@supatype/cli 0.1.0-alpha.6

package/dist/engine/platform.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Platform detection for engine binary downloads.
+ * Maps Node.js platform/arch to the binary naming convention.
+ */
+export interface PlatformInfo {
+    os: "linux" | "darwin" | "win";
+    arch: "x64" | "arm64";
+    binaryName: string;
+    ext: string;
+}
+/**
+ * Detect the current platform and return the binary info.
+ * Throws on unsupported platforms with a helpful message.
+ */
+export declare function detectPlatform(): PlatformInfo;
+/**
+ * Build the artifact filename for a given version and platform.
+ */
+export declare function getArtifactName(version: string, platform: PlatformInfo): string;
+/**
+ * Build the CDN download URL for a given version and artifact.
+ */
+export declare function getCdnUrl(baseUrl: string, version: string, filename: string): string;
+//# sourceMappingURL=platform.d.ts.map

package/dist/engine/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/engine/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAA;IAC9B,IAAI,EAAE,KAAK,GAAG,OAAO,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,EAAE,MAAM,CAAA;CACZ;AAkBD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,YAAY,CAmB7C;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,MAAM,CAE/E;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEpF"}

package/dist/engine/platform.js

@@ -0,0 +1,50 @@
+/**
+ * Platform detection for engine binary downloads.
+ * Maps Node.js platform/arch to the binary naming convention.
+ */
+const PLATFORM_MAP = {
+    "darwin-arm64": { os: "darwin", arch: "arm64" },
+    "darwin-x64": { os: "darwin", arch: "x64" },
+    "linux-arm64": { os: "linux", arch: "arm64" },
+    "linux-x64": { os: "linux", arch: "x64" },
+    "win32-x64": { os: "win", arch: "x64" },
+};
+const SUPPORTED_PLATFORMS = [
+    "linux-x64",
+    "linux-arm64",
+    "darwin-x64",
+    "darwin-arm64",
+    "win-x64",
+];
+/**
+ * Detect the current platform and return the binary info.
+ * Throws on unsupported platforms with a helpful message.
+ */
+export function detectPlatform() {
+    const key = `${process.platform}-${process.arch}`;
+    const mapped = PLATFORM_MAP[key];
+    if (!mapped) {
+        throw new Error(`Supatype engine is not available for ${process.platform}-${process.arch}.\n` +
+            `Supported platforms: ${SUPPORTED_PLATFORMS.join(", ")}`);
+    }
+    const ext = mapped.os === "win" ? ".exe" : "";
+    return {
+        os: mapped.os,
+        arch: mapped.arch,
+        binaryName: `supatype-engine${ext}`,
+        ext,
+    };
+}
+/**
+ * Build the artifact filename for a given version and platform.
+ */
+export function getArtifactName(version, platform) {
+    return `supatype-engine-${version}-${platform.os}-${platform.arch}${platform.ext}`;
+}
+/**
+ * Build the CDN download URL for a given version and artifact.
+ */
+export function getCdnUrl(baseUrl, version, filename) {
+    return `${baseUrl}/v${version}/${filename}`;
+}
+//# sourceMappingURL=platform.js.map

package/dist/engine/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/engine/platform.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH,MAAM,YAAY,GAA2E;IAC3F,cAAc,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE;IAC/C,YAAY,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE;IAC3C,aAAa,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE;IAC7C,WAAW,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE;IACzC,WAAW,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;CACxC,CAAA;AAED,MAAM,mBAAmB,GAAG;IAC1B,WAAW;IACX,aAAa;IACb,YAAY;IACZ,cAAc;IACd,SAAS;CACV,CAAA;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAA;IACjD,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAEhC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,wCAAwC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK;YAC7E,wBAAwB,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzD,CAAA;IACH,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;IAE7C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,kBAAkB,GAAG,EAAE;QACnC,GAAG;KACJ,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,QAAsB;IACrE,OAAO,mBAAmB,OAAO,IAAI,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAA;AACpF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,OAAe,EAAE,QAAgB;IAC1E,OAAO,GAAG,OAAO,KAAK,OAAO,IAAI,QAAQ,EAAE,CAAA;AAC7C,CAAC"}

