Even if a package version is unpublished, that specific name and
version combination can never be reused. In order to publish the
package again, a new version number must be used.
-
The scope is optional and follows the usual rules for npm-scope(7).
+
The scope is optional and follows the usual rules for npm-scope(7).
"Person" fields are shown as a string if they would be shown as an
object. So, for example, this will show the list of npm contributors in
-the shortened string format. (See package.json(5) for more on this.)
+the shortened string format. (See package.json(5) for more on this.)
npm view npm contributors
If a version range is provided, then data will be printed for every
matching version of the package. This will show which version of jsdom
@@ -63,12 +63,12 @@
npm is the package manager for the Node JavaScript platform. It puts
modules in place so that node can find them, and manages dependency
@@ -25,7 +25,7 @@
DESCRIPTION
INTRODUCTION
You probably got npm because you want to install stuff.
Use npm install blerg to install the latest version of "blerg". Check out
-npm-install(1) for more info. It can do a lot of stuff.
+npm-install(1) for more info. It can do a lot of stuff.
Use the npm search command to show everything that's available.
Use npm ls to show everything you've installed.
link:
For linking your current working code into Node's path, so that you
don't have to reinstall every time you make a change. Use
@@ -93,12 +93,12 @@
CONFIGURATION
Defaults: npm's default configuration options are defined in
lib/utils/config-defs.js. These must not be changed.
code:
-Read through npm-coding-style(7) if you plan to submit code.
+Read through npm-coding-style(7) if you plan to submit code.
You don't have to agree with it, but you do have to follow it.
docs:
If you find an error in the documentation, edit the appropriate markdown
@@ -110,7 +110,7 @@
Scoped packages are installed the same way, except they are grouped together
in a sub-folder of the relevant node_modules folder with the name of that
scope prefix by the @ symbol, e.g. npm install @myorg/package would place
-the package in {prefix}/node_modules/@myorg/package. See scopes(7) for
+the package in {prefix}/node_modules/@myorg/package. See scopes(7) for
more details.
If you wish to require() a package, then install it locally.
Executables
@@ -59,7 +59,7 @@
Man Pages
When in local mode, man pages are not installed.
Man pages are not installed on Windows systems.
Cache
-
See npm-cache(1). Cache files are stored in ~/.npm on Posix, or
+
See npm-cache(1). Cache files are stored in ~/.npm on Posix, or
~/npm-cache on Windows.
This is controlled by the cache configuration param.
Temp Files
@@ -159,18 +159,18 @@
Publishing
not be included in the package tarball.
This allows a package maintainer to install all of their dependencies
(and dev dependencies) locally, but only re-publish those items that
-cannot be found elsewhere. See package.json(5) for more information.
+cannot be found elsewhere. See package.json(5) for more information.
Scoped packages are installed the same way, except they are grouped together
in a sub-folder of the relevant node_modules folder with the name of that
scope prefix by the @ symbol, e.g. npm install @myorg/package would place
-the package in {prefix}/node_modules/@myorg/package. See scopes(7) for
+the package in {prefix}/node_modules/@myorg/package. See scopes(7) for
more details.
If you wish to require() a package, then install it locally.
Executables
@@ -59,7 +59,7 @@
Man Pages
When in local mode, man pages are not installed.
Man pages are not installed on Windows systems.
Cache
-
See npm-cache(1). Cache files are stored in ~/.npm on Posix, or
+
See npm-cache(1). Cache files are stored in ~/.npm on Posix, or
~/npm-cache on Windows.
This is controlled by the cache configuration param.
Temp Files
@@ -159,18 +159,18 @@
Publishing
not be included in the package tarball.
This allows a package maintainer to install all of their dependencies
(and dev dependencies) locally, but only re-publish those items that
-cannot be found elsewhere. See package.json(5) for more information.
+cannot be found elsewhere. See package.json(5) for more information.
The most important things in your package.json are the name and version fields.
Those are actually required, and your package won't install without
@@ -43,7 +43,7 @@
The most important things in your package.json are the name and version fields.
Those are actually required, and your package won't install without
@@ -53,7 +53,7 @@
version
Version must be parseable by
node-semver, which is bundled
with npm as a dependency. (npm install semver to use it yourself.)
The "scripts" property is a dictionary containing script commands that are run
at various times in the lifecycle of your package. The key is the lifecycle
event, and the value is the command to run at that point.
-
See npm-scripts(7) to find out more about writing package scripts.
+
See npm-scripts(7) to find out more about writing package scripts.
config
A "config" object can be used to set configuration parameters used in package
scripts that persist across upgrades. For instance, if a package had the
@@ -282,7 +282,7 @@
config
and then had a "start" command that then referenced the
npm_package_config_port environment variable, then the user could
override that by doing npm config set foo:port 8001.
range1 || range2 Passes if either range1 or range2 are satisfied.
git... See 'Git URLs as Dependencies' below
user/repo See 'GitHub URLs' below
-
tag A specific version tagged and published as tag See npm-tag(1)
+
tag A specific version tagged and published as tag See npm-tag(1)
path/path/path See Local Paths below
For example, these are all valid:
@@ -380,7 +380,7 @@
devDependencies
object.
These things will be installed when doing npm link or npm install
from the root of a package, and can be managed like any other npm
-configuration param. See npm-config(7) for more on the topic.
+configuration param. See npm-config(7) for more on the topic.
For build steps that are not platform-specific, such as compiling
CoffeeScript or other languages to JavaScript, use the prepublish
script to do this, and make the required package a devDependency.
@@ -433,7 +433,7 @@
peerDependencies
this. If you depend on features introduced in 1.5.2, use ">= 1.5.2 < 2".
bundledDependencies
Array of package names that will be bundled when publishing the package.
-
If this is spelled "bundleDependencies", then that is also honorable.
+
If this is spelled "bundleDependencies", then that is also honored.
optionalDependencies
If a dependency can be used, but you would like npm to proceed if it cannot be
found or fails to install, then you may put it in the optionalDependencies
@@ -520,7 +520,7 @@
publishConfig
to the global public registry or that a scoped module is private by default.
Any config values can be overridden, but of course only "tag", "registry" and
"access" probably matter for the purposes of publishing.
-
See npm-config(7) to see the list of config options that can be
+
See npm-config(7) to see the list of config options that can be
overridden.
DEFAULT VALUES
npm will default some values based on package contents.
The most important things in your package.json are the name and version fields.
Those are actually required, and your package won't install without
@@ -43,7 +43,7 @@
The most important things in your package.json are the name and version fields.
Those are actually required, and your package won't install without
@@ -53,7 +53,7 @@
version
Version must be parseable by
node-semver, which is bundled
with npm as a dependency. (npm install semver to use it yourself.)
The "scripts" property is a dictionary containing script commands that are run
at various times in the lifecycle of your package. The key is the lifecycle
event, and the value is the command to run at that point.
-
See npm-scripts(7) to find out more about writing package scripts.
+
See npm-scripts(7) to find out more about writing package scripts.
config
A "config" object can be used to set configuration parameters used in package
scripts that persist across upgrades. For instance, if a package had the
@@ -282,7 +282,7 @@
config
and then had a "start" command that then referenced the
npm_package_config_port environment variable, then the user could
override that by doing npm config set foo:port 8001.
range1 || range2 Passes if either range1 or range2 are satisfied.
git... See 'Git URLs as Dependencies' below
user/repo See 'GitHub URLs' below
-
tag A specific version tagged and published as tag See npm-tag(1)
+
tag A specific version tagged and published as tag See npm-tag(1)
path/path/path See Local Paths below
For example, these are all valid:
@@ -380,7 +380,7 @@
devDependencies
object.
These things will be installed when doing npm link or npm install
from the root of a package, and can be managed like any other npm
-configuration param. See npm-config(7) for more on the topic.
+configuration param. See npm-config(7) for more on the topic.
For build steps that are not platform-specific, such as compiling
CoffeeScript or other languages to JavaScript, use the prepublish
script to do this, and make the required package a devDependency.
@@ -433,7 +433,7 @@
peerDependencies
this. If you depend on features introduced in 1.5.2, use ">= 1.5.2 < 2".
bundledDependencies
Array of package names that will be bundled when publishing the package.
-
If this is spelled "bundleDependencies", then that is also honorable.
+
If this is spelled "bundleDependencies", then that is also honored.
optionalDependencies
If a dependency can be used, but you would like npm to proceed if it cannot be
found or fails to install, then you may put it in the optionalDependencies
@@ -520,7 +520,7 @@
publishConfig
to the global public registry or that a scoped module is private by default.
