@supatype/cli 0.1.0-alpha.6 → 0.1.0-alpha.8

package/dist/engine/download.js

@@ -1,108 +0,0 @@
-/**
- * Engine binary download with progress bar, retry, and proxy support.
- */
-import { createWriteStream } from "node:fs";
-import { Readable } from "node:stream";
-import { pipeline } from "node:stream/promises";
-const MAX_RETRIES = 3;
-const RETRY_DELAYS = [1000, 3000, 10000];
-/**
- * Download a file with retry and optional progress bar.
- * Respects HTTP_PROXY / HTTPS_PROXY environment variables.
- */
-export async function downloadFile(options) {
-    const { url, dest, showProgress = false, label } = options;
-    let lastError;
-    for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
-        try {
-            await doDownload(url, dest, showProgress, label);
-            return;
-        }
-        catch (err) {
-            lastError = err instanceof Error ? err : new Error(String(err));
-            if (attempt < MAX_RETRIES - 1) {
-                const delay = RETRY_DELAYS[attempt];
-                process.stderr.write(`Download failed. Retrying (${attempt + 2}/${MAX_RETRIES})...\n`);
-                await sleep(delay);
-            }
-        }
-    }
-    throw new Error(`Failed to download after ${MAX_RETRIES} attempts: ${lastError?.message}`);
-}
-async function doDownload(url, dest, showProgress, label) {
-    const fetchOptions = buildFetchOptions(url);
-    const res = await fetch(url, fetchOptions);
-    if (!res.ok) {
-        throw new Error(`HTTP ${res.status} ${res.statusText}: ${url}`);
-    }
-    if (!res.body) {
-        throw new Error(`No response body: ${url}`);
-    }
-    const contentLength = Number(res.headers.get("content-length") || 0);
-    const out = createWriteStream(dest);
-    if (showProgress && contentLength > 0 && process.stderr.isTTY) {
-        const progressStream = createProgressStream(contentLength, label);
-        await pipeline(Readable.fromWeb(res.body), progressStream, out);
-        // Clear the progress line
-        process.stderr.write("\n");
-    }
-    else {
-        if (showProgress && label) {
-            process.stderr.write(`${label}...\n`);
-        }
-        await pipeline(Readable.fromWeb(res.body), out);
-    }
-}
-/**
- * Build fetch options respecting proxy env vars.
- */
-function buildFetchOptions(url) {
-    const opts = {};
-    // Node.js 18+ fetch supports the proxy via undici dispatcher.
-    // For simplicity, we rely on the global-agent or undici proxy support.
-    // The user should set HTTPS_PROXY or HTTP_PROXY env vars.
-    // Node.js 22+ automatically respects these in fetch().
-    //
-    // For older Node.js, users can install global-agent or similar.
-    return opts;
-}
-/**
- * Creates a Transform stream that logs download progress to stderr.
- */
-function createProgressStream(totalBytes, label) {
-    const { Transform } = require("node:stream");
-    let downloaded = 0;
-    return new Transform({
-        transform(chunk, _encoding, callback) {
-            downloaded += chunk.length;
-            const percent = Math.round((downloaded / totalBytes) * 100);
-            const mb = (downloaded / (1024 * 1024)).toFixed(1);
-            const totalMb = (totalBytes / (1024 * 1024)).toFixed(1);
-            const barWidth = 30;
-            const filled = Math.round((percent / 100) * barWidth);
-            const bar = "=".repeat(filled) + " ".repeat(barWidth - filled);
-            const prefix = label || "Downloading";
-            process.stderr.write(`\r${prefix} ${mb}MB/${totalMb}MB [${bar}] ${percent}%`);
-            this.push(chunk);
-            callback();
-        },
-    });
-}
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
-/**
- * Fetch a JSON file from a URL. Returns undefined on failure.
- */
-export async function fetchJson(url) {
-    try {
-        const res = await fetch(url);
-        if (!res.ok)
-            return undefined;
-        return (await res.json());
-    }
-    catch {
-        return undefined;
-    }
-}
-//# sourceMappingURL=download.js.map

