@rackbops/ac-agent 2.0.0-alpha.49 → 2.0.0-alpha.50

package/README.md

@@ -830,7 +830,7 @@ software is never something a grant could hand to a plugin.
      just before the hand-off.
 2. **Resolves exactly that version on the public npm registry** (`https://registry.npmjs.org`, a
    constant, never configurable):
-   - The metadata must name `@rackbops/ac-agent` and that version.
+   - The metadata must be a JSON object naming `@rackbops/ac-agent` and that version.
    - Its tarball URL must be the registry's own canonical one for it.
    - Its integrity must be one sha512.
 3. **Downloads the tarball** (60 s timeout) and refuses it over 20 MB or unless its sha512 matches.

package/dist/ac-agent.mjs

@@ -47,7 +47,7 @@ function _mergeNamespaces(n, m) {
 }
 
 var name = "@rackbops/ac-agent";
-var version = "2.0.0-alpha.49";
+var version = "2.0.0-alpha.50";
 var type = "module";
 var description = "The per-machine host agent (installed with npx @rackbops/ac-agent): an HTTPS health server plus install/status/uninstall for a Windows logon task or a systemd user unit.";
 var bin = {
@@ -75279,7 +75279,20 @@ async function resolveRelease(version, fetchImpl, registry, timeoutMs = 15_000)
         throw new UpdateRefusal(`${version} is not published`);
     if (!res.ok)
         throw new UpdateRefusal(`registry answered ${res.status} for ${version}`);
-    const meta = (await res.json());
+    // A body that isn't a JSON object (a proxy's error page, `null`) is a refusal like any other bad
+    // metadata, not a fault (#659; listed as a declined minor in #665, fixed after it). The cause is
+    // kept: a timeout or a dropped connection mid-body lands here too.
+    let parsed;
+    try {
+        parsed = await res.json();
+    }
+    catch (err) {
+        throw new UpdateRefusal(`registry metadata for ${version} is not JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (typeof parsed !== "object" || parsed === null) {
+        throw new UpdateRefusal(`registry metadata for ${version} is not an object`);
+    }
+    const meta = parsed;
     if (meta.name !== AGENT_PACKAGE || meta.version !== version) {
         throw new UpdateRefusal(`registry metadata is not ${AGENT_PACKAGE}@${version}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rackbops/ac-agent",
-  "version": "2.0.0-alpha.49",
+  "version": "2.0.0-alpha.50",
   "private": false,
   "type": "module",
   "description": "The per-machine host agent (installed with npx @rackbops/ac-agent): an HTTPS health server plus install/status/uninstall for a Windows logon task or a systemd user unit.",