@package-broker/core 0.16.4 → 0.17.1

package/dist/routes/dist.js

@@ -13,6 +13,56 @@ import { nanoid } from 'nanoid';
 import { unzipSync, strFromU8 } from 'fflate';
 import { getLogger } from '../utils/logger';
 import { getAnalytics } from '../utils/analytics';
+import { lazyLoadPackageFromRepositories, normalizePackageVersions, storePackageInDB, deriveVersionNormalized } from './composer';
+import { computeShasum } from '../utils/checksum';
+/**
+ * Get Content-Type header based on dist.type from package metadata
+ */
+function getContentTypeForDistType(distType) {
+    if (!distType) {
+        return 'application/zip'; // Default fallback
+    }
+    const type = distType.toLowerCase();
+    // Map common dist types to Content-Type headers
+    if (type === 'zip') {
+        return 'application/zip';
+    }
+    if (type === 'tar') {
+        return 'application/x-tar';
+    }
+    if (type === 'tar.gz' || type === 'tgz') {
+        return 'application/gzip';
+    }
+    if (type === 'tar.bz2') {
+        return 'application/x-bzip2';
+    }
+    // Default fallback
+    return 'application/octet-stream';
+}
+/**
+ * Get file extension for Content-Disposition header based on dist.type
+ */
+function getFileExtensionForDistType(distType) {
+    if (!distType) {
+        return 'zip'; // Default fallback
+    }
+    const type = distType.toLowerCase();
+    // Map dist types to file extensions
+    if (type === 'zip') {
+        return 'zip';
+    }
+    if (type === 'tar') {
+        return 'tar';
+    }
+    if (type === 'tar.gz' || type === 'tgz') {
+        return 'tar.gz';
+    }
+    if (type === 'tar.bz2') {
+        return 'tar.bz2';
+    }
+    // Default fallback
+    return 'zip';
+}
 /**
  * Extract README.md or README.mdown from ZIP archive
  */
@@ -123,6 +173,70 @@ async function extractAndStoreReadme(storage, zipData, storageType, repoId, pack
         logger.error('Error extracting/storing README', { packageName, version, storageType, repoId }, error instanceof Error ? error : new Error(String(error)));
     }
 }
+export function findVersionInMetadata(versionFromUrl, displayVersion, normalizedVersions) {
+    for (const { version: metadataVersion, metadata } of normalizedVersions) {
+        if (versionFromUrl === metadataVersion) {
+            return { version: metadataVersion, metadata };
+        }
+        if (displayVersion === metadataVersion) {
+            return { version: metadataVersion, metadata };
+        }
+        const metadataNormalized = metadata.version_normalized;
+        if (metadataNormalized && versionFromUrl === metadataNormalized) {
+            return { version: metadataVersion, metadata };
+        }
+        const derivedNormalized = deriveVersionNormalized(metadataVersion);
+        if (derivedNormalized && versionFromUrl === derivedNormalized) {
+            return { version: metadataVersion, metadata };
+        }
+        const metadataVersionNoV = metadataVersion.startsWith('v') ? metadataVersion.slice(1) : metadataVersion;
+        if (displayVersion === metadataVersionNoV) {
+            return { version: metadataVersion, metadata };
+        }
+        const versionFromUrlNoV = versionFromUrl.startsWith('v') ? versionFromUrl.slice(1) : versionFromUrl;
+        const metadataVersionNoVNormalized = deriveVersionNormalized(metadataVersionNoV);
+        if (metadataVersionNoVNormalized && versionFromUrlNoV === metadataVersionNoVNormalized) {
+            return { version: metadataVersion, metadata };
+        }
+        if (derivedNormalized && displayVersion === derivedNormalized) {
+            return { version: metadataVersion, metadata };
+        }
+        const displayVersionNormalized = deriveVersionNormalized(displayVersion);
+        if (displayVersionNormalized && metadataNormalized && displayVersionNormalized === metadataNormalized) {
+            return { version: metadataVersion, metadata };
+        }
+    }
+    return null;
+}
+/**
+ * Extract version from URL parameter by removing archive extensions
+ * Handles: .zip, .tar, .tar.gz, .tar.bz2
+ */
+function extractVersionFromParam(versionParam) {
+    if (!versionParam)
+        return '';
+    return versionParam
+        .replace(/\.tar\.bz2$/, '')
+        .replace(/\.tar\.gz$/, '')
+        .replace(/\.tar$/, '')
+        .replace(/\.zip$/, '');
+}
+export function normalizeVersionToDisplay(version) {
+    const patchMatch = version.match(/^(\d+\.\d+\.\d+)\.0-patch(\d+)$/);
+    if (patchMatch) {
+        const [, base, patch] = patchMatch;
+        return `${base}-p${patch}`;
+    }
+    if (version.match(/^\d+\.\d+\.\d+\.0$/)) {
+        return version.slice(0, -2);
+    }
+    const suffixMatch = version.match(/^(\d+\.\d+\.\d+)\.0(-.+)$/);
+    if (suffixMatch) {
+        const [, base, suffix] = suffixMatch;
+        return `${base}${suffix}`;
+    }
+    return version;
+}
 /**
  * GET /dist/:repo_id/:vendor/:package/:version.zip
  * OR
@@ -134,23 +248,30 @@ export async function distRoute(c) {
     let vendor = c.req.param('vendor');
     let pkgParam = c.req.param('package');
     let packageName;
