@bockit/sequel 0.0.0-stage → 0.1.0

package/binaries.json

@@ -0,0 +1,106 @@
+{
+  "tools": {
+    "sqlc": {
+      "version": "1.31.1",
+      "executable": "sqlc",
+      "platforms": {
+        "darwin-arm64": {
+          "platform": "darwin_arm64",
+          "asset": "sqlc_1.31.1_darwin_arm64.tar.gz",
+          "archive": "tar.gz",
+          "member": "sqlc",
+          "upstream": "https://github.com/sqlc-dev/sqlc/releases/download/v1.31.1/sqlc_1.31.1_darwin_arm64.tar.gz",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-sqlc-1.31.1/sqlc_1.31.1_darwin_arm64.tar.gz",
+          "assetSha256": "21602158c99eb1f2bae197a66abfb1941d1e9e50b23125bb193349c6b1acc71e",
+          "executableSha256": "7e63a8b2166f1103a2ad1d2e5d05d8fe3f13ca65ecf2774a2570b830d32055fd"
+        },
+        "linux-x64": {
+          "platform": "linux_amd64",
+          "asset": "sqlc_1.31.1_linux_amd64.tar.gz",
+          "archive": "tar.gz",
+          "member": "sqlc",
+          "upstream": "https://github.com/sqlc-dev/sqlc/releases/download/v1.31.1/sqlc_1.31.1_linux_amd64.tar.gz",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-sqlc-1.31.1/sqlc_1.31.1_linux_amd64.tar.gz",
+          "assetSha256": "497ae4fcdfa64c5b0c311ffe4c2bd991e43991e82e5367792ed78bc2dca27354",
+          "executableSha256": "0496fbc18f603e2fbd10c752942d1389a1fa9bc3d18de7243ec00cccd611575f"
+        },
+        "linux-arm64": {
+          "platform": "linux_arm64",
+          "asset": "sqlc_1.31.1_linux_arm64.tar.gz",
+          "archive": "tar.gz",
+          "member": "sqlc",
+          "upstream": "https://github.com/sqlc-dev/sqlc/releases/download/v1.31.1/sqlc_1.31.1_linux_arm64.tar.gz",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-sqlc-1.31.1/sqlc_1.31.1_linux_arm64.tar.gz",
+          "assetSha256": "b7cae247740d0c51a1e657479e5b2d21e6fef428f596682a01bc55bf4ab8a23d",
+          "executableSha256": "3b42bdbc5be1d534b95fc6b9f0e1572e6aa555fda3c96f208cb26abb1bb77d7e"
+        }
+      }
+    },
+    "squawk": {
+      "version": "2.71.0",
+      "executable": "squawk",
+      "platforms": {
+        "darwin-arm64": {
+          "platform": "darwin-arm64",
+          "asset": "squawk-darwin-arm64",
+          "archive": "none",
+          "upstream": "https://github.com/sbdchd/squawk/releases/download/v2.71.0/squawk-darwin-arm64",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-squawk-2.71.0/squawk-darwin-arm64",
+          "assetSha256": "6132cb9779c688303e43746e10268f280b35a3fbcc70b851472021cc882ef5a2",
+          "executableSha256": "6132cb9779c688303e43746e10268f280b35a3fbcc70b851472021cc882ef5a2"
+        },
+        "linux-x64": {
+          "platform": "linux-musl-x64",
+          "asset": "squawk-linux-musl-x64",
+          "archive": "none",
+          "upstream": "https://github.com/sbdchd/squawk/releases/download/v2.71.0/squawk-linux-musl-x64",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-squawk-2.71.0/squawk-linux-musl-x64",
