jpm¶

ID: jpm
Home page: https://github.com/janet-lang/jpm
Platforms: 🐧 Linux · 🍎 macOS · 🪟 Windows
Operations: install · upgrade_all · remove · sync · cleanup
purl types: pkg:jpm
CLI name: jpm
Issues and PRs: 📦 manager: jpm
Source: meta_package_manager/managers/jpm.toml

jpm is the Janet Project Manager, installing Janet modules from the janet-lang/pkgs listing.

Parsing notes, verified against jpm shipped with Janet 1.41.2 on macOS:

jpm reports no version of its own. jpm --version does not merely go unrecognised, it fails: “error: unknown cli option version”. jpm ships with Janet and is versioned with it, so the probe reads the interpreter it sits beside, which is what version_cli exists for.
No inventory: jpm has no listing command of any kind, so installed and outdated are not declared and mpm auto-skips them. There is no search either. What remains is the mutating surface plus a sync and a cache purge.
Scope is global by default, and stays that way wherever mpm is invoked from: the local ./jpm_tree is reached only through the explicit --local flag (cli.janet), never by a project.janet sitting in the working directory. The one override left is the JANET_TREE environment variable (config.janet), which a user sets deliberately and mpm therefore honours.
No sudo is forced. Writing to the module tree is privileged only where that tree is root-owned, which depends on how Janet was installed rather than on the operation: a Homebrew prefix needs none, a system one does. Forcing it would break the first case, and omitting it fails loudly in the second.

What `mpm` adds to `jpm`¶

mpm reaches across every manager at once, not jpm alone: mpm installed and mpm outdated cover jpm alongside every other manager you run in one table, mpm upgrade --all updates them together, and mpm sbom exports the whole machine as one bill of materials.

Every mpm command also gains --dry-run and --plan previews, cross-scheme version comparison and purl identifiers. See manager augmentations for how each one is built.

Your `jpm` commands, in `mpm`¶

You already know jpm: each operation maps one-to-one onto mpm, in an interface shared by every manager.

To…	With `jpm`	With `mpm`
Install a package	`jpm install <package_id>`	`mpm install pkg:jpm/<package_id>`
Upgrade everything	`jpm update-installed`	`mpm --jpm upgrade --all`
Remove a package	`jpm uninstall <package_id>`	`mpm remove pkg:jpm/<package_id>`
Clear caches	`jpm clear-cache`	`mpm --jpm cleanup --cache`

Prefix any command above with --dry-run to simulate the underlying manager calls without touching the system: the safe way to watch what mpm would do before trusting it.

Operations¶

Operation	Supported
`installed`
`outdated`
`orphans`
`search`
`install`	✓
`upgrade`
`upgrade_all`	✓
`remove`	✓
`sync`	✓
`cleanup`	✓
`doctor`

Selecting and configuring `jpm`¶

Deselect jpm for a single run with --no-jpm, or persist the choice in your configuration:

[mpm]
jpm = false

Keep it enabled but tune how mpm drives it with a per-manager override:

[mpm.managers.jpm]
timeout = 900

mpm config-template jpm prints every overridable attribute as a ready-to-paste block.

Recipes¶

A few jobs you would otherwise script around jpm, one mpm command each:

Snapshot and clone a machine: mpm --jpm dump jpm.toml, then mpm restore jpm.toml on the next one.
Export a compliance SBOM: mpm --jpm sbom (CycloneDX by default, --spdx for SPDX).

Privilege escalation¶

mpm runs this manager as the current user and never prepends sudo by default. Flip the policy for its privileged operations with --sudo or the per-manager sudo override.

None of its operations needs root.

See privilege escalation for the full policy.

Cooldown¶

State of jpm’s release-age gating, from the cooldown support table:

Status: ❌ None

A cooldown only pays off where a compromised release can be withdrawn while the clock runs, and can only be emulated where the registry dates its releases. From the retraction table:

Registry: Janet package listing
Retraction: Index revert: the listing is a single curated pkgs.janet in janet-lang/pkgs mapping a symbol to a git URL, so withdrawal is a pull request dropping the entry; the code lives in third-party repositories that can vanish under it
Publish date: ❌ the listing pairs a name with a URL and nothing else, carrying no versions and so no dates; a package’s versions are the git tags of the repository it points at

With --cooldown set, mpm skips this manager’s install and upgrade operations rather than run them unguarded (fail-closed); --allow-unsupported-managers opts back in.

Version probe¶

The version is probed by running:

$ janet -v
1.41.2-homebrew

and extracted with:

r"^(?P<version>\d+\.\d+\.\d+)"

Changelog¶

8.0.0.dev0 (unreleased)
- Add jpm package manager as a bundled definition, with install, remove, upgrade --all, sync and cache cleanup support. It reports no version of its own, so the probe reads the Janet interpreter it ships beside. No listing command exists, so no inventory is declared.