duckhts 1.5.2-9002

package/LICENSE

@@ -0,0 +1,338 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+                            NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Moe Ghoul>, 1 April 1989
+  Moe Ghoul, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.

package/README.Rmd

@@ -0,0 +1,160 @@
+# duckhts for duckdb-wasm
+
+The [DuckHTS](https://github.com/RGenomicsETL/duckhts) DuckDB extension, packaged for
+[`@duckdb/duckdb-wasm`](https://www.npmjs.com/package/@duckdb/duckdb-wasm), so a web
+application can serve the extension from its own origin instead of fetching it from the
+DuckDB community repository at runtime.
+
+Each npm release contains one pinned set of `.wasm` files, verified byte for byte against
+its channel's manifest before packaging. `SIGNED` reports which channel supplied them.
+
+## Channels
+
+| npm dist-tag | Install | Binary source | DuckHTS version |
+|---|---|---|---|
+| `latest` | `npm install duckhts@latest` | signed community repository (`artifacts.json`) | released version |
+| `dev` | `npm install duckhts@dev` | unsigned GitHub Actions run (`artifacts-dev.json`) | `1.5.2.9002` as npm `1.5.2-9002` |
+
+The `dev` loader refuses to load unless DuckDB has `allow_unsigned_extensions=true`.
+For duckdb-wasm, opt in explicitly when opening the database:
+
+```js
+await db.open({ allowUnsignedExtensions: true });
+```
+
+The loader checks `current_setting('allow_unsigned_extensions')`; it never enables it.
+Unsigned extensions are not authenticated by DuckDB's community signature. Only opt in
+when you trust the pinned commit and artifact checksums; enabling the setting applies
+to the database, not just DuckHTS. The staging script verifies each download's sha256
+against `artifacts-dev.json` before packaging. The pinned GitHub Actions run's artifacts
+expire (90 days by default, subject to repository retention settings). The dev pin is
+refreshed with each X.Y.Z.9NNN development version bump. A fresh staging run cannot
+download an expired pin; already verified local `dist` files still work offline. Once
+published to npm, the package tarball retains the verified binaries permanently.
+
+## Use
+
+```sh
+npm install duckhts@latest @duckdb/duckdb-wasm@1.33.1-dev57.0
+```
+
+Serve `node_modules/duckhts/dist/` with the rest of your static files (for example by
+copying it to `vendor/duckhts/`), then:
+
+```js
+import { loadDuckhts, SIGNED } from "duckhts";
+
+const conn = await db.connect();
+await loadDuckhts(conn, { baseUrl: "/vendor/duckhts/" });
+
+const peaks = await conn.query(
+  `SELECT chrom, start, "end" FROM read_bed('${location.origin}/data/peaks.bed')`,
+);
+```
+
+`loadDuckhts` runs `PRAGMA platform` and loads
+`<baseUrl>/<platform>/duckhts.duckdb_extension.wasm` for `wasm_mvp`, `wasm_eh` or
+`wasm_threads`. The SQL functions are documented in the
+[function catalog](https://github.com/RGenomicsETL/duckhts/blob/main/r/Rduckhts/inst/function_catalog/functions.md).
+
+## Runtime support
+
+The peer range is `1.33.1-dev57.0 || >=1.33.1`: the one tested prerelease, or any stable
+release from 1.33.1. npm compares prerelease tags as text (`dev6` sorts after `dev57`),
+so a `>=` floor on a prerelease would admit older builds.
+
+| duckdb-wasm | DuckDB | Status |
+|---|---|---|
+| `1.33.1-dev57.0` | v1.5.4 | Both channels: HTTP readers; `dev` also reads `blob:` files after unsigned opt-in |
+| `1.32.0` | v1.4.3 | `dev` loads; signed DuckHTS 1.5.2 fails: https://github.com/RGenomicsETL/duckhts/issues/247 |
+
+## Browser file access
+
+DuckHTS reads files through htslib using worker-synchronous XHR. Same-origin HTTP URLs
+work, and cross-origin URLs need permissive CORS.
+
+### Local files
+
+DuckHTS builds from https://github.com/RGenomicsETL/duckhts/pull/248 onward read
+`blob:` object URLs, so a page can pass a dropped or picked `File` straight to a reader.
+The URL is a capability, not a path: unguessable, read-only, scoped to the page that
