Package manager (cplus-pm)

cplus-pm is a standalone tool for managing the packages in a project's vendor/ directory. It resolves and fetches dependencies so you do not have to vendor them by hand. It is independent of the compiler — cplus-pm manages packages, cpc builds them — so the two version and ship separately.

Commands

cplus-pm install            # resolve + fetch everything in the manifest
cplus-pm install <pkg>      # add a dependency and fetch it
cplus-pm remove  <pkg>      # drop a dependency
cplus-pm update             # re-resolve to the latest allowed versions

install writes the resolved packages into vendor/ and records exact versions in a lockfile, so a later checkout reproduces the same set.

How resolution works

• Git-tag versioning. Package versions are git tags, so a dependency is a repository plus a version constraint.
• pubgrub resolution. The resolver uses the pubgrub algorithm to pick a version set that satisfies every constraint, or to report a clear conflict when none exists.
• SHA-256 content addressing. Each fetched package is identified by the hash of its contents, so what you build is exactly what was resolved.
• Shared cache. Downloaded packages live in a machine-wide cache and are hard-linked or copied into each project's vendor/, so the same version is fetched once.
• Lockfile. The resolved graph is pinned to a lockfile for reproducible installs across machines and CI.

Relationship to the manifest

Dependencies are still declared in Cplus.toml (see Modules & packages); cplus-pm is what reads those declarations, resolves them, and populates vendor/. The compiler then resolves imports from vendor/ exactly as described in the packages overview. You can still vendor packages by hand — cplus-pm automates the same layout.