@t3x-dev/local 0.1.2 → 0.1.4

package/README.md

@@ -8,5 +8,8 @@ Current PR2 scope:
 - `t3x` forwards to `@t3x-dev/cli`
 - `t3x-mcp` forwards to `@t3x-dev/mcp`
 
-This phase uses local build artifacts already present in the monorepo.
-It does not download runtime assets yet.
+On package install, `postinstall` downloads the platform runtime asset from
+`runtime-manifest.json`.
+
+For private GitHub releases, set `T3X_LOCAL_GITHUB_TOKEN`, `GH_TOKEN`, or
+`GITHUB_TOKEN` to a token with access to the runtime release.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@t3x-dev/local",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "T3X local entry package",
   "license": "Apache-2.0",
   "type": "module",
@@ -17,7 +17,7 @@
     "runtime-manifest.json"
   ],
   "publishConfig": {
-    "access": "public"
+    "access": "restricted"
   },
   "repository": {
     "type": "git",
@@ -38,10 +38,10 @@
   },
   "dependencies": {
     "@hono/node-server": "^1.15.2",
-    "@t3x-dev/api": "0.1.2",
-    "@t3x-dev/cli": "0.1.2",
-    "@t3x-dev/mcp": "0.1.2",
-    "@t3x-dev/storage": "0.1.2",
+    "@t3x-dev/api": "0.1.4",
+    "@t3x-dev/cli": "0.1.4",
+    "@t3x-dev/mcp": "0.1.4",
+    "@t3x-dev/storage": "0.1.4",
     "commander": "^13.1.0"
   },
   "devDependencies": {

package/runtime-manifest.json

@@ -1,38 +1,26 @@
 {
   "manifestVersion": 1,
-  "packageVersion": "0.1.2",
-  "fixedVersion": "0.1.2",
-  "generatedAt": "2026-04-23T09:12:14.667Z",
+  "packageVersion": "0.1.4",
+  "fixedVersion": "0.1.4",
+  "generatedAt": "2026-04-27T05:44:57.580Z",
   "dependencies": {
-    "@t3x-dev/yops": "0.1.2",
-    "@t3x-dev/yschema": "0.1.2",
-    "@t3x-dev/core": "0.1.2",
-    "@t3x-dev/storage": "0.1.2",
-    "@t3x-dev/api": "0.1.2",
-    "@t3x-dev/api-client": "0.1.2",
-    "@t3x-dev/cli": "0.1.2",
-    "@t3x-dev/mcp": "0.1.2",
-    "@t3x-dev/local": "0.1.2",
+    "@t3x-dev/yops": "0.1.4",
+    "@t3x-dev/yschema": "0.1.4",
+    "@t3x-dev/core": "0.1.4",
+    "@t3x-dev/storage": "0.1.4",
+    "@t3x-dev/api": "0.1.4",
+    "@t3x-dev/api-client": "0.1.4",
+    "@t3x-dev/cli": "0.1.4",
+    "@t3x-dev/mcp": "0.1.4",
+    "@t3x-dev/local": "0.1.4",
     "web": "0.1.0"
   },
   "platforms": {
     "darwin-arm64": {
-      "fileName": "t3x-local-runtime-0.1.2-darwin-arm64.tar.gz",
-      "url": "https://github.com/t3x-dev/t3x-core/releases/download/t3x-local-v0.1.2/t3x-local-runtime-0.1.2-darwin-arm64.tar.gz",
-      "sha256": "d90390ca1a90be083a78d4caf670d027985084eafbbfbc001fb84f30565b7a85",
-      "size": 20245492
-    },
-    "linux-arm64": {
-      "fileName": "t3x-local-runtime-0.1.2-linux-arm64.tar.gz",
-      "url": "https://github.com/t3x-dev/t3x-core/releases/download/t3x-local-v0.1.2/t3x-local-runtime-0.1.2-linux-arm64.tar.gz",
-      "sha256": "384afcf94e9208122a995980fbdf9fee072e14514ce269898726fd357e359b2c",
-      "size": 28136616
-    },
-    "linux-x64": {
-      "fileName": "t3x-local-runtime-0.1.2-linux-x64.tar.gz",
-      "url": "https://github.com/t3x-dev/t3x-core/releases/download/t3x-local-v0.1.2/t3x-local-runtime-0.1.2-linux-x64.tar.gz",
-      "sha256": "5ed8c8fb5597c2ecac0593ffc48f604b7484df538965c07d81663d3ad29a7c87",
-      "size": 27977895
+      "fileName": "t3x-local-runtime-0.1.4-darwin-arm64.tar.gz",
+      "url": "https://github.com/t3x-dev/t3x-core/releases/download/t3x-local-v0.1.4/t3x-local-runtime-0.1.4-darwin-arm64.tar.gz",
+      "sha256": "6d5ab00096f233a4a02ab982cdea0375d3ec793d5f7454bfc7bf9cd2fd90b830",
+      "size": 20377274
     }
   }
 }

package/scripts/postinstall-download.mjs

@@ -35,6 +35,7 @@ const LOCAL_DIRECT_FIXED_DEPENDENCIES = [
   '@t3x-dev/mcp',
   '@t3x-dev/storage',
 ];
+const GITHUB_TOKEN_ENV_NAMES = ['T3X_LOCAL_GITHUB_TOKEN', 'GH_TOKEN', 'GITHUB_TOKEN'];
 
