@stacksjs/registry 0.10.48 → 0.10.50

package/dist/index.js

@@ -42257,11 +42257,24 @@ class BuildStatusStore {
     if (changed)
       this.snapshot.scheduleSave();
   }
-  requestRebuild(domain) {
+  requestRebuild(domain, priority = false) {
     const d = String(domain || "").trim();
-    if (!d || this.queue.includes(d))
+    if (!d)
       return false;
-    this.queue.push(d);
+    const queuedAt = this.queue.indexOf(d);
+    if (queuedAt !== -1) {
+      if (!priority || queuedAt === 0)
+        return false;
+      this.queue.splice(queuedAt, 1);
+      this.queue.unshift(d);
+      this.snapshot.scheduleSave();
+      this.emit();
+      return true;
+    }
+    if (priority)
+      this.queue.unshift(d);
+    else
+      this.queue.push(d);
     this.snapshot.scheduleSave();
     this.emit();
     return true;
@@ -42452,24 +42465,145 @@ function compareVersionLoose(a, b) {
   return 0;
 }
 
+// src/subscriptions.ts
+var TIERS = {
+  free: {
+    id: "free",
+    name: "Free",
+    price: 0,
+    commissionBps: 1000,
+    analyticsRetentionDays: 30,
+    maxArtifactBytes: 50 * 1024 * 1024,
+    privatePackages: false,
+    priorityBuilds: false,
+    seats: 1,
+    buildInsurance: false,
+    securityAlerts: false,
+    sbomExport: false,
+    teamEntitlements: false
+  },
+  pro: {
+    id: "pro",
+    name: "Pro",
+    price: 900,
+    commissionBps: 500,
+    analyticsRetentionDays: 3650,
+    maxArtifactBytes: 250 * 1024 * 1024,
+    privatePackages: true,
+    priorityBuilds: true,
+    seats: 1,
+    buildInsurance: true,
+    securityAlerts: true,
+    sbomExport: true,
+    teamEntitlements: false,
+    stripeLookupKey: "pantry_pro_monthly"
+  },
+  team: {
+    id: "team",
+    name: "Team",
+    price: 2900,
+    commissionBps: 500,
+    analyticsRetentionDays: 3650,
+    maxArtifactBytes: 1024 * 1024 * 1024,
+    privatePackages: true,
+    priorityBuilds: true,
+    seats: 10,
+    buildInsurance: true,
+    securityAlerts: true,
+    sbomExport: true,
+    teamEntitlements: true,
+    stripeLookupKey: "pantry_team_monthly"
+  }
+};
+var DISCOVERY_FEE_BPS = 300;
+var MAX_TOTAL_FEE_BPS = 3000;
+function tierOf(value) {
+  if (value === "pro" || value === "team")
+    return value;
+  return "free";
+}
+function tierDefinition(tier) {
+  return TIERS[tier];
+}
+function effectiveTier(sub, now = new Date) {
+  if (!sub || sub.tier === "free")
+    return "free";
+  switch (sub.status) {
+    case "active":
+    case "trialing":
+    case "past_due":
+      return sub.tier;
+    case "canceled":
+      return sub.currentPeriodEnd && new Date(sub.currentPeriodEnd) > now ? sub.tier : "free";
+    default:
+      return "free";
+  }
+}
+function calculateFee(input) {
+  const commissionBps = tierDefinition(input.sellerTier).commissionBps;
+  const discoveryBps = input.discoveredOnSite ? DISCOVERY_FEE_BPS : 0;
+  const totalBps = Math.min(commissionBps + discoveryBps, MAX_TOTAL_FEE_BPS);
+  const applicationFee = Math.max(0, Math.min(Math.floor(input.amount * totalBps / 1e4), input.amount));
+  return {
+    amount: input.amount,
+    commissionBps,
+    discoveryBps,
+    totalBps,
+    applicationFee,
+    sellerNet: input.amount - applicationFee
+  };
+}
+function formatBps(bps) {
+  const percent = bps / 100;
+  return `${Number.isInteger(percent) ? percent : percent.toFixed(2)}%`;
+}
+function isDiscovery(origin) {
+  return origin === "site";
+}
+
 // src/paywall.ts
-var STRIPE_SECRET_KEY = process.env.STRIPE_SECRET_KEY || "";
-var STRIPE_WEBHOOK_SECRET = process.env.STRIPE_WEBHOOK_SECRET || "";
+function stripeSecretKey() {
+  return process.env.STRIPE_SECRET_KEY || "";
+}
+function stripeWebhookSecret() {
+  return process.env.STRIPE_WEBHOOK_SECRET || "";
+}
+function paymentsEnabled() {
+  return stripeSecretKey().length > 0;
+}
+function encodeStripeParams(body, prefix = "") {
+  const out = [];
+  for (const [key, value] of Object.entries(body)) {
+    if (value === undefined || value === null)
+      continue;
+    const name = prefix ? `${prefix}[${key}]` : key;
+    if (Array.isArray(value)) {
+      value.forEach((item, i) => {
+        if (item !== null && typeof item === "object")
+          out.push(...encodeStripeParams(item, `${name}[${i}]`));
+        else
+          out.push([`${name}[${i}]`, String(item)]);
+      });
+    } else if (typeof value === "object") {
+      out.push(...encodeStripeParams(value, name));
+    } else {
+      out.push([name, String(value)]);
+    }
+  }
+  return out;
+}
 async function stripeRequest(method, path, body) {
-  if (!STRIPE_SECRET_KEY)
+  const key = stripeSecretKey();
+  if (!key)
     throw new Error("STRIPE_SECRET_KEY not configured");
   const url = `https://api.stripe.com/v1${path}`;
   const headers = {
-    Authorization: `Bearer ${STRIPE_SECRET_KEY}`
+    Authorization: `Bearer ${key}`
   };
   let fetchBody;
   if (body) {
     headers["Content-Type"] = "application/x-www-form-urlencoded";
-    fetchBody = new URLSearchParams(Object.entries(body).flatMap(([k, v]) => {
-      if (Array.isArray(v))
-        return v.map((item, i) => [`${k}[${i}]`, String(item)]);
-      return [[k, String(v)]];
-    })).toString();
+    fetchBody = new URLSearchParams(encodeStripeParams(body)).toString();
   }
   const res = await fetch(url, { method, headers, body: fetchBody });
   if (!res.ok) {
@@ -42479,93 +42613,247 @@ async function stripeRequest(method, path, body) {
   }
   return res.json();
 }
-async function checkPaywallAccess(storage, packageName, version, authToken) {
+function accountSubject(email) {
+  return `user:${email.toLowerCase().trim()}`;
+}
+async function resolveAccess(storage, packageName, version, buyer, ownerEmail) {
   const paywall = await storage.getPaywall(packageName);
-  if (!paywall || !paywall.enabled) {
-    return { allowed: true };
-  }
-  if (paywall.freeVersions?.includes(version)) {
-    return { allowed: true, paywall };
+  if (!paywall || !paywall.enabled)
+    return { allowed: true, reason: "no-paywall" };
+  if (paywall.freeVersions?.includes(version))
+    return { allowed: true, paywall, reason: "free-version" };
+  if (buyer.admin)
+    return { allowed: true, paywall, reason: "admin" };
+  const email = buyer.userId?.toLowerCase().trim();
+  const owner = ownerEmail?.toLowerCase().trim();
+  if (owner && (email === owner || buyer.org?.toLowerCase().trim() === owner))
+    return { allowed: true, paywall, reason: "owner" };
+  for (const subject of [email, buyer.org?.toLowerCase().trim()]) {
+    if (!subject)
+      continue;
+    const grant = await storage.getAccessGrant(packageName, accountSubject(subject));
+    if (grant) {
+      if (grant.expiresAt && new Date(grant.expiresAt) < new Date)
+        return { allowed: false, paywall, reason: "expired" };
+      return { allowed: true, paywall, reason: subject === email ? "entitled" : "team-entitled" };
+    }
   }
-  if (!authToken) {
-    return { allowed: false, paywall, reason: "Authentication required for paid package" };
+  if (buyer.token) {
+    const legacy = await storage.getAccessGrant(packageName, buyer.token);
+    if (legacy)
+      return { allowed: true, paywall, reason: "entitled" };
   }
-  const grant = await storage.getAccessGrant(packageName, authToken);
-  if (grant) {
-    return { allowed: true, paywall };
+  return {
+    allowed: false,
+    paywall,
+    reason: email || buyer.token ? "payment-required" : "unauthenticated"
+  };
+}
+async function checkPaywallAccess(storage, packageName, version, authToken) {
+  const result = await resolveAccess(storage, packageName, version, { token: authToken });
+  return {
+    allowed: result.allowed,
+    paywall: result.paywall,
+    reason: result.allowed ? undefined : result.reason === "unauthenticated" ? "Authentication required for paid package" : "Payment required"
+  };
+}
+async function isEntitled(storage, packageName, email, org) {
+  for (const subject of [email, org]) {
+    if (!subject)
+      continue;
+    const grant = await storage.getAccessGrant(packageName, accountSubject(subject));
+    if (!grant)
+      continue;
+    if (grant.expiresAt && new Date(grant.expiresAt) < new Date)
+      continue;
+    return true;
   }
-  return { allowed: false, paywall, reason: "Payment required" };
+  return false;
+}
+var SUPPORTED_CURRENCIES = new Set(["usd", "eur", "gbp", "cad", "aud", "chf", "jpy", "sek", "nok", "dkk"]);
+var MIN_PRICE_CENTS = 100;
+var MAX_PRICE_CENTS = 1e7;
+function validatePriceConfig(config) {
+  if (typeof config.price !== "number" || !Number.isInteger(config.price))
+    return "Price must be a whole number of cents (e.g. 900 for $9.00)";
+  if (config.price < MIN_PRICE_CENTS)
+    return `Price must be at least ${MIN_PRICE_CENTS} cents ($${(MIN_PRICE_CENTS / 100).toFixed(2)})`;
+  if (config.price > MAX_PRICE_CENTS)
+    return `Price must be at most ${MAX_PRICE_CENTS} cents ($${(MAX_PRICE_CENTS / 100).toFixed(2)})`;
+  const currency = (config.currency || "usd").toLowerCase();
+  if (!SUPPORTED_CURRENCIES.has(currency))
+    return `Unsupported currency "${currency}" \u2014 one of: ${[...SUPPORTED_CURRENCIES].join(", ")}`;
+  if (config.freeVersions && !Array.isArray(config.freeVersions))
+    return "freeVersions must be an array of version strings";
+  if (config.freeVersions?.some((v) => typeof v !== "string" || v.length > 64))
+    return "freeVersions must be version strings";
+  if (config.payoutAccountId && !/^acct_[A-Za-z0-9]+$/.test(config.payoutAccountId))
+    return "payoutAccountId must be a Stripe Connect account id (acct_\u2026)";
+  if (config.trialDays !== undefined && (!Number.isInteger(config.trialDays) || config.trialDays < 0 || config.trialDays > 365))
+    return "trialDays must be a whole number of days between 0 and 365";
+  return null;
 }
 async function configurePaywall(storage, packageName, config) {
+  const invalid = validatePriceConfig(config);
+  if (invalid)
+    throw new Error(invalid);
   const now = new Date().toISOString();
   const existing = await storage.getPaywall(packageName);
+  const currency = (config.currency || existing?.currency || "usd").toLowerCase();
   let stripeProductId = existing?.stripeProductId;
   let stripePriceId = existing?.stripePriceId;
-  if (STRIPE_SECRET_KEY) {
+  if (paymentsEnabled()) {
     if (!stripeProductId) {
       const product = await stripeRequest("POST", "/products", {
         name: packageName,
-        description: `Access to ${packageName} package`,
+        description: `Access to ${packageName} on the pantry registry`,
         metadata: { pantry_package: packageName }
       });
       stripeProductId = product.id;
     }
-    const price = await stripeRequest("POST", "/prices", {
-      product: stripeProductId,
-      unit_amount: String(config.price),
-      currency: config.currency || "usd"
-    });
-    stripePriceId = price.id;
+    const priceChanged = !stripePriceId || existing?.price !== config.price || existing?.currency?.toLowerCase() !== currency;
+    if (priceChanged) {
+      const price = await stripeRequest("POST", "/prices", {
+        product: stripeProductId,
+        unit_amount: String(config.price),
+        currency
+      });
+      stripePriceId = price.id;
+    }
   }
   const paywall = {
     name: packageName,
     enabled: true,
     price: config.price,
-    currency: config.currency || "usd",
+    currency,
     stripeProductId,
     stripePriceId,
-    freeVersions: config.freeVersions,
-    trialDays: config.trialDays,
+    stripeAccountId: config.payoutAccountId ?? existing?.stripeAccountId,
+    freeVersions: config.freeVersions ?? existing?.freeVersions,
+    trialDays: config.trialDays ?? existing?.trialDays,
     createdAt: existing?.createdAt || now,
     updatedAt: now
   };
   await storage.putPaywall(paywall);
   return paywall;
 }
-async function createCheckoutSession(storage, packageName, accessToken, baseUrl) {
+async function createCheckoutSession(storage, request) {
+  const { packageName, email, baseUrl } = request;
   const paywall = await storage.getPaywall(packageName);
-  if (!paywall || !paywall.enabled) {
-    throw new Error("Package does not have a paywall");
-  }
-  if (!STRIPE_SECRET_KEY) {
-    throw new Error("Stripe is not configured \u2014 set STRIPE_SECRET_KEY");
-  }
-  if (!paywall.stripePriceId) {
-    throw new Error("Stripe price not configured for this package");
-  }
+  if (!paywall || !paywall.enabled)
+    throw new Error("This package is not for sale");
+  if (!paymentsEnabled())
+    throw new Error("Payments are not configured on this registry");
+  if (!paywall.stripePriceId)
+    throw new Error("This package has a price but no Stripe price \u2014 the publisher should save it again");
+  const encoded = encodeURIComponent(packageName);
+  const origin = request.origin || "cli";
+  const fee = calculateFee({
+    amount: paywall.price,
+    sellerTier: request.sellerTier || "free",
+    discoveredOnSite: isDiscovery(origin)
+  });
   const session = await stripeRequest("POST", "/checkout/sessions", {
     mode: "payment",
     "line_items[0][price]": paywall.stripePriceId,
     "line_items[0][quantity]": "1",
-    success_url: `${baseUrl}/packages/${encodeURIComponent(packageName)}/checkout/success?token=${accessToken}`,
-    cancel_url: `${baseUrl}/packages/${encodeURIComponent(packageName)}`,
+    customer_email: email,
+    client_reference_id: `${packageName}:${email}`,
+    success_url: `${baseUrl}/packages/${encoded}/checkout/success`,
+    cancel_url: `${baseUrl}/pkg/${encoded}`,
     "metadata[package_name]": packageName,
-    "metadata[access_token]": accessToken,
-    ...paywall.stripeAccountId ? { "payment_intent_data[transfer_data][destination]": paywall.stripeAccountId } : {}
+    "metadata[buyer_email]": (request.org || email).toLowerCase().trim(),
+    "metadata[purchased_by]": email,
+    "metadata[sale_origin]": origin,