-    let version = c.req.param('version')?.replace('.zip', '') || '';
+    let version = extractVersionFromParam(c.req.param('version'));
     const reference = c.req.param('reference');
     const db = c.get('database');
-    // Handle mirror URL format: /dist/:package/:version/r:reference.zip
-    // In this case, repo_id and vendor/package split are not in the URL
     if (!repoId && !vendor && pkgParam) {
         const fullPackageName = pkgParam;
-        // Look up repo_id from package name
-        const [pkg] = await db
-            .select({ repo_id: packages.repo_id })
+        const displayVersion = normalizeVersionToDisplay(version);
+        let [pkg] = await db
+            .select({ repo_id: packages.repo_id, version: packages.version })
             .from(packages)
             .where(and(eq(packages.name, fullPackageName), eq(packages.version, version)))
             .limit(1);
+        if (!pkg && displayVersion !== version) {
+            [pkg] = await db
+                .select({ repo_id: packages.repo_id, version: packages.version })
+                .from(packages)
+                .where(and(eq(packages.name, fullPackageName), eq(packages.version, displayVersion)))
+                .limit(1);
+            if (pkg) {
+                version = pkg.version;
+            }
+        }
         if (pkg) {
             repoId = pkg.repo_id;
             packageName = fullPackageName;
-            // Split package name into vendor/package for compatibility
             const parts = fullPackageName.split('/');
             if (parts.length === 2) {
                 vendor = parts[0];
@@ -161,7 +282,87 @@ export async function distRoute(c) {
             }
         }
         else {
-            return c.json({ error: 'Not Found', message: 'Package not found' }, 404);
+            const url = new URL(c.req.url);
+            const baseUrl = `${url.protocol}//${url.host}`;
+            const lazyLoadResult = await lazyLoadPackageFromRepositories(db, fullPackageName, c.env.ENCRYPTION_KEY, c.env.KV);
+            if (lazyLoadResult) {
+                const { packageData, repoId: foundRepoId } = lazyLoadResult;
+                const versions = packageData.packages?.[fullPackageName];
+                const normalizedVersions = normalizePackageVersions(versions);
+                const versionData = findVersionInMetadata(version, displayVersion, normalizedVersions);
+                if (versionData) {
+                    const distType = versionData.metadata.dist?.type || 'zip';
+                    const fileExt = getFileExtensionForDistType(distType);
+                    const proxyDistUrl = `${baseUrl}/dist/${foundRepoId}/${fullPackageName}/${versionData.version}.${fileExt}`;
+                    const sourceDistUrl = versionData.metadata.dist?.url || null;
+                    await storePackageInDB(db, fullPackageName, versionData.version, versionData.metadata, foundRepoId, proxyDistUrl, sourceDistUrl);
+                    repoId = foundRepoId;
+                    packageName = fullPackageName;
+                    version = versionData.version;
+                    const parts = fullPackageName.split('/');
+                    if (parts.length === 2) {
+                        vendor = parts[0];
+                        pkgParam = parts[1];
+                    }
+                    else {
+                        return c.json({ error: 'Bad Request', message: 'Invalid package name format' }, 400);
+                    }
+                }
+                else {
+                    return c.json({ error: 'Not Found', message: 'Version not found in repository' }, 404);
+                }
+            }
+            else {
+                return c.json({ error: 'Not Found', message: 'Package not found in any repository' }, 404);
+            }
+        }
+    }
+    else if (!repoId && vendor && pkgParam) {
+        packageName = `${vendor}/${pkgParam}`;
+        const displayVersion = normalizeVersionToDisplay(version);
+        let [pkg] = await db
+            .select({ repo_id: packages.repo_id, version: packages.version })
+            .from(packages)
+            .where(and(eq(packages.name, packageName), eq(packages.version, version)))
+            .limit(1);
+        if (!pkg && displayVersion !== version) {
+            [pkg] = await db
+                .select({ repo_id: packages.repo_id, version: packages.version })
+                .from(packages)
+                .where(and(eq(packages.name, packageName), eq(packages.version, displayVersion)))
+                .limit(1);
+            if (pkg) {
+                version = pkg.version;
+            }
+        }
+        if (pkg) {
+            repoId = pkg.repo_id;
+        }
+        else {
+            const url = new URL(c.req.url);
+            const baseUrl = `${url.protocol}//${url.host}`;
+            const lazyLoadResult = await lazyLoadPackageFromRepositories(db, packageName, c.env.ENCRYPTION_KEY, c.env.KV);
+            if (lazyLoadResult) {
+                const { packageData, repoId: foundRepoId } = lazyLoadResult;