+          "assetSha256": "cf542e159fb3a94e5fd31d8b5282a31334df8205c6d7993afe286e9133fdff3e",
+          "executableSha256": "cf542e159fb3a94e5fd31d8b5282a31334df8205c6d7993afe286e9133fdff3e"
+        },
+        "linux-arm64": {
+          "platform": "linux-musl-arm64",
+          "asset": "squawk-linux-musl-arm64",
+          "archive": "none",
+          "upstream": "https://github.com/sbdchd/squawk/releases/download/v2.71.0/squawk-linux-musl-arm64",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-squawk-2.71.0/squawk-linux-musl-arm64",
+          "assetSha256": "3b350a7ad426cd4f000b9b43211b19d8a724392ad715ad454156653aadf77347",
+          "executableSha256": "3b350a7ad426cd4f000b9b43211b19d8a724392ad715ad454156653aadf77347"
+        }
+      }
+    },
+    "schema-engine": {
+      "version": "8.1.0-1.d1b3f377ca835d73fd50954a5e22128b9ebdd6b8",
+      "executable": "schema-engine",
+      "platforms": {
+        "darwin-arm64": {
+          "platform": "darwin-arm64",
+          "asset": "schema-engine-darwin-arm64.gz",
+          "archive": "gz",
+          "upstream": "https://binaries.prisma.sh/all_commits/d1b3f377ca835d73fd50954a5e22128b9ebdd6b8/darwin-arm64/schema-engine.gz",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-schema-engine-8.1.0-1.d1b3f377ca835d73fd50954a5e22128b9ebdd6b8/schema-engine-darwin-arm64.gz",
+          "assetSha256": "d7e50db1fa19f659dc95050e0e5b23bd3699c5db2f33bd0c43cb3e9bf7df3dc6",
+          "executableSha256": "6032ea1bdbd6dc3d453c36a22838d1d3b3554053083bf7695c104e9993637ba1"
+        },
+        "linux-x64": {
+          "platform": "linux-static-x64",
+          "asset": "schema-engine-linux-static-x64.gz",
+          "archive": "gz",
+          "upstream": "https://binaries.prisma.sh/all_commits/d1b3f377ca835d73fd50954a5e22128b9ebdd6b8/linux-static-x64/schema-engine.gz",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-schema-engine-8.1.0-1.d1b3f377ca835d73fd50954a5e22128b9ebdd6b8/schema-engine-linux-static-x64.gz",
+          "assetSha256": "1f609ddc58e6f5e21934976311162f1e5daa954fd6359c55ef65fee2033c45b4",
+          "executableSha256": "ec4adf16b03f1a37bae5965e4a8f265dccb48096fe03ec253385609babbddfaf"
+        },
+        "linux-arm64": {
+          "platform": "linux-static-arm64",
+          "asset": "schema-engine-linux-static-arm64.gz",
+          "archive": "gz",
+          "upstream": "https://binaries.prisma.sh/all_commits/d1b3f377ca835d73fd50954a5e22128b9ebdd6b8/linux-static-arm64/schema-engine.gz",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-schema-engine-8.1.0-1.d1b3f377ca835d73fd50954a5e22128b9ebdd6b8/schema-engine-linux-static-arm64.gz",
+          "assetSha256": "a80add0047a24ef33cc8e87070caa65a107a406addf3341bc4ccad72c147bbd4",
+          "executableSha256": "edd9415943a93f06ca11564f1fb151e6966410bb35d52ab1fe6d5d613fce91ab"
+        }
+      }
+    }
+  }
+}

