Your first install

This page assumes you have LPM CLI installed. It will walk through installing a real package and getting a feel for how LPM CLI lays things out.

A new project from scratch

mkdir hello-lpm && cd hello-lpm
lpm init -y

lpm init -y creates a minimal package.json. Without -y it prompts for package target, name, version, and a few defaults. The default target is an LPM.dev Registry package; use lpm init --npm when the package itself should be npm-compatible.

Install a dependency

lpm install zod

  ● Resolved  1 dep, 0 transitive  (88 ms)
  ● Linked    hoisted layout        (12 ms)

  + zod  ^4.3.6

Open package.json — zod is now under dependencies with a caret range:

{
  "dependencies": {
    "zod": "^4.3.6"
  }
}

LPM CLI's save policy writes ^resolvedVersion by default. To save exact, append --exact (or set save-exact = true in ~/.lpm/config.toml).

Two new files appear next to your package.json:

• lpm.lock — human-readable, git-diffable lockfile. Commit this.
• lpm.lockb — generated binary companion when the graph fits the binary format. Commit this too when it appears.

node_modules/ starts hoisted by default in LPM CLI's v2 virtual-store layout. Root direct deps are exposed at project node_modules/<dep>; transitive/package-local links live inside shared store entries. Workspaces auto-flip to isolated (pnpm-style symlinks), and default installs with incompatible peer requirements auto-switch to isolated. Override per-invocation with --linker=isolated|hoisted.

Install everything from a manifest

If you cloned a project that already has a package.json:

lpm install

Resolves and installs every dep declared in package.json. If lpm.lock exists and is consistent with the manifest, the install is reproducible — the lockfile pins every transitive version and integrity hash.

Run a script

Add a script to package.json:

{
  "scripts": {
    "hello": "echo 'hi from lpm'"
  }
}

lpm run hello
# hi from lpm

Or just lpm hello — lpm falls through to scripts as a top-level command, like npm run shorthand.

Look around the global store

Every package LPM CLI downloads goes into a single content-addressable store at ~/.lpm/store/. Subsequent installs across other projects reuse the same on-disk copy via clonefile (macOS) or hardlinks (Linux), so a fresh lpm install of the same dep set is essentially free in disk and time.

lpm store verify        # fast structural check (pass --deep for lockfile-backed SRI verify)
lpm cache prune         # preview orphan entries no project references
lpm cache prune --apply # actually remove them

See Content-addressable store for the design.

What now