@powerhousedao/registry 6.2.2-dev.2 → 6.2.2-dev.20

package/dist/cli.d.mts

@@ -21,8 +21,10 @@ declare const registryCommand: Partial<cmd_ts_dist_cjs_argparser_js0.Register> &
     webhooks: string | undefined;
     publicUrl: string | undefined;
     authRenown: boolean;
+    renownUrl: string | undefined;
     verdaccioSecret: string | undefined;
     localPackages: string | undefined;
+    databaseUrl: string | undefined;
   }>>;
 } & cmd_ts_dist_cjs_helpdoc_js0.PrintHelp & cmd_ts_dist_cjs_helpdoc_js0.ProvidesHelp & cmd_ts_dist_cjs_helpdoc_js0.Named & Partial<cmd_ts_dist_cjs_helpdoc_js0.Versioned> & cmd_ts_dist_cjs_argparser_js0.Register & cmd_ts_dist_cjs_runner_js0.Handling<{
   port: number;
@@ -41,8 +43,10 @@ declare const registryCommand: Partial<cmd_ts_dist_cjs_argparser_js0.Register> &
   webhooks: string | undefined;
   publicUrl: string | undefined;
   authRenown: boolean;
+  renownUrl: string | undefined;
   verdaccioSecret: string | undefined;
   localPackages: string | undefined;
+  databaseUrl: string | undefined;
 }, Promise<void>> & {
   run(context: cmd_ts_dist_cjs_argparser_js0.ParseContext): Promise<cmd_ts_dist_cjs_argparser_js0.ParsingResult<Promise<void>>>;
 } & Partial<cmd_ts_dist_cjs_helpdoc_js0.Versioned & cmd_ts_dist_cjs_helpdoc_js0.Descriptive & cmd_ts_dist_cjs_helpdoc_js0.Aliased>;

package/dist/cli.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.mts","names":[],"sources":["../cli.ts"],"mappings":";;;;;cAiBa,eAAA,EAAe,OAAA,CAyI1B,6BAAA,CAzI0B,QAAA;iBAAA,6BAAA,CAAA,YAAA"}
+{"version":3,"file":"cli.d.mts","names":[],"sources":["../cli.ts"],"mappings":";;;;;cAiBa,eAAA,EAAe,OAAA,CAkK1B,6BAAA,CAlK0B,QAAA;iBAAA,6BAAA,CAAA,YAAA"}

package/dist/cli.mjs

@@ -1,77 +1,110 @@
 import { binary, command, flag, number, option, optional, run, string } from "cmd-ts";
 import express, { Router } from "express";
 import { findUp } from "find-up";
-import crypto, { randomBytes } from "node:crypto";
+import crypto, { randomBytes, randomUUID } from "node:crypto";
 import { mkdir } from "node:fs/promises";
 import path from "node:path";
 import { runServer } from "verdaccio";
-import { signPayload } from "@verdaccio/signature";
-import { verifyAuthBearerToken } from "@renown/sdk/node";
+import { Pool } from "pg";
 import fs from "node:fs";
 import { pipeline } from "node:stream/promises";
 import { Readable } from "node:stream";
 import { extract } from "tar";
 import { slimManifest } from "@powerhousedao/shared/registry";
+import { fileURLToPath } from "node:url";
 //#endregion
-//#region src/auth/renown-middleware.ts
-function audienceMatches(aud, expected) {
-	if (!aud) return false;
-	if (Array.isArray(aud)) return aud.includes(expected);
-	return aud === expected;
+//#region src/auth/pg-store.ts
+/** Build a real Postgres pool from a connection string. */
+function createPgPool(databaseUrl) {
+	return new Pool({ connectionString: databaseUrl });
 }
 /**
-* Translates a Renown-signed Bearer token (verifiable from the issuer's DID,
-* stateless) into a verdaccio-format Bearer token (signed with verdaccio's
-* own secret) that verdaccio's normal auth pipeline accepts.