package/dist/binaries/cache.d.ts

@@ -0,0 +1,6 @@
+import type { Platform } from './platform.ts';
+export declare function cacheRoot(env?: NodeJS.ProcessEnv, home?: string): string;
+export declare function cachedPath(root: string, tool: string, version: string, platform: Platform, executable: string): string;
+export declare function makeWorkDir(root: string): Promise<string>;
+export declare function installExecutable(source: string, destination: string): Promise<void>;
+export declare function removeWorkDir(dir: string): Promise<void>;

package/dist/binaries/cache.js

@@ -0,0 +1,36 @@
+import { randomBytes } from 'node:crypto';
+import { chmod, mkdir, rename, rm } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import path from 'node:path';
+// `$SEQUEL_CACHE_DIR`, else `$XDG_CACHE_HOME/sequel`, else `~/.cache/sequel`.
+export function cacheRoot(env = process.env, home = homedir()) {
+    if (env.SEQUEL_CACHE_DIR)
+        return path.resolve(env.SEQUEL_CACHE_DIR);
+    // The XDG spec says a relative XDG_CACHE_HOME is invalid and is to be ignored.
+    if (env.XDG_CACHE_HOME && path.isAbsolute(env.XDG_CACHE_HOME)) {
+        return path.join(env.XDG_CACHE_HOME, 'sequel');
+    }
+    return path.join(home, '.cache', 'sequel');
+}
+// Where a verified executable lives: keyed by tool, version and platform.
+export function cachedPath(root, tool, version, platform, executable) {
+    return path.join(root, tool, version, platform, executable);
+}
+// A fresh working folder inside the cache, on the same filesystem as the executables, so a
+// finished file can be renamed into place. The caller removes it.
+export async function makeWorkDir(root) {
+    const dir = path.join(root, 'tmp', `${process.pid}-${randomBytes(6).toString('hex')}`);
+    await mkdir(dir, { recursive: true });
+    return dir;
+}
+// Makes `source` executable and renames it to `destination`. The rename is atomic, so a
+// concurrent run or an interrupted one never sees a partial file at `destination`, and two
+// runs installing the same verified file at once both succeed.
+export async function installExecutable(source, destination) {
+    await chmod(source, 0o755);
+    await mkdir(path.dirname(destination), { recursive: true });
+    await rename(source, destination);
+}
+export async function removeWorkDir(dir) {
+    await rm(dir, { recursive: true, force: true });
+}

package/dist/binaries/ensure-binary.d.ts

@@ -0,0 +1,10 @@
+import { type Manifest } from './manifest.ts';
+import { type Platform } from './platform.ts';
+export type EnsureBinaryOptions = {
+    manifest?: Manifest;
+    platform?: Platform;
+    cacheDir?: string;
+    fetch?: typeof globalThis.fetch;
+    log?: (message: string) => void;
+};
+export declare function ensureBinary(tool: string, options?: EnsureBinaryOptions): Promise<string>;

