meteor/meteor

Four concrete flows were followed through implementation: development startup, application creation, collection insertion, and password login. Startup orders proxy binding, compilation, Mongo readiness, and application listening through promises rather than a single synchronous chain. The persistence and authentication traces preserve material local/remote, permission, and optional-2FA branches.

• Startup begins at meteor → tools/index.js → continueSetup → cli/main; binary commands may exit this chain early, while ordinary commands load Babel and the CLI command modules.
  meteor#L148-153tools/index.js#L1-25tools/cli/main.js#L294-298
• doRunCommand parses targets/server options → constructs ProjectContext → reads metadata → optionally initializes Cordova → calls runAll.run; runAll creates Runner and awaits init before scheduling or awaiting start.
  tools/cli/commands.js#L482-507tools/cli/commands.js#L558-606tools/runners/run-all.js#L411-419
• Runner.start binds the proxy → starts Mongo asynchronously with up to three attempts → starts updater/HMR when enabled → starts AppRunner; _runOnce prepares and bundles the project, waits for the first-run Mongo promise, starts AppProcess, and switches proxy mode on listening.
  tools/runners/run-all.js#L174-223tools/runners/run-app.js#L669-709tools/runners/run-app.js#L829-870
• Application creation's setup selects a skeleton from explicit flags or interactive prompts → resolves the destination → rejects nesting inside another Meteor app → checks existing contents before deciding what skeleton files to copy.
  tools/cli/commands.js#L938-1051tools/cli/commands.js#L1241-1246
• Creation copies a local skeleton when available/prototype/release-selected, otherwise attempts Git cloning with local-copy fallback; setupMessages then reads metadata, writes the release, records completed upgraders, prepares packages, and installs npm dependencies including development dependencies.
  tools/cli/commands.js#L1292-1326tools/cli/commands.js#L1063-1084tools/cli/commands.js#L1089-1117
• A remote insert follows insertAsync → _insertAsync → _callMutatorMethodAsync → connection.applyAsync; simulation mutates the local collection, while the server chooses restricted validation, insecure mutation, or a 403 rejection.
  packages/mongo/collection/methods_async.js#L82-105packages/allow-deny/allow-deny.js#L473-490packages/allow-deny/allow-deny.js#L162-224
• Restricted insertion runs deny validators first, requires an allow validator to accept, adds a generated ID after validation, and calls underlying insertAsync; MongoConnection then performs insertOne → observer refresh → write.committed, while cursor observers feed subscription updates into client replication.
  packages/allow-deny/allow-deny.js#L290-315packages/mongo/mongo_connection.js#L242-262packages/mongo/collection/collection.js#L111-138packages/mongo/collection/methods_replication.js#L97-143
• Password login follows internalLoginWithPassword → callLoginMethod → server methods.login → _runLoginHandlers → password handler/checkPasswordAsync → optional 2FA → _attemptLogin validation → _loginUser token insertion and setUserId.
  packages/accounts-password/password_client.js#L10-29packages/accounts-base/accounts_server.js#L712-720packages/accounts-password/password_server.js#L313-356packages/accounts-base/accounts_server.js#L469-493packages/accounts-base/accounts_server.js#L524-554packages/accounts-base/accounts_server.js#L627-675