+    "metadata[fee_bps]": String(fee.totalBps),
+    "metadata[seller_tier]": request.sellerTier || "free",
+    ...paywall.stripeAccountId ? {
+      "payment_intent_data[transfer_data][destination]": paywall.stripeAccountId,
+      "payment_intent_data[on_behalf_of]": paywall.stripeAccountId,
+      ...fee.applicationFee > 0 ? { "payment_intent_data[application_fee_amount]": String(fee.applicationFee) } : {}
+    } : {}
   });
   return { url: session.url };
 }
+var _tierPriceCache = new Map;
+async function ensureTierPrice(tier) {
+  if (!tier.stripeLookupKey)
+    throw new Error(`${tier.name} is not a paid tier`);
+  const cached = _tierPriceCache.get(tier.stripeLookupKey);
+  if (cached)
+    return cached;
+  const existing = await stripeRequest("GET", `/prices?lookup_keys[]=${encodeURIComponent(tier.stripeLookupKey)}&active=true&limit=1`);
+  if (existing?.data?.length > 0) {
+    _tierPriceCache.set(tier.stripeLookupKey, existing.data[0].id);
+    return existing.data[0].id;
+  }
+  const product = await stripeRequest("POST", "/products", {
+    name: `pantry ${tier.name}`,
+    description: `pantry registry ${tier.name} plan`,
+    metadata: { pantry_tier: tier.id }
+  });
+  const price = await stripeRequest("POST", "/prices", {
+    product: product.id,
+    unit_amount: String(tier.price),
+    currency: "usd",
+    recurring: { interval: "month" },
+    lookup_key: tier.stripeLookupKey
+  });
+  _tierPriceCache.set(tier.stripeLookupKey, price.id);
+  return price.id;
+}
+async function createSubscriptionCheckout(options) {
+  if (!paymentsEnabled())
+    throw new Error("Payments are not configured on this registry");
+  if (!options.tier.stripeLookupKey)
+    throw new Error("The free plan does not need a subscription");
+  const priceId = await ensureTierPrice(options.tier);
+  const session = await stripeRequest("POST", "/checkout/sessions", {
+    mode: "subscription",
+    "line_items[0][price]": priceId,
+    "line_items[0][quantity]": "1",
+    ...options.stripeCustomerId ? { customer: options.stripeCustomerId } : { customer_email: options.email },
+    success_url: `${options.baseUrl}/account?subscribed=${options.tier.id}`,
+    cancel_url: `${options.baseUrl}/pricing`,
+    "metadata[pantry_tier]": options.tier.id,
+    "metadata[account_email]": options.email,
+    "subscription_data[metadata][pantry_tier]": options.tier.id,
+    "subscription_data[metadata][account_email]": options.email
+  });
+  return { url: session.url };
+}
+async function createBillingPortalSession(customerId, returnUrl) {
+  if (!paymentsEnabled())
+    throw new Error("Payments are not configured on this registry");
+  const session = await stripeRequest("POST", "/billing_portal/sessions", {
+    customer: customerId,
+    return_url: returnUrl
+  });
+  return { url: session.url };
+}
+function subscriptionChangeFrom(object) {
+  const email = object?.metadata?.account_email;
+  const tier = object?.metadata?.pantry_tier;
+  if (!email || !tier)
+    return null;
+  return {
+    email,
+    tier,
+    status: object.cancel_at_period_end && object.status === "active" ? "canceled" : object.status || "none",
+    stripeCustomerId: typeof object.customer === "string" ? object.customer : object.customer?.id,
+    stripeSubscriptionId: object.id,
+    currentPeriodEnd: object.current_period_end ? new Date(object.current_period_end * 1000).toISOString() : undefined
+  };
+}
 var processedWebhookEvents = new Map;
 var WEBHOOK_DEDUP_TTL = 10 * 60 * 1000;
-async function handleStripeWebhook(storage, rawBody, signature) {
-  if (!STRIPE_WEBHOOK_SECRET) {
+async function handleStripeWebhook(storage, rawBody, signature, onSubscription) {
+  if (!stripeWebhookSecret())
     throw new Error("STRIPE_WEBHOOK_SECRET not configured");
-  }
   const event = await verifyStripeWebhook(rawBody, signature);
   if (event.id) {
-    if (processedWebhookEvents.has(event.id)) {
+    if (processedWebhookEvents.has(event.id))
       return { processed: true };
-    }
     processedWebhookEvents.set(event.id, Date.now());
     if (processedWebhookEvents.size > 100) {
       const now = Date.now();
@@ -42575,18 +42863,53 @@ async function handleStripeWebhook(storage, rawBody, signature) {
       }
     }
   }
+  if (event.type?.startsWith("customer.subscription.") && onSubscription) {
+    const change = subscriptionChangeFrom(event.data.object);
+    if (change) {
+      const applied = event.type === "customer.subscription.deleted" ? { ...change, status: "canceled" } : change;
+      await onSubscription(applied);
+      return { processed: true, subscription: `${applied.email}:${applied.tier}:${applied.status}` };
+    }
+    return { processed: false };
+  }
   if (event.type === "checkout.session.completed") {
     const session = event.data.object;
+    if (session.mode === "subscription" && onSubscription) {
+      const email2 = session.metadata?.account_email;
+      const tier = session.metadata?.pantry_tier;
+      if (email2 && tier) {
+        await onSubscription({
+          email: email2,
+          tier,
+          status: "active",
+          stripeCustomerId: typeof session.customer === "string" ? session.customer : session.customer?.id,
+          stripeSubscriptionId: typeof session.subscription === "string" ? session.subscription : session.subscription?.id
+        });
+        return { processed: true, subscription: `${email2}:${tier}:active` };
+      }
+      return { processed: false };
+    }
     const packageName = session.metadata?.package_name;
-    const accessToken = session.metadata?.access_token;
-    if (packageName && accessToken) {
+    const email = session.metadata?.buyer_email;
+    const paid = !session.payment_status || session.payment_status === "paid" || session.payment_status === "no_payment_required";
+    if (packageName && email && paid) {
       const grant = {
         packageName,
-        token: accessToken,
+        token: accountSubject(email),
         stripePaymentId: session.payment_intent || session.id,
         grantedAt: new Date().toISOString()
       };
       await storage.putAccessGrant(grant);
+      return { processed: true, granted: email };
+    }
+    const legacyToken = session.metadata?.access_token;
+    if (packageName && legacyToken && paid) {
+      await storage.putAccessGrant({
+        packageName,
+        token: legacyToken,
+        stripePaymentId: session.payment_intent || session.id,
+        grantedAt: new Date().toISOString()
+      });
       return { processed: true };
     }
   }
@@ -42600,32 +42923,40 @@ async function verifyStripeWebhook(rawBody, signature) {
   }, {});
   const timestamp = parts.t;
   const expectedSig = parts.v1;
-  if (!timestamp || !expectedSig) {
+  if (!timestamp || !expectedSig)
     throw new Error("Invalid Stripe signature format");
-  }
   const payload = `${timestamp}.${rawBody}`;
-  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(STRIPE_WEBHOOK_SECRET), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(stripeWebhookSecret()), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
   const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(payload));
   const computedSig = Array.from(new Uint8Array(sig)).map((b) => b.toString(16).padStart(2, "0")).join("");
   const computedBuf = Buffer.from(computedSig);
   const expectedBuf = Buffer.from(expectedSig);
-  if (computedBuf.length !== expectedBuf.length || !crypto.timingSafeEqual(computedBuf, expectedBuf)) {
+  if (computedBuf.length !== expectedBuf.length || !crypto.timingSafeEqual(computedBuf, expectedBuf))
     throw new Error("Stripe webhook signature verification failed");
-  }
   const age = Math.abs(Date.now() / 1000 - Number(timestamp));
-  if (age > 300) {
+  if (age > 300)
     throw new Error("Stripe webhook timestamp too old");
-  }
   try {
     return JSON.parse(rawBody);
   } catch {
     throw new Error("Invalid webhook body JSON");
   }
 }
+var CURRENCY_SYMBOLS = {
+  usd: "$",
+  eur: "\u20AC",
+  gbp: "\xA3",
+  cad: "CA$",
+  aud: "A$",
+  jpy: "\xA5"
+};
+var ZERO_DECIMAL = new Set(["jpy"]);
 function formatPrice(price, currency) {
-  const amount = price / 100;
-  const symbol = currency === "usd" ? "$" : currency === "eur" ? "\u20AC" : currency === "gbp" ? "\xA3" : `${currency.toUpperCase()} `;
-  return `${symbol}${amount.toFixed(2)}`;
+  const code = (currency || "usd").toLowerCase();
+  const symbol = CURRENCY_SYMBOLS[code] || `${code.toUpperCase()} `;
+  if (ZERO_DECIMAL.has(code))
+    return `${symbol}${price}`;
+  return `${symbol}${(price / 100).toFixed(2)}`;
 }
 
 // ../../node_modules/@stacksjs/stx/dist/index.js
@@ -100217,6 +100548,9 @@ class AuthService {
     return { email: user.email, name: user.name, role: user.role || "user", createdAt: user.createdAt, updatedAt: user.updatedAt };
   }
   async upsertAdminUser(email, name, password) {
+    return this.upsertUserAccount(email, name, password, "admin");
+  }
+  async upsertUserAccount(email, name, password, role = "user") {
     const normalizedEmail = email.toLowerCase().trim();
     if (!normalizedEmail || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(normalizedEmail)) {
       throw new AuthError("Invalid email address", 400);
@@ -100229,14 +100563,14 @@ class AuthService {
     const passwordHash = await hashPassword(password);
     const user = {
       email: normalizedEmail,
-      name: (name || existing?.name || "Admin").trim(),
+      name: (name || existing?.name || (role === "admin" ? "Admin" : normalizedEmail.split("@")[0])).trim(),
       passwordHash,
-      role: "admin",
+      role,
       createdAt: existing?.createdAt || now,
       updatedAt: now
     };
     await this.storage.upsertUser(user);
-    return { email: user.email, name: user.name, role: "admin", createdAt: user.createdAt, updatedAt: user.updatedAt };
+    return { email: user.email, name: user.name, role, createdAt: user.createdAt, updatedAt: user.updatedAt };
   }
   async login(email, password) {
     const normalizedEmail = email.toLowerCase().trim();
@@ -100324,6 +100658,9 @@ class AuthService {
     await this.storage.deleteApiToken(userId, tokenId);
   }
   async validatePublishToken(token, legacyToken) {
+    return this.validateAccessToken(token, legacyToken, "publish");
+  }
+  async validateAccessToken(token, legacyToken, permission) {
     if (legacyToken) {
       const maxLen = Math.max(token.length, legacyToken.length);
       const tokenBuf = Buffer.alloc(maxLen);
@@ -100342,14 +100679,150 @@ class AuthService {
       if (tokenRecord.expiresAt && new Date(tokenRecord.expiresAt) < new Date) {
         return { valid: false, error: "Token has expired" };
       }
-      if (!tokenRecord.permissions.includes("publish")) {
-        return { valid: false, error: "Token does not have publish permission" };
+      const permitted = permission === "read" ? tokenRecord.permissions.includes("read") || tokenRecord.permissions.includes("publish") : tokenRecord.permissions.includes("publish");
+      if (!permitted) {
+        return { valid: false, error: `Token does not have ${permission} permission` };
       }
       this.storage.updateTokenLastUsed(tokenRecord.tokenHash).catch((err) => console.warn("Failed to update token last-used:", err));
       return { valid: true, userId: tokenRecord.userId, tokenId: tokenRecord.id };
     }
     return { valid: false, error: "Invalid token" };
   }
+  async findUser(email) {
+    const user = await this.storage.getUser(email.toLowerCase().trim());
+    if (!user)
+      return null;
+    return {
+      email: user.email,
+      name: user.name,
+      role: user.role || "user",
+      subscription: user.subscription,
+      createdAt: user.createdAt,
+      updatedAt: user.updatedAt
+    };
+  }
+  async getSubscription(email) {
+    const user = await this.storage.getUser(email.toLowerCase().trim());
+    if (!user?.subscription)
+      return null;
+    return {
+      tier: tierOf(user.subscription.tier),
+      status: user.subscription.status || "none",
+      stripeCustomerId: user.subscription.stripeCustomerId,
+      stripeSubscriptionId: user.subscription.stripeSubscriptionId,
+      currentPeriodEnd: user.subscription.currentPeriodEnd,
+      updatedAt: user.subscription.updatedAt
+    };
+  }
+  async getTier(email) {
+    if (!email || email === "_admin")
+      return "free";
+    return effectiveTier(await this.getSubscription(email));
+  }
+  async setSubscription(email, sub) {
+    const normalized = email.toLowerCase().trim();
+    const user = await this.storage.getUser(normalized);
+    if (!user)
+      throw new AuthError(`No such account: ${email}`, 404);
+    const next = {
+      ...user,
+      updatedAt: new Date().toISOString()
+    };
+    if (!sub || sub.tier === "free") {
+      delete next.subscription;
+    } else {
+      next.subscription = {
+        tier: sub.tier,
+        status: sub.status,
+        stripeCustomerId: sub.stripeCustomerId,
+        stripeSubscriptionId: sub.stripeSubscriptionId,
+        currentPeriodEnd: sub.currentPeriodEnd,
+        updatedAt: new Date().toISOString()
+      };
+    }
+    await this.storage.upsertUser(next);
+  }
+  async getTeamMembers(owner) {
+    const user = await this.storage.getUser(owner.toLowerCase().trim());
+    return user?.team?.members ?? [];
+  }
+  async getTeamOwner(email) {
+    const user = await this.storage.getUser(email.toLowerCase().trim());
+    return user?.teamOwner ?? null;
+  }
+  async canActFor(actor, owner) {
+    if (!actor || !owner)
+      return false;
+    const a11 = actor.toLowerCase().trim();
+    const o10 = owner.toLowerCase().trim();
+    if (a11 === o10)
+      return true;
+    return await this.getTeamOwner(a11) === o10;
+  }
+  async addTeamMember(owner, memberEmail, seatLimit) {
+    const ownerEmail = owner.toLowerCase().trim();
+    const member = memberEmail.toLowerCase().trim();
+    if (member === ownerEmail)
