@nocobase/app-cli-distribution 0.0.0-stage → 0.1.0-beta.1

package/dist/public-install.js

@@ -0,0 +1,164 @@
+import { DIST_PRODUCT_PATTERN } from '@nocobase/agent-protocol';
+import { npmLauncherScript } from '@nocobase/app-cli-client/install';
+import { apiErrorResponse, cliRoute, describeRoute, } from '@nocobase/app-server/router';
+import { Hono } from 'hono';
+import { requestedServer } from './install.js';
+const SAFE_SERVER = /^https?:\/\/[A-Za-z0-9.:[\]_-]+(?:\/[A-Za-z0-9._~/-]*)?$/u;
+/** A separate CLI-only installer. It neither changes nor extends the protected installation protocol. */
+export function publicInstallScript(options) {
+    if (!DIST_PRODUCT_PATTERN.test(options.cli) ||
+        options.cli === 'nocobase-runner')
+        throw new Error(`Not a CLI command name: ${options.cli}`);
+    const server = options.server ?? '';
+    return PUBLIC_INSTALL_SCRIPT.replaceAll('@CLI@', options.cli).replace('@DEFAULT_SERVER@', SAFE_SERVER.test(server) ? server.replace(/\/+$/u, '') : '');
+}
+/** Mount explicitly alongside a host's independently configured public artifact admission. */
+export function createPublicInstallRoutes(options) {
+    return new Hono().get('/installScript', describeRoute(options.openapi ?? {
+        tags: ['CliDistribution'],
+        summary: 'Get the public CLI install script',
+        operationId: 'cliDistributionPublicInstallScript',
+        ...cliRoute(false),
+        security: [],
+        responses: {
+            200: {
+                description: 'A public CLI-only POSIX shell script.',
+                content: { 'text/x-shellscript': { schema: { type: 'string' } } },
+            },
+            500: apiErrorResponse(500),
+        },
+    }), (context) => context.body(publicInstallScript({
+        cli: options.cli(),
+        server: requestedServer(context, options),
+    }), 200, {
+        'content-type': 'text/x-shellscript; charset=utf-8',
+        'cache-control': 'no-cache',
+    }));
+}
+// Kept independent of the protected script and its extension points, intentionally allowing some duplication.
+const PUBLIC_INSTALL_SCRIPT = `#!/bin/sh
+# Installs the publicly downloadable @CLI@ CLI. Business access requires a separate login.
+set -eu
+usage() {
+  cat <<'USAGE'
+Usage: install.sh [--server <url>] [--prefix <dir>] [--bin-dir <dir>] [--dry-run]
+
+Requires Node.js 24+, curl, tar and a SHA-256 tool. Supports macOS/Linux and Windows through WSL.
+USAGE
+}
+cli=@CLI@
+server="@DEFAULT_SERVER@"
+prefix="\${NOCOBASE_CLI_INSTALL_DIR:-}"
+bin_dir="\${NOCOBASE_CLI_BIN_DIR:-}"
+dry_run=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --server|--prefix|--bin-dir)
+      [ $# -ge 2 ] && [ -n "$2" ] || { usage >&2; exit 2; }
+      case "$1" in
+        --server) server="$2" ;;
+        --prefix) prefix="$2" ;;
+        --bin-dir) bin_dir="$2" ;;
+      esac
+      shift 2 ;;
+    --dry-run) dry_run=1; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo 'Unknown installation option.' >&2; usage >&2; exit 2 ;;
+  esac
+done
+[ -n "$server" ] || { usage >&2; exit 2; }
+say() { printf '%s\\n' "$*"; }
+fail() { printf '%s install: %s\\n' "$cli" "$*" >&2; exit 1; }
+run() { if [ "$dry_run" = 1 ]; then say "+ $*"; else "$@"; fi; }
+case "$(uname -s)" in
+  Darwin) os=darwin ;;
+  Linux) os=linux ;;
+  *) fail 'Use macOS, Linux or WSL.' ;;
+esac
+case "$(uname -m)" in
+  arm64|aarch64) arch=arm64 ;;
+  x86_64|amd64) arch=x64 ;;
+  *) fail 'Unsupported processor.' ;;
+esac
+target="\${NOCOBASE_CLI_TARGET:-$os-$arch}"
+node_bin="$(command -v node 2>/dev/null || true)"
+[ -n "$node_bin" ] || fail 'Node.js 24 or newer is required.'
