CodeVetter · Repo Unpack · Extension points
npm/cli
Extension mechanisms range from internal command registration to project-controlled dependency policy. Command metadata integrates help, parsing, workspace behavior, and nested routing. Arborist mixes independently defined behaviors and supports both declarative and executable manifest repair. These extension points carry different trust and persistence contracts.
- A top-level command plugs into the alphabetically sorted commands table and corresponding lib/commands filename; aliases and abbreviations pass through deref before Npm.cmd loads the class.
- BaseCommand metadata provides name, description, params, definitions, subcommands, and positional limits; flags builds types/defaults/aliases from definitions and validates before returning parsed flags and positional arguments.
- Nested command families register classes through static subcommands objects, as stage and trust demonstrate; execCommandClass recursively removes consumed command names and adjusts flag-parser depth.
- Global configuration extensions belong in definitions.js as Definition instances; definitions/index.js derives shorthand/default tables and invokes per-definition flatten handlers while preserving registry-scoped settings.
- Arborist behavior is composed through a mixins array reduced over EventEmitter, providing a direct internal integration point for tree loading, resolution, rebuilding, and installation strategies.
- Root packageExtensions rules match package names and semver ranges and may change only dependency/peer fields; normal dependencies are add-only, while peer ranges and peer metadata can be repaired.
- Root .npm-extension.mjs/.cjs exports transformManifest(pkg,context); NpmExtension hashes the selected file, requires synchronous object results, memoizes by package identity, and returns cloned manifests with provenance.
- Dependency patches integrate through patchedDependencies resolution during buildIdealTree and application immediately after extraction; patch commands provide edit/commit/update workflows and reject non-registry target specs.