@stigmer/cli 3.32.0 → 3.34.0

package/local/artifact.d.ts

@@ -21,12 +21,19 @@ export interface TarballBinarySource {
     label: string;
     /** Override the fetch implementation (tests). */
     fetchImpl?: typeof fetch;
+    /** Override the wait between download attempts (tests). */
+    sleep?: (ms: number) => Promise<void>;
 }
+/** Attempts per download before a transient failure is reported. */
+export declare const DOWNLOAD_ATTEMPTS = 4;
+/** The wait before the second attempt; it doubles before each later one (1 s, 2 s, 4 s). */
+export declare const DOWNLOAD_RETRY_BASE_DELAY_MS = 1000;
 /**
  * Download a `.tar.gz`, optionally verify its sha256, extract the named entry,
- * and write it to `binPath` with executable permissions. Throws a
- * {@link CliExitError} with the URL on any network, checksum, or extraction
- * failure.
+ * and write it to `binPath` with executable permissions. Transient network
+ * failures are retried (see the module header). Throws a {@link CliExitError}
+ * with the URL on a persistent network failure, a non-transient HTTP status, a
+ * checksum mismatch, or an extraction failure.
  */
 export declare function fetchTarballBinary(src: TarballBinarySource): Promise<void>;
 /** Lowercase hex sha256 of `bytes`. */

package/local/artifact.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifact.d.ts","sourceRoot":"","sources":["../../src/local/artifact.ts"],"names":[],"mappings":"AAkBA,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAS9D;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASnD;AAED,MAAM,WAAW,mBAAmB;IAClC,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhF;AAED,uCAAuC;AACvC,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEnD;AAyBD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOrE;AASD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAoBhF"}
+{"version":3,"file":"artifact.d.ts","sourceRoot":"","sources":["../../src/local/artifact.ts"],"names":[],"mappings":"AAyBA,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAS9D;AAED,oFAAoF;AACpF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASnD;AAED,MAAM,WAAW,mBAAmB;IAClC,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,oEAAoE;AACpE,eAAO,MAAM,iBAAiB,IAAI,CAAC;AAEnC,4FAA4F;AAC5F,eAAO,MAAM,4BAA4B,OAAQ,CAAC;AAElD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BhF;AAED,uCAAuC;AACvC,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEnD;AAmED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOrE;AASD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAoBhF"}

