
Research
/Security News
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
@decantr/content
Advanced tools
Official Decantr content corpus for AI frontend governance contracts, context, examples, and validation
Support status: core-supported
Release channel: stable
Official Decantr content corpus for @official patterns, themes, shells, archetypes, and blueprints. This package is the source of truth for content-corpus search, schema validation, resolution, content health, and the Fly-hosted content API.
In Decantr 3.9, first-party resolver, client, ranking, wiring, content-type, and provenance implementations live here. @decantr/registry delegates to this package and exists only to preserve Decantr 3.x import and naming compatibility.
npm install @decantr/content
patterns/, themes/, blueprints/, archetypes/, and shells/schemas/, with schema/ retained as an import-path aliaslistContentRecords(), searchContent(), getContentRecord(), and resolveContent()createContentResolver() for the installed official corpus and createResolver() for explicit filesystem roots and overridesContentAPIClient, ContentAPIError, and createContentAPIClient() for content API reads@decantr/content/client for the web-safe client, response, and ranking surfaceContentIntelligenceSummaryResponse and ContentIntelligenceSummaryBucket as the preferred intelligence response namesvalidateContentData() and validateOfficialCorpus()buildContentIntelligenceSummary() for content coverage and recommendation metadataPattern, Theme, Blueprint, Archetype, Shell, resolver, public-record, and Content Health typesContentRef, canonical JSON SHA-256 helpers, and deterministic corpus manifestscontent-identity.v1.json, content-ref.v1.json, and content-corpus-manifest.v1.jsonimport {
createContentResolver,
searchContent,
validateOfficialCorpus,
} from '@decantr/content';
const results = searchContent({ q: 'dashboard', type: 'blueprints', recommended: true });
const resolver = createContentResolver();
const pattern = await resolver.resolve('pattern', 'data-table');
const health = validateOfficialCorpus();
Content API usage:
import { createContentAPIClient } from '@decantr/content/client';
const client = createContentAPIClient();
const results = await client.search({ q: 'dashboard', type: 'blueprint' });
const intelligence = await client.getContentIntelligenceSummary({ namespace: '@official' });
The client resolves its base URL from an explicit baseUrl, then DECANTR_API_URL, then the legacy REGISTRY_URL alias, and finally https://api.decantr.ai/v1. No-argument construction is safe when a browser runtime has no global process, and the package root and /client entrypoint expose the same client class and factory identities in packed installs.
buildContentRef() emits the frozen 3.9 reference shape: namespace/type/ID identity, nullable local version, semantic payload digest, Decantr compatibility, origin, resolution source, and an optional exact override reference. Official refs require SemVer; legacy local refs may use null. Slugs are lookup/display aliases and are not identity.
The SHA-256 digest covers the RFC 8785/JCS-style canonical semantic payload. Identity/schema aliases plus conventional top-level transport path and timestamp fields are projected out; callers can keep additional loader metadata in the input transport envelope. Authored fields inside data, including a theme's authored source, remain digest-significant.
import {
buildContentCorpusManifest,
buildContentRef,
getContentPackageVersion,
getContentRecord,
} from '@decantr/content';
const record = getContentRecord('patterns', 'data-table');
if (!record) throw new Error('Missing official pattern');
const ref = buildContentRef(record);
const manifest = buildContentCorpusManifest({
packageVersion: getContentPackageVersion(),
compatibility: { decantr: '>=2.0.0' },
refs: [ref],
});
buildContentCorpusManifest() validates and sorts exact refs by namespace, type, ID, version, and deterministic tie-breakers; rejects duplicate versioned identities; and hashes the sorted refs. It emits packageName: "@decantr/content", packageVersion, corpusDigest, corpus compatibility, and refs. Repackaging unchanged refs preserves corpusDigest while packageVersion records the installed corpus release.
From the monorepo root:
pnpm --filter @decantr/content validate
pnpm --filter @decantr/content content:health
pnpm --filter @decantr/content test
pnpm audit:packed-content-facade
The packed facade audit builds tarballs, installs them into a clean npm consumer with no workspace links, checks content/registry runtime identity and schema parity, compiles the public 3.8.1 registry client type surface, verifies browser-safe construction and the REGISTRY_URL compatibility alias, and rejects retired-host or local-path leakage. It is package-boundary evidence, not human finding qualification. Stable 3.9.4 publication may separately use the explicit sole-maintainer release gate, which preserves these machine checks while prohibiting precision, recall, qualification, and adoption-proof claims.
decantr content check is the preferred content-author workflow. decantr content-health remains as a backward-compatible primitive.
This corpus is official reference material. It is not a public marketplace, account system, or styling runtime. Brownfield attach and contract-only adoption must work without content API access. Project-owned local law created by decantr codify --from-audit belongs in the consuming app under .decantr/local-patterns.json and .decantr/rules.json.
Some pattern and shell records retain atoms fields as 3.x compatibility hints for the explicit @decantr/css adapter. Contract-only and style-bridge workflows ignore those hints and translate semantic layout, interaction, and visual intent into the consuming project's own styling authority.
@decantr/registry, decantr registry ..., and MCP decantr_registry remain compatibility names in Decantr 3.x. The registry package is a re-export facade over this package; new docs and scripts should prefer @decantr/content and decantr content ....
MIT
FAQs
Official Decantr content corpus for AI frontend governance contracts, context, examples, and validation
The npm package @decantr/content receives a total of 395 weekly downloads. As such, @decantr/content popularity was classified as not popular.
We found that @decantr/content demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.