warp_engine 0.5.1: the device_grants migration collided with the host's

`db:migrate` on the catalog API stopped before running anything: Multiple migrations have the version number 20260819000001. The engine appends its `db/migrate` to the host's migration paths instead of copying migrations in, so engine and host share one version namespace. Both had picked 20260819000001 on the same day by the same habit — the engine for device_grants, apps/api for carry_the_store_config_in_the_registry — and neither repository could see the other's number. Worse than a clash of our own making: it takes the *host's* migrations down with it, for the whole application, before anything runs. device_grants is renumbered to 20260819093412 — a real second-resolution timestamp, which is the actual defence. A round hand-written number is precisely what another repository lands on. Nothing had run it in production, so this is a rename rather than a data migration; a host that already applied the old version renumbers its schema_migrations row. The older engine migrations keep their round numbers: renumbering one that has been deployed everywhere is worse than the risk it carries. They are named in the new spec's grandfather list rather than excused by a rule that would also let the next one through. That spec found a second thing, older than this change: the install template creates `application_tokens`, and so does one of our own migrations — so a fresh host runs CREATE TABLE twice and has to delete the block from its generated copy by hand, which is exactly what teletype-orbit's migration header describes. I had just made it worse by putting device_grants in the template too; that is out again, and the template says why. `application_tokens` is grandfathered and left for a change that is not a hotfix. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
README: the registry example named the wrong org
2026-08-19 11:29:53 +02:00 · 2026-08-19 11:20:53 +02:00 · 2026-08-19 10:36:30 +02:00 · 2026-08-19 10:26:28 +02:00 · 2026-08-19 08:45:25 +02:00 · 2026-08-19 07:19:52 +02:00
163 changed files with 8095 additions and 1721 deletions
@@ -1,10 +1,10 @@
 # Read-only split mirror: a libs/ruby/warp_engine alkönyvtárat kitükrözi a
-# tools/warp_engine repóba (fejlesztés itt, a monorepóban történik; a tükör
+# engines/warp_engine repóba (fejlesztés itt, a monorepóban történik; a tükör
 # csak publikálásra való). Tag-elt release (warp_engine-v*) esetén a gem a
 # Forgejo rubygems registry-be is felmegy.
 #
 # Szükséges Woodpecker secret: forge_token — Forgejo access token
-# repository:write (tools/warp_engine) és package:write joggal.
+# repository:write (engines/warp_engine) és package:write joggal.

 when:
  - event: push
@@ -21,7 +21,37 @@ clone:
      partial: false
      depth: 0 # a subtree splithez teljes history kell

+services:
+  - name: mysql
+    image: mysql:8
+    environment:
+      MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
+      MYSQL_DATABASE: warp_engine_test
+
 steps:
+  # A motor tesztje kapuzza a tobbit: ha bukik, se a tukrozes, se a gem
+  # kiadasa nem fut le. A mirror repoba nincs ertelme CI-t tenni, mert azt a
+  # subtree split minden alkalommal feluliria.
+  test-engine:
+    image: ruby:3.2
+    environment:
+      RAILS_ENV: test
+      DB_HOST: mysql
+    commands:
+      - apt-get update && apt-get install -y --no-install-recommends default-libmysqlclient-dev
+      - cd libs/ruby/warp_engine
+      - bundle install --jobs 4
+      - |
+        echo "==> Varakozas a mysql-re"
+        for i in $(seq 1 60); do
+          if mysqladmin ping -h mysql --silent 2>/dev/null; then break; fi
+          sleep 2
+        done
+      - |
+        echo "==> Teszt adatbazis elokeszitese"
+        bundle exec rake app:db:test:prepare
+      - bundle exec rspec
+
  split-mirror:
    image: alpine/git
    environment:
@@ -32,7 +62,7 @@ steps:
      - git subtree split --prefix=libs/ruby/warp_engine HEAD -b warp-engine-split
      # a secretbe másolt token végén lehet sortörés — levágjuk
      - TOKEN="$$(printf '%s' "$${FORGE_TOKEN}" | tr -d '[:space:]')"
-      - git push --force "https://ci:$${TOKEN}@git.teletypegames.org/tools/warp_engine.git" warp-engine-split:master
+      - git push --force "https://ci:$${TOKEN}@git.teletypegames.org/engines/warp_engine.git" warp-engine-split:master
    when:
      - event: push
        branch: master
@@ -48,10 +78,15 @@ steps:
      - gem build warp_engine.gemspec
      - mkdir -p ~/.gem
      - TOKEN="$$(printf '%s' "$${FORGE_TOKEN}" | tr -d '[:space:]')"
+      # Nevesített kulcs, nem a hoszt-URL: a RubyGems a credentials fájl
+      # kulcsait normalizálja (a pontokból __ lesz, záró perjelet kap), így egy
+      # URL-kulcs sosem egyezik a --host értékével. Ilyenkor a gem push
+      # bejelentkezni próbál a RubyGems sign_in végpontján, amit a Gitea nem
+      # ismer — ez adta a "404 page not found"-ot.
      - |
-        printf -- '---\n:https://git.teletypegames.org/api/packages/tools/rubygems: Bearer %s\n' "$${TOKEN}" > ~/.gem/credentials
+        printf -- '---\n:gitea: Bearer %s\n' "$${TOKEN}" > ~/.gem/credentials
      - chmod 600 ~/.gem/credentials
-      - gem push --host https://git.teletypegames.org/api/packages/tools/rubygems warp_engine-*.gem
+      - gem push --key gitea --host https://git.teletypegames.org/api/packages/engines/rubygems warp_engine-*.gem
    when:
      - event: tag
        ref: refs/tags/warp_engine-v*
@@ -21,8 +21,47 @@ The API is split in two layers:
  (`/api/software*`, `/api/builds*`, `/api/image`, `/api/download`, `/file/*`)
  and the catalog ActiveAdmin resources. See its [README](libs/ruby/warp_engine/README.md).
 - **The host app** (`apps/api`) owns everything TTG-specific: members, events,
-  wiki proxy, RSS feeds, Devise/ActiveAdmin authentication, theming and assets.
-  It consumes WarpEngine as a path gem and mounts it at `/`.
+  the store registry, wiki proxy, RSS feeds, Devise/ActiveAdmin authentication,
+  theming and assets. It consumes WarpEngine as a path gem and mounts it at `/`.
+
+## The store registry
+
+`GET /api/stores` lists the stores a client can install from. The desktop
+graphical client reads it on first run, which is why it is **public**: a client has
+nobody to log in as.
+
+```json
+[
+  { "name": "Teletype Games", "catalogUrl": "https://teletypegames.org", "storeRepositoryUrl": null }
+]
+```
+
+A `Store` row has two required fields — `name` and `catalog_url` — plus an
+**optional** `store_repository_url`, maintained from **ActiveAdmin ▸ 🛒 Stores**;
+`db/seeds.rb` creates our own.
+
+**A store does not need a repository.** The store engine's own defaults already
+cover the host-to-asset mapping, the install modes, the platforms and the
+behaviour; what they cannot know is identity — a slug, a name and a catalog — and
+that is what this row carries. With no repository the client derives the slug from
+the catalog host, writes a small config and installs. Given one, it reads that
+repository's `config.json` and points it at `catalog_url`, and that file remains the
+authority on how the store behaves; a repository without a config file is treated
+as no repository at all.
+
+Every WarpEngine API response also carries a `WarpEngine-Version` header — the registry
+above is the host's own endpoint and does not, because it is not part of the engine.
+
+This lives in the host app **on purpose, not in WarpEngine**. The engine serves
+one catalog and has no business knowing which stores exist for it; who ships a
+store for a catalog is a property of the site.
+
+| | |
+|---|---|
+| Model | `apps/api/app/models/store.rb` |
+| Endpoint | `apps/api/app/controllers/api/stores_controller.rb` |
+| Admin | `apps/api/app/admin/stores.rb` |
+| Client | [`warp-engine-client`](https://git.teletypegames.org/stores/warp-engine-client) |

 ## Development environment

@@ -1,7 +1,7 @@
 PATH
  remote: ../libs/ruby/warp_engine
  specs:
-    warp_engine (0.1.0)
+    warp_engine (0.5.0)
      apipie-rails
      blueprinter
      rails (>= 8.0)
@@ -10,31 +10,31 @@ PATH
 GEM
  remote: https://rubygems.org/
  specs:
-    action_text-trix (2.1.18)
+    action_text-trix (2.1.19)
      railties
-    actioncable (8.1.3)
-      actionpack (= 8.1.3)
-      activesupport (= 8.1.3)
+    actioncable (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
      zeitwerk (~> 2.6)
-    actionmailbox (8.1.3)
-      actionpack (= 8.1.3)
-      activejob (= 8.1.3)
-      activerecord (= 8.1.3)
-      activestorage (= 8.1.3)
-      activesupport (= 8.1.3)
+    actionmailbox (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      mail (>= 2.8.0)
-    actionmailer (8.1.3)
-      actionpack (= 8.1.3)
-      actionview (= 8.1.3)
-      activejob (= 8.1.3)
-      activesupport (= 8.1.3)
+    actionmailer (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      mail (>= 2.8.0)
      rails-dom-testing (~> 2.2)
-    actionpack (8.1.3)
-      actionview (= 8.1.3)
-      activesupport (= 8.1.3)
+    actionpack (8.1.3.1)
+      actionview (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      nokogiri (>= 1.8.5)
      rack (>= 2.2.4)
      rack-session (>= 1.0.1)
@@ -42,21 +42,21 @@ GEM
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
      useragent (~> 0.16)
-    actiontext (8.1.3)
+    actiontext (8.1.3.1)
      action_text-trix (~> 2.1.15)
-      actionpack (= 8.1.3)
-      activerecord (= 8.1.3)
-      activestorage (= 8.1.3)
-      activesupport (= 8.1.3)
+      actionpack (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      globalid (>= 0.6.0)
      nokogiri (>= 1.8.5)
-    actionview (8.1.3)
-      activesupport (= 8.1.3)
+    actionview (8.1.3.1)
+      activesupport (= 8.1.3.1)
      builder (~> 3.1)
      erubi (~> 1.11)
      rails-dom-testing (~> 2.2)
      rails-html-sanitizer (~> 1.6)
-    activeadmin (3.5.1)
+    activeadmin (3.5.2)
      arbre (~> 1.2, >= 1.2.1)
      csv
      formtastic (>= 3.1)
@@ -68,22 +68,22 @@ GEM
      ransack (>= 4.0)
    activeadmin_blaze_theme (1.1.0)
      activeadmin (>= 2.0, < 4)
-    activejob (8.1.3)
-      activesupport (= 8.1.3)
+    activejob (8.1.3.1)
+      activesupport (= 8.1.3.1)
      globalid (>= 0.3.6)
-    activemodel (8.1.3)
-      activesupport (= 8.1.3)
-    activerecord (8.1.3)
-      activemodel (= 8.1.3)
-      activesupport (= 8.1.3)
+    activemodel (8.1.3.1)
+      activesupport (= 8.1.3.1)
+    activerecord (8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      timeout (>= 0.4.0)
-    activestorage (8.1.3)
-      actionpack (= 8.1.3)
-      activejob (= 8.1.3)
-      activerecord (= 8.1.3)
-      activesupport (= 8.1.3)
+    activestorage (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      marcel (~> 1.0)
-    activesupport (8.1.3)
+    activesupport (8.1.3.1)
      base64
      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -107,18 +107,18 @@ GEM
    bcrypt (3.1.22)
    bigdecimal (4.1.2)
    blueprinter (1.3.0)
-    bootsnap (1.24.3)
-      msgpack (~> 1.2)
+    bootsnap (1.25.0)
+      msgpack (~> 1.5)
    builder (3.3.0)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.8)
    connection_pool (3.0.2)
-    crass (1.0.6)
-    csv (3.3.5)
+    crass (1.0.7)
+    csv (3.3.6)
    date (3.5.1)
    debug (1.11.1)
      irb (~> 1.10)
      reline (>= 0.3.8)
-    devise (5.0.3)
+    devise (5.0.4)
      bcrypt (~> 3.0)
      orm_adapter (~> 0.1)
      railties (>= 7.0)
@@ -126,7 +126,7 @@ GEM
      warden (~> 1.2.3)
    diff-lcs (1.6.2)
    drb (2.2.3)
-    erb (6.0.4)
+    erb (6.0.7)
    erubi (1.13.1)
    factory_bot (6.6.0)
      activesupport (>= 6.1.0)
@@ -138,19 +138,19 @@ GEM
    formtastic (6.0.0)
      actionpack (>= 7.2.0)
    formtastic_i18n (0.7.0)
-    globalid (1.3.0)
+    globalid (1.4.0)
      activesupport (>= 6.1)
    has_scope (0.9.0)
      actionpack (>= 7.0)
      activesupport (>= 7.0)
-    i18n (1.14.8)
+    i18n (1.15.2)
      concurrent-ruby (~> 1.0)
    inherited_resources (1.14.0)
      actionpack (>= 6.0)
      has_scope (>= 0.6)
      railties (>= 6.0)
      responders (>= 2)
-    io-console (0.8.2)
+    io-console (0.9.1)
    irb (1.18.0)
      pp (>= 0.6.0)
      prism (>= 1.3.0)
@@ -160,7 +160,7 @@ GEM
      rails-dom-testing (>= 1, < 3)
      railties (>= 4.2.0)
      thor (>= 0.14, < 2.0)
-    json (2.19.5)
+    json (2.21.2)
    kaminari (1.2.2)
      activesupport (>= 4.1.0)
      kaminari-actionview (= 1.2.2)
@@ -173,27 +173,27 @@ GEM
      activerecord
      kaminari-core (= 1.2.2)
    kaminari-core (1.2.2)
-    language_server-protocol (3.17.0.5)
+    language_server-protocol (3.17.0.6)
    lint_roller (1.1.0)
    logger (1.7.0)
-    loofah (2.25.1)
+    loofah (2.25.2)
      crass (~> 1.0.2)
      nokogiri (>= 1.12.0)
-    mail (2.9.0)
+    mail (2.9.1)
      logger
      mini_mime (>= 0.1.1)
      net-imap
      net-pop
      net-smtp
-    marcel (1.1.0)
+    marcel (1.2.1)
    mini_mime (1.1.5)
    minitest (6.0.6)
      drb (~> 2.0)
      prism (~> 1.5)
-    msgpack (1.8.0)
+    msgpack (1.8.4)
    mysql2 (0.5.7)
      bigdecimal
-    net-imap (0.6.4)
+    net-imap (0.6.6)
      date
      net-protocol
    net-pop (0.1.2)
@@ -203,23 +203,20 @@ GEM
    net-smtp (0.5.1)
      net-protocol
    nio4r (2.7.5)
-    nokogiri (1.19.3-arm64-darwin)
+    nokogiri (1.19.4-arm64-darwin)
      racc (~> 1.4)
-    nokogiri (1.19.3-x86_64-linux-gnu)
+    nokogiri (1.19.4-x86_64-linux-gnu)
      racc (~> 1.4)
    orm_adapter (0.5.0)
-    parallel (1.28.0)
-    parser (3.3.11.1)
+    parallel (2.1.0)
+    parser (3.3.12.0)
      ast (~> 2.4.1)
      racc
-    pp (0.6.3)
+    pp (0.6.4)
      prettyprint
    prettyprint (0.2.0)
    prism (1.9.0)
-    psych (5.3.1)
-      date
-      stringio
-    puma (8.0.1)
+    puma (8.0.2)
      nio4r (~> 2.0)
    racc (1.8.1)
    rack (3.2.6)
@@ -230,30 +227,30 @@ GEM
      rack (>= 1.3)
    rackup (2.3.1)
      rack (>= 3)
-    rails (8.1.3)
-      actioncable (= 8.1.3)
-      actionmailbox (= 8.1.3)
-      actionmailer (= 8.1.3)
-      actionpack (= 8.1.3)
-      actiontext (= 8.1.3)
-      actionview (= 8.1.3)
-      activejob (= 8.1.3)
-      activemodel (= 8.1.3)
-      activerecord (= 8.1.3)
-      activestorage (= 8.1.3)
-      activesupport (= 8.1.3)
+    rails (8.1.3.1)
+      actioncable (= 8.1.3.1)
+      actionmailbox (= 8.1.3.1)
+      actionmailer (= 8.1.3.1)
+      actionpack (= 8.1.3.1)
+      actiontext (= 8.1.3.1)
+      actionview (= 8.1.3.1)
+      activejob (= 8.1.3.1)
+      activemodel (= 8.1.3.1)
+      activerecord (= 8.1.3.1)
+      activestorage (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      bundler (>= 1.15.0)
-      railties (= 8.1.3)
+      railties (= 8.1.3.1)
    rails-dom-testing (2.3.0)
      activesupport (>= 5.0.0)
      minitest
      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.7.0)
-      loofah (~> 2.25)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (8.1.3)
-      actionpack (= 8.1.3)
-      activesupport (= 8.1.3)
+    railties (8.1.3.1)
+      actionpack (= 8.1.3.1)
+      activesupport (= 8.1.3.1)
      irb (~> 1.13)
      rackup (>= 1.0.0)
      rake (>= 12.2)
@@ -266,12 +263,17 @@ GEM
      activerecord (>= 7.2)
      activesupport (>= 7.2)
      i18n
-    rdoc (7.2.0)
+    rbs (4.1.2)
+      logger
+      prism (>= 1.6.0)
+      tsort
+    rdoc (8.0.0)
      erb
-      psych (>= 4.0.0)
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
      tsort
    regexp_parser (2.12.0)
-    reline (0.6.3)
+    reline (0.7.0)
      io-console (~> 0.5)
    responders (3.2.0)
      actionpack (>= 7.0)
@@ -296,7 +298,7 @@ GEM
    rspec-support (3.13.7)
    rss (0.3.3)
      rexml
-    rubocop (1.86.1)
+    rubocop (1.89.0)
      json (~> 2.3)
      language_server-protocol (~> 3.17.0.2)
      lint_roller (~> 1.1.0)
@@ -307,14 +309,14 @@ GEM
      rubocop-ast (>= 1.49.0, < 2.0)
      ruby-progressbar (~> 1.7)
      unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.49.1)
+    rubocop-ast (1.50.0)
      parser (>= 3.3.7.2)
      prism (~> 1.7)
    rubocop-performance (1.26.1)
      lint_roller (~> 1.1)
      rubocop (>= 1.75.0, < 2.0)
      rubocop-ast (>= 1.47.1, < 2.0)
-    rubocop-rails (2.34.3)
+    rubocop-rails (2.36.0)
      activesupport (>= 4.2.0)
      lint_roller (~> 1.1)
      rack (>= 1.1)
@@ -346,9 +348,8 @@ GEM
      actionpack (>= 6.1)
      activesupport (>= 6.1)
      sprockets (>= 3.0.0)
-    stringio (3.2.0)
    thor (1.5.0)
-    tilt (2.7.0)
+    tilt (2.8.0)
    timeout (0.6.1)
    tsort (0.2.0)
    tzinfo (2.0.6)
@@ -360,11 +361,11 @@ GEM
    useragent (0.16.11)
    warden (1.2.9)
      rack (>= 2.0.9)
-    websocket-driver (0.8.0)
+    websocket-driver (0.8.2)
      base64
      websocket-extensions (>= 0.1.0)
    websocket-extensions (0.1.5)
-    zeitwerk (2.7.5)
+    zeitwerk (2.8.3)

 PLATFORMS
  arm64-darwin-22
@@ -0,0 +1,45 @@
+ActiveAdmin.register Store do
+  permit_params :name, :catalog_url
+
+  menu priority: 5, label: "🛒 Stores"
+
+  index do
+    selectable_column
+    id_column
+    column :name
+    column :catalog_url do |store|
+      link_to store.catalog_url, store.catalog_url, target: "_blank", rel: "noopener"
+    end
+    column :updated_at
+    actions
+  end
+
+  filter :name
+  filter :catalog_url
+
+  show do
+    attributes_table do
+      row :id
+      row :name
+      row :catalog_url do |store|
+        link_to store.catalog_url, store.catalog_url, target: "_blank", rel: "noopener"
+      end
+      row :created_at
+      row :updated_at
+    end
+    para do
+      "Listed by GET /api/stores, which the graphical client reads on first run. A name " \
+        "and a catalog are the whole record: the client carries its own store engine " \
+        "and configures itself from this much, deriving the store's slug from the " \
+        "catalog host."
+    end
+  end
+
+  form do |f|
+    f.inputs do
+      f.input :name, hint: "What the client shows in its store picker"
+      f.input :catalog_url, hint: "Base URL of the WarpEngine catalog, e.g. https://teletypegames.org"
+    end
+    f.actions
+  end
+end
@@ -0,0 +1,23 @@
+class Api::StoresController < ApiController
+  resource_description do
+    short "Stores"
+  end
+
+  api :GET, "/api/stores", "List the stores a client can install from"
+  desc <<~DESC
+    The registry the graphical desktop client reads on first run: which catalogs
+    exist. Public on purpose: a client has nobody to log in as.
+
+    A name and a catalog URL are the whole record. How a store behaves is fixed per
+    installed client — it carries its own store engine and knows its own machine — so
+    the registry says what a store *is* and nothing about how it works.
+  DESC
+  returns code: 200, desc: "Array of stores" do
+    property :name, String, desc: "Display name of the store"
+    property :catalogUrl, String, desc: "Base URL of the WarpEngine catalog it serves"
+
+  end
+  def index
+    render json: StoreService.new.index
+  end
+end
@@ -0,0 +1,25 @@
+# A store a client can install from: a name and a WarpEngine catalog.
+#
+# That is the whole record, and deliberately so. A client takes identity from it — the
+# name, the catalog, and a slug derived from the catalog host — and everything else from
+# the store engine it carries. How a store behaves is fixed per installed client, which
+# knows its own machine; a copy of it here would be a second authority over decisions
+# the client has already made, including which directories it may delete from.
+#
+# This is deliberately not part of WarpEngine. The engine serves one catalog and has no
+# business knowing which stores exist for it; the registry is a property of this site,
+# which is what the graphical client asks.
+class Store < ApplicationRecord
+  URL = %r{\Ahttps?://\S+\z}
+
+  validates :name, presence: true
+  validates :catalog_url, presence: true, format: { with: URL, message: "must be an http(s) URL" }
+
+  default_scope { where(deleted_at: nil) }
+
+  scope :ordered, -> { order(:name) }
+
+  def self.ransackable_attributes(auth_object = nil)
+    %w[id name catalog_url created_at updated_at]
+  end
+end
@@ -0,0 +1,8 @@
+class StoreSerializer < Blueprinter::Base
+  include WarpEngine::TimestampFields
+
+  field :name
+  # camelCase, as the catalog's own payloads use — one convention for a client
+  # that reads both.
+  field(:catalogUrl) { |store| store.catalog_url }
+end
@@ -0,0 +1,5 @@
+class StoreService
+  def index
+    StoreSerializer.render_as_hash(Store.ordered)
+  end
+end
@@ -1,13 +1,36 @@
-# WarpEngine host-konfiguráció. to_prepare: reload után is újrafut, ezért
-# értékadás (nem <<), hogy idempotens legyen.
+# WarpEngine host configuration. to_prepare: re-runs after reloads, hence
+# assignment (not <<) to stay idempotent.
 Rails.application.config.to_prepare do
  WarpEngine.configure do |c|
-    # A /build/* DB-tokenjeinek tulajdonosa. A :database módra váltás
-    # (c.application_token_source = :database) csak azután jöhet, hogy a CI már
-    # DB-tokent használ — az átkapcsolás azonnal érvényteleníti az UPDATE_SECRET-et.
+    # Owner of the /build/* DB tokens. Switching to :database mode
+    # (c.application_token_source = :database) must wait until CI uses DB
+    # tokens — the flip invalidates UPDATE_SECRET immediately.
    c.application_token_source = :database
    c.application_token_owner_class = "AdminUser"