Any config values can be overridden, but of course only "tag", "registry" and
"access" probably matter for the purposes of publishing.
-
See npm-config(7) to see the list of config options that can be
+
See npm-config(7) to see the list of config options that can be
overridden.
DEFAULT VALUES
npm will default some values based on package contents.
A set of configuration parameters that are internal to npm, and are
defaults if nothing else is specified.
@@ -78,7 +78,7 @@
Shorthands and Other CLI Niceties
Per-Package Config Settings
-
When running scripts (see npm-scripts(7)) the package.json "config"
+
When running scripts (see npm-scripts(7)) the package.json "config"
keys are overwritten in the environment if there is a config param of
<name>[@<version>]:<key>. For example, if the package.json has
this:
The location of npm's cache directory. See npm-cache(1)
+
The location of npm's cache directory. See npm-cache(1)
cache-lock-stale
Default: 60000 (1 minute)
@@ -302,7 +302,7 @@
global
Operates in "global" mode, so that packages are installed into the
prefix folder instead of the current working directory. See
-npm-folders(5) for more on the differences in behavior.
+npm-folders(5) for more on the differences in behavior.
packages are installed into the {prefix}/lib/node_modules folder, instead of the
current working directory.
@@ -360,7 +360,7 @@
init-module
A module that will be loaded by the npm init command. See the
documentation for the
init-package-json module
-for more information, or npm-init(1).
You need to have a package.json file in the root of your project to do
much of anything with npm. That is basically the whole interface.
-
See package.json(5) for details about what goes in that file. At the very
+
See package.json(5) for details about what goes in that file. At the very
least, you need:
name:
@@ -72,7 +72,7 @@
The package.json File
If you have a special compilation or installation script, then you
should put it in the scripts object. You should definitely have at
least a basic smoke-test command as the "scripts.test" field.
-See npm-scripts(7).
+See npm-scripts(7).
main:
If you have a single module that serves as the entry point to your
@@ -86,7 +86,7 @@
The package.json File
You can use npm init in the root of your package in order to get you
-started with a pretty basic package.json file. See npm-init(1) for
+started with a pretty basic package.json file. See npm-init(1) for
more info.
Keeping files out of your package
Use a .npmignore file to keep stuff out of your package. If there's
@@ -110,9 +110,11 @@
Keeping files out of your pa
.DS_Store
.git
.hg
+
.npmrc
.lock-wscript
.svn
.wafpickle-*
+
config.gypi
CVS
npm-debug.log
@@ -123,14 +125,16 @@
Keeping files out of your pa
.npmignore is pointless:
npm link is designed to install a development package and see the
changes in real time without having to keep re-installing it. (You do
need to either re-link or npm rebuild -g to update compiled packages,
of course.)
After a few weeks, if there's no resolution, we'll sort it out.
Don't squat on package names. Publish code or move out of the way.
@@ -51,12 +51,12 @@
DESCRIPTION
owner (Bob).
Joe emails Bob, explaining the situation as respectfully as
possible, and what he would like to do with the module name. He
-adds the npm support staff support@npmjs.com to the CC list of
+adds the npm support staff support@npmjs.com to the CC list of
the email. Mention in the email that Bob can run npm owner add
joe foo to add Joe as an owner of the foo package.
After a reasonable amount of time, if Bob has not responded, or if
Bob and Joe can't come to any sort of resolution, email support
-support@npmjs.com and we'll sort it out. ("Reasonable" is
+support@npmjs.com and we'll sort it out. ("Reasonable" is
usually at least 4 weeks, but extra time is allowed around common
holidays.)
@@ -97,8 +97,8 @@
EXCEPTIONS
If you see bad behavior like this, please report it right away.
for
+proven to be an extremely successful approach. See npm-folders(5) for
more details.
If you want a package to be installed in one place, and have all your
programs reference the same copy of it, then use the npm link command.
@@ -218,18 +218,18 @@
You'll most likely want to npm link your development folder. That's
awesomely handy.
-
To set up your own private registry, check out npm-registry(7).
+
To set up your own private registry, check out npm-registry(7).
Can I list a url as a dependency?
Yes. It should be a url to a gzipped tarball containing a single folder
that has a package.json in its root, or a git url.
(See "what is a package?" above.)
How do I symlink to a dev folder so I don't have to keep re-installing?
To check if the registry is down, open up
https://registry.npmjs.org/ in a web browser. This will also tell
you if you are just unable to access the internet for some reason.
-
If the registry IS down, let us know by emailing support@npmjs.com
+
If the registry IS down, let us know by emailing support@npmjs.com
or posting an issue at https://github.com/npm/npm/issues. If it's
down for the world (and not just on your local network) then we're
probably already being pinged about it.
@@ -287,14 +287,14 @@
Why does npm hate me?
npm is not capable of hatred. It loves everyone, especially you.
The registry URL used is determined by the scope of the package (see
-npm-scope(7)). If no scope is specified, the default registry is used, which is
-supplied by the registry config parameter. See npm-config(1),
-npmrc(5), and npm-config(7) for more on managing npm's configuration.
+npm-scope(7)). If no scope is specified, the default registry is used, which is
+supplied by the registry config parameter. See npm-config(1),
+npmrc(5), and npm-config(7) for more on managing npm's configuration.
Can I run my own private registry?
Yes!
The easiest way is to replicate the couch database, and use the same (or
@@ -40,7 +40,7 @@
package.json(5) for more info on what goes in the package.json file.
+
See package.json(5) for more info on what goes in the package.json file.
Will you replicate from my registry into the public one?
No. If you want things to be public, then publish them into the public
registry using npm. What little security there is would be for nought
@@ -52,11 +52,11 @@
only will prevent some optional features, then it's better to just
print a warning and exit successfully.
Try not to use scripts to do what npm can do for you. Read through
-package.json(5) to see all the things that you can specify and enable
+package.json(5) to see all the things that you can specify and enable
by simply describing your package appropriately. In general, this
will lead to a more robust and consistent state.
Inspect the env to determine where to put things. For instance, if
@@ -190,10 +190,10 @@
You can set any npm configuration params with that script:
-
npm_config_prefix=/some/path sh install.sh
-
-
Or, you can run it in uber-debuggery mode:
-
npm_debug=1 sh install.sh
-
-
Even Fancier
-
Get the code with git. Use make to build the docs and do other stuff.
-If you plan on hacking on npm, make link is your friend.
-
If you've got the npm source code, you can also semi-permanently set
-arbitrary config keys using the ./configure --key=val ..., and then
-run npm commands by doing node cli.js <cmd> <args>. (This is helpful
-for testing, or running stuff without actually installing npm itself.)
-
Windows Install or Upgrade
-
You can download a zip file from https://github.com/npm/npm/releases, and
-unpack it in the node_modules\npm\ folder inside node's installation folder.
-
To upgrade to npm 2, follow the Windows upgrade instructions in
-the npm Troubleshooting Guide:
If that's not fancy enough for you, then you can fetch the code with
-git, and mess with it directly.
-
Installing on Cygwin
-
No.
-
Uninstalling
-
So sad to see you go.
-
sudo npm uninstall npm -g
-
-
Or, if that fails,
-
sudo make uninstall
-
-
More Severe Uninstalling
-
Usually, the above instructions are sufficient. That will remove
-npm, but leave behind anything you've installed.
-
If you would like to remove all the packages that you have installed,
-then you can use the npm ls command to find them, and then npm rm to
-remove them.
-
To remove cruft left behind by npm 0.x, you can use the included
-clean-old.sh script file. You can run it conveniently like this:
-
npm explore npm -g -- sh scripts/clean-old.sh
-
-
npm uses two configuration files, one for per-user configs, and another
-for global (every-user) configs. You can view them by doing:
-
npm config get userconfig # defaults to ~/.npmrc
-npm config get globalconfig # defaults to /usr/local/etc/npmrc
-
-
Uninstalling npm does not remove configuration files by default. You
-must remove them yourself manually if you want them gone. Note that
-this means that future npm installs will not remember the settings that
-you have chosen.
-
Using npm Programmatically
-
Although npm can be used programmatically, its API is meant for use by the CLI
-only, and no guarantees are made regarding its fitness for any other purpose.
-If you want to use npm to reliably perform some task, the safest thing to do is
-to invoke the desired npm command with appropriate arguments.
-
The semantic version of npm refers to the CLI itself, rather than the
-underlying API. The internal API is not guaranteed to remain stable even when
-npm's version indicates no breaking changes have been made according to
-semver.
