lpm download

lpm download <package[@version]> [--version <V>] [--output <DIR>]

Fetches a package tarball and extracts it into a directory you choose. No lockfile, no node_modules, no script execution, no package.json mutation. Just the bytes.

Useful for inspecting a package's contents before you trust it, archiving a snapshot for offline reference, generating a fixture, or reading the source of a package you don't want to install.

Routing matches lpm install:

• @lpm.dev/* fetches from lpm.dev.
• @scope/pkg follows the current project's .npmrc @scope:registry=... mapping when one exists.
• Unscoped names (react, zod, lodash.merge) use the current project's default .npmrc registry, or npmjs.org when no override is present.

If you specifically mean an lpm.dev package, prefer the fully scoped @lpm.dev/owner.pkg form.

Examples

lpm download react                                   # npmjs.org (or project .npmrc default registry)
lpm download react@0.14.3                            # npm-style inline version
lpm download @my-co/internal                         # project .npmrc scoped registry
lpm download @lpm.dev/owner.pkg                      # force lpm.dev
lpm download @lpm.dev/owner.pkg --version 2.1.0      # a specific version
lpm download react --version next                    # dist-tag or semver range
lpm download @lpm.dev/owner.pkg --json               # structured output (URL, integrity, paths)

How it works

1. Fetches the package metadata from the routed registry to find the tarball URL and SRI integrity hash for the requested (or latest) version.
2. Downloads the tarball.
3. Verifies the SRI hash when the registry ships one. If the registry does not ship integrity, lpm download refuses to extract by default; re-run with --allow-unverified only when you intentionally accept an unverified tarball.
4. Extracts into the output directory.

The output directory defaults to the current working directory. The tarball's top-level package/ is unwrapped during extraction (equivalent to tar x --strip-components=1), so you get the package contents directly.

What lpm download does NOT do

• Install dependencies — none of the package's dependencies are fetched
• Touch package.json or any lockfile
• Run lifecycle scripts (preinstall, postinstall, etc.)
• Place the result in node_modules/
• Update the global content-addressable store

For a real install, use lpm install. For source delivery into your project, use lpm add.

Flags

Plus the global flags.

--json envelope

{
  "success": true,
  "package": "@lpm.dev/owner.pkg",
  "version": "2.1.0",
  "tarball_url": "https://lpm.dev/api/registry/@lpm.dev/owner.pkg/-/owner.pkg-2.1.0.tgz",
  "integrity": "sha512-...",
  "integrity_verified": true,
  "size_bytes": 87654,
  "output_dir": "/abs/path/to/output",
  "files_extracted": 42,
  "elapsed_secs": 0.412
}

Fields:

See also

• lpm install — full install, with node_modules and lockfile
• lpm add — source delivery into your project
• lpm info — package metadata without downloading
• lpm resolve — print the resolved dep tree without downloading