@reddb-io/client 1.23.4 → 1.24.0

package/README.md

@@ -30,12 +30,10 @@ pnpm add @reddb-io/client
 npm install @reddb-io/client
 ```
 
-The `postinstall` script downloads the matching `red_client` binary
-from GitHub Releases into `node_modules/@reddb-io/client/bin/`. If your
-environment blocks postinstall scripts or has no network, set
-`REDDB_CLIENT_BIN=/path/to/red_client` to point at a copy you've placed
-manually. The driver itself does **not** need the binary for `connect()`
-— it speaks the wire protocols directly from JS.
+This package is pure JavaScript: it has no install scripts and downloads no
+binary, so it installs the same way on every platform and works with
+`--ignore-scripts`. It speaks the wire protocols directly from JS. For the
+`red` / `red_client` CLI, install `@reddb-io/cli`.
 
 ## Quickstart
 
@@ -186,15 +184,6 @@ await connect('red://host:5050?token=sk-abc')
 await connect('red://user:pass@host:5050')
 ```
 
-## Environment overrides
-
-| Variable                     | Effect                                                |
-| ---------------------------- | ----------------------------------------------------- |
-| `REDDB_CLIENT_BIN`           | Override path to `red_client` for spawn-style helpers |
-| `REDDB_SKIP_POSTINSTALL=1`   | Don't download the binary on install                  |
-| `REDDB_POSTINSTALL_VERSION`  | Pull a specific release tag                           |
-| `REDDB_POSTINSTALL_REPO`     | Pull from a fork (default `reddb-io/reddb`)           |
-
 ## License
 
 MIT.

package/index.browser.d.ts

@@ -35,6 +35,12 @@ export interface QueryResult {
   affected: number
   columns: string[]
   rows: Array<Record<string, unknown>>
+  /** Present when the server reports it. */
+  ok?: boolean
+  /** Causal-consistency token returned by a write; pass it to a later read. */
+  bookmark?: string
+  /** Execution statistics, when the server reports them. */
+  stats?: Record<string, unknown>
 }
 
 export type QueryParam =
@@ -95,9 +101,12 @@ export interface CachePutOptions {
   ttl_ms?: number
   tags?: string[]
   policy?: {
-    idle_evict_ms?: number
-    stale_while_revalidate_ms?: number
-    jitter_ms?: number
+    ttl_ms?: number
+    expires_at_unix_ms?: number
+    max_blob_bytes?: number
+    l1_admission?: 'auto' | 'always' | 'never'
+    priority?: number
+    version?: number
   }
 }
 
@@ -329,6 +338,7 @@ export class VaultClient {
     options?: { collection?: string; tags?: string[] },
   ): Promise<QueryResult>
   get(key: string, options?: { collection?: string }): Promise<QueryResult>
+  reveal(key: string, options?: { collection?: string }): Promise<QueryResult>
   unseal(key: string, options?: { collection?: string }): Promise<QueryResult>
 }
 

package/index.d.ts

@@ -30,6 +30,12 @@ export interface QueryResult {
   affected: number
   columns: string[]
   rows: Array<Record<string, unknown>>
+  /** Present when the server reports it. */
+  ok?: boolean
+  /** Causal-consistency token returned by a write; pass it to a later read. */
+  bookmark?: string
+  /** Execution statistics, when the server reports them. */
+  stats?: Record<string, unknown>
 }
 
 export type QueryParam =
@@ -91,9 +97,12 @@ export interface CachePutOptions {
   ttl_ms?: number
   tags?: string[]
   policy?: {
-    idle_evict_ms?: number
-    stale_while_revalidate_ms?: number
-    jitter_ms?: number
+    ttl_ms?: number
+    expires_at_unix_ms?: number
+    max_blob_bytes?: number
+    l1_admission?: 'auto' | 'always' | 'never'
+    priority?: number
+    version?: number
   }
 }
 
@@ -325,6 +334,7 @@ export class VaultClient {
     options?: { collection?: string; tags?: string[] },
   ): Promise<QueryResult>
   get(key: string, options?: { collection?: string }): Promise<QueryResult>
+  reveal(key: string, options?: { collection?: string }): Promise<QueryResult>
   unseal(key: string, options?: { collection?: string }): Promise<QueryResult>
 }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@reddb-io/client",
-  "version": "1.23.4",
-  "description": "Thin remote-only RedDB driver. Downloads the `red_client` binary on install. Speaks RedWire/gRPC/HTTP. Embedded URIs (memory://, file://, red:///path) are rejected — use @reddb-io/sdk for those.",
+  "version": "1.24.0",
+  "description": "Thin remote-only RedDB driver. Pure JavaScript — no install scripts, no native binary. Speaks RedWire/gRPC/HTTP. Embedded URIs (memory://, file://, red:///path) are rejected — use @reddb-io/sdk for those.",
   "type": "module",
   "main": "src/index.js",
   "browser": "./src/index.browser.js",
@@ -51,7 +51,6 @@
     "src/",
     "index.d.ts",
     "index.browser.d.ts",
-    "postinstall.js",
     "README.md",
     "LICENSE"
   ],
@@ -80,7 +79,6 @@
     "url": "https://github.com/reddb-io/reddb/issues"
   },
   "scripts": {
-    "postinstall": "node postinstall.js",
     "test": "node --test test/*.test.mjs"
   }
 }

