wyvrnpm 2.12.3 → 2.13.12

package/src/download.js

@@ -13,6 +13,9 @@ const { evaluateCompat, pickBestCandidate, summarizeReasons } = require('./compa
 const { buildFromSource }       = require('./build');
 const { uploadSourceBuiltArtefact } = require('./upload-built');
 const { assertAllSafeZipEntryNames } = require('./zip-safe');
+const { sha256OfCanonical }     = require('./signing/canonical');
+const { verifyAttestation, parseSigEnvelope } = require('./signing');
+const { assertBoundHashes }     = require('./signing/attestation');
 const log                       = require('./logger');
 
 // ---------------------------------------------------------------------------
@@ -104,6 +107,117 @@ async function tryDownloadFromSources(name, version, packageSources, platform, h
  * @param {string[]} packageSources
  * @param {object}   authOptions   { awsProfile?, token? }
  */
+/**
+ * Run S1 signature verification on a successfully-downloaded v2 artefact.
+ *
+ * Honours per-registry `mode.json`:
+ *   - `off`     → skip entirely (returns null).
+ *   - `warn`    → att+sig present and valid, log identity; missing → warn + null;
+ *                 invalid → throw (bad sig is stricter than missing).
+ *   - `require` → att+sig must be present AND valid; otherwise throw.
+ *
+ * `requireSignatures` (from CLI `--require-signatures`) escalates whatever
+ * the registry says to `require` for this run.
+ *
+ * Throws on any failure that should block the install. Returns
+ * `{ keyId, identityHint, alg }` on a successful verify, `null` when mode
+ * is off or warn-and-missing.
+ *
+ * @param {object} args
+ * @param {string} args.source        registry source URL the zip came from
+ * @param {string} args.name
+ * @param {string} args.version
+ * @param {string} args.profileHash
+ * @param {string} [args.contentSha256] SHA256 of the local zip — fat-zip bound check (v1)
+ * @param {Object<string, string>} [args.sliceShaMap]
+ *   `{ config → sha256 }` of locally-computed per-slice hashes — slice
+ *   bound check (v2). Pass exactly one of `contentSha256` or `sliceShaMap`.
+ * @param {object} [args.authOptions] { awsProfile?, token? }
+ * @param {boolean} [args.requireSignatures]
+ * @returns {Promise<{keyId: string, identityHint: string|null, alg: string}|null>}
+ */
+async function verifyDownloadIfRequired({
+  source, name, version, profileHash, contentSha256, sliceShaMap,
+  authOptions = {}, requireSignatures = false,
+}) {
+  let provider;
+  try { provider = getProvider(source); }
+  catch { return null; }
+
+  const trust = await provider.v2GetTrustAnchor({ source, ...authOptions });
+  let mode = trust?.mode?.mode ?? 'off';
+  if (requireSignatures) mode = 'require';
+  if (mode === 'off') return null;
+
+  const [attBytes, sigBytes] = await Promise.all([
+    provider.v2GetAttestation({ source, name, version, profileHash, ...authOptions }),
+    provider.v2GetSignature  ({ source, name, version, profileHash, ...authOptions }),
+  ]);
+
+  if (!attBytes || !sigBytes) {
+    if (mode === 'require') {
+      throw new Error(`registry mode=require but signature files missing on ${source}`);
+    }
+    log.warn(`unsigned artefact (mode=warn): ${name}@${version} [${profileHash}]`);
+    return null;
+  }
+  if (!trust?.keys) {
+    throw new Error(`registry has signature files but no .trust/keys.json — mode=${mode}`);
+  }
+
+  // Re-fetch the manifest as the bytes the publisher canonicalised.
+  // Providers no longer mutate the manifest, so the v2GetMeta result is
+  // exactly what was uploaded → the same canonical SHA the attestation
+  // signed over.
+  const meta = await provider.v2GetMeta({ source, name, version, profileHash, ...authOptions });
+  if (!meta) throw new Error(`manifest not available for verification: ${name}@${version}`);
+  const manifestSha256 = sha256OfCanonical(meta);
+
+  const sigEnvelope = parseSigEnvelope(sigBytes.toString('utf8'));
+  let result;
+  if (sliceShaMap && Object.keys(sliceShaMap).length > 0) {
+    // v2 / slice path: cryptographic verify happens against the parsed
+    // canonical bytes once. The bound-hash check runs once per downloaded
+    // slice — the canonical body covers every slice's hash, so a tampered
+    // or omitted slice changes the signed bytes and the sig fails before
+    // we even reach assertBoundHashes.
+    const sliceConfigs = Object.keys(sliceShaMap);
+    const firstConfig  = sliceConfigs[0];
+    result = verifyAttestation({
+      attBytes,
+      sigEnvelope,
+      trustAnchors: trust.keys,
+      expected: {
+        name, version, profileHash, manifestSha256,
+        sliceConfig: firstConfig,
+        sliceSha256: sliceShaMap[firstConfig],
+      },
+    });
+    for (const config of sliceConfigs.slice(1)) {
+      // Cheap shape + value check against the already-verified attestation.
+      assertBoundHashes(result.attestation, {
+        manifestSha256,
+        sliceConfig: config,
+        sliceSha256: sliceShaMap[config],
+      });
+    }
+  } else {
+    // v1 / fat-zip path (today).
+    result = verifyAttestation({
+      attBytes,
+      sigEnvelope,
+      trustAnchors: trust.keys,
+      expected: { name, version, profileHash, contentSha256, manifestSha256 },
+    });
+  }
+  log.info(
+    `signed by ${result.keyId}` +
+    (result.identityHint ? ` (${result.identityHint})` : '') +
+    ` [${result.kind}]`,
+  );
+  return { keyId: result.keyId, identityHint: result.identityHint, alg: result.kind };
+}
+
 async function findV2Index(dep, packageSources, authOptions = {}) {
   const { name, version } = dep;
   const { awsProfile, token } = authOptions;
@@ -126,9 +240,106 @@ async function findV2Index(dep, packageSources, authOptions = {}) {
   return { found: false, indexFoundInSource: null, versionsIndex: null, availableProfiles: [] };
 }
 
