@antasphere/chassis-server 1.0.2 → 1.1.0

package/dist/env.js

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import { parseApiKeyPeppers } from './apikeys/peppers.js';
 import { parseSuperadminEmails } from './accounts/superadmin.js';
 import { isDemoSignInHost, parseDemoEmailDomains, parseDemoHosts } from './identity/demo-pass-rules.js';
+import { loadCliPackage } from './cli-package/index.js';
 /**
  * The single entry point for configuration. Every env var the app reads is
  * declared here; the docs env reference is generated from this schema.
@@ -183,6 +184,18 @@ const chassisEnvShape = (version) => ({
     HUB_HINT_COOKIE_DOMAIN: optionalString(z.string().min(1)),
     /** The restricted bit on the tool itself (PRDCT-2947): `true` on the cloud edition makes this instance refuse to create an organization (`POST /workspaces` answers 403 `restricted_tool`, `/me.canCreateWorkspace` is false) and advertise `restricted: true` in discovery, so a tool that Antasphere opens to organizations one by one does not rest on the hub registry's flag alone. No effect on the self-hosted edition, where workspaces are local. */
     TOOL_RESTRICTED: booleanish.default(false),
+    /** The tool's own CLI package as the release packed it (PRDCT-3312): a folder holding `package.tgz` (the output of `pnpm pack` of `packages/cli`) beside a copy of that package's `package.json`. The image sets it. Cloud edition: the instance serves the tarball on `POST /cli/package` to a member the hub lets into the tool, and discovery carries `cli { name, version }` so the `team` command knows what it installs and whether to update. Unset = the instance serves no CLI: discovery carries no `cli` and the route answers 404 `cli_not_packaged`. A set value whose folder does not hold both files, or whose `package.json` has no string `name` and `version`, refuses the boot with the path and what is missing: a misconfiguration is proven at the image, never discovered by a person's install. */
+    CLI_PACKAGE_DIR: optionalString(z
+        .string()
+        .min(1)
+        .superRefine((dir, ctx) => {
+        try {
+            loadCliPackage(dir);
+        }
+        catch (err) {
+            ctx.addIssue({ code: 'custom', message: err instanceof Error ? err.message : String(err) });
+        }
+    })),
     /** R7 escape hatch (internal/federation.md): acknowledge an EDITION change on an already-set-up instance. Without it, boot refuses an EDITION that differs from the one stamped at setup — flipping editions under existing users/workspaces changes identity semantics and must be a conscious operator act. */
     EDITION_CHANGE_ALLOWED: booleanish.default(false),
     /** Reported version. Defaults to the code's own baked-in package version (PRDCT-1844) — the image knows its version intrinsically, CI injects nothing. The env var remains as a deliberate operator override only. */

