stitchkit 0.93.0 → 0.94.1

package/dist/cli.js

@@ -1,753 +0,0 @@
-import {
-  CliArgumentError,
-  DEFAULT_EXIT_CODES,
-  PrivateAddressRefusal,
-  cliExitCode,
-  cliInvocationResult,
-  createCli,
-  createCliInvoker,
-  defineCliCommand,
-  emitResult,
-  extractCliGlobalOptions,
-  fetchGuarded,
-  parseCliArgs,
-  pollUntilDone,
-  readCapped,
-  renderCliView,
-  routeCliArgv
-} from "./index-3bmnp41g.js";
-import {
-  serializeCanonicalJson
-} from "./index-0j3vcp5m.js";
-import"./index-sbdmyz75.js";
-import"./index-2c2bjw3s.js";
-import {
-  argumentsDigest
-} from "./index-a916km3r.js";
-import"./index-mzvgxp0n.js";
-import"./index-yn8remb1.js";
-import"./index-tmwcrptx.js";
-import"./index-f9mb610r.js";
-import"./index-e0znv5gn.js";
-import"./index-0a349c33.js";
-import"./index-rxfy4cq7.js";
-import"./index-6k1937bx.js";
-import"./index-zcgf3gqf.js";
-import {
-  coerceJsonArgs
-} from "./index-7zbps32p.js";
-import"./index-vjpvjqpn.js";
-import"./index-h9etkkyk.js";
-import"./index-cby4ar3v.js";
-import {
-  AppError
-} from "./index-2vtcmrj9.js";
-import {
-  safeJsonParse
-} from "./index-kzfs85xp.js";
-import {
-  isRecord
-} from "./index-77fekveh.js";
-// src/tools/cli-checkpoint.ts
-import { existsSync, readFileSync } from "node:fs";
-
-// src/internal/atomic-file.ts
-import { randomBytes } from "node:crypto";
-import { closeSync, fchmodSync, fsyncSync, openSync, renameSync, writeSync } from "node:fs";
-import { basename, dirname, join } from "node:path";
-function writeFileAtomic(target, bytes, mode) {
-  const staged = join(dirname(target), `.${basename(target)}.${randomBytes(12).toString("hex")}.tmp`);
-  const handle = openSync(staged, "wx", mode);
-  try {
-    writeSync(handle, bytes);
-    fchmodSync(handle, mode);
-    fsyncSync(handle);
-  } finally {
-    closeSync(handle);
-  }
-  renameSync(staged, target);
-}
-
-// src/tools/cli-checkpoint.ts
-function emptyCheckpoint(entries) {
-  return {
-    entries,
-    digestOf: (line) => argumentsDigest({ command: line.command, args: line.args }),
-    record(id, digest, answer) {
-      entries[id] = { digest, answer };
-    }
-  };
-}
-function readCliCheckpoint(path) {
-  if (!existsSync(path))
-    return emptyCheckpoint({});
-  try {
-    const parsed = safeJsonParse(readFileSync(path, "utf8"));
-    const entries = {};
-    if (isRecord(parsed) && isRecord(parsed.entries)) {
-      for (const [id, value] of Object.entries(parsed.entries)) {
-        if (isRecord(value) && typeof value.digest === "string") {
-          entries[id] = { digest: value.digest, answer: value.answer };
-        }
-      }
-    }
-    return emptyCheckpoint(entries);
-  } catch {
-    return emptyCheckpoint({});
-  }
-}
-function writeCliCheckpoint(path, checkpoint) {
-  writeFileAtomic(path, Buffer.from(`${JSON.stringify({ entries: checkpoint.entries }, null, 2)}
-`, "utf8"), 384);
-}
-// src/tools/cli-installer.ts
-function shellQuote(value) {
-  return `'${value.replaceAll("'", `'"'"'`)}'`;
-}
-function renderCliInstaller(config) {
-  const binary = config.binaryName ?? config.manifest.name;
-  const installDir = config.installDir ?? "$HOME/.local/bin";
-  const assets = config.asset ? [config.asset] : config.manifest.assets;
-  if (assets.length === 0) {
-    throw new Error("[stitchkit] a build manifest with no assets installs nothing");
-  }
-  const selection = assets.length === 1 && assets[0] !== undefined ? singleTarget(assets[0]) : unameDispatch(assets);
-  return `#!/bin/sh
-# ${binary} ${config.manifest.version} (${config.manifest.commit})
-# Generated from the build manifest — it parses no JSON and needs no jq.