+node_version="$("$node_bin" -p 'process.versions.node' 2>/dev/null || true)"
+case "$node_version" in ''|*[!0-9.]*) fail 'Node.js 24 or newer is required.' ;; esac
+[ "\${node_version%%.*}" -ge 24 ] || fail 'Node.js 24 or newer is required.'
+# Validate without printing an invalid address, which could accidentally contain a credential.
+server="$("$node_bin" -e 'try { const u = new URL(process.argv[1]); if (!["http:", "https:"].includes(u.protocol) || u.username || u.password || u.search || u.hash) throw Error(); console.log(u.href.replace(/\\/+$/, "")); } catch { process.exit(2); }' "$server")" || { echo 'Use an HTTP(S) application URL without credentials, query or fragment.' >&2; exit 2; }
+prefix="\${prefix:-$HOME/.local/share/$cli}"
+bin_dir="\${bin_dir:-$HOME/.local/bin}"
+prefix="$("$node_bin" -e 'console.log(require("node:path").resolve(process.argv[1]))' "$prefix")"
+bin_dir="$("$node_bin" -e 'console.log(require("node:path").resolve(process.argv[1]))' "$bin_dir")"
+command -v curl >/dev/null 2>&1 || fail 'curl is required.'
+command -v tar >/dev/null 2>&1 || fail 'tar is required.'
+if command -v sha256sum >/dev/null 2>&1; then
+  sha256() { sha256sum "$1" | cut -d ' ' -f 1; }
+elif command -v shasum >/dev/null 2>&1; then
+  sha256() { shasum -a 256 "$1" | cut -d ' ' -f 1; }
+else
+  fail 'sha256sum or shasum is required.'
+fi
+tmp="$(mktemp -d)"
+trap 'rm -rf "$tmp"' EXIT INT TERM
+field() { sed -n "s/^$1=//p" "$tmp/resolve" | head -n 1; }
+status="$(curl -sS -o "$tmp/resolve" -w '%{http_code}' "$server/api/agents/dist/products/$cli/targets/$target?format=env&accept=npm")" || fail 'Could not reach the application.'
+[ "$status" = 200 ] || fail "The application answered $status while resolving the CLI."
+version="$(field version)"
+case "$version" in ''|.|..|*[!0-9A-Za-z.+-]*) fail 'The application named an unexpected version.' ;; esac
+kind="$(field kind)"
+dest="$prefix/versions/$version"
+if [ "$kind" = npm ]; then
+  package="$(field package)"
+  case "$package" in ''|*[!0-9a-z@/._~-]*) fail 'The application named an unexpected npm package.' ;; esac
+  npm_bin="\${NOCOBASE_NPM:-$(command -v npm 2>/dev/null || true)}"
+  [ -n "$npm_bin" ] && [ -x "$npm_bin" ] || fail 'npm is required for this package.'
+else
+  url="$(field url)"
+  checksum="$(field sha256)"
+  case "$url" in /*) ;; *) fail 'The application named an unexpected download.' ;; esac
+  case "$checksum" in *[!0-9a-f]*|'') fail 'The application named an unexpected checksum.' ;; esac
+fi
+if [ ! -x "$dest/bin/$cli" ]; then
+  if [ "$kind" = npm ]; then
+    run rm -rf "$dest.partial"
+    run mkdir -p "$dest.partial"
+    run "$npm_bin" install --prefix "$dest.partial" --no-save --no-audit --no-fund --omit=optional "$package@$version"
+    if [ "$dry_run" = 0 ]; then
+      [ -e "$dest.partial/node_modules/.bin/$cli" ] || fail 'The package provides no CLI command.'
+      mkdir -p "$dest.partial/bin"
+      cat <<'LAUNCHER' >"$dest.partial/bin/$cli"
+${npmLauncherScript()}LAUNCHER
+      chmod 755 "$dest.partial/bin/$cli"
+    fi
+    run mv "$dest.partial" "$dest"
+  else
+    run curl -fSL --progress-bar -o "$tmp/cli.tar.gz" "$server$url" || fail 'CLI download failed.'
+    if [ "$dry_run" = 0 ]; then
+      actual="$(sha256 "$tmp/cli.tar.gz")"
+      [ "$actual" = "$checksum" ] || fail 'The download does not match its SHA-256.'
+      say 'Checksum verified.'
