@powerhousedao/registry 6.2.3-dev.6 → 6.2.3-dev.60

package/dist/plugins/@powerhousedao/verdaccio-s3-storage/rolldown-runtime-ch10HqoO.js

@@ -0,0 +1,71 @@
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esmMin = (fn, res, err) => () => {
+	if (err) throw err[0];
+	try {
+		return fn && (res = fn(fn = 0)), res;
+	} catch (e) {
+		throw err = [e], e;
+	}
+};
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+//#endregion
+Object.defineProperty(exports, "__commonJSMin", {
+	enumerable: true,
+	get: function() {
+		return __commonJSMin;
+	}
+});
+Object.defineProperty(exports, "__esmMin", {
+	enumerable: true,
+	get: function() {
+		return __esmMin;
+	}
+});
+Object.defineProperty(exports, "__exportAll", {
+	enumerable: true,
+	get: function() {
+		return __exportAll;
+	}
+});
+Object.defineProperty(exports, "__toCommonJS", {
+	enumerable: true,
+	get: function() {
+		return __toCommonJS;
+	}
+});
+Object.defineProperty(exports, "__toESM", {
+	enumerable: true,
+	get: function() {
+		return __toESM;
+	}
+});

package/dist/plugins/verdaccio-registry-auth.js

@@ -19,50 +19,440 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
 //#endregion
 let _verdaccio_core = require("@verdaccio/core");
 let bcryptjs = require("bcryptjs");
-bcryptjs = __toESM(bcryptjs);
+bcryptjs = __toESM(bcryptjs, 1);
+require("@electric-sql/pglite");
+require("@electric-sql/pglite/contrib/pg_trgm");
 let pg = require("pg");
+pg = __toESM(pg, 1);
 let _renown_sdk = require("@renown/sdk");
+//#region src/db/migrations.ts
+const MIGRATION_LOCK_ID = 7446517101;
+function indexConcurrently(name, definition) {
+	return [async (q) => {
+		if ((await q.query("SELECT indisvalid AS valid FROM pg_index WHERE indexrelid = to_regclass($1)", [name])).rows[0]?.valid === false) await q.query(`DROP INDEX CONCURRENTLY IF EXISTS ${name}`);
+	}, `CREATE INDEX CONCURRENTLY IF NOT EXISTS ${name} ${definition}`];
+}
+const MIGRATIONS = [
+	{
+		id: 1,
+		name: "registry state",
+		statements: [
+			`CREATE TABLE IF NOT EXISTS registry_users (
+        username      text PRIMARY KEY,
+        password_hash text NOT NULL,
+        created_at    timestamptz NOT NULL DEFAULT now()
+      )`,
+			`CREATE TABLE IF NOT EXISTS registry_package_owners (
+        package_name text PRIMARY KEY,
+        owners       text[] NOT NULL,
+        claimed_at   timestamptz NOT NULL DEFAULT now()
+      )`,
+			`CREATE TABLE registry_packages (
+        name       text PRIMARY KEY,
+        local      boolean NOT NULL DEFAULT false,
+        dist_tags  jsonb NOT NULL DEFAULT '{}',
+        versions   jsonb NOT NULL DEFAULT '[]',
+        times      jsonb NOT NULL DEFAULT '{}',
+        latest     text,
+        updated_at timestamptz NOT NULL DEFAULT now()
+      )`,
+			`CREATE TABLE registry_versions (
+        package        text NOT NULL,
+        version        text NOT NULL,
+        status         text NOT NULL CHECK (status IN ('pending', 'ready', 'failed')),
+        manifest       jsonb,
+        package_json_version text,
+        files          jsonb NOT NULL DEFAULT '[]',
+        error          text,
+        updated_at     timestamptz NOT NULL DEFAULT now(),
+        PRIMARY KEY (package, version)
+      )`,
+			`CREATE TABLE registry_piece_owners (
+        name       text PRIMARY KEY,
+        package    text NOT NULL,
+        claimed_at timestamptz NOT NULL DEFAULT now()
+      )`,
+			`CREATE TABLE registry_pieces (
+        name            text NOT NULL,
+        version         text NOT NULL,
+        package         text NOT NULL,
+        display_name    text NOT NULL,
+        description     text,
+        descriptor      jsonb,