package/dist/engine/resolve.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Engine resolver — orchestrates binary download, verification, and caching.
+ *
+ * Resolution flow:
+ * 1. Check local cache for the pinned version
+ * 2. If cached and valid, return cached path
+ * 3. If not cached, download from CDN (with GitHub Releases fallback)
+ * 4. Verify signature + checksum
+ * 5. Cache the verified binary
+ * 6. Return the cached path
+ */
+export interface ResolveResult {
+    binaryPath: string;
+    version: string;
+    fromCache: boolean;
+}
+/**
+ * Resolve the engine binary path, downloading if necessary.
+ */
+export declare function resolveEngine(version?: string): Promise<ResolveResult>;
+/**
+ * Check for the latest engine version from CDN.
+ */
+export interface LatestVersionInfo {
+    version: string;
+    date: string;
+}
+export declare function checkLatestVersion(): Promise<LatestVersionInfo | undefined>;
+/**
+ * Check version compatibility.
+ * Engine and CLI must share the same major version.
+ */
+export declare function checkVersionCompatibility(engineVersion: string, expectedVersion: string): {
+    compatible: boolean;
+    message?: string;
+};
+//# sourceMappingURL=resolve.d.ts.map

package/dist/engine/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/engine/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAeH,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,CAAA;CACnB;AAED;;GAEG;AACH,wBAAsB,aAAa,CACjC,OAAO,GAAE,MAAuB,GAC/B,OAAO,CAAC,aAAa,CAAC,CAgFxB;AA0CD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;CACb;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAEjF;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,MAAM,EACrB,eAAe,EAAE,MAAM,GACtB;IAAE,UAAU,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,CAc3C"}

package/dist/engine/resolve.js

@@ -0,0 +1,133 @@
+/**
+ * Engine resolver — orchestrates binary download, verification, and caching.
+ *
+ * Resolution flow:
+ * 1. Check local cache for the pinned version
+ * 2. If cached and valid, return cached path
+ * 3. If not cached, download from CDN (with GitHub Releases fallback)
+ * 4. Verify signature + checksum
+ * 5. Cache the verified binary
+ * 6. Return the cached path
+ */
+import { chmodSync, existsSync } from "node:fs";
+import { rename } from "node:fs/promises";
+import { join } from "node:path";
+import { detectPlatform, getArtifactName, getCdnUrl } from "./platform.js";
+import { getCachedBinaryPath, hasCachedBinary, ensureCacheDir } from "./cache.js";
+import { downloadFile, fetchJson } from "./download.js";
+import { verifyBinary, verifyChecksumOnly } from "./verify.js";
+import { ENGINE_VERSION, CDN_BASE_URL, GITHUB_RELEASES_FALLBACK_URL, } from "../engine-version.js";
+/**
+ * Resolve the engine binary path, downloading if necessary.
+ */
+export async function resolveEngine(version = ENGINE_VERSION) {
+    const platform = detectPlatform();
+    // Check cache first
+    if (hasCachedBinary(version, platform)) {
+        return {
+            binaryPath: getCachedBinaryPath(version, platform),
+            version,
+            fromCache: true,
+        };
+    }
+    // Not cached — need to download
+    const artifactName = getArtifactName(version, platform);
+    const cacheDir = ensureCacheDir(version);
+    const binaryDest = getCachedBinaryPath(version, platform);
+    const tempBinary = `${binaryDest}.tmp`;
+    const checksumDest = join(cacheDir, "checksums.sha256");
+    const signatureDest = join(cacheDir, "checksums.sha256.minisig");
+    // Try CDN first, then GitHub Releases fallback
+    let downloaded = false;
+    try {
+        downloaded = await downloadFromSource(CDN_BASE_URL, version, artifactName, tempBinary, checksumDest, signatureDest);
+    }
+    catch {
+        // CDN failed, try fallback
+    }
+    if (!downloaded) {
+        try {
+            downloaded = await downloadFromSource(GITHUB_RELEASES_FALLBACK_URL, version, artifactName, tempBinary, checksumDest, signatureDest);
+        }
+        catch {
+            // Fallback also failed
+        }
+    }
+    if (!downloaded) {
+        throw new Error("Cannot download Supatype engine. Check your internet connection.\n" +
+            "If this persists, report at https://github.com/supatype/supatype/issues");
+    }
+    // Verify the downloaded binary
+    if (existsSync(signatureDest)) {
+        // Full two-step verification: signature + checksum
+        await verifyBinary(tempBinary, checksumDest, signatureDest, artifactName);
+    }
+    else {
+        // Checksum-only verification (GitHub Releases may not have .minisig)
+        await verifyChecksumOnly(tempBinary, checksumDest, artifactName);
+    }
+    // Move verified binary to final location
+    await rename(tempBinary, binaryDest);
+    // Set executable permission on Unix
+    if (process.platform !== "win32") {
+        chmodSync(binaryDest, 0o755);
+    }
+    return {
+        binaryPath: binaryDest,
+        version,
+        fromCache: false,
+    };
+}
+async function downloadFromSource(baseUrl, version, artifactName, binaryDest, checksumDest, signatureDest) {
+    const binaryUrl = getCdnUrl(baseUrl, version, artifactName);
+    const checksumUrl = getCdnUrl(baseUrl, version, "checksums.sha256");
+    const signatureUrl = getCdnUrl(baseUrl, version, "checksums.sha256.minisig");
+    // Download binary with progress
+    await downloadFile({
+        url: binaryUrl,
+        dest: binaryDest,
+        showProgress: true,
+        label: `Downloading Supatype engine v${version} for ${detectPlatform().os}-${detectPlatform().arch}`,
+    });
+    // Download checksum file
+    await downloadFile({
+        url: checksumUrl,
+        dest: checksumDest,
+    });
+    // Try to download signature file (may not exist for GitHub Releases)
+    try {
+        await downloadFile({
+            url: signatureUrl,
+            dest: signatureDest,
+        });
+    }
+    catch {
+        // Signature file optional for fallback sources
+        // But for CDN, we require it — verifyBinary will enforce this
+    }
+    return true;
+}
+export async function checkLatestVersion() {
+    return fetchJson(`${CDN_BASE_URL}/latest.json`);
+}
+/**
+ * Check version compatibility.
+ * Engine and CLI must share the same major version.
+ */
+export function checkVersionCompatibility(engineVersion, expectedVersion) {
+    const engineMajor = parseMajor(engineVersion);
+    const expectedMajor = parseMajor(expectedVersion);
+    if (engineMajor !== expectedMajor) {
+        return {
+            compatible: false,
+            message: `Engine version ${engineVersion} is not compatible with CLI version ${expectedVersion}.\n` +
+                `Run: npm update @supatype/cli`,
+        };
+    }
+    return { compatible: true };
+}
+function parseMajor(version) {
+    const match = version.match(/^(\d+)/);
+    return match ? parseInt(match[1], 10) : 0;
+}
+//# sourceMappingURL=resolve.js.map