+* Postgres-backed AuthStore. Two small tables:
+*  - registry_users(username PK, password_hash, created_at)
+*  - registry_package_owners(package_name PK, owners text[], claimed_at)
 *
-* Falls through (calls `next()` without modifying auth) on any verification
-* failure: malformed token, bad signature, expired, audience mismatch, or
-* non-renown bearer token. This keeps the legacy htpasswd path usable during
-* the migration grace period — verdaccio's own apiJWTmiddleware sees the
-* original Authorization header and decides what to do with it.
+* Ownership claim is race-free: `INSERT ... ON CONFLICT DO NOTHING` means the
+* first publisher wins atomically; the follow-up read returns the actual
+* owners so a losing racer is denied.
+*
+* Takes an already-built `pg.Pool` (tests inject a pg-mem pool cast to Pool).
 */
-function createRenownAuthMiddleware(opts) {
-	const expectedAud = opts.publicUrl;
-	return async (req, _res, next) => {
-		const header = req.headers.authorization;
-		if (!header?.startsWith("Bearer ")) return next();
-		const token = header.slice(7).trim();
-		if (!token) return next();
-		let verified;
-		try {
-			verified = await verifyAuthBearerToken(token, { audience: expectedAud });
-		} catch {
-			return next();
-		}
-		if (!verified) return next();
-		const payload = verified.payload;
-		if (!audienceMatches(payload?.aud, expectedAud)) return next();
-		const subject = verified.verifiableCredential.credentialSubject;
-		if (!subject?.address) return next();
-		const address = subject.address.toLowerCase();
-		const groups = ["$authenticated", "renown"];
-		let verdaccioJwt;
-		try {
-			verdaccioJwt = await signPayload({
-				name: address,
-				real_groups: groups,
-				groups
-			}, opts.verdaccioSecret, { expiresIn: "5m" });
-		} catch (err) {
-			console.error("[registry] failed to mint internal verdaccio token:", err);
-			return next();
+function createPgStore(pool) {
+	let initialized = null;
+	return {
+		init() {
+			initialized ??= (async () => {
+				await pool.query(`
+          CREATE TABLE IF NOT EXISTS registry_users (
+            username      text PRIMARY KEY,
+            password_hash text NOT NULL,
+            created_at    timestamptz NOT NULL DEFAULT now()
+          )`);
+				await pool.query(`
+          CREATE TABLE IF NOT EXISTS registry_package_owners (
+            package_name text PRIMARY KEY,
+            owners       text[] NOT NULL,
+            claimed_at   timestamptz NOT NULL DEFAULT now()
+          )`);
+			})();
+			return initialized;
+		},
+		async getUser(username) {
+			const row = (await pool.query("SELECT password_hash FROM registry_users WHERE username = $1", [username])).rows[0];
+			return row ? { passwordHash: row.password_hash } : null;
+		},
+		async createUser(username, passwordHash) {
+			try {
+				await pool.query("INSERT INTO registry_users (username, password_hash) VALUES ($1, $2)", [username, passwordHash]);
+				return true;
+			} catch (err) {
+				if (err.code === "23505") return false;
+				throw err;
+			}
+		},
+		async getOwners(pkg) {
+			return (await pool.query("SELECT owners FROM registry_package_owners WHERE package_name = $1", [pkg])).rows[0]?.owners ?? null;
+		},
+		async getOwnersFor(pkgs) {
+			if (pkgs.length === 0) return {};
+			const placeholders = pkgs.map((_, i) => `$${i + 1}`).join(",");
+			const res = await pool.query(`SELECT package_name, owners FROM registry_package_owners WHERE package_name IN (${placeholders})`, pkgs);
+			const out = {};
+			for (const row of res.rows) out[row.package_name] = row.owners;
+			return out;
+		},
+		async claimOwner(pkg, username) {
+			await pool.query(`INSERT INTO registry_package_owners (package_name, owners)
+         VALUES ($1, ARRAY[$2]::text[])
+         ON CONFLICT (package_name) DO NOTHING`, [pkg, username]);
+			return (await pool.query("SELECT owners FROM registry_package_owners WHERE package_name = $1", [pkg])).rows[0]?.owners ?? [];
+		},
+		close() {
+			return pool.end();
 		}
-		req.headers.authorization = `Bearer ${verdaccioJwt}`;
-		req.renownUser = {
-			address,
-			did: payload?.iss,
-			chainId: subject.chainId,
-			networkId: subject.networkId
-		};
-		return next();
 	};
 }
 //#endregion
+//#region src/auth/store-handoff.ts
+const REGISTRY_KEY = Symbol.for("@powerhousedao/registry:auth-store-handoff");
+function registry() {
+	const g = globalThis;
+	return g[REGISTRY_KEY] ??= /* @__PURE__ */ new Map();
+}
+/** Stash a store instance and return a token to carry through plugin config. */
+function stashAuthStore(store) {
+	const token = randomUUID();
+	registry().set(token, {
+		store,
+		loaded: false
+	});
+	return token;
+}
+/** True once the plugin has loaded the store for this token. */
+function wasStoreLoaded(token) {
+	return registry().get(token)?.loaded ?? false;
+}
+//#endregion
 //#region src/semver.ts
 /**
 * Compare two semver version strings for sorting.