-set -eu
-
-binary=${shellQuote(binary)}
-dir="\${INSTALL_DIR:-${installDir}}"
-
-${selection}
-
-fetch() {
-  if command -v curl >/dev/null 2>&1; then
-    curl -fsSL "$1" -o "$2"
-  elif command -v wget >/dev/null 2>&1; then
-    wget -q "$1" -O "$2"
-  else
-    echo "need curl or wget" >&2
-    exit 1
-  fi
-}
-
-digest() {
-  if command -v sha256sum >/dev/null 2>&1; then
-    sha256sum "$1" | cut -d' ' -f1
-  elif command -v shasum >/dev/null 2>&1; then
-    shasum -a 256 "$1" | cut -d' ' -f1
-  elif command -v openssl >/dev/null 2>&1; then
-    openssl dgst -sha256 "$1" | awk '{print $NF}'
-  else
-    echo "need sha256sum, shasum or openssl" >&2
-    exit 1
-  fi
-}
-
-tmp="$(mktemp -d)"
-trap 'rm -rf "$tmp"' EXIT
-
-fetch "$url" "$tmp/download"
-if [ "$compression" = "gzip" ]; then
-  gzip -dc "$tmp/download" > "$tmp/binary"
-else
-  mv "$tmp/download" "$tmp/binary"
-fi
-
-actual="$(digest "$tmp/binary")"
-if [ "$actual" != "$sha256" ]; then
-  echo "checksum mismatch: expected $sha256, got $actual" >&2
-  exit 1
-fi
-
-actual_size="$(wc -c < "$tmp/binary" | tr -d ' ')"
-if [ "$actual_size" != "$size" ]; then
-  echo "size mismatch: expected $size bytes, got $actual_size" >&2
-  exit 1
-fi
-
-mkdir -p "$dir"
-chmod 755 "$tmp/binary"
-# A rename, never a write over the file in place: anything else can leave a
-# half-written executable where a working one used to be.
-mv "$tmp/binary" "$dir/$binary"
-
-echo "installed $binary ${config.manifest.version} to $dir/$binary"
-case ":$PATH:" in
-  *":$dir:"*) ;;
-  *) echo "note: $dir is not on your PATH" >&2 ;;
-esac
-`;
-}
-function singleTarget(asset) {
-  return [
-    `url=${shellQuote(asset.url)}`,
-    `sha256=${shellQuote(asset.sha256)}`,
-    `size=${shellQuote(String(asset.size))}`,
-    `compression=${shellQuote(asset.compression)}`
-  ].join(`
-`);
-}
-function unameDispatch(assets) {
-  const cases = assets.map((asset) => `  ${asset.platform}/${asset.arch})
-    url=${shellQuote(asset.url)}
-    sha256=${shellQuote(asset.sha256)}
-    size=${shellQuote(String(asset.size))}
-    compression=${shellQuote(asset.compression)}
-    ;;`).join(`
-`);
-  const published = assets.map((asset) => `${asset.platform}/${asset.arch}`).join(", ");
-  return `case "$(uname -s)" in
-  Darwin) platform=darwin ;;
-  Linux) platform=linux ;;
-  *) platform="$(uname -s)" ;;
-esac
-case "$(uname -m)" in
-  x86_64|amd64) arch=x64 ;;
-  aarch64|arm64) arch=arm64 ;;
-  *) arch="$(uname -m)" ;;
-esac
-
-case "$platform/$arch" in
-${cases}
-  *)
-    echo "no published build for $platform/$arch — published: ${published}" >&2
-    exit 1
-    ;;
-esac`;
-}
-// src/tools/cli-manifest.ts
-import { z as z2 } from "zod";
-
-// src/tools/cli-signature.ts
-import {
-  createPrivateKey,
-  createPublicKey,
-  sign as cryptoSign,
-  verify as cryptoVerify
-} from "node:crypto";
-import { z } from "zod";
-var CliBuildSignatureSchema = z.object({
-  algorithm: z.literal("ed25519"),
-  keyId: z.string().min(1),
-  signature: z.string().min(1)
-});
-function cliManifestSigningPayload(manifest) {
-  return serializeCanonicalJson({
-    name: manifest.name,
-    version: manifest.version,
-    commit: manifest.commit,
-    builtAt: manifest.builtAt,
-    assets: manifest.assets.map((asset) => ({
-      platform: asset.platform,
-      arch: asset.arch,
-      compression: asset.compression,
-      size: asset.size,
-      sha256: asset.sha256
-    }))
-  });
-}
-function publicKeyOf(material) {
-  const trimmed = material.trim();
-  if (trimmed.includes("BEGIN PUBLIC KEY"))
-    return createPublicKey(trimmed);
-  const raw = Buffer.from(trimmed, "base64");
-  if (raw.length !== 32) {