package/dist/engine/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/engine/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAC/C,OAAO,EAAE,MAAM,EAAoB,MAAM,kBAAkB,CAAA;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AACjF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACvD,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EACL,cAAc,EACd,YAAY,EACZ,4BAA4B,GAC7B,MAAM,sBAAsB,CAAA;AAQ7B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAkB,cAAc;IAEhC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAA;IAEjC,oBAAoB;IACpB,IAAI,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QACvC,OAAO;YACL,UAAU,EAAE,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC;YAClD,OAAO;YACP,SAAS,EAAE,IAAI;SAChB,CAAA;IACH,CAAC;IAED,gCAAgC;IAChC,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACvD,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;IACxC,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACzD,MAAM,UAAU,GAAG,GAAG,UAAU,MAAM,CAAA;IACtC,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAA;IACvD,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAA;IAEhE,+CAA+C;IAC/C,IAAI,UAAU,GAAG,KAAK,CAAA;IAEtB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,kBAAkB,CACnC,YAAY,EACZ,OAAO,EACP,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,aAAa,CACd,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,kBAAkB,CACnC,4BAA4B,EAC5B,OAAO,EACP,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,aAAa,CACd,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,oEAAoE;YACpE,yEAAyE,CAC1E,CAAA;IACH,CAAC;IAED,+BAA+B;IAC/B,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC9B,mDAAmD;QACnD,MAAM,YAAY,CAAC,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,CAAC,CAAA;IAC3E,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,MAAM,kBAAkB,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,CAAA;IAClE,CAAC;IAED,yCAAyC;IACzC,MAAM,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;IAEpC,oCAAoC;IACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC;IAED,OAAO;QACL,UAAU,EAAE,UAAU;QACtB,OAAO;QACP,SAAS,EAAE,KAAK;KACjB,CAAA;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAAe,EACf,OAAe,EACf,YAAoB,EACpB,UAAkB,EAClB,YAAoB,EACpB,aAAqB;IAErB,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,CAAA;IAC3D,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAA;IACnE,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAA;IAE5E,gCAAgC;IAChC,MAAM,YAAY,CAAC;QACjB,GAAG,EAAE,SAAS;QACd,IAAI,EAAE,UAAU;QAChB,YAAY,EAAE,IAAI;QAClB,KAAK,EAAE,gCAAgC,OAAO,QAAQ,cAAc,EAAE,CAAC,EAAE,IAAI,cAAc,EAAE,CAAC,IAAI,EAAE;KACrG,CAAC,CAAA;IAEF,yBAAyB;IACzB,MAAM,YAAY,CAAC;QACjB,GAAG,EAAE,WAAW;QAChB,IAAI,EAAE,YAAY;KACnB,CAAC,CAAA;IAEF,qEAAqE;IACrE,IAAI,CAAC;QACH,MAAM,YAAY,CAAC;YACjB,GAAG,EAAE,YAAY;YACjB,IAAI,EAAE,aAAa;SACpB,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;QAC/C,8DAA8D;IAChE,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,OAAO,SAAS,CAAoB,GAAG,YAAY,cAAc,CAAC,CAAA;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,aAAqB,EACrB,eAAuB;IAEvB,MAAM,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,CAAA;IAC7C,MAAM,aAAa,GAAG,UAAU,CAAC,eAAe,CAAC,CAAA;IAEjD,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;QAClC,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,OAAO,EACL,kBAAkB,aAAa,uCAAuC,eAAe,KAAK;gBAC1F,+BAA+B;SAClC,CAAA;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;AAC7B,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IACrC,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5C,CAAC"}

