# Glossary (/docs/reference/glossary)



A reference for terms that mean something specific in LPM CLI, the LPM.dev Registry, or LPM Firewall. Sorted alphabetically.

### Add (vs. install) [#add-vs-install]

**`lpm add`** is *source delivery* — copies a package's source files into your project, like `shadcn-ui`. **`lpm install`** is *runtime dependency* — resolves and links into `node_modules/`. Not aliases. See [`lpm add`](/docs/packages/add) and [`lpm install`](/docs/packages/install).

### Auto-build [#auto-build]

The signal that triggers the rebuild step for trusted packages immediately after install completes. Sources: `lpm install --auto-build` (works on both project and `-g` installs), `lpm install --yolo` / `--policy=allow` (auto-triggers under the allow policy), or — project only — `package.json > lpm > scripts.autoBuild = true`. If a trusted lifecycle script fails, install exits non-zero. Globals don't read per-project script knobs from `package.json`, so triage with mixed-trust trees on `-g` requires the explicit `--auto-build` flag.

### Behavioral tag [#behavioral-tag]

A static-analysis flag attached to an installed package by [`lpm audit`](/docs/packages/audit) and queryable via [`lpm query`](/docs/packages/query). Examples: `:eval`, `:network`, `:fs`, `:shell`, `:child-process`, `:obfuscated`. Used to make security gates more precise than blanket version pinning.

### Capability [#capability]

A widening request a package's lifecycle scripts can declare in `lpm.scripts.{passEnv, readProject, sandboxLimits}`. Beyond the user's defaults, it requires explicit approval through [`lpm approve-scripts`](/docs/packages/approve-scripts) — the system never silently grants elevated capabilities.

### Cold install [#cold-install]

An install where neither `node_modules` nor the global store has the dep tree yet — everything is downloaded from the registry. Reported in [benchmarks](https://github.com/lpm-dev/rust-client#benchmarks) as the slowest steady-state path.

### Config-aware package [#config-aware-package]

A package whose tarball ships an `lpm.config.json` at the root. [`lpm add`](/docs/packages/add#authoring-config-aware-packages-lpmconfigjson) treats it as a configurable installer (interactive prompts, conditional file copy, conditional dep injection). Without `lpm.config.json` it's a plain source copy.

### Distribution mode [#distribution-mode]

A per-package opt-in for how the package is sold or shared on lpm.dev: **private** (default), **pool**, or **marketplace**. Orthogonal to package *type* (normal / source / Swift). All lpm.dev packages start private.

### Greedy-fusion (resolver) [#greedy-fusion-resolver]

The default resolver. Streams metadata fetches into the dispatcher. Faster than the legacy PubGrub-with-split-retry resolver; opt out with `LPM_RESOLVER=pubgrub`.

### Hoisted layout [#hoisted-layout]

LPM CLI's v2 hoisted virtual-store layout. Root direct deps are surfaced at project `node_modules/<dep>`, while package-local dependency links live inside shared store link entries. &#x2A;*Starting default for single-package projects.** Workspaces auto-default to [isolated](#isolated-layout), and default installs with incompatible peer requirements auto-switch to isolated; override per-invocation with `lpm install --linker=hoisted`, per-user with `~/.lpm/config.toml > linker`, or per-project with `package.json > lpm > linker`.

### Integrity [#integrity]

The SRI hash (`sha512-…`) recorded in the lockfile against each resolved package. Verified on every install. Drift is a hard error.

### Isolated layout [#isolated-layout]

pnpm-style strict `node_modules` — each package gets exactly the deps it declared, no phantom-dependency access. Project `node_modules/<pkg>` is a symlink into the [global content-addressable store](/docs/packages/content-addressable-store). **Default for workspaces** (when LPM CLI detects a `package.json > workspaces` glob or a `pnpm-workspace.yaml`) and for default installs where resolution detects incompatible peer requirements; otherwise single-package projects start [hoisted](#hoisted-layout).

### Lockfile [#lockfile]

`lpm.lock` (TOML, git-diffable, authoritative) plus `lpm.lockb` (binary companion) when the graph fits the binary wire format. Commit `lpm.lock` always; commit `lpm.lockb` when LPM CLI writes it. See [Lockfile format](/docs/reference/lockfile-format) and [Lockb format](/docs/reference/lockb-format).

### lpm.dev [#lpmdev]

The LPM.dev Registry monetization layer. Hosts private, pool, and marketplace packages under the `@lpm.dev/` scope. **LPM CLI is registry-agnostic** — lpm.dev is one of several registries it can talk to. See [Registries](/docs/registries).