package/local/artifact.js

@@ -8,9 +8,16 @@
 // second consumer until the server became an npm artifact.) The tar reader is a
 // tiny POSIX/ustar implementation: no native `tar` dependency, which keeps the
 // base install lean (DD-002).
+//
+// Retrying a transient failure is part of the contract. A connection that resets
+// before or during the body, a 5xx or a 429 is tried again with a doubling wait,
+// so a network blip does not fail a first `stigmer up`, a CI lane or an image
+// build. Any other HTTP status and a checksum mismatch are answers: they fail at
+// once.
 import { createHash } from "node:crypto";
 import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 import { gunzipSync } from "fflate";
 import { CliExitError } from "../errors/cli-exit-error.js";
 import { ExitCode } from "../errors/exit-codes.js";
@@ -36,18 +43,23 @@ export function mapReleaseArch(arch) {
             return arch;
     }
 }
+/** Attempts per download before a transient failure is reported. */
+export const DOWNLOAD_ATTEMPTS = 4;
+/** The wait before the second attempt; it doubles before each later one (1 s, 2 s, 4 s). */
+export const DOWNLOAD_RETRY_BASE_DELAY_MS = 1_000;
 /**
  * Download a `.tar.gz`, optionally verify its sha256, extract the named entry,
- * and write it to `binPath` with executable permissions. Throws a
- * {@link CliExitError} with the URL on any network, checksum, or extraction
- * failure.
+ * and write it to `binPath` with executable permissions. Transient network
+ * failures are retried (see the module header). Throws a {@link CliExitError}
+ * with the URL on a persistent network failure, a non-transient HTTP status, a
+ * checksum mismatch, or an extraction failure.
  */
 export async function fetchTarballBinary(src) {
-    const doFetch = src.fetchImpl ?? fetch;
-    const archive = await fetchBytes(doFetch, src.url, src.label);
+    const net = { doFetch: src.fetchImpl ?? fetch, sleep: src.sleep ?? delay };
+    const archive = await fetchBytes(net, src.url, src.label);
     if (src.checksumUrl !== undefined) {
         const archiveName = archiveBasename(src.url);
-        const expected = parseShasum(await fetchText(doFetch, src.checksumUrl, `${src.label} checksum`), archiveName);
+        const expected = parseShasum(await fetchText(net, src.checksumUrl, `${src.label} checksum`), archiveName);
         const actual = sha256Hex(archive);
         if (expected === "" || expected !== actual) {
             throw new CliExitError(`${src.label} checksum mismatch — refusing to use the download`, ExitCode.General, [
@@ -72,26 +84,53 @@ export async function fetchTarballBinary(src) {
 export function sha256Hex(bytes) {
     return createHash("sha256").update(bytes).digest("hex");
 }
-async function fetchBytes(doFetch, url, label) {
-    const res = await doFetchOrThrow(doFetch, url, label);
-    return new Uint8Array(await res.arrayBuffer());
+async function fetchBytes(net, url, label) {
+    return fetchWithRetry(net, url, label, async (res) => new Uint8Array(await res.arrayBuffer()));
 }
-async function fetchText(doFetch, url, label) {
-    const res = await doFetchOrThrow(doFetch, url, label);
-    return res.text();
+async function fetchText(net, url, label) {
+    return fetchWithRetry(net, url, label, (res) => res.text());
 }
-async function doFetchOrThrow(doFetch, url, label) {
-    let res;
-    try {
-        res = await doFetch(url);
-    }
-    catch (err) {
-        throw new CliExitError(`failed to download ${label} from ${url}`, ExitCode.General, [String(err)]);
-    }
-    if (!res.ok) {
-        throw new CliExitError(`failed to download ${label}: HTTP ${res.status} from ${url}`, ExitCode.General);
+// One download, with its body read inside the attempt: a connection that drops
+// after the headers is as transient as one that never connects, and is retried
+// the same way. The error after the last attempt carries the last failure's
+// cause, which for Node's fetch is the socket error behind "fetch failed".
+async function fetchWithRetry(net, url, label, read) {
+    let lastFailure = "";
+    for (let attempt = 1; attempt <= DOWNLOAD_ATTEMPTS; attempt++) {
+        if (attempt > 1)
+            await net.sleep(DOWNLOAD_RETRY_BASE_DELAY_MS * 2 ** (attempt - 2));
+        let res;
+        try {
+            res = await net.doFetch(url);
+        }
+        catch (err) {
+            lastFailure = describeFailure(err);
+            continue;
+        }
+        if (!res.ok) {
+            if (!isTransientStatus(res.status)) {
+                throw new CliExitError(`failed to download ${label}: HTTP ${res.status} from ${url}`, ExitCode.General);
+            }
+            lastFailure = `HTTP ${res.status}`;
+            continue;
+        }
+        try {
+            return await read(res);
+        }
+        catch (err) {
+            lastFailure = describeFailure(err);
+        }
     }
-    return res;
+    throw new CliExitError(`failed to download ${label} from ${url} after ${DOWNLOAD_ATTEMPTS} attempts: ${lastFailure}`, ExitCode.General, ["check the network connection, then run the command again"]);
+}
+// A server error or a rate limit may clear on its own; any other status will not.
+function isTransientStatus(status) {
+    return status >= 500 || status === 429;
+}
+function describeFailure(err) {
+    if (!(err instanceof Error))
+        return String(err);
+    return err.cause instanceof Error ? `${err.message}: ${err.cause.message}` : err.message;
 }
 /**
  * The sha256 a `shasum`/`sha256sum`-format file records for `filename`, lowercase