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAExG;;;;;GAKG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3G,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CACpC,gBAAgB,EAChB,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC,CAChF,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;AAEvG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAsB,KAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;AAEhG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;AAChC,CAAC;AAED,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,KAAa;IACtC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;QAC7D,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,yBAAyB,EAAE,CAAC;QACpD,OAAO,+BAA+B,yBAAyB,oEAAoE,CAAC;IACtI,CAAC;IACD,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,uFAAuF,CAAC;IACjG,CAAC;IACD,IAAI,kBAAkB,CAAC,KAAK,CAAC,GAAG,uBAAuB,EAAE,CAAC;QACxD,OAAO,0BAA0B,uBAAuB,gEAAgE,CAAC;IAC3H,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAE,EAAE,CACxC,CAAC;KACE,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,MAAM;QAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEP;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC;IAC5C,8DAA8D;IAC9D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,8CAA8C,CAAC;IAC/E,2CAA2C;IAC3C,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,oBAAoB;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACnC,gFAAgF;IAChF,eAAe,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAC3D,2EAA2E;IAC3E,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,EAAE,wDAAwD,CAAC;SAChE,OAAO,CAAC,OAAO,CAAC;IACnB,2GAA2G;IAC3G,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,+EAA+E;IAC/E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7D,+FAA+F;IAC/F,WAAW,EAAE,cAAc,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAClD,qZAAqZ;IACrZ,eAAe,EAAE,cAAc,CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC,CAAC,CACH;IACD,kRAAkR;IAClR,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9C,oXAAoX;IACpX,oBAAoB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,qVAAqV;IACrV,iBAAiB,EAAE,cAAc,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC,CAAC,CACH;IACD,2pBAA2pB;IAC3pB,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,qSAAqS;IACrS,kBAAkB,EAAE,cAAc,CAChC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,cAAc,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC,CAAC,CACH;IACD,+SAA+S;IAC/S,0BAA0B,EAAE,cAAc,CACxC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC,CAAC,CACH;IACD,oCAAoC;IACpC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,oBAAoB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,4XAA4X;IAC5X,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChF,8LAA8L;IAC9L,cAAc,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IACpE,2HAA2H;IAC3H,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,uSAAuS;IACvS,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrD,iRAAiR;IACjR,oBAAoB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,uOAAuO;IACvO,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzD,8bAA8b;IAC9b,eAAe,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,iTAAiT;IACjT,sBAAsB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,sNAAsN;IACtN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IACxC,gaAAga;IACha,iCAAiC,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3D,yUAAyU;IACzU,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,mEAAmE;IACnE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtE,6XAA6X;IAC7X,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtF,mLAAmL;IACnL,yBAAyB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/E,+JAA+J;IAC/J,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1E,gaAAga;IACha,+BAA+B,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrF,iFAAiF;IACjF,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,uEAAuE;IACvE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3C,yCAAyC;IACzC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjD,wCAAwC;IACxC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,mFAAmF;IACnF,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7C,2EAA2E;IAC3E,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,2FAA2F;IAC3F,cAAc,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxF,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,2DAA2D;IAC3D,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IACjE,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,oBAAoB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,yEAAyE;IACzE,mBAAmB,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C;;;;;;OAMG;IACH,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,yFAAyF;IACzF,2BAA2B,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IACjF,8FAA8F;IAC9F,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,4EAA4E;IAC5E,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1E,0QAA0Q;IAC1Q,2BAA2B,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChF,kBAAkB;IAClB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvF,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;CAC9E,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,CAAU,CAAC;AAE5F;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,GAAe,EAAE,GAAoB;IAC9D,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO;IAC9B,IAAI,KAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC;QAAE,OAAO;IACzD,IAAI,IAAI,GAAG,GAAG,CAAC,eAAe,CAAC;IAC/B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC;QACX,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,cAAc,CAAC;QACtB,OAAO,EAAE,8BAA8B,IAAI,oFAAoF;KAChI,CAAC,CAAC;AACL,CAAC;AAyBD,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAC5B,OAA2B;IAE3B,