package/dist/engine/update-notify.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Non-blocking update notification shown after CLI commands.
+ * Checks once per 24 hours. Skips in CI environments.
+ */
+/**
+ * Show an update notification if a newer engine version is available.
+ * This runs after every CLI command, but only actually checks the network
+ * once per 24 hours (throttled via ~/.supatype/update-check.json).
+ */
+export declare function showUpdateNotification(): Promise<void>;
+//# sourceMappingURL=update-notify.d.ts.map

package/dist/engine/update-notify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-notify.d.ts","sourceRoot":"","sources":["../../src/engine/update-notify.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAUH;;;;GAIG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,IAAI,CAAC,CAuB5D"}

package/dist/engine/update-notify.js

@@ -0,0 +1,43 @@
+/**
+ * Non-blocking update notification shown after CLI commands.
+ * Checks once per 24 hours. Skips in CI environments.
+ */
+import { ENGINE_VERSION } from "../engine-version.js";
+import { shouldCheckForUpdates, saveUpdateCheck, getLastKnownLatestVersion, } from "./cache.js";
+import { checkLatestVersion } from "./resolve.js";
+/**
+ * Show an update notification if a newer engine version is available.
+ * This runs after every CLI command, but only actually checks the network
+ * once per 24 hours (throttled via ~/.supatype/update-check.json).
+ */
+export async function showUpdateNotification() {
+    try {
+        const shouldCheck = await shouldCheckForUpdates();
+        if (shouldCheck) {
+            // Perform network check
+            const latest = await checkLatestVersion();
+            if (latest) {
+                await saveUpdateCheck(latest.version);
+                if (latest.version !== ENGINE_VERSION) {
+                    printNotification(latest.version);
+                }
+            }
+        }
+        else {
+            // Use cached info from last check
+            const cachedLatest = await getLastKnownLatestVersion();
+            if (cachedLatest && cachedLatest !== ENGINE_VERSION) {
+                printNotification(cachedLatest);
+            }
+        }
+    }
+    catch {
+        // Never fail the CLI command because of update check
+    }
+}
+function printNotification(latestVersion) {
+    console.log();
+    console.log(`Supatype engine v${latestVersion} is available. ` +
+        `Run: npm update @supatype/cli`);
+}
+//# sourceMappingURL=update-notify.js.map

