@crewhaus/single-binary-cli 0.1.0

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@crewhaus/single-binary-cli",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "bun build --compile wrapper producing self-contained crewhaus binaries for linux/macos/windows × x64/arm64; auto-generated Homebrew/apt/Scoop/Winget manifests (Section 32)",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "exports": {
+    ".": "./src/index.ts"
+  },
+  "scripts": {
+    "test": "bun test src",
+    "build:binary": "bun src/cli.ts"
+  },
+  "dependencies": {
+    "@crewhaus/errors": "0.0.0"
+  },
+  "license": "Apache-2.0",
+  "author": {
+    "name": "Max Meier",
+    "email": "max@studiomax.io",
+    "url": "https://studiomax.io"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/crewhaus/factory.git",
+    "directory": "packages/single-binary-cli"
+  },
+  "homepage": "https://github.com/crewhaus/factory/tree/main/packages/single-binary-cli#readme",
+  "bugs": {
+    "url": "https://github.com/crewhaus/factory/issues"
+  },
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE",
+    "NOTICE"
+  ]
+}

package/src/cli.ts

@@ -0,0 +1,60 @@
+/**
+ * `bun run build:binary` entry point. Builds the requested target, or
+ * the full BUILD_MATRIX when no target flag is passed.
+ *
+ * Examples:
+ *   bun run build:binary --target macos-arm64
+ *   bun run build:binary --version 1.0.0   # builds every entry in BUILD_MATRIX
+ */
+import {
+  ARCHES,
+  type Arch,
+  BUILD_MATRIX,
+  type BuildTarget,
+  PLATFORMS,
+  type Platform,
+  buildBinary,
+  formatTarget,
+} from "./index";
+
+function parseFlag(name: string, argv: string[]): string | undefined {
+  const idx = argv.findIndex((a) => a === `--${name}`);
+  return idx >= 0 ? argv[idx + 1] : undefined;
+}
+
+function parseTarget(value: string): BuildTarget | undefined {
+  const [platform, arch] = value.split("-") as [string, string | undefined];
+  if (!platform || !arch) return undefined;
+  if (!(PLATFORMS as readonly string[]).includes(platform)) return undefined;
+  if (!(ARCHES as readonly string[]).includes(arch)) return undefined;
+  return { platform: platform as Platform, arch: arch as Arch };
+}
+
+async function main() {
+  const argv = process.argv.slice(2);
+  const version = parseFlag("version", argv) ?? "";
+  const targetArg = parseFlag("target", argv);
+  const targets: readonly BuildTarget[] = targetArg
+    ? (() => {
+        const t = parseTarget(targetArg);
+        if (!t) {
+          console.error(`unknown target: ${targetArg}`);
+          process.exit(2);
+        }
+        return [t];
+      })()
+    : BUILD_MATRIX;
+
+  for (const t of targets) {
+    process.stdout.write(`building crewhaus-${formatTarget(t)}...\n`);
+    try {
+      const result = await buildBinary({ target: t, version });
+      process.stdout.write(`  → ${result.outPath}\n`);
+    } catch (err) {
+      console.error(`  ✗ ${formatTarget(t)} failed: ${(err as Error).message}`);
+      process.exit(1);
+    }
+  }
+}
+
+main();

package/src/index.test.ts

@@ -0,0 +1,220 @@
+import { describe, expect, test } from "bun:test";
+import { mkdtempSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  ARCHES,
+  BUILD_MATRIX,
+  type BuildBinaryRunner,
+  type BuildTarget,
+  PLATFORMS,
+  SingleBinaryError,
+  binaryName,
+  buildBinary,
+  bunCompileTarget,
+  formatTarget,
+  isBuildTarget,
+  renderDebianControl,
+  renderHomebrewFormula,
+  renderScoopManifest,
+  renderWingetManifest,
+  sha256OfFile,
+  writeAllManifests,
+} from "./index";
+
+describe("BUILD_MATRIX shape", () => {
+  test("has 5 entries (windows-arm64 intentionally absent)", () => {
