@aztec-labs/sqlite3mc-wasm 6.0.0-nightly.20260829

package/README.md

@@ -0,0 +1,112 @@
+# @aztec-labs/sqlite3mc-wasm
+
+SQLite3 Multiple Ciphers v2.3.5 (based on SQLite 3.53.2) packaged as a WASM
+module.
+
+Upstream: https://github.com/utelle/SQLite3MultipleCiphers
+
+Cipher schemes enabled: ChaCha20 (PRAGMA cipher = chacha20), SQLCipher v4,
+AES-256, and others. See sqlite3mc upstream docs.
+
+Usage: import sqlite3InitModule from @aztec-labs/sqlite3mc-wasm. API is identical
+to @sqlite.org/sqlite-wasm; sqlite3mc is a strict superset.
+
+License: sqlite3mc is MIT-licensed.
+
+## How vendoring works
+
+Upstream WASM/JS artifacts under `vendor/jswasm/` are fetched at build time. The committed state of the directory is:
+
+| File                              | Why                                                                                                                                    |
+|-----------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
+| `.gitignore`                      | Allowlist that keeps the rest of `vendor/jswasm/` out of git                                                                           |
+| `SHA256SUMS`                      | Per-file integrity manifest. Pinned at vendoring time; verified at every build                                                         |
+| `sqlite3.d.mts`                   | Locally-authored TypeScript declaration companion for the upstream `sqlite3.mjs`. Required by TS NodeNext module resolution.           |
+
+Everything else in `vendor/jswasm/` (the actual `.wasm`, `.mjs`, `.js`) is populated by `scripts/vendor.sh`, which is
+invoked from `yarn-project/bootstrap.sh` before any package compiles. It downloads the upstream release zip, verifies
+its SHA256 against the pinned value, extracts the WASM/JS files, and regenerates `SHA256SUMS`. On CI cache hits the
+files come back via the build cache without re-fetching from upstream.
+
+The pinned upstream version lives in `scripts/vendor.pin`:
+
+```sh
+MC_VERSION=2.3.5
+SQLITE_VERSION=3.53.2
+SHA256=3d0d5ebe4c54a9a22012410726ecef711e4e3e15ec11dffddf09488c72a10670
+```
+
+## Verification (full chain)
+
+Run from this package's root, after `scripts/vendor.sh ensure` has populated `vendor/jswasm/`.
+
+### Step 1: zip matches the pinned SHA
+
+The build script verifies this automatically. To check by hand:
+
+```bash
+source scripts/vendor.pin
+curl -sL "https://github.com/utelle/SQLite3MultipleCiphers/releases/download/v${MC_VERSION}/sqlite3mc-${MC_VERSION}-sqlite-${SQLITE_VERSION}-wasm.zip" \
+  | sha256sum
+# Expected: matches $SHA256 from scripts/vendor.pin
+```
+
+If this fails: upstream re-released the asset, or the artifact was tampered with in transit. Investigate before
+trusting any subsequent check.
+
+### Step 2: vendored files match the manifest
+
+```bash
+cd vendor/jswasm && sha256sum -c SHA256SUMS
+```
+
+Expected output: every file reports `OK`.
+
+If any file reports `FAILED`: the file's bytes differ from what was recorded at vendoring time. Either the file was
+modified post-fetch (via pre-commit hooks, accidental edits, etc.), or `SHA256SUMS` itself was tampered with. Both
+cases need investigation, the build should not be trusted.
+
+### Step 3 (optional, stronger): independently re-derive SHA256SUMS from the zip
+
+A reviewer who wants to prove `SHA256SUMS` itself wasn't tampered with can regenerate it from the upstream zip:
+
+```bash
+source scripts/vendor.pin
+curl -sL "https://github.com/utelle/SQLite3MultipleCiphers/releases/download/v${MC_VERSION}/sqlite3mc-${MC_VERSION}-sqlite-${SQLITE_VERSION}-wasm.zip" -o /tmp/sqlite3mc.zip
+unzip -q /tmp/sqlite3mc.zip -d /tmp/sqlite3mc-check
+
+# Compute per-file hashes from the extracted jswasm/
+(cd /tmp/sqlite3mc-check/sqlite3mc-wasm-* && cd jswasm && sha256sum -- * | sort -k2) > /tmp/upstream-sums
+
+# Compare against repo's SHA256SUMS, excluding our locally-authored d.mts
+grep -v 'sqlite3\.d\.mts' vendor/jswasm/SHA256SUMS | sort -k2 > /tmp/repo-sums
+diff /tmp/upstream-sums /tmp/repo-sums
+```
+
+Expected: empty diff. Any output means either upstream files have been modified or `SHA256SUMS` claims different hashes
+than the zip.
+
+## Bumping the pinned version
+
+1. Edit `scripts/vendor.pin` with the new `MC_VERSION`, `SQLITE_VERSION`, and the SHA256 of the new release zip (find
+   it in the upstream release notes or compute it: `curl -sL <url> | sha256sum`).
+2. Run `scripts/vendor.sh` (no args). It fetches the new release, verifies the SHA, replaces `vendor/jswasm/`, and
+   regenerates `SHA256SUMS`.
+3. Re-run kv-store tests to confirm compatibility: `yarn workspace @aztec-labs/kv-store test:browser`
+4. Commit `scripts/vendor.pin` and `vendor/jswasm/SHA256SUMS` together.
+
+To verify a candidate release before editing the pin file:
+
+```bash
+scripts/vendor.sh <mc-version> <sqlite-version> <expected-sha256>
+```
+
+The 3-argument form overrides the pin file but does not modify it.
+
+## Why `vendor/` is excluded from prettier
+
+The repo's `.prettierignore` includes `sqlite3mc-wasm/vendor/`. Without this, pre-commit hooks would silently reformat
+the upstream `.js` / `.mjs` files between fetch and the next commit (whitespace only, semantically identical, but
+cryptographically different bytes), breaking the verification chain above.
+
+If you see prettier formatting drift in this directory, the ignore entry is missing or misconfigured.

