@package-broker/core 0.16.4 → 0.17.0

package/dist/routes/composer.d.ts

@@ -17,12 +17,22 @@ export interface ComposerRouteEnv {
         requestId?: string;
     };
 }
+/** Default maximum versions per package to avoid CPU timeout on Cloudflare Workers */
+export declare const DEFAULT_MAX_VERSIONS = 50;
 /**
  * GET /packages.json
  * Serve aggregated packages.json for all private repositories
  * Uses KV caching with stale-while-revalidate strategy
  */
 export declare function packagesJsonRoute(c: Context<ComposerRouteEnv>): Promise<Response>;
+/**
+ * Lazy load package metadata from all available repositories
+ * Returns package data and repo_id if found, null otherwise
+ */
+export declare function lazyLoadPackageFromRepositories(db: DatabasePort, packageName: string, encryptionKey: string, kv?: KVNamespace | null): Promise<{
+    packageData: any;
+    repoId: string;
+} | null>;
 /**
  * GET /p2/:vendor/:package.json
  * Serve individual package metadata (Composer 2 provider format)
@@ -33,12 +43,17 @@ export declare function p2PackageRoute(c: Context<ComposerRouteEnv>): Promise<Re
  * Build Composer 2 provider response for a single package from stored metadata.
  * Composer 2 (p2) format expects versions as an ARRAY, not a dict keyed by version.
  */
-export declare function buildP2Response(packageName: string, packageVersions: Array<typeof packages.$inferSelect>, maxVersions?: number): ComposerP2Response;
+export declare function buildP2Response(packageName: string, packageVersions: Array<typeof packages.$inferSelect>, maxVersions?: number, baseUrl?: string): ComposerP2Response;
+export declare function deriveVersionNormalized(version: string): string | undefined;
 /**
  * Ensure Packagist repository exists in database
  * Creates it if it doesn't exist
  */
 export declare function ensurePackagistRepository(db: DatabasePort, encryptionKey: string, kv?: KVNamespace): Promise<void>;
+export declare function normalizePackageVersions(versions: any): Array<{
+    version: string;
+    metadata: any;
+}>;
 /**
  * Transform package dist URLs to proxy URLs and store in database
  * Waits for all database writes to complete before returning

package/dist/routes/composer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"composer.d.ts","sourceRoot":"","sources":["../../src/routes/composer.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAa,MAAM,UAAU,CAAC;AACxD,OAAO,EAAgB,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAQvD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE;QACR,EAAE,EAAE,UAAU,CAAC;QACf,EAAE,CAAC,EAAE,WAAW,CAAC;QACjB,KAAK,CAAC,EAAE,KAAK,CAAC;QACd,wBAAwB,CAAC,EAAE,QAAQ,CAAC;QACpC,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,SAAS,EAAE;QACT,OAAO,EAAE,aAAa,CAAC;QACvB,QAAQ,EAAE,YAAY,CAAC;QACvB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAsFD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0EvF;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+PpF;AAmED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC,YAAY,CAAC,EACpD,WAAW,GAAE,MAA6B,GACzC,kBAAkB,CAqKpB;AAuBD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,YAAY,EAChB,aAAa,EAAE,MAAM,EACrB,EAAE,CAAC,EAAE,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAkbD;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,WAAW,EAAE,GAAG,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,EAAE,EAAE,YAAY,GACf,OAAO,CAAC;IAAE,WAAW,EAAE,GAAG,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA4NtE;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,YAAY,EAChB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,GAAG,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,YAAY,EAChB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,GAAG,EACb,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAAC,IAAI,CAAC,CA6Df;AAeD,UAAU,kBAAkB;IAE1B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,UAAU,cAAc;IACtB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,IAAI,EAAE;QACJ,kDAAkD;QAClD,IAAI,EAAE,MAAM,CAAC;QACb,6BAA6B;QAC7B,GAAG,EAAE,MAAM,CAAC;QACZ,+EAA+E;QAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,+BAA+B;QAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,+DAA+D;QAC/D,OAAO,CAAC,EAAE,KAAK,CAAC;YACd,GAAG,EAAE,MAAM,CAAC;YACZ,SAAS,CAAC,EAAE,OAAO,CAAC;SACrB,CAAC,CAAC;KACJ,CAAC;IACF,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,qCAAqC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC"}
