chore: rename hivemind→devsper across entire registry repo

- Go module: github.com/rithul/hivemind/registry/api → github.com/devsper-com/registry/api
- All Go imports, config defaults, test assertions updated
- SQL schema/queries: requires_hivemind → requires_devsper
- Web frontend: package name, titles, branding, auth, types
- Deploy: Caddyfile, docker-compose, scripts → devsper domains/paths
- CI: deploy.yml and infra.yml paths fixed for standalone repo structure
- Terraform: all resource names, defaults, tags, state backend
- Docs: README, DEPLOY, SECURITY, RUNBOOK, oauth-setup
- Email templates: Devsper Registry branding, devsper.com domains
- ECR images: devsper-registry-api, devsper-registry-web
- IAM role: devsper-deploy
- S3 buckets: devsper-registry-packages, devsper-registry-dev
- Remove stale build artifacts (api/bin/registry, api/registry, tsconfig.node.tsbuildinfo)

Author: rithulkamesh

.env.example

@@ -2,7 +2,7 @@
 # Usage: cd registry && just dev  (loads .env via dotenv-load)
 
 # Required
-DATABASE_URL=postgresql://registry:registry@localhost:5432/hivemind_registry?sslmode=disable
+DATABASE_URL=postgresql://registry:registry@localhost:5432/devsper_registry?sslmode=disable
 JWKS_URL=http://localhost:3000/auth/.well-known/jwks.json
 INTERNAL_SECRET=dev-internal-secret
 # Better Auth signing/CSRF (optional in dev; set in prod)

.env.prod.example

@@ -4,12 +4,12 @@
 POSTGRES_USER=registry
 # Generate a strong password: openssl rand -base64 32
 POSTGRES_PASSWORD=your-secure-password
-POSTGRES_DB=hivemind_registry
+POSTGRES_DB=devsper_registry
 
 JWT_SECRET=your-jwt-secret-min-32-bytes-base64-or-hex
 
 # Better Auth JWKS URL for JWT verification (required if using Better Auth instead of legacy JWT)
-JWKS_URL=https://auth.hivemind.rithul.dev/auth/.well-known/jwks.json
+JWKS_URL=https://auth.docs.devsper.com/auth/.well-known/jwks.json
 # Internal secret for auth service <-> API calls (must be >= 32 chars in production)
 # Generate with: openssl rand -base64 48
 INTERNAL_SECRET=
@@ -22,11 +22,11 @@ S3_BUCKET=
 S3_REGION=us-east-1
 SES_REGION=
 SES_FROM_ADDRESS=
-BASE_URL=https://registry.hivemind.rithul.dev
+BASE_URL=https://registry.devsper.com
 
 # Frontend build-time (used when building web image)
-VITE_API_BASE_URL=https://registry.hivemind.rithul.dev
-VITE_REGISTRY_URL=https://registry.hivemind.rithul.dev/simple/
+VITE_API_BASE_URL=https://registry.devsper.com
+VITE_REGISTRY_URL=https://registry.devsper.com/simple/
 
 RATE_LIMIT_RPS=10
 MAX_UPLOAD_SIZE_MB=100

.github/workflows/deploy.yml

@@ -1,8 +1,7 @@
 # Registry Deploy: test both components, build arm64 images, push to ECR, deploy stack.
-# Replaces per-component workflows (registry-api.yml, registry-web.yml).
 #
 # Triggers:
-#   - Push to main touching registry/** or this workflow
+#   - Push to main touching api/** or web/** or this workflow
 #   - Manual dispatch with optional force deploy (skip tests)
 