package/src/cache.js

@@ -2,9 +2,9 @@
  * Cache client — exposes cache.{get,put,exists,invalidate,invalidatePrefix,
  * invalidateTags,flushNamespace} via the underlying HTTP transport.
  *
- * NOTE: These methods require server-side HTTP endpoints under /cache/ns/*.
- * flushNamespace routes to the existing POST /admin/blob_cache/flush_namespace.
- * All others target endpoints planned for a future server release.
+ * The HTTP data-plane endpoints under /cache/ns/* authorize the caller's
+ * tenant and cache namespace. Invalidation is local to the addressed server.
+ * Use the HTTP transport for remote cache operations.
  *
  * Values are base64-encoded in transit so binary payloads survive JSON.
  */
@@ -93,7 +93,7 @@ export class CacheClient {
 
   /**
    * Remove all entries in a namespace.
-   * Routes to POST /admin/blob_cache/flush_namespace (live endpoint).
+   * Uses the caller-scoped POST /cache/ns/:namespace/flush endpoint.
    * @param {string} namespace
    * @returns {Promise<void>}
    */

package/src/core/result.js

@@ -0,0 +1,76 @@
+/**
+ * Canonical query result.
+ *
+ * Every transport must hand callers the same shape,
+ * `{ statement, affected, columns, rows }`, with `rows` an array of plain
+ * objects keyed by column name. The wire does not: the HTTP and RedWire
+ * (`QueryWithParams`) replies are an envelope
+ * `{ ok, statement, affected_rows, result: { columns, records: [{ values, meta }], stats } }`,
+ * and the gRPC reply carries `records` as well. This turns any of them into
+ * the canonical shape. A value that is already canonical normalizes to an
+ * equivalent value, so the function is safe to apply more than once.
+ *
+ * Pure: no `node:` imports, no I/O.
+ */
+
+function isObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+}
+
+function firstNumber(...candidates) {
+  for (const candidate of candidates) {
+    if (typeof candidate === 'number' || typeof candidate === 'bigint') return candidate
+  }
+  return undefined
+}
+
+/** A record is `{ values, meta, ... }`; the row a caller wants is `values`. */
+function recordToRow(record) {
+  return isObject(record) && isObject(record.values) ? record.values : record
+}
+
+function columnNames(raw, body) {
+  if (Array.isArray(body.columns)) return body.columns
+  if (Array.isArray(raw.columns)) return raw.columns
+  const described = raw.descriptor?.columns
+  if (Array.isArray(described)) {
+    return described.map((column) => (isObject(column) ? column.name : column))
+  }
+  return []
+}
+
+/**
+ * @param {unknown} raw a reply from any transport
+ * @returns {{ statement: string, affected: number | bigint, columns: string[], rows: object[] }}
+ *   plus `ok`, `bookmark` and `stats` when the server supplied them
+ */
+export function normalizeQueryResult(raw) {
+  if (!isObject(raw)) return raw
+  const body = isObject(raw.result) ? raw.result : raw
+  const records = Array.isArray(body.records) ? body.records : null
+  const hasRows = Array.isArray(body.rows) || Array.isArray(raw.rows)
+  if (!records && !hasRows && !('affected_rows' in raw) && !('affected' in raw) && !isObject(raw.result)) {
+    // Not a query reply at all (e.g. a bare health/version object): leave it alone.
+    return raw
+  }
+
+  const rows = Array.isArray(body.rows)
+    ? body.rows
+    : Array.isArray(raw.rows)
+      ? raw.rows
+      : records
+        ? records.map(recordToRow)
+        : []
+
+  const result = {
+    statement: raw.statement_type ?? raw.statement ?? body.statement ?? '',
+    affected: firstNumber(raw.affected, raw.affected_rows, body.affected, body.affected_rows) ?? 0,
+    columns: columnNames(raw, body),
+    rows,
+  }
+  if (raw.ok !== undefined) result.ok = raw.ok
+  if (raw.bookmark !== undefined) result.bookmark = raw.bookmark
+  const stats = body.stats ?? raw.stats
+  if (stats !== undefined) result.stats = stats
+  return result
+}

