@antasphere/chassis-server 1.0.0

package/dist/env.js

@@ -0,0 +1,383 @@
+import { z } from 'zod';
+import { parseApiKeyPeppers } from './apikeys/peppers.js';
+import { parseSuperadminEmails } from './accounts/superadmin.js';
+import { isDemoSignInHost, parseDemoEmailDomains, parseDemoHosts } from './identity/demo-pass-rules.js';
+/**
+ * The single entry point for configuration. Every env var the app reads is
+ * declared here; the docs env reference is generated from this schema.
+ * Parsing failures print a readable table and exit — the app never boots on a
+ * half-valid environment.
+ */
+/**
+ * Empty OR whitespace-only (e.g. `VAR=` or `VAR=" "` in compose) means unset.
+ * The trim matters: `Number(' ')` is 0, so an untrimmed blank would silently
+ * flip a `min(0)` numeric knob (like the API rate limit) to its 0/disabled
+ * meaning instead of the default — a security control off by a stray space.
+ */
+export const blankToUndefined = (v) => (typeof v === 'string' && v.trim() === '' ? undefined : v);
+export const booleanish = z.preprocess(blankToUndefined, z.enum(['true', 'false', '1', '0']).transform((v) => v === 'true' || v === '1'));
+/** Optional string where an empty value (e.g. `VAR=` in compose) means unset. */
+export const optionalString = (inner) => z.preprocess(blankToUndefined, inner.optional());
+/**
+ * Numeric knob where blank/whitespace means "use the default". EVERY numeric
+ * var goes through this: `Number('')` is 0, so an unwrapped `min(0)` knob
+ * (retention, quotas, sweeps) silently resolves to its 0/disabled meaning when
+ * compose passes `VAR=${VAR:-}`. `min(1)` knobs would merely fail the boot,
+ * but they ride the same preprocessor so a later `min(0)` cannot be added
+ * without it.
+ */
+export const numeric = (inner) => z.preprocess(blankToUndefined, inner);
+/**
+ * URL where only http(s) is acceptable. `z.url()` alone delegates to the WHATWG
+ * parser, which happily accepts `javascript:alert(1)` and `data:…` (verified
+ * against the pinned zod 4.4.3) — and PUBLIC_BASE_URL becomes the OIDC issuer,
+ * the Better Auth baseURL, and the base of every link we mint, so a non-http
+ * scheme there is a stored-XSS/redirect primitive rather than a typo.
+ */
+export const httpUrl = () => z.url({ protocol: /^https?$/ });
+/**
+ * Cheap, deterministic quality floor for operator-supplied secrets. `min(32)`
+ * on its own accepts `'x'.repeat(32)` and `'changeme'.repeat(4)` — 32 bytes of
+ * length with a handful of bits of entropy, which for AUTH_SECRET is forgeable
+ * session/JWKS material. Three independent smells, all cheap:
+ *
+ *  - Shannon entropy of the observed character distribution, in bits over the
+ *    whole string (a 32-char hex secret scores ~123 bits; `'x'.repeat(32)`
+ *    scores 0).
+ *  - distinct characters (a keyboard-mashed word list scores badly here even
+ *    when its entropy estimate looks acceptable).
+ *  - a short repeated pattern (`abcdefgh` × 4 passes both checks above).
+ *
+ * This is a floor, NOT a strength meter: it rejects the obviously-typed, it
+ * cannot bless the merely-random-looking. `openssl rand -hex 32` always passes.
+ */
+export function shannonEntropyBits(value) {
+    if (value.length === 0)
+        return 0;
+    const counts = new Map();
+    for (const ch of value)
+        counts.set(ch, (counts.get(ch) ?? 0) + 1);
+    let perChar = 0;
+    for (const n of counts.values()) {
+        const p = n / value.length;
+        perChar -= p * Math.log2(p);
+    }
+    return perChar * value.length;
+}
+const MIN_SECRET_ENTROPY_BITS = 64;
+const MIN_SECRET_DISTINCT_CHARS = 8;
+/** True when the whole string is one short block repeated (`'ab'.repeat(16)`). */
+function isRepeatedPattern(value) {
+    for (let len = 1; len < 16 && len <= value.length / 2; len++) {
+        if (value.length % len !== 0)
+            continue;
+        if (value === value.slice(0, len).repeat(value.length / len))
+            return true;
+    }
+    return false;
+}
+/** Human-readable reason a secret is too predictable, or null when acceptable. */
+export function weakSecretReason(value) {
+    if (new Set(value).size < MIN_SECRET_DISTINCT_CHARS) {
+        return `too predictable (fewer than ${MIN_SECRET_DISTINCT_CHARS} distinct characters) — generate one with \`openssl rand -hex 32\``;
+    }
+    if (isRepeatedPattern(value)) {
+        return 'too predictable (a short pattern repeated) — generate one with `openssl rand -hex 32`';
+    }
+    if (shannonEntropyBits(value) < MIN_SECRET_ENTROPY_BITS) {
+        return `too predictable (below ${MIN_SECRET_ENTROPY_BITS} bits of entropy) — generate one with \`openssl rand -hex 32\``;
+    }
+    return null;
+}
+/** A >=`min`-char secret that also has to look random (see weakSecretReason). */
+const highEntropySecret = (min) => z
+    .string()
+    .min(min)
+    .superRefine((raw, ctx) => {
+    const reason = weakSecretReason(raw);
+    if (reason)
+        ctx.addIssue({ code: 'custom', message: reason });
+});
+/**
+ * The generic keys, in the order the env reference lists them. `version` is
+ * the TOOL's own package version: the chassis never reads a package.json, so
+ * the APP_VERSION default is handed in by the tool that boots it.
+ */
+const chassisEnvShape = (version) => ({
+    /** Postgres connection string. The only required variable. */