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,IAAK,EAAa,CAAC;IACjD,MAAM,KAAK,GAA2C,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,IAAI,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,EAAE,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,UAAU,MAAM,8BAA8B,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,4EAA4E;IAC5E,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACrB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG;gBAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAc,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAc,CAAC;IACrF,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,MAA6C,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACxF,MAAM,GAAG,GAAG,KAAmC,CAAC;QAChD,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5B,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO;QACpC,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACpC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,OAAO,EAAE,0DAA0D;iBACpE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAgCD;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,SAAiB;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAQ;IAChC,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACzC,6DAA6D;IAC7D,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,cAAe;QAC9B,QAAQ,EAAE,GAAG,CAAC,aAAc;QAC5B,YAAY,EAAE,GAAG,CAAC,iBAAkB;QACpC,cAAc,EAAE,GAAG,CAAC,oBAAoB,IAAI,cAAc;QAC1D,gBAAgB,EAAE,GAAG,CAAC,sBAAsB,IAAI,uBAAuB,CAAC,GAAG,CAAC,cAAe,CAAC;KAC7F,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,QAAQ,CACtB,MAAyB,EACzB,OAA2B;IAE3B,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAkC,CAAC;IAErE,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG;QACZ,EAAE;QACF,oCAAoC;QACpC,EAAE;QACF,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW;QACxC,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAC3C,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;QACzD,EAAE;QACF,2EAA2E;QAC3E,EAAE;KACH,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACxG,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD;;;;;GAKG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3G,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,UAAU,CACpC,gBAAgB,EAChB,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,CAAC,CAChF,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;AAEvG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAsB,KAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;AAEhG;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;AAE7D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,KAAK;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,OAAO,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;AAChC,CAAC;AAED,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,KAAa;IACtC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;QAC7D,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,yBAAyB,EAAE,CAAC;QACpD,OAAO,+BAA+B,yBAAyB,oEAAoE,CAAC;IACtI,CAAC;IACD,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,uFAAuF,CAAC;IACjG,CAAC;IACD,IAAI,kBAAkB,CAAC,KAAK,CAAC,GAAG,uBAAuB,EAAE,CAAC;QACxD,OAAO,0BAA0B,uBAAuB,gEAAgE,CAAC;IAC3H,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAE,EAAE,CACxC,CAAC;KACE,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACxB,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,MAAM;QAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AAEP;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC;IAC5C,8DAA8D;IAC9D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,8CAA8C,CAAC;IAC/E,2CAA2C;IAC3C,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,oBAAoB;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACnC,gFAAgF;IAChF,eAAe,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAC3D,2EAA2E;IAC3E,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,IAAI,EAAE;SACN,GAAG,CAAC,CAAC,EAAE,wDAAwD,CAAC;SAChE,OAAO,CAAC,OAAO,CAAC;IACnB,2GAA2G;IAC3G,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;IACtC,+EAA+E;IAC/E,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAC7D,+FAA+F;IAC/F,WAAW,EAAE,cAAc,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAClD,qZAAqZ;IACrZ,eAAe,EAAE,cAAc,CAC7B,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC,CAAC,CACH;IACD,kRAAkR;IAClR,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9C,oXAAoX;IACpX,oBAAoB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IAC/C,qVAAqV;IACrV,iBAAiB,EAAE,cAAc,CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC,CAAC,CACH;IACD,2pBAA2pB;IAC3pB,YAAY,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IACvC,qSAAqS;IACrS,kBAAkB,EAAE,cAAc,CAChC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,cAAc,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC,CAAC,CACH;IACD,+SAA+S;IAC/S,0BAA0B,EAAE,cAAc,CACxC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,CAAC;YACH,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC,CAAC,CACH;IACD,oCAAoC;IACpC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,oBAAoB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,4XAA4X;IAC5X,OAAO,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChF,8LAA8L;IAC9L,cAAc,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IACpE,2HAA2H;IAC3H,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,uSAAuS;IACvS,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrD,iRAAiR;IACjR,oBAAoB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,uOAAuO;IACvO,sBAAsB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzD,8bAA8b;IAC9b,eAAe,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IAC1C,2xBAA2xB;IAC3xB,eAAe,EAAE,cAAc,CAC7B,CAAC;SACE,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,cAAc,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC,CAAC,CACL;IACD,iTAAiT;IACjT,sBAAsB,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IACjD,sNAAsN;IACtN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;IACxC,gaAAga;IACha,iCAAiC,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3D,yUAAyU;IACzU,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,mEAAmE;IACnE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtE,6XAA6X;IAC7X,uBAAuB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACtF,mLAAmL;IACnL,yBAAyB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/E,+JAA+J;IAC/J,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1E,gaAAga;IACha,+BAA+B,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrF,iFAAiF;IACjF,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzG,uEAAuE;IACvE,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3C,yCAAyC;IACzC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjD,wCAAwC;IACxC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,mFAAmF;IACnF,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7C,2EAA2E;IAC3E,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,2FAA2F;IAC3F,cAAc,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxF,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,2DAA2D;IAC3D,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IACjE,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnD,oBAAoB,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,yEAAyE;IACzE,mBAAmB,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C;;;;;;OAMG;IACH,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;IACtC,yFAAyF;IACzF,2BAA2B,EAAE,CAAC,CAAC,UAAU,CAAC,gBAAgB,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;IACjF,8FAA8F;IAC9F,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChD,4EAA4E;IAC5E,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1E,0QAA0Q;IAC1Q,2BAA2B,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChF,kBAAkB;IAClB,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvF,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;CAC9E,CAAC,CAAC;AAKH;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,CAAU,CAAC;AAE5F;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CAAC,GAAe,EAAE,GAAoB;IAC9D,IAAI,CAAC,GAAG,CAAC,YAAY;QAAE,OAAO;IAC9B,IAAI,KAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC;QAAE,OAAO;IACzD,IAAI,IAAI,GAAG,GAAG,CAAC,eAAe,CAAC;IAC/B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;IACD,GAAG,CAAC,QAAQ,CAAC;QACX,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,CAAC,cAAc,CAAC;QACtB,OAAO,EAAE,8BAA8B,IAAI,oFAAoF;KAChI,CAAC,CAAC;AACL,CAAC;AAyBD,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAC5B,OAA2B;IAE3B,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,IAAK,EAAa,CAAC;IACjD,MAAM,KAAK,GAA2C,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC;IAC7E,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,IAAI,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,GAAG,EAAE,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,UAAU,MAAM,8BAA8B,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IACD,4EAA4E;IAC5E,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACrB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG;gBAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAc,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAc,CAAC;IACrF,CAAC;IAED,OAAO,CAAC,CAAC,MAAM,CAAC,MAA6C,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACxF,MAAM,GAAG,GAAG,KAAmC,CAAC;QAChD,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9B,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5B,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO;YAAE,OAAO;QACpC,KAAK,MAAM,GAAG,IAAI,iBAAiB,EAAE,CAAC;YACpC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,OAAO,EAAE,0DAA0D;iBACpE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAgCD;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,SAAiB;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC;IACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,MAAM,IAAI,IAAI,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAQ;IAChC,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACzC,6DAA6D;IAC7D,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,cAAe;QAC9B,QAAQ,EAAE,GAAG,CAAC,aAAc;QAC5B,YAAY,EAAE,GAAG,CAAC,iBAAkB;QACpC,cAAc,EAAE,GAAG,CAAC,oBAAoB,IAAI,cAAc;QAC1D,gBAAgB,EAAE,GAAG,CAAC,sBAAsB,IAAI,uBAAuB,CAAC,GAAG,CAAC,cAAe,CAAC;KAC7F,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,QAAQ,CACtB,MAAyB,EACzB,OAA2B;IAE3B,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAkC,CAAC;IAErE,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG;QACZ,EAAE;QACF,oCAAoC;QACpC,EAAE;QACF,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW;QACxC,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE;QAC3C,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;QACzD,EAAE;QACF,2EAA2E;QAC3E,EAAE;KACH,CAAC;IACF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antasphere/chassis-server",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {
     "type": "git",
@@ -54,6 +54,10 @@
       "types": "./dist/apikeys/index.d.ts",
       "default": "./dist/apikeys/index.js"
     },
+    "./cli-package": {
+      "types": "./dist/cli-package/index.d.ts",
+      "default": "./dist/cli-package/index.js"
+    },
     "./accounts": {
       "types": "./dist/accounts/index.d.ts",
       "default": "./dist/accounts/index.js"
@@ -131,8 +135,8 @@
     "ulid": "^3.0.2",
     "yazl": "^3.3.1",
     "zod": "^4.1.0",
-    "@antasphere/chassis-contract": "1.0.2",
-    "@antasphere/chassis-db": "1.0.2"
+    "@antasphere/chassis-contract": "1.1.0",
+    "@antasphere/chassis-db": "1.1.0"
   },
   "devDependencies": {
     "@better-auth/core": "1.6.22",

