---
title: "StudioMeyer Academy Use packages safely"
description: "Approval, file hashes, installation plans and updates that protect your work."
canonical: "https://studiomeyer.academy/en/developers/paketformat"
language: en
markdown_versions: ["https://studiomeyer.academy/entwickler/paketformat.md", "https://studiomeyer.academy/en/developers/paketformat.md", "https://studiomeyer.academy/es/entwickler/paketformat.md"]
publisher: "StudioMeyer Academy, https://studiomeyer.academy (llms.txt: https://studiomeyer.academy/llms.txt)"
---

## Approval before files

The public approved installation-package catalog is currently empty. A private library is not a public package source. Never assume a license. Without an explicitly approved package there is nothing to install.

The package mechanism returns a JSON installation plan, not an executed installation. GET /v1/me/installs lists tracked plans and does not confirm files installed on your device. The server cannot see your filesystem.

## Response and lockfile

The actual response contains status: plan, files and lockfile. Each file has relativePath, content, sha256 and executable. The lockfile contains schemaVersion: 1 and entries. Entries have id, version, status, access, sha256, license, source and installedAt. access is free or premium; installedAt may be null. The JSON schema is authoritative, not an older YAML draft.

```
{
  "status": "plan",
  "files": [],
  "lockfile": {
    "schemaVersion": 1,
    "entries": []
  }
}
```

- [JSON Schema](https://studiomeyer.academy/v1/schema/package.json)

## Status and consent

Only active may automatically enter an authorized plan. candidate needs consentCandidate: true; draft needs consentDraft: true and remains visibly a draft. deprecated is not installed and points to a successor. Executable scripts separately require consentScripts: true after inspection. Premium requires the matching entitlement first; the lockfile grants no access by itself.

## Observe files before replacing them

Send lockfile and observedFiles with { id, relativePath, sha256: string | null } entries for update checks. Use each existing file’s actual SHA-256 and null for a missing file. The service compares observations with approved historical file snapshots; a lockfile hash alone is insufficient.

Only fully observed unchanged files yield localChanges: false and verification: unchanged. Actual differences yield true/modified; missing observations yield null/unverified. modified and unverified block replacement. Show the conflict and obtain a separate decision. Recheck all paths and hashes immediately before every local write, even after an unchanged response.

## Sitemap

Public pages of this site as Markdown: [sitemap](https://studiomeyer.academy/sitemap.md). Curated entry point: [llms.txt](https://studiomeyer.academy/llms.txt), full text: [llms-full.txt](https://studiomeyer.academy/llms-full.txt).