package/dist/engine/download.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"download.js","sourceRoot":"","sources":["../../src/engine/download.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAS/C,MAAM,WAAW,GAAG,CAAC,CAAA;AACrB,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAA;AAExC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAwB;IACzD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,GAAG,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAA;IAC1D,IAAI,SAA4B,CAAA;IAEhC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,CAAA;YAChD,OAAM;QACR,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;YAC/D,IAAI,OAAO,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAE,CAAA;gBACpC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8BAA8B,OAAO,GAAG,CAAC,IAAI,WAAW,QAAQ,CACjE,CAAA;gBACD,MAAM,KAAK,CAAC,KAAK,CAAC,CAAA;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,4BAA4B,WAAW,cAAc,SAAS,EAAE,OAAO,EAAE,CAC1E,CAAA;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,GAAW,EACX,IAAY,EACZ,YAAqB,EACrB,KAAc;IAEd,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IAC3C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IAE1C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAA;IAC7C,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAA;IACpE,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAEnC,IAAI,YAAY,IAAI,aAAa,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC9D,MAAM,cAAc,GAAG,oBAAoB,CAAC,aAAa,EAAE,KAAK,CAAC,CAAA;QACjE,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAW,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,CAAA;QACtE,0BAA0B;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC5B,CAAC;SAAM,CAAC;QACN,IAAI,YAAY,IAAI,KAAK,EAAE,CAAC;YAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,OAAO,CAAC,CAAA;QACvC,CAAC;QACD,MAAM,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAW,CAAC,EAAE,GAAG,CAAC,CAAA;IACxD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,IAAI,GAAgB,EAAE,CAAA;IAE5B,8DAA8D;IAC9D,uEAAuE;IACvE,0DAA0D;IAC1D,uDAAuD;IACvD,EAAE;IACF,gEAAgE;IAEhE,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAC3B,UAAkB,EAClB,KAAc;IAEd,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,aAAa,CAAiC,CAAA;IAC5E,IAAI,UAAU,GAAG,CAAC,CAAA;IAElB,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,CAAC,KAAa,EAAE,SAAS,EAAE,QAAQ;YAC1C,UAAU,IAAI,KAAK,CAAC,MAAM,CAAA;YAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,GAAG,CAAC,CAAA;YAC3D,MAAM,EAAE,GAAG,CAAC,UAAU,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;YAClD,MAAM,OAAO,GAAG,CAAC,UAAU,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;YACvD,MAAM,QAAQ,GAAG,EAAE,CAAA;YACnB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAA;YACrD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAA;YAE9D,MAAM,MAAM,GAAG,KAAK,IAAI,aAAa,CAAA;YACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,MAAM,IAAI,EAAE,MAAM,OAAO,OAAO,GAAG,KAAK,OAAO,GAAG,CACxD,CAAA;YAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAChB,QAAQ,EAAE,CAAA;QACZ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAI,GAAW;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;QAC5B,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,SAAS,CAAA;QAC7B,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/engine/platform.d.ts

@@ -1,24 +0,0 @@
-/**
- * Platform detection for engine binary downloads.
- * Maps Node.js platform/arch to the binary naming convention.
- */
-export interface PlatformInfo {
-    os: "linux" | "darwin" | "win";
-    arch: "x64" | "arm64";
-    binaryName: string;
-    ext: string;
-}
-/**
- * Detect the current platform and return the binary info.
- * Throws on unsupported platforms with a helpful message.
- */
-export declare function detectPlatform(): PlatformInfo;
-/**
- * Build the artifact filename for a given version and platform.
- */
-export declare function getArtifactName(version: string, platform: PlatformInfo): string;
-/**
- * Build the CDN download URL for a given version and artifact.
- */
-export declare function getCdnUrl(baseUrl: string, version: string, filename: string): string;
-//# sourceMappingURL=platform.d.ts.map

package/dist/engine/platform.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/engine/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAA;IAC9B,IAAI,EAAE,KAAK,GAAG,OAAO,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;CACZ;AAkBD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,YAAY,CAmB7C;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,MAAM,CAE/E;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpF"}

