@antasphere/slideless 0.13.7 → 0.13.8

package/dist/bin.js

@@ -3032,7 +3032,7 @@ var require_commander = __commonJS({
 // src/bin.ts
 import { createInterface } from "node:readline/promises";
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/config.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.6.0/node_modules/@antasphere/cli-core/dist/config.js
 import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 var HUB_TOOL = "hub";
@@ -3099,8 +3099,13 @@ function redactKey(key) {
     return "****";
   return `${key.slice(0, 13)}\u2026${key.slice(-4)}`;
 }
-function lookupConnectKey(profile, hubProfileName) {
-  return profile?.connectKeys?.[hubProfileName]?.apiKey;
+function cachedConnectKey(profile, hubProfileName, hubEmail) {
+  const entry = profile?.connectKeys?.[hubProfileName];
+  const hub = hubEmail?.trim().toLowerCase();
+  const minted = entry?.email?.trim().toLowerCase();
+  if (!hub || !minted || hub !== minted)
+    return void 0;
+  return entry?.apiKey;
 }
 function storeConnectKey(env, tool, profileName, hubProfileName, entry, opts = {}) {
   const config2 = loadConfig(env, tool);
@@ -3131,7 +3136,7 @@ function removeConnectKey(env, tool, profileName, hubProfileName) {
   return true;
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/io.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.6.0/node_modules/@antasphere/cli-core/dist/io.js
 async function ask(io, question) {
   if (!io.prompt) {
     throw new Error("This command is interactive \u2014 no prompt available (pass the value as a flag).");
@@ -3146,7 +3151,7 @@ function printJson(io, value) {
 `);
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/resolve.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.6.0/node_modules/@antasphere/cli-core/dist/resolve.js
 var CliUsageError = class extends Error {
   exitCode;
   constructor(message, opts = {}) {
@@ -3251,7 +3256,7 @@ function resolveApiKey(opts) {
   return firstSet(opts.flag, opts.env[opts.envVar], opts.profile?.apiKey);
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/auth.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.6.0/node_modules/@antasphere/cli-core/dist/auth.js
 var CliAuthError = class extends Error {
   status;
   code;
@@ -3306,7 +3311,7 @@ var CliAuthClient = class {
   }
 };
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/connect.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.6.0/node_modules/@antasphere/cli-core/dist/connect.js
 var CliConnectError = class extends CliAuthError {
   stage;
   constructor(stage, status, code, message, details) {
@@ -3393,7 +3398,7 @@ var CliConnectClient = class {
   }
 };
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/connect-on-demand.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.6.0/node_modules/@antasphere/cli-core/dist/connect-on-demand.js
 async function probeToolInstance(toolBaseUrl, fetchImpl) {
   const f = fetchImpl ?? globalThis.fetch.bind(globalThis);
   try {
@@ -3416,8 +3421,15 @@ async function probeToolInstance(toolBaseUrl, fetchImpl) {
     return null;
   }
 }
-function activeHubProfile(env) {
-  return resolveProfile(loadConfig(env, HUB_TOOL), void 0);
+var HUB_URL_ENV = "ANTASPHERE_URL";
+function selectHubProfile(env, opts = {}) {
+  const config2 = loadConfig(env, HUB_TOOL);
+  const apiUrl = firstSet(env[HUB_URL_ENV]);
+  if (apiUrl) {
+    const { name, profile } = selectProfile({ config: config2, apiUrl, cloudUrl: opts.cloudUrl });
+    return { name, profile };
+  }
+  return resolveProfile(config2, void 0);
 }
 function defaultMissingHubLogin(tool) {
   const envVar = `${tool.replace(/-/g, "_").toUpperCase()}_API_KEY`;
@@ -3438,11 +3450,11 @@ async function connectOnDemand(opts) {
   const toolBaseUrl = normalizeUrl(opts.toolBaseUrl);
   const messages = opts.messages ?? {};
   const { profileName } = opts;
-  const hub = activeHubProfile(opts.env);
+  const hub = selectHubProfile(opts.env, { cloudUrl: opts.hubCloudUrl });
   const existing = loadConfig(opts.env, opts.tool).profiles[profileName];
   const { place, at } = placeOf(existing, toolBaseUrl, opts.cloudUrl);
   if (opts.cached !== false && place === "here" && hub.name) {
-    const cachedKey = lookupConnectKey(existing, hub.name);
+    const cachedKey = cachedConnectKey(existing, hub.name, hub.profile?.email);
     if (cachedKey)
       return { outcome: "connected", key: cachedKey, cached: true };
   }
@@ -3450,7 +3462,7 @@ async function connectOnDemand(opts) {
   if (!probe?.cloud)
     return { outcome: "not_cloud" };
   const hubKey = firstSet(hub.profile?.apiKey);
-  const hubBaseUrl = firstSet(hub.profile?.baseUrl);
+  const hubBaseUrl = firstSet(hub.profile?.baseUrl, opts.hubCloudUrl);
   if (!hubKey || !hubBaseUrl || !hub.name) {
     throw new CliUsageError(messages.missingHubLogin ?? defaultMissingHubLogin(opts.tool));
   }
@@ -3496,7 +3508,7 @@ async function connectOnDemand(opts) {
 }
 async function refreshConnectKey(opts) {
   assertToolNamespace(opts.tool);
-  const hub = activeHubProfile(opts.env);
+  const hub = selectHubProfile(opts.env, { cloudUrl: opts.hubCloudUrl });
   const existing = loadConfig(opts.env, opts.tool).profiles[opts.profileName];
   const { place } = placeOf(existing, normalizeUrl(opts.toolBaseUrl), opts.cloudUrl);
   if (hub.name && place === "here")
@@ -3504,7 +3516,7 @@ async function refreshConnectKey(opts) {
   return connectOnDemand({ ...opts, cached: false });
 }
 
-// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/migrate.js
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.6.0/node_modules/@antasphere/cli-core/dist/migrate.js
 import { existsSync as existsSync2, readFileSync as readFileSync2 } from "node:fs";
 import { join as join2 } from "node:path";
 function migrateLegacyConfig(env, spec) {
@@ -3535,33 +3547,33 @@ function migrateLegacyConfig(env, spec) {
   return { migrated: true, from, to };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/config.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/config.js
 function createConfig(identity) {
   const TOOL = identity.tool;
   const LEGACY = { tool: TOOL, legacyDir: identity.legacyConfigDir };
-  function configPath2(env) {
+  function configPath3(env) {
     return configPath(env, TOOL);
   }
-  function loadConfig3(env) {
+  function loadConfig4(env) {
     try {
       migrateLegacyConfig(env, LEGACY);
     } catch {
     }
     return loadConfig(env, TOOL);
   }
-  function saveConfig3(env, config2) {
+  function saveConfig4(env, config2) {
     return saveConfig(env, TOOL, config2);
   }
-  function clearConfig2(env) {
+  function clearConfig3(env) {
     clearConfig(env, TOOL);
