What is LPM.dev Registry?

LPM.dev Registry is a hosted package registry for private, Pool, and Marketplace packages. It supports JavaScript and Swift packages under the @lpm.dev/* scope and includes access control, licensing, author payouts, and team ownership.

LPM.dev Registry and LPM CLI

LPM CLI is the lpm executable that runs on your machine. It installs packages, writes lockfiles, manages workspaces, runs development tools, and connects to package registries.

LPM CLI is registry-agnostic:

Unscoped npm packages use registry.npmjs.org by default.
Private npm-compatible registries are read from .npmrc.
@lpm.dev/* packages route through LPM.dev Registry for access control, Pool attribution, and Marketplace licensing.

LPM.dev Registry is the hosted service. LPM CLI is the client you use to work with it.

Private by default

Every package starts private. Publishing does not automatically list a package or make it available for purchase.

Mode	Who can install	How authors earn
Private	The owner or members of the owning organization	Not applicable
Pool	Active Pool subscribers	Usage-based share of Pool subscription revenue
Marketplace	Users or organizations with an active license	Direct package sales

Moving a package from Private to Pool or Marketplace is an explicit, permanent choice. A Pool or Marketplace package cannot later return to Private or switch to the other public mode.

What happens when you publish

The upload pipeline validates the package identity and manifest, verifies the declared ecosystem, computes the server quality score, and records dependency vulnerability results.

Private and public distribution then follow different paths:

Private versions become available to their owner or organization after the upload completes. They do not enter the public-package publication gate or public discovery pipeline.
Pool and Marketplace versions wait for publication review. A successful upload is not yet a public release. If an approved version already exists, consumers continue to receive it. A package moving out of Private remains private until approval.
Publication review examines the uploaded source, lifecycle scripts, and observed behavior. Clean versions are approved. Suspicious or inconclusive versions require manual review, and malicious versions are rejected.
Approved public versions enter the enrichment pipeline. LPM.dev Registry can generate package summaries, error-handling analysis, API documentation, AI-readable context, and search metadata from the approved source.

Publication review controls whether a public version can be installed. Post-approval enrichment helps people and tools understand the package; it is not the publication decision or a guarantee that the package is free of defects.

Install packages

lpm install @lpm.dev/acme.design-system

Standard packages install through lpm install. Packages published for source delivery can copy configurable source files directly into your project:

lpm add @lpm.dev/acme.login-form

Publish your own package with:

lpm login
lpm publish

See the LPM CLI documentation for installation behavior, registry configuration, command flags, lockfiles, and workspaces.

Hosted developer platform

LPM.dev Registry also provides hosted services around the package workflow:

Organizations — Team-owned packages, member roles, shared licenses, tokens, webhooks, and audit logs.
Environments and Secrets — Local secret storage, encrypted cloud sync, organization sharing, deployment-platform pushes, and OIDC in CI.
Tunnels — Public URLs for local services, stable claimed domains, access controls, and webhook inspection.