@@ -0,0 +1,26 @@
+---
+'@objectstack/cloud-connection': patch
+'@objectstack/cli': patch
+---
+
+feat: `OS_CONSOLE_MAP_STYLE_URL` names a deployment's default map style, served on runtime-config and allowed by the Console's content-security-policy
+
+Clause-②: no
+Metadata-protocol: none
+
+A map view that names no `mapStyle` falls back to a built-in style on a public demo host, so a deployment without public internet, or one whose policy forbids a third-party tile host, shows a grey map. An operator can now name the deployment's own style document once:
+
+```sh
+OS_CONSOLE_MAP_STYLE_URL=https://tiles.example.com/styles/basic/style.json
+```
+
+That one value does two things, both read at boot:
+
+- `GET /api/v1/runtime/config` serves it verbatim as the top-level `mapStyleUrl`, the deployment's default map style. Unset, the key is absent and every other key is unchanged.
+- The Console document's `connect-src` gains the URL's origin. The default demo host stays allowed beside it.
+
+The value must be an absolute `https:` URL on a host name, with no user name, password or whitespace. Anything else stops the server at boot with a message naming the variable, the same way a malformed `OS_CONSOLE_CSP_CONNECT_SRC` entry does. The runtime-config door is anonymous, so the URL is public once set.
+
+It is an operator setting only: there is no Setup setting and no metadata key for it, so only the person who runs the deployment can widen the Console's content-security-policy. A style whose tiles, sprites or glyphs live on other hosts still needs those hosts in `OS_CONSOLE_CSP_CONNECT_SRC`.
+
+The Console's map renderer reads `mapStyleUrl` in a separate change; until then the served value and the policy are in place, and map views keep the built-in style.
@@ -28,7 +28,8 @@ read at startup unless noted otherwise. Boolean variables accept `true` / `false
 | `OS_BOOT_EMPTY` | flag | `0` | When `1`, boot the kernel with no metadata artifact (CLI internal). |
 | `OS_MIGRATE_AND_EXIT` | flag | `0` | When `1`, run pending migrations and exit (suitable for one-shot jobs). |
 | `OS_DISABLE_CONSOLE` | flag | `0` | When `1`, do not mount the Console portal under `/_console`. |
-| `OS_CONSOLE_CSP_CONNECT_SRC` | list | — | Extra `connect-src` sources for the Console document's content-security-policy, separated by spaces: a scheme (`https:`) or a scheme with a host (`https://tiles.example.com`). Name the host of any map view `mapStyle` that is not the default demo style; the server itself, the default map style host and a configured `OS_TELEMETRY_CLIENT_ERROR_REPORTING_DSN` origin are already allowed. A malformed entry refuses the boot. |
+| `OS_CONSOLE_CSP_CONNECT_SRC` | list | — | Extra `connect-src` sources for the Console document's content-security-policy, separated by spaces: a scheme (`https:`) or a scheme with a host (`https://tiles.example.com`). Name the host of any map view `mapStyle` that is not the default demo style, and the tile, sprite and glyph hosts of a style that keeps them elsewhere; the server itself, the default map style host, the `OS_CONSOLE_MAP_STYLE_URL` origin and a configured `OS_TELEMETRY_CLIENT_ERROR_REPORTING_DSN` origin are already allowed. A malformed entry refuses the boot. |
+| `OS_CONSOLE_MAP_STYLE_URL` | URL | — | The deployment's default map style document (for example `https://tiles.example.com/styles/basic/style.json`). Served as `mapStyleUrl` on `GET /api/v1/runtime/config`, which is anonymous, so the URL is public; its origin joins the Console's `connect-src`. Unset, no `mapStyleUrl` is served. Must be an absolute `https:` URL on a host name, with no user name or password; anything else refuses the boot. |
