Documentation

Command reference.

The WPKM mental model is tiny: ask, get, use, purge. Publishing lives alongside it.

01 · Install

Build or obtain WPKM.

WPKM is written in Go and builds into a Windows executable.

go build -o wpkm.exe ./cmd/wpkm

Then place wpkm.exe somewhere on your PATH.

02 · Commands

The command map.

wpkm get <package>Install a package.

wpkm purge <package>Remove an installed package.

wpkm ask <query>Search the registry.

wpkm where <package>Show the local install path.

wpkm listList installed packages.

wpkm about [package]Show WPKM or package information.

wpkm version [package]Show WPKM or installed package version.

wpkm push <file>Publish a package through a GitHub PR.

wpkm helpShow command help.

03 · Get

Install flow.

wpkm get milli

Fetching manifest
Downloading payload
SHA3-512 MATCH
Installing package
✓ milli installed

Package metadata is fetched from the official WPKM registry. The payload is downloaded and hashed before installation.

04 · Push

Publish with one command.

wpkm push milli.exe

WPKM calculates SHA3-512, constructs the package manifest, authenticates with GitHub, and creates a package pull request. GitHub Actions verifies the payload hash before auto-merging a valid package.

05 · ZIP packages

Archive in, extracted package out.

If a manifest points to a payload ending in .zip, WPKM verifies the ZIP first and then extracts it into the package directory.

example.zip
    ↓
SHA3-512 verification
    ↓
secure extraction
    ↓
%LOCALAPPDATA%\\wpkm\\packages\\Example\\

Archive entries are checked to prevent absolute paths, traversal, symbolic links, and unsupported special file types.

06 · Security

Integrity is non-negotiable.

WPKM uses SHA3-512 to detect payload changes between publication and installation. A mismatch stops installation.

Important: a cryptographic hash provides integrity checking, not publisher identity. Future signing can add authenticity on top.

07 · Storage

Where packages live.

%LOCALAPPDATA%\\wpkm\\packages\\
└── milli\\
    ├── milli.exe
    ├── manifest.json
    └── SHA3-512