Install a licensed engine

The paid engines (AT-1DB / GenQuery, generative compression, addressable weights, condition monitoring, and the rest) ship as a compiled, license-gated at1-engines wheel — never public PyPI, never source. Two ways to get it: enable it in your dashboard, or pull a checksummed, version-pinned wheel from CI with an API key. The @tinyfiles/cli and the open Apache-2.0 decoder are unaffected — this is only the licensed engine layer.

Dashboard (interactive)

Sign in and open Dashboard → Engines. Enable the feature you're entitled to, accept the engine EULA once, and download the wheel for your platform. Grants are managed per account (a design partner is comped by us; enterprises self-serve). This is the quickest path for a workstation.

CI / headless (checksummed, pinnable)

A pipeline can't hold a browser session, so the download endpoint also accepts an API key as a bearer token. It returns a version, a signed URL per wheel, and each wheel's build-time SHA-256 (plus a stable SHA256SUMS manifest) — so a binary you run near production data arrives version-pinned and verifiable, not as an expiring link.

# 1. Create an API key once: Dashboard -> API Keys (shown once, copy it) -> export it.
export AT1_TOKEN="at1_...."

# 2. Fetch the checksummed wheel manifest for the feature you're entitled to (e.g. at1db).
curl -sS -X POST "https://tinyfiles.io/api/at1/engines/download?feature=at1db&ack=1" \
     -H "Authorization: Bearer $AT1_TOKEN" -o at1-engines.json

The response (unauthenticated calls get 401):

{
  "feature": "at1db",
  "version": "0.2.33",                      // pin this in CI
  "expires_in": 3600,                       // 1h — long enough for a CI job to fetch + verify
  "sha256sums_url": "https://.../SHA256SUMS",
  "wheels": [
    { "name": "at1_engines-0.2.33-cp313-cp313-macosx_11_0_arm64.whl",
      "url": "https://.../<signed>",
      "sha256": "1b38c9adf8f6..." },        // the audit trail: (version, sha256)
    { "name": "at1_engines-0.2.33-cp313-cp313-manylinux_2_17_x86_64...whl", "url": "...", "sha256": "3cf1cc3b..." }
    // ... one per platform/CPython
  ]
}

# 3. Pick your platform's wheel, download it, and VERIFY the sha256 before you trust the bytes.
python - <<'PY'
import json, hashlib, urllib.request, platform, sys
m = json.load(open("at1-engines.json"))
# choose the wheel that matches your interpreter/OS (this is a manylinux x86_64 example)
w = next(x for x in m["wheels"] if "manylinux" in x["name"] and "x86_64" in x["name"])
blob = urllib.request.urlopen(w["url"]).read()
got = hashlib.sha256(blob).hexdigest()
assert got == w["sha256"], f"CHECKSUM MISMATCH: {got} != {w['sha256']}"   # fail the build, do not install
open(w["name"], "wb").write(blob)
print("verified", w["name"], "sha256", got, "engine version", m["version"])
PY

# 4. Install the verified wheel into your (throwaway) venv.
pip install ./at1_engines-*.whl

Pin version in your lockfile and record the sha256 — the (version, sha256)pair is your audit trail. Signed URLs are valid ~1 hour; re-fetch per job. Linux (manylinux), Windows, and macOS (arm64 + x86_64) wheels are built for supported CPython versions. Nothing you compress or query is transmitted to obtain the wheel — the download is entitlement-gated only.