   }
-  function removeConnectKey2(env, profileName, hubProfileName) {
+  function removeConnectKey3(env, profileName, hubProfileName) {
     return removeConnectKey(env, TOOL, profileName, hubProfileName);
   }
-  return { configPath: configPath2, loadConfig: loadConfig3, saveConfig: saveConfig3, clearConfig: clearConfig2, removeConnectKey: removeConnectKey2 };
+  return { configPath: configPath3, loadConfig: loadConfig4, saveConfig: saveConfig4, clearConfig: clearConfig3, removeConnectKey: removeConnectKey3 };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-sdk@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-sdk/dist/index.js
+// ../../node_modules/.pnpm/@antasphere+chassis-sdk@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-sdk/dist/index.js
 var PlatformApiError = class extends Error {
   status;
   code;
@@ -3752,6 +3764,32 @@ var ChassisClient = class {
   ssoCliConnect(req) {
     return this.request("POST", "/sso/cli-connect", req);
   }
+  /**
+   * Public, CLOUD EDITION only (404 on oss): download the tool's own CLI
+   * package (a gzipped tarball, `instance().cli` names it) on a hub-minted
+   * exchange token, the same token and the same one-time rule as
+   * ssoCliConnect. The token rides in the body and the client's API key is
+   * NEVER sent: the route refuses a machine credential (403
+   * `endpoint_not_allowed`). Raw Response so the caller can stream it; a
+   * non-2xx answer throws PlatformApiError (401 `invalid_token`, 404
+   * `cli_not_packaged`, 404 `not_found` on an instance without the route).
+   */
+  async downloadCliPackage(req) {
+    const { authorization: _credential, ...headers } = this.baseHeaders();
+    const res = await this.fetchImpl(`${this.baseUrl}/api/v1/cli/package`, {
+      method: "POST",
+      headers: { ...headers, "content-type": "application/json" },
+      credentials: "same-origin",
+      signal: this.signal("download"),
+      // Browser-only field; cast keeps this isomorphic under a Node lib.
+      cache: "no-store",
+      body: JSON.stringify(req)
+    });
+    if (!res.ok) {
+      await this.parse(res);
+    }
+    return res;
+  }
   /**
    * CLOUD EDITION only (404 on oss); sessions only (machines 403 — the
    * path is unlisted in the scope allowlist): single logout. The server
@@ -4074,7 +4112,22 @@ var ChassisClient = class {
   }
 };
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/workspace.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/identity.js
+var DEFAULT_HUB_URL = "https://account.antasphere.com";
+function cliIdentity(identity) {
+  return {
+    bin: identity.cli.bin,
+    tool: identity.slug,
+    legacyConfigDir: identity.cli.legacyConfigDir,
+    displayName: identity.displayName,
+    envPrefix: identity.cli.envPrefix,
+    keyPrefix: identity.apiKeyPrefix,
+    exportScope: identity.scopes.dataExport,
+    cloudUrl: identity.cloud.url
+  };
+}
+
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/workspace.js
 var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function isWorkspaceId(value) {
   return UUID_RE.test(value);
@@ -4181,7 +4234,7 @@ ${workspaceLines(me.workspaces)}`;
   };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/context.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/context.js
 var CliApiRefusal = class extends CliUsageError {
   status;
   constructor(message, status) {
@@ -4220,19 +4273,19 @@ function printJson2(io, value) {
 var appliedContexts = /* @__PURE__ */ new WeakMap();
 function createContext(input) {
   const { identity, createClient } = input;
-  const { loadConfig: loadConfig3, removeConnectKey: removeConnectKey2 } = input.config;
+  const { loadConfig: loadConfig4, removeConnectKey: removeConnectKey3 } = input.config;
   const { describeSelection, explainRefusal, pickWorkspaceSelection } = input.workspace;
   const unknownHint = `run \`${identity.bin} profiles\` to list them.`;
-  function resolveProfile2(config2, requested) {
+  function resolveProfile3(config2, requested) {
     const { name, profile } = selectProfile({ config: config2, requested, cloudUrl: identity.cloudUrl, unknownHint });
     return { name, profile };
   }
-  function profileUrl2(profile) {
+  function profileUrl3(profile) {
     return profile?.baseUrl ?? identity.cloudUrl;
   }
   function resolveContext2(cmd, io) {
     const opts = cmd.optsWithGlobals();
-    const config2 = loadConfig3(io.env);
+    const config2 = loadConfig4(io.env);
     const apiUrl = opts.apiUrl ?? opts.url ?? io.env[`${identity.envPrefix}_URL`];
     const selected = selectProfile({
       config: config2,
@@ -4249,7 +4302,7 @@ function createContext(input) {
       profile,
       cloudUrl: identity.cloudUrl
     });
-    const sameProfileInstance = sameInstance(profileUrl2(profile), baseUrl);
+    const sameProfileInstance = sameInstance(profileUrl3(profile), baseUrl);
     let apiKey = resolveApiKey({
       flag: opts.apiKey ?? stdinApiKeys.get(io),
       env: io.env,
@@ -4258,10 +4311,9 @@ function createContext(input) {
     });
     let credentialSource = opts.apiKey !== void 0 || stdinApiKeys.get(io) !== void 0 ? "flag" : io.env[`${identity.envPrefix}_API_KEY`] ? "env" : apiKey ? "profile" : "none";
     if (!apiKey && sameProfileInstance) {
-      const hub = activeHubProfile(io.env);
-      if (hub.name && !cachedForAnotherAccount(profile, hub.name, hub.profile?.email)) {
-        apiKey = lookupConnectKey(profile, hub.name);
-      }
+      const hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
+      if (hub.name)
+        apiKey = cachedConnectKey(profile, hub.name, hub.profile?.email);
       if (apiKey)
         credentialSource = "hub-cache";
     }
@@ -4289,12 +4341,6 @@ function createContext(input) {
     }
     return ctx;
   }
-  function cachedForAnotherAccount(profile, slot, hubEmail) {
-    const cached2 = profile?.connectKeys?.[slot]?.email;
-    if (!cached2 || !hubEmail)
-      return false;
-    return cached2.toLowerCase() !== hubEmail.toLowerCase();
-  }
   const NO_KEY_MESSAGE = `An API key is required. Sign in (\`${identity.bin} login\`), pass --api-key, or set ${identity.envPrefix}_API_KEY.`;
   const MISSING_HUB_LOGIN_MESSAGE = `This ${identity.displayName} instance signs in through Antasphere. Run \`${identity.bin} login\` once (or \`antasphere login\`), then retry \u2014 or pass --api-key <${identity.keyPrefix}_\u2026> / set ${identity.envPrefix}_API_KEY.`;
   function connectOptions(ctx) {
@@ -4304,6 +4350,10 @@ function createContext(input) {
       toolBaseUrl: ctx.baseUrl,
       // A profile with no baseUrl of its own is at the cloud URL (cli-core 0.5.0).