+    # Woodpecker configuration extension (/build/config): the served platforms
+    # and their builder images. An image bump is one line here, rolled out to
+    # every repo by the deploy.
+    c.ci_platforms = {
+      "godot"      => { builder: "git.teletypegames.org/build/godot-builder:4.7.1" },
+      "phaser"     => { builder: "git.teletypegames.org/build/phaser-builder:latest" },
+      "love"       => { builder: "git.teletypegames.org/build/love-builder:latest" },
+      "bevy"       => { builder: "git.teletypegames.org/build/bevy-builder:latest" },
+      "c64"        => { builder: "git.teletypegames.org/build/c64-builder:latest" },
+      "ebitengine" => { builder: "git.teletypegames.org/build/ebitengine-builder:latest" },
+      "tic80"      => { builder: "git.teletypegames.org/build/tic80pro:latest" }
+    }
+    # Explicit URL: request.base_url would yield http:// behind the host nginx
+    # (no X-Forwarded-Proto reaches Rails), and the resulting 301 makes the
+    # pipeline's curl steps silently no-op.
+    c.ci_update_server = "https://teletypegames.org"
+    c.ci_extension_public_key_url = "https://ci.teletypegames.org/api/signature/public-key"
+
+    # Woodpecker CI management (repo sync, secret provisioning, pipeline control)
+    c.woodpecker_url        = ENV["WOODPECKER_URL"]        # e.g. "https://ci.teletypegames.org"
+    c.woodpecker_api_token  = ENV["WOODPECKER_API_TOKEN"]  # Woodpecker PAT with admin access
+    c.woodpecker_repo_owner = ENV["WOODPECKER_REPO_OWNER"] # forge org (e.g. "games")
+
    c.image_owners = [
      {
        label: "member",
@@ -7,6 +7,7 @@ Rails.application.routes.draw do
    get "swagger",              to: "swagger#index"
    get "events",               to: "events#index"
    get "members",              to: "members#index"
+    get "stores",               to: "stores#index"
    get "wiki/pages",           to: "wiki#index"
    get "rss/blog",             to: "rss#blog"
    get "rss/releases",         to: "rss#releases"
@@ -0,0 +1,19 @@
+class CreateStores < ActiveRecord::Migration[8.1]
+  def change
+    create_table :stores, id: { type: :bigint, unsigned: true },
+                          charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci",
+                          if_not_exists: true do |t|
+      # A store is a WarpEngine catalog plus the repository that configures a
+      # client for it. The registry lives here rather than in the engine: the
+      # engine serves one catalog and knows nothing about who ships stores for it.
+      t.string   :name,                 null: false
+      t.string   :catalog_url,          null: false
+      t.string   :store_repository_url, null: false
+      t.datetime :deleted_at, precision: 3
+      t.timestamps            precision: 3
+
+      t.index :deleted_at, name: "idx_stores_deleted_at"
+      t.index :name,       name: "idx_stores_name"
+    end
+  end
+end
@@ -0,0 +1,10 @@
+class AllowStoresWithoutARepository < ActiveRecord::Migration[8.1]
+  # A store repository is now optional. The client only ever needed identity from
+  # it — a name, a catalog and a slug — and the engine's own defaults cover
+  # everything else, so a record with a catalog URL is a complete store. A
+  # repository is still honoured when there is one: it stays the authority on how
+  # that store behaves.
+  def change
+    change_column_null :stores, :store_repository_url, true
+  end
+end
@@ -0,0 +1,16 @@
+class CarryTheStoreConfigInTheRegistry < ActiveRecord::Migration[8.1]
+  # The store's own configuration moves into this record.
+  #
+  # It used to live as a `config.json` in a repository the client fetched over HTTP,
+  # which made a store's behaviour depend on a second thing existing and staying
+  # reachable. The registry already answers what a store *is*; carrying how it behaves
+  # in the same record makes this the one source of truth, and lets a store exist with
+  # no repository at all — which is the ordinary case now that the store engine ships
+  # inside the client.
+  #
+  # Nullable, because a store that configures nothing is still a store: the client
+  # falls back to the engine's built-in defaults, which need only a name and a catalog.
+  def change
+    add_column :stores, :config, :json
+  end
+end
@@ -0,0 +1,18 @@
+class AStoreIsANameAndACatalog < ActiveRecord::Migration[8.1]
+  # Both extras go. A store record is a name and a catalog, and nothing else.
+  #
+  # `config` was added earlier today on the idea that the registry should say how each
+  # store behaves. It should not: the configuration is fixed per installed client — the
+  # client carries it and knows its own machine — so a copy on the server was a second
+  # authority over decisions the client had already made correctly, including where it
+  # may delete. Keeping two stores on one machine apart is a subfolder, which the client
+  # derives itself.
+  #
+  # `store_repository_url` goes for the same reason it stopped being read: the store
+  # engines it pointed at do not exist any more, and a URL nobody follows is a URL that
+  # goes stale.
+  def change
+    remove_column :stores, :config, :json
+    remove_column :stores, :store_repository_url, :string
+  end
+end
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.

-ActiveRecord::Schema[8.1].define(version: 2026_08_05_000003) do
+ActiveRecord::Schema[8.1].define(version: 2026_08_19_120000) do
  create_table "admin_users", charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
    t.datetime "created_at", null: false
    t.datetime "deleted_at", precision: 3
@@ -45,6 +45,24 @@ ActiveRecord::Schema[8.1].define(version: 2026_08_05_000003) do
    t.index ["token_digest"], name: "idx_application_tokens_token_digest", unique: true
  end

+  create_table "device_grants", id: { type: :bigint, unsigned: true }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.bigint "application_token_id", unsigned: true
+    t.datetime "approved_at", precision: 3
+    t.string "client_name", limit: 128
+    t.datetime "created_at", precision: 3
+    t.datetime "denied_at", precision: 3
+    t.string "device_code", limit: 64, null: false
+    t.datetime "expires_at", precision: 3, null: false
+    t.string "issued_token", limit: 64
+    t.bigint "subject_id", unsigned: true
+    t.string "subject_type", limit: 128
+    t.datetime "updated_at", precision: 3
+    t.string "user_code", limit: 16, null: false
+    t.index ["device_code"], name: "idx_device_grants_device_code", unique: true
+    t.index ["expires_at"], name: "idx_device_grants_expires_at"
+    t.index ["user_code"], name: "idx_device_grants_user_code", unique: true
+  end
+
  create_table "downloads", id: { type: :bigint, unsigned: true }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
    t.datetime "created_at", precision: 3
    t.datetime "deleted_at", precision: 3
@@ -196,6 +214,24 @@ ActiveRecord::Schema[8.1].define(version: 2026_08_05_000003) do
    t.index ["image_id"], name: "index_members_on_image_id"
  end

+  create_table "pipelines", id: { type: :bigint, unsigned: true }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.boolean "active", default: true, null: false
+    t.datetime "created_at", precision: 3
+    t.datetime "deleted_at", precision: 3
+    t.datetime "last_pipeline_at", precision: 3
+    t.string "last_pipeline_status", limit: 32
+    t.string "platform", limit: 32, null: false
+    t.string "repo_name", limit: 128, null: false
+    t.string "repo_owner", limit: 128, null: false
+    t.bigint "software_id", unsigned: true
+    t.datetime "updated_at", precision: 3
+    t.bigint "woodpecker_repo_id", null: false, unsigned: true
+    t.index ["deleted_at"], name: "idx_pipelines_deleted"
+    t.index ["repo_owner", "repo_name"], name: "idx_pipelines_owner_name", unique: true
+    t.index ["software_id"], name: "idx_pipelines_software"
+    t.index ["woodpecker_repo_id"], name: "idx_pipelines_wp_id", unique: true
+  end
+
  create_table "platform_links", id: { type: :bigint, unsigned: true }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
    t.datetime "created_at", precision: 3
    t.datetime "deleted_at", precision: 3
@@ -263,10 +299,21 @@ ActiveRecord::Schema[8.1].define(version: 2026_08_05_000003) do
    t.index ["owner_type", "owner_id"], name: "idx_softwares_owner"
  end

+  create_table "stores", id: { type: :bigint, unsigned: true }, charset: "utf8mb4", collation: "utf8mb4_0900_ai_ci", force: :cascade do |t|
+    t.string "catalog_url", null: false
+    t.datetime "created_at", precision: 3, null: false
+    t.datetime "deleted_at", precision: 3
+    t.string "name", null: false
+    t.datetime "updated_at", precision: 3, null: false
+    t.index ["deleted_at"], name: "idx_stores_deleted_at"
+    t.index ["name"], name: "idx_stores_name"
+  end
+
  add_foreign_key "admin_users", "members"
  add_foreign_key "downloads", "releases", name: "fk_downloads_release", on_delete: :nullify
  add_foreign_key "external_links", "softwares", name: "fk_softwares_external_links", on_delete: :cascade
  add_foreign_key "members", "images"
+  add_foreign_key "pipelines", "softwares", name: "fk_pipelines_software", on_delete: :nullify
  add_foreign_key "release_assets", "releases", name: "fk_releases_release_assets", on_delete: :cascade
  add_foreign_key "releases", "softwares", name: "fk_softwares_releases", on_delete: :cascade
  add_foreign_key "software_images", "images"
@@ -15,3 +15,10 @@ end
    m.avatar_filename = attrs[:avatar_filename]
  end
 end
+
+# The store registry the graphical desktop client reads. Our own catalog is the
+# first record; anyone running this site would add their own the same way, from
+# the admin panel or here.
+Store.find_or_create_by!(name: "Teletype Games") do |store|
+  store.catalog_url = ENV.fetch("STORE_CATALOG_URL", "https://teletypegames.org")
+end
@@ -0,0 +1,36 @@
+require "rails_helper"
+
+RSpec.describe Api::StoresController, type: :request do
+  describe "GET /api/stores" do
+    it "lists stores without a login, in name order" do
+      create(:store, name: "Zed Games", catalog_url: "https://zed.example")
+      create(:store, name: "Apex Games", catalog_url: "https://apex.example")
+
+      get "/api/stores"
+
+      expect(response).to have_http_status(:ok)
+      json = JSON.parse(response.body)
+      expect(json.map { |s| s["name"] }).to eq(["Apex Games", "Zed Games"])
+    end
+
+    it "answers with the fields a client needs, camelCased" do
+      create(:store)
+
+      get "/api/stores"
+
+      store = JSON.parse(response.body).first
+      # Exactly two fields: a name and a catalog are the whole record, and a client
+      # that starts reading a third would be reading something this site no longer says.
+      expect(store.keys).to contain_exactly("name", "catalogUrl")
+      expect(store["catalogUrl"]).to eq("https://teletypegames.org")
+    end
+
+    it "leaves out soft-deleted stores" do
+      create(:store, name: "Gone").update!(deleted_at: Time.current)
+
+      get "/api/stores"
+
+      expect(JSON.parse(response.body)).to be_empty
+    end
+  end
+end
@@ -0,0 +1,6 @@
+FactoryBot.define do
+  factory :store do
+    name { "Teletype Games" }
+    catalog_url { "https://teletypegames.org" }
+  end
+end
@@ -0,0 +1,28 @@
+require "rails_helper"
+
+RSpec.describe Store, type: :model do
+  it { should validate_presence_of(:name) }
+  it { should validate_presence_of(:catalog_url) }
+
+  it "rejects a catalog url that is not http(s)" do
+    store = build(:store, catalog_url: "git@example.org:thing.git")
+    expect(store).not_to be_valid
+    expect(store.errors[:catalog_url]).to include("must be an http(s) URL")
+  end
+
+  describe ".ordered" do
+    it "lists stores by name" do
+      later = create(:store, name: "Zed Games")
+      first = create(:store, name: "Apex Games")
+
+      expect(Store.ordered).to eq([first, later])
+    end
+  end
+
+  it "hides soft-deleted stores" do
+    store = create(:store)
+    store.update!(deleted_at: Time.current)
+
+    expect(Store.all).to be_empty
+  end
+end
@@ -0,0 +1,56 @@
+require "rails_helper"
+require "warden/test/helpers"
+
+# The pipeline admin form could not save at all: the resource never declared
+# `permit_params`, so ActiveAdmin handed unpermitted attributes to the model and Rails
+# raised ForbiddenAttributesError on every edit. No model spec could have caught that —
+# the fault was one layer up — so the check belongs here, where the host's ActiveAdmin
+# instance actually runs.
+RSpec.describe "Admin pipelines", type: :request do
+  include Warden::Test::Helpers
+
+  let(:admin) { AdminUser.create!(email: "pipelines-spec@example.org", password: "password123") }
+  let(:software) { create(:software) }
+  let!(:holder) do
+    WarpEngine::Pipeline.create!(woodpecker_repo_id: 990_001, repo_owner: "spec", repo_name: "holder",
+                                 platform: "tic80", software: software)
+  end
+  let!(:taker) do
+    WarpEngine::Pipeline.create!(woodpecker_repo_id: 990_002, repo_owner: "spec", repo_name: "taker",
+                                 platform: "tic80")
+  end
+
+  before do
+    Warden.test_mode!
+    login_as(admin, scope: :admin_user)
+  end
+
+  after { Warden.test_reset! }
+
+  # This app keeps forgery protection on in the test environment, and a request spec has
+  # no rendered form to take a token from. The token is not what is under test here, so it
+  # is switched off for the duration and put back afterwards.
+  around do |example|
+    protection = ActionController::Base.allow_forgery_protection
+    ActionController::Base.allow_forgery_protection = false
+    example.run
+    ActionController::Base.allow_forgery_protection = protection
+  end
+
+  it "saves the form" do
+    put "/admin/pipelines/#{taker.id}", params: { pipeline: { platform: "godot" } }
+
+    expect(response).to have_http_status(:found)
+    expect(taker.reload.platform).to eq("godot")
+  end
+
+  it "moves the software off the pipeline that had it" do
+    put "/admin/pipelines/#{taker.id}",
+        params: { pipeline: { platform: "tic80", software_id: software.id } }
+
+    expect(response).to have_http_status(:found)
+    expect(taker.reload.software).to eq(software)
+    expect(holder.reload.software).to be_nil
+    expect(software.reload.pipeline).to eq(taker)
+  end
+end
@@ -30,7 +30,7 @@ export default {
    startsOn: 'Starts on:',
    upcomingEvents: 'Upcoming Events',
    featuredGame: 'Featured Game',
-    playInBrowser: '▶ Play in Browser',
+    playInBrowser: 'Play in Browser',
    viewProjectDetails: 'View Project Details',
    latestFromYoutube: 'Latest from YouTube',
    visitChannel: 'Visit Channel ↗',
@@ -133,7 +133,7 @@ export default {
    about: 'About',
    latestStable: 'Latest Stable',
    released: 'Released:',
-    playNow: '▶ Play Now',
+    playNow: 'Play Now',
    download: 'Download',
    source: 'Source',
    docs: 'Docs',
@@ -160,6 +160,7 @@ export default {
      win_x64: 'Windows (64-bit)',
      linux_x86: 'Linux (32-bit)',
      linux_x64: 'Linux (64-bit)',
+      linux_arm64: 'Linux (ARM 64-bit)',
      mac_x64: 'macOS (Intel)',
      mac_arm64: 'macOS (Apple Silicon)',
      mac_universal: 'macOS',
@@ -197,6 +198,37 @@ export default {
    title: 'Build Matrix',
    subtitle: 'Which engines build for which platforms.',
  },
+  stores: {
+    title: 'Stores',
+    subtitle: 'Our games on your own machine, kept up to date.',
+    viewClient: 'WarpEngine Client',
+    viewOthers: 'Others',
+
+    clientDesc: 'The app: the catalog as a grid of cards, one click to install a game into your application menu, one to play it. It sets the store up itself on first run, and on Windows it is the way in.',
+    clientDownload: 'Download',
+    clientPlatforms: 'Linux, macOS and Windows · needs Python 3',
+    clientShotAlt: 'The WarpEngine Client window: the store picker and category filters on the left, and the catalog as a grid of game cards with install and play buttons.',
+
+    docs: 'Documentation',
+    repo: 'Git repository',
+    installTitle: 'Install',
+    installThen: 'Then',
+    useTitle: 'Use it',
+    uninstallTitle: 'Remove it',
+    platformsTitle: 'What gets installed',
+    copy: 'Copy',
+
+    batocera: {
+      name: 'Batocera',
+      site: 'Batocera project',
+      tagline: 'The plug-and-play retro distribution',
+    },
+    retroarch: {
+      name: 'RetroArch',
+      site: 'RetroArch',
+      tagline: 'Anything that runs RetroArch',
+    },
+  },
  code: {
    title: 'Codebase',
    subtitle: 'Explore our collection of open-source projects, study our source code, and contribute to our independent game development tools.',
@@ -30,7 +30,7 @@ export default {
    startsOn: 'Kezdete:',
    upcomingEvents: 'Közelgő események',
    featuredGame: 'Kiemelt játék',
-    playInBrowser: '▶ Játék böngészőben',
+    playInBrowser: 'Játék böngészőben',
    viewProjectDetails: 'Projekt részletei',
    latestFromYoutube: 'Legújabb YouTube-ról',
    visitChannel: 'Csatorna megtekintése ↗',
@@ -120,7 +120,7 @@ export default {
    },
    author: 'Szerző:',
    platform: 'Platform:',
-    play: '▶ Játék',
+    play: 'Játék',
    moreInfo: 'Részletek',
    downloads: 'letöltés',
  },
@@ -133,7 +133,7 @@ export default {
    about: 'Leírás',
    latestStable: 'Legújabb stabil',
    released: 'Kiadva:',
-    playNow: '▶ Játék most',
+    playNow: 'Játék most',
    download: 'Letöltés',
    source: 'Forráskód',
    docs: 'Dokumentáció',
@@ -144,7 +144,7 @@ export default {
    notFound: 'A játék nem található',
    failedToLoad: 'Nem sikerült betölteni:',
    loading: 'Betöltés...',
-    play: '▶ Játék',
+    play: 'Játék',
    downloads: 'letöltés',
    links: 'Linkek',
    platformLinks: 'Platform linkek',
@@ -160,6 +160,7 @@ export default {
      win_x64: 'Windows (64 bit)',
      linux_x86: 'Linux (32 bit)',
      linux_x64: 'Linux (64 bit)',
+      linux_arm64: 'Linux (ARM 64 bit)',
      mac_x64: 'macOS (Intel)',
      mac_arm64: 'macOS (Apple Silicon)',
      mac_universal: 'macOS',
@@ -197,6 +198,37 @@ export default {
    title: 'Build mátrix',
    subtitle: 'Melyik engine melyik platformra fordít.',
  },
+  stores: {
+    title: 'Store-ok',
+    subtitle: 'A játékaink a saját gépeden, mindig frissen.',
+    viewClient: 'WarpEngine Client',
+    viewOthers: 'Egyéb',
+
+    clientDesc: 'Az alkalmazás: a katalógus kártyákban, egy kattintás a telepítés az alkalmazásmenübe, egy az indítás. Első indításkor magát a store-t is beállítja, Windowson pedig ez az út.',
+    clientDownload: 'Letöltés',
+    clientPlatforms: 'Linux, macOS és Windows · Python 3 kell hozzá',
+    clientShotAlt: 'A WarpEngine Client ablaka: balra a store-választó és a kategóriaszűrők, jobbra a katalógus játékkártyákban, telepítés és indítás gombokkal.',
+
+    docs: 'Dokumentáció',
+    repo: 'Git repó',
+    installTitle: 'Telepítés',
+    installThen: 'Utána',
+    useTitle: 'Használat',
+    uninstallTitle: 'Eltávolítás',
+    platformsTitle: 'Mi kerül fel',
+    copy: 'Másolás',
+
+    batocera: {
+      name: 'Batocera',
+      site: 'Batocera projekt',
+      tagline: 'A dugd-be-és-megy retro disztró',
+    },
+    retroarch: {
+      name: 'RetroArch',
+      site: 'RetroArch',
+      tagline: 'Bármi, amin fut a RetroArch',
+    },
+  },
  code: {
    title: 'Kódbázis',
    subtitle: 'Fedezd fel nyílt forráskódú projektek gyűjteményét, tanulmányozd forráskódunkat, és járulj hozzá független játékfejlesztő eszközeinkhez.',
@@ -120,6 +120,7 @@ const columnGroups = [
    color: 'group-amber',
    kinds: [
      { kind: 'linux_x64', sub: '64 bit' },
+      { kind: 'linux_arm64', sub: 'ARM 64 bit' },
    ],
  },
  {
@@ -66,6 +66,10 @@
      <RouterLink to="/builds" class="builds-link">
        <i class="fa-solid fa-table-cells"></i> {{ t('builds.title') }}
      </RouterLink>
+      <span class="builds-link-sep">|</span>
+      <RouterLink to="/stores" class="builds-link">
+        <i class="fa-solid fa-gamepad"></i> {{ t('stores.title') }}
+      </RouterLink>
    </div>
  </main>
 </template>
@@ -162,9 +166,12 @@ onMounted(() => store.fetch())
  @apply text-xs text-gray-400 font-medium ml-1;
 }
 .builds-link-row {
-  @apply text-center mt-10;
+  @apply flex flex-wrap items-center justify-center gap-3 mt-10;
 }
 .builds-link {
  @apply text-sm text-gray-400 hover:text-purple-600 font-medium transition-colors;
 }
+.builds-link-sep {
+  @apply text-gray-200 text-sm;
+}
 </style>
@@ -314,7 +314,7 @@ const downloadUrl = (path: string) =>
 // az asset-táblázat sorai és sorrendjük; a html nem letöltés, azt a Play gomb viszi
 const TABLE_KIND_ORDER = [
  'cartridge', 'source', 'docs',
-  'win_x64', 'win_x86', 'linux_x64', 'linux_x86',
+  'win_x64', 'win_x86', 'linux_x64', 'linux_arm64', 'linux_x86',
  'mac_universal', 'mac_arm64', 'mac_x64',
 ]

@@ -33,7 +33,7 @@
      </div>

      <div v-else class="engine-list">
-        <article v-for="(page, index) in enginePages" :key="page.id" class="engine-card group">
+        <article v-for="({ page, digest }, index) in cards" :key="page.id" class="engine-card group">
          <div class="engine-card-index">{{ String(index + 1).padStart(2, '0') }}</div>

