@supatype/cli 0.1.6 → 0.1.9

package/vitest.config.ts

@@ -5,10 +5,16 @@ export default defineConfig({
     jsx: "automatic",
   },
   test: {
+    // Many tests here spawn the built CLI as a subprocess, so each one pays Node startup plus
+    // the Ink and React import cost before it does any work. The 5s default leaves almost no
+    // headroom, and CI runs `turbo run test`, which runs every package concurrently: the same
+    // tests that take 1.2s alone take over 5s under that contention and fail as timeouts.
+    testTimeout: 30_000,
+    hookTimeout: 30_000,
     exclude: [
       "**/node_modules/**",
       "**/dist/**",
-      // Spec for src/engine/* (platform, cache, verify, resolve, download) — enable when Phase 0.5 modules land.
+      // Spec for src/engine/* (platform, cache, verify, resolve, download), enable when Phase 0.5 modules land.
       "tests/engine-distribution.test.ts",
     ],
   },

package/scripts/build-release-bundle.mjs

@@ -1,27 +0,0 @@
-#!/usr/bin/env node
-import { spawnSync } from "node:child_process"
-import { mkdirSync } from "node:fs"
-import { dirname, join } from "node:path"
-import { fileURLToPath } from "node:url"
-
-const root = join(dirname(fileURLToPath(import.meta.url)), "..")
-const outDir = join(root, "release-bundle")
-mkdirSync(outDir, { recursive: true })
-const outfile = join(outDir, "supatype-cli-bundle.cjs")
-
-const result = spawnSync(
-  "npx",
-  [
-    "--yes", "esbuild@0.25.5",
-    join(root, "dist", "cli.js"),
-    "--bundle",
-    "--platform=node",
-    "--target=node22",
-    "--format=cjs",
-    `--outfile=${outfile}`,
-    `--banner:js=#!/usr/bin/env node`,
-  ],
-  { stdio: "inherit", shell: process.platform === "win32" },
-)
-if (result.status !== 0) process.exit(result.status ?? 1)
-console.log(`Wrote ${outfile}`)

package/tests/engine-distribution.test.ts

@@ -1,418 +0,0 @@
-/**
- * Integration tests for engine binary distribution (Phase 0.5).
- *
- * Tests cover:
- * - Platform detection
- * - Cache management
- * - Download, checksum, and signature verification
- * - Version compatibility
- * - Offline mode
- * - Error handling
- */
-
-import { describe, it, expect, beforeEach, afterEach, vi } from "vitest"
-import { mkdirSync, writeFileSync, readFileSync, existsSync, rmSync, chmodSync } from "node:fs"
-import { join } from "node:path"
-import { tmpdir, homedir } from "node:os"
-import { createHash } from "node:crypto"
-
-// ── Platform detection ───────────────────────────────────────────────
-
-describe("Platform detection", () => {
-  it("detects supported platforms", async () => {
-    const { detectPlatform } = await import("../src/engine/platform.js")
-    // This test runs on the current platform — just verify it doesn't throw
-    const platform = detectPlatform()
-    expect(platform.os).toMatch(/^(linux|darwin|win)$/)
-    expect(platform.arch).toMatch(/^(x64|arm64)$/)
-    expect(platform.binaryName).toContain("supatype-engine")
-  })
-
-  it("builds correct artifact names", async () => {
-    const { getArtifactName } = await import("../src/engine/platform.js")
-
-    expect(
-      getArtifactName("0.1.0-alpha.1", { os: "linux", arch: "x64", binaryName: "supatype-engine", ext: "" }),
-    ).toBe("supatype-engine-0.1.0-alpha.1-linux-x64")
-
-    expect(
-      getArtifactName("0.1.0-alpha.1", { os: "darwin", arch: "arm64", binaryName: "supatype-engine", ext: "" }),
-    ).toBe("supatype-engine-0.1.0-alpha.1-darwin-arm64")
-
-    expect(
-      getArtifactName("0.1.0-alpha.1", { os: "win", arch: "x64", binaryName: "supatype-engine.exe", ext: ".exe" }),
-    ).toBe("supatype-engine-0.1.0-alpha.1-win-x64.exe")
-  })
-
-  it("rejects unsupported platforms", async () => {
-    const platformModule = await import("../src/engine/platform.js")
-    // We can't easily test this without mocking process.platform/arch
-    // but the logic is covered by the PLATFORM_MAP check
-    expect(typeof platformModule.detectPlatform).toBe("function")
-  })
-})
-
-// ── CDN URL construction ─────────────────────────────────────────────
-
-describe("CDN URL construction", () => {
-  it("builds correct CDN URLs", async () => {
