The SCUA Package Manager

The language works. Sharing code doesn't.

• Every project is an island. If you want a behaviour-tree module someone else wrote, you copy the file and hope you remember where it came from.
• No versions, no upgrades. A fix in the original never reaches your copy.
• No discovery. You can't even find out that someone already solved your problem.

Ecosystems are the whole game.

• For people: the distance between "I need X" and "X is running in my project" should be about ninety seconds.
• For teams: studios need to share internal libraries across projects without inventing their own infrastructure every time.
• For AI agents: SCUA is built to be a language agents write. An agent needs to find a library, judge whether to trust it, and use it correctly, all without a human babysitting each step.

Embedded packages are hard to retrofit.

• No blame here. The embedded case just wasn't the one package tooling grew up around, and bolting it on afterwards is genuinely hard.
• The infrastructure has also run for two decades on volunteer time and donated hosting. Admirable, and fragile.

npm shows what bolted-on safety costs.

• Install scripts. Installing a package runs its code. That one choice became the main malware channel; a 2025 worm rode it through more than five hundred packages. npm turned scripts off by default in 2026, years after the pattern was obvious.
• Auto-floating versions. One phished maintainer and the bad release ships to everyone by morning.
• left-pad. A package vanished and builds broke across the ecosystem, because names could be unpublished.
• node_modules. The same files copied into every project on your disk, forever.

We did the research before picking a design.

A registry is just a directory of files.

• No server software required at any tier. If you can host files, you can host packages.
• Every package is addressed by a hash of its content, so a copy from any mirror is provably the real thing.

Built to cost almost nothing to run.

• Publishing runs on your machine. The registry never executes anything; it stores what you signed.
• Package bytes stay on the publisher's hosting (a releases page, a bucket, wherever). The public index holds names and hashes: kilobytes, on a CDN.
• Anyone can mirror anything, because hashes make mirrors trustworthy by construction.

Your packages, inside your firewall.

• A company registry is a bucket or a directory behind nginx. No instance, no licence, nothing to patch.
• Your internal names are sealed to your registry in the project manifest, so a public package can never shadow an internal one. That attack class (it hit Apple and Microsoft via npm) is a config error here, not an exploit.
• Fully offline and air-gapped workflows are the same mechanism, not a special mode. Console build farms included.

The engine case comes first this time.

• scua vendor / scua bundle turn your dependency set into a plain directory or a single relocatable blob that your engine build owns.
• The runtime resolves packages with a tiny read-only lookup. No filesystem probing, no environment variables, and no network code in scua at all. You can ship a build where networking simply doesn't exist.
• The package tool is a separate binary (scua-pkg), with its own releases. Updating the language never forces package-infrastructure churn on you, and vice versa.

The safety you get on day one.

• Installing never runs code. Not a script, not a build step, nothing. The npm malware channel doesn't exist here.
• Updates happen when you ask. Publication is not distribution: a compromised maintainer's new release reaches nobody until they explicitly update.
• Packages can't lie about what they touch. A package's capabilities (files, network, clock) are computed from its code. One that never imports net cannot phone home, and the resolver checks that. No reviewer required.
• Names can't vanish. Yank marks a version bad; nothing ever un-exists. No left-pad.

Trust as a traffic light. An honest one.

• Green: verified, history logged, capabilities within budget, vouched for by audits you chose to trust.
• Amber: nothing known to be wrong, but the evidence isn't there yet. The tool tells you exactly what's missing.
• Red: a security advisory, a failed check, or a capability it shouldn't have. Blocked.

Packages that teach your AI to use them.

• An agent can search structurally: "a noise generator that imports nothing" is a real query, not a vibe.
• The trust light comes as machine-readable JSON, so a harness can auto-accept green, ask you about amber, and refuse red.
• Pack text is treated as data, not instructions, so a malicious package can't prompt-inject its way into your agent's plans through its own docs.

First the verbs, then the evidence.

• Now → M1: add, vendor, bundle, publish, self-hosted registries, the public index. Everything on static files.
• From the very first publish: a signed public log of every name-to-hash binding. Nobody independently witnesses it yet, but history can't be backfilled, so it begins on day one.
• Later → M2: independent witnesses, signed publisher identity, an audit ecosystem, search. Those need an operator and money, so they wait until both exist. Nothing else waits for them.