+        descriptor_path text NOT NULL,
+        bundle_file     text NOT NULL,
+        bundle_key      text,
+        published_at    timestamptz,
+        is_latest       boolean NOT NULL DEFAULT false,
+        PRIMARY KEY (name, version)
+      )`,
+			"CREATE INDEX registry_pieces_package ON registry_pieces (package, version)",
+			"CREATE INDEX registry_pieces_bundle ON registry_pieces (bundle_file)",
+			`CREATE TABLE registry_jobs (
+        id         bigserial PRIMARY KEY,
+        kind       text NOT NULL,
+        package    text NOT NULL,
+        version    text NOT NULL DEFAULT '',
+        payload    jsonb NOT NULL DEFAULT '{}',
+        attempts   integer NOT NULL DEFAULT 0,
+        run_after  timestamptz NOT NULL DEFAULT now(),
+        locked_by  text,
+        locked_at  timestamptz,
+        requeued   boolean NOT NULL DEFAULT false,
+        last_error text,
+        created_at timestamptz NOT NULL DEFAULT now(),
+        UNIQUE (kind, package, version)
+      )`,
+			`CREATE TABLE registry_webhooks (
+        endpoint   text PRIMARY KEY,
+        headers    jsonb NOT NULL DEFAULT '{}',
+        created_at timestamptz NOT NULL DEFAULT now()
+      )`
+		]
+	},
+	{
+		id: 2,
+		name: "job priority",
+		statements: ["ALTER TABLE registry_jobs ADD COLUMN priority integer NOT NULL DEFAULT 0", "CREATE INDEX registry_jobs_due ON registry_jobs (priority, id)"]
+	},
+	{
+		id: 3,
+		name: "search",
+		statements: [
+			"CREATE EXTENSION IF NOT EXISTS pg_trgm",
+			`CREATE OR REPLACE FUNCTION registry_search_name(pkg text, m jsonb) RETURNS text
+        LANGUAGE sql IMMUTABLE PARALLEL SAFE
+        AS $$ SELECT lower(concat_ws(' ', pkg, m->>'name')) $$`,
+			`CREATE OR REPLACE FUNCTION registry_search_text(m jsonb) RETURNS text
+        LANGUAGE sql IMMUTABLE PARALLEL SAFE
+        AS $$ SELECT lower(concat_ws(' ', m->>'description',
+          (SELECT string_agg(x #>> '{}', ' ')
+             FROM jsonb_path_query(m, 'lax $.*[*].name') x),
+          (SELECT string_agg(x #>> '{}', ' ')
+             FROM jsonb_path_query(m, 'lax $.*[*].id') x))) $$`,
+			`CREATE OR REPLACE FUNCTION registry_search_doc(pkg text, m jsonb) RETURNS text
+        LANGUAGE sql IMMUTABLE PARALLEL SAFE
+        AS $$ SELECT concat_ws(' ', registry_search_name(pkg, m),
+          registry_search_text(m)) $$`,
+			`CREATE OR REPLACE FUNCTION registry_piece_search_name(
+          name text, display_name text, d jsonb) RETURNS text
+        LANGUAGE sql IMMUTABLE PARALLEL SAFE
+        AS $$ SELECT lower(concat_ws(' ', name, display_name,
+          d->>'displayName')) $$`,
+			`CREATE OR REPLACE FUNCTION registry_piece_search_doc(
+          name text, display_name text, description text, d jsonb) RETURNS text
+        LANGUAGE sql IMMUTABLE PARALLEL SAFE
+        AS $$ SELECT concat_ws(' ',
+          registry_piece_search_name(name, display_name, d),
+          lower(coalesce(d->>'description', description))) $$`,
+			`ALTER TABLE registry_packages
+        ADD COLUMN listed_manifest jsonb,
+        ADD COLUMN listed_package_json_version text,
+        ADD COLUMN search_doc text GENERATED ALWAYS AS
+          (registry_search_doc(name, listed_manifest)) STORED,
+        ADD COLUMN search_tsv tsvector GENERATED ALWAYS AS (
+          setweight(to_tsvector('english',
+            coalesce(registry_search_name(name, listed_manifest), '')), 'A') ||
+          setweight(to_tsvector('english',
+            coalesce(registry_search_text(listed_manifest), '')), 'B')) STORED`,
+			`UPDATE registry_versions SET manifest = NULL
+        WHERE jsonb_typeof(manifest) = 'null'`,