       cloudUrl: identity.cloudUrl,
+      // The same for a hub profile (cli-core 0.6.0, verifier round 1, F4):
+      // one with no baseUrl is at the default hub, so ANTASPHERE_URL naming
+      // that hub finds it, and the slot it names is the one this kit reads.
+      hubCloudUrl: DEFAULT_HUB_URL,
       profileName: ctx.profileName ?? CLOUD_PROFILE,
       env: io.env,
       // Thread the injected fetch so the probe + exchange stay on the test
@@ -4330,9 +4380,10 @@ function createContext(input) {
       const outcome = await refreshConnectKey(connectOptions(ctx));
       if (outcome.outcome === "not_cloud")
         return res;
+      ctx.io.err.write("The cached key was refused; signed in again through Antasphere.\n");
+      healHubAddress(ctx, outcome);
       ctx.apiKey = outcome.key;
       ctx.credentialSource = "hub-exchange";
-      ctx.io.err.write("The cached key was refused; signed in again through Antasphere.\n");
       const headers = new Headers(init?.headers);
       headers.set("authorization", `Bearer ${outcome.key}`);
       return base(input2, { ...init, headers });
@@ -4387,26 +4438,49 @@ function createContext(input) {
     const noun = selection.kind === "org" ? "organization" : "workspace";
     return ` (looked in the ${noun} "${selection.value}", selected by ${describeSelection(selection)})`;
   }
+  async function connect(ctx, overrides = {}) {
+    const outcome = await connectOnDemand({ ...connectOptions(ctx), ...overrides });
+    healHubAddress(ctx, outcome);
+    return outcome;
+  }
+  function healHubAddress(ctx, outcome) {
+    if (outcome.outcome !== "connected" || outcome.cached || !outcome.result)
+      return;
+    const answered = firstSet(outcome.result.user.email);
+    if (!answered)
+      return;
+    const hub = selectHubProfile(ctx.io.env, { cloudUrl: DEFAULT_HUB_URL });
+    const hubConfig = loadConfig(ctx.io.env, HUB_TOOL);
+    const stored = hub.name ? hubConfig.profiles[hub.name] : void 0;
+    const had = firstSet(stored?.email);
+    if (!hub.name || !stored || had?.toLowerCase() === answered.toLowerCase())
+      return;
+    hubConfig.profiles[hub.name] = { ...stored, email: answered };
+    saveConfig(ctx.io.env, HUB_TOOL, hubConfig);
+    if (had) {
+      ctx.io.err.write(`The Antasphere login's address is now ${answered}, replaced from ${had} (the hub's own answer).
+`);
+    }
+  }
   async function connectForKey(ctx) {
     const { io } = ctx;
-    const hub = activeHubProfile(io.env);
+    const hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
     if (ctx.profileName && hub.name) {
-      const profile = loadConfig3(io.env).profiles[ctx.profileName];
-      if (cachedForAnotherAccount(profile, hub.name, hub.profile?.email)) {
-        const stale = profile?.connectKeys?.[hub.name];
-        if (stale) {
-          io.err.write(`The ${identity.displayName} key cached for ${stale.email ?? "another Antasphere login"} is retired: the Antasphere login is now ${hub.profile?.email ?? "another account"}.
-`);
-          const auth = new CliAuthClient({
-            baseUrl: profileUrl2(profile),
-            ...io.fetch ? { fetch: io.fetch } : {}
-          });
-          await auth.revoke(stale.apiKey).catch(() => void 0);
-          removeConnectKey2(io.env, ctx.profileName, hub.name);
-        }
+      const profile = loadConfig4(io.env).profiles[ctx.profileName];
+      const stale = profile?.connectKeys?.[hub.name];
+      if (stale && !cachedConnectKey(profile, hub.name, hub.profile?.email)) {
+        const hubEmail = firstSet(hub.profile?.email);
+        io.err.write(`The ${identity.displayName} key cached for ${firstSet(stale.email) ?? "an unknown login"} is retired: ` + (hubEmail ? `the Antasphere login is now ${hubEmail}.