+created it, and revocable. Any `Blob` the page holds works the same way: a file from
+`<input type="file">` or a drop event, an OPFS file (`handle.getFile()`), a Blob kept in
+IndexedDB, or bytes the page fetched with its own credentials. SQL stays the same:
+`read_bed(url)` does not care where the bytes came from, just as native builds read
+paths, `data:` URLs and `/dev/fd/N`.
+
+The `dev` binaries include the handler. `localFileUrl(file)` creates an object URL and
+returns `{ url, revoke }`. Keep it live while queries use it, then revoke it:
+
+```js
+import { localFileUrl, SIGNED } from "duckhts";
+
+if (!SIGNED) {
+  const local = localFileUrl(fileInput.files[0]);
+  try {
+    const rows = await conn.query(`SELECT chrom, start, "end" FROM read_bed('${local.url}')`);
+  } finally {
+    local.revoke();
+  }
+}
+```
+
+On `latest` (DuckHTS 1.5.2), `localFileUrl` throws because the signed binaries predate
+the handler. `SIGNED` lets applications select a supported input path.
+
+Keep the URL live until every query or result stream using it finishes, including
+queries against views that retain it. Object URLs have no sibling filenames: automatic
+index discovery falls back to streaming, and a region query needs a second URL for the
+index passed as `index_path := '<index blob URL>'`. If a transport ignores Range, the
+backend caches the full response in JavaScript, which costs browser memory
+proportional to the file size.
+
+Files registered with duckdb-wasm (`registerFileBuffer`, `registerFileHandle`,
+`registerFileText`) remain **invisible** to DuckHTS readers. The file-system integration
+is a separate option in https://github.com/RGenomicsETL/duckhts/issues/246.
+
+## Development
+
+```sh
+npm ci
+npm test               # loader, local-file helper and staging tests, offline (signed)
+DUCKHTS_NPM_CHANNEL=dev npm test
+DUCKHTS_NPM_CHANNEL=signed npm run test:browser
+DUCKHTS_NPM_CHANNEL=dev npm run test:browser
+DUCKHTS_NPM_CHANNEL=dev npm run check:version
+```
+
+Render this README with `Rscript -e 'knitr::knit("js/README.Rmd", "js/README.md")'`
+from the repository root. Local-extension blob tests run through `make wasm-playwright-test`.
+
+Set `DUCKHTS_NPM_CHANNEL=signed|dev` for staging, browser tests and packaging.
+`npm run stage` is the only network step; `npm pack` and `npm publish` run it through
+`prepack`. To stage your own wasm binaries, build from source using the repository
+[local duckdb-wasm setup](../README.md#browser-wasmduckdb-wasm-local-setup) or the
+`wasm-playwright-test` target in the root Makefile (both describe a `wasm_eh` build).
+Provide a checksum-pinned dev manifest with all three platform entries and an offline
+download tree with each artifact name as a directory containing
+`duckhts.duckdb_extension.wasm`:
+
+```sh
+node js/scripts/stage.mjs dev /path/to/my-artifacts.json /path/to/output /path/to/gh-download
+```
+
+The output directory is explicit for a custom manifest; staging verifies the sha256 of
+every file before writing it. For the pinned manifest, use
+`node js/scripts/stage.mjs dev js/artifacts-dev.json js/dist /path/to/gh-download`
+from the repository root. `npm run check:version` requires a matching version in
+`description.yml`, the selected manifest, `package.json` and `package-lock.json`.
+It accepts `-- <channel> <pr|publish>`; without a mode it uses strict publish checks.
+Pull requests check identity for the checkout's channel and skip the other channel's
+identity check while testing both runtimes. The publish workflow dispatch takes
+`channel=dev|signed` and `publish=true`; dispatch always requires the selected
+channel to match the checkout's version form.
+
+## Licence
+
+GPL-2.0-or-later: the GNU General Public License, version 2 or (at your option) any
+later version. See [`LICENSE`](LICENSE). The wasm binaries also contain HTSlib,
+htscodecs, libBigWig, cgranges, VariantKey, zlib, bzip2 and liblzma under their own
+licences, reproduced in [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md).