+			`UPDATE registry_pieces SET descriptor = NULL
+        WHERE jsonb_typeof(descriptor) = 'null'`,
+			`UPDATE registry_packages p
+          SET listed_manifest = v.manifest,
+              listed_package_json_version = v.package_json_version
+         FROM registry_versions v
+        WHERE v.package = p.name AND v.version = p.latest
+          AND v.status = 'ready' AND v.manifest IS NOT NULL`,
+			`ALTER TABLE registry_pieces
+        ADD COLUMN search_doc text GENERATED ALWAYS AS
+          (registry_piece_search_doc(name, display_name, description, descriptor)) STORED,
+        ADD COLUMN search_tsv tsvector GENERATED ALWAYS AS (
+          setweight(to_tsvector('english',
+            coalesce(registry_piece_search_name(name, display_name, descriptor), '')), 'A') ||
+          setweight(to_tsvector('english',
+            coalesce(descriptor->>'description', description, '')), 'B')) STORED`
+		]
+	},
+	{
+		id: 4,
+		name: "write ordering",
+		statements: [
+			"ALTER TABLE registry_packages ADD COLUMN modified timestamptz",
+			`CREATE TABLE registry_unpublished (
+        package        text NOT NULL,
+        version        text NOT NULL,
+        unpublished_at timestamptz NOT NULL DEFAULT now(),
+        PRIMARY KEY (package, version)
+      )`,
+			`ALTER TABLE registry_jobs SET (autovacuum_vacuum_scale_factor = 0,
+        autovacuum_vacuum_threshold = 500)`
+		]
+	},
+	{
+		id: 5,
+		name: "search indexes",
+		transaction: false,
+		statements: [
+			...indexConcurrently("registry_packages_search_trgm", `ON registry_packages USING gin (search_doc gin_trgm_ops)
+          WHERE local AND listed_manifest IS NOT NULL`),
+			...indexConcurrently("registry_packages_search_tsv", `ON registry_packages USING gin (search_tsv)
+          WHERE local AND listed_manifest IS NOT NULL`),
+			...indexConcurrently("registry_pieces_search_trgm", "ON registry_pieces USING gin (search_doc gin_trgm_ops) WHERE is_latest"),
+			...indexConcurrently("registry_pieces_search_tsv", "ON registry_pieces USING gin (search_tsv) WHERE is_latest"),
+			...indexConcurrently("registry_pieces_latest", "ON registry_pieces (package) WHERE is_latest"),
+			"DROP INDEX CONCURRENTLY IF EXISTS registry_pieces_bundle"
+		]
+	},
+	{
+		id: 6,
+		name: "reconcile by revision",
+		transaction: false,
+		statements: ["ALTER TABLE registry_packages ADD COLUMN IF NOT EXISTS manifest_rev text", ...indexConcurrently("registry_versions_pending", "ON registry_versions (updated_at) WHERE status = 'pending'")]
+	},
+	{
+		id: 7,
+		name: "permanent version failures",
+		transaction: false,
+		statements: ["ALTER TABLE registry_versions ADD COLUMN IF NOT EXISTS permanent boolean NOT NULL DEFAULT false"]
+	}
+];
+const MIGRATIONS_TABLE = `CREATE TABLE IF NOT EXISTS registry_migrations (
+  id         integer PRIMARY KEY,
+  name       text NOT NULL,
+  applied_at timestamptz NOT NULL DEFAULT now()
+)`;
+const LOCK_TIMEOUT = "5s";
+async function appliedIds(q) {
+	if (!(await q.query("SELECT to_regclass('registry_migrations') IS NOT NULL AS exists")).rows[0]?.exists) return /* @__PURE__ */ new Set();
+	const applied = await q.query("SELECT id FROM registry_migrations");
+	return new Set(applied.rows.map((row) => row.id));
+}
+async function runSteps(q, migration, embedded) {
+	for (const step of migration.statements) if (typeof step === "function") await step(q);
+	else await q.query(embedded ? step.replace(/ CONCURRENTLY/g, "") : step);
+	await q.query("INSERT INTO registry_migrations (id, name) VALUES ($1, $2)", [migration.id, migration.name]);
+}
+const LOCK_POLL_MS = 500;
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function applyInTransaction(db, migration) {
