Your own package index

The public index at soft-forge.dev/cxpm/index is where cxpm looks by default. For a team, a company network or a machine with no internet access, cxpm serve runs an index of your own: the same requests, the same search, fetch and publish, with accounts you make. Point cxpm at it with --index, CXPM_INDEX or ~/.config/cxpm/index.

cxpm serve --database-path /var/lib/cxpm/index --add-account ada    # prints ada's token once
cxpm serve --database-path /var/lib/cxpm/index \
           --listen unix:///run/cxpm/socket.sock \
           --host https://packages.example.org

Option	Default	Meaning
`--listen`	`http://127.0.0.1:7878`	`unix:///path/to/socket`, `http://host:port` or `host:port`
`--host`		The public address a proxy serves the index at; its path is accepted as a prefix of requests
`--database-path`	`/var/lib/cxpm/index`	Where packages and accounts are kept, as JSON files
`--add-account NAME`		Create the account (or replace its token), print the token, exit

cxpm serves plain HTTP. Put a reverse proxy in front of it for TLS and point it at the socket. The index keeps only a hash of each token, so a lost token is replaced with --add-account, not recovered.

Request	Answer
`GET /` , `GET /?q=text`	The packages: name, description, owner, latest version
`GET /<name>`	A package and its versions
`GET /<name>/<version>`	One version: repository, revision, commit, dependencies
`PUT /<name>/<version>`	Publish; needs `Authorization: Bearer <token>`
`DELETE /<name>/<version>`	A publisher deletes the version (`cxpm unpublish`); 409 for the last one, or while another owner’s package depends on the name
`DELETE /<name>`	The owner deletes the package: `{deleted: name}`; the name stays the owner’s
`GET /-/whoami`	The account a token belongs to