+    DATABASE_URL: z.string().min(1, 'required — postgres://user:pass@host:5432/db'),
+    /** Port the single HTTP listener binds. */
+    PORT: numeric(z.coerce.number().int().min(1).max(65535).default(3000)),
+    /** Bind address. */
+    HOST: z.string().default('0.0.0.0'),
+    /** Public origin of this instance (scheme matters: https => Secure cookies). */
+    PUBLIC_BASE_URL: httpUrl().default('http://localhost:3000'),
+    /** Writable data directory (auto-generated secret, local file storage). */
+    DATA_DIR: z
+        .string()
+        .trim()
+        .min(1, 'must not be empty — the app needs a writable directory')
+        .default('/data'),
+    /** Apply pending migrations at boot. When false the app only checks and refuses readiness while behind. */
+    AUTO_MIGRATE: booleanish.default(true),
+    /** all = API + workers in one process; api = HTTP only; worker = jobs only. */
+    SERVICE_ROLE: z.enum(['all', 'api', 'worker']).default('all'),
+    /** Session/JWKS encryption secret. Auto-generated into DATA_DIR/secret when unset or empty. */
+    AUTH_SECRET: optionalString(highEntropySecret(32)),
+    /** Versioned API-key peppers for secret rotation: `<version>:<secret>` entries joined by `;` (e.g. `1:<historical AUTH_SECRET>;2:<new pepper>`, secrets >=32 chars). Version 1 defaults to AUTH_SECRET and, when pinned here, MUST keep the historical AUTH_SECRET-derived value or every existing key stops resolving; new keys mint under the highest version. Rotation runbook: internal/security-runbooks.md. */
+    API_KEY_PEPPERS: optionalString(z.string().superRefine((raw, ctx) => {
+        try {
+            parseApiKeyPeppers(raw);
+        }
+        catch (err) {
+            ctx.addIssue({ code: 'custom', message: err instanceof Error ? err.message : String(err) });
+        }
+    })),
+    /** The credential POST /api/v1/setup requires (constant-time compared). setup.sh generates one into .env. Unset, the server generates a token into `$DATA_DIR/setup-token` at first boot and prints it to the container log — the first-boot claim is never free (PRDCT-1347). */
+    SETUP_TOKEN: optionalString(z.string().min(8)),
+    /** Allow POST /api/v1/setup over plaintext HTTP on a non-loopback PUBLIC_BASE_URL. Default false: the wizard 403s, because the owner password and the setup token would cross the network in the clear on the one request that decides who owns the instance. Reach a TLS-less server through an SSH tunnel (`ssh -L`) instead; set this true only on a trusted private network. */
+    ALLOW_INSECURE_SETUP: booleanish.default(false),
+    /** Break-glass operator allowlist: comma-separated emails. A caller is superadmin ONLY on a SESSION whose VERIFIED email is listed here — machine credentials (API keys, OAuth tokens) never qualify, they 403 fail-closed. Unset (default) = the break-glass endpoints are dormant and 403 for everyone. Runbook: internal/security-runbooks.md. */
+    SUPERADMIN_EMAILS: optionalString(z.string().superRefine((raw, ctx) => {
+        try {
+            parseSuperadminEmails(raw);
+        }
+        catch (err) {
+            ctx.addIssue({ code: 'custom', message: err instanceof Error ? err.message : String(err) });
+        }
+    })),
+    /** Demo sign-in (self-hosted edition only): an owner can mint a demo link that signs a chosen member in without a password, for a demonstration. Default false: no demo route exists and every demo path answers like any unknown path. The boot refuses the switch unless the host of PUBLIC_BASE_URL is loopback or listed in DEMO_SIGN_IN_HOSTS. A link only ever opens an address on a domain reserved for examples and tests (example.com/.net/.org, `.test`, `.example`, `.invalid`, `.localhost`) or listed in DEMO_SIGN_IN_EMAIL_DOMAINS, never an owner but the one minting, never an account with a second factor. On EDITION=cloud it has no effect (the hub owns identity). */
+    DEMO_SIGN_IN: booleanish.default(false),
+    /** The public hosts DEMO_SIGN_IN may be on, beside loopback: comma-separated bare hostnames, matched exactly against the host of PUBLIC_BASE_URL (e.g. `demo.example.io`). An entry with a scheme, a path, a port, a space, a wildcard or an empty label refuses the boot. Unset = loopback only. */
+    DEMO_SIGN_IN_HOSTS: optionalString(z.string().superRefine((raw, ctx) => {
+        try {
+            parseDemoHosts(raw);
+        }
+        catch (err) {
+            ctx.addIssue({ code: 'custom', message: err instanceof Error ? err.message : String(err) });
+        }
+    })),
+    /** Domains a demo link may open beside the reserved example and test ones: comma-separated, each one matching itself and its subdomains (e.g. `demo.acme.io`). Name only domains whose every mailbox is a demonstration account. Same entry rules as DEMO_SIGN_IN_HOSTS. Unset = the reserved domains only. */
+    DEMO_SIGN_IN_EMAIL_DOMAINS: optionalString(z.string().superRefine((raw, ctx) => {
+        try {
+            parseDemoEmailDomains(raw);
+        }
+        catch (err) {
+            ctx.addIssue({ code: 'custom', message: err instanceof Error ? err.message : String(err) });
+        }
+    })),
+    /** Optional Google social login. */
+    GOOGLE_CLIENT_ID: optionalString(z.string().min(1)),
+    GOOGLE_CLIENT_SECRET: optionalString(z.string().min(1)),
