JSR

JSR is a registry, the server package managers download from, not a package manager itself. Packages are ES modules named @scope/name, and authors publish TypeScript source with npx jsr publish or deno publish from a jsr.json (or deno.json) that gives the name, version and exports. JSR analyzes the code as it arrives: it generates API documentation, and for Node-style consumers it transpiles to JavaScript and writes .d.ts files, so authors have no build step. Public APIs must avoid “slow types” (exports whose types need inference), because JSR does not run the TypeScript compiler. Every version is immutable: you can yank it, but not change it, and deleting is allowed only within 24 hours for a version with almost no downloads and no dependents.

Deno imports jsr: specifiers natively and downloads only the files it imports. Everything else goes through an npm-compatible endpoint at npm.jsr.io that serves each package as @jsr/scope__name: pnpm 10.9+, Yarn 4.9+ and vlt understand jsr: directly, and for npm, Bun or older versions npx jsr add writes the .npmrc line and installs with your package manager. Publishing from GitHub Actions uses an OIDC token instead of a stored secret and records SLSA provenance in Sigstore’s transparency log. Each package gets a JSR score from 0 to 100 for documentation, best practices, discoverability and runtime compatibility, which also ranks search results.