package/dist/engine/platform.js

@@ -1,50 +0,0 @@
-/**
- * Platform detection for engine binary downloads.
- * Maps Node.js platform/arch to the binary naming convention.
- */
-const PLATFORM_MAP = {
-    "darwin-arm64": { os: "darwin", arch: "arm64" },
-    "darwin-x64": { os: "darwin", arch: "x64" },
-    "linux-arm64": { os: "linux", arch: "arm64" },
-    "linux-x64": { os: "linux", arch: "x64" },
-    "win32-x64": { os: "win", arch: "x64" },
-};
-const SUPPORTED_PLATFORMS = [
-    "linux-x64",
-    "linux-arm64",
-    "darwin-x64",
-    "darwin-arm64",
-    "win-x64",
-];
-/**
- * Detect the current platform and return the binary info.
- * Throws on unsupported platforms with a helpful message.
- */
-export function detectPlatform() {
-    const key = `${process.platform}-${process.arch}`;
-    const mapped = PLATFORM_MAP[key];
-    if (!mapped) {
-        throw new Error(`Supatype engine is not available for ${process.platform}-${process.arch}.\n` +
-            `Supported platforms: ${SUPPORTED_PLATFORMS.join(", ")}`);
-    }
-    const ext = mapped.os === "win" ? ".exe" : "";
-    return {
-        os: mapped.os,
-        arch: mapped.arch,
-        binaryName: `supatype-engine${ext}`,
-        ext,
-    };
-}
-/**
- * Build the artifact filename for a given version and platform.
- */
-export function getArtifactName(version, platform) {
-    return `supatype-engine-${version}-${platform.os}-${platform.arch}${platform.ext}`;
-}
-/**
- * Build the CDN download URL for a given version and artifact.
- */
-export function getCdnUrl(baseUrl, version, filename) {
-    return `${baseUrl}/v${version}/${filename}`;
-}
-//# sourceMappingURL=platform.js.map

package/dist/engine/platform.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/engine/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,MAAM,YAAY,GAA2E;IAC3F,cAAc,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE;IAC/C,YAAY,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;IAC3C,aAAa,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;IAC7C,WAAW,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE;IACzC,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;CACxC,CAAA;AAED,MAAM,mBAAmB,GAAG;IAC1B,WAAW;IACX,aAAa;IACb,YAAY;IACZ,cAAc;IACd,SAAS;CACV,CAAA;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAA;IACjD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAEhC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,wCAAwC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK;YAC7E,wBAAwB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzD,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IAE7C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,kBAAkB,GAAG,EAAE;QACnC,GAAG;KACJ,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,QAAsB;IACrE,OAAO,mBAAmB,OAAO,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAA;AACpF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,OAAe,EAAE,QAAgB;IAC1E,OAAO,GAAG,OAAO,KAAK,OAAO,IAAI,QAAQ,EAAE,CAAA;AAC7C,CAAC"}

package/dist/engine/resolve.d.ts

@@ -1,37 +0,0 @@
-/**
- * Engine resolver — orchestrates binary download, verification, and caching.
- *
- * Resolution flow:
- * 1. Check local cache for the pinned version
- * 2. If cached and valid, return cached path
- * 3. If not cached, download from CDN (with GitHub Releases fallback)
- * 4. Verify signature + checksum
- * 5. Cache the verified binary
- * 6. Return the cached path
- */
-export interface ResolveResult {
-    binaryPath: string;
-    version: string;
-    fromCache: boolean;
-}
-/**
- * Resolve the engine binary path, downloading if necessary.
- */
-export declare function resolveEngine(version?: string): Promise<ResolveResult>;
-/**
- * Check for the latest engine version from CDN.
- */
-export interface LatestVersionInfo {
-    version: string;
-    date: string;
-}
-export declare function checkLatestVersion(): Promise<LatestVersionInfo | undefined>;
-/**
- * Check version compatibility.
- * Engine and CLI must share the same major version.
- */
-export declare function checkVersionCompatibility(engineVersion: string, expectedVersion: string): {
-    compatible: boolean;
-    message?: string;
-};
-//# sourceMappingURL=resolve.d.ts.map

package/dist/engine/resolve.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/engine/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAeH,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,CAAA;CACnB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,GAAE,MAAuB,GAC/B,OAAO,CAAC,aAAa,CAAC,CAgFxB;AA0CD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAEjF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,GACtB;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAc3C"}