 | `OS_EAGER_SCHEMAS` | flag | `0` | When `1`, evaluate all lazily-built Zod spec schemas eagerly at module load instead of on first use — an emergency rollback of the lazy-schema memory optimization (higher startup RSS). |
 | `OS_SKIP_SCHEMA_SYNC` | flag | `0` | When `1`, skip the implicit `db:sync` on boot. Use after running migrations manually. |
 
 
@@ -42,6 +42,7 @@ const ENV = [
   'OS_PAGE_REACT_ENABLED',
   'OS_PAGE_REACT',
   'OS_CONSOLE_CSP_CONNECT_SRC',
+  'OS_CONSOLE_MAP_STYLE_URL',
   'OS_CLOUD_URL',
   'OS_TELEMETRY_CLIENT_ERROR_REPORTING_DSN',
 ];
@@ -305,4 +306,85 @@ describe('connect-src', () => {
     process.env.OS_CONSOLE_CSP_CONNECT_SRC = `https://ok.example.com ${value}`;
     await expect(mount()).rejects.toThrow(/OS_CONSOLE_CSP_CONNECT_SRC names .*not a connect-src source/);
   });
+
+  it('adds the origin of the deployment\'s default map style, named in OS_CONSOLE_MAP_STYLE_URL', async () => {
+    process.env.OS_CONSOLE_MAP_STYLE_URL = 'https://tiles.example.com:8443/styles/basic/style.json?key=public';
+    const request = await mount();
+    const res = await request('/_console/');
+    expect(directives(res.headers.get('content-security-policy')).get('connect-src')).toEqual([
+      "'self'",
+      'https://demotiles.maplibre.org',
+      'https://tiles.example.com:8443',
+    ]);
+  });
+
+  it('names no map style origin of its own when OS_CONSOLE_MAP_STYLE_URL is unset or empty', async () => {
+    process.env.OS_CONSOLE_MAP_STYLE_URL = '  ';
+    const request = await mount();
+    const res = await request('/_console/');
+    expect(directives(res.headers.get('content-security-policy')).get('connect-src')).toEqual([
+      "'self'",
+      'https://demotiles.maplibre.org',
+    ]);
+  });
+
+  it('keeps OS_CONSOLE_CSP_CONNECT_SRC working beside it, after the map style origin', async () => {
+    process.env.OS_CONSOLE_MAP_STYLE_URL = 'https://tiles.example.com/style.json';
+    process.env.OS_CONSOLE_CSP_CONNECT_SRC = 'https://glyphs.example.com https://tiles.example.com';
+    const request = await mount();
+    const res = await request('/_console/');
+    expect(directives(res.headers.get('content-security-policy')).get('connect-src')).toEqual([
+      "'self'",
+      'https://demotiles.maplibre.org',
+      'https://tiles.example.com',
+      'https://glyphs.example.com',
+    ]);
+  });
+
+  it('allows the very origin RuntimeConfigPlugin serves as the default map style, from one env var', async () => {
+    process.env.OS_CONSOLE_MAP_STYLE_URL = 'https://tiles.example.com/styles/basic/style.json';
+    const request = await mount({ runtimeConfig: {} });
+    const served = await (await request('/api/v1/runtime/config')).json();
+    expect(served.mapStyleUrl).toBe('https://tiles.example.com/styles/basic/style.json');
+    const res = await request('/_console/');
+    expect(directives(res.headers.get('content-security-policy')).get('connect-src')).toContain(
+      new URL(served.mapStyleUrl).origin,
+    );
+  });
+
+  it.each([
+    ['http://tiles.example.com/style.json'],
+    ['/styles/basic/style.json'],
+    ['tiles.example.com'],
+    ["https://tiles.example.com/style.json 'unsafe-inline'"],
+  ])('refuses the boot when OS_CONSOLE_MAP_STYLE_URL is %j', async (value) => {
+    process.env.OS_CONSOLE_MAP_STYLE_URL = value;
+    await expect(mount()).rejects.toThrow(/^OS_CONSOLE_MAP_STYLE_URL is .*absolute https: URL/s);
+  });
+
+  // The Console mount restates RuntimeConfigPlugin's reader rather than
+  // importing it (this module imports Node built-ins only), so the two are held
+  // here to one verdict, refusal text included, on every value named.