 name: Registry Deploy
@@ -11,8 +10,9 @@ on:
   push:
     branches: [main]
     paths:
-      - "registry/**"
-      - ".github/workflows/registry-deploy.yml"
+      - "api/**"
+      - "web/**"
+      - ".github/workflows/deploy.yml"
   workflow_dispatch:
     inputs:
       force:
@@ -46,15 +46,15 @@ jobs:
         with:
           go-version: "1.24"
           cache: true
-          cache-dependency-path: registry/api/go.sum
+          cache-dependency-path: api/go.sum
       - name: Run Go tests
         run: go test ./... -race -coverprofile=coverage.out
-        working-directory: registry/api
+        working-directory: api
         env:
           DATABASE_URL: postgres://test:test@localhost:5432/test?sslmode=disable
       - name: Run go vet
         run: go vet ./...
-        working-directory: registry/api
+        working-directory: api
 
   test-web:
     if: ${{ !inputs.force }}
@@ -66,10 +66,10 @@ jobs:
           bun-version: latest
       - name: Install dependencies
         run: bun install --frozen-lockfile
-        working-directory: registry/web
+        working-directory: web
       - name: Typecheck
         run: bun run tsc -b
-        working-directory: registry/web
+        working-directory: web
 
   # ── Build & Push ───────────────────────────────────────────────────────
 
@@ -91,7 +91,7 @@ jobs:
 
       - uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/hivemind-registry-deploy
+          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/devsper-deploy
           aws-region: us-east-1
 
       - uses: aws-actions/amazon-ecr-login@v2
@@ -102,24 +102,24 @@ jobs:
       - name: Build and push API image
         uses: docker/build-push-action@v6
         with:
-          context: registry/api
+          context: api
           platforms: linux/arm64
           push: true
           tags: |
-            ${{ steps.ecr-login.outputs.registry }}/hivemind-registry-api:latest
-            ${{ steps.ecr-login.outputs.registry }}/hivemind-registry-api:${{ github.sha }}
+            ${{ steps.ecr-login.outputs.registry }}/devsper-registry-api:latest
+            ${{ steps.ecr-login.outputs.registry }}/devsper-registry-api:${{ github.sha }}
           cache-from: type=gha,scope=registry-api
           cache-to: type=gha,mode=max,scope=registry-api
 
       - name: Build and push Web image
         uses: docker/build-push-action@v6
         with:
-          context: registry/web
+          context: web
           platforms: linux/arm64
           push: true
           tags: |
-            ${{ steps.ecr-login.outputs.registry }}/hivemind-registry-web:latest
-            ${{ steps.ecr-login.outputs.registry }}/hivemind-registry-web:${{ github.sha }}
+            ${{ steps.ecr-login.outputs.registry }}/devsper-registry-web:latest
+            ${{ steps.ecr-login.outputs.registry }}/devsper-registry-web:${{ github.sha }}
           cache-from: type=gha,scope=registry-web
           cache-to: type=gha,mode=max,scope=registry-web
 
@@ -139,7 +139,7 @@ jobs:
     steps:
       - uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/hivemind-registry-deploy
+          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/devsper-deploy
           aws-region: us-east-1
 
       - name: Deploy via EC2 Instance Connect
@@ -155,7 +155,7 @@ jobs:
           ssh -i /tmp/deploy_key -o StrictHostKeyChecking=no ubuntu@"$EC2_HOST" \
             "set -euo pipefail && \
              aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin $ECR_REGISTRY && \
-             cd /opt/hivemind-registry && \
+             cd /opt/devsper-registry && \
              docker compose -f docker-compose.prod.yml --env-file .env.prod pull api web && \
              docker compose -f docker-compose.prod.yml --env-file .env.prod up -d --no-deps web && \
              sleep 3 && \
@@ -170,19 +170,19 @@ jobs:
           sleep 8
 
           # Check API health
-          curl -sf --retry 3 --retry-delay 5 "https://registry.hivemind.rithul.dev/health" || \
+          curl -sf --retry 3 --retry-delay 5 "https://registry.devsper.com/health" || \
             { echo "FAIL: /health"; exit 1; }
 
           # Check JWKS endpoint
-          curl -sf --retry 3 --retry-delay 5 "https://registry.hivemind.rithul.dev/auth/jwks" || \
+          curl -sf --retry 3 --retry-delay 5 "https://registry.devsper.com/auth/jwks" || \
             { echo "FAIL: /auth/jwks"; exit 1; }
 
