Skip the bullshit
// docs / Ecosystem

Packages

A package manager whose registry is a git branch. Wally did it first; we did it worse.

toml
# vcwl.toml
registry = "https://github.com/chteau/vcwl"
[dependencies]
is-odd = "^1.0"
kit = "../kit" # a path dependency
sh
vcwl search # what's out there (six packages, one of them is-odd)
vcwl add is-odd # adds is-odd = "^1.0.0" and installs it
vcwl install # resolves, writes vcwl.lock, fills vcwl_packages/
vcwl publish # from a package's directory: commits to the registry branch
vcwl audit # re-runs the security review on what's installed

Security review

Before a registry package is installed, VCWL reviews it. Reading environment variables, touching store keys outside the package's own prefix, shipping active files in public/, symbolic links and paths that escape the package block the install until you trust that exact version:

toml
[trust]
sketchy-pkg = "1.2.3"

vcwl-supabase

The first package that does something: Supabase sign-in (password, magic link, OAuth), your tables through PostgREST, and storage URLs. Rows come back typed with as. It ships JavaScript, so you have to trust it. It has no unit tests. It is vibe coded.

vcwl
import "@supabase"
on mount {
supabase_init("https://your-project.supabase.co", "your-anon-key")
fetch db_select("todos", "select=*&order=id") as [Todo] {
Ok(rows) => {
todos = rows
}
Err(e) => {
error = e.message()
}
}
}
on submit {
fetch db_insert("todos", to_json(NewTodo { title: draft })) as [Todo] {
Ok(rows) => {
todos = todos.concat(rows)
}
Err(e) => {
error = e.message()
}
}
}

vcwl-oauth

"Sign in with ___" in a popup: Google, Discord, GitHub, Roblox, Microsoft, Apple, Twitch, Spotify, GitLab, Facebook, Reddit, LinkedIn, Slack and X built in, anything else with oauth_custom. Providers that want a client secret (GitHub, Roblox, Apple, LinkedIn, Slack, X) need a small token proxy on your server; the package README has one.

vcwl
import "@oauth"
on mount {
oauth_provider("discord", "your-client-id", "")
}
on click {
fetch oauth_sign_in("discord") {
Ok(_) => {
fetch oauth_user("discord") {
Ok(u) => {
user = Some(u)
}
Err(e) => {
error = e.message()
}
}
}
Err(e) => {
error = e.message()
}
}
}
← 3D scenesJavaScript interop →