PkgLift
PkgLift/Registry
Executable evidence

The Dependency Registry

A registry entry is not a search result. It is a reviewed contract connecting one exact CocoaPods identifier to a verified SwiftPM repository, product, and conservative minimum version.

Mapping structure

schemaVersion: 1
pod:
  name: Alamofire
swiftpm:
  repository: https://github.com/Alamofire/Alamofire
  products:
    - Alamofire
  minimumVersion: 5.0.0
  supportedConsumerLanguages:
    - swift
migration:
  confidence: verified
metadata:
  notes: Official mapping
  lastVerified: "2026-08-14"

Why the minimum version is conservative

The minimum records an upstream tag where the repository and listed products were verified. PkgLift compares it with the exact version already resolved by Podfile.lock. It never uses the registry to invent an upgrade.

Consumer-language evidence

supportedConsumerLanguages records the languages from which the exact product has been proven consumable. The list must be non-empty, unique, and contain only known enum values. A mixed Swift and Objective-C target requires both values; a package’s own implementation language is not enough.

Older external mappings without this additive field still load, but cannot support AUTO until reviewed language evidence is added.

Exact pod and subspec identity

Subspec mappings name the subspec explicitly. A base pod mapping does not flow into undeclared subspecs, because they may expose different products, resources, build settings, or compatibility constraints.

Resolution precedence

  1. .pkglift/registry/ local overrides;
  2. paths configured under registry.additionalPaths in .pkglift.yml;
  3. the bundled registry.

The first exact identifier at the highest-precedence source wins. Every loaded entry is validated before classification.

Contribute a mapping

Use official upstream evidence

Confirm the repository, tag, Package.swift, exact product name, and supported platform context.

Prove consumer languages

Cite official import guidance or a reproducible compiling fixture for every listed language.

Choose a conservative minimum

Record a stable major.minor.patch version where the package, product, and language support were verified.

Validate and test

Keep both registry copies synchronized, run swift run pkglift registry validate, and add classification evidence.

No guessing to grow coverage. An unmapped dependency should remain UNKNOWN until its identity, product, and version evidence can be reviewed.

Propose a registry mapping Read contribution rules