@openparachute/hub 0.7.7-rc.6 → 0.7.7-rc.8

package/src/__tests__/sessions.test.ts

@@ -5,13 +5,15 @@ import { join } from "node:path";
 import { hubDbPath, openHubDb } from "../hub-db.ts";
 import {
   SESSION_COOKIE_NAME,
-  SESSION_MAX_LIFETIME_MS,
+  SESSION_SLIDE_THRESHOLD_MS,
+  SESSION_TTL_MS,
   buildSessionClearCookie,
   buildSessionCookie,
   createSession,
   deleteSession,
   findSession,
   parseSessionCookie,
+  shouldSlideSession,
   touchSession,
 } from "../sessions.ts";
 import { createUser } from "../users.ts";
@@ -57,11 +59,11 @@ describe("createSession + findSession", () => {
     try {
       const epoch = new Date("2026-01-01T00:00:00Z");
       const s = createSession(db, { userId, now: () => epoch });
-      // Past TTL (24h).
-      const later = new Date(epoch.getTime() + 25 * 3600 * 1000);
+      // Past TTL (90 days).
+      const later = new Date(epoch.getTime() + SESSION_TTL_MS + 3600 * 1000);
       expect(findSession(db, s.id, () => later)).toBeNull();
       // Still valid one second before expiry.
-      const justBefore = new Date(epoch.getTime() + 24 * 3600 * 1000 - 1000);
+      const justBefore = new Date(epoch.getTime() + SESSION_TTL_MS - 1000);
       expect(findSession(db, s.id, () => justBefore)?.id).toBe(s.id);
     } finally {
       cleanup();
@@ -78,60 +80,64 @@ describe("touchSession (sliding renewal)", () => {
     try {
       const t0 = new Date("2026-01-01T00:00:00Z");
       const s = createSession(db, { userId, now: () => t0 });
-      // Original expiry: t0 + 24h.
-      expect(new Date(s.expiresAt).getTime()).toBe(t0.getTime() + DAY);
-      // Touch 1h later → expiry becomes (t0 + 1h) + 24h.
+      // Original expiry: t0 + 90d.
+      expect(new Date(s.expiresAt).getTime()).toBe(t0.getTime() + SESSION_TTL_MS);
+      // Touch 1h later → expiry becomes (t0 + 1h) + 90d.
       const t1 = new Date(t0.getTime() + HOUR);
       touchSession(db, s.id, () => t1);
       const found = findSession(db, s.id, () => t1);
-      expect(new Date(found?.expiresAt ?? 0).getTime()).toBe(t1.getTime() + DAY);
+      expect(new Date(found?.expiresAt ?? 0).getTime()).toBe(t1.getTime() + SESSION_TTL_MS);
     } finally {
       cleanup();
     }
   });
 
-  test("a touched session outlives the ORIGINAL 24h expiry", async () => {
+  test("a touched session outlives the ORIGINAL 90d expiry", async () => {
     const { db, userId, cleanup } = await makeDb();
     try {
       const t0 = new Date("2026-01-01T00:00:00Z");
       const s = createSession(db, { userId, now: () => t0 });
-      // Activity at +12h slides expiry to +36h.
-      touchSession(db, s.id, () => new Date(t0.getTime() + 12 * HOUR));
-      // At +30h — PAST the original +24h — the session is still alive.
-      const at30h = new Date(t0.getTime() + 30 * HOUR);
-      expect(findSession(db, s.id, () => at30h)?.id).toBe(s.id);
+      // Activity at +45d slides expiry to +135d.
+      touchSession(db, s.id, () => new Date(t0.getTime() + 45 * DAY));
+      // At +100d — PAST the original +90d — the session is still alive.
+      const at100d = new Date(t0.getTime() + 100 * DAY);
+      expect(findSession(db, s.id, () => at100d)?.id).toBe(s.id);
     } finally {
       cleanup();
     }
   });
 