+    /** Edition selector (internal/federation.md): `oss` (default, self-host — zero hub surface at runtime) or `cloud` (federates human login + entitlements to the Antasphere hub; requires the HUB_* block). Any other value refuses to boot — the selector decides the identity binding, so a typo must fail loudly, never silently bind `oss`. Also surfaced in discovery + usage events. */
+    EDITION: z.preprocess(blankToUndefined, z.enum(['oss', 'cloud']).default('oss')),
+    /** Hub OIDC issuer, e.g. https://account.antasphere.com — discovery, JWKS, and the authorize/token endpoints all derive from it. Required when EDITION=cloud; never read when EDITION=oss. */
+    HUB_ISSUER_URL: z.preprocess(blankToUndefined, httpUrl().optional()),
+    /** OAuth client id from this tool's entry in the hub TOOL_REGISTRY (e.g. tool-acme-cloud). Required when EDITION=cloud. */
+    HUB_CLIENT_ID: optionalString(z.string().min(4)),
+    /** OAuth client secret matching the hub registry entry (confidential client; PKCE stays on regardless). Also authenticates the per-user refresh grant — there is NO service key: every hub read between logins presents the USER's own grant (internal/federation.md). Required when EDITION=cloud. */
+    HUB_CLIENT_SECRET: optionalString(z.string().min(16)),
+    /** Name of the hub-set shared SSO hint cookie the dashboard reads client-side (internal/federation.md; NEVER a security input — it only gates whether a silent connect is attempted). Cloud-only; unset = the cross-repo default `ant_sso_hint`. Never read when EDITION=oss. */
+    HUB_HINT_COOKIE_NAME: optionalString(z.string().min(1)),
+    /** Domain the hint cookie lives on (the hub sets it, tools clear it — both sides must agree). Cloud-only; unset = the hub issuer host minus its first label (account.antasphere.com → antasphere.com). Never read when EDITION=oss. */
+    HUB_HINT_COOKIE_DOMAIN: optionalString(z.string().min(1)),
+    /** The restricted bit on the tool itself (PRDCT-2947): `true` on the cloud edition makes this instance refuse to create an organization (`POST /workspaces` answers 403 `restricted_tool`, `/me.canCreateWorkspace` is false) and advertise `restricted: true` in discovery, so a tool that Antasphere opens to organizations one by one does not rest on the hub registry's flag alone. No effect on the self-hosted edition, where workspaces are local. */
+    TOOL_RESTRICTED: booleanish.default(false),
+    /** R7 escape hatch (internal/federation.md): acknowledge an EDITION change on an already-set-up instance. Without it, boot refuses an EDITION that differs from the one stamped at setup — flipping editions under existing users/workspaces changes identity semantics and must be a conscious operator act. */
+    EDITION_CHANGE_ALLOWED: booleanish.default(false),
+    /** Reported version. Defaults to the code's own baked-in package version (PRDCT-1844) — the image knows its version intrinsically, CI injects nothing. The env var remains as a deliberate operator override only. */
+    APP_VERSION: z.string().default(version),
+    /** RFC 7591 dynamic client registration on the built-in authorization server: unauthenticated `POST /api/v1/auth/oauth2/register`, which is how MCP clients self-register. Default true (the connector-friendly posture, rate-limited in api/index.ts). Set false on an instance whose OAuth clients are provisioned by hand — the endpoint then refuses every caller instead of minting client records for anyone who asks. */
+    OAUTH_DYNAMIC_CLIENT_REGISTRATION: booleanish.default(true),
+    /** `Strict-Transport-Security` max-age in seconds, sent on every response when PUBLIC_BASE_URL is https (browsers ignore HSTS over plain http per RFC 6797 §7.2, so an http instance is unaffected). Default 180 days; 0 disables the header — the escape hatch for an operator who is not yet certain every subdomain can serve TLS. */
+    HSTS_MAX_AGE: numeric(z.coerce.number().int().min(0).default(15552000)),
+    /** Instance-level cap read by the default AllowAllEntitlements. */
+    MAX_FILE_SIZE_MB: numeric(z.coerce.number().int().min(1).default(100)),
+    /** How many workspaces ONE person may own on this instance — the cap on creating another workspace from the dashboard (the first one comes from setup). Any signed-in member who is not a guest may create one until they own this many. 0 closes workspace creation for everyone. On the cloud edition the count is Antasphere's own organization limit; only the 0 switch applies here. */
+    MAX_WORKSPACES_PER_USER: numeric(z.coerce.number().int().min(0).max(1000).default(10)),
+    /** General per-principal API quota: sustained requests/minute allowed to every authenticated /api/v1 principal (API key, OAuth token, session). 0 disables the general limiter. */
+    API_RATE_LIMIT_PER_MINUTE: numeric(z.coerce.number().int().min(0).default(600)),
+    /** Spike cap for the general API quota: max requests per principal in any 1-second burst. 0 disables burst smoothing (the per-minute window still applies). */
+    API_RATE_LIMIT_BURST: numeric(z.coerce.number().int().min(0).default(100)),
+    /** Cloud: CLI connects (`POST /sso/cli-connect`, what `<tool> login` and every first command after `antasphere login` call) one client address may make per 15 minutes. A venue's Wi-Fi is one address behind the proxy (TRUST_PROXY), so the default is sized for a room; each connect presents a one-time exchange token the hub minted for one person, which is what bounds a single account. Never disabled (minimum 1). */