-
If you still would like to use npm programmatically, it's possible. The API
-isn't very well documented, but it is rather simple.
-
Eventually, npm will be just a thin CLI wrapper around the modules that it
-depends on, but for now, there are some things that only the CLI can do. You
-should try using one of npm's dependencies first, and only use the API if what
-you're trying to do is only supported by npm itself.
-
var npm = require("npm")
-npm.load(myConfigObject, function (er) {
- if (er) return handlError(er)
- npm.commands.install(["some", "args"], function (er, data) {
- if (er) return commandFailed(er)
- // command succeeded, and data might have some info
- })
- npm.registry.log.on("log", function (message) { .... })
-})
-
-
The load function takes an object hash of the command-line configs.
-The various npm.commands.<cmd> functions take an array of
-positional argument strings. The last argument to any
-npm.commands.<cmd> function is a callback. Some commands take other
-optional arguments. Read the source.
-
You cannot set configs individually for any single npm function at this
-time. Since npm is a singleton, any call to npm.config.set will
-change the value for all npm commands in that process.
-
See ./bin/npm-cli.js for an example of pulling config values off of the
-command line arguments using nopt. You may also want to check out npm
-help config to learn about all the options you can set there.
You can use the npm help command to read any of them.
-
If you're a developer, and you want to use npm to publish your program,
-you should read this
-
Legal Stuff
-
"npm" and "The npm Registry" are owned by npm, Inc.
-All rights reserved. See the included LICENSE file for more details.
-
"Node.js" and "node" are trademarks owned by Joyent, Inc.
-
Modules published on the npm registry are not officially endorsed by
-npm, Inc. or the Node.js project.
-
Data published to the npm registry is not part of npm itself, and is
-the sole property of the publisher. While every effort is made to
-ensure accountability, there is absolutely no guarantee, warranty, or
-assertion expressed or implied as to the quality, fitness for a
-specific purpose, or lack of malice in any given npm package.
Any data published to The npm Registry (including user account
-information) may be removed or modified at the sole discretion of the
-npm server administrators.
-
In plainer english
-
npm is the property of npm, Inc.
-
If you publish something, it's yours, and you are solely accountable
-for it.
-
If other people publish something, it's theirs.
-
Users can publish Bad Stuff. It will be removed promptly if reported.
-But there is no vetting process for published modules, and you use
-them at your own risk. Please inspect the source.
-
If you publish Bad Stuff, we may delete it from the registry, or even
-ban your account in extreme cases. So don't do that.
This command tries to guess at the likely location of a package's
-bug tracker URL, and then tries to open it using the --browser
-config param.
-
Like other commands, the first parameter is an array. This command only
-uses the first element, which is expected to be a package name with an
-optional version number.
-
This command will launch a browser, so this command may not be the most
-friendly for programmatic use.
This acts much the same ways as the npm-cache(1) command line
-functionality.
-
The callback is called with the package.json data of the thing that is
-eventually added to or read from the cache.
-
The top level npm.commands.cache(...) functionality is a public
-interface, and like all commands on the npm.commands object, it will
-match the command line behavior exactly.
-
However, the cache folder structure and the cache helper functions are
-considered internal API surface, and as such, may change in future
-releases of npm, potentially without warning or significant version
-incrementation.
npm comes with a full set of commands, and each of the commands takes a
-similar set of arguments.
-
In general, all commands on the command object take an array of positional
-argument strings. The last argument to any function is a callback. Some
-commands are special and take other optional arguments.
-
All commands have their own man page. See man npm-<command> for command-line
-usage, or man 3 npm-<command> for programmatic usage.
npm.commands.config(args, callback)
-var val = npm.config.get(key)
-npm.config.set(key, val)
-
DESCRIPTION
-
This function acts much the same way as the command-line version. The first
-element in the array tells config what to do. Possible values are:
-
-
set
-
Sets a config parameter. The second element in args is interpreted as the
- key, and the third element is interpreted as the value.
-
-
get
-
Gets the value of a config parameter. The second element in args is the
- key to get the value of.
-
-
delete (rm or del)
-
Deletes a parameter from the config. The second element in args is the
- key to delete.
-
-
list (ls)
-
Show all configs that aren't secret. No parameters necessary.
-
-
edit:
-
Opens the config file in the default editor. This command isn't very useful
- programmatically, but it is made available.
-
-
-
To programmatically access npm configuration settings, or set them for
-the duration of a program, use the npm.config.set and npm.config.get
-functions instead.
This command tries to guess at the likely location of a package's
-documentation URL, and then tries to open it using the --browser
-config param.
-
Like other commands, the first parameter is an array. This command only
-uses the first element, which is expected to be a package name with an
-optional version number.
-
This command will launch a browser, so this command may not be the most
-friendly for programmatic use.
Opens the package folder in the default editor (or whatever you've
-configured as the npm editor config -- see npm help config.)
-
After it has been edited, the package is rebuilt so as to pick up any
-changes in compiled packages.
-
For instance, you can do npm install connect to install connect
-into your package, and then npm.commands.edit(["connect"], callback)
-to make a few changes to your locally installed copy.
-
The first parameter is a string array with a single element, the package
-to open. The package can optionally have a version number attached.
-
Since this command opens an editor in a new process, be careful about where
-and how this is used.
Spawn a subshell in the directory of the installed package specified.
-
If a command is specified, then it is run in the subshell, which then
-immediately terminates.
-
Note that the package is not automatically rebuilt afterwards, so be
-sure to use npm rebuild <pkg> if you make any changes.
-
The first element in the 'args' parameter must be a package name. After that is the optional command, which can be any number of strings. All of the strings will be combined into one, space-delimited command.
This command is rarely useful, but it exists in the rare case that it is.
-
This command takes an array of search terms and returns the help pages that
-match in order of best match.
-
If there is only one match, then npm displays that help section. If there
-are multiple results, the results are printed to the screen formatted and the
-array of results is returned. Each result is an object with these properties:
-
-
hits:
-A map of args to number of hits on that arg. For example, {"npm": 3}
-
found:
-Total number of unique args that matched.
-
totalHits:
-Total number of hits.
-
lines:
-An array of all matching lines (and some adjacent lines).
-
file:
-Name of the file that matched
-
-
The silent parameter is not necessary not used, but it may in the future.
This will ask you a bunch of questions, and then write a package.json for you.
-
It attempts to make reasonable guesses about what you want things to be set to,
-and then writes a package.json file with the options you've selected.
-
If you already have a package.json file, it'll read that first, and default to
-the options in there.
-
It is strictly additive, so it does not delete options from your package.json
-without a really good reason to do so.
-
Since this function expects to be run on the command-line, it doesn't work very
-well as a programmatically. The best option is to roll your own, and since
-JavaScript makes it stupid simple to output formatted JSON, that is the
-preferred method. If you're sure you want to handle command-line prompting,
-then go ahead and use this programmatically.
npm.load() must be called before any other function call. Both parameters are
-optional, but the second is recommended.
-
The first parameter is an object containing command-line config params, and the
-second parameter is a callback that will be called when npm is loaded and ready
-to serve.
-
The first parameter should follow a similar structure as the package.json
-config object.
-
For example, to emulate the --dev flag, pass an object that looks like this:
-
{
- "dev": true
-}
-
For a list of all the available command-line configs, see npm help config
This command will print to stdout all the versions of packages that are
-installed, as well as their dependencies, in a tree-structure. It will also
-return that data using the callback.
-
This command does not take any arguments, but args must be defined.
-Beyond that, if any arguments are passed in, npm will politely warn that it
-does not take positional arguments, though you may set config flags
-like with any other command, such as global to list global packages.
-
It will print out extraneous, missing, and invalid packages.
-
If the silent parameter is set to true, nothing will be output to the screen,
-but the data will still be returned.
-
Callback is provided an error if one occurred, the full data about which
-packages are installed and which dependencies they will receive, and a
-"lite" data object which just shows which versions are installed where.
-Note that the full data object is a circular structure, so care must be
-taken if it is serialized to JSON.
-
CONFIGURATION
-
long
-
-
Default: false
-
Type: Boolean
-
-
Show extended information.
-
parseable
-
-
Default: false
-
Type: Boolean
-
-
Show parseable output instead of tree view.
-
global
-
-
Default: false
-
Type: Boolean
-
-
List packages in the global install prefix instead of in the current
-project.
-
Note, if parseable is set or long isn't set, then duplicates will be trimmed.
-This means that if a submodule has the same dependency as a parent module, then the
-dependency will only be output once.
