@astrale-os/cli 1.0.0-beta.24 → 1.0.0-beta.26

package/dist/astrale.js

@@ -2578,7 +2578,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@astrale-os/cli",
-    version: "1.0.0-beta.24",
+    version: "1.0.0-beta.26",
     description: "Astrale CLI — connect to existing Astrale kernels",
     keywords: [
       "astrale",
@@ -86741,8 +86741,18 @@ async function json4(fetcher, url3, label) {
       cause
     });
   }
+  const body = await responseText(response2, label);
+  try {
+    return JSON.parse(body);
+  } catch (cause) {
+    throw new UiError("UI_REGISTRY_UNAVAILABLE", label + " returned malformed JSON.", undefined, {
+      cause
+    });
+  }
+}
+async function responseText(response2, label) {
   if (!response2.ok) {
-    throw new UiError("UI_REGISTRY_UNAVAILABLE", label + " returned HTTP " + response2.status + ".");
+    throw new UiError("UI_REGISTRY_UNAVAILABLE", label + " returned HTTP " + response2.status + ".", undefined, { cause: new HttpStatusError(response2.status) });
   }
   const declaredLength = Number(response2.headers.get("content-length"));
   if (Number.isFinite(declaredLength) && declaredLength > MAX_DOCUMENT_BYTES) {
@@ -86771,13 +86781,7 @@ async function json4(fetcher, url3, label) {
     body.set(chunk, offset);
     offset += chunk.byteLength;
   }
-  try {
-    return JSON.parse(new TextDecoder().decode(body));
-  } catch (cause) {
-    throw new UiError("UI_REGISTRY_UNAVAILABLE", label + " returned malformed JSON.", undefined, {
-      cause
-    });
-  }
+  return new TextDecoder().decode(body);
 }
 async function resolveUiRelease(requested, fetcher = fetch) {
   const versionDocument = requested ? { version: requested.replace(/^v/u, "") } : await json4(fetcher, NPM_PACKAGE + "/beta", "npm UI release");
@@ -86789,13 +86793,45 @@ async function resolveUiRelease(requested, fetcher = fetch) {
     throw new UiError("UI_REGISTRY_UNAVAILABLE", "Invalid UI beta release version: " + version2);
   }
   const ref = "v" + version2;
-  const reference4 = await json4(fetcher, GITHUB_API + "/git/ref/tags/" + encodeURIComponent(ref), "UI ref " + ref);
-  const commit = reference4.object.type === "commit" ? reference4.object.sha : (await json4(fetcher, reference4.object.url, "annotated UI tag " + ref)).object.sha;
+  const commit = await resolveReleaseCommit(ref, fetcher);
   if (!/^[0-9a-f]{40}$/u.test(commit)) {
     throw new UiError("UI_REGISTRY_UNAVAILABLE", "UI ref " + ref + " did not resolve to a commit.");
   }
   return readUiReleaseSnapshot({ version: version2, ref, commit }, fetcher);
 }
+async function resolveReleaseCommit(ref, fetcher) {
+  try {
+    const reference4 = await json4(fetcher, GITHUB_API + "/git/ref/tags/" + encodeURIComponent(ref), "UI ref " + ref);