+    fi
+    run rm -rf "$dest.partial"
+    run mkdir -p "$dest.partial"
+    run tar -xzf "$tmp/cli.tar.gz" -C "$dest.partial" --strip-components=1 || fail 'Could not unpack the CLI archive.'
+    if [ "$dry_run" = 0 ]; then
+      [ -x "$dest.partial/bin/$cli" ] || fail 'The archive provides no CLI command.'
+    fi
+    run mv "$dest.partial" "$dest"
+  fi
+fi
+run ln -sfn "versions/$version" "$prefix/current"
+run ln -sfn "$node_bin" "$prefix/node"
+run mkdir -p "$bin_dir"
+run ln -sfn "$prefix/current/bin/$cli" "$bin_dir/$cli"
+if [ "$dry_run" = 0 ]; then
+  "$node_bin" -e 'console.log(JSON.stringify({prefix: process.argv[1], binLink: process.argv[2], mode: "cli"}, null, 2))' "$prefix" "$bin_dir/$cli" >"$prefix/install.json"
+fi
+if [ "$dry_run" = 1 ]; then say 'Dry run: no installation was changed.'; else say "$cli is installed: $bin_dir/$cli"; fi
+case ":$PATH:" in *":$bin_dir:"*) ;; *) say "Add $bin_dir to your PATH." ;; esac
+say "Next: $cli login --server $server"
+`;
+//# sourceMappingURL=public-install.js.map

package/dist/public-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-install.js","sourceRoot":"","sources":["../src/public-install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EACL,gBAAgB,EAChB,QAAQ,EACR,aAAa,GAEd,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAE/C,MAAM,WAAW,GAAG,2DAA2D,CAAC;AAOhF,yGAAyG;AACzG,MAAM,UAAU,mBAAmB,CACjC,OAAmC;IAEnC,IACE,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;QACvC,OAAO,CAAC,GAAG,KAAK,iBAAiB;QAEjC,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,OAAO,qBAAqB,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CACnE,kBAAkB,EAClB,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAC5D,CAAC;AACJ,CAAC;AASD,8FAA8F;AAC9F,MAAM,UAAU,yBAAyB,CACvC,OAAmC;IAEnC,OAAO,IAAI,IAAI,EAAE,CAAC,GAAG,CACnB,gBAAgB,EAChB,aAAa,CACX,OAAO,CAAC,OAAO,IAAI;QACjB,IAAI,EAAE,CAAC,iBAAiB,CAAC;QACzB,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,oCAAoC;QACjD,GAAG,QAAQ,CAAC,KAAK,CAAC;QAClB,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE;YACT,GAAG,EAAE;gBACH,WAAW,EAAE,uCAAuC;gBACpD,OAAO,EAAE,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;aAClE;YACD,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC;SAC3B;KACF,CACF,EACD,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,IAAI,CACV,mBAAmB,CAAC;QAClB,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,EAAE,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC;KAC1C,CAAC,EACF,GAAG,EACH;QACE,cAAc,EAAE,mCAAmC;QACnD,eAAe,EAAE,UAAU;KAC5B,CACF,CACJ,CAAC;AACJ,CAAC;AAED,8GAA8G;AAC9G,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8F5B,iBAAiB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BpB,CAAC"}

package/dist/routes.d.ts

@@ -0,0 +1,29 @@
+import { type DistArtifact, type DistNpmPackage, type DistResolution } from '@nocobase/agent-protocol';
+import type { Context, Hono, MiddlewareHandler } from 'hono';
+import type { DistService } from './artifacts.js';
+import type { DownloadTokenService } from './download-tokens.js';
+export type Admission = (context: Context) => Promise<boolean>;
+export interface DistributionRoutesOptions {
+    readonly artifacts: DistService;
+    /** Explicit allowed products, or 'all' when the host intentionally serves every configured product. */
+    readonly products: readonly string[] | 'all';
+    readonly admissions?: readonly Admission[];
+    readonly fallback?: MiddlewareHandler;
+    readonly mint?: {
+        readonly guard: MiddlewareHandler;
+        readonly tokens: DownloadTokenService;
+        readonly createdBy: (context: Context) => string | null;
+    };
+    readonly openapi?: Partial<Record<'mint' | 'manifest' | 'resolve' | 'file', import('@nocobase/app-server/router').DescribeRouteOptions>>;
+    readonly unauthorizedMessage?: string;
+}
+/** `key=value` lines a POSIX shell reads without a JSON parser. Values never contain a newline. */
+export declare function artifactEnv(artifact: DistArtifact): string;
+/** The same lines for an npm answer, led by `kind=npm`; only a caller that sent `accept=npm` reads them. */
+export declare function npmPackageEnv(npm: DistNpmPackage): string;
+/** `artifactEnv` or `npmPackageEnv`, whichever the answer is. */
+export declare function resolutionEnv(resolution: DistResolution): string;
+/** A token authorizes before file lookup, then binds/counts the actual artifact's platform. */
