x07-package

This skill documents the single canonical workflow for dependency management in X07 using the built-in package manager (

x07 pkg ...

When to use

Use this skill when:

adding/updating dependencies,
generating/verifying lockfiles,
publishing a package to an index/registry.

Canonical commands

Create a publishable package repo (for
```
x07 pkg publish
```
):
- ```
x07 init --package
```
Add a dependency entry to
```
x07.json
```
and sync the lockfile:
- ```
x07 pkg add <name>@<version> --sync
```
Generate or update a project lockfile:
- ```
x07 pkg lock --project x07.json
```
Non-mutating whole-project validation (no emit):
- ```
x07 check --project x07.json
```
Reverse-lookup which package provides a module:
- ```
x07 pkg provides <module-id>
```

List available versions of a package:

```
x07 pkg versions <name>
```
```
x07 pkg versions <name> --refresh
```

Verify a lockfile is up to date (CI mode):
- ```
x07 pkg lock --project x07.json --check
```
- If you intentionally accept risk in CI: add
```
--allow-yanked
```
  and/or
```
--allow-advisories
```

Pack a package directory deterministically:

x07 pkg pack --package <dir> --out <out.x07pkg>

Interactive:
```
x07 pkg login --index <url>
```

Non-interactive:

printf '%s' "$X07_TOKEN" | x07 pkg login --index <url> --token-stdin

Publish:

x07 pkg publish --package <dir> --index <url>

Notes

Official registry index URL:
```
sparse+https://registry.x07.io/index/
```
Publishing to the official registry requires non-empty
```
description
```
and
```
docs
```
in
```
x07-package.json
```
.
The lockfile path is controlled by
```
x07.json
```
(
```
lockfile
```
) and defaults to
```
x07.lock.json
```
.
When fetching is required,
```
x07 pkg lock
```
defaults to the official registry index; override with
```
--index <url>
```
.
Sparse index reads (including
```
x07 pkg versions
```
) may be cached; use
```
--refresh
```
after publishing to force a cache-busting fetch (HTTP/HTTPS indexes only).
Canonical project manifests use
```
x07.project@0.3.0
```
.
```
x07.project@0.2.0
```
is accepted for legacy manifests, but
```
project.patch
```
requires
```
@0.3.0
```
.
In
```
--check
```
mode, when the index can be consulted, lock validation also fails on yanked dependencies and active advisories unless explicitly allowed.
Use
```
project.patch
```
in
```
x07.json
```
to override transitive dependency versions (for example, moving off yanked/advised versions).
Patch paths under
```
.x07/deps/...
```
are treated as vendored deps (fetchable) during
```
x07 pkg lock
```
hydration; patch paths elsewhere are local-only and must exist on disk.
Official packages may declare required helper packages via
```
meta.requires_packages
```
. When present,
```
x07 pkg lock
```
may add and fetch these transitive deps (and update
```
x07.json
```
).
If dependencies are already present on disk,
```
x07 pkg lock
```
can run without
```
--index
```
using
```
--offline
```
.

x07-package

NPX Install

Tags

SKILL.md Content

x07-package

When to use

Canonical commands

Notes