+                const versions = packageData.packages?.[packageName];
+                const normalizedVersions = normalizePackageVersions(versions);
+                const versionData = findVersionInMetadata(version, displayVersion, normalizedVersions);
+                if (versionData) {
+                    const distType = versionData.metadata.dist?.type || 'zip';
+                    const fileExt = getFileExtensionForDistType(distType);
+                    const proxyDistUrl = `${baseUrl}/dist/${foundRepoId}/${packageName}/${versionData.version}.${fileExt}`;
+                    const sourceDistUrl = versionData.metadata.dist?.url || null;
+                    await storePackageInDB(db, packageName, versionData.version, versionData.metadata, foundRepoId, proxyDistUrl, sourceDistUrl);
+                    repoId = foundRepoId;
+                    version = versionData.version;
+                }
+                else {
+                    return c.json({ error: 'Not Found', message: 'Version not found in repository' }, 404);
+                }
+            }
+            else {
+                return c.json({ error: 'Not Found', message: 'Package not found in any repository' }, 404);
+            }
         }
     }
     else {
@@ -172,19 +373,14 @@ export async function distRoute(c) {
         return c.json({ error: 'Bad Request', message: 'Missing required parameters' }, 400);
     }
     const storage = c.var.storage;
-    // Handle Packagist packages (repo_id = "packagist") - cache in storage
     if (repoId === 'packagist') {
-        // Use public storage key for Packagist packages
         const storageKey = buildStorageKey('public', 'packagist', packageName, version);
-        // Look up artifact in database
         let artifact = (await db
             .select()
             .from(artifacts)
             .where(and(eq(artifacts.repo_id, 'packagist'), eq(artifacts.package_name, packageName), eq(artifacts.version, version)))
             .limit(1))[0];
-        // Check if artifact exists in storage
         let stream = await storage.get(storageKey);
-        // If not in storage, fetch from Packagist and cache
         if (!stream) {
             const packagistUrl = `https://repo.packagist.org/p2/${packageName}.json`;
             try {
@@ -197,10 +393,6 @@ export async function distRoute(c) {
                     const packagistData = await response.json();
                     const versions = packagistData.packages?.[packageName];
                     // Find version in array (Composer 2 p2 format) or dictionary (legacy format)
-                    // Handle version normalization:
-                    // - 1.5.9.0 → 1.5.9 (trailing .0)
-                    // - 3.9999999.9999999.9999999-dev → 3.x-dev (dev version)
-                    // - 2.4.8.0-patch3 → 2.4.8-p3 (patch alias)
                     const shortVersion = version.replace(/\.0$/, '');
                     const devMatch = version.match(/^(\d+)\.9999999\.9999999\.9999999-dev$/);
                     const xDevVersion = devMatch ? `${devMatch[1]}.x-dev` : null;
@@ -246,26 +438,58 @@ export async function distRoute(c) {
                                     totalSize += value.length;
                                 }
                             }
-                            // Combine chunks into a single Uint8Array
                             const combined = new Uint8Array(totalSize);
                             let offset = 0;
                             for (const chunk of chunks) {
                                 combined.set(chunk, offset);
                                 offset += chunk.length;
                             }
-                            // Store in storage (synchronous)
+                            let computedShasum;
+                            if (!versionData.dist?.shasum) {
+                                computedShasum = computeShasum(combined);
+                            }
                             const arrayBuffer = combined.buffer.slice(combined.byteOffset, combined.byteOffset + combined.byteLength);
                             try {
                                 await storage.put(storageKey, arrayBuffer);
                                 const logger = getLogger();
                                 logger.info('Successfully stored Packagist artifact in storage', { storageKey, size: totalSize, packageName, version });
-                                // Proactively extract and store README in background
+                                if (computedShasum) {
+                                    c.executionCtx.waitUntil((async () => {
+                                        try {
+                                            const [pkg] = await db
+                                                .select({ metadata: packages.metadata })
+                                                .from(packages)
+                                                .where(and(eq(packages.repo_id, 'packagist'), eq(packages.name, packageName), eq(packages.version, version)))
+                                                .limit(1);
