@bockit/sequel 0.0.0-stage → 0.2.0

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,268 @@
+# Third-party notices
+
+sequel fetches, mirrors or vendors the tools below, unmodified. Each is a pinned version, verified against the sha256 recorded in `binaries.json` (or, for the vendored WASM, in `vendor/prisma-schema-wasm/README.md`). Each binary also contains its own dependencies, under the licences its upstream project lists.
+
+`pg` (MIT) is an npm dependency of sequel and carries its own licence.
+
+## Prisma schema engine
+
+- **Version:** `8.1.0-1.d1b3f377ca835d73fd50954a5e22128b9ebdd6b8`, the engine behind Prisma 7.10.1
+- **Source:** [`prisma/prisma-engines`](https://github.com/prisma/prisma-engines/tree/d1b3f377ca835d73fd50954a5e22128b9ebdd6b8) at commit `d1b3f377ca835d73fd50954a5e22128b9ebdd6b8`. Binaries from `https://binaries.prisma.sh/all_commits/d1b3f377ca835d73fd50954a5e22128b9ebdd6b8/<platform>/schema-engine.gz`, for `darwin-arm64`, `linux-static-x64` and `linux-static-arm64`.
+- **Licence:** Apache-2.0, whose full text is [below](#apache-license-20).
+- **Copyright:** Prisma Data, Inc. and the prisma-engines contributors. The repository's `LICENSE` names no copyright holder, and it has no NOTICE file.
+
+## Prisma schema WASM
+
+Vendored in `vendor/prisma-schema-wasm/`, built from the same engine commit.
+
+- **Version:** `@prisma/prisma-schema-wasm` `8.1.0-1.d1b3f377ca835d73fd50954a5e22128b9ebdd6b8`
+- **Source:** the npm registry; built from [`prisma/prisma-engines`](https://github.com/prisma/prisma-engines/tree/d1b3f377ca835d73fd50954a5e22128b9ebdd6b8/prisma-schema-wasm) at commit `d1b3f377ca835d73fd50954a5e22128b9ebdd6b8`.
+- **Licence:** Apache-2.0. Its `LICENSE` is in the vendored folder, and its full text is [below](#apache-license-20).
+- **Copyright:** as for the schema engine.
+
+## sqlc
+
+- **Version:** v1.31.1
+- **Source:** [`sqlc-dev/sqlc`](https://github.com/sqlc-dev/sqlc/tree/v1.31.1). Binaries from its [v1.31.1 release](https://github.com/sqlc-dev/sqlc/releases/tag/v1.31.1): `sqlc_1.31.1_darwin_arm64.tar.gz`, `sqlc_1.31.1_linux_amd64.tar.gz` and `sqlc_1.31.1_linux_arm64.tar.gz`.
+- **Licence:** MIT, whose full text follows, copied from its `LICENSE` at v1.31.1.
+- **Copyright:** Copyright (c) 2024 Riza, Inc.
+
+```
+MIT License
+
+Copyright (c) 2024 Riza, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## Squawk
+
+- **Version:** 2.71.0
+- **Source:** [`sbdchd/squawk`](https://github.com/sbdchd/squawk/tree/v2.71.0). Binaries from its [v2.71.0 release](https://github.com/sbdchd/squawk/releases/tag/v2.71.0): `squawk-darwin-arm64`, `squawk-linux-musl-x64` and `squawk-linux-musl-arm64`.
+- **Licence:** Squawk is licensed under Apache-2.0 or MIT, at the user's option. sequel uses and redistributes it under Apache-2.0, whose full text is [below](#apache-license-20).
+- **Copyright:** Squawk Team & Contributors, as its `Cargo.toml` names its authors. Its licence files name no copyright holder.
+
+## Apache License 2.0
+
+The full text, from <https://www.apache.org/licenses/LICENSE-2.0.txt>, which applies to the Prisma schema engine, the Prisma schema WASM and Squawk.
+
+```
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+```

