@powerhousedao/registry 6.2.3-dev.9 → 6.2.3

package/dist/cli.mjs

@@ -9,8 +9,10 @@ import { Pool } from "pg";
 import fs from "node:fs";
 import { pipeline } from "node:stream/promises";
 import { Readable } from "node:stream";
-import { extract } from "tar";
+import { create, extract, list } from "tar";
 import { slimManifest } from "@powerhousedao/shared/registry";
+import { promisify } from "node:util";
+import { gunzip } from "node:zlib";
 import { fileURLToPath } from "node:url";
 //#endregion
 //#region src/auth/pg-store.ts
@@ -106,27 +108,48 @@ function wasStoreLoaded(token) {
 }
 //#endregion
 //#region src/semver.ts
-/**
-* Compare two semver version strings for sorting.
-* Returns negative if a < b, positive if a > b, 0 if equal.
-*
-* Handles numeric component comparison (so "1.0.10" > "1.0.9")
-* and prerelease ordering (release > prerelease).
-*/
+function splitVersion(version) {
+	const withoutBuild = version.split("+", 1)[0];
+	const dash = withoutBuild.indexOf("-");
+	const core = dash === -1 ? withoutBuild : withoutBuild.slice(0, dash);
+	const pre = dash === -1 ? "" : withoutBuild.slice(dash + 1);
+	return {
+		core: core.split(".").map(Number),
+		pre: pre ? pre.split(".") : []
+	};
+}
+const NUMERIC = /^\d+$/;
+function comparePrerelease(a, b) {
+	for (let i = 0; i < Math.max(a.length, b.length); i++) {
+		if (i >= a.length) return -1;
+		if (i >= b.length) return 1;
+		const x = a[i];
+		const y = b[i];
+		const xNum = NUMERIC.test(x);
+		const yNum = NUMERIC.test(y);
+		if (xNum && yNum) {
+			const diff = Number(x) - Number(y);
+			if (diff !== 0) return diff;
+			continue;
+		}
+		if (xNum) return -1;
+		if (yNum) return 1;
+		if (x !== y) return x < y ? -1 : 1;
+	}
+	return 0;
+}
+/** Semver sort order: negative if a < b, positive if a > b, 0 if equal. */
 function compareSemver(a, b) {
-	const [coreA, preA] = a.split("-", 2);
-	const [coreB, preB] = b.split("-", 2);
-	const partsA = coreA.split(".").map(Number);
-	const partsB = coreB.split(".").map(Number);
-	for (let i = 0; i < Math.max(partsA.length, partsB.length); i++) {
-		const na = partsA[i] ?? 0;
-		const nb = partsB[i] ?? 0;
+	const va = splitVersion(a);
+	const vb = splitVersion(b);
+	for (let i = 0; i < Math.max(va.core.length, vb.core.length); i++) {
+		const na = va.core[i] ?? 0;
+		const nb = vb.core[i] ?? 0;
 		if (na !== nb) return na - nb;
 	}
-	if (!preA && preB) return 1;
-	if (preA && !preB) return -1;
-	if (preA && preB) return preA < preB ? -1 : preA > preB ? 1 : 0;
-	return 0;
+	if (va.pre.length === 0 && vb.pre.length > 0) return 1;
+	if (va.pre.length > 0 && vb.pre.length === 0) return -1;
+	return comparePrerelease(va.pre, vb.pre);
 }
 //#endregion
 //#region src/cdn.ts
@@ -165,10 +188,15 @@ function isExactVersion(tag) {
 	return !!tag && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(tag);
 }
 var CdnCache = class {
+	cdnCachePath;
 	#extractionLocks = /* @__PURE__ */ new Map();
+	#registryUrl;
 	constructor(registryUrl, cdnCachePath) {
-		this.registryUrl = registryUrl;
 		this.cdnCachePath = cdnCachePath;
+		this.#registryUrl = registryUrl;
+	}
+	get registryUrl() {
+		return typeof this.#registryUrl === "function" ? this.#registryUrl() : this.#registryUrl;
 	}
 	async getFileByVersion(packageName, version, filePath) {
 		const versionDir = path.join(this.cdnCachePath, packageName, version);
@@ -354,9 +382,15 @@ function readPackageMetadata(storagePath, packageName) {
 		const distTags = parsed["dist-tags"];
 		const versions = (parsed.versions ? Object.keys(parsed.versions) : []).slice().sort(compareSemver);
 		const locallyPublished = !!parsed._attachments && Object.keys(parsed._attachments).length > 0;
+		const time = {};
+		for (const version of versions) {
+			const at = parsed.time?.[version];
+			if (typeof at === "string") time[version] = at;
+		}
 		return {
 			distTags: distTags && Object.keys(distTags).length > 0 ? distTags : void 0,
 			versions: versions.length > 0 ? versions : void 0,
+			time,
 			locallyPublished
 		};
 	} catch {
@@ -392,16 +426,19 @@ function readPackageJsonVersion(dir) {
 		return;
 	}
 }
-function getLatestVersionDir(pkgDir) {