The first element of the 'args' parameter defines what to do, and the subsequent
-elements depend on the action. Possible values for the action are (order of
-parameters are given in parenthesis):
-
-
ls (package):
-List all the users who have access to modify a package and push new versions.
-Handy when you need to know who to bug for help.
-
add (user, package):
-Add a new user as a maintainer of a package. This user is enabled to modify
-metadata, publish new versions, and add other owners.
-
rm (user, package):
-Remove a user from the package owner list. This immediately revokes their
-privileges.
-
-
Note that there is only one level of access. Either you can modify a package,
-or you can't. Future versions may contain more fine-grained access levels, but
-that is not implemented at this time.
For anything that's installable (that is, a package folder, tarball,
-tarball url, name@tag, name@version, or name), this command will fetch
-it to the cache, and then copy the tarball to the current working
-directory as <name>-<version>.tgz, and then write the filenames out to
-stdout.
-
If the same package is specified multiple times, then the file will be
-overwritten the second time.
-
If no arguments are supplied, then npm packs the current package folder.
This command runs the npm build command on each of the matched packages. This is useful
-when you install a new version of node, and must recompile all your C++ addons with
-the new binary. If no 'packages' parameter is specify, every package will be rebuilt.
This command tries to guess at the likely location of a package's
-repository URL, and then tries to open it using the --browser
-config param.
-
Like other commands, the first parameter is an array. This command only
-uses the first element, which is expected to be a package name with an
-optional version number.
-
This command will launch a browser, so this command may not be the most
-friendly for programmatic use.
This runs an arbitrary command from a package's "scripts" object.
-
It is used by the test, start, restart, and stop commands, but can be
-called directly, as well.
-
The 'args' parameter is an array of strings. Behavior depends on the number
-of elements. If there is only one element, npm assumes that the element
-represents a command to be run on the local repository. If there is more than
-one element, then the first is assumed to be the package and the second is
-assumed to be the command to run. All other elements are ignored.
Search the registry for packages matching the search terms. The available parameters are:
-
-
searchTerms:
-Array of search terms. These terms are case-insensitive.
-
silent:
-If true, npm will not log anything to the console.
-
staleness:
-This is the threshold for stale packages. "Fresh" packages are not refreshed
-from the registry. This value is measured in seconds.
-
callback:
-Returns an object where each key is the name of a package, and the value
-is information about that package along with a 'words' property, which is
-a space-delimited string of all of the interesting words in that package.
-The only properties included are those that are searched, which generally include:
-
-
name
-
description
-
maintainers
-
url
-
keywords
-
-
-
-
A search on the registry excludes any result that does not match all of the
-search terms. It also removes any items from the results that contain an
-excluded term (the "searchexclude" config). The search is case insensitive
-and doesn't try to read your mind (it doesn't do any verb tense matching or the
-like).
This acts much the same ways as shrinkwrapping on the command-line.
-
This command does not take any arguments, but 'args' must be defined.
-Beyond that, if any arguments are passed in, npm will politely warn that it
-does not take positional arguments.
-
If the 'silent' parameter is set to true, nothing will be output to the screen,
-but the shrinkwrap file will still be written.
-
Finally, 'callback' is a function that will be called when the shrinkwrap has
-been saved.
Tags the specified version of the package with the specified tag, or the
---tag config if not specified.
-
The 'package@version' is an array of strings, but only the first two elements are
-currently used.
-
The first element must be in the form package@version, where package
-is the package name and version is the version number (much like installing a
-specific version).
-
The second element is the name of the tag to tag this version with. If this
-parameter is missing or falsey (empty), the default from the config will be
-used. For more information about how to set this config, check
-man 3 npm-config for programmatic usage or man npm-config for cli usage.
This removes a package version from the registry, deleting its
-entry and removing the tarball.
-
The package parameter must be defined.
-
Only the first element in the package parameter is used. If there is no first
-element, then npm assumes that the package at the current working directory
-is what is meant.
-
If no version is specified, or if all versions are removed then
-the root package entry is removed from the registry entirely.
Run this in a package directory to bump the version and write the new
-data back to the package.json file.
-
If run in a git repo, it will also create a version commit and tag, and
-fail if the repo is not clean.
-
Like all other commands, this function takes a string array as its first
-parameter. The difference, however, is this function will fail if it does
-not have exactly one element. The only element should be a version number.
This command shows data about a package and prints it to the stream
-referenced by the outfd config, which defaults to stdout.
-
The "args" parameter is an ordered list that closely resembles the command-line
-usage. The elements should be ordered such that the first element is
-the package and version (package@version). The version is optional. After that,
-the rest of the parameters are fields with optional subfields ("field.subfield")
-which can be used to get only the information desired from the registry.
-
The callback will be passed all of the data returned by the query.
-
For example, to get the package registry entry for the connect package,
-you can do this:
-
npm.commands.view(["connect"], callback)
-
If no version is specified, "latest" is assumed.
-
Field names can be specified after the package descriptor.
-For example, to show the dependencies of the ronn package at version
-0.3.5, you could do the following:
For fields that are arrays, requesting a non-numeric field will return
-all of the values from the objects in the list. For example, to get all
-the contributor names for the "express" project, you can do this:
You may also use numeric indices in square braces to specifically select
-an item in an array field. To just get the email address of the first
-contributor in the list, you can do this:
Multiple fields may be specified, and will be printed one after another.
-For exampls, to get all the contributor names and email addresses, you
-can do this:
"Person" fields are shown as a string if they would be shown as an
-object. So, for example, this will show the list of npm contributors in
-the shortened string format. (See npm help json for more on this.)
If a version range is provided, then data will be printed for every
-matching version of the package. This will show which version of jsdom
-was required by each matching version of yui3:
If only a single string field for a single version is output, then it
-will not be colorized or quoted, so as to enable piping the output to
-another command.
-
If the version range matches multiple versions, than each printed value
-will be prefixed with the version it applies to.
-
If multiple fields are requested, than each of them are prefixed with
-the field name.
-
Console output can be disabled by setting the 'silent' parameter to true.
-
RETURN VALUE
-
The data returned will be an object in this formation:
var npm = require("npm")
-npm.load([configObject, ]function (er, npm) {
- // use the npm object, now that it's loaded.
-
- npm.config.set(key, val)
- val = npm.config.get(key)
-
- console.log("prefix = %s", npm.prefix)
-
- npm.commands.install(["package"], cb)
-})
-
VERSION
-
2.13.3
-
DESCRIPTION
-
This is the API documentation for npm.
-To find documentation of the command line
-client, see npm(1).
-
Prior to using npm's commands, npm.load() must be called. If you provide
-configObject as an object map of top-level configs, they override the values
-stored in the various config locations. In the npm command line client, this
-set of configs is parsed from the command line options. Additional
-configuration params are loaded from two configuration files. See
-npm-config(1), npm-config(7), and npmrc(5) for more information.
-
After that, each of the functions are accessible in the
-commands object: npm.commands.<cmd>. See npm-index(7) for a list of
-all possible commands.
-
All commands on the command object take an array of positional argument
-strings. The last argument to any function is a callback. Some
-commands take other optional arguments.
-
Configs cannot currently be set on a per function basis, as each call to
-npm.config.set will change the value for all npm commands in that process.
-
To find API documentation for a specific command, run the npm apihelp
-command.
-
METHODS AND PROPERTIES
-
-
npm.load(configs, cb)
-
Load the configuration params, and call the cb function once the
- globalconfig and userconfig files have been loaded as well, or on
- nextTick if they've already been loaded.
-
-
npm.config
-
An object for accessing npm configuration parameters.
-
-
npm.config.get(key)
-
npm.config.set(key, val)
-
npm.config.del(key)
-
-
-
npm.dir or npm.root
-
The node_modules directory where npm will operate.
-
-
npm.prefix
-
The prefix where npm is operating. (Most often the current working
- directory.)
-
-
npm.cache
-
The place where npm keeps JSON and tarballs it fetches from the
- registry (or uploads to the registry).
-
-
npm.tmp
-
npm's temporary working directory.
-
-
npm.deref
-
Get the "real" name for a command that has either an alias or
- abbreviation.
-
-
-
MAGIC
-
For each of the methods in the npm.commands object, a method is added to the
-npm object, which takes a set of positional string arguments rather than an
-array and a callback.
-
If the last argument is a callback, then it will use the supplied
-callback. However, if no callback is provided, then it will print out
-the error or results.
Note that that won't work in a node program, since the install
-method will get called before the configuration load is completed.