+` : "the Antasphere login carries no address to match it with.\n"));
+        const auth = new CliAuthClient({
+          baseUrl: profileUrl3(profile),
+          ...io.fetch ? { fetch: io.fetch } : {}
+        });
+        await auth.revoke(stale.apiKey).catch(() => void 0);
+        removeConnectKey3(io.env, ctx.profileName, hub.name);
       }
     }
-    const outcome = await connectOnDemand(connectOptions(ctx));
+    const outcome = await connect(ctx);
     if (outcome.outcome === "not_cloud") {
       throw new CliUsageError(NO_KEY_MESSAGE);
     }
@@ -4421,14 +4495,15 @@ function createContext(input) {
     return outcome.key;
   }
   return {
-    resolveProfile: resolveProfile2,
+    resolveProfile: resolveProfile3,
     resolveContext: resolveContext2,
     requireApiKey: requireApiKey2,
     workspaceSource,
     explainWorkspaceRefusal,
     workspaceNotFoundHint,
-    profileUrl: profileUrl2,
-    connectOptions
+    profileUrl: profileUrl3,
+    connectOptions,
+    connect
   };
 }
 async function drainPages(first, fetchPage) {
@@ -4475,7 +4550,7 @@ var {
   Help
 } = import_index.default;
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/stdin.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/stdin.js
 var claims = /* @__PURE__ */ new WeakMap();
 async function readAllStdin() {
   const chunks = [];
@@ -4496,9 +4571,8 @@ async function readSecretFromStdin(io, claimant) {
   return value;
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/auth.js
-var HUB_URL_ENV = "ANTASPHERE_URL";
-var DEFAULT_HUB_URL = "https://account.antasphere.com";
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/auth.js
+var HUB_URL_ENV2 = "ANTASPHERE_URL";
 function describeCredential(source, profileName) {
   switch (source) {
     case "flag":
@@ -4530,10 +4604,10 @@ function organizationsLine(me) {
 `;
 }
 function registerAuthCommands(kit, program2, io) {
-  const { identity, createClient, clearConfig: clearConfig2, configPath: configPath2, connectOptions, loadConfig: loadConfig3, profileUrl: profileUrl2, removeConnectKey: removeConnectKey2, requireApiKey: requireApiKey2, resolveContext: resolveContext2, saveConfig: saveConfig3, workspaceSource } = kit;
+  const { identity, createClient, clearConfig: clearConfig3, configPath: configPath3, connect, loadConfig: loadConfig4, profileUrl: profileUrl3, removeConnectKey: removeConnectKey3, requireApiKey: requireApiKey2, resolveContext: resolveContext2, saveConfig: saveConfig4, workspaceSource } = kit;
   const { describeSource } = kit.workspace;
   function saveProfileKey(profileName, baseUrl, apiKey, email3) {
-    const config3 = loadConfig3(io.env);
+    const config3 = loadConfig4(io.env);
     const previous = config3.profiles[profileName];
     config3.profiles[profileName] = {
       ...previous,
@@ -4542,25 +4616,25 @@ function registerAuthCommands(kit, program2, io) {
       ...email3 ? { email: email3 } : {}
     };
     config3.activeProfile = profileName;
-    return saveConfig3(io.env, config3);
+    return saveConfig4(io.env, config3);
   }
   function activate(profileName, baseUrl) {
-    const config3 = loadConfig3(io.env);
+    const config3 = loadConfig4(io.env);
     config3.profiles[profileName] = { ...config3.profiles[profileName], baseUrl: normalizeUrl(baseUrl) };
     config3.activeProfile = profileName;
-    return saveConfig3(io.env, config3);
+    return saveConfig4(io.env, config3);
   }
   async function hubLogin(opts) {
     const hubConfig = loadConfig(io.env, HUB_TOOL);
     const selected = selectProfile({
       config: hubConfig,
-      apiUrl: io.env[HUB_URL_ENV],
+      apiUrl: io.env[HUB_URL_ENV2],
       cloudUrl: DEFAULT_HUB_URL
     });
     const profile = selected.name ?? CLOUD_PROFILE;
     const hubUrl = resolveBaseUrl({
       env: io.env,
-      envVar: HUB_URL_ENV,
+      envVar: HUB_URL_ENV2,
       profile: selected.profile,
       cloudUrl: DEFAULT_HUB_URL
     });
@@ -4609,8 +4683,8 @@ function registerAuthCommands(kit, program2, io) {
     const profileName = ctx.profileName ?? CLOUD_PROFILE;
     const { baseUrl } = ctx;
     const saved = ctx.config.profiles[profileName];
-    if (saved && !sameInstance(profileUrl2(saved), baseUrl)) {
-      throw new CliUsageError(`Profile "${profileName}" is the instance ${profileUrl2(saved)}, and this login targets ${baseUrl}. Drop --profile to sign in on the profile of ${baseUrl}, or drop --api-url to sign in on "${profileName}".`);
+    if (saved && !sameInstance(profileUrl3(saved), baseUrl)) {
+      throw new CliUsageError(`Profile "${profileName}" is the instance ${profileUrl3(saved)}, and this login targets ${baseUrl}. Drop --profile to sign in on the profile of ${baseUrl}, or drop --api-url to sign in on "${profileName}".`);
     }
     const pasted = globals.apiKey ?? stdinApiKey(io);
     if (pasted !== void 0) {
@@ -4637,35 +4711,37 @@ ${organizationsLine(me2)}`);
     }
     const probe = await probeToolInstance(baseUrl, io.fetch);
     if (probe?.cloud) {
-      let hub = activeHubProfile(io.env);
-      const stored = hub.profile?.apiKey ? hub.profile.email : void 0;
-      const switching = Boolean(stored) && opts.email !== void 0 && opts.email.toLowerCase() !== stored.toLowerCase();
+      let hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
+      const hasKey = Boolean(hub.profile?.apiKey);
+      const stored = hasKey ? firstSet(hub.profile?.email) : void 0;
+      const switching = hasKey && opts.email !== void 0 && (stored === void 0 || opts.email.toLowerCase() !== stored.toLowerCase());
       if (switching) {
-        io.err.write(`Replacing the Antasphere login ${stored} with ${opts.email}.
+        io.err.write(stored ? `Replacing the Antasphere login ${stored} with ${opts.email}.
+` : `Signing in as ${opts.email}: the stored Antasphere login carries no address.
