Crate aube_registry

Modules§

client
config
jsr: JSR (https://jsr.io) serves its packages through an npm-compatible endpoint at https://npm.jsr.io. Packages are namespaced under the @jsr scope with the JSR scope folded into the package name via a __ separator — so jsr:@std/collections is fetched as @jsr/std__collections from the npm-compat registry.
osv_bloom_client: Compact bloom-filter prefilter for OSV MAL-* advisories.
osv_mirror: Local mirror of OSV’s npm malicious-advisory dump.
slow_metadata: Debounced, grouped warnings for slow registry metadata fetches.
supply_chain: Supply-chain checks for aube add.

Attestations
Dist
ExactVersionPackument: One exact release plus the compact history needed for time and trust policy checks. The full registry document is decoded in a single pass: the selected release uses VersionMetadata, while every other release uses VersionTrustMetadata.
NpmUser
Packument: A packument (package document) from the npm registry. This is the metadata for all versions of a package.
PackumentTrustHistory: The subset of a full packument needed to enforce publish-time and trust-downgrade policies for an exact version. Deserializing this shape skips dependency maps and distribution metadata for every historical release, avoiding the large retained heap of a full Packument.
PeerDepMeta
VersionMetadata: Metadata for a specific version of a package.
VersionTrustDist
VersionTrustMetadata

BundledDependencies: bundledDependencies shape from package.json. npm/pnpm accept either an array of dep names or a boolean (true meaning “bundle everything in dependencies”). We preserve both so the resolver can compute the exact name set.
Error
NetworkMode: Controls whether the registry client is allowed to hit the network.