The registry

Prism has a single package registry. It is the default and the only one the toolchain talks to, which means the ecosystem cannot fragment into half-compatible mirrors the way other languages have. If it is not in the registry, it is not a dependency — it is a vendored fork.

Adding a dependency

prism add http
prism add native-webview --version 2.x

The first command resolves the latest compatible version; the second pins a range. Both update prism.toml and the lockfile in one step.

[dependencies]
http = "2.3.1"
native-webview = "2.*"

The lockfile

prism.lock records the exact versions resolved, including transitive dependencies:

[[package]]
name = "http"
version = "2.3.1"
checksum = "sha256:9f86d081884c7d659a2feaa0c55ad015"

• The lockfile is checked into source control. Reproducible builds are the default.
• prism update changes the lockfile deliberately; a plain prism build never does.
• Checksums are verified against the registry on every fetch.

Versioning

Prism packages follow semantic versioning, enforced at publish time:

The compiler refuses to publish a package whose version does not match the change in its public API — the registry compares against the previous release.

Publishing

prism publish

See Publishing for the full flow, including namespacing and private packages.

Note: the registry is young. Breaking changes to the registry format itself are unlikely but possible until v1.0; the toolchain will migrate projects automatically.