### Marketplace package [#marketplace-package]

A distribution mode where installs require a license purchase. Per-package opt-in.

### MCP [#mcp]

[Model Context Protocol](https://modelcontextprotocol.io). The LPM.dev Registry ships an MCP server that AI editors can wire up via [`lpm mcp setup`](/docs/reference/mcp-servers).

### Minimum release age [#minimum-release-age]

Cooldown (default 24h) before a freshly published version is installable. On project installs, LPM CLI enforces it for direct/root dependency versions by default; `minimumReleaseAgePolicy: "strict"` / `release-age-policy = "strict"` also checks transitive dependencies and lockfile replays. For ranges, LPM CLI skips too-new checked candidates and can pick an older satisfying version; exact checked pins to too-new versions fail. Tunable via `lpm install --min-release-age` (works on both project and `-g`), `package.json > lpm > minimumReleaseAge` (project only), or `~/.lpm/config.toml > minimum-release-age-secs` (machine-wide, applies to project and `-g`). Bypass per-invocation with `--allow-new`, or exempt exact canonical package names with `--min-release-age-exclude`, `package.json > lpm > minimumReleaseAgeExclude`, or `~/.lpm/config.toml > minimum-release-age-exclude`.

### npm-alias dep [#npm-alias-dep]

A dep declared like `"my-react": "npm:react@^19.0.0"`. Local name (`my-react`) diverges from the canonical target (`react`). Tracked in lockfiles via `alias-dependencies` and `root-aliases`. Disables the binary lockfile (TOML-only).

### Plugin [#plugin]

A versioned, lazy-downloaded tool that backs one of LPM CLI's built-in commands — Oxlint powers [`lpm lint`](/docs/dev/lint), Biome powers [`lpm fmt`](/docs/dev/fmt), and Rolldown powers [`lpm bundle`](/docs/dev/bundle). First use downloads and verifies the tool into LPM CLI's global cache; the same machine reuses the verified copy across projects. Pin versions per-project in `lpm.json > tools`; manage installed plugins with [`lpm plugin`](/docs/dev/plugin) (`list`, `outdated`, `update`, `remove`). Tools that aren't plugin-backed, such as `tsc` via [`lpm check`](/docs/dev/check) or `tsdown` via [`lpm pack`](/docs/dev/pack), stay project-owned.

### Pool package [#pool-package]

A distribution mode where the package's metadata is public but installs are gated to pool subscribers. Publisher earns a share of the pool's revenue. Per-package opt-in.

### Provenance [#provenance]

Sigstore-signed attestation that proves which CI workflow built a tarball and which commit it came from. Generated at publish time with `lpm publish --provenance`. Verified at install / audit time.

### Provenance drift [#provenance-drift]

A change in a package's publisher identity between a prior approval and a candidate version. LPM CLI blocks installs on drift on both project and `-g` paths; opt out per-package via `lpm install --ignore-provenance-drift <pkg>` or fully via `--ignore-provenance-drift-all`. The reference snapshot is captured into the trust binding's `provenanceAtApproval` field at `lpm approve-scripts` time (or `--global` time for the global trust file).

### Quality score [#quality-score]

Per-package score (0–100) computed from readme / license / types / tests / maintenance signals. Run [`lpm quality`](/docs/packages/quality) to view; gate publishing with `lpm publish --min-score N`.

### Rebuild [#rebuild]

The dependency lifecycle-script step of the install pipeline. The executed dependency phases are `preinstall`, `install`, `postinstall` (in that order); dependency `prepare` and `prepublishOnly` are recognized for detection but never executed. Default-deny: dependency scripts don't run during `lpm install` (or `lpm install -g`) and require approval via [`lpm approve-scripts`](/docs/packages/approve-scripts) (project) / `lpm approve-scripts --global` (global) or a non-default [script policy](/docs/packages/install#lifecycle-scripts). Bare project installs have a separate root lifecycle runner for `pnpm:devPreinstall`, `preinstall`, `install`, `postinstall`, `preprepare`, `prepare`, and `postprepare`. The standalone `lpm rebuild` command targets the project; a `lpm rebuild --global` companion is a planned follow-up — until then, reinstalling the affected global is the post-approval rerun path.

### Sandbox [#sandbox]

The OS-level containment LPM CLI runs lifecycle scripts inside: Seatbelt on macOS, landlock on Linux, AppContainer on Windows. Three modes: **default** (filesystem containment + env scrubbing; outbound network allowed), **strict** (also denies outbound network), **none** (no containment; full host access including credential env). Set per-invocation with `lpm install --strict-sandbox` / `--paranoid` (alias) / `--no-sandbox`; persistently with `[sandbox] mode` in `~/.lpm/config.toml` (or `LPM_STRICT_SANDBOX=1` for strict). Setup wizard: [`lpm config sandbox`](/docs/infra/config#setup-wizards). Packages can request capability widening (extra write roots, env vars) via the [`lpm.scripts`](#capability) block in `package.json`, but widening requires explicit approval through [`lpm approve-scripts`](/docs/packages/approve-scripts).