+  it.each([
+    ['https://tiles.example.com/styles/basic/style.json'],
+    ['https://Tiles.Example.com:8443/style.json?key=public'],
+    ['https://192.0.2.10/style.json'],
+    ['   '],
+    ['http://tiles.example.com/style.json'],
+    ['/styles/basic/style.json'],
+    ['tiles.example.com'],
+    ['javascript:alert(1)'],
+    ['https://user:secret@tiles.example.com/style.json'],
+    ['https://[::1]/style.json'],
+    ['https://a.example.com/style.json https://b.example.com/style.json'],
+  ])('gives the same verdict as RuntimeConfigPlugin on OS_CONSOLE_MAP_STYLE_URL=%j', async (value) => {
+    process.env.OS_CONSOLE_MAP_STYLE_URL = value;
+    const verdict = (start: () => Promise<unknown>) => start().then(() => 'accepted', (e: Error) => e.message);
+    const runtimeConfig = await verdict(() => new RuntimeConfigPlugin({}).start({
+      hook: () => {},
+      getService: (name: string) => { throw new Error(`no service ${name}`); },
+      logger: { warn: () => {}, info: () => {}, debug: () => {}, error: () => {} },
+    } as any));
+    expect(await verdict(() => mount())).toBe(runtimeConfig);
+  });
 });
@@ -720,10 +720,72 @@ function readExtraConnectSources(env: NodeJS.ProcessEnv): string[] {
   return sources;
 }
 
+/**
+ * The env var an operator names the deployment's default map style document
+ * in: an absolute `https:` URL, such as
+ * `https://tiles.example.com/styles/basic/style.json`. `RuntimeConfigPlugin`
+ * serves the same value as `mapStyleUrl` on `GET /api/v1/runtime/config`, and
+ * the Console document's `connect-src` names its origin, so the map view can
+ * fetch the style the door hands it.
+ */
+const CONSOLE_MAP_STYLE_URL_ENV = 'OS_CONSOLE_MAP_STYLE_URL';
+
+/**
+ * A DNS host name as the WHATWG parser leaves it. An IP literal in brackets is
+ * left out: a content-security-policy host source cannot name one.
+ */
+const MAP_STYLE_HOST = /^[a-z0-9-]+(?:\.[a-z0-9-]+)*$/;
+
+/**
+ * The origin of the map style named in {@link CONSOLE_MAP_STYLE_URL_ENV}, or
+ * `undefined` when it is unset or empty; anything that is not an absolute
+ * `https:` URL on a host name, without credentials or whitespace, refuses the
+ * boot.
+ *
+ * The same contract, and the same refusal, as the reader `RuntimeConfigPlugin`
+ * serves the value through (`@objectstack/cloud-connection`,
+ * `readConsoleMapStyleUrl`). It is restated here rather than imported because
+ * this module, published as `@objectstack/cli/console`, imports Node built-ins
+ * only (`test/published-subpath-console.pin.test.ts`).
+ * `console.content-security-policy.test.ts` holds the two to the same verdict
+ * on every value it names, so the policy allows exactly the URL the door
+ * serves, and a value one side refuses cannot boot past the other.
+ */
+function readMapStyleOrigin(env: NodeJS.ProcessEnv): string | undefined {
+  const value = String(env[CONSOLE_MAP_STYLE_URL_ENV] ?? '').trim();
+  if (value === '') return undefined;
+  const refuse = (why: string, shown: string = value): never => {
+    throw new Error(
+      `${CONSOLE_MAP_STYLE_URL_ENV} is ${JSON.stringify(shown)}, which ${why}. Name the map style document `
+      + 'as an absolute https: URL on a host name, for example '
+      + 'https://tiles.example.com/styles/basic/style.json, or unset it to keep the built-in default style.',
+    );
+  };
+  if (/\s/.test(value)) return refuse('contains whitespace');
+  let parsed: URL;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return refuse('is not an absolute URL');
+  }
+  if (parsed.protocol !== 'https:') return refuse(`uses ${parsed.protocol} rather than https:`);
+  if (parsed.username !== '' || parsed.password !== '') {
+    // Named without the credentials: this message lands in the boot log.
+    return refuse(
+      'carries a user name or password, which the anonymous runtime-config door would publish',
+      `${parsed.protocol}//${parsed.host}${parsed.pathname}`,
+    );
+  }
+  if (!MAP_STYLE_HOST.test(parsed.hostname)) return refuse('names a host that a content-security-policy cannot allow');
+  return parsed.origin;
+}
+
 /**
  * The default map style the Console's map view loads when the view names none
  * (objectui `plugin-map`, `DEFAULT_MAP_STYLE`). Its style, tiles and glyphs are
- * all on this host.