package/dist/binaries/ensure-binary.js

@@ -0,0 +1,85 @@
+import { createWriteStream, existsSync } from 'node:fs';
+import path from 'node:path';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { SequelError } from '../errors.js';
+import { cachedPath, cacheRoot, installExecutable, makeWorkDir, removeWorkDir } from './cache.js';
+import { loadManifest, manifestEntry } from './manifest.js';
+import { currentPlatform } from './platform.js';
+import { unpack } from './unpack.js';
+import { sha256File, verifySha256 } from './verify.js';
+const DOWNLOAD_TIMEOUT_MS = 10 * 60_000;
+// Executables verified by this process, keyed by path and expected hash. Each process checks
+// a cached binary's sha256 once, before its first use, and shares the check between callers.
+const verified = new Map();
+// Returns the path of a pinned tool's verified executable, fetching it into the cache on
+// first use: from the mirror, then upstream.
+export function ensureBinary(tool, options = {}) {
+    const manifest = options.manifest ?? loadManifest();
+    const platform = options.platform ?? currentPlatform();
+    const root = options.cacheDir ?? cacheRoot();
+    const { version, executable, entry } = manifestEntry(manifest, tool, platform);
+    const destination = cachedPath(root, tool, version, platform, executable);
+    const key = `${destination}\0${entry.executableSha256}`;
+    let pending = verified.get(key);
+    if (pending === undefined) {
+        pending = prepare({
+            label: `${tool} ${version} (${platform})`,
+            entry,
+            root,
+            destination,
+            fetch: options.fetch ?? globalThis.fetch,
+            log: options.log ?? ((message) => process.stderr.write(`${message}\n`)),
+        });
+        verified.set(key, pending);
+        // A failure isn't remembered, so a later call in the same process tries again.
+        pending.catch(() => verified.delete(key));
+    }
+    return pending;
+}
+async function prepare(job) {
+    const { label, entry, destination } = job;
+    if (existsSync(destination)) {
+        const actual = await sha256File(destination);
+        if (actual === entry.executableSha256)
+            return destination;
+        throw new SequelError(`The cached ${label} at ${destination} failed its checksum: expected sha256 ${entry.executableSha256}, got ${actual}. It changed after it was verified, so it was not run. Delete ${path.dirname(destination)} and rerun to fetch it again.`);
+    }
+    job.log(`Fetching ${label}…`);
+    const workDir = await makeWorkDir(job.root);
+    try {
+        const asset = await download(job, workDir);
+        const unpacked = await unpack(asset, entry, workDir);
+        await verifySha256(unpacked, entry.executableSha256, `The executable in ${entry.asset}`);
+        await installExecutable(unpacked, destination);
+    }
+    finally {
+        await removeWorkDir(workDir);
+    }
+    return destination;
+}
+// Downloads the asset and verifies it, trying the mirror first and then upstream. A source
+// that fails, or serves bytes with the wrong checksum, is passed over for the next.
+async function download(job, workDir) {
+    const { entry } = job;
+    const file = path.join(workDir, 'asset');
+    const failures = [];
+    for (const [source, url] of [
+        ['mirror', entry.mirror],
+        ['upstream', entry.upstream],
+    ]) {
+        try {
+            const response = await job.fetch(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+            if (!response.ok || response.body === null) {
+                throw new Error(`HTTP ${response.status}`);
+            }
+            await pipeline(Readable.fromWeb(response.body), createWriteStream(file));
+            await verifySha256(file, entry.assetSha256, entry.asset);
+            return file;
+        }
+        catch (error) {
+            failures.push(`  ${source} ${url}: ${error.message}`);
+        }
+    }
+    throw new SequelError(`Could not fetch ${job.label}:\n${failures.join('\n')}\nCheck the network connection and rerun.`);
+}

package/dist/binaries/manifest.d.ts

@@ -0,0 +1,30 @@
+import { type Platform } from './platform.ts';
+export type Archive = 'none' | 'tar.gz' | 'gz';
+export type PlatformEntry = {
+    platform: string;
+    asset: string;
+    archive: Archive;
+    member?: string;
+    upstream: string;
+    mirror: string;
+    assetSha256: string;
+    executableSha256: string;
+};
+export type ToolEntry = {
+    version: string;
+    executable: string;
+    platforms: Record<Platform, PlatformEntry>;
+};
+export type Manifest = {
+    tools: Record<string, ToolEntry>;
+};
+export declare const MANIFEST_FILE: string;
+export declare const MIRROR_PREFIX = "https://github.com/Bockit/sequel/releases/download/";
+export declare function loadManifest(file?: string): Manifest;
+export declare function parseManifest(json: unknown, file?: string): Manifest;
+export declare function manifestEntry(manifest: Manifest, tool: string, platform: Platform): {
+    version: string;
+    executable: string;
+    entry: PlatformEntry;
+};
+export declare function mirrorTag(entry: PlatformEntry): string | undefined;

