jfrog-package-curation

JFrog Package Curation

Prerequisites

• Read ../jfrog/SKILL.md for JFrog Platform concepts, domain model, CLI setup, and API patterns.
• OneModel shapes drift by server version. Before inventing GraphQL fields or where filters, read ../jfrog/references/onemodel-graphql.md (schema fetch workflow) and ../jfrog/references/onemodel-query-examples.md (Public packages, Stored packages). Regenerate or verify queries against GET "$JFROG_URL/onemodel/api/v1/supergraph/schema" when examples fail validation.

Which path do I need?

• Package hasn't been checked or downloaded yet (is it safe / allowed / curated? download it) → go to Check & download below.
• A package operation already failed — ETARGET (npm), "no matching distribution" (pip), NU1102 (NuGet), a version missing/stripped from the registry, 403 / "blocked by curation policy", or an approved waiver not taking effect → go to Troubleshoot a failure below.

---

Troubleshoot a failure

Requires the JFrog MCP curation tools (jfs_curation_*); no jf CLI equivalent is used in this path. See the skill's compatibility note.

Root-causing a curation-attributable failure (ETARGET, 403, a version missing from the index, a waiver not taking effect) is a multi-step investigation — preflight checks, the two-gate model, symptom classification, then a full RCA procedure. It doesn't belong inline here since a plain download never touches it. Open references/rca-procedure.md and follow it from the top — one file, covering preflight, the #1 RULE, the two-gate model, symptom classification (Step 0), and the RCA itself (Steps 1–4, worked examples, gotchas).

---

Check & download

Workflow overview

flowchart TD
    A[User requests package check / download] --> B{Package in Public Catalog?}
    B -->|Yes| C[Get latest version from Catalog]
    B -->|No| D{Package in JFrog Platform Stored Packages?}
    D -->|Yes| E[Get latest version from Stored Packages]
    D -->|No| F[Package not found — stop]
    C --> G{Latest version in JFrog Platform?}
    E --> G
    G -->|Yes| H[Safe — download from JFrog Platform]
    G -->|No| I{Curation entitled?}
    I -->|Yes| J[Check curation policy via API]
    I -->|No| K[Download via remote repo]
    J -->|200 Allowed| K
    J -->|403 Blocked| M[Report curation blocked — see Troubleshoot a failure]