package/src/grpc.js

@@ -10,6 +10,7 @@ import { connect as connectHttp2 } from 'node:http2'
 import { Buffer } from 'node:buffer'
 
 import { RedDBError } from './protocol.js'
+import { normalizeQueryResult } from './core/result.js'
 import { normalizeExactNumbers, serializeJsonValue } from './core/serialization.js'
 
 const SERVICE = '/reddb.v1.RedDb'
@@ -155,12 +156,14 @@ function normalizeQueryReply(reply) {
       throw new RedDBError('QUERY_ERROR', `bad gRPC query JSON: ${err.message}`)
     }
   }
-  const rows = normalizeExactNumbers(parsed.rows ?? parsed.records ?? [])
+  // `records` are `{ values, meta }` objects; the caller wants the `values`.
+  const canonical = normalizeQueryResult(parsed)
+  const rows = normalizeExactNumbers(Array.isArray(canonical?.rows) ? canonical.rows : [])
   return {
     ok: reply.ok,
-    statement: parsed.statement ?? reply.statement ?? '',
-    affected: parsed.affected ?? parsed.affected_rows ?? 0,
-    columns: parsed.columns ?? reply.columns ?? [],
+    statement: canonical?.statement || reply.statement || '',
+    affected: canonical?.affected ?? 0,
+    columns: canonical?.columns?.length ? canonical.columns : (reply.columns ?? []),
     rows,
   }
 }

package/src/http.js

@@ -27,8 +27,8 @@
  *   cache.exists            → GET    /cache/ns/:ns/:key/exists
  *   cache.invalidate        → DELETE /cache/ns/:ns/:key
  *   cache.invalidate_prefix → DELETE /cache/ns/:ns?prefix=...
- *   cache.invalidate_tags   → DELETE /cache/ns/:ns/tags  (body: {tags})
- *   cache.flush_namespace   → POST   /admin/blob_cache/flush_namespace
+ *   cache.invalidate_tags   → POST   /cache/ns/:ns/invalidate-tags (body: {tags})
+ *   cache.flush_namespace   → POST   /cache/ns/:ns/flush
  *
  * Auth: every request after construction carries `Authorization:
  * Bearer <token>` (when set). `setToken(token)` updates it in
@@ -38,6 +38,7 @@
 
 import { RedDBError } from './protocol.js'
 import { classifyNdjsonFrame, splitLines } from './core/ndjson.js'
+import { normalizeQueryResult } from './core/result.js'
 import { normalizeExactNumbers, serializeJsonValue } from './core/serialization.js'
 
 export class HttpRpcClient {
@@ -76,6 +77,11 @@ export class HttpRpcClient {
     }
     const { url, init } = route(this.baseUrl, params)
     const response = await fetch(url, this.attachAuth(init))
+    if (method === 'query') {
+      // Keep the whole envelope: `statement` and `affected_rows` sit next to
+      // `result`, which is all the generic unwrap below would return.
+      return normalizeQueryResult(await parseResponse(response, { envelope: true }))
+    }
     return parseResponse(response)
   }
 
@@ -281,7 +287,7 @@ async function readInputTerminal(response) {
   return end
 }
 
-async function parseResponse(response) {
+async function parseResponse(response, { envelope = false } = {}) {
   const text = await response.text()
   let body = null
   if (text) {
@@ -303,7 +309,7 @@ async function parseResponse(response) {
       const code = body.error_code || 'RPC_ERROR'
       throw new RedDBError(code, body.error || 'unknown error', body)
     }
-    return normalizeExactNumbers(body.result ?? body)
+    return normalizeExactNumbers(envelope ? body : (body.result ?? body))
   }
   return normalizeExactNumbers(body)
 }
@@ -326,7 +332,9 @@ const ROUTES = {
   }),
   insert: (base, { collection, payload }) => ({
     url: `${base}/collections/${encodeURIComponent(collection)}/rows`,
-    init: { method: 'POST', body: JSON.stringify(serializeJsonValue(payload)) },
+    // The server reads the row from `fields` (`row create payload must contain
+    // an object field named 'fields'`); a bare object is a 400.
+    init: { method: 'POST', body: JSON.stringify({ fields: serializeJsonValue(payload) }) },
   }),
   bulk_insert: (base, { collection, payloads }) => ({
     url: `${base}/collections/${encodeURIComponent(collection)}/bulk/rows`,
@@ -387,11 +395,11 @@ const ROUTES = {
     init: { method: 'DELETE' },
   }),
   'cache.invalidate_tags': (base, { namespace, tags }) => ({
-    url: `${base}/cache/ns/${encodeURIComponent(namespace)}/tags`,
-    init: { method: 'DELETE', body: JSON.stringify({ tags }) },
+    url: `${base}/cache/ns/${encodeURIComponent(namespace)}/invalidate-tags`,
+    init: { method: 'POST', body: JSON.stringify({ tags }) },
   }),
   'cache.flush_namespace': (base, { namespace }) => ({
-    url: `${base}/admin/blob_cache/flush_namespace`,
-    init: { method: 'POST', body: JSON.stringify({ namespace }) },
+    url: `${base}/cache/ns/${encodeURIComponent(namespace)}/flush`,
+    init: { method: 'POST' },
   }),
 }