+{"version":3,"file":"composer.d.ts","sourceRoot":"","sources":["../../src/routes/composer.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,YAAY,EAAa,MAAM,UAAU,CAAC;AACxD,OAAO,EAAgB,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAQvD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE;QACR,EAAE,EAAE,UAAU,CAAC;QACf,EAAE,CAAC,EAAE,WAAW,CAAC;QACjB,KAAK,CAAC,EAAE,KAAK,CAAC;QACd,wBAAwB,CAAC,EAAE,QAAQ,CAAC;QACpC,cAAc,EAAE,MAAM,CAAC;QACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;IACF,SAAS,EAAE;QACT,OAAO,EAAE,aAAa,CAAC;QACvB,QAAQ,EAAE,YAAY,CAAC;QACvB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAmFvC;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA0EvF;AAiCD;;;GAGG;AACH,wBAAsB,+BAA+B,CACnD,EAAE,EAAE,YAAY,EAChB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,EAAE,CAAC,EAAE,WAAW,GAAG,IAAI,GACtB,OAAO,CAAC;IAAE,WAAW,EAAE,GAAG,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CA0FtD;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CA8KpF;AAyGD;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,WAAW,EAAE,MAAM,EACnB,eAAe,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC,YAAY,CAAC,EACpD,WAAW,GAAE,MAA6B,EAC1C,OAAO,CAAC,EAAE,MAAM,GACf,kBAAkB,CAoLpB;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAsD3E;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,YAAY,EAChB,aAAa,EAAE,MAAM,EACrB,EAAE,CAAC,EAAE,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CA4Cf;AA+WD,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,GAAG,GAAG,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,GAAG,CAAA;CAAE,CAAC,CAiBjG;AAoED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,WAAW,EAAE,GAAG,EAChB,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,EAAE,EAAE,YAAY,GACf,OAAO,CAAC;IAAE,WAAW,EAAE,GAAG,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA4NtE;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,YAAY,EAChB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,GAAG,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,YAAY,EAChB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,GAAG,EACb,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,OAAO,CAAC,IAAI,CAAC,CA6Df;AAeD,UAAU,kBAAkB;IAE1B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,UAAU,cAAc;IACtB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,yCAAyC;IACzC,IAAI,EAAE;QACJ,kDAAkD;QAClD,IAAI,EAAE,MAAM,CAAC;QACb,6BAA6B;QAC7B,GAAG,EAAE,MAAM,CAAC;QACZ,+EAA+E;QAC/E,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,+BAA+B;QAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,+DAA+D;QAC/D,OAAO,CAAC,EAAE,KAAK,CAAC;YACd,GAAG,EAAE,MAAM,CAAC;YACZ,SAAS,CAAC,EAAE,OAAO,CAAC;SACrB,CAAC,CAAC;KACJ,CAAC;IACF,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC5B,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,MAAM,CAAC,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,qCAAqC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,yCAAyC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC"}

package/dist/routes/composer.js

@@ -13,7 +13,7 @@ import { encryptCredentials } from '../utils/encryption';
 import { getLogger } from '../utils/logger';
 import { getAnalytics } from '../utils/analytics';
 /** Default maximum versions per package to avoid CPU timeout on Cloudflare Workers */
-const DEFAULT_MAX_VERSIONS = 50;
+export const DEFAULT_MAX_VERSIONS = 50;
 /**
  * Schedule background storage of package data.
  * Uses Cloudflare Workflows when available, falls back to inline processing.