+                                            if (pkg?.metadata) {
+                                                try {
+                                                    const metadata = JSON.parse(pkg.metadata);
+                                                    if (!metadata.dist?.shasum) {
+                                                        if (!metadata.dist) {
+                                                            metadata.dist = {};
+                                                        }
+                                                        metadata.dist.shasum = computedShasum;
+                                                        await db
+                                                            .update(packages)
+                                                            .set({ metadata: JSON.stringify(metadata) })
+                                                            .where(and(eq(packages.repo_id, 'packagist'), eq(packages.name, packageName), eq(packages.version, version)));
+                                                    }
+                                                }
+                                                catch {
+                                                    // Ignore metadata update errors in background task
+                                                }
+                                            }
+                                        }
+                                        catch {
+                                            // Ignore background task errors
+                                        }
+                                    })());
+                                }
                                 c.executionCtx.waitUntil(extractAndStoreReadme(storage, combined, 'public', 'packagist', packageName, version));
                             }
                             catch (err) {
                                 const logger = getLogger();
                                 logger.error('Error storing Packagist artifact in storage', { storageKey, size: totalSize, packageName, version }, err instanceof Error ? err : new Error(String(err)));
-                                // Don't fail the download if storage fails - still return the file to user
                             }
                             // Create or update artifact record
                             const now = Math.floor(Date.now() / 1000);
@@ -325,20 +549,14 @@ export async function distRoute(c) {
                 const logger = getLogger();
                 logger.error('Error proxying Packagist artifact', { packageName, version }, error instanceof Error ? error : new Error(String(error)));
             }
-            // If Packagist fetch failed or version not found, try local DB fallback
             if (!stream) {
-                // Fallback: Check if we have the package in our local DB
-                // This handles cases where metadata is cached in KV/DB (so composer found it)
-                // but upstream Packagist no longer lists it (so dist fetch failed)
                 try {
-                    // Normalize version for DB lookup (remove trailing .0 if present)
                     const shortVersion = version.replace(/\.0$/, '');
                     let [pkg] = await db
                         .select()
                         .from(packages)
                         .where(and(eq(packages.repo_id, 'packagist'), eq(packages.name, packageName), or(eq(packages.version, version), eq(packages.version, shortVersion))))
                         .limit(1);
-                    // Handle 3.999... -> 3.x-dev normalization for DB lookup
                     if (!pkg && version.includes('9999999') && version.endsWith('-dev')) {
                         const devMatch = version.match(/^(\d+)\.9999999\.9999999\.9999999-dev$/);
                         if (devMatch) {
@@ -353,7 +571,6 @@ export async function distRoute(c) {
                     if (pkg?.source_dist_url) {
                         const logger = getLogger();
                         logger.info('Found package in local DB fallback', { packageName, version, sourceDistUrl: pkg.source_dist_url });
-                        // Download from source
                         const sourceResponse = await fetch(pkg.source_dist_url, {
                             headers: {
                                 'User-Agent': COMPOSER_USER_AGENT,
@@ -375,18 +592,51 @@ export async function distRoute(c) {
                                     totalSize += value.length;
                                 }
                             }
-                            // Combine chunks into a single Uint8Array
                             const combined = new Uint8Array(totalSize);
                             let offset = 0;
                             for (const chunk of chunks) {
                                 combined.set(chunk, offset);
                                 offset += chunk.length;
                             }
-                            // Store in storage (synchronous)
+                            let computedShasum;
