Packages
Install, publish, audit, and manage dependencies — plus the resolver, lockfile, store, and security model behind them.
LPM CLI's package-management surface. The CLI commands are listed first; the deeper-dive concept pages explaining how the resolver, lockfile, store, save policy, and security gates fit together come below.
For an end-to-end walkthrough, see Publishing your first package or Migrating from npm.
Install + dependency management
lpm install
Install dependencies from package.json, or add new ones. The foundational command.
lpm uninstall
Remove from dependencies and node_modules.
lpm add
Source delivery — copy a package's source into your project (any registry).
lpm remove
Reverse of lpm add — remove source-delivered files.
lpm global
Manage globally-installed CLIs under ~/.lpm/global/.
lpm cache
Ephemeral caches + reference-aware prune of the global store.
lpm upgrade
Bump eligible LPM.dev Registry and npm deps to their latest matching range.
lpm outdated
Show dependencies with newer versions available.
lpm patch
Patch dependencies locally with integrity binding.
Publish, search, discover
lpm init
Create a new LPM.dev Registry or npm-compatible package manifest.
lpm version
Bump package.json version, with optional git commit/tag and JSON plans.
lpm release
Plan, apply, and publish workspace releases in dependency order.
lpm publish
Publish to LPM.dev Registry (or --npm / --github / --gitlab). Provenance, quality gates, secret scan.
lpm stage
Stage, inspect, approve, or reject npm staged publishes.
lpm search
Search LPM.dev Registry.
lpm info
Metadata for npm, custom-registry, or LPM.dev Registry packages.
Security + tools
lpm audit
Vulnerability + behavioral audit. OSV + behavioral analysis tags.
lpm tidy
Find unused dependency declarations and phantom imports.
lpm query
CSS-like selector queries on installed packages — precision gates for CI.
lpm graph
Render the dependency graph as tree, DOT, Mermaid, JSON, stats, or HTML.
lpm sbom
Export CycloneDX or SPDX SBOMs from lpm.lock.
lpm licenses
Inventory dependency licenses and fail CI on compliance policy.
lpm trust
Manage trustedDependencies — list, diff, prune.
lpm rebuild
Run lifecycle scripts (the deferred step of install).
lpm approve-scripts
Approve packages blocked by the default-deny lifecycle script policy.
Migration + inspection
lpm migrate
Convert from npm / pnpm / yarn / bun. Backups + rollback.
lpm catalog
Inspect catalog usage and resolved lockfile snapshots.
lpm fetch
Populate the package store from lpm.lock without installing.
lpm download
Download and extract a tarball with no install side-effects.
lpm resolve
Print a resolved dependency tree without installing.
Specialized integrations
lpm pool
Pool revenue stats with per-package weighted downloads.
lpm quality
Quality report for an LPM.dev Registry package.
lpm swift-registry
Configure SPM to install LPM.dev Registry-hosted Swift packages (SE-0292).
lpm skills
Manage package-published and standalone AI agent skills.
Features (concept pages)
Resolver
Greedy-fusion by default, with PubGrub as the documented opt-out.
Lockfile
Authoritative lpm.lock TOML plus lpm.lockb when the graph fits the binary format.
Content-addressable store
One on-disk copy per content hash; per-graph link entries; shared across projects.
Save policy
How version ranges land in package.json — caret default, explicit preservation, prerelease safety.
Security & audit
Defense in depth — script policy, behavioral analysis, OSV, provenance, typosquatting, triage gate.
Workspaces
Monorepo support — declaration, filter grammar, workspace:* protocol, catalogs, deploy.
npm compatibility
What works the same as npm, what's different, and what LPM CLI adds.
Swift Package Registry (SE-0292)
The SE-0292 implementation — identity mapping, signing, trust model.