@meith/marketplace 0.17.1 → 0.17.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meith/marketplace",
-  "version": "0.17.1",
+  "version": "0.17.2",
   "license": "LGPL-3.0-or-later",
   "repository": {
     "type": "git",
@@ -19,6 +19,6 @@
     "access": "public"
   },
   "dependencies": {
-    "@meith/theme-kit": "0.17.1"
+    "@meith/theme-kit": "0.17.2"
   }
 }

package/src/build-info.ts

@@ -7,7 +7,7 @@ import { parseApiVersion, THEME_API_VERSION } from '@meith/theme-kit'
  * packages/create-meith/src/bin.ts — see docs/release.md — and kept honest
  * by the same `scripts/release-check.mjs`.
  */
-export const MEITH_VERSION = '0.17.1'
+export const MEITH_VERSION = '0.17.2'
 
 /**
  * The theme-kit major this build implements, read from the single place

package/src/cache.ts

@@ -21,11 +21,14 @@ export const EMPTY_CACHE: CachedMarketplace = {
 /**
  * The cached feed and the daily task's own bookkeeping — one row, whichever
  * infrastructure package backs it (see packages/db's `marketplace-repo.ts`).
- * `hasNotified`/`markNotified` are what make an update notify administrators
- * exactly once per (plugin, version), ever: independent of whether the
- * notification itself has since been read, which a bare `dedupeKey` on the
- * notification service is not (its coalescing only holds while a
- * notification is unread — see packages/notifications).
+ * `claimNotified` is what makes an update notify administrators exactly once
+ * per (plugin, version), ever, even when the daily task and an admin's
+ * "Refresh" click race on the same newly-seen version — independent of
+ * whether the notification itself has since been read, which a bare
+ * `dedupeKey` on the notification service is not (its coalescing only holds
+ * while a notification is unread — see packages/notifications). See
+ * docs/marketplace.md for why the claim is a single atomic step rather than
+ * a check followed by a write.
  */
 export interface MarketplaceCacheRepository {
   read(): Promise<CachedMarketplace>
@@ -35,6 +38,10 @@ export interface MarketplaceCacheRepository {
     readonly fetchedAt: Date
   }): Promise<void>
   saveError(input: { readonly message: string; readonly at: Date }): Promise<void>
-  hasNotified(key: string, version: string): Promise<boolean>
-  markNotified(key: string, version: string): Promise<void>
+  /**
+   * Atomically records (key, version) as notified and reports whether this
+   * call is the one that newly claimed it — `false` means some other caller
+   * (a concurrent refresh) already has, and this one must not notify.
+   */
+  claimNotified(key: string, version: string): Promise<boolean>
 }

package/src/fetch.ts

@@ -22,11 +22,53 @@ export interface FetchFeedOptions {
   readonly fetchImpl?: typeof fetch
 }
 
+/** See `docs/marketplace.md#outbound-fetches-do-not-follow-redirects`. */
+export async function readCappedBody(
+  response: Response,
+  maxBytes: number,
+): Promise<Uint8Array | null> {
+  const declaredLength = response.headers.get('content-length')
+  if (declaredLength !== null) {
+    const declared = Number(declaredLength)
+    if (Number.isFinite(declared) && declared > maxBytes) return null
+  }
+
+  if (response.body === null) {
+    const buffer = await response.arrayBuffer()
+    return buffer.byteLength > maxBytes ? null : new Uint8Array(buffer)
+  }
+
+  const reader = response.body.getReader()
+  const chunks: Uint8Array[] = []
+  let total = 0
+
+  while (true) {
+    const { done, value } = await reader.read()
+    if (done) break
+    total += value.byteLength
+    if (total > maxBytes) {
+      await reader.cancel()
+      return null
+    }
+    chunks.push(value)
+  }
+
+  const combined = new Uint8Array(total)
+  let offset = 0
+  for (const chunk of chunks) {
+    combined.set(chunk, offset)
+    offset += chunk.byteLength
+  }
+  return combined
+}
+
 /**
  * Fetches and JSON-parses a marketplace feed. Never throws: an unreachable
- * host, a non-200 response, an oversized body or invalid JSON are all
- * reported as `{ ok: false, error }` — the board with no outbound network is
- * meant to fail quietly here, not crash the task that called this.
+ * host, a non-200 response (a redirect included — see
+ * `docs/marketplace.md#outbound-fetches-do-not-follow-redirects`), an
+ * oversized body or invalid JSON are all reported as `{ ok: false, error }`
+ * — the board with no outbound network is meant to fail quietly here, not
+ * crash the task that called this.
  */
 export async function fetchMarketplaceFeed(options: FetchFeedOptions): Promise<FetchFeedResult> {
   const fetchImpl = options.fetchImpl ?? fetch
@@ -39,6 +81,7 @@ export async function fetchMarketplaceFeed(options: FetchFeedOptions): Promise<F
       response = await fetchImpl(options.url, {
         signal: controller.signal,
         headers: { accept: 'application/json' },
+        redirect: 'manual',
       })
     } catch (error) {
       return { ok: false, body: null, error: `could not reach ${options.url}: ${String(error)}` }
@@ -48,8 +91,8 @@ export async function fetchMarketplaceFeed(options: FetchFeedOptions): Promise<F
       return { ok: false, body: null, error: `${options.url} answered ${response.status}` }
     }
 
