← zed-pkg home System map

Small services. Explicit trust boundaries.

Zed keeps package intent in the repository, publication authority at the write API, immutable bytes at content-addressed storage, and independent public fallbacks at the edge. Each hostname has one job.

Architecture docs Infrastructure code

The public request path

The public service contract separates account traffic, authenticated writes, metadata reads, and artifact bytes instead of asking one origin to serve every concern.

zpkg.net Static marketing, public explanations, and links into product surfaces.

app.zpkg.net Account-aware web UI backed by the Rust MASH web server.

api.zpkg.net Authenticated publication and other state-changing registry operations.

registry.zpkg.net Public package and version metadata reads, including bounded edge fallback.

cdn.zpkg.net Immutable artifact bytes from private R2 or independently public package sources.

GitHub Releases Public artifact mirror and provenance route for GitHub-backed packages.

Postgres Package identity, versions, ownership, policy, and publication metadata.

R2 / S3 Content-addressed archives served through a constrained public byte boundary.

The CLI is the coordination plane

Authoring

.zpkg.toml declares package identity, version, source repository, install behavior, targets, build permissions, and dependency requirements.

Publication

zed publish verifies source provenance, builds a deterministic pruned archive, writes registry metadata, and mirrors supported forge artifacts.

Consumption

zed install resolves metadata, checks SHA-256, writes the global store once, and materializes the selected project layout.

Read and write failures are different

Operation	Primary route	Fallback behavior
Publish metadata or mutate state	`api.zpkg.net` / registry origin	Fail closed at the edge; supported forge mirrors are written by the CLI, not by a public proxy.
Read package/version metadata	`registry.zpkg.net`	For independently public packages, bounded Cloudflare workers may reconstruct metadata from public sources.
Read immutable artifact bytes	`cdn.zpkg.net` or a recorded download URL	Content-addressed R2 first; allowlisted public GitHub/native routes where public proof exists.
Frozen restore	Recorded lockfile source	The pinned digest remains authoritative even when the primary metadata service is unavailable.

Shared contracts, generated clients

Rust services and clients share typed package, manifest, lockfile, and registry contracts through zed-interfaces. The broader repository family supplies SDKs, sync, CLI, web, API, infrastructure, documentation, and cross-repository E2E verification.

Early-access boundary

Architecture describes the checked-in system contract. Individual production routes remain subject to deployment and live-canary gates; planned work is labeled rather than presented as generally available.