@mutmutco/installer-gate 0.1.1 → 0.1.2

package/dist/index.js

@@ -377,6 +377,11 @@ function createGateHandler(config) {
       await refresh(req, res);
       return;
     }
+    if (pathname === "/release/version") {
+      requireMethod(method, "GET");
+      await releaseVersion(res);
+      return;
+    }
     if (pathname === "/release/manifest") {
       requireMethod(method, "GET");
       await releaseManifest(req, res);
@@ -492,6 +497,20 @@ function createGateHandler(config) {
     }
     return identity;
   }
+  async function releaseVersion(res) {
+    const read = config.release.currentVersion;
+    if (!read) {
+      sendJson(res, 404, { error: "not_found" });
+      return;
+    }
+    let version;
+    try {
+      version = await read();
+    } catch {
+      throw new GateHttpError(500, "internal_error");
+    }
+    sendJson(res, 200, { version });
+  }
   async function releaseManifest(req, res) {
     if (await authenticate(req, res) === null) return;
     let input;

package/dist/types.d.ts

@@ -36,6 +36,11 @@ export interface ReleaseConfig {
     sign: (canonicalBytes: Buffer) => Buffer;
     /** Reads one release file by manifest-relative path. Throws when absent. */
     readFile: (path: string) => Promise<Buffer>;
+    /** #6864: the current release version ALONE, read straight from the pointer — no file hashing.
+     *  Backs the unauthenticated `GET /release/version` probe, so it must stay cheap: `manifest()`
+     *  re-hashes every payload file on each call and must never sit behind a public route. Optional:
+     *  a store that does not provide it simply has no version probe (the route answers 404). */
+    currentVersion?: () => Promise<string>;
 }
 interface GateConfigBase {
     allowlist: AllowlistConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/installer-gate",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Installer gate server library — GitHub device flow, allowlists, and signed release manifests. Mounted by a product's own server.",
   "type": "module",
   "license": "UNLICENSED",