# System map — axios/axios

> Canonical page: https://codevetter.com/unpack/axios/system-map

# System map — axios/axios

Scanned commit 56a5f1acdc41965f464eb59bec6cc828113ba546 (2026-09-16). Generated by codevetter codevetter 1.12.0 on 2026-09-22.

The public ESM entry is `index.js`, which unwraps the default instance built by `lib/axios.js` and re-exports its statics as named exports; CJS consumers get the Rollup-built `dist/node/axios.cjs`. Domain logic lives in `lib/core/` (Axios class, dispatch, merge, headers, errors, interceptors), I/O in `lib/adapters/`, environment selection in `lib/platform/` (Node by default, browser via package.json `browser` aliasing), and generic utilities in `lib/helpers/`. There is no storage layer — the only persistent state is browser cookies read for XSRF (`lib/helpers/cookies.js`) and pooled HTTP/2 sessions (`lib/helpers/Http2Sessions.js`). Build is `gulp clear && rollup -c` producing five bundles; tests are Vitest with three projects (unit/browser/browser-headless) plus packed-tarball smoke and module suites. Deployment shape is an npm package published on `v1.*.*` tags with provenance.
- `index.js` is the ESM public entry: it imports the default instance from `lib/axios.js` and destructures 18 statics (`Axios`, `AxiosError`, `CanceledError`, `CancelToken`, `VERSION`, `toFormData`, `AxiosHeaders`, `HttpStatusCode`, `formToJSON`, `getAdapter`, `mergeConfig`, `create`, …) so ESM and CJS named-import shapes stay identical. — [index.js#L1-L43](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/index.js#L1-L43) [lib/axios.js#L44-L89](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/axios.js#L44-L89)
- `createInstance(defaultConfig)` in `lib/axios.js` binds `Axios.prototype.request` to a fresh `Axios` context via `helpers/bind.js`, then copies both prototype and context onto the callable with `utils.extend(..., {allOwnKeys: true})`, which is why `axios(...)` is callable *and* carries `.get`/`.interceptors`/`.defaults`. — [lib/axios.js#L20-L42](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/axios.js#L20-L42) [lib/helpers/bind.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/helpers/bind.js)
- Runtime boundary between Node and browser is resolved by package.json `browser`/`react-native` maps that swap `lib/adapters/http.js` → `lib/helpers/null.js`, `lib/platform/node/index.js` → `lib/platform/browser/index.js`, and Node `Buffer`/`FormData` classes to null — `lib/platform/index.js` itself always imports the Node platform. — [package.json#L52-L66](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/package.json#L52-L66) [lib/platform/index.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/platform/index.js) [lib/platform/node/index.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/platform/node/index.js) [lib/platform/browser/index.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/platform/browser/index.js)
- Adapter registry `knownAdapters` maps `http` → Node adapter, `xhr` → XHR adapter, and `fetch` → an object with a `get(config)` factory (`fetchAdapter.getFetch`), so fetch is resolved lazily per-`config.env` while the other two are plain functions or `false`. — [lib/adapters/adapters.js#L16-L36](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/adapters.js#L16-L36) [lib/adapters/fetch.js#L680-L715](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/fetch.js#L680-L715)
- Default adapter preference is the ordered list `['xhr', 'http', 'fetch']` set in `lib/defaults/index.js`; `getAdapter` walks it, treating `false` as 'not supported by the environment' and `undefined` as 'not available in the build' when composing the `ERR_NOT_SUPPORT` message. — [lib/defaults/index.js#L42](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/defaults/index.js#L42) [lib/adapters/adapters.js#L65-L115](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/adapters.js#L65-L115)
- The Node adapter is the heaviest module (1490 lines) and pulls in `http`, `https`, `http2`, `zlib`, `stream`, `path`, plus the four runtime deps `follow-redirects`, `form-data` (indirectly), `https-proxy-agent`, and `proxy-from-env`. — [lib/adapters/http.js#L1-L37](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/lib/adapters/http.js#L1-L37) [package.json#L149-L154](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/package.json#L149-L154)