package/local/artifact.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifact.js","sourceRoot":"","sources":["../../src/local/artifact.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,2EAA2E;AAC3E,iEAAiE;AACjE,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,8BAA8B;AAE9B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,QAAyB;IACpD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,OAAO;YACV,OAAO,SAAS,CAAC;QACnB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,OAAO,CAAC;QACjB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAuBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAwB;IAC/D,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC;IACvC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAE9D,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,KAAK,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAC9G,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,IAAI,YAAY,CAAC,GAAG,GAAG,CAAC,KAAK,mDAAmD,EAAE,QAAQ,CAAC,OAAO,EAAE;gBACxG,aAAa,QAAQ,IAAI,iBAAiB,WAAW,OAAO,GAAG,CAAC,WAAW,GAAG,EAAE;gBAChF,aAAa,MAAM,EAAE;gBACrB,aAAa,GAAG,CAAC,GAAG,EAAE;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CAAC,GAAG,GAAG,CAAC,SAAS,gCAAgC,GAAG,CAAC,KAAK,UAAU,EAAE,QAAQ,CAAC,OAAO,EAAE;YAC5G,YAAY,GAAG,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,SAAS,CAAC,KAAiB;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAAqB,EAAE,GAAW,EAAE,KAAa;IACzE,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACtD,OAAO,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAqB,EAAE,GAAW,EAAE,KAAa;IACxE,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACtD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,OAAqB,EAAE,GAAW,EAAE,KAAa;IAC7E,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,YAAY,CAAC,sBAAsB,KAAK,SAAS,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,YAAY,CAAC,sBAAsB,KAAK,UAAU,GAAG,CAAC,MAAM,SAAS,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,QAAgB;IAC3D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACtD,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AACrE,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAe,EAAE,IAAY;IAC3D,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,EAAE;YAAE,MAAM,CAAC,kCAAkC;QAE/D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,GAAG,GAAG,CAAC;QAE/B,MAAM,aAAa,GAAG,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,CAAC;QAC5D,IAAI,aAAa,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;QACnD,CAAC;QAED,yEAAyE;QACzE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB,EAAE,KAAa,EAAE,MAAc;IACnE,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,MAAM,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC7B,OAAO,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC"}
+{"version":3,"file":"artifact.js","sourceRoot":"","sources":["../../src/local/artifact.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,2EAA2E;AAC3E,iEAAiE;AACjE,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,8BAA8B;AAC9B,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,8EAA8E;AAC9E,iFAAiF;AACjF,QAAQ;AAER,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,QAAyB;IACpD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC;QAClB,KAAK,OAAO;YACV,OAAO,SAAS,CAAC;QACnB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,OAAO,CAAC;QACjB;YACE,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC;AAyBD,oEAAoE;AACpE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAEnC,4FAA4F;AAC5F,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAwB;IAC/D,MAAM,GAAG,GAAa,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,IAAI,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC;IACrF,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAE1D,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,KAAK,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,IAAI,YAAY,CAAC,GAAG,GAAG,CAAC,KAAK,mDAAmD,EAAE,QAAQ,CAAC,OAAO,EAAE;gBACxG,aAAa,QAAQ,IAAI,iBAAiB,WAAW,OAAO,GAAG,CAAC,WAAW,GAAG,EAAE;gBAChF,aAAa,MAAM,EAAE;gBACrB,aAAa,GAAG,CAAC,GAAG,EAAE;aACvB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACxD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CAAC,GAAG,GAAG,CAAC,SAAS,gCAAgC,GAAG,CAAC,KAAK,UAAU,EAAE,QAAQ,CAAC,OAAO,EAAE;YAC5G,YAAY,GAAG,CAAC,GAAG,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpD,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,SAAS,CAAC,KAAiB;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAQD,KAAK,UAAU,UAAU,CAAC,GAAa,EAAE,GAAW,EAAE,KAAa;IACjE,OAAO,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAa,EAAE,GAAW,EAAE,KAAa;IAChE,OAAO,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,2EAA2E;AAC3E,KAAK,UAAU,cAAc,CAC3B,GAAa,EACb,GAAW,EACX,KAAa,EACb,IAAmC;IAEnC,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,iBAAiB,EAAE,OAAO,EAAE,EAAE,CAAC;QAC9D,IAAI,OAAO,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC,KAAK,CAAC,4BAA4B,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QAEpF,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YACnC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,YAAY,CAAC,sBAAsB,KAAK,UAAU,GAAG,CAAC,MAAM,SAAS,GAAG,EAAE,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC1G,CAAC;YACD,WAAW,GAAG,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YACnC,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,sBAAsB,KAAK,SAAS,GAAG,UAAU,iBAAiB,cAAc,WAAW,EAAE,EAC7F,QAAQ,CAAC,OAAO,EAChB,CAAC,0DAA0D,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AACzC,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;AAC3F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,QAAgB;IAC3D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACtD,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AACrE,SAAS,eAAe,CAAC,GAAW;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAe,EAAE,IAAY;IAC3D,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,EAAE;YAAE,MAAM,CAAC,kCAAkC;QAE/D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,MAAM,SAAS,GAAG,MAAM,GAAG,GAAG,CAAC;QAE/B,MAAM,aAAa,GAAG,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,IAAI,CAAC;QAC5D,IAAI,aAAa,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;QACnD,CAAC;QAED,yEAAyE;QACzE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,KAAiB,EAAE,KAAa,EAAE,MAAc;IACnE,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,MAAM,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC;IAC7B,OAAO,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,GAAG,IAAI,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;AACzC,CAAC"}

