Tooling

Package Registry

The package manager reads like the rest of Zornux: install a dependency by name, publish your own, search for others — over local folders or remote registries, through one provider seam so no hosting provider is ever baked in.

Configuring a registry

A registry is a name and a location — a folder or an https:// URL. The built-in default is zornux; declare your own in zornux.project, or override the default with the ZORNUX_REGISTRY environment variable.

text

# zornux.project
name = my-app
version = 0.1.0
source = src/

registry acme = https://packages.acme.test
default-registry = acme

text

zornux registry list                 # show registries (the default is marked)
zornux registry add acme https://packages.acme.test
zornux registry remove acme

Installing & restoring

zornux add takes a name as well as a path:

text

zornux add MathTools            # highest version from the default registry
zornux add MathTools@1.2.0      # a specific version
zornux add ../math-tools        # still works: a local folder
zornux restore                  # fetch every missing dependency

Verified before it touches disk

Every download's SHA-256 must match the checksum the registry's index advertises before the archive is unpacked — a corrupt or tampered package never reaches your cache. And only add and restore reach out: zornux run and build never hit the network.

Discovering packages

text

zornux search math       # find packages by name across the registries
zornux info MathTools    # a package's versions, grouped by registry

Mirrors & scoping

Configure several registries and resolution tries them in order — the default first — stopping at the first that offers a satisfying version. A private registry is consulted before the public one, and a registry being down just falls through to the next. A single dependency can be pinned with a from clause:

text

dependency InternalTools = ^2.0.0 from acme

zornux add InternalTools --registry acme records that scope for you.

Publishing & authentication

text

zornux login acme --token <token>    # store a token (or set ZORNUX_REGISTRY_TOKEN)
zornux publish --registry acme       # pack and upload the current project
zornux publish --local ./registry    # or publish to a folder

Tokens are secrets

A token lives in a user credentials file and is never echoed — login confirms without printing it, the same discipline as configuration secrets. Publishing without a token fails fast (ZX3405); a rejected token (ZX3406) or an already-published version (ZX3407, versions are immutable) each report a clear diagnostic.

The registry contract

The remote provider speaks a small, hosting-agnostic REST/JSON contract, so a registry can be a Cloudflare Worker, a static file host, or an enterprise server:

Request	Response
`GET {base}/packages/{name}`	index JSON: versions + checksums
`GET {base}/packages/{name}/{version}.zxpkg`	the package archive
`GET {base}/search?q={query}`	search results
`PUT {base}/packages/{name}/{version}`	publish (bearer token)

Diagnostics

ZX3400 unknown registry, ZX3402 unreachable, ZX3403 no such package, ZX3404 integrity failure, ZX3405/3406 auth, ZX3407 publish rejected — all ZX3400–ZX3499, each written for a human.

Built on the module system.