Skip to content

WEBFORGE_PACKAGES.md

Latest commit

 

History

History
92 lines (66 loc) · 2.44 KB

WEBFORGE_PACKAGES.md

File metadata and controls

92 lines (66 loc) · 2.44 KB
Raw

TechScript WebForge: Package Management & Ecosystem

Manifests, Deterministic Lockfiles, and Safe Dependency Resolution

1. Overview

TechScript features a secure, integrated package manager designed to provide the convenience of modern package tooling without the security pitfalls of unvetted arbitrary lifecycle execution scripts.

2. Manifest File (techscript.toml)

The authoritative project manifest is techscript.toml located at your project root:

[package]
name = "my-site"
version = "1.0.0"
authors = ["Developer <dev@example.com>"]
edition = "2024"
license = "MIT"
description = "My full-stack WebForge website"

[dependencies]
http_client = "1.2.0"
analytics = "0.5.1"

[dev-dependencies]
test_utils = "1.0.0"

Backward Compatibility

If an existing project uses tech.toml, the toolchain automatically discovers and parses it without requiring immediate migration. When saving new packages, techscript.toml is written by default.

3. Deterministic Lockfile (techscript.lock)

When dependencies are installed or updated, WebForge produces or refreshes techscript.lock:

# This file is automatically generated by TechScript.
# It is recommended to commit this file to version control.

[[package]]
name = "http_client"
version = "1.2.0"
checksum = "sha256:7f83b1657ff1fc53b92dc18148a1d65dfc2d4b1fa3d677284addd200126d9069"

[[package]]
name = "analytics"
version = "0.5.1"
checksum = "sha256:b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9"

The lockfile pins exact package versions and cryptographic SHA-256 checksums to ensure reproducible builds across team members, staging environments, and CI/CD pipelines.

4. Package Operations

Adding a Dependency

techscript add analytics
# or:
techscript install analytics

Removing a Dependency

techscript remove analytics
# or:
techscript uninstall analytics

Listing Installed Packages

techscript list

Searching the Catalog

techscript search math

5. Security & Isolation

  • No Arbitrary Pre/Post Install Scripts: Unlike traditional package managers that execute arbitrary host shell commands during installation, TechScript packages are declarative data and AST-level modules.
  • Sandboxed Capability Enforcement: Imported packages cannot access the file system, network, or environment unless explicitly permitted by the project manifest's capabilities whitelist.