tessl 0.101.0 → 0.103.0

package/bin/tessl.js

@@ -1,146 +1,10 @@
 #!/usr/bin/env node
 
-// installer/src/main.ts
-import { existsSync as existsSync3 } from "node:fs";
-import { mkdir as mkdir3, rm as rm2 } from "node:fs/promises";
-import { basename as basename2, join as join2 } from "node:path";
-import { createInterface } from "node:readline";
-import { Readable as Readable2 } from "node:stream";
-
-// installer/src/download.ts
-async function downloadTarball(url) {
-  const response = await fetch(url);
-  if (!response.ok) {
-    throw new Error(`Failed to download binary: ${response.status} ${response.statusText}`);
-  }
-  if (!response.body) {
-    throw new Error("Response body is null");
-  }
-  return response.body;
-}
-async function downloadBytes(url, maxBytes = 512 * 1024 * 1024) {
-  const response = await fetch(url);
-  if (!response.ok) {
-    throw new Error(`Failed to download ${url}: ${response.status} ${response.statusText}`);
-  }
-  const advertised = Number(response.headers.get("content-length"));
-  if (Number.isFinite(advertised) && advertised > maxBytes) {
-    throw new Error(`Response from ${url} exceeds size limit (${advertised} > ${maxBytes} bytes)`);
-  }
-  if (!response.body) {
-    throw new Error(`Response from ${url} has no body`);
-  }
-  const chunks = [];
-  let total = 0;
-  const reader = response.body.getReader();
-  for (;; ) {
-    const chunk = await reader.read();
-    if (chunk.done)
-      break;
-    total += chunk.value.byteLength;
-    if (total > maxBytes) {
-      await reader.cancel();
-      throw new Error(`Response from ${url} exceeds size limit (> ${maxBytes} bytes)`);
-    }
-    chunks.push(chunk.value);
-  }
-  return Buffer.concat(chunks);
-}
-
-// installer/src/channels.ts
-var MAX_CHANNEL_RESPONSE_BYTES = 8 * 1024;
-var VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9.+-]{0,127}$/;
-function assertPathSafeVersion(version, source) {
-  if (!VERSION_PATTERN.test(version)) {
-    const shown = version.length > 40 ? `${JSON.stringify(version.slice(0, 40))}… (${version.length} chars)` : JSON.stringify(version);
-    const where = source ? ` from ${source}` : "";
-    throw new Error(`Refusing to install: release channel returned a malformed version${where}: ${shown}.`);
-  }
-  return version;
-}
-async function fetchLatestVersion(channel) {
-  const url = getChannelUrl(channel);
-  const bytes = await downloadBytes(url, MAX_CHANNEL_RESPONSE_BYTES);
-  const version = bytes.toString("utf8").trim();
-  if (!version) {
-    throw new Error(`Empty version returned from ${url}`);
-  }
-  return assertPathSafeVersion(version, url);
-}
-function getChannelFromVersion(version) {
-  if (version.includes("head"))
-    return "head";
-  if (version.includes("nightly"))
-    return "nightly";
-  if (version.includes("beta"))
-    return "beta";
-  return "latest";
-}
-function getBaseUrl() {
-  return process.env.TESSL_INSTALL_BASE_URL || "https://install.tessl.io";
-}
-function getChannelUrl(channel) {
-  return `${getBaseUrl()}/.well-known/tessl/${channel}.txt`;
-}
-function getManifestUrl(version) {
-  return `${getBaseUrl()}/binaries/${encodeURIComponent(version)}/SHA256SUMS`;
-}
-function getManifestSigUrl(version) {
-  return `${getBaseUrl()}/binaries/${encodeURIComponent(version)}/SHA256SUMS.sig`;
-}
-function getBinaryFileName(version, platform) {
-  return `tessl-${version}-${platform}.tar.gz`;
-}
-function getBinaryUrl(version, platform) {
-  const encodedVersion = encodeURIComponent(version);
-  return `${getBaseUrl()}/binaries/${encodedVersion}/${getBinaryFileName(encodedVersion, platform)}`;
-}
-
-// installer/src/extract.ts
-import { spawn } from "node:child_process";
-import { mkdir } from "node:fs/promises";
