@eik/core 2.1.71 → 2.1.73

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [2.1.73](https://github.com/eik-lib/core/compare/v2.1.72...v2.1.73) (2026-08-14)
+
+
+### Bug Fixes
+
+* write eik.json server-side as the final committed marker for package uploads ([#632](https://github.com/eik-lib/core/issues/632)) ([4461f76](https://github.com/eik-lib/core/commit/4461f76881886992db70848d42c7d6a199397c8f)), closes [#4](https://github.com/eik-lib/core/issues/4) [#5](https://github.com/eik-lib/core/issues/5)
+
+## [2.1.72](https://github.com/eik-lib/core/compare/v2.1.71...v2.1.72) (2026-08-14)
+
+
+### Bug Fixes
+
+* upgrade size-limit log from info to warn and include package details ([#631](https://github.com/eik-lib/core/issues/631)) ([e324b5e](https://github.com/eik-lib/core/commit/e324b5e6cab52c788535d3c54b888e0514e40546))
+
 ## [2.1.71](https://github.com/eik-lib/core/compare/v2.1.70...v2.1.71) (2026-08-13)
 
 

package/lib/handlers/pkg.put.js

@@ -82,19 +82,22 @@ const PkgPut = class PkgPut {
 				.parse(incoming)
 				.then((result) => {
 					const pkg = new Package(incoming);
+					/** @type {Record<string,any>|null} */
+					let eikJson = null;
 					result.forEach((/** @type {any} */ obj) => {
 						if (obj.constructor.name === "FormField") {
 							pkg.setMeta(obj);
 						}
 						if (obj.constructor.name === "FormFile") {
+							eikJson = obj.eikJson;
 							obj.value.forEach((/** @type {any} */ o) => {
 								pkg.setAsset(o);
 							});
 						}
 					});
-					return pkg;
+					return { pkg, eikJson };
 				})
-				.then(async (pkg) => {
+				.then(async ({ pkg, eikJson }) => {
 					const path = createFilePathToPackage(pkg);
 					await writeJSON(this._sink, path, pkg, "application/json");
 
@@ -102,7 +105,7 @@ const PkgPut = class PkgPut {
 						`pkg:put - Successfully wrote package meta file to sink - Pathname: ${path}`,
 					);
 
-					resolve(pkg);
+					resolve({ pkg, eikJson });
 				})
 				.catch((error) => {
 					reject(error);
@@ -110,6 +113,29 @@ const PkgPut = class PkgPut {
 		});
 	}
 
+	/**
+	 * Writes eik.json to the sink as the final committed marker for a version.
+	 * Merges any fields from the client's eik.json (captured from the tar) with
+	 * server-authoritative values, ensuring the file is always server-written
+	 * regardless of what the client's tar contained.
+	 *
+	 * @param {any} incoming
+	 * @param {Record<string,any>|null} capturedEikJson
+	 */
+	async _writeEikJson(incoming, capturedEikJson) {
+		const content = {
+			...capturedEikJson,
+			name: incoming.name,
+			version: incoming.version,
+			type: incoming.type,
+		};
+		const eikJsonPath = createFilePathToEikJson(incoming);
+		await writeJSON(this._sink, eikJsonPath, content, "application/json");
+		this._log.info(
+			`pkg:put - Successfully wrote eik.json to sink - Pathname: ${eikJsonPath}`,
+		);
+	}
+
 	/**
 	 * @param {any} incoming
 	 */
@@ -226,7 +252,7 @@ const PkgPut = class PkgPut {
 		}
 
 		const versions = await this._readVersions(incoming);
-		const pkg = await this._parser(incoming);
+		const { pkg, eikJson } = await this._parser(incoming);
 		versions.setVersion(pVersion, pkg.integrity);
 
 		try {
@@ -238,6 +264,15 @@ const PkgPut = class PkgPut {
 			throw e;
 		}
 
+		try {
+			await this._writeEikJson(incoming, eikJson);
+			// eslint-disable-next-line no-unused-vars
+		} catch (error) {
+			const e = new HttpError.BadGateway();
+			end({ labels: { success: false, status: e.status, type } });
+			throw e;
+		}
+
 		const outgoing = new HttpOutgoing();
 		outgoing.cacheControl = this._cacheControl || "";
 		outgoing.statusCode = 303;

package/lib/multipart/form-file.js

@@ -1,12 +1,13 @@
 const FormFile = class FormFile {
 	/**
-	 * @param {{ value?: any[], name?: string }} [options]
+	 * @param {{ value?: any[], name?: string, eikJson?: Record<string,any>|null }} [options]
 	 */
-	constructor({ value = [], name = "" } = {}) {
+	constructor({ value = [], name = "", eikJson = null } = {}) {
 		if (!Array.isArray(value))
 			throw new TypeError('The argument "value" must be of type Array');
 		this._value = value;
 		this._name = name;
+		this._eikJson = eikJson;
 	}
 
 	get value() {
@@ -17,6 +18,11 @@ const FormFile = class FormFile {
 		return this._name;
 	}
 