package/README.md

@@ -0,0 +1,160 @@
+# duckhts for duckdb-wasm
+
+The [DuckHTS](https://github.com/RGenomicsETL/duckhts) DuckDB extension, packaged for
+[`@duckdb/duckdb-wasm`](https://www.npmjs.com/package/@duckdb/duckdb-wasm), so a web
+application can serve the extension from its own origin instead of fetching it from the
+DuckDB community repository at runtime.
+
+Each npm release contains one pinned set of `.wasm` files, verified byte for byte against
+its channel's manifest before packaging. `SIGNED` reports which channel supplied them.
+
+## Channels
+
+| npm dist-tag | Install | Binary source | DuckHTS version |
+|---|---|---|---|
+| `latest` | `npm install duckhts@latest` | signed community repository (`artifacts.json`) | released version |
+| `dev` | `npm install duckhts@dev` | unsigned GitHub Actions run (`artifacts-dev.json`) | `1.5.2.9002` as npm `1.5.2-9002` |
+
+The `dev` loader refuses to load unless DuckDB has `allow_unsigned_extensions=true`.
+For duckdb-wasm, opt in explicitly when opening the database:
+
+```js
+await db.open({ allowUnsignedExtensions: true });
+```
+
+The loader checks `current_setting('allow_unsigned_extensions')`; it never enables it.
+Unsigned extensions are not authenticated by DuckDB's community signature. Only opt in
+when you trust the pinned commit and artifact checksums; enabling the setting applies
+to the database, not just DuckHTS. The staging script verifies each download's sha256
+against `artifacts-dev.json` before packaging. The pinned GitHub Actions run's artifacts
+expire (90 days by default, subject to repository retention settings). The dev pin is
+refreshed with each X.Y.Z.9NNN development version bump. A fresh staging run cannot
+download an expired pin; already verified local `dist` files still work offline. Once
+published to npm, the package tarball retains the verified binaries permanently.
+
+## Use
+
+```sh
+npm install duckhts@latest @duckdb/duckdb-wasm@1.33.1-dev57.0
+```
+
+Serve `node_modules/duckhts/dist/` with the rest of your static files (for example by
+copying it to `vendor/duckhts/`), then:
+
+```js
+import { loadDuckhts, SIGNED } from "duckhts";
+
+const conn = await db.connect();
+await loadDuckhts(conn, { baseUrl: "/vendor/duckhts/" });
+
+const peaks = await conn.query(
+  `SELECT chrom, start, "end" FROM read_bed('${location.origin}/data/peaks.bed')`,
+);
+```
+
+`loadDuckhts` runs `PRAGMA platform` and loads
+`<baseUrl>/<platform>/duckhts.duckdb_extension.wasm` for `wasm_mvp`, `wasm_eh` or
+`wasm_threads`. The SQL functions are documented in the
+[function catalog](https://github.com/RGenomicsETL/duckhts/blob/main/r/Rduckhts/inst/function_catalog/functions.md).
+
+## Runtime support
+
+The peer range is `1.33.1-dev57.0 || >=1.33.1`: the one tested prerelease, or any stable
+release from 1.33.1. npm compares prerelease tags as text (`dev6` sorts after `dev57`),
+so a `>=` floor on a prerelease would admit older builds.
+
+| duckdb-wasm | DuckDB | Status |
+|---|---|---|
+| `1.33.1-dev57.0` | v1.5.4 | Both channels: HTTP readers; `dev` also reads `blob:` files after unsigned opt-in |
+| `1.32.0` | v1.4.3 | `dev` loads; signed DuckHTS 1.5.2 fails: https://github.com/RGenomicsETL/duckhts/issues/247 |
+
+## Browser file access
+
+DuckHTS reads files through htslib using worker-synchronous XHR. Same-origin HTTP URLs
+work, and cross-origin URLs need permissive CORS.
+
+### Local files
+
+DuckHTS builds from https://github.com/RGenomicsETL/duckhts/pull/248 onward read
+`blob:` object URLs, so a page can pass a dropped or picked `File` straight to a reader.
+The URL is a capability, not a path: unguessable, read-only, scoped to the page that
+created it, and revocable. Any `Blob` the page holds works the same way: a file from
+`<input type="file">` or a drop event, an OPFS file (`handle.getFile()`), a Blob kept in