+    expect(BUILD_MATRIX.length).toBe(5);
+    expect(
+      BUILD_MATRIX.find((m) => m.platform === "windows" && m.arch === "arm64"),
+    ).toBeUndefined();
+  });
+
+  test("PLATFORMS and ARCHES are tightly typed enums", () => {
+    expect(PLATFORMS).toEqual(["linux", "macos", "windows"]);
+    expect(ARCHES).toEqual(["x64", "arm64"]);
+  });
+});
+
+describe("bunCompileTarget", () => {
+  test.each(BUILD_MATRIX.map((t): [BuildTarget, string] => [t, `bun-${t.platform}-${t.arch}`]))(
+    "%j → %s",
+    (t, expected) => {
+      expect(bunCompileTarget(t)).toBe(expected);
+    },
+  );
+});
+
+describe("binaryName", () => {
+  test("appends version + .exe on windows", () => {
+    expect(binaryName({ platform: "windows", arch: "x64" }, "1.0.0")).toBe(
+      "crewhaus-windows-x64-1.0.0.exe",
+    );
+  });
+
+  test("no .exe on linux/macos", () => {
+    expect(binaryName({ platform: "linux", arch: "x64" }, "1.0.0")).toBe(
+      "crewhaus-linux-x64-1.0.0",
+    );
+    expect(binaryName({ platform: "macos", arch: "arm64" }, "0.0.1")).toBe(
+      "crewhaus-macos-arm64-0.0.1",
+    );
+  });
+
+  test("empty version → no trailing dash", () => {
+    expect(binaryName({ platform: "linux", arch: "x64" }, "")).toBe("crewhaus-linux-x64");
+  });
+});
+
+describe("isBuildTarget guard", () => {
+  test("accepts every entry in BUILD_MATRIX", () => {
+    for (const t of BUILD_MATRIX) {
+      expect(isBuildTarget(t)).toBe(true);
+    }
+  });
+
+  test("rejects windows-arm64 (not supported by Bun)", () => {
+    expect(isBuildTarget({ platform: "windows", arch: "arm64" })).toBe(false);
+  });
+});
+
+describe("buildBinary() (T2 dry-run)", () => {
+  test("happy path — argv is bun build --compile --target=<platform>-<arch> ...", async () => {
+    let captured: readonly string[] = [];
+    const runner: BuildBinaryRunner = async (argv) => {
+      captured = argv;
+      return { exitCode: 0, stdout: "", stderr: "" };
+    };
+    const result = await buildBinary({
+      target: { platform: "linux", arch: "x64" },
+      version: "1.2.3",
+      outDir: "/tmp/dist",
+      runner,
+    });
+    expect(captured[0]).toBe("bun");
+    expect(captured).toContain("build");
+    expect(captured).toContain("--compile");
+    expect(captured).toContain("--target");
+    expect(captured).toContain("bun-linux-x64");
+    expect(captured).toContain("--outfile");
+    expect(captured).toContain("/tmp/dist/crewhaus-linux-x64-1.2.3");
+    expect(result.outPath).toBe("/tmp/dist/crewhaus-linux-x64-1.2.3");
+  });
+
+  test("rejects unsupported target windows-arm64", async () => {
+    await expect(
+      buildBinary({
+        target: { platform: "windows", arch: "arm64" },
+        runner: async () => ({ exitCode: 0, stdout: "", stderr: "" }),
+      }),
+    ).rejects.toThrow(/unsupported build target/);
+  });
+
+  test("non-zero exit → SingleBinaryError with stderr", async () => {
+    await expect(
+      buildBinary({
+        target: { platform: "linux", arch: "x64" },
+        runner: async () => ({ exitCode: 2, stdout: "", stderr: "bun not found" }),
+      }),
+    ).rejects.toThrow(/bun not found/);
+  });
+
+  test("formatTarget round-trip", () => {
+    expect(formatTarget({ platform: "linux", arch: "arm64" })).toBe("linux-arm64");
+  });
+});
+
+describe("manifest rendering (T1)", () => {
+  const sha256 = {
+    "macos-arm64": "a".repeat(64),
+    "macos-x64": "b".repeat(64),
+    "linux-arm64": "c".repeat(64),
+    "linux-x64": "d".repeat(64),
+    "windows-x64": "e".repeat(64),
+  } as const;
+
+  const inputs = {
+    version: "1.0.0",
+    homepage: "https://github.com/crewhaus/factory",