package/src/api/cli-package.ts

@@ -0,0 +1,151 @@
+import { createReadStream, statSync, type Stats } from 'node:fs';
+import { Readable } from 'node:stream';
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import { lt, sql } from 'drizzle-orm';
+import type { cliPackageRoute } from '@antasphere/chassis-contract/routes';
+import { ssoConnectJtis, type Db } from '@antasphere/chassis-db';
+import type { HubConnectAssertion, HubSsoService } from '../identity/hub-sso.js';
+import type { CliPackage } from '../cli-package/index.js';
+import type { Logger } from '../logger.js';
+
+const err = (code: string, message: string) => ({ error: { code, message } });
+
+/**
+ * The tool's own CLI package (cloud edition ONLY, PRDCT-3312):
+ *
+ *   POST /cli/package → verify a hub-minted 120 s exchange JWT (the same H3
+ *   token `/sso/cli-connect` takes), burn its jti, stream the tarball the
+ *   release packed (`CLI_PACKAGE_DIR`, cli-package/index.ts)
+ *
+ * The public `team` command installs each internal tool's private CLI from
+ * here: the hub mints the token only for a member it lets into the tool
+ * (its 403 `tool_access_denied` otherwise), so holding a valid one IS the
+ * access decision, and this route adds none of its own.
+ *
+ * Registered by create-api.ts ONLY when the instance boots EDITION=cloud,
+ * beside `/sso/cli-connect` and for the same reason: an oss boot never
+ * mounts this module, so the path answers the JSON 404 terminator there
+ * (zero hub surface). Rate-limited on the CLI-connect wall (the same hub
+ * token, the same cost).
+ *
+ * NOT a public path and unlisted in the machine scope allowlist, on
+ * purpose: the token rides in the BODY, never in `Authorization` (a
+ * three-part bearer reads as an OAuth token to the scope gate). A request
+ * carrying no credential reaches this handler with no principal; an API key
+ * or an OAuth bearer meets the fail-closed 403 `endpoint_not_allowed` before
+ * it (middleware/scopes.ts).
+ *
+ * Verification discipline is sso-connect.ts's, unchanged:
+ *
+ *  - the token passes `HubSsoService.verifyConnectToken` — hub-JWKS
+ *    signature, iss pinned to the hub, aud pinned to OUR resource URL,
+ *    RS256 only, expiry, `purpose: 'sso-connect'` required, `jti` required;
+ *  - the `jti` is consumed ONE-TIME-USE in the SAME `sso_connect_jtis`
+ *    ledger, insert-first: a token spent here cannot then mint a key at
+ *    `/sso/cli-connect`, and the other way round;
+ *  - every verification failure (signature, iss, aud, purpose, expiry,
+ *    replay) answers ONE uniform 401 — no oracle for probing tokens.
+ *
+ * Only after the token is spent does the route say whether a package
+ * exists (404 `cli_not_packaged`): an unverified caller learns nothing
+ * about the instance's release.
+ */
+
+export interface CliPackageRouteDeps {
+  db: Db;
+  hubSso: HubSsoService;
+  /** What the boot read off `CLI_PACKAGE_DIR`; null = released without its CLI package. */
+  cliPackage: CliPackage | null;
+  logger: Logger;
+  routes: { cliPackageRoute: typeof cliPackageRoute };
+}
+
+export function registerCliPackageRoutes(api: OpenAPIHono, deps: CliPackageRouteDeps): void {
+  const { db, hubSso, cliPackage, logger } = deps;
+  const { cliPackageRoute } = deps.routes;
+
+  api.openapi(cliPackageRoute, async (c) => {
+    const body = c.req.valid('json');
+
+    // 1. Verify hard. One uniform 401 for every rejection reason.
+    let assertion: HubConnectAssertion;
+    try {
+      assertion = await hubSso.verifyConnectToken(body.token);
+    } catch (cause) {
+      logger.warn({ err: cause }, 'cli package: exchange token rejected');
+      return c.json(err('invalid_token', 'The exchange token is invalid, expired, or already used'), 401);
+    }
+
+    // 2. Burn the jti (one-time-use, G8), in the ledger /sso/cli-connect
+    // burns into. Insert-first: the claim precedes any effect, so a replay —
+    // even a concurrent one — downloads nothing. The sweep keeps the ledger
+    // tiny; best-effort, never correctness-bearing (expired rows only shadow
+    // jtis of already-expired tokens).
+    void db
+      .delete(ssoConnectJtis)
+      .where(lt(ssoConnectJtis.expiresAt, sql`now() - interval '1 minute'`))
+      .catch(() => {});
+    const claimed = await db
+      .insert(ssoConnectJtis)
+      .values({ jti: assertion.jti, expiresAt: assertion.expiresAt })
+      .onConflictDoNothing()
+      .returning({ jti: ssoConnectJtis.jti });
+    if (claimed.length === 0) {
+      logger.warn({ jti: assertion.jti }, 'cli package: replayed jti rejected');
+      return c.json(err('invalid_token', 'The exchange token is invalid, expired, or already used'), 401);
+    }
+
+    // 3. Released without its CLI package: say so, with a sentence the
+    // `team` command can print as it is. The boot's read names what the
+    // image packed; the file is statted again HERE, after the burn, so a
+    // folder changed under a running instance answers the same 404 instead
+    // of a 200 whose body and length disagree.
+    const notPackaged = () =>
+      c.json(
+        err(
+          'cli_not_packaged',
+          'This instance was released without its CLI package, so it has none to serve'
+        ),
+        404
+      );
+    if (cliPackage === null) return notPackaged();
+    let stat: Stats;
+    try {
+      stat = statSync(cliPackage.path);
+    } catch (cause) {
+      logger.error({ err: cause, path: cliPackage.path }, 'cli package: the tarball read at boot is gone');
+      return notPackaged();
+    }
+    if (!stat.isFile()) {
+      logger.error({ path: cliPackage.path }, 'cli package: the tarball read at boot is no longer a file');
+      return notPackaged();
+    }
+
+    // 4. Stream the tarball. The bytes are the release's, never a person's,
+    // but they are served as an attachment and never sniffed all the same;
+    // no-store, so a shared cache never answers the next exchange.
+    logger.info(
+      {
+        hubSub: assertion.sub,
+        email: assertion.email,
+        package: cliPackage.name,
+        version: cliPackage.version
+      },
+      'cli package: served'
+    );
+    const nodeStream = createReadStream(cliPackage.path);
+    // Backpressure rides Readable.toWeb; a client abort must destroy the
+    // source or every abandoned download leaks a descriptor (files/serve.ts).
+    c.req.raw.signal.addEventListener('abort', () => nodeStream.destroy());
+    const web = Readable.toWeb(nodeStream) as unknown as ReadableStream;
+    return c.body(web, 200, {
+      'content-type': 'application/gzip',
+      'content-disposition': `attachment; filename="${cliPackage.filename}"`,
+      // The size statted now, never the boot's: the header and the bytes agree.
+      'content-length': String(stat.size),
+      // Also set on every response by the global security-headers middleware.
+      'x-content-type-options': 'nosniff',
+      'cache-control': 'no-store'
+    });
+  });
+}