package/dist/engine/update-notify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-notify.js","sourceRoot":"","sources":["../../src/engine/update-notify.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,yBAAyB,GAC1B,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAEjD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,qBAAqB,EAAE,CAAA;QAEjD,IAAI,WAAW,EAAE,CAAC;YAChB,wBAAwB;YACxB,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAA;YACzC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBACrC,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC;oBACtC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,kCAAkC;YAClC,MAAM,YAAY,GAAG,MAAM,yBAAyB,EAAE,CAAA;YACtD,IAAI,YAAY,IAAI,YAAY,KAAK,cAAc,EAAE,CAAC;gBACpD,iBAAiB,CAAC,YAAY,CAAC,CAAA;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,aAAqB;IAC9C,OAAO,CAAC,GAAG,EAAE,CAAA;IACb,OAAO,CAAC,GAAG,CACT,oBAAoB,aAAa,iBAAiB;QAClD,+BAA+B,CAChC,CAAA;AACH,CAAC"}

package/dist/engine/verify.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Checksum and signature verification for engine binaries.
+ *
+ * Two-step verification:
+ * 1. Verify minisign signature on checksums.sha256 file
+ * 2. Verify SHA256 hash of binary against signed checksum file
+ *
+ * Both steps MUST pass before the CLI executes the binary.
+ */
+/**
+ * Embedded minisign public key.
+ *
+ * This key is used to verify the signature on the checksum file.
+ * It ensures the checksum file was produced by Supatype's CI,
+ * not by an attacker who compromised the CDN.
+ *
+ * Generated with: minisign -G
+ * The corresponding private key is stored as a GitHub Actions secret.
+ *
+ * TODO: Replace with actual public key once generated.
+ */
+export declare const MINISIGN_PUBLIC_KEY = "RWS0000000000000000000000000000000000000000000000000";
+/**
+ * Verify the minisign signature on a checksum file.
+ *
+ * Uses a pure-JS minisign verification (Ed25519).
+ * Returns true if the signature is valid, false otherwise.
+ */
+export declare function verifySignature(checksumPath: string, signaturePath: string, publicKey?: string): Promise<boolean>;
+/**
+ * Verify the SHA256 checksum of a binary against a signed checksum file.
+ *
+ * The checksum file format follows sha256sum output:
+ * <hash>  <filename>
+ */
+export declare function verifyChecksum(binaryPath: string, checksumPath: string, expectedFilename: string): Promise<boolean>;
+/**
+ * Run the full two-step verification pipeline.
+ * Deletes the binary if verification fails.
+ *
+ * Step 1: Verify minisign signature on checksums.sha256
+ * Step 2: Verify SHA256 hash of binary against signed checksum
+ */
+export declare function verifyBinary(binaryPath: string, checksumPath: string, signaturePath: string, artifactName: string): Promise<void>;
+/**
+ * Simple checksum-only verification (no signature).
+ * Used as a fallback when signature files are not available.
+ */
+export declare function verifyChecksumOnly(binaryPath: string, checksumPath: string, artifactName: string): Promise<void>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/engine/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/engine/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,yDAAyD,CAAA;AAEzF;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,SAAS,GAAE,MAA4B,GACtC,OAAO,CAAC,OAAO,CAAC,CAkElB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,OAAO,CAAC,CA0BlB;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/engine/verify.js