+    downloadBaseUrl: "https://github.com/crewhaus/factory/releases/download/v1.0.0",
+    sha256,
+  };
+
+  test("Homebrew formula has on_macos / on_linux blocks with correct shas", () => {
+    const formula = renderHomebrewFormula(inputs);
+    expect(formula).toContain("class Crewhaus < Formula");
+    expect(formula).toContain('version "1.0.0"');
+    expect(formula).toContain("on_macos");
+    expect(formula).toContain("on_linux");
+    expect(formula).toContain(sha256["macos-arm64"]);
+    expect(formula).toContain(sha256["macos-x64"]);
+    expect(formula).toContain(sha256["linux-arm64"]);
+    expect(formula).toContain(sha256["linux-x64"]);
+  });
+
+  test("Homebrew rejects non-semver versions", () => {
+    expect(() => renderHomebrewFormula({ ...inputs, version: "v1" })).toThrow();
+  });
+
+  test("Debian control has correct Architecture/Description", () => {
+    const ctl = renderDebianControl(inputs);
+    expect(ctl).toContain("Package: crewhaus");
+    expect(ctl).toContain("Version: 1.0.0");
+    expect(ctl).toContain("Architecture: any");
+  });
+
+  test("Scoop manifest exposes 64bit url + hash", () => {
+    const scoop = renderScoopManifest(inputs) as {
+      version: string;
+      architecture: { "64bit": { url: string; hash: string } };
+    };
+    expect(scoop.version).toBe("1.0.0");
+    expect(scoop.architecture["64bit"].hash).toBe(sha256["windows-x64"]);
+    expect(scoop.architecture["64bit"].url).toContain("crewhaus-windows-x64-1.0.0.exe");
+  });
+
+  test("Winget manifest is valid YAML-shaped text with InstallerSha256 uppercase", () => {
+    const winget = renderWingetManifest(inputs);
+    expect(winget).toContain("PackageIdentifier: CrewHaus.CLI");
+    expect(winget).toContain("PackageVersion: 1.0.0");
+    expect(winget).toContain(sha256["windows-x64"].toUpperCase());
+  });
+
+  test("manifest rendering refuses missing/short shas", () => {
+    expect(() =>
+      renderHomebrewFormula({ ...inputs, sha256: { "macos-arm64": sha256["macos-arm64"] } }),
+    ).toThrow(/missing sha256/);
+    expect(() => renderScoopManifest({ ...inputs, sha256: { "windows-x64": "short" } })).toThrow(
+      /malformed sha256/,
+    );
+  });
+
+  test("writeAllManifests writes deterministic files", () => {
+    const dir = mkdtempSync(join(tmpdir(), "crewhaus-pkg-"));
+    const out = writeAllManifests(inputs, dir);
+    const formulaText = readFileSync(out.homebrew, "utf8");
+    const scoopText = readFileSync(out.scoop, "utf8");
+    expect(formulaText).toContain('version "1.0.0"');
+    expect(scoopText).toContain(
+      '"hash": "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"',
+    );
+  });
+});
+
+describe("sha256OfFile", () => {
+  test("rejects missing files", async () => {
+    await expect(sha256OfFile("/nonexistent/path/to/file")).rejects.toThrow(SingleBinaryError);
+  });
+
+  test("hashes a real file deterministically", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "crewhaus-sha-"));
+    const path = join(dir, "test.bin");
+    const { writeFileSync } = await import("node:fs");
+    writeFileSync(path, "deterministic test bytes");
+    const a = await sha256OfFile(path);
+    const b = await sha256OfFile(path);
+    expect(a).toBe(b);
+    expect(a).toMatch(/^[0-9a-f]{64}$/);
+  });
+});

package/src/index.ts

@@ -0,0 +1,327 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+/**
+ * Section 32 — `@crewhaus/single-binary-cli`
+ *
+ * `bun build --compile` wrapper that produces self-contained
+ * `dist/crewhaus-{linux,macos,windows}-{x64,arm64}` binaries for the
+ * `crewhaus` CLI. Each binary is ~80 MB; no Bun/Node prereq on the
+ * target host.