-    throw new Error("[stitchkit] an Ed25519 public key is 32 bytes or SPKI PEM");
-  }
-  const spki = Buffer.concat([Buffer.from("302a300506032b6570032100", "hex"), raw]);
-  return createPublicKey({ key: spki, format: "der", type: "spki" });
-}
-function signCliManifest(manifest, options) {
-  const signature = cryptoSign(null, Buffer.from(cliManifestSigningPayload(manifest), "utf8"), createPrivateKey(typeof options.privateKey === "string" ? options.privateKey : { key: Buffer.from(options.privateKey), format: "der", type: "pkcs8" }));
-  return {
-    algorithm: "ed25519",
-    keyId: options.keyId,
-    signature: signature.toString("base64")
-  };
-}
-function verifyCliManifest(manifest, signature, trust) {
-  const keys = trust?.keys;
-  if (!keys || Object.keys(keys).length === 0)
-    return "unenforced";
-  if (!signature)
-    return "missing";
-  const material = Object.hasOwn(keys, signature.keyId) ? keys[signature.keyId] : undefined;
-  if (material === undefined)
-    return "unknown-key";
-  try {
-    const ok = cryptoVerify(null, Buffer.from(cliManifestSigningPayload(manifest), "utf8"), publicKeyOf(material), Buffer.from(signature.signature, "base64"));
-    return ok ? "valid" : "invalid";
-  } catch {
-    return "invalid";
-  }
-}
-function cliSignatureAccepted(verdict) {
-  return verdict === "valid" || verdict === "unenforced";
-}
-
-// src/tools/cli-manifest.ts
-var CliBuildTargetSchema = z2.object({
-  platform: z2.string().min(1),
-  arch: z2.string().min(1)
-});
-var CliBuildAssetSchema = CliBuildTargetSchema.extend({
-  url: z2.url(),
-  compression: z2.enum(["gzip", "none"]).default("none"),
-  size: z2.int().positive(),
-  sha256: z2.string().regex(/^[0-9a-f]{64}$/, "sha256 must be 64 lowercase hex characters")
-});
-var CliBuildManifestSchema = z2.object({
-  name: z2.string().min(1),
-  version: z2.string().min(1),
-  commit: z2.string().min(1),
-  builtAt: z2.iso.datetime(),
-  assets: z2.array(CliBuildAssetSchema),
-  signature: CliBuildSignatureSchema.optional()
-});
-var CliBuildStampSchema = z2.object({
-  version: z2.string().min(1),
-  commit: z2.string().min(1),
-  builtAt: z2.iso.datetime()
-});
-function formatCliBuildStamp(stamp, name) {
-  const prefix = name ? `${name} ` : "";
-  return `${prefix}${stamp.version} (${stamp.commit.slice(0, 12)}, built ${stamp.builtAt})`;
-}
-function currentCliBuildTarget() {
-  return { platform: process.platform, arch: process.arch };
-}
-function selectCliBuildAsset(manifest, target = currentCliBuildTarget()) {
-  return manifest.assets.find((asset) => asset.platform === target.platform && asset.arch === target.arch);
-}
-function isManifestList(value) {
-  return Array.isArray(value);
-}
-function assertCliPublishable(previous, next) {
-  const published = previous === undefined ? [] : isManifestList(previous) ? previous : [previous];
-  for (const candidate of published) {
-    if (candidate.version !== next.version)
-      continue;
-    if (candidate.commit === next.commit)
-      continue;
-    throw new Error(`[stitchkit] ${next.name} ${next.version} was already published from commit ${candidate.commit}; ` + `refusing to republish it from ${next.commit} — bump the version instead`);
-  }
-}
-// src/tools/cli-profile.ts
-import {
-  chmodSync,
-  existsSync as existsSync2,
-  mkdirSync,
-  readdirSync,
-  readFileSync as readFileSync2,
-  statSync,
-  writeFileSync
-} from "node:fs";
-import { join as join2 } from "node:path";
-var PROFILE_SUFFIX = ".json";
-var FILE_MODE = 384;
-var DIRECTORY_MODE = 448;
-
-class CliProfileError extends AppError {
-  constructor(message, code = "NOT_FOUND") {
-    super(code, message, code === "NOT_FOUND" ? 404 : code === "FORBIDDEN" ? 403 : 400);