          <div class="engine-card-body">
@@ -42,7 +42,21 @@
            </h2>

            <p v-if="page.description" class="engine-card-desc">{{ page.description }}</p>
-            <p v-if="page.content" class="engine-card-preview">{{ getCleanPreview(page.content) }}</p>
+            <p v-if="digest.intro" class="engine-card-preview">{{ digest.intro }}</p>
+            <p v-else-if="page.content" class="engine-card-preview">{{ getCleanPreview(page.content) }}</p>
+
+            <section v-if="digest.highlights.length" class="engine-highlights">
+              <h3 v-if="digest.highlightsTitle" class="engine-highlights-title">{{ digest.highlightsTitle }}</h3>
+              <ul class="engine-highlights-grid">
+                <li v-for="(item, i) in digest.highlights" :key="i" class="engine-highlight">
+                  <span class="engine-highlight-icon"><i class="fa-solid fa-check"></i></span>
+                  <p class="engine-highlight-body">
+                    <strong v-if="item.title" class="engine-highlight-lead">{{ item.title }}</strong>
+                    <template v-if="item.title && item.text"> — </template>{{ item.text }}
+                  </p>
+                </li>
+              </ul>
+            </section>

            <div class="engine-card-actions">
              <a :href="exploreUrl(page)" target="_blank" rel="noopener" class="engine-explore-btn">
@@ -62,11 +76,11 @@
 </template>

 <script setup lang="ts">
-import { onMounted } from 'vue'
+import { computed, onMounted } from 'vue'
 import { storeToRefs } from 'pinia'
 import { useI18n } from 'vue-i18n'
 import { WIKI_BASE } from '../../api/wiki.api'
-import { useEnginesStore } from '../../stores/engines.store'
+import { useEnginesStore, getEngineDigest } from '../../stores/engines.store'
 import type { WikiPageWithContent } from '../../lib/interfaces/wiki.interface'
 import SkeletonCard from '../../components/SkeletonCard.vue'

@@ -76,6 +90,10 @@ const store = useEnginesStore()
 const { pages: enginePages, loading, error } = storeToRefs(store)
 const { getCleanPreview } = store

+const cards = computed(() =>
+  enginePages.value.map((page) => ({ page, digest: getEngineDigest(page.content) })),
+)
+
 // Explore points at the engine's git repository (from wiki metadata);
 // pages without one fall back to their wiki page.
 const exploreUrl = (page: WikiPageWithContent): string =>
@@ -135,6 +153,27 @@ onMounted(() => store.fetch())
 .engine-card-preview {
  @apply text-base text-slate-400 leading-relaxed mb-8 max-w-3xl;
 }
+.engine-highlights {
+  @apply mb-10;
+}
+.engine-highlights-title {
+  @apply text-xs font-bold uppercase tracking-[0.2em] text-emerald-400 mb-5;
+}
+.engine-highlights-grid {
+  @apply grid md:grid-cols-2 gap-x-10 gap-y-4 max-w-4xl;
+}
+.engine-highlight {
+  @apply flex items-start gap-3;
+}
+.engine-highlight-icon {
+  @apply mt-1 flex h-5 w-5 flex-none items-center justify-center rounded-md bg-emerald-500/15 text-emerald-400 text-[10px];
+}
+.engine-highlight-body {
+  @apply text-sm text-slate-400 leading-relaxed;
+}
+.engine-highlight-lead {
+  @apply text-white font-semibold;
+}
 .engine-card-actions {
  @apply flex flex-wrap items-center gap-6;
 }
@@ -0,0 +1,43 @@
+<template>
+  <div class="cb">
+    <pre><code>{{ command }}</code></pre>
+    <button class="cb-copy" :title="t('stores.copy')" @click="copy">
+      <i :class="copied ? 'fa-solid fa-check' : 'fa-regular fa-copy'"></i>
+    </button>
+  </div>
+</template>
+
+<script setup lang="ts">
+// The page shows five of these — install, restart, CLI, uninstall — so the
+// block and its copy button live in one place rather than being repeated.
+import { ref } from 'vue'
+import { useI18n } from 'vue-i18n'
+
+const { command } = defineProps<{ command: string }>()
+const { t } = useI18n()
+const copied = ref(false)
+
+async function copy() {
+  try {
+    await navigator.clipboard.writeText(command)
+    copied.value = true
+    setTimeout(() => { copied.value = false }, 2000)
+  } catch {
+    // Clipboard API needs a secure context — the command stays selectable anyway.
+  }
+}
+</script>
+
+<style scoped>
+.cb {
+  @apply relative block bg-gray-900 text-gray-100 rounded-xl overflow-x-auto;
+}
+/* Explicitly margin-free: a `pre` carries a browser margin of its own, and the block is
+   spaced by whatever contains it — otherwise what follows ends up against it. */
+.cb pre {
+  @apply m-0 p-4 pr-14 font-mono text-sm leading-relaxed;
+}
+.cb-copy {
+  @apply absolute top-2 right-2 w-9 h-9 rounded-lg bg-gray-800 text-gray-300 hover:bg-gray-700 hover:text-white transition-colors;
+}
+</style>
@@ -0,0 +1,343 @@
+<template>
+  <header class="hero-section-gradient from-emerald-700 to-teal-800 py-10">
+    <div class="hero-container">
+      <h1 class="hero-title">{{ t('stores.title') }}</h1>
+      <p class="hero-subtitle text-emerald-50">{{ t('stores.subtitle') }}</p>
+    </div>
+  </header>
+
+  <main class="main-container py-8 px-4 mt-0">
+    <!-- Two ways in, and almost everybody wants the first one. A thin switcher rather
+         than a page of prose: whoever needs the detail follows a link to the wiki. -->
+    <nav class="st-views" role="tablist" :aria-label="t('stores.title')">
+      <button
+        class="st-view" :class="{ 'st-view-active': view === 'client' }"
+        role="tab" :aria-selected="view === 'client'" @click="selectView('client')"
+      >
+        <i class="fa-solid fa-window-maximize"></i> {{ t('stores.viewClient') }}
+      </button>
+      <button
+        class="st-view" :class="{ 'st-view-active': view === 'others' }"
+        role="tab" :aria-selected="view === 'others'" @click="selectView('others')"
+      >
+        <i class="fa-solid fa-terminal"></i> {{ t('stores.viewOthers') }}
+      </button>
+    </nav>
+
+    <section v-if="view === 'client'" class="st-section st-app">
+      <div class="st-app-grid">
+        <div>
+          <p class="st-app-lead">{{ t('stores.clientDesc') }}</p>
+          <div class="st-links">
+            <a
+              :href="client.releasesUrl" target="_blank" rel="noopener noreferrer"
+              class="st-link st-link-cta"
+            >
+              <i class="fa-solid fa-download"></i> {{ t('stores.clientDownload') }}
+            </a>
+            <a :href="client.wikiUrl" target="_blank" rel="noopener noreferrer" class="st-link st-link-indigo">
+              <i class="fa-solid fa-book"></i> {{ t('stores.docs') }}
+            </a>
+            <a :href="client.repoUrl" target="_blank" rel="noopener noreferrer" class="st-link st-link-dark">
+              <i class="fa-solid fa-code-branch"></i> {{ t('stores.repo') }}
+            </a>
+          </div>
+          <p class="st-app-platforms">
+            <i class="fa-brands fa-linux"></i> <i class="fa-brands fa-apple"></i>
+            <i class="fa-brands fa-windows"></i> {{ t('stores.clientPlatforms') }}
+          </p>
+        </div>
+
+        <!-- Eager, with its dimensions given: it sits in the first screen, so lazy
+             loading it would only buy a reflow. -->
+        <figure class="st-app-shot">
+          <img :src="clientScreenshot" :alt="t('stores.clientShotAlt')" width="2304" height="1664">
+        </figure>
+      </div>
+    </section>
+
+    <template v-else>
+      <div class="st-devices" role="tablist" :aria-label="t('stores.viewOthers')">
+        <button
+          v-for="d in devices"
+          :key="d.id"
+          class="st-device"
+          :class="{ 'st-device-active': d.id === device }"
+          role="tab"
+          :aria-selected="d.id === device"
+          @click="select(d.id)"
+        >
+          <i :class="d.icon" class="st-device-icon"></i>
+          <span class="st-device-name">{{ t(`stores.${d.id}.name`) }}</span>
+          <span class="st-device-tagline">{{ t(`stores.${d.id}.tagline`) }}</span>
+        </button>
+      </div>
+
+      <section class="st-section">
+        <!-- The spacing lives on this one container. Margins on the labels and none on
+             the button row is what let the buttons sit flush against the last block. -->
+        <div class="st-cmds">
+          <p class="st-cmd-label">{{ t('stores.installTitle') }}</p>
+          <CommandBlock :command="current.installCmd" />
+          <template v-if="current.afterInstallCmd">
+            <p class="st-cmd-label">{{ t('stores.installThen') }}</p>
+            <CommandBlock :command="current.afterInstallCmd" />
+          </template>
+
+          <p class="st-cmd-label">{{ t('stores.useTitle') }}</p>
+          <CommandBlock :command="current.cliSnippet" />
+
+          <p class="st-cmd-label">{{ t('stores.uninstallTitle') }}</p>
+          <CommandBlock :command="current.uninstallCmd" />
+        </div>
+
+        <div class="st-links st-links-after">
+          <a :href="current.wikiUrl" target="_blank" rel="noopener noreferrer" class="st-link st-link-indigo">
+            <i class="fa-solid fa-book"></i> {{ t('stores.docs') }}
+          </a>
+          <a :href="current.repoUrl" target="_blank" rel="noopener noreferrer" class="st-link st-link-dark">
+            <i class="fa-solid fa-code-branch"></i> {{ t('stores.repo') }}
+          </a>
+          <a :href="current.projectUrl" target="_blank" rel="noopener noreferrer" class="st-link st-link-emerald">
+            <i :class="current.icon"></i> {{ t(`stores.${device}.site`) }}
+          </a>
+        </div>
+      </section>
+
+      <!-- Which catalog platforms a store engine can put on a device. The app has no
+           such list to show: it installs whatever the catalog offers, and says so on the
+           cards themselves. -->
+      <section class="st-section">
+        <h2 class="st-section-title">{{ t('stores.platformsTitle') }}</h2>
+        <ul class="st-platforms">
+          <li v-for="p in platforms" :key="p.platform" class="st-platform">
+            <i :class="p.icon" class="st-platform-icon"></i>
+            <span class="st-platform-name">{{ p.label }}</span>
+            <code class="st-platform-ext">{{ p.ext }}</code>
+          </li>
+        </ul>
+      </section>
+    </template>
+    <div class="st-back">
+      <RouterLink to="/catalog" class="st-back-link">{{ t('catalogShow.back') }}</RouterLink>
+    </div>
+  </main>
+</template>
+
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+import { RouterLink, useRoute, useRouter } from 'vue-router'
+import { useI18n } from 'vue-i18n'
+import { CONFIG } from '../../lib/config'
+import CommandBlock from './CommandBlock.vue'
+import clientScreenshot from '../../assets/warpengine-client.png'
+
+const { t } = useI18n()
+const route = useRoute()
+const router = useRouter()
+
+const FORGE = 'https://git.teletypegames.org/stores'
+
+// The graphical client. Its own thing rather than a link on the desktop store: it
+// drives any WarpEngine store the site's registry offers, and on Windows it is the
+// only way in — there is no `curl … | sh` there.
+const CLIENT = {
+  repoUrl: `${FORGE}/warp-engine-client`,
+  releasesUrl: `${FORGE}/warp-engine-client/releases`,
+  wikiUrl: `${CONFIG.wikiBase}/stores/warp-engine-client`,
+}
+
+type DeviceId = 'batocera' | 'retroarch'
+
+// The devices below are the ones a store reaches through a shell installer. An
+// ordinary computer is not among them any more: there the store *is* the app in the
+// section above, which carries its own engine and needs nothing installed first.
+const BATOCERA_CLI = '/userdata/system/batocera-store/ttg-store'
+const RETROARCH_CLI = '~/.local/bin/ttg-retroarch-store'
+
+const devices = [
+  {
+    id: 'batocera' as DeviceId,
+    icon: 'fa-solid fa-tv',
+    projectUrl: 'https://batocera.org',
+    repoUrl: `${FORGE}/ttg-batocera-store`,
+    wikiUrl: `${CONFIG.wikiBase}/stores/ttg-batocera-store`,
+    // The installer is served straight from the forge, so this one line is the
+    // whole install on the device.
+    installCmd: `curl -fsSL ${FORGE}/ttg-batocera-store/raw/branch/master/install.sh | sh`,
+    afterInstallCmd: 'batocera-es-swissknife --restart',
+    uninstallCmd: `curl -fsSL ${FORGE}/ttg-batocera-store/raw/branch/master/uninstall.sh | sh`,
+    cliSnippet: [
+      `${BATOCERA_CLI} list      # compatible catalog entries`,
+      `${BATOCERA_CLI} sync      # download everything new`,
+      `${BATOCERA_CLI} remove c64demo`,
+    ].join('\n'),
+  },
+  {
+    id: 'retroarch' as DeviceId,
+    icon: 'fa-solid fa-gamepad',
+    projectUrl: 'https://www.retroarch.com',
+    repoUrl: `${FORGE}/ttg-retroarch-store`,
+    wikiUrl: `${CONFIG.wikiBase}/stores/ttg-retroarch-store`,
+    installCmd: `curl -fsSL ${FORGE}/ttg-retroarch-store/raw/branch/master/install.sh | sh`,
+    afterInstallCmd: '',
+    uninstallCmd: `curl -fsSL ${FORGE}/ttg-retroarch-store/raw/branch/master/uninstall.sh | sh`,
+    cliSnippet: [
+      `${RETROARCH_CLI} paths    # where things go, and whether the cores are there`,
+      `${RETROARCH_CLI} list     # compatible catalog entries`,
+      `${RETROARCH_CLI} sync     # download everything new`,
+      `${RETROARCH_CLI} remove c64demo`,
+    ].join('\n'),
+  },
+]
+
+type ViewId = 'client' | 'others'
+
+// `?view=` and `?device=` keep a link shareable, and let /batocera redirect here without
+// losing which store the visitor came for. Query only: the router does not scroll for a
+// query-only change, so switching does not throw the page back to the top.
+const initial = devices.some((d) => d.id === route.query.device)
+  ? (route.query.device as DeviceId)
+  : 'batocera'
+const device = ref<DeviceId>(initial)
+// The client view is what most visitors want, so it is the default — except when the URL
+// names a device, which is how /batocera and /retroarch redirect here. Somebody arriving
+// from those wants the integrations, not the app.
+const view = ref<ViewId>(
+  route.query.view === 'others' || (route.query.view === undefined && route.query.device !== undefined)
+    ? 'others'
+    : 'client',
+)
+const current = computed(() => devices.find((d) => d.id === device.value) ?? devices[0])
+// The app is not tied to a device tab: it drives whichever store the site's registry
+// offers, so it stands above the chooser rather than inside it.
+const client = CLIENT
+
+function select(id: DeviceId) {
+  device.value = id
+  void router.replace({ query: { ...route.query, device: id } })
+}
+
+function selectView(id: ViewId) {
+  view.value = id
+  void router.replace({ query: { ...route.query, view: id } })
+}
+
+const platforms = [
+  { platform: 'c64', label: 'Commodore 64 (VICE)', ext: '.prg', icon: 'fa-solid fa-floppy-disk' },
+  { platform: 'tic80', label: 'TIC-80', ext: '.tic', icon: 'fa-solid fa-tv' },
+]
+</script>
+
+<style scoped>
+.st-links {
+  @apply flex flex-wrap gap-3;
+}
+.st-link {
+  @apply inline-flex items-center gap-2 font-bold py-2.5 px-5 rounded-xl text-sm text-white transition-all active:scale-95;
+}
+.st-link-dark { @apply bg-slate-800 hover:bg-slate-900 shadow-lg shadow-slate-800/20; }
+.st-link-indigo { @apply bg-indigo-600 hover:bg-indigo-700 shadow-lg shadow-indigo-600/20; }
+.st-link-emerald { @apply bg-emerald-600 hover:bg-emerald-700 shadow-lg shadow-emerald-600/20; }
+
+.st-section {
+  @apply bg-white rounded-2xl shadow-xl border border-gray-100 p-6 md:p-8 mt-6;
+}
+.st-section-title {
+  @apply flex items-center gap-3 text-xl font-bold text-gray-900 mb-2;
+}
+
+.st-devices {
+  @apply grid grid-cols-1 sm:grid-cols-3 gap-3 mb-6;
+}
+.st-device {
+  @apply flex flex-col items-start gap-1 text-left bg-gray-50 border-2 border-gray-100 rounded-xl px-4 py-3 transition-all hover:border-emerald-200 active:scale-95;
+}
+.st-device-active {
+  @apply bg-emerald-50 border-emerald-500;
+}
+.st-device-icon {
+  @apply text-gray-400;
+}
+.st-device-active .st-device-icon {
+  @apply text-emerald-600;
+}
+.st-device-name {
+  @apply font-bold text-gray-900;
+}
+.st-device-tagline {
+  @apply text-sm text-gray-500;
+}
+
+/* The switcher is meant to be almost nothing: two words and a line under the active one. */
+.st-views {
+  @apply flex gap-1 border-b border-gray-200 mb-6;
+}
+.st-view {
+  @apply flex items-center gap-2 px-4 py-2 -mb-px text-sm font-semibold text-gray-500 border-b-2 border-transparent transition-colors hover:text-gray-800;
+}
+.st-view-active {
+  @apply text-emerald-700 border-emerald-500;
+}
+/* One rhythm for the whole command list, so nothing depends on a margin someone
+   remembered to add. */
+.st-cmds {
+  @apply space-y-2;
+}
+.st-cmd-label {
+  @apply text-xs font-semibold uppercase tracking-wide text-gray-400 pt-3;
+}
+.st-cmd-label:first-child {
+  @apply pt-0;
+}
+.st-links-after {
+  @apply mt-6;
+}
+.st-engine-link {
+  @apply text-indigo-600 hover:underline font-mono text-xs;
+}
+/* The app leads the page, so it is the one section that looks like an offer rather
+   than a paragraph. */
+.st-app {
+  @apply bg-gradient-to-br from-emerald-50 to-teal-50 border-emerald-200;
+}
+.st-app-lead {
+  @apply text-gray-700 text-lg leading-relaxed mb-4;
+}
+.st-app-platforms {
+  @apply flex items-center gap-2 text-sm text-gray-500 mt-4;
+}
+.st-app-grid {
+  @apply grid gap-6 items-start lg:grid-cols-2;
+}
+.st-app-shot {
+  @apply rounded-xl overflow-hidden border border-emerald-200/70 shadow-lg bg-gray-900;
+}
+.st-app-shot img {
+  @apply block w-full h-auto;
+}
+.st-link-cta {
+  @apply bg-emerald-600 text-white hover:bg-emerald-700 text-base px-5 py-2.5 font-semibold;
+}
+.st-platforms {
+  @apply grid grid-cols-1 sm:grid-cols-2 gap-3;
+}
+.st-platform {
+  @apply flex items-center gap-3 bg-gray-50 border border-gray-100 rounded-xl px-4 py-3;
+}
+.st-platform-icon {
+  @apply text-gray-400;
+}
+.st-platform-name {
+  @apply font-medium text-gray-800 flex-grow;
+}
+.st-platform-ext {
+  @apply font-mono text-xs text-purple-600 bg-purple-50 px-2 py-0.5 rounded;
+}
+.st-back {
+  @apply mt-8 text-center;
+}
+.st-back-link {
+  @apply text-gray-400 hover:text-gray-600 text-sm font-medium transition-colors;
+}
+</style>
@@ -8,6 +8,7 @@ import { enginesRouter } from './engines.router'
 import { howtosRouter } from './howtos.router'
 import { teamRouter } from './team.router'
 import { buildsRouter } from './builds.router'
+import { storesRouter } from './stores.router'

 export const router = createRouter({
  history: createWebHistory(),
@@ -21,8 +22,15 @@ export const router = createRouter({
    ...howtosRouter,
    ...teamRouter,
    ...buildsRouter,
+    ...storesRouter,
  ],
-  scrollBehavior() {
+  scrollBehavior(to, from, savedPosition) {
+    // Back and forward land where the visitor was.
+    if (savedPosition) return savedPosition
+    // A query-only change is not a new page. The stores page writes its switcher into the
+    // URL so a link stays shareable, and throwing the reader back to the top for that
+    // felt like a reload.
+    if (to.path === from.path) return false
    return { top: 0 }
  },
 })
@@ -0,0 +1,13 @@
+import type { RouteRecordRaw } from 'vue-router'
+
+export const storesRouter: RouteRecordRaw[] = [
+  { path: '/stores', name: 'storesIndex', component: () => import('../page/stores/StoresIndexPage.vue') },
+  // The Batocera store had a page to itself until the RetroArch store joined it.
+  // Both device names keep working as URLs — the old links, and the guess someone
+  // makes after reading "RetroArch store" — and each lands on its own tab.
+  { path: '/batocera', redirect: { name: 'storesIndex', query: { device: 'batocera' } } },
+  { path: '/retroarch', redirect: { name: 'storesIndex', query: { device: 'retroarch' } } },
+  // `/desktop` used to name a shell store for ordinary computers. That store is the
+  // app now, so the old URL lands on the app rather than on a device tab.
+  { path: '/desktop', redirect: { name: 'storesIndex' } },
+]
@@ -0,0 +1,79 @@
+import { describe, it, expect } from 'vitest'
+import { getEngineDigest } from '../engines.store'
+
+// Generic markdown in the shape every engine-tagged wiki page must follow:
+// intro paragraph, then "What You Get" as the first heading with bullets.
+// Dummy text only — real content always comes from the wiki at runtime.
+const SAMPLE_MARKDOWN = `
+> Example Engine is a **sample** framework that turns markdown into landing cards.
+
+# What You Get
+
+- **First feature**: some \`inline code\` — with a longer explanation.
+- **Second feature**: a [link](https://example.org) inside the text.
+- Plain bullet without a bold lead.
+
+# Later Section
+
+- **Not picked up**: a list under a later heading.
+`
+
+describe('getEngineDigest', () => {
+  it('extracts the intro from the leading blockquote with inline markdown stripped', () => {
+    const digest = getEngineDigest(SAMPLE_MARKDOWN)
+    expect(digest.intro).toBe(
+      'Example Engine is a sample framework that turns markdown into landing cards.',
+    )
+  })
+
+  it('takes the What You Get heading as the highlights title', () => {
+    expect(getEngineDigest(SAMPLE_MARKDOWN).highlightsTitle).toBe('What You Get')
+  })
+
+  it('parses bold-lead bullets into title and text', () => {
+    const [first, second] = getEngineDigest(SAMPLE_MARKDOWN).highlights
+    expect(first).toEqual({
+      title: 'First feature',
+      text: 'some inline code — with a longer explanation.',
+    })
+    expect(second).toEqual({
+      title: 'Second feature',
+      text: 'a link inside the text.',
+    })
+  })
+
+  it('keeps bullets without a bold lead as plain text', () => {
+    const third = getEngineDigest(SAMPLE_MARKDOWN).highlights[2]
+    expect(third).toEqual({ title: '', text: 'Plain bullet without a bold lead.' })
+  })
+
+  it('stops at the heading after the What You Get section', () => {
+    expect(getEngineDigest(SAMPLE_MARKDOWN).highlights).toHaveLength(3)
+  })
+
+  it('matches the heading case-insensitively', () => {
+    const digest = getEngineDigest('# WHAT you get\n- **A**: b.')
+    expect(digest.highlights).toEqual([{ title: 'A', text: 'b.' }])
+  })
+
+  it('yields no highlights when the first heading is not What You Get', () => {
+    const digest = getEngineDigest('Intro line.\n\n# Features\n- **A**: b.\n\n# What You Get\n- **C**: d.')
+    expect(digest.intro).toBe('Intro line.')
+    expect(digest.highlights).toEqual([])
+  })
+
+  it('caps the highlights at six items', () => {
+    const many = '# What You Get\n' + Array.from({ length: 9 }, (_, i) => `- item ${i}`).join('\n')
+    expect(getEngineDigest(many).highlights).toHaveLength(6)
+  })
+
+  it('uses the first paragraph as intro when there is no blockquote', () => {
+    const digest = getEngineDigest('Just a plain paragraph.\n\n---\n\n# What You Get\n- one')
+    expect(digest.intro).toBe('Just a plain paragraph.')
+    expect(digest.highlights).toEqual([{ title: '', text: 'one' }])
+  })
+
+  it('returns an empty digest for empty content', () => {
+    expect(getEngineDigest('')).toEqual({ intro: '', highlightsTitle: '', highlights: [] })
+  })
+})
@@ -4,6 +4,75 @@ import wikiApi from '../api/wiki.api'
 import { useLoadable } from '../composables/useLoadable'
 import type { WikiPageWithContent } from '../lib/interfaces/wiki.interface'