package/src/api/create-api.ts

@@ -7,7 +7,7 @@ import { registerOpenApiDoc } from './index.js';
 import { ulid } from 'ulid';
 import { and, asc, desc, eq } from 'drizzle-orm';
 import { ACTIVE_WORKSPACE_HEADER, type Principal } from '@antasphere/chassis-contract';
-import { instanceRoute, setupRoute } from '@antasphere/chassis-contract/routes';
+import { cliPackageRoute, instanceRoute, setupRoute } from '@antasphere/chassis-contract/routes';
 import {
   account,
   instanceSettings,
@@ -76,6 +76,8 @@ import {
   type WorkspaceCloudDeps
 } from './index.js';
 import { registerSsoConnectRoutes } from './index.js';
+import { registerCliPackageRoutes } from './index.js';
+import { loadCliPackage } from '../cli-package/index.js';
 import { registerSsoLogoutRoutes } from './index.js';
 import { registerMemberRoutes } from './index.js';
 import { demoSessionJudge, demoSignInOn, registerDemoPassRoutes } from './index.js';
@@ -357,6 +359,13 @@ export function createApiApp<
   // Demo sign-in (the demo pass spec): DEMO_SIGN_IN on the self-hosted
   // edition only. Off, no demo route, wall or discovery key exists.
   const demoSignIn = demoSignInOn(env, hub, logger);
+  // The tool's own CLI package (PRDCT-3312), read once here. parseEnv has
+  // already refused a CLI_PACKAGE_DIR that does not hold the pair, so a
+  // throw from here (the folder emptied between the two reads) still
+  // refuses the boot, it is never a person's failed install. Served (and
+  // advertised) only where its route is registered: the cloud block below.
+  const cliPackage = loadCliPackage(env.CLI_PACKAGE_DIR);
+  const cliServed = deps.hubSso && deps.hubGrant ? cliPackage : null;
 
   const api = new OpenAPIHono({
     // Validation failures use the same wire shape as every other error.
@@ -573,6 +582,9 @@ export function createApiApp<
   // route itself: oss mounts zero hub surface.
   if (deps.hubSso) {
     api.use('/sso/cli-connect', rateLimit(limiters.cliConnect, clientIp));
+    // The CLI package download (cloud only, api/cli-package.ts) presents the
+    // same one-time hub token at the same cost: the same wall.
+    api.use('/cli/package', rateLimit(limiters.cliConnect, clientIp));
   }
 
