Opal
Software
2026
Rust, Cargo Workspaces, oxc (AST/Parser), BLAKE3, Content-Addressed Storage, npm Registry Protocol, SemVer Resolution, Property-Based Testing (proptest), Fuzzing (cargo-fuzz/libFuzzer), GitHub Actions CI/CD, Cross-Platform Release Engineering, Benchmarking,
An all-in-one JavaScript toolkit in a single Rust binary, built on one shared module graph. Today: a beta npm-compatible package manager (install, add, remove, upgrade) with a content-addressed store, crash-safe installs, and resolution cross-checked against npm. It installs and builds its own site in production.
- Role
- Engineering
- Year
- 2026
- Type
- Software
- Live
- opalx.dev
Challenge
Replacing npm, Node, a bundler, and a test runner with one binary means four tools stop reimplementing resolution and share a single module graph — but the package-manager layer has to match npm's resolution decisions exactly before anything can be built on top of it. Package managers fail quietly rather than loudly: a version npm wouldn't have picked, a stale cache entry, a half-written lockfile after a Ctrl-C. None of those crash, and all of them cost trust long after the change that caused them.
Approach
One resolver in opal-core with no tool-specific knowledge, npm's semver dialect written by hand (the semver crate implements Cargo's, which silently resolves npm ranges differently), and a BLAKE3 content-addressed store where every write is temp file → verify → atomic rename. The node_modules linker is a reconciler that diffs opal.lock against what's actually on disk and applies only the delta, so a kill partway through is safe to resume by re-running the install. Correctness is gated by property tests, six cargo-fuzz targets on every parser of untrusted input, SIGKILL chaos tests at named and random fault points, and CI jobs that run real npm on the same fixtures and diff the resulting trees.
Outcome
Beta as of v0.4.1: 470 tests plus 28 registry-backed ones, 6/6 fixture trees identical to npm's, 12,032/12,032 version-preference cases agreeing with npm's own npm-pick-manifest, and 432 of 433 package versions identical on a 365-package Next.js scaffold. On a Next.js app a warm reinstall is 12–19× faster than npm's and a first install 1.1–1.2× faster, though a CI install from a lockfile and an empty cache is still 1.3–1.4× slower. 332 random SIGKILLs that interrupted a running install, plus 252 against the real registry, all converged on a clean tree; six fuzz targets ran about 15M executions with no open crashes. The adversarial suites paid for themselves: the fuzzer found a lockfile-injection vector, and the npm cross-check found that Opal was installing versions npm wouldn't, which reshaped the version-selection rule.