+      throw new AuthError("You are already on your own team", 400);
+    const ownerUser = await this.storage.getUser(ownerEmail);
+    if (!ownerUser)
+      throw new AuthError("No such account", 404);
+    const memberUser = await this.storage.getUser(member);
+    if (!memberUser)
+      throw new AuthError(`${memberEmail} does not have an account yet \u2014 they need to sign up first`, 404);
+    if (memberUser.teamOwner && memberUser.teamOwner !== ownerEmail)
+      throw new AuthError(`${memberEmail} is already on another team`, 409);
+    if (memberUser.team?.members?.length)
+      throw new AuthError(`${memberEmail} runs their own team`, 409);
+    const members = ownerUser.team?.members ?? [];
+    if (members.includes(member))
+      return members;
+    if (members.length + 1 >= seatLimit)
+      throw new AuthError(`That plan includes ${seatLimit} seats, and they are all taken`, 402);
+    const next = [...members, member];
+    await this.storage.upsertUser({
+      ...ownerUser,
+      team: { members: next, updatedAt: new Date().toISOString() },
+      updatedAt: new Date().toISOString()
+    });
+    await this.storage.upsertUser({
+      ...memberUser,
+      teamOwner: ownerEmail,
+      updatedAt: new Date().toISOString()
+    });
+    return next;
+  }
+  async removeTeamMember(owner, memberEmail) {
+    const ownerEmail = owner.toLowerCase().trim();
+    const member = memberEmail.toLowerCase().trim();
+    const ownerUser = await this.storage.getUser(ownerEmail);
+    if (!ownerUser)
+      throw new AuthError("No such account", 404);
+    const next = (ownerUser.team?.members ?? []).filter((m7) => m7 !== member);
+    await this.storage.upsertUser({
+      ...ownerUser,
+      team: { members: next, updatedAt: new Date().toISOString() },
+      updatedAt: new Date().toISOString()
+    });
+    const memberUser = await this.storage.getUser(member);
+    if (memberUser?.teamOwner === ownerEmail) {
+      const cleaned = { ...memberUser, updatedAt: new Date().toISOString() };
+      delete cleaned.teamOwner;
+      await this.storage.upsertUser(cleaned);
+    }
+    return next;
+  }
+  async findByStripeCustomer(customerId, candidateEmail) {
+    if (candidateEmail) {
+      const sub = await this.getSubscription(candidateEmail);
+      if (sub?.stripeCustomerId === customerId || !sub?.stripeCustomerId) {
+        const user = await this.storage.getUser(candidateEmail.toLowerCase().trim());
+        if (user)
+          return user.email;
+      }
+    }
+    return null;
+  }
 }
 
 class AuthError extends Error {
@@ -100469,6 +100942,9 @@ class DynamoDBAuthStorage {
       name: data.name,
       passwordHash: data.passwordHash,
       role: data.role === "admin" ? "admin" : "user",
+      ...data.subscription ? { subscription: JSON.parse(data.subscription) } : {},
+      ...data.team ? { team: JSON.parse(data.team) } : {},
+      ...data.teamOwner ? { teamOwner: data.teamOwner } : {},
       createdAt: data.createdAt,
       updatedAt: data.updatedAt
     };
@@ -100483,6 +100959,9 @@ class DynamoDBAuthStorage {
         name: user.name,
         passwordHash: user.passwordHash,
         role: user.role || "user",
+        ...user.subscription ? { subscription: JSON.stringify(user.subscription) } : {},
+        ...user.team ? { team: JSON.stringify(user.team) } : {},
+        ...user.teamOwner ? { teamOwner: user.teamOwner } : {},
         createdAt: user.createdAt,
         updatedAt: user.updatedAt
       }),
@@ -100499,6 +100978,9 @@ class DynamoDBAuthStorage {
         name: user.name,
         passwordHash: user.passwordHash,
         role: user.role || "user",
+        ...user.subscription ? { subscription: JSON.stringify(user.subscription) } : {},
+        ...user.team ? { team: JSON.stringify(user.team) } : {},
+        ...user.teamOwner ? { teamOwner: user.teamOwner } : {},
         createdAt: user.createdAt,
         updatedAt: user.updatedAt
       })
@@ -100704,6 +101186,783 @@ function createAuthStorage(tableName, region) {
   return new InMemoryAuthStorage;
 }
 
+// src/plugins.ts
+function pluginSpecifiers(env2 = process.env) {
+  return (env2.REGISTRY_PLUGINS || "").split(",").map((s11) => s11.trim()).filter(Boolean);
+}
+function assertPlugin(value, specifier) {
+  if (!value || typeof value !== "object" || typeof value.name !== "string") {
+    throw new TypeError(`Registry plugin "${specifier}" must default-export an object with a \`name\` (or a function returning one)`);
+  }
+  return value;
+}
+async function loadPlugin(specifier) {
+  const target = specifier.startsWith(".") ? new URL(specifier, `file://${process.cwd()}/`).href : specifier;
+  let mod;
+  try {
+    mod = await import(target);
+  } catch (err) {
+    throw new Error(`Failed to load registry plugin "${specifier}": ${err.message}`);
+  }
+  const exported = mod.default;
+  const resolved = typeof exported === "function" ? await exported() : exported;
+  return assertPlugin(resolved, specifier);
+}
+var _plugins = null;
+function loadPlugins(env2 = process.env) {
+  if (_plugins)
+    return _plugins;
+  const specifiers = pluginSpecifiers(env2);
+  _plugins = specifiers.length === 0 ? Promise.resolve([]) : Promise.all(specifiers.map(loadPlugin)).then((plugins) => {
+    console.log(`Loaded ${plugins.length} registry plugin(s): ${plugins.map((p11) => p11.name).join(", ")}`);
+    return plugins;
+  });
+  return _plugins;
+}
+function setPlugins(plugins) {
+  _plugins = Promise.resolve(plugins);
+}
+function resetPlugins() {
+  _plugins = null;
+}
+async function pluginsAuthorize() {
+  const plugins = await loadPlugins();
+  return plugins.some((p11) => typeof p11.authorizeRead === "function");
+}
+async function pluginAccessVerdict(ctx) {
+  const plugins = await loadPlugins();
+  let verdict;
+  for (const plugin of plugins) {
+    if (!plugin.authorizeRead)
+      continue;
+    let result;
+    try {
+      result = await plugin.authorizeRead(ctx);
+    } catch (err) {
+      console.error(`Registry plugin "${plugin.name}" authorizeRead threw:`, err);
+      return "deny";
+    }
+    if (result === "deny")
+      return "deny";
+    if (result === "allow")
+      verdict = "allow";
+  }
+  return verdict;
+}
+async function pluginResponse(req, ctx) {
+  const plugins = await loadPlugins();
+  for (const plugin of plugins) {
+    if (!plugin.handleRequest)
+      continue;
+    try {
+      const res = await plugin.handleRequest(req, ctx);
+      if (res)
+        return res;
+    } catch (err) {
+      console.error(`Registry plugin "${plugin.name}" handleRequest threw:`, err);
+      return Response.json({ error: "Plugin error" }, { status: 500 });
+    }
+  }
+  return null;
+}
+function emitPluginEvent(event) {
+  loadPlugins().then((plugins) => {
+    for (const plugin of plugins) {
+      if (!plugin.onEvent)
+        continue;
+      try {
+        const result = plugin.onEvent(event);
+        if (result && typeof result.catch === "function")
+          result.catch((err) => console.error(`Registry plugin "${plugin.name}" onEvent rejected:`, err));
+      } catch (err) {
+        console.error(`Registry plugin "${plugin.name}" onEvent threw:`, err);
+      }
+    }
+  }).catch(() => {});
+}
+
+// src/access.ts
+function isTruthy(value) {
+  if (!value)
+    return false;
+  const v11 = value.trim().toLowerCase();
+  return v11 === "1" || v11 === "true" || v11 === "yes" || v11 === "on";
+}
+function isFalsy(value) {
+  if (value == null)
+    return false;
+  const v11 = value.trim().toLowerCase();
+  return v11 === "0" || v11 === "false" || v11 === "no" || v11 === "off";
+}
+function resolveVisibility(env2 = process.env) {
+  const raw = (env2.REGISTRY_VISIBILITY ?? env2.PANTRY_REGISTRY_VISIBILITY ?? "").trim().toLowerCase();
+  if (raw === "private")
+    return "private";
+  if (raw === "public")
+    return "public";
+  if (isTruthy(env2.REGISTRY_PRIVATE))
+    return "private";
+  return "public";
+}
+function signupsEnabled(env2 = process.env, visibility = resolveVisibility(env2)) {
+  const raw = env2.REGISTRY_ALLOW_SIGNUP;
+  if (isTruthy(raw))
+    return true;
+  if (isFalsy(raw))
+    return false;
+  return visibility === "public";
+}
+function allowedSignupDomains(env2 = process.env) {
+  return (env2.REGISTRY_SIGNUP_DOMAINS || "").split(",").map((d10) => d10.trim().toLowerCase().replace(/^@/, "")).filter(Boolean);
+}
+function isSignupEmailAllowed(email, env2 = process.env) {
+  const domains = allowedSignupDomains(env2);
+  if (domains.length === 0)
+    return true;
+  const domain = email.toLowerCase().trim().split("@")[1] || "";
+  return domains.includes(domain);
+}
+var ALWAYS_PUBLIC_PATHS = new Set([
+  "/health",
+  "/api/registry-info",
+  "/login",
+  "/signup",
+  "/auth/login",
+  "/auth/logout",
+  "/auth/signup",
+  "/auth/me",
+  "/favicon.ico",
+  "/robots.txt",
+  "/webhooks/stripe"
+]);
+function extraPublicPaths(env2 = process.env) {
+  return (env2.REGISTRY_PUBLIC_PATHS || "").split(",").map((p11) => p11.trim()).filter(Boolean);
+}
+function isPublicPath(path6, env2 = process.env) {
+  if (ALWAYS_PUBLIC_PATHS.has(path6))
+    return true;
+  for (const prefix of extraPublicPaths(env2)) {
+    if (prefix === "/") {
+      if (path6 === "/")
+        return true;
+      continue;
+    }
+    if (path6 === prefix || path6.startsWith(prefix.endsWith("/") ? prefix : `${prefix}/`))
+      return true;
+  }
+  return false;
+}
+function wantsHtml(req) {
+  if (req.method !== "GET")
+    return false;
+  const accept = req.headers.get("accept") || "";
+  return accept.includes("text/html");
+}
+async function enforceReadAccess(req, url, options) {
+  const env2 = options.env ?? process.env;
+  const visibility = options.visibility ?? resolveVisibility(env2);
+  const path6 = url.pathname;
+  const cors = options.corsHeaders ?? {};
+  const publicPath = visibility === "public" || isPublicPath(path6, env2);
+  const anonymous = { authenticated: false, userId: null };
+  const identity = publicPath && !await pluginsAuthorize() ? anonymous : await options.identify(req);
+  const verdict = await pluginAccessVerdict({
+    req,
+    url,
+    path: path6,
+    method: req.method,
+    visibility,
+    userId: identity.userId
+  });
+  if (verdict === "allow")
+    return null;
+  if (verdict !== "deny") {
+    if (publicPath)
+      return null;
+    if (identity.authenticated) {
+      emitPluginEvent({ type: "access-granted", path: path6, method: req.method, userId: identity.userId });
+      return null;
+    }
+  }
+  const reason = verdict === "deny" ? "Denied by access policy" : "Authentication required";
+  emitPluginEvent({ type: "access-denied", path: path6, method: req.method, reason });
+  if (wantsHtml(req) && verdict !== "deny") {
+    return new Response(null, {
+      status: 302,
+      headers: { ...cors, Location: `/login?next=${encodeURIComponent(path6 + url.search)}` }
+    });
+  }
+  const registryUrl = env2.BASE_URL || url.origin;
+  return Response.json({
+    error: reason,
+    ...verdict === "deny" ? {} : {
+      hint: `This registry is private. Store a token with: pantry token set --registry ${registryUrl}`,
+      docs: "https://pantry.dev/self-hosting"
+    }
+  }, {
+    status: verdict === "deny" ? 403 : 401,
+    headers: {
+      ...cors,
+      ...verdict === "deny" ? {} : { "WWW-Authenticate": 'Bearer realm="pantry-registry"' }
+    }
+  });
+}
+function registryInfo(env2 = process.env, baseUrl) {
+  const visibility = resolveVisibility(env2);
+  const base = (baseUrl || env2.BASE_URL || "").replace(/\/$/, "");
+  return {
+    visibility,
+    requiresAuth: visibility === "private",
+    signupsEnabled: signupsEnabled(env2, visibility),
+    ...base ? { loginUrl: `${base}/login` } : {},
+    docs: "https://pantry.dev/self-hosting"
+  };
+}
+
+// src/mirror.ts
+function orgKey(org) {
+  return org.toLowerCase().trim().replace(/[^a-z0-9._@-]/g, "_").replace(/@/g, "_at_");
+}
+function safeSegment(value) {
+  const trimmed = String(value || "").trim();
+  if (!trimmed || trimmed.length > 200)
+    return null;
+  if (trimmed.includes("..") || trimmed.startsWith("/"))
+    return null;
+  if (!/^[\w@./+-]+$/.test(trimmed))
+    return null;
+  return trimmed.replace(/\//g, "_");
+}
+async function sha256Hex(bytes) {
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return Array.from(new Uint8Array(digest)).map((b11) => b11.toString(16).padStart(2, "0")).join("");
+}
+function integrityMatches(integrity, hex) {
+  if (!integrity)
+    return true;
+  const [algorithm, encoded] = integrity.split("-");
+  if (algorithm !== "sha256" || !encoded)
+    return true;
+  try {
+    const expected = Array.from(Buffer.from(encoded, "base64")).map((b11) => b11.toString(16).padStart(2, "0")).join("");
+    return expected === hex;
+  } catch {
+    return true;
+  }
+}
+var defaultFetcher = async (url) => {
+  const res = await fetch(url, { redirect: "follow" });
+  if (!res.ok)
+    throw new Error(`HTTP ${res.status}`);
+  return res.arrayBuffer();
+};
+
+class MirrorStore {
+  storage;
+  fetcher;
+  maxArtifactBytes;
+  maxEntries;
+  constructor(storage, options = {}) {
+    this.storage = storage;
+    this.fetcher = options.fetcher || defaultFetcher;
+    this.maxArtifactBytes = options.maxArtifactBytes ?? 200 * 1024 * 1024;
+    this.maxEntries = options.maxEntries ?? 2000;
+  }
+  indexKey(org) {
+    return `mirror/${orgKey(org)}/index.json`;
+  }
+  async getIndex(org) {
+    try {
+      const bytes = await this.storage.download(this.indexKey(org));
+      const parsed = JSON.parse(new TextDecoder().decode(bytes));
+      if (parsed && Array.isArray(parsed.entries))
+        return parsed;
+    } catch {}
+    return { org, updatedAt: new Date().toISOString(), entries: [] };
+  }
+  async putIndex(index) {
+    const body = new TextEncoder().encode(JSON.stringify(index)).buffer;