package/binaries.json

@@ -0,0 +1,106 @@
+{
+  "tools": {
+    "sqlc": {
+      "version": "1.31.1",
+      "executable": "sqlc",
+      "platforms": {
+        "darwin-arm64": {
+          "platform": "darwin_arm64",
+          "asset": "sqlc_1.31.1_darwin_arm64.tar.gz",
+          "archive": "tar.gz",
+          "member": "sqlc",
+          "upstream": "https://github.com/sqlc-dev/sqlc/releases/download/v1.31.1/sqlc_1.31.1_darwin_arm64.tar.gz",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-sqlc-1.31.1/sqlc_1.31.1_darwin_arm64.tar.gz",
+          "assetSha256": "21602158c99eb1f2bae197a66abfb1941d1e9e50b23125bb193349c6b1acc71e",
+          "executableSha256": "7e63a8b2166f1103a2ad1d2e5d05d8fe3f13ca65ecf2774a2570b830d32055fd"
+        },
+        "linux-x64": {
+          "platform": "linux_amd64",
+          "asset": "sqlc_1.31.1_linux_amd64.tar.gz",
+          "archive": "tar.gz",
+          "member": "sqlc",
+          "upstream": "https://github.com/sqlc-dev/sqlc/releases/download/v1.31.1/sqlc_1.31.1_linux_amd64.tar.gz",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-sqlc-1.31.1/sqlc_1.31.1_linux_amd64.tar.gz",
+          "assetSha256": "497ae4fcdfa64c5b0c311ffe4c2bd991e43991e82e5367792ed78bc2dca27354",
+          "executableSha256": "0496fbc18f603e2fbd10c752942d1389a1fa9bc3d18de7243ec00cccd611575f"
+        },
+        "linux-arm64": {
+          "platform": "linux_arm64",
+          "asset": "sqlc_1.31.1_linux_arm64.tar.gz",
+          "archive": "tar.gz",
+          "member": "sqlc",
+          "upstream": "https://github.com/sqlc-dev/sqlc/releases/download/v1.31.1/sqlc_1.31.1_linux_arm64.tar.gz",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-sqlc-1.31.1/sqlc_1.31.1_linux_arm64.tar.gz",
+          "assetSha256": "b7cae247740d0c51a1e657479e5b2d21e6fef428f596682a01bc55bf4ab8a23d",
+          "executableSha256": "3b42bdbc5be1d534b95fc6b9f0e1572e6aa555fda3c96f208cb26abb1bb77d7e"
+        }
+      }
+    },
+    "squawk": {
+      "version": "2.71.0",
+      "executable": "squawk",
+      "platforms": {
+        "darwin-arm64": {
+          "platform": "darwin-arm64",
+          "asset": "squawk-darwin-arm64",
+          "archive": "none",
+          "upstream": "https://github.com/sbdchd/squawk/releases/download/v2.71.0/squawk-darwin-arm64",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-squawk-2.71.0/squawk-darwin-arm64",
+          "assetSha256": "6132cb9779c688303e43746e10268f280b35a3fbcc70b851472021cc882ef5a2",
+          "executableSha256": "6132cb9779c688303e43746e10268f280b35a3fbcc70b851472021cc882ef5a2"
+        },
+        "linux-x64": {
+          "platform": "linux-musl-x64",
+          "asset": "squawk-linux-musl-x64",
+          "archive": "none",
+          "upstream": "https://github.com/sbdchd/squawk/releases/download/v2.71.0/squawk-linux-musl-x64",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-squawk-2.71.0/squawk-linux-musl-x64",