@@ -156,6 +156,116 @@ export async function packagesJsonRoute(c) {
     headers.set('Cache-Control', 'public, max-age=300, stale-while-revalidate=60');
     return new Response(JSON.stringify(packagesJson), { status: 200, headers });
 }
+function sortRepositoriesByPriority(repos) {
+    return [...repos].sort((a, b) => {
+        if (a.id === 'manual' && b.id !== 'manual')
+            return -1;
+        if (a.id !== 'manual' && b.id === 'manual')
+            return 1;
+        if (a.id === 'packagist' && b.id !== 'packagist')
+            return 1;
+        if (a.id !== 'packagist' && b.id === 'packagist')
+            return -1;
+        return (a.created_at || 0) - (b.created_at || 0);
+    });
+}
+function matchesPackageFilter(packageName, filter) {
+    if (!filter)
+        return true;
+    const patterns = filter.split(',').map((p) => p.trim().toLowerCase());
+    const pkgLower = packageName.toLowerCase();
+    return patterns.some((pattern) => {
+        if (pattern.endsWith('/*')) {
+            const prefix = pattern.slice(0, -1);
+            return pkgLower.startsWith(prefix);
+        }
+        if (pattern.endsWith('*')) {
+            const prefix = pattern.slice(0, -1);
+            return pkgLower.startsWith(prefix);
+        }
+        return pkgLower === pattern;
+    });
+}
+/**
+ * Lazy load package metadata from all available repositories
+ * Returns package data and repo_id if found, null otherwise
+ */
+export async function lazyLoadPackageFromRepositories(db, packageName, encryptionKey, kv) {
+    const allRepos = await db
+        .select()
+        .from(repositories)
+        .where(inArray(repositories.status, ['active', 'pending', 'syncing']));
+    const sortedRepos = sortRepositoriesByPriority(allRepos);
+    for (const repo of sortedRepos) {
+        try {
+            if (!matchesPackageFilter(packageName, repo.package_filter)) {
+                continue;
+            }
+            let packageData = null;
+            if (repo.vcs_type === 'composer') {
+                const { fetchPackageFromUpstream } = await import('../utils/upstream-fetch');
+                packageData = await fetchPackageFromUpstream({
+                    id: repo.id,
+                    url: repo.url,
+                    vcs_type: repo.vcs_type,
+                    credential_type: repo.credential_type,
+                    auth_credentials: repo.auth_credentials,
+                    package_filter: repo.package_filter,
+                }, packageName, encryptionKey);
+            }
+            else if (repo.vcs_type === 'git') {
+                const { fetchPackageFromGitHub, isGitHubUrl } = await import('../utils/upstream-fetch');
+                if (!isGitHubUrl(repo.url)) {
+                    continue;
+                }
+                packageData = await fetchPackageFromGitHub({
+                    id: repo.id,
+                    url: repo.url,
+                    vcs_type: repo.vcs_type,
+                    credential_type: repo.credential_type,
+                    auth_credentials: repo.auth_credentials,
+                    package_filter: repo.package_filter,
+                }, packageName, encryptionKey);
+            }
+            if (packageData) {
+                return { packageData, repoId: repo.id };
+            }
+        }
+        catch (error) {
+            const logger = getLogger();
+            logger.warn('Error fetching package from repo', {
+                packageName,
+                repoId: repo.id,
+                vcsType: repo.vcs_type,
+                error: error instanceof Error ? error.message : String(error)
+            });
+        }
+    }
+    const { isPackagistMirroringEnabled } = await import('../modules/admin');
+    const mirroringEnabled = await isPackagistMirroringEnabled(kv);
+    if (mirroringEnabled) {
+        try {
+            const packagistUrl = `https://repo.packagist.org/p2/${packageName}.json`;
+            const response = await fetch(packagistUrl, {
+                headers: {
+                    'User-Agent': COMPOSER_USER_AGENT,
+                },
+            });
+            if (response.ok) {
+                const packageData = await response.json();
+                return { packageData, repoId: 'packagist' };
+            }
+        }
+        catch (error) {
+            const logger = getLogger();
+            logger.warn('Error fetching from Packagist', {
+                packageName,
+                error: error instanceof Error ? error.message : String(error)
+            });
+        }
+    }
+    return null;
+}
 /**
  * GET /p2/:vendor/:package.json
  * Serve individual package metadata (Composer 2 provider format)
@@ -241,7 +351,9 @@ export async function p2PackageRoute(c) {
     if (existingPackages.length > 0) {
         // Build response from database packages
         const maxVersions = getMaxVersions(c.env);
-        const packageData = buildP2Response(packageName, existingPackages, maxVersions);
+        const url = new URL(c.req.url);
+        const baseUrl = `${url.protocol}//${url.host}`;