@@ -245,6 +278,37 @@ var CdnCache = class {
 			if (fs.readdirSync(pkgDir).length === 0) fs.rmdirSync(pkgDir);
 		} catch {}
 	}
+	async reconcileWithRegistry(packageName) {
+		const url = `${this.registryUrl}/${encodeURIComponent(packageName)}`;
+		let versions;
+		try {
+			const res = await fetch(url, { headers: { Accept: "application/json" } });
+			if (!res.ok) return [];
+			const meta = await res.json();
+			versions = Object.keys(meta.versions ?? {});
+		} catch {
+			return [];
+		}
+		if (versions.length === 0) return [];
+		return this.reconcileVersions(packageName, versions);
+	}
+	reconcileVersions(packageName, keepVersions) {
+		const pkgDir = path.join(this.cdnCachePath, packageName);
+		const keep = new Set(keepVersions);
+		const removed = [];
+		let entries;
+		try {
+			entries = fs.readdirSync(pkgDir, { withFileTypes: true });
+		} catch {
+			return removed;
+		}
+		for (const entry of entries) {
+			if (!entry.isDirectory() || keep.has(entry.name)) continue;
+			this.invalidateVersion(packageName, entry.name);
+			removed.push(entry.name);
+		}
+		return removed;
+	}
 	/** Remove all cached version directories except the specified one. */
 	pruneOldVersions(packageName, keepVersion) {
 		const pkgDir = path.join(this.cdnCachePath, packageName);
@@ -340,17 +404,40 @@ function getLatestVersionDir(pkgDir) {
 	versions.sort(compareSemver);
 	return path.join(pkgDir, versions[versions.length - 1]);
 }
-function loadPackage(cdnCachePath, name, version) {
+function loadPackage(cdnCachePath, name, version, storagePath) {
 	const pkgDir = path.join(cdnCachePath, name);
 	const manifestDir = (version ? path.join(pkgDir, version) : getLatestVersionDir(pkgDir)) ?? pkgDir;
 	const manifest = readManifest(manifestDir);
 	if (!manifest) return null;
+	const resolvedName = manifest.name || name;
+	const { distTags, versions } = readPackageMetadata(storagePath, resolvedName);
 	return {
-		name: manifest.name || name,
+		name: resolvedName,
 		path: `/-/cdn/${name}`,
 		manifest,
 		documentTypes: getDocumentTypesFromManifest(manifest),
-		version: readPackageJsonVersion(manifestDir)
+		version: readPackageJsonVersion(manifestDir),
+		distTags,
+		versions
+	};
+}
+/**
+* Project a full {@link PackageInfo} down to the trimmed shape the paginated
+* package-listing UI renders per row. Version metadata and documentTypes are
+* intentionally dropped — the client fetches them on demand.