+IndexedDB, or bytes the page fetched with its own credentials. SQL stays the same:
+`read_bed(url)` does not care where the bytes came from, just as native builds read
+paths, `data:` URLs and `/dev/fd/N`.
+
+The `dev` binaries include the handler. `localFileUrl(file)` creates an object URL and
+returns `{ url, revoke }`. Keep it live while queries use it, then revoke it:
+
+```js
+import { localFileUrl, SIGNED } from "duckhts";
+
+if (!SIGNED) {
+  const local = localFileUrl(fileInput.files[0]);
+  try {
+    const rows = await conn.query(`SELECT chrom, start, "end" FROM read_bed('${local.url}')`);
+  } finally {
+    local.revoke();
+  }
+}
+```
+
+On `latest` (DuckHTS 1.5.2), `localFileUrl` throws because the signed binaries predate
+the handler. `SIGNED` lets applications select a supported input path.
+
+Keep the URL live until every query or result stream using it finishes, including
+queries against views that retain it. Object URLs have no sibling filenames: automatic
+index discovery falls back to streaming, and a region query needs a second URL for the
+index passed as `index_path := '<index blob URL>'`. If a transport ignores Range, the
+backend caches the full response in JavaScript, which costs browser memory
+proportional to the file size.
+
+Files registered with duckdb-wasm (`registerFileBuffer`, `registerFileHandle`,
+`registerFileText`) remain **invisible** to DuckHTS readers. The file-system integration
+is a separate option in https://github.com/RGenomicsETL/duckhts/issues/246.
+
+## Development
+
+```sh
+npm ci
+npm test               # loader, local-file helper and staging tests, offline (signed)
+DUCKHTS_NPM_CHANNEL=dev npm test
+DUCKHTS_NPM_CHANNEL=signed npm run test:browser
+DUCKHTS_NPM_CHANNEL=dev npm run test:browser
+DUCKHTS_NPM_CHANNEL=dev npm run check:version
+```
+
+Render this README with `Rscript -e 'knitr::knit("js/README.Rmd", "js/README.md")'`
+from the repository root. Local-extension blob tests run through `make wasm-playwright-test`.
+
+Set `DUCKHTS_NPM_CHANNEL=signed|dev` for staging, browser tests and packaging.
+`npm run stage` is the only network step; `npm pack` and `npm publish` run it through
+`prepack`. To stage your own wasm binaries, build from source using the repository
+[local duckdb-wasm setup](../README.md#browser-wasmduckdb-wasm-local-setup) or the
+`wasm-playwright-test` target in the root Makefile (both describe a `wasm_eh` build).
+Provide a checksum-pinned dev manifest with all three platform entries and an offline
+download tree with each artifact name as a directory containing
+`duckhts.duckdb_extension.wasm`:
+
+```sh
+node js/scripts/stage.mjs dev /path/to/my-artifacts.json /path/to/output /path/to/gh-download
+```
+
+The output directory is explicit for a custom manifest; staging verifies the sha256 of
+every file before writing it. For the pinned manifest, use
+`node js/scripts/stage.mjs dev js/artifacts-dev.json js/dist /path/to/gh-download`
+from the repository root. `npm run check:version` requires a matching version in
+`description.yml`, the selected manifest, `package.json` and `package-lock.json`.
+It accepts `-- <channel> <pr|publish>`; without a mode it uses strict publish checks.
+Pull requests check identity for the checkout's channel and skip the other channel's
+identity check while testing both runtimes. The publish workflow dispatch takes
+`channel=dev|signed` and `publish=true`; dispatch always requires the selected
+channel to match the checkout's version form.
+
+## Licence
+
+GPL-2.0-or-later: the GNU General Public License, version 2 or (at your option) any
+later version. See [`LICENSE`](LICENSE). The wasm binaries also contain HTSlib,
+htscodecs, libBigWig, cgranges, VariantKey, zlib, bzip2 and liblzma under their own
+licences, reproduced in [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md).