-
ABBREVS
-
In order to support npm ins foo instead of npm install foo, the
-npm.commands object has a set of abbreviations as well as the full
-method names. Use the npm.deref method to find the real name.
-
For example:
-
var cmd = npm.deref("unp") // cmd === "unpublish"
-
For all of the subcommands, npm access will perform actions on the packages
-in the current working directory if no package name is passed to the
-subcommand.
-
-
public / restricted:
-Set a package to be either publicly accessible or restricted.
-
-
add / rm:
-Add or remove the ability of users and teams to have read-only or read-write
-access to a package.
-
-
ls:
-Show all of the access privileges for a package. Will only show permissions
-for packages to which you have at least read access.
-
-
edit:
-Set the access privileges for a package at once using $EDITOR.
-
-
-
DETAILS
-
npm access always operates directly on the current registry, configurable
-from the command line using --registry=<registry url>.
-
Unscoped packages are always public.
-
Scoped packages default to restricted, but you can either publish them as
-public using npm publish --access=public, or set their access as public using
-npm access public after the initial publish.
-
You must have privileges to set the access of a package:
-
-
You are an owner of an unscoped or scoped package.
-
You are a member of the team that owns a scope.
-
You have been given read-write privileges for a package, either as a member
-of a team or directly as an owner.
-
-
If your account is not paid, then attempts to publish scoped packages will fail
-with an HTTP 402 status code (logically enough), unless you use
---access=public.
Create or verify a user named <username> in the specified registry, and
-save the credentials to the .npmrc file. If no registry is specified,
-the default registry will be used (see npm-config(7)).
-
The username, password, and email are read in from prompts.
You may use this command multiple times with the same user account to
-authorize on a new machine. When authenticating on a new machine,
-the username, password and email address must all match with
-your existing record.
-
npm login is an alias to adduser and behaves exactly the same way.
The base URL of the npm package registry. If scope is also specified,
-this registry will only be used for packages with that scope. See npm-scope(7).
-
scope
-
Default: none
-
If specified, the user and login credentials given will be associated
-with the specified scope. See npm-scope(7). You can use both at the same time,
-e.g.
This will set a registry for the given scope and login or create a user for
-that registry at the same time.
-
always-auth
-
Default: false
-
If specified, save configuration indicating that all requests to the given
-registry should include authorization information. Useful for private
-registries. Can be used with --registry and / or --scope, e.g.
This will ensure that all requests to that registry (including for tarballs)
-include an authorization header. See always-auth in npm-config(7) for more
-details on always-auth. Registry-specific configuration of always-auth takes
-precedence over any global configuration.
npm bugs <pkgname>
-npm bugs (with no args in a package dir)
-
DESCRIPTION
-
This command tries to guess at the likely location of a package's
-bug tracker URL, and then tries to open it using the --browser
-config param. If no package name is provided, it will search for
-a package.json in the current folder and use the name property.
-
CONFIGURATION
-
browser
-
-
Default: OS X: "open", Windows: "start", Others: "xdg-open"
-
Type: String
-
-
The browser that is called by the npm bugs command to open websites.
The npm bundle command has been removed in 1.0, for the simple reason
-that it is no longer necessary, as the default behavior is now to
-install packages into the local space.
-
Just use npm install now to do what npm bundle used to do.
add:
-Add the specified package to the local cache. This command is primarily
-intended to be used internally by npm, but it can provide a way to
-add data to the local installation cache explicitly.
-
-
ls:
-Show the data in the cache. Argument is a path to show in the cache
-folder. Works a bit like the find program, but limited by the
-depth config.
-
-
clean:
-Delete data out of the cache folder. If an argument is provided, then
-it specifies a subpath to delete. If no argument is provided, then
-the entire cache is cleared.
-
-
-
DETAILS
-
npm stores cache data in the directory specified in npm config get cache.
-For each package that is added to the cache, three pieces of information are
-stored in {cache}/{name}/{version}:
-
-
.../package/package.json:
-The package.json file, as npm sees it.
-
.../package.tgz:
-The tarball for that version.
-
-
Additionally, whenever a registry request is made, a .cache.json file
-is placed at the corresponding URI, to store the ETag and the requested
-data. This is stored in {cache}/{hostname}/{path}/.cache.json.
-
Commands that make non-essential registry requests (such as search and
-view, or the completion scripts) generally specify a minimum timeout.
-If the .cache.json file is younger than the specified timeout, then
-they do not make an HTTP request to the registry.
-
CONFIGURATION
-
cache
-
Default: ~/.npm on Posix, or %AppData%/npm-cache on Windows.
The synopsis above
-loads the completions into your current shell. Adding it to
-your ~/.bashrc or ~/.zshrc will make the completions available
-everywhere.
-
You may of course also pipe the output of npm completion to a file
-such as /usr/local/etc/bash_completion.d/npm if you have a system
-that will read that file for you.
-
When COMP_CWORD, COMP_LINE, and COMP_POINT are defined in the
-environment, npm completion acts in "plumbing mode", and outputs
-completions based on the arguments.
Searches the local package tree and attempts to simplify the overall
-structure by moving dependencies further up the tree, where they can
-be more effectively shared by multiple dependent packages.
-
For example, consider this dependency graph:
-
a
-+-- b <-- depends on c@1.0.x
-| `-- c@1.0.3
-`-- d <-- depends on c@~1.0.9
- `-- c@1.0.10
-
In this case, npm-dedupe(1) will transform the tree to:
-
a
-+-- b
-+-- d
-`-- c@1.0.10
-
Because of the hierarchical nature of node's module lookup, b and d
-will both get their dependency met by the single c package at the root
-level of the tree.
-
If a suitable version exists at the target location in the tree
-already, then it will be left untouched, but the other duplicates will
-be deleted.
-
If no suitable version can be found, then a warning is printed, and
-nothing is done.
-
If any arguments are supplied, then they are filters, and only the
-named packages will be touched.
-
Note that this operation transforms the dependency tree, and may
-result in packages getting updated versions, perhaps from the npm
-registry.
-
This feature is experimental, and may change in future versions.
-
The --tag argument will apply to all of the affected dependencies. If a
-tag with the given name exists, the tagged version is preferred over newer
-versions.
Add, remove, and enumerate distribution tags on a package:
-
-
add:
-Tags the specified version of the package with the specified tag, or the
---tag config if not specified.
-
-
rm:
-Clear a tag that is no longer in use from the package.
-
-
ls:
-Show all of the dist-tags for a package, defaulting to the package in
-the current prefix.
-
-
-
A tag can be used when installing packages as a reference to a version instead
-of using a specific version number:
-
npm install <name>@<tag>
-
When installing dependencies, a preferred tagged version may be specified:
-
npm install --tag <tag>
-
This also applies to npm dedupe.
-
Publishing a package sets the "latest" tag to the published version unless the
---tag option is used. For example, npm publish --tag=beta.
-
PURPOSE
-
Tags can be used to provide an alias instead of version numbers. For
-example, npm currently uses the tag "next" to identify the upcoming
-version, and the tag "latest" to identify the current version.
-
A project might choose to have multiple streams of development, e.g.,
-"stable", "canary".
-
CAVEATS
-
This command used to be known as npm tag, which only created new tags, and so
-had a different syntax.
-
Tags must share a namespace with version numbers, because they are specified in
-the same slot: npm install <pkg>@<version> vs npm install <pkg>@<tag>.
-
Tags that can be interpreted as valid semver ranges will be rejected. For
-example, v1.4 cannot be used as a tag, because it is interpreted by semver as
->=1.4.0 <1.5.0. See https://github.com/npm/npm/issues/6082.
-
The simplest way to avoid semver problems with tags is to use tags that do not
-begin with a number or the letter v.
npm docs [<pkgname> [<pkgname> ...]]
-npm docs (with no args in a package dir)
-npm home [<pkgname> [<pkgname> ...]]
-npm home (with no args in a package dir)
-
DESCRIPTION
-
This command tries to guess at the likely location of a package's
-documentation URL, and then tries to open it using the --browser
-config param. You can pass multiple package names at once. If no
-package name is provided, it will search for a package.json in
-the current folder and use the name property.
-
CONFIGURATION
-
browser
-
-
Default: OS X: "open", Windows: "start", Others: "xdg-open"
-
Type: String
-
-
The browser that is called by the npm docs command to open websites.
Opens the package folder in the default editor (or whatever you've
-configured as the npm editor config -- see npm-config(7).)
