Use local and unpublished packages

Not every dependency lives on JSR. Ende has two supported ways to use code that isn’t published anywhere: the links field for local directories, and plain HTTPS imports for code reachable by URL.

The links field in ende.json overrides a dependency with a local directory during development. Given a local package with a name, version, and exports:

greeter/ende.json
{
  "name": "@acme/greeter",
  "version": "0.1.0",
  "exports": "./mod.ts"
}
greeter/mod.ts
export function greet(name: string): string {
  return `Hello, ${name}!`;
}

Point your application at it with links, and import it like a registry package:

my-app/ende.json
{
  "links": ["../greeter"],
  "imports": {
    "@acme/greeter": "jsr:@acme/greeter@^0.1.0"
  }
}
my-app/main.ts
import { greet } from "@acme/greeter";

console.log(greet("local package"));
$ ende run main.ts
Hello, local package!

The linked directory is used instead of the registry; the package doesn’t even have to be published. Edits in greeter/ are picked up directly.

Note

links is only respected in the workspace root.

Import straight from an HTTPS URL

Any module reachable over HTTPS can be imported directly, including raw files from a GitHub repository:

main.ts
import { equal } from "https://raw.githubusercontent.com/denoland/std/cdf74a86680beb4ef74c95e0fd5d71c5d7841eb9/assert/equal.ts";

console.log(equal([1, 2], [1, 2]));
$ ende run main.ts
Download https://raw.githubusercontent.com/denoland/std/cdf74a86680beb4ef74c95e0fd5d71c5d7841eb9/assert/equal.ts
true

Pin the URL to a tag or commit hash rather than a branch, so the code can’t change underneath you.

For private repositories, set ENDE_AUTH_TOKENS to a personal access token scoped to the host, e.g. [email protected]; see Private repositories for details.

Caution

Only import over HTTPS from sources you trust, and prefer a registry for anything beyond small projects. HTTPS imports are not supported by ende add/ende install.

What is not supported

Ende does not support git dependency specifiers (git+https:/git+ssh:) or tarball URL dependencies.

The supported alternatives are:

  • the links field for local directories
  • HTTPS imports for code hosted in a (possibly private) git repository
  • vendoring remote modules you need to patch or build offline, with "vendor": true in ende.json
  • publishing the package to JSR

For lockfiles, version ranges, and everything else about dependencies, see the packages documentation.