@openparachute/hub 0.7.7-rc.8 → 0.7.7

package/src/__tests__/surface-notes-alias.test.ts

@@ -0,0 +1,296 @@
+/**
+ * W2-12 — `/surface/notes` → `/surface/parachute` conditional alias.
+ *
+ * The condition is decided on `uis{}` MOUNT PATHS (the values
+ * `resolveUiMount` routes on), not map keys: fire only when no sub-unit
+ * resolves at/under `/surface/notes` AND one is mounted at exactly
+ * `/surface/parachute`. Unit tests pin the helper's condition + target
+ * shape; the integration tests drive `hubFetch` end-to-end to prove the
+ * dispatch placement (before the generic services proxy) and — the
+ * load-bearing half — that an EXISTING notes-ui install (a `/surface/notes`
+ * uis mount) passes through to its upstream untouched.
+ */
+import { describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { hubFetch } from "../hub-server.ts";
+import { clearNotesRedirectLogState } from "../notes-redirect.ts";
+import { type ServiceEntry, writeManifest } from "../services-manifest.ts";
+import { isSurfaceNotesPath, maybeRedirectSurfaceNotes } from "../surface-notes-alias.ts";
+
+// ---------------------------------------------------------------------------
+// Manifest fixtures
+// ---------------------------------------------------------------------------
+
+/** A surface-host row carrying the given uis map (or none). */
+function surfaceRow(uis: ServiceEntry["uis"] | undefined, port = 1946): ServiceEntry {
+  const entry: ServiceEntry = {
+    name: "parachute-surface",
+    port,
+    paths: ["/surface"],
+    health: "/surface/healthz",
+    version: "0.4.0",
+  };
+  if (uis !== undefined) entry.uis = uis;
+  return entry;
+}
+
+/** Post-rename install: the app surface registered at /surface/parachute. */
+const PARACHUTE_UIS: ServiceEntry["uis"] = {
+  parachute: { displayName: "Parachute", path: "/surface/parachute", audience: "public" },
+};
+
+/** Existing install: notes-ui still registered at /surface/notes. */
+const NOTES_UIS: ServiceEntry["uis"] = {
+  notes: { displayName: "Notes", path: "/surface/notes", audience: "public" },
+};
+
+// ---------------------------------------------------------------------------
+// isSurfaceNotesPath — boundary shape
+// ---------------------------------------------------------------------------
+
+describe("isSurfaceNotesPath", () => {
+  test("matches the bare mount, trailing slash, and sub-paths", () => {
+    expect(isSurfaceNotesPath("/surface/notes")).toBe(true);
+    expect(isSurfaceNotesPath("/surface/notes/")).toBe(true);
+    expect(isSurfaceNotesPath("/surface/notes/index.html")).toBe(true);
+    expect(isSurfaceNotesPath("/surface/notes/a/b?ignored-not-part-of-path")).toBe(true);
+  });
+
+  test("does NOT match sibling prefixes or other mounts", () => {
+    expect(isSurfaceNotesPath("/surface/notesy")).toBe(false);
+    expect(isSurfaceNotesPath("/surface/notes-archive/")).toBe(false);
+    expect(isSurfaceNotesPath("/surface/parachute")).toBe(false);
+    expect(isSurfaceNotesPath("/notes/")).toBe(false);
+    expect(isSurfaceNotesPath("/surface")).toBe(false);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// maybeRedirectSurfaceNotes — the condition + target shape
+// ---------------------------------------------------------------------------
+
+describe("maybeRedirectSurfaceNotes", () => {
+  test("fires when /surface/parachute is mounted and /surface/notes is not", () => {
+    const services = [surfaceRow(PARACHUTE_UIS)];
+    expect(maybeRedirectSurfaceNotes("/surface/notes", "", services)).toBe("/surface/parachute");
+    expect(maybeRedirectSurfaceNotes("/surface/notes/", "", services)).toBe("/surface/parachute/");
+    expect(maybeRedirectSurfaceNotes("/surface/notes/a/b.html", "", services)).toBe(
+      "/surface/parachute/a/b.html",
+    );
+  });
+
+  test("preserves the query string on the target", () => {
+    const services = [surfaceRow(PARACHUTE_UIS)];
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "?q=1&n=2", services)).toBe(
+      "/surface/parachute/x?q=1&n=2",
+    );
+  });
+
+  test("INERT when a /surface/notes mount exists (existing notes-ui install)", () => {