-  test("an UNtouched session still expires at the original 24h", async () => {
+  test("an UNtouched session still expires at the original 90d", async () => {
     const { db, userId, cleanup } = await makeDb();
     try {
       const t0 = new Date("2026-01-01T00:00:00Z");
       const s = createSession(db, { userId, now: () => t0 });
-      // No touch — at +25h it's gone (today's absolute-TTL behavior preserved
-      // for idle / closed tabs that stop re-minting).
-      const at25h = new Date(t0.getTime() + 25 * HOUR);
-      expect(findSession(db, s.id, () => at25h)).toBeNull();
+      // No touch — one day past the 90d TTL it's gone (idle / closed tabs
+      // that stop re-minting still lapse at the full TTL).
+      const past = new Date(t0.getTime() + SESSION_TTL_MS + DAY);
+      expect(findSession(db, s.id, () => past)).toBeNull();
     } finally {
       cleanup();
     }
   });
 
-  test("caps at created_at + SESSION_MAX_LIFETIME_MS (sliding can't run forever)", async () => {
+  test("NO ceiling (Q4) — an actively-touched session rolls forward indefinitely", async () => {
+    // The old SESSION_MAX_LIFETIME_MS (30d) absolute cap is gone: repeatedly
+    // touching a session keeps sliding its expiry to now + 90d with no upper
+    // bound, matching cloud's rolling posture (an idle session still lapses
+    // at the TTL; an active one never does).
     const { db, userId, cleanup } = await makeDb();
     try {
       const t0 = new Date("2026-01-01T00:00:00Z");
       const s = createSession(db, { userId, now: () => t0 });
-      const ceiling = t0.getTime() + SESSION_MAX_LIFETIME_MS;
-      // A touch near the ceiling would slide to now + 24h, but the cap pins it.
-      const nearCeiling = new Date(ceiling - HOUR); // raw slide would be ceiling + 23h
-      touchSession(db, s.id, () => nearCeiling);
-      const found = findSession(db, s.id, () => nearCeiling);
-      expect(new Date(found?.expiresAt ?? 0).getTime()).toBe(ceiling);
-      // Past the ceiling the session is dead even though it was just "active".
-      expect(findSession(db, s.id, () => new Date(ceiling + 1000))).toBeNull();
+      // Touch well past where the old 30-day ceiling would have pinned it.
+      const farOut = new Date(t0.getTime() + 200 * DAY);
+      touchSession(db, s.id, () => farOut);
+      const found = findSession(db, s.id, () => farOut);
+      expect(new Date(found?.expiresAt ?? 0).getTime()).toBe(farOut.getTime() + SESSION_TTL_MS);
+      // Still alive nearly 90 more days out, right up to the fresh slide's TTL.
+      const stillAlive = new Date(farOut.getTime() + SESSION_TTL_MS - DAY);
+      expect(findSession(db, s.id, () => stillAlive)?.id).toBe(s.id);
     } finally {
       cleanup();
     }
@@ -147,6 +153,47 @@ describe("touchSession (sliding renewal)", () => {
   });
 });
 
+describe("shouldSlideSession (bounded slide, G3 twin)", () => {
+  test("false for a freshly-created session (full TTL remaining)", async () => {
+    const { db, userId, cleanup } = await makeDb();
+    try {
+      const t0 = new Date("2026-01-01T00:00:00Z");
+      const s = createSession(db, { userId, now: () => t0 });
+      expect(shouldSlideSession(s, () => t0)).toBe(false);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("false just before crossing the slide threshold", async () => {
+    const { db, userId, cleanup } = await makeDb();
+    try {
+      const t0 = new Date("2026-01-01T00:00:00Z");
+      const s = createSession(db, { userId, now: () => t0 });
+      // Elapsed just UNDER the threshold (30d) → remaining life still above
+      // (TTL - threshold) → not yet due to slide.
+      const justBefore = new Date(t0.getTime() + SESSION_SLIDE_THRESHOLD_MS - 1000);
+      expect(shouldSlideSession(s, () => justBefore)).toBe(false);
+    } finally {
+      cleanup();
+    }
+  });
+
+  test("true once remaining life drops below the slide threshold", async () => {
+    const { db, userId, cleanup } = await makeDb();
+    try {
+      const t0 = new Date("2026-01-01T00:00:00Z");
+      const s = createSession(db, { userId, now: () => t0 });
+      // Elapsed just OVER the threshold (30d) → remaining life below
+      // (TTL - threshold) → due to slide.
+      const justAfter = new Date(t0.getTime() + SESSION_SLIDE_THRESHOLD_MS + 1000);
+      expect(shouldSlideSession(s, () => justAfter)).toBe(true);
+    } finally {
+      cleanup();
+    }
+  });
+});
+
 describe("deleteSession", () => {
   test("removes the session row", async () => {
     const { db, userId, cleanup } = await makeDb();

