@openparachute/vault 0.5.0-rc.1 → 0.6.0-rc.1

package/README.md

@@ -99,7 +99,7 @@ The daemon binds `0.0.0.0:1940` (or whatever you set in `PORT`) and serves REST,
 
 `vault init` asks two explicit questions: (1) install vault as an MCP server in `~/.claude.json`? (2) also surface the access token so you can paste it into other MCP clients (Codex, Goose, OpenCode, Cursor, Zed, Cline), scripts, or `curl`? Both default yes. Pass `--mcp` / `--no-mcp` and `--token` / `--no-token` for non-interactive installs.
 
-If you said yes to (2), the hub-issued JWT is printed prominently at the end — it's the same token baked into `~/.claude.json` (if you also said yes to (1)). It's not stored anywhere retrievable — save it if you need it for `curl`, cron, or any other script. Lost it? Mint a fresh one with `parachute auth mint-token --scope vault:<name>:<verb>` (or rewire an MCP client with `parachute-vault mcp-install`, or use the admin SPA Tokens page). As of vault 0.5.0 (vault#282 Stage 2) vault no longer mints its own `pvt_*` tokens — minting is the hub's job.
+If you said yes to (2), the hub-issued JWT is printed prominently at the end — it's the same token baked into `~/.claude.json` (if you also said yes to (1)). It's not stored anywhere retrievable — save it if you need it for `curl`, cron, or any other script. Lost it? Mint a fresh one with `parachute auth mint-token --scope vault:<name>:<verb>` (or rewire an MCP client with `parachute-vault mcp-install`, or use the admin SPA Tokens page). As of vault 0.6.0 (vault#282 Stage 2) vault no longer mints its own `pvt_*` tokens — minting is the hub's job.
 
 ### OAuth lives on the hub
 
@@ -122,7 +122,7 @@ Two ways to authenticate — pick based on the client, not the deployment:
 | **OAuth 2.1 + PKCE (browser flow, via hub)** | Claude Desktop, Parachute Daily, any third-party MCP client set up interactively | Click "Add integration", enter the vault MCP URL, a browser opens to the **hub's** consent page, sign in with hub credentials, done — no token ever touches your clipboard |
 | **Bearer token (hub JWT)** | Claude Code (auto-wired by `vault init`), CLI scripts, cron jobs, any non-interactive caller | `curl -H "Authorization: Bearer <hub-jwt>"` — mint one with `parachute-vault mcp-install` (MCP clients) or `parachute auth mint-token --scope vault:<name>:<verb>` (scripts) |
 
-As of 0.5.0 (vault#282 Stage 2) vault is a **pure hub resource-server**: both paths use a hub-signed JWT that vault validates against the hub's JWKS. (The OAuth path is the interactive browser handshake; the bearer path mints the same kind of JWT non-interactively.) The old vault-local `pvt_*` opaque token was dropped — vault no longer mints or accepts it. The server-wide `VAULT_AUTH_TOKEN` operator bearer remains for the no-granular-auth / cross-container path.
+As of 0.6.0 (vault#282 Stage 2) vault is a **pure hub resource-server**: both paths use a hub-signed JWT that vault validates against the hub's JWKS. (The OAuth path is the interactive browser handshake; the bearer path mints the same kind of JWT non-interactively.) The old vault-local `pvt_*` opaque token was dropped — vault no longer mints or accepts it. The server-wide `VAULT_AUTH_TOKEN` operator bearer remains for the no-granular-auth / cross-container path.
 