+    CLI_CONNECT_IP_LIMIT_PER_15_MIN: numeric(z.coerce.number().int().min(1).default(300)),
+    /** Email delivery. `none` (default) never blocks a flow: links stay copyable. */
+    EMAIL_DRIVER: z.preprocess(blankToUndefined, z.enum(['none', 'smtp', 'resend', 'brevo']).default('none')),
+    /** smtp(s)://user:pass@host:port — required when EMAIL_DRIVER=smtp. */
+    SMTP_URL: optionalString(z.string().min(1)),
+    /** Required when EMAIL_DRIVER=resend. */
+    RESEND_API_KEY: optionalString(z.string().min(1)),
+    /** Required when EMAIL_DRIVER=brevo. */
+    BREVO_API_KEY: optionalString(z.string().min(1)),
+    /** Sender, e.g. `Acme <noreply@acme.example>`. Required when a driver delivers. */
+    EMAIL_FROM: optionalString(z.string().min(3)),
+    /** When set, rate limits (and later caches) are shared across replicas. */
+    REDIS_URL: optionalString(z.string().min(1)),
+    /** File storage: local (default; DATA_DIR volume, single replica) or s3 (MinIO/AWS/R2). */
+    STORAGE_DRIVER: z.preprocess(blankToUndefined, z.enum(['local', 's3']).default('local')),
+    S3_BUCKET: optionalString(z.string().min(1)),
+    S3_REGION: optionalString(z.string().min(1)),
+    /** Endpoint override for MinIO/R2; leave unset for AWS. */
+    S3_ENDPOINT: z.preprocess(blankToUndefined, httpUrl().optional()),
+    S3_ACCESS_KEY_ID: optionalString(z.string().min(1)),
+    S3_SECRET_ACCESS_KEY: optionalString(z.string().min(1)),
+    /** Path-style addressing — required by MinIO and most S3-compatibles. */
+    S3_FORCE_PATH_STYLE: booleanish.default(true),
+    /**
+     * Trust x-forwarded-for for client IPs (rate limits, audit). The app reads
+     * the RIGHTMOST hop — the one your proxy appended or set (Caddy ≥2.5
+     * discards client-supplied X-Forwarded-* by default). Enable ONLY behind a
+     * reverse proxy you control; when false the socket address is used and
+     * spoofed headers are ignored.
+     */
+    TRUST_PROXY: booleanish.default(false),
+    /** OTLP/HTTP endpoint for trace export. Unset (default) = no export, zero phone-home. */
+    OTEL_EXPORTER_OTLP_ENDPOINT: z.preprocess(blankToUndefined, httpUrl().optional()),
+    /** GET /metrics requires `Authorization: Bearer <token>`; unset = /metrics disabled (401). */
+    METRICS_TOKEN: optionalString(z.string().min(8)),
+    /** Days of audit_log to keep (nightly purge at 03:00). 0 = keep forever. */
+    AUDIT_RETENTION_DAYS: numeric(z.coerce.number().int().min(0).default(365)),
+    /** Grace period for orphaned users (accounts with ZERO workspace memberships, e.g. setup-race losers): the nightly 03:00 sweep deletes them once older than this many hours. A user with ANY membership row — even deactivated — is never touched. 0 = sweep disabled. */
+    ORPHAN_USER_RETENTION_HOURS: numeric(z.coerce.number().int().min(0).default(72)),
+    /** pino level. */
+    LOG_LEVEL: z.enum(['fatal', 'error', 'warn', 'info', 'debug', 'trace']).default('info'),
+    NODE_ENV: z.enum(['development', 'test', 'production']).default('production')
+});
+/**
+ * Vars the cloud edition cannot boot without. Enforced as a schema check so
+ * a cloud instance missing ANY of them fails env parsing with one readable
+ * table listing every gap — never a partial boot that dies later at the
+ * first hub call. On EDITION=oss these stay plain optional strings: unset
+ * is fine and nothing reads them.
+ */
+const HUB_REQUIRED_VARS = ['HUB_ISSUER_URL', 'HUB_CLIENT_ID', 'HUB_CLIENT_SECRET'];
+/**
+ * The demo sign-in's boot refusal (the demo pass spec, section 1): a switch
+ * that signs people in without a password is refused on a public host
+ * nobody named. Loopback is always fine; any other host of PUBLIC_BASE_URL
+ * must be listed in DEMO_SIGN_IN_HOSTS. Judged on both editions: the rule is
+ * about where the instance answers, and a cloud boot that ignores the switch
+ * today still names no host it was not meant for. A malformed list already
+ * failed its own key; nothing more is said here then.
+ */
+function demoSignInRefusal(env, ctx) {
+    if (!env.DEMO_SIGN_IN)
+        return;
+    let hosts;
+    try {
+        hosts = parseDemoHosts(env.DEMO_SIGN_IN_HOSTS);
+    }
+    catch {
+        return;
+    }
+    if (isDemoSignInHost(env.PUBLIC_BASE_URL, hosts))
+        return;
+    let host = env.PUBLIC_BASE_URL;
+    try {
+        host = new URL(env.PUBLIC_BASE_URL).hostname;
+    }
+    catch {
+        // unparseable never reaches here (httpUrl validated it); the raw value names it
+    }
+    ctx.addIssue({
+        code: 'custom',
+        path: ['DEMO_SIGN_IN'],
+        message: `DEMO_SIGN_IN is refused on ${host}: the host of PUBLIC_BASE_URL is not loopback and not listed in DEMO_SIGN_IN_HOSTS`
+    });
+}
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type
+export function buildEnvSchema(options) {
+    const chassis = chassisEnvShape(options.version);
+    const extension = options.extension;
+    const extra = extension?.shape ?? {};
+    const after = extension?.after ?? {};
+    const extraKeys = Object.keys(extra);
+    for (const key of extraKeys) {
+        if (key in chassis)
+            throw new Error(`env extension re-declares the chassis key ${key}`);
+        const anchor = after[key];
+        if (anchor !== undefined && !(anchor in chassis)) {
