Package Manifest Reference¶

Complete Shape¶

> package: reports:
  author: Kedi Team
  contact: maintainers@example.com
  version: 1.2.0
  source: src/reports
  python: python@3.11-3.14
  license: MIT
  python_dependencies:
    pydantic>=2
    httpx[http2]>=0.27

The file must be named exactly package.kedi, contain exactly one package directive, and contain no imports, exports, procedures, types, Python, values, or executable statements. Comments are allowed.

Fields¶

Field	Required	Validation
package name	yes	`[a-z][a-z0-9_]*`
`source`	installable package: yes	literal relative directory containing `main.kedi`
`version`	no	valid PEP 440 version
`python`	no	fixed version or inclusive closed range
`python_dependencies`	no	one list of valid PEP 508 requirements
`author`	no	metadata text
`contact`	no	metadata text
`license`	no	metadata text

Unknown fields, duplicate scalar fields, a second dependency block, or a second package directive fail validation.

Python Requirement¶

Accepted forms:

python@3.11
python@3.11-3.14

The range includes both endpoints and its upper bound cannot precede its lower bound. Installation compares it with the interpreter running kedi install. This field does not create or select a virtual environment.

Source Tree¶

For source: src/reports, installation requires:

package.kedi
src/
  reports/
    main.kedi

The package root import loads main.kedi; nested imports load sibling .kedi files. Absolute paths, .., symlink escapes, sparse-checkout patterns, special files, missing roots, and oversized source trees are rejected.

Dependencies¶

python_dependencies records and validates dependency requirements. Kedi does not install them into the active Python environment. Package setup must satisfy them separately.

Installation¶

kedi install
kedi install path/to/package.kedi
kedi add package_name
kedi add git+https://github.com/owner/repository.git

Installed content and .kedi-install.json receipts live below the Kedi home registry. Registry installation can identify a verified source commit; this proves identity/integrity, not safety. Imported packages may execute Python with the host process's authority.