-
After it has been edited, the package is rebuilt so as to pick up any
-changes in compiled packages.
-
For instance, you can do npm install connect to install connect
-into your package, and then npm edit connect to make a few
-changes to your locally installed copy.
-
CONFIGURATION
-
editor
-
-
Default: EDITOR environment variable if set, or "vi" on Posix,
-or "notepad" on Windows.
-
Type: path
-
-
The command to run for npm edit or npm config edit.
If supplied a topic, then show the appropriate documentation page.
-
If the topic does not exist, or if multiple terms are provided, then run
-the help-search command to find a match. Note that, if help-search
-finds a single subject, then it will run help on that topic, so unique
-matches are equivalent to specifying a topic name.
-
CONFIGURATION
-
viewer
-
-
Default: "man" on Posix, "browser" on Windows
-
Type: path
-
-
The program to use to view help content.
-
Set to "browser" to view html help content in the default web browser.
npm install (with no args in a package dir)
-npm install <tarball file>
-npm install <tarball url>
-npm install <folder>
-npm install [@<scope>/]<name> [--save|--save-dev|--save-optional] [--save-exact]
-npm install [@<scope>/]<name>@<tag>
-npm install [@<scope>/]<name>@<version>
-npm install [@<scope>/]<name>@<version range>
-npm i (with any of the previous argument usage)
-
DESCRIPTION
-
This command installs a package, and any packages that it depends on. If the
-package has a shrinkwrap file, the installation of dependencies will be driven
-by that. See npm-shrinkwrap(1).
-
A package is:
-
-
a) a folder containing a program described by a package.json file
-
b) a gzipped tarball containing (a)
-
c) a url that resolves to (b)
-
d) a <name>@<version> that is published on the registry (see npm-registry(7)) with (c)
-
e) a <name>@<tag> that points to (d)
-
f) a <name> that has a "latest" tag satisfying (e)
-
g) a <git remote url> that resolves to (b)
-
-
Even if you never publish your package, you can still get a lot of
-benefits of using npm if you just want to write a node program (a), and
-perhaps if you also want to be able to easily install it elsewhere
-after packing it up into a tarball (b).
-
-
npm install (in package directory, no arguments):
-
Install the dependencies in the local node_modules folder.
-
In global mode (ie, with -g or --global appended to the command),
- it installs the current package context (ie, the current working
- directory) as a global package.
-
By default, npm install will install all modules listed as dependencies.
- With the --production flag (or when the NODE_ENV environment variable
- is set to production), npm will not install modules listed in
- devDependencies.
-
-
npm install <folder>:
-
Install a package that is sitting in a folder on the filesystem.
-
-
npm install <tarball file>:
-
Install a package that is sitting on the filesystem. Note: if you just want
- to link a dev directory into your npm root, you can do this more easily by
- using npm link.
-
Example:
-
npm install ./package.tgz
-
-
npm install <tarball url>:
-
Fetch the tarball url, and then install it. In order to distinguish between
- this and other options, the argument must start with "http://" or "https://"
Do a <name>@<tag> install, where <tag> is the "tag" config. (See
- npm-config(7).)
-
In most cases, this will install the latest version
- of the module published on npm.
-
Example:
-
npm install sax
-
npm install takes 3 exclusive, optional flags which save or update
- the package version in your main package.json:
-
-
--save: Package will appear in your dependencies.
-
-
--save-dev: Package will appear in your devDependencies.
-
-
--save-optional: Package will appear in your optionalDependencies.
-
When using any of the above options to save dependencies to your
-package.json, there is an additional, optional flag:
-
-
--save-exact: Saved dependencies will be configured with an
-exact version rather than using npm's default semver range
-operator.
-
<scope> is optional. The package will be downloaded from the registry
-associated with the specified scope. If no registry is associated with
-the given scope the default registry is assumed. See npm-scope(7).
-
Note: if you do not include the @-symbol on your scope name, npm will
-interpret this as a GitHub repository instead, see below. Scopes names
-must also be followed by a slash.
**Note**: If there is a file or folder named `<name>` in the current
-working directory, then it will try to install that, and only try to
-fetch the package by name if it is not valid.
-
-
npm install [@<scope>/]<name>@<tag>:
-
Install the version of the package that is referenced by the specified tag.
- If the tag does not exist in the registry data for that package, then this
- will fail.
Install a version of the package matching the specified version range. This
- will follow the same rules for resolving dependencies described in package.json(5).
-
Note that most version ranges must be put in quotes so that your shell will
- treat it as a single argument.
Install the package at https://gist.github.com/gistID by attempting to
- clone it using git. The GitHub username associated with the gist is
- optional and will not be saved in package.json if --save is used.
-
If you don't specify a commit-ish then master will be used.
The --tag argument will apply to all of the specified install targets. If a
-tag with the given name exists, the tagged version is preferred over newer
-versions.
-
The --force argument will force npm to fetch remote resources even if a
-local copy exists on disk.
-
npm install sax --force
-
The --global argument will cause npm to install the package globally
-rather than locally. See npm-folders(5).
-
The --link argument will cause npm to link global installs into the
-local space in some cases.
-
The --no-bin-links argument will prevent npm from creating symlinks for
-any binaries the package might contain.
-
The --no-optional argument will prevent optional dependencies from
-being installed.
-
The --no-shrinkwrap argument, which will ignore an available
-shrinkwrap file and use the package.json instead.
-
The --nodedir=/path/to/node/source argument will allow npm to find the
-node source code so that npm can compile native modules.
-
See npm-config(7). Many of the configuration params have some
-effect on installation, since that's most of what npm does.
-
ALGORITHM
-
To install a package, npm uses the following algorithm:
-
install(where, what, family, ancestors)
-fetch what, unpack to <where>/node_modules/<what>
-for each dep in what.dependencies
- resolve dep to precise version
-for each dep@version in what.dependencies
- not in <where>/node_modules/<what>/node_modules/*
- and not in <family>
- add precise version deps to <family>
- install(<where>/node_modules/<what>, dep, family)
-
For this package{dep} structure: A{B,C}, B{C}, C{D},
-this algorithm produces:
-
A
-+-- B
-`-- C
- `-- D
-
That is, the dependency from B to C is satisfied by the fact that A
-already caused C to be installed at a higher level.
-
See npm-folders(5) for a more detailed description of the specific
-folder structures that npm creates.
-
Limitations of npm's Install Algorithm
-
There are some very rare and pathological edge-cases where a cycle can
-cause npm to try to install a never-ending tree of packages. Here is
-the simplest case:
-
A -> B -> A' -> B' -> A -> B -> A' -> B' -> A -> ...
-
where A is some version of a package, and A' is a different version
-of the same package. Because B depends on a different version of A
-than the one that is already in the tree, it must install a separate
-copy. The same is true of A', which must install B'. Because B'
-depends on the original version of A, which has been overridden, the
-cycle falls into infinite regress.
-
To avoid this situation, npm flat-out refuses to install any
-name@version that is already present anywhere in the tree of package
-folder ancestors. A more correct, but more complex, solution would be
-to symlink the existing version into the new location. If this ever
-affects a real use-case, it will be investigated.
npm link (in package folder)
-npm link [@<scope>/]<pkgname>
-npm ln (with any of the previous argument usage)
-
DESCRIPTION
-
Package linking is a two-step process.
-
First, npm link in a package folder will create a globally-installed
-symbolic link from prefix/package-name to the current folder (see
-npm-config(7) for the value of prefix).
-
Next, in some other location, npm link package-name will create a
-symlink from the local node_modules folder to the global symlink.
-
Note that package-name is taken from package.json,
-not from directory name.
-
The package name can be optionally prefixed with a scope. See npm-scope(7).
-The scope must be preceded by an @-symbol and followed by a slash.
-
When creating tarballs for npm publish, the linked packages are
-"snapshotted" to their current state by resolving the symbolic links.
-
This is handy for installing your own stuff, so that you can work on it and
-test it iteratively without having to continually rebuild.
-
For example:
-
cd ~/projects/node-redis # go into the package directory
-npm link # creates global link
-cd ~/projects/node-bloggy # go into some other package directory.
-npm link redis # link-install the package
-
Now, any changes to ~/projects/node-redis will be reflected in
-~/projects/node-bloggy/node_modules/node-redis/. Note that the link should
-be to the package name, not the directory name for that package.
-
You may also shortcut the two steps in one. For example, to do the
-above use-case in a shorter way:
-
cd ~/projects/node-bloggy # go into the dir of your main project
-npm link ../node-redis # link the dir of your dependency
-
The second line is the equivalent of doing:
-
(cd ../node-redis; npm link)
-npm link node-redis
-
That is, it first creates a global link, and then links the global
-installation target into your project's node_modules folder.