+ *
+ * Bun 1.2's `--compile` cross-compile matrix:
+ *   - linux-x64        ✅
+ *   - linux-arm64      ✅
+ *   - macos-x64        ✅
+ *   - macos-arm64      ✅
+ *   - windows-x64      ✅ (named "bun-windows-x64" target)
+ *   - windows-arm64    ❌ (Bun does not produce windows-arm64; documented
+ *                          gap — use linux-arm64 in WSL or skip)
+ *
+ * The auto-generated package manifests (Homebrew formula, Debian
+ * control, Scoop manifest, Winget manifest) live under
+ * `packaging/` and are templated against the binaries this package
+ * builds. `renderHomebrewFormula({version, sha256ByPlatform})` etc.
+ * regenerate them deterministically on every release.
+ */
+import { CrewhausError } from "@crewhaus/errors";
+
+export class SingleBinaryError extends CrewhausError {
+  override readonly name = "SingleBinaryError";
+  constructor(message: string, cause?: unknown) {
+    super("config", message, cause);
+  }
+}
+
+export const PLATFORMS = ["linux", "macos", "windows"] as const;
+export const ARCHES = ["x64", "arm64"] as const;
+export type Platform = (typeof PLATFORMS)[number];
+export type Arch = (typeof ARCHES)[number];
+
+/**
+ * The (platform, arch) pairs Bun --compile actually produces. The
+ * `windows-arm64` slot is intentionally absent because Bun has no
+ * `bun-windows-arm64` target as of Bun 1.2.
+ */
+export type BuildTarget = { readonly platform: Platform; readonly arch: Arch };
+export const BUILD_MATRIX: readonly BuildTarget[] = [
+  { platform: "linux", arch: "x64" },
+  { platform: "linux", arch: "arm64" },
+  { platform: "macos", arch: "x64" },
+  { platform: "macos", arch: "arm64" },
+  { platform: "windows", arch: "x64" },
+];
+
+/** Bun's --target string for a given (platform, arch) pair. */
+export function bunCompileTarget(t: BuildTarget): string {
+  return `bun-${t.platform}-${t.arch}`;
+}
+
+/**
+ * Output filename of a built binary. Adds `.exe` on windows.
+ */
+export function binaryName(t: BuildTarget, version: string): string {
+  const base = `crewhaus-${t.platform}-${t.arch}`;
+  const versioned = version ? `${base}-${version}` : base;
+  return t.platform === "windows" ? `${versioned}.exe` : versioned;
+}
+
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const REPO_ROOT = resolve(PACKAGE_ROOT, "..", "..");
+const CLI_ENTRYPOINT_REL = "apps/cli/src/index.ts";
+
+export type BuildBinaryRunner = (
+  argv: readonly string[],
+  cwd: string,
+) => Promise<{ exitCode: number; stdout: string; stderr: string }>;
+
+export type BuildBinaryOptions = {
+  readonly target: BuildTarget;
+  readonly version?: string;
+  readonly outDir?: string;
+  /** Test injection point. Defaults to spawning bun via node:child_process. */
+  readonly runner?: BuildBinaryRunner;
+};
+
+export type BuildBinaryResult = {
+  readonly target: BuildTarget;
+  readonly outPath: string;
+  readonly buildArgv: readonly string[];
+};
+
+export async function buildBinary(opts: BuildBinaryOptions): Promise<BuildBinaryResult> {
+  const t = opts.target;
+  if (!isBuildTarget(t)) {
+    throw new SingleBinaryError(
+      `unsupported build target: ${t.platform}-${t.arch} (allowed: ${BUILD_MATRIX.map(formatTarget).join(", ")})`,
+    );
+  }
+  const outDir = opts.outDir ?? join(REPO_ROOT, "dist");
+  const version = (opts.version ?? "").trim();
+  const outPath = join(outDir, binaryName(t, version));
+  const argv: string[] = [
+    "bun",
+    "build",
+    "--compile",
+    "--target",
+    bunCompileTarget(t),
+    CLI_ENTRYPOINT_REL,
+    "--outfile",
+    outPath,
+  ];
+
+  const runner = opts.runner ?? defaultRunner;