+/**
+ * Per-config slice download. Called by tryV2Exact when the exact-match
+ * manifest carries an `artefactConfigs` block. Resolves the consumer's
+ * requested configs against the publisher's available configs, downloads
+ * each slice into a per-package staging path, and SHA-verifies on the fly.
+ *
+ * Empty intersection → fail-fast (CLAUDE.md §2.8 silent fallback is a
+ * bug). Partial intersection → warn about missing slices, proceed with
+ * what's available.
+ *
+ * `requestConfigs === null` is the "no consumer override" signal — fetch
+ * every slice the publisher published. Equivalent to today's behaviour
+ * for fat-zip publishes (consumer pulls everything).
+ *
+ * @param {object} args
+ * @returns {Promise<{
+ *   ok:      boolean,
+ *   reason?: string,
+ *   slices?: Array<{ config: string, zipPath: string, sha256: string }>,
+ * }>}
+ */
+async function downloadV2Slices({
+  provider, source, name, version, profileHash,
+  exactMeta, requestConfigs, destDir, timeoutMs, authOptions = {},
+}) {
+  const available = Object.keys(exactMeta.artefactConfigs || {});
+  if (available.length === 0) {
+    return { ok: false, reason: 'manifest declared artefactConfigs but the map was empty' };
+  }
+  // Default: when consumer didn't override, fetch every config the
+  // publisher has — equivalent to today's "download everything" behaviour
+  // for pre-feature consumers.
+  const requested = (Array.isArray(requestConfigs) && requestConfigs.length > 0)
+    ? requestConfigs
+    : available;
+  const downloadConfigs = requested.filter((c) => available.includes(c));
+  if (downloadConfigs.length === 0) {
+    return {
+      ok:     false,
+      reason:
+        `none of the requested configs [${requested.join(', ')}] are published — ` +
+        `available: [${available.join(', ')}]`,
+    };
+  }
+  if (downloadConfigs.length < requested.length) {
+    const missing = requested.filter((c) => !available.includes(c));
+    log.warn(
+      `requested config(s) [${missing.join(', ')}] not published for ${name}@${version} — ` +
+      `skipping; available: [${available.join(', ')}]`,
+    );
+  }
+
+  const { awsProfile, token } = authOptions;
+  const slices = [];
+  for (const config of downloadConfigs.slice().sort()) {
+    const slicePath = path.join(destDir, `${name}-${config}.zip`);
+    const ok = await provider.v2DownloadZip(
+      { source, name, version, profileHash, sliceConfig: config, awsProfile, token },
+      slicePath,
+      timeoutMs,
+    );
+    if (!ok) {
+      return { ok: false, reason: `failed to download slice "${config}" from ${source}` };
+    }
+    const localSha    = sha256Of(slicePath);
+    const expectedSha = exactMeta.artefactConfigs[config]?.sha256;
+    if (typeof expectedSha !== 'string' || localSha !== expectedSha) {
+      return {
+        ok:     false,
+        reason:
+          `SHA256 mismatch on slice "${config}":\n` +
+          `  expected: ${expectedSha}\n` +
+          `  actual:   ${localSha}`,
+      };
+    }
+    slices.push({ config, zipPath: slicePath, sha256: localSha });
+    log.info(`  ${config.padEnd(15)} ${formatSizeShort(slicePath).padStart(10)}  sha=${localSha.slice(0, 16)}...`);
+  }
+  return { ok: true, slices };
+}
+
+/**
+ * Best-effort byte-size formatter for slice download log lines. Returns
+ * a short rendering ("3.7 MB") or a fallback when stat fails.
+ */
+function formatSizeShort(filePath) {
+  try {
+    const n = fs.statSync(filePath).size;
+    if (n < 1024)             return `${n} B`;
+    if (n < 1024 * 1024)      return `${(n / 1024).toFixed(1)} KB`;
+    if (n < 1024 * 1024 * 1024) return `${(n / 1024 / 1024).toFixed(2)} MB`;
+    return `${(n / 1024 / 1024 / 1024).toFixed(2)} GB`;
+  } catch {
+    return '?';
+  }
+}
+
 async function tryV2Exact(dep, packageSources, destZipPath, timeoutMs, authOptions = {}) {
   const { name, version, profileHash } = dep;
-  const { awsProfile, token } = authOptions;
+  const { awsProfile, token, requestConfigs } = authOptions;
 
