fix: resolve default version via npm alpha dist-tag

The homepage default (no ?tag= query) scanned the GitHub /releases
list and returned the first release with matching installer assets,
which could pick up a stable release instead of the intended alpha
channel. Resolve the default version via npm's `alpha` dist-tag
first, then fetch that specific tag from GitHub. On failure (incl.
404 from npm/GitHub being momentarily out of sync) return null so
getRelease doesn't poison `release:latest` with a 5-minute negative
cache.

Author: fengmk2

routes/index.ts

@@ -12,6 +12,7 @@ const ASSET_NAMES: Record<Arch, string> = {
 };
 const LATEST_CACHE_TTL = 300; // 5 minutes
 const TAGGED_CACHE_TTL = 86400; // 24 hours
+const DEFAULT_DIST_TAG = "alpha";
 
 type Arch = "x64" | "arm64";
 
@@ -76,25 +77,19 @@ export async function fetchRelease(
     return (await res.json()) as GitHubRelease;
   }
 
-  // Includes pre-releases, unlike /releases/latest
+  const version = await fetchNpmDistTagVersion(DEFAULT_DIST_TAG);
+  if (!version) return null;
   const res = await fetchGitHub(
-    `/repos/${GITHUB_OWNER}/${GITHUB_REPO}/releases?per_page=10`,
+    `/repos/${GITHUB_OWNER}/${GITHUB_REPO}/releases/tags/v${version}`,
     githubToken,
   );
   if (!res.ok) {
-    console.error(`GitHub API error: ${res.status} ${res.statusText} for releases list`);
+    console.error(`GitHub API error: ${res.status} ${res.statusText} for default tag v${version}`);
+    // Treat all failures (incl. 404) as transient so getRelease doesn't cache a negative
+    // under `release:latest` when npm/GitHub are momentarily out of sync.
     return null;
   }
-  const releases = (await res.json()) as GitHubRelease[];
-  console.log(
-    "GitHub releases:",
-    JSON.stringify(releases.map((r) => ({ tag: r.tag_name, assets: r.assets.map((a) => a.name) }))),
-  );
-  return (
-    releases.find((r) =>
-      r.assets.some((a) => a.name === ASSET_NAMES.x64 || a.name === ASSET_NAMES.arm64),
-    ) ?? null
-  );
+  return (await res.json()) as GitHubRelease;
 }
 
 export function buildReleaseFromTag(tag: string): CachedRelease {
@@ -108,12 +103,7 @@ export function buildReleaseFromTag(tag: string): CachedRelease {
   };
 }
 
-interface NpmDistTags {
-  alpha?: string;
-  latest?: string;
-}
-
-async function fetchLatestVersionFromNpm(): Promise<string | null> {
+async function fetchNpmDistTagVersion(distTag: string): Promise<string | null> {
   try {
     const res = await fetch("https://registry.npmjs.com/vite-plus", {
       headers: { Accept: "application/vnd.npm.install-v1+json" },
@@ -122,9 +112,8 @@ async function fetchLatestVersionFromNpm(): Promise<string | null> {
       console.error(`npm registry error: ${res.status} ${res.statusText}`);
       return null;
     }
-    const data = (await res.json()) as { "dist-tags"?: NpmDistTags };
-    // Windows installers are currently published under the alpha dist-tag
-    return data["dist-tags"]?.alpha ?? data["dist-tags"]?.latest ?? null;
+    const data = (await res.json()) as { "dist-tags"?: Record<string, string> };
+    return data["dist-tags"]?.[distTag] ?? null;
   } catch (err) {
     console.error("Failed to fetch version from npm registry:", err);
     return null;
@@ -176,7 +165,7 @@ async function getRelease(
 
   // Fallback 2: construct download URLs from tag or npm registry version
   if (tag) return buildReleaseFromTag(tag);
-  const version = await fetchLatestVersionFromNpm();
+  const version = await fetchNpmDistTagVersion(DEFAULT_DIST_TAG);
   if (version) return buildReleaseFromTag(`v${version}`);
 
   return null;

tests/index.test.ts

@@ -190,4 +190,74 @@ describe("fetchRelease", () => {
     const result = await fetchRelease("v1.0.0", undefined);
     expect(result).toEqual(release);
   });
+
+  it("default path: resolves via npm alpha dist-tag then fetches that GitHub tag", async () => {
+    const release = {
+      tag_name: "v0.1.17-alpha.0",
+      assets: [
+        {
+          name: "vp-setup-x86_64-pc-windows-msvc.exe",
+          browser_download_url:
+            "https://github.com/voidzero-dev/vite-plus/releases/download/v0.1.17-alpha.0/vp-setup-x86_64-pc-windows-msvc.exe",
+        },
+      ],
+    };
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify({ "dist-tags": { alpha: "0.1.17-alpha.0" } }), { status: 200 }),
+      )
+      .mockResolvedValueOnce(new Response(JSON.stringify(release), { status: 200 }));
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await fetchRelease(undefined, undefined);
+
+    expect(result).toEqual(release);
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+    const secondCallUrl = fetchMock.mock.calls[1][0];
+    expect(secondCallUrl).toContain("/releases/tags/v0.1.17-alpha.0");
+  });
+
+  it("default path: returns null and skips GitHub when npm registry fails", async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(
+        new Response("Service Unavailable", { status: 503, statusText: "Service Unavailable" }),
+      );
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await fetchRelease(undefined, undefined);
+
+    expect(result).toBeNull();
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("default path: returns null and skips GitHub when npm has no alpha dist-tag", async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify({ "dist-tags": { latest: "0.1.0" } }), { status: 200 }),
+      );
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await fetchRelease(undefined, undefined);
+
+    expect(result).toBeNull();
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+  });
+
+  it('default path: returns null (not "not-found") when GitHub 404s the resolved tag', async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValueOnce(
+        new Response(JSON.stringify({ "dist-tags": { alpha: "0.1.17-alpha.0" } }), { status: 200 }),
+      )
+      .mockResolvedValueOnce(new Response("Not Found", { status: 404, statusText: "Not Found" }));
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await fetchRelease(undefined, undefined);
+
+    expect(result).toBeNull();
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+  });
 });