 ### Claude Code
 
@@ -219,7 +219,7 @@ parachute-vault 2fa backup-codes           # regenerate backup codes
 # Tokens — vault#282 Stage 2: vault no longer mints its own tokens. Mint a
 # hub JWT with `parachute-vault mcp-install` (MCP clients) or
 # `parachute auth mint-token --scope vault:<name>:<verb>` (scripts).
-parachute-vault tokens                     # list any vestigial pre-0.5.0 token rows (all vaults)
+parachute-vault tokens                     # list any vestigial pre-0.6.0 token rows (all vaults)
 parachute-vault tokens revoke <token-id>   # revoke a vestigial row (default vault; add --vault to target)
 
 # Obsidian
@@ -531,7 +531,7 @@ The SSG / sync pattern. Two equivalent forms — bracket-style is canonical goin
 curl -H "Authorization: Bearer $VAULT_TOKEN" \
   "http://localhost:1940/vault/default/api/notes?meta[updated_at][gte]=2026-04-01T00:00:00Z"
 
-# Flat form (DEPRECATED in 0.4.3; planned removal in a later 0.x per vault#288)
+# Flat form (DEPRECATED in 0.4.3; planned removal 0.6.0 per vault#288)
 curl -H "Authorization: Bearer $VAULT_TOKEN" \
   "http://localhost:1940/vault/default/api/notes?date_field=updated_at&date_from=2026-04-01T00:00:00Z"
 ```
@@ -704,13 +704,13 @@ For wiring up an AI client (Claude Code, Claude Desktop, Parachute Daily), see [
 
 ### Passing the key
 
-As of 0.5.0 (vault#282 Stage 2) vault accepts these bearers at every authenticated endpoint:
+As of 0.6.0 (vault#282 Stage 2) vault accepts these bearers at every authenticated endpoint:
 
 - **Hub-issued JWT** (`eyJ...`) — the user-credential path; what OAuth issues and what `parachute-vault mcp-install` / `parachute auth mint-token` produce. Audience-bound to `vault.<name>`, scope-narrowed (`vault:<name>:<verb>`).
 - **`VAULT_AUTH_TOKEN`** — the server-wide operator bearer (env var; full-admin against any vault on the server).
 - **`pvk_...`** — legacy global API keys from `config.yaml` / per-vault `vault.yaml` (still honored for existing deployments).
 
-The old vault-local `pvt_*` opaque token was **dropped at 0.5.0** — vault no longer mints or accepts it.
+The old vault-local `pvt_*` opaque token was **dropped at 0.6.0** — vault no longer mints or accepts it.
 
 ```bash
 # Header (preferred)
@@ -742,7 +742,7 @@ Two permission levels carry through the JWT scope verb:
 | `read` | Query, list, find-path, vault-info only |
 
 `parachute-vault tokens list` / `tokens revoke` remain only to clean up any
-vestigial pre-0.5.0 rows. Legacy `pvk_...` keys from config.yaml still work at
+vestigial pre-0.6.0 rows. Legacy `pvk_...` keys from config.yaml still work at
 runtime; the `vault keys` CLI commands were removed long ago.
 
 ### Public endpoints

package/core/src/schema.ts

@@ -96,7 +96,7 @@ CREATE TABLE IF NOT EXISTS indexed_fields (
 
 -- Tokens: API authentication with OAuth-standard scopes.
 --
--- VESTIGIAL as of 0.5.0 (vault#282 Stage 2). Vault is a pure hub
+-- VESTIGIAL as of 0.6.0 (vault#282 Stage 2). Vault is a pure hub
 -- resource-server: it no longer mints (pvt_*) or validates rows in this
 -- table — auth runs through hub-issued JWTs + VAULT_AUTH_TOKEN + legacy YAML
 -- api_keys only. The table is KEPT (not dropped) because migrateVaultKeys
@@ -105,7 +105,7 @@ CREATE TABLE IF NOT EXISTS indexed_fields (
 -- leftover rows. A future cosmetic migration may drop it alongside
 -- oauth_clients/oauth_codes. 'tokens list' / 'tokens revoke' (CLI) still
 -- read/delete here for cleanup of leftover rows. See the field docs below for
--- the historical (pre-0.5.0) semantics.
+-- the historical (pre-0.6.0) semantics.
 --
 -- scopes is a whitespace-separated list of granted scopes (OAuth 2.0 §3.3)
 -- — e.g. "vault:read vault:write". Introduced in v12 alongside enforcement;
@@ -140,7 +140,7 @@ CREATE TABLE IF NOT EXISTS indexed_fields (
 -- session. Session-pinned list+revoke in manage-token filters on this.
 --
 -- revoked_at (v19) marked soft-revocation of vault-DB tokens. Vestigial
--- post-0.5.0 (vault#282 Stage 2) — the validation path that read it
+-- post-0.6.0 (vault#282 Stage 2) — the validation path that read it
 -- (resolveToken) was removed alongside the pvt_* mint.
 CREATE TABLE IF NOT EXISTS tokens (
   token_hash TEXT PRIMARY KEY,
@@ -420,7 +420,7 @@ export function initSchema(db: Database): void {
   // Migrate v15 → v16: add `vault_name` column to tokens. Existing rows
   // backfilled to NULL ("server-wide / legacy" semantic) — at the time auth
   // accepted NULL for any vault so pre-v16 pvt_* tokens kept working. (pvt_*
-  // validation was dropped at 0.5.0 / vault#282 Stage 2; the column is now
+  // validation was dropped at 0.6.0 / vault#282 Stage 2; the column is now
   // vestigial.) See vault#257.
   migrateToV16(db);
 
