About us

What is BPM?

BPM is a fast, deterministic package manager for the Bnlang ecosystem. It helps teams install dependencies reliably, keep projects secure, and publish libraries with confidence.

By combining an immutable lockfile, a shared cache, and clear workflows, BPM reduces install time, avoids "works on my machine" issues, and fits smoothly into CI/CD pipelines.

Core principles

Performance: Parallel downloads, local/global cache, and minimal I/O for fast installs.
Security: Integrity checks, optional organizational policies, and advisory surfacing.
Determinism: Stable dependency graphs with a lockfile for reproducible installs across machines and CI.

How BPM works (at a glance)

Resolve: reads your manifest and lockfile, resolving versions with SemVer rules.
Fetch: downloads archives from your configured registry or mirror into a local cache.
Verify: checks integrity via a hash before unpacking any artifact.
Link: places packages into your project and links executables to a global bin.
Record: writes the final dependency graph to the lockfile for future reproducibility.

Create a project

Initialize a new project and move into its directory.

$ bpm init my-app
$ cd my-app

Manage dependencies

Add or remove packages as your project evolves.

$ bpm install web-framework
$ bpm remove web-framework

Stay up to date

Upgrade packages and optionally audit for advisories.

$ bpm update
$ bpm audit   # optional

Run scripts

Execute scripts defined in your project manifest.

$ bpm run dev
$ bpm run build
$ bpm run start

Publishing packages

Prepare: fill out your manifest (name, version, entry points, files, scripts).
Login: authenticate with your registry.
Pack & verify: BPM creates a tarball and integrity hash.
Publish: upload the package and record the new version in the registry.

Commands

$ bpm login
$ bpm publish

Configuration & files

Project manifest: bnpkg.json describes your application or library.
Lockfile: bpm-lock.json pins the exact dependency graph.
Global store: cache and global installs, typically at ~/.bpm
User config: per-user settings, typically at ~/.bpmrc.json
Bin links: executables symlinked into ~/.bpm/bin

Security model (summary)

Integrity: all artifacts are verified before installation.
Policies (optional): restrict installs to approved registries, scopes, and publishers.
Advisories: surface known issues when advisory sources are configured.
Credentials: tokens are stored locally; never commit secrets to source control.

Tips

Commit your lockfile for consistent installs across machines and CI.
Use workspaces if your repository contains multiple related packages.
Prefer exact versions for internal packages when stability matters.
Run to discover all commands. bpm help