-    this.name = "CliProfileError";
-  }
-}
-function assertProfileName(name) {
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(name)) {
-    throw new CliProfileError(`"${name}" is not a usable profile name — letters, digits, dot, dash and underscore`, "BAD_REQUEST");
-  }
-}
-function createCliProfileStore(config) {
-  const announce = config.announce ?? ((line) => process.stderr.write(`${line}
-`));
-  const pathFor = (name) => {
-    assertProfileName(name);
-    return join2(config.directory, `${name}${PROFILE_SUFFIX}`);
-  };
-  const list = () => {
-    if (!existsSync2(config.directory))
-      return [];
-    return readdirSync(config.directory).filter((entry) => entry.endsWith(PROFILE_SUFFIX)).map((entry) => entry.slice(0, -PROFILE_SUFFIX.length)).sort();
-  };
-  const read = (name) => {
-    const path = pathFor(name);
-    if (!existsSync2(path)) {
-      throw new CliProfileError(missingMessage(name, path, config));
-    }
-    const mode = statSync(path).mode & 63;
-    if (mode !== 0) {
-      throw new CliProfileError(`profile "${name}" is readable by other users — run: chmod 600 ${path}`, "FORBIDDEN");
-    }
-    const parsed = safeJsonParse(readFileSync2(path, "utf8"));
-    const result = config.schema.safeParse(parsed);
-    if (!result.success) {
-      const issue = result.error.issues[0];
-      const field = issue?.path.join(".");
-      throw new CliProfileError(`profile "${name}" (${path}) is not usable: ${field ? `${field}: ` : ""}${issue?.message ?? "invalid"}`, "BAD_REQUEST");
-    }
-    return result.data;
-  };
-  return {
-    directory: config.directory,
-    pathFor,
-    list,
-    read,
-    write(name, value) {
-      const path = pathFor(name);
-      mkdirSync(config.directory, { recursive: true, mode: DIRECTORY_MODE });
-      writeFileSync(path, `${JSON.stringify(value, null, 2)}
-`, { mode: FILE_MODE });
-      chmodSync(path, FILE_MODE);
-      return path;
-    },
-    resolve(name) {
-      if (name !== undefined) {
-        const path = pathFor(name);
-        return { name, path, value: read(name), substituted: false };
-      }
-      const configured = list();
-      const only = configured[0];
-      if (configured.length === 1 && only !== undefined) {
-        const path = pathFor(only);
-        announce(`[${only}] using the only configured profile (${path})`);
-        return { name: only, path, value: read(only), substituted: true };
-      }
-      if (configured.length === 0) {
-        const example = join2(config.directory, `<name>${PROFILE_SUFFIX}`);
-        throw new CliProfileError(`no profile is configured in ${config.directory}${config.createHint ? ` — ${config.createHint("<name>", example)}` : ""}`);
-      }
-      throw new CliProfileError(`several profiles are configured (${configured.join(", ")}) — name one`, "BAD_REQUEST");
-    }
-  };
-}
-function missingMessage(name, path, config) {
-  const hint = config.createHint ? ` — ${config.createHint(name, path)}` : "";
-  return `profile "${name}" is not configured; expected ${path}${hint}`;
-}
-// src/tools/cli-stream.ts
-import { z as z3 } from "zod";
-var LineSchema = z3.object({
-  id: z3.string().min(1),
-  command: z3.string().min(1),
-  args: z3.record(z3.string(), z3.unknown()).default({})
-});
-async function* readStdinLines(source = process.stdin) {
-  const decoder = new TextDecoder;
-  let pending = "";
-  for await (const chunk of source) {
-    pending += typeof chunk === "string" ? chunk : decoder.decode(chunk, { stream: true });
-    let newline = pending.indexOf(`
-`);
-    while (newline !== -1) {
-      const line = pending.slice(0, newline);
