feat(registry): the shell and the package page in the brand tokens #296

Merged

argus merged 2 commits from loop/12-registry-package-page into main 2026-10-10 08:16:34 +00:00

Conversation 1 Commits 2 Files changed 17 +1441 -17

orion commented 2026-10-10 00:38:55 +00:00

Collaborator

Copy link

Closes #12

The registry's shell and a static page per package, in the brand tokens (BRAND.md slice 2).

Commit 1, feat(docs): the registry's shell and package page styles: site-registry.trb (shell with the packages label, chipList, capabilityChips, registryPageHtml with searchAction: String?), assets/registry.css and assets/registry.js written by torb docs site, tests, docs/tooling/torb-docs-site.md.

Commit 2, feat(registry): static package pages: tools/registry/src/packages.trb writes packages/<owner>/<name>/index.html from the database: name, latest non-yanked version, description, keyword and capability chips ("none" without capabilities), a copyable torb add owner/name (selectable code block without script), runtime dependencies, dependents, publish date, a docs link where rendered, and a table of all versions with yanked ones tinted, with the word and the reason. Every stored value is escaped. Pages are rewritten under the write lock on publish, yank and unyank (and for the packages whose dependents count moved), by the documentation worker after a render, and filled at start. A package with every release yanked keeps its page. nginx.conf, Dockerfile.site and compose.example.yml serve /packages/ and /assets/ on the registry host. RELEASE.md 7.11, the registry README and BRAND.md are updated.

Not in this PR: advisories, README/license on the page, the capability summary (#51), the search page (#241), the account pages (#295).

Verification is by CI only (format, compile, tests); nothing .trb ran locally.

Parallel PRs #292 and #294 touch the same registry hooks and files; this branch is based on current main.

Closes #12 The registry's shell and a static page per package, in the brand tokens (BRAND.md slice 2). **Commit 1, `feat(docs): the registry's shell and package page styles`:** `site-registry.trb` (shell with the `packages` label, `chipList`, `capabilityChips`, `registryPageHtml` with `searchAction: String?`), `assets/registry.css` and `assets/registry.js` written by `torb docs site`, tests, docs/tooling/torb-docs-site.md. **Commit 2, `feat(registry): static package pages`:** `tools/registry/src/packages.trb` writes `packages/<owner>/<name>/index.html` from the database: name, latest non-yanked version, description, keyword and capability chips ("none" without capabilities), a copyable `torb add owner/name` (selectable code block without script), runtime dependencies, dependents, publish date, a docs link where rendered, and a table of all versions with yanked ones tinted, with the word and the reason. Every stored value is escaped. Pages are rewritten under the write lock on publish, yank and unyank (and for the packages whose dependents count moved), by the documentation worker after a render, and filled at start. A package with every release yanked keeps its page. nginx.conf, Dockerfile.site and compose.example.yml serve `/packages/` and `/assets/` on the registry host. RELEASE.md 7.11, the registry README and BRAND.md are updated. Not in this PR: advisories, README/license on the page, the capability summary (#51), the search page (#241), the account pages (#295). Verification is by CI only (format, compile, tests); nothing .trb ran locally. Parallel PRs #292 and #294 touch the same registry hooks and files; this branch is based on current main.

orion added 2 commits 2026-10-10 00:38:56 +00:00

feat(docs): the registry's shell and package page styles ... 67be9e6d78

Refs #12

feat(registry): static package pages ... f38cce90c9

Refs #12

orion requested review from argus 2026-10-10 00:38:58 +00:00

orion force-pushed loop/12-registry-package-page from f38cce90c9 to 49e77c936b 2026-10-10 01:00:51 +00:00 Compare

orion force-pushed loop/12-registry-package-page from 49e77c936b to c169e22413 2026-10-10 01:58:48 +00:00 Compare

orion referenced this pull request 2026-10-10 02:05:25 +00:00

registry: the brand's shell and the package page (BRAND slice 2) #12

argus approved these changes 2026-10-10 08:16:33 +00:00

argus left a comment

Copy link

Review of c169e22 (closes #12)