+            throw new Error(`env extension places ${key} after ${anchor}, which is not a chassis key`);
+        }
+    }
+    // Ordered splice: object key order IS the order of the generated reference.
+    const merged = {};
+    for (const [key, schema] of Object.entries(chassis)) {
+        merged[key] = schema;
+        for (const extraKey of extraKeys) {
+            if (after[extraKey] === key)
+                merged[extraKey] = extra[extraKey];
+        }
+    }
+    for (const extraKey of extraKeys) {
+        if (after[extraKey] === undefined)
+            merged[extraKey] = extra[extraKey];
+    }
+    return z.object(merged).superRefine((value, ctx) => {
+        const env = value;
+        extension?.refine?.(env, ctx);
+        demoSignInRefusal(env, ctx);
+        if (env.EDITION !== 'cloud')
+            return;
+        for (const key of HUB_REQUIRED_VARS) {
+            if (env[key] === undefined) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: [key],
+                    message: 'required when EDITION=cloud — see internal/federation.md'
+                });
+            }
+        }
+    });
+}
+/**
+ * Default hint-cookie domain: the hub issuer host minus its first label —
+ * account.antasphere.com → antasphere.com, the shared parent domain both
+ * the hub and every tool live under. When stripping a label leaves nothing
+ * (a single-label host like `localhost`), the host itself is the honest
+ * fallback; operators on unusual topologies override via
+ * HUB_HINT_COOKIE_DOMAIN.
+ */
+function defaultHintCookieDomain(issuerUrl) {
+    const host = new URL(issuerUrl).hostname;
+    const parent = host.split('.').slice(1).join('.');
+    return parent || host;
+}
+export function hubConfig(env) {
+    if (env.EDITION !== 'cloud')
+        return null;
+    // parseEnv already refused a cloud env missing any of these.
+    return {
+        issuerUrl: env.HUB_ISSUER_URL,
+        clientId: env.HUB_CLIENT_ID,
+        clientSecret: env.HUB_CLIENT_SECRET,
+        hintCookieName: env.HUB_HINT_COOKIE_NAME ?? 'ant_sso_hint',
+        hintCookieDomain: env.HUB_HINT_COOKIE_DOMAIN ?? defaultHintCookieDomain(env.HUB_ISSUER_URL)
+    };
+}
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type
+export function parseEnv(source, options) {
+    const result = buildEnvSchema(options).safeParse(source);
+    if (result.success)
+        return result.data;
+    const rows = [];
+    for (const issue of result.error.issues) {
+        const key = issue.path.join('.') || '(root)';
+        rows.push([key, issue.message]);
+    }
+    const width = Math.max(...rows.map(([k]) => k.length), 'VARIABLE'.length);
+    const lines = [
+        '',
+        'Invalid environment configuration:',
+        '',
+        `  ${'VARIABLE'.padEnd(width)}  PROBLEM`,
+        `  ${'-'.repeat(width)}  ${'-'.repeat(40)}`,
+        ...rows.map(([k, msg]) => `  ${k.padEnd(width)}  ${msg}`),
+        '',
+        'See docs/reference/env-reference.md (or .env.example) for every variable.',
+        ''
+    ];
+    console.error(lines.join('\n'));
+    process.exit(1);
+}
+//# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAExG;;;;;GAKG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3G,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CACpC,gBAAgB,EAChB,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC,CAChF,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;AAEvG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAsB,KAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;AAEhG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;AAChC,CAAC;AAED,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,KAAa;IACtC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;QAC7D,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,yBAAyB,EAAE,CAAC;QACpD,OAAO,+BAA+B,yBAAyB,oEAAoE,CAAC;IACtI,CAAC;IACD,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,uFAAuF,CAAC;IACjG,CAAC;IACD,IAAI,kBAAkB,CAAC,KAAK,CAAC,GAAG,uBAAuB,EAAE,CAAC;QACxD,OAAO,0BAA0B,uBAAuB,gEAAgE,CAAC;IAC3H,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAE,EAAE,CACxC,CAAC;KACE,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,MAAM;QAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEP;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC;IAC5C,8DAA8D;IAC9D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,8CAA8C,CAAC;IAC/E,2CAA2C;IAC3C,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,oBAAoB;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACnC,gFAAgF;IAChF,eAAe,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAC3D,2EAA2E;IAC3E,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,EAAE,wDAAwD,CAAC;SAChE,OAAO,CAAC,OAAO,CAAC;IACnB,2GAA2G;IAC3G,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,+EAA+E;IAC/E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7D,+FAA+F;IAC/F,WAAW,EAAE,cAAc,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAClD,qZAAqZ;IACrZ,eAAe,EAAE,cAAc,CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC,CAAC,CACH;IACD,kRAAkR;IAClR,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9C,oXAAoX;IACpX,oBAAoB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,qVAAqV;IACrV,iBAAiB,EAAE,cAAc,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC,CAAC,CACH;IACD,2pBAA2pB;IAC3pB,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,qSAAqS;IACrS,kBAAkB,EAAE,cAAc,CAChC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,cAAc,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC,CAAC,CACH;IACD,+SAA+S;IAC/S,0BAA0B,EAAE,cAAc,CACxC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC,CAAC,CACH;IACD,oCAAoC;IACpC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,oBAAoB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,4XAA4X;IAC5X,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChF,8LAA8L;IAC9L,cAAc,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IACpE,2HAA2H;IAC3H,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,uSAAuS;IACvS,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrD,iRAAiR;IACjR,oBAAoB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,uOAAuO;IACvO,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzD,8bAA8b;IAC9b,eAAe,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,iTAAiT;IACjT,sBAAsB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,sNAAsN;IACtN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IACxC,gaAAga;IACha,iCAAiC,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3D,yUAAyU;IACzU,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,mEAAmE;IACnE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtE,6XAA6X;IAC7X,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtF,mLAAmL;IACnL,yBAAyB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/E,+JAA+J;IAC/J,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1E,gaAAga;IACha,+BAA+B,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrF,iFAAiF;IACjF,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,uEAAuE;IACvE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3C,yCAAyC;IACzC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjD,wCAAwC;IACxC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,mFAAmF;IACnF,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7C,2EAA2E;IAC3E,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,2FAA2F;IAC3F,cAAc,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxF,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,2DAA2D;IAC3D,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IACjE,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,oBAAoB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,yEAAyE;IACzE,mBAAmB,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C;;;;;;OAMG;IACH,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,yFAAyF;IACzF,2BAA2B,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IACjF,8FAA8F;IAC9F,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,4EAA4E;IAC5E,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1E,0QAA0Q;IAC1Q,2BAA2B,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChF,kBAAkB;IAClB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvF,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;CAC9E,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,CAAU,CAAC;AAE5F;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,GAAe,EAAE,GAAoB;IAC9D,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO;IAC9B,IAAI,KAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC;QAAE,OAAO;IACzD,IAAI,IAAI,GAAG,GAAG,CAAC,eAAe,CAAC;IAC/B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC;QACX,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,cAAc,CAAC;QACtB,OAAO,EAAE,8BAA8B,IAAI,oFAAoF;KAChI,CAAC,CAAC;AACL,CAAC;AAyBD,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAC5B,OAA2B;IAE3B,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,IAAK,EAAa,CAAC;IACjD,MAAM,KAAK,GAA2C,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,IAAI,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,EAAE,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,UAAU,MAAM,8BAA8B,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,4EAA4E;IAC5E,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACrB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG;gBAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAc,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAc,CAAC;IACrF,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,MAA6C,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACxF,MAAM,GAAG,GAAG,KAAmC,CAAC;QAChD,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5B,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO;QACpC,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACpC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,OAAO,EAAE,0DAA0D;iBACpE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAgCD;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,SAAiB;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAQ;IAChC,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACzC,6DAA6D;IAC7D,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,cAAe;QAC9B,QAAQ,EAAE,GAAG,CAAC,aAAc;QAC5B,YAAY,EAAE,GAAG,CAAC,iBAAkB;QACpC,cAAc,EAAE,GAAG,CAAC,oBAAoB,IAAI,cAAc;QAC1D,gBAAgB,EAAE,GAAG,CAAC,sBAAsB,IAAI,uBAAuB,CAAC,GAAG,CAAC,cAAe,CAAC;KAC7F,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,QAAQ,CACtB,MAAyB,EACzB,OAA2B;IAE3B,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAkC,CAAC;IAErE,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG;QACZ,EAAE;QACF,oCAAoC;QACpC,EAAE;QACF,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW;QACxC,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAC3C,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;QACzD,EAAE;QACF,2EAA2E;QAC3E,EAAE;KACH,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/files/http.d.ts