 `);
       }
       if (!hub.profile?.apiKey || switching)
         await hubLogin(opts);
-      hub = activeHubProfile(io.env);
-      const stale = hub.name ? loadConfig3(io.env).profiles[profileName]?.connectKeys?.[hub.name] : void 0;
+      hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
+      const stale = hub.name ? loadConfig4(io.env).profiles[profileName]?.connectKeys?.[hub.name] : void 0;
       if (stale && hub.name) {
         const auth = new CliAuthClient({
-          baseUrl: profileUrl2(loadConfig3(io.env).profiles[profileName]),
+          baseUrl: profileUrl3(loadConfig4(io.env).profiles[profileName]),
           ...io.fetch ? { fetch: io.fetch } : {}
         });
         await auth.revoke(stale.apiKey).catch(() => void 0);
-        removeConnectKey2(io.env, profileName, hub.name);
+        removeConnectKey3(io.env, profileName, hub.name);
       }
       let outcome;
       try {
-        outcome = await connectOnDemand({ ...connectOptions(ctx), profileName, cached: false });
+        outcome = await connect(ctx, { profileName, cached: false });
       } catch (e) {
         if (!(e instanceof CliUsageError) || !/rejected/.test(e.message))
           throw e;
         io.err.write("The stored Antasphere login was rejected: signing in again.\n");
         await hubLogin(opts);
-        hub = activeHubProfile(io.env);
-        outcome = await connectOnDemand({ ...connectOptions(ctx), profileName, cached: false });
+        hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
+        outcome = await connect(ctx, { profileName, cached: false });
       }
       if (outcome.outcome === "not_cloud") {
         throw new CliUsageError(`${baseUrl} stopped answering as an Antasphere-cloud instance; try again.`);
@@ -4709,11 +4785,11 @@ API key "${minted.keyName}" (${redactKey(minted.key)}) saved to profile "${profi
 ${organizationsLine(me)}`);
   });
   async function hubLogout() {
-    const hub = activeHubProfile(io.env);
+    const hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
     if (!hub.name || !hub.profile?.apiKey)
       return null;
     const auth = new CliAuthClient({
-      baseUrl: profileUrl2(hub.profile),
+      baseUrl: hub.profile.baseUrl?.trim() || DEFAULT_HUB_URL,
       ...io.fetch ? { fetch: io.fetch } : {}
     });
     let revoked = false;
@@ -4737,7 +4813,7 @@ ${organizationsLine(me)}`);
     const ctx = resolveContext2(cmd, io);
     const profileName = ctx.profileName;
     const profile = profileName ? ctx.config.profiles[profileName] : void 0;
-    const hubLogin2 = activeHubProfile(io.env).profile;
+    const hubLogin2 = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL }).profile;
     if (!profileName || !profile) {
       if (hubLogin2?.apiKey) {
         if (opts.all) {
@@ -4752,7 +4828,7 @@ ${organizationsLine(me)}`);
       }
       throw new CliUsageError("No profile to log out of.");
     }
-    const baseUrl = profileUrl2(profile);
+    const baseUrl = profileUrl3(profile);
     const auth = new CliAuthClient({ baseUrl, ...io.fetch ? { fetch: io.fetch } : {} });
     let revoked = 0;
     let refused = 0;
@@ -4776,16 +4852,16 @@ ${organizationsLine(me)}`);
     const slots = Object.entries(profile.connectKeys ?? {});
     for (const [slot, entry] of slots) {
       await revoke(entry.apiKey, `the key of the Antasphere login "${slot}"`);
-      removeConnectKey2(io.env, profileName, slot);
+      removeConnectKey3(io.env, profileName, slot);
     }
     if (profile.apiKey)
       await revoke(profile.apiKey, "the profile key");
-    const config3 = loadConfig3(io.env);
+    const config3 = loadConfig4(io.env);
     const current = config3.profiles[profileName];
     if (current) {
       delete current.apiKey;
       delete current.email;
-      saveConfig3(io.env, config3);
+      saveConfig4(io.env, config3);
     }
     const ended = opts.all ? await hubLogout() : null;
     if (globals.json) {
@@ -4813,7 +4889,7 @@ ${organizationsLine(me)}`);
     await requireApiKey2(ctx);
     const me = await ctx.client.me();
     const source = workspaceSource(ctx);
-    const hub = activeHubProfile(io.env);
+    const hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
     const hubLine = hubLoginLine(ctx, hub.profile);
     if (ctx.json) {
       return printJson2(io, {
@@ -4861,7 +4937,7 @@ ${organizationsLine(me)}`);
   });
   program2.command("use <profile>").description("Switch the active profile (the instance the commands run against)").action(async (name, _opts, cmd) => {
     const globals = cmd.optsWithGlobals();
-    const config3 = loadConfig3(io.env);
+    const config3 = loadConfig4(io.env);
     if (!config3.profiles[name]) {
       if (name !== CLOUD_PROFILE) {
         throw new CliUsageError(`Unknown profile "${name}" \u2014 run \`${identity.bin} profiles\`.`);
@@ -4869,16 +4945,16 @@ ${organizationsLine(me)}`);
       config3.profiles[name] = { baseUrl: normalizeUrl(identity.cloudUrl) };
     }
     config3.activeProfile = name;
-    saveConfig3(io.env, config3);
+    saveConfig4(io.env, config3);
     if (globals.json)
       return printJson2(io, { activeProfile: name });
-    io.out.write(`Active profile: ${name} (${profileUrl2(config3.profiles[name])})
+    io.out.write(`Active profile: ${name} (${profileUrl3(config3.profiles[name])})
 `);
   });
   program2.command("profiles").description("List the profiles (one per instance) and how each signs in").action(async (_opts, cmd) => {
     const globals = cmd.optsWithGlobals();
-    const config3 = loadConfig3(io.env);
-    const hub = activeHubProfile(io.env);
+    const config3 = loadConfig4(io.env);
+    const hub = selectHubProfile(io.env, { cloudUrl: DEFAULT_HUB_URL });
     const rows = Object.entries(config3.profiles);
     if (!config3.profiles[CLOUD_PROFILE])
       rows.unshift([CLOUD_PROFILE, { baseUrl: normalizeUrl(identity.cloudUrl) }]);
@@ -4890,8 +4966,9 @@ ${organizationsLine(me)}`);
       if (entry)
         return { kind: "hub", text: `via Antasphere${entry.email ? ` (${entry.email})` : ""}` };
       const others = Object.keys(p.connectKeys ?? {});
+      const chosen = firstSet(io.env[HUB_URL_ENV2]) ? "not the one ANTASPHERE_URL names" : "not the active one";
       if (others.length > 0)
-        return { kind: "hub", text: `via Antasphere (login "${others.join('", "')}", not the active one)` };
+        return { kind: "hub", text: `via Antasphere (login "${others.join('", "')}", ${chosen})` };
       return { kind: "none", text: "(not signed in)" };
     };
     if (globals.json) {
@@ -4903,7 +4980,7 @@ ${organizationsLine(me)}`);
           return [
             n,
             {
-              baseUrl: profileUrl2(p),
+              baseUrl: profileUrl3(p),
               saved: Boolean(config3.profiles[n]),
               credential: cred.kind,
               apiKey: p.apiKey ? redactKey(p.apiKey) : null,
@@ -4914,20 +4991,20 @@ ${organizationsLine(me)}`);
         }))
       });
     }
-    io.out.write(table(rows.map(([n, p]) => [activeName === n ? "*" : " ", n, profileUrl2(p), credentialOf(p).text])));
+    io.out.write(table(rows.map(([n, p]) => [activeName === n ? "*" : " ", n, profileUrl3(p), credentialOf(p).text])));
   });
   const config2 = program2.command("config").description("Inspect or reset the CLI config file");
   config2.command("show").description("Show the config path, active profile, and redacted keys").action(async (_opts, cmd) => {
     const globals = cmd.optsWithGlobals();
-    const cfg = loadConfig3(io.env);
-    const path = configPath2(io.env);
+    const cfg = loadConfig4(io.env);
+    const path = configPath3(io.env);
     const redacted = {
       path,
       activeProfile: cfg.activeProfile ?? null,
       profiles: Object.fromEntries(Object.entries(cfg.profiles).map(([n, p]) => [
         n,
         {
-          baseUrl: profileUrl2(p),
+          baseUrl: profileUrl3(p),
           apiKey: p.apiKey ? redactKey(p.apiKey) : null,
           email: p.email ?? null,
           // Hub-connected keys (one per hub profile), redacted like the rest.
