@dynomate/cli 0.0.10

package/LICENSE

@@ -0,0 +1,7 @@
+Dynomate CLI Proprietary License Notice
+
+Copyright (c) 2026 Dynomate. All rights reserved.
+
+This software is proprietary and confidential. Use is permitted only under the
+applicable Dynomate terms. No permission is granted to redistribute, modify,
+sublicense, or reverse engineer this software.

package/README.md

@@ -0,0 +1,44 @@
+# @dynomate/cli
+
+This package installs the native Dynomate command-line client. Test releases use
+the npm `next` tag:
+
+```bash
+npm install --global @dynomate/cli@next
+dynomate-cli --version
+```
+
+Run the same install command again to upgrade. The package exposes only
+`dynomate-cli`; `dynomate` is reserved for the desktop application.
+
+## Supported platforms
+
+- macOS 11 or newer on Apple Silicon (`arm64`)
+- macOS 11 or newer on Intel (`x64`)
+- 64-bit GNU/Linux (`x64`) with glibc 2.35 or newer (Ubuntu 22.04 baseline)
+- 64-bit Windows (`x64`)
+
+Installation downloads the archive for the current platform from the immutable
+release at
+`https://releases.dynomate.io/cli/dynomate-cli-v<version>/`. The installer reads
+that release's `SHA256SUMS`, verifies the archive before extracting it, and then
+atomically installs only the `dynomate-cli` executable.
+
+Install scripts are required. If npm is run with `--ignore-scripts`, the native
+executable is not downloaded and the launcher exits with instructions to
+reinstall normally. The installer also needs HTTPS access to
+`releases.dynomate.io`.
+
+If install scripts cannot run, download the archive for your platform and the
+[SHA256SUMS](https://releases.dynomate.io/cli/dynomate-cli-v0.0.10/SHA256SUMS)
+manifest directly, verify it, and invoke `dynomate-cli` (`dynomate-cli.exe` on
+Windows) yourself:
+
+- [macOS Apple Silicon](https://releases.dynomate.io/cli/dynomate-cli-v0.0.10/dynomate-cli-v0.0.10-aarch64-apple-darwin.tar.gz)
+- [macOS Intel](https://releases.dynomate.io/cli/dynomate-cli-v0.0.10/dynomate-cli-v0.0.10-x86_64-apple-darwin.tar.gz)
+- [GNU/Linux x64](https://releases.dynomate.io/cli/dynomate-cli-v0.0.10/dynomate-cli-v0.0.10-x86_64-unknown-linux-gnu.tar.gz)
+- [Windows x64](https://releases.dynomate.io/cli/dynomate-cli-v0.0.10/dynomate-cli-v0.0.10-x86_64-pc-windows-msvc.zip)
+
+## License
+
+Dynomate CLI is proprietary software. See `LICENSE` in this package.

package/bin/dynomate-cli.js

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+
+import { launch } from "../lib/launcher.js";
+
+try {
+  const { code, signal } = await launch();
+  if (signal) {
+    process.removeAllListeners(signal);
+    process.kill(process.pid, signal);
+  } else {
+    process.exitCode = code ?? 1;
+  }
+} catch (error) {
+  console.error(`dynomate-cli: ${error.message}`);
+  process.exitCode = 1;
+}

