Registries & Manifests

A registry is the source of truth for "what packages exist and what versions they have." Examples: npmjs.org, crates.io, pypi.org, rubygems.org.

A manifest is the per-package metadata file. Examples:

• npm: package.json
• cargo: Cargo.toml
• pip: pyproject.toml / setup.py
• gem: Gemfile

A typical registry response for one version of a package:

{
  "name": "lodash",
  "version": "4.17.21",
  "dependencies": {
    "react": "^18.0.0",
    "axios": "~1.5.0"
  },
  "tarball": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
  "shasum": "679591c564c3bffaae8454cf0b3df370c3d6911c"
}

When you npm install lodash, npm:

1. Fetches https://registry.npmjs.org/lodash
2. Picks the highest version matching the constraint in package.json
3. Downloads the tarball
4. Verifies the SHA-1 hash matches
5. Recurses into the dependencies — fetch their metadata, pick versions, etc.

Most registries support a SAT-like API:

• GET /<package> — all versions metadata
• GET /<package>/<version> — specific version
• GET /<package>/-/<package>-<version>.tgz — tarball

For this lesson: a tiny in-memory registry with version queries.