@@ -852,7 +852,7 @@ function migrateToV15(db: Database): void {
  * "server-wide / legacy" semantic. At the time, `authenticateVaultRequest`
  * accepted NULL for any vault so pre-v16 pvt_* tokens kept working. (pvt_*
  * validation + the `/vault/<name>/tokens` mint route were both removed at
- * 0.5.0 / vault#282 Stage 2 — the column + index are now vestigial; the
+ * 0.6.0 / vault#282 Stage 2 — the column + index are now vestigial; the
  * index still speeds the per-vault `listTokens` cleanup listing.)
  *
  * Wrapped in BEGIN IMMEDIATE / COMMIT (with try/catch ROLLBACK) per the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openparachute/vault",
-  "version": "0.5.0-rc.1",
+  "version": "0.6.0-rc.1",
   "description": "Agent-native knowledge graph. Notes, tags, links over MCP.",
   "module": "src/cli.ts",
   "type": "module",

package/src/auth-hub-jwt.test.ts

@@ -668,7 +668,7 @@ describe("authenticateVaultRequest — hub JWT tag-scoping (auth-unification C0)
 
 // ---------------------------------------------------------------------------
 // pvt_* DROP (vault#282 Stage 2 — BREAKING). pvt_* tokens were the only
-// non-JWT, non-YAML credential vault used to mint + validate. At 0.5.0 the
+// non-JWT, non-YAML credential vault used to mint + validate. At 0.6.0 the
 // mint + validation were removed entirely: a pvt_*-prefixed bearer is no
 // longer JWT-shaped (skips authenticateHubJwt) and matches no surviving
 // credential, so it 401s. The hub JWT — the migration target — keeps working.

package/src/auth-status.ts

@@ -8,7 +8,7 @@
  *
  * What gets exposed:
  *   - `initialized` — at least one vault exists
- *   - `auth_modes`  — accepted bearer formats. As of 0.5.0 (vault#282 Stage 2)
+ *   - `auth_modes`  — accepted bearer formats. As of 0.6.0 (vault#282 Stage 2)
  *     vault is a pure hub resource-server: the only first-class user
  *     credential is a hub-issued JWT, so this is `["hub_jwt"]`. (The
  *     server-wide VAULT_AUTH_TOKEN operator bearer + legacy YAML api_keys
@@ -17,7 +17,7 @@
  *   - `vaults`      — list of `{ name, url }` for client-side dispatch
  *   - `hasOwnerPassword`, `hasTotp` — OAuth consent prerequisites
  *   - `hasTokens`   — boolean | null. Probes the vestigial `tokens` table for
- *     any leftover pre-0.5.0 rows (the table is kept inert as the YAML-import
+ *     any leftover pre-0.6.0 rows (the table is kept inert as the YAML-import
  *     landing zone + a future-cosmetic-drop target). `null` ≈ "we couldn't
  *     read all DBs, don't trust this answer"; `true`/`false` are honest yes/no.
  *

