How LPM.dev Registry is different
LPM.dev Registry adds hosted private distribution, paid access, usage-based author revenue, and public-package review to the @lpm.dev/* scope. It works alongside npm and other registries through LPM CLI; it does not require every dependency in a project to come from lpm.dev.
vs npm
| Capability | npm | LPM.dev Registry |
|---|---|---|
| Default package model | Public or private, selected when publishing | Private by default; Pool and Marketplace are explicit later choices |
| Built-in package sales | Not tied to registry install access | Marketplace checkout, licenses, and install entitlements |
| Shared subscription revenue | Not built into package distribution | Pool access with usage-based author revenue |
| Source delivery | Conventional package installation | Conventional installation plus configurable source delivery with lpm add |
| Public release workflow | Standard registry publishing and moderation | New public versions remain unavailable until LPM.dev publication review approves them |
| Package information | Publisher metadata and registry metadata | Publisher metadata, server quality scoring, and post-approval source-derived enrichment |
npm remains the default source for public JavaScript dependencies in LPM CLI. Use LPM.dev Registry when a package needs private hosting, team ownership, Pool distribution, Marketplace licensing, or first-class source delivery.
vs GitHub Packages
| Capability | GitHub Packages | LPM.dev Registry |
|---|---|---|
| Ownership model | GitHub users, organizations, and repositories | LPM.dev users and organizations |
| Paid package access | No built-in package marketplace | Marketplace purchases grant install access |
| Shared subscription | No package-revenue pool | Pool subscriptions fund packages through measured usage |
| Access decisions | Package visibility and GitHub permissions | Ownership, organization membership, Pool subscription, or Marketplace license |
| Source delivery | Package artifacts | Package artifacts plus configurable source delivery with lpm add |
GitHub Packages is useful when package hosting should follow GitHub repository and organization permissions. LPM.dev Registry is designed for packages whose distribution, payment, and install access need to be one system.
vs Tidelift / Open Collective
Funding platforms support maintainers through sponsorships, subscriptions, or procurement programs. Package delivery normally remains separate from the funding relationship.
LPM.dev Registry connects funding to distribution. A Marketplace purchase grants install access to that package. A Pool subscription grants access to Pool packages and contributes to usage-based author revenue.
Public packages are reviewed before release
For Pool and Marketplace packages, a successful upload does not mean the version is live. LPM.dev Registry holds the version from consumers while publication review examines its source, lifecycle scripts, and observed behavior.
- Clean versions are approved for consumer access.
- Suspicious or inconclusive versions move to manual review.
- Malicious versions are rejected.
When an existing public package publishes a new version, consumers continue to resolve the last approved version during review. When a private package is moving to Pool or Marketplace, it remains private until the selected version is approved.
Private packages do not enter this public-package gate.
Review and enrichment are different stages
LPM.dev Registry keeps the public release decision separate from the information generated for an approved package:
- Upload-time checks validate the manifest and ecosystem, compute a quality score, and record dependency vulnerability results.
- Publication review decides whether a Pool or Marketplace version can become consumer-visible.
- Post-approval enrichment can generate a source-derived summary, security-pattern report, error-handling assessment, API documentation, AI-readable context, and search metadata.
Enrichment helps people and tools evaluate and use a package. It does not replace the publication gate, and generated output is not presented as a guarantee of correctness or security.
Source code delivery
Packages published for source delivery can place full source files directly into a consumer's project with lpm add. Authors can define configuration options and destination paths, giving consumers an explicit, reviewable copy of the code rather than access only through an installed package interface.
lpm add @lpm.dev/acme.login-formSee Source Code Delivery and Source Configuration for the package format.
LPM CLI still works with other registries
LPM CLI installs ordinary npm packages directly from npm, honors private registries configured in .npmrc, and routes only @lpm.dev/* through LPM.dev Registry by default.
See LPM CLI registry documentation for routing and authentication details.
