Dependencies

peko add sockets              # newest version, recorded as "*"
peko add sockets@1.2.3        # pin inline
peko add sockets --version 1.2.3
peko add local --path ../local
peko remove sockets
peko install                  # resolve, download, lock
peko update                   # re-resolve, refresh the lock

With no version the requirement is recorded as *, meaning any version. A version may be given inline after @, or with --version. When more than one source is present the order is --path, then --version, then the inline form.

The requirement is written into [dependencies] as you gave it, so it accepts the usual range syntax as well as an exact version:

[dependencies]
sockets = "1.2.3"     # exactly this version
pekoui  = "^0.1.6"    # compatible updates
std     = "*"         # any version

peko build and peko run resolve automatically, so install is only needed on its own.

peko.lock pins the resolved versions and checksums. Do not edit it by hand. install uses it when it satisfies the manifest; update ignores it and re-resolves from scratch.

Where sources land

Packages unpack into ~/.Peko/registry/src/<name>/<name>-<version>/. That is real, readable source, and it is the right place to check what a dependency actually provides.

The global scope

--global writes to the manifest at the Peko root instead of the project, making a package available everywhere:

peko add pekoui --global
peko remove pekoui --global

peko setup uses this to install std and pekoui. Both lockfiles are read at build time, with the project's entries taking precedence.

Path dependencies

A path dependency points at a directory containing its own peko.toml, is resolved recursively, and shadows a registry package of the same name. It is the way to develop a library and its consumer together.

Gated packages

Some packages are proprietary and need a paid entitlement. From your side nothing changes: run peko add <name> as usual. When the public download is absent and you are signed in, the CLI requests a short-lived signed URL with your token, downloads the bundle, and verifies its hash.

What arrives is not source. It is a prebuilt bundle keyed by toolchain version, carrying definition-only stubs and compiled objects for every platform.

Resolving and locking work signed out, because the metadata is public. Only the bytes are gated:

Failure	Meaning	Fix
401	not signed in	peko login
403	the plan does not include it	upgrade
404	no bundle for this toolchain version	check your toolchain
429	rate limited	retry

Offline builds

PEKO_OFFLINE skips the keychain read and every network call, for a hermetic build whose dependencies are already cached.