           # Check web frontend
-          curl -sf --retry 3 --retry-delay 5 "https://registry.hivemind.rithul.dev/" || \
+          curl -sf --retry 3 --retry-delay 5 "https://registry.devsper.com/" || \
             { echo "FAIL: / (web)"; exit 1; }
 
           # Check packages API
-          curl -sf --retry 3 --retry-delay 5 "https://registry.hivemind.rithul.dev/api/v1/packages" || \
+          curl -sf --retry 3 --retry-delay 5 "https://registry.devsper.com/api/v1/packages" || \
             { echo "FAIL: /api/v1/packages"; exit 1; }
 
           echo "All smoke tests passed"

.github/workflows/infra.yml

@@ -1,17 +1,17 @@
 # Infrastructure: Terraform plan on PR (with comment), apply on push to main.
-# Path filter: registry/infra. Manual run: workflow_dispatch.
+# Path filter: infra/**. Manual run: workflow_dispatch.
 
 name: Infrastructure
 
 on:
   push:
     branches: [main]
     paths:
-      - "registry/infra/**"
+      - "infra/**"
   pull_request:
     branches: [main]
     paths:
-      - "registry/infra/**"
+      - "infra/**"
   workflow_dispatch:
 
 jobs:
@@ -25,15 +25,15 @@ jobs:
       - uses: actions/checkout@v4
       - uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/hivemind-registry-deploy
+          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/devsper-deploy
           aws-region: us-east-1
       - uses: hashicorp/setup-terraform@v3
-      - run: cd registry/infra && terraform init
-      - run: cd registry/infra && terraform validate
-      - run: cd registry/infra && terraform plan -no-color -out=tfplan
+      - run: cd infra && terraform init
+      - run: cd infra && terraform validate
+      - run: cd infra && terraform plan -no-color -out=tfplan
       - id: plan_show
         run: |
-          cd registry/infra && terraform show -no-color tfplan > plan.txt
+          cd infra && terraform show -no-color tfplan > plan.txt
           echo "plan<<PLANEOF" >> $GITHUB_OUTPUT
           cat plan.txt >> $GITHUB_OUTPUT
           echo "PLANEOF" >> $GITHUB_OUTPUT
@@ -69,8 +69,8 @@ jobs:
       - uses: actions/checkout@v4
       - uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/hivemind-registry-deploy
+          role-to-assume: arn:aws:iam::${{ vars.AWS_ACCOUNT_ID }}:role/devsper-deploy
           aws-region: us-east-1
       - uses: hashicorp/setup-terraform@v3
-      - run: cd registry/infra && terraform init
-      - run: cd registry/infra && terraform apply -auto-approve
+      - run: cd infra && terraform init
+      - run: cd infra && terraform apply -auto-approve

DEPLOY.md

@@ -2,10 +2,10 @@
 
 ## Architecture
 
-The hivemind project deploys two services to a single EC2 instance:
+The devsper project deploys two services to a single EC2 instance:
 
-- **Registry** (`registry.hivemind.rithul.dev`) — Go API + Node.js web app + Postgres, running via Docker Compose behind Caddy
-- **Docs** (`hivemind.rithul.dev`) — Static Docusaurus site served by the same Caddy instance
+- **Registry** (`registry.devsper.com`) — Go API + Node.js web app + Postgres, running via Docker Compose behind Caddy
+- **Docs** (`docs.devsper.com`) — Static Docusaurus site served by the same Caddy instance
 
 ## CI/CD Workflows
 
@@ -26,7 +26,7 @@ Manual dispatch supports a `force` boolean to skip tests.
 
 Triggers on push to `main` touching `website/**`, or manual dispatch.
 