 if (process.env.T3X_LOCAL_SKIP_DOWNLOAD === '1' || process.env.T3X_LOCAL_SKIP_DOWNLOAD === 'true') {
   console.log(
@@ -131,11 +132,11 @@ async function downloadArtifact(source, destinationPath) {
   }
 
   if (source.startsWith('http://') || source.startsWith('https://')) {
-    const response = await fetch(source);
+    const response = await fetchRuntimeArtifact(source);
 
     if (!response.ok) {
       throw new Error(
-        `[t3x-local:postinstall] Failed to download runtime: HTTP ${response.status}`
+        `[t3x-local:postinstall] Failed to download runtime: HTTP ${response.status}${getDownloadHint(source)}`
       );
     }
 
@@ -147,6 +148,145 @@ async function downloadArtifact(source, destinationPath) {
   await fs.copyFile(source, destinationPath);
 }
 
+async function fetchRuntimeArtifact(source) {
+  const response = await fetch(source, { headers: getDownloadHeaders(source) });
+  const token = getGitHubToken();
+
+  if (
+    response.ok ||
+    !token ||
+    !isGitHubReleaseDownloadUrl(source) ||
+    !isAuthRetryStatus(response.status)
+  ) {
+    return response;
+  }
+
+  const apiResponse = await fetchGitHubReleaseAsset(source, token);
+  return apiResponse ?? response;
+}
+
+function getDownloadHeaders(source) {
+  if (!isGitHubUrl(source)) {
+    return undefined;
+  }
+
+  const token = getGitHubToken();
+  if (!token) {
+    return undefined;
+  }
+
+  return {
+    Authorization: `Bearer ${token}`,
+    'User-Agent': '@t3x-dev/local postinstall',
+  };
+}
+
+function getDownloadHint(source) {
+  if (!isGitHubUrl(source) || getGitHubToken()) {
+    return '';
+  }
+
+  return `; set ${GITHUB_TOKEN_ENV_NAMES[0]}, GH_TOKEN, or GITHUB_TOKEN if the runtime release is private`;
+}
+
+function getGitHubToken() {
+  for (const envName of GITHUB_TOKEN_ENV_NAMES) {
+    const token = process.env[envName]?.trim();
+    if (token) {
+      return token;
+    }
+  }
+
+  return null;
+}
+
+async function fetchGitHubReleaseAsset(source, token) {
+  const releaseAsset = parseGitHubReleaseDownloadUrl(source);
+  if (!releaseAsset) {
+    return null;
+  }
+
+  const releaseUrl = `https://api.github.com/repos/${releaseAsset.owner}/${releaseAsset.repo}/releases/tags/${releaseAsset.tag}`;
+  const releaseResponse = await fetch(releaseUrl, {
+    headers: getGitHubApiHeaders(token),
+  });
+
+  if (!releaseResponse.ok) {
+    return releaseResponse;
+  }
+
+  const release = await releaseResponse.json();
+  const asset = release.assets?.find((candidate) => candidate.name === releaseAsset.assetName);
+
+  if (!asset?.url) {
+    return new Response(null, {
+      status: 404,
+      statusText: `Release asset ${releaseAsset.assetName} not found`,
+    });
+  }
+
+  return fetch(asset.url, {
+    headers: {
+      ...getGitHubApiHeaders(token),
+      Accept: 'application/octet-stream',
+    },
+  });
+}
+
+function getGitHubApiHeaders(token) {
+  return {
+    Authorization: `Bearer ${token}`,
+    Accept: 'application/vnd.github+json',
+    'X-GitHub-Api-Version': '2022-11-28',
+    'User-Agent': '@t3x-dev/local postinstall',
+  };
+}
+
+function isGitHubUrl(source) {
+  try {
+    const { hostname } = new URL(source);
+    return hostname === 'github.com' || hostname === 'api.github.com';
+  } catch {
+    return false;
+  }
+}
+
+function isGitHubReleaseDownloadUrl(source) {
+  return parseGitHubReleaseDownloadUrl(source) !== null;
+}
+
+function parseGitHubReleaseDownloadUrl(source) {
+  try {
+    const url = new URL(source);
+    if (url.hostname !== 'github.com') {
+      return null;
+    }
+
+    const [, owner, repo, releases, download, tag, ...assetParts] = url.pathname.split('/');
+    if (!owner || !repo || releases !== 'releases' || download !== 'download' || !tag) {
+      return null;
+    }
+
+    const assetName = assetParts.join('/');
+    if (!assetName) {
+      return null;
+    }
+
+    return {
+      owner: encodeURIComponent(owner),
+      repo: encodeURIComponent(repo),
+      tag: encodeURIComponent(decodeURIComponent(tag)),
+      assetName: decodeURIComponent(assetName),
+    };
+  } catch {
+    return null;
+  }
+}
+
+function isAuthRetryStatus(status) {
+  return status === 403 || status === 404;
+}
+
 async function verifyArchiveSha(archivePath, expectedSha) {
   const file = await fs.readFile(archivePath);
   const actualSha = crypto.createHash('sha256').update(file).digest('hex');