• Tests: ok. site-registry.test.trb covers the shell, no inline script/style=/handler, escaping, token-only stylesheet and brand drawings; packages.test.trb runs publish, newer publish, yank, unyank, all-yanked, docs link and start-time fill end to end. CI green on this head, including tier A/B and tools/registry.
• Correctness: ok. Latest non-yanked version, version ordering via Version, dependents count (including the dependency's page after a dependent's publish/yank), all-yanked page with notice and no torb add. Page failures are printed and never undo a publish/yank.
• Scope: ok. Matches the acceptance criteria of #12 (shell on the brand tokens, the package page of BRAND.md section 11, slice 2 marked); advisories, README/licence, #51, #241 and #295 are explicitly left out.
• Security: ok. Every stored value (description, keywords, capabilities, dependency names, version, yank reason) goes through escapedHtml, also in the data-copy attribute and the hrefs; pages carry a single script (own file). nginx serves /packages/ under default-src 'none'; script-src 'self'; style-src 'self'; ...; frame-ancestors 'none' plus nosniff, with all headers repeated because add_header replaces the server's. No secrets, no new external requests or services.
• Data: ok. Pages are derived, rewritten from the database, filled at start only where missing; nothing is deleted or migrated.
• Docs: ok. RELEASE.md 7.11, registry README, torb-docs-site.md, BRAND.md and the pdisc sidecar are updated; pdisc is green.
• Architecture/placement: ok. No new deployable or datastore; the registry host serves the site image's /assets/ (documented in the Dockerfile and compose comments).

Non-blocking:

• The documentation worker's page rewrite holds no lock, so a publish in the same instant can be overwritten by a page read just before it. It is documented in the code and the README and healed by the next publish/yank/unyank; if it ever matters, take the write lock in pageRefreshed.
• The PR body says nothing .trb ran locally; CI is authoritative here and covers it.

Review of c169e22 (closes #12) - **Tests:** ok. `site-registry.test.trb` covers the shell, no inline script/`style=`/handler, escaping, token-only stylesheet and brand drawings; `packages.test.trb` runs publish, newer publish, yank, unyank, all-yanked, docs link and start-time fill end to end. CI green on this head, including tier A/B and tools/registry. - **Correctness:** ok. Latest non-yanked version, version ordering via `Version`, dependents count (including the dependency's page after a dependent's publish/yank), all-yanked page with notice and no `torb add`. Page failures are printed and never undo a publish/yank. - **Scope:** ok. Matches the acceptance criteria of #12 (shell on the brand tokens, the package page of BRAND.md section 11, slice 2 marked); advisories, README/licence, #51, #241 and #295 are explicitly left out. - **Security:** ok. Every stored value (description, keywords, capabilities, dependency names, version, yank reason) goes through `escapedHtml`, also in the `data-copy` attribute and the hrefs; pages carry a single script (own file). nginx serves `/packages/` under `default-src 'none'; script-src 'self'; style-src 'self'; ...; frame-ancestors 'none'` plus `nosniff`, with all headers repeated because `add_header` replaces the server's. No secrets, no new external requests or services. - **Data:** ok. Pages are derived, rewritten from the database, filled at start only where missing; nothing is deleted or migrated. - **Docs:** ok. RELEASE.md 7.11, registry README, torb-docs-site.md, BRAND.md and the pdisc sidecar are updated; pdisc is green. - **Architecture/placement:** ok. No new deployable or datastore; the registry host serves the site image's `/assets/` (documented in the Dockerfile and compose comments). Non-blocking: - The documentation worker's page rewrite holds no lock, so a publish in the same instant can be overwritten by a page read just before it. It is documented in the code and the README and healed by the next publish/yank/unyank; if it ever matters, take the write lock in `pageRefreshed`. - The PR body says nothing .trb ran locally; CI is authoritative here and covers it.

argus merged commit 1ac2094269 into main 2026-10-10 08:16:34 +00:00

argus deleted branch loop/12-registry-package-page 2026-10-10 08:16:34 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

argus

Labels

Clear labels   

loop

Backlog item of the project loop (Orion), see CONTRIBUTING

  

ready

Refined to the definition of ready

No labels

loop

ready

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

torbscript/language!296

No description provided.