-      pending = pending.slice(newline + 1);
-      yield line.endsWith("\r") ? line.slice(0, -1) : line;
-      newline = pending.indexOf(`
-`);
-    }
-  }
-  if (pending !== "")
-    yield pending.endsWith("\r") ? pending.slice(0, -1) : pending;
-}
-function parseLine(line) {
-  let parsed;
-  try {
-    parsed = safeJsonParse(line);
-  } catch {
-    return { ok: false, answer: malformed("the line is not JSON") };
-  }
-  const result = LineSchema.safeParse(parsed);
-  if (!result.success) {
-    const id = isRecord(parsed) && typeof parsed.id === "string" ? parsed.id : undefined;
-    return {
-      ok: false,
-      answer: {
-        ...malformed("the line needs `id` and `command`"),
-        ...id !== undefined && { id }
-      }
-    };
-  }
-  return { ok: true, value: result.data };
-}
-function malformed(message) {
-  return {
-    id: "",
-    ok: false,
-    exitCode: 2,
-    error: { code: "BAD_REQUEST", message }
-  };
-}
-async function runCliStream(invoker, lines, onAnswer, hooks = {}) {
-  for await (const line of lines) {
-    if (line.trim() === "")
-      continue;
-    const parsed = parseLine(line);
-    if (!parsed.ok) {
-      onAnswer(parsed.answer);
-      continue;
-    }
-    const { id, command, args } = parsed.value;
-    const answered = hooks.before?.(id, { command, args });
-    if (answered) {
-      onAnswer(answered);
-      continue;
-    }
-    const outcome = await invoker.invoke(command, args);
-    hooks.after?.(id, { command, args }, outcome);
-    onAnswer({ id, ...outcome });
-  }
-}
-function defineCliStreamCommand(config) {
-  return defineCliCommand({
-    name: config.name ?? "stream",
-    description: config.description ?? "Run one operation per JSON line of stdin, answering each",
-    input: z3.object({}),
-    handler: async (context) => {
-      const invoker = typeof config.invoker === "function" ? await config.invoker() : config.invoker;
-      await runCliStream(invoker, (config.readLines ?? readStdinLines)(), (answer) => {
-        context.stdout(`${JSON.stringify(answer)}
-`);
-      });
-    }
-  });
-}
-function defineCliBatchCommand(config) {
-  return defineCliCommand({
-    name: config.name ?? "batch",
-    description: config.description ?? "Run one operation per JSON line of stdin, resuming from a checkpoint",
-    input: z3.object({
-      checkpoint: z3.string().optional()
-    }),
-    handler: async (context) => {
-      const invoker = typeof config.invoker === "function" ? await config.invoker() : config.invoker;
-      const path = context.input.checkpoint ?? config.checkpointPath ?? ".stitchkit-batch.json";
-      const checkpoint = readCliCheckpoint(path);
-      await runCliStream(invoker, (config.readLines ?? readStdinLines)(), (answer) => {
-        context.stdout(`${JSON.stringify(answer)}
-`);
-      }, {
-        before: (id, line) => {
-          const digest = checkpoint.digestOf(line);
-          const recorded = checkpoint.entries[id];
-          if (!recorded)
-            return;
-          if (recorded.digest !== digest) {
-            return {
-              id,
-              ok: false,
-              exitCode: 2,
-              error: {
-                code: "CONFLICT",
-                message: "this id was already run with different content — change the id or start a new checkpoint"
-              }
-            };
-          }
-          const replay = isRecord(recorded.answer) ? recorded.answer : {};
-          return { ...replay, id, replayed: true };
-        },
-        after: (id, line, outcome) => {
-          if (!outcome.ok)
-            return;
-          checkpoint.record(id, checkpoint.digestOf(line), outcome);