package/src/account-api.ts

@@ -33,6 +33,11 @@
  * ownership gate the cloud twin runs per-vault is trivially satisfied here.
  */
 import type { Database } from "bun:sqlite";
+import {
+  type AccountBootstrap,
+  type ParachuteAccountDescriptor,
+  validateVaultScopes,
+} from "@openparachute/door-contract";
 import { ACCOUNT_VAULT_TOKEN_TTL_SECONDS } from "./account-home-ui.ts";
 import {
   type AdminAuthContext,
@@ -42,6 +47,7 @@ import {
 } from "./admin-auth.ts";
 import { HOST_ADMIN_SCOPE, provisionVault } from "./admin-vaults.ts";
 import { SERVICES_MANIFEST_PATH } from "./config.ts";
+import { activePublicSignupPath } from "./invites.ts";
 import { inferAudience } from "./jwt-audience.ts";
 import { recordTokenMint, signAccessToken, validateAccessToken } from "./jwt-sign.ts";
 import { ACCOUNT_SELF_ADMIN_SCOPE, ACCOUNT_SELF_READ_SCOPE } from "./scope-explanations.ts";
@@ -102,10 +108,14 @@ export interface AccountApiDeps {
 // Shared helpers
 // ---------------------------------------------------------------------------
 
-function json(status: number, body: unknown): Response {
+function json(status: number, body: unknown, extraHeaders?: Record<string, string>): Response {
   return new Response(JSON.stringify(body), {
     status,
-    headers: { "content-type": "application/json", "cache-control": "no-store" },
+    headers: {
+      "content-type": "application/json",
+      "cache-control": "no-store",
+      ...extraHeaders,
+    },
   });
 }
 
@@ -200,43 +210,69 @@ function servicesBlock(meta: VaultMeta): Record<string, { url: string; version:
 // ---------------------------------------------------------------------------
 
 /**
- * The self-host door descriptor. Public, no auth — it is what lets the app
- * render honestly per door (D2): `billing:false` + `plans:[]` means the app
- * shows no billing/upgrade UI on self-host; `caps_writable:true` means the
- * operator can PUT caps freely (the cloud twin is plan-derived → false).
+ * The self-host door descriptor — the canonical `ParachuteAccountDescriptor`
+ * (door-contract 0.4.0) both doors serve, so a client (the app) branches its
+ * front door without hardcoding per-door shapes. Public, no auth, wildcard
+ * CORS (the app pulls it cross-origin).
+ *
+ * `features`/`caps_writable` are hub EXTRAS beyond the shared contract — the
+ * shared conformance checker (`checkAccountDescriptor`) walks expected keys
+ * only, so these ride along without breaking cross-door conformance.
+ * `billing:false` + `plans:[]` (Q7, parked) mean the app shows no
+ * billing/upgrade UI on self-host; `caps_writable:true` means the operator
+ * can PUT caps freely (the cloud twin is plan-derived → false).
  *
- * `import`/`export` describe the self-host DOOR's portability capability
- * (which it has). The `/account/vaults/<name>/export` + `/account/vaults/import`
- * REST endpoints are a follow-on to this PR (H2 ships the vault-lifecycle +
- * caps core); the flags stay true because the door supports portability.
+ * `signup_path` is conditional (Q2): present only while an active multi-use
+ * public invite exists (`activePublicSignupPath`, invites.ts) — an operator-
+ * shared link is otherwise the only way in, so the app must not render a
+ * "create account" affordance when there is nowhere for it to go.
  */
-export function handleAccountCapabilities(req: Request, deps: { issuer: string }): Response {
+export function handleAccountCapabilities(
+  req: Request,
+  deps: { db: Database; issuer: string; now?: () => Date },
+): Response {
   if (req.method !== "GET") return methodNotAllowed("GET");
-  const descriptor = {
-    door: "self-host",
-    issuer: deps.issuer.replace(/\/$/, ""),
-    account_token: { endpoint: "/account/token", method: "POST", scheme: "cookie" },
+  const issuer = deps.issuer.replace(/\/$/, "");
+  const now = deps.now ? deps.now() : new Date();
+  const signupPath = activePublicSignupPath(deps.db, now);
+  const descriptor: ParachuteAccountDescriptor & {
     features: {
-      vault_create: true,
-      vault_delete: true,
-      import: true,
-      export: true,
-      billing: false,
-      plans: [] as string[],
-      modules: true,
-      expose: true,
-    },
+      modules: boolean;
+      expose: boolean;
+      import: boolean;
+      export: boolean;
+      billing: boolean;
+    };
+    caps_writable: boolean;
+  } = {
+    issuer,
+    door: "hub",
+    account_endpoint: `${issuer}/account`,
+    auth: { methods: ["password"], signin_path: "/login" },
+    ...(signupPath ? { signup_path: signupPath } : {}),
+    vault_url_template: `${issuer}/vault/{name}`,
+    capabilities: { vault_create: true, vault_rename: false, vault_delete: true },
+    plans: [],
+    // Hub EXTRAS (kept — see the doc comment above).
+    features: { modules: true, expose: true, import: true, export: true, billing: false },
     caps_writable: true,
-    limits: { vaults_max: null as number | null },
   };
-  return json(200, descriptor);
+  return json(200, descriptor, {
+    "access-control-allow-origin": "*",
+    "access-control-allow-methods": "GET, OPTIONS",
+  });
 }
 