   let indexFoundInSource = null;
   let versionsIndex      = null;
@@ -143,11 +354,50 @@ async function tryV2Exact(dep, packageSources, destZipPath, timeoutMs, authOptio
     log.info(`Trying v2: ${metaUrl}`);
     const exactMeta = await provider.v2GetMeta({ source, name, version, profileHash, awsProfile, token });
     if (exactMeta) {
+      // ── Per-config slice publish ───────────────────────────────────────
+      if (exactMeta.artefactConfigs && Object.keys(exactMeta.artefactConfigs).length > 0) {
+        log.info(`  per-config publish: configs=${Object.keys(exactMeta.artefactConfigs).join(', ')}`);
+        const sliceResult = await downloadV2Slices({
+          provider, source, name, version, profileHash,
+          exactMeta, requestConfigs,
+          destDir:     path.dirname(destZipPath),
+          timeoutMs,
+          authOptions: { awsProfile, token },
+        });
+        if (sliceResult.ok) {
+          return {
+            found: true,
+            result: {
+              kind:            'slice',
+              slices:          sliceResult.slices,
+              configs:         sliceResult.slices.map((s) => s.config).sort(),
+              perConfigSha256: Object.fromEntries(sliceResult.slices.map((s) => [s.config, s.sha256])),
+              gitSha:          exactMeta.gitSha   ?? null,
+              gitRepo:         exactMeta.gitRepo  ?? null,
+              profileHash,
+              source,
+            },
+            indexFoundInSource: source,
+            availableProfiles:  [],
+          };
+        }
+        // Slice download failed — bubble the reason for caller diagnostics.
+        log.error(`per-config download failed for ${name}@${version}: ${sliceResult.reason}`);
+        return {
+          found: false,
+          sliceFailureReason: sliceResult.reason,
+          indexFoundInSource: source,
+          availableProfiles:  [],
+          versionsIndex:      null,
+        };
+      }
+      // ── Fat-zip path (today) ───────────────────────────────────────────
       const ok = await provider.v2DownloadZip({ source, name, version, profileHash, awsProfile, token }, destZipPath, timeoutMs);
       if (ok) {
         return {
           found:              true,
           result: {
+            kind:          'fat-zip',
             contentSha256: exactMeta.contentSha256 ?? null,
             gitSha:        exactMeta.gitSha        ?? null,
             gitRepo:       exactMeta.gitRepo       ?? null,
@@ -345,6 +595,24 @@ async function downloadDependencies(deps, packageSources, platform, razerDir, ht
     // so the caller can print a single aggregated summary at the end of an
     // install (see src/commands/install.js). Mutated in place.
     uploadStats,
+    // S1: when true, every download must verify against the registry's
+    // trust anchor regardless of what `mode.json` says. Set by
+    // `wyvrnpm install --require-signatures`.
+    requireSignatures = false,
+    // S1 upload-built: when set, the consumer-rebuilt artefact is signed
+    // with this context before upload. Resolved once at the install entry
+    // point (src/commands/install.js) from the consumer's defaultSigning
+    // / per-source signing config.
+    uploadSigningContext = null,
+    // Per-config slice selection (PLAN-PER-CONFIG). null means "no
+    // override; fetch every slice the publisher published" — equivalent
+    // to today's behaviour for fat-zip publishes.
+    requestConfigs = null,
+    // Per-dep override of `requestConfigs`. Map of `{ depName: [...] }`.
+    // When a dep is named in this map, those configs apply to it
+    // exclusively; otherwise the global `requestConfigs` takes over.
+    // Resolved by install.js from wyvrn.local.json: depRequestConfigs.
+    depRequestConfigs = null,
   } = options;
 
