Skip to main content
Hosted Package authoring uses two private git repositories with different lifetimes. A temporary workspace repository accepts your authored source. After Akua validates that source, it copies the exact commit into a new Package repository that belongs to the resulting Package. Keeping these repositories separate makes Package versions reproducible without turning an authoring credential into a permanent Package credential.

​
Workspace repositories

A workspace repository is a short-lived upload surface for an Akua Package workspace, including its required akua.toml, package.k, and local files. Its write token is scoped to that repository and returned only when it is created. Choose a scheduled revocation delay from 60 seconds to one hour. Akua caps the schedule to the repository’s remaining lifetime and returns the resulting time in revocation_scheduled_at. Scheduled revocation starts cleanup; it does not enforce token expiry at that exact time. Akua retries revocation and revokes issued write tokens before it purges the repository. Protect the credential until revocation succeeds or the repository is removed.
Hard expiry requires the hosted Git provider to persist an absolute expiry or bounded TTL when it creates a token, reject expired tokens on every authenticated request, and prune expired tokens during authentication, listing, or maintenance. The provider does not support that contract yet.
The repository itself expires after 24 hours unless Package creation removes it sooner. You can push more commits while the workspace repository exists. This is useful when validation reports a problem: Akua keeps the repository after validation failure, so you can correct the source and submit another Package creation request against a new commit or ref. Workspace repositories are not Package records and cannot be installed. They exist only to receive authored source.

​
Package repositories

A successful creation request resolves the ref you selected to an exact commit, validates the checkout, and copies that content into a fresh Package repository. Akua creates the Package and its first version only after the source is valid and the copy succeeds. The Package version records the commit in its Package repository. Later installations vendor that version into their own installation repositories; they do not depend on the temporary workspace repository.
By default, Akua deletes the workspace repository after Package creation succeeds. Retain it when the same authored source must be reused for a later creation workflow. Retention does not change its 24-hour expiry.

​
Validation and limits

Akua checks repository size before evaluating authored Package content. A source larger than 50 MiB is rejected without evaluating its content and is purged, even if keep_source_repository was requested. Accepted source is evaluated in an execution sandbox with no network access and restricted filesystem access. Validation diagnostics appear on the Package creation operation. Other failed validation or preparation steps do not create a Package repository or Package record, and leave the workspace repository available for a corrective push until its normal 24-hour expiry. The keep_source_repository option changes cleanup after successful Package creation only; it does not retain an oversized source. Workspace repository counts are limited by your workspace plan. List repositories with the workspace purpose to inspect active authoring repositories and their expiry times.

​
API

Create a repository

Create a temporary repository for authored Package source.

Create a write token

Mint a one-time, repository-scoped credential for your push.

Create a Package

Validate hosted source and create its durable Package version.

List repositories

Inspect Package, installation, and workspace repositories.

Packages

Understand Package versions, inputs, and compatibility.

Package format

Author package.k, inputs, and Package metadata.

Installation repositories

See how a Package version materializes for each install.

API authentication

Authenticate automation and select a workspace context.