+        const packageData = buildP2Response(packageName, existingPackages, maxVersions, baseUrl);
         // Cache the result (fire-and-forget to avoid blocking on KV rate limits)
         const cachingEnabled = await isPackageCachingEnabled(c.env.KV);
         if (cachingEnabled && c.env.KV) {
@@ -267,112 +379,36 @@ export async function p2PackageRoute(c) {
         return new Response(JSON.stringify(packageData), { status: 200, headers });
     }
     // Not in database - try lazy loading from upstream repositories
-    const activeRepos = await db
-        .select()
-        .from(repositories)
-        .where(eq(repositories.status, 'active'));
     const url = new URL(c.req.url);
     const baseUrl = `${url.protocol}//${url.host}`;
     const maxVersions = getMaxVersions(c.env);
-    // Try to fetch from upstream repositories (Composer and GitHub)
-    for (const repo of activeRepos) {
-        try {
-            // Early filter: skip repo if package_filter is set and package doesn't match
-            // This avoids unnecessary API calls to upstream repositories
-            // Supports wildcards: "mirasvit/*" matches all mirasvit packages
-            if (repo.package_filter) {
-                const patterns = repo.package_filter.split(',').map((p) => p.trim().toLowerCase());
-                const pkgLower = packageName.toLowerCase();
-                const matches = patterns.some((pattern) => {
-                    if (pattern.endsWith('/*')) {
-                        // Wildcard pattern: "vendor/*" matches "vendor/anything"
-                        const prefix = pattern.slice(0, -1); // "vendor/"
-                        return pkgLower.startsWith(prefix);
-                    }
-                    if (pattern.endsWith('*')) {
-                        // Prefix wildcard: "mirasvit*" matches "mirasvit-module", "mirasvit/foo"
-                        const prefix = pattern.slice(0, -1);
-                        return pkgLower.startsWith(prefix);
-                    }
-                    // Exact match
-                    return pkgLower === pattern;
-                });
-                if (!matches) {
-                    continue; // Skip this repo - package not in filter list
-                }
-            }
-            let packageData = null;
-            if (repo.vcs_type === 'composer') {
-                // Fetch from Composer repository (Satis, Private Packagist, etc.)
-                const { fetchPackageFromUpstream } = await import('../utils/upstream-fetch');
-                packageData = await fetchPackageFromUpstream({
-                    id: repo.id,
-                    url: repo.url,
-                    vcs_type: repo.vcs_type,
-                    credential_type: repo.credential_type,
-                    auth_credentials: repo.auth_credentials,
-                    package_filter: repo.package_filter,
-                }, packageName, c.env.ENCRYPTION_KEY);
-            }
-            else if (repo.vcs_type === 'git') {
-                // Fetch from GitHub repository (public or private)
-                const { fetchPackageFromGitHub, isGitHubUrl } = await import('../utils/upstream-fetch');
-                // Validate GitHub URL using proper hostname check (security)
-                if (!isGitHubUrl(repo.url)) {
-                    // Skip non-GitHub git repos (e.g., GitLab, Bitbucket - not yet supported)
-                    continue;
-                }
-                packageData = await fetchPackageFromGitHub({
-                    id: repo.id,
-                    url: repo.url,
-                    vcs_type: repo.vcs_type,
-                    credential_type: repo.credential_type,
-                    auth_credentials: repo.auth_credentials,
-                    package_filter: repo.package_filter,
-                }, packageName, c.env.ENCRYPTION_KEY);
-            }
-            if (packageData) {
-                const transformedData = transformDistUrlsInMemory(packageData, repo.id, baseUrl, maxVersions);
-                // Store package versions in background
-                schedulePackageStorage(c, packageName, packageData, repo.id, baseUrl);
-                // Track metadata request (cache miss, from upstream)
-                const analytics = getAnalytics();
-                const requestId = c.get('requestId');
-                const packageCount = transformedData.packages?.[packageName] ? Object.keys(transformedData.packages[packageName]).length : 0;
-                analytics.trackPackageMetadataRequest({
-                    requestId,
-                    cacheHit: false,
-                    packageCount,
-                });
-                const headers = new Headers();
-                headers.set('Content-Type', 'application/json');
-                headers.set('Last-Modified', new Date().toUTCString());
-                headers.set('Cache-Control', 'public, max-age=300, stale-while-revalidate=60');
-                headers.set('X-Cache', 'MISS-UPSTREAM');