package/lib/archive.js

@@ -0,0 +1,117 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { gunzipSync, inflateRawSync } from "node:zlib";
+
+function basename(path) {
+  return path.replaceAll("\\", "/").split("/").filter(Boolean).at(-1);
+}
+
+function tarString(buffer, start, length) {
+  return buffer.subarray(start, start + length).toString("utf8").replace(/\0.*$/, "").trim();
+}
+
+function oneExecutable(matches, executableName) {
+  if (matches.length === 0) throw new Error(`Archive does not contain ${executableName}`);
+  if (matches.length > 1) throw new Error(`Archive contains more than one ${executableName}`);
+  if (matches[0].length === 0) throw new Error(`Archive contains an empty ${executableName}`);
+  return matches[0];
+}
+
+function extractTarGz(buffer, executableName) {
+  const tar = gunzipSync(buffer);
+  const matches = [];
+  for (let offset = 0; offset + 512 <= tar.length;) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every((byte) => byte === 0)) break;
+    const checksumText = tarString(header, 148, 8).replace(/^0+/, "") || "0";
+    if (!/^[0-7]+$/.test(checksumText)) throw new Error("Archive contains an invalid tar header checksum");
+    const expectedChecksum = Number.parseInt(checksumText, 8);
+    let actualChecksum = 0;
+    for (let index = 0; index < 512; index += 1) {
+      actualChecksum += index >= 148 && index < 156 ? 32 : header[index];
+    }
+    if (actualChecksum !== expectedChecksum) throw new Error("Archive contains a corrupt tar header");
+    const prefix = tarString(header, 345, 155);
+    const name = `${prefix}${prefix ? "/" : ""}${tarString(header, 0, 100)}`;
+    const sizeText = tarString(header, 124, 12).replace(/^0+/, "") || "0";
+    if (!/^[0-7]+$/.test(sizeText)) throw new Error("Archive contains an invalid tar entry size");
+    const size = Number.parseInt(sizeText, 8);
+    const type = header[156];
+    const dataStart = offset + 512;
+    const dataEnd = dataStart + size;
+    if (!Number.isSafeInteger(size) || dataEnd > tar.length) throw new Error("Archive contains a truncated tar entry");
+    if (basename(name) === executableName) {
+      if (type !== 0 && type !== 48) throw new Error(`Archive entry ${name} is not a regular file`);
+      matches.push(Buffer.from(tar.subarray(dataStart, dataEnd)));
+    }
+    offset = dataStart + Math.ceil(size / 512) * 512;
+  }
+  return oneExecutable(matches, executableName);
+}
+
+function crc32(buffer) {
+  let crc = 0xffffffff;
+  for (const byte of buffer) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit += 1) crc = (crc >>> 1) ^ (0xedb88320 & -(crc & 1));
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+function extractZip(buffer, executableName) {
+  let eocd = -1;
+  for (let offset = buffer.length - 22; offset >= Math.max(0, buffer.length - 65_557); offset -= 1) {
+    if (buffer.readUInt32LE(offset) === 0x06054b50) { eocd = offset; break; }
+  }
+  if (eocd < 0) throw new Error("Archive is not a valid ZIP file");
+  const entries = buffer.readUInt16LE(eocd + 10);
+  let offset = buffer.readUInt32LE(eocd + 16);
+  const matches = [];
+  for (let index = 0; index < entries; index += 1) {
+    if (offset + 46 > buffer.length || buffer.readUInt32LE(offset) !== 0x02014b50) throw new Error("ZIP central directory is invalid");
+    const flags = buffer.readUInt16LE(offset + 8);
+    const method = buffer.readUInt16LE(offset + 10);
+    const expectedCrc = buffer.readUInt32LE(offset + 16);
+    const compressedSize = buffer.readUInt32LE(offset + 20);
+    const uncompressedSize = buffer.readUInt32LE(offset + 24);
+    const nameLength = buffer.readUInt16LE(offset + 28);
+    const extraLength = buffer.readUInt16LE(offset + 30);
+    const commentLength = buffer.readUInt16LE(offset + 32);
+    const localOffset = buffer.readUInt32LE(offset + 42);
+    const nameEnd = offset + 46 + nameLength;
+    if (nameEnd > buffer.length) throw new Error("ZIP central directory is truncated");
+    const name = buffer.subarray(offset + 46, nameEnd).toString("utf8");
+    if (basename(name) === executableName) {
+      if (flags & 1) throw new Error("Encrypted ZIP entries are not supported");
+      if (compressedSize === 0xffffffff || uncompressedSize === 0xffffffff || localOffset === 0xffffffff) throw new Error("ZIP64 archives are not supported");
+      if (localOffset + 30 > buffer.length || buffer.readUInt32LE(localOffset) !== 0x04034b50) throw new Error("ZIP local header is invalid");
+      const localNameLength = buffer.readUInt16LE(localOffset + 26);
+      const localExtraLength = buffer.readUInt16LE(localOffset + 28);
+      const start = localOffset + 30 + localNameLength + localExtraLength;
+      const end = start + compressedSize;
+      if (end > buffer.length) throw new Error("Archive contains a truncated ZIP entry");
+      const compressed = buffer.subarray(start, end);
+      const data = method === 0 ? Buffer.from(compressed) : method === 8 ? inflateRawSync(compressed) : null;
+      if (!data) throw new Error(`Unsupported ZIP compression method: ${method}`);
+      if (data.length !== uncompressedSize || crc32(data) !== expectedCrc) throw new Error(`ZIP entry ${name} failed integrity validation`);
+      matches.push(data);
+    }
+    offset += 46 + nameLength + extraLength + commentLength;
+  }
+  return oneExecutable(matches, executableName);
+}
+
+export async function extractExecutable(archivePath, format, executableName, destination) {
+  const archive = await readFile(archivePath);
+  let executable;
+  try {
+    executable = format === "tar.gz"
+      ? extractTarGz(archive, executableName)
+      : format === "zip"
+        ? extractZip(archive, executableName)
+        : null;
+  } catch (error) {
+    throw new Error(`Could not extract ${executableName}: ${error.message}`, { cause: error });
+  }
+  if (!executable) throw new Error(`Unsupported archive format: ${format}`);
+  await writeFile(destination, executable, { flag: "wx", mode: 0o755 });
+}