@@ -0,0 +1,161 @@
+/**
+ * Checksum and signature verification for engine binaries.
+ *
+ * Two-step verification:
+ * 1. Verify minisign signature on checksums.sha256 file
+ * 2. Verify SHA256 hash of binary against signed checksum file
+ *
+ * Both steps MUST pass before the CLI executes the binary.
+ */
+import { createHash } from "node:crypto";
+import { readFile, unlink } from "node:fs/promises";
+/**
+ * Embedded minisign public key.
+ *
+ * This key is used to verify the signature on the checksum file.
+ * It ensures the checksum file was produced by Supatype's CI,
+ * not by an attacker who compromised the CDN.
+ *
+ * Generated with: minisign -G
+ * The corresponding private key is stored as a GitHub Actions secret.
+ *
+ * TODO: Replace with actual public key once generated.
+ */
+export const MINISIGN_PUBLIC_KEY = "RWS0000000000000000000000000000000000000000000000000";
+/**
+ * Verify the minisign signature on a checksum file.
+ *
+ * Uses a pure-JS minisign verification (Ed25519).
+ * Returns true if the signature is valid, false otherwise.
+ */
+export async function verifySignature(checksumPath, signaturePath, publicKey = MINISIGN_PUBLIC_KEY) {
+    // Minisign signature format:
+    // Line 1: untrusted comment
+    // Line 2: base64-encoded signature
+    // Line 3 (optional): trusted comment
+    // Line 4 (optional): base64-encoded global signature
+    try {
+        const sigContent = await readFile(signaturePath, "utf8");
+        const checksumContent = await readFile(checksumPath);
+        const sigLines = sigContent.trim().split("\n");
+        if (sigLines.length < 2)
+            return false;
+        // Parse the signature (line 2 is the base64-encoded signature)
+        const sigBase64 = sigLines[1].trim();
+        const sigBytes = Buffer.from(sigBase64, "base64");
+        // Minisign signature: 2 bytes algorithm + 8 bytes key ID + 64 bytes Ed25519 sig
+        if (sigBytes.length < 74)
+            return false;
+        const algorithm = sigBytes.subarray(0, 2);
+        const keyId = sigBytes.subarray(2, 10);
+        const signature = sigBytes.subarray(10, 74);
+        // Parse public key
+        const pkBytes = Buffer.from(publicKey.slice(2), "base64"); // Skip "RW" prefix
+        if (pkBytes.length < 42)
+            return false;
+        // Public key: 2 bytes algorithm + 8 bytes key ID + 32 bytes Ed25519 pubkey
+        const pkKeyId = pkBytes.subarray(2, 10);
+        const pk = pkBytes.subarray(10, 42);
+        // Verify key IDs match
+        if (!keyId.equals(pkKeyId))
+            return false;
+        // Verify Ed25519 signature using Node.js crypto
+        const { verify, createPublicKey } = await import("node:crypto");
+        const publicKeyObj = createPublicKey({
+            key: Buffer.concat([
+                // Ed25519 public key DER prefix
+                Buffer.from("302a300506032b6570032100", "hex"),
+                pk,
+            ]),
+            format: "der",
+            type: "spki",
+        });
+        const isValid = verify(null, checksumContent, publicKeyObj, signature);
+        // If there's a trusted comment (line 3-4), verify the global signature too
+        if (sigLines.length >= 4 && isValid) {
+            const trustedComment = sigLines[2]?.replace(/^trusted comment: ?/, "") || "";
+            const globalSigBase64 = sigLines[3].trim();
+            const globalSig = Buffer.from(globalSigBase64, "base64");
+            const globalMessage = Buffer.concat([signature, Buffer.from(trustedComment)]);
+            const globalValid = verify(null, globalMessage, publicKeyObj, globalSig);
+            return globalValid;
+        }
+        return isValid;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Verify the SHA256 checksum of a binary against a signed checksum file.
+ *
+ * The checksum file format follows sha256sum output:
+ * <hash>  <filename>
+ */
+export async function verifyChecksum(binaryPath, checksumPath, expectedFilename) {
+    const checksumContent = await readFile(checksumPath, "utf8");
+    // Find the line matching our filename
+    const lines = checksumContent.trim().split("\n");
+    let expectedHash;
+    for (const line of lines) {
+        // Format: "<hash>  <filename>" (two spaces)
+        const parts = line.trim().split(/\s+/);
+        if (parts.length >= 2 && parts[1] === expectedFilename) {
+            expectedHash = parts[0].toLowerCase();
+            break;
+        }
+    }
+    if (!expectedHash) {
+        throw new Error(`No checksum found for ${expectedFilename} in checksum file`);
+    }
+    const binaryData = await readFile(binaryPath);
+    const actualHash = createHash("sha256").update(binaryData).digest("hex");
+    return actualHash === expectedHash;
+}
+/**
+ * Run the full two-step verification pipeline.
+ * Deletes the binary if verification fails.
+ *
+ * Step 1: Verify minisign signature on checksums.sha256
+ * Step 2: Verify SHA256 hash of binary against signed checksum
+ */
+export async function verifyBinary(binaryPath, checksumPath, signaturePath, artifactName) {
+    // Step 1: Verify signature
+    const sigValid = await verifySignature(checksumPath, signaturePath);
+    if (!sigValid) {
+        await safeDelete(binaryPath);
+        throw new Error("Engine checksum signature verification failed.\n" +
+            "The checksum file may have been tampered with.\n" +
+            "If this persists, report at https://github.com/supatype/supatype/issues");
+    }
+    // Step 2: Verify checksum
+    const checksumValid = await verifyChecksum(binaryPath, checksumPath, artifactName);
+    if (!checksumValid) {
+        await safeDelete(binaryPath);
+        throw new Error("Engine binary checksum mismatch.\n" +
+            "This could indicate a corrupt download or a tampered binary.\n" +
+            "Try again or report at https://github.com/supatype/supatype/issues");
+    }
+}
+/**
+ * Simple checksum-only verification (no signature).
+ * Used as a fallback when signature files are not available.
+ */
+export async function verifyChecksumOnly(binaryPath, checksumPath, artifactName) {
+    const valid = await verifyChecksum(binaryPath, checksumPath, artifactName);
+    if (!valid) {
+        await safeDelete(binaryPath);
+        throw new Error("Engine binary checksum mismatch.\n" +
+            "This could indicate a corrupt download or a tampered binary.\n" +
+            "Try again or report at https://github.com/supatype/supatype/issues");
+    }
+}
+async function safeDelete(path) {
+    try {
+        await unlink(path);
+    }
+    catch {
+        // Ignore deletion errors
+    }
+}
+//# sourceMappingURL=verify.js.map