package/dest/index.js

@@ -0,0 +1,81 @@
+import vendoredInit from '../vendor/jswasm/sqlite3.mjs';
+/**
+ * Bundler-visible static reference to the wasm binary. Because the URL argument is a string literal, bundlers detect
+ * the expression, emit the wasm as an asset, and rewrite the URL, so the default `locateFile` below resolves to the
+ * emitted asset instead of guessing a path relative to the (relocated) output chunk at runtime.
+ */ export const SQLITE3_WASM_URL = new URL('../vendor/jswasm/sqlite3.wasm', import.meta.url);
+/**
+ * Initializes the sqlite3mc wasm module.
+ *
+ * With no options, the wasm is fetched from {@link SQLITE3_WASM_URL}, which bundlers rewrite to their emitted asset,
+ * so bundled consumers work by default. Pass `locateFile`, `wasmBinary`, or `instantiateWasm` to override.
+ *
+ * If loading the wasm fails (unreachable URL, HTTP error, corrupt bytes), the returned promise rejects with the cause.
+ * Exception: failures inside a caller-supplied `instantiateWasm` cannot be observed (Emscripten's hook contract has no
+ * error channel), so with a custom hook the promise never settles on failure.
+ */ export default function sqlite3InitModule(options = {}) {
+    return new Promise((resolve, reject)=>{
+        const instantiateWasm = options.instantiateWasm ?? (options.wasmBinary ? wasmBinaryInstantiator(options.wasmBinary, reject) : urlInstantiator(options.locateFile ?? defaultLocateFile, reject));
+        const callOptions = {
+            ...options,
+            instantiateWasm
+        };
+        installInitModuleState(callOptions);
+        // The vendored init consumes the installed state synchronously (its pre-js runs before the first await), so
+        // interleaved calls cannot observe each other's state. On instantiation failure the vendored promise never
+        // settles (the hook has no error channel), so the instantiators report failure through `reject` instead.
+        vendoredInit(callOptions).then(resolve, reject);
+    });
+}
+/** Builds an Emscripten `instantiateWasm` hook that instantiates the given bytes instead of fetching by URL. */ function wasmBinaryInstantiator(wasmBinary, onFailure) {
+    return (imports, onSuccess)=>{
+        void WebAssembly.instantiate(wasmBinary, imports).then(({ instance, module })=>onSuccess(instance, module), (error)=>onFailure(instantiationError('wasmBinary', error)));
+        return {};
+    };
+}
+/**
+ * Builds an Emscripten `instantiateWasm` hook that fetches and instantiates the wasm from the located URL, replacing
+ * the vendored fallback (which reports failures nowhere). Prefers streaming compilation, falling back to
+ * buffer-based instantiation when streaming is unavailable or fails (e.g. a server responding without the
+ * `application/wasm` MIME type, which `instantiateStreaming` rejects).
+ */ function urlInstantiator(locate, onFailure) {
+    return (imports, onSuccess)=>{
+        const url = locate('sqlite3.wasm', '');
+        const streaming = WebAssembly.instantiateStreaming ? WebAssembly.instantiateStreaming(fetch(url, {
+            credentials: 'same-origin'
+        }), imports).catch(()=>fetchAndInstantiate(url, imports)) : fetchAndInstantiate(url, imports);
+        void streaming.then(({ instance, module })=>onSuccess(instance, module), (error)=>onFailure(instantiationError(url, error)));
+        return {};
+    };
+}
+/** Fetches the wasm and instantiates it from a buffer, surfacing HTTP errors that streaming instantiation obscures. */ async function fetchAndInstantiate(url, imports) {
+    const response = await fetch(url, {
+        credentials: 'same-origin'
+    });
+    if (!response.ok) {
+        throw new Error(`HTTP ${response.status} ${response.statusText}`.trimEnd());
+    }
+    return WebAssembly.instantiate(await response.arrayBuffer(), imports);
+}
+function instantiationError(source, cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    return new Error(`sqlite3 wasm instantiation failed (${source}): ${detail}`, {
+        cause
+    });
+}
+/**
+ * Installs the global state object the vendored module's pre-js binds its `Module.locateFile` and
+ * `Module.instantiateWasm` wrappers to.
+ */ function installInitModuleState(options) {
+    const urlParams = globalThis.location?.href ? new URL(globalThis.location.href).searchParams : new URLSearchParams();
+    const debugModule = urlParams.has('sqlite3.debugModule') ? (...args)=>console.warn('sqlite3.debugModule:', ...args) : ()=>{};
+    globalThis.sqlite3InitModuleState = Object.assign(Object.create(null), {
+        debugModule,
+        wasmFilename: 'sqlite3.wasm',
+        emscriptenLocateFile: options.locateFile ?? defaultLocateFile,
+        emscriptenInstantiateWasm: options.instantiateWasm
+    });
+}
+/** Resolves the wasm to {@link SQLITE3_WASM_URL} so bundled consumers load the bundler-emitted asset by default. */ function defaultLocateFile(path, prefix) {
+    return path === 'sqlite3.wasm' ? SQLITE3_WASM_URL.href : new URL(path, prefix || import.meta.url).href;
+}

