Reference

# CLI reference

Every bin/importmap command, its options, and its exit status.

## Commands

| Command | What it does | Docs |
| --- | --- | --- |
| `pin [PACKAGES]` | Resolves each package on a CDN, downloads it to vendor/javascript (or pins the URL with --remote) and writes the pin. | [Pinning](https://importmap-plus.zoolutions.llc/docs/pinning) |
| `unpin [PACKAGES]` | Removes the pin and the vendored file. | [Pinning](https://importmap-plus.zoolutions.llc/docs/pinning) |
| `lock [PACKAGES]` | Marks the pins as locked at their current version. No network. | [Locking](https://importmap-plus.zoolutions.llc/docs/locking) |
| `unlock [PACKAGES]` | Removes the lock marker. No network. | [Locking](https://importmap-plus.zoolutions.llc/docs/locking) |
| `update [PACKAGES]` | Re-pins the outdated packages: the named ones, or every one. | [Updating](https://importmap-plus.zoolutions.llc/docs/updating) |
| `outdated` | Lists packages the registry has a newer version of. | [Updating](https://importmap-plus.zoolutions.llc/docs/updating) |
| `audit` | Lists known vulnerabilities for the pinned versions. | [Updating](https://importmap-plus.zoolutions.llc/docs/updating) |
| `pristine` | Redownloads every vendored package at its pinned version. | [Updating](https://importmap-plus.zoolutions.llc/docs/updating) |
| `packages` | Prints every package with a version, one per line. | [Updating](https://importmap-plus.zoolutions.llc/docs/updating) |
| `json` | Boots the app and prints the resolved import map as JSON. | [Updating](https://importmap-plus.zoolutions.llc/docs/updating) |

A package spec is `name[@version][/subpath]`: `react`, `luxon@3`, `luxon@3.7.2`, `apexcharts/core`, `@hotwired/stimulus@3`. `lock` and `unlock` take names only.

## pin options

| Option | Type | Default | Description |
| --- | --- | --- | --- |
| `--from CDN` | String | the pin's CDN, else jspm | jspm, unpkg, jsdelivr, esm.sh, skypack or esm.run. Also moves a remote pin to that CDN. |
| `--remote` | Boolean | false | Pin the resolved URL instead of vendoring a download; converts a vendored pin. |
| `--minify / --no-minify` | Boolean | what the pin says | Run the download through bun, esbuild or terser. Recorded on the pin. |
| `--lock / --no-lock` | Boolean | what the pin says | Lock the named packages at this version, or drop their lock. Dependencies are never locked. |
| `--force` | Boolean | false | Re-pin locked packages, keeping each lock at the new version. |
| `--preload VALUE` | String, repeatable | the pin's preload | true, false, or an entry point name; repeat for several entry points. |
| `--env ENV` | String | production | The jspm environment condition (production or development). |

## update options

| Option | Type | Default | Description |
| --- | --- | --- | --- |
| `--all` | Boolean | false | Update every outdated package — what a bare update does; rejected together with names. |
| `--force` | Boolean | false | Update locked packages too, keeping each lock at the new version. |

## pristine options

| Option | Type | Default | Description |
| --- | --- | --- | --- |
| `--from CDN` | String | each pin's CDN | Redownload everything from this CDN and record it on each pin. |
| `--minify / --no-minify` | Boolean | what each pin says | Minify every download, or none, and record it. |
| `--env ENV` | String | production | The jspm environment condition. |

## Exit status

| Command | Exits 1 when |
| --- | --- |
| `outdated` | an unlocked package is outdated |
| `audit` | a vulnerability is known for a pinned version |
| `update` | a named package has no pin, or names are combined with --all; nothing is updated in either case |
| `lock / unlock` | a named package has no pin, has no version to lock at, or was given with a version |
| any | a CDN or registry request fails after three attempts; the message names the URL |