   // ── JSON pre-validation in front of the Better Auth mount (AF-1 + the
@@ -832,6 +844,10 @@ export function createApiApp<
         // Present only on a cloud instance whose operator restricted the tool
         // (PRDCT-2947): organizations are opened by Antasphere, not created here.
         ...(hub && env.TOOL_RESTRICTED ? { restricted: true } : {}),
+        // Present only on a cloud instance whose release packed the tool's
+        // CLI (PRDCT-3312): what `POST /cli/package` serves, for the `team`
+        // command to install. An oss boot has no route, so no key either.
+        ...(cliServed ? { cli: { name: cliServed.name, version: cliServed.version } } : {}),
         // What this version declares for the billing rail (§7): the hub seeds
         // from it, staff read it, a client reads the limit it is held to.
         entitlements: {
@@ -1290,6 +1306,14 @@ export function createApiApp<
       cliKeyScopes: tool.scopes.cliKey,
       routes: { ssoCliConnectRoute }
     });
+    // The tool's own CLI package (PRDCT-3312): cloud-only for the same
+    // reason as /sso/cli-connect (it verifies the same hub exchange token
+    // and burns it in the same ledger), so an oss boot leaves the path to
+    // the JSON 404 terminator. Deliberately UNLISTED in the machine scope
+    // allowlist and absent from PUBLIC_API_PATHS: the token rides in the
+    // body, a request without a credential reaches the handler, and an API
+    // key or an OAuth bearer meets 403 endpoint_not_allowed before it.
+    registerCliPackageRoutes(api, { db, hubSso, cliPackage, logger, routes: { cliPackageRoute } });
   }
   // Single logout (SL-2): cloud-only like /sso/cli-connect — an oss boot
   // leaves POST /sso/logout to the JSON 404 terminator. Deliberately

package/src/api/index.ts

@@ -2,6 +2,7 @@ export { registerApiKeyRoutes } from './apikeys.js';
 export { registerAuditRoutes } from './audit.js';
 export { registerBreakGlassRoutes } from './break-glass.js';
 export { registerCliAuthRoutes } from './cli-auth.js';
+export { registerCliPackageRoutes, type CliPackageRouteDeps } from './cli-package.js';
 export { demoSessionJudge, demoSignInOn, registerDemoPassRoutes } from './demo-passes.js';
 export {
   registerExportRoutes,

package/src/cli-package/index.ts

@@ -0,0 +1,88 @@
+import { readFileSync, statSync, type Stats } from 'node:fs';
+import { join } from 'node:path';
+
+/**
+ * The tool's own CLI package, as the release packed it (PRDCT-3312): the
+ * folder `CLI_PACKAGE_DIR` names holds `package.tgz` (the output of
+ * `pnpm pack` of the tool's `packages/cli`) beside a copy of that package's
+ * `package.json`. The instance reads the pair ONCE at boot and serves the
+ * tarball on `POST /cli/package` (api/cli-package.ts, cloud only) to a member
+ * the hub let into the tool; discovery advertises `cli { name, version }` so
+ * the `team` command knows what it installs and whether to update.
+ *
+ * A folder that is named but does not hold the pair, or whose `package.json`
+ * carries no string `name` and `version`, refuses the boot (env.ts): a
+ * misconfiguration is proven at the image, never discovered by a person's
+ * install. Pure: nothing runs at import; the reads are synchronous and happen
+ * when the boot asks.
+ */
+export interface CliPackage {
+  /** The package's npm name, from its `package.json` (e.g. `@scope/tool`). */
+  name: string;
+  /** The package's version, from its `package.json`. */
+  version: string;
+  /** The tarball's path (the configured folder joined with `package.tgz`), what the route streams. */
+  path: string;
+  /** The tarball's size when the boot read it (the route stats the file again when it serves). */
+  sizeBytes: number;
+  /** npm's own pack name for the pair, the attachment's filename. */
+  filename: string;
+}
+
+/** The tarball's name inside the folder, whatever the package is called. */
+export const CLI_PACKAGE_TARBALL = 'package.tgz';
+/** The manifest copy beside it. */
+export const CLI_PACKAGE_MANIFEST = 'package.json';
+
+/**
+ * npm's own pack filename: the scope's `@` dropped and its `/` turned into
+ * `-` (`@scope/tool` + `1.2.3` → `scope-tool-1.2.3.tgz`); an unscoped name is
+ * kept as it is (`tool` → `tool-1.2.3.tgz`).
+ */
+export function packFilename(name: string, version: string): string {
+  const base = name.startsWith('@') ? name.slice(1).replace('/', '-') : name;
+  return `${base}-${version}.tgz`;
+}
+
+/**
+ * Read the folder `CLI_PACKAGE_DIR` names. `undefined` (the variable unset)
+ * answers null: the instance serves no CLI. A named folder answers the
+ * package, or THROWS an Error naming the folder and the missing piece.
+ */
+export function loadCliPackage(dir: string | undefined): CliPackage | null {
+  if (dir === undefined) return null;
+  const refuse = (what: string): never => {
+    throw new Error(`CLI_PACKAGE_DIR=${dir}: ${what}`);
+  };
+
+  const tarball = join(dir, CLI_PACKAGE_TARBALL);
+  let stat: Stats;
+  try {
+    stat = statSync(tarball);
+  } catch {
+    return refuse(`no ${CLI_PACKAGE_TARBALL} in the folder (the output of \`pnpm pack\` of the CLI package)`);
+  }
+  if (!stat.isFile()) return refuse(`${CLI_PACKAGE_TARBALL} is not a file`);
+
+  let raw: string;
+  try {
+    raw = readFileSync(join(dir, CLI_PACKAGE_MANIFEST), 'utf8');
+  } catch {
+    return refuse(`no ${CLI_PACKAGE_MANIFEST} in the folder (a copy of the CLI package's manifest)`);
+  }
+  let manifest: unknown;
+  try {
+    manifest = JSON.parse(raw);
+  } catch {
+    return refuse(`${CLI_PACKAGE_MANIFEST} is not valid JSON`);
+  }
+  const { name, version } = (manifest ?? {}) as { name?: unknown; version?: unknown };
+  if (typeof name !== 'string' || name.length === 0) {
+    return refuse(`${CLI_PACKAGE_MANIFEST} carries no string "name"`);
+  }
+  if (typeof version !== 'string' || version.length === 0) {
+    return refuse(`${CLI_PACKAGE_MANIFEST} carries no string "version"`);
+  }
+
+  return { name, version, path: tarball, sizeBytes: stat.size, filename: packFilename(name, version) };
+}