+/** Extracted version directories of a package, oldest first. */
+function listVersionDirs(pkgDir) {
 	let entries;
 	try {
 		entries = fs.readdirSync(pkgDir, { withFileTypes: true });
 	} catch {
-		return null;
+		return [];
 	}
-	const versions = entries.filter((e) => e.isDirectory()).map((e) => e.name);
+	return entries.filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).sort(compareSemver);
+}
+function getLatestVersionDir(pkgDir) {
+	const versions = listVersionDirs(pkgDir);
 	if (versions.length === 0) return null;
-	versions.sort(compareSemver);
 	return path.join(pkgDir, versions[versions.length - 1]);
 }
 function loadPackage(cdnCachePath, name, version, storagePath) {
@@ -448,63 +485,70 @@ function getDocumentTypesFromManifest(manifest) {
 	documentTypes.push(...(documentModels ?? []).map((dm) => dm.id), ...(editors ?? []).flatMap((e) => e.documentTypes).filter((dt) => dt !== void 0), ...(subgraphs ?? []).flatMap((e) => e.documentTypes).filter((dt) => dt !== void 0));
 	return documentTypes;
 }
-function scanPackages(cdnCachePath, storagePath) {
+function readPackageDir(cdnCachePath, dirName, storagePath) {
+	const pkgDir = path.join(cdnCachePath, dirName);
+	const versionDirs = listVersionDirs(pkgDir);
+	const latest = versionDirs.at(-1);
+	const manifestDir = latest ? path.join(pkgDir, latest) : pkgDir;
+	const manifest = readManifest(manifestDir);
+	const name = manifest?.name || dirName;
+	const { distTags, versions, time, locallyPublished } = readPackageMetadata(storagePath, name);
+	return {
+		dirName,
+		packageDir: pkgDir,
+		manifestDir,
+		versionDirs,
+		manifest,
+		name,
+		version: readPackageJsonVersion(manifestDir),
+		distTags,
+		versions,
+		time,
+		locallyPublished
+	};
+}
+function* scanPackageDirs(cdnCachePath, storagePath) {
 	const absDir = path.resolve(cdnCachePath);
-	const packages = [];
 	let entries;
 	try {
 		entries = fs.readdirSync(absDir, { withFileTypes: true });
 	} catch {
-		return packages;
+		return;
 	}
 	for (const entry of entries) {
 		if (!entry.isDirectory()) continue;
-		if (entry.name.startsWith("@")) {
-			const scopeDir = path.join(absDir, entry.name);
-			let scopedEntries;
-			try {
-				scopedEntries = fs.readdirSync(scopeDir, { withFileTypes: true });
-			} catch (error) {
-				console.log(error);
-				continue;
-			}
-			for (const scopedEntry of scopedEntries) {
-				if (!scopedEntry.isDirectory()) continue;
-				const dirName = `${entry.name}/${scopedEntry.name}`;
-				const pkgDir = path.join(scopeDir, scopedEntry.name);
-				const manifestDir = getLatestVersionDir(pkgDir) ?? pkgDir;
-				const manifest = readManifest(manifestDir);
-				const name = manifest?.name || dirName;
-				const { distTags, versions, locallyPublished } = readPackageMetadata(storagePath, name);
-				if (locallyPublished === false) continue;
-				packages.push({
-					name,
-					path: `/-/cdn/${dirName}`,
-					manifest,
-					documentTypes: getDocumentTypesFromManifest(manifest),
-					version: readPackageJsonVersion(manifestDir),
-					distTags,
-					versions
-				});
-			}
-		} else {
-			const pkgDir = path.join(absDir, entry.name);
-			const manifestDir = getLatestVersionDir(pkgDir) ?? pkgDir;
-			const manifest = readManifest(manifestDir);
-			const name = manifest?.name || entry.name;
-			const { distTags, versions, locallyPublished } = readPackageMetadata(storagePath, name);
-			if (locallyPublished === false) continue;
-			packages.push({
-				name,
-				path: `/-/cdn/${entry.name}`,
-				manifest,
-				documentTypes: getDocumentTypesFromManifest(manifest),
-				version: readPackageJsonVersion(manifestDir),
-				distTags,
-				versions
-			});
+		if (!entry.name.startsWith("@")) {
+			yield readPackageDir(absDir, entry.name, storagePath);
+			continue;
+		}
+		const scopeDir = path.join(absDir, entry.name);
+		let scopedEntries;
+		try {
+			scopedEntries = fs.readdirSync(scopeDir, { withFileTypes: true });
+		} catch (error) {
+			console.log(error);
+			continue;
+		}
+		for (const scopedEntry of scopedEntries) {
+			if (!scopedEntry.isDirectory()) continue;
+			yield readPackageDir(absDir, `${entry.name}/${scopedEntry.name}`, storagePath);