package/local/temporal/download.d.ts

@@ -1,5 +1,9 @@
 export { extractTarEntry } from "../artifact.js";
-/** Default Temporal CLI version (matches the Go CLI's `DefaultTemporalVersion`). */
+/**
+ * The Temporal CLI version every channel runs: `stigmer up`, the all-in-one
+ * image, and the CI lanes and developer machines that install it with
+ * `make install-temporal-cli`. Bump it deliberately; it moves all of them.
+ */
 export declare const DEFAULT_TEMPORAL_VERSION = "1.5.1";
 /** The release's `sha256sum`-format digest file, one line per published asset. */
 export declare const TEMPORAL_CHECKSUMS_FILE = "checksums.txt";
@@ -14,6 +18,8 @@ export interface TemporalDownloadTarget {
     arch?: string;
     /** Override the fetch implementation (tests). */
     fetchImpl?: typeof fetch;
+    /** Override the wait between download attempts (tests). */
+    sleep?: (ms: number) => Promise<void>;
 }
 /** The release asset name for a version on a platform, as Temporal publishes it. */
 export declare function temporalArchiveName(version: string, platform: NodeJS.Platform, arch: string): string;

package/local/temporal/download.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../../src/local/temporal/download.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,UAAU,CAAC;AAEhD,kFAAkF;AAClF,eAAO,MAAM,uBAAuB,kBAAkB,CAAC;AAEvD,MAAM,WAAW,sBAAsB;IACrC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpG;AAED,kEAAkE;AAClE,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,yEAAyE;AACzE,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAWvF;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE5D"}
+{"version":3,"file":"download.d.ts","sourceRoot":"","sources":["../../../src/local/temporal/download.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,UAAU,CAAC;AAEhD,kFAAkF;AAClF,eAAO,MAAM,uBAAuB,kBAAkB,CAAC;AAEvD,MAAM,WAAW,sBAAsB;IACrC,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpG;AAED,kEAAkE;AAClE,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,yEAAyE;AACzE,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYvF;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE5D"}

package/local/temporal/download.js

@@ -15,7 +15,11 @@ import { fetchTarballBinary, mapReleaseArch, mapReleaseOs } from "../artifact.js
 // Re-exported so existing consumers (temporal/index.ts, download.test.ts) keep
 // importing the tar reader from here.
 export { extractTarEntry } from "../artifact.js";
-/** Default Temporal CLI version (matches the Go CLI's `DefaultTemporalVersion`). */
+/**
+ * The Temporal CLI version every channel runs: `stigmer up`, the all-in-one
+ * image, and the CI lanes and developer machines that install it with
+ * `make install-temporal-cli`. Bump it deliberately; it moves all of them.
+ */
 export const DEFAULT_TEMPORAL_VERSION = "1.5.1";
 /** The release's `sha256sum`-format digest file, one line per published asset. */
 export const TEMPORAL_CHECKSUMS_FILE = "checksums.txt";
@@ -37,6 +41,7 @@ export async function downloadTemporalCli(target) {
         binPath: target.binPath,
         label: "Temporal CLI",
         fetchImpl: target.fetchImpl,
+        sleep: target.sleep,
     });
 }
 /** True if a Temporal binary is already present at `binPath`. */