package/src/env.ts

@@ -2,6 +2,7 @@ import { z } from 'zod';
 import { parseApiKeyPeppers } from './apikeys/peppers.js';
 import { parseSuperadminEmails } from './accounts/superadmin.js';
 import { isDemoSignInHost, parseDemoEmailDomains, parseDemoHosts } from './identity/demo-pass-rules.js';
+import { loadCliPackage } from './cli-package/index.js';
 
 /**
  * The single entry point for configuration. Every env var the app reads is
@@ -198,6 +199,19 @@ const chassisEnvShape = (version: string) => ({
   HUB_HINT_COOKIE_DOMAIN: optionalString(z.string().min(1)),
   /** The restricted bit on the tool itself (PRDCT-2947): `true` on the cloud edition makes this instance refuse to create an organization (`POST /workspaces` answers 403 `restricted_tool`, `/me.canCreateWorkspace` is false) and advertise `restricted: true` in discovery, so a tool that Antasphere opens to organizations one by one does not rest on the hub registry's flag alone. No effect on the self-hosted edition, where workspaces are local. */
   TOOL_RESTRICTED: booleanish.default(false),
+  /** The tool's own CLI package as the release packed it (PRDCT-3312): a folder holding `package.tgz` (the output of `pnpm pack` of `packages/cli`) beside a copy of that package's `package.json`. The image sets it. Cloud edition: the instance serves the tarball on `POST /cli/package` to a member the hub lets into the tool, and discovery carries `cli { name, version }` so the `team` command knows what it installs and whether to update. Unset = the instance serves no CLI: discovery carries no `cli` and the route answers 404 `cli_not_packaged`. A set value whose folder does not hold both files, or whose `package.json` has no string `name` and `version`, refuses the boot with the path and what is missing: a misconfiguration is proven at the image, never discovered by a person's install. */
+  CLI_PACKAGE_DIR: optionalString(
+    z
+      .string()
+      .min(1)
+      .superRefine((dir, ctx) => {
+        try {
+          loadCliPackage(dir);
+        } catch (err) {
+          ctx.addIssue({ code: 'custom', message: err instanceof Error ? err.message : String(err) });
+        }
+      })
+  ),
   /** R7 escape hatch (internal/federation.md): acknowledge an EDITION change on an already-set-up instance. Without it, boot refuses an EDITION that differs from the one stamped at setup — flipping editions under existing users/workspaces changes identity semantics and must be a conscious operator act. */
   EDITION_CHANGE_ALLOWED: booleanish.default(false),
   /** Reported version. Defaults to the code's own baked-in package version (PRDCT-1844) — the image knows its version intrinsically, CI injects nothing. The env var remains as a deliberate operator override only. */