-
If your linked package is scoped (see npm-scope(7)) your link command must
-include that scope, e.g.
When logged into a registry that supports token-based authentication, tell the
-server to end this token's session. This will invalidate the token everywhere
-you're using it, not just for the current environment.
-
When logged into a legacy registry that uses username and password authentication, this will
-clear the credentials in your user configuration. In this case, it will only affect
-the current environment.
-
If --scope is provided, this will find the credentials for the registry
-connected to that scope, if set.
The base URL of the npm package registry. If scope is also specified,
-it takes precedence.
-
scope
-
Default: none
-
If specified, the user and login credentials given will be associated
-with the specified scope. See npm-scope(7). You can use both at the same time,
-e.g.
npm list [[@<scope>/]<pkg> ...]
-npm ls [[@<scope>/]<pkg> ...]
-npm la [[@<scope>/]<pkg> ...]
-npm ll [[@<scope>/]<pkg> ...]
-
DESCRIPTION
-
This command will print to stdout all the versions of packages that are
-installed, as well as their dependencies, in a tree-structure.
-
Positional arguments are name@version-range identifiers, which will
-limit the results to only the paths to the packages named. Note that
-nested packages will also show the paths to the specified packages.
-For example, running npm ls promzard in npm's source tree will show:
It will print out extraneous, missing, and invalid packages.
-
If a project specifies git urls for dependencies these are shown
-in parentheses after the name@version to make it easier for users to
-recognize potential forks of a project.
-
When run as ll or la, it shows extended information by default.
-
CONFIGURATION
-
json
-
-
Default: false
-
Type: Boolean
-
-
Show information in JSON format.
-
long
-
-
Default: false
-
Type: Boolean
-
-
Show extended information.
-
parseable
-
-
Default: false
-
Type: Boolean
-
-
Show parseable output instead of tree view.
-
global
-
-
Default: false
-
Type: Boolean
-
-
List packages in the global install prefix instead of in the current
-project.
-
depth
-
-
Type: Int
-
-
Max display depth of the dependency tree.
-
prod / production
-
-
Type: Boolean
-
Default: false
-
-
Display only the dependency tree for packages in dependencies.
-
dev
-
-
Type: Boolean
-
Default: false
-
-
Display only the dependency tree for packages in devDependencies.
This command will check the registry to see if any (or, specific) installed
-packages are currently outdated.
-
The resulting field 'wanted' shows the latest version according to the
-version specified in the package.json, the field 'latest' the very latest
-version of the package.
-
CONFIGURATION
-
json
-
-
Default: false
-
Type: Boolean
-
-
Show information in JSON format.
-
long
-
-
Default: false
-
Type: Boolean
-
-
Show extended information.
-
parseable
-
-
Default: false
-
Type: Boolean
-
-
Show parseable output instead of tree view.
-
global
-
-
Default: false
-
Type: Boolean
-
-
Check packages in the global install prefix instead of in the current
-project.
ls:
-List all the users who have access to modify a package and push new versions.
-Handy when you need to know who to bug for help.
-
add:
-Add a new user as a maintainer of a package. This user is enabled to modify
-metadata, publish new versions, and add other owners.
-
rm:
-Remove a user from the package owner list. This immediately revokes their
-privileges.
-
-
Note that there is only one level of access. Either you can modify a package,
-or you can't. Future versions may contain more fine-grained access levels, but
-that is not implemented at this time.
For anything that's installable (that is, a package folder, tarball,
-tarball url, name@tag, name@version, or name), this command will fetch
-it to the cache, and then copy the tarball to the current working
-directory as <name>-<version>.tgz, and then write the filenames out to
-stdout.
-
If the same package is specified multiple times, then the file will be
-overwritten the second time.
-
If no arguments are supplied, then npm packs the current package folder.
This command removes "extraneous" packages. If a package name is
-provided, then only packages matching one of the supplied names are
-removed.
-
Extraneous packages are packages that are not listed on the parent
-package's dependencies list.
-
If the --production flag is specified or the NODE_ENV environment
-variable is set to production, this command will remove the packages
-specified in your devDependencies. Setting --production=false will
-negate NODE_ENV being set to production.
Publishes a package to the registry so that it can be installed by name. See
-npm-developers(7) for details on what's included in the published package, as
-well as details on how the package is built.
-
By default npm will publish to the public registry. This can be overridden by
-specifying a different default registry or using a npm-scope(7) in the name
-(see package.json(5)).
-
-
<folder>:
-A folder containing a package.json file
-
-
<tarball>:
-A url or file path to a gzipped tar archive containing a single folder
-with a package.json file inside.
-
-
[--tag <tag>]
-Registers the published package with the given tag, such that npm install
-<name>@<tag> will install this version. By default, npm publish updates
-and npm install installs the latest tag.
-
-
[--access <public|restricted>]
-Tells the registry whether this package should be published as public or
-restricted. Only applies to scoped packages, which default to restricted.
-If you don't have a paid account, you must publish with --access public
-to publish scoped packages.
-
-
-
Fails if the package name and version combination already exists in
-the specified registry.
-
Once a package is published with a given name and version, that
-specific name and version combination can never be used again, even if
-it is removed with npm-unpublish(1).
This command runs the npm build command on the matched folders. This is useful
-when you install a new version of node, and must recompile all your C++ addons with
-the new binary.
npm repo <pkgname>
-npm repo (with no args in a package dir)
-
DESCRIPTION
-
This command tries to guess at the likely location of a package's
-repository URL, and then tries to open it using the --browser
-config param. If no package name is provided, it will search for
-a package.json in the current folder and use the name property.
-
CONFIGURATION
-
browser
-
-
Default: OS X: "open", Windows: "start", Others: "xdg-open"
-
Type: String
-
-
The browser that is called by the npm repo command to open websites.
This runs an arbitrary command from a package's "scripts" object. If no
-"command" is provided, it will list the available scripts. run[-script] is
-used by the test, start, restart, and stop commands, but can be called
-directly, as well. When the scripts in the package are printed out, they're
-separated into lifecycle (test, start, restart) and directly-run scripts.
-
As of npm@2.0.0, you can
-use custom arguments when executing scripts. The special option -- is used by
-getopt to delimit the end of the options. npm will pass
-all the arguments after the -- directly to your script:
-
npm run test -- --grep="pattern"
-
The arguments will only be passed to the script specified after npm run
-and not to any pre or post script.
-
The env script is a special built-in command that can be used to list
-environment variables that will be available to the script at runtime. If an
-"env" command is defined in your package it will take precedence over the
-built-in.
-
In addition to the shell's pre-existing PATH, npm run adds
-node_modules/.bin to the PATH provided to scripts. Any binaries provided by
-locally-installed dependencies can be used without the node_modules/.bin
-prefix. For example, if there is a devDependency on tap in your package,
-you should write:
-
"scripts": {"test": "tap test/\*.js"}
-
instead of "scripts": {"test": "node_modules/.bin/tap test/\*.js"} to run your tests.
npm search [--long] [search terms ...]
-npm s [search terms ...]
-npm se [search terms ...]
-
DESCRIPTION
-
Search the registry for packages matching the search terms.
-
If a term starts with /, then it's interpreted as a regular expression.
-A trailing / will be ignored in this case. (Note that many regular
-expression characters must be escaped or quoted in most shells.)
-
CONFIGURATION
-
long
-
-
Default: false
-
Type: Boolean
-
-
Display full package descriptions and other long text across multiple
-lines. When disabled (default) search results are truncated to fit
-neatly on a single line. Modules with extremely long names will
-fall on multiple lines.
This command locks down the versions of a package's dependencies so
-that you can control exactly which versions of each dependency will be
-used when your package is installed. The package.json file is still
-required if you want to use npm install.
-
By default, npm install recursively installs the target's
-dependencies (as specified in package.json), choosing the latest
-available version that satisfies the dependency's semver pattern. In
-some situations, particularly when shipping software where each change
-is tightly managed, it's desirable to fully specify each version of
-each dependency recursively so that subsequent builds and deploys do
-not inadvertently pick up newer versions of a dependency that satisfy
-the semver pattern. Specifying specific semver patterns in each
-dependency's package.json would facilitate this, but that's not always
-possible or desirable, as when another author owns the npm package.
-It's also possible to check dependencies directly into source control,
-but that may be undesirable for other reasons.
