Repository navigation
Conversation
…behind the licence check, and dist.url on catalog and update releases An instance fetches a release's prebuilt engine dist with its own token. Free extensions are open to any active instance; a paid one needs its organization to own the extension or hold an active licence, checked on every request. Yanked releases stay downloadable; suspended listings and releases without a dist are 404. Catalog and update releases name the download in dist.url next to size, sha256, integrity and built_against.
roncodes
changed the base branch from
feat/publisher-analytics
to
release/v2.0.0
October 24, 2026 09:21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Instances can download a release's prebuilt engine dist with their own token, so the console installs it as a runtime engine instead of running
pnpm addand rebuilding the console. This fixes the service side of D9 from the end-to-end walk.GET /v1/instances/me/releases/{release}/dist(rel_id) streams the dist. Any active instance can fetch a free extension's dist. A paid extension's dist needs the instance's organization to own the extension or hold an active licence; otherwise the endpoint returns 403 withCache-Control: private, no-store. The check runs on every request, so a revoked or expired licence stops downloads at once. Yanked releases stay downloadable. A suspended listing, an unreleased release, or a release without a dist returns 404 with a message./v1/instances/me/updatesreleases now carrydist.url(pointing at the route above) alongsidesize,sha256,integrityandbuilt_against.LicenceGate::allows()holds the owner-or-licence rule. The package routes'check()now uses it too.distparagraph out of the middle of the catalog table, where it was breaking the table.GET /npm/{engine}/-/dist/{version}from #11 still serves the same archive. Whether to keep it is an open question in the PR thread.Stacked on #12, which now includes #11 (merged forward in eb2dc08). Tests:
tests/Feature/Instance/InstanceReleaseDistTest.php, plus the catalog dist assertion updated forurl.