+export declare function downloadTokenAdmission(tokens: DownloadTokenService, artifacts: DistService): Admission;
+export declare function createDistributionRoutes(options: DistributionRoutesOptions): Hono;
+//# sourceMappingURL=routes.d.ts.map

package/dist/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAEA,OAAO,EAWL,KAAK,YAAY,EAEjB,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,0BAA0B,CAAC;AAUlC,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAI7D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AASjE,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/D,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,uGAAuG;IACvG,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC;IAC7C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE;QACd,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;QAClC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;QACtC,QAAQ,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,MAAM,GAAG,IAAI,CAAC;KACzD,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CACxB,MAAM,CACJ,MAAM,GAAG,UAAU,GAAG,SAAS,GAAG,MAAM,EACxC,OAAO,6BAA6B,EAAE,oBAAoB,CAC3D,CACF,CAAC;IACF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CACvC;AAED,mGAAmG;AACnG,wBAAgB,WAAW,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,CAc1D;AAED,4GAA4G;AAC5G,wBAAgB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAUzD;AAED,iEAAiE;AACjE,wBAAgB,aAAa,CAAC,UAAU,EAAE,cAAc,GAAG,MAAM,CAIhE;AAED,+FAA+F;AAC/F,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,oBAAoB,EAC5B,SAAS,EAAE,WAAW,GACrB,SAAS,CA0BX;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,GACjC,IAAI,CA2LN"}

package/dist/routes.js

@@ -0,0 +1,199 @@
+import { Readable } from 'node:stream';
+import { DIST_ACCEPT_NPM, DIST_TARGET_PATTERN, distAccepts, DistArtifactSchema, DistManifestSchema, DistNpmPackageSchema, DistResolutionSchema, HEADERS, isDistNpmPackage, ProtocolError, UNIVERSAL_TARGET, } from '@nocobase/agent-protocol';
+import { apiErrorResponse, apiErrorResponses, apiValidator, dataResponse, cliRoute, describeRoute, resolver, } from '@nocobase/app-server/router';
+import { z } from 'zod';
+import { distributionRouter } from './http.js';
+import { DistFileParams, DistTargetParams, DistTargetQuery, DownloadTokenSchema, } from './schemas.js';
+/** `key=value` lines a POSIX shell reads without a JSON parser. Values never contain a newline. */
+export function artifactEnv(artifact) {
+    const parsed = DistArtifactSchema.parse(artifact);
+    return [
+        `product=${parsed.product}`,
+        `version=${parsed.version}`,
+        `target=${parsed.target}`,
+        `url=${parsed.url}`,
+        `sha256=${parsed.sha256}`,
+        `size=${parsed.size}`,
+        `channel=${parsed.channel}`,
+        // Only for the universal tarball, so the answer for a tarball built for the platform stays as it was.
+        ...(parsed.universal === true ? ['universal=true'] : []),
+        '',
+    ].join('\n');
+}
+/** The same lines for an npm answer, led by `kind=npm`; only a caller that sent `accept=npm` reads them. */
+export function npmPackageEnv(npm) {
+    const parsed = DistNpmPackageSchema.parse(npm);
+    return [
+        `kind=${parsed.kind}`,
+        `product=${parsed.product}`,
+        `version=${parsed.version}`,
+        `package=${parsed.package}`,
+        `channel=${parsed.channel}`,
+        '',
+    ].join('\n');
+}
+/** `artifactEnv` or `npmPackageEnv`, whichever the answer is. */
+export function resolutionEnv(resolution) {
+    return isDistNpmPackage(resolution)
+        ? npmPackageEnv(resolution)
+        : artifactEnv(resolution);
+}
+/** A token authorizes before file lookup, then binds/counts the actual artifact's platform. */
+export function downloadTokenAdmission(tokens, artifacts) {
+    /** What a download token is asked for on this request: the manifest, a platform, or a tarball (which counts). */
+    return async (context) => {
+        const token = context.req.header(HEADERS.downloadToken);
+        if (!token)
+            return false;
+        const { product, target, version, file } = context.req.param();
+        if (version !== undefined && file !== undefined && product !== undefined) {
+            // Checked before the file is looked up, so an invalid token learns nothing about which files there are.