+                            if (pkg?.metadata) {
+                                try {
+                                    const metadata = JSON.parse(pkg.metadata);
+                                    if (!metadata.dist?.shasum) {
+                                        computedShasum = computeShasum(combined);
+                                    }
+                                }
+                                catch {
+                                    // If metadata parsing fails, compute shasum anyway
+                                    computedShasum = computeShasum(combined);
+                                }
+                            }
+                            else {
+                                computedShasum = computeShasum(combined);
+                            }
                             const arrayBuffer = combined.buffer.slice(combined.byteOffset, combined.byteOffset + combined.byteLength);
                             try {
                                 await storage.put(storageKey, arrayBuffer);
-                                // Proactively extract and store README
+                                if (computedShasum && pkg) {
+                                    c.executionCtx.waitUntil((async () => {
+                                        try {
+                                            const metadata = pkg.metadata ? JSON.parse(pkg.metadata) : {};
+                                            if (!metadata.dist?.shasum) {
+                                                if (!metadata.dist) {
+                                                    metadata.dist = {};
+                                                }
+                                                metadata.dist.shasum = computedShasum;
+                                                await db
+                                                    .update(packages)
+                                                    .set({ metadata: JSON.stringify(metadata) })
+                                                    .where(and(eq(packages.repo_id, 'packagist'), eq(packages.name, packageName), eq(packages.version, version)));
+                                            }
+                                        }
+                                        catch {
+                                            // Ignore metadata update errors in background task
+                                        }
+                                    })());
+                                }
                                 c.executionCtx.waitUntil(extractAndStoreReadme(storage, combined, 'public', 'packagist', packageName, version));
                             }
                             catch (err) {
@@ -463,11 +713,32 @@ export async function distRoute(c) {
             // Run in background to not block the response
             c.executionCtx.waitUntil(updateDownloadCount());
         }
+        // Get dist.type from package metadata to determine Content-Type
+        let distType = null;
+        if (artifact) {
+            // Try to get dist.type from stored package metadata
+            const [pkgForType] = await db
+                .select({ metadata: packages.metadata })
+                .from(packages)
+                .where(and(eq(packages.repo_id, 'packagist'), eq(packages.name, packageName), eq(packages.version, version)))
+                .limit(1);
+            if (pkgForType?.metadata) {
+                try {
+                    const metadata = JSON.parse(pkgForType.metadata);
+                    distType = metadata.dist?.type || null;
+                }
+                catch {
+                    // Ignore parse errors
+                }
+            }
+        }
         // Build response headers
         const headers = new Headers();
-        headers.set('Content-Type', 'application/zip');
-        // Format filename as vendor--module-name--version.zip (replace / with --)
-        const filename = `${packageName.replace('/', '--')}--${version}.zip`;
+        const contentType = getContentTypeForDistType(distType);
+        const fileExt = getFileExtensionForDistType(distType);
+        headers.set('Content-Type', contentType);
+        // Format filename as vendor--module-name--version.{ext} (replace / with --)
+        const filename = `${packageName.replace('/', '--')}--${version}.${fileExt}`;
         headers.set('Content-Disposition', `attachment; filename="${filename}"`);
         if (artifact?.size) {
             headers.set('Content-Length', String(artifact.size));
@@ -495,20 +766,16 @@ export async function distRoute(c) {
     }
     // For private repositories, use private storage key
     const storageKey = buildStorageKey('private', repoId, packageName, version);
-    // Look up artifact in database
     let artifact = (await db
         .select()
         .from(artifacts)
         .where(and(eq(artifacts.repo_id, repoId), eq(artifacts.package_name, packageName), eq(artifacts.version, version)))
         .limit(1))[0];
-    // Look up package to get source_dist_url (needed for on-demand mirroring)