+    await this.storage.upload(this.indexKey(index.org), body);
+  }
+  async snapshot(org, entries) {
+    const index = await this.getIndex(org);
+    const existing = new Map(index.entries.map((e11) => [`${e11.name}@${e11.version}:${e11.integrity || ""}`, e11]));
+    let mirrored = 0;
+    let skipped = 0;
+    let failed = 0;
+    const touched = [];
+    for (const entry of entries.slice(0, this.maxEntries)) {
+      const name = safeSegment(entry.name);
+      const version3 = safeSegment(entry.version);
+      if (!name || !version3) {
+        failed++;
+        continue;
+      }
+      const identity = `${entry.name}@${entry.version}:${entry.integrity || ""}`;
+      const already = existing.get(identity);
+      if (already?.key) {
+        skipped++;
+        touched.push(already);
+        continue;
+      }
+      const record = {
+        ...entry,
+        mirroredAt: new Date().toISOString()
+      };
+      if (!entry.resolved) {
+        record.error = "no download URL";
+        failed++;
+        existing.set(identity, record);
+        touched.push(record);
+        continue;
+      }
+      try {
+        const bytes = await this.fetcher(entry.resolved);
+        if (bytes.byteLength > this.maxArtifactBytes) {
+          record.error = `artifact is larger than the ${Math.round(this.maxArtifactBytes / (1024 * 1024))}MB mirror limit`;
+          failed++;
+        } else {
+          const hex = await sha256Hex(bytes);
+          if (!integrityMatches(entry.integrity, hex)) {
+            record.error = "integrity mismatch \u2014 upstream bytes differ from the lockfile";
+            failed++;
+          } else {
+            const key = `mirror/${orgKey(org)}/${name}/${version3}/${hex.slice(0, 32)}.tgz`;
+            await this.storage.upload(key, bytes);
+            record.key = key;
+            record.size = bytes.byteLength;
+            record.sha256 = hex;
+            mirrored++;
+          }
+        }
+      } catch (err) {
+        record.error = err.message;
+        failed++;
+      }
+      existing.set(identity, record);
+      touched.push(record);
+    }
+    const next = {
+      org,
+      updatedAt: new Date().toISOString(),
+      entries: [...existing.values()]
+    };
+    await this.putIndex(next);
+    return { mirrored, skipped, failed, entries: touched };
+  }
+  async fetchArtifact(org, name, version3) {
+    const index = await this.getIndex(org);
+    const matches = index.entries.filter((e11) => e11.name === name && e11.version === version3 && e11.key).sort((a11, b11) => b11.mirroredAt.localeCompare(a11.mirroredAt));
+    for (const record of matches) {
+      try {
+        return { bytes: await this.storage.download(record.key), record };
+      } catch {}
+    }
+    return null;
+  }
+  async list(org) {
+    const index = await this.getIndex(org);
+    return [...index.entries].sort((a11, b11) => b11.mirroredAt.localeCompare(a11.mirroredAt));
+  }
+  async stats(org) {
+    const entries = await this.list(org);
+    return {
+      artifacts: entries.length,
+      stored: entries.filter((e11) => e11.key).length,
+      bytes: entries.reduce((sum, e11) => sum + (e11.size || 0), 0),
+      failed: entries.filter((e11) => e11.error).length
+    };
+  }
+}
+function normalizeEntries(value) {
+  if (!Array.isArray(value))
+    return [];
+  const out = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object")
+      continue;
+    const entry = item;
+    if (typeof entry.name !== "string" || typeof entry.version !== "string")
+      continue;
+    out.push({
+      name: entry.name,
+      version: entry.version,
+      resolved: typeof entry.resolved === "string" ? entry.resolved : undefined,
+      integrity: typeof entry.integrity === "string" ? entry.integrity : undefined,
+      ecosystem: typeof entry.ecosystem === "string" ? entry.ecosystem : undefined,
+      license: typeof entry.license === "string" ? entry.license : undefined
+    });
+  }
+  return out;
+}
+
+// src/security.ts
+var SEVERITY_ORDER = {
+  critical: 0,
+  high: 1,
+  moderate: 2,
+  low: 3,
+  unknown: 4
+};
+function osvEcosystem(ecosystem) {
+  switch ((ecosystem || "npm").toLowerCase()) {
+    case "npm":
+      return "npm";
+    case "pypi":
+    case "python":
+      return "PyPI";
+    case "cargo":
+    case "crates":
+      return "crates.io";
+    case "go":
+      return "Go";
+    case "composer":
+    case "packagist":
+      return "Packagist";
+    case "rubygems":
+    case "gem":
+      return "RubyGems";
+    case "maven":
+      return "Maven";
+    case "nuget":
+      return "NuGet";
+    default:
+      return "";
+  }
+}
+function severityOf(vuln) {
+  const explicit = vuln?.database_specific?.severity || vuln?.affected?.[0]?.database_specific?.severity;
+  if (typeof explicit === "string") {
+    const normalized = explicit.toLowerCase();
+    if (normalized === "critical" || normalized === "high" || normalized === "moderate" || normalized === "low")
+      return normalized;
+    if (normalized === "medium")
+      return "moderate";
+  }
+  const score = vuln?.severity?.find((s11) => s11.type?.startsWith("CVSS"))?.score;
+  if (typeof score === "string") {
+    const match = score.match(/\/(?:AV|A):/) ? null : Number.parseFloat(score);
+    if (match !== null && Number.isFinite(match)) {
+      if (match >= 9)
+        return "critical";
+      if (match >= 7)
+        return "high";
+      if (match >= 4)
+        return "moderate";
+      if (match > 0)
+        return "low";
+    }
+  }
+  return "unknown";
+}
+function fixedVersionOf(vuln) {
+  for (const affected of vuln?.affected || []) {
+    for (const range of affected?.ranges || []) {
+      for (const event of range?.events || []) {
+        if (event?.fixed)
+          return String(event.fixed);
+      }
+    }
+  }
+  return;
+}
+var osvFetcher = async (entries) => {
+  const queries = entries.map((e11) => ({ entry: e11, ecosystem: osvEcosystem(e11.ecosystem) })).filter((q11) => q11.ecosystem);
+  const found = new Map;
+  if (queries.length === 0)
+    return found;
+  const CHUNK = 500;
+  for (let i9 = 0;i9 < queries.length; i9 += CHUNK) {
+    const chunk = queries.slice(i9, i9 + CHUNK);
+    const res = await fetch("https://api.osv.dev/v1/querybatch", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        queries: chunk.map((q11) => ({
+          package: { name: q11.entry.name, ecosystem: q11.ecosystem },
+          version: q11.entry.version
+        }))
+      })
+    });
+    if (!res.ok)
+      throw new Error(`OSV responded ${res.status}`);
+    const body = await res.json();
+    const results = body.results || [];
+    for (let j10 = 0;j10 < chunk.length; j10++) {
+      const ids = (results[j10]?.vulns || []).map((v11) => v11.id).slice(0, 25);
+      if (ids.length === 0)
+        continue;
+      const alerts = [];
+      for (const id2 of ids) {
+        try {
+          const detail = await fetch(`https://api.osv.dev/v1/vulns/${encodeURIComponent(id2)}`);
+          const vuln = detail.ok ? await detail.json() : null;
+          alerts.push({
+            type: "vulnerability",
+            package: chunk[j10].entry.name,
+            version: chunk[j10].entry.version,
+            ecosystem: chunk[j10].ecosystem,
+            id: id2,
+            severity: vuln ? severityOf(vuln) : "unknown",
+            summary: vuln?.summary || vuln?.details?.slice(0, 200) || id2,
+            url: `https://osv.dev/vulnerability/${id2}`,
+            fixedIn: vuln ? fixedVersionOf(vuln) : undefined
+          });
+        } catch {
+          alerts.push({
+            type: "vulnerability",
+            package: chunk[j10].entry.name,
+            version: chunk[j10].entry.version,
+            ecosystem: chunk[j10].ecosystem,
+            id: id2,
+            severity: "unknown",
+            summary: id2,
+            url: `https://osv.dev/vulnerability/${id2}`
+          });
+        }
+      }
+      found.set(`${chunk[j10].entry.name}@${chunk[j10].entry.version}`, alerts);
+    }
+  }
+  return found;
+};
+function normalizeLicense(license) {
+  return license.trim().toUpperCase();
+}
+function checkLicense(entry, policy) {
+  if (!policy || !policy.allow?.length && !policy.deny?.length)
+    return null;
+  const license = entry.license?.trim();
+  if (!license) {
+    if (!policy.allow?.length)
+      return null;
+    return {
+      type: "license",
+      package: entry.name,
+      version: entry.version,
+      license: "unknown",
+      reason: "unknown",
+      summary: `${entry.name}@${entry.version} does not declare a licence, and your policy allows only: ${policy.allow.join(", ")}`
+    };
+  }
+  const normalized = normalizeLicense(license);
+  if (policy.deny?.some((d10) => normalizeLicense(d10) === normalized)) {
+    return {
+      type: "license",
+      package: entry.name,
+      version: entry.version,
+      license,
+      reason: "denied",
+      summary: `${entry.name}@${entry.version} is ${license}, which your policy denies`
+    };
+  }
+  if (policy.allow?.length && !policy.allow.some((a11) => normalizeLicense(a11) === normalized)) {
+    return {
+      type: "license",
+      package: entry.name,
+      version: entry.version,
+      license,
+      reason: "not-allowed",
+      summary: `${entry.name}@${entry.version} is ${license}, which is not in your allowed list`
+    };
+  }
+  return null;
+}
+
+class SecurityStore {
+  storage;
+  fetcher;
+  constructor(storage, fetcher = osvFetcher) {
+    this.storage = storage;
+    this.fetcher = fetcher;
+  }
+  key(org) {
+    return `security/${orgKey(org)}/watch.json`;
+  }
+  async getWatchList(org) {
+    try {
+      const bytes = await this.storage.download(this.key(org));
+      const parsed = JSON.parse(new TextDecoder().decode(bytes));
+      if (parsed && Array.isArray(parsed.entries))
+        return parsed;
+    } catch {}
+    return { org, entries: [], updatedAt: new Date().toISOString() };
+  }
+  async setWatchList(org, entries, policy) {
+    const existing = await this.getWatchList(org);
+    const list = {
+      org,
+      entries,
+      policy: policy ?? existing.policy,
+      updatedAt: new Date().toISOString()
+    };
+    const body = new TextEncoder().encode(JSON.stringify(list)).buffer;
+    await this.storage.upload(this.key(org), body);
+    return list;
+  }
+  async setPolicy(org, policy) {
+    const existing = await this.getWatchList(org);
+    return this.setWatchList(org, existing.entries, policy);
+  }
+  async report(org) {
+    const list = await this.getWatchList(org);
+    const alerts = [];
+    let degraded;
+    try {
+      const vulns = await this.fetcher(list.entries);
+      for (const found of vulns.values())
+        alerts.push(...found);
+    } catch (err) {
+      degraded = `advisory lookup failed: ${err.message}`;
+    }
+    for (const entry of list.entries) {
+      const licenseAlert = checkLicense(entry, list.policy);
+      if (licenseAlert)
+        alerts.push(licenseAlert);
+    }
+    alerts.sort((a11, b11) => {
+      const sa3 = a11.type === "vulnerability" ? SEVERITY_ORDER[a11.severity] : 5;
+      const sb3 = b11.type === "vulnerability" ? SEVERITY_ORDER[b11.severity] : 5;
+      return sa3 - sb3 || a11.package.localeCompare(b11.package);
+    });
+    const counts = { critical: 0, high: 0, moderate: 0, low: 0, license: 0 };
+    for (const alert3 of alerts) {
+      if (alert3.type === "license")
+        counts.license++;
+      else if (alert3.severity !== "unknown")
+        counts[alert3.severity]++;
+    }
+    return {
+      org,
+      generatedAt: new Date().toISOString(),
+      watched: list.entries.length,
+      alerts,
+      counts,
+      ...degraded ? { degraded } : {}
+    };
+  }
+}
+function normalizePolicy(value) {
+  if (!value || typeof value !== "object")
+    return;
+  const raw = value;
+  const strings = (v11) => Array.isArray(v11) ? v11.filter((x11) => typeof x11 === "string" && x11.length < 100).slice(0, 200) : undefined;
+  const allow = strings(raw.allow);
+  const deny = strings(raw.deny);
+  if (!allow && !deny)
+    return;
+  return { ...allow ? { allow } : {}, ...deny ? { deny } : {} };
+}
+
+// src/sbom.ts
+function purlFor(entry) {
+  const type = (entry.ecosystem || "npm").toLowerCase();
+  const [scope, bare] = entry.name.startsWith("@") ? [entry.name.slice(0, entry.name.indexOf("/")), entry.name.slice(entry.name.indexOf("/") + 1)] : [null, entry.name];
+  const namespace = scope ? `${encodeURIComponent(scope)}/` : "";
+  return `pkg:${type}/${namespace}${encodeURIComponent(bare)}@${encodeURIComponent(entry.version)}`;
+}
+function hashesFor(entry) {
+  const hashes = [];
+  if (entry.sha256)
+    hashes.push({ alg: "SHA-256", content: entry.sha256 });
+  if (entry.integrity?.startsWith("sha512-")) {
+    try {
+      const hex = Array.from(Buffer.from(entry.integrity.slice(7), "base64")).map((b11) => b11.toString(16).padStart(2, "0")).join("");
+      hashes.push({ alg: "SHA-512", content: hex });
+    } catch {}
+  }
+  return hashes;
+}
+function toCycloneDx(entries, options) {
+  const timestamp = options.timestamp || new Date().toISOString();
+  return {
+    bomFormat: "CycloneDX",
+    specVersion: "1.5",
+    serialNumber: `urn:uuid:${options.documentId || deterministicUuid(options.org, timestamp)}`,
+    version: 1,
+    metadata: {
+      timestamp,
+      tools: [{ vendor: "pantry", name: "pantry-registry", version: "1" }],
+      component: {
+        type: "application",
+        name: options.subject || options.org,
+        version: timestamp.slice(0, 10)
+      }
+    },
+    components: entries.map((entry) => ({
+      type: "library",
+      name: entry.name,
+      version: entry.version,
+      purl: purlFor(entry),
+      ...entry.license ? { licenses: [{ license: { id: entry.license } }] } : {},
+      ...hashesFor(entry).length ? { hashes: hashesFor(entry) } : {},