package/dest/src/index.d.ts

@@ -0,0 +1,33 @@
+import type { Sqlite3Static } from '@sqlite.org/sqlite-wasm';
+export type { Database, SAHPoolUtil, Sqlite3Static } from '@sqlite.org/sqlite-wasm';
+/**
+ * Bundler-visible static reference to the wasm binary. Because the URL argument is a string literal, bundlers detect
+ * the expression, emit the wasm as an asset, and rewrite the URL, so the default `locateFile` below resolves to the
+ * emitted asset instead of guessing a path relative to the (relocated) output chunk at runtime.
+ */
+export declare const SQLITE3_WASM_URL: URL;
+/**
+ * Emscripten module-loader options honored by {@link sqlite3InitModule}. Any further options are passed through to the
+ * vendored module unchanged.
+ */
+export interface Sqlite3InitOptions {
+    /** Resolves the URL from which a runtime asset (in practice always `sqlite3.wasm`) is fetched. */
+    locateFile?: (path: string, prefix: string) => string;
+    /** Pre-fetched wasm bytes. When set, the wasm is instantiated directly and never fetched by URL. */
+    wasmBinary?: BufferSource;
+    /** Custom wasm instantiation hook (standard Emscripten contract). Takes precedence over `wasmBinary`. */
+    instantiateWasm?: (imports: WebAssembly.Imports, onSuccess: (instance: WebAssembly.Instance, module: WebAssembly.Module) => void) => object;
+    [key: string]: unknown;
+}
+/**
+ * Initializes the sqlite3mc wasm module.
+ *
+ * With no options, the wasm is fetched from {@link SQLITE3_WASM_URL}, which bundlers rewrite to their emitted asset,
+ * so bundled consumers work by default. Pass `locateFile`, `wasmBinary`, or `instantiateWasm` to override.
+ *
+ * If loading the wasm fails (unreachable URL, HTTP error, corrupt bytes), the returned promise rejects with the cause.
+ * Exception: failures inside a caller-supplied `instantiateWasm` cannot be observed (Emscripten's hook contract has no
+ * error channel), so with a custom hook the promise never settles on failure.
+ */
+export default function sqlite3InitModule(options?: Sqlite3InitOptions): Promise<Sqlite3Static>;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguZC50cyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssRUFBRSxhQUFhLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUk3RCxZQUFZLEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxhQUFhLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUVwRjs7OztHQUlHO0FBQ0gsZUFBTyxNQUFNLGdCQUFnQixLQUE0RCxDQUFDO0FBRTFGOzs7R0FHRztBQUNILE1BQU0sV0FBVyxrQkFBa0I7SUFDakMsa0dBQWtHO0lBQ2xHLFVBQVUsQ0FBQyxFQUFFLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsTUFBTSxLQUFLLE1BQU0sQ0FBQztJQUN0RCxvR0FBb0c7SUFDcEcsVUFBVSxDQUFDLEVBQUUsWUFBWSxDQUFDO0lBQzFCLHlHQUF5RztJQUN6RyxlQUFlLENBQUMsRUFBRSxDQUNoQixPQUFPLEVBQUUsV0FBVyxDQUFDLE9BQU8sRUFDNUIsU0FBUyxFQUFFLENBQUMsUUFBUSxFQUFFLFdBQVcsQ0FBQyxRQUFRLEVBQUUsTUFBTSxFQUFFLFdBQVcsQ0FBQyxNQUFNLEtBQUssSUFBSSxLQUM1RSxNQUFNLENBQUM7SUFDWixDQUFDLEdBQUcsRUFBRSxNQUFNLEdBQUcsT0FBTyxDQUFDO0NBQ3hCO0FBRUQ7Ozs7Ozs7OztHQVNHO0FBQ0gsTUFBTSxDQUFDLE9BQU8sVUFBVSxpQkFBaUIsQ0FBQyxPQUFPLEdBQUUsa0JBQXVCLEdBQUcsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQWNsRyJ9

package/dest/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAI7D,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAEpF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,KAA4D,CAAC;AAE1F;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,kGAAkG;IAClG,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC;IACtD,oGAAoG;IACpG,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,yGAAyG;IACzG,eAAe,CAAC,EAAE,CAChB,OAAO,EAAE,WAAW,CAAC,OAAO,EAC5B,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,KAAK,IAAI,KAC5E,MAAM,CAAC;IACZ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,aAAa,CAAC,CAclG"}