 		}
 	}
+}
+function scanPackages(cdnCachePath, storagePath) {
+	const packages = [];
+	for (const pkg of scanPackageDirs(cdnCachePath, storagePath)) {
+		if (pkg.locallyPublished === false) continue;
+		packages.push({
+			name: pkg.name,
+			path: `/-/cdn/${pkg.dirName}`,
+			manifest: pkg.manifest,
+			documentTypes: getDocumentTypesFromManifest(pkg.manifest),
+			version: pkg.version,
+			distTags: pkg.distTags,
+			versions: pkg.versions
+		});
+	}
 	return packages;
 }
 function findPackagesByDocumentType(packagesDir, documentType) {
@@ -514,6 +558,377 @@ function findPackagesByDocumentType(packagesDir, documentType) {
 	});
 }
 //#endregion
+//#region src/pieces.ts
+const gunzip$1 = promisify(gunzip);
+/** Piece names in this scope belong to Activepieces; no package may claim one. */
+const RESERVED_PIECE_SCOPE = "@activepieces/";
+const INDEX_TTL_MS = 3e4;
+const indexes = /* @__PURE__ */ new Map();
+const versionPieces = /* @__PURE__ */ new Map();
+const descriptors = /* @__PURE__ */ new Map();
+const materializing = /* @__PURE__ */ new Map();
+/** Drop the cached index and descriptors — a publish or unpublish moved them. */
+function invalidatePieceIndex() {
+	indexes.clear();
+	versionPieces.clear();
+	descriptors.clear();
+}
+function indexKey(cdnCachePath, storagePath) {
+	return `${path.resolve(cdnCachePath)}\0${storagePath ?? ""}`;
+}
+function piecesOf(manifest) {
+	return manifest?.pieces ?? [];
+}
+function piecesAt(versionDir) {
+	const hit = versionPieces.get(versionDir);
+	if (hit) return hit;
+	if (!fs.existsSync(path.join(versionDir, "package.json"))) return [];
+	const manifest = readManifest(versionDir);
+	if (!manifest) return [];
+	const pieces = piecesOf(manifest);
+	versionPieces.set(versionDir, pieces);
+	return pieces;
+}
+function toIndexEntry(piece, packageName, packageVersion, packageDir, publishedAt) {
+	const { id, bundle } = piece;
+	if (!id || !bundle) return null;
+	return {
+		name: id,
+		displayName: piece.name || id,
+		...piece.description ? { description: piece.description } : {},
+		version: packageVersion,
+		packageName,
+		packageVersion,
+		packageDir,
+		bundle,
+		descriptor: piece.descriptor ?? `${bundle}/descriptor.json`,
+		...publishedAt ? { publishedAt } : {}
+	};
+}
+function indexVersion(index, pkg, version) {
+	const versionDir = path.join(pkg.dir, version);
+	const held = [];
+	for (const piece of piecesAt(versionDir)) {
+		const entry = toIndexEntry(piece, pkg.name, version, versionDir, pkg.publishedAt[version]);
+		if (!entry) continue;
+		let line = index.get(entry.name);
+		if (line && line.packageName !== pkg.name) {
+			console.warn(`[registry] piece "${entry.name}" is claimed by both ${line.packageName} and ${pkg.name}; keeping ${line.packageName}`);
+			continue;
+		}
+		if (!line) {
+			line = {
+				packageName: pkg.name,
+				versions: /* @__PURE__ */ new Map(),
+				pending: /* @__PURE__ */ new Set(),
+				publishedAt: pkg.publishedAt
+			};
+			index.set(entry.name, line);
+		}
+		line.versions.set(version, entry);
+		held.push(entry.name);
+	}
+	return held;
+}
+function buildPieceIndex(cdnCachePath, storagePath) {
+	const index = /* @__PURE__ */ new Map();
+	for (const scanned of scanPackageDirs(cdnCachePath, storagePath)) {
+		if (scanned.locallyPublished === false) continue;
+		const pkg = {
+			name: scanned.name,
+			dir: scanned.packageDir,
+			publishedAt: scanned.time ?? {}
+		};
+		const names = /* @__PURE__ */ new Set();
+		const extracted = /* @__PURE__ */ new Set();
+		for (const version of scanned.versionDirs) {
+			const held = indexVersion(index, pkg, version);
+			if (fs.existsSync(path.join(pkg.dir, version, "package.json"))) extracted.add(version);
+			for (const name of held) names.add(name);
+		}
+		const pending = (scanned.versions ?? []).filter((v) => !extracted.has(v));
+		for (const name of names) {
+			const line = index.get(name);
+			for (const version of pending) line?.pending.add(version);
+		}
+	}
+	return index;
+}
+/** The piece index, rebuilt only when the cached one has gone stale. */
+function pieceIndex(cdnCachePath, storagePath) {
+	const key = indexKey(cdnCachePath, storagePath);