+export interface EngineHighlight {
+  title: string
+  text: string
+}
+
+// Landing-page digest of a wiki engine page. Convention: every engine-tagged
+// page opens with an intro paragraph, then a "What You Get" heading as its
+// first heading, with the feature bullets underneath.
+export interface EngineDigest {
+  intro: string
+  highlightsTitle: string
+  highlights: EngineHighlight[]
+}
+
+const HIGHLIGHTS_HEADING = 'what you get'
+const MAX_HIGHLIGHTS = 6
+
+// Inline markdown (links, bold, code) stripped so the text reads as plain prose.
+function stripInline(md: string): string {
+  return md
+    .replace(/\[([^\]]*)\]\([^)]*\)/g, '$1')
+    .replace(/\*\*([^*]+)\*\*/g, '$1')
+    .replace(/[*_`]/g, '')
+    .replace(/\s+/g, ' ')
+    .trim()
+}
+
+export function getEngineDigest(content: string): EngineDigest {
+  const digest: EngineDigest = { intro: '', highlightsTitle: '', highlights: [] }
+  let inHighlights = false
+
+  for (const raw of (content || '').split('\n')) {
+    const line = raw.trim()
+    if (!line || /^([-*_])\1{2,}$/.test(line)) continue
+
+    const heading = line.match(/^#{1,6}\s+(.*)$/)
+    if (heading) {
+      // The section ends at the next heading; and if the page's first heading
+      // is not "What You Get", it doesn't follow the convention — no highlights.
+      if (inHighlights) break
+      const title = stripInline(heading[1])
+      if (title.toLowerCase() !== HIGHLIGHTS_HEADING) break
+      inHighlights = true
+      digest.highlightsTitle = title
+      continue
+    }
+
+    if (inHighlights) {
+      const bullet = line.match(/^[-*]\s+(.*)$/)
+      if (!bullet) continue
+      const lead = bullet[1].match(/^\*\*([^*]+)\*\*\s*[:—–-]?\s*(.*)$/)
+      digest.highlights.push(
+        lead
+          ? { title: stripInline(lead[1]), text: stripInline(lead[2]) }
+          : { title: '', text: stripInline(bullet[1]) },
+      )
+      continue
+    }
+
+    // First prose line (paragraph or blockquote) before the heading is the intro.
+    if (!digest.intro) {
+      digest.intro = stripInline(line.replace(/^>\s*/, ''))
+    }
+  }
+
+  digest.highlights = digest.highlights.slice(0, MAX_HIGHLIGHTS)
+  return digest
+}
+
 export const useEnginesStore = defineStore('engines', () => {
  const pages = ref<WikiPageWithContent[]>([])
  const { loading, error, withCache, invalidate } = useLoadable()
@@ -19,5 +88,5 @@ export const useEnginesStore = defineStore('engines', () => {
    return content.replace(/[#*`_[\]()>|-]/g, '').replace(/\s+/g, ' ').trim().slice(0, 260) + '...'
  }

-  return { pages, loading, error, fetch, getCleanPreview, invalidate }
+  return { pages, loading, error, fetch, getCleanPreview, getEngineDigest, invalidate }
 })
@@ -43,7 +43,7 @@ services:
      - interstack

  woodpecker-server:
-    image: woodpeckerci/woodpecker-server:v3.16.0
+    image: woodpeckerci/woodpecker-server:v3.17.0
    container_name: woodpecker-server
    environment:
      WOODPECKER_HOST: "https://${WOODPECKER_DOMAIN}"
@@ -54,6 +54,10 @@ services:
      WOODPECKER_GITEA_SECRET: ${GITEA_CLIENT_SECRET}
      WOODPECKER_SERVER_ADDR: ":8000"
      WOODPECKER_AGENT_SECRET: ${WOODPECKER_AGENT_SECRET}
+      # Global configuration extension: every pipeline start asks the update
+      # server for the config; non-marker repos fall back to their own YAML (204).
+      WOODPECKER_CONFIG_EXTENSION_ENDPOINT: "https://${WEBAPP_DOMAIN}/build/config"
+      WOODPECKER_ADMIN: mr.zero
    volumes:
      - ./data/woodpecker:/var/lib/woodpecker
    labels:
@@ -67,7 +71,7 @@ services:
      - interstack

  woodpecker-agent:
-    image: woodpeckerci/woodpecker-agent:v3.16.0
+    image: woodpeckerci/woodpecker-agent:v3.17.0
    container_name: woodpecker-agent
    environment:
      WOODPECKER_SERVER: "woodpecker-server:9000"
@@ -162,6 +166,9 @@ services:
      - ADMIN_EMAIL=${ADMIN_EMAIL:-admin@teletype.hu}
      - ADMIN_PASSWORD=${ADMIN_PASSWORD:-password123}
      - WIKI_GRAV_URL=${WIKI_GRAV_URL:-https://wiki.teletypegames.org}
+      - WOODPECKER_URL=${WOODPECKER_URL:-http://woodpecker-server:8000}
+      - WOODPECKER_API_TOKEN=${WOODPECKER_API_TOKEN:-}
+      - WOODPECKER_REPO_OWNER=${WOODPECKER_REPO_OWNER:-}
    depends_on:
      mysql:
        condition: service_healthy
@@ -192,25 +199,6 @@ services:
      - proxy
      - interstack

-  droparea:
-    image: linuxserver/openssh-server
-    container_name: droparea
-    environment:
-      PUID: 1
-      PGID: 1
-      TZ: Europe/Budapest
-      SUDO_ACCESS: "false"
-      PASSWORD_ACCESS: "true"
-      USER_NAME: drop
-      USER_PASSWORD: ${DROP_PASSWORD}
-    volumes:
-      - ./data/softwares:/home/drop
-    ports:
-      - "${DROPAREA_SSH_PORT}:2222"
-    networks:
-      - proxy
-      - interstack
-
 volumes:
  gitea:
  woodpecker:
@@ -13,7 +13,6 @@ PHPMYADMIN_DOMAIN=db.teletype.hu

 # Ports
 GITEA_SSH_PORT=2222
-DROPAREA_SSH_PORT=2223
 TRAEFIK_WEB_PORT=9100
 TRAEFIK_API_PORT=9101

@@ -23,7 +22,6 @@ WOODPECKER_AGENT_SECRET=
 MYSQL_ROOT_PASSWORD=
 DB_PASSWORD=
 UPDATE_SECRET=
-DROP_PASSWORD=
 WEBAPP_WIKIJS_TOKEN=
 DISCORD_INVITE_LINK=

@@ -2,3 +2,4 @@ log/
 spec/dummy/log/
 spec/dummy/tmp/
 Gemfile.lock
+.bundle/
@@ -8,5 +8,6 @@ group :development, :test do
  gem "rspec-rails", "~> 7.0"
  gem "factory_bot_rails"
  gem "shoulda-matchers", "~> 6.0"
+  gem "webmock", "~> 3.0"
  gem "debug", platforms: %i[mri windows]
 end
@@ -5,19 +5,31 @@ software catalog: catalog models, a CI-pipeline-callable release updater, a
 public read-only JSON API, and optional ActiveAdmin resources that plug into
 your app's existing admin.

-Repository: `https://git.teletypegames.org/tools/warp_engine`
+Repository: `https://git.teletypegames.org/engines/warp_engine`

 ## Features

 - **Catalog domain**: `Software`, `Release`, `ReleaseAsset`, `ExternalLink`,
  `PlatformLink`, `Image`, `SoftwareImage`, `Download` models with soft-delete
  semantics and download statistics.
- **CI-callable updater**: your build pipeline drops artifacts into a
-  directory and calls one endpoint — WarpEngine extracts archives, parses
-  metadata and upserts the catalog records. Supported platforms out of the
+- **CI-callable updater**: your build pipeline uploads artifacts over HTTP
+  and calls one endpoint — WarpEngine extracts archives, parses metadata
+  and upserts the catalog records. Supported platforms out of the
  box: TIC-80, Ebitengine, LÖVE, C64, Godot, Bevy, Phaser. Authenticated by
  a shared secret or by per-owner database tokens with expiry and scopes
  (`ApplicationToken`, managed in the admin).
+- **Pluggable access**: a host supplies a policy and the catalog gains prices,
+  entitlements and gated downloads — and *says so* in its API, so clients can
+  show a paid title as paid instead of failing at the download. Default `:open`
+  is the catalog as it always was.
+- **Client sign-in**: an RFC 8628 device authorization grant for clients with no
+  browser of their own, over the host's own user model. Off unless configured.
+- **Pluggable storage**: artifacts are served through a storage adapter
+  (`:local` by default); a host can serve them from an object store without
+  patching the engine.
+- **Publish events**: every published release emits
+  `ActiveSupport::Notifications` (`warp_engine.publish`), so hosts can react
+  to new builds without model callbacks.
 - **Public JSON API**: catalog listing, highlighted title, per-platform build
  matrix, image serving, download tracking, and a static file server for
  web-playable builds.
@@ -26,6 +38,10 @@ Repository: `https://git.teletypegames.org/tools/warp_engine`
  image library with orphan cleanup, a file manager with a picker mode, and
  download statistics. Without ActiveAdmin the engine runs headless
  (API + updater only).
+- **Woodpecker CI management (optional)**: with a Woodpecker API token
+  configured, the admin also gains repo sync, per-repo pipeline history
+  with manual triggers, and automatic provisioning of application tokens
+  as Woodpecker secrets.

 ## Requirements

@@ -36,19 +52,18 @@ Repository: `https://git.teletypegames.org/tools/warp_engine`
 ## Example stack (docker compose)

 `examples/compose` boots everything the engine's workflow assumes, end to
-end: the catalog app itself, the SSH drop area the updater contract feeds
-from and — behind a compose profile — a Gitea forge with Woodpecker CI, so
-you can watch a pipeline publish a release into the catalog.
+end: the catalog app itself and — behind a compose profile — a Gitea forge
+with Woodpecker CI, so you can watch a pipeline publish a release into the
+catalog.

 | Service | Role | Where |
 | --- | --- | --- |
 | `app` | Minimal Rails host with the engine mounted as a path gem (headless: API + updater) | `http://localhost:8080` |
 | `mysql` | Catalog database | internal |
-| `droparea` | SSH server where pipelines drop build artifacts; shares the `softwares` volume with `app` | `ssh drop@localhost -p 2222` |
 | `gitea` | Git forge (profile `ci`) | `http://gitea:3000` |
 | `woodpecker` + agent | CI wired to gitea (profile `ci`) | `http://woodpecker:8000` |

-### Quickstart — catalog + drop area
+### Quickstart — catalog only

 ```sh
 cd examples/compose
@@ -89,10 +104,6 @@ curl -X POST -H "X-Update-Secret: example-update-secret" \
  "http://localhost:8080/build/publish?platform=love&name=demo&version=0.1.0"
 ```

-(Dropping the files in over the SSH drop area — `scp -P 2222 demo-0.1.0.*
-drop@localhost:drop/`, password `DROP_PASSWORD` from `.env` — works just as
-well; the updater only cares that the files end up in `file_container_path`.)
-
 `GET /api/software` now lists *Demo Game* with `html` and `win_x64` assets,
 `http://localhost:8080/file/demo-0.1.0/index.html` serves the extracted web
 build, and `GET /api/download?path=demo-0.1.0-win-x64.zip` serves the
@@ -147,17 +158,22 @@ From the git repository:

 ```ruby
 # Gemfile
-gem "warp_engine", git: "https://git.teletypegames.org/tools/warp_engine.git"
+gem "warp_engine", git: "https://git.teletypegames.org/engines/warp_engine.git"
 ```

-Or from the Forgejo rubygems registry (tagged releases):
+Or from the Forgejo rubygems registry, which is where **tagged releases** land — a
+version rather than whatever a branch happens to hold:

 ```ruby
-source "https://git.teletypegames.org/api/packages/tools/rubygems" do
-  gem "warp_engine"
+source "https://git.teletypegames.org/api/packages/engines/rubygems" do
+  gem "warp_engine", "~> 0.5"
 end
 ```