package/src/redwire-core.js

@@ -17,6 +17,7 @@
  */
 
 import { RedDBError } from './protocol.js'
+import { normalizeQueryResult } from './core/result.js'
 
 const MAGIC = 0xfe
 const SUPPORTED_VERSION = 0x01
@@ -344,6 +345,14 @@ export class RedWireClient {
       }
       kind = MessageKind.QueryWithParams
       payload = encodeQueryWithParams(sql, params)
+    } else if (this.supportsParams()) {
+      // Always QueryWithParams, with an empty list when there is nothing to
+      // bind. The legacy Query frame answers a bare summary with no rows for
+      // anything but a binary SELECT, and QueryBinary mis-decodes some
+      // replies (a one-row table came back as all NULLs on 1.23.4);
+      // QueryWithParams returns the full envelope for every statement.
+      kind = MessageKind.QueryWithParams
+      payload = encodeQueryWithParams(sql, [])
     } else {
       kind = isSelectQuery(sql) ? MessageKind.QueryBinary : MessageKind.Query
       payload = new TextEncoder().encode(sql)
@@ -351,7 +360,7 @@ export class RedWireClient {
     await writeFrame(this.socket, kind, corr, payload)
     const resp = await this.reader.next()
     if (resp.kind === MessageKind.Result) {
-      return decodeResultPayload(resp.payload)
+      return normalizeQueryResult(decodeResultPayload(resp.payload))
     }
     if (resp.kind === MessageKind.Error) {
       throw new RedDBError(

package/src/vault.js

@@ -23,9 +23,13 @@ export class VaultClient {
   }
 
   unseal(key, options = {}) {
+    return this.reveal(key, options)
+  }
+
+  reveal(key, options = {}) {
     const collection = options.collection ?? this.collection
     return this.client.call('query', {
-      sql: `UNSEAL VAULT ${keyedIdentifier(collection)}.${keyedIdentifier(key)}`,
+      sql: `VAULT REVEAL ${keyedIdentifier(collection)}.${keyedIdentifier(key)}`,
     })
   }
 }