   if (!fs.existsSync(razerDir)) {
@@ -367,6 +635,16 @@ async function downloadDependencies(deps, packageSources, platform, razerDir, ht
     // configured sources.
     const depSources = pinnedSource ? [pinnedSource.url] : packageSources;
 
+    // Per-dep override of the global slice selection. Resolved once
+    // here so the cache check, slice download, and post-extract meta
+    // write all see the same effective config list. The override comes
+    // from wyvrn.local.json:depRequestConfigs[<name>] when set,
+    // otherwise the dep inherits the global `requestConfigs`.
+    const depEffectiveRequestConfigs =
+      (depRequestConfigs && Object.prototype.hasOwnProperty.call(depRequestConfigs, name))
+        ? depRequestConfigs[name]
+        : requestConfigs;
+
     const extractDir  = path.join(razerDir, name);
     const versionFile = path.join(extractDir, '.wyvrn-version');
     const metaFile    = path.join(extractDir, '.wyvrn-meta.json');
@@ -396,12 +674,36 @@ async function downloadDependencies(deps, packageSources, platform, razerDir, ht
         const sameVersion = installedVersion === version;
         const sameProfile = !profileHash || installedMeta?.profileHash === profileHash;
 
-        if (sameVersion && sameProfile) {
+        // Slice publishes additionally key the cache on the consumer's
+        // configs request — going from [Release] to [Release, Debug] must
+        // re-fetch even when version + profileHash match, otherwise the
+        // Debug binaries are missing and find_package(Debug) fails.
+        const sameConfigs = (() => {
+          // Pre-feature dep (no `configs` in installedMeta) → version + profileHash is enough.
+          if (!installedMeta?.configs) return true;
+          // Slice dep: compare requestConfigs (or "everything" if null) vs installed.
+          // Uses the per-dep effective list so a `depRequestConfigs.grpc`
+          // override correctly invalidates the cache when the consumer
+          // adds or removes configs from grpc's slice selection.
+          if (!depEffectiveRequestConfigs) return true;
+          const requestedSet = new Set(depEffectiveRequestConfigs);
+          const installedSet = new Set(installedMeta.configs);
+          if (requestedSet.size !== installedSet.size) return false;
+          for (const c of requestedSet) if (!installedSet.has(c)) return false;
+          return true;
+        })();
+
+        if (sameVersion && sameProfile && sameConfigs) {
           log.info(`Already present: ${name}@${version}${profileHash ? ` [${installedMeta?.profileHash}]` : ''} — skipping`);
           lockEntries.set(name, {
             version,
             profileHash:   installedMeta?.profileHash   ?? null,
-            contentSha256: installedMeta?.contentSha256 ?? null,
+            ...(installedMeta?.configs
+              ? {
+                  configs:         installedMeta.configs,
+                  perConfigSha256: installedMeta.perConfigSha256 ?? {},
+                }
+              : { contentSha256: installedMeta?.contentSha256 ?? null }),
             gitSha:        installedMeta?.gitSha        ?? null,
             resolvedFrom:  installedMeta?.resolvedFrom  ?? 'cached',
             ...(options      ? { options }                   : {}),
@@ -411,8 +713,10 @@ async function downloadDependencies(deps, packageSources, platform, razerDir, ht
         }
         if (!sameVersion) {
           log.info(`Version changed: ${name} ${installedVersion} → ${version}, re-downloading`);
-        } else {
+        } else if (!sameProfile) {
           log.info(`Profile changed for ${name}@${version}, re-downloading`);
+        } else {
+          log.info(`Requested configs changed for ${name}@${version} — re-downloading`);
         }
         fs.rmSync(extractDir, { recursive: true, force: true });
       }
@@ -441,12 +745,26 @@ async function downloadDependencies(deps, packageSources, platform, razerDir, ht
             depSources,
             destZipPath,
             timeoutMs,
-            { awsProfile, token },
+            { awsProfile, token, requestConfigs: depEffectiveRequestConfigs },
           );
 