+	const cached = indexes.get(key);
+	if (cached && Date.now() - cached.builtAt < INDEX_TTL_MS) return cached.index;
+	const index = buildPieceIndex(cdnCachePath, storagePath);
+	indexes.set(key, {
+		index,
+		builtAt: Date.now()
+	});
+	return index;
+}
+/** The highest extracted version of a piece. */
+function latestOf(line) {
+	let latest;
+	for (const entry of line.versions.values()) if (!latest || compareSemver(entry.version, latest.version) > 0) latest = entry;
+	return latest;
+}
+/** The latest version of a piece. */
+function findPiece(cdnCachePath, name, storagePath) {
+	const line = pieceIndex(cdnCachePath, storagePath).get(name);
+	return line ? latestOf(line) : void 0;
+}
+async function materialize(extractor, cdnCachePath, index, line, version) {
+	const key = `${line.packageName}@${version}`;
+	const running = materializing.get(key);
+	if (running) return running;
+	const started = (async () => {
+		try {
+			await extractor.getFileByVersion(line.packageName, version, "package.json");
+		} catch (error) {
+			console.error(`[registry] failed to extract ${key}:`, error);
+			return;
+		}
+		const dir = path.join(cdnCachePath, line.packageName);
+		if (!fs.existsSync(path.join(dir, version, "package.json"))) return;
+		indexVersion(index, {
+			name: line.packageName,
+			dir,
+			publishedAt: line.publishedAt
+		}, version);
+		for (const other of index.values()) if (other.packageName === line.packageName) other.pending.delete(version);
+	})().finally(() => materializing.delete(key));
+	materializing.set(key, started);
+	return started;
+}
+async function materializeAll(extractor, cdnCachePath, index, line) {
+	await Promise.all([...line.pending].map((version) => materialize(extractor, cdnCachePath, index, line, version)));
+}
+function newestFirst(line) {
+	return [...line.versions.values()].sort((a, b) => compareSemver(b.version, a.version));
+}
+/** Every version of a piece, newest first; undefined for an unknown name. */
+async function pieceVersions(extractor, cdnCachePath, name, storagePath) {
+	const index = pieceIndex(cdnCachePath, storagePath);
+	const line = index.get(name);
+	if (!line) return void 0;
+	await materializeAll(extractor, cdnCachePath, index, line);
+	return newestFirst(line);
+}
+function versionSummary(entry) {
+	return {
+		version: entry.version,
+		packageVersion: entry.packageVersion,
+		publishedAt: entry.publishedAt ?? null
+	};
+}
+/** One exact version of a piece, extracting its package version if needed. */
+async function findPieceVersion(extractor, cdnCachePath, name, version, storagePath) {
+	const index = pieceIndex(cdnCachePath, storagePath);
+	const line = index.get(name);
+	if (!line) return { kind: "unknown-piece" };
+	if (!line.versions.has(version) && line.pending.has(version)) await materialize(extractor, cdnCachePath, index, line, version);
+	const entry = line.versions.get(version);
+	if (entry) return {
+		kind: "found",
+		entry
+	};
+	await materializeAll(extractor, cdnCachePath, index, line);
+	return {
+		kind: "unknown-version",
+		available: newestFirst(line).map((e) => e.version)
+	};
+}
+function insidePackage(entry, relative) {
+	const root = path.resolve(entry.packageDir);
+	const resolved = path.resolve(root, relative);
+	if (resolved !== root && !resolved.startsWith(root + path.sep)) return null;
+	return resolved;
+}
+function readDescriptor(entry) {
+	const file = insidePackage(entry, entry.descriptor);
+	if (!file) return null;
+	const hit = descriptors.get(file);
+	if (hit !== void 0) return hit;
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(file, "utf-8"));
+	} catch {
+		parsed = null;
+	}
+	descriptors.set(file, parsed);
+	return parsed;
+}
+const count = (record) => record ? Object.keys(record).length : 0;
+function suggested(blocks) {
+	return Object.entries(blocks ?? {}).map(([name, block]) => ({
+		name,
+		displayName: block.displayName ?? name,
+		description: block.description ?? ""
+	}));
+}
+function catalogEntry(entry, descriptor, suggestions) {
+	return {
+		name: entry.name,
+		displayName: descriptor.displayName || entry.displayName,