+*/
+function toPackageListItem(pkg) {
+	const publisher = pkg.manifest?.publisher;
+	return {
+		name: pkg.name,
+		path: pkg.path,
+		version: pkg.version,
+		description: pkg.manifest?.description ?? void 0,
+		category: pkg.manifest?.category ?? void 0,
+		publisher: publisher ? {
+			name: publisher.name,
+			url: publisher.url
+		} : void 0
 	};
 }
 function getDocumentTypesFromManifest(manifest) {
@@ -479,6 +566,20 @@ function createWarmer(config, cdn) {
 }
 //#endregion
 //#region src/middleware.ts
+const DEFAULT_PAGE_SIZE = 30;
+const MAX_PAGE_SIZE = 50;
+/** Parse+clamp a `limit` query param to 1..MAX_PAGE_SIZE (default 30). */
+function clampPageSize(raw) {
+	const n = Number.parseInt(String(raw), 10);
+	if (!Number.isFinite(n) || n <= 0) return DEFAULT_PAGE_SIZE;
+	return Math.min(n, MAX_PAGE_SIZE);
+}
+/** Parse a non-negative `offset` query param (default 0). */
+function parseOffset(raw) {
+	const n = Number.parseInt(String(raw), 10);
+	if (!Number.isFinite(n) || n < 0) return 0;
+	return n;
+}
 const MIME_TYPES = {
 	".js": "application/javascript",
 	".mjs": "application/javascript",
@@ -492,6 +593,15 @@ const MIME_TYPES = {
 function getContentType(filePath) {
 	return MIME_TYPES[path.extname(filePath).toLowerCase()] ?? "application/octet-stream";
 }
+function publisherFromRequest(req) {
+	const name = req.remote_user?.name;
+	if (!name) return void 0;
+	if (name.startsWith("did:pkh:")) return {
+		address: (name.split(":").pop() ?? name).toLowerCase(),
+		did: name
+	};
+	return { address: name };
+}
 /**
 * Resolve a package version. Exact versions skip the network call. Upstream
 * errors fall back to the latest cached version; genuine not-found falls back
@@ -531,9 +641,23 @@ function etagMatches(header, etag) {
 		return tag === "*" || opaqueTag(tag) === target;
 	});
 }
-function createPowerhouseRouter(config, sse, webhooks) {
+function createPowerhouseRouter(config, sse, webhooks, ownerStore) {
 	const cdn = new CdnCache(`http://localhost:${config.port}`, config.cdnCachePath);
 	const router = Router();
+	const withOwners = async (pkgs) => {
+		if (!ownerStore || pkgs.length === 0) return pkgs;
+		try {
+			await ownerStore.init();
+			const map = await ownerStore.getOwnersFor(pkgs.map((p) => p.name));
+			return pkgs.map((p) => p.name in map ? {
+				...p,
+				owners: map[p.name]
+			} : p);
+		} catch (err) {
+			console.error("[registry] owner lookup failed:", err);
+			return pkgs;
+		}
+	};
 	router.use((_req, res, next) => {
 		res.setHeader("Access-Control-Allow-Origin", "*");
 		next();
@@ -573,16 +697,32 @@ function createPowerhouseRouter(config, sse, webhooks) {
 	});
 	const warm = createWarmer(config, cdn);
 	warm();
-	router.get("/packages", (req, res) => {
+	router.get("/packages", async (req, res) => {
 		warm();
 		const packages = scanPackages(config.cdnCachePath, config.storagePath);
 		const documentType = req.query.documentType;
 		if (documentType) {
 			const filtered = packages.filter((pkg) => pkg.manifest?.documentModels?.some((m) => m.id === documentType));
-			res.json(filtered);
+			res.json(await withOwners(filtered));
+			return;
+		}
+		if (req.query.limit === void 0) {
+			res.json(await withOwners(packages));
 			return;
 		}
-		res.json(packages);
+		const limit = clampPageSize(req.query.limit);
+		const offset = parseOffset(req.query.offset);
+		const search = typeof req.query.search === "string" ? req.query.search.trim().toLowerCase() : "";
+		const sorted = (search ? packages.filter((pkg) => pkg.name.toLowerCase().includes(search)) : packages).slice().sort((a, b) => a.name.localeCompare(b.name));