@@ -4944,14 +5021,14 @@ ${organizationsLine(me)}`);
   });
   config2.command("clear").description("Delete the config file (all profiles and stored keys)").action(async (_opts, cmd) => {
     const globals = cmd.optsWithGlobals();
-    clearConfig2(io.env);
+    clearConfig3(io.env);
     if (globals.json)
       return printJson2(io, { cleared: true });
     io.out.write("Config cleared.\n");
   });
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/workspaces.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/workspaces.js
 function registerWorkspaceCommands(kit, program2, io) {
   const { requireApiKey: requireApiKey2, resolveContext: resolveContext2, workspaceSource } = kit;
   const { describeSelection } = kit.workspace;
@@ -5023,7 +5100,7 @@ function registerWorkspaceCommands(kit, program2, io) {
   });
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/teams.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/teams.js
 function explainTeamRefusal(e, ctx) {
   switch (e.code) {
     case "forbidden":
@@ -5227,7 +5304,7 @@ ${teamLines(team)}`);
   });
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/projects.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/projects.js
 var ROLES = ["viewer", "editor", "manager"];
 function parseRole(value) {
   if (ROLES.includes(value))
@@ -20016,7 +20093,7 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/common.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/common.js
 var apiErrorSchema = external_exports.object({
   error: external_exports.object({
     code: external_exports.string(),
@@ -20121,12 +20198,12 @@ function isValidMediaType(value) {
   return value.length >= 1 && value.length <= 255 && isLatin1(value) && MEDIA_TYPE_RE.test(value);
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/scope.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/scope.js
 function defineScopeSchema(scopes) {
   return external_exports.enum(scopes);
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/seams.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/seams.js
 var KNOWN_AUTH_METHODS = [
   "password",
   "email-otp",
@@ -21710,7 +21787,7 @@ var HUB_TOOL_WIRE_INPUTS = {
   }
 };
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/entitlements.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/entitlements.js
 var entitlementTierSchema = billingPlanSchema;
 var entitlementActionSchema = external_exports.object({
   key: external_exports.string().min(1),
@@ -21744,7 +21821,7 @@ var entitlementProfileSchema = external_exports.object({
   upgradeUrl: external_exports.string()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/instance.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/instance.js
 var instanceInfoSchema2 = external_exports.object({
   name: external_exports.string(),
   instanceId: external_exports.string().nullable(),
@@ -21794,6 +21871,14 @@ var instanceInfoSchema2 = external_exports.object({
    * false, so the self-hosted discovery bytes are unchanged.
    */
   restricted: external_exports.boolean().optional(),
+  /**
+   * The tool's own CLI package (cloud edition, PRDCT-3312): present only when
+   * the instance was released with it (`CLI_PACKAGE_DIR`), naming the npm
+   * package `POST /cli/package` serves and its version. The `team` command
+   * reads it to know what it installs and whether to update. ABSENT
+   * otherwise, so older discovery bytes are unchanged.
+   */
+  cli: external_exports.object({ name: external_exports.string(), version: external_exports.string() }).optional(),
   /**
    * What this version of the tool declares for the billing rail (its priced
    * actions with their default credits, its limits and features per tier):
@@ -21805,7 +21890,7 @@ var instanceInfoSchema2 = external_exports.object({
   entitlements: toolEntitlementsSchema.optional()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/setup.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/setup.js
 var setupRequestSchema2 = external_exports.object({
   instanceName: plainText(1, 120),
   owner: external_exports.object({
@@ -21822,7 +21907,7 @@ var setupResponseSchema2 = external_exports.object({
   ownerUserId: external_exports.string()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/workspaces.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/workspaces.js
 var lookKey2 = external_exports.string().regex(/^[a-z][a-z0-9-]{0,31}$/, "a short lowercase key").nullable();
 var lookLevel2 = external_exports.number().min(0).max(1).nullable();
 var workspaceLookSchema2 = external_exports.object({
@@ -21862,7 +21947,7 @@ var workspaceUpdatedSchema2 = external_exports.object({
   })
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/me.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/me.js
 var onboardingDismissedSchema = external_exports.object({
   dismissed: external_exports.literal(true)
 });
@@ -22014,7 +22099,7 @@ function defineMeSchemas(scopeSchema3) {
   return { meResponseSchema: meResponseSchema3 };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/members.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/members.js
 var memberSchema2 = external_exports.object({
   id: external_exports.string(),
   userId: external_exports.string(),
@@ -22048,7 +22133,7 @@ var memberChangeEmailLinkSchema2 = external_exports.object({
   expiresAt: external_exports.string()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/cli-auth.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/cli-auth.js
 var cliAuthRequestSchema2 = external_exports.object({
   email: external_exports.email()
 });
@@ -22090,7 +22175,7 @@ function defineCliAuthSchemas(apiKeySchema3) {
   return { cliAuthCompletedSchema: cliAuthCompletedSchema3 };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/sso-connect.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/sso-connect.js
 var ssoCliConnectSchema = external_exports.object({
   /** The hub-minted exchange JWT (compact JWS — three base64url segments). */
   token: external_exports.string().min(20).max(4096),
@@ -22105,12 +22190,18 @@ var ssoCliConnectSchema = external_exports.object({
   hubRefreshToken: external_exports.string().min(20).max(512).optional()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/sso-logout.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/cli-package.js
+var cliPackageRequestSchema = external_exports.object({
+  /** The hub-minted exchange JWT (compact JWS — three base64url segments). */
+  token: external_exports.string().min(1)
+});
+
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/sso-logout.js
 var ssoLogoutResponseSchema = external_exports.object({
   url: external_exports.string().nullable()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/invitations.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/invitations.js
 var invitationSchema2 = external_exports.object({
   id: external_exports.string(),