package/local/temporal/download.js.map

@@ -1 +1 @@
-{"version":3,"file":"download.js","sourceRoot":"","sources":["../../../src/local/temporal/download.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,uEAAuE;AACvE,mDAAmD;AACnD,EAAE;AACF,wEAAwE;AACxE,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAE/E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAElF,+EAA+E;AAC/E,sCAAsC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD,oFAAoF;AACpF,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEhD,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAevD,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,QAAyB,EAAE,IAAY;IAC1F,OAAO,gBAAgB,OAAO,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;AAC5F,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,KAAa;IACpE,OAAO,wDAAwD,OAAO,IAAI,KAAK,EAAE,CAAC;AACpF,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAA8B;IACtE,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtH,MAAM,kBAAkB,CAAC;QACvB,GAAG,EAAE,uBAAuB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;QACrD,WAAW,EAAE,uBAAuB,CAAC,MAAM,CAAC,OAAO,EAAE,uBAAuB,CAAC;QAC7E,SAAS,EAAE,UAAU;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"download.js","sourceRoot":"","sources":["../../../src/local/temporal/download.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,uEAAuE;AACvE,mDAAmD;AACnD,EAAE;AACF,wEAAwE;AACxE,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAE/E,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAElF,+EAA+E;AAC/E,sCAAsC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEhD,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAAG,eAAe,CAAC;AAiBvD,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,QAAyB,EAAE,IAAY;IAC1F,OAAO,gBAAgB,OAAO,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;AAC5F,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,KAAa;IACpE,OAAO,wDAAwD,OAAO,IAAI,KAAK,EAAE,CAAC;AACpF,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAA8B;IACtE,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtH,MAAM,kBAAkB,CAAC;QACvB,GAAG,EAAE,uBAAuB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;QACrD,WAAW,EAAE,uBAAuB,CAAC,MAAM,CAAC,OAAO,EAAE,uBAAuB,CAAC;QAC7E,SAAS,EAAE,UAAU;QACrB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/cli",
-  "version": "3.32.0",
+  "version": "3.34.0",
   "description": "Stigmer command-line interface — manage agents, workflows, MCP servers, skills, and executions from the terminal",
   "license": "Apache-2.0",
   "type": "module",
@@ -35,12 +35,12 @@
     "@connectrpc/connect": "^2.0.0",
     "@connectrpc/connect-node": "^2.1.1",
     "@modelcontextprotocol/sdk": "^1.26.0",
-    "@stigmer/ink": "3.32.0",
-    "@stigmer/mcp-server": "3.32.0",
-    "@stigmer/plugin-package": "3.32.0",
-    "@stigmer/protos": "3.32.0",
-    "@stigmer/sdk": "3.32.0",
-    "@stigmer/zip-structure": "3.32.0",
+    "@stigmer/ink": "3.34.0",
+    "@stigmer/mcp-server": "3.34.0",
+    "@stigmer/plugin-package": "3.34.0",
+    "@stigmer/protos": "3.34.0",
+    "@stigmer/sdk": "3.34.0",
+    "@stigmer/zip-structure": "3.34.0",
     "commander": "^12.1.0",
     "fflate": "^0.8.3",
     "ink": "^7.0.0",

package/src/local/artifact.ts

@@ -8,10 +8,17 @@
 // second consumer until the server became an npm artifact.) The tar reader is a
 // tiny POSIX/ustar implementation: no native `tar` dependency, which keeps the
 // base install lean (DD-002).
+//
+// Retrying a transient failure is part of the contract. A connection that resets
+// before or during the body, a 5xx or a 429 is tried again with a doubling wait,
+// so a network blip does not fail a first `stigmer up`, a CI lane or an image
+// build. Any other HTTP status and a checksum mismatch are answers: they fail at
+// once.
 
 import { createHash } from "node:crypto";
 import { chmodSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
 import { gunzipSync } from "fflate";
 import { CliExitError } from "../errors/cli-exit-error.js";
 import { ExitCode } from "../errors/exit-codes.js";
@@ -59,21 +66,30 @@ export interface TarballBinarySource {
   label: string;
   /** Override the fetch implementation (tests). */
   fetchImpl?: typeof fetch;
+  /** Override the wait between download attempts (tests). */
+  sleep?: (ms: number) => Promise<void>;
 }
 
