Trust
Official resources
Where opsinjs actually lives. If you found it somewhere else, it is not ours.
Nothing has been published to npm, so every package is fake.
There is no @opsinjs package on npm and no CLI of ours. If you find a package by this name today, whoever published it is not us. Do not install it, and please report it. The components that do exist are installed as source from the registry URL below and from no other origin. Every one of them is shipped and carries no version number, and shipped means only that the source installs: nothing here has been released. Every component has been audited against WCAG 2.2 AA by its own authors, in a static source pass and a rendered pass, and the findings were fixed. That is an author-run audit, not an independent review, and none of it has had a clinical review, so nothing here is for a production health surface until a clinician signs it. This paragraph will change the day something is, and the release will be announced in the changelog with a version and a date.
Canonical locations
- Documentation
https://opsinjs.pensievelabs.orgThe only site this documentation is published from. Mirrors are not endorsed; a mirror that is not obviously a mirror is a supply-chain problem.
- Repository
https://github.com/prashantonomy/opsinjsSource, issues and the public decision record. Everything on this site is generated from this repository.
- npm scope
@opsinjsReserved for the published packages. Nothing is published under it yet.
- Registry
https://opsinjs.pensievelabs.org/r/registry.jsonThe shadcn-specification registry the CLI and the MCP server read. Component source will be served from this origin and no other.
- Agent index
https://opsinjs.pensievelabs.org/llms.txtThe curated machine-readable index. Assistants that read this get the real status of every component.
Why a page like this exists at all
opsinjs is distributed the shadcn way: you run a command, and source code is written into your repository. That is a genuinely good distribution model, because you own what you install, you can read it, and you can change it without fighting a package boundary. It also moves a trust decision to a place developers are not used to making one.
When you run npx shadcn add against a registry URL, the server on the other end decides what source lands in your project. Nobody reviews that. There is no lockfile hash and no npm audit. The URL is the trust boundary, which is why the canonical one is published here, on the site, at a stable path, rather than only in a README that gets copied and edited.
The health context sharpens this. Code that renders somebody’s blood pressure and decides what colour to make it is a bad place for an unreviewed third-party edit. That is not because it is likely, but because the failure is quiet and the consequence is somebody misreading their own result.
How to check what you have
Check the registry URL before you run the command. It should be exactly https://opsinjs.pensievelabs.org/r/registry.json. A different host, an extra subdomain, a shortened link or an http:// scheme are all reasons to stop.
Check your own commit history. Nothing in an emitted file names where it came from, so run the install in its own commit naming the item and the date. That commit is what lets a file in your repository be traced back to a release rather than to “sometime last year”.
Check the licence. The code is MIT and the guidance prose is CC BY 4.0. A copy that claims different terms is not this project, least of all one that claims the prose is unrestricted.
Report anything that looks wrong. Impersonation of a health-adjacent project is worth reporting even when it looks harmless, because the audience for the impersonation is people building software that shows patients their own data. How to report a security issue.
What opsinjs is not
It is not affiliated with, endorsed by or derived from any national health service, clinical body or regulator. Where this documentation cites the NHS service manual, WCAG or a published study, it cites it: the text here is original, and the reference is a link rather than a copy.
It is not a medical device, and it does not confer any regulatory status on software built with it. Safety, scope and limitations states the boundary precisely, and regulatory context explains what the consuming product still owes its regulator.