 // ---------------------------------------------------------------------------
 // GET /account — account bootstrap
 // ---------------------------------------------------------------------------
 
-/** `{ account_id, email, door }`. On self-host the account id is `self`. */
+/**
+ * The contract's `AccountBootstrap` — `{ id, email?, door }`. On self-host the
+ * account id is the sentinel `self`; `email` is present only when the
+ * operator row has one (`users.email` is nullable-by-history, migration
+ * v15 — the door-contract type models it as optional, not nullable).
+ */
 export async function handleAccountRoot(req: Request, deps: AccountApiDeps): Promise<Response> {
   if (req.method !== "GET") return methodNotAllowed("GET");
   let ctx: AdminAuthContext;
@@ -246,11 +282,12 @@ export async function handleAccountRoot(req: Request, deps: AccountApiDeps): Pro
     return adminAuthErrorResponse(err);
   }
   const user = getUserById(deps.db, ctx.sub);
-  return json(200, {
-    account_id: "self",
-    email: user?.email ?? null,
-    door: "self-host",
-  });
+  const body: AccountBootstrap = {
+    id: "self",
+    door: "hub",
+    ...(user?.email ? { email: user.email } : {}),
+  };
+  return json(200, body);
 }
 
 // ---------------------------------------------------------------------------
@@ -369,6 +406,19 @@ export async function handleAccountCreateVault(
     const error = provisioned.status === 400 ? "invalid_name" : "server_error";
     return json(provisioned.status, { error, message: provisioned.message });
   }
+  // Q6 (hub-parity P2): this facade no longer answers 200-idempotent on an
+  // existing name — it converges on cloud's exact 409 `vault_taken` shape.
+  // `provisionVault` itself is UNCHANGED (still idempotent for its other
+  // caller, the invite-redeem flow, which doesn't route through this
+  // facade) — only this facade's wire answer changes. A scripted consumer
+  // that relied on 200-on-existing must follow up with
+  // `POST /account/vaults/<name>/token` to get a usable token.
+  if (!provisioned.created) {
+    return json(409, {
+      error: "vault_taken",
+      message: "That vault name is already taken.",
+    });
+  }
 
   const entry = provisioned.entry;
   const meta: VaultMeta = { name: entry.name, url: entry.url, version: entry.version };
@@ -387,25 +437,30 @@ export async function handleAccountCreateVault(
       : {}),
     services: servicesBlock(meta),
   };
-  // 201 on a fresh create; 200 on an idempotent re-POST of an existing vault
-  // (no fresh token — `vault_token` is "" and the app mints via /token).
-  return json(provisioned.created ? 201 : 200, body);
+  return json(201, body);
 }
 