+ * all on this host. It stays allowed when the operator names the deployment's
+ * own default in `OS_CONSOLE_MAP_STYLE_URL`: a view may still name it, and a
+ * Console build that does not read the served default yet still loads it.
  */
 const DEFAULT_MAP_STYLE_ORIGIN = 'https://demotiles.maplibre.org';
 
@@ -760,9 +822,12 @@ const DEFAULT_MAP_STYLE_ORIGIN = 'https://demotiles.maplibre.org';
  *   values, and images inside an email template preview.
  * - `connect-src`: the server itself (`'self'`, which also covers the
  *   same-origin realtime WebSocket and the metadata event stream), the default
- *   map style's host, the error-reporting endpoint when the runtime serves a
- *   DSN (`telemetry.errorReporting.dsn` from `GET /api/v1/runtime/config`), and
- *   the hosts an operator names in `OS_CONSOLE_CSP_CONNECT_SRC`.
+ *   map style's host, the origin of the deployment's own default map style
+ *   when the operator names one in `OS_CONSOLE_MAP_STYLE_URL` (the URL
+ *   `GET /api/v1/runtime/config` serves as `mapStyleUrl`), the
+ *   error-reporting endpoint when the runtime serves a DSN
+ *   (`telemetry.errorReporting.dsn` from the same door), and the hosts an
+ *   operator names in `OS_CONSOLE_CSP_CONNECT_SRC`.
  * - `default-src 'self'` covers the rest the Console uses: the module workers
  *   maplibre starts from its own file, the PWA manifest, and the same-origin
  *   frames (the Studio's live canvas). The build ships no web fonts.
@@ -776,12 +841,14 @@ function consoleContentSecurityPolicy(input: {
   nonce: string;
   reactPages: boolean;
   errorReportingOrigin: string | undefined;
+  mapStyleOrigin: string | undefined;
   extraConnectSources: readonly string[];
   embeddable: boolean;
 }): string {
   const scriptSrc = ["'self'", `'nonce-${input.nonce}'`, "'wasm-unsafe-eval'"];
   if (input.reactPages) scriptSrc.push("'unsafe-eval'");
   const connectSrc = ["'self'", DEFAULT_MAP_STYLE_ORIGIN];
+  if (input.mapStyleOrigin !== undefined) connectSrc.push(input.mapStyleOrigin);
   if (input.errorReportingOrigin !== undefined) connectSrc.push(input.errorReportingOrigin);
   connectSrc.push(...input.extraConnectSources);
   const directives: string[][] = [
@@ -912,6 +979,9 @@ export function createConsoleStaticPlugin(distPath: string, options?: { isDev?:
       // Read once, at boot: a malformed value refuses here, loudly, rather
       // than reaching the header of every document.
       const extraConnectSources = readExtraConnectSources(process.env);
+      // The deployment's default map style (#26001), on the contract the
+      // runtime-config door serves it under, so the policy allows that URL.
+      const mapStyleOrigin = readMapStyleOrigin(process.env);
 
       const indexPath = path.join(absoluteDist, 'index.html');
       if (!fs.existsSync(indexPath)) {
@@ -997,6 +1067,7 @@ export function createConsoleStaticPlugin(distPath: string, options?: { isDev?:
           nonce,
           reactPages,
           errorReportingOrigin: shell?.errorReportingOrigin,
+          mapStyleOrigin,
           extraConnectSources,
           embeddable: reqPath.startsWith(`${PUBLIC_FORM_PAGE}/`),
         });
 
@@ -0,0 +1,92 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The deployment's default map style: one operator env var, read the same way
+ * by both of its readers (#26001, ruling A: operator env only).
