Files in your repo, locked.

The CLI writes the files a Vard describes into your repository and records them in a lockfile, so every checkout builds with the same files.

Start in four commands @vardum/cli on npm

╭─ ~/marketing-site ───────────────────────────────────────────╮
│                                                              │
│ $ npx vardum status                                          │
│ would pull src/assets/logo.svg                               │
│ dry run: 1 change                                            │
│                                                              │
│ $ npx vardum pull                                            │
│ pull src/assets/logo.svg                                     │
│ 1 change                                                     │
│                                                              │
│ $ git diff --stat                                            │
│  .vardum.lock        |  8 ++++----                           │
│  src/assets/logo.svg | 14 +++++++-------                     │
│                                                              │
│ $ git commit -qam "Update logo to v13"                       │
│ $ npx vardum pull --frozen                                   │
│ 0 changes                                                    │
│                                                              │
╰──────────────────────────────────────────────────────────────╯

╭─ ~/marketing-site ───────────────────╮
│                                      │
│ $ npx vardum status                  │
│ would pull src/assets/logo.svg       │
│ dry run: 1 change                    │
│                                      │
│ $ npx vardum pull                    │
│ pull src/assets/logo.svg             │
│ 1 change                             │
│                                      │
│ $ git diff --stat                    │
│  .vardum.lock        |  8 ++++----   │
│  src/assets/logo.svg | 14 +++++++    │
│ -------                              │
│                                      │
│ $ git commit -qam "Update logo to    │
│   v13"                               │
│ $ npx vardum pull --frozen           │
│ 0 changes                            │
│                                      │
╰──────────────────────────────────────╯

Start in four commands.

npm i -D -E @vardum/cli
Pin the exact version, so CI runs the same CLI you do.
npx vardum init
Writes vardum.json. Paste the values from Copy setup in the app.
npx vardum login
Opens the browser and stores a key with your own permissions.
npx vardum pull
Writes the files and .vardum.lock. Review them and commit.

Commands

Every command accepts --json.

`vardum init`	Write vardum.json for this project
`vardum login, logout`	Authorize this machine in the browser, or revoke its key
`vardum whoami`	Show the project, workspace and key in use, offline
`vardum status`	Show what a pull would change, writing nothing
`vardum pull`	Fetch the Vard, update files and the lockfile (alias: sync)
`vardum pull --frozen`	Restore exactly what the lockfile names
`vardum push`	Upload local changes to outputs marked Writable
`vardum push-folder <dir>`	Upload a directory as assets, keeping its paths
`vardum pull-asset <key> <path>`	Download one asset to a path
`vardum update`	Update the CLI itself, not your assets

Flags

`--dry-run`	Plan only; nothing is written
`--force`	Overwrite local edits; checksums are still verified
`--delete`	Remove files an earlier pull wrote that the Vard no longer lists
`--json`	One { dryRun, changed, actions } object for scripts and CI

Files

`vardum.json`	Server, workspace and Vard. Commit it.
`.vardum.lock`	Paths, versions, checksums and download URLs. Commit it.
`~/.config/vardum/credentials.json`	Your machine key, readable only by you. Never commit it.

Reproducible in CI.

Install with npm ci and run a frozen pull with a read key from your secret store. If a run fails halfway, the JSON still lists which files landed.

# .github/workflows/build.yml
steps:
  - run: npm ci
  - run: npx --no-install vardum pull --frozen --json
    env:
      VARDUM_API_KEY: ${{ secrets.VARDUM_API_KEY }}
  - run: npm run build

# stdout
{ "dryRun": false, "changed": 3, "actions": [ … ] }

Careful by default.

Local edits stop a pull until you pass --force
--delete only removes files an earlier pull created
Downloads stay on your server; redirects are refused
If a locked version is gone from the server, the build fails; it never falls back to latest

~/marketing-site

$ npx vardum status --delete
would pull src/assets/icon.png  (local edits — needs --force)
would delete src/assets/brand/old-mark.svg
dry run: 2 changes

Start with one logo.

Start your own instance, upload it, map it into a repository, and pull.

Get started How it works

npm i -D -E @vardum/cli