skip to content
[readonly]
  • total 3
  • drwxr-xr-x-../
  • drwxr-xr-x-Oct 27 12:00packages/# everything published
  • -rw-r--r--4.1KOct 27 12:00api.txt# the registry's HTTP API

The registry

Anyone can sign up and publish. Your username is your scope: packages named @you/... are yours alone. Sign up on the web, or from a terminal:

sh
$ printf '%s\n' "$PASSWORD" | sexc register --username you --email you@example.com --password-stdin
$ printf '%s\n' "$PASSWORD" | sexc login --username you --password-stdin
$ sexc whoami

Passwords come from stdin, never the command line: sexc never prompts. The token it gets is kept in ~/.sexc/credentials (mode 0600). In CI, make a token on settings/tokens and set SEXC_TOKEN.

Installing

sh
$ sexc add @ajax/strbuf        # adds "^1.2.0" to dependencies, installs
$ sexc install                 # what sexc-lock.json says
$ sexc install --frozen        # in CI: fail if the lock is stale
$ sexc outdated
$ sexc why @ajax/mem
  • One version of each package. C has one namespace for symbols, so a build holds exactly one version of each dependency: the highest that satisfies every range that asks for it. If none does, sexc says which packages disagree.
  • A lockfile. sexc-lock.json pins every version and its SHA-256, checked on every install.
  • One store. Like pnpm, each version is unpacked once per machine, in ~/.sexc/store, and linked into .sexc/deps.
  • Built your way. Dependencies build with your compiler and profile, and their warnings never fail your build.

Publishing

sh
$ sexc pack --dry-run          # what would go in
$ sexc publish                 # this package
$ sexc publish -r              # every package in the workspace, in order
$ sexc yank @you/thing@1.0.1 --reason "breaks free()"
  • workspace:* dependencies become ^<version> in what's published.
  • Everything in the package folder goes in, except hidden files and folders; list "files" in sexc.json to narrow it.
  • Versions are immutable. A yanked version stays installable for lockfiles that already name it.
  • Mark a package "private": true and it is never published.
for agents

Every command takes --json, and sexc-mcp offers them all as tools. The HTTP API is in api.txt; every package page has a .json twin.