Copy-Paste Components Have One Fatal Flaw — Velocity X Versions Them

If you've been living under a rock: the shadcn model won. Components as source files you own, not a package you import. No breaking changes falling out of npm update, no fighting someone else's API for a padding tweak.

But the model has a known hole, and it's not a secret — once the file is in your repo, upstream improvements stop reaching you. The component you copied in January is the component you have in December. Plot twist: you've traded dependency hell for a slow fork of your entire UI layer.

The Setup

Velocity X keeps the ownership model and fixes the hole: every component is published as explicit versions, and the CLI knows which one you have.

velocityx add aspect-ratio-box@1.0.0   # exact version
velocityx info aspect-ratio-box        # every version + its access level
velocityx upgrade aspect-ratio-box     # move to current, with migration notes

A v1 and a v2 are two different components with their own source, look and props — the library counts them that way, 400+ installable versions across the set. Pick the one that fits; swap later if you change your mind.

The Money Pattern

The part that makes upgrades safe is the lockfile hash. On install, the CLI records a fingerprint of every file it wrote. On upgrade, it compares your copy against that fingerprint first:

$ velocityx upgrade standard-command-palette
✗ components/velocity/standard-command-palette/CommandPalette.tsx
  has local edits — refusing to overwrite.
  Use --force to replace, or --dry-run to preview the diff.

Your edits are yours; the CLI already told you that you own the file, so it refuses to silently take it back. Downgrade works too — pinning back to a known-good version is half the value of keeping an archive.

The Catch

The velocityx CLI itself is in preview — it isn't on npm yet, so the commands above aren't self-service today. The versioning model and archive are live; the free tier's source is public on GitHub in the meantime.

Versioning is only honest if the rules never bend, so two of them are load-bearing. A version published free is free forever — MIT can't be revoked, even when a newer version of the same component is paid. And migration notes have to tell you what actually changed, including the unglamorous stuff like theme-token meaning shifting between generations.

The Verdict

Own-your-source was the right call; frozen-in-time was the price. Versioned source with a hot-swap path is the version of this model that survives contact with year two of a real codebase. The full library ships 40 free MIT components to start with — no account, no key.