+          "assetSha256": "cf542e159fb3a94e5fd31d8b5282a31334df8205c6d7993afe286e9133fdff3e",
+          "executableSha256": "cf542e159fb3a94e5fd31d8b5282a31334df8205c6d7993afe286e9133fdff3e"
+        },
+        "linux-arm64": {
+          "platform": "linux-musl-arm64",
+          "asset": "squawk-linux-musl-arm64",
+          "archive": "none",
+          "upstream": "https://github.com/sbdchd/squawk/releases/download/v2.71.0/squawk-linux-musl-arm64",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-squawk-2.71.0/squawk-linux-musl-arm64",
+          "assetSha256": "3b350a7ad426cd4f000b9b43211b19d8a724392ad715ad454156653aadf77347",
+          "executableSha256": "3b350a7ad426cd4f000b9b43211b19d8a724392ad715ad454156653aadf77347"
+        }
+      }
+    },
+    "schema-engine": {
+      "version": "8.1.0-1.d1b3f377ca835d73fd50954a5e22128b9ebdd6b8",
+      "executable": "schema-engine",
+      "platforms": {
+        "darwin-arm64": {
+          "platform": "darwin-arm64",
+          "asset": "schema-engine-darwin-arm64.gz",
+          "archive": "gz",
+          "upstream": "https://binaries.prisma.sh/all_commits/d1b3f377ca835d73fd50954a5e22128b9ebdd6b8/darwin-arm64/schema-engine.gz",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-schema-engine-8.1.0-1.d1b3f377ca835d73fd50954a5e22128b9ebdd6b8/schema-engine-darwin-arm64.gz",
+          "assetSha256": "d7e50db1fa19f659dc95050e0e5b23bd3699c5db2f33bd0c43cb3e9bf7df3dc6",
+          "executableSha256": "6032ea1bdbd6dc3d453c36a22838d1d3b3554053083bf7695c104e9993637ba1"
+        },
+        "linux-x64": {
+          "platform": "linux-static-x64",
+          "asset": "schema-engine-linux-static-x64.gz",
+          "archive": "gz",
+          "upstream": "https://binaries.prisma.sh/all_commits/d1b3f377ca835d73fd50954a5e22128b9ebdd6b8/linux-static-x64/schema-engine.gz",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-schema-engine-8.1.0-1.d1b3f377ca835d73fd50954a5e22128b9ebdd6b8/schema-engine-linux-static-x64.gz",
+          "assetSha256": "1f609ddc58e6f5e21934976311162f1e5daa954fd6359c55ef65fee2033c45b4",
+          "executableSha256": "ec4adf16b03f1a37bae5965e4a8f265dccb48096fe03ec253385609babbddfaf"
+        },
+        "linux-arm64": {
+          "platform": "linux-static-arm64",
+          "asset": "schema-engine-linux-static-arm64.gz",
+          "archive": "gz",
+          "upstream": "https://binaries.prisma.sh/all_commits/d1b3f377ca835d73fd50954a5e22128b9ebdd6b8/linux-static-arm64/schema-engine.gz",
+          "mirror": "https://github.com/Bockit/sequel/releases/download/bin-schema-engine-8.1.0-1.d1b3f377ca835d73fd50954a5e22128b9ebdd6b8/schema-engine-linux-static-arm64.gz",
+          "assetSha256": "a80add0047a24ef33cc8e87070caa65a107a406addf3341bc4ccad72c147bbd4",
+          "executableSha256": "edd9415943a93f06ca11564f1fb151e6966410bb35d52ab1fe6d5d613fce91ab"
+        }
+      }
+    }
+  }
+}