package/postinstall.js

@@ -1,139 +0,0 @@
-/**
- * postinstall.js — download the matching `red_client` binary from
- * GitHub Releases.
- *
- * Behaviour:
- *   - Resolves `red_client-<platform>-<arch>` from process.platform +
- *     process.arch via the vendored asset fetcher.
- *   - Targets the GitHub release matching this package's version.
- *   - Drops the binary at `<package>/bin/red_client[.exe]` and chmods
- *     +x on Unix.
- *   - On any failure, prints a warning to stderr but exits 0 — npm
- *     install never breaks because of this script. The user gets a
- *     clear error later when they call `connect()` if the binary is
- *     missing AND the runtime needs to spawn it. (The remote-only
- *     transports in @reddb-io/client don't actually need the binary
- *     for `connect()` itself; the binary is provided as a CLI helper
- *     for ad-hoc REPL / one-shot SQL.)
- *
- * Override hooks (env vars):
- *   REDDB_SKIP_POSTINSTALL=1      do nothing
- *   REDDB_POSTINSTALL_VERSION=…   pull a different release tag
- *   REDDB_POSTINSTALL_REPO=…      pull from a fork (default: reddb-io/reddb)
- *   REDDB_CLIENT_BIN=/path        runtime override consulted by callers
- *                                 that spawn the binary; postinstall
- *                                 still downloads to the package dir
- *                                 unless REDDB_SKIP_POSTINSTALL=1.
- */
-
-import { createRequire } from 'node:module'
-import { fileURLToPath } from 'node:url'
-import { dirname, join, sep } from 'node:path'
-import { existsSync, mkdirSync, writeFileSync, chmodSync } from 'node:fs'
-
-import { fetchReleaseAsset } from './src/internal/asset-fetcher/index.js'
-
-const HERE = dirname(fileURLToPath(import.meta.url))
-const require = createRequire(import.meta.url)
-const pkg = require('./package.json')
-
-const DEFAULT_REPO = 'reddb-io/reddb'
-const BIN_NAME = 'red_client'
-
-if (process.env.REDDB_SKIP_POSTINSTALL === '1') {
-  process.stdout.write('@reddb-io/client: postinstall skipped (REDDB_SKIP_POSTINSTALL=1)\n')
-  process.exit(0)
-}
-
-// Workspace-local install detection — see drivers/js/postinstall.js for
-// the matching guard and rationale. connect() in this package doesn't need
-// the binary anyway; the helper CLI is the only consumer.
-if (!HERE.includes(`${sep}node_modules${sep}`)) {
-  process.stdout.write(
-    '@reddb-io/client: skipping postinstall — running from a workspace checkout (no node_modules/).\n' +
-    '       connect() works without the binary. If you also want the red_client CLI:\n' +
-    '         cargo build --release --bin red_client -p reddb-io-client --no-default-features\n' +
-    '         export REDDB_CLIENT_BIN="$PWD/target/release/red_client"\n' +
-    '       Set REDDB_SKIP_POSTINSTALL=1 to silence this message.\n',
-  )
-  process.exit(0)
-}
-
-main().catch((err) => {
-  process.stderr.write(formatFailure(err))
-  process.exit(0)
-})
-
-function formatFailure(err) {
-  const repo = process.env.REDDB_POSTINSTALL_REPO || DEFAULT_REPO
-  if (err && err.code === 'UNSUPPORTED_PLATFORM') {
-    return (
-      `@reddb-io/client: no prebuilt red_client binary for ${process.platform}/${process.arch}.\n`
-      + `       Note: connect() itself does not need the binary — it is only used as a CLI helper.\n`
-      + `       Options:\n`
-      + `         - build from source: https://github.com/${repo}#build-from-source\n`
-      + `         - or set REDDB_CLIENT_BIN=/path/to/red_client.\n`
-    )
-  }
-  if (err && err.code === 'ASSET_NOT_FOUND') {
-    return (
-      `@reddb-io/client: release asset not found at ${err.url}\n`
-      + `       The GitHub Release for this client version likely has not been\n`
-      + `       published yet. The driver still installs and connect() works\n`
-      + `       without the binary; this only affects the bundled CLI helper.\n`
-      + `       To unblock:\n`
-      + `         1. Pull a specific tag and rebuild:\n`
-      + `              REDDB_POSTINSTALL_VERSION=v1.0.5 npm rebuild @reddb-io/client\n`
-      + `         2. Or download red_client manually and export REDDB_CLIENT_BIN.\n`
-      + `       Releases: https://github.com/${repo}/releases\n`
-    )
-  }
-  return (
-    `@reddb-io/client: postinstall could not download red_client (${err && err.message}).\n`
-    + `       The package itself still installs (connect() does not need the binary).\n`
-    + `       To get the bundled CLI working:\n`
-    + `         - set REDDB_CLIENT_BIN=/path/to/red_client\n`
-    + `         - or install it manually from https://github.com/${repo}/releases\n`
-  )
-}
-
-async function main() {
-  const repo = process.env.REDDB_POSTINSTALL_REPO || DEFAULT_REPO
-  const tag = process.env.REDDB_POSTINSTALL_VERSION
-    ? normalizeTag(process.env.REDDB_POSTINSTALL_VERSION)
-    : `v${pkg.version}`
-
-  const binDir = join(HERE, 'bin')
-  const binaryPath = join(binDir, defaultBinaryName())
-
-  if (existsSync(binaryPath)) {
-    process.stdout.write(`@reddb-io/client: binary already present at ${binaryPath}\n`)
-    return
-  }
-
-  process.stdout.write(
-    `@reddb-io/client: downloading ${BIN_NAME} ${tag} for ${process.platform}/${process.arch} from ${repo}\n`,
-  )
-  const body = await fetchReleaseAsset({
-    repo,
-    tag,
-    platform: process.platform,
-    arch: process.arch,
-    binName: BIN_NAME,
-  })
-  mkdirSync(binDir, { recursive: true })
-  writeFileSync(binaryPath, body)
-  if (process.platform !== 'win32') {
-    chmodSync(binaryPath, 0o755)
-  }
-  process.stdout.write(`@reddb-io/client: installed binary at ${binaryPath}\n`)
-}
-
-function defaultBinaryName() {
-  return process.platform === 'win32' ? `${BIN_NAME}.exe` : BIN_NAME
-}
-
-function normalizeTag(value) {
-  const v = String(value).trim()
-  return v.startsWith('v') ? v : `v${v}`
-}