+ *
+ * A map view that names no `mapStyle` of its own falls back to a built-in
+ * default whose style, tiles and glyphs all live on a public demo host. A
+ * deployment without public internet, or one whose policy forbids a
+ * third-party tile host, gets a grey canvas there, and before this env var
+ * the only remedy was editing every map view of every app. The operator now
+ * names the deployment's own style document once:
+ *
+ *   OS_CONSOLE_MAP_STYLE_URL=https://tiles.example.com/styles/basic/style.json
+ *
+ * Two readers act on that one value, on one contract:
+ *
+ *   - `RuntimeConfigPlugin` serves it, through {@link readConsoleMapStyleUrl},
+ *     as `mapStyleUrl` on `GET /api/v1/runtime/config`, the deployment's
+ *     default map style;
+ *   - the CLI's Console mount adds its origin to the Console document's
+ *     `connect-src`, computed once at boot (`readMapStyleOrigin` in
+ *     `packages/cli/src/utils/console.ts`). That module is published as
+ *     `@objectstack/cli/console` and imports Node built-ins only, so it
+ *     restates this contract instead of importing it; the CLI's
+ *     `console.content-security-policy.test.ts` holds the two readers to the
+ *     same verdict on every value it names.
+ *
+ * It is an operator posture and nothing else: no Setup setting, no settings
+ * key, no spec key, and no per-request policy. Widening the Console's
+ * `connect-src` is the operator's act alone, so a tenant admin has no door to
+ * it. The value is public once set (the runtime-config door is anonymous), so
+ * it must not carry credentials.
+ *
+ * Contract, strict on purpose: the value is an ABSOLUTE `https:` URL whose
+ * host is a DNS name, with no user name, password or whitespace. Empty or
+ * whitespace-only reads as unset. Anything else refuses the boot, naming the
+ * variable, the same way a malformed `OS_CONSOLE_CSP_CONNECT_SRC` entry does:
+ * a map style the Console could not load, or a policy that names the wrong
+ * origin, is a misconfiguration the operator must see at once, never a
+ * quietly grey map.
+ */
+
+/** The variable an operator names the deployment's default map style document in. */
+export const CONSOLE_MAP_STYLE_URL_ENV = 'OS_CONSOLE_MAP_STYLE_URL';
+
+/**
+ * A DNS host name as the WHATWG parser leaves it (lower-cased, punycoded). An
+ * IP literal in brackets is left out: a content-security-policy host source
+ * cannot name one, so the origin could never be allowed.
+ */
+const DNS_HOST = /^[a-z0-9-]+(?:\.[a-z0-9-]+)*$/;
+
+/**
+ * The deployment's default map style URL, or `undefined` when the operator set
+ * none. The value is returned as written (trimmed), never re-serialised by the
+ * parser, so what the operator declared is byte for byte what the Console
+ * loads.
+ *
+ * @throws Error naming {@link CONSOLE_MAP_STYLE_URL_ENV} when the value is set
+ *   but is not an absolute `https:` URL on a DNS host without credentials.
+ */
+export function readConsoleMapStyleUrl(env: Readonly<Record<string, string | undefined>>): string | undefined {
+    const value = String(env[CONSOLE_MAP_STYLE_URL_ENV] ?? '').trim();
+    if (value === '') return undefined;
+    const refuse = (why: string, shown: string = value): never => {
+        throw new Error(
+            `${CONSOLE_MAP_STYLE_URL_ENV} is ${JSON.stringify(shown)}, which ${why}. Name the map style document `
+            + 'as an absolute https: URL on a host name, for example '
+            + 'https://tiles.example.com/styles/basic/style.json, or unset it to keep the built-in default style.',
+        );
+    };
+    // The parser would percent-encode it into the path; it is a second value
+    // or a typo, never part of one style URL.
+    if (/\s/.test(value)) return refuse('contains whitespace');
+    let parsed: URL;
+    try {
+        parsed = new URL(value);
+    } catch {
+        return refuse('is not an absolute URL');
+    }
+    if (parsed.protocol !== 'https:') return refuse(`uses ${parsed.protocol} rather than https:`);
+    if (parsed.username !== '' || parsed.password !== '') {
+        // Named without the credentials: this message lands in the boot log.
+        return refuse(
+            'carries a user name or password, which the anonymous runtime-config door would publish',
+            `${parsed.protocol}//${parsed.host}${parsed.pathname}`,
+        );
+    }
+    if (!DNS_HOST.test(parsed.hostname)) return refuse('names a host that a content-security-policy cannot allow');
+    return value;
+}