       if (v2.found) {
         downloadResult = v2.result;
-        resolvedFrom   = 'v2';
+        resolvedFrom   = (v2.result?.kind === 'slice') ? 'v2-slice' : 'v2';
+      } else if (v2.sliceFailureReason) {
+        // We DID find an exact match for this profileHash, but the per-config
+        // slice download failed — empty consumer-publisher intersection,
+        // SHA mismatch, network error. Fail-fast: don't fall back to compat
+        // / source-build / v1, which would silently substitute a different
+        // build (CLAUDE.md §2.8 — silent fallback is a bug).
+        log.error(`per-config slice failed for ${name}@${version}: ${v2.sliceFailureReason}`);
+        lockEntries.set(name, {
+          version,
+          profileHash,
+          resolvedFrom: 'slice-failed',
+          sliceFailureReason: v2.sliceFailureReason,
+        });
+        continue;
       } else if (v2.indexFoundInSource) {
         // v2 knows this package but no exact profile match (or --build=always
         // forced the path here). Do NOT fall back to v1 — that would silently
@@ -559,8 +877,14 @@ async function downloadDependencies(deps, packageSources, platform, razerDir, ht
       }
     }
 
-    // ── SHA256 integrity check (v2 only) ────────────────────────────────────
-    if (downloadResult?.contentSha256) {
+    // Slice publishes are recognised by `kind: 'slice'` on the download
+    // result. SHA-verify already happened in downloadV2Slices (per slice,
+    // before this point); the rest of the pipeline just needs to know
+    // whether we have one zip or N to extract.
+    const sliceMode = downloadResult?.kind === 'slice';
+
+    // ── SHA256 integrity check (fat-zip only; slice already verified) ──────
+    if (!sliceMode && downloadResult?.contentSha256) {
       const actual = sha256Of(destZipPath);
       if (actual !== downloadResult.contentSha256) {
         log.error(
@@ -575,10 +899,55 @@ async function downloadDependencies(deps, packageSources, platform, razerDir, ht
       log.info(`SHA256 verified: ${actual.slice(0, 16)}...`);
     }
 
+    // ── S1 signature verification ──────────────────────────────────────────
+    // Only meaningful for v2 downloads with a known source (skip cached,
+    // link, and v1-fallback paths). Aborts on bad sig under any non-off
+    // mode; warn-mode missing falls through with a logged warning. Slice
+    // mode passes the per-config sha map; fat-zip mode passes contentSha256.
+    let signerInfo = null;
+    const haveBoundHashes = sliceMode
+      ? Boolean(downloadResult?.perConfigSha256 && Object.keys(downloadResult.perConfigSha256).length > 0)
+      : Boolean(downloadResult?.contentSha256);
+    if (downloadResult?.source && downloadResult?.profileHash && haveBoundHashes) {
+      try {
+        signerInfo = await verifyDownloadIfRequired({
+          source:        downloadResult.source,
+          name, version,
+          profileHash:   downloadResult.profileHash,
+          ...(sliceMode
+            ? { sliceShaMap: downloadResult.perConfigSha256 }
+            : { contentSha256: downloadResult.contentSha256 }),
+          authOptions:   { awsProfile, token },
+          requireSignatures,
+        });
+      } catch (err) {
+        log.error(`signature verification failed for ${name}@${version}: ${err.message}`);
+        if (sliceMode) {
+          for (const slice of downloadResult.slices ?? []) {
+            try { fs.unlinkSync(slice.zipPath); } catch { /* ignore */ }
+          }
+        } else {
+          try { fs.unlinkSync(destZipPath); } catch { /* ignore */ }
+        }
+        lockEntries.set(name, { version, profileHash: downloadResult.profileHash, resolvedFrom: 'sig-verify-failed' });
+        continue;
+      }
+    }
+
     // ── Extract ─────────────────────────────────────────────────────────────
     try {
       fs.mkdirSync(extractDir, { recursive: true });
-      await extractZip(destZipPath, extractDir);
+      if (sliceMode) {
+        // Multiple slices into one tree — shared files re-extract identically
+        // (multi-config-merge invariant locked in by the slice byte-identity
+        // audit on the publish side). Per-config files land in their distinct
+        // lib/<Config>/ etc. paths, no overwrites.
+        for (const slice of downloadResult.slices) {
+          await extractZip(slice.zipPath, extractDir);
+        }
+      } else {
+        await extractZip(destZipPath, extractDir);
+      }
 
