
Product
Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.
@archsmith/schema
Advanced tools
IR schema and governed registries (sub-layers, colors, icons) for ArchSmith diagrams
The IR schema and governed registries for ArchSmith — the structural contract a diagram intermediate representation (IR) must satisfy, and the catalog of colors/sub-layer types it's allowed to reference.
See the root README for what ArchSmith is and how the pieces fit together; this package is the schema layer only, consumed by @archsmith/renderer for validation.
diagram-schema.json — JSON Schema (draft 2020-12) for the IR: the document a human or agent produces describing a layered architecture, and that @archsmith/renderer validates and renders to SVG. Fixed shape: 5 columns, Core Platform sub-layers stacked in order, systems-of-record as a sibling section below the "deployed on" wrapper.registries/sub-layers.json — the governed, extensible list of Core Platform sub-layer types (Discovery and Governance, Execution and Capability Layer, Entity Layer, Systems of Record and Knowledge).registries/colors.json — the governed color catalog. standard and accessible are active families with the same semantic token assignments; the accessible family is a color/contrast-safe alternative.registries/icons.json — placeholder only. Categories that will need icons are listed; no actual icon tokens are defined yet, deliberately, to avoid inventing bespoke icon shapes ad hoc — tracked here. Items without an icon render as a plain colored dot.import { getDiagramSchema, getRegistry, listRegistryNames } from "@archsmith/schema";
const schema = getDiagramSchema(); // the parsed diagram-schema.json
const colors = getRegistry("colors"); // one governed registry, parsed
listRegistryNames(); // ["sub-layers", "colors", "icons"]
In practice you'll rarely call this package directly — @archsmith/renderer's validate()/render() already do, and @archsmith/mcp-server exposes the schema and each registry as MCP resources for an agent to read live.
The ArchSmith schema is registered with SchemaStore, so any file named *.archsmith.json gets autocomplete and inline validation for free in VS Code, JetBrains IDEs, Neovim (coc.nvim / nvim-lspconfig), and any other SchemaStore-aware editor — no $schema line needed. This is the recommended default; SchemaStore points at schema/latest/diagram-schema.json, so it always validates against the newest schema.
If your file doesn't match that naming pattern, or you want to pin validation to the exact schema version you authored against, add the $schema field manually:
{
"$schema": "https://ayeshlk.github.io/archsmith/schema/0.3.5/diagram-schema.json",
"schemaVersion": "0.3.5"
}
Versioned URLs remain immutable. https://ayeshlk.github.io/archsmith/schema/latest/diagram-schema.json follows the newest schema and is useful for discovery, but committed diagrams should use the versioned URL for reproducibility.
Changing diagram-schema.json's structure, or adding an entry to any registry, is a deliberate change-request event — never a decision made by a generation step or an end user mid-diagram. This is what keeps the format a consistent house style rather than free-form per-diagram layout. Bump schemaVersion/registryVersion on any such change.
What stays free per diagram (no change request needed): which already-approved sub-layers/colors/icons a given diagram uses, how many rows of boxes a layer has, and whether a legend or notes callout is included. Both governed color families are selectable; their token ids preserve the same semantic assignments.
Apache-2.0
FAQs
IR schema and governed registries (sub-layers, colors, icons) for ArchSmith diagrams
The npm package @archsmith/schema receives a total of 35 weekly downloads. As such, @archsmith/schema popularity was classified as not popular.
We found that @archsmith/schema demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.

Security News
Fixes for eMudhra and Brotli are out. Getting them everywhere they’re needed means tracking down bundled libraries, runtimes, and certificate stores.

Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.