For the reviewers: I suggest reviewing commit by commit for simplicity.

Manifest validation is left out for now, this is only relevant for the package I think, but if it is relevant to other downstream tools we can add it in post.

I have added a project crate which should at some point have things like the project locking mentioned in #4452, but I left the feature out as I'm not 100% sure how to implement it in a cross-platform manner. Currently, it only contains recursive project lookup by searching for the manifest file.

Regarding package downloads, I initially wanted to abstract this a little more, but it proved difficult. I think this is the feature where it's least clear what should be configurable and what shouldn't, so this can be extended later when the API surface is clearer. It will likely change once we add support for custom registries and git packages, so it's ok that it's not yet fully defined, I think.

I should note that I had a discussion with @Thumuss regarding manifest validation. While this is something that only 2 projects need, utpm and the package bundler, it may still be beneficial to add to typst-kit or typst-syntax.

I should note that I had a discussion with @Thumuss regarding manifest validation. While this is something that only 2 projects need, utpm and the package bundler, it may still be beneficial to add to typst-kit or typst-syntax.

As I said earlier on discord, utpm will need manifest validation because it will publish directly a PR on typst/packages. We don't need a big validation system, just enough to block malformed typst.toml.

I think the Typst Universe specific checks don't really belong in the compiler repository. Was that the idea or are you talking about some other kind of validation?

I was thinking of this, yeah, but there are other forms like package names being identifiers which are directly tied to how package specs are parsed.

But I guess we can leave it out.

There are some unticked boxes in the PR description. Do you still want to tackle those here? Personally, I think we can merge what's there first and proceed with the rest separately.

For project locking, I was unable to come up with anything cross-platform and safe. I left some notes on #4658 regarding those issues.

Regarding manifest validation, we decided to leave this out of typst-kit since it's universe specific.

Alright, then we can merge once you've pushed.

Alright, then we can merge once you've pushed.

One review comment is left open, do you prefer getters setters for effectively public fields?

Thank you!