x07-package

This skill documents the single canonical workflow for dependency management in X07 using the built-in package manager (x07 pkg ... ).

When to use

Use this skill when:

• adding/updating dependencies,

• generating/verifying lockfiles,

• publishing a package to an index/registry.

Canonical commands

Create a publishable package repo (for x07 pkg publish ):

• x07 init --package

Add a dependency entry to x07.json and sync the lockfile:

• x07 pkg add <name>@<version> --sync

Generate or update a project lockfile:

• x07 pkg lock --project x07.json

Non-mutating whole-project validation (no emit):

• x07 check --project x07.json

Reverse-lookup which package provides a module:

• x07 pkg provides <module-id>

List available versions of a package:

• x07 pkg versions <name>

• x07 pkg versions <name> --refresh

Verify a lockfile is up to date (CI mode):

• x07 pkg lock --project x07.json --check

• If you intentionally accept risk in CI: add --allow-yanked and/or --allow-advisories

Pack a package directory deterministically:

• x07 pkg pack --package <dir> --out <out.x07pkg>

Login (store credentials for an index):

• Interactive: x07 pkg login --index <url>

• Non-interactive: printf '%s' "$X07_TOKEN" | x07 pkg login --index <url> --token-stdin

Publish:

• x07 pkg publish --package <dir> --index <url>

Notes

• Official registry index URL: sparse+https://registry.x07.io/index/

• Publishing to the official registry requires non-empty description and docs in x07-package.json .

• The lockfile path is controlled by x07.json (lockfile ) and defaults to x07.lock.json .

• When fetching is required, x07 pkg lock defaults to the official registry index; override with --index <url> .

• Sparse index reads (including x07 pkg versions ) may be cached; use --refresh after publishing to force a cache-busting fetch (HTTP/HTTPS indexes only).

• Canonical project manifests use x07.project@0.3.0 . x07.project@0.2.0 is accepted for legacy manifests, but project.patch requires @0.3.0 .

• In --check mode, when the index can be consulted, lock validation also fails on yanked dependencies and active advisories unless explicitly allowed.

• Use project.patch in x07.json to override transitive dependency versions (for example, moving off yanked/advised versions).

• Patch paths under .x07/deps/... are treated as vendored deps (fetchable) during x07 pkg lock hydration; patch paths elsewhere are local-only and must exist on disk.

• Official packages may declare required helper packages via meta.requires_packages . When present, x07 pkg lock may add and fetch these transitive deps (and update x07.json ).

• If dependencies are already present on disk, x07 pkg lock can run without --index using --offline .

See also: https://x07lang.org/docs/packages/publishing-by-example/