+            await tokens.admit(token, { product });
+            const found = await artifacts.file(product, version, file);
+            // The universal tarball serves every platform, so it downloads under whichever one the token is bound to.
+            await tokens.admit(token, {
+                product,
+                ...(found.target === UNIVERSAL_TARGET ? {} : { target: found.target }),
+                download: true,
+            });
+            return true;
+        }
+        await tokens.admit(token, {
+            ...(product === undefined ? {} : { product }),
+            ...(target === undefined ? {} : { target }),
+        });
+        return true;
+    };
+}
+export function createDistributionRoutes(options) {
+    const products = options.products;
+    if (products !== 'all' && !Array.isArray(products))
+        throw new Error("products must explicitly be an array or 'all'.");
+    const router = distributionRouter();
+    const artifacts = options.artifacts;
+    const allowed = async (context, next) => {
+        for (const admission of options.admissions ?? []) {
+            if (await admission(context))
+                return next();
+        }
+        if (options.fallback)
+            return options.fallback(context, next);
+        throw new ProtocolError('UNAUTHORIZED', options.unauthorizedMessage ??
+            'A download credential or sign-in is required.');
+    };
+    const productAllowed = async (context, next) => {
+        const product = context.req.param('product');
+        if (product !== undefined &&
+            products !== 'all' &&
+            !products.includes(product))
+            throw new ProtocolError('NOT_FOUND', `This application serves no ${product} on the ${artifacts.channel} channel. Build it with nocobase cli build.`);
+        return next();
+    };
+    const downloadErrors = {
+        401: apiErrorResponse(401, 'A required download credential or signed-in identity is missing or invalid.'),
+        500: apiErrorResponse(500),
+    };
+    if (options.mint !== undefined) {
+        const mint = options.mint;
+        router.post('/downloadTokens', mint.guard, describeRoute(options.openapi?.mint ?? {
+            tags: ['CliDistribution'],
+            summary: 'Create a CLI download token',
+            operationId: 'cliDistributionMint',
+            ...cliRoute(false),
+            responses: {
+                201: dataResponse(DownloadTokenSchema),
+                ...apiErrorResponses,
+            },
+        }), async (context) => {
+            return context.json({ data: await mint.tokens.create(mint.createdBy(context)) }, 201);
+        });
+    }
+    router.get('/manifest', allowed, productAllowed, describeRoute(options.openapi?.manifest ?? {
+        tags: ['CliDistribution'],
+        summary: 'Get the distribution manifest',
+        operationId: 'cliDistributionManifest',
+        ...cliRoute(false),
+        responses: { 200: dataResponse(DistManifestSchema), ...downloadErrors },
+    }), async (context) => {
+        const manifest = await artifacts.manifest();
+        return context.json({
+            data: products !== 'all'
+                ? {
+                    ...manifest,
+                    products: Object.fromEntries(Object.entries(manifest.products).filter(([product]) => products.includes(product))),
+                }
+                : manifest,
+        });
+    });
+    router.get('/products/:product/targets/:target', allowed, productAllowed, describeRoute(options.openapi?.resolve ?? {
+        tags: ['CliDistribution'],
+        summary: 'Resolve a CLI artifact',
+        operationId: 'cliDistributionResolve',
+        ...cliRoute(false),
+        responses: {
+            200: {
+                description: 'The resolved artifact or npm package.',
+                content: {
+                    'application/json': {
+                        schema: resolver(z.object({ data: DistResolutionSchema })),
+                    },
+                    'text/plain': { schema: { type: 'string' } },
+                },
+            },
+            404: apiErrorResponse(404),
+            ...downloadErrors,
+        },
+    }), apiValidator('param', DistTargetParams), apiValidator('query', DistTargetQuery), async (context) => {
+        const { product, target } = context.req.valid('param');
+        const query = context.req.valid('query');
+        // An npm answer only to a caller that asked for it: everyone else is answered exactly as before it existed.