+The registry is publicly readable, so no credential is needed to install from it. Use a
+**block-scoped** source rather than a second global one: with two global sources Bundler
+cannot say which gem came from where.
+
 Then:

 ```sh
@@ -201,6 +217,18 @@ Rails.application.config.to_prepare do
    # after backfilling owners — ownerless softwares are claimable by anyone.
    # c.enforce_software_ownership = true

+    # Who may see a title and who may download it (see "Access" below).
+    # :open (default) lists everything and serves everything.
+    # c.access_policy = MyStore::AccessPolicy.new
+
+    # Client sign-in (see "Client sign-in" below). nil (default) means there is
+    # none: /api/auth/* answers 404 and GET /api/service reports auth: null.
+    # c.access_token_owner_class  = "User"
+    # c.identity_verification_url = "/devices"
+    #
+    # How to recognise a caller with a session instead of a bearer token.
+    # c.subject_resolver = ->(request) { request.env["warden"]&.user }
+
    # If your app's own models reference catalog images, register them so the
    # admin Images page counts them as "in use":
    # c.image_owners = [
@@ -221,8 +249,7 @@ Publishing a release from CI is two steps:
 1. **Upload** build artifacts into `file_container_path`, named by convention:
   `<name>-<version>.metadata.json`, `<name>-<version>.html.zip`,
   `<name>-<version>-win-x64.zip`, `<name>-<version>.tic`, ... (each platform
-   declares which asset kinds it expects — see `GET /api/builds`). Either
-   drop the files in over the shared volume (SSH drop area), or push them
+   declares which asset kinds it expects — see `GET /api/builds`). Push them
   over HTTP — one request per file, `upload` scope, optional `sha256`
   integrity check:

@@ -264,17 +291,262 @@ accepts both:
 When switching to `:database`, create the tokens and move your pipelines to
 them first — the flip invalidates the shared secret immediately.

+## CI pipeline configs (Woodpecker)
+
+WarpEngine can act as a [Woodpecker configuration extension](https://woodpecker-ci.org/docs/usage/extensions/configuration-extension):
+instead of a copy-pasted `.woodpecker.yaml` in every game repo, the repo holds a
+one-line marker and the engine serves the full per-platform pipeline
+(version → build → upload → publish, calling `/build/upload` + `/build/publish`
+with the `application_token` Woodpecker secret):
+
+```yaml
+# .woodpecker.yaml in a game repo
+platform: godot
+```
+
+- `POST /build/config` — the extension endpoint Woodpecker calls on every
+  pipeline start (httpsig/ed25519-signed request, verified against
+  `ci_extension_public_key(_url)`). Non-marker configs get a `204` so the
+  repo's own YAML keeps running — opt-in migration, and putting a full
+  pipeline back into the repo is the opt-out.
+- `GET /build/config?platform=godot` — renders the same pipeline as a preview.
+
+Configuration: `ci_platforms` maps platform names to builder images
+(`{ "godot" => { builder: "..." }, "tic80" => { builder: ..., exporter: ... } }`);
+an empty map (default) disables the feature. Set the Woodpecker side with
+`WOODPECKER_CONFIG_EXTENSION_ENDPOINT=https://your-host/build/config` (or
+per-repo in Settings → Extensions). Templates live in
+`app/services/warp_engine/platforms/<platform>/pipeline.yaml.erb`.
+
+## Woodpecker CI management
+
+Beyond serving pipeline configs, WarpEngine can drive the Woodpecker REST API
+itself. Set `woodpecker_url` and `woodpecker_api_token` — while either is nil
+(the default), every management feature stays inactive and the admin pages
+hide themselves:
+
+```ruby
+c.woodpecker_url        = ENV["WOODPECKER_URL"]        # e.g. "https://ci.example.org"
+c.woodpecker_api_token  = ENV["WOODPECKER_API_TOKEN"]  # PAT of a Woodpecker *instance admin*
+c.woodpecker_repo_owner = ENV["WOODPECKER_REPO_OWNER"] # forge org the game repos live under
+```
+
+What it unlocks (all surfaced in the admin):
+
+- **Repo sync** (*Pipelines → Sync from Woodpecker*): mirrors the Woodpecker
+  repo list into `Pipeline` records, auto-matching each repo to a catalog
+  `Software` by name; repos that disappear from Woodpecker are deactivated.
+  Platform and software links are editable by hand afterwards.
+- **Pipeline history**: each entry on the *Pipelines* page lists its recent
+  runs with a manual *Trigger* action; the newest run refreshes the cached
+  last-pipeline status shown on the Pipelines index. The software's admin
+  page links to its pipelines from the Quick Links sidebar.
+- **Secret provisioning**: database application tokens are pushed to the
+  repos as the `application_token` Woodpecker secret — creating a token
+  provisions it to its owner's repos (unrestricted tokens to all active
+  repos), deleting a token removes the secret, and *Rotate* creates a
+  replacement token, provisions it everywhere and revokes the old one in a
+  single step.
+
+The API token must belong to a Woodpecker **instance admin** — listing the
+server's repos is an admin-only endpoint (anything less yields
+`403 User not authorized`). Add the user to `WOODPECKER_ADMIN` on the
+Woodpecker server, then log out and back in: the admin flag is written to
+the user record at login, a server restart alone is not enough.
+
+## Storage
+
+Build artifacts are served through a storage adapter. The default is the
+local filesystem under `file_container_path` — byte for byte the behaviour
+the engine always had:
+
+```ruby
+c.storage_adapter = :local   # default
+```
+
+A host that keeps its artifacts elsewhere (an object store behind a CDN, for
+example) can plug in its own object instead of patching the engine. The
+contract is three methods:
+
+```ruby
+class MyObjectStore
+  def file?(relative_path)      = ...   # true/false
+  def directory?(relative_path) = ...   # true/false
+
+  # Return a WarpEngine::Storage::Location:
+  #   Location.file(absolute_path)  — the engine will send_file it
+  #   Location.redirect(url)        — the engine will redirect (signed URL)
+  def locate(relative_path, filename: nil, expires_in: nil) = ...
+end
+
+c.storage_adapter = MyObjectStore.new
+```
+
+`GET /api/download` and `GET /file/*` both go through the adapter, so a
+signing adapter turns them into redirects without any further change.
+`WarpEngine::DownloadService#create` still returns an absolute path (and
+`nil` when there is none), so existing callers keep working;
+`#locate` is the new entry point that can also hand back a redirect.
+
+**Serving only.** Ingestion — `POST /build/upload`, archive extraction and
+the admin file manager — still writes to the local disk. A remote adapter
+needs its own upload path today.
+
+## Access
+
+Who may see a title, and who may download it. The default answers "everyone" to
+both — every software listed, every artifact served, no prices — which is the
+catalog the engine always had:
+
+```ruby
+c.access_policy = :open   # default
+```
+
+A host that sells supplies a policy instead. The contract is three methods:
+
+```ruby
+class MyStore::AccessPolicy
+  # Which titles GET /api/software lists at all.
+  def visible_software_scope(subject: nil) = ...   # an ActiveRecord scope
+
+  # What a client is told about one title.
+  def access_for(software:, subject: nil)
+    WarpEngine::Access.new(
+      gated: true, entitled: false,           # needs an entitlement; this caller has none
+      price_cents: 1490, currency: "EUR",
+      purchase_url: "https://shop.example/games/slug",
+      web_url: "https://shop.example/play/slug"   # nil keeps the engine's own /file/ path
+    )
+  end
+
+  # nil refuses the download; a Grant allows it.
+  def authorize_download(asset:, subject:, request:) = WarpEngine::Access::Grant.new
+end
+
+c.access_policy = MyStore::AccessPolicy.new
+```
+
+`subject` is whoever the request authenticated as, or `nil` for an anonymous
+caller — deliberately untyped, because the engine has no user model and whose
+object this is belongs to the host.
+
+Every catalog entry carries an `access` block, **including under the open
+policy**, so a client never has to tell "this catalog says nothing" from "this
+title is not gated":
+
+```json
+"access": { "gated": false, "entitled": true, "price": null,
+            "purchaseUrl": null, "webUrl": null }
+```
+
+The vocabulary is generic on purpose. A client reads more than one store, and a
+word from any one host's domain would make it specific to that host.
+
+**A policy that raises is treated as a refusal**: an empty catalog and a denied
+download, logged. An artifact served because the gatekeeper crashed is the one
+failure mode this engine must not have.
+
+## Client sign-in
+
+A desktop client has no cookie jar and no browser session, so it cannot host a
+login form without asking somebody to type a password into a window that is not
+a browser. The engine implements the device authorization grant (RFC 8628)
+instead — but only where a host has said whose tokens these are:
+
+```ruby
+c.access_token_owner_class  = "User"      # nil (default): no sign-in at all
+c.identity_verification_url = "/devices"  # your page where a person types the code
+c.device_code_ttl           = 600
+c.device_code_interval      = 5
+```
+
+With `access_token_owner_class` unset, `/api/auth/*` answers 404 and
+`GET /api/service` reports `auth: null`, so a client offers no sign-in.
+
+The flow:
+
+1. the client `POST`s `/api/auth/device` and shows the `userCode` it gets back;
+2. the person opens `verificationUrl` in a browser and types that code;
+3. **your page** calls `WarpEngine::DeviceGrantService#approve(user_code:, subject:)`
+   with the signed-in user — approving needs a session and HTML, neither of
+   which is the engine's business;
+4. the client's next `POST /api/auth/device/token` carries the token away. It is
+   handed over exactly once and never stored in the clear afterwards.
+
+### Recognising a browser
+
+A bearer token is what a *client* carries; a browser carries a session, and the
+engine has no idea what a session is. A host that wants its signed-in visitors
+recognised on these endpoints too — so that clicking a download link on the site
+works the same way the client's download does — says how:
+
+```ruby
+c.subject_resolver = ->(request) { request.env["warden"]&.user }
+```
+
+Without one, a request with no bearer token is anonymous, which is what the
+read-only API always did. A resolver that raises is logged and treated as
+anonymous rather than taking the request down with it.
+
+The token is a `WarpEngine::ApplicationToken` with the `catalog` scope, sent as
+`Authorization: Bearer …`. `DELETE /api/auth/token` revokes it (signing out),
+and the admin lists both kinds of token and the sign-ins behind them.
+
+## Publish events
+
+Publishing a release emits an `ActiveSupport::Notifications` event, so a host
+can react to a new build without hanging a callback on the models:
+
+```ruby
+ActiveSupport::Notifications.subscribe("warp_engine.publish") do |*, payload|
+  payload[:software]  # WarpEngine::Software
+  payload[:release]   # WarpEngine::Release
+  payload[:platform]  # "godot"
+  payload[:name]      # "mygame"
+  payload[:version]   # "1.2.0"
+end
+```
+
+Hosts that must support older engine versions can feature-detect with
+`WarpEngine.respond_to?(:instruments_publish?) && WarpEngine.instruments_publish?`.
+
+Downloads emit one too — `warp_engine.download`, with `path`, `asset`,
+`release`, `software`, `subject` and the `Download` record — so a host can keep
+its own account of who fetched what without reaching into `DownloadService`.
+
 ## Public API

 | Endpoint | Purpose |
 | --- | --- |
-| `GET /api/software` | Full catalog with releases, assets, links, download counts; `?owner_id=` filters to one publisher |
+| `GET /api/service` | What this deployment is: version, whether the catalog gates, and how to sign in (or that you cannot) |
+| `GET /api/software` | Full catalog with releases, assets, links, download counts and an `access` block; `?owner_id=` filters to one publisher |
 | `GET /api/software/highlighted` | The currently highlighted title |
 | `GET /api/builds` | Expected asset kinds per platform (build matrix) |
 | `GET /api/softwares/:name/builds` | Actual vs. missing build assets per release |
 | `GET /api/image/:id` | Serves catalog images |
 | `GET /api/download?path=` | Serves an artifact and logs a download record |
 | `GET /file/*path` | Serves static build output (web-playable games, docs) |
+| `POST /api/auth/device` | Starts a device sign-in; returns the code pair (404 without a client identity) |
+| `POST /api/auth/device/token` | Polls a device sign-in for its token |
+| `DELETE /api/auth/token` | Revokes the bearer token on the request (signing out) |
+
+Every read endpoint accepts an optional `Authorization: Bearer …`; none requires
+one. What it changes is what the access policy is asked about — an anonymous
+caller is a normal, supported caller.
+
+### `WarpEngine-Version`
+
+Every response above carries the engine's version in a `WarpEngine-Version` header, so a
+client can branch on the engine's age without a round trip to ask:
+
+```
+$ curl -sI https://teletypegames.org/api/software | grep -i warpengine
+WarpEngine-Version: 0.5.0
+```
+
+Set before the action runs rather than after, which means an error response carries it
+too — a client needs the version most when something came back wrong. The name is
+`WarpEngine::VERSION_HEADER`, so nothing spells it out twice.

 ## Admin integration

@@ -296,6 +568,15 @@ host:
  former Go backend (Go zero-time timestamps, camelCase keys, legacy flat
  path fields).
 - Model extension points: `ActiveSupport.on_load(:warp_engine_<model>)` hooks.
+- **A software has one pipeline, and the newest assignment wins.** `Software#pipeline` is
+  a `has_one`, so two pipelines pointing at the same software is not an error the database
+  catches — it is a link that silently does nothing, with the software still showing
+  whichever row came first. Assigning a software that another pipeline holds therefore
+  *moves* it: the previous holder is left without one, the admin says which one it took it
+  from, and `Pipeline#software_taken_from` carries that list for anything else that cares.
+  Deliberately a callback rather than a unique index: rows here are soft-deleted, and a
+  unique index counts deleted rows, so a pipeline removed last year would block its
+  software from ever being linked again.

 ## Tests

@@ -2,7 +2,7 @@ ActiveAdmin.register WarpEngine::ApplicationToken, as: "Application Token" do
  actions :index, :show, :new, :create, :edit, :update, :destroy
  permit_params :name, :owner_id, :expires_at, :scopes_string, :unrestricted

-  menu priority: 9, label: "🎟️ App Tokens"
+  menu parent: "🌀 WarpEngine", priority: 9, label: "🎟️ App Tokens"

  config.sort_order = "created_at_desc"
  config.batch_actions = false
@@ -10,6 +10,12 @@ ActiveAdmin.register WarpEngine::ApplicationToken, as: "Application Token" do
  scope :all, default: true
  scope("Active")  { |scope| scope.where("expires_at IS NULL OR expires_at > ?", Time.current) }
  scope("Expired") { |scope| scope.where("expires_at <= ?", Time.current) }
+  # Two kinds of token share this table: one publishes software, the other reads the
+  # catalog from somebody's desktop client. They are told apart by scope, and an admin
+  # looking for one is rarely looking for the other.
+  CATALOG_SCOPE_SQL = %(JSON_CONTAINS(COALESCE(scopes, '[]'), '"catalog"')).freeze
+  scope("Publishing") { |scope| scope.where("NOT #{CATALOG_SCOPE_SQL}") }
+  scope("Clients")    { |scope| scope.where(CATALOG_SCOPE_SQL) }

  index do
    id_column
@@ -39,29 +45,48 @@ ActiveAdmin.register WarpEngine::ApplicationToken, as: "Application Token" do
                  include_blank: false
        else
          f.template.concat(f.template.content_tag(:li,
-            "application_token_owner_class nincs beállítva — token nem hozható létre.",
+            "application_token_owner_class is not configured — tokens cannot be created.",
            class: "flash flash_error"))
        end
      end
      f.input :name
      f.input :scopes_string, label: "Scopes (comma separated)",
-              hint: %(A /build/publish (és a legacy /update) végponthoz az "update", a /build/upload-hoz az "upload" scope kell.)
-      f.input :unrestricted, hint: "Belső token: az owner-izoláció (enforce_software_ownership) nem vonatkozik rá."
-      f.input :expires_at, hint: "Üresen hagyva sosem jár le."
+              hint: %(The "update" scope is required for /build/publish, the "upload" scope for /build/upload, the "catalog" scope for a client reading the API. Client tokens are normally issued by device sign-in rather than created here.)
+      f.input :unrestricted, hint: "Internal token: exempt from owner isolation (enforce_software_ownership)."
+      f.input :expires_at, hint: "Leave empty for a token that never expires."
    end
    f.actions
  end

+  action_item :rotate, only: :show do
+    if WarpEngine.woodpecker_configured?
+      link_to "Rotate Token", rotate_admin_application_token_path(resource),
+              method: :post, data: { confirm: "This will revoke the current token, create a new one, and push it to Woodpecker. Continue?" }
+    end
+  end
+
+  member_action :rotate, method: :post do
+    result = WarpEngine::SecretSyncService.new.rotate(resource)
+    if result[:rotated]
+      session[:warp_engine_plain_token] = result[:new_token].plain_token
+      redirect_to resource_path(result[:new_token]),
+        notice: "Token rotated and synced to #{result.dig(:sync_result, :synced)&.size || 0} pipeline(s)"
+    else
+      redirect_to resource_path(resource),
+        alert: "Rotation failed: #{result[:reason]}"
+    end
+  end
+
  show do
    if (plain = controller.instance_variable_get(:@plain_token))
-      panel "⚠️ Token — csak most látható, másold ki!" do
+      panel "⚠️ Token — shown only once, copy it now!" do
        pre plain, style: "font-family:monospace;font-size:14px;padding:8px;background:#fff3cd;user-select:all;"
      end
    end
    attributes_table do
      row :id
      row :name
-      row("Token") { |t| code "#{t.token_prefix}… (SHA256 digest tárolva)" }
+      row("Token") { |t| code "#{t.token_prefix}… (SHA256 digest stored)" }
      row("Owner") { |t| "#{t.owner_type} ##{t.owner_id} — #{t.owner.try(:email) || t.owner.try(:name)}" }
      row("Scopes") { |t| t.scopes_string }
      row :unrestricted
@@ -73,13 +98,26 @@ ActiveAdmin.register WarpEngine::ApplicationToken, as: "Application Token" do
  end

  controller do
-    # A plain token csak közvetlenül a létrehozás után létezik; a session-ön át
-    # jut el az egyszeri megjelenítésig (a flash nem jó: az AA layout minden
-    # flash kulcsot üzenetsávként renderel).
+    # The plain token only exists right after creation; it travels via the
+    # session to its one-time display (flash is unsuitable: the AA layout
+    # renders every flash key as a message bar).
    def create
      create! do |success, _failure|
        success.html do
          session[:warp_engine_plain_token] = resource.plain_token
+
+          if WarpEngine.woodpecker_configured?
+            service = WarpEngine::SecretSyncService.new
+            pipelines = service.pipelines_for_token(resource)
+            if pipelines.any?
+              result = service.provision(resource.plain_token, pipelines: pipelines)
+              flash[:notice] = "Token created and synced to #{result[:synced].size} pipeline(s)."
+              if result[:failed].any?
+                flash[:alert] = "Failed to sync to #{result[:failed].size} pipeline(s)."
+              end
+            end
+          end
+
          redirect_to resource_path(resource) and return
        end
      end
@@ -90,10 +128,12 @@ ActiveAdmin.register WarpEngine::ApplicationToken, as: "Application Token" do
      show!
    end

-    # Revoke = soft delete, audit-nyommal.
    def destroy
+      if WarpEngine.woodpecker_configured?
+        WarpEngine::SecretSyncService.new.deprovision(resource)
+      end
      resource.revoke!
-      redirect_to collection_path, notice: "Token revoked."
+      redirect_to collection_path, notice: "Token revoked and Woodpecker secrets cleaned up."
    end
  end
 end
@@ -0,0 +1,62 @@
+ActiveAdmin.register WarpEngine::DeviceGrant, as: "Device Sign-in" do
+  # Read-only on purpose. A grant is created by a client and answered by a person on the
+  # host's own page; an admin creating one by hand would be issuing somebody else a
+  # credential, which is not a thing this page should make easy.
+  actions :index, :show
+
+  menu parent: "🌀 WarpEngine", priority: 10, label: "📱 Device Sign-ins",
+       if: proc { WarpEngine.identity_configured? }
+
+  config.sort_order = "created_at_desc"
+  config.batch_actions = false
+
+  scope :all, default: true
+  scope("Pending")  { |scope| scope.where(approved_at: nil, denied_at: nil).where(expires_at: Time.current..) }
+  scope("Approved") { |scope| scope.where.not(approved_at: nil) }
+  scope("Denied")   { |scope| scope.where.not(denied_at: nil) }
+
+  index do
+    id_column
+    column("Code") { |g| code g.formatted_user_code, style: "font-family:monospace;" }
+    column("Device") { |g| g.client_name }
+    column("State") { |g| status_tag g.state.to_s }
+    column("Who") do |g|
+      next "—" if g.subject_id.blank?
+
+      subject = g.subject
+      subject.try(:email) || subject.try(:name) || "#{g.subject_type} ##{g.subject_id}"
+    end
+    column :expires_at
+    column :created_at
+  end
+
+  filter :client_name_cont, label: "Device"
+  filter :created_at
+  filter :expires_at
+
+  show do
+    attributes_table do
+      row("User code") { |g| code g.formatted_user_code, style: "font-family:monospace;" }
+      row("Device") { |g| g.client_name }
+      row("State") { |g| status_tag g.state.to_s }
+      row("Who") do |g|
+        next "—" if g.subject_id.blank?
+
+        subject = g.subject
+        subject.try(:email) || subject.try(:name) || "#{g.subject_type} ##{g.subject_id}"
+      end
+      # The device code itself is never shown: it is the client's live credential for as
+      # long as the grant is pending, and this page is not where it should leak from.
+      row("Token") do |g|
+        token = g.application_token
+        next "—" if token.nil?
+
+        link_to "#{token.token_prefix}… (#{token.name})", admin_application_token_path(token)
+      end
+      row :approved_at
+      row :denied_at
+      row :expires_at
+      row :created_at
+    end
+  end
+end
@@ -1,7 +1,7 @@
 ActiveAdmin.register WarpEngine::Download, as: "Download" do
  actions :index, :show

-  menu priority: 7, label: "📊 Download Stats"
+  menu parent: "🌀 WarpEngine", priority: 7, label: "📊 Download Stats"

  scope :all, default: true
  scope("Today")         { |scope| scope.where("downloads.created_at >= ?", Date.current.beginning_of_day) }
@@ -1,5 +1,5 @@
 ActiveAdmin.register_page "Files" do
-  menu priority: 6, label: "📁 Files"
+  menu parent: "🌀 WarpEngine", priority: 6, label: "📁 Files"

  content do
    service = WarpEngine::FileManagerService.new
@@ -1,7 +1,7 @@
 ActiveAdmin.register WarpEngine::Image, as: "Image" do
  permit_params :file_upload

-  menu priority: 5, label: "🖼️ Images"
+  menu parent: "🌀 WarpEngine", priority: 5, label: "🖼️ Images"

  # SoftwareImage a natív használó; a hoston regisztrált image_owners
  # (WarpEngine.config) további használókat adhat hozzá (pl. TTG Member).
@@ -0,0 +1,134 @@
+ActiveAdmin.register WarpEngine::Pipeline, as: "Pipeline" do
+  actions :index, :show, :edit, :update
+
+  # Without this the edit form cannot save at all: ActiveAdmin hands unpermitted params to
+  # the model and Rails raises ForbiddenAttributesError. The two fields here are the two
+  # the form offers; everything else about a pipeline comes from the Woodpecker sync.
+  permit_params :platform, :software_id
+
+  menu parent: "🌀 WarpEngine", priority: 10, label: "🚀 Pipelines"
+
+  config.sort_order = "repo_name_asc"
+  config.batch_actions = false
+
+  scope :all, default: true
+  scope("Active")   { |s| s.where(active: true) }
+  scope("Inactive") { |s| s.where(active: false) }
+
+  WarpEngine::PlatformLink::SUPPORTED_PLATFORMS.each do |p|
+    scope(p.capitalize) { |s| s.where(platform: p) }
+  end
+
+  index do
+    id_column
+    column :repo_owner
+    column :repo_name
+    column :platform
+    column("Software") { |r| r.software ? link_to(r.software.title, admin_software_path(r.software)) : "-" }
+    column(:active) { |r| status_tag(r.active ? "active" : "inactive", class: r.active ? "yes" : "no") }
+    column("Pipeline") { |r|
+      if r.last_pipeline_status
+        status_tag r.last_pipeline_status,
+                   class: r.last_pipeline_status == "success" ? "yes" : "no"
+      else
+        "-"
+      end
+    }
+    column :last_pipeline_at
+    actions defaults: true do |pipeline|
+      if pipeline.active && WarpEngine.woodpecker_configured?
+        item "Trigger", trigger_admin_pipeline_path(pipeline), method: :post, class: "member_link"
+      end
+    end
+  end
+
+  filter :repo_name
+  filter :platform, as: :select, collection: WarpEngine::PlatformLink::SUPPORTED_PLATFORMS
+  filter :active
+
+  form do |f|
+    f.inputs do
+      f.input :platform, as: :select, collection: WarpEngine::PlatformLink::SUPPORTED_PLATFORMS
+      f.input :software_id, as: :select,
+              collection: WarpEngine::Software.order(:title).map { |s| [ s.title, s.id ] },
+              include_blank: "- none -",
+              hint: "One pipeline per software. Picking one that another pipeline already " \
+                    "has moves the link here — that pipeline is left without a software, " \