package/dist/binaries/manifest.js

@@ -0,0 +1,112 @@
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { SequelError } from '../errors.js';
+import { PLATFORMS } from './platform.js';
+export const MANIFEST_FILE = fileURLToPath(new URL('../../binaries.json', import.meta.url));
+export const MIRROR_PREFIX = 'https://github.com/Bockit/sequel/releases/download/';
+const SHA256 = /^[0-9a-f]{64}$/;
+const ARCHIVES = ['none', 'tar.gz', 'gz'];
+export function loadManifest(file = MANIFEST_FILE) {
+    let json;
+    try {
+        json = JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch (error) {
+        throw new SequelError(`${file} could not be read: ${error.message}`);
+    }
+    return parseManifest(json, file);
+}
+// Checks the manifest's shape, so a bad edit fails on load rather than mid-download.
+export function parseManifest(json, file = 'binaries.json') {
+    const fail = (where, problem) => {
+        throw new SequelError(where ? `${file}: \`${where}\` ${problem}` : `${file} ${problem}`);
+    };
+    const tools = object(object(json, '', fail).tools, 'tools', fail);
+    for (const [name, toolValue] of Object.entries(tools)) {
+        const tool = object(toolValue, `tools.${name}`, fail);
+        for (const key of ['version', 'executable']) {
+            if (typeof tool[key] !== 'string' || tool[key] === '') {
+                fail(`tools.${name}.${key}`, 'must be a non-empty string.');
+            }
+        }
+        if (tool.executable.includes('/')) {
+            fail(`tools.${name}.executable`, 'must be a file name, not a path.');
+        }
+        const platforms = object(tool.platforms, `tools.${name}.platforms`, fail);
+        const keys = Object.keys(platforms).sort();
+        if (keys.join() !== [...PLATFORMS].sort().join()) {
+            fail(`tools.${name}.platforms`, `must have exactly ${PLATFORMS.join(', ')}; it has ${keys.join(', ') || 'none'}.`);
+        }
+        for (const platform of PLATFORMS) {
+            checkEntry(platforms[platform], `tools.${name}.platforms.${platform}`, fail);
+        }
+    }
+    return json;
+}
+// The manifest entry for one tool on one platform.
+export function manifestEntry(manifest, tool, platform) {
+    const toolEntry = manifest.tools[tool];
+    if (toolEntry === undefined) {
+        throw new SequelError(`binaries.json has no entry for ${tool}.`);
+    }
+    return {
+        version: toolEntry.version,
+        executable: toolEntry.executable,
+        entry: toolEntry.platforms[platform],
+    };
+}
+// The `Bockit/sequel` release tag a mirror URL points into, or undefined if it isn't one.
+export function mirrorTag(entry) {
+    const suffix = `/${entry.asset}`;
+    if (!entry.mirror.startsWith(MIRROR_PREFIX) || !entry.mirror.endsWith(suffix))
+        return undefined;
+    const tag = entry.mirror.slice(MIRROR_PREFIX.length, -suffix.length);
+    return /^[A-Za-z0-9._-]+$/.test(tag) ? tag : undefined;
+}
+function object(value, where, fail) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        fail(where, 'must be an object.');
+    }
+    return value;
+}
+function checkEntry(value, where, fail) {
+    const entry = object(value, where, fail);
+    for (const key of ['platform', 'asset', 'upstream', 'mirror']) {
+        if (typeof entry[key] !== 'string' || entry[key] === '') {
+            fail(`${where}.${key}`, 'must be a non-empty string.');
+        }
+    }
+    for (const key of ['assetSha256', 'executableSha256']) {
+        if (typeof entry[key] !== 'string' || !SHA256.test(entry[key])) {
+            fail(`${where}.${key}`, 'must be a sha256: 64 lower-case hex digits.');
+        }
+    }
+    if (!ARCHIVES.includes(entry.archive)) {
+        fail(`${where}.archive`, `must be one of ${ARCHIVES.join(', ')}.`);
+    }
+    if (entry.asset.includes('/')) {
+        fail(`${where}.asset`, 'must be a file name, not a path.');
+    }
+    if (entry.archive === 'tar.gz') {
+        const member = entry.member;
+        if (typeof member !== 'string' || member === '') {
+            fail(`${where}.member`, 'must name the executable inside the tar.gz.');
+        }
+        if (path.isAbsolute(member) || member.split('/').includes('..')) {
+            fail(`${where}.member`, 'must be a relative path inside the archive.');
+        }
+    }
+    else if (entry.member !== undefined) {
+        fail(`${where}.member`, 'is only for tar.gz assets.');
+    }
+    if (entry.archive === 'none' && entry.assetSha256 !== entry.executableSha256) {
+        fail(where, 'is a bare executable, so its two sha256s must be the same.');
+    }
+    if (!entry.upstream.startsWith('https://')) {
+        fail(`${where}.upstream`, 'must be an https URL.');
+    }
+    if (mirrorTag(entry) === undefined) {
+        fail(`${where}.mirror`, `must be ${MIRROR_PREFIX}<tag>/${entry.asset}.`);
+    }
+}