### Save policy [#save-policy]

The rule that decides what range gets saved to `package.json` when `lpm install <pkg>` finishes. Defaults to `^resolvedVersion`. See [Save policy](/docs/packages/save-policy).

### Script policy [#script-policy]

`deny` (default) / `allow` / `triage`. Governs whether and how dependency lifecycle scripts run on both `lpm install` and `lpm install -g`; it does not gate the root project's bare-install lifecycle. Set per-invocation with `--policy` / `--yolo` / `--triage`, per-project with `package.json > lpm > scriptPolicy` (project installs only), per-user with `~/.lpm/config.toml > script-policy` (applies to both project and `-g`). On `-g` the project-config tier is N/A; the chain collapses to CLI flag > `~/.lpm/config.toml` > default. Setup wizard: `lpm config scripts`.

### Skill (agent skill) [#skill-agent-skill]

A Markdown file that teaches an AI agent how to use a package or workflow. Package authors publish LPM.dev package skills that extract into `.lpm/skills/<package>/` during [`lpm install`](/docs/packages/install) and [`lpm add`](/docs/packages/add) (skip with `--no-skills`). The LPM CLI also manages standalone standard `SKILL.md` sources from GitHub or local directories through [`lpm skills`](/docs/packages/skills). Package-published skills follow LPM.dev publishing validation; standalone sources are commit-pinned and security-scanned before installation. See [AI agent skills](/docs/reference/ai-agent-skills) for the full model.

### Triage advisor [#triage-advisor]

`none` (default) / `claude-cli` / `codex` / `ollama`. Optional LLM advisor for the [triage gate](/docs/packages/security-audit#optional-llm-advisor) — only active when script policy is `triage`. Set per-project with `package.json > lpm > triageAdvisor`, per-user with `~/.lpm/config.toml > triage-advisor`. Independent of script policy. Approvals are **ephemeral** — never written to disk — so a second install invokes the advisor again. Setup wizard: `lpm config triage`.

### Source package [#source-package]

A package whose tarball ships an `lpm.config.json` at the root — `lpm add` treats it as a configurable installer. Status is **content-based** (the file's presence), not naming or registry.

### Store [#store]

The global content-addressable package store at `~/.lpm/store/v2/`. One on-disk copy per content hash (`objects/`), shared across every project on the machine via per-graph link entries (`links/`). Project `node_modules/<pkg>` is a **symlink** into the matching link entry; the link entries themselves materialize from objects via clonefile (macOS) or hardlinks (Linux). Maintained by [`lpm store`](/docs/infra/store); see [Content-addressable store](/docs/packages/content-addressable-store) for the full mechanism.

### Trusted dependency [#trusted-dependency]

A package on a trust allowlist that's permitted to run lifecycle scripts under `scriptPolicy: "deny"`. Project trust lives in `package.json > lpm > trustedDependencies` (legacy array of names, or rich map bound to integrity + script hash). Global trust lives in `~/.lpm/global/trusted-dependencies.json` (rich map only, with an extra `provenanceAtApproval` snapshot used by the install-time drift gate). The two stores are independent — `lpm approve-scripts` writes the former, `lpm approve-scripts --global` writes the latter.

### Tunnel claim [#tunnel-claim]

Pro/Org-only — registering a stable tunnel domain so subsequent `lpm dev --tunnel` and `lpm tunnel` runs serve from the same URL. Free users get an ephemeral random domain on every run.

### Up-to-date install [#up-to-date-install]

An `lpm install` invocation that detects nothing has changed (mtime fast path) and exits in a few ms without doing any work. Reported in [benchmarks](https://github.com/lpm-dev/rust-client#benchmarks) as `~14 ms`.

### Warm install [#warm-install]

An install where the global store and lockfile are present but `node_modules` is missing. The install rebuilds `node_modules/` from already-extracted store entries — no downloads, no resolution. Reported in [benchmarks](https://github.com/lpm-dev/rust-client#benchmarks) as `~387 ms`.

### Workspace [#workspace]

A monorepo declared via `package.json > workspaces` (npm/yarn array form, or yarn-style object form). LPM CLI walks the globs, builds a topological graph, and exposes member-targeting via `--filter` and `-w`. See [Workspaces](/docs/packages/workspaces).