CodeVetter · Repo Unpack · Data flow
npm/cli
CLI arguments, environment settings, and configuration files become typed configuration and flattened options consumed by command implementations. Installation turns requested specs and manifest metadata into an ideal graph, then reconciles that graph with disk. Authentication produces registry-scoped configuration, while publishing produces tarball bytes and registry requests. Output is routed through proc-log and finalized centrally.
- npx rewrites process.argv to npm exec, translates -p, --shell, and --no-install, removes obsolete options, and inserts -- before the first positional argument before invoking cli(process).
- Config.load loads defaults and builtin configuration, parses CLI and npm_config_* environment values, then discovers project, user, and global files before exporting child-process settings.
- Npm.#load takes positional arguments from parsedArgv.remain, removes the command token, resolves aliases, initializes display settings, and returns the raw command spelling plus remaining arguments.
- Install combines flatOptions, destination path, requested additions, workspace names, and resolved script policy into Arborist options; buildIdealTree initializes state, applies extensions and requests, resolves dependencies, checks platform compatibility, and resolves patches.
- Reification passes each non-link node's resolved source and integrity to pacote.extract, determines root source-policy eligibility from dependency edges, then applies its patch; link nodes instead enter a filesystem symlink path.
- Successful installation persistence updates dependency fields through PackageJson.save, saves ideal-tree lock metadata, then transfers idealTree to actualTree and writes node_modules/.package-lock.json or a linked-layout hidden lock.
- Login selects a registry, obtains a token through auth.login, stores it under a registry-scoped user configuration key, and serializes raw INI data to the configured user file with mode 0600.
- Publishing transforms a package spec into a prepared manifest and in-memory tarball, rereads publication settings, selects registry credentials, and sends bytes through libpub; Npm.finish flushes buffered output with final JSON/error metadata.