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "", [surfaceRow(NOTES_UIS)])).toBe(
+      undefined,
+    );
+    // ... even when a parachute mount ALSO exists (transitional both-present
+    // install) — a live legacy mount is never preempted.
+    const both = [surfaceRow({ ...NOTES_UIS, ...PARACHUTE_UIS })];
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "", both)).toBe(undefined);
+  });
+
+  test("INERT when no uis{} exist at all (pre-uis surface-host rows — today's live shape)", () => {
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "", [surfaceRow(undefined)])).toBe(
+      undefined,
+    );
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "", [])).toBe(undefined);
+  });
+
+  test("INERT when the target mount is absent — never redirects into a 404", () => {
+    // A `parachute` KEY whose path was customized elsewhere does not count:
+    // the redirect target is the literal /surface/parachute mount, so its
+    // existence (by path) is part of the condition.
+    const customized: ServiceEntry["uis"] = {
+      parachute: { displayName: "Parachute", path: "/surface/app", audience: "public" },
+    };
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "", [surfaceRow(customized)])).toBe(
+      undefined,
+    );
+  });
+
+  test("fires in the in-place-upgrade caveat: uis KEY still `notes`, PATH flipped to /surface/parachute", () => {
+    // Re-adding the renamed package over the old instance with
+    // `instance_name=notes` and no `mount_path` keeps the map key `notes`
+    // while the mount flips — exactly the orphaned-bookmark scenario this
+    // alias exists for. The path-based condition (not key-based) covers it.
+    const upgraded: ServiceEntry["uis"] = {
+      notes: { displayName: "Parachute", path: "/surface/parachute", audience: "public" },
+    };
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "?a=1", [surfaceRow(upgraded)])).toBe(
+      "/surface/parachute/x?a=1",
+    );
+  });
+
+  test("a sub-unit mounted UNDER /surface/notes counts as the legacy identity resolving", () => {
+    // A deeper mount like /surface/notes/foo still serves real content under
+    // the legacy prefix; redirecting across it would hijack a live route.
+    const deep: ServiceEntry["uis"] = {
+      ...PARACHUTE_UIS,
+      foo: { displayName: "Foo", path: "/surface/notes/foo", audience: "public" },
+    };
+    expect(maybeRedirectSurfaceNotes("/surface/notes/foo/x", "", [surfaceRow(deep)])).toBe(
+      undefined,
+    );
+  });
+
+  test("non-matching pathnames return undefined regardless of manifest state", () => {
+    const services = [surfaceRow(PARACHUTE_UIS)];
+    expect(maybeRedirectSurfaceNotes("/surface/notesy", "", services)).toBe(undefined);
+    expect(maybeRedirectSurfaceNotes("/surface/parachute/x", "", services)).toBe(undefined);
+    expect(maybeRedirectSurfaceNotes("/notes/x", "", services)).toBe(undefined);
+  });
+
+  test("normalizes trailing slashes on declared uis paths", () => {
+    const slashed: ServiceEntry["uis"] = {
+      parachute: { displayName: "Parachute", path: "/surface/parachute/", audience: "public" },
+    };
+    expect(maybeRedirectSurfaceNotes("/surface/notes/x", "", [surfaceRow(slashed)])).toBe(
+      "/surface/parachute/x",
+    );
+  });
+});
+
+// ---------------------------------------------------------------------------
+// hubFetch integration — dispatch placement + passthrough
+// ---------------------------------------------------------------------------
+
+interface Harness {
+  dir: string;
+  manifestPath: string;
+  cleanup: () => void;
+}
+
+function makeHarness(): Harness {
+  const dir = mkdtempSync(join(tmpdir(), "pcli-surface-notes-alias-"));
+  return {
+    dir,
+    manifestPath: join(dir, "services.json"),
+    cleanup: () => rmSync(dir, { recursive: true, force: true }),
+  };
+}
+
+function req(path: string): Request {
+  return new Request(`http://127.0.0.1${path}`);
+}
+
+// Loopback peer so the default publicExposure cloak never interferes —
+// same shape audience-gate.test.ts uses.
+const fakeServer = (address: string) => ({ requestIP: () => ({ address }) });
