lpm quality

lpm quality reads the stored quality report for a package on LPM.dev Registry.

lpm quality [OPTIONS] <PACKAGE>

Use it to inspect a published package's score and failed checks without an installation. It does not scan your working directory, run tests, or calculate a new report.

Quickstart

lpm quality @lpm.dev/owner.widget

The command has one mode and no version selector. package@version, version ranges, and npm package names are not supported.

LPM CLI supports npm and private registries for package installation. This command uses the LPM.dev Registry quality API. See Registries.

Examples

lpm quality owner.widget
lpm quality owner.widget --json
lpm quality owner.widget --json | jq '.checks[] | select(.passed == false)'

For a private package, sign in as an authorized publisher:

lpm login
lpm quality @lpm.dev/owner.private-widget

See lpm login for authentication. For an unattended report, provide an authorized token through the environment:

LPM_TOKEN="$REGISTRY_TOKEN" lpm quality owner.private-widget --json

A task in lpm.json

lpm.json has no dedicated quality-report configuration. A named task can read the current report on each run:

{
  "tasks": {
    "quality-report": {
      "command": "lpm quality @lpm.dev/owner.widget",
      "cache": false
    }
  }
}

lpm run quality-report
lpm run quality-report -- --json

The second command requests JSON for that run. The task does not create or update quality data. See lpm run.

Which report you receive

Public reports allow anonymous access. Private reports require publisher access for the package. For private packages, unavailable access can appear as not_found to protect package names.

The Registry selects its current consumer release for public readers. For authorized publishers of non-Free packages, it can select the current publisher release, including a release still under review. Free default reads use the consumer release even with publisher credentials. The response includes a publication date, but no package version identifier.

A stored browser session can refresh after rejected access. Tokens supplied through --token or LPM_TOKEN do not refresh automatically. See Authentication.

The report can change without a new publication. The Registry removes maintenance points after the selected release exceeds 90 whole days in age.

Read the score and checks

The human report shows a score, tier, ecosystem, and a flat list of checks. Failed checks include their available points and any improvement detail.

A score of zero is a valid report. A low score or failed check does not cause a nonzero exit status.

The LPM.dev Registry owns the check definitions and point limits. Client-supplied scores, weights, and duplicate checks cannot add points. Checks without server evidence earn zero points.

Approved skills add seven points. Three or more approved skills add another three points. Skills awaiting public security review do not earn these points, including during review retries. Private packages use static skill validation until public distribution activates.

lpm publish runs the locally available checks before an upload to LPM.dev Registry. Checks that require Registry analysis remain pending until processing completes. The final score can differ from local preflight.

JSON output

lpm quality owner.widget --json

Each check includes id, category, label, passed, points, maxPoints, and detail. Missing optional check fields appear as null. The CLI retains the existing maxScore and maxPoints spellings for compatibility.

If no report exists, the command succeeds with available: false, a message, and an empty check array. A failed request returns success: false with error and error_code.

Require an available score in CI

set -o pipefail
lpm quality owner.widget --json | jq -e '.success and .available and (.score >= 70)'

This example fails when the lookup fails, the report is unavailable, or the score is less than 70. The command itself has no minimum-score flag. For a local publication gate, see the --min-score option in lpm publish.

Recovery

Quality warnings during installation

lpm install can show optional quality warnings. These lookups use available credentials without refreshing a session. Missing reports and unavailable scores do not become zero-score warnings. A recorded score of zero remains a valid warning. Explicit lpm quality requests can still recover an expired session.

Flags

This command has no command-specific flags.

LPM_TOKEN and LPM_REGISTRY_URL provide the token and Registry defaults. Explicit flags override these environment values for one run. See Global flags.

See also

• lpm publish — local quality checks and publication gates.
• lpm skills — skill installation and author validation.
• lpm info — package metadata.
• lpm audit — installed-package security checks.