package/package.json

@@ -0,0 +1,79 @@
+{
+  "name": "@aztec-labs/sqlite3mc-wasm",
+  "version": "6.0.0-nightly.20260829",
+  "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dest/src/index.d.ts",
+      "import": "./dest/index.js"
+    },
+    "./vendor/jswasm/sqlite3.wasm": "./vendor/jswasm/sqlite3.wasm",
+    "./vendor/jswasm/sqlite3-opfs-async-proxy.js": "./vendor/jswasm/sqlite3-opfs-async-proxy.js"
+  },
+  "inherits": [
+    "../package.common.json",
+    "./package.local.json"
+  ],
+  "scripts": {
+    "build": "yarn clean && ../scripts/tsc.sh",
+    "clean": "rm -rf ./dest .tsbuildinfo",
+    "test": "NODE_NO_WARNINGS=1 node --experimental-vm-modules ../node_modules/.bin/jest --passWithNoTests --maxWorkers=${JEST_MAX_WORKERS:-8}",
+    "build:dev": "../scripts/tsc.sh --watch",
+    "prepublishOnly": "./scripts/verify-pack.sh"
+  },
+  "devDependencies": {
+    "@jest/globals": "^30.0.0",
+    "@sqlite.org/sqlite-wasm": "3.50.4-build1",
+    "@typescript/native-preview": "7.0.0-dev.20260113.1",
+    "jest": "^30.0.0",
+    "ts-node": "^10.9.1",
+    "typescript": "^5.3.3"
+  },
+  "files": [
+    "src",
+    "vendor",
+    "dest",
+    "!*.test.*"
+  ],
+  "engines": {
+    "node": ">=20.10"
+  },
+  "jest": {
+    "extensionsToTreatAsEsm": [
+      ".ts"
+    ],
+    "transform": {
+      "^.+\\.tsx?$": [
+        "@swc/jest",
+        {
+          "jsc": {
+            "parser": {
+              "syntax": "typescript",
+              "decorators": true
+            },
+            "transform": {
+              "decoratorVersion": "2022-03"
+            }
+          }
+        }
+      ]
+    },
+    "moduleNameMapper": {
+      "^\\.\\./vendor/jswasm/(.*)$": "<rootDir>/../vendor/jswasm/$1",
+      "^(\\.{1,2}/.*)\\.[cm]?js$": "$1"
+    },
+    "reporters": [
+      "default"
+    ],
+    "testTimeout": 120000,
+    "testRegex": "./src/.*\\.test\\.(js|mjs|ts)$",
+    "rootDir": "./src",
+    "setupFiles": [
+      "../../foundation/src/jest/setup.mjs"
+    ],
+    "setupFilesAfterEnv": [
+      "../../foundation/src/jest/setupAfterEnv.mjs"
+    ],
+    "testEnvironment": "../../foundation/src/jest/env.mjs"
+  }
+}

