fix(cdn): fix cache logic and optimize CDN module

- Fix getMeta() always returning {} causing cachePackageFromTarball
  to skip all caching (check cachedMeta?.files instead of cachedMeta)
- Fix GitHub route adding wrong v-prefix to tag names from jsDelivr API
- Add SKIP_TTL_MS (10min) for skipped packages to auto-retry later
- Add AbortSignal.timeout to cachePackageFromTarball download
- Extract NPM_REGISTRY_URL and JSR_REGISTRY_URL as constants
- Simplify ESM dependency resolution with semver.minVersion
- Fix ESM import rewrite regex to escape special characters
- Remove unnecessary async from calculateIntegrity
- Preserve integrity field in directory listings
- Fix cdnjs route mutating API response array in-place
- Add npm org listing endpoint (GET /cdn/npm/@scope)

Author: DemoMacro

server/routes/cdn/cdnjs/[...path].ts

@@ -237,7 +237,7 @@ export default defineHandler(async (event) => {
       // If still not found or version not specified, get latest version
       if (!versionFound) {
         // Sort by semver (descending) and get first
-        const sortedVersions = allVersions.sort(semver.rcompare);
+        const sortedVersions = [...allVersions].sort(semver.rcompare);
         const latestVersion = sortedVersions[0];
         if (latestVersion) {
           version = latestVersion;

server/routes/cdn/gh/[...path].ts

@@ -140,11 +140,7 @@ export default defineHandler(async (event) => {
     version = "main";
   }
 
-  // Normalize semver versions with v-prefix for GitHub (tags always use v-prefix)
-  if (semver.valid(version) && !version.startsWith("v")) {
-    version = `v${version}`;
-  }
-
+  // Use version as-is from jsDelivr API — it already returns the exact tag name
   const tarballUrl = getGitHubTarballUrl(owner, repo, version);
   const storage = cacheStorage;
   const cacheBase = `cdn/gh/${owner}/${repo}/${version}`;

server/routes/cdn/jsr/[...path].ts

@@ -5,6 +5,7 @@ import semver from "semver";
 import {
   type CdnFile,
   type CdnPackageListing,
+  JSR_REGISTRY_URL,
   getCacheControl,
   getContentType,
   getDirectoryListing,
@@ -81,8 +82,7 @@ export default defineHandler(async (event) => {
   // Fetch package metadata from npm.jsr.io
   // JSR uses npm compatibility name: @scope/package -> @jsr/scope__package
   const npmCompatName = `@jsr/${scope}__${pkg}`;
-  const registryUrl = "https://npm.jsr.io";
-  const metadataRes = await fetch(`${registryUrl}/${npmCompatName}`);
+  const metadataRes = await fetch(`${JSR_REGISTRY_URL}/${npmCompatName}`);
   if (!metadataRes.ok) {
     throw new HTTPError({
       status: 404,

server/routes/cdn/npm/[...path].ts

@@ -4,7 +4,10 @@ import semver from "semver";
 
 import {
   type CdnFile,
+  type CdnOrgListing,
   type CdnPackageListing,
+  CACHE_CONTROL_SHORT,
+  NPM_REGISTRY_URL,
   bundleNpmPackage,
   getCacheControl,
   getContentType,
@@ -65,6 +68,27 @@ export default defineHandler(async (event) => {
   let filepath: string;
 
   if (path.startsWith("@")) {
+    // Handle org listing: @scope or @scope/ (no package name)
+    const scopeOnlyMatch = path.match(/^@([^/]+)\/?$/);
+    if (scopeOnlyMatch) {
+      const [, scope] = scopeOnlyMatch;
+      const orgRes = await fetch(`${NPM_REGISTRY_URL}/-/org/${scope}/package`);
+      if (!orgRes.ok) {
+        throw new HTTPError({ status: 404, statusText: "Organization not found" });
+      }
+      const orgData = (await orgRes.json()) as Record<string, string>;
+      const packages = Object.keys(orgData);
+
+      event.res.headers.set("Content-Type", "application/json");
+      event.res.headers.set("Cache-Control", CACHE_CONTROL_SHORT);
+
+      const response: CdnOrgListing = {
+        name: `@${scope}`,
+        packages,
+      };
+      return response;
+    }
+
     // Scoped: @types/hast@latest/index.d.ts
     const match = path.match(/^@([^/]+)\/([^@/]+)(?:@([^/]+))?(?:\/(.*))?$/);
     if (!match) {
@@ -101,8 +125,7 @@ export default defineHandler(async (event) => {
   }
 