+		description: descriptor.description ?? entry.description ?? "",
+		logoUrl: descriptor.logoUrl ?? "",
+		version: entry.version,
+		authors: descriptor.authors ?? [],
+		categories: descriptor.categories ?? [],
+		auth: descriptor.auth ?? null,
+		actions: count(descriptor.actions),
+		triggers: count(descriptor.triggers),
+		...descriptor.minimumSupportedRelease ? { minimumSupportedRelease: descriptor.minimumSupportedRelease } : {},
+		...descriptor.maximumSupportedRelease ? { maximumSupportedRelease: descriptor.maximumSupportedRelease } : {},
+		package: entry.packageName,
+		packageVersion: entry.packageVersion,
+		...suggestions ? {
+			suggestedActions: suggested(descriptor.actions),
+			suggestedTriggers: Object.entries(descriptor.triggers ?? {}).map(([name, block]) => ({
+				name,
+				displayName: block.displayName ?? name,
+				description: block.description ?? "",
+				type: block.type ?? ""
+			}))
+		} : {}
+	};
+}
+/** The catalog of latest versions, sorted by display name. */
+function pieceCatalog(cdnCachePath, options = {}) {
+	const entries = [];
+	for (const line of pieceIndex(cdnCachePath, options.storagePath).values()) {
+		const entry = latestOf(line);
+		const descriptor = entry ? readDescriptor(entry) : null;
+		if (!entry || !descriptor) continue;
+		entries.push(catalogEntry(entry, descriptor, options.suggestions === true));
+	}
+	return entries.sort((a, b) => a.displayName.localeCompare(b.displayName));
+}
+/** The CDN path of a file inside the package version that ships the piece. */
+function cdnPath(entry, relative) {
+	return `/-/cdn/${entry.packageName}@${entry.packageVersion}/${relative}`;
+}
+/** The tarball filename cdn.activepieces.com would use for the same piece. */
+function pieceTarballName(name, version) {
+	return `${name.replace("/", "-")}-${version}.tgz`;
+}
+function pieceTarballPath(entry) {
+	return `/-/pieces/bundled/${pieceTarballName(entry.name, entry.version)}`;
+}
+/** One piece version: what provides it, and where its descriptor and bundle are. */
+function pieceDetail(entry, origin) {
+	const descriptor = readDescriptor(entry);
+	if (!descriptor) return null;
+	return {
+		...descriptor,
+		name: entry.name,
+		version: entry.version,
+		package: entry.packageName,
+		packageVersion: entry.packageVersion,
+		descriptorUrl: `${origin}${cdnPath(entry, entry.descriptor)}`,
+		bundleUrl: `${origin}${pieceTarballPath(entry)}`
+	};
+}
+async function findPieceByTarball(extractor, cdnCachePath, filename, storagePath) {
+	if (!filename.endsWith(".tgz")) return void 0;
+	const stem = filename.slice(0, -4);
+	for (const name of pieceIndex(cdnCachePath, storagePath).keys()) {
+		const prefix = `${name.replace("/", "-")}-`;
+		if (!stem.startsWith(prefix)) continue;
+		const version = stem.slice(prefix.length);
+		if (!isExactVersion(version)) continue;
+		const found = await findPieceVersion(extractor, cdnCachePath, name, version, storagePath);
+		if (found.kind === "found") return found.entry;
+	}
+}
+function listFiles(dir, prefix = "") {
+	const files = [];
+	for (const item of fs.readdirSync(dir, { withFileTypes: true })) {
+		const rel = prefix ? `${prefix}/${item.name}` : item.name;
+		if (item.isDirectory()) files.push(...listFiles(path.join(dir, item.name), rel));
+		else if (item.isFile()) files.push(rel);
+	}
+	return files.sort();
+}
+const cuts = /* @__PURE__ */ new Map();
+async function cutTarball(entry, pieceDir, target) {
+	const files = listFiles(pieceDir);
+	if (files.length === 0) return null;
+	fs.mkdirSync(path.dirname(target), { recursive: true });
+	const tmp = `${target}.tmp-${crypto.randomUUID()}`;
+	try {
+		await create({
+			file: tmp,
+			gzip: true,
+			cwd: pieceDir,
+			prefix: "package",
+			portable: true
+		}, files);
+		fs.renameSync(tmp, target);
+	} catch (error) {
+		fs.rmSync(tmp, { force: true });
+		console.error(`[registry] failed to pack piece ${entry.name}:`, error);
+		return null;
+	}
+	return target;
+}
+async function pieceTarball(entry) {
+	const pieceDir = insidePackage(entry, entry.bundle);
+	if (!pieceDir || !fs.existsSync(path.join(pieceDir, "package.json"))) return null;