@@ -0,0 +1,23 @@
+import type { ByteRange } from '../storage/driver.js';
+/**
+ * HTTP Range parsing for the files module. Single range only — multi-range
+ * responses require multipart bodies nobody needs and open a DoS vector
+ * (many tiny ranges of a huge blob), so `a-b,c-d` is rejected outright.
+ */
+export type RangeParse = {
+    kind: 'none';
+} | {
+    kind: 'range';
+    range: ByteRange;
+} | {
+    kind: 'unsatisfiable';
+};
+export declare function parseRangeHeader(header: string | undefined, size: number): RangeParse;
+export declare function contentDispositionFor(contentType: string, filename: string): string;
+/**
+ * Encode a Content-Disposition with an explicit mode. `inline` for an ACTIVE
+ * type is legitimate ONLY on the sandboxed viewer surface (ADR 012) — the
+ * app-origin routes must keep deriving the mode via `contentDispositionFor`.
+ */
+export declare function encodeContentDisposition(mode: 'inline' | 'attachment', filename: string): string;
+//# sourceMappingURL=http.d.ts.map

package/dist/files/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/files/http.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,SAAS,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAE9B,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,CAyBrF;AAuBD,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAInF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,QAAQ,GAAG,YAAY,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKhG"}

package/dist/files/http.js

@@ -0,0 +1,66 @@
+export function parseRangeHeader(header, size) {
+    if (!header)
+        return { kind: 'none' };
+    const match = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+    if (!match) {
+        // Multi-range or malformed: RFC allows ignoring, but for the seekable
+        // media target we answer 416 on anything bytes-shaped we cannot honor,
+        // and ignore non-bytes units.
+        return header.trim().startsWith('bytes=') ? { kind: 'unsatisfiable' } : { kind: 'none' };
+    }
+    const [, startStr, endStr] = match;
+    if (startStr === '' && endStr === '')
+        return { kind: 'unsatisfiable' };
+    if (startStr === '') {
+        // suffix form: last N bytes
+        const suffix = Number(endStr);
+        if (suffix === 0)
+            return { kind: 'unsatisfiable' };
+        const start = Math.max(0, size - suffix);
+        return size === 0 ? { kind: 'unsatisfiable' } : { kind: 'range', range: { start, end: size - 1 } };
+    }
+    const start = Number(startStr);
+    if (start >= size)
+        return { kind: 'unsatisfiable' };
+    const end = endStr === '' ? size - 1 : Math.min(Number(endStr), size - 1);
+    if (end < start)
+        return { kind: 'unsatisfiable' };
+    return { kind: 'range', range: { start, end } };
+}
+/**
+ * Safe-serving policy (§2.6): browser-renderable ACTIVE content (HTML, SVG,
+ * XML — anything that can execute script on the app origin) is never served
+ * inline. Passive media may render inline; everything unknown downloads.
+ * Always paired with X-Content-Type-Options: nosniff.
+ */
+const INLINE_SAFE = new Set([
+    'image/png',
+    'image/jpeg',
+    'image/gif',
+    'image/webp',
+    'image/avif',
+    'video/mp4',
+    'video/webm',
+    'audio/mpeg',
+    'audio/ogg',
+    'audio/wav',
+    'application/pdf',
+    'text/plain'
+]);
+export function contentDispositionFor(contentType, filename) {
+    const base = contentType.split(';')[0]?.trim().toLowerCase() ?? '';
+    const mode = INLINE_SAFE.has(base) ? 'inline' : 'attachment';
+    return encodeContentDisposition(mode, filename);
+}
+/**
+ * Encode a Content-Disposition with an explicit mode. `inline` for an ACTIVE
+ * type is legitimate ONLY on the sandboxed viewer surface (ADR 012) — the
+ * app-origin routes must keep deriving the mode via `contentDispositionFor`.
+ */
+export function encodeContentDisposition(mode, filename) {
+    // RFC 5987 encoding for non-ASCII names; strip quotes/control chars.
+    const ascii = filename.replace(/[^\x20-\x7e]/g, '_').replace(/["\\]/g, '_');
+    const encoded = encodeURIComponent(filename);
+    return `${mode}; filename="${ascii}"; filename*=UTF-8''${encoded}`;
+}
+//# sourceMappingURL=http.js.map

