dsh-plugin-update 0.3.1 → 0.4.0

package/dist/service.js

@@ -226,6 +226,55 @@ async function fetchNpmRelease(fetchImpl, timeoutMs = CHECK_TIMEOUT_MS, opts) {
     throw checkFailedWithStatus(response);
   }
 }
+async function fetchNpmVersionRelease(fetchImpl, timeoutMs = CHECK_TIMEOUT_MS, opts) {
+  const targetName = opts?.targetPackageName ?? PACKAGE_NAME;
+  const registry = opts?.registryUrl ?? NPM_REGISTRY;
+  const channel = opts?.releaseChannel === "prerelease" ? "prerelease" : "stable";
+  const version = opts?.version;
+  if (typeof version !== "string" || !validReleaseVersion(version) || !isVersionAllowedInChannel(version, channel)) {
+    throw updateError("invalid-release");
+  }
+  let response = null;
+  try {
+    response = await fetchImpl(`${registry}${encodeURIComponent(targetName)}/${encodeURIComponent(version)}`, {
+      headers: { accept: "application/json" },
+      redirect: "error",
+      signal: timeoutSignal(timeoutMs)
+    });
+  } catch {
+    throw updateError("check-failed");
+  }
+  try {
+    if (!response.ok) throw checkFailedWithStatus(response);
+    const declared = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > MAX_METADATA_BYTES) throw updateError("invalid-release");
+    const text = await response.text();
+    if (byteLength(text) > MAX_METADATA_BYTES) throw updateError("invalid-release");
+    const value = JSON.parse(text);
+    if (value.name !== targetName || value.version !== version || !isVersionAllowedInChannel(value.version, channel)) {
+      throw updateError("invalid-release");
+    }
+    const nodeRange = value.engines?.node;
+    if (nodeRange !== void 0 && typeof nodeRange !== "string") throw updateError("invalid-release");
+    const tarballText = value.dist?.tarball;
+    const integrity = value.dist?.integrity;
+    let tarball;
+    try {
+      tarball = new URL(String(tarballText));
+    } catch {
+      throw updateError("invalid-release");
+    }
+    const registryOrigin = new URL(registry).origin;
+    const shapeOk = tarball.origin === registryOrigin && !tarball.username && !tarball.password && !tarball.search && !tarball.hash && tarball.pathname === `/${targetName}/-/${targetName}-${version}.tgz` && typeof integrity === "string" && new RegExp(INTEGRITY_PATTERN).test(integrity);
+    if (!shapeOk) throw updateError("invalid-release");
+    return { version, nodeRange: typeof nodeRange === "string" ? nodeRange : "*", integrity, tarball: tarball.href };
+  } catch (error) {
+    if (error?.code === "check-failed") throw error;
+    if (error?.code === "invalid-release") throw error;
+    if (response !== null && response.ok) throw updateError("invalid-release");
+    throw checkFailedWithStatus(response);
+  }
+}
 function createUpdateCore(ports) {
   const checkTimeoutMs = ports.checkTimeoutMs ?? CHECK_TIMEOUT_MS;
   const confirmationTtlMs = ports.confirmationTtlMs ?? CONFIRMATION_TTL_MS;
@@ -446,6 +495,7 @@ export {
   compareVersions,
   createUpdateCore,
   fetchNpmRelease,
+  fetchNpmVersionRelease,
   isPrereleaseVersion,
   isVersionAllowedInChannel,
   satisfiesNodeRange,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-update",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "可复用的更新系统装成的 npm 包：任何 DSH 插件照文档能集成检查更新等功能（地图 #579）",
   "license": "MIT",
   "author": "王辰浩",