+
+function startEchoUpstream(): { port: number; stop: () => void } {
+  const server = Bun.serve({
+    port: 0,
+    hostname: "127.0.0.1",
+    fetch: (r) =>
+      new Response(JSON.stringify({ upstream: "notes-ui", path: new URL(r.url).pathname }), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      }),
+  });
+  return { port: server.port as number, stop: () => server.stop(true) };
+}
+
+describe("hubFetch × surface-notes alias (W2-12)", () => {
+  test("301: /surface/notes/* → /surface/parachute/* when only the parachute mount exists (tail + query preserved)", async () => {
+    clearNotesRedirectLogState();
+    const h = makeHarness();
+    try {
+      writeManifest({ services: [surfaceRow(PARACHUTE_UIS)] }, h.manifestPath);
+      const f = hubFetch(h.dir, { manifestPath: h.manifestPath });
+      const res = await f(req("/surface/notes/some/path?q=1&n=2"), fakeServer("127.0.0.1"));
+      expect(res.status).toBe(301);
+      expect(res.headers.get("location")).toBe("/surface/parachute/some/path?q=1&n=2");
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("301: bare /surface/notes → /surface/parachute", async () => {
+    clearNotesRedirectLogState();
+    const h = makeHarness();
+    try {
+      writeManifest({ services: [surfaceRow(PARACHUTE_UIS)] }, h.manifestPath);
+      const f = hubFetch(h.dir, { manifestPath: h.manifestPath });
+      const res = await f(req("/surface/notes"), fakeServer("127.0.0.1"));
+      expect(res.status).toBe(301);
+      expect(res.headers.get("location")).toBe("/surface/parachute");
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("200 passthrough: an existing notes-ui install (notes uis mount) proxies to its upstream untouched", async () => {
+    clearNotesRedirectLogState();
+    const upstream = startEchoUpstream();
+    const h = makeHarness();
+    try {
+      writeManifest({ services: [surfaceRow(NOTES_UIS, upstream.port)] }, h.manifestPath);
+      const f = hubFetch(h.dir, { manifestPath: h.manifestPath });
+      const res = await f(req("/surface/notes/index.html"), fakeServer("127.0.0.1"));
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { upstream: string; path: string };
+      // The blind proxy forwarded the ORIGINAL path — no rewrite rode along.
+      expect(body.upstream).toBe("notes-ui");
+      expect(body.path).toBe("/surface/notes/index.html");
+    } finally {
+      upstream.stop();
+      h.cleanup();
+    }
+  });
+
+  test("404: /surface/notesy (sibling prefix) is untouched by the alias", async () => {
+    clearNotesRedirectLogState();
+    const h = makeHarness();
+    try {
+      // parachute-mount-only manifest, but NO row claims /surface/notesy —
+      // the boundary check keeps the alias out of the way and the dispatch
+      // falls through to the branded 404.
+      writeManifest(
+        {
+          services: [
+            {
+              name: "parachute-app",
+              port: 1944,
+              paths: ["/app"],
+              health: "/app",
+              version: "0.5.0",
+              uis: PARACHUTE_UIS,
+            },
+          ],
+        },
+        h.manifestPath,
+      );
+      const f = hubFetch(h.dir, { manifestPath: h.manifestPath });
+      const res = await f(req("/surface/notesy"), fakeServer("127.0.0.1"));
+      expect(res.status).toBe(404);
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("404 (not 301): no uis at all — today's live shape stays inert end-to-end", async () => {
+    clearNotesRedirectLogState();
+    const h = makeHarness();
+    try {
+      // A pre-uis surface row would normally proxy /surface/* blind; with no
+      // live upstream the proxy path yields a 502/404-class response — the
+      // assertion here is only that NO 301 fires. Use an empty manifest so
+      // the outcome is a deterministic 404.
+      writeManifest({ services: [] }, h.manifestPath);
+      const f = hubFetch(h.dir, { manifestPath: h.manifestPath });
+      const res = await f(req("/surface/notes/"), fakeServer("127.0.0.1"));
+      expect(res.status).toBe(404);
+    } finally {
+      h.cleanup();
+    }
+  });
+});