+        const npm = distAccepts(query.accept, DIST_ACCEPT_NPM) &&
+            DIST_TARGET_PATTERN.test(target)
+            ? await artifacts.npmPackage(product)
+            : null;
+        const resolution = npm ?? (await artifacts.resolve(product, target));
+        if (query.format === 'env')
+            return context.text(resolutionEnv(resolution), 200, {
+                'cache-control': 'no-store',
+            });
+        return context.json({ data: resolution }, 200, {
+            'cache-control': 'no-store',
+        });
+    });
+    router.get('/products/:product/versions/:version/files/:file', allowed, productAllowed, describeRoute(options.openapi?.file ?? {
+        tags: ['CliDistribution'],
+        summary: 'Download a CLI artifact',
+        operationId: 'cliDistributionFile',
+        ...cliRoute(false),
+        responses: {
+            200: {
+                description: 'The artifact file.',
+                content: {
+                    'application/gzip': {
+                        schema: { type: 'string', format: 'binary' },
+                    },
+                },
+                headers: {
+                    'x-checksum-sha256': {
+                        schema: { type: 'string' },
+                        description: 'The SHA-256 checksum.',
+                    },
+                },
+            },
+            404: apiErrorResponse(404),
+            ...downloadErrors,
+        },
+    }), apiValidator('param', DistFileParams), async (context) => {
+        const { product, version, file: name } = context.req.valid('param');
+        const file = await artifacts.file(product, version, name);
+        const stream = Readable.toWeb(file.open());
+        return context.body(stream, 200, {
+            'content-type': 'application/gzip',
+            'content-length': String(file.size),
+            'x-checksum-sha256': file.sha256,
+            'cache-control': 'private, max-age=31536000, immutable',
+        });
+    });
+    return router;
+}
+//# sourceMappingURL=routes.js.map

package/dist/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,OAAO,EACP,gBAAgB,EAChB,aAAa,EAEb,gBAAgB,GAGjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,aAAa,EACb,QAAQ,GACT,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAI/C,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAuBtB,mGAAmG;AACnG,MAAM,UAAU,WAAW,CAAC,QAAsB;IAChD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,OAAO;QACL,WAAW,MAAM,CAAC,OAAO,EAAE;QAC3B,WAAW,MAAM,CAAC,OAAO,EAAE;QAC3B,UAAU,MAAM,CAAC,MAAM,EAAE;QACzB,OAAO,MAAM,CAAC,GAAG,EAAE;QACnB,UAAU,MAAM,CAAC,MAAM,EAAE;QACzB,QAAQ,MAAM,CAAC,IAAI,EAAE;QACrB,WAAW,MAAM,CAAC,OAAO,EAAE;QAC3B,sGAAsG;QACtG,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,aAAa,CAAC,GAAmB;IAC/C,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,OAAO;QACL,QAAQ,MAAM,CAAC,IAAI,EAAE;QACrB,WAAW,MAAM,CAAC,OAAO,EAAE;QAC3B,WAAW,MAAM,CAAC,OAAO,EAAE;QAC3B,WAAW,MAAM,CAAC,OAAO,EAAE;QAC3B,WAAW,MAAM,CAAC,OAAO,EAAE;QAC3B,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,aAAa,CAAC,UAA0B;IACtD,OAAO,gBAAgB,CAAC,UAAU,CAAC;QACjC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC;QAC3B,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;AAC9B,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,sBAAsB,CACpC,MAA4B,EAC5B,SAAsB;IAEtB,iHAAiH;IACjH,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAE3D,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACzE,wGAAwG;YACxG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC3D,0GAA0G;YAC1G,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE;gBACxB,OAAO;gBACP,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;gBACtE,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE;YACxB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,OAAkC;IAElC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,QAAQ,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,OAAO,GAAsB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACzD,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACjD,IAAI,MAAM,SAAS,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;QAC9C,