feat: deploy registry to AWS Lambda and migrate to registry.pantry.dev

- Add Lambda handler adapting API Gateway v2 events to registry handler
- Extract shared fetch handler from Bun server for Lambda reuse
- Deploy Lambda function + API Gateway HTTP API (pantry-registry)
- Add deploy-registry.yml workflow for CI deployments
- Replace all registry.stacksjs.com/org/pantry.sh URLs with registry.pantry.dev
- Add build:lambda and deploy scripts to registry package.json

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: chrisbbreuer

.github/workflows/deploy-registry.yml

@@ -0,0 +1,72 @@
+name: Deploy Registry
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'packages/registry/src/**'
+  workflow_dispatch:
+
+jobs:
+  deploy:
+    name: Deploy to Lambda
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+
+      - name: Build Lambda bundle
+        run: |
+          cd packages/registry
+          bun build src/lambda.ts --outfile dist/lambda.mjs --target node --minify
+          cd dist && zip -j lambda.zip lambda.mjs
+          echo "Bundle size: $(wc -c < lambda.zip) bytes"
+
+      - name: Deploy to AWS Lambda
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_REGION: us-east-1
+        run: |
+          aws lambda update-function-code \
+            --function-name pantry-registry \
+            --zip-file fileb://packages/registry/dist/lambda.zip \
+            --region us-east-1 \
+            --query 'LastModified' --output text
+
+      - name: Verify deployment
+        run: |
+          sleep 5
+          HTTP_CODE=$(curl -sS -o /dev/null -w '%{http_code}' \
+            'https://registry.pantry.dev/health' \
+            --max-time 15 2>/dev/null) || true
+          echo "Health check: HTTP $HTTP_CODE"
+          if [ "$HTTP_CODE" != "200" ]; then
+            echo "::warning::Health check returned $HTTP_CODE (custom domain may not be configured yet)"
+          fi
+
+  notify:
+    name: Discord notification
+    needs: deploy
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/discord-notify
+        with:
+          title: "Registry Deploy — ${{ needs.deploy.result == 'success' && 'Deployed' || needs.deploy.result == 'cancelled' && 'Cancelled' || 'Failed' }}"
+          description: "Registry Lambda function updated"
+          status: ${{ needs.deploy.result == 'success' && 'success' || needs.deploy.result == 'cancelled' && 'warning' || 'failure' }}
+          fields: |
+            [
+              {"name": "Branch", "value": "${{ github.ref_name }}", "inline": true},
+              {"name": "Actor", "value": "${{ github.actor }}", "inline": true}
+            ]
+          webhook_url: ${{ secrets.DISCORD_WEBHOOK_URL }}

.github/workflows/health-monitor.yml

@@ -22,7 +22,7 @@ jobs:
           # Use a temp file to isolate the HTTP code from error output
           HTTP_CODE=$(curl -sS -o /tmp/health-response -w '%{http_code}' \
             --max-time 15 \
-            'https://registry.stacksjs.com/health' 2>/dev/null) || true
+            'https://registry.pantry.dev/health' 2>/dev/null) || true
           # Extract only the last 3 chars (the HTTP code) in case of any prefix noise
           HTTP_CODE="${HTTP_CODE: -3}"
           echo "http_code=$HTTP_CODE" >> "$GITHUB_OUTPUT"

README.md

@@ -386,7 +386,7 @@ Each published package gets an install URL tied to the commit SHA:
 
 ```bash
 # Install a specific commit's package
-npm install https://registry.stacksjs.org/commits/abc1234/@scope/my-package/tarball
+npm install https://registry.pantry.dev/commits/abc1234/@scope/my-package/tarball
 ```
 
 **GitHub Actions integration** — replace `pkg-pr-new` in your CI:

docs/OIDC_AUTHENTICATION.md

@@ -173,7 +173,7 @@ pantry publish --no-oidc
 pantry publish --dry-run
 
 # Specify custom registry
-pantry publish --registry https://registry.pantry.sh
+pantry publish --registry https://registry.pantry.dev
 
 # Disable provenance generation
 pantry publish --no-provenance

docs/OIDC_IMPLEMENTATION.md

@@ -228,7 +228,7 @@ pantry publish --dry-run
 pantry publish --no-oidc
 
 # Custom registry
-pantry publish --registry https://registry.pantry.sh
+pantry publish --registry https://registry.pantry.dev
 