package/lib/install.js

@@ -0,0 +1,54 @@
+import { chmod, mkdir, mkdtemp, rename, rm, stat } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { extractExecutable } from "./archive.js";
+import { downloadFile, downloadText } from "./network.js";
+import { nativeBinaryPath } from "./paths.js";
+import { parseChecksumManifest, releaseDescriptor } from "./release.js";
+
+async function exists(path) {
+  try {
+    await stat(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+export async function installNative(options = {}) {
+  const descriptor = releaseDescriptor(options);
+  const destination = options.destination || nativeBinaryPath(descriptor);
+  const parent = dirname(destination);
+  await mkdir(parent, { recursive: true });
+  const temporaryDirectory = await mkdtemp(join(parent, ".install-"));
+  const archivePath = join(temporaryDirectory, descriptor.archiveName);
+  const stagedBinary = join(temporaryDirectory, descriptor.executable);
+  const backup = `${destination}.previous-${process.pid}`;
+  let movedExisting = false;
+  try {
+    const manifest = await downloadText(descriptor.checksumUrl);
+    const expectedHash = parseChecksumManifest(manifest, descriptor.archiveName);
+    const actualHash = await downloadFile(descriptor.archiveUrl, archivePath);
+    if (actualHash !== expectedHash) {
+      throw new Error(`Checksum mismatch for ${descriptor.archiveName}: expected ${expectedHash}, received ${actualHash}`);
+    }
+    await extractExecutable(archivePath, descriptor.format, descriptor.executable, stagedBinary);
+    if (descriptor.platform !== "win32") await chmod(stagedBinary, 0o755);
+    if (await exists(destination)) {
+      await rm(backup, { force: true });
+      await rename(destination, backup);
+      movedExisting = true;
+    }
+    try {
+      await rename(stagedBinary, destination);
+    } catch (error) {
+      if (movedExisting) await rename(backup, destination);
+      movedExisting = false;
+      throw error;
+    }
+    if (movedExisting) await rm(backup, { force: true });
+    return { destination, descriptor, sha256: actualHash };
+  } finally {
+    await rm(temporaryDirectory, { recursive: true, force: true });
+  }
+}