package/src/__tests__/wizard-transcription.test.ts

@@ -82,6 +82,41 @@ describe("walkTranscriptionStep — mode resolution (the CLI question)", () => {
     }
   });
 
+  test("non-interactive stdin (no flag) DEFAULTS to none — never hangs on the prompt", async () => {
+    // Headless-hardening: with no `--transcribe-mode` flag AND a closed / non-
+    // interactive stdin, an interactive `prompt("Pick [1]:")` would busy-hang
+    // Bun's readline question() forever (the exact e2e wedge). Transcription is
+    // optional and documented as never-blocking, so resolveChoice DEFAULTS to
+    // "none" (with an honest log line) rather than throwing. We drive the real
+    // defaultPrompt (no `prompt` seam) and force isTTY=false for determinism;
+    // if the guard regressed, this test would HANG instead of passing.
+    const h = makeHarness();
+    const origIsTTY = process.stdin.isTTY;
+    Object.defineProperty(process.stdin, "isTTY", { value: false, configurable: true });
+    try {
+      const r = recordingRunner();
+      const logs: string[] = [];
+      const code = await walkTranscriptionStep({
+        configDir: h.dir,
+        log: (l) => logs.push(l),
+        // no transcribeMode, no prompt seam → real defaultPrompt would be hit
+        runCommand: r.run,
+        platform: "linux",
+      });
+      expect(code).toBe(0);
+      expect(r.cmds).toEqual([]); // nothing installed
+      expect(readCfg(h.dir)).toBeUndefined(); // no provider recorded
+      expect(logs.join("\n")).toContain("not interactive");
+      expect(logs.join("\n")).toContain("Transcription off");
+    } finally {
+      Object.defineProperty(process.stdin, "isTTY", {
+        value: origIsTTY,
+        configurable: true,
+      });
+      h.cleanup();
+    }
+  });
+
   test("interactive prompt: '3' then 'g' chooses groq cloud", async () => {
     const h = makeHarness();
     try {