-    const { getCdnUrl } = await import("../src/engine/platform.js")
-
-    const url = getCdnUrl(
-      "https://releases.supatype.com/engine",
-      "0.1.0-alpha.1",
-      "supatype-engine-0.1.0-alpha.1-linux-x64",
-    )
-    expect(url).toBe(
-      "https://releases.supatype.com/engine/v0.1.0-alpha.1/supatype-engine-0.1.0-alpha.1-linux-x64",
-    )
-  })
-})
-
-// ── Cache management ─────────────────────────────────────────────────
-
-describe("Cache management", () => {
-  const testCacheDir = join(tmpdir(), `supatype-test-cache-${Date.now()}`)
-
-  // We test the pure functions, not the ones using homedir()
-  afterEach(() => {
-    if (existsSync(testCacheDir)) {
-      rmSync(testCacheDir, { recursive: true, force: true })
-    }
-  })
-
-  it("lists cached versions from empty cache", async () => {
-    const { listCachedVersions } = await import("../src/engine/cache.js")
-    // May or may not have cached versions on this machine
-    const versions = listCachedVersions()
-    expect(Array.isArray(versions)).toBe(true)
-  })
-
-  it("pruneCacheExcept keeps specified version", async () => {
-    const { pruneCacheExcept, getCacheDir } = await import("../src/engine/cache.js")
-    const cacheDir = getCacheDir()
-
-    // Create test versions
-    const v1Dir = join(cacheDir, "test-0.0.1")
-    const v2Dir = join(cacheDir, "test-0.0.2")
-    mkdirSync(v1Dir, { recursive: true })
-    mkdirSync(v2Dir, { recursive: true })
-    writeFileSync(join(v1Dir, "supatype-engine"), "binary1")
-    writeFileSync(join(v2Dir, "supatype-engine"), "binary2")
-
-    const result = pruneCacheExcept("test-0.0.2")
-    expect(result.removed).toContain("test-0.0.1")
-    expect(result.removed).not.toContain("test-0.0.2")
-
-    // Cleanup
-    if (existsSync(v2Dir)) rmSync(v2Dir, { recursive: true, force: true })
-  })
-})
-
-// ── Checksum verification ────────────────────────────────────────────
-
-describe("Checksum verification", () => {
-  const testDir = join(tmpdir(), `supatype-test-checksum-${Date.now()}`)
-
-  beforeEach(() => {
-    mkdirSync(testDir, { recursive: true })
-  })
-
-  afterEach(() => {
-    if (existsSync(testDir)) {
-      rmSync(testDir, { recursive: true, force: true })
-    }
-  })
-
-  it("verifies correct checksum", async () => {
-    const { verifyChecksum } = await import("../src/engine/verify.js")
-
-    const binaryContent = Buffer.from("test binary content")
-    const binaryPath = join(testDir, "supatype-engine")
-    writeFileSync(binaryPath, binaryContent)
-
-    const hash = createHash("sha256").update(binaryContent).digest("hex")
-    const checksumPath = join(testDir, "checksums.sha256")
-    writeFileSync(checksumPath, `${hash}  supatype-engine-0.1.0-linux-x64\n`)
-
-    const result = await verifyChecksum(
-      binaryPath,
-      checksumPath,
-      "supatype-engine-0.1.0-linux-x64",
-    )
-    expect(result).toBe(true)
-  })
-
-  it("rejects mismatched checksum", async () => {
-    const { verifyChecksum } = await import("../src/engine/verify.js")
-
-    const binaryPath = join(testDir, "supatype-engine")
-    writeFileSync(binaryPath, "actual content")
-
-    const checksumPath = join(testDir, "checksums.sha256")
-    writeFileSync(checksumPath, `${"a".repeat(64)}  supatype-engine-0.1.0-linux-x64\n`)
-
-    const result = await verifyChecksum(
-      binaryPath,
-      checksumPath,
-      "supatype-engine-0.1.0-linux-x64",
-    )
-    expect(result).toBe(false)
-  })
-
-  it("rejects corrupt cached binary (flipped byte)", async () => {
-    const { verifyChecksum } = await import("../src/engine/verify.js")
-
-    const originalContent = Buffer.from("original binary content here")
-    const hash = createHash("sha256").update(originalContent).digest("hex")
-
-    // Corrupt the binary (flip a byte)
-    const corruptContent = Buffer.from(originalContent)
-    corruptContent[0] = corruptContent[0]! ^ 0xff
-
-    const binaryPath = join(testDir, "supatype-engine")
-    writeFileSync(binaryPath, corruptContent)
-
-    const checksumPath = join(testDir, "checksums.sha256")
-    writeFileSync(checksumPath, `${hash}  supatype-engine-0.1.0-linux-x64\n`)
