> ## Documentation Index
> Fetch the complete documentation index at: https://docs.akua.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Package repositories

> How authored source becomes an immutable, Akua-hosted Package version

Hosted Package authoring uses two private git repositories with different lifetimes. A temporary **workspace repository** accepts your authored source. After Akua validates that source, it copies the exact commit into a new **Package repository** that belongs to the resulting Package.

Keeping these repositories separate makes Package versions reproducible without turning an authoring credential into a permanent Package credential.

## Workspace repositories

A workspace repository is a short-lived upload surface for an Akua Package workspace, including its required `akua.toml`, `package.k`, and local files. Its write token is scoped to that repository and returned only when it is created. Choose a scheduled revocation delay from 60 seconds to one hour. Akua caps the schedule to the repository's remaining lifetime and returns the resulting time in `revocation_scheduled_at`.

Scheduled revocation starts cleanup; it does not enforce token expiry at that exact time. Akua retries revocation and revokes issued write tokens before it purges the repository. Protect the credential until revocation succeeds or the repository is removed.

<Info>
  Hard expiry requires the hosted Git provider to persist an absolute expiry or bounded TTL when it creates a token, reject expired tokens on every authenticated request, and prune expired tokens during authentication, listing, or maintenance. The provider does not support that contract yet.
</Info>

The repository itself expires after 24 hours unless Package creation removes it sooner.

You can push more commits while the workspace repository exists. This is useful when validation reports a problem: Akua keeps the repository after validation failure, so you can correct the source and submit another Package creation request against a new commit or ref.

Workspace repositories are not Package records and cannot be installed. They exist only to receive authored source.

## Package repositories

A successful creation request resolves the ref you selected to an exact commit, validates the checkout, and copies that content into a fresh Package repository. Akua creates the Package and its first version only after the source is valid and the copy succeeds.

The Package version records the commit in its Package repository. Later installations vendor that version into their own [installation repositories](/installs/repositories); they do not depend on the temporary workspace repository.

```text theme={null}
Workspace repository
  selected ref → exact commit
    Package validation
      Package repository + Package version
        Per-installation repositories
```

By default, Akua deletes the workspace repository after Package creation succeeds. Retain it when the same authored source must be reused for a later creation workflow. Retention does not change its 24-hour expiry.

## Validation and limits

Akua checks repository size before evaluating authored Package content. A source larger than 50 MiB is rejected without evaluating its content and is purged, even if `keep_source_repository` was requested. Accepted source is evaluated in an execution sandbox with no network access and restricted filesystem access.

Validation diagnostics appear on the Package creation operation. Other failed validation or preparation steps do not create a Package repository or Package record, and leave the workspace repository available for a corrective push until its normal 24-hour expiry. The `keep_source_repository` option changes cleanup after successful Package creation only; it does not retain an oversized source.

Workspace repository counts are limited by your workspace plan. List repositories with the `workspace` purpose to inspect active authoring repositories and their expiry times.

## API

<CardGroup cols={2}>
  <Card title="Create a repository" icon="code-branch" href="/api-reference/repositories/create-workspace-repository">
    Create a temporary repository for authored Package source.
  </Card>

  <Card title="Create a write token" icon="key" href="/api-reference/repositories/create-workspace-repository-write-token">
    Mint a one-time, repository-scoped credential for your push.
  </Card>

  <Card title="Create a Package" icon="cube" href="/api-reference/packages/create-package">
    Validate hosted source and create its durable Package version.
  </Card>

  <Card title="List repositories" icon="list" href="/api-reference/repositories/list-repositories-in-workspace">
    Inspect Package, installation, and workspace repositories.
  </Card>
</CardGroup>

## Related topics

<CardGroup cols={2}>
  <Card title="Packages" icon="cube" href="/packages">
    Understand Package versions, inputs, and compatibility.
  </Card>

  <Card title="Package format" icon="file-code" href="/akua/package-format">
    Author `package.k`, inputs, and Package metadata.
  </Card>

  <Card title="Installation repositories" icon="folder-tree" href="/installs/repositories">
    See how a Package version materializes for each install.
  </Card>

  <Card title="API authentication" icon="key" href="/apis/authentication">
    Authenticate automation and select a workspace context.
  </Card>
</CardGroup>