package/dist/binaries/platform.d.ts

@@ -0,0 +1,3 @@
+export declare const PLATFORMS: readonly ['darwin-arm64', 'linux-x64', 'linux-arm64'];
+export type Platform = (typeof PLATFORMS)[number];
+export declare function currentPlatform(os?: string, arch?: string): Platform;

package/dist/binaries/platform.js

@@ -0,0 +1,10 @@
+import { SequelError } from '../errors.js';
+export const PLATFORMS = ['darwin-arm64', 'linux-x64', 'linux-arm64'];
+// sequel's name for the platform it runs on. Each manifest entry maps it to the tool's own name.
+export function currentPlatform(os = process.platform, arch = process.arch) {
+    const platform = `${os}-${arch}`;
+    if (!PLATFORMS.includes(platform)) {
+        throw new SequelError(`sequel does not support ${platform}. Its pinned tools are built for ${PLATFORMS.join(', ')}.`);
+    }
+    return platform;
+}

package/dist/binaries/unpack.d.ts

@@ -0,0 +1,2 @@
+import type { PlatformEntry } from './manifest.ts';
+export declare function unpack(asset: string, entry: PlatformEntry, workDir: string): Promise<string>;

package/dist/binaries/unpack.js

@@ -0,0 +1,35 @@
+import { execFile } from 'node:child_process';
+import { createReadStream, createWriteStream } from 'node:fs';
+import { mkdir } from 'node:fs/promises';
+import path from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import { promisify } from 'node:util';
+import { createGunzip } from 'node:zlib';
+import { SequelError } from '../errors.js';
+const run = promisify(execFile);
+// Extracts the executable from a verified asset into `workDir`, and returns its path.
+// Only call this after the asset's checksum has passed.
+export async function unpack(asset, entry, workDir) {
+    const output = path.join(workDir, 'executable');
+    switch (entry.archive) {
+        case 'none':
+            return asset;
+        case 'gz':
+            await pipeline(createReadStream(asset), createGunzip(), createWriteStream(output));
+            return output;
+        case 'tar.gz': {
+            const member = entry.member;
+            const dir = path.join(workDir, 'unpacked');
+            await mkdir(dir);
+            try {
+                // The system tar, present on every supported platform. Only the named member is
+                // extracted, and both GNU tar and bsdtar refuse members that escape `dir`.
+                await run('tar', ['-xzf', asset, '-C', dir, member]);
+            }
+            catch (error) {
+                throw new SequelError(`Could not extract ${member} from ${entry.asset} with tar: ${error.message.trim()}`);
+            }
+            return path.join(dir, member);
+        }
+    }
+}

package/dist/binaries/verify.d.ts

@@ -0,0 +1,2 @@
+export declare function sha256File(file: string): Promise<string>;
+export declare function verifySha256(file: string, expected: string, what: string): Promise<void>;

package/dist/binaries/verify.js

@@ -0,0 +1,16 @@
+import { createHash } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { SequelError } from '../errors.js';
+export async function sha256File(file) {
+    const hash = createHash('sha256');
+    for await (const chunk of createReadStream(file))
+        hash.update(chunk);
+    return hash.digest('hex');
+}
+// Refuses a file whose sha256 isn't the one recorded in the manifest. `what` names it.
+export async function verifySha256(file, expected, what) {
+    const actual = await sha256File(file);
+    if (actual !== expected) {
+        throw new SequelError(`${what} failed its checksum: expected sha256 ${expected}, got ${actual}. It was not used.`);
+    }
+}