-Single job: build Docusaurus, rsync `website/build/` to EC2 `/opt/hivemind-docs/`, verify with curl.
+Single job: build Docusaurus, rsync `website/build/` to EC2 `/opt/devsper-docs/`, verify with curl.
 
 ### `docs.yml` — Docs Versioning
 
@@ -46,13 +46,13 @@ Triggers on release published. Creates a versioned docs snapshot via `docusaurus
 
 All workflows authenticate to AWS via OIDC federation — no static AWS keys are stored in GitHub.
 
-- **Role**: `arn:aws:iam::<account-id>:role/hivemind-registry-deploy`
+- **Role**: `arn:aws:iam::<account-id>:role/devsper-deploy`
 - **Trust policy**: Allows `sts:AssumeRoleWithWebIdentity` from the GitHub OIDC provider for this repository
 - **Permissions**: ECR push/pull, EC2 Instance Connect `SendSSHPublicKey`, S3 (for package storage)
 
 ### Environment Secrets (on EC2)
 
-The file `/opt/hivemind-registry/.env.prod` contains production secrets:
+The file `/opt/devsper-registry/.env.prod` contains production secrets:
 
 ```
 ECR_REGISTRY=<account-id>.dkr.ecr.us-east-1.amazonaws.com
@@ -61,7 +61,7 @@ POSTGRES_PASSWORD=<password>
 POSTGRES_DB=registry
 JWT_SECRET=<secret>
 INTERNAL_SECRET=<secret>
-BASE_URL=https://registry.hivemind.rithul.dev
+BASE_URL=https://registry.devsper.com
 AWS_REGION=us-east-1
 BUCKET_NAME=<s3-bucket>
 GITHUB_CLIENT_ID=<id>
@@ -82,9 +82,9 @@ GOOGLE_CLIENT_SECRET=<secret>
 ### Registry Setup
 
 ```bash
-sudo mkdir -p /opt/hivemind-registry
-sudo chown ubuntu:ubuntu /opt/hivemind-registry
-cd /opt/hivemind-registry
+sudo mkdir -p /opt/devsper-registry
+sudo chown ubuntu:ubuntu /opt/devsper-registry
+cd /opt/devsper-registry
 
 # Copy docker-compose.prod.yml and Caddyfile from the repo
 # Create .env.prod with all required secrets (see above)
@@ -96,23 +96,23 @@ docker compose -f docker-compose.prod.yml --env-file .env.prod up -d
 ### Docs Setup
 
 ```bash
-sudo mkdir -p /opt/hivemind-docs
-sudo chown ubuntu:ubuntu /opt/hivemind-docs
+sudo mkdir -p /opt/devsper-docs
+sudo chown ubuntu:ubuntu /opt/devsper-docs
 ```
 
-The docs-deploy workflow will rsync the built Docusaurus site to `/opt/hivemind-docs/`. Caddy serves it via the `hivemind.rithul.dev` server block in the Caddyfile.
+The docs-deploy workflow will rsync the built Docusaurus site to `/opt/devsper-docs/`. Caddy serves it via the `docs.devsper.com` server block in the Caddyfile.
 
 ### Caddyfile
 
-The Caddyfile at `/opt/hivemind-registry/Caddyfile` serves both domains:
+The Caddyfile at `/opt/devsper-registry/Caddyfile` serves both domains:
 
-- `registry.hivemind.rithul.dev` → reverse proxy to API (`:8080`) and Web (`:3000`)
-- `hivemind.rithul.dev` → static files from `/srv/docs` (host bind-mount from `/opt/hivemind-docs`)
+- `registry.devsper.com` → reverse proxy to API (`:8080`) and Web (`:3000`)
+- `docs.devsper.com` → static files from `/srv/docs` (host bind-mount from `/opt/devsper-docs`)
 
 After updating the Caddyfile, reload Caddy:
 
 ```bash
-cd /opt/hivemind-registry
+cd /opt/devsper-registry
 docker compose -f docker-compose.prod.yml --env-file .env.prod exec caddy caddy reload --config /etc/caddy/Caddyfile
 ```
 
