{"_id":"@atarashi/registry","name":"@atarashi/registry","dist-tags":{"latest":"1.0.0"},"versions":{"1.0.0":{"name":"@atarashi/registry","version":"1.0.0","description":"Blueprint registry: fetch, verify, cache, pin and load blueprints.","type":"module","license":"MIT","author":"Gautam Suthar <iamgautamsuthar@gmail.com> (https://www.github.com/callmegautam)","repository":{"type":"git","url":"git+https://github.com/callmegautam/atarashi.git","directory":"packages/registry"},"homepage":"https://github.com/callmegautam/atarashi/tree/main/packages/registry#readme","bugs":{"url":"https://github.com/callmegautam/atarashi/issues"},"exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.js"},"./package.json":"./package.json"},"main":"./dist/index.js","types":"./dist/index.d.ts","engines":{"node":">=20.11"},"dependencies":{"semver":"^7.7.2","tar":"^7.5.2","@atarashi/core":"1.0.0","@atarashi/schema":"1.0.0"},"devDependencies":{"@types/semver":"^7.7.1"},"publishConfig":{"access":"public"},"scripts":{"build":"tsup","typecheck":"tsc --noEmit -p tsconfig.json","build:index":"node --experimental-strip-types scripts/build-index.mts","bump:versions":"node --experimental-strip-types scripts/bump-version-manifest.mts","test":"vitest run --coverage","clean":"rm -rf dist .turbo"},"_nodeVersion":"26.2.0","_id":"@atarashi/registry@1.0.0","dist":{"integrity":"sha512-26YtMBLZoJhJ0qF/V42Iwl37F17lJsVEHK7tOO0iVa8Qq6/ONg/i27IcAFbN1d09wJmY32f3rhRDaMeoQ5kfaw==","shasum":"04b0e5e555cfb943636730e21c1c5e79fe080077","tarball":"https://registry.npmjs.org/@atarashi/registry/-/registry-1.0.0.tgz","fileCount":6,"unpackedSize":183753,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQDFuAvIXQjizd+2ahSl4M+V12HWjKONeZcAWrg8xNP7TQIhAPeZrxYPbcXBvn8vn8lGKvLiz0+ITqDaRlGYuTDCKSpt"}]},"_npmUser":{"name":"iamgautamsuthar","email":"iamgautamsuthar@gmail.com"},"directories":{},"maintainers":[{"name":"iamgautamsuthar","email":"iamgautamsuthar@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/registry_1.0.0_1789054553885_0.36923613193607174"},"_hasShrinkwrap":false}},"time":{"created":"2026-09-10T15:35:53.647Z","1.0.0":"2026-09-10T15:35:54.023Z","modified":"2026-09-10T15:35:54.291Z"},"maintainers":[{"name":"iamgautamsuthar","email":"iamgautamsuthar@gmail.com"}],"description":"Blueprint registry: fetch, verify, cache, pin and load blueprints.","homepage":"https://github.com/callmegautam/atarashi/tree/main/packages/registry#readme","repository":{"type":"git","url":"git+https://github.com/callmegautam/atarashi.git","directory":"packages/registry"},"author":"Gautam Suthar <iamgautamsuthar@gmail.com> (https://www.github.com/callmegautam)","bugs":{"url":"https://github.com/callmegautam/atarashi/issues"},"license":"MIT","readme":"# `@atarashi/registry`\n\nThe only I/O boundary for blueprints. `@atarashi/core` asks this package for a\n`LoadedBlueprint` and never touches the disk or the network itself.\n\n```ts\nimport { createRegistry } from '@atarashi/registry';\nimport { generate } from '@atarashi/core';\n\nconst registry = createRegistry({ cwd: process.cwd(), offline: false });\nconst plan = await generate(spec, { source: registry, atarashiVersion });\n```\n\n## Four layers\n\n| Layer | Where | Trust |\n|---|---|---|\n| Local | `./.atarashi/blueprints/<ns>/<name>/blueprint.json` | Untrusted |\n| npm | `atarashi-blueprint-*` packages, by `npm:` spec | Untrusted |\n| Registry | `atarashi.gautamsuthar.in/registry`, verified and cached | Per source |\n| Bundled | `@atarashi/blueprints`, inside the npm package | Trusted |\n\nLocal wins outright, so an author can override anything while developing. Then\nnpm. Then the registry and the bundled collection compete on version: the newer\none wins, which is how a registry release ships a blueprint fix without a CLI\nrelease, while a run with no network still resolves everything from the\nbundled copy.\n\n`trusted` is set by the *source*, never by the document the source serves. Only\ntrusted blueprints may run hooks without explicit consent (doc 09, T2).\n\n## Integrity\n\n- The index carries a root hash over its canonicalized entries and version\n  manifest; it is re-verified on every read, including from the cache.\n- Every tarball is checked against its `sha256` digest before extraction.\n- A mismatch is a hard failure that names the artifact. There is no fallback\n  path to an unverified copy: unreachability degrades, tampering does not.\n\n## Extraction\n\nArchives are parsed entirely in memory and only written once every member has\nbeen validated: no absolute paths, drive letters, UNC paths, `..` segments,\nnull bytes, symlinks or hard links; per-file, total-size and entry-count\nceilings; case-collision detection; and a re-check that each resolved path is\ninside the destination. This is a security boundary; see `tests/extract.test.ts`.\n\n## Cache\n\n```\n$XDG_CACHE_HOME/atarashi/        # ~/Library/Caches on macOS, LOCALAPPDATA on Windows\n  index/1.4.2.json               # verified against its published root hash\n  blueprints/db-postgres-1.2.0-8f2c…/\n  meta.json                      # ETags, fetch timestamps\n```\n\nContent-addressed, so it is safe to share between projects and CI runs\n(`~/.cache/atarashi` makes a good CI cache key). Override with\n`ATARASHI_CACHE_DIR`.\n\nFreshness is a 24 h TTL plus an ETag: inside the TTL nothing is requested, and\nafter it a `304` costs one conditional GET. A pinned version skips both: a\npublished registry version is immutable, so a cache hit is always correct.\n\n## Offline\n\n`offline: true` or `ATARASHI_OFFLINE=1` skips the network entirely. Bundled\nblueprints and anything already cached still resolve; a registry-only blueprint\nreports what to run to populate the cache.\n\n## Publishing\n\n```bash\npnpm --filter @atarashi/registry build:index      # pack, hash, emit v1/index.json\npnpm --filter @atarashi/registry bump:versions    # propose version-manifest bumps\n```\n\n`build-index.mts` is deterministic (sorted members, fixed mtime, no uid/gid),\nso rebuilding the same sources produces byte-identical tarballs and the same\ndigests. `.github/workflows/registry-publish.yml` publishes it and refuses to\noverwrite a version that already exists.\n","readmeFilename":"","_rev":"1-387ee62a30f5ec443906cf0d23669237"}