package/dist/check.d.ts

@@ -0,0 +1,9 @@
+import { type ResolvedConfig } from './config/resolve-config.ts';
+export type CheckFailure = {
+    problem: string;
+    details: string[];
+    fix: string;
+};
+export declare function runChecks(config: ResolvedConfig, log: (message: string) => void): Promise<CheckFailure[]>;
+export declare function lineChanges(current: string, next: string): string[];
+export declare function checkFailureMessage(failures: CheckFailure[]): string;

package/dist/check.js

@@ -0,0 +1,166 @@
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { ensureBinary } from './binaries/ensure-binary.js';
+import { requireDatabase } from './config/resolve-config.js';
+import { SequelError } from './errors.js';
+import { readExtrasSnapshot } from './extras/snapshot.js';
+import { checkModules } from './generate/generate-modules.js';
+import { findQueryFolders } from './generate/modules.js';
+import { deployTo } from './migrate/deploy.js';
+import { diffMigrationsToSchema } from './migrate/drift.js';
+import { findMigrations } from './migrate/files.js';
+import { formatFinding, lintMigrations, migrationsToLint } from './migrate/lint.js';
+import { readSchemaFiles, validateSchema } from './schema/schema.js';
+import { unsupportedColumns } from './schema/unsupported.js';
+// SPEC §3's `check`: brings the test database up to the latest migration, then runs every check
+// and returns every failure, in SPEC's order. It writes no files. A check that can't run because
+// an earlier one failed (drift needs a valid schema, say) is skipped, and the earlier failure
+// says why.
+export async function runChecks(config, log) {
+    const testUrl = requireDatabase(config, 'test');
+    const shown = (file) => path.relative(config.root, file);
+    const failures = [];
+    const fail = (order, failure) => failures.push({ order, failure });
+    const expected = async (order, problem, fix, body) => {
+        try {
+            return await body();
+        }
+        catch (error) {
+            if (!(error instanceof SequelError))
+                throw error;
+            fail(order, { problem, details: [error.message], fix });
+            return undefined;
+        }
+    };
+    // The schema folder.
+    const files = await expected(5, "The schema folder can't be read", "Fix the config's `schema`, then run `sequel check` again.", () => readSchemaFiles(config.schema, config.root));
+    let schemaValid = false;
+    if (files !== undefined) {
+        const message = validateSchema(files, config.root);
+        if (message === undefined)
+            schemaValid = true;
+        else {
+            fail(5, {
+                problem: "The schema folder doesn't validate",
+                details: [message],
+                fix: 'Fix the schema. `sequel validate` shows the same errors.',
+            });
+        }
+    }
+    // The migrations, and the test database.
+    const migrations = await expected(2, "The migrations can't be read", 'Fix the files named, then run `sequel check` again.', () => findMigrations(config.migrations, { root: config.root }));
+    const deployed = migrations !== undefined &&
+        (await expected(1, "The test database can't be brought up to the latest migration", 'Fix the migration named, then run `sequel check` again.', async () => {
+            await deployTo(config, testUrl, { log, quietWhenCurrent: true });
+            return true;
+        })) === true;
+    // 1. Generated modules.
+    if (deployed) {
+        const modules = await expected(1, "The query modules can't be generated", 'Fix the queries named. `sequel generate` reports the same errors.', async () => checkModules({
+            sqlc: await ensureBinary('sqlc'),
+            databaseUrl: testUrl,
+            folders: await findQueryFolders(config.queries),
+            bigint: config.types.bigint,
+            root: config.root,
+        }));
+        if (modules !== undefined) {
+            const details = [
+                ...modules.stale.map((file) => `stale: ${shown(file)}`),
+                ...modules.missing.map((file) => `missing: ${shown(file)}`),
+                ...modules.orphaned.map((file) => `orphaned: ${shown(file)} (its query file is gone)`),
+            ];
+            if (details.length > 0) {
+                fail(1, {
