lpm.toml reference

Configure project save rules, workspace execution, dependency checks, and lifecycle sandbox defaults.

lpm.toml stores project defaults for LPM CLI. Use it for dependency save rules, workspace commands, and lifecycle sandbox settings.

lpm.toml

save-exact = true

[workspace]
concurrency = 4

With this configuration, lpm install saves exact versions. Workspace lpm run commands run at most four packages concurrently.

Location and scope

Place the file beside the relevant package.json. Commit it to share defaults and policy exceptions with the team. Keep personal preferences in config.toml. See Files LPM CLI creates.

Workspace execution reads the workspace root's file. Package save rules use the install target's file. No general parent-directory merge combines these files.

File	Purpose
`lpm.toml`	Project defaults described here
package.json > lpm	Dependency layout, resolution, and lifecycle policy
lpm.json	Runtime, tasks, development services, publishing, and environments
config.toml	User defaults across projects

A missing file supplies no project overrides. Consumers reject malformed TOML and invalid values for the fields they read. Unknown fields do not activate behavior. LPM CLI limits this file to 16 MiB before parsing.

Use lpm config to inspect effective values and their sources:

lpm config list --json

The generic configuration setter writes the user file. Edit lpm.toml directly for project defaults.

Save policy

save-prefix = "~"
save-exact = false

Key	Type	Default	Behavior
`save-prefix`	`"^"`, `"~"`, or `""`	`"^"`	Prefix for newly saved resolved versions. An empty string saves exact versions.
`save-exact`	Boolean	`false`	Save exact versions regardless of `save-prefix`.

For save-policy booleans, the strings "true", "1", and "yes" mean true. "false", "0", and "no" mean false. Use native TOML booleans in new files.

Each key resolves independently: project file, user file, then its default. Explicit save flags override that configuration for one invocation:

lpm install react --exact
lpm install react --tilde
lpm install react --save-prefix '^'

Explicit ranges, existing dependency entries, and catalogs have additional rules. See Save policy.

Workspace execution and changed files

[workspace]
concurrency = 4
changed-files-ignore-pattern = ["**/README.md", "docs/**"]
test-pattern = ["**/*.test.js", "**/*.spec.ts"]

Key under `workspace`	Type	Default	Behavior
`concurrency`	Positive integer	Available host parallelism	Maximum concurrent packages for workspace run, test, and bench commands.
`changed-files-ignore-pattern`	String or string array	`[]`	Ignore matching Git-diff paths before selecting affected packages.
`test-pattern`	String or string array	`[]`	Treat matching changed files as test-only changes.

A test-only package remains selected. Its change does not seed the reverse dependency closure for affected-package selection.

Concurrency resolves from --workspace-concurrency, this file, user workspace-concurrency, then available host parallelism. A positive decimal string is also accepted in either configuration file.

CLI pattern flags append to project patterns for the current invocation. They do not replace those lists.

lpm run build --all --workspace-concurrency 2
lpm run test --affected --changed-files-ignore-pattern 'docs/**'

See Workspaces for Git-ref filters and package selection.

Sandbox

[sandbox]
mode = "strict"
allow-degraded = false

Key under `sandbox`	Type	Default	Behavior
`mode`	`"default"`, `"strict"`, or `"none"`	`"default"`	Requested dependency lifecycle sandbox mode.
`allow-degraded`	Boolean	`false`	Permit a reduced sandbox when the host cannot provide the requested containment.

Mode precedence is CLI flags, true LPM_STRICT_SANDBOX, project file, user file, then the default. False or invalid environment values do not override a configured mode. --strict-sandbox and --paranoid request strict mode. --no-sandbox requests no sandbox.

allow-degraded accepts the same boolean strings as save policy.

The project file proposes a posture. It cannot authorize weaker protection than the approved machine floor. An unauthorized reduction fails with security_approval_required. Managed policy can prohibit the reduction entirely.

Use lpm security for an approved temporary exception. Use lpm config for a persistent machine change.

Tidy ignores

[tidy]
ignore-unused = ["eslint-config-next"]
ignore-phantom = ["virtual:*"]
ignore-paths = ["generated/**"]

Key under `tidy`	Matches	Behavior
`ignore-unused`	Package-name globs	Suppress matching unused dependency findings.
`ignore-phantom`	Package-name globs	Suppress matching undeclared-import findings.
`ignore-paths`	Project-relative source paths	Exclude matching source files from import analysis.

Each key accepts a string or string array and defaults to []. These project-only rules apply to lpm tidy report and fix modes. They do not grant lifecycle trust or alter dependency resolution.

lpm tidy --json

Typosquat policy

[[policy.typosquat.allow]]
package = "axois"
similar-to = "axios"
reason = "Intentional internal compatibility package"

Entry field	Required	Behavior
`package`	Yes	Exact direct dependency name to allow.
`similar-to`	No	Restrict the exception to this detected popular-package match.
`reason`	Yes	Nonempty explanation for the exception.

Malformed policy sections, empty package names, and non-string match constraints fail before installation. The list defaults to empty. When typosquat checks are active, lpm install and lpm add consult these exceptions. similar_to is a compatibility alias for similar-to. Use only one form. Omitting similar-to allows the named package regardless of which popular package it resembles.

When you choose to allow a suspicious name at the lpm install prompt, LPM CLI asks for a reason and appends an entry here. It replaces the file atomically and keeps its permissions. An lpm.toml that is a symbolic link is refused. Commit the change so teammates and CI share the exception.