-
-    const result = await verifyChecksum(
-      binaryPath,
-      checksumPath,
-      "supatype-engine-0.1.0-linux-x64",
-    )
-    expect(result).toBe(false)
-  })
-
-  it("throws when filename not found in checksum file", async () => {
-    const { verifyChecksum } = await import("../src/engine/verify.js")
-
-    const binaryPath = join(testDir, "supatype-engine")
-    writeFileSync(binaryPath, "content")
-
-    const checksumPath = join(testDir, "checksums.sha256")
-    writeFileSync(checksumPath, `${"a".repeat(64)}  other-file\n`)
-
-    await expect(
-      verifyChecksum(binaryPath, checksumPath, "supatype-engine-0.1.0-linux-x64"),
-    ).rejects.toThrow("No checksum found")
-  })
-})
-
-// ── Signature verification ───────────────────────────────────────────
-
-describe("Signature verification", () => {
-  const testDir = join(tmpdir(), `supatype-test-sig-${Date.now()}`)
-
-  beforeEach(() => {
-    mkdirSync(testDir, { recursive: true })
-  })
-
-  afterEach(() => {
-    if (existsSync(testDir)) {
-      rmSync(testDir, { recursive: true, force: true })
-    }
-  })
-
-  it("rejects tampered checksum file (invalid signature)", async () => {
-    const { verifySignature } = await import("../src/engine/verify.js")
-
-    const checksumPath = join(testDir, "checksums.sha256")
-    writeFileSync(checksumPath, `${"a".repeat(64)}  supatype-engine-0.1.0-linux-x64\n`)
-
-    // Create a fake .minisig with garbage signature
-    const sigPath = join(testDir, "checksums.sha256.minisig")
-    writeFileSync(
-      sigPath,
-      `untrusted comment: fake\n${Buffer.alloc(74).toString("base64")}\n`,
-    )
-
-    const result = await verifySignature(checksumPath, sigPath)
-    expect(result).toBe(false)
-  })
-
-  it("rejects missing .minisig file", async () => {
-    const { verifySignature } = await import("../src/engine/verify.js")
-
-    const checksumPath = join(testDir, "checksums.sha256")
-    writeFileSync(checksumPath, "some content")
-
-    const result = await verifySignature(checksumPath, join(testDir, "nonexistent.minisig"))
-    expect(result).toBe(false)
-  })
-
-  it("rejects forged signature with wrong key", async () => {
-    const { verifySignature } = await import("../src/engine/verify.js")
-
-    const checksumPath = join(testDir, "checksums.sha256")
-    writeFileSync(checksumPath, `${"a".repeat(64)}  supatype-engine\n`)
-
-    // Forged signature (valid format but wrong key)
-    const sigPath = join(testDir, "checksums.sha256.minisig")
-    const fakeSignature = Buffer.alloc(74)
-    fakeSignature.writeUInt16LE(0x4564, 0) // Ed algorithm bytes
-    writeFileSync(
-      sigPath,
-      `untrusted comment: forged\n${fakeSignature.toString("base64")}\n`,
-    )
-
-    const result = await verifySignature(checksumPath, sigPath)
-    expect(result).toBe(false)
-  })
-})
-
-// ── Version compatibility ────────────────────────────────────────────
-
-describe("Version compatibility", () => {
-  it("accepts same major version", async () => {
-    const { checkVersionCompatibility } = await import("../src/engine/resolve.js")
-
-    expect(checkVersionCompatibility("1.2.3", "1.0.0").compatible).toBe(true)
-    expect(checkVersionCompatibility("0.1.0", "0.2.0").compatible).toBe(true)
-  })
-
-  it("rejects different major versions", async () => {
-    const { checkVersionCompatibility } = await import("../src/engine/resolve.js")
-
-    const result = checkVersionCompatibility("2.1.0", "1.3.0")
-    expect(result.compatible).toBe(false)
-    expect(result.message).toContain("not compatible")
-    expect(result.message).toContain("npm update @supatype/cli")
-  })
-})
-
-// ── Update check throttling ─────────────────────────────────────────
-
-describe("Update check throttling", () => {
-  it("returns true when no check file exists", async () => {
-    const { shouldCheckForUpdates } = await import("../src/engine/cache.js")
-    // On fresh machine, should want to check
-    const result = await shouldCheckForUpdates()
-    expect(typeof result).toBe("boolean")
-  })
-
-  it("skips check in CI environments", async () => {
-    const origCI = process.env.CI