package/lib/launcher.js

@@ -0,0 +1,43 @@
+import { spawn } from "node:child_process";
+import { access } from "node:fs/promises";
+import { constants } from "node:fs";
+import { nativeBinaryPath } from "./paths.js";
+
+export async function ensureNativeBinary(binary = nativeBinaryPath()) {
+  try {
+    await access(binary, process.platform === "win32" ? constants.F_OK : constants.X_OK);
+  } catch {
+    throw new Error(
+      "The native Dynomate CLI is not installed. Reinstall @dynomate/cli without --ignore-scripts, or use a direct archive from https://releases.dynomate.io/cli/.",
+    );
+  }
+  return binary;
+}
+
+export function spawnNative(binary, args, options = {}) {
+  const child = spawn(binary, args, {
+    stdio: "inherit",
+    windowsHide: false,
+    ...options,
+  });
+  const forwardedSignals = process.platform === "win32" ? ["SIGINT", "SIGTERM"] : ["SIGINT", "SIGTERM", "SIGHUP"];
+  const handlers = new Map();
+  for (const signal of forwardedSignals) {
+    const handler = () => {
+      if (!child.killed) child.kill(signal);
+    };
+    handlers.set(signal, handler);
+    process.on(signal, handler);
+  }
+  return new Promise((resolve, reject) => {
+    child.once("error", reject);
+    child.once("close", (code, signal) => resolve({ code, signal }));
+  }).finally(() => {
+    for (const [signal, handler] of handlers) process.off(signal, handler);
+  });
+}
+
+export async function launch(args = process.argv.slice(2), options = {}) {
+  const binary = await ensureNativeBinary(options.binary);
+  return spawnNative(binary, args, options.spawnOptions);
+}

package/lib/network.js

@@ -0,0 +1,61 @@
+import { createWriteStream } from "node:fs";
+import { createHash } from "node:crypto";
+import { get as httpGet } from "node:http";
+import { get as httpsGet } from "node:https";
+import { pipeline } from "node:stream/promises";
+
+const MAX_REDIRECTS = 5;
+const MAX_MANIFEST_BYTES = 1024 * 1024;
+const REQUEST_TIMEOUT_MS = 30_000;
+
+function open(url, redirects = 0) {
+  return new Promise((resolve, reject) => {
+    const parsed = new URL(url);
+    const get = parsed.protocol === "https:" ? httpsGet : parsed.protocol === "http:" ? httpGet : null;
+    if (!get) return reject(new Error(`Unsupported download protocol: ${parsed.protocol}`));
+    const request = get(parsed, { headers: { "user-agent": "@dynomate/cli installer" } }, (response) => {
+      const status = response.statusCode ?? 0;
+      if (status >= 300 && status < 400 && response.headers.location) {
+        response.resume();
+        if (redirects >= MAX_REDIRECTS) return reject(new Error(`Too many redirects while downloading ${url}`));
+        const redirected = new URL(response.headers.location, parsed);
+        if (parsed.protocol === "https:" && redirected.protocol !== "https:") {
+          return reject(new Error(`Refusing insecure redirect while downloading ${url}`));
+        }
+        return resolve(open(redirected.href, redirects + 1));
+      }
+      if (status !== 200) {
+        response.resume();
+        return reject(new Error(`Download failed with HTTP ${status}: ${url}`));
+      }
+      resolve(response);
+    });
+    request.setTimeout(REQUEST_TIMEOUT_MS, () => {
+      request.destroy(new Error(`Download timed out after ${REQUEST_TIMEOUT_MS} ms: ${url}`));
+    });
+    request.on("error", (error) => reject(new Error(`Download failed for ${url}: ${error.message}`, { cause: error })));
+  });
+}
+
+export async function downloadText(url) {
+  const response = await open(url);
+  const chunks = [];
+  let length = 0;
+  for await (const chunk of response) {
+    length += chunk.length;
+    if (length > MAX_MANIFEST_BYTES) {
+      response.destroy();
+      throw new Error(`Checksum manifest is larger than ${MAX_MANIFEST_BYTES} bytes`);
+    }
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+export async function downloadFile(url, destination) {
+  const response = await open(url);
+  const hash = createHash("sha256");
+  response.on("data", (chunk) => hash.update(chunk));
+  await pipeline(response, createWriteStream(destination, { flags: "wx", mode: 0o600 }));
+  return hash.digest("hex");
+}

package/lib/paths.js

@@ -0,0 +1,10 @@
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { PACKAGE_VERSION } from "./release.js";
+
+export const PACKAGE_ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+
+export function nativeBinaryPath({ platform = process.platform, version = PACKAGE_VERSION } = {}) {
+  const extension = platform === "win32" ? ".exe" : "";
+  return join(PACKAGE_ROOT, "native", version, `dynomate-cli${extension}`);
+}

