@eik/core 2.1.76 → 2.1.78

package/CHANGELOG.md

@@ -1,3 +1,17 @@
+## [2.1.78](https://github.com/eik-lib/core/compare/v2.1.77...v2.1.78) (2026-08-17)
+
+
+### Bug Fixes
+
+* include server-written eik.json in the package asset list ([#637](https://github.com/eik-lib/core/issues/637)) ([42ea8c6](https://github.com/eik-lib/core/commit/42ea8c6d328f2e35c2ba8618f4c3e74d48454ed2))
+
+## [2.1.77](https://github.com/eik-lib/core/compare/v2.1.76...v2.1.77) (2026-08-17)
+
+
+### Bug Fixes
+
+* propagate sink errors in versions.get as 502 rather than 404 ([#636](https://github.com/eik-lib/core/issues/636)) ([21b8619](https://github.com/eik-lib/core/commit/21b8619eeff9150914adcfa2ae6a233e2c10ec60))
+
 ## [2.1.76](https://github.com/eik-lib/core/compare/v2.1.75...v2.1.76) (2026-08-14)
 
 

package/lib/handlers/pkg.put.js

@@ -3,6 +3,7 @@ import originalUrl from "original-url";
 import HttpError from "http-errors";
 import Metrics from "@metrics/client";
 import abslog from "abslog";
+import ssri from "ssri";
 
 import {
 	createFilePathToPackage,
@@ -22,6 +23,7 @@ import HttpOutgoing from "../classes/http-outgoing.js";
 import Versions from "../classes/versions.js";
 import Package from "../classes/package.js";
 import Author from "../classes/author.js";
+import Asset from "../classes/asset.js";
 import config from "../utils/defaults.js";
 
 /**
@@ -97,14 +99,7 @@ const PkgPut = class PkgPut {
 					});
 					return { pkg, eikJson };
 				})
-				.then(async ({ pkg, eikJson }) => {
-					const path = createFilePathToPackage(pkg);
-					await writeJSON(this._sink, path, pkg, "application/json");
-
-					this._log.info(
-						`pkg:put - Successfully wrote package meta file to sink - Pathname: ${path}`,
-					);
-
+				.then(({ pkg, eikJson }) => {
 					resolve({ pkg, eikJson });
 				})
 				.catch((error) => {
@@ -119,8 +114,12 @@ const PkgPut = class PkgPut {
 	 * server-authoritative values, ensuring the file is always server-written
 	 * regardless of what the client's tar contained.
 	 *
+	 * Returns an Asset representing the written file so the caller can include
+	 * it in the package's asset list.
+	 *
 	 * @param {any} incoming
 	 * @param {Record<string,any>|null} capturedEikJson
+	 * @returns {Promise<InstanceType<typeof Asset>>}
 	 */
 	async _writeEikJson(incoming, capturedEikJson) {
 		const content = {
@@ -130,10 +129,28 @@ const PkgPut = class PkgPut {
 			type: incoming.type,
 		};
 		const eikJsonPath = createFilePathToEikJson(incoming);
-		await writeJSON(this._sink, eikJsonPath, content, "application/json");
+		const buffer = await writeJSON(
+			this._sink,
+			eikJsonPath,
+			content,
+			"application/json",
+		);
 		this._log.info(
 			`pkg:put - Successfully wrote eik.json to sink - Pathname: ${eikJsonPath}`,
 		);
+
+		const asset = new Asset({
+			pathname: "eik.json",
+			version: incoming.version,
+			name: incoming.name,
+			type: incoming.type,
+			org: incoming.org,
+		});
+		asset.integrity = ssri
+			.fromData(buffer, { algorithms: ["sha512"] })
+			.toString();
+		asset.size = buffer.length;
+		return asset;
 	}
 
 	/**
@@ -265,10 +282,26 @@ const PkgPut = class PkgPut {
 		});
 
 		const { pkg, eikJson } = await this._parser(incoming);
-		versions.setVersion(pVersion, pkg.integrity);
 
+		// Write eik.json before package metadata so the asset list is complete
+		// when {version}.package.json is written to the sink.
+		let eikJsonAsset;
 		try {
-			await this._writeVersions(incoming, versions);
+			eikJsonAsset = await this._writeEikJson(incoming, eikJson);
+			// eslint-disable-next-line no-unused-vars
+		} catch (error) {
+			const e = new HttpError.BadGateway();
+			end({ labels: { success: false, status: e.status, type } });
+			throw e;
+		}
+		pkg.setAsset(eikJsonAsset);
+
+		try {
+			const pkgMetaPath = createFilePathToPackage(pkg);
+			await writeJSON(this._sink, pkgMetaPath, pkg, "application/json");
+			this._log.info(
+				`pkg:put - Successfully wrote package meta file to sink - Pathname: ${pkgMetaPath}`,
+			);
 			// eslint-disable-next-line no-unused-vars
 		} catch (error) {
 			const e = new HttpError.BadGateway();
@@ -276,8 +309,10 @@ const PkgPut = class PkgPut {
 			throw e;
 		}
 
+		versions.setVersion(pVersion, pkg.integrity);
+
 		try {
-			await this._writeEikJson(incoming, eikJson);
+			await this._writeVersions(incoming, versions);
 			// eslint-disable-next-line no-unused-vars
 		} catch (error) {
 			const e = new HttpError.BadGateway();

package/lib/handlers/versions.get.js

@@ -81,57 +81,83 @@ const VersionsGet = class VersionsGet {
 		}
 		const path = createFilePathToVersion({ org, type, name: pName });
 