-    process.env.CI = "true"
-
-    const { shouldCheckForUpdates } = await import("../src/engine/cache.js")
-    const result = await shouldCheckForUpdates()
-    expect(result).toBe(false)
-
-    if (origCI !== undefined) {
-      process.env.CI = origCI
-    } else {
-      delete process.env.CI
-    }
-  })
-})
-
-// ── Download retry ──────────────────────────────────────────────────
-
-describe("Download retry", () => {
-  it("fetchJson returns undefined on network error", async () => {
-    const { fetchJson } = await import("../src/engine/download.js")
-    const result = await fetchJson("http://localhost:1/nonexistent")
-    expect(result).toBeUndefined()
-  })
-})
-
-// ── Engine version constants ─────────────────────────────────────────
-
-describe("Engine version constants", () => {
-  it("exports valid version and URLs", async () => {
-    const {
-      ENGINE_VERSION,
-      CDN_BASE_URL,
-      ENGINE_RELEASES_REPO,
-      GITHUB_RELEASES_FALLBACK_URL,
-    } = await import("../src/engine-version.js")
-
-    expect(ENGINE_VERSION).toMatch(/^\d+\.\d+\.\d+/)
-    expect(CDN_BASE_URL).toBe("https://releases.supatype.com/engine")
-    expect(ENGINE_RELEASES_REPO).toBe("supatype/engine-releases")
-    expect(GITHUB_RELEASES_FALLBACK_URL).toContain("github.com")
-  })
-})
-
-// ── Full binary verification pipeline ────────────────────────────────
-
-describe("Binary verification pipeline", () => {
-  const testDir = join(tmpdir(), `supatype-test-pipeline-${Date.now()}`)
-
-  beforeEach(() => {
-    mkdirSync(testDir, { recursive: true })
-  })
-
-  afterEach(() => {
-    if (existsSync(testDir)) {
-      rmSync(testDir, { recursive: true, force: true })
-    }
-  })
-
-  it("verifyChecksumOnly passes with valid checksum", async () => {
-    const { verifyChecksumOnly } = await import("../src/engine/verify.js")
-
-    const content = Buffer.from("valid engine binary")
-    const hash = createHash("sha256").update(content).digest("hex")
-
-    const binaryPath = join(testDir, "engine")
-    writeFileSync(binaryPath, content)
-
-    const checksumPath = join(testDir, "checksums.sha256")
-    writeFileSync(checksumPath, `${hash}  engine-0.1.0-linux-x64\n`)
-
-    // Should not throw
-    await verifyChecksumOnly(binaryPath, checksumPath, "engine-0.1.0-linux-x64")
-  })
-
-  it("verifyChecksumOnly rejects and deletes corrupt binary", async () => {
-    const { verifyChecksumOnly } = await import("../src/engine/verify.js")
-
-    const binaryPath = join(testDir, "engine")
-    writeFileSync(binaryPath, "corrupt content")
-
-    const checksumPath = join(testDir, "checksums.sha256")
-    writeFileSync(checksumPath, `${"f".repeat(64)}  engine-0.1.0-linux-x64\n`)
-
-    await expect(
-      verifyChecksumOnly(binaryPath, checksumPath, "engine-0.1.0-linux-x64"),
-    ).rejects.toThrow("checksum mismatch")
-
-    // Binary should be deleted
-    expect(existsSync(binaryPath)).toBe(false)
-  })
-
-  it("verifyBinary rejects when signature is invalid", async () => {
-    const { verifyBinary } = await import("../src/engine/verify.js")
-
-    const content = Buffer.from("binary content")
-    const hash = createHash("sha256").update(content).digest("hex")
-
-    const binaryPath = join(testDir, "engine")
-    writeFileSync(binaryPath, content)
-
-    const checksumPath = join(testDir, "checksums.sha256")
-    writeFileSync(checksumPath, `${hash}  engine-artifact\n`)
-
-    const sigPath = join(testDir, "checksums.sha256.minisig")
-    writeFileSync(sigPath, `untrusted comment: bad\n${Buffer.alloc(74).toString("base64")}\n`)
-
-    await expect(
-      verifyBinary(binaryPath, checksumPath, sigPath, "engine-artifact"),
-    ).rejects.toThrow("signature verification failed")
-
-    // Binary should be deleted
-    expect(existsSync(binaryPath)).toBe(false)
-  })
-})
-
-// ── Binary size check (placeholder for CI) ───────────────────────────
-
-describe("Binary size", () => {
-  it("has a 20MB size target documented", () => {
-    // This is a CI-level check. Here we just verify the constant is defined.
-    const MAX_BINARY_SIZE_MB = 20
-    expect(MAX_BINARY_SIZE_MB).toBe(20)
-  })
-})