@vantaloom/cli 0.1.2 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vantaloom/cli",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "private": false,
   "type": "module",
   "description": "Vantaloom local runtime manager.",

package/src/cli.mjs

@@ -261,7 +261,7 @@ async function syncFromRelease(options, action) {
 }
 
 async function downloadReleaseAsset({ repo, releaseTag, assetName, target, token }) {
-  const url = `https://github.com/${repo}/releases/download/${releaseTag}/${assetName}`
+  const releaseUrl = `https://api.github.com/repos/${repo}/releases/tags/${releaseTag}`
   const headers = {
     "User-Agent": "vantaloom-cli",
   }
@@ -270,7 +270,28 @@ async function downloadReleaseAsset({ repo, releaseTag, assetName, target, token
     headers.Authorization = `Bearer ${githubToken}`
   }
 
-  const response = await fetch(url, { headers })
+  const releaseResponse = await fetch(releaseUrl, { headers })
+  if (!releaseResponse.ok) {
+    const detail = await releaseResponse.text().catch(() => "")
+    const authHint = releaseResponse.status === 404 || releaseResponse.status === 403
+      ? " If the repository is private, set VANTALOOM_GITHUB_TOKEN to a GitHub token that can read releases."
+      : ""
+    throw new Error(`failed to inspect ${repo}@${releaseTag}: HTTP ${releaseResponse.status}.${authHint}${detail ? ` ${detail.slice(0, 200)}` : ""}`)
+  }
+
+  const release = await releaseResponse.json()
+  const asset = release.assets?.find((asset) => asset.name === assetName)
+  if (!asset) {
+    const names = release.assets?.map((asset) => asset.name).join(", ") || "none"
+    throw new Error(`missing release asset ${assetName} in ${repo}@${releaseTag}; available assets: ${names}`)
+  }
+
+  const response = await fetch(asset.url, {
+    headers: {
+      ...headers,
+      Accept: "application/octet-stream",
+    },
+  })
   if (!response.ok) {
     const detail = await response.text().catch(() => "")
     const authHint = response.status === 404 || response.status === 403