+		const total = sorted.length;
+		const items = sorted.slice(offset, offset + limit).map(toPackageListItem);
+		res.json({
+			items,
+			total,
+			limit,
+			offset,
+			hasMore: offset + limit < total
+		});
 	});
 	router.get("/packages/by-document-type", (req, res) => {
 		const documentType = req.query.type;
@@ -602,12 +742,12 @@ function createPowerhouseRouter(config, sse, webhooks) {
 			return;
 		}
 		const version = resolution.kind === "ok" ? resolution.version : void 0;
-		const pkg = loadPackage(config.cdnCachePath, name, version);
+		const pkg = loadPackage(config.cdnCachePath, name, version, config.storagePath);
 		if (!pkg) {
 			res.status(404).send("Package not found");
 			return;
 		}
-		res.json(pkg);
+		res.json((await withOwners([pkg]))[0]);
 	});
 	router.get("/-/cdn/*", async (req, res) => {
 		const fullPath = req.params[0];
@@ -693,9 +833,41 @@ function parseUnpublishRequest(reqPath) {
 		version
 	};
 }
+function parseManifestRewrite(reqPath) {
+	const revIdx = reqPath.indexOf("/-rev/");
+	if (revIdx <= 0) return null;
+	const beforeRev = reqPath.slice(1, revIdx);
+	if (beforeRev.includes("/-/")) return null;
+	return { packageName: decodeURIComponent(beforeRev) };
+}
 function createUnpublishHook(config, notifications) {
 	const cdn = new CdnCache(`http://localhost:${config.port}`, config.cdnCachePath);
+	const handleManifestRewrite = (req, res) => {
+		const rewrite = parseManifestRewrite(req.path);
+		if (!rewrite) return;
+		const originalEnd = res.end.bind(res);
+		res.end = function(chunk, encoding, cb) {
+			if (res.statusCode >= 200 && res.statusCode < 300) {
+				const publishedBy = publisherFromRequest(req);
+				cdn.reconcileWithRegistry(rewrite.packageName).then((removed) => {
+					for (const version of removed) notifications.notifyUnpublish({
+						packageName: rewrite.packageName,
+						version,
+						publishedBy
+					});
+				}).catch((err) => {
+					console.error(`[registry] CDN reconcile failed for ${rewrite.packageName}:`, err);
+				});
+			}
+			return originalEnd(chunk, encoding, cb);
+		};
+	};
 	return (req, res, next) => {
+		if (req.method === "PUT") {
+			handleManifestRewrite(req, res);
+			next();
+			return;
+		}
 		if (req.method !== "DELETE") {
 			next();
 			return;
@@ -710,14 +882,10 @@ function createUnpublishHook(config, notifications) {
 			if (res.statusCode >= 200 && res.statusCode < 300) try {
 				if (parsed.version) cdn.invalidateVersion(parsed.packageName, parsed.version);
 				else cdn.invalidate(parsed.packageName);
-				const renownUser = req.renownUser;
 				notifications.notifyUnpublish({
 					packageName: parsed.packageName,
 					version: parsed.version,
-					publishedBy: renownUser ? {
-						address: renownUser.address,
-						did: renownUser.did
-					} : void 0
+					publishedBy: publisherFromRequest(req)
 				});
 			} catch (err) {
 				console.error(`[registry] CDN purge failed for ${parsed.packageName}${parsed.version ? `@${parsed.version}` : ""}:`, err);
@@ -747,11 +915,7 @@ function createPublishHook(config, notifications) {
 				return originalEnd(chunk, encoding, cb);
 			}
 			if (versions.length > 1) console.warn(`[registry] Multiple versions published for ${packageName}: ${JSON.stringify(versions)}`);
-			const renownUser = req.renownUser;
-			const publishedBy = renownUser ? {
-				address: renownUser.address,
-				did: renownUser.did
-			} : void 0;
+			const publishedBy = publisherFromRequest(req);
 			cdn.extractTarball(packageName, version).then(() => {
 				notifications.notifyPublish({