package/dist/binaries/cache.d.ts

@@ -0,0 +1,6 @@
+import type { Platform } from './platform.ts';
+export declare function cacheRoot(env?: NodeJS.ProcessEnv, home?: string): string;
+export declare function cachedPath(root: string, tool: string, version: string, platform: Platform, executable: string): string;
+export declare function makeWorkDir(root: string): Promise<string>;
+export declare function installExecutable(source: string, destination: string): Promise<void>;
+export declare function removeWorkDir(dir: string): Promise<void>;

package/dist/binaries/cache.js

@@ -0,0 +1,36 @@
+import { randomBytes } from 'node:crypto';
+import { chmod, mkdir, rename, rm } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import path from 'node:path';
+// `$SEQUEL_CACHE_DIR`, else `$XDG_CACHE_HOME/sequel`, else `~/.cache/sequel`.
+export function cacheRoot(env = process.env, home = homedir()) {
+    if (env.SEQUEL_CACHE_DIR)
+        return path.resolve(env.SEQUEL_CACHE_DIR);
+    // The XDG spec says a relative XDG_CACHE_HOME is invalid and is to be ignored.
+    if (env.XDG_CACHE_HOME && path.isAbsolute(env.XDG_CACHE_HOME)) {
+        return path.join(env.XDG_CACHE_HOME, 'sequel');
+    }
+    return path.join(home, '.cache', 'sequel');
+}
+// Where a verified executable lives: keyed by tool, version and platform.
+export function cachedPath(root, tool, version, platform, executable) {
+    return path.join(root, tool, version, platform, executable);
+}
+// A fresh working folder inside the cache, on the same filesystem as the executables, so a
+// finished file can be renamed into place. The caller removes it.
+export async function makeWorkDir(root) {
+    const dir = path.join(root, 'tmp', `${process.pid}-${randomBytes(6).toString('hex')}`);
+    await mkdir(dir, { recursive: true });
+    return dir;
+}
+// Makes `source` executable and renames it to `destination`. The rename is atomic, so a
+// concurrent run or an interrupted one never sees a partial file at `destination`, and two
+// runs installing the same verified file at once both succeed.
+export async function installExecutable(source, destination) {
+    await chmod(source, 0o755);
+    await mkdir(path.dirname(destination), { recursive: true });
+    await rename(source, destination);
+}
+export async function removeWorkDir(dir) {
+    await rm(dir, { recursive: true, force: true });
+}

package/dist/binaries/ensure-binary.d.ts

@@ -0,0 +1,10 @@
+import { type Manifest } from './manifest.ts';
+import { type Platform } from './platform.ts';
+export type EnsureBinaryOptions = {
+    manifest?: Manifest;
+    platform?: Platform;
+    cacheDir?: string;
+    fetch?: typeof globalThis.fetch;
+    log?: (message: string) => void;
+};
+export declare function ensureBinary(tool: string, options?: EnsureBinaryOptions): Promise<string>;

package/dist/binaries/ensure-binary.js

@@ -0,0 +1,85 @@
+import { createWriteStream, existsSync } from 'node:fs';
+import path from 'node:path';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { SequelError } from '../errors.js';
+import { cachedPath, cacheRoot, installExecutable, makeWorkDir, removeWorkDir } from './cache.js';
+import { loadManifest, manifestEntry } from './manifest.js';
+import { currentPlatform } from './platform.js';
+import { unpack } from './unpack.js';
+import { sha256File, verifySha256 } from './verify.js';
+const DOWNLOAD_TIMEOUT_MS = 10 * 60_000;
+// Executables verified by this process, keyed by path and expected hash. Each process checks
