{ "slug": "code/registry", "title": "Code Registry", "description": "Use Cuitty Code Registry for npm, Cargo, OCI, and PyPI packages.", "url": "https://cuitty.com/docs/code/registry", "markdown_url": "https://cuitty.com/docs/code/registry.md", "json_url": "https://cuitty.com/docs/code/registry.json", "frontmatter": { "title": "Code Registry", "description": "Use Cuitty Code Registry for npm, Cargo, OCI, and PyPI packages.", "order": 20, "section": "Code", "updatedAt": "2026-05-24" }, "headings": [ { "depth": 2, "slug": "required-services", "text": "Required services" }, { "depth": 2, "slug": "environment-variables", "text": "Environment variables" }, { "depth": 2, "slug": "permissions-model", "text": "Permissions model" }, { "depth": 2, "slug": "npm", "text": "npm" }, { "depth": 2, "slug": "cargo", "text": "Cargo" }, { "depth": 2, "slug": "pypi", "text": "PyPI" }, { "depth": 2, "slug": "docker-and-oci", "text": "Docker and OCI" }, { "depth": 2, "slug": "common-workflows", "text": "Common workflows" }, { "depth": 2, "slug": "failure-modes-and-recovery", "text": "Failure modes and recovery" }, { "depth": 2, "slug": "related-pages", "text": "Related pages" } ], "body_markdown": "Cuitty Code Registry stores packages and artifacts owned by Cuitty users and organizations. It uses the same users, organizations, slugs, teams, apps, audit logs, and SpiceDB permissions as repositories.\n\nPackages default to private. Moving a package to organization or public visibility requires an explicit Cuitty visibility change and audit event.\n\n## Required services\n\n- Cuitty Git API for package metadata and protocol endpoints.\n- Database for package records, versions, dist tags, visibility, ownership, and artifact references.\n- SpiceDB for namespace, package, publish, install, and view permissions.\n- Registry artifact storage for tarballs, crates, wheels, and image layers.\n- Airflow for publish validation, scans, provenance, index updates, and replication when enabled.\n- Optional object storage for larger deployments.\n\n## Environment variables\n\n```bash\nPUBLIC_API_URL=http://localhost:4351\nAUTH_ISSUER=http://localhost:7705\nAUTH_CLIENT_ID=cuitty-git\nSPICEDB_ENDPOINT=http://localhost:50051\nSPICEDB_PRESHARED_KEY=dev-secret\nAIRFLOW_URL=http://localhost:8080\nREGISTRY_STORAGE_URL=file:///var/lib/cuitty/registry\n```\n\n## Permissions model\n\nRegistry namespaces and packages have separate relationships. Namespace owners can administer the namespace and publish packages. Package owners and package maintainers can manage package metadata and versions. Public and organization visibility map to explicit SpiceDB relationships, and unauthorized callers may receive `404` for private packages.\n\n## npm\n\nUse the npm endpoint for scoped and unscoped package metadata, publish, and tarball download:\n\n```bash\nnpm config set @acme:registry http://localhost:4351/api/v1/npm/\nnpm login --registry http://localhost:4351/api/v1/npm/\nnpm publish --registry http://localhost:4351/api/v1/npm/\nnpm install @acme/button --registry http://localhost:4351/api/v1/npm/\n```\n\nFor scoped packages, the npm scope must match the Cuitty owner namespace. For example, `@acme/button` must publish under the `acme` owner.\n\n## Cargo\n\nConfigure a sparse registry:\n\n```toml\n[registries.cuitty]\nindex = \"sparse+http://localhost:4351/api/v1/cargo/index/\"\n```\n\nThen publish or install with:\n\n```bash\ncargo publish --registry cuitty\ncargo add package-name --registry cuitty\n```\n\n## PyPI\n\nUpload with Twine and install from the simple index:\n\n```bash\ntwine upload --repository-url http://localhost:4351/api/v1/pypi/ dist/*\npip install --index-url http://localhost:4351/api/v1/pypi/simple/ package-name\n```\n\nPackage names should be normalized consistently between upload metadata, simple index pages, and install URLs.\n\n## Docker and OCI\n\nPush images through the registry host:\n\n```bash\ndocker login localhost:4351\ndocker tag image localhost:4351/acme/image:tag\ndocker push localhost:4351/acme/image:tag\ndocker pull localhost:4351/acme/image:tag\n```\n\nOperators should decide whether tags are mutable, immutable, or protected by policy before opening production pushes.\n\n## Common workflows\n\n1. Create or claim a registry namespace for a user or organization.\n2. Publish a package version through the native package manager.\n3. Store package metadata, files, checksums, and visibility.\n4. Update protocol indexes or tags.\n5. Install through the native package manager using the same registry URL.\n\n## Failure modes and recovery\n\n- `404` for a private package can be intentional when the caller lacks view permission.\n- `403` means the package exists but the caller is authenticated without the required permission.\n- Artifact storage failures can leave metadata and files out of sync; check API logs, package version records, and storage references before allowing new publishes.\n- Scope mismatch errors mean the package name does not match the target Cuitty owner namespace.\n\n## Related pages\n\n- [npm Packages](/docs/code/npm)\n- [Cargo Crates](/docs/code/cargo)\n- [PyPI Packages](/docs/code/pypi)\n- [OCI and Docker Images](/docs/code/oci)\n- [Authorization with SpiceDB](/docs/code/authz-spicedb)\n- [Operator runbook](/docs/code/operator-runbook)", "body_html": "