package/src/auth.test.ts

@@ -1,7 +1,7 @@
 /**
  * Auth invariants — vault as a pure hub resource-server (vault#282 Stage 2).
  *
- * The `pvt_*` opaque vault-DB token was dropped at 0.5.0: vault no longer
+ * The `pvt_*` opaque vault-DB token was dropped at 0.6.0: vault no longer
  * mints or validates it. The surviving auth surfaces tested here are:
  *   - VAULT_AUTH_TOKEN — the server-wide operator bearer.
  *   - Legacy YAML api_keys (vault.yaml / config.yaml) — hashed keys.
@@ -91,7 +91,7 @@ describe("auth — pvt_* tokens are unvalidatable (fail closed)", () => {
   // API key" a non-pvt_ bad token gets) — the prefix is the user-meaningful
   // signal that the mechanism was dropped, not that the key was mistyped.
   const PVT_MESSAGE =
-    "pvt_* tokens are no longer supported (vault 0.5.0). Re-add this vault via your hub to get an access token.";
+    "pvt_* tokens are no longer supported (vault 0.6.0). Re-add this vault via your hub to get an access token.";
 
   test("a pvt_* bearer is 401-rejected with the dropped-token message on the per-vault surface", async () => {
     seedVault("journal");

package/src/auth.ts

@@ -1,7 +1,7 @@
 /**
  * Authentication and authorization for the vault server.
  *
- * As of 0.5.0 vault is a PURE HUB RESOURCE-SERVER (vault#282 Stage 2). The
+ * As of 0.6.0 vault is a PURE HUB RESOURCE-SERVER (vault#282 Stage 2). The
  * opaque `pvt_*` vault-DB token was dropped — vault no longer mints or
  * validates it. Three auth paths survive:
  *
@@ -310,7 +310,7 @@ function droppedPvtTokenResponse(): Response {
     {
       error: "Unauthorized",
       message:
-        "pvt_* tokens are no longer supported (vault 0.5.0). Re-add this vault via your hub to get an access token.",
+        "pvt_* tokens are no longer supported (vault 0.6.0). Re-add this vault via your hub to get an access token.",
     },
     { status: 401 },
   );

package/src/cli.ts

@@ -1586,15 +1586,15 @@ function cmdTokens(args: string[]) {
     return;
   }
 
-  // `tokens create` was removed at 0.5.0 (vault#282 Stage 2). Vault no longer
+  // `tokens create` was removed at 0.6.0 (vault#282 Stage 2). Vault no longer
   // mints its own (pvt_*) tokens — it's a pure hub resource-server. Tokens are
   // now hub-issued JWTs: run `parachute-vault mcp-install` to mint + wire one
   // for an MCP client, or `parachute auth mint-token --scope vault:<name>:<verb>`
   // for scripts. `tokens list` / `tokens revoke` remain for cleaning up any
-  // vestigial pre-0.5.0 rows.
+  // vestigial pre-0.6.0 rows.
   if (subcmd === "create") {
     console.error(
-      "`parachute-vault tokens create` was removed at 0.5.0 — vault no longer mints its own tokens.\n" +
+      "`parachute-vault tokens create` was removed at 0.6.0 — vault no longer mints its own tokens.\n" +
         "  Mint a hub-issued JWT instead:\n" +
         "    parachute-vault mcp-install --scope vault:<verb>   # wire an MCP client\n" +
         "    parachute auth mint-token --scope vault:<name>:<verb>   # for scripts\n" +
@@ -3359,7 +3359,7 @@ async function createVault(name: string): Promise<VaultCredential> {
   writeVaultConfig(config);
 
