lpm download

Use lpm download to inspect package contents, save a source snapshot, or create a local fixture.

lpm download [OPTIONS] <PACKAGE>

Quickstart

# Extract a package into a separate directory
lpm download react --output inspect-react

# Select an exact version
lpm download react@19.2.4 --output inspect-react-19

# Write a non-interactive JSON result
lpm download react --version next --output inspect-react-next --json

The command downloads one archive and extracts its contents. It does not install dependencies, run scripts, or populate the package store. It does not edit project dependency declarations or lockfiles. If the archive contains package.json, that file appears inside the output directory.

Add a repeatable task

lpm.json has no dedicated download configuration. Use an uncached task for a repeated inspection command:

{
  "tasks": {
    "inspect-react": {
      "command": "lpm download react@19.2.4",
      "cache": false
    }
  }
}

lpm run inspect-react -- --output inspection-1 --json
lpm run inspect-react -- --output inspection-2 --json

Each run downloads and checks the archive. Use a separate output directory for each snapshot. An explicit task command takes precedence over a package script with the same name. See Tasks for task configuration.

Select a package and version

lpm download react@19.2.4 --output react-source
lpm download react --version '^19' --output react-19
lpm download @my-co/internal --output internal-source
lpm download @lpm.dev/owner.pkg --output registry-source

<PACKAGE> accepts a package name with an optional @version suffix. Versions can be exact versions, semver ranges, or dist-tags such as latest and next. Without a version, the command selects the registry's latest version. Use an inline version or --version. Supplying both causes an error.

LPM CLI supports npm, LPM.dev Registry, and private registries:

• @lpm.dev/* always uses LPM.dev Registry.
• Other scoped packages follow the scope's .npmrc registry mapping.
• Unscoped packages use the configured default registry, or npm when no override exists.

This command accepts package names, not arbitrary archive URLs. See Registry configuration for routing and authentication.

Output directories and collisions

--output defaults to the current directory. The archive's first path component is removed, so package files appear directly inside that directory. Use --output to keep inspection files separate from project files.

Before publication, LPM CLI verifies the archive and checks its complete contents in private temporary storage. It then checks the output paths for collisions. Existing real directories can contain unrelated files. Existing payload files, links, or other entries cause an error. The command writes regular files. It does not create archive links or empty directories. The command has no overwrite flag.

# Choose a fresh directory after a collision
lpm download react@19.2.4 --output another-inspection

Archive validation errors leave existing output files unchanged. If a write fails during publication, the error reports completed new files, new directories, and any incomplete new file. Those new entries remain in the output directory. Use a fresh directory before retrying. A file created by another process is never replaced to complete the download.

Integrity and transport

Download checks the registry's SRI hash. For legacy metadata, a valid SHA-1 dist.shasum also supplies the expected hash. Missing integrity fails before the tarball request. A hash mismatch always fails, including with --allow-unverified.

For a trusted source that supplies no hash, you can explicitly allow unverified extraction:

lpm download @my-co/legacy --output legacy-source --allow-unverified --json

This option only permits a missing hash. The result reports integrity_verified: false. Archive path and size checks still apply.

Redirects follow the registry transport policy. An HTTPS request cannot redirect to HTTP. A deliberate HTTP registry override does not permit that downgrade.

Archive limits

LPM CLI rejects unsafe paths, case-fold path collisions, and archives that exceed these limits:

These checks complete before output publication. Download and extraction use temporary files with bounded memory. The temporary archive, staged package, and output files can occupy disk space at the same time.

Firewall checks

When LPM Firewall is active, download checks eligible public npm packages after version selection. It excludes LPM.dev Registry packages and private registry packages.

monitor transfers the package while the check runs, then warns and continues. enforce finishes the check before transfer and blocks denied packages or denied entitlement. Active modes require LPM.dev Registry authentication through lpm login or LPM_TOKEN in CI.

JSON output

lpm download react@19.2.4 --output react-source --json

{
  "success": true,
  "package": "react",
  "version": "19.2.4",
  "tarball_url": "https://registry.npmjs.org/react/-/react-19.2.4.tgz",
  "integrity": "sha512-...",
  "integrity_verified": true,
  "size_bytes": 87654,
  "output_dir": "/absolute/path/react-source",
  "files_extracted": 42,
  "elapsed_secs": 0.412
}

An active firewall check can add a firewall object.

Flags

See Global flags for shared options.

See also

• lpm info
• lpm resolve
• lpm fetch
• lpm install