 					packageName,
@@ -888,6 +1052,17 @@ var WebhookChannel = class {
 function buildVerdaccioConfig(config) {
 	const htpasswdPath = path.join(config.storagePath, "htpasswd");
 	const uplinkUrl = config.uplink ?? "https://registry.npmjs.org/";
+	const usePgAuth = Boolean(config.databaseUrl || config.authStore);
+	const storeToken = config.authStoreToken ?? (config.authStore ? stashAuthStore(config.authStore) : void 0);
+	const pluginsDir = config.pluginsDir ?? path.join(path.dirname(fileURLToPath(import.meta.url)), "plugins");
+	const auth = usePgAuth ? { "registry-auth": {
+		...config.databaseUrl ? { databaseUrl: config.databaseUrl } : {},
+		...storeToken ? { storeToken } : {},
+		...config.renown ? {
+			publicUrl: config.renown.publicUrl,
+			...config.renown.renownUrl ? { renownUrl: config.renown.renownUrl } : {}
+		} : {}
+	} } : { htpasswd: { file: htpasswdPath } };
 	const base = {
 		storage: config.storagePath,
 		self_path: "./",
@@ -896,7 +1071,8 @@ function buildVerdaccioConfig(config) {
 			sign: { expiresIn: "90d" },
 			verify: {}
 		} } },
-		auth: { htpasswd: { file: htpasswdPath } },
+		auth,
+		...usePgAuth ? { plugins: pluginsDir } : {},
 		uplinks: { npmjs: {
 			url: uplinkUrl,
 			maxage: config.uplinkMaxage ?? "2m",
@@ -965,18 +1141,21 @@ async function resolveDir(dir) {
 	return found;
 }
 async function runRegistry(args) {
-	const { port, storageDir, cdnCacheDir, uplink, uplinkMaxage, webEnabled, webhooks, s3AccessKeyId, s3Bucket, s3Endpoint, s3ForcePathStyle, s3KeyPrefix, s3Region, s3SecretAccessKey, publicUrl, authRenown, verdaccioSecret: verdaccioSecretArg, localPackages } = args;
+	const { port, storageDir, cdnCacheDir, uplink, uplinkMaxage, webEnabled, webhooks, s3AccessKeyId, s3Bucket, s3Endpoint, s3ForcePathStyle, s3KeyPrefix, s3Region, s3SecretAccessKey, publicUrl, authRenown, renownUrl, verdaccioSecret: verdaccioSecretArg, localPackages, databaseUrl, pluginsDir, authStore } = args;
 	const storagePath = await resolveDir(storageDir);
 	const cdnCachePath = await resolveDir(cdnCacheDir);
 	const verdaccioSecret = verdaccioSecretArg ?? randomBytes(32).toString("hex");
 	const renownEnabled = authRenown === true && Boolean(publicUrl);
 	if (authRenown === true && !publicUrl) console.warn("[registry] auth-renown is enabled but --public-url / PH_REGISTRY_PUBLIC_URL is not set; Renown auth will be disabled.");
+	if (renownEnabled && !databaseUrl && !authStore) console.warn("[registry] Renown auth requires a database (--database-url) for the auth plugin; renown will be inactive.");
 	console.log({
 		storagePath,
 		cdnCachePath
 	});
 	const webhookConfigs = webhooks?.split(",").map((url) => url.trim()).filter(Boolean).map((endpoint) => ({ endpoint }));
 	const localPackagePatterns = localPackages?.split(",").map((p) => p.trim()).filter(Boolean);
+	const sharedAuthStore = authStore ?? (databaseUrl ? createPgStore(createPgPool(databaseUrl)) : void 0);
+	const authStoreToken = sharedAuthStore ? stashAuthStore(sharedAuthStore) : void 0;
 	const config = {
 		port,
 		storagePath,
@@ -986,7 +1165,10 @@ async function runRegistry(args) {
 		webEnabled,
 		verdaccioSecret,
 		...localPackagePatterns?.length ? { localPackagePatterns } : {},
-		...renownEnabled && publicUrl ? { renown: { publicUrl } } : {},
+		...renownEnabled && publicUrl ? { renown: {
+			publicUrl,
+			...renownUrl ? { renownUrl } : {}
+		} } : {},
 		...webhookConfigs?.length && { notify: { webhooks: webhookConfigs } },
 		...s3Bucket && s3Endpoint && s3Region && { s3: {
 			bucket: s3Bucket,