-                return new Response(JSON.stringify(transformedData), { status: 200, headers });
-            }
-        }
-        catch (error) {
-            const logger = getLogger();
-            logger.warn('Error fetching package from repo', {
-                packageName,
-                repoId: repo.id,
-                vcsType: repo.vcs_type,
-                error: error instanceof Error ? error.message : String(error)
-            });
-            // Continue to next repository
-        }
-    }
-    // Not found in any upstream repo - check if Packagist mirroring is enabled
-    const mirroringEnabled = await isPackagistMirroringEnabled(c.env.KV);
-    if (!mirroringEnabled) {
-        return c.json({
-            error: 'Not Found',
-            message: 'Package not found. Public Packagist mirroring is disabled.',
-        }, 404);
+    const lazyLoadResult = await lazyLoadPackageFromRepositories(db, packageName, c.env.ENCRYPTION_KEY, c.env.KV);
+    if (lazyLoadResult) {
+        const { packageData, repoId } = lazyLoadResult;
+        const transformedData = transformDistUrlsInMemory(packageData, repoId, baseUrl, maxVersions);
+        // Store package versions in background
+        schedulePackageStorage(c, packageName, packageData, repoId, baseUrl);
+        // Track metadata request (cache miss, from upstream)
+        const analytics = getAnalytics();
+        const requestId = c.get('requestId');
+        const packageCount = transformedData.packages?.[packageName] ? Object.keys(transformedData.packages[packageName]).length : 0;
+        analytics.trackPackageMetadataRequest({
+            requestId,
+            cacheHit: false,
+            packageCount,
+        });
+        const headers = new Headers();
+        headers.set('Content-Type', 'application/json');
+        headers.set('Last-Modified', new Date().toUTCString());
+        headers.set('Cache-Control', 'public, max-age=300, stale-while-revalidate=60');
+        headers.set('X-Cache', 'MISS-UPSTREAM');
+        return new Response(JSON.stringify(transformedData), { status: 200, headers });
     }
-    // Proxy to public Packagist
-    return proxyToPackagist(c, packageName);
+    // Not found in any repository (including Packagist)
+    return c.json({
+        error: 'Not Found',
+        message: 'Package not found in any repository.',
+    }, 404);
 }
 /**
  * Build aggregated packages.json from all repositories
@@ -413,15 +449,53 @@ async function buildPackagesJson(c) {
         if (!packagesMap[pkg.name]) {
             packagesMap[pkg.name] = {};
         }
-        // Use dist_url (proxy URL) and transform to mirror format
-        // source_dist_url is the original external URL - don't expose it to clients
+        // Preserve original dist from metadata - do NOT modify dist.url or dist.type
+        let dist;
+        if (pkg.metadata) {
+            try {
+                const metadata = JSON.parse(pkg.metadata);
+                if (metadata.dist && typeof metadata.dist === 'object' && !Array.isArray(metadata.dist)) {
+                    // Use original dist from upstream metadata exactly as-is
+                    dist = { ...metadata.dist };
+                }
+                else {
+                    // Fallback: create minimal dist if metadata doesn't have dist
+                    dist = {
+                        type: 'zip',
+                        url: pkg.source_dist_url || transformDistUrlToMirrorFormat(pkg.dist_url) || pkg.dist_url,
+                    };
+                }
+            }
+            catch {
+                // If metadata parsing fails, use fallback
+                dist = {
+                    type: 'zip',
+                    url: pkg.source_dist_url || transformDistUrlToMirrorFormat(pkg.dist_url) || pkg.dist_url,
+                };
+            }
+        }
+        else {
+            // No metadata available - use fallback
+            dist = {
+                type: 'zip',
+                url: pkg.source_dist_url || transformDistUrlToMirrorFormat(pkg.dist_url) || pkg.dist_url,
+            };
+        }
+        // Add mirrors section to dist object if not already present
+        // This ensures Composer can use the mirror while preserving original dist.url
+        // This prevents Composer from treating packages as upgrades when dist.url differs
+        if (!dist.mirrors || !Array.isArray(dist.mirrors) || dist.mirrors.length === 0) {
+            dist.mirrors = [
+                {
+                    url: `${baseUrl}/dist/m/%package%/%version%.%type%`,
+                    preferred: true,
+                },
+            ];
+        }
         packagesMap[pkg.name][pkg.version] = {
             name: pkg.name,
             version: pkg.version,
-            dist: {
-                type: 'zip',
-                url: transformDistUrlToMirrorFormat(pkg.dist_url) || pkg.dist_url,
-            },
+            dist,
         };
     }
     return {
@@ -432,7 +506,7 @@ async function buildPackagesJson(c) {
  * Build Composer 2 provider response for a single package from stored metadata.