   // Touch the store so the vault's SQLite DB + schema are created. No token
-  // row is written — vault is a pure hub resource-server post-0.5.0.
+  // row is written — vault is a pure hub resource-server post-0.6.0.
   getVaultStore(name);
   return mintBootstrapCredential(name);
 }
@@ -3539,7 +3539,7 @@ Vaults:
 Tokens (vault#282 Stage 2 — vault is a pure hub resource-server; it no longer
 mints its own tokens. Mint a hub-issued JWT with \`parachute-vault mcp-install\`
 or \`parachute auth mint-token --scope vault:<name>:<verb>\`. \`list\` / \`revoke\`
-below operate on any vestigial pre-0.5.0 rows for cleanup.):
+below operate on any vestigial pre-0.6.0 rows for cleanup.):
   parachute-vault tokens                          List vault-DB tokens (every vault)
   parachute-vault tokens list --vault <name>      List tokens for one vault only
   parachute-vault tokens revoke <token-id>        Revoke a vestigial token (default vault)

package/src/init-summary.ts

@@ -23,7 +23,7 @@ export type InitSummaryInput = {
 
 /**
  * Build the post-install summary lines for `vault init`, branched on the
- * (addMcp, addToken, apiKey) decision matrix. Post-0.5.0 the token is a
+ * (addMcp, addToken, apiKey) decision matrix. Post-0.6.0 the token is a
  * hub-issued JWT minted via operator.token; when no hub is reachable `apiKey`
  * is undefined even though the operator opted in (`addToken`/`addMcp`):
  *

package/src/mcp-tools.ts

@@ -463,7 +463,7 @@ function resolveHubOrigin(): { url: string; source: string } {
  *
  * After the auth-unification arc (vault#403, MGT) the tool is a thin proxy to
  * hub's mint-token attenuation endpoint: it mints short-TTL HUB JWTs. The
- * `pvt_*` vault-DB mint infra it replaced was removed at 0.5.0 (vault#282
+ * `pvt_*` vault-DB mint infra it replaced was removed at 0.6.0 (vault#282
  * Stage 2 — vault is a pure hub resource-server).
  *
  * Closure-captured context:

package/src/routes.ts

@@ -564,7 +564,7 @@ async function handleNotesInner(
       //
       //   - **Flat date params** (DEPRECATED): `?date_field=created_at&
       //     date_from=…&date_to=…` and the legacy `?date_from=…&date_to=…`.
-      //     Still functional through 0.5.x; planned removal in a later 0.x
+      //     Still functional through 0.5.x; planned removal in 0.6.0
       //     (vault#288). New consumers should use bracket-style.
       //
       // Precedence on overlap: bracket-style wins. If a caller passes both

package/src/routing.test.ts

@@ -100,8 +100,8 @@ function createVault(name: string, description?: string): void {
 
 /**
  * Seed a vestigial row directly into a vault's `tokens` table (raw INSERT).
- * Post-0.5.0 (vault#282 Stage 2) vault no longer mints these, but the table
- * survives + `/auth/status` probes it for leftover pre-0.5.0 rows. This is how
+ * Post-0.6.0 (vault#282 Stage 2) vault no longer mints these, but the table
+ * survives + `/auth/status` probes it for leftover pre-0.6.0 rows. This is how
  * we exercise the `hasTokens=true` branch now that there's no mint path.
  */
 function seedVestigialTokenRow(vaultName: string): void {
@@ -114,7 +114,7 @@ function seedVestigialTokenRow(vaultName: string): void {
 /**
  * Seed a vestigial tag-scoped row (raw INSERT, `scoped_tags` JSON populated).
  * The tag-delete / -rename / -merge fail-closed guard (`findTokensReferencingTag`)
- * reads this column. Post-0.5.0 hub-JWT tag scopes live in the JWT claim, not
+ * reads this column. Post-0.6.0 hub-JWT tag scopes live in the JWT claim, not
  * the DB, so the guard now protects only these vestigial rows — these tests
  * pin that the DB-row guard still fires.
  */

package/src/routing.ts

@@ -463,7 +463,7 @@ export async function route(
   }
 
   // The per-vault `/tokens` REST surface (pvt_* mint/list/revoke) was removed
-  // at 0.5.0 (vault#282 Stage 2 — vault is a pure hub resource-server). Hub
+  // at 0.6.0 (vault#282 Stage 2 — vault is a pure hub resource-server). Hub
   // JWTs are minted via hub's registry (`/api/auth/mint-token`); a `/tokens`
   // request now falls through to the catch-all 404 below.
 