Cuitty Code Registry stores packages and artifacts owned by Cuitty users and organizations. It uses the same users, organizations, slugs, teams, apps, audit logs, and SpiceDB permissions as repositories.

\n

Packages default to private. Moving a package to organization or public visibility requires an explicit Cuitty visibility change and audit event.

\n

Required services

\n\n

Environment variables

\n
PUBLIC_API_URL=http://localhost:4351\nAUTH_ISSUER=http://localhost:7705\nAUTH_CLIENT_ID=cuitty-git\nSPICEDB_ENDPOINT=http://localhost:50051\nSPICEDB_PRESHARED_KEY=dev-secret\nAIRFLOW_URL=http://localhost:8080\nREGISTRY_STORAGE_URL=file:///var/lib/cuitty/registry
\n

Permissions model

\n

Registry namespaces and packages have separate relationships. Namespace owners can administer the namespace and publish packages. Package owners and package maintainers can manage package metadata and versions. Public and organization visibility map to explicit SpiceDB relationships, and unauthorized callers may receive 404 for private packages.

\n

npm

\n

Use the npm endpoint for scoped and unscoped package metadata, publish, and tarball download:

\n
npm config set @acme:registry http://localhost:4351/api/v1/npm/\nnpm login --registry http://localhost:4351/api/v1/npm/\nnpm publish --registry http://localhost:4351/api/v1/npm/\nnpm install @acme/button --registry http://localhost:4351/api/v1/npm/
\n

For scoped packages, the npm scope must match the Cuitty owner namespace. For example, @acme/button must publish under the acme owner.

\n

Cargo

\n

Configure a sparse registry:

\n
[registries.cuitty]\nindex = \"sparse+http://localhost:4351/api/v1/cargo/index/\"
\n

Then publish or install with:

\n
cargo publish --registry cuitty\ncargo add package-name --registry cuitty
\n

PyPI

\n

Upload with Twine and install from the simple index:

\n
twine upload --repository-url http://localhost:4351/api/v1/pypi/ dist/*\npip install --index-url http://localhost:4351/api/v1/pypi/simple/ package-name
\n

Package names should be normalized consistently between upload metadata, simple index pages, and install URLs.

\n

Docker and OCI

\n

Push images through the registry host:

\n
docker login localhost:4351\ndocker tag image localhost:4351/acme/image:tag\ndocker push localhost:4351/acme/image:tag\ndocker pull localhost:4351/acme/image:tag
\n

Operators should decide whether tags are mutable, immutable, or protected by policy before opening production pushes.

\n

Common workflows

\n
    \n
  1. Create or claim a registry namespace for a user or organization.
    2. \n
  2. Publish a package version through the native package manager.
    3. \n
  3. Store package metadata, files, checksums, and visibility.
    4. \n
  4. Update protocol indexes or tags.
    5. \n
  5. Install through the native package manager using the same registry URL.
    6. \n
\n

Failure modes and recovery

\n\n

Related pages

\n", "links_out": [ "/docs/code/npm", "/docs/code/cargo", "/docs/code/pypi", "/docs/code/oci", "/docs/code/authz-spicedb", "/docs/code/operator-runbook" ] }