-    const text = await response.text()
-    if (text.length > MAX_BODY_BYTES) {
+    const bytes = await readCappedBody(response, MAX_BODY_BYTES)
+    if (bytes === null) {
       return {
         ok: false,
         body: null,
@@ -58,7 +101,7 @@ export async function fetchMarketplaceFeed(options: FetchFeedOptions): Promise<F
     }
 
     try {
-      return { ok: true, body: JSON.parse(text), error: null }
+      return { ok: true, body: JSON.parse(new TextDecoder().decode(bytes)), error: null }
     } catch {
       return { ok: false, body: null, error: `${options.url} did not answer valid JSON` }
     }

package/src/index.ts

@@ -1,6 +1,11 @@
 export { MEITH_VERSION, PLUGIN_API_MAJOR, THEME_API_MAJOR } from './build-info'
 export { type CachedMarketplace, EMPTY_CACHE, type MarketplaceCacheRepository } from './cache'
-export { type FetchFeedOptions, type FetchFeedResult, fetchMarketplaceFeed } from './fetch'
+export {
+  type FetchFeedOptions,
+  type FetchFeedResult,
+  fetchMarketplaceFeed,
+  readCappedBody,
+} from './fetch'
 export {
   compareSemver,
   parseMeithRange,

package/src/refresh.ts

@@ -10,7 +10,11 @@ export interface RefreshCatalogInput {
   readonly build: BuildInfo
   /** How this build resolves a listing's key against what it compiled in. */
   readonly resolveInstalled: (listing: MarketplaceListing) => InstalledEntry | null
-  /** Called once per newly-detected (plugin, version) update, before it is recorded as notified. */
+  /**
+   * Called once per newly-detected (plugin, version) update, after it has
+   * already been claimed as notified — see docs/marketplace.md for why the
+   * claim happens first, and what that means if this throws.
+   */
   readonly notifyUpdate: (listing: MarketplaceListing) => Promise<void>
   readonly now?: () => Date
   readonly fetchImpl?: typeof fetch
@@ -29,7 +33,9 @@ export interface RefreshCatalogResult {
  * notification for any plugin whose new version this board has not already
  * notified about. This is the one function both the daily task and the
  * admin "Refresh" button call — see docs/marketplace.md — so there is
- * exactly one place that decides what counts as a successful refresh.
+ * exactly one place that decides what counts as a successful refresh, and
+ * the two can run concurrently: `claimNotified` is what keeps a race between
+ * them from raising the same (plugin, version) update twice.
  */
 export async function refreshCatalog(input: RefreshCatalogInput): Promise<RefreshCatalogResult> {
   const now = input.now ?? (() => new Date())
@@ -62,10 +68,9 @@ export async function refreshCatalog(input: RefreshCatalogInput): Promise<Refres
     const installed = input.resolveInstalled(listing)
     const result = computeListingStatus({ ...listing, installed }, input.build)
     if (result.status !== 'update-available') continue
-    if (await input.repository.hasNotified(listing.key, listing.version)) continue
+    if (!(await input.repository.claimNotified(listing.key, listing.version))) continue
 
     await input.notifyUpdate(listing)
-    await input.repository.markNotified(listing.key, listing.version)
     notified += 1
   }
 

package/src/schema.ts

@@ -52,11 +52,15 @@ export const REQUIRED_LISTING_FIELDS = [
   'licence',
 ] as const
 
-const KEY_PATTERN = /^[a-z][a-z0-9-]{1,39}$/
+/**
+ * Mirrors KEY_PATTERN in scripts/marketplace-gen.mjs and
+ * packages/plugin-kit/src/plugin.ts. Exported so
+ * scripts/marketplace-gen.test.ts can pin all three against each other.
+ */
+export const KEY_PATTERN = /^[a-z][a-z0-9-]{1,39}$/
 const VERSION_PATTERN = /^\d+\.\d+\.\d+$/
 const PACKAGE_PATTERN = /^(@[a-z0-9-][a-z0-9-._]*\/)?[a-z0-9-][a-z0-9-._]*$/
-// The served feed's screenshots are absolute site paths, not bare filenames —
-// see the module comment above.
+/** The served feed's screenshots are absolute site paths, not bare filenames — see this file's own header. */
 const SCREENSHOT_PATH_PATTERN = /^\/marketplace\/screenshots\/[a-z0-9][a-z0-9-]*\.png$/
 const KINDS = new Set<string>(['plugin', 'theme'])