+	const target = path.join(entry.packageDir, ".piece-bundles", pieceTarballName(entry.name, entry.version));
+	if (fs.existsSync(target)) return target;
+	const pending = cuts.get(target);
+	if (pending) return pending;
+	const started = cutTarball(entry, pieceDir, target).finally(() => {
+		cuts.delete(target);
+	});
+	cuts.set(target, started);
+	return started;
+}
+const MANIFEST_PATHS = [
+	"powerhouse.manifest.json",
+	"cdn/powerhouse.manifest.json",
+	"dist/powerhouse.manifest.json"
+];
+const MAX_TARBALL_BYTES = 134217728;
+function stripRoot(entryPath) {
+	return entryPath.replace(/^[^/]+\//, "");
+}
+function manifestsInTar(tar) {
+	const found = /* @__PURE__ */ new Map();
+	list({
+		sync: true,
+		filter: (entryPath) => MANIFEST_PATHS.includes(stripRoot(entryPath)),
+		onReadEntry: (entry) => {
+			const chunks = [];
+			entry.on("data", (chunk) => chunks.push(Buffer.from(chunk)));
+			entry.on("end", () => {
+				found.set(stripRoot(String(entry.path)), Buffer.concat(chunks).toString("utf-8"));
+			});
+		}
+	}).end(tar);
+	return found;
+}
+/** The piece names a published tarball claims; empty when it claims none. */
+async function pieceNamesInTarball(tgz) {
+	let manifests;
+	try {
+		manifests = manifestsInTar(await gunzip$1(tgz, { maxOutputLength: MAX_TARBALL_BYTES }));
+	} catch {
+		return [];
+	}
+	for (const candidate of MANIFEST_PATHS) {
+		const raw = manifests.get(candidate);
+		if (raw === void 0) continue;
+		try {
+			return piecesOf(JSON.parse(raw)).map((piece) => piece.id).filter((id) => typeof id === "string" && id !== "");
+		} catch {
+			return [];
+		}
+	}
+	return [];
+}
+//#endregion
 //#region src/warmup.ts
 const WARM_INTERVAL_MS = 3e4;
 const WARM_CONCURRENCY = 8;
@@ -526,7 +941,7 @@ function createWarmer(config, cdn) {
 	let warmInFlight = false;
 	let lastWarmAt = 0;
 	return async function warm() {
-		if (warmInFlight) return;
+		if (warmInFlight || config.port === 0) return;
 		if (Date.now() - lastWarmAt < WARM_INTERVAL_MS) return;
 		warmInFlight = true;
 		try {
@@ -590,8 +1005,21 @@ const MIME_TYPES = {
 	".html": "text/html",
 	".svg": "image/svg+xml"
 };
+function localUrl(config) {
+	return () => `http://localhost:${config.port}`;
+}
+function versionsRouteName(raw) {
+	if (!raw.endsWith("/versions")) return null;
+	const name = raw.slice(0, -9);
+	const slashes = name.split("/").length - 1;
+	return (name.startsWith("@") ? slashes === 1 : slashes === 0) && name !== "" ? name : null;
+}
 function getContentType(filePath) {
-	return MIME_TYPES[path.extname(filePath).toLowerCase()] ?? "application/octet-stream";
+	const ext = path.extname(filePath).toLowerCase();
+	return MIME_TYPES[ext] ?? "application/octet-stream";
+}
+function originOf(req) {
+	return `${req.get("x-forwarded-proto")?.split(",")[0].trim() || req.protocol}://${req.get("host") ?? ""}`;
 }
 function publisherFromRequest(req) {
 	const name = req.remote_user?.name;
@@ -642,7 +1070,7 @@ function etagMatches(header, etag) {
 	});
 }
 function createPowerhouseRouter(config, sse, webhooks, ownerStore) {
-	const cdn = new CdnCache(`http://localhost:${config.port}`, config.cdnCachePath);
+	const cdn = new CdnCache(localUrl(config), config.cdnCachePath);
 	const router = Router();
 	const withOwners = async (pkgs) => {
 		if (!ownerStore || pkgs.length === 0) return pkgs;
@@ -749,6 +1177,80 @@ function createPowerhouseRouter(config, sse, webhooks, ownerStore) {
 		}
 		res.json((await withOwners([pkg]))[0]);
 	});
+	router.get("/pieces", (req, res) => {
+		warm();
+		res.json(pieceCatalog(config.cdnCachePath, {
+			storagePath: config.storagePath,
+			suggestions: req.query.suggestionType === "ACTION_AND_TRIGGER"
+		}));
+	});
+	router.get("/pieces/*", async (req, res) => {
+		warm();
+		const raw = req.params[0];
+		const versionsOf = versionsRouteName(raw);
+		if (versionsOf) {
+			const versions = await pieceVersions(cdn, config.cdnCachePath, versionsOf, config.storagePath);
+			if (!versions) {
+				res.status(404).json({ error: `Piece not found: ${versionsOf}` });
+				return;
+			}
+			res.json(versions.map(versionSummary));
+			return;
+		}
+		const name = raw;
+		const version = typeof req.query.version === "string" ? req.query.version : void 0;