+/** Attempts per download before a transient failure is reported. */
+export const DOWNLOAD_ATTEMPTS = 4;
+
+/** The wait before the second attempt; it doubles before each later one (1 s, 2 s, 4 s). */
+export const DOWNLOAD_RETRY_BASE_DELAY_MS = 1_000;
+
 /**
  * Download a `.tar.gz`, optionally verify its sha256, extract the named entry,
- * and write it to `binPath` with executable permissions. Throws a
- * {@link CliExitError} with the URL on any network, checksum, or extraction
- * failure.
+ * and write it to `binPath` with executable permissions. Transient network
+ * failures are retried (see the module header). Throws a {@link CliExitError}
+ * with the URL on a persistent network failure, a non-transient HTTP status, a
+ * checksum mismatch, or an extraction failure.
  */
 export async function fetchTarballBinary(src: TarballBinarySource): Promise<void> {
-  const doFetch = src.fetchImpl ?? fetch;
-  const archive = await fetchBytes(doFetch, src.url, src.label);
+  const net: Download = { doFetch: src.fetchImpl ?? fetch, sleep: src.sleep ?? delay };
+  const archive = await fetchBytes(net, src.url, src.label);
 
   if (src.checksumUrl !== undefined) {
     const archiveName = archiveBasename(src.url);
-    const expected = parseShasum(await fetchText(doFetch, src.checksumUrl, `${src.label} checksum`), archiveName);
+    const expected = parseShasum(await fetchText(net, src.checksumUrl, `${src.label} checksum`), archiveName);
     const actual = sha256Hex(archive);
     if (expected === "" || expected !== actual) {
       throw new CliExitError(`${src.label} checksum mismatch — refusing to use the download`, ExitCode.General, [
@@ -102,27 +118,69 @@ export function sha256Hex(bytes: Uint8Array): string {
   return createHash("sha256").update(bytes).digest("hex");
 }
 
-async function fetchBytes(doFetch: typeof fetch, url: string, label: string): Promise<Uint8Array> {
-  const res = await doFetchOrThrow(doFetch, url, label);
-  return new Uint8Array(await res.arrayBuffer());
+// The network a download runs over: the fetch it calls and the wait between attempts.
+interface Download {
+  doFetch: typeof fetch;
+  sleep: (ms: number) => Promise<void>;
 }
 
-async function fetchText(doFetch: typeof fetch, url: string, label: string): Promise<string> {
-  const res = await doFetchOrThrow(doFetch, url, label);
-  return res.text();
+async function fetchBytes(net: Download, url: string, label: string): Promise<Uint8Array> {
+  return fetchWithRetry(net, url, label, async (res) => new Uint8Array(await res.arrayBuffer()));
 }
 
-async function doFetchOrThrow(doFetch: typeof fetch, url: string, label: string): Promise<Response> {
-  let res: Response;
-  try {
-    res = await doFetch(url);
-  } catch (err) {
-    throw new CliExitError(`failed to download ${label} from ${url}`, ExitCode.General, [String(err)]);
-  }
-  if (!res.ok) {
-    throw new CliExitError(`failed to download ${label}: HTTP ${res.status} from ${url}`, ExitCode.General);
+async function fetchText(net: Download, url: string, label: string): Promise<string> {
+  return fetchWithRetry(net, url, label, (res) => res.text());
+}
+
+// One download, with its body read inside the attempt: a connection that drops
+// after the headers is as transient as one that never connects, and is retried
+// the same way. The error after the last attempt carries the last failure's
+// cause, which for Node's fetch is the socket error behind "fetch failed".
+async function fetchWithRetry<T>(
+  net: Download,
+  url: string,
+  label: string,
+  read: (res: Response) => Promise<T>,
+): Promise<T> {
+  let lastFailure = "";
+  for (let attempt = 1; attempt <= DOWNLOAD_ATTEMPTS; attempt++) {
+    if (attempt > 1) await net.sleep(DOWNLOAD_RETRY_BASE_DELAY_MS * 2 ** (attempt - 2));
+
+    let res: Response;
+    try {
+      res = await net.doFetch(url);
+    } catch (err) {
+      lastFailure = describeFailure(err);
+      continue;
+    }
+    if (!res.ok) {
+      if (!isTransientStatus(res.status)) {
+        throw new CliExitError(`failed to download ${label}: HTTP ${res.status} from ${url}`, ExitCode.General);
+      }
+      lastFailure = `HTTP ${res.status}`;
+      continue;
+    }
+    try {
+      return await read(res);
+    } catch (err) {
+      lastFailure = describeFailure(err);
+    }
   }
-  return res;
+  throw new CliExitError(
+    `failed to download ${label} from ${url} after ${DOWNLOAD_ATTEMPTS} attempts: ${lastFailure}`,
+    ExitCode.General,
+    ["check the network connection, then run the command again"],
+  );
+}
+
+// A server error or a rate limit may clear on its own; any other status will not.
+function isTransientStatus(status: number): boolean {
+  return status >= 500 || status === 429;
+}
+
+function describeFailure(err: unknown): string {
+  if (!(err instanceof Error)) return String(err);
+  return err.cause instanceof Error ? `${err.message}: ${err.cause.message}` : err.message;
 }
 