package/src/internal/asset-fetcher/asset-name.js

@@ -1,37 +0,0 @@
-/**
- * Resolve the GitHub release asset filename for a given Node
- * `process.platform` / `process.arch` pair and binary base name.
- *
- * Mapping is the existing scheme from `drivers/js/postinstall.js`:
- *   linux  + x64       → <bin>-linux-x86_64
- *   linux  + arm64     → <bin>-linux-aarch64
- *   linux  + arm/armv7l→ <bin>-linux-armv7
- *   darwin + x64       → <bin>-macos-x86_64
- *   darwin + arm64     → <bin>-macos-aarch64
- *   win32  + x64       → <bin>-windows-x86_64.exe
- *
- * Throws `UnsupportedPlatformError` for any other combination.
- */
-
-export class UnsupportedPlatformError extends Error {
-  constructor(platform, arch) {
-    super(`unsupported platform/arch combination: ${platform}/${arch}`)
-    this.name = 'UnsupportedPlatformError'
-    this.code = 'UNSUPPORTED_PLATFORM'
-    this.platform = platform
-    this.arch = arch
-  }
-}
-
-export function composeAssetName({ platform, arch, binName }) {
-  if (typeof binName !== 'string' || binName === '') {
-    throw new TypeError('composeAssetName: `binName` must be a non-empty string')
-  }
-  if (platform === 'linux' && arch === 'x64') return `${binName}-linux-x86_64`
-  if (platform === 'linux' && arch === 'arm64') return `${binName}-linux-aarch64`
-  if (platform === 'linux' && (arch === 'arm' || arch === 'armv7l')) return `${binName}-linux-armv7`
-  if (platform === 'darwin' && arch === 'x64') return `${binName}-macos-x86_64`
-  if (platform === 'darwin' && arch === 'arm64') return `${binName}-macos-aarch64`
-  if (platform === 'win32' && arch === 'x64') return `${binName}-windows-x86_64.exe`
-  throw new UnsupportedPlatformError(platform, arch)
-}

package/src/internal/asset-fetcher/checksum.js

@@ -1,23 +0,0 @@
-import { createHash } from 'node:crypto'
-
-export class ChecksumMismatchError extends Error {
-  constructor(expected, actual) {
-    super(`checksum mismatch: expected sha256=${expected}, got sha256=${actual}`)
-    this.name = 'ChecksumMismatchError'
-    this.code = 'CHECKSUM_MISMATCH'
-    this.expected = expected
-    this.actual = actual
-  }
-}
-
-export function sha256Hex(buf) {
-  return createHash('sha256').update(buf).digest('hex')
-}
-
-export function verifySha256(buf, expected) {
-  const expectedNorm = String(expected).trim().toLowerCase()
-  const actual = sha256Hex(buf)
-  if (actual !== expectedNorm) {
-    throw new ChecksumMismatchError(expectedNorm, actual)
-  }
-}