-import { Readable } from "node:stream";
-import { pipeline } from "node:stream/promises";
-async function extractTarball(stream, destination) {
-  await mkdir(destination, { recursive: true });
-  const tar = spawn("tar", ["-xzf", "-", "-C", destination], {
-    stdio: ["pipe", "inherit", "inherit"]
-  });
-  if (!tar.stdin) {
-    throw new Error("Failed to open tar stdin");
-  }
-  const tarExit = new Promise((resolve, reject) => {
-    tar.on("exit", (code) => {
-      if (code === 0) {
-        resolve();
-      } else {
-        reject(new Error(`tar exited with code ${code}`));
-      }
-    });
-    tar.on("error", reject);
-  });
-  await pipeline(Readable.fromWeb(stream), tar.stdin);
-  await tarExit;
-}
-
-// installer/src/keys.ts
-var RELEASE_SIGNING_PUBLIC_KEYS = [
-  {
-    id: "kms-2026-06",
-    publicKeyPem: `-----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE81DxbddrC8wywZa2W0R+dq5q7xsB
-TaNvYdQeUrdR5LGZIaYN4XziIK27qwZEl4xJIEB+sqgsx2limHUjf/OKwA==
------END PUBLIC KEY-----
-`
-  }
-];
-var RELEASE_VERIFICATION_ENABLED = true;
-
 // installer/src/path.ts
 import { existsSync } from "node:fs";
 import {
   copyFile,
-  mkdir as mkdir2,
+  mkdir,
   readdir,
   readlink,
   rename,
@@ -219,7 +83,7 @@ async function promoteStagedBinary({
   if (!validation.success) {
     throw new Error(`${validation.error}. Please try again.`);
   }
-  await mkdir2(versionsDir, { recursive: true });
+  await mkdir(versionsDir, { recursive: true });
   await rename(stagedBinPath, versionedBinPath);
 }
 async function getExistingBinaryPath(tesslBinPath) {
@@ -244,7 +108,7 @@ async function updateBinaryAtomic({
   versionedBinPath,
   tesslBinPath
 }) {
-  await mkdir2(dirname(tesslBinPath), { recursive: true });
+  await mkdir(dirname(tesslBinPath), { recursive: true });
   const tag = `${Date.now()}-${process.pid}-${nextPathSeq()}`;
   const tempPath = `${tesslBinPath}.tmp.${tag}`;
   if (process.platform === "win32") {
@@ -358,41 +222,142 @@ function getPlatformDescription() {
   return `${platformName} ${archName}`;
 }
 
-// installer/src/spawn.ts
-import { spawn as spawn2 } from "node:child_process";
-function spawnBinary(binaryPath, args) {
-  const child = spawn2(binaryPath, args, {
-    stdio: "inherit",
-    env: {
-      ...process.env,
-      TESSL_MANAGED_BY_NPM: "1"
+// installer/src/prepare.ts
+import { existsSync as existsSync3 } from "node:fs";
+import { mkdir as mkdir3, rm as rm2 } from "node:fs/promises";
+import { basename as basename2, join as join2 } from "node:path";
+import { createInterface } from "node:readline";
+import { Readable as Readable2 } from "node:stream";
+
+// installer/src/download.ts
+async function downloadTarball(url) {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`Failed to download binary: ${response.status} ${response.statusText}`);
+  }
+  if (!response.body) {
+    throw new Error("Response body is null");
+  }
+  return response.body;
+}
+async function downloadBytes(url, maxBytes = 512 * 1024 * 1024) {
+  const response = await fetch(url);
+  if (!response.ok) {
+    throw new Error(`Failed to download ${url}: ${response.status} ${response.statusText}`);
+  }
+  const advertised = Number(response.headers.get("content-length"));
+  if (Number.isFinite(advertised) && advertised > maxBytes) {
+    throw new Error(`Response from ${url} exceeds size limit (${advertised} > ${maxBytes} bytes)`);
+  }
+  if (!response.body) {
+    throw new Error(`Response from ${url} has no body`);
+  }
+  const chunks = [];
+  let total = 0;
+  const reader = response.body.getReader();
+  for (;; ) {
+    const chunk = await reader.read();
+    if (chunk.done)
+      break;
+    total += chunk.value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel();