package/dist/engine/resolve.js

@@ -1,133 +0,0 @@
-/**
- * Engine resolver — orchestrates binary download, verification, and caching.
- *
- * Resolution flow:
- * 1. Check local cache for the pinned version
- * 2. If cached and valid, return cached path
- * 3. If not cached, download from CDN (with GitHub Releases fallback)
- * 4. Verify signature + checksum
- * 5. Cache the verified binary
- * 6. Return the cached path
- */
-import { chmodSync, existsSync } from "node:fs";
-import { rename } from "node:fs/promises";
-import { join } from "node:path";
-import { detectPlatform, getArtifactName, getCdnUrl } from "./platform.js";
-import { getCachedBinaryPath, hasCachedBinary, ensureCacheDir } from "./cache.js";
-import { downloadFile, fetchJson } from "./download.js";
-import { verifyBinary, verifyChecksumOnly } from "./verify.js";
-import { ENGINE_VERSION, CDN_BASE_URL, GITHUB_RELEASES_FALLBACK_URL, } from "../engine-version.js";
-/**
- * Resolve the engine binary path, downloading if necessary.
- */
-export async function resolveEngine(version = ENGINE_VERSION) {
-    const platform = detectPlatform();
-    // Check cache first
-    if (hasCachedBinary(version, platform)) {
-        return {
-            binaryPath: getCachedBinaryPath(version, platform),
-            version,
-            fromCache: true,
-        };
-    }
-    // Not cached — need to download
-    const artifactName = getArtifactName(version, platform);
-    const cacheDir = ensureCacheDir(version);
-    const binaryDest = getCachedBinaryPath(version, platform);
-    const tempBinary = `${binaryDest}.tmp`;
-    const checksumDest = join(cacheDir, "checksums.sha256");
-    const signatureDest = join(cacheDir, "checksums.sha256.minisig");
-    // Try CDN first, then GitHub Releases fallback
-    let downloaded = false;
-    try {
-        downloaded = await downloadFromSource(CDN_BASE_URL, version, artifactName, tempBinary, checksumDest, signatureDest);
-    }
-    catch {
-        // CDN failed, try fallback
-    }
-    if (!downloaded) {
-        try {
-            downloaded = await downloadFromSource(GITHUB_RELEASES_FALLBACK_URL, version, artifactName, tempBinary, checksumDest, signatureDest);
-        }
-        catch {
-            // Fallback also failed
-        }
-    }
-    if (!downloaded) {
-        throw new Error("Cannot download Supatype engine. Check your internet connection.\n" +
-            "If this persists, report at https://github.com/supatype/supatype/issues");
-    }
-    // Verify the downloaded binary
-    if (existsSync(signatureDest)) {
-        // Full two-step verification: signature + checksum
-        await verifyBinary(tempBinary, checksumDest, signatureDest, artifactName);
-    }
-    else {
-        // Checksum-only verification (GitHub Releases may not have .minisig)
-        await verifyChecksumOnly(tempBinary, checksumDest, artifactName);
-    }
-    // Move verified binary to final location
-    await rename(tempBinary, binaryDest);
-    // Set executable permission on Unix
-    if (process.platform !== "win32") {
-        chmodSync(binaryDest, 0o755);
-    }
-    return {
-        binaryPath: binaryDest,
-        version,
-        fromCache: false,
-    };
-}
-async function downloadFromSource(baseUrl, version, artifactName, binaryDest, checksumDest, signatureDest) {
-    const binaryUrl = getCdnUrl(baseUrl, version, artifactName);
-    const checksumUrl = getCdnUrl(baseUrl, version, "checksums.sha256");
-    const signatureUrl = getCdnUrl(baseUrl, version, "checksums.sha256.minisig");
-    // Download binary with progress
-    await downloadFile({
-        url: binaryUrl,
-        dest: binaryDest,
-        showProgress: true,
-        label: `Downloading Supatype engine v${version} for ${detectPlatform().os}-${detectPlatform().arch}`,
-    });
-    // Download checksum file
-    await downloadFile({
-        url: checksumUrl,
-        dest: checksumDest,
-    });
-    // Try to download signature file (may not exist for GitHub Releases)
-    try {
-        await downloadFile({
-            url: signatureUrl,
-            dest: signatureDest,
-        });
-    }
-    catch {
-        // Signature file optional for fallback sources
-        // But for CDN, we require it — verifyBinary will enforce this
-    }
-    return true;
-}
-export async function checkLatestVersion() {
-    return fetchJson(`${CDN_BASE_URL}/latest.json`);
-}
-/**
- * Check version compatibility.
- * Engine and CLI must share the same major version.
- */
-export function checkVersionCompatibility(engineVersion, expectedVersion) {
-    const engineMajor = parseMajor(engineVersion);
-    const expectedMajor = parseMajor(expectedVersion);
-    if (engineMajor !== expectedMajor) {
-        return {
-            compatible: false,
-            message: `Engine version ${engineVersion} is not compatible with CLI version ${expectedVersion}.\n` +
-                `Run: npm update @supatype/cli`,
-        };
-    }
-    return { compatible: true };
-}
-function parseMajor(version) {
-    const match = version.match(/^(\d+)/);
-    return match ? parseInt(match[1], 10) : 0;
-}
-//# sourceMappingURL=resolve.js.map