+	/** @returns {Record<string,any>|null} */
+	get eikJson() {
+		return this._eikJson;
+	}
+
 	toJSON() {
 		return {
 			value: this.value,

package/lib/multipart/parser.js

@@ -1,4 +1,5 @@
 import { pipeline } from "node:stream";
+import path from "node:path";
 import HttpError from "http-errors";
 import Busboy from "busboy";
 import abslog from "abslog";
@@ -148,10 +149,12 @@ const MultipartParser = class MultipartParser {
 			const ac = new AbortController();
 			/** @type {Promise<any>[]} */
 			const queue = [];
+			/** @type {Record<string,any>|null} */
+			let capturedEikJson = null;
 
 			file.once("limit", () => {
-				this._log.info(
-					`multipart - Uploaded package exceeds legal file size limit - Field: ${fieldname} - Filename: ${filename}`,
+				this._log.warn(
+					`multipart - Uploaded package exceeds the max allowed file size - Field: ${fieldname} - Filename: ${filename} - Name: ${incoming.name} - Version: ${incoming.version} - Type: ${incoming.type} - Limit: ${this._pkgMaxFileSize} bytes`,
 				);
 				ac.abort();
 				file.emit("error", new HttpError.PayloadTooLarge());
@@ -166,6 +169,30 @@ const MultipartParser = class MultipartParser {
 						entry.resume();
 						return;
 					}
+
+					// eik.json is captured in memory and written server-side
+					// after the upload is fully committed, so that it can serve
+					// as a reliable committed marker independent of what the
+					// client includes in the tar.
+					if (path.normalize(entry.path) === "eik.json") {
+						/** @type {Buffer[]} */
+						const chunks = [];
+						entry.on("data", (/** @type {Buffer} */ chunk) => {
+							chunks.push(chunk);
+						});
+						entry.once("end", () => {
+							try {
+								capturedEikJson = JSON.parse(
+									Buffer.concat(chunks).toString("utf8"),
+								);
+							} catch {
+								// Malformed eik.json in tar — proceed without it.
+							}
+						});
+						entry.once("error", () => {});
+						return;
+					}
+
 					const persist = this._persistFile({
 						incoming,
 						entry,
@@ -205,7 +232,11 @@ const MultipartParser = class MultipartParser {
 
 				Promise.all(queue)
 					.then((result) => {
-						const formFile = new FormFile({ name: fieldname, value: result });
+						const formFile = new FormFile({
+							name: fieldname,
+							value: result,
+							eikJson: capturedEikJson,
+						});
 						resolve(formFile);
 					})
 					.catch((err) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eik/core",
-  "version": "2.1.71",
+  "version": "2.1.73",
   "description": "Core server package",
   "main": "lib/main.js",
   "types": "./types/main.d.ts",

package/types/handlers/pkg.put.d.ts

@@ -66,6 +66,16 @@ declare const PkgPut: {
          * @param {any} incoming
          */
         _parser(incoming: any): Promise<any>;
+        /**
+         * Writes eik.json to the sink as the final committed marker for a version.
+         * Merges any fields from the client's eik.json (captured from the tar) with
+         * server-authoritative values, ensuring the file is always server-written
+         * regardless of what the client's tar contained.
+         *
+         * @param {any} incoming
+         * @param {Record<string,any>|null} capturedEikJson
+         */
+        _writeEikJson(incoming: any, capturedEikJson: Record<string, any> | null): Promise<void>;
         /**
          * @param {any} incoming
          */

package/types/multipart/form-file.d.ts

@@ -1,13 +1,17 @@
 export default FormFile;
 declare const FormFile: {
-    new ({ value, name }?: {
+    new ({ value, name, eikJson }?: {
         value?: any[];
         name?: string;
+        eikJson?: Record<string, any> | null;
     }): {
         _value: any[];
         _name: string;
+        _eikJson: Record<string, any> | null;
         get value(): any[];
         get name(): string;
+        /** @returns {Record<string,any>|null} */
+        get eikJson(): Record<string, any> | null;
         toJSON(): {
             value: any[];
             name: string;