+      throw new Error(`Response from ${url} exceeds size limit (> ${maxBytes} bytes)`);
     }
+    chunks.push(chunk.value);
+  }
+  return Buffer.concat(chunks);
+}
+
+// installer/src/channels.ts
+var MAX_CHANNEL_RESPONSE_BYTES = 8 * 1024;
+var VERSION_PATTERN = /^[A-Za-z0-9][A-Za-z0-9.+-]{0,127}$/;
+function assertPathSafeVersion(version, source) {
+  if (!VERSION_PATTERN.test(version)) {
+    const shown = version.length > 40 ? `${JSON.stringify(version.slice(0, 40))}… (${version.length} chars)` : JSON.stringify(version);
+    const where = source ? ` from ${source}` : "";
+    throw new Error(`Refusing to install: release channel returned a malformed version${where}: ${shown}.`);
+  }
+  return version;
+}
+async function fetchLatestVersion(channel) {
+  const url = getChannelUrl(channel);
+  const bytes = await downloadBytes(url, MAX_CHANNEL_RESPONSE_BYTES);
+  const version = bytes.toString("utf8").trim();
+  if (!version) {
+    throw new Error(`Empty version returned from ${url}`);
+  }
+  return assertPathSafeVersion(version, url);
+}
+function getChannelFromVersion(version) {
+  if (version.includes("head"))
+    return "head";
+  if (version.includes("nightly"))
+    return "nightly";
+  if (version.includes("beta"))
+    return "beta";
+  return "latest";
+}
+function getBaseUrl() {
+  return process.env.TESSL_INSTALL_BASE_URL || "https://install.tessl.io";
+}
+function getChannelUrl(channel) {
+  return `${getBaseUrl()}/.well-known/tessl/${channel}.txt`;
+}
+function getManifestUrl(version) {
+  return `${getBaseUrl()}/binaries/${encodeURIComponent(version)}/SHA256SUMS`;
+}
+function getManifestSigUrl(version) {
+  return `${getBaseUrl()}/binaries/${encodeURIComponent(version)}/SHA256SUMS.sig`;
+}
+function getBinaryFileName(version, platform) {
+  return `tessl-${version}-${platform}.tar.gz`;
+}
+function getBinaryUrl(version, platform) {
+  const encodedVersion = encodeURIComponent(version);
+  return `${getBaseUrl()}/binaries/${encodedVersion}/${getBinaryFileName(encodedVersion, platform)}`;
+}
+
+// installer/src/extract.ts
+import { spawn } from "node:child_process";
+import { mkdir as mkdir2 } from "node:fs/promises";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+async function extractTarball(stream, destination) {
+  await mkdir2(destination, { recursive: true });
+  const tar = spawn("tar", ["-xzf", "-", "-C", destination], {
+    stdio: ["pipe", "inherit", "inherit"]
   });
-  const signals = process.platform === "win32" ? ["SIGINT", "SIGTERM", "SIGBREAK"] : ["SIGINT", "SIGTERM", "SIGHUP"];
-  const handlers = new Map;
-  for (const signal of signals) {
-    const handler = () => {
-      child.kill(signal);
-    };
-    handlers.set(signal, handler);
-    process.on(signal, handler);
+  if (!tar.stdin) {
+    throw new Error("Failed to open tar stdin");
   }
-  child.on("exit", (code, signal) => {
-    if (signal) {
-      for (const [sig, handler] of handlers) {
-        process.removeListener(sig, handler);
+  const tarExit = new Promise((resolve2, reject) => {
+    tar.on("exit", (code) => {
+      if (code === 0) {
+        resolve2();
+      } else {
+        reject(new Error(`tar exited with code ${code}`));
       }
-      process.kill(process.pid, signal);
-    } else {
-      process.exit(code ?? 1);
-    }
-  });
-  child.on("error", (err) => {
-    console.error(`Failed to spawn binary: ${err.message}`);
-    process.exit(1);
+    });
+    tar.on("error", reject);
   });
+  await pipeline(Readable.fromWeb(stream), tar.stdin);
+  await tarExit;
 }
 
+// installer/src/keys.ts
+var RELEASE_SIGNING_PUBLIC_KEYS = [
+  {
+    id: "kms-2026-06",
+    publicKeyPem: `-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE81DxbddrC8wywZa2W0R+dq5q7xsB
+TaNvYdQeUrdR5LGZIaYN4XziIK27qwZEl4xJIEB+sqgsx2limHUjf/OKwA==
