vendor.kz - Vendored dependencies as a first-class, compile-time-checked concept. A vendored dependency is source you copied into your own tree. The copy is the easy part; the hard part is that once it's in your repo it LOOKS trustworthy, and nothing notices when it changes. `std/vendor` makes the change loud: import std/vendor std/vendor:bindings { koru/vaxis: ./vendored/vaxis } Each binding names a module and the local tree that supplies it. `vendor.lock` — one per program, at the compilation root, with every binding path relative to it — records a SHA-256 for every file in that tree plus one tree hash over the sorted manifest. The `bindings` transform recomputes those hashes at COMPILE TIME and refuses the program when they disagree with the lock. A dependency that changed under you does not compile; the diagnostic names the file that drifted. This is the same doctrine the rest of the language runs on — the real surface or a loud failure — applied to the dependency graph. It is deliberately NOT a `vendor audit` you have to remember to run: an audit nobody runs is how 500k compromised packages a year get through. You vendor a library because you had to CHANGE it — a bug upstream will not fix on your schedule, a platform they do not support. So the lock records TWO trees per binding: `as-copied`, what arrived from upstream and is never overwritten, and `as-compiled`, what your program is actually built from. The difference is your patch, computed rather than remembered, and it survives every re-pin. Without that split the one command you must run to accept your own fix is also the command that destroys the evidence of it, and a deliberate patch becomes indistinguishable from a tampered file. Commands: koruc main.kz vendor add <pkg> # acquire through npm into your tree, and pin it koruc main.kz vendor # status of every binding (default: check) koruc main.kz vendor check # same, explicit koruc main.kz vendor sync # accept what is on disk as the tree you compile koruc main.kz vendor diff # drift against the pin, AND your patch vs upstream `sync` is the one command that makes drift go away, and it is the one command you should read a real diff before running. `diff` is what you read. `add` acquires through npm and does not reimplement it: no registry client, no version-range resolution, no transitive dependency walk. npm fetches; Koru keeps, pins, and diffs — which is the part npm has no answer for.