+  const { exitCode, stderr } = await runner(argv, REPO_ROOT);
+  if (exitCode !== 0) {
+    throw new SingleBinaryError(
+      `bun build --compile (${formatTarget(t)}) exited with ${exitCode}: ${stderr.slice(0, 1024)}`,
+    );
+  }
+  return { target: t, outPath, buildArgv: argv };
+}
+
+export function isBuildTarget(t: BuildTarget): boolean {
+  return BUILD_MATRIX.some((m) => m.platform === t.platform && m.arch === t.arch);
+}
+
+export function formatTarget(t: BuildTarget): string {
+  return `${t.platform}-${t.arch}`;
+}
+
+const defaultRunner: BuildBinaryRunner = async (argv, cwd) => {
+  const { spawn } = await import("node:child_process");
+  return new Promise((resolve_) => {
+    const head = argv[0] ?? "bun";
+    const child = spawn(head, argv.slice(1), { cwd, stdio: ["ignore", "pipe", "pipe"] });
+    const out: Buffer[] = [];
+    const err: Buffer[] = [];
+    child.stdout.on("data", (b) => out.push(b));
+    child.stderr.on("data", (b) => err.push(b));
+    child.on("error", (e) =>
+      resolve_({ exitCode: 1, stdout: "", stderr: String((e as Error).message) }),
+    );
+    child.on("close", (code) =>
+      resolve_({
+        exitCode: code ?? 1,
+        stdout: Buffer.concat(out).toString("utf8"),
+        stderr: Buffer.concat(err).toString("utf8"),
+      }),
+    );
+  });
+};
+
+// ─── package manifest generation ─────────────────────────────────────────────
+
+export type ShaByTarget = Readonly<Partial<Record<string, string>>>;
+
+export type ManifestInputs = {
+  readonly version: string;
+  readonly homepage: string;
+  readonly downloadBaseUrl: string;
+  readonly sha256: ShaByTarget;
+};
+
+export function renderHomebrewFormula(inputs: ManifestInputs): string {
+  const { version, homepage, downloadBaseUrl, sha256 } = inputs;
+  if (!/^\d+\.\d+\.\d+/.test(version)) {
+    throw new SingleBinaryError(`homebrew version must be semver-shaped: ${version}`);
+  }
+  const macosArm64 = requireSha(sha256, "macos-arm64");
+  const macosX64 = requireSha(sha256, "macos-x64");
+  const linuxArm64 = requireSha(sha256, "linux-arm64");
+  const linuxX64 = requireSha(sha256, "linux-x64");
+  return `class Crewhaus < Formula
+  desc "Modular meta-harness — compile a single spec into multiple agent runtimes"
+  homepage "${homepage}"
+  version "${version}"
+  license "MIT"
+
+  on_macos do
+    on_arm do
+      url "${downloadBaseUrl}/crewhaus-macos-arm64-${version}"
+      sha256 "${macosArm64}"
+    end
+    on_intel do
+      url "${downloadBaseUrl}/crewhaus-macos-x64-${version}"
+      sha256 "${macosX64}"
+    end
+  end
+
+  on_linux do
+    on_arm do
+      url "${downloadBaseUrl}/crewhaus-linux-arm64-${version}"
+      sha256 "${linuxArm64}"
+    end
+    on_intel do
+      url "${downloadBaseUrl}/crewhaus-linux-x64-${version}"
+      sha256 "${linuxX64}"
+    end
+  end
+
+  def install
+    bin.install Dir["*"].first => "crewhaus"
+  end
+
+  test do
+    system "#{bin}/crewhaus", "--version"
+  end
+end
+`;
+}
+
+export function renderDebianControl(inputs: ManifestInputs): string {
+  const { version } = inputs;
+  return `Package: crewhaus
+Version: ${version}
+Section: utils
+Priority: optional
+Architecture: any
+Maintainer: CrewHaus Maintainers <maintainers@crewhaus.io>
+Depends: libc6 (>= 2.31)
+Description: Modular meta-harness — compile a single spec into multiple agent runtimes
+ CrewHaus compiles a single high-level harness spec into multiple
+ runtime targets (graph, workflow, channel bot, eval, batch worker,
+ voice service, browser-driver, research-runner). The binary is a
+ self-contained Bun bundle requiring no Node/Bun on the target host.