+-----END PUBLIC KEY-----
+`
+  }
+];
+var RELEASE_VERIFICATION_ENABLED = true;
+
 // installer/src/verify.ts
 import { createHash, verify } from "node:crypto";
 function parseManifest(manifest) {
@@ -430,7 +395,7 @@ function sha256Hex(data) {
   return createHash("sha256").update(data).digest("hex");
 }
 
-// installer/src/main.ts
+// installer/src/prepare.ts
 function isInteractive() {
   return process.stdin.isTTY === true && process.stdout.isTTY === true;
 }
@@ -438,7 +403,8 @@ async function downloadVerifyAndExtract({
   version,
   platform,
   tarballUrl,
-  destination
+  destination,
+  trustedKeys
 }) {
   const fileName = getBinaryFileName(version, platform);
   const [tarballBytes, manifestBytes, manifestSig] = await Promise.all([
@@ -446,7 +412,7 @@ async function downloadVerifyAndExtract({
     downloadBytes(getManifestUrl(version), 2 * 1024 * 1024),
     downloadBytes(getManifestSigUrl(version), 64 * 1024)
   ]);
-  if (!verifyManifestSignatureWithKeys(manifestBytes, manifestSig, RELEASE_SIGNING_PUBLIC_KEYS)) {
+  if (!verifyManifestSignatureWithKeys(manifestBytes, manifestSig, trustedKeys)) {
     throw new Error("SHA256SUMS signature verification failed — refusing to install. " + "The download may be corrupt or tampered with.");
   }
   const expected = expectedHashFor(manifestBytes.toString("utf8"), fileName);
@@ -470,44 +436,27 @@ async function promptConfirmation(message) {
     });
   });
 }
-function printUnsupportedPlatformMessage() {
-  console.error("Error: Unsupported platform", getPlatformDescription());
-  console.error(`Tessl CLI binaries are available for:
-    - macOS (ARM64, x64)
-    - Linux (x64, ARM64)
-    - Windows (x64, ARM64)
-  `);
-}
-async function prepareBinary() {
-  const tesslBinPath = getTesslBinPath();
-  const existingBinary = await getExistingBinaryPath(tesslBinPath);
-  const installerVersion = "0.101.0";
-  const isTestOrDevBuild = installerVersion.includes("test") || installerVersion.includes("dev");
-  let versionMismatch = false;
-  if (isTestOrDevBuild && existingBinary) {
-    const platform2 = getPlatformString();
-    if (!platform2) {
-      printUnsupportedPlatformMessage();
-      return process.exit(1);
-    }
-    if (existingBinary !== getVersionedBinPath(installerVersion, platform2)) {
-      console.log(`Test/dev build - switching to version: ${installerVersion}`);
-      versionMismatch = true;
+async function describeInstallFailure(version, cause) {
+  const reason = cause instanceof Error ? cause.message : String(cause);
+  let available = "";
+  try {
+    const latest = await Promise.race([
+      fetchLatestVersion(getChannelFromVersion(version)),
+      new Promise((_, reject) => setTimeout(() => reject(new Error("timeout")), 5000).unref())
+    ]);
+    if (latest !== version) {
+      available = ` The latest available version is ${latest}.`;
     }
-  }
-  if (existingBinary && !versionMismatch) {
-    return tesslBinPath;
-  }
-  const platform = getPlatformString();
-  if (!platform) {
-    printUnsupportedPlatformMessage();
-    return process.exit(1);
-  }
-  const version = isTestOrDevBuild ? installerVersion : await fetchLatestVersion(getChannelFromVersion(installerVersion));
-  const versionedBinPath = getVersionedBinPath(version, platform);
-  if (existsSync3(versionedBinPath)) {
-    return versionedBinPath;
-  }
+  } catch {}
+  return new Error(`Failed to install Tessl CLI version ${version}: ${reason}.${available}`);
+}
+async function downloadRequestedVersion({
+  version,
+  platform,
+  versionedBinPath,
+  trustedKeys,
+  verificationEnabled
+}) {
   console.log(`Downloading ${version} for ${platform}`);
   const url = getBinaryUrl(version, platform);
   const versionsDir = getVersionsDirectory();