-          writeCliCheckpoint(path, checkpoint);
-        }
-      });
-    }
-  });
-}
-// src/tools/cli-update.ts
-import { createHash } from "node:crypto";
-import { existsSync as existsSync3, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
-import { gunzipSync } from "node:zlib";
-var DEFAULT_CHECK_TIMEOUT_MS = 2000;
-var DEFAULT_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000;
-var DEFAULT_DOWNLOAD_TIMEOUT_MS = 120000;
-var MANIFEST_MAX_BYTES = 256 * 1024;
-var DEFAULT_MAX_ASSET_BYTES = 256 * 1024 * 1024;
-function parseVersion(value) {
-  const match = /^v?(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?/.exec(value.trim());
-  if (!match)
-    return;
-  const numbers = [match[1], match[2], match[3]].map((part) => Number(part));
-  if (numbers.some((part) => !Number.isFinite(part)))
-    return;
-  return { numbers, prerelease: match[4] };
-}
-function compareCliVersions(left, right) {
-  const a = parseVersion(left);
-  const b = parseVersion(right);
-  if (!a || !b)
-    return;
-  for (let index = 0;index < 3; index++) {
-    const difference = (a.numbers[index] ?? 0) - (b.numbers[index] ?? 0);
-    if (difference !== 0)
-      return difference < 0 ? -1 : 1;
-  }
-  if (a.prerelease === b.prerelease)
-    return 0;
-  if (a.prerelease === undefined)
-    return 1;
-  if (b.prerelease === undefined)
-    return -1;
-  return a.prerelease < b.prerelease ? -1 : 1;
-}
-async function checkCliUpdate(config) {
-  const now = config.now ?? Date.now();
-  const interval = config.intervalMs ?? DEFAULT_CHECK_INTERVAL_MS;
-  if (config.lastCheckedAt !== undefined && now - config.lastCheckedAt < interval) {
-    return { status: "skipped", nextCheckAt: config.lastCheckedAt + interval };
-  }
-  try {
-    const response = await fetchGuarded(new URL(config.manifestUrl), config.allowPrivateHosts ?? false, {
-      timeoutMs: config.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS,
-      bodyTimeoutMs: config.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS
-    });
-    if (!response.ok)
-      return { status: "unknown", reason: `manifest responded ${response.status}` };
-    const body = await readCapped(response, MANIFEST_MAX_BYTES);
-    if (!body)
-      return { status: "unknown", reason: "manifest is larger than expected" };
-    const parsed = CliBuildManifestSchema.safeParse(JSON.parse(body.toString("utf8")));
-    if (!parsed.success)
-      return { status: "unknown", reason: "manifest did not validate" };
-    const manifest = parsed.data;
-    const order = compareCliVersions(config.currentVersion, manifest.version);
-    if (order === undefined) {
-      return {
-        status: "unknown",
-        reason: `cannot compare ${config.currentVersion} with ${manifest.version}`
-      };
-    }
-    const verdict = verifyCliManifest(manifest, manifest.signature, config.trust);
-    if (order >= 0)
-      return { status: "current", version: manifest.version, signature: verdict };
-    if (!cliSignatureAccepted(verdict)) {
-      return { status: "unknown", reason: `manifest signature: ${verdict}` };
-    }
-    const asset = selectCliBuildAsset(manifest, config.target ?? currentCliBuildTarget());
-    return {
-      status: "outdated",
-      version: manifest.version,
-      manifest,
-      ...asset && { asset },
-      signature: verdict
-    };
-  } catch (error) {
-    if (error instanceof PrivateAddressRefusal) {
-      return {
-        status: "unknown",
-        reason: `${error.message} — the manifest endpoint is not public. Set ` + "`allowPrivateHosts` if it is your own deployment; the download keeps " + "its own setting, because an asset URL comes from the document."
