artbd-ui

React components and utilities used by Gear projects.

Private shadcn registry

This repository exposes every component family and reusable hook through a bearer-token-protected shadcn registry. The source catalog is registry.json and is generated from src/.

Regenerate and verify the catalog after adding or moving source files:

npm run registry:generate
npm run registry:check

Generate a token and start the registry:

export REGISTRY_TOKEN="$(openssl rand -hex 32)"
npm run registry:start

The server listens on 127.0.0.1:3000 by default. Copy .env.example values into your deployment environment rather than committing a token. The server intentionally does not load .env files itself.

Configure a consumer project's components.json:

{
  "registries": {
    "@gear": {
      "url": "https://registry.example.com/r/{name}.json",
      "headers": {
        "Authorization": "Bearer ${GEAR_REGISTRY_TOKEN}"
      }
    }
  }
}

Then set GEAR_REGISTRY_TOKEN in the consumer environment and use the namespace:

npx shadcn@latest view @gear/kbd
npx shadcn@latest add @gear/kbd
npx shadcn@latest add @gear/use-controllable-state

The catalog endpoint used by shadcn list, search, and MCP clients is /r/registry.json. Individual items are served from /r/<name>.json.

Deployment notes

• The deployable Next.js service is isolated in registry/. On Vercel, set the project Root Directory to registry and enable source access outside that root during the build step.
• After linking the Vercel project at the repository root, run npm --prefix registry run deploy:preview for a local preview deployment or npm --prefix registry run deploy:production to mirror the production GitHub Actions deployment. See the registry README for authentication, verification, and one-time linking instructions.
• registry/vercel.json forces npm run build, which stages the root catalog and referenced src/ files before Next.js builds the authenticated route handlers.
• Terminate TLS in front of this HTTP server; never expose tokens over plain HTTP.
• Authenticated success responses are marked private and vary on Authorization; failures are no-store.
• The lightweight registry/server.mjs development server has a per-process rate limiter. Use Vercel Firewall or another shared limiter for the deployed serverless app.
• Rotate tokens through your deployment secret manager. The local server refuses to start without REGISTRY_TOKEN; the deployed app fails closed with 503 Service Unavailable until it is configured.
• Run npm run registry:test after changing the server or catalog. The test loads every generated item through the actual shadcn producer API.