+      ...entry.resolved ? { externalReferences: [{ type: "distribution", url: entry.resolved }] } : {},
+      properties: [
+        { name: "pantry:mirrored", value: entry.key ? "true" : "false" },
+        ...entry.mirroredAt ? [{ name: "pantry:mirroredAt", value: entry.mirroredAt }] : []
+      ]
+    }))
+  };
+}
+function toSpdx(entries, options) {
+  const timestamp = options.timestamp || new Date().toISOString();
+  const name = options.subject || options.org;
+  const packages = entries.map((entry, i9) => ({
+    SPDXID: `SPDXRef-Package-${i9}`,
+    name: entry.name,
+    versionInfo: entry.version,
+    downloadLocation: entry.resolved || "NOASSERTION",
+    filesAnalyzed: false,
+    licenseConcluded: entry.license || "NOASSERTION",
+    licenseDeclared: entry.license || "NOASSERTION",
+    copyrightText: "NOASSERTION",
+    externalRefs: [{
+      referenceCategory: "PACKAGE-MANAGER",
+      referenceType: "purl",
+      referenceLocator: purlFor(entry)
+    }],
+    ...entry.sha256 ? { checksums: [{ algorithm: "SHA256", checksumValue: entry.sha256 }] } : {}
+  }));
+  return {
+    spdxVersion: "SPDX-2.3",
+    dataLicense: "CC0-1.0",
+    SPDXID: "SPDXRef-DOCUMENT",
+    name,
+    documentNamespace: `https://pantry.dev/sbom/${encodeURIComponent(options.org)}/${options.documentId || deterministicUuid(options.org, timestamp)}`,
+    creationInfo: {
+      created: timestamp,
+      creators: ["Tool: pantry-registry"]
+    },
+    packages,
+    relationships: packages.map((pkg) => ({
+      spdxElementId: "SPDXRef-DOCUMENT",
+      relatedSpdxElement: pkg.SPDXID,
+      relationshipType: "DESCRIBES"
+    }))
+  };
+}
+function buildSbom(entries, format, options) {
+  return format === "spdx" ? toSpdx(entries, options) : toCycloneDx(entries, options);
+}
+function parseFormat(value) {
+  return String(value || "").toLowerCase() === "spdx" ? "spdx" : "cyclonedx";
+}
+function deterministicUuid(org, timestamp) {
+  const seed = `${org}:${timestamp}`;
+  let h15 = 2166136261;
+  let h23 = 16777619;
+  for (let i9 = 0;i9 < seed.length; i9++) {
+    h15 = Math.imul(h15 ^ seed.charCodeAt(i9), 16777619) >>> 0;
+    h23 = Math.imul(h23 + seed.charCodeAt(i9) + i9, 2246822507) >>> 0;
+  }
+  const hex = (n10) => n10.toString(16).padStart(8, "0");
+  const a11 = hex(h15);
+  const b11 = hex(h23);
+  const c10 = hex((h15 ^ h23) >>> 0);
+  const d10 = hex(h15 + h23 >>> 0);
+  return `${a11}-${b11.slice(0, 4)}-4${b11.slice(5, 8)}-a${c10.slice(1, 4)}-${c10.slice(4)}${d10}`;
+}
+
 // src/server.ts
 var _aliases = new Map;
 function loadAliases() {
@@ -101132,6 +102391,17 @@ function createHandler(registry, analyticsStorage, zigPackageStorage, baseUrl, b
       return new Response(null, { headers: corsHeaders });
     }
     try {
+      if (path6 === "/api/registry-info" && req.method === "GET") {
+        return Response.json(registryInfo(process.env, baseUrl), {
+          headers: { ...corsHeaders, "Cache-Control": "no-store" }
+        });
+      }
+      const denied = await enforceReadAccess(req, url, { identify: identifyReader, corsHeaders });
+      if (denied)
+        return denied;
+      const fromPlugin = await pluginResponse(req, { url, path: path6, method: req.method, visibility: resolveVisibility() });
+      if (fromPlugin)
+        return fromPlugin;
       const ua3 = req.headers.get("user-agent") || "";
       const isCLI = /^(curl|wget|httpie|fetch|libfetch|powershell)/i.test(ua3) || !ua3;
       if (isCLI && (path6 === "/" || path6 === "")) {
@@ -101241,8 +102511,11 @@ function createHandler(registry, analyticsStorage, zigPackageStorage, baseUrl, b
         const domain = typeof body?.domain === "string" ? body.domain : "";
         if (!/^[a-zA-Z0-9._/-]{1,128}$/.test(domain))
           return Response.json({ error: "valid domain required" }, { status: 400, headers: corsHeaders });
-        const queued = getBuildStatus().requestRebuild(domain);
-        return Response.json({ queued, domain }, { headers: corsHeaders });
+        const identity = await identifyReader(req);
+        const tier = await tierForUser(identity.userId);
+        const priority = identity.userId === "_admin" || tierDefinition(tier).priorityBuilds;
+        const queued = getBuildStatus().requestRebuild(domain, priority);
+        return Response.json({ queued, domain, priority }, { headers: corsHeaders });
       }
       if (path6 === "/api/rebuild-queue" && req.method === "GET") {
         return Response.json({ queue: getBuildStatus().getQueue() }, { headers: corsHeaders });
@@ -101273,6 +102546,52 @@ function createHandler(registry, analyticsStorage, zigPackageStorage, baseUrl, b
         if (authResponse)
           return authResponse;
       }
+      if (authService) {
+        const enterprise = await handleEnterpriseRoutes(path6, req, registry, corsHeaders);
+        if (enterprise)
+          return enterprise;
+      }
+      if (authService && (path6 === "/api/plans" || path6.startsWith("/account/"))) {
+        const subscriptionResponse = await handleSubscriptionRoutes(path6, req, authService, baseUrl, corsHeaders);
+        if (subscriptionResponse)
+          return subscriptionResponse;
+      }
+      if (path6.startsWith("/admin/") && authService) {
+        const adminResponse = await handleAdminRoutes(path6, req, authService, corsHeaders);
+        if (adminResponse)
+          return adminResponse;
+      }
+      if (path6 === "/pricing" && req.method === "GET") {
+        const html = await renderSitePage("pricing.stx", {
+          title: "Plans",
+          metaDescription: "Publishing and installing on pantry is free. Selling a package costs a fee per sale \u2014 10% on Free, 5% on a plan \u2014 and a plan also insures your builds, watches your lockfile and unlocks private packages.",
+          canonicalUrl: "https://pantry.dev/pricing",
+          plans: Object.values(TIERS).map((t11) => ({
+            id: t11.id,
+            name: t11.name,
+            featured: t11.id === "pro",
+            formattedPrice: t11.price === 0 ? "Free" : `$${(t11.price / 100).toFixed(0)}/mo`,
+            sellingFee: formatBps(t11.commissionBps),
+            tagline: t11.id === "free" ? "Publish and sell, no cost" : t11.id === "pro" ? "For people who ship" : "For teams who depend on it",
+            publishing: [
+              t11.privatePackages ? "Private & unlisted packages" : "Public packages",
+              t11.analyticsRetentionDays >= 3650 ? "Lifetime full analytics" : "30 days of full analytics",
+              `${Math.round(t11.maxArtifactBytes / 1048576)}MB artifacts`,
+              t11.priorityBuilds ? "Priority builds" : "Standard build queue",
+              t11.seats > 1 ? `${t11.seats} seats, shared packages` : "1 seat"
+            ],
+            consuming: [
+              t11.buildInsurance ? "Build insurance \u2014 every artifact mirrored" : "Standard downloads",
+              t11.securityAlerts ? "Continuous CVE & licence alerts" : "Point-in-time `pantry audit`",
+              t11.sbomExport ? "SBOM export (CycloneDX, SPDX)" : "No SBOM export",
+              t11.teamEntitlements ? "Paid packages bought once for the whole team" : "Purchases are per account"
+            ]
+          })),
+          discoveryFee: formatBps(DISCOVERY_FEE_BPS),
+          paymentsEnabled: paymentsEnabled()
+        });
+        return htmlResponse(html);
+      }
       if (authService && (path6 === "/login" || path6 === "/signup" || path6 === "/account")) {
         return handleSiteAuth(path6, req, authService, corsHeaders);
       }
@@ -101366,7 +102685,15 @@ function createHandler(registry, analyticsStorage, zigPackageStorage, baseUrl, b
         }
         try {
           const rawBody = await req.text();
-          const result = await handleStripeWebhook(registry.metadata, rawBody, signature);
+          const result = await handleStripeWebhook(registry.metadata, rawBody, signature, authService ? async (change) => {
+            await authService.setSubscription(change.email, {
+              tier: tierOf(change.tier),
+              status: change.status,
+              stripeCustomerId: change.stripeCustomerId,
+              stripeSubscriptionId: change.stripeSubscriptionId,
+              currentPeriodEnd: change.currentPeriodEnd
+            });
+          } : undefined);
           return Response.json(result, { headers: corsHeaders });
         } catch (err) {
           console.error("Stripe webhook error:", err);
@@ -101542,61 +102869,111 @@ function createHandler(registry, analyticsStorage, zigPackageStorage, baseUrl, b
           if (!paywall || !paywall.enabled) {
             return Response.json({ enabled: false }, { headers: corsHeaders });
           }
+          const identity = await identifyReader(req);
+          const owned = identity.userId && identity.userId !== "_admin" ? await isEntitled(registry.metadata, packageName, identity.userId) : false;
           return Response.json({
             enabled: true,
             price: paywall.price,
             currency: paywall.currency,
             formattedPrice: formatPrice(paywall.price, paywall.currency),
-            freeVersions: paywall.freeVersions || []
-          }, { headers: corsHeaders });
+            freeVersions: paywall.freeVersions || [],
+            owned,
+            paymentsEnabled: paymentsEnabled(),
+            buyUrl: `${baseUrl}/packages/${encodeURIComponent(packageName)}/buy`
+          }, { headers: { ...corsHeaders, "Cache-Control": "no-store" } });
         }
         if (rest === "paywall" && req.method === "POST") {
-          const authResult = await validateToken3(req.headers.get("authorization"));
-          if (!authResult.valid) {
-            return Response.json({ error: authResult.error }, { status: 401, headers: corsHeaders });
-          }
+          const denied2 = await requirePackageOwner(req, registry, packageName, corsHeaders);
+          if (denied2)
+            return denied2;
           let body;
           try {
             body = await req.json();
           } catch {
             return Response.json({ error: "Invalid JSON body" }, { status: 400, headers: corsHeaders });
           }
-          if (!body.price || typeof body.price !== "number" || body.price < 100) {
-            return Response.json({ error: "Price must be at least 100 cents ($1.00)" }, { status: 400, headers: corsHeaders });
+          const invalid = validatePriceConfig(body);
+          if (invalid) {
+            return Response.json({ error: invalid }, { status: 400, headers: corsHeaders });
+          }
+          try {
+            const paywall = await configurePaywall(registry.metadata, packageName, body);
+            return Response.json({
+              success: true,
+              paywall: {
+                enabled: paywall.enabled,
+                price: paywall.price,
+                currency: paywall.currency,
+                formattedPrice: formatPrice(paywall.price, paywall.currency),
+                freeVersions: paywall.freeVersions || [],
+                payoutAccountId: paywall.stripeAccountId,
+                paymentsEnabled: paymentsEnabled()
+              }
+            }, { status: 200, headers: corsHeaders });
+          } catch (err) {
+            return Response.json({ error: err.message || "Could not set the price" }, { status: 400, headers: corsHeaders });
           }
-          const paywall = await configurePaywall(registry.metadata, packageName, body);
-          return Response.json({
-            success: true,
-            paywall: {
-              enabled: paywall.enabled,
-              price: paywall.price,
-              currency: paywall.currency,
-              formattedPrice: formatPrice(paywall.price, paywall.currency)
-            }
-          }, { status: 200, headers: corsHeaders });
         }
         if (rest === "paywall" && req.method === "DELETE") {
-          const authResult = await validateToken3(req.headers.get("authorization"));
-          if (!authResult.valid) {
-            return Response.json({ error: authResult.error }, { status: 401, headers: corsHeaders });
-          }
+          const denied2 = await requirePackageOwner(req, registry, packageName, corsHeaders);
+          if (denied2)
+            return denied2;
           await registry.metadata.deletePaywall(packageName);
           return Response.json({ success: true }, { headers: corsHeaders });
         }
-        if (rest === "checkout" && req.method === "GET") {
-          const token = url.searchParams.get("token");
-          if (!token) {
-            return Response.json({ error: "Token required \u2014 run `pantry auth login` first" }, { status: 400, headers: corsHeaders });
+        if (rest === "checkout" && req.method === "POST") {
+          const identity = await identifyReader(req);
+          if (!identity.authenticated || !identity.userId || identity.userId === "_admin") {
+            return Response.json({
+              error: "Sign in to buy a package",
+              hint: "Create an account at /signup, then: pantry token set"
+            }, { status: 401, headers: corsHeaders });
+          }
+          if (await isEntitled(registry.metadata, packageName, identity.userId)) {
+            return Response.json({ owned: true, message: "You already own this package" }, { headers: corsHeaders });
           }
           try {
-            const session = await createCheckoutSession(registry.metadata, packageName, token, baseUrl);
+            const session = await createCheckoutSession(registry.metadata, {
+              packageName,
+              email: identity.userId,
+              baseUrl,
+              sellerTier: await sellerTierFor(registry, authService, packageName),
+              origin: url.searchParams.get("origin") === "site" ? "site" : "cli"
+            });