-      };
-    }
-    return {
-      status: "unknown",
-      reason: error instanceof Error ? error.message : String(error)
-    };
-  }
-}
-async function applyCliUpdate(config) {
-  const target = config.targetPath ?? process.execPath;
-  if (config.trust) {
-    if (!config.manifest) {
-      throw new Error("[stitchkit] update: a trust root needs the manifest the asset came from");
-    }
-    const verdict = verifyCliManifest(config.manifest, config.manifest.signature, config.trust);
-    if (!cliSignatureAccepted(verdict)) {
-      throw new Error(`[stitchkit] update: refusing to install — manifest signature ${verdict}`);
-    }
-    if (!config.manifest.assets.some((asset) => asset.sha256 === config.asset.sha256)) {
-      throw new Error("[stitchkit] update: the asset is not one the signed manifest names");
-    }
-  }
-  const response = await fetchGuarded(new URL(config.asset.url), config.allowPrivateHosts ?? false, {
-    timeoutMs: config.timeoutMs ?? DEFAULT_DOWNLOAD_TIMEOUT_MS,
-    bodyTimeoutMs: config.timeoutMs ?? DEFAULT_DOWNLOAD_TIMEOUT_MS
-  });
-  if (!response.ok) {
-    throw new Error(`[stitchkit] update download responded ${response.status}`);
-  }
-  const transferred = await readCapped(response, config.maxBytes ?? DEFAULT_MAX_ASSET_BYTES);
-  if (!transferred)
-    throw new Error("[stitchkit] update download exceeded the size ceiling");
-  const bytes = config.asset.compression === "gzip" ? gunzipSync(transferred, { maxOutputLength: config.asset.size }) : transferred;
-  if (bytes.length !== config.asset.size) {
-    throw new Error(`[stitchkit] update is ${bytes.length} bytes, manifest says ${config.asset.size} — refusing to install it`);
-  }
-  const sha256 = createHash("sha256").update(bytes).digest("hex");
-  if (sha256 !== config.asset.sha256) {
-    throw new Error(`[stitchkit] update digest ${sha256} does not match the manifest — refusing to install it`);
-  }
-  const backup = config.backupPath ? keepReplacedBinary(target, config.backupPath) : undefined;
-  writeFileAtomic(target, bytes, 493);
-  return {
-    path: target,
-    bytes: bytes.length,
-    sha256,
-    ...backup && { backupPath: backup.path, backupSha256: backup.sha256 }
-  };
-}
-function keepReplacedBinary(target, backupPath) {
-  if (!existsSync3(target))
-    return;
-  const previous = readFileSync3(target);
-  writeFileAtomic(backupPath, previous, statSync2(target).mode & 511);
-  return { path: backupPath, sha256: createHash("sha256").update(previous).digest("hex") };
-}
-function rollbackCliUpdate(config) {
-  const target = config.targetPath ?? process.execPath;
-  if (!existsSync3(config.backupPath)) {
-    throw new Error(`[stitchkit] rollback: no backup at ${config.backupPath}`);
-  }
-  const bytes = readFileSync3(config.backupPath);
-  const sha256 = createHash("sha256").update(bytes).digest("hex");
-  if (sha256 !== config.expectedSha256) {
-    throw new Error(`[stitchkit] rollback: backup digest ${sha256} does not match the expected ${config.expectedSha256} — refusing to restore it`);
-  }
-  writeFileAtomic(target, bytes, statSync2(config.backupPath).mode & 511);
-  return { path: target, bytes: bytes.length, sha256 };
-}
-export {
-  writeCliCheckpoint,
-  verifyCliManifest,
-  signCliManifest,
-  selectCliBuildAsset,
-  runCliStream,
-  routeCliArgv,
-  rollbackCliUpdate,
-  renderCliView,
-  renderCliInstaller,
-  readCliCheckpoint,
-  pollUntilDone,
-  parseCliArgs,
-  formatCliBuildStamp,
-  extractCliGlobalOptions,
-  emitResult,
-  defineCliStreamCommand,
-  defineCliCommand,
-  defineCliBatchCommand,
-  currentCliBuildTarget,
-  createCliProfileStore,
-  createCliInvoker,
-  createCli,
-  compareCliVersions,
-  coerceJsonArgs,
-  cliSignatureAccepted,
-  cliManifestSigningPayload,
-  cliInvocationResult,
-  cliExitCode,
-  checkCliUpdate,
-  assertCliPublishable,
-  applyCliUpdate,
-  DEFAULT_EXIT_CODES,
-  CliProfileError,
-  CliBuildTargetSchema,
-  CliBuildStampSchema,
-  CliBuildSignatureSchema,
-  CliBuildManifestSchema,
-  CliBuildAssetSchema,
-  CliArgumentError
-};