package/src/__tests__/wizard.test.ts

@@ -655,4 +655,83 @@ describe("runCliWizard", () => {
       "/admin/setup/expose",
     ]);
   });
+
+  test("non-interactive stdin fails fast (no hang) when a required answer is missing", async () => {
+    // Headless-hardening: with stdin closed (cloud-init, `ssh host 'parachute
+    // setup-wizard …'`, run.sh-exec'd stages.sh) an unanswered prompt would
+    // busy-hang Bun's readline question() forever. defaultPrompt now throws a
+    // clear, flag-naming error instead. We drive the real defaultPrompt (no
+    // `prompt` seam) with the account username unsupplied, forcing the account
+    // step to prompt — and force isTTY=false so the assertion is deterministic
+    // regardless of how the test runner's stdin is wired.
+    const { fetchImpl } = makeFakeHub();
+    const origIsTTY = process.stdin.isTTY;
+    Object.defineProperty(process.stdin, "isTTY", { value: false, configurable: true });
+    try {
+      await expect(
+        runCliWizard({
+          hubUrl: "http://127.0.0.1:1939",
+          log: () => {},
+          fetchImpl,
+          sleep: async () => {},
+          // no accountUsername → account step calls the real defaultPrompt.
+          accountPassword: "longpassword",
+          vaultMode: "skip",
+          exposeMode: "localhost",
+        }),
+      ).rejects.toThrow(/stdin is not interactive/);
+    } finally {
+      Object.defineProperty(process.stdin, "isTTY", {
+        value: origIsTTY,
+        configurable: true,
+      });
+    }
+  });
+
+  test("headless runCliWizard with NO --transcribe-mode completes (transcription defaults to none, not a throw)", async () => {
+    // Regression guard for the review must-fix: `runCliWizard` used to forward
+    // its (throwing) `defaultPrompt` into the transcription step, so a headless
+    // run with account/vault/expose all supplied via flags but NO
+    // `--transcribe-mode` would THROW at the transcription step ("cannot prompt
+    // for: Pick [1]:") instead of defaulting to none. The wizard now forwards a
+    // prompt to the transcription step ONLY when a real seam is injected, so
+    // headless hits `resolveChoice`'s undefined-prompt non-TTY guard → none.
+    const { state, fetchImpl } = makeFakeHub();
+    const logs: string[] = [];
+    let ran = false;
+    const origIsTTY = process.stdin.isTTY;
+    Object.defineProperty(process.stdin, "isTTY", { value: false, configurable: true });
+    try {
+      const code = await runCliWizard({
+        hubUrl: "http://127.0.0.1:1939",
+        log: (l) => logs.push(l),
+        fetchImpl,
+        sleep: async () => {},
+        accountUsername: "admin",
+        accountPassword: "longpassword",
+        vaultMode: "skip",
+        exposeMode: "localhost",
+        configDir: "/tmp/pcli-wizard-headless-none", // triggers the step; none writes nothing
+        // NO transcribeMode, NO prompt seam → headless must default to none.
+        transcribeRunCommand: async () => {
+          ran = true;
+          return 0;
+        },
+      });
+      expect(code).toBe(0); // completed, did NOT throw
+      expect(ran).toBe(false); // none → no scribe install
+      expect(logs.join("\n")).toContain("Transcription off");
+      // Full flow still walked account → vault → expose.
+      expect(state.posted.map((p) => p.path)).toEqual([
+        "/admin/setup/account",
+        "/admin/setup/vault",
+        "/admin/setup/expose",
+      ]);
+    } finally {
+      Object.defineProperty(process.stdin, "isTTY", {
+        value: origIsTTY,
+        configurable: true,
+      });
+    }
+  });
 });

package/src/account-api.ts

@@ -33,6 +33,12 @@
  * ownership gate the cloud twin runs per-vault is trivially satisfied here.
  */
 import type { Database } from "bun:sqlite";
+// NOTE: this is a VALUE import — hub can't run without
+// `@openparachute/door-contract` resolving at runtime, so it's a real
+// `^0.6.0` runtime `dependency` (package.json, mirroring `@openparachute/depcheck`)
+// and NOT a `workspace:*` devDependency. The published hub tarball doesn't ship
+// `packages/`, so the npm-installed hub resolves door-contract from the registry.
+// See RELEASING.md → "Releasing door-contract".
 import {
   type AccountBootstrap,
   type ParachuteAccountDescriptor,

package/src/admin-connections.ts

@@ -1082,7 +1082,8 @@ async function renewCredentialConnection(
   }
 
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(
       401,
       "unauthenticated",
@@ -1257,7 +1258,8 @@ async function claimCredentialConnection(
   }
 