+    return reference4.object.type === "commit" ? reference4.object.sha : (await json4(fetcher, reference4.object.url, "annotated UI tag " + ref)).object.sha;
+  } catch (cause) {
+    const status = cause instanceof UiError && cause.cause instanceof HttpStatusError ? cause.cause.status : undefined;
+    if (status !== 403 && status !== 429 && !(status !== undefined && status >= 500))
+      throw cause;
+  }
+  const label = "UI release " + ref;
+  let response2;
+  try {
+    response2 = await fetcher(GITHUB_WEB + "/releases/tag/" + encodeURIComponent(ref), {
+      headers: { accept: "text/html" }
+    });
+  } catch (cause) {
+    throw new UiError("UI_REGISTRY_UNAVAILABLE", "Unable to reach " + label + ".", undefined, {
+      cause
+    });
+  }
+  const html = await responseText(response2, label);
+  const marker = 'href="/astrale-os/ui/tree/' + ref + '"';
+  const markerOffset = html.lastIndexOf(marker);
+  const releaseHeader = markerOffset < 0 ? "" : html.slice(markerOffset, markerOffset + 8192);
+  const commits = new Set([
+    ...releaseHeader.matchAll(/data-hovercard-type=["']commit["'][^>]+href=["']\/astrale-os\/ui\/commit\/([0-9a-f]{40})["']/gu)
+  ].map((match) => match[1]));
+  const commit = commits.size === 1 ? commits.values().next().value : undefined;
+  if (!commit) {
+    throw new UiError("UI_REGISTRY_UNAVAILABLE", "UI ref " + ref + " did not resolve to a commit.");
+  }
+  return commit;
+}
 async function readUiReleaseSnapshot(identity3, fetcher = fetch) {
   const [compatibility, registry2] = await Promise.all([
     json4(fetcher, RAW + "/" + identity3.commit + "/tooling/compatibility.json", "UI compatibility metadata"),
@@ -86907,9 +86943,16 @@ function isSafeRelative2(value3) {
 function registryItemUrl(release, itemName) {
   return RAW + "/" + release.commit + "/registry/public/r/" + encodeURIComponent(itemName) + ".json";
 }
-var NPM_PACKAGE = "https://registry.npmjs.org/@astrale-os/ui", GITHUB_API = "https://api.github.com/repos/astrale-os/ui", RAW = "https://raw.githubusercontent.com/astrale-os/ui", MAX_DOCUMENT_BYTES = 1048576, MAX_REGISTRY_DOCUMENTS = 100;
+var NPM_PACKAGE = "https://registry.npmjs.org/@astrale-os/ui", GITHUB_API = "https://api.github.com/repos/astrale-os/ui", GITHUB_WEB = "https://github.com/astrale-os/ui", RAW = "https://raw.githubusercontent.com/astrale-os/ui", MAX_DOCUMENT_BYTES = 1048576, MAX_REGISTRY_DOCUMENTS = 100, HttpStatusError;
 var init_release = __esm(() => {
   init_model7();
+  HttpStatusError = class HttpStatusError extends Error {
+    status;
+    constructor(status) {
+      super("HTTP " + status);
+      this.status = status;
+    }
+  };
 });
 