+	for (;;) {
+		if (await db.transaction(async (tx) => {
+			if (!(await tx.query("SELECT pg_try_advisory_xact_lock($1) AS ok", [MIGRATION_LOCK_ID])).rows[0]?.ok) return false;
+			await tx.query(`SET LOCAL lock_timeout = '${LOCK_TIMEOUT}'`);
+			await tx.query(MIGRATIONS_TABLE);
+			if (!(await appliedIds(tx)).has(migration.id)) await runSteps(tx, migration, db.embedded);
+			return true;
+		})) return;
+		await sleep(LOCK_POLL_MS);
+	}
+}
+async function applyOnline(db, migration) {
+	await db.session(async (s) => {
+		for (;;) {
+			if ((await s.query("SELECT pg_try_advisory_lock($1) AS ok", [MIGRATION_LOCK_ID])).rows[0]?.ok) break;
+			await sleep(LOCK_POLL_MS);
+		}
+		try {
+			await s.query(`SET lock_timeout = '${LOCK_TIMEOUT}'`);
+			await s.query(MIGRATIONS_TABLE);
+			if ((await appliedIds(s)).has(migration.id)) return;
+			await runSteps(s, migration, false);
+		} finally {
+			await s.query("SELECT pg_advisory_unlock($1)", [MIGRATION_LOCK_ID]);
+		}
+	});
+}
+/** Applies pending migrations; any number of processes may run it at once. */
+async function migrate(db) {
+	const applied = await appliedIds(db);
+	for (const migration of MIGRATIONS) {
+		if (applied.has(migration.id)) continue;
+		if (migration.transaction === false && !db.embedded) await applyOnline(db, migration);
+		else await applyInTransaction(db, migration);
+	}
+}
+/** Migrations this build needs that the database hasn't applied. */
+async function pendingMigrations(db) {
+	const applied = await appliedIds(db);
+	return MIGRATIONS.filter((m) => !applied.has(m.id)).map(({ id, name }) => ({
+		id,
+		name
+	}));
+}
+async function checkSchema(db) {
+	const pending = await pendingMigrations(db);
+	if (pending.length === 0) return;
+	const list = pending.map((m) => `${m.id} (${m.name})`).join(", ");
+	throw new Error(`the registry database is missing migration(s) ${list}; run \`ph-registry migrate\` first, or set PH_REGISTRY_MIGRATE_ON_BOOT=true`);
+}
+/** Whether to migrate at boot: the flag, else the env, else only for PGlite. */
+function migrateOnBoot(explicit, databaseUrl) {
+	if (explicit !== void 0) return explicit;
+	const env = process.env.PH_REGISTRY_MIGRATE_ON_BOOT;
+	if (env === "true" || env === "false") return env === "true";
+	return !databaseUrl;
+}
+/** Migrates, or checks the schema is current and refuses to start if not. */
+function prepareSchema(db, migrateNow) {
+	return migrateNow ? migrate(db) : checkSchema(db);
+}
+//#endregion
+//#region src/db/database.ts
+const LISTENER_CHECK_MS = 3e4;
+function createPostgresDatabase(connectionString, listenConnectionString = connectionString, poolMax = 10) {
+	const pool = new pg.default.Pool({
+		connectionString,
+		connectionTimeoutMillis: 1e4,
+		max: poolMax
+	});
+	pool.on("error", (err) => {
+		console.error("[registry] postgres pool error:", err.message);
+	});
+	const listeners = /* @__PURE__ */ new Map();
+	let listener;
+	let connected = false;
+	let everConnected = false;
+	let closed = false;
+	const reconnectHandlers = /* @__PURE__ */ new Set();
+	const dropListener = (client, reason) => {
+		console.error("[registry] postgres listener lost:", reason);
+		connected = false;
+		listener = void 0;
+		client.end().catch(() => void 0);
+		if (!closed) setTimeout(() => void reconnect(), 1e3);
+	};
+	const connectListener = async () => {
+		const client = new pg.default.Client({
+			connectionString: listenConnectionString,
+			keepAlive: true
+		});
+		client.on("notification", (msg) => {
+			for (const fn of listeners.get(msg.channel) ?? []) fn(msg.payload ?? "");
+		});
+		const timers = {};
