jsr can avoid native binary downloads

[andykais]

JSR has support for including arbitrary files in a published package https://jsr.io/docs/publishing-packages#filtering-files. That means you could avoid the fetch step during startup and remove two permissions needed during first launch (--allow-net, --allow-write). The actual config would look something like this:

  "publish": {
    "include": [
      "built_native_deps/**/*"
    ]
  }

The downside here is that until jsr has smarter retrieval logic, all native dependencies will be fetched by all platforms, so thats a tradeoff worth thinking about. Imo though this is the right direction rather than an implicit fetch step during first startup.

[DjDeveloperr]

The download size of sqlite on JSR would become quite huge if we add all platform binaries. Until there is smarter retrieval logic, I'm not sure about increasing the download size by that much. You can check the binaries size here: https://github.com/denodrivers/sqlite3/releases/tag/0.11.1 - all that being downloaded on all platforms will be not a good idea...

There might be ways around it... for example by publishing platform specific modules that contain just the binaries, and then dynamically import that platform specific module, which will put the binary in the cache, and then perhaps we can figure out how to obtain the location for that. Not sure how this plays with static analysis, but worth trying if it even works.

Node-API modules on NPM do something similar, they publish packages like {name}-darwin-arm64 etc, specify OS in package.json, add it as optional dependency in main bindings package.