+                    "and the move is written to the log."
+    end
+    f.actions
+  end
+
+  sidebar "Details", only: :show do
+    attributes_table_for resource do
+      row :id
+      row :woodpecker_repo_id
+      row :repo_owner
+      row :repo_name
+      row :platform
+      row("Software") { |r| r.software ? link_to(r.software.title, admin_software_path(r.software)) : "-" }
+      row(:active) { |r| status_tag(r.active ? "active" : "inactive", class: r.active ? "yes" : "no") }
+      row :last_pipeline_status
+      row :last_pipeline_at
+      row :created_at
+      row :updated_at
+    end
+  end
+
+  show do
+    panel "Pipelines" do
+      if !WarpEngine.woodpecker_configured?
+        para "Woodpecker is not configured. Set woodpecker_url and woodpecker_api_token in the WarpEngine initializer.",
+             style: "color:#999;"
+      elsif !resource.active
+        para "This repository is inactive.", style: "color:#999;"
+      else
+        begin
+          pipelines = WarpEngine::PipelineService.new.list_pipelines(resource, page: 1)
+          if pipelines.is_a?(Array) && pipelines.any?
+            table_for pipelines.first(10) do
+              column("Number") { |p| p["number"] }
+              column("Status") { |p| status_tag p["status"], class: p["status"] == "success" ? "yes" : "no" }
+              column("Branch") { |p| p["branch"] }
+              column("Message") { |p| p["message"]&.truncate(60) }
+              # Woodpecker returns unix epoch seconds in "created"
+              column("Created") { |p| p["created"] ? Time.zone.at(p["created"]).strftime("%Y-%m-%d %H:%M") : "-" }
+            end
+          else
+            para "No pipelines found.", style: "color:#999;"
+          end
+        rescue => e
+          para "Error fetching pipelines: #{e.message}", style: "color:red;"
+        end
+      end
+    end
+  end
+
+  member_action :trigger, method: :post do
+    pipeline = WarpEngine::Pipeline.find(params[:id])
+    WarpEngine::PipelineService.new.trigger(pipeline)
+    redirect_to resource_path(pipeline), notice: "Pipeline triggered for #{pipeline.full_name}"
+  rescue => e
+    redirect_to resource_path(pipeline), alert: "Trigger failed: #{e.message}"
+  end
+
+  collection_action :sync, method: :post do
+    result = WarpEngine::PipelineSyncService.new.sync_all
+    redirect_to collection_path,
+      notice: "Synced: #{result[:created].size} new, #{result[:updated].size} updated, #{result[:deactivated].size} deactivated"
+  rescue => e
+    redirect_to collection_path, alert: "Sync failed: #{e.message}"
+  end
+
+  action_item :sync_repos, only: :index do
+    if WarpEngine.woodpecker_configured?
+      link_to "Sync from Woodpecker", sync_admin_pipelines_path, method: :post
+    end
+  end
+
+  controller do
+    def scoped_collection
+      super.includes(:software)
+    end
+  end
+end
@@ -1,7 +1,7 @@
 ActiveAdmin.register WarpEngine::PlatformLink, as: "Platform Link" do
  permit_params :name, :url, :platform, :position

-  menu priority: 5, label: "🔗 Platform Links"
+  menu parent: "🌀 WarpEngine", priority: 5, label: "🔗 Platform Links"

  config.sort_order = "platform_asc"

@@ -6,7 +6,7 @@ ActiveAdmin.register WarpEngine::Software, as: "Software" do
                releases_attributes: [ :id, :version, :_destroy,
                                       { release_assets_attributes: [ :id, :kind, :path, :_destroy ] } ]

-  menu priority: 2, label: "🎮 Softwares"
+  menu parent: "🌀 WarpEngine", priority: 2, label: "🎮 Softwares"

  actions :all, except: [ :edit ]

@@ -52,6 +52,15 @@ ActiveAdmin.register WarpEngine::Software, as: "Software" do
        text_node "View on site"
      end
    end
+
+    if resource.pipeline
+      div style: "margin-bottom:8px;" do
+        a href: admin_pipeline_path(resource.pipeline), style: "display:inline-flex;align-items:center;gap:6px;font-weight:bold;color:#5850ec;" do
+          span "🚀", style: "font-size:16px;"
+          text_node "Pipelines"
+        end
+      end
+    end
  end

  sidebar "Download Statistics", only: :show do
@@ -0,0 +1,74 @@
+module WarpEngine
+  # Who the caller is, on the read-only side of the API.
+  #
+  # Distinct from UpdateAuthentication, which guards publishing: that one asks "may this
+  # pipeline write to the catalog", this one asks "whose library am I looking at". The
+  # answer is allowed to be nobody — an anonymous caller is a normal, supported caller,
+  # and a catalog with no policy configured never needs one.
+  #
+  # The credential is a bearer token, because that is what a client can carry: it has no
+  # cookie jar and no browser session.
+  module SubjectAuthentication
+    extend ActiveSupport::Concern
+
+    private
+
+    # The ApplicationToken behind the request, or nil.
+    def current_access_token
+      return @current_access_token if defined?(@current_access_token)
+
+      @current_access_token = resolve_access_token
+    end
+
+    # Whoever the request is on behalf of — the host's own object, or nil.
+    #
+    # Two ways to be somebody, tried in that order. A bearer token is what a client
+    # carries. A *browser* carries a session instead, and the engine has no idea what a
+    # session is here — so a host that wants its signed-in visitors recognised on these
+    # endpoints supplies a resolver:
+    #
+    #   c.subject_resolver = ->(request) { request.env["warden"]&.user }
+    #
+    # Without one, a browser is simply anonymous, which is what it always was.
+    def current_subject
+      return @current_subject if defined?(@current_subject)
+
+      @current_subject = current_access_token&.owner || resolve_host_subject
+    end
+
+    def resolve_access_token
+      return nil unless WarpEngine.identity_configured?
+
+      token = bearer_token
+      return nil if token.blank?
+
+      record = WarpEngine::ApplicationToken.authenticate(
+        token, required_scope: WarpEngine::ApplicationToken::CATALOG_SCOPE
+      )
+      return nil if record.nil?
+
+      record.touch_last_used!
+      record
+    end
+
+    # A resolver that raises must not take the request with it: it runs on every read
+    # endpoint, and a broken one would turn the whole API into 500s rather than into
+    # anonymous requests, which is the honest fallback.
+    def resolve_host_subject
+      resolver = WarpEngine.config.subject_resolver
+      return nil if resolver.nil?
+
+      resolver.call(request)
+    rescue StandardError => e
+      Rails.logger.error("[WarpEngine::SubjectAuthentication] subject_resolver #{e.class}: #{e.message}")
+      nil
+    end
+
+    def bearer_token
+      header = request.headers["Authorization"].to_s
+      return nil unless header.start_with?("Bearer ")
+
+      header.delete_prefix("Bearer ").strip.presence
+    end
+  end
+end
@@ -1,7 +1,7 @@
 module WarpEngine
-  # Token-hitelesítés a publikáló (/build/*) endpointokhoz.
-  # A hitelesítési forrás kizárólagos: :database módban a shared secret nem
-  # érvényes, :env módban a DB-tokenek nem.
+  # Token authentication for the publishing (/build/*) endpoints.
+  # The auth source is exclusive: in :database mode the shared secret is not
+  # accepted, in :env mode DB tokens are not.
  module UpdateAuthentication
    extend ActiveSupport::Concern

@@ -9,8 +9,8 @@ module WarpEngine

    attr_reader :current_application_token

-    # A token kizárólag az X-Update-Secret headerből jöhet — URL-ben a secret
-    # proxy- és access-logokba szivárogna.
+    # The token is accepted from the X-Update-Secret header only — in the URL
+    # it would leak into proxy and access logs.
    def update_authorized?(required_scope:)
      token = request.headers["X-Update-Secret"].presence
      return false if token.blank?
@@ -23,13 +23,13 @@ module WarpEngine

    def env_secret_authorized?(token)
      expected = WarpEngine.config.update_secret
-      # Konfigurálatlan secret esetén az endpoint zárva marad.
+      # With no secret configured the endpoint stays closed.
      expected.present? && ActiveSupport::SecurityUtils.secure_compare(token, expected)
    end

    def database_token_authorized?(token, required_scope)
      if WarpEngine.config.application_token_owner_class.blank?
-        Rails.logger.error("[#{self.class.name}] application_token_source=:database, de application_token_owner_class nincs beállítva — minden kérés elutasítva")
+        Rails.logger.error("[#{self.class.name}] application_token_source=:database but application_token_owner_class is not set — rejecting every request")
        return false
      end

@@ -41,9 +41,9 @@ module WarpEngine
      true
    end

-    # Owner-kényszer: csak :database módban (van token) és bekapcsolt
-    # enforce_software_ownership mellett szűr. Owner nélküli software a
-    # backfillig szabad préda — a kényszer bekapcsolása előtt kell backfillelni.
+    # Ownership enforcement applies only in :database mode (there is a token)
+    # with enforce_software_ownership on. An ownerless software is up for grabs
+    # until the backfill — backfill before enabling the enforcement.
    def software_ownership_authorized?(name)
      return true unless WarpEngine.config.enforce_software_ownership

@@ -56,8 +56,8 @@ module WarpEngine
      software.owner_type == token.owner_type && software.owner_id == token.owner_id
    end

-    # Az először publikált (vagy backfill előtti, gazdátlan) software a beküldő
-    # token ownerét kapja. Unrestricted (belső) token nem foglal ownert.
+    # A first-published (or pre-backfill, ownerless) software gets the
+    # submitting token's owner. Unrestricted (internal) tokens claim nothing.
    def claim_software_ownership(name)
      token = current_application_token
      return if token.nil? || token.unrestricted?
@@ -0,0 +1,61 @@
+module WarpEngine
+  # The device authorization grant, client side (RFC 8628).
+  #
+  # Both actions are unauthenticated, and have to be: the whole point of the flow is
+  # that the caller has no credential yet. What protects it is that a device code is
+  # useless until a signed-in person approves it on the host's own page.
+  class Api::Auth::DevicesController < ApiController
+    before_action :ensure_identity_configured
+
+    resource_description do
+      short "Device sign-in"
+    end
+
+    api :POST, "/api/auth/device", "Start a device sign-in and get a code pair"
+    param :client_name, String, required: false, desc: "What to call this device in the person's account"
+    returns code: 200, desc: "The code pair and where to take it"
+    error code: 404, desc: "This deployment has no client sign-in"
+    def create
+      grant = service.request(client_name: params[:client_name])
+
+      render json: {
+        deviceCode:      grant.device_code,
+        userCode:        grant.formatted_user_code,
+        verificationUrl: service.verification_url(base_url: request.base_url),
+        interval:        WarpEngine.config.device_code_interval.to_i,
+        expiresIn:       (grant.expires_at - Time.current).to_i
+      }
+    end
+
+    api :POST, "/api/auth/device/token", "Poll a device sign-in for its token"
+    param :device_code, String, required: true, desc: "The device code from POST /api/auth/device"
+    returns code: 200, desc: "state is one of pending, approved, denied, expired"
+    error code: 404, desc: "No such device code, or no client sign-in here"
+    def token
+      state, plain = service.poll(device_code: params[:device_code])
+
+      # The token rides on the one poll that finds the grant newly approved; a client
+      # that loses it starts the flow again. Keeping a plain token around to hand out
+      # twice would mean storing it, which is the thing this design avoids.
+      body = { state: state.to_s }
+      body[:token] = plain if plain.present?
+      render json: body
+    rescue WarpEngine::DeviceGrantService::UnknownCode
+      render json: { error: "Not found" }, status: :not_found
+    end
+
+    private
+
+    def service
+      @service ||= WarpEngine::DeviceGrantService.new
+    end
+
+    # A deployment with no configured subject class has no sign-in at all, and says so
+    # the same way GET /api/service does — by not offering it.
+    def ensure_identity_configured
+      return if WarpEngine.identity_configured?
+
+      render json: { error: "Not found" }, status: :not_found
+    end
+  end
+end
@@ -0,0 +1,24 @@
+module WarpEngine
+  # Signing out: a client throws away its own token.
+  #
+  # Revocation is a soft delete on the ApplicationToken, so the record of which device
+  # signed in and when survives it. The person's own list of devices — where somebody
+  # revokes a token for a laptop they no longer have — is the host's page, because it
+  # needs a session and a browser.
+  class Api::Auth::TokensController < ApiController
+    resource_description do
+      short "Client tokens"
+    end
+
+    api :DELETE, "/api/auth/token", "Revoke the bearer token this request carries"
+    returns code: 204, desc: "Revoked"
+    error code: 401, desc: "No usable bearer token on the request"
+    def destroy
+      token = current_access_token
+      return head(:unauthorized) if token.nil?
+
+      WarpEngine::DeviceGrantService.new.revoke(token: token)
+      head :no_content
+    end
+  end
+end
@@ -0,0 +1,74 @@
+module WarpEngine
+  module Api
+    class CiController < ApiController
+      include UpdateAuthentication
+
+      before_action :require_woodpecker!
+
+      resource_description do
+        short "CI pipeline management"
+      end
+
+      api :GET, "/api/ci/pipelines", "List active pipelines"
+      returns code: 200, desc: "JSON array of tracked pipelines"
+      error code: 503, desc: "Woodpecker not configured"
+      def pipelines
+        records = Pipeline.active.includes(:software)
+        render json: records.map { |p| pipeline_json(p) }
+      end
+
+      api :GET, "/api/ci/pipelines/:id/status", "Get a pipeline with its latest run"
+      param :id, :number, required: true, desc: "Pipeline id"
+      returns code: 200, desc: "JSON with pipeline and latest run data"
+      error code: 503, desc: "Woodpecker not configured"
+      def status
+        pipeline = Pipeline.find(params[:id])
+        latest_run = begin
+          PipelineService.new.pipeline_detail(pipeline, "latest")
+        rescue WoodpeckerClient::ApiError
+          nil
+        end
+        render json: { pipeline: pipeline_json(pipeline), latest_run: latest_run }
+      end
+
+      api :POST, "/api/ci/pipelines/:id/trigger", "Trigger a pipeline"
+      header "X-Update-Secret", "Shared secret or application token (update scope)", required: true
+      param :id, :number, required: true, desc: "Pipeline id"
+      param :branch, String, required: false, desc: "Branch to build (default: main)"
+      returns code: 200, desc: "JSON with triggered run data"
+      error code: 401, desc: "Invalid secret"
+      error code: 503, desc: "Woodpecker not configured"
+      def trigger
+        unless update_authorized?(required_scope: ApplicationToken::UPDATE_SCOPE)
+          return render json: { error: "Unauthorized" }, status: :unauthorized
+        end
+
+        pipeline = Pipeline.find(params[:id])
+        result = PipelineService.new.trigger(pipeline, branch: params[:branch] || "main")
+        render json: { triggered: true, pipeline: result }
+      end
+
+      private
+
+      def require_woodpecker!
+        return if WarpEngine.woodpecker_configured?
+
+        render json: { error: "Woodpecker not configured" }, status: :service_unavailable
+      end
+
+      def pipeline_json(pipeline)
+        {
+          id: pipeline.id,
+          woodpecker_repo_id: pipeline.woodpecker_repo_id,
+          repo_owner: pipeline.repo_owner,
+          repo_name: pipeline.repo_name,
+          platform: pipeline.platform,
+          active: pipeline.active,
+          software_name: pipeline.software&.name,
+          last_pipeline_status: pipeline.last_pipeline_status,
+          last_pipeline_at: pipeline.last_pipeline_at
+        }
+      end
+    end
+  end
+end
@@ -8,23 +8,29 @@ module WarpEngine
    api :GET, "/api/download", "Download a file by path"
    param :path, String, required: true, desc: "File path to download"
    returns code: 200, desc: "File binary data"
+    returns code: 302, desc: "Redirect to the storage location (non-local storage adapter)"
    error code: 400, desc: "Path is blank"
+    error code: 403, desc: "The access policy refused this caller"
    error code: 404, desc: "File not found"
    def show
      path = params[:path]
      return render(json: { error: "Path is required" }, status: :bad_request) if path.blank?

-      full_path = WarpEngine::DownloadService.new.create(
+      location = WarpEngine::DownloadService.new.locate(
        path: path,
        ip: request.remote_ip,
        user_agent: request.user_agent,
-        referer: request.referer
+        referer: request.referer,
+        subject: current_subject,
+        request: request
      )

-      if full_path
-        send_file full_path, disposition: "attachment", type: resolve_mime(full_path)
-      else
+      if location.nil?
        render json: { error: "Not found" }, status: :not_found
+      elsif location.redirect?
+        redirect_to location.url, allow_other_host: true
+      else
+        send_file location.path, disposition: "attachment", type: resolve_mime(location.path)
      end
    end
  end
@@ -0,0 +1,62 @@
+module WarpEngine
+  # What this deployment is and what it can do, in one unauthenticated request.
+  #
+  # This is how a client stops guessing. Before it existed, everything a client knew
+  # about a store was compiled into the client — which endpoints to call, whether
+  # signing in was a thing here, where to send somebody who wanted to buy something.
+  # Every one of those is a property of the *server*, and a client that carries them
+  # can only ever serve the one store it was built for.
+  class Api::ServiceController < ApiController
+    resource_description do
+      short "Service descriptor"
+    end
+
+    api :GET, "/api/service", "What this WarpEngine deployment offers"
+    desc <<~DESC
+      Public on purpose: a client reads this *before* it can have a credential.
+
+      `auth` is null where the host has configured no client identity — the catalog is
+      open, there is nobody to sign in as, and a client should not offer to. Where it is
+      present, `auth.device` describes the device authorization grant a client with no
+      browser of its own uses to sign in.
+
+      `catalog.gated` says whether any title here can require an entitlement. A client
+      can render a store that never gates differently from one that sometimes does,
+      without having to read the whole catalog first to find out.
+    DESC
+    returns code: 200, desc: "The descriptor" do
+      property :engine, String, desc: "Always 'warp_engine'"
+      property :version, String, desc: "Engine version, same value as the WarpEngine-Version header"
+      property :catalog, Hash, desc: "Catalog properties" do
+        property :gated, :boolean, desc: "Whether titles here can require an entitlement"
+      end
+      property :auth, Hash, desc: "How to sign in, or null where there is no sign-in"
+    end
+    def show
+      render json: {
+        engine:  "warp_engine",
+        version: WarpEngine::VERSION,
+        catalog: { gated: !WarpEngine::AccessPolicy.open? },
+        auth:    auth_descriptor
+      }
+    end
+
+    private
+
+    def auth_descriptor
+      return nil unless WarpEngine.identity_configured?
+
+      service = WarpEngine::DeviceGrantService.new
+      {
+        schemes: [ "bearer" ],
+        device: {
+          authorizeUrl:    warp_engine.api_auth_device_url,
+          tokenUrl:        warp_engine.api_auth_device_token_url,
+          revokeUrl:       warp_engine.api_auth_token_url,
+          verificationUrl: service.verification_url(base_url: request.base_url),
+          interval:        WarpEngine.config.device_code_interval.to_i
+        }
+      }
+    end
+  end
+end
@@ -56,7 +56,7 @@ module WarpEngine
      end
    end
    def index
-      render json: WarpEngine::SoftwareService.new.index(owner_id: params[:owner_id])
+      render json: WarpEngine::SoftwareService.new.index(owner_id: params[:owner_id], subject: current_subject)
    end
  end
 end
@@ -34,7 +34,7 @@ module WarpEngine
    end
    error code: 404, desc: "No highlighted software found"
    def index
-      result = WarpEngine::SoftwareHighlightedService.new.index
+      result = WarpEngine::SoftwareHighlightedService.new.index(subject: current_subject)
      if result
        render json: result
      else
@@ -5,6 +5,16 @@ module WarpEngine
      formats [ "json" ]
    end

+    # Every response the engine serves names the version that served it, so a client can
+    # branch on the engine's age without a round trip to ask. Set *before* the action,
+    # not after: an error handled by `rescue_from` never reaches an after_action, and a
+    # client needs the version most when something came back wrong.
+    before_action :set_version_header
+
+    # Every read-only endpoint may be called with a bearer token; none of them requires
+    # one. See WarpEngine::SubjectAuthentication.
+    include WarpEngine::SubjectAuthentication
+
    rescue_from StandardError do |e|
      Rails.logger.error("[#{self.class.name}] #{e.class}: #{e.message}")
      render json: { error: "Internal server error" }, status: :internal_server_error
@@ -22,8 +32,22 @@ module WarpEngine
      render json: { error: e.message }, status: :bad_request
    end

+    rescue_from WarpEngine::DownloadService::Denied do
+      render json: { error: "Forbidden" }, status: :forbidden
+    end
+
    private

+    def set_version_header
+      # The name is spelled out here rather than taken from WarpEngine::VERSION_HEADER on
+      # purpose. A deployed process can end up with these controllers and an older
+      # `lib/` — it happened on the first deploy of this feature — and a controller that
+      # needs a constant from the newer half answers 500 to every request instead of
+      # serving the catalog. A response header is not worth that fragility. The constant
+      # is still the documented name, and a spec holds the two together.
+      response.headers["WarpEngine-Version"] = WarpEngine::VERSION
+    end
+
    def resolve_mime(path)
      ext = File.extname(path.to_s).delete_prefix(".")
      Mime::Type.lookup_by_extension(ext) || "application/octet-stream"
@@ -0,0 +1,83 @@
+module WarpEngine
+  module Build
+    # Woodpecker configuration-extension endpoint: on every pipeline start the
+    # CI server POSTs the repo's marker file and receives the platform's full
+    # pipeline YAML. GET renders the same thing as a preview.
+    class ConfigsController < ApiController
+      resource_description do
+        short "Woodpecker CI pipeline configs"
+      end
+
+      api :GET, "/build/config", "Preview the generated pipeline config for a platform"
+      param :platform, String, required: true, desc: "Platform (a configured ci_platforms key, e.g. tic80)"
+      param :name, String, required: false, desc: "Software name substituted into the pipeline (default: example)"
+      returns code: 200, desc: "Pipeline YAML (text/yaml)"
+      error code: 404, desc: "Unknown platform"
+      def show
+        yaml = render_config(platform: params[:platform], name: params[:name].presence || "example")
+        return render json: { error: "Unknown platform" }, status: :not_found if yaml.nil?
+
+        render plain: yaml, content_type: "text/yaml"
+      end
+
+      api :POST, "/build/config", "Woodpecker configuration extension endpoint"
+      description <<~DESC
+        Called by the Woodpecker server on every pipeline start (httpsig-signed request).
+        If the repo's .woodpecker.yaml is a marker (has a `platform:` key), responds with
+        the generated pipeline; otherwise responds 204 so the repo's own config runs.
+      DESC
+      returns code: 200, desc: %(JSON: {"configs": [{"name": ..., "data": "<pipeline YAML>"}]})
+      returns code: 204, desc: "Not a marker config — keep the repo's own configuration"
+      error code: 403, desc: "Missing or invalid request signature"
+      error code: 422, desc: "Marker requests an unknown platform"
+      def create
+        unless WarpEngine::CiSignatureVerifier.new(request).valid?
+          return render json: { error: "Invalid signature" }, status: :forbidden
+        end
+
+        marker = find_marker
+        return head :no_content if marker.nil?
+
+        platform = marker["platform"].to_s
+        name     = marker["name"].presence || repo_name
+        yaml     = render_config(platform: platform, name: name)
+        if yaml.nil?
+          return render json: { error: "Unknown platform: #{platform}" }, status: :unprocessable_entity
+        end
+
+        render json: { configs: [ { name: platform, data: yaml } ] }
+      end
+
+      private
+
+      def render_config(platform:, name:)
+        WarpEngine::CiConfigService.new.render(
+          platform:      platform,
+          name:          name,
+          update_server: WarpEngine.config.ci_update_server.presence || request.base_url
+        )
+      end
+
+      # The first submitted config that parses as a marker (Hash with a `platform`
+      # key). The docs call the key "configuration", the example-config-service
+      # uses "configs" — accept both.
+      def find_marker
+        configs = params[:configuration].presence || params[:configs].presence || []
+        configs.each do |config|
+          data = config[:data].to_s
+          parsed = begin
+            YAML.safe_load(data)
+          rescue Psych::Exception
