Consume a package

Inspect a package before you add it. Declare the requested version in the consuming .bproj manifest.

Prerequisites

Know the package name and requested version. Select the consuming project. Ensure that the registry is reachable.

Actions

1. Inspect the package and its active versions for the requested version:

   beskid pckg details Acme.Math
   beskid pckg versions Acme.Math

2. Download that coordinate when you need offline inspection:

   beskid pckg download Acme.Math --version 1.0.0 --output ./vendor/Acme.Math-1.0.0.bpk

3. Add the dependency to App.bproj:

   dependency "Acme.Math" {
     source = "registry"
     version = "1.0.0"
   }

4. Resolve once to update the lockfile:

   beskid fetch --project ./App.bproj --plain

5. Inspect Project.lock after every registry resolution for an Acme.Math resolved_version that matches 1.0.0.

6. You must stop the workflow if resolved_version differs from the requested version. Do not analyze, build, test, or publish with that lockfile.

7. Commit Project.lock only after its values match the requested package coordinate.

8. Run the resolution with the reviewed lockfile enforced:

   beskid fetch --project ./App.bproj --locked --plain

Expected result

Project.lock records the resolver’s selected resolved_version. After review, the resolver extracts the archive under obj/beskid/deps/src/<materialized-id>. --locked and --frozen preserve reviewed lock behavior on later runs.

The current resolver can fall back to the first active version when the requested version is absent. This behavior is an implementation limitation under reconciliation. Initial registry resolution is not an exact-version guarantee.

Recovery

If the requested version is absent, run beskid pckg versions Acme.Math and select an active coordinate. If the resolver falls back, stop the workflow and remove the unreviewed lockfile change. A yanked version is not available for a new download. If --locked reports drift, review the manifest change and regenerate the lockfile outside CI.

Next task

Apply credential and failure recovery or enforce the lock in CI.