+// a cached binary's sha256 once, before its first use, and shares the check between callers.
+const verified = new Map();
+// Returns the path of a pinned tool's verified executable, fetching it into the cache on
+// first use: from the mirror, then upstream.
+export function ensureBinary(tool, options = {}) {
+    const manifest = options.manifest ?? loadManifest();
+    const platform = options.platform ?? currentPlatform();
+    const root = options.cacheDir ?? cacheRoot();
+    const { version, executable, entry } = manifestEntry(manifest, tool, platform);
+    const destination = cachedPath(root, tool, version, platform, executable);
+    const key = `${destination}\0${entry.executableSha256}`;
+    let pending = verified.get(key);
+    if (pending === undefined) {
+        pending = prepare({
+            label: `${tool} ${version} (${platform})`,
+            entry,
+            root,
+            destination,
+            fetch: options.fetch ?? globalThis.fetch,
+            log: options.log ?? ((message) => process.stderr.write(`${message}\n`)),
+        });
+        verified.set(key, pending);
+        // A failure isn't remembered, so a later call in the same process tries again.
+        pending.catch(() => verified.delete(key));
+    }
+    return pending;
+}
+async function prepare(job) {
+    const { label, entry, destination } = job;
+    if (existsSync(destination)) {
+        const actual = await sha256File(destination);
+        if (actual === entry.executableSha256)
+            return destination;
+        throw new SequelError(`The cached ${label} at ${destination} failed its checksum: expected sha256 ${entry.executableSha256}, got ${actual}. It changed after it was verified, so it was not run. Delete ${path.dirname(destination)} and rerun to fetch it again.`);
+    }
+    job.log(`Fetching ${label}…`);
+    const workDir = await makeWorkDir(job.root);
+    try {
+        const asset = await download(job, workDir);
+        const unpacked = await unpack(asset, entry, workDir);
+        await verifySha256(unpacked, entry.executableSha256, `The executable in ${entry.asset}`);
+        await installExecutable(unpacked, destination);
+    }
+    finally {
+        await removeWorkDir(workDir);
+    }
+    return destination;
+}
+// Downloads the asset and verifies it, trying the mirror first and then upstream. A source
+// that fails, or serves bytes with the wrong checksum, is passed over for the next.
+async function download(job, workDir) {
+    const { entry } = job;
+    const file = path.join(workDir, 'asset');
+    const failures = [];
+    for (const [source, url] of [
+        ['mirror', entry.mirror],
+        ['upstream', entry.upstream],
+    ]) {
+        try {
+            const response = await job.fetch(url, { signal: AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS) });
+            if (!response.ok || response.body === null) {
+                throw new Error(`HTTP ${response.status}`);
+            }
+            await pipeline(Readable.fromWeb(response.body), createWriteStream(file));
+            await verifySha256(file, entry.assetSha256, entry.asset);
+            return file;
+        }
+        catch (error) {
+            failures.push(`  ${source} ${url}: ${error.message}`);
+        }
+    }
+    throw new SequelError(`Could not fetch ${job.label}:\n${failures.join('\n')}\nCheck the network connection and rerun.`);
+}