package/dist/engine/resolve.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/engine/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAoB,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AACjF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EACL,cAAc,EACd,YAAY,EACZ,4BAA4B,GAC7B,MAAM,sBAAsB,CAAA;AAQ7B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,cAAc;IAEhC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAA;IAEjC,oBAAoB;IACpB,IAAI,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC;YAClD,OAAO;YACP,SAAS,EAAE,IAAI;SAChB,CAAA;IACH,CAAC;IAED,gCAAgC;IAChC,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACxC,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACzD,MAAM,UAAU,GAAG,GAAG,UAAU,MAAM,CAAA;IACtC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAA;IACvD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAA;IAEhE,+CAA+C;IAC/C,IAAI,UAAU,GAAG,KAAK,CAAA;IAEtB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,kBAAkB,CACnC,YAAY,EACZ,OAAO,EACP,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,aAAa,CACd,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,kBAAkB,CACnC,4BAA4B,EAC5B,OAAO,EACP,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,aAAa,CACd,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,oEAAoE;YACpE,yEAAyE,CAC1E,CAAA;IACH,CAAC;IAED,+BAA+B;IAC/B,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,mDAAmD;QACnD,MAAM,YAAY,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,CAAC,CAAA;IAC3E,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,MAAM,kBAAkB,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,CAAA;IAClE,CAAC;IAED,yCAAyC;IACzC,MAAM,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAEpC,oCAAoC;IACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC;IAED,OAAO;QACL,UAAU,EAAE,UAAU;QACtB,OAAO;QACP,SAAS,EAAE,KAAK;KACjB,CAAA;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAAe,EACf,OAAe,EACf,YAAoB,EACpB,UAAkB,EAClB,YAAoB,EACpB,aAAqB;IAErB,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;IAC3D,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAA;IACnE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAA;IAE5E,gCAAgC;IAChC,MAAM,YAAY,CAAC;QACjB,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,IAAI;QAClB,KAAK,EAAE,gCAAgC,OAAO,QAAQ,cAAc,EAAE,CAAC,EAAE,IAAI,cAAc,EAAE,CAAC,IAAI,EAAE;KACrG,CAAC,CAAA;IAEF,yBAAyB;IACzB,MAAM,YAAY,CAAC;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,YAAY;KACnB,CAAC,CAAA;IAEF,qEAAqE;IACrE,IAAI,CAAC;QACH,MAAM,YAAY,CAAC;YACjB,GAAG,EAAE,YAAY;YACjB,IAAI,EAAE,aAAa;SACpB,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;QAC/C,8DAA8D;IAChE,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,OAAO,SAAS,CAAoB,GAAG,YAAY,cAAc,CAAC,CAAA;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,aAAqB,EACrB,eAAuB;IAEvB,MAAM,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,aAAa,GAAG,UAAU,CAAC,eAAe,CAAC,CAAA;IAEjD,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;QAClC,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,OAAO,EACL,kBAAkB,aAAa,uCAAuC,eAAe,KAAK;gBAC1F,+BAA+B;SAClC,CAAA;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;AAC7B,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACrC,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5C,CAAC"}