package/src/internal/asset-fetcher/download.js

@@ -1,170 +0,0 @@
-import { request as httpsRequest } from 'node:https'
-import { request as httpRequest } from 'node:http'
-
-const MAX_REDIRECTS = 5
-
-/**
- * Hosts a release download may be served from. The postinstall script writes
- * the response to disk and then executes it, so an unrestricted redirect
- * chain (or a plain-http hop) turns any network position into code
- * execution on the installing machine. GitHub serves release assets from
- * `github.com` and redirects to its object storage.
- */
-const ALLOWED_HOSTS = new Set([
-  'github.com',
-  'objects.githubusercontent.com',
-  'release-assets.githubusercontent.com',
-  'raw.githubusercontent.com',
-])
-
-/**
- * Ceiling on a downloaded asset. The `red` binary is tens of megabytes; a
- * response without this cap is buffered in full whatever its size.
- */
-const MAX_BODY_BYTES = 512 * 1024 * 1024
-
-export class DisallowedHostError extends Error {
-  constructor(url) {
-    super(`refusing to download from a non-allowlisted host: ${url}`)
-    this.name = 'DisallowedHostError'
-    this.code = 'DISALLOWED_HOST'
-    this.url = url
-  }
-}
-
-export class ResponseTooLargeError extends Error {
-  constructor(url, limit) {
-    super(`response from ${url} exceeds the ${limit}-byte limit`)
-    this.name = 'ResponseTooLargeError'
-    this.code = 'RESPONSE_TOO_LARGE'
-    this.url = url
-    this.limit = limit
-  }
-}
-
-/**
- * Reject anything that is not https on an allowlisted host. Applied to the
- * initial URL and to every redirect target, since a redirect is exactly how
- * an attacker would leave the allowlist.
- *
- * `allowedHosts` exists so the test suite can point the transport at a local
- * server; production callers never pass it and get {@link ALLOWED_HOSTS}
- * plus the https requirement.
- */
-export function assertDownloadableUrl(url, allowedHosts = ALLOWED_HOSTS) {
-  let parsed
-  try {
-    parsed = new URL(url)
-  } catch {
-    throw new DisallowedHostError(url)
-  }
-  const isDefaultPolicy = allowedHosts === ALLOWED_HOSTS
-  if (isDefaultPolicy && parsed.protocol !== 'https:') {
-    throw new DisallowedHostError(url)
-  }
-  if (!allowedHosts.has(parsed.hostname)) {
-    throw new DisallowedHostError(url)
-  }
-  return parsed
-}
-
-export class AssetNotFoundError extends Error {
-  constructor(url) {
-    super(`asset not found (HTTP 404) at ${url}`)
-    this.name = 'AssetNotFoundError'
-    this.code = 'ASSET_NOT_FOUND'
-    this.url = url
-  }
-}
-
-export class HttpError extends Error {
-  constructor(status, url) {
-    super(`HTTP ${status} fetching ${url}`)
-    this.name = 'HttpError'
-    this.code = 'HTTP_ERROR'
-    this.status = status
-    this.url = url
-  }
-}
-
-export class TooManyRedirectsError extends Error {
-  constructor(url) {
-    super(`too many redirects (>${MAX_REDIRECTS}) starting at ${url}`)
-    this.name = 'TooManyRedirectsError'
-    this.code = 'TOO_MANY_REDIRECTS'
-    this.url = url
-  }
-}
-
-function resolveLocation(currentUrl, location) {
-  if (/^https?:\/\//i.test(location)) return location
-  return new URL(location, currentUrl).toString()
-}
-
-export function downloadFollowingRedirects(
-  url,
-  { userAgent, originalUrl, allowedHosts } = {},
-  depth = 0,
-) {
-  const startUrl = originalUrl || url
-  if (depth > MAX_REDIRECTS) {
-    return Promise.reject(new TooManyRedirectsError(startUrl))
-  }
-  let parsed
-  try {
-    parsed = assertDownloadableUrl(url, allowedHosts)
-  } catch (err) {
-    return Promise.reject(err)
-  }
-  const request = parsed.protocol === 'http:' ? httpRequest : httpsRequest
-  return new Promise((resolve, reject) => {
-    const req = request(
-      url,
-      {
-        method: 'GET',
-        headers: {
-          'User-Agent': userAgent || 'reddb-internal-asset-fetcher',
-          Accept: 'application/octet-stream',
-        },
-      },
-      (res) => {
-        const status = res.statusCode || 0
-        if (status >= 300 && status < 400 && res.headers.location) {
-          res.resume()
-          const next = resolveLocation(url, res.headers.location)
-          downloadFollowingRedirects(
-            next,
-            { userAgent, originalUrl: startUrl, allowedHosts },
-            depth + 1,
-          ).then(resolve, reject)
-          return
-        }
-        if (status === 404) {
-          res.resume()
-          reject(new AssetNotFoundError(startUrl))
-          return
-        }
-        if (status < 200 || status >= 300) {
-          res.resume()
-          reject(new HttpError(status, url))
-          return
-        }
-        const chunks = []
-        let received = 0
-        res.on('data', (chunk) => {
-          received += chunk.length
-          if (received > MAX_BODY_BYTES) {
-            res.destroy()
-            reject(new ResponseTooLargeError(startUrl, MAX_BODY_BYTES))
-            return
-          }
-          chunks.push(chunk)
-        })
-        res.on('end', () => resolve(Buffer.concat(chunks)))
-        res.on('error', reject)
-      },
-    )
-    req.on('error', reject)
-    req.end()
-  })
-}