+            return Response.json({ url: session.url }, { headers: corsHeaders });
+          } catch (err) {
+            console.error("Checkout session error:", err);
+            return Response.json({ error: err.message || "Could not start checkout" }, { status: 400, headers: corsHeaders });
+          }
+        }
+        if ((rest === "buy" || rest === "checkout") && req.method === "GET") {
+          const sessionToken = extractSessionToken(req);
+          const user = sessionToken && authService ? await authService.validateSession(sessionToken) : null;
+          if (!user) {
+            const next = `/packages/${encodeURIComponent(packageName)}/buy`;
+            return new Response(null, {
+              status: 302,
+              headers: { ...corsHeaders, Location: `/login?next=${encodeURIComponent(next)}` }
+            });
+          }
+          if (await isEntitled(registry.metadata, packageName, user.email)) {
             return new Response(null, {
               status: 302,
-              headers: { ...corsHeaders, Location: session.url }
+              headers: { ...corsHeaders, Location: `/packages/${encodeURIComponent(packageName)}/checkout/success` }
             });
+          }
+          try {
+            const session = await createCheckoutSession(registry.metadata, {
+              packageName,
+              email: user.email,
+              baseUrl,
+              sellerTier: await sellerTierFor(registry, authService, packageName),
+              origin: "site"
+            });
+            return new Response(null, { status: 302, headers: { ...corsHeaders, Location: session.url } });
           } catch (err) {
             console.error("Checkout session error:", err);
-            return Response.json({ error: "Failed to create checkout session" }, { status: 400, headers: corsHeaders });
+            return Response.json({ error: err.message || "Could not start checkout" }, { status: 400, headers: corsHeaders });
           }
         }
         if (rest === "checkout/success" && req.method === "GET") {
@@ -101615,19 +102992,20 @@ function createHandler(registry, analyticsStorage, zigPackageStorage, baseUrl, b
           if (!version3 || !/^[a-zA-Z0-9._+-]+$/.test(version3) || version3.length > 64) {
             return Response.json({ error: "Invalid version" }, { status: 400, headers: corsHeaders });
           }
-          const authToken = extractBearerToken(req.headers.get("authorization")) || url.searchParams.get("token");
-          const access4 = await checkPaywallAccess(registry.metadata, packageName, version3, authToken);
+          const access4 = await resolvePackageAccess(req, registry, packageName, version3);
           if (!access4.allowed && access4.paywall) {
-            const checkoutUrl = `${baseUrl}/packages/${encodeURIComponent(packageName)}/checkout`;
+            const buyUrl = `${baseUrl}/packages/${encodeURIComponent(packageName)}/buy`;
+            const priceText = formatPrice(access4.paywall.price, access4.paywall.currency);
             return Response.json({
               error: "Payment required",
               package: packageName,
               price: access4.paywall.price,
               currency: access4.paywall.currency,
-              formattedPrice: formatPrice(access4.paywall.price, access4.paywall.currency),
-              checkoutUrl,
-              message: `This package requires payment (${formatPrice(access4.paywall.price, access4.paywall.currency)}). Visit ${checkoutUrl} to purchase access, or run: pantry auth login`
-            }, { status: 402, headers: corsHeaders });
+              formattedPrice: priceText,
+              buyUrl,
+              checkoutUrl: buyUrl,
+              message: access4.reason === "unauthenticated" ? `${packageName} costs ${priceText}. Sign in and buy it with: pantry buy ${packageName}` : `${packageName} costs ${priceText}. Buy it with: pantry buy ${packageName} (or open ${buyUrl})`
+            }, { status: 402, headers: { ...corsHeaders, "Cache-Control": "no-store" } });
           }
           const tarball = await registry.downloadTarball(packageName, version3);
           if (!tarball) {
@@ -101767,9 +103145,14 @@ function createServer(registry, port = 3000, analytics, zigStorage, binaryStorag
   const start = () => {
     server = Bun.serve({
       port,
-      fetch: handler
+      fetch: handler,
+      maxRequestBodySize: Math.max(...Object.values(TIERS).map((t11) => t11.maxArtifactBytes)) + 33554432
     });
+    const visibility = resolveVisibility();
     console.log(`Pantry Registry running at http://localhost:${port}`);
+    console.log(visibility === "private" ? "  Visibility: PRIVATE \u2014 every read requires a token or a logged-in session" : "  Visibility: public \u2014 reads are unauthenticated (set REGISTRY_VISIBILITY=private to close it)");
+    if (visibility === "private" && signupsEnabled())
+      console.warn("  WARNING: REGISTRY_ALLOW_SIGNUP is on \u2014 anyone can create an account and read every package");
     console.log("Endpoints:");
     console.log("  GET  /packages/{name}           - Get package metadata");
     console.log("  GET  /packages/{name}/{version} - Get specific version");
@@ -101954,6 +103337,440 @@ async function isAuthorizedRequest(req) {
   } catch {}
   return false;
 }
+async function identifyReader(req) {
+  try {
+    const authHeader = req.headers.get("authorization");
+    const token = extractBearerToken(authHeader);
+    if (token && _authService) {
+      const result = await _authService.validateAccessToken(token, getRegistryToken3() ?? "", "read");
+      if (result.valid)
+        return { authenticated: true, userId: result.userId ?? null };
+    } else if (token) {
+      const result = await validateToken3(authHeader);
+      if (result.valid)
+        return { authenticated: true, userId: result.userId ?? null };
+    }
+    if (_authService) {
+      const sessionToken = extractSessionToken(req);
+      if (sessionToken) {
+        const user = await _authService.validateSession(sessionToken);
+        if (user)
+          return { authenticated: true, userId: user.email };
+      }
+    }
+  } catch {}
+  return { authenticated: false, userId: null };
+}
+async function isAdminRequest(req) {
+  try {
+    const authHeader = req.headers.get("authorization");
+    const token = extractBearerToken(authHeader);
+    if (token) {
+      const registryToken = getRegistryToken3();
+      if (registryToken && token.length === registryToken.length) {
+        const maxLen = Math.max(token.length, registryToken.length);
+        const a11 = Buffer.alloc(maxLen);
+        const b11 = Buffer.alloc(maxLen);
+        Buffer.from(token).copy(a11);
+        Buffer.from(registryToken).copy(b11);
+        if (__require("crypto").timingSafeEqual(a11, b11))
+          return true;
+      }
+    }
+    if (_authService) {
+      const sessionToken = extractSessionToken(req);
+      if (sessionToken) {
+        const user = await _authService.validateSession(sessionToken);
+        if (user?.role === "admin")
+          return true;
+      }
+    }
+  } catch {}
+  return false;
+}
+async function requirePackageOwner(req, registry, packageName, corsHeaders) {
+  const identity = await identifyReader(req);
+  if (!identity.authenticated) {
+    return Response.json({ error: "Authentication required", hint: "pantry token set --registry <registry-url>" }, { status: 401, headers: corsHeaders });
+  }
+  if (identity.userId === "_admin")
+    return null;
+  const record = await registry.getPublisherPackageRecord(packageName);
+  if (!record) {
+    return Response.json({ error: "Package not found" }, { status: 404, headers: corsHeaders });
+  }
+  if (record.publishedBy && record.publishedBy !== identity.userId) {
+    if (_authService && await _authService.canActFor(identity.userId, record.publishedBy))
+      return null;
+    return Response.json({ error: "Only the publisher of this package can change its price" }, { status: 403, headers: corsHeaders });
+  }
+  return null;
+}
+async function requirePublishRights(registry, userId, packageName, corsHeaders) {
+  if (!userId || userId === "_admin")
+    return null;
+  const record = await registry.getPublisherPackageRecord(packageName).catch(() => null);
+  const owner = record?.publishedBy;
+  if (!owner)
+    return null;
+  if (owner === userId)
+    return null;
+  if (_authService && await _authService.canActFor(userId, owner))
+    return null;
+  return Response.json({
+    error: `${packageName} belongs to another account`,
+    hint: "Ask its owner to add you to their team, or publish under a name you own"
+  }, { status: 403, headers: corsHeaders });
+}
+async function tierForPackage(registry, packageName, fallbackUserId) {
+  const record = await registry.getPublisherPackageRecord(packageName).catch(() => null);
+  if (record?.publishedBy)
+    return tierForUser(record.publishedBy);
+  return tierForUser(fallbackUserId);
+}
+async function tierForUser(userId) {
+  if (!userId || userId === "_admin" || !_authService)
+    return "free";
+  try {
+    return await _authService.getTier(userId);
+  } catch {
+    return "free";
+  }
+}
+async function sellerTierFor(registry, auth, packageName) {
+  if (!auth)
+    return "free";
+  try {
+    const record = await registry.getPublisherPackageRecord(packageName);
+    if (!record?.publishedBy)
+      return "free";
+    return await auth.getTier(record.publishedBy);
+  } catch {
+    return "free";
+  }
+}
+async function handleSubscriptionRoutes(path6, req, auth, baseUrl, corsHeaders) {
+  if (path6 === "/api/plans" && req.method === "GET") {
+    return Response.json({
+      plans: Object.values(TIERS).map((t11) => ({
+        id: t11.id,
+        name: t11.name,
+        price: t11.price,
+        formattedPrice: t11.price === 0 ? "Free" : `$${(t11.price / 100).toFixed(0)}/mo`,
+        sellingFee: formatBps(t11.commissionBps),
+        sellingFeeBps: t11.commissionBps,
+        commission: formatBps(t11.commissionBps),
+        commissionBps: t11.commissionBps,
+        privatePackages: t11.privatePackages,
+        priorityBuilds: t11.priorityBuilds,
+        analyticsRetentionDays: t11.analyticsRetentionDays,
+        maxArtifactMB: Math.round(t11.maxArtifactBytes / 1048576),
+        seats: t11.seats,
+        buildInsurance: t11.buildInsurance,
+        securityAlerts: t11.securityAlerts,
+        sbomExport: t11.sbomExport,
+        teamEntitlements: t11.teamEntitlements
+      })),
+      discoveryFee: formatBps(DISCOVERY_FEE_BPS),
+      discoveryFeeBps: DISCOVERY_FEE_BPS,
+      paymentsEnabled: paymentsEnabled()
+    }, { headers: { ...corsHeaders, "Cache-Control": "public, max-age=300" } });
+  }
+  const isTeamPath = path6 === "/account/team" || path6.startsWith("/account/team/");
+  if (path6 !== "/account/subscription" && path6 !== "/account/billing-portal" && !isTeamPath)
+    return null;
+  const sessionToken = extractSessionToken(req);
+  const user = sessionToken ? await auth.validateSession(sessionToken) : null;
+  if (!user) {
+    return Response.json({ error: "Sign in to manage your plan" }, { status: 401, headers: corsHeaders });
+  }
+  const current = await auth.getSubscription(user.email);
+  const tier = await auth.getTier(user.email);
+  if (path6 === "/account/subscription" && req.method === "GET") {
+    const def = tierDefinition(tier);
+    return Response.json({
+      tier,
+      name: def.name,
+      status: current?.status || "none",
+      sellingFee: formatBps(def.commissionBps),
+      commission: formatBps(def.commissionBps),
+      currentPeriodEnd: current?.currentPeriodEnd,
+      manageable: Boolean(current?.stripeCustomerId)
+    }, { headers: { ...corsHeaders, "Cache-Control": "no-store" } });
+  }
+  if (path6 === "/account/subscription" && req.method === "POST") {
+    const body = await req.json().catch(() => null);
+    const requested = tierOf(body?.tier);
+    if (requested === "free") {
+      return Response.json({ error: "Cancel from the billing portal rather than downgrading here", hint: "POST /account/billing-portal" }, { status: 400, headers: corsHeaders });
+    }
+    if (tier === requested) {
+      return Response.json({ alreadySubscribed: true, tier }, { headers: corsHeaders });
+    }
+    try {
+      const session = await createSubscriptionCheckout({
+        tier: tierDefinition(requested),
+        email: user.email,
+        baseUrl,
+        stripeCustomerId: current?.stripeCustomerId
+      });
+      return Response.json({ url: session.url }, { headers: corsHeaders });
+    } catch (err) {
+      console.error("Subscription checkout error:", err);
+      return Response.json({ error: err.message || "Could not start checkout" }, { status: 400, headers: corsHeaders });
+    }
+  }
+  if (isTeamPath) {
+    const def = tierDefinition(tier);
+    if (path6 === "/account/team" && req.method === "GET") {
+      const members = await auth.getTeamMembers(user.email);
+      const belongsTo = await auth.getTeamOwner(user.email);
+      return Response.json({
+        tier,
+        seats: def.seats,
+        seatsUsed: members.length + 1,
+        members,
+        memberOf: belongsTo,
+        canInvite: def.seats > 1
+      }, { headers: { ...corsHeaders, "Cache-Control": "no-store" } });
+    }
+    if (path6 === "/account/team/members" && req.method === "POST") {
+      if (def.seats <= 1) {
+        return Response.json({
+          error: "Seats are a Team feature",
+          hint: "pantry subscribe team",
+          tier
+        }, { status: 402, headers: corsHeaders });
+      }
+      const body = await req.json().catch(() => null);
+      const invitee = typeof body?.email === "string" ? body.email.trim() : "";
+      if (!invitee) {
+        return Response.json({ error: "An email address is required" }, { status: 400, headers: corsHeaders });
+      }
