Publish packages to LPM.dev Registry

LPM CLI packages the project and performs local checks. LPM.dev Registry then validates the upload and decides when the version is available based on the package's distribution mode.

Package identity

LPM.dev Registry package names use @lpm.dev/<owner>.<package>:

{
  "name": "@lpm.dev/acme.design-system",
  "version": "1.0.0"
}

Context	Example
`package.json`	`@lpm.dev/acme.design-system`
Package page	`https://lpm.dev/acme.design-system`
Install command	`lpm install @lpm.dev/acme.design-system`

The owner must be your username or an organization where your role allows publishing. Package versions are immutable: increment the version before publishing again.

JavaScript packages need a valid package.json with at least name and version. Standard npm packing rules—including files, .npmignore, and always-included package metadata—control the uploaded tarball.

Preview the local package checks:

lpm publish --check

Swift

Swift publishing requires both package.json and Package.swift in the project:

{
  "name": "@lpm.dev/acme.networking",
  "version": "1.0.0"
}

lpm publish --check
lpm publish

package.json supplies the LPM.dev Registry identity and version. LPM CLI detects Package.swift and runs swift package dump-package to collect targets, platforms, dependencies, products, and the tools version.

See Packages for the JavaScript and Swift package formats. See the LPM CLI publish reference for multi-registry targets, provenance, and every flag.

Publish

lpm login
lpm publish

New packages are private. Publishing a package does not automatically list it in the Pool or Marketplace.

1. Local checks

Before upload, LPM CLI:

Validates the package name, version, project manifest, and any authored Agent Skills.
Builds the tarball and computes its integrity hashes.
Blocks potential secrets unless you explicitly accept the risk.
Computes the local quality score and enforces --min-score when supplied.

lpm publish --check
lpm publish --min-score 80

lpm publish --check is local-only. It does not verify Registry reachability, authentication, ownership, plan limits, or whether a version already exists.

2. Registry validation

LPM.dev Registry validates the request again before accepting it. These checks include:

Authentication, owner permissions, token scope, and organization billing state.
Package identity, immutable versioning, and ecosystem consistency.
Manifest and dependency metadata, distribution restrictions, and vulnerability metadata.
Account package and storage limits.
A hard limit of 100 MiB for a single uploaded tarball.

If a blocking check fails, the version is not published.

3. Availability

The next step depends on the package's distribution mode:

Distribution mode	After a successful upload
Private	The version becomes available to its owner or organization.
Pool	The version waits for publication review before Pool subscribers can install it.
Marketplace	The version waits for publication review before licensed customers can install it.

Authors cannot bypass publication review for Pool or Marketplace versions. If a public package already has an approved version, consumers continue receiving that approved version while the new upload is reviewed. A package moving from Private stays private until its selected version is approved.

Publication review inspects the uploaded source, lifecycle scripts, and behavioral signals. Clean versions can be approved automatically; suspicious or inconclusive results require manual review, and rejected versions do not become available.

4. Public-package enrichment

After a Pool or Marketplace version is approved, it can enter the public enrichment pipeline for:

Package summaries and search metadata.
Error-handling and security-pattern analysis.
Generated API documentation and AI-readable context.
Agent Skill security processing when skills are included.

This enrichment is not the publication gate. Approval happens first, and private package source is excluded from the public AI enrichment and embedding pipeline.

Publishing limits

Account	Private packages	Included package storage
Hobby	2	100 MB
Pro	Unlimited	5 GB
Organization	Unlimited	5 GB per seat

Pro and Organization accounts can continue beyond included storage with billed overage. The 100 MiB single-tarball cap applies to every account.

After publishing

Open the package page:

https://lpm.dev/<owner>.<package>

From the dashboard you can manage versions, access, package metadata, and the permanent choice between Private, Pool, and Marketplace distribution. Marketplace authors also configure pricing plans and a payment provider before public activation.