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(
       401,
       "unauthenticated",

package/src/admin-lock.ts

@@ -24,11 +24,10 @@
  * The admin SPA + every module config UI get their working Bearer from one of
  * the cookie-gated mint endpoints:
  *   - `GET /admin/host-admin-token`        (the SPA's own Bearer)
- *   - `GET /admin/agent-token`             (agent chat + config UIs)
  *   - `GET /admin/vault-admin-token/<name>`(per-vault admin SPA)
  *   - `GET /admin/module-token/<short>`    (generic module config UI Bearer)
  *
- * All four share the exact `parseSessionCookie → findSession → [isFirstAdmin]
+ * All three share the exact `parseSessionCookie → findSession → [isFirstAdmin]
  * → signAccessToken` shape. Inserting {@link requireUnlocked} into each makes
  * the lock cascade to EVERY admin surface with no per-module changes: when
  * locked, the mint returns 423 and the relevant UI shows the lock screen / its

package/src/admin-module-token.ts

@@ -8,15 +8,14 @@
  * hub frames/links those surfaces consistently (the Modules page "Configure"
  * action). Each module-owned config UI, served behind the hub proxy to a
  * logged-in portal operator, needs an admin-scoped hub Bearer to call its own
- * `<short>:admin`-gated endpoints — the same shape the agent config UI gets
- * from `/admin/agent-token` and the vault admin SPA gets from
- * `/admin/vault-admin-token/<name>`. This is the GENERIC mint that covers every
- * other self-registered single-audience module, so the hub doesn't grow a
+ * `<short>:admin`-gated endpoints. This generic mint covers every
+ * self-registered single-audience module, while the vault admin SPA uses
+ * `/admin/vault-admin-token/<name>`, so the hub doesn't grow a
  * bespoke per-module mint endpoint as each module ships a config UI.
  *
  * Scope + audience: `<short>:admin`, audience = `<short>` (the bare service
  * prefix). Modules validate the JWT's `aud` against their literal short name
- * (`scribe`, `surface`, `agent`) — the same shape `inferAudience`
+ * (`scribe`, `surface`, or a third-party short) — the same shape `inferAudience`
  * stamps for the public OAuth flow, so a hub-minted and an OAuth-minted admin
  * token are indistinguishable to the module. This mirrors the per-request
  * `<short>:admin` proxy token `api-modules-config.ts` used to mint; the
@@ -32,7 +31,7 @@
  *
  * Gate: the session must belong to the first admin (the single hub admin under
  * the Phase 1 multi-user model — `users.ts:isFirstAdmin`), exactly like
- * host-admin-token / vault-admin-token / agent-token. A friend account holds
+ * host-admin-token and vault-admin-token. A friend account holds
  * a valid session but must not mint a module admin Bearer.
  *
  * Tokens are short-lived (10 min — matches the sibling admin-token mints); the
@@ -45,12 +44,12 @@ import {
   type ModuleManifest,
   readModuleManifest as defaultReadModuleManifest,
 } from "./module-manifest.ts";
-import { findServiceByShort, isKnownModuleShort } from "./service-spec.ts";
+import { RETIRED_MODULES, findServiceByShort, isKnownModuleShort } from "./service-spec.ts";
 import type { ServiceEntry } from "./services-manifest.ts";
 import { findSession, parseSessionCookie } from "./sessions.ts";
 import { isFirstAdmin } from "./users.ts";
 
-/** Short TTL — matches host/vault/agent admin-token. UI re-fetches on near-expiry. */
+/** Short TTL — matches sibling admin-token mints. UI re-fetches on near-expiry. */
 export const MODULE_TOKEN_TTL_SECONDS = 10 * 60;
 const MODULE_TOKEN_CLIENT_ID = "parachute-hub-spa";
 
@@ -115,6 +114,12 @@ export async function handleModuleToken(
   if (!MODULE_SHORT_RE.test(short)) {
     return jsonError(400, "invalid_request", `module short "${short}" is not a valid identifier`);
   }
+  // Retirement wins over the generic self-registration trust path. Otherwise a
+  // stale row plus readable module.json could keep minting after Hub support is
+  // deliberately removed.
+  if (RETIRED_MODULES[short]) {
+    return jsonError(404, "not_found", `no module "${short}" known to this hub`);
+  }
   // Vault is per-instance — its admin scope needs a vault name. Route the caller
   // to the dedicated per-vault endpoint rather than minting a useless bare
   // `vault:admin` (no vault validates that audience).