+      try {
+        const members = await auth.addTeamMember(user.email, invitee, def.seats);
+        return Response.json({ members, seats: def.seats, seatsUsed: members.length + 1 }, { headers: corsHeaders });
+      } catch (err) {
+        const status = err instanceof AuthError ? err.status : 400;
+        return Response.json({ error: err.message }, { status, headers: corsHeaders });
+      }
+    }
+    const removeMatch = path6.match(/^\/account\/team\/members\/(.+)$/);
+    if (removeMatch && req.method === "DELETE") {
+      const target = decodeURIComponent(removeMatch[1]);
+      const members = await auth.removeTeamMember(user.email, target);
+      return Response.json({ members, seats: def.seats, seatsUsed: members.length + 1 }, { headers: corsHeaders });
+    }
+    return Response.json({ error: "Not found" }, { status: 404, headers: corsHeaders });
+  }
+  if (path6 === "/account/billing-portal" && req.method === "POST") {
+    if (!current?.stripeCustomerId) {
+      return Response.json({ error: "This account has no billing history" }, { status: 400, headers: corsHeaders });
+    }
+    try {
+      const session = await createBillingPortalSession(current.stripeCustomerId, `${baseUrl}/account`);
+      return Response.json({ url: session.url }, { headers: corsHeaders });
+    } catch (err) {
+      console.error("Billing portal error:", err);
+      return Response.json({ error: err.message || "Could not open the billing portal" }, { status: 400, headers: corsHeaders });
+    }
+  }
+  return null;
+}
+var _mirrorStore = null;
+var _securityStore = null;
+function mirrorStore(registry) {
+  if (!_mirrorStore)
+    _mirrorStore = new MirrorStore(registry.tarball);
+  return _mirrorStore;
+}
+function securityStore(registry) {
+  if (!_securityStore)
+    _securityStore = new SecurityStore(registry.tarball);
+  return _securityStore;
+}
+async function orgFor(email) {
+  if (!_authService)
+    return email;
+  return await _authService.getTeamOwner(email) || email;
+}
+async function requirePaidOrg(req, feature, corsHeaders, entitled = (t11) => t11.buildInsurance) {
+  const identity = await identifyReader(req);
+  if (!identity.authenticated || !identity.userId || identity.userId === "_admin") {
+    return Response.json({ error: "Sign in to use this", hint: "pantry token set" }, { status: 401, headers: corsHeaders });
+  }
+  const org = await orgFor(identity.userId);
+  const tier = await tierForUser(org);
+  if (!entitled(tierDefinition(tier))) {
+    return Response.json({
+      error: `${feature} is a paid feature`,
+      hint: "pantry subscribe pro",
+      tier
+    }, { status: 402, headers: corsHeaders });
+  }
+  return { org, email: identity.userId, tier };
+}
+async function handleEnterpriseRoutes(path6, req, registry, corsHeaders) {
+  if (!path6.startsWith("/mirror") && !path6.startsWith("/security") && path6 !== "/sbom")
+    return null;
+  if (path6 === "/mirror/snapshot" && req.method === "POST") {
+    const gate = await requirePaidOrg(req, "Build insurance", corsHeaders);
+    if (gate instanceof Response)
+      return gate;
+    const body = await req.json().catch(() => null);
+    const entries = normalizeEntries(body?.entries);
+    if (entries.length === 0) {
+      return Response.json({ error: "No usable entries \u2014 send {entries: [{name, version, resolved, integrity}]}" }, { status: 400, headers: corsHeaders });
+    }
+    const result = await mirrorStore(registry).snapshot(gate.org, entries);
+    return Response.json({
+      org: gate.org,
+      mirrored: result.mirrored,
+      skipped: result.skipped,
+      failed: result.failed,
+      failures: result.entries.filter((e11) => e11.error).map((e11) => ({ name: e11.name, version: e11.version, error: e11.error }))
+    }, { headers: corsHeaders });
+  }
+  if (path6 === "/mirror" && req.method === "GET") {
+    const gate = await requirePaidOrg(req, "Build insurance", corsHeaders);
+    if (gate instanceof Response)
+      return gate;
+    const store = mirrorStore(registry);
+    return Response.json({
+      org: gate.org,
+      stats: await store.stats(gate.org),
+      entries: (await store.list(gate.org)).slice(0, 500)
+    }, { headers: { ...corsHeaders, "Cache-Control": "no-store" } });
+  }
+  const mirrorTarball = path6.match(/^\/mirror\/(.+)\/([^/]+)\/tarball$/);
+  if (mirrorTarball && req.method === "GET") {
+    const gate = await requirePaidOrg(req, "Build insurance", corsHeaders);
+    if (gate instanceof Response)
+      return gate;
+    const found = await mirrorStore(registry).fetchArtifact(gate.org, decodeURIComponent(mirrorTarball[1]), decodeURIComponent(mirrorTarball[2]));
+    if (!found) {
+      return Response.json({ error: "Not in your mirror" }, { status: 404, headers: corsHeaders });
+    }
+    return new Response(found.bytes, {
+      headers: {
+        ...corsHeaders,
+        "Content-Type": "application/gzip",
+        "Content-Length": String(found.bytes.byteLength),
+        "X-Pantry-Mirrored-At": found.record.mirroredAt,
+        ...found.record.sha256 ? { "X-Pantry-SHA256": found.record.sha256 } : {},
+        "Cache-Control": "private, max-age=31536000, immutable"
+      }
+    });
+  }
+  if (path6 === "/security/watch" && (req.method === "PUT" || req.method === "POST")) {
+    const gate = await requirePaidOrg(req, "Security alerts", corsHeaders, (t11) => t11.securityAlerts);
+    if (gate instanceof Response)
+      return gate;
+    const body = await req.json().catch(() => null);
+    const entries = normalizeEntries(body?.entries);
+    if (entries.length === 0) {
+      return Response.json({ error: "No usable entries \u2014 send {entries: [{name, version, ecosystem, license}]}" }, { status: 400, headers: corsHeaders });
+    }
+    const list = await securityStore(registry).setWatchList(gate.org, entries, normalizePolicy(body?.policy));
+    return Response.json({ org: gate.org, watched: list.entries.length, policy: list.policy }, { headers: corsHeaders });
+  }
+  if (path6 === "/security/policy" && (req.method === "PUT" || req.method === "POST")) {
+    const gate = await requirePaidOrg(req, "Security alerts", corsHeaders, (t11) => t11.securityAlerts);
+    if (gate instanceof Response)
+      return gate;
+    const policy = normalizePolicy(await req.json().catch(() => null));
+    if (!policy) {
+      return Response.json({ error: "Send {allow: [...]} and/or {deny: [...]}" }, { status: 400, headers: corsHeaders });
+    }
+    const list = await securityStore(registry).setPolicy(gate.org, policy);
+    return Response.json({ org: gate.org, policy: list.policy }, { headers: corsHeaders });
+  }
+  if (path6 === "/security/alerts" && req.method === "GET") {
+    const gate = await requirePaidOrg(req, "Security alerts", corsHeaders, (t11) => t11.securityAlerts);
+    if (gate instanceof Response)
+      return gate;
+    const report = await securityStore(registry).report(gate.org);
+    return Response.json(report, { headers: { ...corsHeaders, "Cache-Control": "no-store" } });
+  }
+  if (path6 === "/sbom" && req.method === "GET") {
+    const gate = await requirePaidOrg(req, "SBOM export", corsHeaders, (t11) => t11.sbomExport);
+    if (gate instanceof Response)
+      return gate;
+    const url = new URL(req.url);
+    const format = parseFormat(url.searchParams.get("format"));
+    let entries = await mirrorStore(registry).list(gate.org);
+    if (entries.length === 0) {
+      const watched = await securityStore(registry).getWatchList(gate.org);
+      entries = watched.entries.map((e11) => ({ ...e11, mirroredAt: watched.updatedAt }));
+    }
+    const document2 = buildSbom(entries, format, {
+      org: gate.org,
+      subject: url.searchParams.get("name") || undefined
+    });
+    return new Response(JSON.stringify(document2, null, 2), {
+      headers: {
+        ...corsHeaders,
+        "Content-Type": "application/json",
+        "Content-Disposition": `attachment; filename="${format === "spdx" ? "sbom.spdx.json" : "sbom.cdx.json"}"`,
+        "Cache-Control": "no-store"
+      }
+    });
+  }
+  return null;
+}
+async function resolvePackageAccess(req, registry, packageName, version3) {
+  const paywall = await registry.metadata.getPaywall(packageName);
+  if (!paywall || !paywall.enabled)
+    return { allowed: true, reason: "no-paywall" };
+  const identity = await identifyReader(req);
+  const record = await registry.getPublisherPackageRecord(packageName);
+  return resolveAccess(registry.metadata, packageName, version3, {
+    userId: identity.userId,
+    token: extractBearerToken(req.headers.get("authorization")),
+    admin: identity.userId === "_admin",
+    org: identity.userId && identity.userId !== "_admin" ? await orgFor(identity.userId) : null
+  }, record?.publishedBy);
+}
+async function handleAdminRoutes(path6, req, auth, corsHeaders) {
+  if (!path6.startsWith("/admin/"))
+    return null;
+  const known = path6 === "/admin/users" || path6 === "/admin/tokens" || path6 === "/admin/tokens/revoke";
+  if (!known || req.method !== "POST")
+    return null;
+  if (!await isAdminRequest(req)) {
+    return Response.json({ error: "Admin authentication required", hint: "Send the registry token: Authorization: Bearer $PANTRY_REGISTRY_TOKEN" }, { status: 401, headers: corsHeaders });
+  }
+  const body = await req.json().catch(() => null);
+  if (!body)
+    return Response.json({ error: "Invalid JSON body" }, { status: 400, headers: corsHeaders });
+  const email = typeof body.email === "string" ? body.email : "";
+  try {
+    if (path6 === "/admin/users") {
+      const user = await auth.upsertUserAccount(email, typeof body.name === "string" ? body.name : "", typeof body.password === "string" ? body.password : "", body.role === "admin" ? "admin" : "user");
+      return Response.json({ success: true, user }, { status: 201, headers: corsHeaders });
+    }
+    if (path6 === "/admin/tokens") {
+      const user = await auth.findUser(email);
+      if (!user)
+        return Response.json({ error: `No such user: ${email}` }, { status: 404, headers: corsHeaders });
+      const valid = ["publish", "read"];
+      const permissions2 = Array.isArray(body.permissions) ? body.permissions.filter((p11) => valid.includes(p11)) : ["read"];
+      const result = await auth.createApiToken(user.email, typeof body.name === "string" ? body.name : "admin-issued", {
+        permissions: permissions2.length > 0 ? permissions2 : ["read"],
+        expiresInDays: typeof body.expiresInDays === "number" ? body.expiresInDays : undefined
+      });
+      return Response.json({ success: true, ...result }, { status: 201, headers: corsHeaders });
+    }
+    const id2 = typeof body.id === "string" ? body.id : "";
+    if (!email || !id2)
+      return Response.json({ error: "email and id are required" }, { status: 400, headers: corsHeaders });
+    await auth.deleteApiToken(email.toLowerCase().trim(), id2);
+    return Response.json({ success: true }, { headers: corsHeaders });
+  } catch (err) {
+    const status = err instanceof AuthError ? err.status : 400;
+    return Response.json({ error: err.message }, { status, headers: corsHeaders });
+  }
+}
 async function handlePublish(req, registry, corsHeaders) {
   const contentType = req.headers.get("content-type") || "";
   const authHeader = req.headers.get("authorization");
@@ -101986,8 +103803,17 @@ async function handlePublish(req, registry, corsHeaders) {
     const metaErr = validateMetadataLimits(metadata);
     if (metaErr)
       return Response.json({ error: metaErr }, { status: 400, headers: corsHeaders });
-    if (tarballFile.size > 52428800) {
-      return Response.json({ error: "Tarball exceeds maximum size of 50MB" }, { status: 413, headers: corsHeaders });
+    const notYours = await requirePublishRights(registry, authResult.userId, metadata.name, corsHeaders);
+    if (notYours)
+      return notYours;
+    const publisherTier = await tierForPackage(registry, metadata.name, authResult.userId);
+    const maxBytes = tierDefinition(publisherTier).maxArtifactBytes;
+    if (tarballFile.size > maxBytes) {
+      const mb3 = (bytes) => `${Math.round(bytes / 1048576)}MB`;
+      return Response.json({
+        error: `Tarball is ${mb3(tarballFile.size)}, over the ${mb3(maxBytes)} limit for the ${tierDefinition(publisherTier).name} plan`,
+        ...publisherTier === "free" ? { hint: "Pro raises this to 250MB, Team to 1GB: pantry subscribe pro" } : {}
+      }, { status: 413, headers: corsHeaders });
     }
     const exists = await registry.exists(metadata.name, metadata.version);
     if (exists) {
@@ -102015,6 +103841,9 @@ async function handlePublish(req, registry, corsHeaders) {
     const jsonVersionErr = validatePublishVersion(metadata.version);
     if (jsonVersionErr)
       return Response.json({ error: jsonVersionErr }, { status: 400, headers: corsHeaders });
+    const notYoursJson = await requirePublishRights(registry, authResult.userId, metadata.name, corsHeaders);
+    if (notYoursJson)
+      return notYoursJson;
     const jsonMetaErr = validateMetadataLimits(metadata);
     if (jsonMetaErr)
       return Response.json({ error: jsonMetaErr }, { status: 400, headers: corsHeaders });
@@ -102142,10 +103971,25 @@ function extractSessionToken(req) {
   const match = cookie.match(/pantry_session=([^;]+)/);
   return match ? match[1] : null;
 }
+function safeRedirectTarget(value) {
+  if (!value || !value.startsWith("/") || value.startsWith("//"))
+    return null;
+  return value;
+}
+function signupRejection(email) {
+  if (!signupsEnabled())
+    return "Signups are closed on this registry \u2014 ask an operator for an account";
+  if (!isSignupEmailAllowed(email))
+    return "That email domain is not allowed to sign up on this registry";
+  return null;
+}
 async function handleAuthRoutes(path6, req, auth, corsHeaders) {
   if (path6 === "/auth/signup" && req.method === "POST") {