+		client.on("error", (err) => {
+			clearInterval(timers.check);
+			dropListener(client, err.message);
+		});
+		await client.connect();
+		for (const channel of listeners.keys()) await client.query(`LISTEN ${pg.default.escapeIdentifier(channel)}`);
+		const check = setInterval(() => {
+			const timeout = setTimeout(() => {
+				clearInterval(check);
+				dropListener(client, "health check timed out");
+			}, 1e4);
+			client.query("SELECT 1").catch(() => void 0).finally(() => clearTimeout(timeout));
+		}, LISTENER_CHECK_MS);
+		check.unref();
+		timers.check = check;
+		client.on("end", () => clearInterval(check));
+		connected = true;
+		if (everConnected) for (const fn of reconnectHandlers) fn();
+		everConnected = true;
+		return client;
+	};
+	const reconnect = async () => {
+		if (closed || listener || listeners.size === 0) return;
+		listener = connectListener();
+		await listener.catch(() => {
+			listener = void 0;
+			setTimeout(() => void reconnect(), 1e3);
+		});
+	};
+	return {
+		async query(text, params) {
+			return pool.query(text, params);
+		},
+		async transaction(fn) {
+			const client = await pool.connect();
+			try {
+				await client.query("BEGIN");
+				const result = await fn({ query: (text, params) => client.query(text, params) });
+				await client.query("COMMIT");
+				return result;
+			} catch (err) {
+				await client.query("ROLLBACK").catch(() => void 0);
+				throw err;
+			} finally {
+				client.release();
+			}
+		},
+		async session(fn) {
+			const client = new pg.default.Client({
+				connectionString: listenConnectionString,
+				connectionTimeoutMillis: 1e4
+			});
+			client.on("error", (err) => {
+				console.error("[registry] postgres session error:", err.message);
+			});
+			await client.connect();
+			try {
+				return await fn({ query: (text, params) => client.query(text, params) });
+			} finally {
+				await client.end().catch(() => void 0);
+			}
+		},
+		embedded: false,
+		async listen(channel, onMessage) {
+			let set = listeners.get(channel);
+			const isNew = !set;
+			if (!set) {
+				set = /* @__PURE__ */ new Set();
+				listeners.set(channel, set);
+			}
+			set.add(onMessage);
+			listener ??= connectListener();
+			const client = await listener;
+			if (isNew) await client.query(`LISTEN ${pg.default.escapeIdentifier(channel)}`);
+			return () => {
+				set.delete(onMessage);
+				return Promise.resolve();
+			};
+		},
+		async notify(channel, payload) {
+			await pool.query("SELECT pg_notify($1, $2)", [channel, payload]);
+		},
+		listening: () => connected || listeners.size === 0,
+		onReconnect: (fn) => {
+			reconnectHandlers.add(fn);
+		},
+		async close() {
+			closed = true;
+			await (await listener?.catch(() => void 0))?.end().catch(() => void 0);
+			await pool.end();
+		}
+	};
+}
+//#endregion
 //#region src/auth/pg-store.ts
-/** Build a real Postgres pool from a connection string. */
+/** A database over a Postgres connection string. */
 function createPgPool(databaseUrl) {
-	return new pg.Pool({ connectionString: databaseUrl });
+	return createPostgresDatabase(databaseUrl);
 }
 /**
-* Postgres-backed AuthStore. Two small tables:
-*  - registry_users(username PK, password_hash, created_at)
-*  - registry_package_owners(package_name PK, owners text[], claimed_at)
+* Database-backed AuthStore over `registry_users` and `registry_package_owners`.
 *
 * Ownership claim is race-free: `INSERT ... ON CONFLICT DO NOTHING` means the
 * first publisher wins atomically; the follow-up read returns the actual
 * owners so a losing racer is denied.
-*
-* Takes an already-built `pg.Pool` (tests inject a pg-mem pool cast to Pool).