+            nil
+          end
+          return parsed if parsed.is_a?(Hash) && parsed.key?("platform")
+        end
+        nil
+      end
+
+      def repo_name
+        params.dig(:repo, :name).to_s
+      end
+    end
+  end
+end
@@ -29,13 +29,13 @@ module WarpEngine
          return render json: { error: "Forbidden" }, status: :forbidden
        end

-        input = WarpEngine::UpdateInputDto.new(
+        input = WarpEngine::PublishInputDto.new(
          platform: params[:platform],
          name:     params[:name],
          version:  params[:version]
        )

-        WarpEngine::UpdateService.new.update(input)
+        WarpEngine::PublishService.new.publish(input)
        claim_software_ownership(params[:name])

        render json: { published: true, name: params[:name], platform: params[:platform], version: params[:version] }
@@ -9,11 +9,11 @@ module WarpEngine
        short "Build artifact upload"
      end

-      # A release-fájlnevek kötött konvenciója: <name>-<version>.<ext> vagy
-      # <name>-<version>-<target>.zip — az updater is ezeket keresi.
+      # Release file naming convention: <name>-<version>.<ext> or
+      # <name>-<version>-<target>.zip — the updater looks for these too.
      NAME_FORMAT = /\A[A-Za-z0-9._-]+\z/

-      api :POST, "/build/upload", "Upload a build artifact into the drop area"
+      api :POST, "/build/upload", "Upload a build artifact into the artifact directory"
      header "X-Update-Secret", "Shared secret or application token (upload scope)", required: true
      param :name, String, required: true, desc: "Software name (filename must be prefixed with <name>-<version>)"
      param :version, String, required: true, desc: "Version string"
@@ -9,9 +9,12 @@ module WarpEngine
    param :path, String, required: true, desc: "File path"
    returns code: 200, desc: "File binary data"
    returns code: 301, desc: "Redirect to file URL"
+    error code: 403, desc: "The access policy refused this caller"
    error code: 404, desc: "File not found"
    def show
-      result = WarpEngine::FileService.new.show(WarpEngine::FileShowInputDto.new(path: params[:path]))
+      result = WarpEngine::FileService.new.show(
+        WarpEngine::FileShowInputDto.new(path: params[:path]), subject: current_subject
+      )
      case result.type
      when :redirect  then redirect_to result.url, status: :moved_permanently
      when :file      then send_file result.path, disposition: "inline", type: resolve_mime(result.path)
@@ -1,5 +1,5 @@
 module WarpEngine
-  UpdateInputDto = Struct.new(:platform, :name, :version, keyword_init: true) do
+  PublishInputDto = Struct.new(:platform, :name, :version, keyword_init: true) do
    def initialize(platform:, name:, version: nil)
      super
    end
@@ -0,0 +1,8 @@
+module WarpEngine
+  class ApplicationJob < ActiveJob::Base
+    retry_on WoodpeckerClient::ConnectionError, wait: 30.seconds, attempts: 3
+    discard_on WoodpeckerClient::ApiError do |job, error|
+      Rails.logger.error("[#{job.class.name}] discarded: #{error.message}")
+    end
+  end
+end
@@ -0,0 +1,9 @@
+module WarpEngine
+  class PipelineSyncJob < ApplicationJob
+    queue_as :default
+
+    def perform
+      PipelineSyncService.new.sync_all
+    end
+  end
+end
@@ -6,9 +6,12 @@ module WarpEngine

    UPDATE_SCOPE = "update".freeze
    UPLOAD_SCOPE = "upload".freeze
+    # A token held by a *client* rather than a publisher: it reads the catalog and
+    # downloads artifacts, and it never publishes anything.
+    CATALOG_SCOPE = "catalog".freeze

-    # A generált token csak létrehozáskor, memóriában érhető el — a DB-ben
-    # kizárólag a SHA256 digest és a nem-titkos prefix tárolódik.
+    # The generated token is only available in memory at creation time — the DB
+    # stores nothing but the SHA256 digest and the non-secret prefix.
    attr_reader :plain_token

    belongs_to :owner, polymorphic: true
@@ -30,7 +33,7 @@ module WarpEngine
      Digest::SHA256.hexdigest(token)
    end

-    # Az élő (nem törölt, nem lejárt), a kért scope-pal rendelkező token, különben nil.
+    # The live (not deleted, not expired) token carrying the required scope, else nil.
    def self.authenticate(token, required_scope: nil)
      return nil if token.blank?

@@ -45,7 +48,7 @@ module WarpEngine
      expires_at.present? && expires_at <= Time.current
    end

-    # Visszavonás = soft delete, az audit-nyom megmarad.
+    # Revocation = soft delete, the audit trail stays.
    def revoke!
      update_column(:deleted_at, Time.current)
    end
@@ -54,7 +57,7 @@ module WarpEngine
      update_column(:last_used_at, Time.current)
    end

-    # Admin form: vesszővel elválasztott scope-lista
+    # Admin form: comma separated scope list
    def scopes_string
      Array(scopes).join(", ")
    end
@@ -67,7 +70,7 @@ module WarpEngine
      %w[created_at deleted_at expires_at id last_used_at name owner_id owner_type token_prefix unrestricted updated_at]
    end

-    # A polimorf owner asszociációra a Ransack nem tud szűrni.
+    # Ransack cannot filter on the polymorphic owner association.
    def self.ransackable_associations(auth_object = nil)
      []
    end
@@ -78,6 +81,15 @@ module WarpEngine
      self.owner_type = WarpEngine.config.application_token_owner_class if owner_type.blank?
    end

+    # Publishing tokens and client tokens share this table but not their owners: one
+    # belongs to whoever ships software, the other to whoever buys it. Both classes are
+    # the host's to name, and either is acceptable here — which of the two a given token
+    # may do is decided by its scopes, not by its owner.
+    def self.permitted_owner_types
+      [ WarpEngine.config.application_token_owner_class,
+        WarpEngine.config.access_token_owner_class ].compact_blank
+    end
+
    def generate_token
      return if token_digest.present?

@@ -87,11 +99,11 @@ module WarpEngine
    end

    def owner_type_matches_configuration
-      expected = WarpEngine.config.application_token_owner_class
-      if expected.blank?
+      permitted = self.class.permitted_owner_types
+      if permitted.empty?
        errors.add(:base, "application_token_owner_class is not configured")
-      elsif owner_type != expected
-        errors.add(:owner_type, "must be #{expected}")
+      elsif !permitted.include?(owner_type)
+        errors.add(:owner_type, "must be #{permitted.join(' or ')}")
      end
    end

@@ -0,0 +1,97 @@
+module WarpEngine
+  # One pending sign-in from a client that has no browser of its own.
+  #
+  # The shape is RFC 8628's device authorization grant, and the reason for it is that a
+  # desktop client cannot host a login form without asking a person to type a password
+  # into a window that is not a browser. So the client asks for a pair of codes, sends
+  # the person to the host's own page with the short one, and polls with the long one
+  # until somebody approves it.
+  #
+  # Short-lived by design: this row exists for the minute or two between "the client
+  # asked" and "the person answered". What survives it is the ApplicationToken.
+  class DeviceGrant < ApplicationRecord
+    self.table_name = "device_grants"
+
+    # No I, O, 0 or 1: this alphabet is read off one screen and typed into another, and
+    # those four are where that goes wrong.
+    USER_CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789".freeze
+    USER_CODE_LENGTH   = 8
+
+    belongs_to :application_token, class_name: "WarpEngine::ApplicationToken", optional: true
+    belongs_to :subject, polymorphic: true, optional: true
+
+    validates :device_code, presence: true, uniqueness: true
+    validates :user_code, presence: true, uniqueness: true
+    validates :expires_at, presence: true
+
+    scope :pending, -> { where(approved_at: nil, denied_at: nil).where(expires_at: Time.current..) }
+
+    before_validation :generate_codes, on: :create
+    before_validation :set_expiry, on: :create
+
+    def self.find_pending_by_user_code(code)
+      pending.find_by(user_code: normalize_user_code(code))
+    end
+
+    # Typed by a person, so it arrives with whatever case and separators they used.
+    def self.normalize_user_code(code)
+      code.to_s.upcase.gsub(/[^A-Z0-9]/, "")
+    end
+
+    def expired? = expires_at <= Time.current
+    def approved? = approved_at.present?
+    def denied? = denied_at.present?
+
+    # What the polling client is told. Order matters: a denied grant is denied even
+    # after it expires, because "somebody said no" is the more useful answer.
+    def state
+      return :denied if denied?
+      return :approved if approved?
+      return :expired if expired?
+
+      :pending
+    end
+
+    # Grouped for reading aloud and for typing: WARP-K7M2.
+    def formatted_user_code
+      user_code.to_s.scan(/.{1,4}/).join("-")
+    end
+
+    # Housekeeping for a host that wants it: an expired grant has nothing left to give,
+    # and its issued_token would be a live secret nobody is waiting for.
+    def self.sweep_expired!
+      where(expires_at: ...Time.current).where.not(issued_token: nil).update_all(issued_token: nil)
+    end
+
+    def self.ransackable_attributes(auth_object = nil)
+      %w[approved_at client_name created_at denied_at expires_at id subject_id subject_type updated_at user_code]
+    end
+
+    def self.ransackable_associations(auth_object = nil)
+      []
+    end
+
+    private
+
+    def generate_codes
+      self.device_code = SecureRandom.hex(32) if device_code.blank?
+      self.user_code = self.class.generate_user_code if user_code.blank?
+    end
+
+    def self.generate_user_code
+      # Retried rather than trusted: the alphabet is small enough that a collision is
+      # a real, if rare, event, and a unique index would turn it into a 500.
+      10.times do
+        candidate = Array.new(USER_CODE_LENGTH) { USER_CODE_ALPHABET.chars.sample }.join
+        return candidate unless exists?(user_code: candidate)
+      end
+      raise "could not generate a free device user code"
+    end
+
+    def set_expiry
+      self.expires_at ||= WarpEngine.config.device_code_ttl.to_i.seconds.from_now
+    end
+
+    ActiveSupport.run_load_hooks(:warp_engine_device_grant, self)
+  end
+end
@@ -0,0 +1,73 @@
+module WarpEngine
+  class Pipeline < ApplicationRecord
+    self.table_name = "pipelines"
+
+    # Repos synced from Woodpecker without a matching Software land here
+    # until a platform is assigned by hand.
+    UNKNOWN_PLATFORM = "unknown".freeze
+
+    belongs_to :software, class_name: "WarpEngine::Software", optional: true
+
+    # Pipelines this record took the software from during the last save, by full name.
+    # The admin says so out loud: a silent reassignment is what made the old behaviour
+    # confusing in the first place.
+    attr_reader :software_taken_from
+
+    default_scope { where(deleted_at: nil) }
+
+    # One pipeline per software, and the newest assignment wins.
+    #
+    # `Software#pipeline` is a `has_one`, so two pipelines pointing at the same software
+    # is not an error — it is worse than one: the software keeps showing whichever row
+    # comes first, and assigning it elsewhere looks like it did nothing. Rather than
+    # refusing the assignment, the link moves: whoever held that software lets go of it.
+    #
+    # Deliberately a callback and not a unique index. Rows here are soft-deleted, and a
+    # unique index counts deleted rows too, so a pipeline someone removed last year would
+    # block the software from ever being linked again.
+    before_save :claim_software_from_other_pipelines, if: :will_save_change_to_software_id?
+
+    validates :woodpecker_repo_id, presence: true, uniqueness: true
+    validates :repo_owner, presence: true
+    validates :repo_name, presence: true
+    validates :platform, presence: true,
+              inclusion: { in: WarpEngine::PlatformLink::SUPPORTED_PLATFORMS + [ UNKNOWN_PLATFORM ] }
+
+    scope :active, -> { where(active: true) }
+
+    def full_name
+      "#{repo_owner}/#{repo_name}"
+    end
+
+    def self.ransackable_attributes(auth_object = nil)
+      %w[active created_at deleted_at id last_pipeline_at last_pipeline_status
+         platform repo_name repo_owner software_id woodpecker_repo_id]
+    end
+
+    def self.ransackable_associations(auth_object = nil)
+      %w[software]
+    end
+
+    private
+
+    def claim_software_from_other_pipelines
+      return if software_id.blank?
+
+      others = Pipeline.where(software_id: software_id).where.not(id: id)
+      @software_taken_from = others.map(&:full_name)
+      return if @software_taken_from.empty?
+
+      # Logged rather than flashed. The first attempt at this put a message on screen by
+      # overriding the admin's `update` action, which bypassed the permitted-params path
+      # and made every pipeline edit fail with ForbiddenAttributesError. A silent
+      # reassignment is a small problem; an admin page that cannot save is a large one.
+      Rails.logger.info(
+        "[WarpEngine::Pipeline] #{full_name} took software #{software_id} from " \
+        "#{@software_taken_from.join(', ')}"
+      )
+      others.update_all(software_id: nil, updated_at: Time.current)
+    end
+
+    ActiveSupport.run_load_hooks(:warp_engine_pipeline, self)
+  end
+end
@@ -1,7 +1,7 @@
 module WarpEngine
  class ReleaseAsset < ApplicationRecord
    KINDS = %w[cartridge source html docs
-               win_x86 win_x64 linux_x86 linux_x64
+               win_x86 win_x64 linux_x86 linux_x64 linux_arm64
               mac_x64 mac_arm64 mac_universal].freeze

    belongs_to :release
@@ -2,8 +2,8 @@ module WarpEngine
  class Software < ApplicationRecord
    self.table_name = "softwares"

-    # A publikáló token ownere (pl. AdminUser) — 3rd party izolációhoz, ld.
-    # enforce_software_ownership. nil = belső / backfill előtti software.
+    # Owner of the publishing token (e.g. AdminUser) — for 3rd-party isolation,
+    # see enforce_software_ownership. nil = internal / pre-backfill software.
    belongs_to :owner, polymorphic: true, optional: true

    has_many :software_images, foreign_key: :software_id, dependent: :destroy
@@ -11,6 +11,7 @@ module WarpEngine
    has_many :releases, foreign_key: :software_id
    has_many :downloads, through: :releases
    has_many :external_links, foreign_key: :software_id
+    has_one :pipeline, foreign_key: :software_id

    accepts_nested_attributes_for :software_images, allow_destroy: true
    accepts_nested_attributes_for :external_links, allow_destroy: true
@@ -5,5 +5,8 @@ module WarpEngine
    field(:latestRelease)      { |_, opts|  opts[:latest]       ? ReleaseSerializer.render_as_hash(opts[:latest], download_counts: opts[:download_counts])       : nil }
    field(:webPlayableRelease) { |_, opts|  opts[:web_playable] ? ReleaseSerializer.render_as_hash(opts[:web_playable], download_counts: opts[:download_counts]) : nil }
    field(:totalDownloads)     { |_, opts|  opts[:total_downloads] || 0 }
+    # Whether this title is gated, what it costs and where to get it. Always present —
+    # see WarpEngine::Access. Under the open policy it is the constant OPEN answer.
+    field(:access)             { |_, opts| (opts[:access] || WarpEngine::Access::OPEN).as_json }
  end
 end
@@ -14,7 +14,7 @@ module WarpEngine
    field(:license)      { |sw| sw.license.to_s }
    field :platform
    field :status
-    # Publikus owner-azonosító — az /api/software?owner_id= szűrőhöz.
+    # Public owner id — for the /api/software?owner_id= filter.
    field(:ownerId) { |sw| sw.owner_id }
    field(:highlighted)  { |sw| sw.highlighted ? true : false }
    field(:externalLinks) { |sw| ExternalLinkSerializer.render_as_hash(sw.external_links) }
@@ -2,7 +2,7 @@ require "zip"
 require "fileutils"

 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module ArchiveExtraction
      private

@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildCartridge
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildDocs
        extend ActiveSupport::Concern
@@ -0,0 +1,28 @@
+module WarpEngine
+  module Platforms
+    module Builds
+      # Linux on 64-bit ARM: Raspberry Pi 4/5, Odroid, and the retro handhelds.
+      # Batocera and the ES-family distributions run on these as much as on
+      # x86_64, and an x64 binary installs there but will not start — which is
+      # why this is a separate kind rather than something linux_x64 can cover.
+      #
+      # Include this in a platform service only once its pipeline actually
+      # produces the artifact: registering the kind makes /api/builds report it
+      # as missing for every release until then.
+      module BuildLinuxArm64
+        extend ActiveSupport::Concern
+
+        included do
+          register_expected_kind "linux_arm64"
+        end
+
+        private
+
+        def linux_arm64_asset_path(versioned)
+          path = full_path("#{versioned}-linux-arm64.zip")
+          { "linux_arm64" => path } if File.file?(path)
+        end
+      end
+    end
+  end
+end
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildLinuxX64
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildMacArm64
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildMacUniversal
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildMacX64
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildSource
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildWeb
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildWinX64
        extend ActiveSupport::Concern
@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Builds
      module BuildWinX86
        extend ActiveSupport::Concern
@@ -1,7 +1,7 @@
 require "json"

 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module MetadataParsing
      METADATA_KEYS = %i[name title author desc site repo license].freeze

@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module SoftwarePersistence
      private

@@ -1,5 +1,5 @@
 module WarpEngine
-  module SoftwareUpdater
+  module Platforms
    module Updatable
      extend ActiveSupport::Concern
      include ArchiveExtraction
@@ -9,7 +9,7 @@ module WarpEngine
      class_methods do
        def platform(value = nil)
          @platform = value if value
-          @platform ||= name.demodulize.delete_suffix("Service").downcase
+          @platform ||= name.deconstantize.demodulize.downcase
        end

        def label(value = nil)
@@ -2,7 +2,7 @@ module WarpEngine
  class BuildsService
    def index
      platforms = WarpEngine::PlatformLink::SUPPORTED_PLATFORMS.each_with_object({}) do |platform, hash|
-        service_class = "WarpEngine::SoftwareUpdater::#{platform.camelize}Service".constantize
+        service_class = "WarpEngine::Platforms::#{platform.camelize}::Service".constantize
        hash[platform] = {
          label: service_class.label,
          kinds: service_class.expected_kinds
@@ -16,7 +16,7 @@ module WarpEngine

    def show(name)
      software = WarpEngine::Software.find_by!(name: name)
-      service_class = "WarpEngine::SoftwareUpdater::#{software.platform.camelize}Service".constantize
+      service_class = "WarpEngine::Platforms::#{software.platform.camelize}::Service".constantize
      expected = service_class.expected_kinds

      releases = software.releases.includes(:release_assets).order(updated_at: :desc)
@@ -0,0 +1,40 @@
+require "erb"
+
+module WarpEngine
+  # Renders the /build/config platform templates: the pipeline logic lives in
+  # app/services/warp_engine/platforms/<platform>/pipeline.yaml.erb, the
+  # per-platform builder images come from WarpEngine.config.ci_platforms.
+  class CiConfigService
+    PLATFORM_FORMAT = /\A[a-z0-9_-]+\z/
+
+    # The rendered pipeline YAML, or nil when the platform is not served.
+    def render(platform:, name:, update_server:)
+      platform = platform.to_s
+      return nil unless platform.match?(PLATFORM_FORMAT)
+
+      spec = platform_spec(platform)
+      return nil if spec.nil?
+
+      path = templates_dir.join(platform, "pipeline.yaml.erb")
+      return nil unless path.exist?
+
+      ERB.new(path.read, trim_mode: "-").result_with_hash(
+        name:          name.to_s,
+        update_server: update_server.to_s,
+        builder:       spec[:builder],
+        exporter:      spec[:exporter]
+      )
+    end
+
+    private
+
+    def platform_spec(platform)
+      spec = WarpEngine.config.ci_platforms.stringify_keys[platform]
+      spec&.symbolize_keys
+    end
+
+    def templates_dir
+      WarpEngine::Engine.root.join("app", "services", "warp_engine", "platforms")
+    end
+  end
+end
@@ -0,0 +1,154 @@
+require "openssl"
+require "base64"
+require "net/http"
+require "digest"
+
+module WarpEngine
+  # Verifies the signature of Woodpecker configuration-extension requests.
+  # Woodpecker 3.x signs with RFC 9421 HTTP message signatures (ed25519, via
+  # yaronf/httpsign): Signature-Input + Signature + Content-Digest headers,
+  # covered components "@request-target" and "content-digest". Older versions
+  # used draft-cavage http-signatures (a single Signature header) — kept as a
+  # fallback.
+  class CiSignatureVerifier
+    CAVAGE_PARAM = /(\w+)="([^"]*)"/
+
+    @key_cache = {}
+    @key_mutex = Mutex.new
+
+    class << self
+      # The downloaded key is cached process-wide (per URL).
+      def fetch_public_key(url)
+        @key_mutex.synchronize do
+          @key_cache[url] ||= Net::HTTP.get(URI.parse(url))
+        end
+      end
+
+      def reset_key_cache!
+        @key_mutex.synchronize { @key_cache = {} }
+      end
+    end
+
+    def initialize(request)
+      @request = request
+    end
+
+    def valid?
+      pem = public_key_pem
+      if pem.blank?
+        Rails.logger.error("[CiSignatureVerifier] no ci_extension_public_key(_url) configured — rejecting request")
+        return false
+      end
+
+      key = OpenSSL::PKey.read(pem)
+      if @request.headers["Signature-Input"].present?
+        rfc9421_valid?(key)
+      else
+        cavage_valid?(key)
+      end
+    rescue OpenSSL::PKey::PKeyError, ArgumentError => e
+      Rails.logger.error("[CiSignatureVerifier] #{e.class}: #{e.message}")
+      false
+    end
+
+    private
+
+    def public_key_pem
+      config = WarpEngine.config
+      return config.ci_extension_public_key if config.ci_extension_public_key.present?
+      return nil if config.ci_extension_public_key_url.blank?
+
+      self.class.fetch_public_key(config.ci_extension_public_key_url)
+    rescue StandardError => e
+      Rails.logger.error("[CiSignatureVerifier] public key fetch failed: #{e.class}: #{e.message}")
+      nil
+    end
+
+    # --- RFC 9421 ---
+
+    def rfc9421_valid?(key)
+      input = @request.headers["Signature-Input"].to_s
+      match = input.match(/\A\s*([\w.-]+)=(\(.*)\z/m)
+      return false if match.nil?
+
+      label, inner = match[1], match[2]
+      components = inner[/\((.*?)\)/m, 1].to_s.scan(/"([^"]*)"/).flatten
+      return false if components.empty?
+
+      signature = @request.headers["Signature"].to_s[/#{Regexp.escape(label)}=:([A-Za-z0-9+\/=]+):/, 1]
+      return false if signature.blank?
+      return false unless content_digest_valid?(components)
+
+      lines = components.map do |component|
+        value = component_value(component)
+        return false if value.nil?
+        %("#{component}": #{value})
+      end
+      lines << %("@signature-params": #{inner})
+
+      key.verify(nil, Base64.decode64(signature), lines.join("\n"))
+    end
+
+    def component_value(name)
+      case name
+      when "@request-target" then @request.fullpath
+      when "@method"         then @request.request_method
+      when "@target-uri"     then @request.original_url
+      when "@authority"      then @request.host_with_port
+      when "@path"           then @request.path
+      when "@query"          then "?#{@request.query_string}"
+      when /\A@/             then nil
+      else @request.headers[name]
+      end
+    end
+
+    # When content-digest is a covered component, the body itself must match
+    # the digest header — this is what ties the signature to the payload.
+    def content_digest_valid?(components)
+      return true unless components.include?("content-digest")
+
+      digest = @request.headers["Content-Digest"].to_s[/sha-256=:([A-Za-z0-9+\/=]+):/, 1]
+      return false if digest.blank?
+
+      expected = Digest::SHA256.base64digest(@request.raw_post)
+      ActiveSupport::SecurityUtils.secure_compare(digest, expected)
+    end
+
+    # --- draft-cavage fallback ---
+
+    def cavage_valid?(key)
+      params = cavage_params
+      return false if params.nil? || params["signature"].blank?
+
+      signing_string = cavage_signing_string(params.fetch("headers", "date"))
+      return false if signing_string.nil?
+
+      key.verify(nil, Base64.decode64(params["signature"]), signing_string)
+    end
+
+    # Parameters of the Signature header (or the "Authorization: Signature ..." form).
+    def cavage_params
+      header = @request.headers["Signature"].presence
+      if header.nil?
+        auth = @request.headers["Authorization"].to_s
+        header = auth.delete_prefix("Signature ") if auth.start_with?("Signature ")
+      end
+      return nil if header.blank?
+
+      header.scan(CAVAGE_PARAM).to_h
+    end
+
+    def cavage_signing_string(headers_list)
+      lines = headers_list.split(" ").map do |name|
+        if name == "(request-target)"
+          "(request-target): #{@request.request_method.downcase} #{@request.fullpath}"
+        else
+          value = @request.headers[name]
+          return nil if value.nil?
+          "#{name.downcase}: #{value}"
+        end
+      end
+      lines.join("\n")
+    end
+  end
+end
@@ -0,0 +1,102 @@
+module WarpEngine
+  # The device authorization grant, from both ends.