  * Composer 2 (p2) format expects versions as an ARRAY, not a dict keyed by version.
  */
-export function buildP2Response(packageName, packageVersions, maxVersions = DEFAULT_MAX_VERSIONS) {
+export function buildP2Response(packageName, packageVersions, maxVersions = DEFAULT_MAX_VERSIONS, baseUrl) {
     // Apply version limiting to DB records as well
     // Convert to normalized format for limiting
     const normalizedForLimiting = packageVersions.map(pkg => ({
@@ -448,21 +522,42 @@ export function buildP2Response(packageName, packageVersions, maxVersions = DEFA
     const filteredPackageVersions = packageVersions.filter(pkg => limitedVersionSet.has(pkg.version));
     const versions = [];
     for (const pkg of filteredPackageVersions) {
-        const dist = {
-            type: 'zip',
-            url: transformDistUrlToMirrorFormat(pkg.dist_url) || pkg.dist_url,
-        };
-        if (pkg.dist_reference) {
-            dist.reference = pkg.dist_reference;
-        }
         let fullMetadata = null;
         if (pkg.metadata) {
             try {
                 fullMetadata = JSON.parse(pkg.metadata);
             }
             catch {
+                // Ignore invalid JSON; use fallback metadata
             }
         }
+        // Preserve original dist from metadata - do NOT modify dist.url or dist.type
+        let dist;
+        if (fullMetadata?.dist && typeof fullMetadata.dist === 'object' && !Array.isArray(fullMetadata.dist)) {
+            // Use original dist from upstream metadata exactly as-is
+            dist = { ...fullMetadata.dist };
+        }
+        else {
+            // Fallback: only create minimal dist if metadata doesn't exist (shouldn't happen in practice)
+            dist = {
+                type: 'zip',
+                url: pkg.source_dist_url || transformDistUrlToMirrorFormat(pkg.dist_url) || pkg.dist_url,
+            };
+            if (pkg.dist_reference) {
+                dist.reference = pkg.dist_reference;
+            }
+        }
+        // Add mirrors section to dist object if not already present
+        // This ensures Composer can use the mirror while preserving original dist.url
+        // This prevents Composer from treating packages as upgrades when dist.url differs
+        if (baseUrl && (!dist.mirrors || !Array.isArray(dist.mirrors) || dist.mirrors.length === 0)) {
+            dist.mirrors = [
+                {
+                    url: `${baseUrl}/dist/m/%package%/%version%.%type%`,
+                    preferred: true,
+                },
+            ];
+        }
         const displayVersion = typeof fullMetadata?.version === 'string' ? fullMetadata.version : pkg.version;
         const normalizedVersion = typeof fullMetadata?.version_normalized === 'string'
             ? fullMetadata.version_normalized
@@ -484,6 +579,7 @@ export function buildP2Response(packageName, packageVersions, maxVersions = DEFA
                 }
             }
             catch {
+                // Ignore license processing errors; use original value
                 versionDataBase.license = pkg.license;
             }
         }
@@ -510,12 +606,6 @@ export function buildP2Response(packageName, packageVersions, maxVersions = DEFA
                     ...(fullMetadata.source.reference && { reference: fullMetadata.source.reference }),
                 };
             }
-            if (fullMetadata.dist?.type && fullMetadata.dist.type !== 'zip') {
-                dist.type = fullMetadata.dist.type;
-            }
-            if (fullMetadata.dist?.shasum) {
-                dist.shasum = fullMetadata.dist.shasum;
-            }
             if (fullMetadata.require && typeof fullMetadata.require === 'object' && !Array.isArray(fullMetadata.require)) {
                 versionDataBase.require = fullMetadata.require;
             }
@@ -582,21 +672,52 @@ export function buildP2Response(packageName, packageVersions, maxVersions = DEFA
         },
     };
 }
-function deriveVersionNormalized(version) {
+export function deriveVersionNormalized(version) {
     const v = version.startsWith('v') ? version.slice(1) : version;
+    // Handle patch versions (e.g., "103.0.7-p8" → "103.0.7.0-patch8")
     const patchMatch = v.match(/^(\d+\.\d+\.\d+)-p(\d+)$/);
     if (patchMatch) {
         const [, base, patch] = patchMatch;
         return `${base}.0-patch${patch}`;
     }
-    const numericMatch = v.match(/^(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:\.(\d+))?$/);
-    if (numericMatch) {
-        const major = numericMatch[1];
-        const minor = numericMatch[2] ?? '0';
-        const patch = numericMatch[3] ?? '0';
-        const build = numericMatch[4] ?? '0';
-        return `${major}.${minor}.${patch}.${build}`;
+    // Explicit parser avoids regex backtracking and ReDoS concerns:
+    // 1. Parse up to 4 numeric segments separated by dots from the start of the string.