 */
-function createPgStore(pool) {
+function createPgStore(pool, options = {}) {
 	let initialized = null;
 	return {
 		init() {
-			initialized ??= (async () => {
-				await pool.query(`
-          CREATE TABLE IF NOT EXISTS registry_users (
-            username      text PRIMARY KEY,
-            password_hash text NOT NULL,
-            created_at    timestamptz NOT NULL DEFAULT now()
-          )`);
-				await pool.query(`
-          CREATE TABLE IF NOT EXISTS registry_package_owners (
-            package_name text PRIMARY KEY,
-            owners       text[] NOT NULL,
-            claimed_at   timestamptz NOT NULL DEFAULT now()
-          )`);
-			})();
+			initialized ??= prepareSchema(pool, options.migrate ?? true).catch((err) => {
+				initialized = null;
+				throw err;
+			});
 			return initialized;
 		},
 		async getUser(username) {
@@ -96,7 +486,7 @@ function createPgStore(pool) {
 			return (await pool.query("SELECT owners FROM registry_package_owners WHERE package_name = $1", [pkg])).rows[0]?.owners ?? [];
 		},
 		close() {
-			return pool.end();
+			return pool.close();
 		}
 	};
 }
@@ -194,9 +584,11 @@ function createRegistryAuthPlugin(store, renownVerifier) {
 			}).catch((err) => cb(internal(err)));
 		},
 		adduser(user, password, cb) {
-			ready.then(() => store.createUser(user, bcryptjs.default.hashSync(password, BCRYPT_ROUNDS))).then((created) => {
-				if (!created) return cb(_verdaccio_core.errorUtils.getConflict("username already registered"));
-				return cb(null, true);
+			ready.then(() => store.createUser(user, bcryptjs.default.hashSync(password, BCRYPT_ROUNDS))).then(async (created) => {
+				if (created) return cb(null, true);
+				const rec = await store.getUser(user);
+				if (rec && bcryptjs.default.compareSync(password, rec.passwordHash)) return cb(null, true);
+				return cb(_verdaccio_core.errorUtils.getConflict("username already registered"));
 			}).catch((err) => cb(internal(err)));
 		},
 		allow_access(_user, _pkg, cb) {
@@ -228,9 +620,10 @@ function createRegistryAuthPlugin(store, renownVerifier) {
 /** Verdaccio plugin entry. The loader calls this factory (or `new`s the
 *  default export — both return the plugin object). */
 function registryAuthPlugin(config) {
-	const plugin = createRegistryAuthPlugin((config.storeToken ? takeAuthStore(config.storeToken) : void 0) ?? createPgStore(createPgPool(config.databaseUrl ?? (() => {
+	const databaseUrl = () => config.databaseUrl ?? (() => {
 		throw new Error("registry-auth plugin requires a databaseUrl (or a store token)");
-	})())), config.publicUrl ? createRenownVerifier({
+	})();
+	const plugin = createRegistryAuthPlugin((config.storeToken ? takeAuthStore(config.storeToken) : void 0) ?? createPgStore(createPgPool(databaseUrl()), { migrate: migrateOnBoot(void 0, config.databaseUrl) }), config.publicUrl ? createRenownVerifier({
 		publicUrl: config.publicUrl,
 		renownUrl: config.renownUrl
 	}) : void 0);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@powerhousedao/registry",
-  "version": "6.2.3-dev.6",
+  "version": "6.2.3-dev.60",
   "description": "Powerhouse package registry — resolves and manages document model package dependencies within the Powerhouse ecosystem.",
   "type": "module",
   "repository": {
@@ -29,29 +29,29 @@
   "author": "",
   "license": "ISC",
   "dependencies": {
-    "@powerhousedao/shared": "6.2.3-dev.6",
-    "@renown/sdk": "6.2.3-dev.6",
-    "@verdaccio/core": "8.0.0-next-8.37",
-    "@verdaccio/signature": "8.0.0-next-8.29",
+    "@aws-sdk/client-s3": "3.1087.0",
+    "@electric-sql/pglite": "0.3.15",
+    "@powerhousedao/shared": "6.2.3-dev.60",
+    "@renown/sdk": "6.2.3-dev.60",
+    "@verdaccio/core": "9.0.0-next-9.31",
     "bcryptjs": "^2.4.3",
     "cmd-ts": "0.15.0",
     "express": "^4.22.1",
     "find-up": "^8.0.0",
     "pg": "8.18.0",
     "tar": "^7.5.11",
-    "verdaccio": "^6.5.0",
-    "verdaccio-aws-s3-storage": "^10.4.0"
+    "verdaccio": "7.0.0-next-7.27"
   },
   "devDependencies": {
-    "tsdown": "0.21.1",
+    "@powerhousedao/reactor-workflow": "6.2.3-dev.60",
+    "@powerhousedao/verdaccio-s3-storage": "13.0.0",
     "@types/bcryptjs": "^2.4.6",
     "@types/express": "^4.17.21",
     "@types/node": "25.2.3",
     "@types/pg": "8.16.0",
-    "@types/supertest": "^6.0.2",
-    "pg-mem": "^3.0.14",
-    "supertest": "^7.1.0",
-    "vitest": "4.1.1"
+    "@verdaccio/local-storage": "14.0.0-next-9.31",
+    "tsdown": "0.23.0",
+    "vitest": "5.0.3"
   },
   "homepage": "https://academy.vetra.io",
   "scripts": {