kairo.toml and resolved by Forge. Forge writes a lock file (forge.lock) with the exact resolved versions so every developer and CI run gets the same build.
Declaring dependencies
Add a[dependencies] table to kairo.toml. Keys are package names (PascalCase, dot-separated). Values are version requirements.
Both applications and libraries can declare dependencies. Only applications produce a runnable artifact; libraries are consumed by other packages.
Version requirements
Kairo v0.1 supports version pins by matching the leading segments of a four-part version:Restore
forge restore reads kairo.toml, resolves each dependency to a concrete version, and writes forge.lock.
1
Read manifest
Forge parses
kairo.toml and validates the schema.2
Resolve versions
Forge finds the highest version compatible with every requirement.
3
Fetch metadata
Forge fetches package metadata from configured registries.
4
Write lock
Forge writes
forge.lock with the resolved, deterministic set.The lock file
forge.lock records the exact version of every direct and transitive dependency. Commit it to source control.
When
forge.lock exists, forge build, forge check, and forge run use the locked versions instead of re-resolving. This is what makes builds reproducible.Updating dependencies
To pick up newer compatible versions, deleteforge.lock and run forge restore again, or use the explicit update command:
Transitive dependencies
Forge resolves the full dependency graph, including transitive dependencies. You only declare what you use directly; transitive packages are resolved automatically and recorded in the lock file.Deferred features
The full dependency registry protocol is deferred. In v0.1:- The registry protocol and authentication model are not yet ratified.
- Private registries and mirrors are configured through external Forge configuration.
- Advanced version operators (ranges,
^,~) are deferred.
Next steps
Manifest reference
Full
kairo.toml reference.Forge CLI
forge restore, forge build, and every other command.