package/src/index.ts

@@ -0,0 +1,134 @@
+import type { Sqlite3Static } from '@sqlite.org/sqlite-wasm';
+
+import vendoredInit from '../vendor/jswasm/sqlite3.mjs';
+
+export type { Database, SAHPoolUtil, Sqlite3Static } from '@sqlite.org/sqlite-wasm';
+
+/**
+ * Bundler-visible static reference to the wasm binary. Because the URL argument is a string literal, bundlers detect
+ * the expression, emit the wasm as an asset, and rewrite the URL, so the default `locateFile` below resolves to the
+ * emitted asset instead of guessing a path relative to the (relocated) output chunk at runtime.
+ */
+export const SQLITE3_WASM_URL = new URL('../vendor/jswasm/sqlite3.wasm', import.meta.url);
+
+/**
+ * Emscripten module-loader options honored by {@link sqlite3InitModule}. Any further options are passed through to the
+ * vendored module unchanged.
+ */
+export interface Sqlite3InitOptions {
+  /** Resolves the URL from which a runtime asset (in practice always `sqlite3.wasm`) is fetched. */
+  locateFile?: (path: string, prefix: string) => string;
+  /** Pre-fetched wasm bytes. When set, the wasm is instantiated directly and never fetched by URL. */
+  wasmBinary?: BufferSource;
+  /** Custom wasm instantiation hook (standard Emscripten contract). Takes precedence over `wasmBinary`. */
+  instantiateWasm?: (
+    imports: WebAssembly.Imports,
+    onSuccess: (instance: WebAssembly.Instance, module: WebAssembly.Module) => void,
+  ) => object;
+  [key: string]: unknown;
+}
+
+/**
+ * Initializes the sqlite3mc wasm module.
+ *
+ * With no options, the wasm is fetched from {@link SQLITE3_WASM_URL}, which bundlers rewrite to their emitted asset,
+ * so bundled consumers work by default. Pass `locateFile`, `wasmBinary`, or `instantiateWasm` to override.
+ *
+ * If loading the wasm fails (unreachable URL, HTTP error, corrupt bytes), the returned promise rejects with the cause.
+ * Exception: failures inside a caller-supplied `instantiateWasm` cannot be observed (Emscripten's hook contract has no
+ * error channel), so with a custom hook the promise never settles on failure.
+ */
+export default function sqlite3InitModule(options: Sqlite3InitOptions = {}): Promise<Sqlite3Static> {
+  return new Promise((resolve, reject) => {
+    const instantiateWasm =
+      options.instantiateWasm ??
+      (options.wasmBinary
+        ? wasmBinaryInstantiator(options.wasmBinary, reject)
+        : urlInstantiator(options.locateFile ?? defaultLocateFile, reject));
+    const callOptions = { ...options, instantiateWasm };
+    installInitModuleState(callOptions);
+    // The vendored init consumes the installed state synchronously (its pre-js runs before the first await), so
+    // interleaved calls cannot observe each other's state. On instantiation failure the vendored promise never
+    // settles (the hook has no error channel), so the instantiators report failure through `reject` instead.
+    vendoredInit(callOptions).then(resolve, reject);
+  });
+}
+
+/** Builds an Emscripten `instantiateWasm` hook that instantiates the given bytes instead of fetching by URL. */
+function wasmBinaryInstantiator(
+  wasmBinary: BufferSource,
+  onFailure: (error: Error) => void,
+): Required<Sqlite3InitOptions>['instantiateWasm'] {
+  return (imports, onSuccess) => {
