pakx-web

Marketing site for pakx — deployed at pakx.dev. Static landing + federated browse + docs + status + legal.

The signed-in dashboard and API live in a separate repo at pakxdev/pakx-registry, served from registry.pakx.dev.

Stack

• Next.js 16 (App Router, Turbopack)
• React 19
• Tailwind CSS v4 (CSS-first, no postcss config)
• Geist sans + mono via next/font
• Nonce-based CSP via src/middleware.ts
• Cross-origin federated reader at src/lib/registry.ts (MCP Registry + Smithery + pakx-registry)

Routes

Path	Render	Purpose
/	static	Landing — hero, install snippets, manifest preview, crates table
/explore	dynamic	Federated registry browser (forwards ?q= to all three upstreams)
/p/[source]/[...id]	dynamic	Package detail (versions, install snippet, raw metadata)
/docs	static	Six-step quickstart
/pricing	static	Three-tier pricing + FAQ
/status	dynamic	Live registry health probe
/terms	static	Terms of Service
/privacy	static	Privacy Policy
/opengraph-image	dynamic	1200×630 PNG via next/og for social cards
/install.sh	static	POSIX installer (downloads + sha256-verifies prebuilt)
/install.ps1	static	Windows installer (same)
/.well-known/security.txt	static	RFC 9116 disclosure contacts
/robots.txt, /sitemap.xml	static	Crawler metadata

Security

• Nonce-based CSP with 'strict-dynamic', frame-ancestors 'none', upgrade-insecure-requests. Allowlists the three federated registry origins in connect-src so /explore and /status keep working.
• Hardening headers: X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy denying camera/mic/geolocation/FLoC, HSTS one-year preload.
• npm audit 0 (postcss override to ^8.5.15).
• Disclosures via GitHub Security Advisory or security@pakx.dev.

Develop

npm install
npm run dev    # http://localhost:3000
npm run lint   # eslint
npm run build  # production build

Local next dev panics in the Turbopack PostCSS subprocess on some Windows boxes (DLL exit 0xc0000142). Production next build works fine; use that for local verification when dev refuses to start.

Deploy

Push to main → Vercel runs the deploy automatically. Custom domain pakx.dev configured in Vercel project settings; DNS lives at the registrar.

GitHub Actions is temporarily disabled across the pakx repos to control CI billing. Vercel previews still run on every PR.

Related repos

• pakxdev/pakx — the CLI itself
• pakxdev/pakx-registry — backend (live at registry.pakx.dev)
• pakxdev/homebrew-tap — brew install pakxdev/tap/pakx
• pakxdev/scoop-pakx — scoop bucket add pakx ...

License

MIT — see LICENSE (or the root pakx repo).