     try {
       const body = await req.json();
+      const rejection = signupRejection(body.email || "");
+      if (rejection)
+        return Response.json({ error: rejection }, { status: 403, headers: corsHeaders });
       await auth.signup(body.email || "", body.name || "", body.password || "");
       const { sessionToken, user: loggedInUser } = await auth.login(body.email || "", body.password || "");
       return new Response(JSON.stringify({ success: true, user: loggedInUser, sessionToken }), {
@@ -102276,11 +104120,12 @@ async function handleSiteAuth(path6, req, auth, corsHeaders) {
         const email = formData.get("email") || "";
         const password = formData.get("password") || "";
         const { sessionToken: sessionToken2 } = await auth.login(email, password);
+        const next = safeRedirectTarget(formData.get("next") || new URL(req.url).searchParams.get("next"));
         return new Response(null, {
           status: 302,
           headers: {
             ...htmlHeaders,
-            Location: "/account",
+            Location: next || "/account",
             "Set-Cookie": `pantry_session=${sessionToken2}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=2592000`
           }
         });
@@ -102300,12 +104145,20 @@ async function handleSiteAuth(path6, req, auth, corsHeaders) {
     return new Response(html, { headers: htmlHeaders });
   }
   if (path6 === "/signup") {
+    if (!signupsEnabled()) {
+      return new Response(null, { status: 302, headers: { ...htmlHeaders, Location: "/login" } });
+    }
     if (req.method === "POST") {
       try {
         const formData = await req.formData();
         const email = formData.get("email") || "";
         const name = formData.get("name") || "";
         const password = formData.get("password") || "";
+        const rejection = signupRejection(email);
+        if (rejection) {
+          const html2 = await renderSitePage("signup.stx", { error: escapeHtml4(rejection), title: "Sign Up" });
+          return new Response(html2, { status: 403, headers: htmlHeaders });
+        }
         await auth.signup(email, name, password);
         const { sessionToken: sessionToken2 } = await auth.login(email, password);
         return new Response(null, {
@@ -102371,14 +104224,16 @@ async function requireSessionUser(req, auth) {
 function isSiteAdmin(user) {
   return user.role === "admin";
 }
-function canManagePackage(pkg, user) {
+async function canManagePackage(pkg, user) {
   if (!pkg)
     return false;
   if (isSiteAdmin(user))
     return true;
   if (!pkg.publishedBy)
     return true;
-  return pkg.publishedBy === user.email;
+  if (pkg.publishedBy === user.email)
+    return true;
+  return _authService ? _authService.canActFor(user.email, pkg.publishedBy) : false;
 }
 async function handlePublisherApi(path6, req, registry, analyticsStorage, auth, corsHeaders) {
   if (!path6.startsWith("/publisher/api/"))
@@ -102397,16 +104252,75 @@ async function handlePublisherApi(path6, req, registry, analyticsStorage, auth,
     const packages = await registry.listPublisherPackages(user.email, admin ? 200 : 50, admin);
     return Response.json({ packages, admin }, { headers: corsHeaders });
   }
+  const paywallMatch = path6.match(/^\/publisher\/api\/packages\/(.+)\/paywall$/);
+  if (paywallMatch) {
+    const name = decodeURIComponent(paywallMatch[1]);
+    const record = await registry.getPublisherPackageRecord(name);
+    if (!record || !await canManagePackage(record, user)) {
+      return Response.json({ error: "Package not found or access denied" }, { status: 403, headers: corsHeaders });
+    }
+    if (req.method === "GET") {
+      const paywall = await registry.metadata.getPaywall(name);
+      return Response.json({
+        paywall: paywall && paywall.enabled ? {
+          enabled: true,
+          price: paywall.price,
+          currency: paywall.currency,
+          formattedPrice: formatPrice(paywall.price, paywall.currency),
+          freeVersions: paywall.freeVersions || [],
+          payoutAccountId: paywall.stripeAccountId
+        } : { enabled: false },
+        paymentsEnabled: paymentsEnabled()
+      }, { headers: { ...corsHeaders, "Cache-Control": "no-store" } });
+    }
+    if (req.method === "PUT" || req.method === "POST") {
+      let body;
+      try {
+        body = await req.json();
+      } catch {
+        return Response.json({ error: "Invalid JSON" }, { status: 400, headers: corsHeaders });
+      }
+      const invalid = validatePriceConfig(body);
+      if (invalid)
+        return Response.json({ error: invalid }, { status: 400, headers: corsHeaders });
+      if (!record.publishedBy && !admin) {
+        await registry.claimPublisherPackage(name, user.email);
+      }
+      try {
+        const paywall = await configurePaywall(registry.metadata, name, body);
+        return Response.json({
+          paywall: {
+            enabled: paywall.enabled,
+            price: paywall.price,
+            currency: paywall.currency,
+            formattedPrice: formatPrice(paywall.price, paywall.currency),
+            freeVersions: paywall.freeVersions || [],
+            payoutAccountId: paywall.stripeAccountId
+          },
+          paymentsEnabled: paymentsEnabled()
+        }, { headers: corsHeaders });
+      } catch (err) {
+        return Response.json({ error: err.message || "Could not set the price" }, { status: 400, headers: corsHeaders });
+      }
+    }
+    if (req.method === "DELETE") {
+      await registry.metadata.deletePaywall(name);
+      return Response.json({ paywall: { enabled: false } }, { headers: corsHeaders });
+    }
+  }
   const pkgMatch = path6.match(/^\/publisher\/api\/packages\/(.+)$/);
   if (pkgMatch) {
     const name = decodeURIComponent(pkgMatch[1]);
     if (req.method === "GET") {
       const record = await registry.getPublisherPackageRecord(name);
-      if (!record || !canManagePackage(record, user)) {
+      if (!record || !await canManagePackage(record, user)) {
         return Response.json({ error: "Package not found or access denied" }, { status: 403, headers: corsHeaders });
       }
       const stats = await analyticsStorage.getPackageStats(name);
       const commits = await registry.getPackageCommits(name, 15);
+      const tier = await auth.getTier(user.email);
+      const retentionDays = tierDefinition(tier).analyticsRetentionDays;
+      const timeline = await analyticsStorage.getDownloadTimeline(name, retentionDays);
       return Response.json({
         package: record,
         stats: {
@@ -102414,12 +104328,14 @@ async function handlePublisherApi(path6, req, registry, analyticsStorage, auth,
           downloads30d: stats?.monthlyDownloads ?? 0,
           weeklyDownloads: stats?.weeklyDownloads ?? 0
         },
+        timeline,
+        analytics: { tier, retentionDays, truncated: retentionDays < 3650 },
         commits
       }, { headers: corsHeaders });
     }
     if (req.method === "PATCH") {
       const record = await registry.getPublisherPackageRecord(name);
-      if (!record || !canManagePackage(record, user)) {
+      if (!record || !await canManagePackage(record, user)) {
         return Response.json({ error: "Package not found or access denied" }, { status: 403, headers: corsHeaders });
       }
       let body;
@@ -102431,7 +104347,19 @@ async function handlePublisherApi(path6, req, registry, analyticsStorage, auth,
       if (!record.publishedBy && !admin) {
         await registry.claimPublisherPackage(name, user.email);
       }
-      const updated = await registry.updatePublisherPackage(name, user.email, {
+      const settings = body.settings;
+      if (settings?.visibility === "unlisted" && !admin) {
+        const tier = await auth.getTier(user.email);
+        if (!tierDefinition(tier).privatePackages) {
+          return Response.json({
+            error: "Unlisted packages are a Pro feature",
+            hint: "Subscribe at /pricing, or with: pantry subscribe pro",
+            tier
+          }, { status: 402, headers: corsHeaders });
+        }
+      }
+      const actingAs = record.publishedBy && record.publishedBy !== user.email && _authService && await _authService.canActFor(user.email, record.publishedBy) ? record.publishedBy : user.email;
+      const updated = await registry.updatePublisherPackage(name, actingAs, {
         description: body.description,
         homepage: body.homepage,
         repository: body.repository,
@@ -103592,6 +105520,15 @@ async function handleSitePackage(name, analytics, binaryStorage, registry, zigSt
   const aliased = _aliases.get(name);
   if (aliased && aliased !== name)
     name = aliased;
+  const paywall = registry ? await registry.metadata.getPaywall(name).catch(() => null) : null;
+  const paidProps = paywall?.enabled ? {
+    isPaid: true,
+    priceLabel: formatPrice(paywall.price, paywall.currency),
+    buyUrl: `/packages/${encodeURIComponent(name)}/buy`,
+    freeVersionList: (paywall.freeVersions || []).join(", "),
+    hasFreeVersions: (paywall.freeVersions || []).length > 0
+  } : { isPaid: false, priceLabel: "", buyUrl: "", freeVersionList: "", hasFreeVersions: false };
+  const renderPackagePage = (props) => renderSitePage("package.stx", { ...paidProps, ...props });
   const safeName = escapeHtml4(name);
   const encodedName = encodeURIComponent(name);
   const [rawMeta, stats, timeline, pkgInfo, zigPkg, phpPkg] = await Promise.all([
@@ -103613,7 +105550,7 @@ async function handleSitePackage(name, analytics, binaryStorage, registry, zigSt
     packagistPkg = await fetchFromPackagist(name).catch(() => null);
   }
   if (!meta && !pkgInfo && !zigPkg && !phpPkg && !packagistPkg) {
-    const html2 = await renderSitePage("package.stx", {
+    const html2 = await renderPackagePage({
       name,
       safeName,
       encodedName,
@@ -103636,7 +105573,7 @@ async function handleSitePackage(name, analytics, binaryStorage, registry, zigSt
     const zigTimeline = (timeline || []).map((d10) => ({ date: d10.date, count: d10.count || 0 }));
     const zigLineChart = generateLineChart(zigTimeline, 700, 200);
     const zigStats = stats || { totalDownloads: 0, weeklyDownloads: 0, monthlyDownloads: 0, versionDownloads: {} };
-    const html2 = await renderSitePage("package.stx", {
+    const html2 = await renderPackagePage({
       name,
       safeName,
       encodedName,
@@ -103674,7 +105611,7 @@ async function handleSitePackage(name, analytics, binaryStorage, registry, zigSt
     const phpLineChart = generateLineChart(phpTimeline, 700, 200);
     const phpStats = stats || { totalDownloads: 0, weeklyDownloads: 0, monthlyDownloads: 0, versionDownloads: {} };
     const phpDeps = phpPkg.require ? Object.keys(phpPkg.require).filter((d10) => d10 !== "php") : [];
-    const html2 = await renderSitePage("package.stx", {
+    const html2 = await renderPackagePage({
       name,
       safeName,
       encodedName,
@@ -103712,7 +105649,7 @@ async function handleSitePackage(name, analytics, binaryStorage, registry, zigSt
     const pkgStats = stats || { totalDownloads: 0, weeklyDownloads: 0, monthlyDownloads: 0, versionDownloads: {} };
     const pkgDeps = Object.keys(packagistPkg.require || {}).filter((d10) => d10 !== "php" && !d10.startsWith("ext-"));
     const pkgVersions = packagistPkg.versions || [];
-    const html2 = await renderSitePage("package.stx", {
+    const html2 = await renderPackagePage({
       name,
       safeName,
       encodedName,
@@ -103783,7 +105720,7 @@ async function handleSitePackage(name, analytics, binaryStorage, registry, zigSt
     const versionItems = Object.entries(versionDownloads).map(([label, value]) => ({ label, value })).sort((a11, b11) => b11.value - a11.value).slice(0, 8);
     const versionDistribution = generateHorizontalBarChart(versionItems, 600, 28, 6, 120);
     const pkgDescription = meta.description || `${name} \u2014 ${versionCount} versions available for macOS and Linux`;
-    const html2 = await renderSitePage("package.stx", {
+    const html2 = await renderPackagePage({
       name,
       safeName,
       encodedName,
@@ -103820,7 +105757,7 @@ async function handleSitePackage(name, analytics, binaryStorage, registry, zigSt
   const fbStats = stats || { totalDownloads: pkgInfo?.downloads || 0, weeklyDownloads: 0, monthlyDownloads: 0, versionDownloads: {} };
   const fbVersion = pkgInfo?.version || "unknown";
   const fbVersions = fbVersion !== "unknown" ? [fbVersion] : [];
-  const html = await renderSitePage("package.stx", {
+  const html = await renderPackagePage({
     name,
     safeName,
     encodedName,
@@ -104366,6 +106303,8 @@ function rewritePackageJsonContent(content, packageDir) {
 export {
   verifyPassword,
   validateZigHash,
+  signupsEnabled,
+  setPlugins,
   searchPackagist,
   searchNpm,
   rewriteWorkspaceRanges,
@@ -104374,14 +106313,25 @@ export {
   rewriteCatalogRanges,
   resolveWorkspaceSpec,
   resolveWorkspacePackages,
+  resolveVisibility,
+  resetPlugins,
+  registryInfo,
   readWorkspaceGlobsFromManifest,
   readWorkspaceGlobs,
+  pluginsAuthorize,
+  pluginSpecifiers,
+  pluginResponse,
+  pluginAccessVerdict,
   parseZigZon,
   parseComposerJson,
   manifestUsesWorkspaceProtocol,
   manifestUsesCatalogProtocol,
+  loadPlugins,
+  loadPlugin,
   listNpmVersions,
   isUserApiToken,
+  isSignupEmailAllowed,
+  isPublicPath,
   hashToken,
   hashPassword,
   handleStripeWebhook,
@@ -104395,6 +106345,9 @@ export {
   findWorkspaceRoot,
   fetchFromPackagist,
   fetchFromNpm,
+  extraPublicPaths,
+  enforceReadAccess,
+  emitPluginEvent,
   downloadNpmTarball,
   createZigStorage,
   createServer,
@@ -104411,6 +106364,7 @@ export {
   computeZigHash,
   computePhpChecksum,
   checkPaywallAccess,
+  allowedSignupDomains,
   WORKSPACE_RANGE_SECTIONS,
   UnresolvableWorkspaceDependencyError,
   UnresolvableCatalogDependencyError,