RegestaUniversal Package Registry Kernel

What Regesta Is ​

Regesta is a draft architecture for a transparent universal package registry. It is not an attempt to clone one package manager with a different API surface. It is a registry kernel where package identity, release state, object storage, authorization, and auditability are shared primitives.

The core model is broader than any single ecosystem. npm, PyPI, Cargo, Go, OCI, and future package managers should be able to consume projections over the same Regesta-native objects.

Public Demo ​

The current experimental demo is available at:

• https://registry.regesta.dev/ for the Regesta-native registry API.
• https://npm.regesta.dev/ for the npm-compatible projection.

The demo is not a production registry. Data may be reset while the design and implementation are still changing.

Core Ideas ​

• Transparent: release manifests, objects, channels, and events are addressable and auditable.
• Secure: write authority is tied to explicit trust proofs, starting from domain ownership.
• Modern: source, artifacts, metadata, and verification data are structured for package managers, humans, security tools, and AI agents.
• Scalable: immutable objects and deterministic projections are naturally cacheable and can be backed by different storage systems.
• Community-driven: the registry should not be controlled by one company, operator, or package ecosystem.

Documentation Map ​

• Why Regesta explains the philosophy and long-term goals.
• Architecture describes the registry kernel and layer boundaries.
• Roadmap tracks the broader direction.
• Protocol, Schema, and API describe the implementation-facing model.
• Getting Started shows how to run the implementation.