+                    problem: 'Generated modules are out of date',
+                    details,
+                    fix: 'Run `sequel generate`, and commit the result.',
+                });
+            }
+        }
+    }
+    // 2. Drift.
+    if (migrations !== undefined && files !== undefined && schemaValid) {
+        const diff = await expected(2, "Drift between the migrations and the schema folder can't be checked", 'Fix the problem named, then run `sequel check` again.', () => diffMigrationsToSchema({ config, migrations, files }));
+        if (diff?.changed) {
+            fail(2, {
+                problem: 'The migrations and the schema folder differ. Replayed, the migrations need this to match the schema',
+                details: [diff.sql.trimEnd()],
+                fix: 'Run `sequel migrate new <name>` to write a migration for the difference, or change the schema to match the migrations.',
+            });
+        }
+    }
+    // 3. Lint after the cut-over.
+    if (migrations !== undefined) {
+        const findings = await expected(3, "The migrations can't be linted", 'Fix the problem named, then run `sequel check` again.', async () => lintMigrations({
+            squawk: await ensureBinary('squawk'),
+            migrations: migrationsToLint(migrations, config.lint.cutover),
+            root: config.root,
+            ...(files === undefined ? {} : { unsupported: unsupportedColumns(files) }),
+        }));
+        if (findings !== undefined && findings.length > 0) {
+            fail(3, {
+                problem: `Migrations after the lint cut-over have ${findings.length} lint finding${findings.length === 1 ? '' : 's'}`,
+                details: findings.map(formatFinding),
+                fix: 'Fix each, or suppress a Squawk finding with `-- squawk-ignore <rule> -- <reason>`. `sequel migrate lint` lists them.',
+            });
+        }
+    }
+    // 4. The extras snapshot.
+    if (deployed) {
+        const next = await readExtrasSnapshot(testUrl);
+        const current = await readFile(config.snapshot, 'utf8').catch(() => undefined);
+        if (current !== next) {
+            fail(4, {
+                problem: current === undefined
+                    ? `The extras snapshot ${shown(config.snapshot)} is missing`
+                    : `The extras snapshot ${shown(config.snapshot)} is stale`,
+                details: current === undefined ? [] : lineChanges(current, next),
+                fix: 'Run `sequel extras`, and commit the snapshot.',
+            });
+        }
+    }
+    return failures.sort((a, b) => a.order - b.order).map((entry) => entry.failure);
+}
+// The lines that differ, from a longest-common-subsequence diff: `-` for the snapshot as
+// committed, `+` for the database. Snapshots are small, so the quadratic table is fine.
+export function lineChanges(current, next) {
+    const a = current.split('\n');
+    const b = next.split('\n');
+    const lcs = Array.from({ length: a.length + 1 }, () => new Array(b.length + 1).fill(0));
+    for (let i = a.length - 1; i >= 0; i--) {
+        for (let j = b.length - 1; j >= 0; j--) {
+            const row = lcs[i];
+            row[j] =
+                a[i] === b[j]
+                    ? lcs[i + 1][j + 1] + 1
+                    : Math.max(lcs[i + 1][j], row[j + 1]);
+        }
+    }
+    const changes = [];
+    let i = 0;
+    let j = 0;
+    while (i < a.length || j < b.length) {
+        if (i < a.length && j < b.length && a[i] === b[j]) {
+            i++;
+            j++;
+        }
+        else if (i < a.length &&
+            (j === b.length ||
+                lcs[i + 1][j] >= lcs[i][j + 1])) {
+            changes.push(`- ${a[i++]}`);
+        }
+        else {
+            changes.push(`+ ${b[j++]}`);
+        }
+    }
+    return changes;
+}
+export function checkFailureMessage(failures) {
+    const blocks = failures.map((failure, i) => {
+        const details = failure.details
+            .flatMap((detail) => detail.split('\n'))
+            .map((line) => `     ${line}`);
+        return [`${i + 1}. ${failure.problem}:`, ...details, `   Fix: ${failure.fix}`].join('\n');
+    });
+    return `sequel check found ${failures.length} problem${failures.length === 1 ? '' : 's'}:\n\n${blocks.join('\n\n')}`;
+}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};