@@ -516,23 +465,49 @@ async function prepareBinary() {
   const progressInterval = setInterval(() => process.stdout.write("."), 500).unref();
   try {
     await mkdir3(stagingDir, { recursive: true });
-    if (RELEASE_VERIFICATION_ENABLED) {
+    if (verificationEnabled) {
       await downloadVerifyAndExtract({
         version,
         platform,
         tarballUrl: url,
-        destination: stagingDir
+        destination: stagingDir,
+        trustedKeys
       });
     } else {
       const tarballStream = await downloadTarball(url);
       await extractTarball(tarballStream, stagingDir);
     }
     await promoteStagedBinary({ stagedBinPath, versionedBinPath, versionsDir });
+  } catch (err) {
+    throw await describeInstallFailure(version, err);
   } finally {
     clearInterval(progressInterval);
     console.log("");
     await rm2(stagingDir, { recursive: true, force: true }).catch(() => {});
   }
+}
+async function prepareBinary({
+  installerVersion,
+  platform,
+  tesslBinPath,
+  trustedKeys = RELEASE_SIGNING_PUBLIC_KEYS,
+  verificationEnabled = RELEASE_VERIFICATION_ENABLED
+}) {
+  const version = installerVersion;
+  const versionedBinPath = getVersionedBinPath(version, platform);
+  const existingBinary = await getExistingBinaryPath(tesslBinPath);
+  if (existingBinary !== null) {
+    return tesslBinPath;
+  }
+  if (!existsSync3(versionedBinPath)) {
+    await downloadRequestedVersion({
+      version,
+      platform,
+      versionedBinPath,
+      trustedKeys,
+      verificationEnabled
+    });
+  }
   const shouldInstall = !isInteractive() || await promptConfirmation(`Install Tessl CLI to ${tesslBinPath}?`);
   if (shouldInstall) {
     await updateBinaryAtomic({ versionedBinPath, tesslBinPath });
@@ -546,8 +521,63 @@ On Alpine: apk add libgcc libstdc++
   }
   return versionedBinPath;
 }
+
+// installer/src/spawn.ts
+import { spawn as spawn2 } from "node:child_process";
+function spawnBinary(binaryPath, args) {
+  const child = spawn2(binaryPath, args, {
+    stdio: "inherit",
+    env: {
+      ...process.env,
+      TESSL_MANAGED_BY_NPM: "1"
+    }
+  });
+  const signals = process.platform === "win32" ? ["SIGINT", "SIGTERM", "SIGBREAK"] : ["SIGINT", "SIGTERM", "SIGHUP"];
+  const handlers = new Map;
+  for (const signal of signals) {
+    const handler = () => {
+      child.kill(signal);
+    };
+    handlers.set(signal, handler);
+    process.on(signal, handler);
+  }
+  child.on("exit", (code, signal) => {
+    if (signal) {
+      for (const [sig, handler] of handlers) {
+        process.removeListener(sig, handler);
+      }
+      process.kill(process.pid, signal);
+    } else {
+      process.exit(code ?? 1);
+    }
+  });
+  child.on("error", (err) => {
+    console.error(`Failed to spawn binary: ${err.message}`);
+    process.exit(1);
+  });
+}
+
+// installer/src/main.ts
+function printUnsupportedPlatformMessage() {
+  console.error("Error: Unsupported platform", getPlatformDescription());
+  console.error(`Tessl CLI binaries are available for:
+    - macOS (ARM64, x64)
+    - Linux (x64, ARM64)
+    - Windows (x64, ARM64)
+  `);
+}
 async function main() {
-  const path = await prepareBinary();
+  const platform = getPlatformString();
+  if (!platform) {
+    printUnsupportedPlatformMessage();
+    process.exit(1);
+  }
+  const installerVersion = "0.103.0";
+  const path = await prepareBinary({
+    installerVersion,
+    platform,
+    tesslBinPath: getTesslBinPath()
+  });
   spawnBinary(path, process.argv.slice(2));
 }
 main().catch((err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tessl",
-  "version": "0.101.0",
+  "version": "0.103.0",
   "description": "Tessl CLI",
   "author": "Tessl",
   "license": "SEE LICENSE.md",