Zed treats publication authority and artifact availability as separate problems. Writes remain authenticated and fail closed; public reads can use independently verifiable mirrors without turning the edge into a second source of truth.
When the registry origin is unavailable or lacks a public package,
registry.zpkg.net can reconstruct bounded version
metadata from a public GitHub Release sidecar.
GET /v1/packages/acme/http-kit/versions/1.2.0 x-zed-source: github-public
cdn.zpkg.net can proxy an allowlisted public GitHub
Release object after validating each redirect and enforcing a
bounded content length.
GET /github/acme/http-kit/v1.2.0/zpkg-acme-http-kit-1.2.0.tar.gz x-zed-edge: cdn x-zed-source: github-release
The CLI can read public Release metadata and bytes directly when the configured registry and public object source are unavailable. Frozen installs remain governed by the lockfile digest.
The CLI mirrors supported GitHub-backed publishes to Releases. A dedicated public canary now verifies the real publish, Cloudflare read, direct install, and frozen reinstall chain before this site presents the complete path as generally available.
| Request | Edge policy | Reason |
|---|---|---|
| Authenticated publish, yank, or ownership change | Origin only; return a typed unavailable response if the write origin is down | A public proxy must not invent authorization or become a confused-deputy writer. |
| Public package/version read | Origin first, then independently public bounded metadata sources | Public availability can degrade gracefully without mutating registry state. |
| Immutable artifact read | Private R2 content-addressed object or validated public upstream | The response is safe only when identity, redirects, size, and cache policy are constrained. |
| Unknown route or unsupported method | Reject before any upstream network call | The edge state machine keeps non-registry paths out of the origin and fallback clients. |
The canary is intentionally owned by the repository whose Release it writes. Its repository-scoped Actions token never needs sibling-repo write authority.
Build an exact CLI SHA, make the registry unreachable, and require
zed publish to report a successful GitHub Release mirror.
Match direct GitHub, sidecar, registry fallback, and Cloudflare CDN SHA-256, size, download URL, and byte content.
Disable registry and R2 access, install directly from GitHub, wipe
the store, then require --frozen to restore without lock drift.
A helper that uploads handcrafted bytes can isolate GitHub API health, but only the product-path canary certifies the real CLI metadata and fallback contract end to end.
x-zed-source header.