package/dist/files/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/files/http.ts"],"names":[],"mappings":"AAYA,MAAM,UAAU,gBAAgB,CAAC,MAA0B,EAAE,IAAY;IACvE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,sEAAsE;QACtE,uEAAuE;QACvE,8BAA8B;QAC9B,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IACnC,IAAI,QAAQ,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAEvE,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QACpB,4BAA4B;QAC5B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC;QACzC,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;IACrG,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACpD,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,GAAG,GAAG,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IAClD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,WAAW;IACX,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,WAAW;IACX,iBAAiB;IACjB,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CAAC,WAAmB,EAAE,QAAgB;IACzE,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACnE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7D,OAAO,wBAAwB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA6B,EAAE,QAAgB;IACtF,qEAAqE;IACrE,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,GAAG,IAAI,eAAe,KAAK,uBAAuB,OAAO,EAAE,CAAC;AACrE,CAAC"}

package/dist/files/index.d.ts

@@ -0,0 +1,5 @@
+export { contentDispositionFor, encodeContentDisposition, parseRangeHeader } from './http.js';
+export { FileService } from './service.js';
+export { FileTooLargeError, spoolUpload } from './spool.js';
+export { serveBlob } from './serve.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/files/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/files/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}

package/dist/files/index.js

@@ -0,0 +1,5 @@
+export { contentDispositionFor, encodeContentDisposition, parseRangeHeader } from './http.js';
+export { FileService } from './service.js';
+export { FileTooLargeError, spoolUpload } from './spool.js';
+export { serveBlob } from './serve.js';
+//# sourceMappingURL=index.js.map

package/dist/files/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/files/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}

package/dist/files/serve.d.ts

@@ -0,0 +1,43 @@
+import type { Context } from 'hono';
+import { type StorageDriver } from '../storage/driver.js';
+import type { Logger } from '../logger.js';
+export interface ServeBlobOptions {
+    storage: StorageDriver;
+    logger: Logger;
+    workspaceId: string;
+    sha256: string;
+    /**
+     * The blob's storage key when it is NOT a content-addressed workspace
+     * file (a form upload lives under its own key, forms/uploads.ts). Unset =
+     * `blobKey(workspaceId, sha256)`. The ETag stays the sha either way.
+     */
+    storageKey?: string;
+    sizeBytes: number;
+    contentType: string;
+    filename: string;
+    headOnly: boolean;
+    /**
+     * Full Content-Disposition override. Default (unset) = the safe-serving
+     * policy (`contentDispositionFor`: active types attachment). ONLY the
+     * public viewer (ADR 012) passes `inline; …` — legitimate solely because
+     * every viewer response is locked under `CSP: sandbox` (opaque origin);
+     * never override this on an app-origin surface without that regime.
+     */
+    contentDisposition?: string;
+    /**
+     * Headers merged over the defaults (viewer: the ADR 012 sandbox CSP,
+     * `Referrer-Policy: no-referrer`, and a revalidating Cache-Control — the
+     * viewer URL is not content-addressed, so `immutable` would be wrong
+     * there). Applied to every status this helper emits, 304 included.
+     */
+    extraHeaders?: Record<string, string>;
+}
+/**
+ * Stream one content-addressed blob: immutable ETag (= the sha), 304, single
+ * Range (206/416), safe-serving disposition + nosniff (docs/security/security.md —
+ * user content never renders on the app origin). Shared by the files content
+ * route and the tool's asset download; both resolve METADATA first and
+ * only then hand the bytes question here.
+ */
+export declare function serveBlob(c: Context, opts: ServeBlobOptions): Promise<Response>;
+//# sourceMappingURL=serve.d.ts.map

package/dist/files/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/files/serve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,EAAW,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,aAAa,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoErF"}