vendor

Arguments and rejection

topaz vendor accepts no positional operands. --root <dir> selects the package root and defaults to the current directory.

--from <dir> selects a local registry root. A dependency declared as <name> at <version> is read from <dir>/<name>/<version>. A URL is not a registry directory and is rejected without a network request.

Without --from, the command verifies each existing registry package under vendor/<name>/<version>. It does not replace that content from another source.

The package manifest selects the language mode. --language-version, --locked, output-format options, extra operands, missing values, repeated options, and attached values are rejected. topaz fetch is rejected during command validation.

Output

Successful vendoring leaves standard output empty. Standard error reports the number of registry packages verified or materialized and the written lock path.

An error is reported on standard error. A backup cleanup failure after the new lock is committed is a warning and does not change the successful result.

--format json is rejected because vendoring has no JSON report. The written topaz.lock uses the same format as topaz lock.

Exit status

Exit code 0 means every registry dependency was admitted and the lock was written. Zero registry dependencies is a successful operation that still validates and writes the package lock.

Exit code 1 covers invalid arguments or manifests, missing registry content, mismatched package names or versions, hash mismatches, symlinks or invalid vendor paths, failed copies, failed Lispex preparation, and lock publication failures.

A warning while removing an obsolete backup after commitment retains exit code 0 because the new vendor content and lock are already complete.

Filesystem effects

Standard-library and path dependencies are not copied into the registry vendor tree. Their identities still participate in applicable package and lock validation.

With --from, each candidate is admitted and hashed before its destination is replaced. Content is copied through a staging directory. The existing dependency directory is retained as a backup until the lock succeeds.

A failure before lock commitment restores previously replaced vendor directories when filesystem recovery succeeds. Recovery artifacts can remain after an I/O failure and do not establish a completed operation.

The command rejects symlinks within admitted package content and along vendor paths. It does not delete unrelated vendor entries or modify the registry source. Without --from, vendored package bytes remain unchanged.

The package lock is written after dependency verification. Package-owned Lispex preparation outputs are updated when the manifest requires them.

Network access

Vendoring performs no network access. It reads the explicitly selected local registry or the existing vendor tree and never falls back to a remote registry.

Reproducibility

The same manifest, registry package bytes, local dependency bytes, and installed preparation components produce the same vendor contents and lock bytes. Registry package selection uses exact name and version directories.

Temporary staging and backup names are not part of the installed package identity. Filesystem timestamps do not change the selected package or its content hash.

Packages and locks

A candidate package must declare the requested name and exact version. When the dependency table supplies hash, candidate content must match it. When no hash is supplied, the admitted content hash is recorded in the new lock.

The command does not rewrite manifest pins. Subsequent compilation requires --locked for registry dependencies and checks vendored bytes against the lock.

The invocation topaz vendor main.tpz --language-version 5.21 is expected to exit with 1.