+    void WebAssembly.instantiate(wasmBinary, imports).then(
+      ({ instance, module }) => onSuccess(instance, module),
+      error => onFailure(instantiationError('wasmBinary', error)),
+    );
+    return {};
+  };
+}
+
+/**
+ * Builds an Emscripten `instantiateWasm` hook that fetches and instantiates the wasm from the located URL, replacing
+ * the vendored fallback (which reports failures nowhere). Prefers streaming compilation, falling back to
+ * buffer-based instantiation when streaming is unavailable or fails (e.g. a server responding without the
+ * `application/wasm` MIME type, which `instantiateStreaming` rejects).
+ */
+function urlInstantiator(
+  locate: (path: string, prefix: string) => string,
+  onFailure: (error: Error) => void,
+): Required<Sqlite3InitOptions>['instantiateWasm'] {
+  return (imports, onSuccess) => {
+    const url = locate('sqlite3.wasm', '');
+    const streaming = WebAssembly.instantiateStreaming
+      ? WebAssembly.instantiateStreaming(fetch(url, { credentials: 'same-origin' }), imports).catch(() =>
+          fetchAndInstantiate(url, imports),
+        )
+      : fetchAndInstantiate(url, imports);
+    void streaming.then(
+      ({ instance, module }) => onSuccess(instance, module),
+      error => onFailure(instantiationError(url, error)),
+    );
+    return {};
+  };
+}
+
+/** Fetches the wasm and instantiates it from a buffer, surfacing HTTP errors that streaming instantiation obscures. */
+async function fetchAndInstantiate(
+  url: string,
+  imports: WebAssembly.Imports,
+): Promise<WebAssembly.WebAssemblyInstantiatedSource> {
+  const response = await fetch(url, { credentials: 'same-origin' });
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status} ${response.statusText}`.trimEnd());
+  }
+  return WebAssembly.instantiate(await response.arrayBuffer(), imports);
+}
+
+function instantiationError(source: string, cause: unknown): Error {
+  const detail = cause instanceof Error ? cause.message : String(cause);
+  return new Error(`sqlite3 wasm instantiation failed (${source}): ${detail}`, { cause });
+}
+
+/**
+ * Installs the global state object the vendored module's pre-js binds its `Module.locateFile` and
+ * `Module.instantiateWasm` wrappers to.
+ */
+function installInitModuleState(options: Sqlite3InitOptions): void {
+  const urlParams = globalThis.location?.href ? new URL(globalThis.location.href).searchParams : new URLSearchParams();
+  const debugModule = urlParams.has('sqlite3.debugModule')
+    ? // eslint-disable-next-line no-console -- mirrors the vendored module's own console-based debug channel
+      (...args: unknown[]) => console.warn('sqlite3.debugModule:', ...args)
+    : () => {};
+  (globalThis as { sqlite3InitModuleState?: object }).sqlite3InitModuleState = Object.assign(Object.create(null), {
+    debugModule,
+    wasmFilename: 'sqlite3.wasm',
+    emscriptenLocateFile: options.locateFile ?? defaultLocateFile,
+    emscriptenInstantiateWasm: options.instantiateWasm,
+  });
+}
+
+/** Resolves the wasm to {@link SQLITE3_WASM_URL} so bundled consumers load the bundler-emitted asset by default. */
+function defaultLocateFile(path: string, prefix: string): string {
+  return path === 'sqlite3.wasm' ? SQLITE3_WASM_URL.href : new URL(path, prefix || import.meta.url).href;
+}

