Wiz registry

The Wiz registry is a self-hostable package registry and its reusable TypeScript client. It supports public and private packages, immutable versions, scoped ownership, organizations and teams, access tokens, password and passkey authentication, TOTP, recovery codes, SMTP verification, audit events, and registry-backed package resolution.

The server uses Bun, Elysia, Drizzle ORM, and PostgreSQL. API contracts generate OpenAPI 3.1 documentation rendered with Scalar.

Published package:

• @wiz-sh/registry-client is the canonical client used by the CLI and package manager.

Run locally

Copy the safe development defaults and start the complete environment:

cp .env.example .env
docker compose -f docker-compose.dev.yml up --build --wait

The development topology includes PostgreSQL, Redis, MinIO, Mailpit, migrations, the API, and a worker. Useful endpoints are:

• http://localhost:3000/health
• http://localhost:3000/ready
• http://localhost:3000/openapi
• http://localhost:3000/openapi/json

Verification

bun install
bun run check
bun run build
bun run registry:prod:validate
bun run registry:test:e2e

The isolated end-to-end runner owns startup, migrations, SMTP capture, API/client/CLI tests, log collection, and teardown. Set WIZ_E2E_KEEP_ENVIRONMENT=true only when retaining a failed environment for debugging.

Real mailbox testing is optional and reads credentials only from the ignored .env.smtp-e2e.local file. Production secrets must never be committed.

Production

docker-compose.prod.yml is a self-hosting baseline with health checks, durable services, non-development credentials, and reverse-proxy deployment. Configure storage, SMTP, WebAuthn origin and RP ID, cryptographic peppers, CORS, telemetry, and public URLs through environment variables.

Detailed deployment, backup, security, package, and authentication guides live in the documentation repository. Licensed under MIT.