package/dist/binaries/manifest.d.ts

@@ -0,0 +1,30 @@
+import { type Platform } from './platform.ts';
+export type Archive = 'none' | 'tar.gz' | 'gz';
+export type PlatformEntry = {
+    platform: string;
+    asset: string;
+    archive: Archive;
+    member?: string;
+    upstream: string;
+    mirror: string;
+    assetSha256: string;
+    executableSha256: string;
+};
+export type ToolEntry = {
+    version: string;
+    executable: string;
+    platforms: Record<Platform, PlatformEntry>;
+};
+export type Manifest = {
+    tools: Record<string, ToolEntry>;
+};
+export declare const MANIFEST_FILE: string;
+export declare const MIRROR_PREFIX = "https://github.com/Bockit/sequel/releases/download/";
+export declare function loadManifest(file?: string): Manifest;
+export declare function parseManifest(json: unknown, file?: string): Manifest;
+export declare function manifestEntry(manifest: Manifest, tool: string, platform: Platform): {
+    version: string;
+    executable: string;
+    entry: PlatformEntry;
+};
+export declare function mirrorTag(entry: PlatformEntry): string | undefined;

package/dist/binaries/manifest.js

@@ -0,0 +1,112 @@
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { SequelError } from '../errors.js';
+import { PLATFORMS } from './platform.js';
+export const MANIFEST_FILE = fileURLToPath(new URL('../../binaries.json', import.meta.url));
+export const MIRROR_PREFIX = 'https://github.com/Bockit/sequel/releases/download/';
+const SHA256 = /^[0-9a-f]{64}$/;
+const ARCHIVES = ['none', 'tar.gz', 'gz'];
+export function loadManifest(file = MANIFEST_FILE) {
+    let json;
+    try {
+        json = JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch (error) {
+        throw new SequelError(`${file} could not be read: ${error.message}`);
+    }
+    return parseManifest(json, file);
+}
+// Checks the manifest's shape, so a bad edit fails on load rather than mid-download.
+export function parseManifest(json, file = 'binaries.json') {
+    const fail = (where, problem) => {
+        throw new SequelError(where ? `${file}: \`${where}\` ${problem}` : `${file} ${problem}`);
+    };
+    const tools = object(object(json, '', fail).tools, 'tools', fail);
+    for (const [name, toolValue] of Object.entries(tools)) {
+        const tool = object(toolValue, `tools.${name}`, fail);
+        for (const key of ['version', 'executable']) {
+            if (typeof tool[key] !== 'string' || tool[key] === '') {
+                fail(`tools.${name}.${key}`, 'must be a non-empty string.');
+            }
+        }
+        if (tool.executable.includes('/')) {
+            fail(`tools.${name}.executable`, 'must be a file name, not a path.');
+        }
+        const platforms = object(tool.platforms, `tools.${name}.platforms`, fail);
+        const keys = Object.keys(platforms).sort();
+        if (keys.join() !== [...PLATFORMS].sort().join()) {
+            fail(`tools.${name}.platforms`, `must have exactly ${PLATFORMS.join(', ')}; it has ${keys.join(', ') || 'none'}.`);
+        }
+        for (const platform of PLATFORMS) {
+            checkEntry(platforms[platform], `tools.${name}.platforms.${platform}`, fail);
+        }
+    }
+    return json;
+}
+// The manifest entry for one tool on one platform.
+export function manifestEntry(manifest, tool, platform) {
+    const toolEntry = manifest.tools[tool];
+    if (toolEntry === undefined) {
+        throw new SequelError(`binaries.json has no entry for ${tool}.`);
+    }
+    return {
+        version: toolEntry.version,
+        executable: toolEntry.executable,
+        entry: toolEntry.platforms[platform],
+    };
+}
+// The `Bockit/sequel` release tag a mirror URL points into, or undefined if it isn't one.
+export function mirrorTag(entry) {
+    const suffix = `/${entry.asset}`;
+    if (!entry.mirror.startsWith(MIRROR_PREFIX) || !entry.mirror.endsWith(suffix))
+        return undefined;
+    const tag = entry.mirror.slice(MIRROR_PREFIX.length, -suffix.length);
+    return /^[A-Za-z0-9._-]+$/.test(tag) ? tag : undefined;
+}
+function object(value, where, fail) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        fail(where, 'must be an object.');
+    }
+    return value;
+}
+function checkEntry(value, where, fail) {
+    const entry = object(value, where, fail);
+    for (const key of ['platform', 'asset', 'upstream', 'mirror']) {
+        if (typeof entry[key] !== 'string' || entry[key] === '') {
+            fail(`${where}.${key}`, 'must be a non-empty string.');
+        }
+    }
+    for (const key of ['assetSha256', 'executableSha256']) {
+        if (typeof entry[key] !== 'string' || !SHA256.test(entry[key])) {
+            fail(`${where}.${key}`, 'must be a sha256: 64 lower-case hex digits.');
+        }
+    }
+    if (!ARCHIVES.includes(entry.archive)) {
+        fail(`${where}.archive`, `must be one of ${ARCHIVES.join(', ')}.`);
+    }
+    if (entry.asset.includes('/')) {
+        fail(`${where}.asset`, 'must be a file name, not a path.');
+    }
+    if (entry.archive === 'tar.gz') {
+        const member = entry.member;
+        if (typeof member !== 'string' || member === '') {
+            fail(`${where}.member`, 'must name the executable inside the tar.gz.');
+        }
+        if (path.isAbsolute(member) || member.split('/').includes('..')) {
+            fail(`${where}.member`, 'must be a relative path inside the archive.');
+        }
+    }
+    else if (entry.member !== undefined) {
+        fail(`${where}.member`, 'is only for tar.gz assets.');
+    }
+    if (entry.archive === 'none' && entry.assetSha256 !== entry.executableSha256) {
+        fail(where, 'is a bare executable, so its two sha256s must be the same.');
+    }
+    if (!entry.upstream.startsWith('https://')) {
+        fail(`${where}.upstream`, 'must be an https URL.');
+    }
+    if (mirrorTag(entry) === undefined) {
+        fail(`${where}.mirror`, `must be ${MIRROR_PREFIX}<tag>/${entry.asset}.`);
+    }
+}