package/lib/release.js

@@ -0,0 +1,65 @@
+import { readFileSync } from "node:fs";
+
+const packageJson = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+
+export const PACKAGE_VERSION = packageJson.version;
+export const RELEASE_TAG = `dynomate-cli-v${PACKAGE_VERSION}`;
+export const DEFAULT_RELEASE_BASE_URL = "https://releases.dynomate.io/cli";
+
+const TARGETS = new Map([
+  ["darwin-arm64", { triple: "aarch64-apple-darwin", format: "tar.gz", executable: "dynomate-cli" }],
+  ["darwin-x64", { triple: "x86_64-apple-darwin", format: "tar.gz", executable: "dynomate-cli" }],
+  ["linux-x64", { triple: "x86_64-unknown-linux-gnu", format: "tar.gz", executable: "dynomate-cli" }],
+  ["win32-x64", { triple: "x86_64-pc-windows-msvc", format: "zip", executable: "dynomate-cli.exe" }],
+]);
+
+export function selectTarget(platform = process.platform, arch = process.arch) {
+  const target = TARGETS.get(`${platform}-${arch}`);
+  if (!target) {
+    throw new Error(
+      `Unsupported platform: ${platform}/${arch}. Supported targets are macOS arm64/x64, Linux x64, and Windows x64.`,
+    );
+  }
+  return { ...target, platform, arch };
+}
+
+export function releaseDescriptor({
+  platform = process.platform,
+  arch = process.arch,
+  baseUrl = process.env.DYNOMATE_CLI_RELEASE_BASE_URL || DEFAULT_RELEASE_BASE_URL,
+  version = PACKAGE_VERSION,
+} = {}) {
+  if (!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(version)) {
+    throw new Error(`Invalid package version: ${version}`);
+  }
+  const target = selectTarget(platform, arch);
+  const tag = `dynomate-cli-v${version}`;
+  const archiveName = `${tag}-${target.triple}.${target.format}`;
+  const releaseUrl = `${baseUrl.replace(/\/$/, "")}/${tag}`;
+  return {
+    ...target,
+    version,
+    tag,
+    archiveName,
+    archiveUrl: `${releaseUrl}/${archiveName}`,
+    checksumUrl: `${releaseUrl}/SHA256SUMS`,
+  };
+}
+
+export function parseChecksumManifest(text, archiveName) {
+  const matches = [];
+  for (const line of text.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    const match = /^([a-fA-F0-9]{64})\s+\*?(.+?)\s*$/.exec(line);
+    if (!match) throw new Error("Invalid SHA256SUMS manifest");
+    if (match[2] === archiveName) matches.push(match[1].toLowerCase());
+  }
+  if (matches.length !== 1) {
+    throw new Error(
+      matches.length === 0
+        ? `SHA256SUMS does not contain ${archiveName}`
+        : `SHA256SUMS contains duplicate entries for ${archiveName}`,
+    );
+  }
+  return matches[0];
+}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@dynomate/cli",
+  "version": "0.0.10",
+  "description": "Installer and launcher for the native Dynomate CLI",
+  "type": "module",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Bagio-labs/hammer.git",
+    "directory": "packages/cli"
+  },
+  "homepage": "https://dynomate.io",
+  "bugs": {
+    "url": "https://github.com/Bagio-labs/hammer/issues"
+  },
+  "publishConfig": {
+    "access": "public",
+    "tag": "next"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "bin": {
+    "dynomate-cli": "bin/dynomate-cli.js"
+  },
+  "files": [
+    "bin/",
+    "lib/",
+    "scripts/",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "postinstall": "node scripts/install.js",
+    "test": "node --test",
+    "pack:check": "npm pack --dry-run"
+  }
+}

package/scripts/install.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+
+import { installNative } from "../lib/install.js";
+
+try {
+  const { descriptor } = await installNative();
+  console.log(`Installed dynomate-cli ${descriptor.version} for ${descriptor.triple}`);
+} catch (error) {
+  console.error(`Failed to install dynomate-cli: ${error.message}`);
+  process.exitCode = 1;
+}