   // Fetch package metadata from npm registry
-  const registryUrl = "https://registry.npmjs.org";
-  const metadataRes = await fetch(`${registryUrl}/${packageName}`);
+  const metadataRes = await fetch(`${NPM_REGISTRY_URL}/${packageName}`);
   if (!metadataRes.ok) {
     throw new HTTPError({
       status: 404,

server/utils/cdn/constants.ts

@@ -1,11 +1,20 @@
-/** Tarball download timeout in milliseconds (10 seconds) */
-export const TARBALL_DOWNLOAD_TIMEOUT = 10_000;
+/** Tarball download timeout in milliseconds (30 seconds) */
+export const TARBALL_DOWNLOAD_TIMEOUT = 30_000;
 
 /** Short cache duration for mutable/branch/incomplete versions (10 minutes) */
 export const CACHE_CONTROL_SHORT = "public, max-age=600";
 
 /** Long cache duration for immutable/complete semver versions (1 year) */
 export const CACHE_CONTROL_LONG = "public, max-age=31536000, immutable";
 
+/** How long a skipped package stays skipped before retry (10 minutes) */
+export const SKIP_TTL_MS = 10 * 60 * 1000;
+
+/** npm registry base URL */
+export const NPM_REGISTRY_URL = "https://registry.npmjs.org";
+
+/** JSR registry base URL (npm compatibility layer) */
+export const JSR_REGISTRY_URL = "https://npm.jsr.io";
+
 /** Maximum allowed unpacked package size in bytes (50 MB) */
 export const MAX_UNPACKED_SIZE = 50 * 1024 * 1024;

server/utils/cdn/esm.ts

@@ -43,47 +43,12 @@ export async function bundleNpmPackage(options: BundleOptions): Promise<string>
 
   for (const [depName, depRange] of Object.entries(allDependencyRanges)) {
     try {
-      const rangeStr = depRange as string;
-      // Use semver to parse the range and get the upper bound
-      const range = new semver.Range(rangeStr);
-
-      // Get comparators from the range to find the upper bound
-      let targetVersion: string | null = null;
-
-      for (const comparatorSet of range.set) {
-        for (const comparator of comparatorSet) {
-          // Look for the upper bound (comparator with < operator)
-          if (comparator.operator === "<") {
-            const version = comparator.semver;
-            if (version.patch === 0 && version.prerelease && version.prerelease[0] === 0) {
-              const major = version.major;
-              const minor = version.minor;
-
-              if (minor === 0) {
-                targetVersion = String(major - 1);
-              } else {
-                targetVersion = `${major}.${minor - 1}`;
-              }
-              break;
-            }
-          }
-        }
-        if (targetVersion) break;
-      }
-
-      // Fallback: if no upper bound found, use minVersion
-      if (!targetVersion) {
-        const minVersion = semver.minVersion(rangeStr);
-        if (minVersion) {
-          targetVersion = minVersion.version;
-        }
-      }
-
-      if (targetVersion) {
-        dependencies[depName] = targetVersion;
+      const minVersion = semver.minVersion(depRange as string);
+      if (minVersion) {
+        dependencies[depName] = minVersion.version;
       }
-    } catch (error) {
-      console.error(`[Bundler] Error resolving ${depName}:`, error);
+    } catch {
+      console.error(`[Bundler] Error resolving ${depName}`);
     }
   }
 
@@ -204,10 +169,10 @@ export async function bundleNpmPackage(options: BundleOptions): Promise<string>
   // Rewrite all bare imports to CDN paths
   for (const depName of allImports) {
     const cdnPath = cdnPaths[depName] || `/cdn/npm/${depName}/+esm`;
+    const escapedDepName = depName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     bundledCode = bundledCode.replaceAll(
-      new RegExp(`(?:from)?(["'])${depName}\\1`, "g"),
-      (m, quote) =>
-        m.startsWith("from") ? `from${quote}${cdnPath}${quote}` : `${quote}${cdnPath}${quote}`,
+      new RegExp(`(from\\s*["'])${escapedDepName}(["'])`, "g"),
+      `$1${cdnPath}$2`,
     );
   }
 

