Struct Registry 

pub struct Registry {
    pub base_url: String,
    pub detail: PackumentDetail,
}

An npm-compatible registry. Defaults to the public registry and the abbreviated packument.

Fields

base_url: String

detail: PackumentDetail

How much of each packument to fetch. Abbreviated by default (faster); Full includes per-version license.

Implementations

impl Registry

pub fn npm() -> Self

The public npm registry (https://registry.npmjs.org).

pub fn with_base_url(base_url: impl Into<String>) -> Self

A registry at a custom base URL (e.g. a private mirror).

pub fn with_detail(self, detail: PackumentDetail) -> Self

Set how much of each packument to fetch (e.g. PackumentDetail::Full to capture license).

pub fn tarball_url(&self, name: &str, version: &str) -> String

Conventional tarball URL for an exact version. Handles scoped names: @scope/pkg → <base>/@scope/pkg/-/pkg-<version>.tgz.

pub fn packument( &self, name: &str, ) -> Result<Value, Box<dyn Error + Send + Sync>>

Fetch the package metadata document (“packument”).

pub fn resolve( &self, name: &str, range: &Range, ) -> Result<Resolved, Box<dyn Error + Send + Sync>>

Resolve the newest published version of name matching the range.

pub fn search( &self, query: &str, limit: usize, ) -> Result<Vec<SearchResult>, Box<dyn Error + Send + Sync>>

Search the registry for query, returning up to limit results ranked by the registry’s own relevance score (npm’s /-/v1/search endpoint). limit is clamped to the registry’s 1..=250 window. Each result carries the package’s latest version and indexed metadata, not a range resolution — follow up with resolve to pin a version.

pub fn resolve_tree( &self, roots: &[(String, Range)], ) -> Result<Vec<Resolved>, Box<dyn Error + Send + Sync>>

Resolve the transitive dependency graph of roots into a flat set — one version per package name (the npm v3+ node_modules layout). Each package’s dependencies are read straight from the registry metadata (no tarball extraction), every child resolved to its newest matching version, and the set de-duplicated by name. Cyclic graphs terminate (a name is resolved once). Returns the packages sorted by name. Packuments are prefetched concurrently (bounded, level by level); resolution order, version selection, errors, and output are deterministic and identical to a sequential walk.

MVP limitation: a single version per package name. Two incompatible requirements on the same package — a genuine conflict npm would resolve by nesting — is reported as an error rather than silently mis-resolved; resolve_tree_nested is the conflict-tolerant sibling that keeps a version per disagreeing range instead.

pub fn resolve_tree_nested( &self, roots: &[(String, Range)], ) -> Result<Vec<Resolved>, Box<dyn Error + Send + Sync>>

Resolve the transitive dependency graph of roots the way npm’s nested node_modules does: a requirement an already-resolved version satisfies reuses it (npm’s dedupe), and requirements that disagree keep one resolved version per range instead of erroring like resolve_tree. Returns the packages sorted by name, then version — possibly several versions of one name.

This is the resolution an audit wants — a nested-compatible package/version set, not npm’s placement algorithm: no hoisting, no peer-dependency handling, and no os/cpu filtering (every platform’s optional deps are included — their advisories matter regardless of the auditing machine). optionalDependencies are traversed alongside dependencies; non-registry specs (git / path / tarball / workspace: / link:) and optional deps that fail to resolve are skipped — this method drops the Omission records, the crate-internal observed variant returns them. Installs keep resolve_tree’s flat one-version-per-name guarantee. Packuments are prefetched concurrently (bounded, level by level); the result is deterministic and identical to a sequential walk.

Trait Implementations

impl Default for Registry

fn default() -> Self

Returns the “default value” for a type.