index.md

layout	home
hero	name text tagline actions Regesta Universal Package Registry Kernel Transparent, secure, modern, scalable, and community-driven. theme text link brand Why Regesta /why-regesta theme text link alt Explore the protocol /protocol
features	title details Transparent by default Releases, objects, channels, and events are public facts that can be independently verified. title details Domain-bound identity Package ownership is anchored in domains instead of operator-owned usernames or one registry namespace. title details Ecosystem-neutral core npm, PyPI, Cargo, Go, OCI, and future protocols are projections over Regesta-native data. title details Scalable public infrastructure Content-addressed objects, deterministic projections, and storage adapters keep the protocol portable.

::: warning Project Status Regesta is an early draft and experimental implementation, not a production registry. The current implementation is an npm-first demo; PyPI, Cargo, Go, OCI, and future ecosystem projections need separate design and implementation. V0 is TypeScript-first; native, Rust, or WASM components remain future optimization paths rather than the current primary runtime. :::

What Regesta Is

Regesta is a draft architecture for a transparent universal package registry. It is not an attempt to clone one package manager with a different API surface. It is a registry kernel where package identity, release state, object storage, authorization, and auditability are shared primitives.

The core model is broader than any single ecosystem. npm, PyPI, Cargo, Go, OCI, and future package managers should be able to consume projections over the same Regesta-native objects.

Public Demo

The current experimental demo is available at:

• https://registry.regesta.dev/ for the Regesta-native registry API.
• https://npm.regesta.dev/ for the npm-compatible projection.

The demo is not a production registry. Data may be reset while the design and implementation are still changing.

Core Ideas

• Transparent: release manifests, objects, channels, and events are addressable and auditable.
• Secure: write authority is tied to explicit trust proofs, starting from domain ownership.
• Modern: source, artifacts, metadata, and verification data are structured for package managers, humans, security tools, and AI agents.
• Scalable: immutable objects and deterministic projections are naturally cacheable and can be backed by different storage systems.
• Community-driven: the registry should not be controlled by one company, operator, or package ecosystem.

Documentation Map

• Why Regesta explains the philosophy and long-term goals.
• Architecture describes the registry kernel and layer boundaries.
• Roadmap tracks the broader direction.
• Protocol, Schema, and API describe the implementation-facing model.
• Getting Started shows how to run the implementation.