 // src/ui/runner.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/cli",
-  "version": "1.0.0-beta.24",
+  "version": "1.0.0-beta.26",
   "description": "Astrale CLI — connect to existing Astrale kernels",
   "keywords": [
     "astrale",

package/src/ui/__tests__/ui.test.ts

@@ -330,6 +330,97 @@ describe('UI release and runner contracts', () => {
     )
   })
 
+  test('resolves the immutable release commit when the anonymous GitHub API is rate limited', async () => {
+    const seen: string[] = []
+    const fallback = mockFetch(seen)
+    const fetcher = (async (input: string | URL | Request, init?: RequestInit) => {
+      const url = String(input)
+      if (url.includes('/git/ref/tags/')) {
+        seen.push(url)
+        return Response.json({ message: 'API rate limit exceeded' }, { status: 403 })
+      }
+      if (url.includes('/releases/tag/')) {
+        seen.push(url)
+        return new Response(
+          `<a data-hovercard-type="commit" href="/astrale-os/ui/commit/${'b'.repeat(40)}">decoy</a>
+           <a href="/astrale-os/ui/tree/v0.3.0-beta.0">repository navigation</a>
+           ${'x'.repeat(35_000)}
+           <a href="/astrale-os/ui/tree/v0.3.0-beta.0">tag</a>
+           <a data-hovercard-type="commit" href="/astrale-os/ui/commit/${commit}">commit</a>`,
+          { headers: { 'content-type': 'text/html' } },
+        )
+      }
+      return fallback(input, init)
+    }) as typeof fetch
+
+    const release = await resolveUiRelease('0.3.0-beta.0', fetcher)
+
+    expect(release.commit).toBe(commit)
+    expect(seen).toContain('https://github.com/astrale-os/ui/releases/tag/v0.3.0-beta.0')
+    expect(seen).toContain(
+      'https://raw.githubusercontent.com/astrale-os/ui/' + commit + '/tooling/compatibility.json',
+    )
+  })
+
+  test('rejects a release page without an exact Astrale UI commit target', async () => {
+    const fetcher = (async (input: string | URL | Request) => {
+      const url = String(input)
+      if (url.includes('/git/ref/tags/')) return new Response('limited', { status: 403 })
+      if (url.includes('/releases/tag/')) return new Response('<main>release unavailable</main>')
+      throw new Error('release snapshot must not be fetched')
+    }) as typeof fetch
+
+    await expect(resolveUiRelease('0.3.0-beta.0', fetcher)).rejects.toMatchObject({
+      code: 'UI_REGISTRY_UNAVAILABLE',
+      message: 'UI ref v0.3.0-beta.0 did not resolve to a commit.',
+    })
+  })
+
+  test('does not replace an authoritative missing tag with release-page HTML', async () => {
+    const seen: string[] = []
+    const fetcher = (async (input: string | URL | Request) => {
+      const url = String(input)
+      seen.push(url)
+      if (url.includes('/git/ref/tags/')) return new Response('missing', { status: 404 })
+      throw new Error('release page must not be fetched')
+    }) as typeof fetch
+
+    await expect(resolveUiRelease('0.3.0-beta.0', fetcher)).rejects.toMatchObject({
+      code: 'UI_REGISTRY_UNAVAILABLE',
+      message: 'UI ref v0.3.0-beta.0 returned HTTP 404.',
+    })
+    expect(seen).toEqual(['https://api.github.com/repos/astrale-os/ui/git/ref/tags/v0.3.0-beta.0'])
+  })
+
+  test('bounds declared and streamed release-page HTML before reading a snapshot', async () => {
+    for (const oversized of [
+      new Response('large', { headers: { 'content-length': '1048577' } }),
+      new Response(
+        new ReadableStream({
+          start(controller) {
+            controller.enqueue(new Uint8Array(1_048_577))
+            controller.close()
+          },
+        }),
+      ),
+    ]) {
+      const seen: string[] = []
+      const fetcher = (async (input: string | URL | Request) => {
+        const url = String(input)
+        seen.push(url)
+        if (url.includes('/git/ref/tags/')) return new Response('limited', { status: 403 })
+        if (url.includes('/releases/tag/')) return oversized
+        throw new Error('release snapshot must not be fetched')
+      }) as typeof fetch
+
+      await expect(resolveUiRelease('0.3.0-beta.0', fetcher)).rejects.toMatchObject({
+        code: 'UI_REGISTRY_UNAVAILABLE',
+        message: 'UI release v0.3.0-beta.0 exceeds the supported response size.',
+      })
+      expect(seen).toHaveLength(2)
+    }
+  })
+
   test('admits a release theme as one canonical consumer-owned CSS target', async () => {
     const release = await resolveUiRelease('0.3.0-beta.0', themeFetch())
     expect(release.registry.items).toEqual([

package/src/ui/release.ts

@@ -2,11 +2,17 @@ import { UiError, type UiCompatibility, type UiRegistry, type UiRelease } from '
 
 const NPM_PACKAGE = 'https://registry.npmjs.org/@astrale-os/ui'
 const GITHUB_API = 'https://api.github.com/repos/astrale-os/ui'
+const GITHUB_WEB = 'https://github.com/astrale-os/ui'
 const RAW = 'https://raw.githubusercontent.com/astrale-os/ui'
 const MAX_DOCUMENT_BYTES = 1_048_576
 const MAX_REGISTRY_DOCUMENTS = 100
 
