Projects and dependencies
A single file needs no project. vyrn.json names an entry point and the imports; vyrn.lock pins what a build may fetch, down to the compiler's own tools.
vyrn.json
vyrn new <name> writes a project: a manifest with a main, and a first file. A program that is one file needs none of this — vyrn run file.vyrn is complete — and a manifest earns its place when imports need names.
Dependencies
vyrn add takes a github: or https: specifier and writes it to the manifest. The lock file records the content hash, and every later fetch is verified against it. vyrn vendor copies the sources into the repository, --offline refuses the network, and vyrn update is the only command that moves a pin. A dependency that vanishes upstream still builds.
Toolchain pinning
The manifest's toolchain key and the lock's tool: lines pin the compiler's own tools into ~/.vyrn/tools. vyrn update --locked fetches exactly what the lock names. CI runs that, so a build on a new machine is the build you tested.