-		try {
-			const file = await (this._sink && this._sink.read(path));
-			const outgoing = new HttpOutgoing();
-			outgoing.cacheControl = this._cacheControl;
-			outgoing.mimeType = "application/json";
-
-			if (this._etag) {
-				outgoing.etag = file.etag;
-			}
-
-			if (this._etag && req.headers["if-none-match"] === file.etag) {
-				outgoing.statusCode = 304;
-				file.stream.destroy();
-			} else {
-				outgoing.statusCode = 200;
-				outgoing.stream = file.stream;
-
-				const outgoingStream = outgoing.stream;
-				if (outgoingStream) {
-					outgoingStream.on(
-						"error",
-						(/** @type {NodeJS.ErrnoException} */ err) => {
-							// ERR_STREAM_PREMATURE_CLOSE means the client closed the
-							// connection before the transfer finished. This is normal
-							// browser behaviour (navigation, cancelled requests, etc.)
-							// and not a server-side error worth alerting on.
-							if (err.code === "ERR_STREAM_PREMATURE_CLOSE") {
-								this._log.debug(`pkg:latest - File stream error - ${err}`);
-							} else {
-								this._log.info(`pkg:latest - File stream error - ${err}`);
-							}
-							end({ labels: { success: false, status: 503, type } });
-						},
-					);
-
-					outgoingStream.on("end", () => {
-						end({ labels: { status: outgoing.statusCode, type } });
-					});
-				}
-			}
+		if (!this._sink) {
+			const e = new HttpError.NotFound();
+			end({ labels: { success: false, status: e.status, type } });
+			throw e;
+		}
 
-			this._log.debug(`pkg:latest - Package log found - Pathname: ${path}`);
+		// Check existence first to distinguish a genuinely missing package
+		// from a transient infrastructure error. Without this distinction,
+		// any GCS or network failure would surface as 404, which callers
+		// may misinterpret as "package does not exist".
+		try {
+			await this._sink.exist(path);
+		} catch {
+			this._log.debug(
+				`pkg:latest - Package versions not found - Pathname: ${path}`,
+			);
+			const e = new HttpError.NotFound();
+			end({ labels: { success: false, status: e.status, type } });
+			throw e;
+		}
 
-			return outgoing;
-			// eslint-disable-next-line no-unused-vars
+		// File exists — any read failure here is an infrastructure error.
+		let file;
+		try {
+			file = await this._sink.read(path);
 		} catch (error) {
-			this._log.debug(`pkg:latest - Package log found - Pathname: ${path}`);
-			const e = new HttpError.NotFound();
+			this._log.error(
+				`pkg:latest - Failed to read package versions from sink - Pathname: ${path}`,
+			);
+			this._log.trace(error);
+			const e = new HttpError.BadGateway();
 			end({ labels: { success: false, status: e.status, type } });
 			throw e;
 		}
+
+		const outgoing = new HttpOutgoing();
+		outgoing.cacheControl = this._cacheControl;
+		outgoing.mimeType = "application/json";
+
+		if (this._etag) {
+			outgoing.etag = file.etag;
+		}
+
+		if (this._etag && req.headers["if-none-match"] === file.etag) {
+			outgoing.statusCode = 304;
+			file.stream.destroy();
+		} else {
+			outgoing.statusCode = 200;
+			outgoing.stream = file.stream;
+
+			const outgoingStream = outgoing.stream;
+			if (outgoingStream) {
+				outgoingStream.on(
+					"error",
+					(/** @type {NodeJS.ErrnoException} */ err) => {
+						// ERR_STREAM_PREMATURE_CLOSE means the client closed the
+						// connection before the transfer finished. This is normal
+						// browser behaviour (navigation, cancelled requests, etc.)
+						// and not a server-side error worth alerting on.
+						if (err.code === "ERR_STREAM_PREMATURE_CLOSE") {
+							this._log.debug(`pkg:latest - File stream error - ${err}`);
+						} else {
+							this._log.info(`pkg:latest - File stream error - ${err}`);
+						}
+						end({ labels: { success: false, status: 503, type } });
+					},
+				);
+
+				outgoingStream.on("end", () => {
+					end({ labels: { status: outgoing.statusCode, type } });
+				});
+			}
+		}
+
+		this._log.debug(`pkg:latest - Package versions found - Pathname: ${path}`);
+
+		return outgoing;
 	}
 };
 export default VersionsGet;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eik/core",
-  "version": "2.1.76",
+  "version": "2.1.78",
   "description": "Core server package",
   "main": "lib/main.js",
   "types": "./types/main.d.ts",

package/types/handlers/pkg.put.d.ts

@@ -72,10 +72,14 @@ declare const PkgPut: {
          * server-authoritative values, ensuring the file is always server-written
          * regardless of what the client's tar contained.
          *
+         * Returns an Asset representing the written file so the caller can include
+         * it in the package's asset list.
+         *
          * @param {any} incoming
          * @param {Record<string,any>|null} capturedEikJson
+         * @returns {Promise<InstanceType<typeof Asset>>}
          */
-        _writeEikJson(incoming: any, capturedEikJson: Record<string, any> | null): Promise<void>;
+        _writeEikJson(incoming: any, capturedEikJson: Record<string, any> | null): Promise<InstanceType<typeof Asset>>;
         /**
          * @param {any} incoming
          * @returns {Promise<InstanceType<typeof Versions>>}
@@ -125,4 +129,5 @@ declare const PkgPut: {
 };
 import abslog from "abslog";
 import Metrics from "@metrics/client";
+import Asset from "../classes/asset.js";
 import Versions from "../classes/versions.js";