- Build emits five artifacts from two inputs: `dist/esm/axios.js` (ESM, from `index.js`), `dist/axios.js` (UMD, Babel-transpiled to ES5, from `lib/axios.js`), `dist/browser/axios.cjs`, and `dist/node/axios.cjs` (Babel-targeted at Node 12, with `proxy-from-env` deliberately inlined by `nodeCjsExternal`). — [rollup.config.js#L66-L145](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/rollup.config.js#L66-L145)
- `gulp version` (run via the `preversion` npm script) regenerates `lib/env/data.js` from package.json and rewrites the `contributors` array by calling the GitHub API through an axios instance built in `scripts/axios-build-instance.js` using `GITHUB_TOKEN`. — [gulpfile.js#L36-L82](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/gulpfile.js#L36-L82) [scripts/axios-build-instance.js](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/scripts/axios-build-instance.js) [package.json#L100-L102](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/package.json#L100-L102)
- Test commands are Vitest-project-scoped: `npm run test:vitest:unit` (node env, `tests/unit/**/*.test.js`), `test:vitest:browser` (chromium headed), and `test:vitest:browser:headless` (chromium+firefox+webkit via Playwright), all declared in `vitest.config.js` with a 10s default `testTimeout`. — [vitest.config.js#L1-L46](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/vitest.config.js#L1-L46) [package.json#L103-L108](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/package.json#L103-L108)
- CI order in `run-ci.yml` is: checkout → `npm ci --ignore-scripts` → lint → build → `npx playwright install --with-deps` → unit → browser headless → `npm pack` → dependency-review → upload tarball; every downstream job (`cjs-smoke`, `esm-smoke`, `cjs-module`, `esm-module`, `bun-smoke`, `deno-smoke`) `needs` that job and installs the packed tarball rather than the source tree. — [.github/workflows/run-ci.yml#L14-L60](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/run-ci.yml#L14-L60) [.github/workflows/run-ci.yml#L62-L110](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/run-ci.yml#L62-L110)
- Publishing is tag-triggered (`v1.*.*`) into the `npm-publish` GitHub environment with `id-token: write` and `npm stage publish --provenance --access public`; release branches are cut by a manual `workflow_dispatch` in `release-branch.yml` with patch/minor/major + prerelease inputs. — [.github/workflows/publish.yml#L1-L37](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/publish.yml#L1-L37) [.github/workflows/release-branch.yml#L1-L18](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/release-branch.yml#L1-L18)
- Supply-chain guards are separate workflows: `lockfile-lint.yml` validates HTTPS registry URLs and integrity hashes on any package.json/package-lock.json change (pinned by name, deliberately not a devDependency), `zizmor.yml` scans the Actions themselves with `permissions: {}`, and `verify-build-reproducibility.yml` does a two-pass build diff (currently `continue-on-error: true`). — [.github/workflows/lockfile-lint.yml#L1-L40](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/lockfile-lint.yml#L1-L40) [.github/workflows/zizmor.yml#L1-L22](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/zizmor.yml#L1-L22) [.github/workflows/verify-build-reproducibility.yml#L1-L28](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/.github/workflows/verify-build-reproducibility.yml#L1-L28)
- The documentation site is a separate VitePress+Vue workspace under `docs/` with its own package.json (`docs:dev`, `docs:build`, `docs:update:sponsors`, `test:search`) and 155 markdown files across localized `docs/<lang>/pages/` trees — it is not part of the library build. — [docs/package.json#L1-L30](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/docs/package.json#L1-L30) [package.json#L110](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/package.json#L110)
- Two local dev servers exist for manual exercise: `npm start` runs `sandbox/server.js` (serves `sandbox/client.html` and an `/api` echo endpoint) and `npm run examples` runs `examples/server.js`. — [package.json#L111-L112](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/package.json#L111-L112) [sandbox/server.js#L1-L30](https://github.com/axios/axios/blob/56a5f1acdc41965f464eb59bec6cc828113ba546/sandbox/server.js#L1-L30)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)