+    // 2. Treat everything after the parsed numeric part as the suffix (e.g., "-beta", "-alpha", "-dev").
+    let index = 0;
+    const length = v.length;
+    const segments = [];
+    while (index < length && segments.length < 4) {
+        const start = index;
+        // Read a numeric segment
+        while (index < length) {
+            const ch = v.charCodeAt(index);
+            if (ch < 48 || ch > 57) { // not '0'–'9'
+                break;
+            }
+            index++;
+        }
+        if (index === start) {
+            // No digits found where a segment was expected
+            break;
+        }
+        segments.push(v.slice(start, index));
+        // If we have 4 segments or we've reached the end, stop
+        if (segments.length === 4 || index >= length) {
+            break;
+        }
+        // Expect a dot between segments; if not present, stop parsing numeric part
+        if (v[index] === '.') {
+            index++;
+            continue;
+        }
+        break;
+    }
+    if (segments.length > 0) {
+        const [major, minor = '0', patch = '0', build = '0'] = segments;
+        const suffix = v.slice(index); // everything after the numeric part
+        return `${major}.${minor}.${patch}.${build}${suffix}`;
     }
+    // Fallback: return undefined for non-standard versions
     return undefined;
 }
 /**
@@ -914,17 +1035,33 @@ function transformDistUrlsInMemory(packageData, repoId, proxyBaseUrl, maxVersion
                 ? metadata.version_normalized
                 : deriveVersionNormalized(version);
             // Build transformed version with original display version
+            // Preserve original dist from metadata - do NOT modify dist.url or dist.type
+            let dist = metadata.dist || {
+                type: 'zip',
+                url: `${proxyBaseUrl}/dist/m/${pkgName}/${version}.zip`,
+                reference: distReference,
+            };
+            // Add mirrors section to dist object if not already present
+            // This ensures Composer can use the mirror while preserving original dist.url
+            // This prevents Composer from treating packages as upgrades when dist.url differs
+            if (!dist.mirrors || !Array.isArray(dist.mirrors) || dist.mirrors.length === 0) {
+                dist = {
+                    ...dist,
+                    mirrors: [
+                        {
+                            url: `${proxyBaseUrl}/dist/m/%package%/%version%.%type%`,
+                            preferred: true,
+                        },
+                    ],
+                };
+            }
             const versionData = {
                 ...metadata,
                 name: pkgName,
                 version,
                 ...(normalizedVersion ? { version_normalized: normalizedVersion } : {}),
-                dist: {
-                    ...metadata.dist,
-                    type: metadata.dist?.type || 'zip',
-                    url: `${proxyBaseUrl}/dist/m/${pkgName}/${version}.zip`,
-                    reference: distReference,
-                },
+                // Use dist with mirrors section
+                dist,
             };
             // Clean invalid source field if present
             if (versionData.source === '__unset' ||
@@ -947,7 +1084,7 @@ function transformDistUrlsInMemory(packageData, repoId, proxyBaseUrl, maxVersion
     }
     return result;
 }
-function normalizePackageVersions(versions) {
+export function normalizePackageVersions(versions) {
     if (Array.isArray(versions)) {
         return versions.map((metadata) => ({
             // Use original `version` field, NOT `version_normalized`