     let [pkg] = await db
         .select()
         .from(packages)
         .where(and(eq(packages.repo_id, repoId), eq(packages.name, packageName), eq(packages.version, version)))
         .limit(1);
-    // If not found with specific repo_id, try to find it with any repo_id
-    // This handles cases where package was stored but repo_id doesn't match
     if (!pkg) {
         const [pkgAnyRepo] = await db
             .select()
@@ -522,7 +789,6 @@ export async function distRoute(c) {
         }
     }
     if (!pkg) {
-        // Package not found in database - try to fetch from repository directly
         // This handles race conditions where metadata wasn't stored yet
         const [repo] = await db
             .select()
@@ -549,8 +815,9 @@ export async function distRoute(c) {
                     const credentials = JSON.parse(credentialsJson);
                     const sourceResponse = await downloadFromSource(sourceDistUrl, repo.credential_type, credentials);
                     if (sourceResponse.ok && sourceResponse.body) {
+                        const distType = packageVersion.dist?.type || null;
                         const headers = new Headers();
-                        headers.set('Content-Type', 'application/zip');
+                        headers.set('Content-Type', getContentTypeForDistType(distType));
                         headers.set('Cache-Control', 'public, max-age=3600');
                         return new Response(sourceResponse.body, {
                             status: 200,
@@ -564,7 +831,6 @@ export async function distRoute(c) {
                 logger.error('Error fetching package from upstream', { packageName, version, repoId }, error instanceof Error ? error : new Error(String(error)));
             }
         }
-        // Package not found in database and couldn't fetch from upstream
         const logger = getLogger();
         logger.warn('Package not found in DB for repo', { packageName, version, repoId, note: 'This may indicate a race condition or missing package metadata' });
         return c.json({
@@ -572,7 +838,6 @@ export async function distRoute(c) {
             message: 'Package not found. The package metadata may not be available yet. Try refreshing package metadata.'
         }, 404);
     }
-    // Check conditional request (If-Modified-Since) if artifact exists
     if (artifact) {
         const ifModifiedSince = c.req.header('If-Modified-Since');
         if (ifModifiedSince && artifact.created_at) {
@@ -583,23 +848,18 @@ export async function distRoute(c) {
             }
         }
     }
-    // Get artifact from storage
     let stream = await storage.get(storageKey);
-    // If artifact not in storage, try on-demand mirroring
     if (!stream) {
-        // Validate source_dist_url exists and is a valid URL
         if (!pkg.source_dist_url) {
             const logger = getLogger();
             logger.error('Package found but source_dist_url is missing', { packageName, version, repoId });
             return c.json({ error: 'Not Found', message: 'Artifact file not found and source URL unavailable. Please re-sync the repository.' }, 404);
         }
-        // Validate it's actually a URL (not a placeholder or column name)
         if (!pkg.source_dist_url.startsWith('http://') && !pkg.source_dist_url.startsWith('https://')) {
             const logger = getLogger();
             logger.error('Package has invalid source_dist_url', { packageName, version, repoId, sourceDistUrl: pkg.source_dist_url });
             return c.json({ error: 'Not Found', message: 'Invalid source URL. Please re-sync the repository to update package metadata.' }, 404);
         }
-        // Get repository for credentials
         const [repo] = await db
             .select()
             .from(repositories)
@@ -609,18 +869,13 @@ export async function distRoute(c) {
             return c.json({ error: 'Not Found', message: 'Repository not found' }, 404);
         }
         try {
-            // Decrypt credentials
             const credentialsJson = await decryptCredentials(repo.auth_credentials, c.env.ENCRYPTION_KEY);
             const credentials = JSON.parse(credentialsJson);
-            // Download from source with authentication
             const sourceResponse = await downloadFromSource(pkg.source_dist_url, repo.credential_type, credentials);
-            // Read the response body as a stream
             const sourceStream = sourceResponse.body;
             if (!sourceStream) {
                 throw new Error('Source response has no body');
             }
-            // Store in R2 storage (non-blocking for response, but we need to wait for it)
-            // We'll stream to user while storing in background
             const chunks = [];
             const reader = sourceStream.getReader();
             let totalSize = 0;
@@ -634,25 +889,53 @@ export async function distRoute(c) {
                     totalSize += value.length;
                 }
             }
-            // Combine chunks
             const combined = new Uint8Array(totalSize);
