# System map — npm/cli

> Canonical page: https://codevetter.com/unpack/cli/system-map

# System map — npm/cli

Scanned commit b317f16c80df02ea3628cfa77170d5ae9b59720c (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

The runtime is a Node.js CLI with a central Npm object coordinating configuration, command dispatch, output, and error handling. Independently packaged workspaces provide dependency-tree management and registry operations. Persistent state spans project manifests and locks, installed modules, caches, logs, and user configuration. Distribution bundles runtime dependencies and builds documentation during packaging.
- package.json exposes npm through bin/npm-cli.js and npx through bin/npx-cli.js; index.js invokes the CLI when executed directly and rejects imports with the removed-programmatic-API error. — [package.json#L35-48](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/package.json#L35-L48) [bin/npm-cli.js#L1-2](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/bin/npm-cli.js#L1-L2) [index.js#L1-5](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/index.js#L1-L5)
- lib/cli.js optionally enables Node's compile cache, then validateEngines installs early syntax-error handlers before loading the asynchronous CLI entry module. — [lib/cli.js#L1-12](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/cli.js#L1-L12) [lib/cli/validate-engines.js#L15-42](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/cli/validate-engines.js#L15-L42)
- Npm constructs Config and Display alongside LogFile and Timers; Npm.cmd resolves registered names before dynamically requiring a command implementation. — [lib/npm.js#L20-29](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/npm.js#L20-L29) [lib/npm.js#L41-70](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/npm.js#L41-L70)
- execCommandClass handles recursive subcommands, help, workspace support, developer-engine checks, and separate execution branches for commands with definitions versus legacy commands. — [lib/npm.js#L230-267](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/npm.js#L230-L267) [lib/npm.js#L270-313](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/npm.js#L270-L313)
- Config stores default, builtin, global, user, project, environment, and CLI layers in a prototype chain; flat options are generated from lower to higher priority. — [workspaces/config/lib/index.js#L42-55](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/config/lib/index.js#L42-L55) [workspaces/config/lib/index.js#L116-122](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/config/lib/index.js#L116-L122) [workspaces/config/lib/index.js#L212-228](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/config/lib/index.js#L212-L228)
- Arborist owns actual, virtual, and ideal dependency trees and composes tracker, resolution, loading, rebuilding, reification, and isolated-install behavior through mixins. — [workspaces/arborist/lib/arborist/index.js#L1-27](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/arborist/lib/arborist/index.js#L1-L27) [workspaces/arborist/lib/arborist/index.js#L39-50](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/workspaces/arborist/lib/arborist/index.js#L39-L50)
- Installation delegates to Arborist and pacote; publishing delegates to libnpmpack, libnpmpublish, npm-registry-fetch, and optional CI OIDC exchange. — [lib/commands/install.js#L147-176](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/commands/install.js#L147-L176) [lib/commands/publish.js#L1-17](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/commands/publish.js#L1-L17) [lib/commands/publish.js#L145-158](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/lib/commands/publish.js#L145-L158)
- The distributable includes bin, lib, documentation, and man pages with bundled runtime dependencies; prepack builds docs, test invokes TAP, lint invokes ESLint, and supported Node versions are explicitly constrained. — [package.json#L12-18](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/package.json#L12-L18) [package.json#L119-130](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/package.json#L119-L130) [package.json#L213-230](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/package.json#L213-L230) [package.json#L264-266](https://github.com/npm/cli/blob/b317f16c80df02ea3628cfa77170d5ae9b59720c/package.json#L264-L266)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)