santifer/career-ops · error · Error

the release pointer is not an object: ${url}

Error message

the release pointer is not an object: ${url}

What it means

The release pointer parsed as JSON but is not an object (e.g. a JSON string, number, array, or the literal 'null'). fetchPointer() requires a JSON object so it can read doc.filename and doc.sha256; anything else is rejected with this error. This guards against a pointer file whose contents silently changed shape.

Source

Thrown at plugins/h1b-sponsor/install-h1b-index.mjs:118

 * them is about to become part of a URL and the other the sole thing standing
 * between a substituted download and a lookup that trusts it.
 */
async function fetchPointer(fetchImpl, url) {
  const out = await fetchImpl(url, { timeoutMs: POINTER_TIMEOUT_MS }, async res => {
    if (res.status !== 200) return { status: res.status };
    const read = await readBoundedText(res, MAX_POINTER_BYTES);
    return read.oversized ? { oversized: true } : { text: read.text };
  });
  if (out.status) throw new Error(`could not read the release pointer (HTTP ${out.status}): ${url}`);
  if (out.oversized) throw new Error(`the release pointer is implausibly large: ${url}`);

  let doc;
  try {
    doc = JSON.parse(String(out.text || ''));
  } catch {
    throw new Error(`the release pointer is not JSON: ${url}`);
  }
  if (!doc || typeof doc !== 'object') throw new Error(`the release pointer is not an object: ${url}`);

  const filename = String(doc.filename || '');
  if (!FILENAME_RE.test(filename)) {
    throw new Error(`the release pointer names an unusable index filename (${JSON.stringify(doc.filename)}): ${url}`);
  }
  const sha256 = String(doc.sha256 || '').trim().toLowerCase();
  if (!SHA256_RE.test(sha256)) {
    throw new Error(`the release pointer does not carry a sha256 digest: ${url}`);
  }
  // Recorded, never acted on, so a missing or odd value costs a label rather
  // than the install. Bounded because it lands in a file on disk.
  const version = doc.version === undefined || doc.version === null
    ? null
    : String(doc.version).slice(0, 64);
  return { filename, sha256, version };
}

/**

View on GitHub (pinned to 1696bec4d0)

Solutions

1. Inspect the pointer file at the URL (curl it) and confirm it is a JSON object like {"filename":...,"sha256":...}.
2. Repoint H1B_API_BASE to the correct host if you are hitting the wrong service.
3. If you control the release, republish a correctly shaped pointer object and retry.

Example fix

// before (pointer file contents)
"0.9.4"
// after
{"filename":"h1b-index-2026-08-30.json","sha256":"<64-hex>"}

const doc = JSON.parse(await (await fetch(pointerUrl)).text());
if (!doc || typeof doc !== 'object' || Array.isArray(doc)) {
  throw new Error(`pointer at ${pointerUrl} must be a JSON object with filename/sha256`);
}

function isPointerObject(v) {
  return !!v && typeof v === 'object' && !Array.isArray(v) && typeof v.filename === 'string';
}

try {
  await installH1BIndex();
} catch (e) {
  if (String(e.message).includes('not an object')) {
    console.error('Pointer file has the wrong JSON shape; republish as {filename, sha256}.');
  } else throw e;
}

When it happens

Trigger: fetchPointer(url) parses the body successfully but the result is falsy or typeof doc !== 'object' — e.g. the file contains "null", "42", "[1,2]", or a quoted string.

Common situations: The pointer file was overwritten with a placeholder or checksum value during a broken release; someone hand-edited the hosted pointer; the endpoint serves a JSON scalar from a different service; an empty-ish body like 'null' after upstream cleared the file.

Understand the failure class

Background: "Invalid JSON response" and "Failed to parse response" errors: when an API answers 200 but the body isn't the JSON your library expected — this error's family across 28 libraries.

Related errors

• Missing required field: ${context}.${key}
• each entry needs a string "input" and "output"
• ${key} must be an array in ${path}
• the release pointer names an unusable index filename (${JSON
• the release pointer does not carry a sha256 digest: ${url}

AI-assisted analysis of santifer/career-ops@1696bec4d0 (2026-09-01). Data as JSON: /api/errors/332ce4bb78124e0b. Report an issue: GitHub.