Source Ownership

When you install a Solidiom primitive or template, you get the source code. Not a compiled bundle. Not a CDN link. The actual TypeScript source files land in your project.

#What Source Ownership Means

1. You can read it — no minified mystery code in node_modules
2. You can modify it — change behavior, add features, fix bugs
3. You can audit it — security review every line before deploying
4. You can fork it — take the code and never look back
5. You can vendor it — commit to your repo and disconnect from upstream

#How It Works

#Package Mode (default)

solidiom add button

Installs @solidiom/button as a workspace dependency. Source is in node_modules/@solidiom/button/source/ — readable, but managed by your package manager.

#Source Mode

solidiom add button --mode source

Copies primitive source directly into the configured source directory. You own these files completely and can review conflicts with solidiom diff --primitive button.

#Integrity Verification

For registry integrity, use the registry mode explicitly:

solidiom verify --registry

Artifact verification instead requires an artifact path, for example solidiom verify ./dist/dialog.tgz.

#Why Not Just npm?

Traditional component libraries give you a compiled bundle:

• You can’t see the implementation
• You can’t fix bugs without waiting for a release
• You can’t remove features you don’t need
• You can’t audit for security without decompiling

Solidiom’s source/ emission gives you the same development experience as code you wrote yourself, with the option to stay connected to upstream improvements.

#Trade-offs

#The Registry Contract

The registry ensures that what you install is what was published:

• Every file has a SHA-256 digest in the manifest
• Manifests are signed with Ed25519 (asymmetric verification)
• The CLI fails closed on digest mismatch
• Offline mode works from a local registry snapshot

You don’t have to trust us. You can verify.