 /**

package/src/local/temporal/download.test.ts

@@ -1,9 +1,17 @@
+// The Temporal CLI download end to end over a scripted `fetch`: asset naming,
+// verification against the release's checksums.txt, extraction, and the retry
+// contract `../artifact.ts` gives every release download. The retry cases pin
+// which failures are transient (a dropped connection before or during the body,
+// a 5xx, a 429) and which are answers (a 404, a bad digest), the backoff, and
+// the error a persistent failure ends in. A recording `sleep` keeps them instant.
+
 import { createHash } from "node:crypto";
 import { existsSync, mkdtempSync, readFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { gzipSync } from "fflate";
 import { describe, expect, it } from "vitest";
+import { CliExitError } from "../../errors/cli-exit-error.js";
 import {
   TEMPORAL_CHECKSUMS_FILE,
   downloadTemporalCli,
@@ -130,3 +138,111 @@ describe("downloadTemporalCli", () => {
     await expect(downloadTemporalCli({ version: "9.9.9", binPath, fetchImpl })).rejects.toThrow(/HTTP 404/);
   });
 });
+
+type Failure = "reject" | "body" | number;
+
+// Wraps a release so requests for one asset fail as scripted before the real
+// release answers: each entry of `failures` is consumed by one request for
+// `asset`. "reject" is a connection that never answers (Node's fetch rejects
+// with the socket error as `cause`), "body" one that drops after the headers,
+// a number an HTTP status. `calls` counts the requests for `asset`.
+function flaky(inner: typeof fetch, asset: string, failures: Failure[]): { fetchImpl: typeof fetch; calls: () => number } {
+  let calls = 0;
+  const fetchImpl = (async (input: string | URL | Request) => {
+    const url = String(input);
+    if (!url.endsWith(`/${asset}`)) return inner(input);
+    calls += 1;
+    const failure = failures[calls - 1];
+    if (failure === "reject") throw new TypeError("fetch failed", { cause: new Error("read ECONNRESET") });
+    if (failure === "body") {
+      return {
+        ok: true,
+        status: 200,
+        arrayBuffer: async () => {
+          throw new TypeError("terminated", { cause: new Error("other side closed") });
+        },
+      } as unknown as Response;
+    }
+    if (typeof failure === "number") {
+      return { ok: false, status: failure, arrayBuffer: async () => new ArrayBuffer(0) } as unknown as Response;
+    }
+    return inner(input);
+  }) as unknown as typeof fetch;
+  return { fetchImpl, calls: () => calls };
+}
+
+describe("downloadTemporalCli over an unreliable network", () => {
+  const linuxArm = temporalArchiveName("1.5.1", "linux", "arm64");
+  const arm = archiveFor(Buffer.from("the-arm64-binary"));
+  const good = release("1.5.1", { [linuxArm]: arm }, `${sha256(arm)}  ${linuxArm}\n`);
+
+  function install(fetchImpl: typeof fetch): { binPath: string; delays: number[]; run: Promise<void> } {
+    const binPath = join(mkdtempSync(join(tmpdir(), "stigmer-temporal-")), "temporal");
+    const delays: number[] = [];
+    const sleep = async (ms: number): Promise<void> => {
+      delays.push(ms);
+    };
+    const run = downloadTemporalCli({ version: "1.5.1", binPath, platform: "linux", arch: "arm64", fetchImpl, sleep });
+    return { binPath, delays, run };
+  }
+
+  it("retries a connection that never answers, then installs the verified binary", async () => {
+    const net = flaky(good, linuxArm, ["reject"]);
+    const { binPath, delays, run } = install(net.fetchImpl);
+    await run;
+    expect(readFileSync(binPath, "utf8")).toBe("the-arm64-binary");
+    expect(net.calls()).toBe(2);
+    expect(delays).toEqual([1000]);
+  });
+
+  it("retries a connection that drops after the headers", async () => {
+    const net = flaky(good, linuxArm, ["body"]);
+    const { binPath, run } = install(net.fetchImpl);
+    await run;
+    expect(readFileSync(binPath, "utf8")).toBe("the-arm64-binary");
+    expect(net.calls()).toBe(2);
+  });
+
+  it("retries a 5xx and a 429, doubling the wait", async () => {
+    const net = flaky(good, linuxArm, [503, 429]);
+    const { binPath, delays, run } = install(net.fetchImpl);
+    await run;
+    expect(readFileSync(binPath, "utf8")).toBe("the-arm64-binary");
+    expect(net.calls()).toBe(3);
+    expect(delays).toEqual([1000, 2000]);
+  });
+
+  it("retries the checksums.txt fetch the same way", async () => {
+    const net = flaky(good, TEMPORAL_CHECKSUMS_FILE, ["reject"]);
+    const { binPath, run } = install(net.fetchImpl);
+    await run;
+    expect(readFileSync(binPath, "utf8")).toBe("the-arm64-binary");
+    expect(net.calls()).toBe(2);
+  });
+
+  it("takes a 404 as the answer and does not retry it", async () => {
+    const net = flaky(good, linuxArm, [404]);
+    const { delays, run } = install(net.fetchImpl);
+    await expect(run).rejects.toThrow(/HTTP 404/);
+    expect(net.calls()).toBe(1);
+    expect(delays).toEqual([]);
+  });
+
+  it("gives up after four attempts, saying what failed and what to do", async () => {
+    const net = flaky(good, linuxArm, ["reject", "reject", "reject", "reject"]);
+    const { binPath, delays, run } = install(net.fetchImpl);
+    const err: unknown = await run.then(
+      () => undefined,
+      (e: unknown) => e,
+    );
+    expect(err).toBeInstanceOf(CliExitError);
+    const exit = err as CliExitError;
+    expect(exit.message).toBe(
+      `failed to download Temporal CLI from ${temporalReleaseAssetUrl("1.5.1", linuxArm)} after 4 attempts: fetch failed: read ECONNRESET`,
+    );
+    expect(exit.hints).toEqual(["check the network connection, then run the command again"]);
+    expect(net.calls()).toBe(4);
+    expect(delays).toEqual([1000, 2000, 4000]);
+    expect(existsSync(binPath)).toBe(false);
+  });
+});