package/dist/engine/update-notify.d.ts

@@ -1,11 +0,0 @@
-/**
- * Non-blocking update notification shown after CLI commands.
- * Checks once per 24 hours. Skips in CI environments.
- */
-/**
- * Show an update notification if a newer engine version is available.
- * This runs after every CLI command, but only actually checks the network
- * once per 24 hours (throttled via ~/.supatype/update-check.json).
- */
-export declare function showUpdateNotification(): Promise<void>;
-//# sourceMappingURL=update-notify.d.ts.map

package/dist/engine/update-notify.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"update-notify.d.ts","sourceRoot":"","sources":["../../src/engine/update-notify.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH;;;;GAIG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAuB5D"}

package/dist/engine/update-notify.js

@@ -1,43 +0,0 @@
-/**
- * Non-blocking update notification shown after CLI commands.
- * Checks once per 24 hours. Skips in CI environments.
- */
-import { ENGINE_VERSION } from "../engine-version.js";
-import { shouldCheckForUpdates, saveUpdateCheck, getLastKnownLatestVersion, } from "./cache.js";
-import { checkLatestVersion } from "./resolve.js";
-/**
- * Show an update notification if a newer engine version is available.
- * This runs after every CLI command, but only actually checks the network
- * once per 24 hours (throttled via ~/.supatype/update-check.json).
- */
-export async function showUpdateNotification() {
-    try {
-        const shouldCheck = await shouldCheckForUpdates();
-        if (shouldCheck) {
-            // Perform network check
-            const latest = await checkLatestVersion();
-            if (latest) {
-                await saveUpdateCheck(latest.version);
-                if (latest.version !== ENGINE_VERSION) {
-                    printNotification(latest.version);
-                }
-            }
-        }
-        else {
-            // Use cached info from last check
-            const cachedLatest = await getLastKnownLatestVersion();
-            if (cachedLatest && cachedLatest !== ENGINE_VERSION) {
-                printNotification(cachedLatest);
-            }
-        }
-    }
-    catch {
-        // Never fail the CLI command because of update check
-    }
-}
-function printNotification(latestVersion) {
-    console.log();
-    console.log(`Supatype engine v${latestVersion} is available. ` +
-        `Run: npm update @supatype/cli`);
-}
-//# sourceMappingURL=update-notify.js.map

package/dist/engine/update-notify.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"update-notify.js","sourceRoot":"","sources":["../../src/engine/update-notify.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,yBAAyB,GAC1B,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAEjD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,qBAAqB,EAAE,CAAA;QAEjD,IAAI,WAAW,EAAE,CAAC;YAChB,wBAAwB;YACxB,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAA;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBACrC,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;oBACtC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,kCAAkC;YAClC,MAAM,YAAY,GAAG,MAAM,yBAAyB,EAAE,CAAA;YACtD,IAAI,YAAY,IAAI,YAAY,KAAK,cAAc,EAAE,CAAC;gBACpD,iBAAiB,CAAC,YAAY,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,aAAqB;IAC9C,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CACT,oBAAoB,aAAa,iBAAiB;QAClD,+BAA+B,CAChC,CAAA;AACH,CAAC"}

