pakx-registry

Federated package registry backend for pakx. Phase B of the SaaS roadmap.

Hosts the metadata + tarballs that pakx publish writes and that pakx install resolves when it can't find a package on the public federated sources (Official MCP Registry, Smithery, GitHub raw).

Status

v0 — scaffolded. Schema, NextAuth, API key management, and the full /api/v1/packages CRUD surface are implemented. Deployment to Vercel + first CLI integration (Phase C) are the next milestones.

Stack

• Next.js 16 (App Router)
• Drizzle ORM against Neon Serverless Postgres (HTTP driver on Vercel; pg for local dev — driver is auto-selected in lib/db/index.ts).
• Auth.js v5 with the GitHub provider.
• Vercel Blob for tarball storage.
• zod for request validation.

v0 API

GET    /api/v1/packages?q=…&limit=…
GET    /api/v1/packages/:owner/:name
GET    /api/v1/packages/:owner/:name/:version
PUT    /api/v1/packages/:owner/:name/:version   (Bearer pakx_v1_…)
DELETE /api/v1/packages/:owner/:name/:version   (Bearer pakx_v1_…)
POST   /api/v1/packages                          (Bearer pakx_v1_…)

GET    /api/v1/whoami                            (Bearer pakx_v1_…)
GET    /api/v1/tokens                            (session)
POST   /api/v1/tokens                            (session)
DELETE /api/v1/tokens/:id                        (session)

Local dev

cp .env.example .env
# fill in DATABASE_URL, AUTH_SECRET, AUTH_GITHUB_ID, AUTH_GITHUB_SECRET
pnpm install
pnpm exec drizzle-kit push           # apply schema to your Postgres
pnpm dev                              # http://localhost:3000

Generate AUTH_SECRET with pnpm dlx auth secret.

GitHub OAuth app — register at github.com/settings/apps with callback URL http://localhost:3000/api/auth/callback/github for local dev (plus the production callback when you deploy).

Deploy

vercel link
vercel env pull .env.production.local
vercel --prod

After the first deploy, attach a Neon Postgres + Vercel Blob from the Vercel Storage tab. The lib/db driver auto-detects Neon URLs.

CLI integration (Phase C)

Once this service is live, the pakx CLI gains:

• pakx login — GitHub OAuth device flow → POST /api/v1/tokens with session → store pakx_v1_… in ~/.pakx/credentials.
• pakx whoami — GET /api/v1/whoami with the stored bearer.
• pakx pack — build a tarball from the local skill bundle.
• pakx publish — POST /api/v1/packages + PUT tarball to /api/v1/packages/:owner/:name/:version.
• pakx unpublish — DELETE /api/v1/packages/:owner/:name/:version (with the same 72h grace-period rule as npm).

License

MIT — see LICENSE (or root pakx repo if not yet copied).