 // ---------------------------------------------------------------------------
 // POST /account/vaults/<name>/token — per-vault token mint
 // ---------------------------------------------------------------------------
 
-const MINTABLE_VERBS = new Set(["read", "write", "admin"]);
-
 interface ScopesBody {
   ok: true;
   scopes: string[];
 }
 
 /**
- * Parse + validate the requested `scopes`. Each must be `vault:<name>:<verb>`
- * for THIS vault with a mintable verb. Omitted / empty → default read+write.
+ * Parse + validate the requested `scopes`. The JSON-parse tolerance (optional
+ * body, optional content-type, swallow a malformed body) stays LOCAL — it's
+ * HTTP plumbing the shared validator knows nothing about (it's pure, no
+ * `Request`). The scope-SHAPE logic (array check, per-entry
+ * `vault:<name>:<verb>` grammar, empty/absent → default read+write) is the
+ * shared `validateVaultScopes` (door-contract 0.4.0) — the ONE implementation
+ * cloud's twin also imports, replacing the two hand-synced copies. Its reason
+ * taxonomy (`invalid_request` | `invalid_scope`) was built byte-exact with
+ * this function's prior behavior (see vault-scopes.ts's doc comment), so this
+ * swap is a behavioral no-op for the hub — verified by rerunning this file's
+ * existing test cases unchanged (account-api.test.ts).
  */
 async function parseScopesBody(req: Request, vaultName: string): Promise<ScopesBody | BodyErr> {
   const defaultScopes = [`vault:${vaultName}:read`, `vault:${vaultName}:write`];
@@ -422,34 +477,24 @@ async function parseScopesBody(req: Request, vaultName: string): Promise<ScopesB
   }
   if (!raw || typeof raw !== "object") return { ok: true, scopes: defaultScopes };
   const requested = (raw as Record<string, unknown>).scopes;
-  if (requested === undefined || requested === null) return { ok: true, scopes: defaultScopes };
-  if (!Array.isArray(requested) || requested.some((s) => typeof s !== "string")) {
-    return {
-      ok: false,
-      status: 400,
-      error: "invalid_request",
-      message: '"scopes" must be an array of strings',
-    };
-  }
-  const scopes = requested as string[];
-  if (scopes.length === 0) return { ok: true, scopes: defaultScopes };
-  for (const s of scopes) {
-    const parts = s.split(":");
-    if (
-      parts.length !== 3 ||
-      parts[0] !== "vault" ||
-      parts[1] !== vaultName ||
-      !MINTABLE_VERBS.has(parts[2] ?? "")
-    ) {
-      return {
-        ok: false,
-        status: 400,
-        error: "invalid_scope",
-        message: `scope "${s}" must be vault:${vaultName}:{read|write|admin}`,
-      };
-    }
+
+  const result = validateVaultScopes(requested, vaultName);
+  if (!result.ok) {
+    return result.reason === "invalid_request"
+      ? {
+          ok: false,
+          status: 400,
+          error: "invalid_request",
+          message: '"scopes" must be an array of strings',
+        }
+      : {
+          ok: false,
+          status: 400,
+          error: "invalid_scope",
+          message: `every scope must be vault:${vaultName}:{read|write|admin}`,
+        };
   }
-  return { ok: true, scopes };
+  return { ok: true, scopes: result.scopes };
 }
 