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,388 @@
+# Third-party notices
+
+The `duckhts.duckdb_extension.wasm` files in this package are the DuckHTS DuckDB extension compiled for duckdb-wasm. DuckHTS itself is distributed here under the GNU General Public License, version 2 or (at your option) any later version; see `LICENSE`. The binaries also contain the components below, each under its own licence, reproduced verbatim from the source named for it. The component list comes from the wasm build's link inputs (`libhts.a`, `libz.a`, `libbz2.a`, `liblzma.a`, and DuckHTS's own sources including the vendored cgranges, libBigWig and VariantKey code).
+
+DuckHTS also contains a computational subset ported from Somalier v0.3.4 (Brent Pedersen and contributors, MIT), and is compiled against the DuckDB C API headers (DuckDB contributors, MIT); no Somalier or DuckDB source files are bundled.
+
+## HTSlib
+
+- Copyright: Genome Research Ltd and contributors
+- Licence: MIT/Expat outside `cram/`; Modified BSD 3-Clause for `cram/`
+- Text from: third_party/htslib/LICENSE
+
+```text
+[Files in this distribution outwith the cram/ subdirectory are distributed
+according to the terms of the following MIT/Expat license.]
+
+The MIT/Expat License
+
+Copyright (C) 2012-2026 Genome Research Ltd.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
+
+[Files within the cram/ subdirectory in this distribution are distributed
+according to the terms of the following Modified 3-Clause BSD license.]
+
+The Modified-BSD License
+
+Copyright (C) 2012-2026 Genome Research Ltd.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice,
+   this list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+3. Neither the names Genome Research Ltd and Wellcome Trust Sanger Institute
+   nor the names of its contributors may be used to endorse or promote products
+   derived from this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY GENOME RESEARCH LTD AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL GENOME RESEARCH LTD OR ITS CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+[The use of a range of years within a copyright notice in this distribution
+should be interpreted as being equivalent to a list of years including the
+first and last year specified and all consecutive years between them.
+
+For example, a copyright notice that reads "Copyright (C) 2005, 2007-2009,
+2011-2012" should be interpreted as being identical to a notice that reads
+"Copyright (C) 2005, 2007, 2008, 2009, 2011, 2012" and a copyright notice
+that reads "Copyright (C) 2005-2012" should be interpreted as being identical
+to a notice that reads "Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010,
+2011, 2012".]
+```
+
+## htscodecs (bundled with HTSlib)
+
+- Copyright: Genome Research Ltd and contributors
+- Licence: BSD 3-Clause (see text for exceptions)
+- Text from: third_party/htslib/htscodecs/LICENSE.md
+
+```text
+All files except those explicitly listed below are copyright Genome
+Research Limited and are made available under the BSD license.
+
+> Redistribution and use in source and binary forms, with or without
+> modification, are permitted provided that the following conditions
+> are met:
+> 
+>     (1) Redistributions of source code must retain the above copyright
+>     notice, this list of conditions and the following disclaimer. 
+> 
+>     (2) Redistributions in binary form must reproduce the above copyright
+>     notice, this list of conditions and the following disclaimer in
+>     the documentation and/or other materials provided with the distribution.  
+>     
+>     (3)The name of the author may not be used to endorse or promote
+>     products derived from this software without specific prior written
+>     permission.
+> 
+> THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+> IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+> WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+> DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT,
+> INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+> (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+> SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+> HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+> STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
+> IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+> POSSIBILITY OF SUCH DAMAGE. 
+
+c_range_coder.h is Public Domain, derived from work by Eugene
+Shelwien.
+
+rANS_byte.h and rANS_word.h are derived from Fabien Giesen's work and
+is Public Domain.  https://github.com/rygorous/ryg_rans This work was
+in turn based on the ANS family of entropy encoders as described by
+Jarek Duda's paper: http://arxiv.org/abs/1311.2540
+
+> To the extent possible under law, Fabian Giesen has waived all
+> copyright and related or neighboring rights to ryg_rans, as
+> per the terms of the CC0 license:
+> 
+>   https://creativecommons.org/publicdomain/zero/1.0
+> 
+> This work is published from the United States.
+```
+
+## libBigWig
+
+- Copyright: Devon Ryan
+- Licence: MIT
+- Text from: third_party/libBigWig/LICENSE
+
+```text
+The MIT License (MIT)
+
+Copyright (c) 2015 Devon Ryan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+## cgranges
+
+- Copyright: Dana-Farber Cancer Institute (Heng Li)
+- Licence: MIT
+- Text from: third_party/cgranges/cgranges.h (header)
+
+```text
+The MIT License
+
+   Copyright (c) 2019 Dana-Farber Cancer Institute
+
+   Permission is hereby granted, free of charge, to any person obtaining
+   a copy of this software and associated documentation files (the
+   "Software"), to deal in the Software without restriction, including
+   without limitation the rights to use, copy, modify, merge, publish,
+   distribute, sublicense, and/or sell copies of the Software, and to
+   permit persons to whom the Software is furnished to do so, subject to
+   the following conditions:
+
+   The above copyright notice and this permission notice shall be
+   included in all copies or substantial portions of the Software.
+
+   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+   EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+   NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+   BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+   ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+   CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+   SOFTWARE.
