Packages

The index

The index fb reads to learn each package's versions, and the archives it downloads.

fb learns what versions a package has from the registry’s index: one small file a package, at https://index.futureblitz.dev/<name>, which the edge caches. A build downloads only the index files and archives it needs, and fb keeps them in its cache, so it reads an index file again only when it changed.

A package’s index file

Each line is one version, as JSON, in the order they were published:

{"v":1,"name":"colors","version":"1.4.2","deps":[{"name":"palette","req":"0.3"}],"fb":"1.0","targets":[],"archives":{"source":{"sha256":"…","size":48211}},"yanked":false}

Key
`v`	The line’s format, 1. fb skips a line of a format it doesn’t know.
`name`, `version`	The package and the version
`deps`	Its dependencies, each its `name` and its range, `req`
`fb`	The range of fb versions it builds with, or `null`
`targets`	The targets it has prebuilt archives for; empty for a package of source alone, which builds for every target
`archives`	Each archive’s SHA-256 and size: `source`, and one for each target
`yanked`	Whether new resolutions skip it. A version an fb.lock has still downloads.

A deleted version, which its publisher can delete on the package site within 72 hours if nothing depends on it, is gone from the file, and its number is never used again.

The archives

An archive is at https://dl.futureblitz.dev/<name>/<version>/<file>, and never changes once it’s published:

<name>-<version>.fbpkg holds the package’s project.toml, its license, its readme, and its source, without build/, tests/, fb.lock, or hidden files.
<name>-<version>-<target>.fbpkg, for a package with prebuilt code, holds that target’s libraries, so a build downloads only its own target’s.

An archive is a tar compressed with gzip. fb checks each one’s SHA-256 against the index line, or against fb.lock’s, before it uses any of it, and unpacks only plain files and folders, with paths that stay inside the package.

config.json

https://index.futureblitz.dev/config.json says where the archives and the API are, for a registry’s index; a registry of your own serves one too:

{
  "v": 1,
  "dl": "https://dl.example.com/{name}/{version}/{file}",
  "api": "https://packages.example.com/api/v1"
}

Report an issue with this page or with FutureBlitz on GitHub.