+		if (version === void 0) {
+			const entry = findPiece(config.cdnCachePath, name, config.storagePath);
+			const detail = entry ? pieceDetail(entry, originOf(req)) : null;
+			if (!detail) {
+				res.status(404).json({ error: `Piece not found: ${name}` });
+				return;
+			}
+			res.json(detail);
+			return;
+		}
+		const found = await findPieceVersion(cdn, config.cdnCachePath, name, version, config.storagePath);
+		if (found.kind === "unknown-piece") {
+			res.status(404).json({ error: `Piece not found: ${name}` });
+			return;
+		}
+		if (found.kind === "unknown-version") {
+			res.status(404).json({
+				error: `Piece version not found: ${name}@${version}`,
+				available: found.available
+			});
+			return;
+		}
+		const detail = pieceDetail(found.entry, originOf(req));
+		if (!detail) {
+			res.status(404).json({ error: `Piece not found: ${name}@${version}` });
+			return;
+		}
+		res.json(detail);
+	});
+	router.get("/-/pieces/bundled/*", async (req, res) => {
+		warm();
+		const filename = req.params[0];
+		const entry = await findPieceByTarball(cdn, config.cdnCachePath, filename, config.storagePath);
+		const file = entry ? await pieceTarball(entry) : null;
+		if (!entry || !file) {
+			res.status(404).json({ error: `Piece bundle not found: ${filename}` });
+			return;
+		}
+		res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+		const etag = `"${entry.packageName}-${filename}"`;
+		res.setHeader("ETag", etag);
+		if (etagMatches(req.headers["if-none-match"], etag)) {
+			res.status(304).end();
+			return;
+		}
+		res.setHeader("Content-Type", "application/gzip");
+		try {
+			await pipeline(fs.createReadStream(file), res);
+		} catch {
+			res.destroy();
+		}
+	});
 	router.get("/-/cdn/*", async (req, res) => {
 		const fullPath = req.params[0];
 		let packageSpec;
@@ -841,7 +1343,7 @@ function parseManifestRewrite(reqPath) {
 	return { packageName: decodeURIComponent(beforeRev) };
 }
 function createUnpublishHook(config, notifications) {
-	const cdn = new CdnCache(`http://localhost:${config.port}`, config.cdnCachePath);
+	const cdn = new CdnCache(localUrl(config), config.cdnCachePath);
 	const handleManifestRewrite = (req, res) => {
 		const rewrite = parseManifestRewrite(req.path);
 		if (!rewrite) return;
@@ -850,6 +1352,7 @@ function createUnpublishHook(config, notifications) {
 			if (res.statusCode >= 200 && res.statusCode < 300) {
 				const publishedBy = publisherFromRequest(req);
 				cdn.reconcileWithRegistry(rewrite.packageName).then((removed) => {
+					if (removed.length > 0) invalidatePieceIndex();
 					for (const version of removed) notifications.notifyUnpublish({
 						packageName: rewrite.packageName,
 						version,
@@ -882,6 +1385,7 @@ function createUnpublishHook(config, notifications) {
 			if (res.statusCode >= 200 && res.statusCode < 300) try {
 				if (parsed.version) cdn.invalidateVersion(parsed.packageName, parsed.version);
 				else cdn.invalidate(parsed.packageName);
+				invalidatePieceIndex();
 				notifications.notifyUnpublish({
 					packageName: parsed.packageName,
 					version: parsed.version,
@@ -896,12 +1400,12 @@ function createUnpublishHook(config, notifications) {
 	};
 }
 function createPublishHook(config, notifications) {
-	const cdn = new CdnCache(`http://localhost:${config.port}`, config.cdnCachePath);
-	return (req, res, next) => {
-		if (req.method !== "PUT" || req.path.includes("/-rev/")) {
-			next();
-			return;
-		}
+	const cdn = new CdnCache(localUrl(config), config.cdnCachePath);
+	const parseBody = express.json({
+		strict: false,
+		limit: config.maxBodySize ?? "300mb"
+	});
+	const attachExtraction = (req, res) => {
 		const originalEnd = res.end.bind(res);
 		res.end = function(chunk, encoding, cb) {
 			const urlPath = req.path.replace(/^\//, "");
@@ -917,6 +1421,7 @@ function createPublishHook(config, notifications) {
 			if (versions.length > 1) console.warn(`[registry] Multiple versions published for ${packageName}: ${JSON.stringify(versions)}`);
 			const publishedBy = publisherFromRequest(req);
 			cdn.extractTarball(packageName, version).then(() => {
+				invalidatePieceIndex();