             let offset = 0;
             for (const chunk of chunks) {
                 combined.set(chunk, offset);
                 offset += chunk.length;
             }
-            // Create stream for response
             stream = new Response(combined).body;
-            // Store in storage (background)
+            let computedShasum;
+            if (pkg?.metadata) {
+                try {
+                    const metadata = JSON.parse(pkg.metadata);
+                    if (!metadata.dist?.shasum) {
+                        computedShasum = computeShasum(combined);
+                    }
+                }
+                catch {
+                    // If metadata parsing fails, compute shasum anyway
+                    computedShasum = computeShasum(combined);
+                }
+            }
+            else {
+                computedShasum = computeShasum(combined);
+            }
             c.executionCtx.waitUntil((async () => {
                 try {
-                    // Store artifact
-                    // Convert to ArrayBuffer
                     const arrayBuffer = combined.buffer.slice(combined.byteOffset, combined.byteOffset + combined.byteLength);
                     await storage.put(storageKey, arrayBuffer);
                     const logger = getLogger();
                     logger.info('Successfully stored artifact on-demand', { storageKey, size: totalSize });
-                    // Create or update artifact record
+                    if (computedShasum && pkg) {
+                        try {
+                            const metadata = pkg.metadata ? JSON.parse(pkg.metadata) : {};
+                            if (!metadata.dist?.shasum) {
+                                if (!metadata.dist) {
+                                    metadata.dist = {};
+                                }
+                                metadata.dist.shasum = computedShasum;
+                                await db
+                                    .update(packages)
+                                    .set({ metadata: JSON.stringify(metadata) })
+                                    .where(and(eq(packages.repo_id, repoId), eq(packages.name, packageName), eq(packages.version, version)));
+                            }
+                        }
+                        catch {
+                            // Ignore metadata update errors in background task
+                        }
+                    }
                     const now = Math.floor(Date.now() / 1000);
                     if (artifact) {
                         await db
@@ -675,7 +958,6 @@ export async function distRoute(c) {
                             download_count: 0,
                             created_at: now,
                         }).onConflictDoNothing();
-                        // Update local artifact for download count
                         artifact = {
                             id: artifactId,
                             repo_id: repoId,
@@ -688,7 +970,6 @@ export async function distRoute(c) {
                             last_downloaded_at: null,
                         };
                     }
-                    // Proactively extract and store README
                     await extractAndStoreReadme(storage, combined, 'private', repoId, packageName, version);
                 }
                 catch (error) {
@@ -727,10 +1008,21 @@ export async function distRoute(c) {
             }
         })());
     }
-    // Build response
+    let distType = null;
+    if (pkg?.metadata) {
+        try {
+            const metadata = JSON.parse(pkg.metadata);
+            distType = metadata.dist?.type || null;
+        }
+        catch {
+            // Ignore invalid JSON; fallback to null distType
+        }
+    }
     const headers = new Headers();
-    headers.set('Content-Type', 'application/zip');
-    const filename = `${packageName.replace('/', '--')}--${version}.zip`;
+    const contentType = getContentTypeForDistType(distType);
+    const fileExt = getFileExtensionForDistType(distType);
+    headers.set('Content-Type', contentType);
+    const filename = `${packageName.replace('/', '--')}--${version}.${fileExt}`;
     headers.set('Content-Disposition', `attachment; filename="${filename}"`);
     if (artifact?.size) {
         headers.set('Content-Length', String(artifact.size));
@@ -738,9 +1030,7 @@ export async function distRoute(c) {
     if (artifact?.created_at) {
         headers.set('Last-Modified', new Date(artifact.created_at * 1000).toUTCString());
     }
-    // Cache settings
     headers.set('Cache-Control', 'public, max-age=31536000, immutable');
-    // Track package download analytics
     const analytics = getAnalytics();
     const requestId = c.get('requestId');
     analytics.trackPackageDownload({
@@ -756,7 +1046,6 @@ export async function distRoute(c) {
         headers,
     });
 }
-// Aliases for specific route patterns handled by the same function
 export const distMirrorRoute = distRoute;
 export const distLockfileRoute = distRoute;
 //# sourceMappingURL=dist.js.map