sub-units are skipped; absent status counts as active.
+    expect(html).toContain("ui.status");
+  });
+  test("the legacy 'Open Notes' hardcode survives only as the no-uis fallback", () => {
+    // Still present (pre-uis surface-host installs keep their CTA) …
+    expect(html).toContain("Open Notes");
+    expect(html).toContain("'/surface/notes/'");
+    // … but no longer keyed on the bare presence of parachute-surface as
+    // the PRIMARY path: the uis[] loop renders first, the hasSurface check
+    // only backstops an empty tile list.
+    expect(html).toContain("Legacy fallback");
+  });
+});
 describe("renderHub — signed-in indicator (rc.13)", () => {
   test("session user → 'Signed in as <name>' + inline POST form with CSRF", () => {
     const html = renderHub({