 				notifications.notifyPublish({
 					packageName,
 					version,
@@ -927,8 +1432,62 @@ function createPublishHook(config, notifications) {
 			});
 			return originalEnd(chunk, encoding, cb);
 		};
-		next();
 	};
+	return (req, res, next) => {
+		if (req.method !== "PUT" || req.path.includes("/-rev/")) {
+			next();
+			return;
+		}
+		const urlPath = req.path.replace(/^\//, "");
+		if (!urlPath || urlPath.startsWith("-")) {
+			attachExtraction(req, res);
+			next();
+			return;
+		}
+		parseBody(req, res, (parseError) => {
+			if (parseError) {
+				next();
+				return;
+			}
+			pieceClaimConflict(config, decodeURIComponent(urlPath), req.body).then((conflict) => {
+				if (conflict) {
+					res.status(409).json({ error: conflict });
+					return;
+				}
+				attachExtraction(req, res);
+				next();
+			}).catch((err) => {
+				console.error("[registry] piece collision check failed:", err);
+				attachExtraction(req, res);
+				next();
+			});
+		});
+	};
+}
+function publishedTarball(body) {
+	if (body === null || typeof body !== "object") return null;
+	const attachments = body._attachments;
+	if (!attachments || typeof attachments !== "object") return null;
+	for (const [name, attachment] of Object.entries(attachments)) {
+		if (!name.endsWith(".tgz")) continue;
+		const data = attachment.data;
+		if (typeof data === "string") return Buffer.from(data, "base64");
+	}
+	return null;
+}
+async function pieceClaimConflict(config, packageName, body) {
+	const tarball = publishedTarball(body);
+	if (!tarball) return null;
+	const names = await pieceNamesInTarball(tarball);
+	if (names.length === 0) return null;
+	const reserved = names.filter((name) => name.startsWith(RESERVED_PIECE_SCOPE));
+	if (reserved.length > 0) return `Piece names in the ${RESERVED_PIECE_SCOPE} scope belong to Activepieces; ${packageName} cannot claim ${reserved.map((n) => `"${n}"`).join(", ")}. Rename the piece into your own scope.`;
+	const index = pieceIndex(config.cdnCachePath, config.storagePath);
+	for (const name of names) {
+		const owner = index.get(name);
+		if (owner && owner.packageName !== packageName) return `Piece "${name}" is already published by ${owner.packageName}; ${packageName} cannot claim it.`;
+	}
+	return null;
 }
 //#endregion
 //#region src/notifications/manager.ts
@@ -1187,7 +1746,8 @@ async function runRegistry(args) {
 	if (config.databaseUrl || config.authStore) console.log("[registry] Postgres-backed auth plugin active (persistent accounts + package ownership)");
 	await mkdir(storagePath, { recursive: true });
 	await mkdir(cdnCachePath, { recursive: true });
-	const verdaccioServer = await runServer(buildVerdaccioConfig(config));
+	const verdaccioConfig = buildVerdaccioConfig(config);
+	const verdaccioServer = await runServer(verdaccioConfig);
 	if (authStoreToken && !wasStoreLoaded(authStoreToken)) {
 		verdaccioServer.close();
 		throw new Error("registry-auth plugin failed to load despite a configured database/auth store; refusing to start without auth and package-ownership enforcement.");
@@ -1203,7 +1763,9 @@ async function runRegistry(args) {
 	app.use(createPublishHook(config, notifications));
 	app.use(createUnpublishHook(config, notifications));
 	app.use((req, res) => verdaccioHandler(req, res));
-	return app.listen(port, () => {
+	const server = app.listen(port, () => {
+		config.port = server.address().port;
+		const port = config.port;
 		console.log(`Powerhouse Registry running on http://localhost:${port}`);
 		console.log(`  CDN:      http://localhost:${port}/-/cdn/`);
 		console.log(`  Packages: http://localhost:${port}/packages`);
@@ -1213,6 +1775,7 @@ async function runRegistry(args) {
 		if (config.s3) console.log(`  S3:       ${config.s3.endpoint}/${config.s3.bucket}`);
 		if (config.renown) console.log(`  Renown auth: ${config.renown.publicUrl}`);
 	});
+	return server;
 }
 //#endregion
 //#region cli.ts
@@ -1362,7 +1925,8 @@ const registryCommand = command({
 		}
 	}
 });
-await run(binary(registryCommand), process.argv);
+const registryCli = binary(registryCommand);
+await run(registryCli, process.argv);
 //#endregion
 export { registryCommand };