deps(better-sqlite3): move to the N-API 13.x line and stop ABI rebuilds

[mrsibe]

What

better-sqlite3 12.11.1 → 13.0.3, plus the packaging change that makes the upgrade actually pay off.

Why this is not just a version bump

better-sqlite3 12.x ships one ABI-specific binary per Node/Electron version and downloads it with prebuild-install. Its published prebuilds stop at electron-v146:

Electron	ABI	12.11.1 prebuild?
42	146	✅ last one published
43	148	❌
44	149	❌

(v12.12.0 would have had an ABI 148 asset, but it was never published to npm — npm view better-sqlite3@12.12.0 is a 404.)

So on Electron 44 electron-builder install-app-deps found no prebuild and fell back to node-gyp rebuild --build-from-source, which needs Python + MSVC:

Error: Could not find any Python installation to use
  at PythonFinder.fail (.../node-gyp/lib/find-python.js:300:11)
  ⨯ node-gyp failed to rebuild 'node_modules/better-sqlite3'

CI runners and Linux have that toolchain, which is exactly why every CI check was green while a plain Windows dev machine could not npm install.

The fix

13.x is N-API and ships a prebuild per platform/arch inside the npm package (prebuilds/win32-x64.node, darwin-arm64.node, …), with no install script. N-API binaries are stable across Node and Electron, so nothing needs rebuilding:

• better-sqlite3 → ^13.0.3
• Removed the postinstall hook. electron-builder install-app-deps ignores npmRebuild and always rebuilds (verified in app-builder-lib/out/util/yarn.js, installOrRebuild → rebuild), so the flag alone would not have unblocked npm install.
• npmRebuild: false in electron-builder.yml, with the reasoning recorded there. Every native dependency here is now N-API: better-sqlite3 (package prebuilds), onnxruntime-node (bin/napi-v6/<platform>/<arch>, napi_versions: [6]), sharp (@img/sharp-*), @napi-rs/canvas. Rebuilding can now only replace a correct prebuild with a locally compiled one — and it was the thing demanding a toolchain.
• Net effect: npm install no longer compiles anything, on any platform.

A trap this would have hit on the first release

release.yml asserted the unpacked artifact contains better_sqlite3.node. That filename no longer exists (13.x uses prebuilds/<platform>-<arch>.node), so the macOS release check would have failed the first tagged release with "better_sqlite3.node was not unpacked". It now asserts a better-sqlite3/prebuilds/*.node file. Verified the old build/Release/better_sqlite3.node really is gone.

Docs corrected where the N-API change made them false: CONTRIBUTING (no toolchain needed), docs/dependency-audit.md ("rebuilt against the Electron ABI / cannot load in plain Node", and SQLite 3.53.2 → 3.53.4), the smokeTest.ts comment, and the entitlements comment.

Verified (Linux x64, WSL2)

Check	Result
npm install	13.0.3 with prebuilds, no build/ directory → nothing compiled
npm run typecheck	clean
npm test	472/472 pass
npm run build:unpack	skipped dependencies rebuild reason=npmRebuild is set to false
npm run smoke:packaged	29 checks pass

From the packaged run:

[SmokeTest] ok   better-sqlite3 opened the database and loaded the sqlite-vec extension
[SmokeTest] ok   FTS5 is available and ranks: sqlite 3.53.4, ENABLE_FTS5 flag present
[SmokeTest] ok   sqlite-vec reports version v0.1.9
[SmokeTest] PASS - 29 checks passed

Left to CI, and the one thing to watch

macOS arm64 and Windows packaging. Cross-arch is the risk: npmRebuild: false means electron-builder does not rebuild for a target arch different from the host. It does not make cross-arch worse than before — @electron/rebuild never fetched sharp's or @napi-rs/canvas's target-arch prebuilds either — and better-sqlite3 now carries every platform/arch itself while onnxruntime-node ships all of them in one package. The release matrix builds each artifact on its own architecture. If a cross-arch build is ever added, this is the setting to revisit.

Separately noticed (not fixed here)

While measuring sizes: packaged onnxruntime-node is now ~416 MB, of which ~260 MB is libonnxruntime_providers_cuda.so. That predates this change (it is what npm ci installs on main) and is the "ships binaries for the wrong platform" follow-up already recorded in the audit — only much larger now. Recorded in the audit table so the stale 155 MB figure does not mislead.

Rollback

Revert the branch. No schema or storage-format change; better-sqlite3 13 still bundles SQLite 3.53.4 and the same on-disk format, and the packaged app re-reads existing databases unchanged.