+```
+
+## VariantKey / RegionKey
+
+- Copyright: Nicola Asuni and contributors
+- Licence: MIT
+- Text from: third_party/variantkey/LICENSE
+
+```text
+MIT LICENSE
+
+Copyright (c) 2017-2019, 2023 GENOMICS plc
+Copyright (c) 2017-2018 Nicola Asuni - Tecnick.com (binsearch)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+```
+
+## zlib 1.3.1
+
+- Copyright: Jean-loup Gailly and Mark Adler
+- Licence: Zlib
+- Text from: vcpkg zlib (wasm32-emscripten) copyright file
+
+```text
+Copyright notice:
+
+ (C) 1995-2022 Jean-loup Gailly and Mark Adler
+
+  This software is provided 'as-is', without any express or implied
+  warranty.  In no event will the authors be held liable for any damages
+  arising from the use of this software.
+
+  Permission is granted to anyone to use this software for any purpose,
+  including commercial applications, and to alter it and redistribute it
+  freely, subject to the following restrictions:
+
+  1. The origin of this software must not be misrepresented; you must not
+     claim that you wrote the original software. If you use this software
+     in a product, an acknowledgment in the product documentation would be
+     appreciated but is not required.
+  2. Altered source versions must be plainly marked as such, and must not be
+     misrepresented as being the original software.
+  3. This notice may not be removed or altered from any source distribution.
+
+  Jean-loup Gailly        Mark Adler
+  jloup@gzip.org          madler@alumni.caltech.edu
+```
+
+## bzip2 1.0.8
+
+- Copyright: Julian Seward
+- Licence: bzip2-1.0.6
+- Text from: vcpkg bzip2 (wasm32-emscripten) copyright file
+
+```text
+--------------------------------------------------------------------------
+
+This program, "bzip2", the associated library "libbzip2", and all
+documentation, are copyright (C) 1996-2019 Julian R Seward.  All
+rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+
+2. The origin of this software must not be misrepresented; you must 
+   not claim that you wrote the original software.  If you use this 
+   software in a product, an acknowledgment in the product 
+   documentation would be appreciated but is not required.
+
+3. Altered source versions must be plainly marked as such, and must
+   not be misrepresented as being the original software.
+
+4. The name of the author may not be used to endorse or promote 
+   products derived from this software without specific prior written 
+   permission.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
+OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
+GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
+WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
+NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Julian Seward, jseward@acm.org
+bzip2/libbzip2 version 1.0.8 of 13 July 2019
+
+--------------------------------------------------------------------------
+```
+
+## liblzma (XZ Utils) 5.8.1
+
+- Copyright: Lasse Collin and contributors
+- Licence: 0BSD for liblzma (see text)
+- Text from: vcpkg liblzma (wasm32-emscripten) copyright file
+
+```text
+XZ Utils Licensing
+==================
+
+    Different licenses apply to different files in this package. Here
+    is a summary of which licenses apply to which parts of this package:
+
+      - liblzma is under the BSD Zero Clause License (0BSD).
+
+      - The command line tools xz, xzdec, lzmadec, and lzmainfo are
+        under 0BSD except that, on systems that don't have a usable
+        getopt_long, GNU getopt_long is compiled and linked in from the
+        'lib' directory. The getopt_long code is under GNU LGPLv2.1+.
+
+      - The scripts to grep, diff, and view compressed files have been
+        adapted from GNU gzip. These scripts (xzgrep, xzdiff, xzless,
+        and xzmore) are under GNU GPLv2+. The man pages of the scripts
+        are under 0BSD; they aren't based on the man pages of GNU gzip.
+
+      - Most of the XZ Utils specific documentation that is in
+        plain text files (like README, INSTALL, PACKAGERS, NEWS,
+        and ChangeLog) are under 0BSD unless stated otherwise in
+        the file itself. The files xz-file-format.txt and
+        lzma-file-format.xt are in the public domain but may
+        be distributed under the terms of 0BSD too.
+
+      - Translated messages and man pages are under 0BSD except that
+        some old translations are in the public domain.
+
+      - Test files and test code in the 'tests' directory, and
+        debugging utilities in the 'debug' directory are under
+        the BSD Zero Clause License (0BSD).
+
+      - The GNU Autotools based build system contains files that are
+        under GNU GPLv2+, GNU GPLv3+, and a few permissive licenses.
+        These files don't affect the licensing of the binaries being
+        built.
+
+      - The 'extra' directory contains files that are under various
+        free software licenses. These aren't built or installed as
+        part of XZ Utils.
+
+    The following command may be helpful in finding per-file license
+    information. It works on xz.git and on a clean file tree extracted
+    from a release tarball.
+
+        sh build-aux/license-check.sh -v
+
+    For the files under the BSD Zero Clause License (0BSD), if
+    a copyright notice is needed, the following is sufficient:
+
+        Copyright (C) The XZ Utils authors and contributors
+
+    If you copy significant amounts of 0BSD-licensed code from XZ Utils
+    into your project, acknowledging this somewhere in your software is
+    polite (especially if it is proprietary, non-free software), but
+    it is not legally required by the license terms. Here is an example
+    of a good notice to put into "about box" or into documentation:
+
+        This software includes code from XZ Utils <https://tukaani.org/xz/>.
+
+    The following license texts are included in the following files:
+      - COPYING.0BSD: BSD Zero Clause License
+      - COPYING.LGPLv2.1: GNU Lesser General Public License version 2.1
+      - COPYING.GPLv2: GNU General Public License version 2
+      - COPYING.GPLv3: GNU General Public License version 3
+
+    If you have questions, don't hesitate to ask for more information.
+    The contact information is in the README file.
+```