package/dist/engine/verify.d.ts

@@ -1,50 +0,0 @@
-/**
- * Checksum and signature verification for engine binaries.
- *
- * Two-step verification:
- * 1. Verify minisign signature on checksums.sha256 file
- * 2. Verify SHA256 hash of binary against signed checksum file
- *
- * Both steps MUST pass before the CLI executes the binary.
- */
-/**
- * Embedded minisign public key.
- *
- * This key is used to verify the signature on the checksum file.
- * It ensures the checksum file was produced by Supatype's CI,
- * not by an attacker who compromised the CDN.
- *
- * Generated with: minisign -G
- * The corresponding private key is stored as a GitHub Actions secret.
- *
- * TODO: Replace with actual public key once generated.
- */
-export declare const MINISIGN_PUBLIC_KEY = "RWS0000000000000000000000000000000000000000000000000";
-/**
- * Verify the minisign signature on a checksum file.
- *
- * Uses a pure-JS minisign verification (Ed25519).
- * Returns true if the signature is valid, false otherwise.
- */
-export declare function verifySignature(checksumPath: string, signaturePath: string, publicKey?: string): Promise<boolean>;
-/**
- * Verify the SHA256 checksum of a binary against a signed checksum file.
- *
- * The checksum file format follows sha256sum output:
- * <hash>  <filename>
- */
-export declare function verifyChecksum(binaryPath: string, checksumPath: string, expectedFilename: string): Promise<boolean>;
-/**
- * Run the full two-step verification pipeline.
- * Deletes the binary if verification fails.
- *
- * Step 1: Verify minisign signature on checksums.sha256
- * Step 2: Verify SHA256 hash of binary against signed checksum
- */
-export declare function verifyBinary(binaryPath: string, checksumPath: string, signaturePath: string, artifactName: string): Promise<void>;
-/**
- * Simple checksum-only verification (no signature).
- * Used as a fallback when signature files are not available.
- */
-export declare function verifyChecksumOnly(binaryPath: string, checksumPath: string, artifactName: string): Promise<void>;
-//# sourceMappingURL=verify.d.ts.map

package/dist/engine/verify.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/engine/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,yDAAyD,CAAA;AAEzF;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,SAAS,GAAE,MAA4B,GACtC,OAAO,CAAC,OAAO,CAAC,CAkElB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,OAAO,CAAC,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/engine/verify.js