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,MAAM,IAAI,aAAa,CACrB,cAAc,EACd,OAAO,CAAC,mBAAmB;YACzB,+CAA+C,CAClD,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,cAAc,GAAsB,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAChE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7C,IACE,OAAO,KAAK,SAAS;YACrB,QAAQ,KAAK,KAAK;YAClB,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;YAE3B,MAAM,IAAI,aAAa,CACrB,WAAW,EACX,8BAA8B,OAAO,WAAW,SAAS,CAAC,OAAO,6CAA6C,CAC/G,CAAC;QACJ,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,cAAc,GAAG;QACrB,GAAG,EAAE,gBAAgB,CACnB,GAAG,EACH,6EAA6E,CAC9E;QACD,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC;KAC3B,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,MAAM,CAAC,IAAI,CACT,iBAAiB,EACjB,IAAI,CAAC,KAAK,EACV,aAAa,CACX,OAAO,CAAC,OAAO,EAAE,IAAI,IAAI;YACvB,IAAI,EAAE,CAAC,iBAAiB,CAAC;YACzB,OAAO,EAAE,6BAA6B;YACtC,WAAW,EAAE,qBAAqB;YAClC,GAAG,QAAQ,CAAC,KAAK,CAAC;YAClB,SAAS,EAAE;gBACT,GAAG,EAAE,YAAY,CAAC,mBAAmB,CAAC;gBACtC,GAAG,iBAAiB;aACrB;SACF,CACF,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,OAAO,OAAO,CAAC,IAAI,CACjB,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,EAC3D,GAAG,CACJ,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,CACR,WAAW,EACX,OAAO,EACP,cAAc,EACd,aAAa,CACX,OAAO,CAAC,OAAO,EAAE,QAAQ,IAAI;QAC3B,IAAI,EAAE,CAAC,iBAAiB,CAAC;QACzB,OAAO,EAAE,+BAA+B;QACxC,WAAW,EAAE,yBAAyB;QACtC,GAAG,QAAQ,CAAC,KAAK,CAAC;QAClB,SAAS,EAAE,EAAE,GAAG,EAAE,YAAY,CAAC,kBAAkB,CAAC,EAAE,GAAG,cAAc,EAAE;KACxE,CACF,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC5C,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,IAAI,EACF,QAAQ,KAAK,KAAK;gBAChB,CAAC,CAAC;oBACE,GAAG,QAAQ;oBACX,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CACrD,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAC3B,CACF;iBACF;gBACH,CAAC,CAAC,QAAQ;SACf,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,GAAG,CACR,oCAAoC,EACpC,OAAO,EACP,cAAc,EACd,aAAa,CACX,OAAO,CAAC,OAAO,EAAE,OAAO,IAAI;QAC1B,IAAI,EAAE,CAAC,iBAAiB,CAAC;QACzB,OAAO,EAAE,wBAAwB;QACjC,WAAW,EAAE,wBAAwB;QACrC,GAAG,QAAQ,CAAC,KAAK,CAAC;QAClB,SAAS,EAAE;YACT,GAAG,EAAE;gBACH,WAAW,EAAE,uCAAuC;gBACpD,OAAO,EAAE;oBACP,kBAAkB,EAAE;wBAClB,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;qBAC3D;oBACD,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;iBAC7C;aACF;YACD,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC;YAC1B,GAAG,cAAc;SAClB;KACF,CACF,EACD,YAAY,CAAC,OAAO,EAAE,gBAAgB,CAAC,EACvC,YAAY,CAAC,OAAO,EAAE,eAAe,CAAC,EACtC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,4GAA4G;QAC5G,MAAM,GAAG,GACP,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,eAAe,CAAC;YAC1C,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;YAC9B,CAAC,CAAC,MAAM,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,UAAU,GACd,GAAG,IAAI,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK;YACxB,OAAO,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE;gBAClD,eAAe,EAAE,UAAU;aAC5B,CAAC,CAAC;QACL,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE;YAC7C,eAAe,EAAE,UAAU;SAC5B,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,GAAG,CACR,kDAAkD,EAClD,OAAO,EACP,cAAc,EACd,aAAa,CACX,OAAO,CAAC,OAAO,EAAE,IAAI,IAAI;QACvB,IAAI,EAAE,CAAC,iBAAiB,CAAC;QACzB,OAAO,EAAE,yBAAyB;QAClC,WAAW,EAAE,qBAAqB;QAClC,GAAG,QAAQ,CAAC,KAAK,CAAC;QAClB,SAAS,EAAE;YACT,GAAG,EAAE;gBACH,WAAW,EAAE,oBAAoB;gBACjC,OAAO,EAAE;oBACP,kBAAkB,EAAE;wBAClB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;qBAC7C;iBACF;gBACD,OAAO,EAAE;oBACP,mBAAmB,EAAE;wBACnB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBAC1B,WAAW,EAAE,uBAAuB;qBACrC;iBACF;aACF;YACD,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC;YAC1B,GAAG,cAAc;SAClB;KACF,CACF,EACD,YAAY,CAAC,OAAO,EAAE,cAAc,CAAC,EACrC,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAA+B,CAAC;QACzE,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YAC/B,cAAc,EAAE,kBAAkB;YAClC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;YACnC,mBAAmB,EAAE,IAAI,CAAC,MAAM;YAChC,eAAe,EAAE,sCAAsC;SACxD,CAAC,CAAC;IACL,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/schemas.d.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+import type { DownloadToken } from './download-tokens.js';
