Browser package management with modular dependency and version management. https://jspm.io
Install any package from GitHub or npm:
jspm install npm:lodash-node
jspm install github:components/jquery
jspm install jquery
In an HTML page, include the jspm Loader (loader.js), along with the automatically generated configuration file (config.js), then load the modules:
<script src="loader.js"></script>
<script src="config.js"></script>
<script>
jspm.import('npm:lodash-node/modern/objects/isEqual', function(isEqual) {
});
jspm.import('github:components/jquery', function($) {
});
jspm.import('jquery', function($) {
});
</script>
jspm install github:my/module.Read the guide on configuring packages for jspm here.
If you are having any trouble configuring a package for jspm, please just post an issue and we'll help get it configured.
npm install jspm jspm-github jspm-npm -g
This installs the jspm CLI along with the Github and npm endpoint modules.
cd my-project
jspm init
Enter config file location (config.js):
Enter external library install location (jspm_packages):
Enter local application code location / baseURL (lib):
Config file updated.
No package.json found, would you like to create one? (y/n): y
package.json updated.
Downloading loader files to jspm_packages.
es6-module-loader.js
loader.js
traceur.js
ok Loader files downloaded successfully.
Sets up the package.json and configuration file, and downloads the jspm loader files.
jspm.config call in it)jspm_packages)lib)Note that unlike RequireJS, the baseURL is different from the external package location.
jspm install npm:underscore
Any npm or Github package can be installed in this way.
Most npm packages will install without any configuration necessary. Github packages may need to be configured for jspm first. Read the guide here on configuring packages for jspm.
All installs are saved into the package.json, so that the jspm_packages folder and configuration file can be entirely recreated with a single jspm install call with no arguments. This is ideal for version-controlled projects where third party libraries aren't saved in the repo itself.
If you check config.js, you will see its contents have been updated to:
config.js:
jspm.config({
baseURL: 'lib',
jspmPackages: 'jspm_packages',
map: {
'npm:underscore': 'npm:underscore@1.5.2'
}
});
test.html:
<!doctype html>
<html>
<head>
<script src='jspm_packages/loader.js'></script>
<script src='config.js'></script>
<script>
jspm.import('npm:underscore', function(_) {
_.map([1, 2, 3], function(num) { return num + 1; });
});
</script>
</head>
<body>
</body>
</html>
Open test.html to see the application run. This sample can also be found here - https://github.com/jspm/jspm-demo.
jspm install myjquery=jquery@1.8
This will write the jspm loader map configuration for myjquery instead of jquery@1.8.
Allowing requires of the form:
jspm.import('myjquery')
jspm install jquery
Automatically downloads and sets the configuration map for the loader.
This is equivalent to writing:
jspm install jquery=github:components/jquery
The jspm registry just provides a mapping from a name into an endpoint package name. It is purely a name shortening service and nothing more.
The npm and Github endpoints are both served by CDN, which is automatically configured in jspm.
We can switch the CDN version with a single command:
jspm setmode remote
This updates the configuration to now load all the packages from the CDN directly instead of the jspm_packages folder. The app will still behave identically.
Revert back to the local files with:
jspm setmode local
jspm update
All packages will be checked, and versions bumped for latest and minor version package installs.
jspm is not a build tool, and never will be a build tool. Use grunt and other tools for automating project tasks.
The only operations jspm provides as a helper are:
Minification is provided for convenience only, while transpiling is provided as a fundamental use case for modules of the future.
Application code is stored in the baseURL directory (lib in the original example), which is also stored in the package.json as:
package.json:
{
"directories": {
"lib": "lib"
}
}
When building, this is the directory that we build.
To set build options, add a directories.dist and a buildConfig object to the package.json:
package.json:
{
"directories": {
"lib": "lib",
"dist": "lib-built"
},
"buildConfig": {
"uglify": true, // or set to options object
"traceur": true, // or set to options object
"transpile": true
}
}
To run the build, use the command:
jspm build
To run the application from the built sources, use the command:
jspm setmode production
The baseURL in the configuration file will be updated to the build directory, and the app will load its resources from there.
To try out a demonstration of this, clone the ES6 demo repo here.
Use -f or --force with the install command to overwrite and redownload all dependencies.
Use -h or --https to download with https instead of alternative protocols.
Use -o or --override to force-set the package override for a package that needs extra configuration. See https://github.com/jspm/registry/wiki/Configuring-Packages-for-jspm#testing-package-overrides.
jspm --help for command list.Apache 2.0
FAQs
Import Map Package Manager
The npm package jspm receives a total of 7,739 weekly downloads. As such, jspm popularity was classified as popular.
We found that jspm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PyPI confirms no security flaws were exploited in the Ultralytics supply chain attack and highlights improvements for safer package publishing.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.