server/utils/cdn/index.ts

@@ -1,9 +1,11 @@
-export type { CdnFile, CdnDirectoryListing, CdnPackageListing } from "./types";
+export type { CdnFile, CdnDirectoryListing, CdnPackageListing, CdnOrgListing } from "./types";
 export {
   TARBALL_DOWNLOAD_TIMEOUT,
   CACHE_CONTROL_SHORT,
   CACHE_CONTROL_LONG,
   MAX_UNPACKED_SIZE,
+  NPM_REGISTRY_URL,
+  JSR_REGISTRY_URL,
 } from "./constants";
 export { getCacheControl } from "./semver";
 export {

server/utils/cdn/integrity.ts

@@ -7,7 +7,7 @@
  * @param data - File data as Uint8Array
  * @returns SRI integrity string in format "sha256-{base64-hash}"
  */
-export async function calculateIntegrity(data: Uint8Array): Promise<string> {
+export function calculateIntegrity(data: Uint8Array): string {
   const hasher = new Bun.CryptoHasher("sha256");
   hasher.update(data);
   return `sha256-${hasher.digest("base64")}`;

server/utils/cdn/listing.ts

@@ -17,14 +17,15 @@ export async function getDirectoryListing(
 ): Promise<CdnPackageListing | null> {
   const storage = cacheStorage;
   const meta = await storage.getMeta(cacheBase);
-  const allFiles = (meta?.files || []) as Array<{ name: string; size: number }>;
+  const allFiles = (meta?.files || []) as Array<CdnFile>;
 
   const dirPrefix = `${filepath}/`;
   const dirContents: CdnFile[] = allFiles
     .filter((file) => file.name.startsWith(dirPrefix))
     .map((file) => ({
       name: file.name.slice(dirPrefix.length),
       size: file.size,
+      ...(file.integrity ? { integrity: file.integrity } : {}),
     }))
     .filter((file) => file.name.length > 0);
 

server/utils/cdn/tarball.ts

@@ -1,7 +1,7 @@
 import { HTTPError } from "nitro/h3";
 
 import { cacheStorage } from "../storage";
-import { MAX_UNPACKED_SIZE, TARBALL_DOWNLOAD_TIMEOUT } from "./constants";
+import { MAX_UNPACKED_SIZE, SKIP_TTL_MS, TARBALL_DOWNLOAD_TIMEOUT } from "./constants";
 import { calculateIntegrity } from "./integrity";
 import type { CdnFile } from "./types";
 
@@ -201,20 +201,23 @@ export async function cachePackageFromTarball(
 ): Promise<void> {
   const storage = cacheStorage;
 
-  // Check if already cached or previously skipped
+  // Check if already cached with file list, or still within skip TTL
   const cachedMeta = await storage.getMeta(cacheBase);
-  if (cachedMeta) return;
+  if (cachedMeta?.files) return;
+  if (cachedMeta?.skippedAt && Date.now() - Number(cachedMeta.skippedAt) < SKIP_TTL_MS) return;
 
   // Skip if another call is already downloading this tarball
   if (pendingTarballs.has(cacheBase)) return;
   pendingTarballs.add(cacheBase);
 
   try {
     // Download and extract tarball
-    const tarballRes = await fetch(tarballUrl);
+    const tarballRes = await fetch(tarballUrl, {
+      signal: AbortSignal.timeout(TARBALL_DOWNLOAD_TIMEOUT),
+    });
     if (!tarballRes.ok) {
       console.error(`Failed to download tarball for ${logLabel || cacheBase}`);
-      await storage.setMeta(cacheBase, { missed: true });
+      await storage.setMeta(cacheBase, { skippedAt: Date.now() });
       return;
     }
 
@@ -240,7 +243,7 @@ export async function cachePackageFromTarball(
       console.warn(
         `Skipping ${logLabel || cacheBase}: unpacked size ${(totalSize / 1024 / 1024).toFixed(1)} MB exceeds ${MAX_UNPACKED_SIZE / 1024 / 1024} MB limit`,
       );
-      await storage.setMeta(cacheBase, { missed: true });
+      await storage.setMeta(cacheBase, { skippedAt: Date.now() });
       return;
     }
 
@@ -257,7 +260,7 @@ export async function cachePackageFromTarball(
         await storage.setItemRaw(cacheKey, fileData);
 
         // Calculate SHA-256 integrity for SRI
-        const integrity = await calculateIntegrity(fileData);
+        const integrity = calculateIntegrity(fileData);
         const fileItem = fileList.find((f) => f.name === relativePath);
         if (fileItem) {
           fileItem.integrity = integrity;