gemmein 0.21.0 → 0.22.1

package/lib/engine.mjs

@@ -12,6 +12,11 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { spawn } from "node:child_process";
 
+/** No byte of the engine arrived for this long (connecting included): the
+ *  download is abandoned with a sentence instead of hanging a first run. */
+export const DOWNLOAD_IDLE_MS = 30_000;
+const UNREACHABLE = "couldn't download the Gemmein engine — check your connection and run again";
+
 export function engineDir(version, base = join(homedir(), ".gemmein", "engine")) {
   return join(base, version);
 }
@@ -33,7 +38,7 @@ export function engineCached(version, files, base) {
  * A hash mismatch aborts everything — nothing unverified is ever written
  * to its final location, so nothing unverified can ever run.
  */
-export async function fetchEngine(version, files, downloadBase, base) {
+export async function fetchEngine(version, files, downloadBase, base, { idleMs = DOWNLOAD_IDLE_MS } = {}) {
   if (Object.values(files).some((h) => !/^[a-f0-9]{64}$/.test(h))) {
     throw new Error(
       "this shim build has no released engine pinned — update the gemmein package (npm i -g gemmein@latest)"
@@ -47,9 +52,31 @@ export async function fetchEngine(version, files, downloadBase, base) {
   writeFileSync(join(dir, "package.json"), JSON.stringify({ type: "module" }) + "\n");
   for (const [name, expected] of Object.entries(files)) {
     const url = `${downloadBase}/${version}/${name}`;
-    const res = await fetch(url);
+    // Every chunk that arrives restarts the clock; silence for idleMs aborts.
+    const stop = new AbortController();
+    let quiet;
+    const moved = () => { clearTimeout(quiet); quiet = setTimeout(() => stop.abort(), idleMs); };
+    let res;
+    const chunks = [];
+    try {
+      moved();
+      res = await fetch(url, { signal: stop.signal });
+      if (res.ok) {
+        const reader = res.body.getReader();
+        for (;;) {
+          moved();
+          const { done, value } = await reader.read();
+          if (done) break;
+          chunks.push(value);
+        }
+      }
+    } catch {
+      throw new Error(UNREACHABLE);
+    } finally {
+      clearTimeout(quiet);
+    }
     if (!res.ok) throw new Error(`couldn't download the Gemmein engine (${res.status} for ${name}) — check your connection and try again`);
-    const bytes = Buffer.from(await res.arrayBuffer());
+    const bytes = Buffer.concat(chunks);
     const actual = sha256(bytes);
     if (actual !== expected) {
       throw new Error(

package/lib/versions.mjs

@@ -10,12 +10,12 @@
 // fails closed: the shim refuses to download anything until a real release
 // has been promoted.
 
-export const ENGINE_VERSION = "0.21.0";
+export const ENGINE_VERSION = "0.22.1";
 
 /** file name -> hex sha256 */
 export const ENGINE_FILES = {
-  "gemmein.js": "ac85761c598e6257db70d50becf7e756ac5813cee98294baa395df1bae5c68d8",
-  "llms.txt": "fd2defdc2fd879d147b5c198aac57e8983a06d2b70549a174dc6c4057b785b23",
+  "gemmein.js": "cf015214b36468cf047c0810a6d69dfd6c425c3e478699d69bfb95e2e0993609",
+  "llms.txt": "c10af7f35c60c88c931c4745be22d018880648fc5a3971fc644ee4cb17d58d8d",
 };
 
 export const DOWNLOAD_BASE = "https://downloads.gemmein.com/engine";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gemmein",
-  "version": "0.21.0",
+  "version": "0.22.1",
   "description": "gemmein \u2014 declare your business boundaries, prove them locally, ship. Thin launcher: downloads the Gemmein local engine, verifies it, runs it. What you read here is what runs.",
   "license": "MIT",
   "type": "module",
@@ -15,7 +15,8 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node --test test/*.test.mjs"
+    "test": "node --test test/*.test.mjs",
+    "prepublishOnly": "node ../../Noob-Auth/ops/process/gate.mjs release"
   },
   "keywords": [
     "backend",