 # Disable provenance
 pantry publish --no-provenance

docs/OIDC_IMPLEMENTATION_SUMMARY.md

@@ -181,7 +181,7 @@ pantry publish --dry-run
 pantry publish --no-oidc
 
 # Custom registry
-pantry publish --registry https://registry.pantry.sh
+pantry publish --registry https://registry.pantry.dev
 
 # Disable provenance
 pantry publish --no-provenance

docs/features/commit-publishing.md

@@ -24,7 +24,7 @@ pantry publish:commit ./my-package
 Each published package gets an install URL:
 
 ```
-https://registry.stacksjs.org/commits/abc1234/@scope/my-package/tarball
+https://registry.pantry.dev/commits/abc1234/@scope/my-package/tarball
 ```
 
 ## Usage
@@ -66,7 +66,7 @@ Private packages (those with `"private": true` in `package.json`) are automatica
 
 | Option | Description | Default |
 |--------|-------------|---------|
-| `--registry <url>` | Registry URL to publish to | `https://registry.stacksjs.org` |
+| `--registry <url>` | Registry URL to publish to | `https://registry.pantry.dev` |
 | `--token <token>` | Authentication token | `PANTRY_TOKEN` env var |
 | `--dry-run` | Preview what would be published without uploading | `false` |
 | `--compact` | Minimal output suitable for CI environments | `false` |
@@ -135,10 +135,10 @@ Published commit packages can be installed using standard package managers:
 
 ```bash
 # Install via npm/bun/yarn/pnpm
-npm install https://registry.stacksjs.org/commits/abc1234/@scope/package/tarball
+npm install https://registry.pantry.dev/commits/abc1234/@scope/package/tarball
 
 # Or for unscoped packages
-npm install https://registry.stacksjs.org/commits/abc1234/my-package/tarball
+npm install https://registry.pantry.dev/commits/abc1234/my-package/tarball
 ```
 
 ## Registry API
@@ -156,10 +156,10 @@ The Pantry registry provides these endpoints for commit packages:
 
 ```bash
 # List all packages for a commit
-curl https://registry.stacksjs.org/commits/abc1234
+curl https://registry.pantry.dev/commits/abc1234
 
 # Get metadata for a specific package
-curl https://registry.stacksjs.org/commits/abc1234/@scope/my-package
+curl https://registry.pantry.dev/commits/abc1234/@scope/my-package
 ```
 
 ## Architecture

docs/features/package-management.md

@@ -342,7 +342,7 @@ Published packages get install URLs tied to the commit SHA:
 
 ```bash
 # Install from a specific commit
-npm install https://registry.stacksjs.org/commits/abc1234/@scope/package/tarball
+npm install https://registry.pantry.dev/commits/abc1234/@scope/package/tarball
 ```
 
 ### Options

docs/usage.md

@@ -868,7 +868,7 @@ Each published package gets an install URL tied to the commit SHA:
 
 ```bash
 # Install a commit package
-npm install https://registry.stacksjs.org/commits/abc1234/@scope/my-package/tarball
+npm install https://registry.pantry.dev/commits/abc1234/@scope/my-package/tarball
 ```
 
 ### CI/CD Usage
@@ -887,7 +887,7 @@ Replace `pkg-pr-new` in your GitHub Actions:
 
 | Option | Description |
 |--------|-------------|
-| `--registry <url>` | Custom registry URL (default: `https://registry.stacksjs.org`) |
+| `--registry <url>` | Custom registry URL (default: `https://registry.pantry.dev`) |
 | `--token <token>` | Authentication token (or set `PANTRY_TOKEN` env var) |
 | `--dry-run` | Preview without publishing |
 | `--compact` | Minimal output for CI environments |

packages/registry/package.json

@@ -23,7 +23,9 @@
     "test": "bun test",
     "test:analytics": "bun test src/analytics.test.ts",
     "test:commit-publish": "bun test src/commit-publish.test.ts",
-    "typecheck": "bun --bun tsc --noEmit"
+    "typecheck": "bun --bun tsc --noEmit",
+    "build:lambda": "bun build src/lambda.ts --outfile dist/lambda.mjs --target node --minify && cd dist && zip -j lambda.zip lambda.mjs",
+    "deploy": "bun run build:lambda && aws lambda update-function-code --function-name pantry-registry --zip-file fileb://dist/lambda.zip --region us-east-1"
   },
   "dependencies": {},
   "devDependencies": {