# Projects and dependencies

A single file needs no project. `vyrn.json` names an entry point and the imports; `vyrn.lock` pins what a build may fetch, down to the compiler's own tools.

## vyrn.json

`vyrn new <name>` writes a project: a manifest with a `main`, and a first file. A program that is one file needs none of this — `vyrn run file.vyrn` is complete — and a manifest earns its place when imports need names.

## Dependencies

`vyrn add` takes a `github:` or `https:` specifier and writes it to the manifest. The lock file records the content hash, and every later fetch is verified against it. `vyrn vendor` copies the sources into the repository, `--offline` refuses the network, and `vyrn update` is the only command that moves a pin. A dependency that vanishes upstream still builds.

## Toolchain pinning

The manifest's `toolchain` key and the lock's `tool:` lines pin the compiler's own tools into `~/.vyrn/tools`. `vyrn update --locked` fetches exactly what the lock names. CI runs that, so a build on a new machine is the build you tested.

---

From https://vyrn-lang.github.io/tooling/projects.html — generated by `site/export.vyrn` from the Vyrn repository.