@@ -121,7 +121,7 @@ docker compose -f docker-compose.prod.yml --env-file .env.prod exec caddy caddy
 Migrations are embedded in the API binary and run automatically on startup. If you need to run them manually:
 
 ```bash
-cd /opt/hivemind-registry
+cd /opt/devsper-registry
 docker compose -f docker-compose.prod.yml --env-file .env.prod exec api /registry migrate
 ```
 
@@ -134,7 +134,7 @@ Trigger via GitHub Actions → "Registry Deploy" → Run workflow (optionally ch
 Or SSH to EC2 and pull/restart manually:
 
 ```bash
-cd /opt/hivemind-registry
+cd /opt/devsper-registry
 aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin <ecr-registry>
 docker compose -f docker-compose.prod.yml --env-file .env.prod pull api web
 docker compose -f docker-compose.prod.yml --env-file .env.prod up -d --no-deps web
@@ -150,5 +150,5 @@ Or build locally and rsync:
 
 ```bash
 cd website && npm ci && npm run build
-rsync -azP --delete website/build/ ubuntu@<ec2-host>:/opt/hivemind-docs/
+rsync -azP --delete website/build/ ubuntu@<ec2-host>:/opt/devsper-docs/
 ```

README.docker.md

@@ -18,7 +18,7 @@ cd registry
 docker compose -f docker-compose.dev.yml up --build
 ```
 
-- **Postgres**: localhost:5432 (user `registry`, password `registry`, db `hivemind_registry`)
+- **Postgres**: localhost:5432 (user `registry`, password `registry`, db `devsper_registry`)
 - **API**: http://localhost:8080 (Go app with Air hot reload)
 - **Web**: http://localhost:3000 (Vite dev server; serves `/auth` in-process, proxies `/api` and `/simple` to API)
 
@@ -50,25 +50,25 @@ If you see **CONNRESET** in the browser or terminal, the API may have restarted
 
    - Configure the index in `pyproject.toml`:
      ```toml
-     [tool.hivemind]
+     [tool.devsper]
      index-url = "http://localhost:3000/simple/"
      ```
    - Upload via the registry UI (package page → upload), or use the API with auth (e.g. `POST /api/v1/packages/{name}/upload` with Bearer token or API key).
 
 Trust/certificate warnings for `http://` are expected for local dev; use HTTPS in production.
 
-### Test plugin (hivemind-plugin-demo)
+### Test plugin (devsper-plugin-demo)
 
 A minimal plugin lives in `registry/test-plugin/`. To build and optionally seed the registry:
 
 1. **Build the wheel**: From repo root, `just test-plugin-build` (or `cd registry/test-plugin && pip install build && python -m build`).
-2. **Create the package and upload**: Use the web UI (register, create package `hivemind-plugin-demo`, upload the wheel from `registry/test-plugin/dist/`), or run the seed script when the API has storage (S3) configured:
+2. **Create the package and upload**: Use the web UI (register, create package `devsper-plugin-demo`, upload the wheel from `registry/test-plugin/dist/`), or run the seed script when the API has storage (S3) configured:
    ```bash
    ./registry/scripts/seed-dev.sh
    # Or with custom wheel: ./registry/scripts/seed-dev.sh /path/to/wheel.whl
    ```
    Set `REGISTRY_EMAIL`, `REGISTRY_PASSWORD` if needed; default is `seed@localhost` / `seedpass123`.
-3. **Install from the registry**: `pip install --index-url http://localhost:3000/simple/ hivemind-plugin-demo` (or `just test-plugin-install` from repo root).
+3. **Install from the registry**: `pip install --index-url http://localhost:3000/simple/ devsper-plugin-demo` (or `just test-plugin-install` from repo root).
 
 Without S3 configured, the API will not accept uploads (upload and file download return 503). For local dev with uploads, use AWS credentials and set `S3_BUCKET`, or use a local S3-compatible store (e.g. LocalStack).