@@ -996,22 +1178,28 @@ async function runRegistry(args) {
 			secretAccessKey: s3SecretAccessKey,
 			keyPrefix: s3KeyPrefix,
 			s3ForcePathStyle
-		} }
+		} },
+		...databaseUrl ? { databaseUrl } : {},
+		...pluginsDir ? { pluginsDir } : {},
+		...sharedAuthStore ? { authStore: sharedAuthStore } : {},
+		...authStoreToken ? { authStoreToken } : {}
 	};
+	if (config.databaseUrl || config.authStore) console.log("[registry] Postgres-backed auth plugin active (persistent accounts + package ownership)");
 	await mkdir(storagePath, { recursive: true });
 	await mkdir(cdnCachePath, { recursive: true });
-	const verdaccioHandler = (await runServer(buildVerdaccioConfig(config))).listeners("request")[0];
+	const verdaccioServer = await runServer(buildVerdaccioConfig(config));
+	if (authStoreToken && !wasStoreLoaded(authStoreToken)) {
+		verdaccioServer.close();
+		throw new Error("registry-auth plugin failed to load despite a configured database/auth store; refusing to start without auth and package-ownership enforcement.");
+	}
+	const verdaccioHandler = verdaccioServer.listeners("request")[0];
 	const app = express();
 	const sseChannel = new SSEChannel();
 	const webhookChannel = new WebhookChannel(config.storagePath, config.notify);
 	const notifications = new NotificationManager([sseChannel, webhookChannel]);
 	const staticDir = await findUp("static", { type: "directory" });
 	if (staticDir) app.use("/-/static", express.static(staticDir));
-	app.use(createPowerhouseRouter(config, sseChannel, webhookChannel));
-	if (config.renown) app.use(createRenownAuthMiddleware({
-		publicUrl: config.renown.publicUrl,
-		verdaccioSecret
-	}));
+	app.use(createPowerhouseRouter(config, sseChannel, webhookChannel, sharedAuthStore));
 	app.use(createPublishHook(config, notifications));
 	app.use(createUnpublishHook(config, notifications));
 	app.use((req, res) => verdaccioHandler(req, res));
@@ -1128,6 +1316,13 @@ const registryCommand = command({
 			defaultValue: () => process.env.PH_REGISTRY_AUTH_RENOWN === "true",
 			defaultValueIsSerializable: true
 		}),
+		renownUrl: option({
+			long: "renown-url",
+			type: optional(string),
+			description: "Renown service base URL for credential verification. Defaults to https://www.renown.id.",
+			defaultValue: () => process.env.PH_REGISTRY_RENOWN_URL,
+			defaultValueIsSerializable: true
+		}),
 		verdaccioSecret: option({
 			long: "verdaccio-secret",
 			type: optional(string),
@@ -1141,10 +1336,23 @@ const registryCommand = command({
 			description: "Comma-separated globs (e.g. '@powerhousedao/*,document-model,ph-cmd') served locally only — no npmjs uplink proxy. Lets you re-publish a workspace package whose version already exists on npmjs without bumping.",
 			defaultValue: () => process.env.PH_REGISTRY_LOCAL_PACKAGES,
 			defaultValueIsSerializable: true
+		}),
+		databaseUrl: option({
+			long: "database-url",
+			type: optional(string),
+			description: "Postgres connection string. When set, the registry uses the DB-backed auth plugin (persistent accounts + npm-style package ownership) instead of the built-in htpasswd.",
+			defaultValue: () => process.env.PH_REGISTRY_DATABASE_URL ?? process.env.DATABASE_URL,
+			defaultValueIsSerializable: true
 		})
 	},
 	handler: async (args) => {
-		console.log(args);
+		const redact = (v) => v ? "[redacted]" : void 0;
+		console.log({
+			...args,
+			databaseUrl: redact(args.databaseUrl),
+			verdaccioSecret: redact(args.verdaccioSecret),
+			s3SecretAccessKey: redact(args.s3SecretAccessKey)
+		});
 		try {
 			await runRegistry(args);
 		} catch (error) {