package/src/local/temporal/download.ts

@@ -18,7 +18,11 @@ import { fetchTarballBinary, mapReleaseArch, mapReleaseOs } from "../artifact.js
 // importing the tar reader from here.
 export { extractTarEntry } from "../artifact.js";
 
-/** Default Temporal CLI version (matches the Go CLI's `DefaultTemporalVersion`). */
+/**
+ * The Temporal CLI version every channel runs: `stigmer up`, the all-in-one
+ * image, and the CI lanes and developer machines that install it with
+ * `make install-temporal-cli`. Bump it deliberately; it moves all of them.
+ */
 export const DEFAULT_TEMPORAL_VERSION = "1.5.1";
 
 /** The release's `sha256sum`-format digest file, one line per published asset. */
@@ -35,6 +39,8 @@ export interface TemporalDownloadTarget {
   arch?: string;
   /** Override the fetch implementation (tests). */
   fetchImpl?: typeof fetch;
+  /** Override the wait between download attempts (tests). */
+  sleep?: (ms: number) => Promise<void>;
 }
 
 /** The release asset name for a version on a platform, as Temporal publishes it. */
@@ -58,6 +64,7 @@ export async function downloadTemporalCli(target: TemporalDownloadTarget): Promi
     binPath: target.binPath,
     label: "Temporal CLI",
     fetchImpl: target.fetchImpl,
+    sleep: target.sleep,
   });
 }