package/artifacts-dev.json

@@ -0,0 +1,24 @@
+{
+  "duckhts": "1.5.2.9002",
+  "signed": false,
+  "source": {
+    "repository": "RGenomicsETL/duckhts",
+    "run": 36251218841,
+    "commit": "3e47da128d301dbf908d8052e778a9d8a8b5df48",
+    "url": "https://github.com/RGenomicsETL/duckhts/actions/runs/36251218841"
+  },
+  "platforms": {
+    "wasm_mvp": {
+      "artifact": "duckhts-v1.5.0-extension-wasm_mvp",
+      "sha256": "38a1f94963e911f17d3ea498cfbacf5f151e8ae487958f52a53328d5b9fd73b5"
+    },
+    "wasm_eh": {
+      "artifact": "duckhts-v1.5.0-extension-wasm_eh",
+      "sha256": "f9d5ece2f930717c48efe0b960f13817d37eb6389333a9d72a64c41c3fdc165f"
+    },
+    "wasm_threads": {
+      "artifact": "duckhts-v1.5.0-extension-wasm_threads",
+      "sha256": "f6e8234ad40cdd1cd948fc9fd2391fd3accc97f7830042024107072dafb2b0cd"
+    }
+  }
+}

package/artifacts.json

@@ -0,0 +1,11 @@
+{
+  "duckhts": "1.5.2",
+  "source": "https://community-extensions.duckdb.org/v1.5.5",
+  "abi": "C_STRUCT",
+  "minimum_duckdb": "v1.2.0",
+  "platforms": {
+    "wasm_mvp": "b10b0e3aa9b4ed4a5301321578224a21f8528e45bd5b09a9141bc2b14a36b81c",
+    "wasm_eh": "2dc20d6cb8c85340c64a8cb3af728e343cca46c0bef356fe139ce9379e2ab7dd",
+    "wasm_threads": "74fd1176620bd4914123dbb16663cdca3d3559a516b1491403b9db5eef84a493"
+  }
+}

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "duckhts",
+  "version": "1.5.2-9002",
+  "description": "DuckHTS DuckDB extension for duckdb-wasm: read HTS formats (BAM, CRAM, VCF, BCF, FASTA, FASTQ, GFF, GTF, BED, GenBank, bigWig, tabix) with SQL in the browser",
+  "type": "module",
+  "license": "GPL-2.0-or-later",
+  "author": "Sounkou Mahamane Toure",
+  "homepage": "https://github.com/RGenomicsETL/duckhts/tree/main/js#readme",
+  "bugs": "https://github.com/RGenomicsETL/duckhts/issues",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/RGenomicsETL/duckhts.git",
+    "directory": "js"
+  },
+  "keywords": [
+    "duckdb",
+    "duckdb-wasm",
+    "duckdb-extension",
+    "htslib",
+    "genomics",
+    "bioinformatics",
+    "bam",
+    "vcf",
+    "gff",
+    "genbank"
+  ],
+  "exports": {
+    ".": {
+      "types": "./src/index.d.ts",
+      "default": "./src/index.js"
+    },
+    "./dist/*": "./dist/*"
+  },
+  "files": [
+    "src",
+    "dist",
+    "artifacts.json",
+    "artifacts-dev.json",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md"
+  ],
+  "scripts": {
+    "stage": "node scripts/stage.mjs",
+    "prepack": "node scripts/stage.mjs",
+    "pretest": "node scripts/channel.mjs",
+    "test": "node --test test/*.test.mjs",
+    "test:browser": "node scripts/stage.mjs && playwright test --config test/browser/playwright.config.mjs",
+    "check:version": "node scripts/check-version.mjs"
+  },
+  "peerDependencies": {
+    "@duckdb/duckdb-wasm": "1.33.1-dev57.0 || >=1.33.1"
+  },
+  "peerDependenciesMeta": {
+    "@duckdb/duckdb-wasm": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "devDependencies": {
+    "@playwright/test": "1.60.0",
+    "duckdb-wasm-next": "npm:@duckdb/duckdb-wasm@1.33.1-dev57.0",
+    "duckdb-wasm-stable": "npm:@duckdb/duckdb-wasm@1.32.0"
+  }
+}