 export async function handleAccountMintVaultToken(

package/src/account-session.ts

@@ -0,0 +1,132 @@
+/**
+ * `GET /account/session` — the same-origin boot oracle (hub-parity P1; the
+ * hub's twin of cloud `account-session.ts`). Returns `{ signed_in, csrf, ... }`
+ * so the same-origin `parachute-app` — served at the hub's own origin — can
+ * (a) decide whether to render the signed-in UI or the sign-in ceremony, and
+ * (b) echo `csrf` back as `__csrf` on its next same-origin `POST /account/token`
+ * mint (C2). The CSRF cookie is `HttpOnly` (csrf.ts), so the SPA can't read it
+ * directly; this hands the token over the same way a server-rendered form's
+ * hidden input does.
+ *
+ * PUBLIC — no Bearer, no scope gate. It drives the `parachute_hub_session`
+ * cookie directly, same as `/api/me`: a client with no account Bearer yet has
+ * nothing else to authenticate a read with, and this endpoint IS the
+ * bootstrap. Mounted ABOVE the force-change-password gate (hub-server.ts
+ * CHOKE POINT 1) — it's a pure state oracle, not a mutating surface, so a
+ * pre-rotation user must still be able to read it (the app needs `signed_in` +
+ * `csrf` to drive the rotation ceremony itself, not get walled off before it
+ * can even ask). `POST /account/token` stays BELOW the gate — a pre-rotation
+ * user hits its 403 `force_change_password` there, and the app is expected to
+ * weather that (P4).
+ *
+ * SAME-ORIGIN ONLY, by design — mirrors cloud's posture exactly: the response
+ * is CREDENTIALED (it reflects the session cookie and sets the CSRF cookie),
+ * so it carries NO CORS headers. A cross-origin caller simply gets no
+ * `access-control-allow-origin`, so the browser blocks it from reading the
+ * body — intended, not an oversight.
+ */
+import type { Database } from "bun:sqlite";
+import { ensureCsrfToken } from "./csrf.ts";
+import { isHttpsRequest } from "./request-protocol.ts";
+import {
+  SESSION_TTL_MS,
+  buildSessionCookie,
+  findActiveSession,
+  shouldSlideSession,
+  touchSession,
+} from "./sessions.ts";
+import { getUserById } from "./users.ts";
+
+export interface AccountSessionDeps {
+  db: Database;
+}
+
+/** Matches the `/account/*` 405 shape (`account-api.ts`'s `methodNotAllowed`)
+ * — same `{error, message}` body + `Allow` header, kept local to this file
+ * per the one-handler-one-file convention (`api-me.ts`, `account-token.ts`). */
+function methodNotAllowed(allow: string): Response {
+  return new Response(JSON.stringify({ error: "method_not_allowed", message: `use ${allow}` }), {
+    status: 405,
+    headers: { "content-type": "application/json", allow },
+  });
+}
+
+/**
+ * A credentialed JSON reply that can carry MULTIPLE Set-Cookie headers (the
+ * CSRF mint and the session slide's re-issue can coincide — a plain
+ * `Record`-keyed header init can't hold two `set-cookie` values). NO CORS
+ * headers (see the module note); `no-store` so a back/forward navigation
+ * never replays a stale csrf/session state. Mirrors cloud's `sessionJson`.
+ */
+function sessionJson(body: unknown, cookies: readonly string[]): Response {
+  const headers = new Headers({ "content-type": "application/json", "cache-control": "no-store" });
+  for (const c of cookies) headers.append("set-cookie", c);
+  return new Response(JSON.stringify(body), { status: 200, headers });
+}
+
+export function handleAccountSession(req: Request, deps: AccountSessionDeps): Response {
+  if (req.method !== "GET") return methodNotAllowed("GET");
+
+  // CSRF token for BOTH branches (G2 — anonymous CSRF; the piece `api-me.ts`
+  // lacks, since it mints only when signed in). ensureCsrfToken reuses an
+  // existing CSRF cookie or mints one (setCookie only when it minted) — it
+  // works WITHOUT a session and authorizes NOTHING alone (it's one half of a
+  // double-submit that also needs the matching cookie + same-origin + a live
+  // session at the mint gate it protects). Returning it on the signed-OUT
+  // branch lets the app run the sign-in moment in-app.
+  const csrf = ensureCsrfToken(req);
+  const cookies: string[] = [];
+  if (csrf.setCookie) cookies.push(csrf.setCookie);
+
+  // findActiveSession is the single chokepoint: it refuses an expired row (a
+  // logged-out row is gone outright). Nothing below rolls or reads a
+  // dead/absent session.
+  const session = findActiveSession(deps.db, req);
+  if (!session) {
+    return sessionJson({ signed_in: false, csrf: csrf.token }, cookies);
+  }
+
+  // Bounded slide (the G3 twin, and the reason NOT to call bare
+  // `touchSession` unconditionally here): this endpoint is POLLED — the
+  // app's `/check-email` screen hits it every few seconds while it waits for
+  // a magic-link-style click — so sliding only past
+  // `SESSION_SLIDE_THRESHOLD_MS` of remaining life bounds the write (and the
+  // cookie re-issue) to ~once per threshold per session, not per request.
+  if (shouldSlideSession(session)) {
+    touchSession(deps.db, session.id);
+    cookies.push(
+      buildSessionCookie(session.id, Math.floor(SESSION_TTL_MS / 1000), {
+        secure: isHttpsRequest(req),
+      }),
+    );
+  }
+
+  const user = getUserById(deps.db, session.userId);
+  if (!user) {
+    // Session row points at a deleted user — treat as signed-out (the
+    // `api-me.ts` precedent) rather than surface a stale identity. Any slide
+    // cookie computed above still rides along; it's harmless (the row is
+    // about to be orphaned regardless) and keeping the branch simple beats
+    // special-casing a cookie rollback for a should-never-happen state.
+    return sessionJson({ signed_in: false, csrf: csrf.token }, cookies);
+  }
+
+  return sessionJson(
+    {
+      signed_in: true,
+      csrf: csrf.token,
+      // users.email is null-by-history (migration v15) — username is always
+      // present, email only when the row has one (B2 signup capture).
+      username: user.username,
+      ...(user.email ? { email: user.email } : {}),
+      account_created_at: user.createdAt,
+      // HUB EXTRA — additive, not part of the door-contract pin
+      // (`checkAccountSessionResponse` tolerates extra fields): lets the app
+      // hop a temp-password user straight to the change-password ceremony
+      // instead of hitting the force-change-password 403 wall on their next
+      // `/account/*` call.
+      ...(user.passwordChanged === false ? { password_change_required: true } : {}),
+    },
+    cookies,
+  );
+}