       // Write .wyvrn-version (v1 compat)
       fs.writeFileSync(versionFile, version, 'utf8');
@@ -588,16 +957,25 @@ async function downloadDependencies(deps, packageSources, platform, razerDir, ht
         version,
         resolvedFrom,
         profileHash:   downloadResult?.profileHash   ?? null,
-        contentSha256: downloadResult?.contentSha256 ?? null,
+        ...(sliceMode
+          ? {
+              configs:         downloadResult.configs,
+              perConfigSha256: downloadResult.perConfigSha256,
+            }
+          : { contentSha256: downloadResult?.contentSha256 ?? null }),
         gitSha:        downloadResult?.gitSha        ?? null,
         gitRepo:       downloadResult?.gitRepo       ?? null,
         installedAt:   new Date().toISOString(),
+        // S1: signer identity per dep when verification succeeded
+        // (null otherwise — surfaces in `wyvrnpm show` and audit tools).
+        signer: signerInfo,
       };
       fs.writeFileSync(metaFile, JSON.stringify(meta, null, 2) + '\n', 'utf8');
 
       log.info(
         `Extracted: ${name}@${version}` +
         (downloadResult?.profileHash ? ` [${downloadResult.profileHash}]` : '') +
+        (sliceMode ? ` configs=[${downloadResult.configs.join(', ')}]` : '') +
         ` (${resolvedFrom}) → ${extractDir}`,
       );
 
@@ -612,7 +990,12 @@ async function downloadDependencies(deps, packageSources, platform, razerDir, ht
         version,
         resolvedFrom,
         profileHash:   downloadResult?.profileHash   ?? null,
-        contentSha256: downloadResult?.contentSha256 ?? null,
+        ...(sliceMode
+          ? {
+              configs:         downloadResult.configs,
+              perConfigSha256: downloadResult.perConfigSha256,
+            }
+          : { contentSha256: downloadResult?.contentSha256 ?? null }),
         gitSha:        downloadResult?.gitSha        ?? null,
         ...(options      ? { options }                        : {}),
         // S4: record the pinned source name on the lock entry so a
@@ -639,6 +1022,12 @@ async function downloadDependencies(deps, packageSources, platform, razerDir, ht
             options,
             uploadSource,
             uploadAuth:         uploadAuth ?? { awsProfile, token },
+            // S1 — sign the consumer-rebuilt artefact identically to an
+            // author publish. Resolved once at install entry and threaded
+            // down here. When null, the upload is unsigned and the
+            // destination registry's mode.json governs whether downstream
+            // consumers warn or abort.
+            signingContext:     uploadSigningContext,
           });
           if (uploadStats) {
             const bucket = outcome.uploaded
@@ -657,6 +1046,14 @@ async function downloadDependencies(deps, packageSources, platform, razerDir, ht
       log.warn(`Failed to extract ${name}@${version}: ${err.message}`);
       lockEntries.set(name, { version, resolvedFrom: 'extract-failed' });
     } finally {
+      // Clean up downloaded zip(s). Slice mode tracks N paths; fat-zip is
+      // the single destZipPath. Both ignore unlink errors — the file may
+      // not exist if an earlier step bailed.
+      if (downloadResult?.kind === 'slice') {
+        for (const slice of downloadResult.slices ?? []) {
+          try { fs.unlinkSync(slice.zipPath); } catch { /* ignore */ }
+        }
+      }
       try { fs.unlinkSync(destZipPath); } catch { /* ignore */ }
     }
   }