package/vendor/jswasm/SHA256SUMS

@@ -0,0 +1,11 @@
+4ea2bcbd715b0d56089fc871ea241f8c5985d8669d1ddecaab4d56a8da806ce9  sqlite3-opfs-async-proxy.js
+c043fcfadc1ded8e248ef032a27b6fcda4d66f9eee4b2a27acba02b85d17764f  sqlite3-worker1-bundler-friendly.mjs
+349fc2eb7eb4fbe8b6a14779b5144f7506d3b0e14bf6385062a11013cb63d5fe  sqlite3-worker1-promiser-bundler-friendly.mjs
+552fd74e051da915335eedfed5eb5c025103ad52dd3535e406ee0aabe8b43a57  sqlite3-worker1-promiser.js
+4a73a2d1c105190ac8eb58572d5a4280f04baba0bae28d8e7a8fc33d9d23750b  sqlite3-worker1-promiser.mjs
+1bed25837f00f7b68943cfcabed62dfd202cae863a72af24a0d6487d7d7b0e61  sqlite3-worker1.js
+aeeb5f492b283a00fe275bd667711031c72b5acc45b06483b527d62f6f9cc28b  sqlite3-worker1.mjs
+ed52a9f3ae2f29865ec5ba502302ef3df2ff70cb4a427733c721f2dda0a5effb  sqlite3.d.mts
+df462b605bf855e3415aace4e5db413fcde2234a7bf80a388b641405bdd45668  sqlite3.js
+802291c5578f935da7138689fc73deddd1a0880c7082595d7498eeaa5f8126c3  sqlite3.mjs
+e7600bc6d59b1459362c8c2d4686f733e26d58041b3cdc599929661ecfeb21ae  sqlite3.wasm