   email: external_exports.string(),
@@ -22152,7 +22243,7 @@ var invitationAcceptedSchema2 = external_exports.object({
   role: workspaceRoleSchema
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/audit.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/audit.js
 var auditEntrySchema2 = external_exports.object({
   id: external_exports.number(),
   actorUserId: external_exports.string().nullable(),
@@ -22197,7 +22288,7 @@ var auditListSchema2 = external_exports.object({
   total: external_exports.number().int().nullable()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/break-glass.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/break-glass.js
 var breakGlassClaimOwnershipRequestSchema2 = external_exports.object({
   userId: external_exports.string().min(1).optional(),
   workspaceId: external_exports.uuid().optional()
@@ -22222,7 +22313,7 @@ var breakGlassResetTwoFactorSchema2 = external_exports.object({
   hadTwoFactor: external_exports.boolean()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/files.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/files.js
 var fileSchema2 = external_exports.object({
   id: external_exports.string(),
   sha256: external_exports.string(),
@@ -22247,7 +22338,7 @@ var fileUploadQuerySchema2 = external_exports.object({
   name: plainText(1, 255)
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/projects.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/projects.js
 var projectRoleSchema = external_exports.enum(["manager", "editor", "viewer"]);
 var PROJECT_METADATA_MAX_LENGTH = 16 * 1024;
 var projectMetadataSchema = opaqueJsonChecks(external_exports.record(external_exports.string(), external_exports.unknown())).refine((v) => JSON.stringify(v).length <= PROJECT_METADATA_MAX_LENGTH, `metadata must serialize to at most ${PROJECT_METADATA_MAX_LENGTH} characters`);
@@ -22335,7 +22426,7 @@ var projectMemberParamsSchema = external_exports.object({
 });
 var projectTeamParamsSchema = external_exports.object({ id: external_exports.uuid(), teamId: external_exports.uuid() });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/teams.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/teams.js
 var teamSlugSchema2 = external_exports.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "lowercase letters and digits, joined by single dashes").min(1).max(60);
 var teamSchema2 = external_exports.object({
   id: external_exports.string(),
@@ -22389,7 +22480,7 @@ var teamMemberParamsSchema = external_exports.object({
   userId: noControlChars(external_exports.string().min(1).max(200))
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/demo-passes.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/demo-passes.js
 var DEMO_PASS_MAX_MINUTES2 = 10080;
 var demoPassSchema2 = external_exports.object({
   id: external_exports.string(),
@@ -22430,7 +22521,7 @@ var demoPassRedeemedSchema2 = external_exports.object({
   expiresAt: external_exports.string()
 });
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/api-keys.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/schemas/api-keys.js
 function defineApiKeySchemas(scopeSchema3) {
   const apiKeySchema3 = external_exports.object({
     id: external_exports.string(),
@@ -22475,7 +22566,7 @@ function defineApiKeySchemas(scopeSchema3) {
   return { apiKeySchema: apiKeySchema3, apiKeysListSchema: apiKeysListSchema3, apiKeyCreateSchema: apiKeyCreateSchema3, apiKeyCreatedSchema: apiKeyCreatedSchema3 };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/define.js
+// ../../node_modules/.pnpm/@antasphere+chassis-contract@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-contract/dist/define.js
 function defineChassisContract(tool) {
   return buildChassisContract(defineScopeSchema(tool.scopes));
 }
@@ -22489,7 +22580,7 @@ function buildChassisContract(scopeSchema3) {
   };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/owner-session.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/owner-session.js
 var SIGN_IN_WAITS_MS = [4e3, 8e3, 12e3];
 var SESSION_COOKIE = /session_token$/;
 function sessionCookie(res) {
@@ -22570,7 +22661,7 @@ async function withOwnerSession(ctx, options, run2) {
   }
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/demo.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/demo.js
 var SWITCH_OFF = "Demo sign-in is off on this instance (DEMO_SIGN_IN), or this is the cloud edition, where demo links are minted at the Antasphere hub.";
 var NOT_AN_OWNER = "Only an owner of this workspace manages demo links: the account that signed in is not one.";
 var REFUSALS = /* @__PURE__ */ new Set([
@@ -22724,14 +22815,14 @@ function registerDemoCommands(kit, program2, io) {
   });
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/files.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/files.js
 import { createWriteStream } from "node:fs";
 import { mkdir as mkdir2, readFile, writeFile } from "node:fs/promises";
 import { basename, resolve as resolve2, win32 } from "node:path";
 import { Readable } from "node:stream";
 import { pipeline as pipeline2 } from "node:stream/promises";
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/safe-write.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/safe-write.js
 import { constants as FS } from "node:fs";
 import { mkdir, open, realpath, unlink } from "node:fs/promises";
 import { dirname as dirname2, isAbsolute, relative, resolve } from "node:path";
@@ -22812,7 +22903,7 @@ async function streamContained(root, relPath, source) {
   }
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/files.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/files.js
 function safeDownloadName(originalName) {
   const name = basename(win32.basename(originalName));
   if (name === "" || name === "." || name === ".." || name.startsWith(".")) {
@@ -22939,7 +23030,7 @@ function registerFileCommands(kit, program2, io) {
   });
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/completion.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/commands/completion.js
 function commandTree(program2) {
   return program2.commands.filter((c) => !c.name().startsWith("help")).map((c) => ({
     name: c.name(),
@@ -23014,7 +23105,7 @@ function registerCompletionCommand(identity, program2, io) {
   });
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/program.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/program.js
 function creditFigures(credit) {
   const parts = [
     typeof credit?.credits === "number" ? `this needs ${credit.credits} credits` : null,
@@ -23096,21 +23187,7 @@ function createProgram(kit, definition) {
   return { buildProgram, run: run2 };
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/identity.js
-function cliIdentity(identity) {
-  return {
-    bin: identity.cli.bin,
-    tool: identity.slug,
-    legacyConfigDir: identity.cli.legacyConfigDir,
-    displayName: identity.displayName,
-    envPrefix: identity.cli.envPrefix,