+`;
+}
+
+export function renderScoopManifest(inputs: ManifestInputs): unknown {
+  const { version, homepage, downloadBaseUrl, sha256 } = inputs;
+  const winX64 = requireSha(sha256, "windows-x64");
+  return {
+    version,
+    description: "Modular meta-harness — compile a single spec into multiple agent runtimes",
+    homepage,
+    license: "MIT",
+    architecture: {
+      "64bit": {
+        url: `${downloadBaseUrl}/crewhaus-windows-x64-${version}.exe`,
+        hash: winX64,
+      },
+    },
+    bin: "crewhaus.exe",
+  };
+}
+
+export function renderWingetManifest(inputs: ManifestInputs): string {
+  const { version, homepage, downloadBaseUrl, sha256 } = inputs;
+  const winX64 = requireSha(sha256, "windows-x64");
+  return `# yaml-language-server: $schema=https://aka.ms/winget-manifest.installer.1.4.0.schema.json
+PackageIdentifier: CrewHaus.CLI
+PackageVersion: ${version}
+Publisher: CrewHaus
+Author: CrewHaus
+PackageName: crewhaus
+PackageUrl: ${homepage}
+License: MIT
+ShortDescription: Modular meta-harness — compile a single spec into multiple agent runtimes
+Description: |
+  CrewHaus compiles a single high-level harness spec into multiple runtime targets.
+Tags:
+  - cli
+  - llm
+  - agent-framework
+Installers:
+  - Architecture: x64
+    InstallerType: portable
+    InstallerUrl: ${downloadBaseUrl}/crewhaus-windows-x64-${version}.exe
+    InstallerSha256: ${winX64.toUpperCase()}
+ManifestType: installer
+ManifestVersion: 1.4.0
+`;
+}
+
+function requireSha(map: ShaByTarget, target: string): string {
+  const sha = map[target];
+  if (!sha) {
+    throw new SingleBinaryError(`missing sha256 for ${target} in package manifest inputs`);
+  }
+  if (!/^[0-9a-f]{64}$/i.test(sha)) {
+    throw new SingleBinaryError(`malformed sha256 for ${target}: ${sha}`);
+  }
+  return sha;
+}
+
+// ─── on-disk manifest writers ────────────────────────────────────────────────
+
+export function packagingDir(): string {
+  return join(PACKAGE_ROOT, "packaging");
+}
+
+export function writeAllManifests(
+  inputs: ManifestInputs,
+  root: string = packagingDir(),
+): {
+  homebrew: string;
+  debian: string;
+  scoop: string;
+  winget: string;
+} {
+  mkdirSync(join(root, "Formula"), { recursive: true });
+  mkdirSync(join(root, "debian"), { recursive: true });
+  const homebrew = join(root, "Formula", "crewhaus.rb");
+  const debian = join(root, "debian", "control");
+  const scoop = join(root, "scoop.json");
+  const winget = join(root, "winget.yaml");
+  writeFileSync(homebrew, renderHomebrewFormula(inputs), { mode: 0o644 });
+  writeFileSync(debian, renderDebianControl(inputs), { mode: 0o644 });
+  writeFileSync(scoop, `${JSON.stringify(renderScoopManifest(inputs), null, 2)}\n`, {
+    mode: 0o644,
+  });
+  writeFileSync(winget, renderWingetManifest(inputs), { mode: 0o644 });
+  return { homebrew, debian, scoop, winget };
+}
+
+// ─── helpers consumed by the binary CLI ─────────────────────────────────────
+
+/** Read a file's sha256 — used by release tooling to populate manifests. */
+export async function sha256OfFile(path: string): Promise<string> {
+  if (!existsSync(path)) {
+    throw new SingleBinaryError(`file not found: ${path}`);
+  }
+  const { createHash } = await import("node:crypto");
+  const hash = createHash("sha256");
+  hash.update(readFileSync(path));
+  return hash.digest("hex");
+}