package/src/channel.js

@@ -0,0 +1,3 @@
+// Generated by scripts/channel.mjs for the dev channel.
+export const SIGNED = false;
+export const BLOB_CAPABLE = true;

package/src/index.d.ts

@@ -0,0 +1,29 @@
+export type DuckhtsPlatform = "wasm_mvp" | "wasm_eh" | "wasm_threads";
+
+export declare const SIGNED: boolean;
+
+/** Create a revocable object URL for a blob-capable build; unavailable on the signed channel. */
+export declare function localFileUrl(file: Blob): { url: string; revoke(): void };
+
+export declare const EXTENSION_FILE: "duckhts.duckdb_extension.wasm";
+
+export declare const PLATFORMS: readonly DuckhtsPlatform[];
+
+/** URL of the DuckHTS binary for `platform` under `baseUrl`. */
+export declare function extensionUrl(baseUrl: string | URL, platform: string): string;
+
+/** The subset of an `AsyncDuckDBConnection` the loader uses. */
+export interface QueryableConnection {
+  query(sql: string): Promise<{ toArray(): Array<Record<string, unknown>> }>;
+}
+
+/**
+ * Run `PRAGMA platform` on `conn` and `LOAD` the matching DuckHTS binary from
+ * `baseUrl`, the directory where the application serves this package's `dist/`.
+ * The dev channel requires `allow_unsigned_extensions=true` on the connection
+ * before loading; this function never changes that setting.
+ */
+export declare function loadDuckhts(
+  conn: QueryableConnection,
+  options: { baseUrl: string | URL },
+): Promise<{ platform: DuckhtsPlatform }>;

package/src/index.js

@@ -0,0 +1,51 @@
+// Load the DuckHTS extension into a duckdb-wasm connection from a URL the
+// application controls, so no request leaves the application's own origin.
+//
+// `baseUrl` is the directory holding <platform>/duckhts.duckdb_extension.wasm,
+// i.e. wherever the application serves this package's dist/ directory.
+
+import { BLOB_CAPABLE, SIGNED } from "./channel.js";
+import { localFileUrl as createLocalFileUrl } from "./local-file.js";
+
+export { SIGNED };
+
+export function localFileUrl(file) {
+  if (!BLOB_CAPABLE) throw new Error("duckhts: localFileUrl requires a blob-capable build; this signed build does not support blob: URLs");
+  return createLocalFileUrl(file);
+}
+
+export const EXTENSION_FILE = "duckhts.duckdb_extension.wasm";
+
+export const PLATFORMS = Object.freeze(["wasm_mvp", "wasm_eh", "wasm_threads"]);
+
+export function extensionUrl(baseUrl, platform) {
+  if (!PLATFORMS.includes(platform)) {
+    throw new Error(
+      `duckhts: no wasm build for DuckDB platform '${platform}'; ` +
+        `this package ships ${PLATFORMS.join(", ")}`,
+    );
+  }
+  const base = new URL(baseUrl, globalThis.location?.href);
+  if (!base.pathname.endsWith("/")) base.pathname += "/";
+  return new URL(`${platform}/${EXTENSION_FILE}`, base).href;
+}
+
+function sqlString(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+
+export async function loadDuckhts(conn, { baseUrl }) {
+  if (baseUrl === undefined) {
+    throw new Error("duckhts: loadDuckhts(conn, { baseUrl }) requires baseUrl");
+  }
+  if (!SIGNED) {
+    const setting = await conn.query("SELECT current_setting('allow_unsigned_extensions') AS enabled");
+    if (setting.toArray()[0]?.enabled !== true) {
+      throw new Error("duckhts: dev channel requires allow_unsigned_extensions=true before loadDuckhts; configure DuckDB to allow unsigned extensions explicitly");
+    }
+  }
+  const result = await conn.query("PRAGMA platform");
+  const platform = String(result.toArray()[0].platform);
+  await conn.query(`LOAD ${sqlString(extensionUrl(baseUrl, platform))}`);
+  return { platform };
+}

package/src/local-file.js

@@ -0,0 +1,9 @@
+// Object URLs for browser Files and Blobs, for DuckHTS readers built with the
+// Emscripten blob: handler (https://github.com/RGenomicsETL/duckhts/pull/248).
+//
+// The caller owns the URL. Keep it live until every query or stream using it
+// has finished, including queries against views that retain the URL.
+export function localFileUrl(file) {
+  const url = URL.createObjectURL(file);
+  return { url, revoke: () => URL.revokeObjectURL(url) };
+}