+  #
+  # The client's end is #request, #poll and #revoke, all reachable over /api/auth/*.
+  # The person's end is #approve and #deny, which the *host* calls from its own page —
+  # approving needs a session and a logged-in human, and the engine has neither.
+  class DeviceGrantService
+    class NotConfigured < StandardError; end
+    class UnknownCode < StandardError; end
+
+    # A client asks for a code pair. Deliberately unauthenticated: there is nobody to
+    # authenticate as yet, which is the whole reason this flow exists.
+    def request(client_name:)
+      ensure_configured!
+
+      WarpEngine::DeviceGrant.create!(client_name: client_name.presence&.truncate(128))
+    end
+
+    # The client polls with the device code. Returns [state, token], where the token is
+    # the plain string and is available exactly once — on the poll that finds the grant
+    # newly approved. A second poll gets :approved with no token, which is the honest
+    # answer: the secret was handed over and is not kept.
+    def poll(device_code:)
+      ensure_configured!
+
+      grant = WarpEngine::DeviceGrant.find_by(device_code: device_code.to_s)
+      raise UnknownCode if grant.nil?
+
+      return [ grant.state, nil ] unless grant.state == :approved
+
+      # Read once, then gone: the column exists only to carry the secret across the gap
+      # between the browser that approved it and the client that is polling for it.
+      plain = grant.issued_token
+      grant.update_columns(issued_token: nil) if plain.present?
+      [ :approved, plain ]
+    end
+
+    # The host's approval page calls this with the code a person typed and the subject
+    # they are signed in as. Issuing the token here rather than on the next poll keeps
+    # the decision and its consequence in one transaction.
+    def approve(user_code:, subject:)
+      ensure_configured!
+
+      grant = WarpEngine::DeviceGrant.find_pending_by_user_code(user_code)
+      raise UnknownCode if grant.nil?
+
+      ActiveRecord::Base.transaction do
+        token = WarpEngine::ApplicationToken.create!(
+          name: grant.client_name.presence || "Client",
+          owner_type: WarpEngine.config.access_token_owner_class,
+          owner_id: subject.id,
+          scopes: [ WarpEngine::ApplicationToken::CATALOG_SCOPE ]
+        )
+        grant.update!(
+          subject_type: WarpEngine.config.access_token_owner_class,
+          subject_id: subject.id,
+          application_token: token,
+          issued_token: token.plain_token,
+          approved_at: Time.current
+        )
+      end
+
+      grant
+    end
+
+    def deny(user_code:)
+      ensure_configured!
+
+      grant = WarpEngine::DeviceGrant.find_pending_by_user_code(user_code)
+      raise UnknownCode if grant.nil?
+
+      grant.update!(denied_at: Time.current)
+      grant
+    end
+
+    # Signing out: the client throws its own token away. Revocation is a soft delete on
+    # the token, so the audit trail of who signed in from where survives it.
+    def revoke(token:)
+      return false if token.nil?
+
+      token.revoke!
+      true
+    end
+
+    # Where a person goes to type the user code. A path is made absolute against the
+    # request's own base, so a host that configured "/devices" does not have to know its
+    # own hostname.
+    def verification_url(base_url: nil)
+      configured = WarpEngine.config.identity_verification_url.presence || "/devices"
+      return configured if configured.start_with?("http://", "https://")
+      return configured if base_url.blank?
+
+      "#{base_url.to_s.chomp('/')}/#{configured.delete_prefix('/')}"
+    end
+
+    private
+
+    def ensure_configured!
+      raise NotConfigured unless WarpEngine.identity_configured?
+    end
+  end
+end
@@ -1,5 +1,10 @@
 module WarpEngine
  class DownloadService
+    # The access policy said no. The controller turns this into a 403 — distinct from
+    # the nil that means "no such file", because telling a person their file is missing
+    # when it is merely locked sends them looking for the wrong problem.
+    class Denied < StandardError; end
+
    def self.container_base
      WarpEngine.config.file_container_path
    end
@@ -9,26 +14,77 @@ module WarpEngine
      Pathname.new(container_base).realpath
    end

-    def create(path:, ip:, user_agent:, referer:)
-      sanitized = path.to_s
-      base_path = self.class.base_path
-      full_path = base_path.join(sanitized).realpath
-      return nil unless full_path.to_s.start_with?(base_path.to_s)
-      return nil unless File.file?(full_path)
+    # A letöltés helyét adja vissza (fájl vagy aláírt URL) és naplózza a
+    # letöltést. A hely feloldása a storage adapteren megy — alapból :local,
+    # tehát változatlanul lemezről.
+    #
+    # `subject` is whoever the request authenticated as, or nil. Under the open policy
+    # it is ignored and every file is served, exactly as before.
+    def locate(path:, ip:, user_agent:, referer:, subject: nil, request: nil)
+      relative = path.to_s
+      return nil unless storage.file?(relative)

-      escaped = sanitized.gsub("%", "\\%").gsub("_", "\\_")
-      asset = WarpEngine::ReleaseAsset.find_by(path: File.join(self.class.container_base, sanitized)) ||
-              WarpEngine::ReleaseAsset.where("path LIKE ?", "%#{escaped}%").first
+      asset = find_asset(relative)
+      grant = authorize!(asset, subject, request)

-      WarpEngine::Download.create!(
-        file_path: sanitized,
+      log_download(relative, asset: asset, ip: ip, user_agent: user_agent, referer: referer, subject: subject)
+
+      storage.locate(relative,
+                     filename: grant.filename.presence || File.basename(relative),
+                     expires_in: grant.expires_in)
+    end
+
+    # Visszafelé kompatibilis felület: az abszolút fájlútvonalat adja vissza
+    # (vagy nil-t). Nem lemezes adapternél nincs útvonal — ott a #locate való.
+    def create(path:, ip:, user_agent:, referer:, subject: nil, request: nil)
+      location = locate(path: path, ip: ip, user_agent: user_agent, referer: referer,
+                        subject: subject, request: request)
+      return nil if location.nil?
+
+      location.file? ? location.path : nil
+    end
+
+    private
+
+    def storage
+      WarpEngine.storage
+    end
+
+    # A policy that refuses returns nil; one that raises is treated as a refusal too.
+    # An artifact served because the gatekeeper crashed is the one failure mode this
+    # engine must not have.
+    def authorize!(asset, subject, request)
+      grant = WarpEngine.access_policy.authorize_download(asset: asset, subject: subject, request: request)
+      raise Denied if grant.nil?
+
+      grant
+    rescue Denied
+      raise
+    rescue StandardError => e
+      Rails.logger.error("[WarpEngine::AccessPolicy] #{e.class}: #{e.message}")
+      raise Denied
+    end
+
+    def find_asset(relative)
+      escaped = relative.gsub("%", "\\%").gsub("_", "\\_")
+      WarpEngine::ReleaseAsset.find_by(path: File.join(self.class.container_base, relative)) ||
+        WarpEngine::ReleaseAsset.where("path LIKE ?", "%#{escaped}%").first
+    end
+
+    def log_download(relative, asset:, ip:, user_agent:, referer:, subject:)
+      download = WarpEngine::Download.create!(
+        file_path: relative,
        release: asset&.release,
        ip_address: ip,
        user_agent: user_agent&.truncate(500),
        referer: referer&.truncate(500)
      )

-      full_path
+      # The same seam the publish side has: a host that wants its own record of who
+      # downloaded what subscribes rather than reaching into this class.
+      ActiveSupport::Notifications.instrument("warp_engine.download",
+        path: relative, asset: asset, release: asset&.release,
+        software: asset&.release&.software, subject: subject, download: download, ip: ip)
    end
  end
 end
@@ -5,31 +5,64 @@ module WarpEngine
      Pathname.new(WarpEngine.config.file_container_path).realpath
    end

-    def show(input)
-      full_path = base_path.join(input.path.to_s)
-      return FileResultDto.not_found unless safe_path?(full_path)
+    # A fájlok helyét a storage adapter adja (alapból :local, azaz a lemez) —
+    # így a host az objektumtárból is kiszolgálhat anélkül, hogy az engine-t
+    # patchelné. Lásd WarpEngine::Storage.
+    # `subject` is whoever the request authenticated as, or nil. Under the open policy
+    # it is ignored and every file is served, exactly as before.
+    #
+    # A hosted (browser) build reaches this path as hundreds of relative requests for
+    # js, wasm and images, which is why the gate here is the policy's plain yes/no
+    # rather than anything signed: there is nothing to sign per file. A host serving
+    # gated web builds to browsers will usually want its own session-based route in
+    # front of this one — a browser has a session, and a redirect to a login page is a
+    # better answer there than a bare 403.
+    def show(input, subject: nil)
+      relative = input.path.to_s

-      if File.directory?(full_path)
-        index_path = full_path.join("index.html")
-        return FileResultDto.not_found unless File.file?(index_path)
-        return FileResultDto.redirect("/file/#{input.path.to_s.chomp("/")}/index.html")
+      if storage.directory?(relative)
+        index = File.join(relative.chomp("/"), "index.html")
+        return FileResultDto.not_found unless storage.file?(index)
+
+        return FileResultDto.redirect("/file/#{index}")
      end

-      if File.file?(full_path)
-        FileResultDto.file(full_path)
-      else
-        FileResultDto.not_found
-      end
+      return FileResultDto.not_found unless storage.file?(relative)
+
+      authorize!(relative, subject)
+
+      to_result(storage.locate(relative, filename: File.basename(relative)))
    end

    private

-    def base_path
-      @base_path ||= self.class.base_path
+    # Same rule and same failure mode as DownloadService: a policy that refuses or
+    # raises means no file. An artifact served because the gatekeeper crashed is the
+    # one failure mode this engine must not have.
+    def authorize!(relative, subject)
+      # The open policy authorises everything, and this path serves a browser build as
+      # hundreds of requests for js, wasm and images. Asking it per file would mean a
+      # LIKE query per asset for an answer that is always yes.
+      return WarpEngine::Access::Grant::OPEN if WarpEngine::AccessPolicy.open?
+
+      asset = WarpEngine::ReleaseAsset.where("path LIKE ?", "%#{relative.gsub('%', '\\%').gsub('_', '\\_')}%").first
+      grant = WarpEngine.access_policy.authorize_download(asset: asset, subject: subject, request: nil)
+      raise WarpEngine::DownloadService::Denied if grant.nil?
+
+      grant
+    rescue WarpEngine::DownloadService::Denied
+      raise
+    rescue StandardError => e
+      Rails.logger.error("[WarpEngine::AccessPolicy] #{e.class}: #{e.message}")
+      raise WarpEngine::DownloadService::Denied
    end

-    def safe_path?(path)
-      File.exist?(path) && Pathname.new(path).realpath.to_s.start_with?(base_path.to_s)
+    def storage
+      WarpEngine.storage
+    end
+
+    def to_result(location)
+      location.redirect? ? FileResultDto.redirect(location.url) : FileResultDto.file(location.path)
    end
  end
 end
@@ -0,0 +1,35 @@
+module WarpEngine
+  class PipelineService
+    def initialize(client: WoodpeckerClient.new)
+      @client = client
+    end
+
+    def trigger(pipeline, branch: "main")
+      @client.trigger_pipeline(pipeline.woodpecker_repo_id, branch: branch)
+    end
+
+    # Fetches one page of a pipeline's runs; the newest one refreshes the
+    # cached last_pipeline_* columns (Pipelines index and the CI API).
+    def list_pipelines(pipeline, page: 1)
+      runs = @client.list_pipelines(pipeline.woodpecker_repo_id, page: page)
+      refresh_last_pipeline(pipeline, runs.first) if page == 1 && runs.is_a?(Array)
+      runs
+    end
+
+    def pipeline_detail(pipeline, number)
+      @client.get_pipeline(pipeline.woodpecker_repo_id, number)
+    end
+
+    private
+
+    # Woodpecker returns unix epoch seconds in "created".
+    def refresh_last_pipeline(pipeline, run)
+      return unless run && pipeline.persisted?
+
+      pipeline.update_columns(
+        last_pipeline_status: run["status"],
+        last_pipeline_at:     run["created"] ? Time.zone.at(run["created"]) : nil
+      )
+    end
+  end
+end
@@ -0,0 +1,73 @@
+module WarpEngine
+  class PipelineSyncService
+    def initialize(client: WoodpeckerClient.new)
+      @client = client
+    end
+
+    def sync_all
+      remote_repos = @client.list_repos
+      results = { created: [], updated: [], deactivated: [] }
+      remote_ids = remote_repos.map { |r| r["id"] }
+
+      remote_repos.each do |remote|
+        record = Pipeline.unscoped.find_or_initialize_by(
+          woodpecker_repo_id: remote["id"]
+        )
+
+        was_new = record.new_record?
+        record.assign_attributes(
+          repo_name:  remote["name"],
+          repo_owner: remote["owner"],
+          active:     remote["active"],
+          deleted_at: nil
+        )
+
+        if record.platform.blank? || record.platform == Pipeline::UNKNOWN_PLATFORM
+          sw = Software.find_by(name: remote["name"])
+          record.platform = sw&.platform || Pipeline::UNKNOWN_PLATFORM
+          record.software = sw if sw
+        end
+
+        next unless record.save
+
+        results[was_new ? :created : :updated] << record
+      end
+
+      Pipeline.where.not(woodpecker_repo_id: remote_ids).find_each do |orphan|
+        orphan.update!(active: false) if orphan.active?
+        results[:deactivated] << orphan
+      end
+
+      results
+    end
+
+    def activate(repo_id)
+      @client.activate_repo(repo_id)
+      sync_single(repo_id)
+    end
+
+    def deactivate(repo_id)
+      @client.deactivate_repo(repo_id)
+      record = Pipeline.find_by!(woodpecker_repo_id: repo_id)
+      record.update!(active: false)
+    end
+
+    private
+
+    def sync_single(repo_id)
+      remote = @client.get_repo(repo_id)
+      record = Pipeline.unscoped.find_or_initialize_by(woodpecker_repo_id: repo_id)
+      record.assign_attributes(
+        repo_name: remote["name"], repo_owner: remote["owner"],
+        active: remote["active"], deleted_at: nil
+      )
+      if record.platform.blank?
+        sw = Software.find_by(name: remote["name"])
+        record.platform = sw&.platform || Pipeline::UNKNOWN_PLATFORM
+        record.software = sw if sw
+      end
+      record.save!
+      record
+    end
+  end
+end
@@ -0,0 +1,112 @@
+# Generated pipeline — WarpEngine /build/config (platform: bevy, name: <%= name %>)
+steps:
+  - name: version
+    image: alpine
+    commands:
+      - apk add --no-cache git jq
+      - |
+        if [ -f metadata.json ]; then
+          VERSION=$(jq -r '.version' metadata.json)
+        else
+          VERSION=$(git rev-parse --short HEAD)
+        fi
+        BRANCH=$(git rev-parse --abbrev-ref HEAD)
+        if [ "$BRANCH" != "main" ] && [ "$BRANCH" != "master" ]; then
+          VERSION="dev-$VERSION-$BRANCH"
+        fi
+        echo "VERSION is: $VERSION"
+        echo $VERSION > .version
+
+  - name: build
+    image: <%= builder %>
+    pull: true
+    commands:
+      - |
+        VERSION=$(cat .version)
+        mkdir -p dist
+        cargo build --release --target wasm32-unknown-unknown
+        wasm-bindgen --target web --no-typescript \
+          --out-dir dist --out-name game target/wasm32-unknown-unknown/release/<%= name %>.wasm
+        echo "==> Downloading index.html"
+        curl -sSL https://git.teletypegames.org/tools/bevy-tools/raw/branch/master/web/index.html -o dist/index.html
+        echo "==> Packaging HTML/WASM for $VERSION"
+        zip -r "<%= name %>-$VERSION.html.zip" -j dist/game_bg.wasm dist/game.js dist/index.html
+        echo "==> Cleaning temporary files"
+        rm -f dist/game_bg.wasm dist/game.js dist/index.html
+
+  - name: binaries
+    image: <%= builder %>
+    pull: true
+    commands:
+      - |
+        VERSION=$(cat .version)
+        # Native binaries. linux-x64: glibc build in the debian-based builder
+        # image; win-x64: mingw-w64 cross-compile (x86_64-pc-windows-gnu).
+        # Mac needs osxcross, it is not built here.
+        # The zip gets the assets/ dir too if the project has one — bevy loads
+        # it at runtime, it is not embedded in the binary.
+        set -e
+        pack_binary() {
+          P_SLUG="$1"; P_BIN="$2"; P_NAME="$3"
+          PKG_DIR="<%= name %>-$VERSION-$P_SLUG"
+          rm -rf "$PKG_DIR" "$PKG_DIR.zip"
+          mkdir -p "$PKG_DIR"
+          cp "$P_BIN" "$PKG_DIR/$P_NAME"
+          chmod +x "$PKG_DIR/$P_NAME"
+          if [ -d assets ]; then cp -r assets "$PKG_DIR/assets"; fi
+          zip -qr "$PKG_DIR.zip" "$PKG_DIR"
+          rm -rf "$PKG_DIR"
+          echo "==> $PKG_DIR.zip kesz"
+        }
+        echo "==> Building linux-x64 binary"
+        cargo build --release
+        pack_binary "linux-x64" "target/release/<%= name %>" "<%= name %>"
+        echo "==> Building win-x64 binary"
+        CARGO_TARGET_X86_64_PC_WINDOWS_GNU_LINKER=x86_64-w64-mingw32-gcc \
+          cargo build --release --target x86_64-pc-windows-gnu
+        pack_binary "win-x64" "target/x86_64-pc-windows-gnu/release/<%= name %>.exe" "<%= name %>.exe"
+        # linux-arm64: Raspberry Pi, Odroid, retro handhelds. pkg-config has to
+        # be told it may cross, and pointed at the arm64 .pc files, otherwise
+        # alsa-sys/libudev-sys pick up the host x86_64 libraries.
+        echo "==> Building linux-arm64 binary"
+        PKG_CONFIG_ALLOW_CROSS=1 \
+          PKG_CONFIG_PATH=/usr/lib/aarch64-linux-gnu/pkgconfig \
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc \
+          cargo build --release --target aarch64-unknown-linux-gnu
+        pack_binary "linux-arm64" "target/aarch64-unknown-linux-gnu/release/<%= name %>" "<%= name %>"
+
+  - name: upload
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        FILE="<%= name %>-$VERSION.html.zip"
+        META_SRC="metadata.json"
+        META_DST="<%= name %>-$VERSION.metadata.json"
+        cp $META_SRC $META_DST
+        BINS=""
+        for slug in win-x64 linux-x64 linux-arm64; do
+          [ -f "<%= name %>-$VERSION-$slug.zip" ] && BINS="$BINS <%= name %>-$VERSION-$slug.zip"
+        done
+        for f in $FILE $META_DST $BINS; do
+          curl -fsS -H "X-Update-Secret: $UPDATE_SECRET" \
+            -F "file=@$f" \
+            "$UPDATE_SERVER/build/upload?name=<%= name %>&version=$VERSION" || exit 1
+        done
+
+  - name: publish
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        curl -fsS -X POST -H "X-Update-Secret: $UPDATE_SECRET" "$UPDATE_SERVER/build/publish?name=<%= name %>&platform=bevy&version=$VERSION"
@@ -0,0 +1,15 @@
+module WarpEngine
+  module Platforms
+    module Bevy
+      class Service
+        include Updatable
+        include Builds::BuildWeb
+        include Builds::BuildWinX64
+        include Builds::BuildLinuxX64
+        include Builds::BuildLinuxArm64
+
+        label "Bevy"
+      end
+    end
+  end
+end
@@ -0,0 +1,59 @@
+# Generated pipeline — WarpEngine /build/config (platform: c64, name: <%= name %>)
+steps:
+  - name: version
+    image: alpine
+    commands:
+      - |
+        VERSION=$(sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' metadata.json | head -n 1)
+        if [ -z "$VERSION" ]; then
+          echo "ERROR: no \"version\" field in metadata.json!"
+          exit 1
+        fi
+        BRANCH=${CI_COMMIT_BRANCH:-${WOODPECKER_BRANCH}}
+        BRANCH=$(echo "$BRANCH" | tr '/' '-')
+        if [ "$BRANCH" != "main" ] && [ "$BRANCH" != "master" ] && [ -n "$BRANCH" ]; then
+          VERSION="dev-$VERSION-$BRANCH"
+        fi
+        echo "VERSION is: $VERSION"
+        echo $VERSION > .version
+
+  - name: build
+    image: <%= builder %>
+    commands:
+      - |
+        VERSION=$(cat .version)
+        acme -f cbm -o <%= name %>.prg main.asm
+        echo "==> Creating versioned files for $VERSION"
+        cp <%= name %>.prg <%= name %>-$VERSION.prg
+        cp metadata.json <%= name %>-$VERSION.metadata.json
+        ls -lh <%= name %>-$VERSION.*
+
+  - name: artifact
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        echo "==> Uploading artifacts for version $VERSION"
+        for f in <%= name %>-$VERSION.prg <%= name %>-$VERSION.metadata.json; do
+          curl -fsS -H "X-Update-Secret: $UPDATE_SECRET" \
+            -F "file=@$f" \
+            "$UPDATE_SERVER/build/upload?name=<%= name %>&version=$VERSION" || exit 1
+        done
+
+  - name: publish
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        echo "==> Publishing version $VERSION"
+        curl -fsS -X POST -H "X-Update-Secret: $UPDATE_SECRET" "$UPDATE_SERVER/build/publish?name=<%= name %>&platform=c64&version=$VERSION"
@@ -0,0 +1,14 @@
+module WarpEngine
+  module Platforms
+    module C64
+      class Service
+        include Updatable
+        include Builds::BuildCartridge
+
+        label "C64"
+
+        def cartridge_ext = ".prg"
+      end
+    end
+  end
+end
@@ -0,0 +1,101 @@
+# Generated pipeline — WarpEngine /build/config (platform: ebitengine, name: <%= name %>)
+steps:
+  - name: version
+    image: alpine
+    commands:
+      - apk add --no-cache git jq
+      - |
+        if [ -f metadata.json ]; then
+          VERSION=$(jq -r '.version' metadata.json)
+        else
+          VERSION=$(git rev-parse --short HEAD)
+        fi
+        BRANCH=$(git rev-parse --abbrev-ref HEAD)
+        if [ "$BRANCH" != "main" ] && [ "$BRANCH" != "master" ]; then
+          VERSION="dev-$VERSION-$BRANCH"
+        fi
+        echo "VERSION is: $VERSION"
+        echo $VERSION > .version
+
+  - name: build
+    image: <%= builder %>
+    pull: true
+    commands:
+      - |
+        VERSION=$(cat .version)
+        mkdir -p dist
+        GOOS=js GOARCH=wasm go build -o dist/game.wasm .
+        cp "$(go env GOROOT)/lib/wasm/wasm_exec.js" dist/wasm_exec.js
+        echo "==> Downloading index.html"
+        curl -sSL https://git.teletypegames.org/tools/ebitengine-tools/raw/branch/master/web/index.html -o dist/index.html
+        echo "==> Packaging HTML/WASM for $VERSION"
+        zip -r "<%= name %>-$VERSION.html.zip" -j dist/game.wasm dist/wasm_exec.js dist/index.html
+        echo "==> Cleaning temporary files"
+        rm -f dist/game.wasm dist/wasm_exec.js dist/index.html
+
+  - name: binaries
+    image: <%= builder %>
+    pull: true
+    commands:
+      - |
+        VERSION=$(cat .version)
+        # win-x86 / win-x64: pure Go cross-compile (Windowson nem kell cgo)
+        # linux-x64: cgo build, linux/amd64 hoston fut (builder image, X11/GL dev libekkel)
+        # helper: builds one target + zips it with a single root folder
+        # (unix zip keeps the executable bit)
+        binary_build() {
+          B_GOOS="$1"; B_GOARCH="$2"; B_CGO="$3"; B_EXT="$4"; B_TARGET="$5"; B_CC="$6"
+          PKG_DIR="<%= name %>-$VERSION-$B_TARGET"
+          echo "==> Building $PKG_DIR"
+          rm -rf "$PKG_DIR" "$PKG_DIR.zip"
+          mkdir -p "$PKG_DIR"
+          # cgo cross-compile needs an explicit cross gcc; a native build must
+          # not see CC at all, otherwise go picks the wrong compiler
+          if [ -n "$B_CC" ]; then export CC="$B_CC"; else unset CC; fi
+          CGO_ENABLED=$B_CGO GOOS=$B_GOOS GOARCH=$B_GOARCH go build -o "$PKG_DIR/<%= name %>$B_EXT" .
+          if [ -f LICENSE ]; then cp LICENSE "$PKG_DIR/"; fi
+          if [ -f README.md ]; then cp README.md "$PKG_DIR/"; fi
+          zip -r "$PKG_DIR.zip" "$PKG_DIR" >/dev/null
+          rm -rf "$PKG_DIR"
+          echo "==> $PKG_DIR.zip kesz"
+        }
+        # CI (linux builder) builds these four:
+        binary_build "windows" "386" "0" ".exe" "win-x86"
+        binary_build "windows" "amd64" "0" ".exe" "win-x64"
+        binary_build "linux" "amd64" "1" "" "linux-x64"
+        # linux-arm64: Raspberry Pi, Odroid, retro handhelds — cgo cross-build
+        # against the arm64 X11/GL/ALSA headers in the builder image
+        binary_build "linux" "arm64" "1" "" "linux-arm64" "aarch64-linux-gnu-gcc"
+
+  - name: artifact
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        FILE="<%= name %>-$VERSION.html.zip"
+        META_SRC="metadata.json"
+        META_DST="<%= name %>-$VERSION.metadata.json"
+        BINS=$(ls <%= name %>-$VERSION-*.zip 2>/dev/null || true)
+        cp $META_SRC $META_DST
+        for f in $FILE $META_DST $BINS; do
+          curl -fsS -H "X-Update-Secret: $UPDATE_SECRET" \
+            -F "file=@$f" \
+            "$UPDATE_SERVER/build/upload?name=<%= name %>&version=$VERSION" || exit 1
+        done
+
+  - name: publish
+    image: alpine
+    environment:
+      UPDATE_SERVER: <%= update_server %>
+      UPDATE_SECRET:
+        from_secret: application_token
+    commands:
+      - apk add --no-cache curl
+      - |
+        VERSION=$(cat .version)
+        curl -fsS -X POST -H "X-Update-Secret: $UPDATE_SECRET" "$UPDATE_SERVER/build/publish?name=<%= name %>&platform=ebitengine&version=$VERSION"
@@ -0,0 +1,18 @@
+module WarpEngine
+  module Platforms
+    module Ebitengine
+      class Service
+        include Updatable
+        include Builds::BuildWeb
+        include Builds::BuildWinX86
+        include Builds::BuildWinX64
+        include Builds::BuildLinuxX64
+        include Builds::BuildLinuxArm64
+        include Builds::BuildMacX64
+        include Builds::BuildMacArm64
+
+        label "Ebitengine"
+      end
+    end
+  end
+end
--- a/Show More
+++ b/Show More