@@ -1,161 +0,0 @@
-/**
- * Checksum and signature verification for engine binaries.
- *
- * Two-step verification:
- * 1. Verify minisign signature on checksums.sha256 file
- * 2. Verify SHA256 hash of binary against signed checksum file
- *
- * Both steps MUST pass before the CLI executes the binary.
- */
-import { createHash } from "node:crypto";
-import { readFile, unlink } from "node:fs/promises";
-/**
- * Embedded minisign public key.
- *
- * This key is used to verify the signature on the checksum file.
- * It ensures the checksum file was produced by Supatype's CI,
- * not by an attacker who compromised the CDN.
- *
- * Generated with: minisign -G
- * The corresponding private key is stored as a GitHub Actions secret.
- *
- * TODO: Replace with actual public key once generated.
- */
-export const MINISIGN_PUBLIC_KEY = "RWS0000000000000000000000000000000000000000000000000";
-/**
- * Verify the minisign signature on a checksum file.
- *
- * Uses a pure-JS minisign verification (Ed25519).
- * Returns true if the signature is valid, false otherwise.
- */
-export async function verifySignature(checksumPath, signaturePath, publicKey = MINISIGN_PUBLIC_KEY) {
-    // Minisign signature format:
-    // Line 1: untrusted comment
-    // Line 2: base64-encoded signature
-    // Line 3 (optional): trusted comment
-    // Line 4 (optional): base64-encoded global signature
-    try {
-        const sigContent = await readFile(signaturePath, "utf8");
-        const checksumContent = await readFile(checksumPath);
-        const sigLines = sigContent.trim().split("\n");
-        if (sigLines.length < 2)
-            return false;
-        // Parse the signature (line 2 is the base64-encoded signature)
-        const sigBase64 = sigLines[1].trim();
-        const sigBytes = Buffer.from(sigBase64, "base64");
-        // Minisign signature: 2 bytes algorithm + 8 bytes key ID + 64 bytes Ed25519 sig
-        if (sigBytes.length < 74)
-            return false;
-        const algorithm = sigBytes.subarray(0, 2);
-        const keyId = sigBytes.subarray(2, 10);
-        const signature = sigBytes.subarray(10, 74);
-        // Parse public key
-        const pkBytes = Buffer.from(publicKey.slice(2), "base64"); // Skip "RW" prefix
-        if (pkBytes.length < 42)
-            return false;
-        // Public key: 2 bytes algorithm + 8 bytes key ID + 32 bytes Ed25519 pubkey
-        const pkKeyId = pkBytes.subarray(2, 10);
-        const pk = pkBytes.subarray(10, 42);
-        // Verify key IDs match
-        if (!keyId.equals(pkKeyId))
-            return false;
-        // Verify Ed25519 signature using Node.js crypto
-        const { verify, createPublicKey } = await import("node:crypto");
-        const publicKeyObj = createPublicKey({
-            key: Buffer.concat([
-                // Ed25519 public key DER prefix
-                Buffer.from("302a300506032b6570032100", "hex"),
-                pk,
-            ]),
-            format: "der",
-            type: "spki",
-        });
-        const isValid = verify(null, checksumContent, publicKeyObj, signature);
-        // If there's a trusted comment (line 3-4), verify the global signature too
-        if (sigLines.length >= 4 && isValid) {
-            const trustedComment = sigLines[2]?.replace(/^trusted comment: ?/, "") || "";
-            const globalSigBase64 = sigLines[3].trim();
-            const globalSig = Buffer.from(globalSigBase64, "base64");
-            const globalMessage = Buffer.concat([signature, Buffer.from(trustedComment)]);
-            const globalValid = verify(null, globalMessage, publicKeyObj, globalSig);
-            return globalValid;
-        }
-        return isValid;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Verify the SHA256 checksum of a binary against a signed checksum file.
- *
- * The checksum file format follows sha256sum output:
- * <hash>  <filename>
- */
-export async function verifyChecksum(binaryPath, checksumPath, expectedFilename) {
-    const checksumContent = await readFile(checksumPath, "utf8");
-    // Find the line matching our filename
-    const lines = checksumContent.trim().split("\n");
-    let expectedHash;
-    for (const line of lines) {
-        // Format: "<hash>  <filename>" (two spaces)
-        const parts = line.trim().split(/\s+/);
-        if (parts.length >= 2 && parts[1] === expectedFilename) {
-            expectedHash = parts[0].toLowerCase();
-            break;
-        }
-    }
-    if (!expectedHash) {
-        throw new Error(`No checksum found for ${expectedFilename} in checksum file`);
-    }
-    const binaryData = await readFile(binaryPath);
-    const actualHash = createHash("sha256").update(binaryData).digest("hex");
-    return actualHash === expectedHash;
-}
-/**
- * Run the full two-step verification pipeline.
- * Deletes the binary if verification fails.
- *
- * Step 1: Verify minisign signature on checksums.sha256
- * Step 2: Verify SHA256 hash of binary against signed checksum
- */
-export async function verifyBinary(binaryPath, checksumPath, signaturePath, artifactName) {
-    // Step 1: Verify signature
-    const sigValid = await verifySignature(checksumPath, signaturePath);
-    if (!sigValid) {
-        await safeDelete(binaryPath);
-        throw new Error("Engine checksum signature verification failed.\n" +
-            "The checksum file may have been tampered with.\n" +
-            "If this persists, report at https://github.com/supatype/supatype/issues");
-    }
-    // Step 2: Verify checksum
-    const checksumValid = await verifyChecksum(binaryPath, checksumPath, artifactName);
-    if (!checksumValid) {
-        await safeDelete(binaryPath);
-        throw new Error("Engine binary checksum mismatch.\n" +
-            "This could indicate a corrupt download or a tampered binary.\n" +
-            "Try again or report at https://github.com/supatype/supatype/issues");
-    }
-}
-/**
- * Simple checksum-only verification (no signature).
- * Used as a fallback when signature files are not available.
- */
-export async function verifyChecksumOnly(binaryPath, checksumPath, artifactName) {
-    const valid = await verifyChecksum(binaryPath, checksumPath, artifactName);
-    if (!valid) {
-        await safeDelete(binaryPath);
-        throw new Error("Engine binary checksum mismatch.\n" +
-            "This could indicate a corrupt download or a tampered binary.\n" +
-            "Try again or report at https://github.com/supatype/supatype/issues");
-    }
-}
-async function safeDelete(path) {
-    try {
-        await unlink(path);
-    }
-    catch {
-        // Ignore deletion errors
-    }
-}
-//# sourceMappingURL=verify.js.map