W Wax

Package safety

Wax verifies downloaded packages before installing them and keeps project files consistent when commands fail.

Verify every download

wax.lock binds the manifest text to one registry and one version per package. It records dependency aliases, archive locations, and a SHA 512 integrity value for each archive. Installation verifies downloaded and cached archives before use.

An archive's name, version, dependencies, and download metadata must agree with each other and the lockfile. Every package contains at least one regular Wax file under Src/; it may also include debugger sources under Queries/, manifest and license material, and their source directories.

Path traversal, absolute paths, links, devices, duplicate or unknown entries, names that are not portable, case collisions, and content beyond package limits are rejected before files reach Packages/.

Keep project files together

Commands that inspect or change a project take the same exclusive project lock. A transaction journal and staged package directory keep wax.json, wax.lock, and Packages/ in sync. A failed dependency operation restores the previous files. After an interruption, the next command that changes dependencies tries to finish the recovery first.

The process lock lives in the Wax user data directory, not inside the project. That lets list, outdated, and doctor inspect project trees without changing them while still refusing to read the project while another process replaces its packages.

Registry connections

Registries other than local development servers require HTTPS. The standalone client includes its TLS implementation and a pinned public CA bundle, so installing packages does not depend on Node.js or a system package manager. WAX_PACKAGE_CA_BUNDLE adds a private trust root; certificate verification cannot be disabled.

A registry introduced only by a lockfile never receives credentials. Locked archive URLs must share the registry origin.

Credentials

GitHub establishes account identity, but Wax stores only session credentials issued by Wax and publish credentials in the platform credential store. Publishing uses a separate revocable credential. Logout revokes remote credentials before removing the local copy.

Do not print credentials, pass them as arguments, commit credential directories, or place tokens in wax.json or wax.lock.

Repeat a build

  1. Commit the exact wax.json and generated wax.lock.
  2. Restore with wax install, not update.
  3. Preserve or populate the package cache for offline builds.
  4. Run wax install --offline to prove the locked inputs are sufficient.
  5. Review and commit lockfile changes when dependencies are updated.

Package archives produced by pack are deterministic for the same accepted files and manifest.