package/src/internal/asset-fetcher/index.js

@@ -1,130 +0,0 @@
-/**
- * @reddb-io/internal-asset-fetcher — fetch a `red`/`red_client` binary
- * from a GitHub release.
- *
- * Public surface: one function.
- *
- *   fetchReleaseAsset({ repo, tag, platform, arch, binName, sha256? }) → Buffer
- *
- * Steps:
- *   1. Map (platform, arch, binName) → asset filename.
- *   2. Compose the GitHub download URL: `https://github.com/<repo>/releases/download/<tag>/<asset>`.
- *   3. Follow up to 5 redirects, returning the final body as a Buffer.
- *   4. If `sha256` was supplied, verify before returning.
- *
- * Errors carry distinct `.code` values so callers can differentiate:
- *   - UNSUPPORTED_PLATFORM   — no asset for this platform/arch
- *   - ASSET_NOT_FOUND        — HTTP 404 (release/tag/asset name wrong)
- *   - CHECKSUM_MISMATCH      — body downloaded but sha256 mismatched
- *   - HTTP_ERROR             — any other non-2xx status
- *   - TOO_MANY_REDIRECTS     — redirect chain longer than 5 hops
- *
- * Internal modules (`./asset-name.js`, `./download.js`, `./checksum.js`)
- * are not part of the public contract — only `fetchReleaseAsset` is.
- * They are imported directly in tests for focused coverage.
- */
-
-import { composeAssetName } from './asset-name.js'
-import { downloadFollowingRedirects } from './download.js'
-import { sha256Hex, verifySha256, ChecksumMismatchError } from './checksum.js'
-
-/**
- * A GitHub `owner/name` pair. `repo` reaches this function from
- * `REDDB_POSTINSTALL_REPO` / `REDDB_MCP_REPO`, and is interpolated into the
- * download URL, so a value containing a path or authority would point the
- * download somewhere else entirely.
- */
-const REPO_PATTERN = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/
-
-/** A release tag, as it appears in the download URL path. */
-const TAG_PATTERN = /^[A-Za-z0-9._+-]+$/
-
-export class ChecksumUnavailableError extends Error {
-  constructor(assetName) {
-    super(
-      `no SHA256SUMS entry for ${assetName}; refusing to install an unverified binary ` +
-        `(set REDDB_POSTINSTALL_ALLOW_UNVERIFIED=1 to override)`,
-    )
-    this.name = 'ChecksumUnavailableError'
-    this.code = 'CHECKSUM_UNAVAILABLE'
-    this.assetName = assetName
-  }
-}
-
-/**
- * Parse a `SHA256SUMS` file (`<hex>  <filename>` per line) and return the
- * digest recorded for `assetName`, or `null` when it is not listed.
- */
-export function sha256FromSumsFile(text, assetName) {
-  for (const line of String(text).split('\n')) {
-    const match = line.trim().match(/^([0-9a-fA-F]{64})\s+\*?(.+)$/)
-    if (match && match[2].trim() === assetName) {
-      return match[1].toLowerCase()
-    }
-  }
-  return null
-}
-
-export async function fetchReleaseAsset({ repo, tag, platform, arch, binName, sha256 } = {}) {
-  if (typeof repo !== 'string' || repo === '') {
-    throw new TypeError('fetchReleaseAsset: `repo` must be a non-empty string (e.g. "reddb-io/reddb")')
-  }
-  if (typeof tag !== 'string' || tag === '') {
-    throw new TypeError('fetchReleaseAsset: `tag` must be a non-empty string (e.g. "v0.2.9")')
-  }
-  if (typeof platform !== 'string' || platform === '') {
-    throw new TypeError('fetchReleaseAsset: `platform` must be a non-empty string')
-  }
-  if (typeof arch !== 'string' || arch === '') {
-    throw new TypeError('fetchReleaseAsset: `arch` must be a non-empty string')
-  }
-
-  if (!REPO_PATTERN.test(repo)) {
-    throw new TypeError(`fetchReleaseAsset: \`repo\` must be "owner/name", got ${JSON.stringify(repo)}`)
-  }
-  if (!TAG_PATTERN.test(tag)) {
-    throw new TypeError(`fetchReleaseAsset: \`tag\` contains unsupported characters: ${JSON.stringify(tag)}`)
-  }
-
-  const assetName = composeAssetName({ platform, arch, binName })
-  const base = `https://github.com/${repo}/releases/download/${tag}`
-  const body = await downloadFollowingRedirects(`${base}/${assetName}`)
-
-  // The caller may pin a digest; otherwise fall back to the `SHA256SUMS`
-  // file the release publishes beside the assets. The downloaded bytes are
-  // written to disk and executed, so installing them unverified is the one
-  // outcome worth failing the install over — `install.sh` has verified since
-  // it shipped, and this path had not.
-  if (sha256) {
-    verifySha256(body, sha256)
-    return body
-  }
-
-  let expected = null
-  try {
-    const sums = await downloadFollowingRedirects(`${base}/SHA256SUMS`)
-    expected = sha256FromSumsFile(sums.toString('utf8'), assetName)
-  } catch {
-    expected = null
-  }
-  if (expected) {
-    if (sha256Hex(body) !== expected) {
-      throw new ChecksumMismatchError(expected, sha256Hex(body))
-    }
-    return body
-  }
-  if (allowUnverified()) {
-    return body
-  }
-  throw new ChecksumUnavailableError(assetName)
-}
-
-/**
- * Escape hatch for installing from a release that predates `SHA256SUMS`, or
- * from a fork that does not publish one. Opt-in and loud rather than the
- * silent default it used to be.
- */
-function allowUnverified() {
-  const raw = process.env.REDDB_POSTINSTALL_ALLOW_UNVERIFIED
-  return raw === '1' || raw === 'true' || raw === 'yes'
-}