package/dist/engine/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/engine/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAEnD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sDAAsD,CAAA;AAEzF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,YAAoB,EACpB,aAAqB,EACrB,YAAoB,mBAAmB;IAEvC,6BAA6B;IAC7B,4BAA4B;IAC5B,mCAAmC;IACnC,qCAAqC;IACrC,qDAAqD;IAErD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;QACxD,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAA;QAEpD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QAErC,+DAA+D;QAC/D,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAEjD,gFAAgF;QAChF,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,KAAK,CAAA;QAEtC,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACtC,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAE3C,mBAAmB;QACnB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAA,CAAC,mBAAmB;QAC7E,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;YAAE,OAAO,KAAK,CAAA;QAErC,2EAA2E;QAC3E,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACvC,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAEnC,uBAAuB;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAA;QAExC,gDAAgD;QAChD,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAA;QAE/D,MAAM,YAAY,GAAG,eAAe,CAAC;YACnC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;gBACjB,gCAAgC;gBAChC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,CAAC;gBAC9C,EAAE;aACH,CAAC;YACF,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,CAAC,CAAA;QAEtE,2EAA2E;QAC3E,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;YAC5E,MAAM,eAAe,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;YAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAA;YAExD,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAA;YAC7E,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,CAAC,CAAA;YACxE,OAAO,WAAW,CAAA;QACpB,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,UAAkB,EAClB,YAAoB,EACpB,gBAAwB;IAExB,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;IAE5D,sCAAsC;IACtC,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAChD,IAAI,YAAgC,CAAA;IAEpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,4CAA4C;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;YACvD,YAAY,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAA;YACtC,MAAK;QACP,CAAC;IACH,CAAC;IAED,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,yBAAyB,gBAAgB,mBAAmB,CAC7D,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAExE,OAAO,UAAU,KAAK,YAAY,CAAA;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,UAAkB,EAClB,YAAoB,EACpB,aAAqB,EACrB,YAAoB;IAEpB,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,YAAY,EAAE,aAAa,CAAC,CAAA;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,UAAU,CAAC,UAAU,CAAC,CAAA;QAC5B,MAAM,IAAI,KAAK,CACb,kDAAkD;YAClD,kDAAkD;YAClD,yEAAyE,CAC1E,CAAA;IACH,CAAC;IAED,0BAA0B;IAC1B,MAAM,aAAa,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,CAAA;IAClF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,UAAU,CAAC,UAAU,CAAC,CAAA;QAC5B,MAAM,IAAI,KAAK,CACb,oCAAoC;YACpC,gEAAgE;YAChE,oEAAoE,CACrE,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAkB,EAClB,YAAoB,EACpB,YAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,CAAA;IAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,UAAU,CAAC,UAAU,CAAC,CAAA;QAC5B,MAAM,IAAI,KAAK,CACb,oCAAoC;YACpC,gEAAgE;YAChE,oEAAoE,CACrE,CAAA;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;AACH,CAAC"}

