The package manager

venutian install, uninstall, list, lock and verify all run as plain Venutian, the same way venutian run runs any other .ven file. Nothing about how a package gets installed lives in the native binary.

venutian.json is the manifest you write: a name, a version and a dependencies map, one entry per package, each naming its kind and where to find it.

{
  "name": "utils_lib",
  "version": "1.0.0",
  "dependencies": {
    "core_lib": {
      "kind": "path",
      "location": "../core_lib"
    }
  }
}

venutian.lock.json is the file venutian lock writes, one entry per installed package, each carrying the content hash of the directory venutian install actually put on disk.

{
  "core_lib": {
    "content_hash": "5f2b1c9a0e7d4f6b8a3c1d9e0f2b7a4c6d8e1f3a5b7c9d0e2f4a6b8c0d2e4f6a"
  }
}

The manifest says what you asked for. The lockfile says what you actually got, byte for byte.

venutian install ../my-lib or venutian install my-lib.tar.gz copies that directory or unpacks that archive into venutian_packages/<name>/, a conventional local directory your own code reaches through Venutian's existing relative path use:

use "venutian_packages/my-lib/whatever.ven"

There is no package name resolution at the language level. use stays whole file and relative path, so the package manager's job is exactly this: take a package from a local directory or a local archive and put it where a plain relative use already knows how to find it.

Installing one package installs its dependencies too. The resolver walks a package's own venutian.json, installs each dependency, then recurses into that dependency's own manifest, resolving relative paths against the dependency's original source location so a nested ../sibling-lib still finds the right directory once everything is copied into venutian_packages/. A package already resolved is skipped; a package still being resolved when its own name comes up again is a real cycle, and the resolver raises rather than looping forever:

circular dependency detected at 'name'

Every installed package's whole directory is hashed once: every file found under it, each combined as its path and its own SHA-256, concatenated together and hashed again as a whole. Two installs of a byte for byte identical package always produce the same hash; any changed, added, removed or renamed file changes it. venutian lock records that hash for what is installed right now; venutian verify recomputes it and compares, catching a missing package directory or a mismatched hash before it becomes a build that only works on one machine.

Publishing copies a source directory into a registry directory under a name and version, so another project can fetch it back out, content hash and all.

venutian publish <source-dir> <name> <version> [--sign <key>]
venutian fetch <name>

Marketplace publishing sends the same package to the network registry that also powers the packages page and the release notifier below.