+export declare const DistTargetParams: z.ZodType<{
+    product: string;
+    target: string;
+}>;
+export declare const DistFileParams: z.ZodType<{
+    product: string;
+    version: string;
+    file: string;
+}>;
+export declare const DistTargetQuery: z.ZodType<{
+    format?: 'json' | 'env' | undefined;
+    accept?: string | undefined;
+}>;
+export declare const DownloadTokenSchema: z.ZodType<DownloadToken>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAG1D,eAAO,MAAM,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CACrC,CAAC;AACxC,eAAO,MAAM,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAIC,CAAC;AAEH,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7B,CAMC,CAAC;AAEH,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CASvD,CAAC"}

package/dist/schemas.js

@@ -0,0 +1,25 @@
+import { z } from 'zod';
+const id = z.string().min(1).max(200);
+const dateTime = z.string().meta({ format: 'date-time' });
+export const DistTargetParams = z.object({ product: id, target: id });
+export const DistFileParams = z.object({
+    product: id,
+    version: id.describe('The version to read or restore.'),
+    file: id.describe('The file to upload.'),
+});
+export const DistTargetQuery = z.object({
+    format: z.enum(['json', 'env']).optional(),
+    accept: z.string().max(200).optional().meta({
+        description: 'The other answers the caller understands, comma-separated. `npm`: when the application has no tarball of the product but names its npm package, answer that package and exact version (`kind: npm`) instead of 404. Unknown values are ignored.',
+    }),
+});
+export const DownloadTokenSchema = z.object({
+    token: z.string().meta({
+        description: 'The download token, shown only in this answer; the install script downloads the CLI with it.',
+    }),
+    expiresAt: dateTime,
+    maxDownloads: z.number().int().meta({
+        description: 'How many tarball downloads it allows, retries included.',
+    }),
+});
+//# sourceMappingURL=schemas.js.map

package/dist/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAC3B,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AACxC,MAAM,CAAC,MAAM,cAAc,GAItB,CAAC,CAAC,MAAM,CAAC;IACZ,OAAO,EAAE,EAAE;IACX,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IACvD,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;CACzC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAGvB,CAAC,CAAC,MAAM,CAAC;IACZ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;QAC1C,WAAW,EACT,iPAAiP;KACpP,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAA6B,CAAC,CAAC,MAAM,CAAC;IACpE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QACrB,WAAW,EACT,8FAA8F;KACjG,CAAC;IACF,SAAS,EAAE,QAAQ;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAClC,WAAW,EAAE,yDAAyD;KACvE,CAAC;CACH,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,57 @@
 {
   "name": "@nocobase/app-cli-distribution",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0-beta.1",
+  "description": "Composable server-side CLI artifact distribution and installation.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "prettier": "@nocobase/dev-config/prettier",
+  "engines": {
+    "node": ">=24.0.0"
+  },
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./public-install": {
+      "types": "./dist/public-install.d.ts",
+      "import": "./dist/public-install.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "hono": "^4.13.2",
+    "zod": "^4.6.6",
+    "@nocobase/agent-protocol": "^0.1.0-beta.19",
+    "@nocobase/app-cli-client": "^0.1.0-beta.22"
+  },
+  "peerDependencies": {
+    "@nocobase/app-server": "^5.0.0-beta.6"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^6.0.3",
+    "eslint": "^10.0.0",
+    "prettier": "^3.9.6",
+    "vitest": "^4.1.10",
+    "@nocobase/dev-config": "0.1.0-beta.25"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "lint": "eslint . --max-warnings 0",
+    "lint:fix": "eslint . --fix --max-warnings 0",
+    "format": "prettier . --write",
+    "format:check": "prettier . --check",
+    "fix": "pnpm lint:fix && pnpm format"
+  }
 }