package/src/scopes.ts

@@ -7,7 +7,7 @@
  *     VAULT_AUTH_TOKEN operator bearer, which are vault-pinned by context
  *     (the YAML key lives under a specific vault; the operator bearer is
  *     server-wide full-admin). (The `pvt_*` vault-DB token that also used
- *     this shape was dropped at 0.5.0 — vault#282 Stage 2.)
+ *     this shape was dropped at 0.6.0 — vault#282 Stage 2.)
  *   - **Narrowed** `vault:<name>:<verb>` — used by hub-issued JWTs, which are
  *     not pinned by storage and so MUST name the resource they grant access
  *     to. Hub JWTs carrying broad `vault:<verb>` are rejected at validation

package/src/token-store.ts

@@ -1,16 +1,16 @@
 /**
  * Token operations for the per-vault `tokens` table.
  *
- * VESTIGIAL as of 0.5.0 (vault#282 Stage 2). Vault is a pure hub
+ * VESTIGIAL as of 0.6.0 (vault#282 Stage 2). Vault is a pure hub
  * resource-server: it no longer mints (`pvt_*`) or validates rows in this
  * table. What survives here:
  *   - `listTokens` / `revokeToken` / `findTokensReferencingTag` — read/clean up
- *     any leftover pre-0.5.0 rows.
+ *     any leftover pre-0.6.0 rows.
  *   - `migrateVaultKeys` — the legacy-YAML-api_keys import landing zone (raw
  *     INSERT; the only writer left).
  *   - the `mcp_mint_ledger` helpers — hub-JWT attribution for manage-token.
  *
- * The `Token`/field docs below describe the historical (pre-0.5.0) auth
+ * The `Token`/field docs below describe the historical (pre-0.6.0) auth
  * semantics for the surviving read/cleanup paths; no validation path reads
  * `scoped_tags` / `vault_name` off these rows anymore.
  *
@@ -76,13 +76,13 @@ export interface Token {
   /**
    * Session pin (v19). When this token was minted via manage-token, this
    * is the hub JWT's jti claim of the minting session. NULL otherwise.
-   * (Vestigial post-0.5.0 — no new rows are written; vault no longer mints
+   * (Vestigial post-0.6.0 — no new rows are written; vault no longer mints
    * vault-DB tokens. See vault#282 Stage 2.)
    */
   parent_jti: string | null;
   /**
    * Soft-revoke timestamp (v19). Marked the row revoked while keeping it in
-   * place for audit history. Vestigial post-0.5.0 (vault#282 Stage 2) — no
+   * place for audit history. Vestigial post-0.6.0 (vault#282 Stage 2) — no
    * validation path reads these rows anymore. NULL = active.
    */
   revoked_at: string | null;
@@ -110,9 +110,9 @@ export function parseScopedTags(raw: string | null): string[] | null {
 // Token operations
 //
 // vault#282 Stage 2: the pvt_* mint (`generateToken` / `createToken`) and
-// validation (`resolveToken`) were removed at 0.5.0 — vault is a pure hub
+// validation (`resolveToken`) were removed at 0.6.0 — vault is a pure hub
 // resource-server and no longer issues or accepts opaque vault-DB tokens.
-// What survives: `listTokens` / `revokeToken` (cleanup of vestigial pre-0.5.0
+// What survives: `listTokens` / `revokeToken` (cleanup of vestigial pre-0.6.0
 // rows), the YAML-import landing zone (`migrateVaultKeys`, raw INSERT), and the
 // `mcp_mint_ledger` machinery (hub-JWT attribution for manage-token).
 // ---------------------------------------------------------------------------

package/src/vault.test.ts

@@ -1382,7 +1382,7 @@ describe("scoped MCP wrapper", async () => {
     await store.createNote("h", { tags: ["health"] });
 
     // Seed a vestigial tag-scoped row referencing "health" (raw INSERT —
-    // vault no longer mints these post-0.5.0, but findTokensReferencingTag
+    // vault no longer mints these post-0.6.0, but findTokensReferencingTag
     // still guards the tag-delete path against leftover rows). vault#282.
     store.db
       .prepare(