package/dist/engine-version.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The engine binary version this CLI package expects.
+ * Update this whenever a new engine binary is released.
+ *
+ * The CLI always downloads and uses this exact version.
+ * Upgrading the CLI (npm update) may bump the pinned engine version.
+ * This ensures CLI and engine are always compatible.
+ *
+ * Versioning policy:
+ *   0.x.y-alpha.N  — alpha
+ *   0.x.y-beta.N   — beta
+ *   0.x.y          — stable pre-1.0
+ *   1.0.0          — cloud launch
+ *   Major bumps (1.0 → 2.0) indicate breaking changes to the schema AST format.
+ */
+export declare const ENGINE_VERSION = "0.1.0";
+/**
+ * Primary CDN for engine binary distribution.
+ * Hetzner Object Storage behind Cloudflare edge caching.
+ */
+export declare const CDN_BASE_URL = "https://releases.supatype.io/engine";
+/**
+ * Fallback: GitHub Releases on the public engine-releases repo.
+ * Used when the primary CDN is unavailable.
+ * Contains only binaries — no source code.
+ */
+export declare const ENGINE_RELEASES_REPO = "supatype/engine-releases";
+export declare const GITHUB_RELEASES_FALLBACK_URL = "https://github.com/supatype/engine-releases/releases/download";
+/**
+ * Legacy: GitHub repository for direct engine releases (before CDN).
+ * Kept for backwards compatibility with existing downloads.
+ */
+export declare const ENGINE_REPO = "supatype/schema-engine";
+export declare const ENGINE_DOWNLOAD_BASE = "https://github.com/supatype/schema-engine/releases/download/v0.1.0";
+//# sourceMappingURL=engine-version.d.ts.map

package/dist/engine-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-version.d.ts","sourceRoot":"","sources":["../src/engine-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc,UAAU,CAAA;AAErC;;;GAGG;AACH,eAAO,MAAM,YAAY,wCAAwC,CAAA;AAEjE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,6BAA6B,CAAA;AAC9D,eAAO,MAAM,4BAA4B,kEACuB,CAAA;AAEhE;;;GAGG;AACH,eAAO,MAAM,WAAW,2BAA2B,CAAA;AACnD,eAAO,MAAM,oBAAoB,uEACyC,CAAA"}

package/dist/engine-version.js

@@ -0,0 +1,35 @@
+/**
+ * The engine binary version this CLI package expects.
+ * Update this whenever a new engine binary is released.
+ *
+ * The CLI always downloads and uses this exact version.
+ * Upgrading the CLI (npm update) may bump the pinned engine version.
+ * This ensures CLI and engine are always compatible.
+ *
+ * Versioning policy:
+ *   0.x.y-alpha.N  — alpha
+ *   0.x.y-beta.N   — beta
+ *   0.x.y          — stable pre-1.0
+ *   1.0.0          — cloud launch
+ *   Major bumps (1.0 → 2.0) indicate breaking changes to the schema AST format.
+ */
+export const ENGINE_VERSION = "0.1.0";
+/**
+ * Primary CDN for engine binary distribution.
+ * Hetzner Object Storage behind Cloudflare edge caching.
+ */
+export const CDN_BASE_URL = "https://releases.supatype.io/engine";
+/**
+ * Fallback: GitHub Releases on the public engine-releases repo.
+ * Used when the primary CDN is unavailable.
+ * Contains only binaries — no source code.
+ */
+export const ENGINE_RELEASES_REPO = "supatype/engine-releases";
+export const GITHUB_RELEASES_FALLBACK_URL = `https://github.com/${ENGINE_RELEASES_REPO}/releases/download`;
+/**
+ * Legacy: GitHub repository for direct engine releases (before CDN).
+ * Kept for backwards compatibility with existing downloads.
+ */
+export const ENGINE_REPO = "supatype/schema-engine";
+export const ENGINE_DOWNLOAD_BASE = `https://github.com/${ENGINE_REPO}/releases/download/v${ENGINE_VERSION}`;
+//# sourceMappingURL=engine-version.js.map

package/dist/engine-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine-version.js","sourceRoot":"","sources":["../src/engine-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAA;AAErC;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,qCAAqC,CAAA;AAEjE;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAA;AAC9D,MAAM,CAAC,MAAM,4BAA4B,GACvC,sBAAsB,oBAAoB,oBAAoB,CAAA;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,wBAAwB,CAAA;AACnD,MAAM,CAAC,MAAM,oBAAoB,GAC/B,sBAAsB,WAAW,uBAAuB,cAAc,EAAE,CAAA"}