Skip to content
Crate HavenHaven docs

Namespaces

A namespace is a complete cargo registry with its own crates, policy, and access rules. An organization can have many namespaces: one per team, one per product, a public storefront, a filtered mirror of crates.io. Each is independent.

Two kinds

Section titled “Two kinds”

The kind is chosen at creation and cannot be changed afterwards.

  • Publish namespace: crates arrive through cargo publish. This is your private (or public) registry for first-party code.
  • Mirror namespace: crates arrive from an upstream registry that Haven pulls through on demand. You never publish into a mirror. See Mirrors.

Both kinds share the same surfaces: the same cargo registry protocol, the same policy engine, the same crate pages, held view, rustdoc hosting, and tokens.

Visibility

Section titled “Visibility”
  • Private (the default): readable only by your organization’s members and tokens, plus identities you explicitly grant.
  • Public: any signed-in user can browse the namespace and read promoted versions with a public-read token. Held versions stay invisible to the public; the gate applies to strangers exactly as it does to you.

Visibility can be flipped later from the namespace settings. Making a private namespace public exposes its promoted contents to everyone, so the UI asks for confirmation.

Owners

Section titled “Owners”

A namespace has one or more owners. Owners change settings and policy, manage the allowlist of a mirror, approve promotions, vouch for publishers, and manage grants. Promotion approvals count distinct owner identities, so a namespace with a promotion threshold above one needs at least that many owners to waive a hold; see Policy overview.

Grants

Section titled “Grants”

Grants share specific crates with identities outside the namespace’s organization, without making anything public. A grant names:

  • a subject: the identity being granted read access, and
  • a version requirement: a semver range such as ^1.4 limiting which versions the subject can resolve and download.

Grants are per crate. They are the right tool for selling or licensing a crate to a customer: the customer sees exactly the crates and version ranges you granted, nothing else in the namespace.