From 99ceb89e484b4b375081cc035a72ef186cce5b82 Mon Sep 17 00:00:00 2001
From: Klagarge <remi@heredero.ch>
Date: Sat, 10 Oct 2026 21:01:20 +0200
Subject: [PATCH] refactor: move toolchain logic into scripts/

Assisted-by: Delta:zai-glm-5.3
---
 .gitignore           |  7 ++++++-
 Justfile             | 48 ++++++++++++++------------------------------
 scripts/bootstrap.sh | 43 +++++++++++++++++++++++++++++++++++++++
 scripts/calepin.sh   | 12 +++++++++++
 scripts/clean.sh     |  9 +++++++++
 5 files changed, 85 insertions(+), 34 deletions(-)
 create mode 100755 scripts/bootstrap.sh
 create mode 100755 scripts/calepin.sh
 create mode 100755 scripts/clean.sh

diff --git a/.gitignore b/.gitignore
index 0663bc0..0b71b18 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,10 @@
+# Generated site and pinned toolchain
 public/
 tools/
+
+# Calepin build artifacts
 .calepin/
-**/.calepin/
+.calepin-entry.*
+
+# IDE
 .idea/
diff --git a/Justfile b/Justfile
index 249c73f..9b8b42d 100644
--- a/Justfile
+++ b/Justfile
@@ -1,41 +1,23 @@
-calepin-version := "0.0.61"
-typst-version := "0.15.1"
-
-# Print available recipes
+# Show the available recipes
 default:
-	@just --list
+    @just --list
 
-# Download and verify the pinned toolchain
+# Bootstrap the pinned calepin + typst binaries into tools/
 tools:
-	mkdir -p tools
-	cd tools && \
-	if [ ! -f calepin ]; then \
-		curl -sL "https://github.com/vincentarelbundock/calepin/releases/download/v{{calepin-version}}/calepin-x86_64-unknown-linux-gnu.tar.xz" -o calepin-x86_64-unknown-linux-gnu.tar.xz; \
-		curl -sL "https://github.com/vincentarelbundock/calepin/releases/download/v{{calepin-version}}/calepin-x86_64-unknown-linux-gnu.tar.xz.sha256" -o calepin-x86_64-unknown-linux-gnu.tar.xz.sha256; \
-		sha256sum -c calepin-x86_64-unknown-linux-gnu.tar.xz.sha256; \
-		tar -xf calepin-x86_64-unknown-linux-gnu.tar.xz --strip-components=1 calepin-x86_64-unknown-linux-gnu/calepin; \
-		rm calepin-x86_64-unknown-linux-gnu.tar.xz calepin-x86_64-unknown-linux-gnu.tar.xz.sha256; \
-	fi
-	cd tools && \
-	if [ ! -f typst ]; then \
-		curl -sL "https://github.com/typst/typst/releases/download/v{{typst-version}}/typst-x86_64-unknown-linux-musl.tar.xz" -o typst.tar.xz; \
-		tar -xf typst.tar.xz --strip-components=1 typst-x86_64-unknown-linux-musl/typst; \
-		rm typst.tar.xz; \
-	fi
+    ./scripts/bootstrap.sh
 
-# Build the site
-build:
-	PATH="$PWD/tools:$PATH" calepin compile site public
+# Compile the site into public/
+build: tools
+    ./scripts/calepin.sh compile site public
 
-# Preview the site locally
-preview:
-	PATH="$PWD/tools:$PATH" calepin serve public
+# Build, then serve the site locally
+preview: build
+    ./scripts/calepin.sh serve public
 
-# Watch for changes and preview
-watch:
-	PATH="$PWD/tools:$PATH" calepin watch site public --serve
+# Rebuild on change and serve the result
+watch: tools
+    ./scripts/calepin.sh watch site public --serve
 
-# Clean the output directory
+# Remove generated output and build caches
 clean:
-	rm -rf public
-
+    ./scripts/clean.sh
diff --git a/scripts/bootstrap.sh b/scripts/bootstrap.sh
new file mode 100755
index 0000000..363725c
--- /dev/null
+++ b/scripts/bootstrap.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Bootstrap the pinned toolchain (Calepin + Typst) into tools/.
+# Idempotent: skips downloads when the binaries are already in place.
+set -euo pipefail
+
+# Pinned toolchain -- bump both binaries together and re-verify checksums.
+calepin_version="0.0.61"
+typst_version="0.15.1"
+# Typst publishes no .sha256 assets; this digest comes from the official
+# release metadata (GitHub asset digest of typst-x86_64-unknown-linux-musl.tar.xz).
+typst_sha256="a6d077d0a95eed5a2eba715b2dae06be954f624ccbf85758a03f389ded33118c"
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+tools="$root/tools"
+
+if [ "$(uname -m)" != "x86_64" ]; then
+    echo "error: unsupported architecture $(uname -m), pinned binaries are x86_64" >&2
+    exit 1
+fi
+
+mkdir -p "$tools"
+
+if [ ! -x "$tools/calepin" ]; then
+    name="calepin-x86_64-unknown-linux-gnu.tar.xz"
+    base="https://github.com/vincentarelbundock/calepin/releases/download/v$calepin_version"
+    curl -fsSLo "$tools/$name" "$base/$name"
+    curl -fsSLo "$tools/$name.sha256" "$base/$name.sha256"
+    (cd "$tools" && sha256sum -c "$name.sha256")
+    tar -xJf "$tools/$name" -C "$tools" --strip-components=1 "calepin-x86_64-unknown-linux-gnu/calepin"
+    rm "$tools/$name" "$tools/$name.sha256"
+fi
+
+if [ ! -x "$tools/typst" ]; then
+    name="typst-x86_64-unknown-linux-musl.tar.xz"
+    curl -fsSLo "$tools/$name" "https://github.com/typst/typst/releases/download/v$typst_version/$name"
+    echo "$typst_sha256  $name" > "$tools/$name.sha256"
+    (cd "$tools" && sha256sum -c "$name.sha256")
+    tar -xJf "$tools/$name" -C "$tools" --strip-components=1 "typst-x86_64-unknown-linux-musl/typst"
+    rm "$tools/$name" "$tools/$name.sha256"
+fi
+
+"$tools/calepin" --version
+"$tools/typst" --version
diff --git a/scripts/calepin.sh b/scripts/calepin.sh
new file mode 100755
index 0000000..b8ca051
--- /dev/null
+++ b/scripts/calepin.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Run the pinned Calepin CLI from tools/, bootstrapping the toolchain on demand.
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+if [ ! -x "$root/tools/calepin" ]; then
+    "$root/scripts/bootstrap.sh"
+fi
+
+export PATH="$root/tools:$PATH"
+exec "$root/tools/calepin" "$@"
diff --git a/scripts/clean.sh b/scripts/clean.sh
new file mode 100755
index 0000000..f51527e
--- /dev/null
+++ b/scripts/clean.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# Remove generated site output and build caches. Never touches tracked files.
+set -euo pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+rm -rf "$root/public"
+find "$root/site" -name '.calepin' -prune -exec rm -rf {} +
+find "$root/site" -type f -name '.calepin-entry.*' -delete