-    keyPrefix: identity.apiKeyPrefix,
-    exportScope: identity.scopes.dataExport,
-    cloudUrl: identity.cloud.url
-  };
-}
-
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/open.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/open.js
 import { spawn } from "node:child_process";
 function platformOpener(platform = process.platform) {
   if (platform === "darwin")
@@ -23136,7 +23213,7 @@ function isInteractive(io) {
   return io.out.isTTY === true;
 }
 
-// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.0.2_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/index.js
+// ../../node_modules/.pnpm/@antasphere+chassis-cli@1.1.0_hono@4.12.27/node_modules/@antasphere/chassis-cli/dist/index.js
 function defineCli(definition) {
   const { identity, createClient } = definition;
   const config2 = createConfig(identity);
@@ -23881,6 +23958,33 @@ var formResponsesSummarySchema = external_exports.object({
   total: external_exports.number().int()
 });
 
+// ../contract/dist/schemas/apps.js
+var appEntrySchema = external_exports.object({
+  /** The tool's registry slug (`finance`, `hiring`, …): what picks its drawing and its sentence. */
+  slug: external_exports.string(),
+  /** The tool's display name. */
+  name: external_exports.string(),
+  /** Where opening the tool lands. */
+  launchUrl: external_exports.string(),
+  /** The operator's own sentence for the tool (the file source), else null. */
+  description: external_exports.string().nullable(),
+  /** The person has signed in to the tool (the hub source); false when nothing says so. */
+  connected: external_exports.boolean(),
+  /** When the person first signed in to the tool (the hub source), else null. */
+  firstUsedAt: external_exports.string().nullable(),
+  /** When the person last signed in to the tool (the hub source), else null. */
+  lastUsedAt: external_exports.string().nullable(),
+  /** This very tool: the page shows it, with no button. */
+  current: external_exports.boolean()
+});
+var APP_SOURCES = ["hub", "file", "none"];
+var appsListSchema = external_exports.object({
+  apps: external_exports.array(appEntrySchema),
+  /** The account that signs the person in (the hub), when the instance knows one. */
+  hub: external_exports.object({ url: external_exports.string(), name: external_exports.string() }).nullable(),
+  source: external_exports.enum(APP_SOURCES)
+});
+
 // ../contract/dist/embed.js
 var EMBED_PLACEMENT_RE = /^[A-Za-z0-9._-]{1,64}$/;
 function buildEmbedSnippets(opts) {
@@ -24329,6 +24433,13 @@ var PlatformClient = class extends ChassisClient {
   deleteFormResponse(id, responseId) {
     return this.request("DELETE", `/presentations/${encodeURIComponent(id)}/responses/${encodeURIComponent(responseId)}`);
   }
+  // ── Apps ──────────────────────────────────────────────────────────────────
+  // The other tools of the organization: a browser session's alone (an API key
+  // or an OAuth token is refused 403). `me()` is the chassis client's.
+  /** The tools the caller may open, the account that signs them in, and where the list came from. */
+  apps() {
+    return this.request("GET", "/apps");
+  }
 };
 
 // src/cli.ts
@@ -24348,6 +24459,16 @@ var requireApiKey = cli.requireApiKey;
 import { readFile as readFile3, stat as stat2 } from "node:fs/promises";
 import { join as join4 } from "node:path";
 
+// ../../node_modules/.pnpm/@antasphere+cli-core@0.5.0/node_modules/@antasphere/cli-core/dist/resolve.js
+var CliUsageError2 = class extends Error {
+  exitCode;
+  constructor(message, opts = {}) {
+    super(message);
+    this.name = "CliUsageError";
+    this.exitCode = opts.exitCode ?? 1;
+  }
+};
+
 // src/manifest.ts
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
@@ -24603,7 +24724,7 @@ function isReferenceType(value) {
 function parseReferenceType(value) {
   const wanted = value.trim().toLowerCase();
   if (isReferenceType(wanted)) return wanted;
-  throw new CliUsageError(`--type must be one of ${REFERENCE_TYPES.join(", ")} (got "${value}")`);
+  throw new CliUsageError2(`--type must be one of ${REFERENCE_TYPES.join(", ")} (got "${value}")`);
 }
 var OPEN_FENCE = /^---[ \t]*$/;
 var CLOSE_FENCE = /^(?:---|\.\.\.)[ \t]*$/;
@@ -24685,7 +24806,7 @@ function referenceLines(refs) {
 }
 function resolveReference(candidates, value, what) {
   const wanted = value.trim();
-  if (!wanted) throw new CliUsageError(`Name a ${what}: its id, its title, or the start of its title.`);
+  if (!wanted) throw new CliUsageError2(`Name a ${what}: its id, its title, or the start of its title.`);
   if (isDeckId(wanted)) {
     const byId = candidates.find((r) => r.id.toLowerCase() === wanted.toLowerCase());
     if (byId) return byId;
@@ -24697,13 +24818,13 @@ function resolveReference(candidates, value, what) {
   const prefixed = candidates.filter((r) => r.title.trim().toLowerCase().startsWith(lower));
   if (prefixed.length === 1) return prefixed[0];
   if (prefixed.length > 1) throw ambiguous(prefixed, wanted, what);
-  throw new CliUsageError(
+  throw new CliUsageError2(
     `No ${what} named "${wanted}" among the ones you can read` + (candidates.length > 0 ? `. Yours:
 ${referenceLines(candidates)}` : ` (there are none).`)
   );
 }
 function ambiguous(matches, wanted, what) {
-  return new CliUsageError(
+  return new CliUsageError2(
     `"${wanted}" names several ${what}s. Name one by its id:
 ${referenceLines(matches)}`
   );
@@ -24712,7 +24833,7 @@ function splitRefAtVersion(value) {
   const m = value.match(/^(.*)@(\d+)$/);
   if (!m) return { ref: value, version: void 0 };
   const version2 = Number(m[2]);
-  if (version2 < 1) throw new CliUsageError(`"${value}": a version is a whole number from 1.`);
+  if (version2 < 1) throw new CliUsageError2(`"${value}": a version is a whole number from 1.`);
   return { ref: m[1], version: version2 };
 }
 var PROVENANCE_KEY = "references";
@@ -27419,7 +27540,7 @@ async function zipMode(ctx, io, id, responseId, filters, zip) {
 }
 
 // src/index.ts
-var VERSION = "0.13.7";
+var VERSION = "0.13.8";
 function registerTool(program2, io) {
   registerDeckCommands(program2, io);
   registerContentCommands(program2, io);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@antasphere/slideless",
-  "version": "0.13.7",
+  "version": "0.13.8",
   "description": "The Slideless CLI — push, share, pull, and preview decks on a Slideless instance",
   "license": "SEE LICENSE IN LICENSE",
   "repository": {
@@ -36,9 +36,9 @@
     "test": "vitest run --passWithNoTests"
   },
   "devDependencies": {
-    "@antasphere/chassis-cli": "1.0.2",
-    "@antasphere/chassis-contract": "1.0.2",
-    "@antasphere/chassis-sdk": "1.0.2",
+    "@antasphere/chassis-cli": "1.1.0",
+    "@antasphere/chassis-contract": "1.1.0",
+    "@antasphere/chassis-sdk": "1.1.0",
     "@antasphere/cli-core": "^0.5.0",
     "@slideless/contract": "workspace:*",
     "@slideless/sdk": "workspace:*",