package/src/admin-surfaces.ts

@@ -61,7 +61,8 @@ function jsonError(status: number, error: string, description: string): Response
 /** Validate the operator bearer + require the surfaces scope. Mirrors api-modules-ops. */
 async function authorize(req: Request, deps: AdminSurfacesDeps): Promise<Response | undefined> {
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();

package/src/api-hub-upgrade.ts

@@ -158,7 +158,8 @@ interface ParsedBody {
 
 async function authorize(req: Request, deps: ApiHubUpgradeDeps): Promise<Response | undefined> {
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();

package/src/api-mint-token.ts

@@ -132,7 +132,8 @@ export async function handleApiMintToken(req: Request, deps: ApiMintTokenDeps):
 
   // 1. Bearer presence + parsing.
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();

package/src/api-modules-ops.ts

@@ -308,7 +308,8 @@ export function parseModulesPath(pathname: string): PathMatch | undefined {
 
 async function authorize(req: Request, deps: ApiModulesOpsDeps): Promise<Response | undefined> {
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();

package/src/api-modules.ts

@@ -82,7 +82,7 @@ import type { ModuleStartError, ModuleState, Supervisor } from "./supervisor.ts"
 
 /**
  * Resolve a known module to the display + install bootstrap data the admin SPA
- * renders. Reads from FIRST_PARTY_FALLBACKS (notes) first,
+ * renders. Reads from FIRST_PARTY_FALLBACKS (notes / app) first,
  * KNOWN_MODULES (vault / scribe / agent / surface) second.
  *
  * Returns `undefined` if the short is in neither table — a genuinely
@@ -351,15 +351,15 @@ interface ModuleWireShape {
    * `.parachute/module.json` `configUiUrl`, joined against its mount path the
    * same way `management_url` resolves `managementUrl`/`uiUrl`. Drives the
    * Modules page's consistent **Configure** action — clicking lands the
-   * operator on the module's own config UI (agent `/agent/admin`, scribe
-   * `/scribe/admin`, …), which mints its admin Bearer from the hub's
-   * cookie-gated `/admin/module-token/<short>` (or `/admin/agent-token`).
+   * operator on the module's own config UI (for example `/scribe/admin`),
+   * which mints its admin Bearer from the hub's cookie-gated
+   * `/admin/module-token/<short>`.
    *
    * Null when the module hasn't declared `configUiUrl` — the SPA omits the
    * Configure action for that module rather than rendering a dead button.
    * Distinct from `management_url`: a module may declare one, both, or
-   * neither. Agent declares `configUiUrl: "/agent/admin"` + `uiUrl`;
-   * vault declares `managementUrl` (its admin SPA is the config surface).
+   * neither. Vault declares `managementUrl` (its admin SPA is the config
+   * surface).
    */
   config_ui_url: string | null;
 }
@@ -462,7 +462,8 @@ export async function handleApiModules(req: Request, deps: ApiModulesDeps): Prom
 
   // Bearer presence + parsing.
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();
@@ -780,7 +781,8 @@ export async function handleApiModulesChannel(
 
   // Bearer presence + parsing.
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();

package/src/api-revoke-token.ts

@@ -100,7 +100,8 @@ export async function handleApiRevokeToken(
 
   // 1. Bearer presence + parsing.
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();

package/src/api-settings-hub-origin.ts

@@ -185,7 +185,8 @@ export async function handleApiSettingsHubOrigin(
   // Bearer presence + parsing — identical shape to api-modules
   // for consistency across hub-internal admin endpoints.
   const auth = req.headers.get("authorization");
-  if (!auth || !auth.startsWith("Bearer ")) {
+  // Bearer scheme is case-insensitive per RFC 7235; token passed verbatim (V1.4/C1.3 parity).
+  if (!auth || !/^Bearer\s+/i.test(auth)) {
     return jsonError(401, "unauthenticated", "Authorization: Bearer <token> required");
   }
   const bearer = auth.slice("Bearer ".length).trim();