 type Fetch = typeof fetch
+class HttpStatusError extends Error {
+  constructor(readonly status: number) {
+    super('HTTP ' + status)
+  }
+}
 type RegistrySource = {
   name?: string
   homepage?: string
@@ -23,8 +29,24 @@ async function json<T>(fetcher: Fetch, url: string, label: string): Promise<T> {
       cause,
     })
   }
+  const body = await responseText(response, label)
+  try {
+    return JSON.parse(body) as T
+  } catch (cause) {
+    throw new UiError('UI_REGISTRY_UNAVAILABLE', label + ' returned malformed JSON.', undefined, {
+      cause,
+    })
+  }
+}
+
+async function responseText(response: Response, label: string): Promise<string> {
   if (!response.ok) {
-    throw new UiError('UI_REGISTRY_UNAVAILABLE', label + ' returned HTTP ' + response.status + '.')
+    throw new UiError(
+      'UI_REGISTRY_UNAVAILABLE',
+      label + ' returned HTTP ' + response.status + '.',
+      undefined,
+      { cause: new HttpStatusError(response.status) },
+    )
   }
   const declaredLength = Number(response.headers.get('content-length'))
   if (Number.isFinite(declaredLength) && declaredLength > MAX_DOCUMENT_BYTES) {
@@ -52,13 +74,7 @@ async function json<T>(fetcher: Fetch, url: string, label: string): Promise<T> {
     body.set(chunk, offset)
     offset += chunk.byteLength
   }
-  try {
-    return JSON.parse(new TextDecoder().decode(body)) as T
-  } catch (cause) {
-    throw new UiError('UI_REGISTRY_UNAVAILABLE', label + ' returned malformed JSON.', undefined, {
-      cause,
-    })
-  }
+  return new TextDecoder().decode(body)
 }
 
 export async function resolveUiRelease(
@@ -76,11 +92,19 @@ export async function resolveUiRelease(
     throw new UiError('UI_REGISTRY_UNAVAILABLE', 'Invalid UI beta release version: ' + version)
   }
   const ref = 'v' + version
-  const reference = await json<{
-    object: { type: 'commit' | 'tag'; sha: string; url: string }
-  }>(fetcher, GITHUB_API + '/git/ref/tags/' + encodeURIComponent(ref), 'UI ref ' + ref)
-  const commit =
-    reference.object.type === 'commit'
+  const commit = await resolveReleaseCommit(ref, fetcher)
+  if (!/^[0-9a-f]{40}$/u.test(commit)) {
+    throw new UiError('UI_REGISTRY_UNAVAILABLE', 'UI ref ' + ref + ' did not resolve to a commit.')
+  }
+  return readUiReleaseSnapshot({ version, ref, commit }, fetcher)
+}
+
+async function resolveReleaseCommit(ref: string, fetcher: Fetch): Promise<string> {
+  try {
+    const reference = await json<{
+      object: { type: 'commit' | 'tag'; sha: string; url: string }
+    }>(fetcher, GITHUB_API + '/git/ref/tags/' + encodeURIComponent(ref), 'UI ref ' + ref)
+    return reference.object.type === 'commit'
       ? reference.object.sha
       : (
           await json<{ object: { sha: string } }>(
@@ -89,10 +113,41 @@ export async function resolveUiRelease(
             'annotated UI tag ' + ref,
           )
         ).object.sha
-  if (!/^[0-9a-f]{40}$/u.test(commit)) {
+  } catch (cause) {
+    const status =
+      cause instanceof UiError && cause.cause instanceof HttpStatusError
+        ? cause.cause.status
+        : undefined
+    if (status !== 403 && status !== 429 && !(status !== undefined && status >= 500)) throw cause
+  }
+
+  const label = 'UI release ' + ref
+  let response: Response
+  try {
+    response = await fetcher(GITHUB_WEB + '/releases/tag/' + encodeURIComponent(ref), {
+      headers: { accept: 'text/html' },
+    })
+  } catch (cause) {
+    throw new UiError('UI_REGISTRY_UNAVAILABLE', 'Unable to reach ' + label + '.', undefined, {
+      cause,
+    })
+  }
+  const html = await responseText(response, label)
+  const marker = 'href="/astrale-os/ui/tree/' + ref + '"'
+  const markerOffset = html.lastIndexOf(marker)
+  const releaseHeader = markerOffset < 0 ? '' : html.slice(markerOffset, markerOffset + 8_192)
+  const commits = new Set(
+    [
+      ...releaseHeader.matchAll(
+        /data-hovercard-type=["']commit["'][^>]+href=["']\/astrale-os\/ui\/commit\/([0-9a-f]{40})["']/gu,
+      ),
+    ].map((match) => match[1]),
+  )
+  const commit = commits.size === 1 ? commits.values().next().value : undefined
+  if (!commit) {
     throw new UiError('UI_REGISTRY_UNAVAILABLE', 'UI ref ' + ref + ' did not resolve to a commit.')
   }
-  return readUiReleaseSnapshot({ version, ref, commit }, fetcher)
+  return commit
 }
 
 export async function readUiReleaseSnapshot(