package/src/api-invites.ts

@@ -32,6 +32,7 @@ import type { Database } from "bun:sqlite";
 import { type AdminAuthError, adminAuthErrorResponse, requireScope } from "./admin-auth.ts";
 import { HOST_ADMIN_SCOPE } from "./admin-vaults.ts";
 import { SERVICES_MANIFEST_PATH } from "./config.ts";
+import { setSetting } from "./hub-settings.ts";
 import {
   DEFAULT_INVITE_TTL_SECONDS,
   type Invite,
@@ -543,6 +544,24 @@ export async function handleCreateInvite(req: Request, deps: ApiInvitesDeps): Pr
     vaultCapBytes: effectiveVaultCapBytes,
     ...(deps.now !== undefined ? { now: deps.now } : {}),
   });
+  // Q2 (hub-parity P2, the raw-token reality): a multi-use PROVISIONING link
+  // IS the public signup page (the operator mints it to broadcast, and each
+  // redeemer gets their OWN new vault) — persisting ITS raw token so the
+  // account descriptor can advertise `signup_path` does NOT weaken the
+  // hash-only posture of single-use friend invites, which never write this row.
+  // The `provisionVault` guard is load-bearing security, not cosmetic: a
+  // multi-use SHARED-vault invite (`provision_vault=false` + an existing
+  // vault_name — "many users join one team vault", coherent per the mint gates
+  // above) must NEVER be auto-published on the anonymous, wildcard-CORS
+  // descriptor, or its team-vault-write link leaks to anyone who fetches the
+  // exposed hub. Only multi-use + provisioning = genuine public signup (the
+  // same conjunction the vault-cap heuristic above already treats as such).
+  // The newest public link wins (overwrites any prior value);
+  // `activePublicSignupPath` (invites.ts) re-validates liveness on every read
+  // and lazily clears a revoked/exhausted/expired one.
+  if (maxUses > 1 && provisionVault) {
+    setSetting(deps.db, "public_signup_token", issued.rawToken, deps.now ?? (() => new Date()));
+  }
   const status = inviteStatus(issued.invite, now);
   return new Response(
     JSON.stringify({