If these are the only versions of A, B, and C available in the
-registry, then a normal npm install A will install:
-
A@0.1.0
-`-- B@0.0.1
- `-- C@0.0.1
-
However, if B@0.0.2 is published, then a fresh npm install A will
-install:
-
A@0.1.0
-`-- B@0.0.2
- `-- C@0.0.1
-
assuming the new version did not modify B's dependencies. Of course,
-the new version of B could include a new version of C and any number
-of new dependencies. If such changes are undesirable, the author of A
-could specify a dependency on B@0.0.1. However, if A's author and B's
-author are not the same person, there's no way for A's author to say
-that he or she does not want to pull in newly published versions of C
-when B hasn't changed at all.
-
In this case, A's author can run
-
npm shrinkwrap
-
This generates npm-shrinkwrap.json, which will look something like this:
The shrinkwrap command has locked down the dependencies based on
-what's currently installed in node_modules. When npm install
-installs a package with an npm-shrinkwrap.json in the package
-root, the shrinkwrap file (rather than package.json files) completely
-drives the installation of that package and all of its dependencies
-(recursively). So now the author publishes A@0.1.0, and subsequent
-installs of this package will use B@0.0.1 and C@0.0.1, regardless the
-dependencies and versions listed in A's, B's, and C's package.json
-files.
-
Using shrinkwrapped packages
-
Using a shrinkwrapped package is no different than using any other
-package: you can npm install it by hand, or add a dependency to your
-package.json file and npm install it.
-
Building shrinkwrapped packages
-
To shrinkwrap an existing package:
-
-
Run npm install in the package root to install the current
-versions of all dependencies.
-
Validate that the package works as expected with these versions.
-
Run npm shrinkwrap, add npm-shrinkwrap.json to git, and publish
-your package.
-
-
To add or update a dependency in a shrinkwrapped package:
-
-
Run npm install in the package root to install the current
-versions of all dependencies.
-
Add or update dependencies. npm install each new or updated
-package individually and then update package.json. Note that they
-must be explicitly named in order to be installed: running npm
-install with no arguments will merely reproduce the existing
-shrinkwrap.
-
Validate that the package works as expected with the new
-dependencies.
-
Run npm shrinkwrap, commit the new npm-shrinkwrap.json, and
-publish your package.
-
-
You can use npm-outdated(1) to view dependencies with newer versions
-available.
-
Other Notes
-
A shrinkwrap file must be consistent with the package's package.json
-file. npm shrinkwrap will fail if required dependencies are not
-already installed, since that would result in a shrinkwrap that
-wouldn't actually work. Similarly, the command will fail if there are
-extraneous packages (not referenced by package.json), since that would
-indicate that package.json is not correct.
-
Since npm shrinkwrap is intended to lock down your dependencies for
-production use, devDependencies will not be included unless you
-explicitly set the --dev flag when you run npm shrinkwrap. If
-installed devDependencies are excluded, then npm will print a
-warning. If you want them to be installed with your module by
-default, please consider adding them to dependencies instead.
-
If shrinkwrapped package A depends on shrinkwrapped package B, B's
-shrinkwrap will not be used as part of the installation of A. However,
-because A's shrinkwrap is constructed from a valid installation of B
-and recursively specifies all dependencies, the contents of B's
-shrinkwrap will implicitly be included in A's shrinkwrap.
-
Caveats
-
If you wish to lock down the specific bytes included in a package, for
-example to have 100% confidence in being able to reproduce a
-deployment or build, then you ought to check your dependencies into
-source control, or pursue some other mechanism that can verify
-contents rather than versions.
THIS COMMAND IS DEPRECATED. See npm-dist-tag(1) for details.
-
Tags the specified version of the package with the specified tag, or the
---tag config if not specified.
-
A tag can be used when installing packages as a reference to a version instead
-of using a specific version number:
-
npm install <name>@<tag>
-
When installing dependencies, a preferred tagged version may be specified:
-
npm install --tag <tag>
-
This also applies to npm dedupe.
-
Publishing a package always sets the "latest" tag to the published version.
-
PURPOSE
-
Tags can be used to provide an alias instead of version numbers. For
-example, npm currently uses the tag "next" to identify the upcoming
-version, and the tag "latest" to identify the current version.
-
A project might choose to have multiple streams of development, e.g.,
-"stable", "canary".
-
CAVEATS
-
Tags must share a namespace with version numbers, because they are
-specified in the same slot: npm install <pkg>@<version> vs npm
-install <pkg>@<tag>.
-
Tags that can be interpreted as valid semver ranges will be
-rejected. For example, v1.4 cannot be used as a tag, because it is
-interpreted by semver as >=1.4.0 <1.5.0. See
-https://github.com/npm/npm/issues/6082.
-
The simplest way to avoid semver problems with tags is to use tags
-that do not begin with a number or the letter v.
It is generally considered bad behavior to remove versions of a library
-that others are depending on!
-
Consider using the deprecate command
-instead, if your intent is to encourage users to upgrade.
-
There is plenty of room on the registry.
-
DESCRIPTION
-
This removes a package version from the registry, deleting its
-entry and removing the tarball.
-
If no version is specified, or if all versions are removed then
-the root package entry is removed from the registry entirely.
-
Even if a package version is unpublished, that specific name and
-version combination can never be reused. In order to publish the
-package again, a new version number must be used.
-
The scope is optional and follows the usual rules for npm-scope(7).
This command will update all the packages listed to the latest version
-(specified by the tag config), respecting semver.
-
It will also install missing packages. As with all commands that install
-packages, the --dev flag will cause devDependencies to be processed
-as well.
-
If the -g flag is specified, this command will update globally installed
-packages.
-
If no package name is specified, all packages in the specified location (global
-or local) will be updated.
-
As of npm@2.6.1, the npm update will only inspect top-level packages.
-Prior versions of npm would also recursively inspect all dependencies.
-To get the old behavior, use npm --depth 9999 update, but be warned that
-simultaneous asynchronous update of all packages, including npm itself
-and packages that npm depends on, often causes problems up to and including
-the uninstallation of npm itself.
-
To restore a missing npm, use the command:
-
curl -L https://npmjs.com/install.sh | sh
-
EXAMPLES
-
IMPORTANT VERSION NOTE: these examples assume npm@2.6.1 or later. For
-older versions of npm, you must specify --depth 0 to get the behavior
-described below.
-
For the examples below, assume that the current package is app and it depends
-on dependencies, dep1 (dep2, .. etc.). The published versions of dep1 are:
Then npm update will install dep1@1.2.2, because 1.2.2 is latest and
-1.2.2 satisfies ^1.1.1.
-
Tilde Dependencies
-
However, if app's package.json contains:
-
dependencies: {
- dep1: "~1.1.1"
-}
-
In this case, running npm update will install dep1@1.1.2. Even though the latest
-tag points to 1.2.2, this version does not satisfy ~1.1.1, which is equivalent
-to >=1.1.1 <1.2.0. So the highest-sorting version that satisfies ~1.1.1 is used,
-which is 1.1.2.
-
Caret Dependencies below 1.0.0
-
Suppose app has a caret dependency on a version below 1.0.0, for example:
-
dependencies: {
- dep1: "^0.2.0"
-}
-
npm update will install dep1@0.2.0, because there are no other
-versions which satisfy ^0.2.0.
-
If the dependence were on ^0.4.0:
-
dependencies: {
- dep1: "^0.4.0"
-}
-
Then npm update will install dep1@0.4.1, because that is the highest-sorting
-version that satisfies ^0.4.0 (>= 0.4.0 <0.5.0)
-
Recording Updates with --save
-
When you want to update a package and save the new version as
-the minimum required dependency in package.json, you can use
-npm update --save. For example if package.json contains
-
dependencies: {
- dep1: "^1.1.1"
-}
-
Then npm update --save will install dep1@1.2.2 (i.e., latest),
-and package.json will be modified:
-
dependencies: {
- dep1: "^1.2.2"
-}
-
Note that npm will only write an updated version to package.json
-if it installs a new package.
-
Updating Globally-Installed Packages
-
npm update -g will apply the update action to each globally- installed
-package that is outdated -- that is, has a version that is different from
-latest.
-
NOTE: If a package has been upgraded to a version newer than latest, it will
-be downgraded.
npm version [<newversion> | major | minor | patch | premajor | preminor | prepatch | prerelease]
-
DESCRIPTION
-
Run this in a package directory to bump the version and write the new
-data back to package.json and, if present, npm-shrinkwrap.json.
-
The newversion argument should be a valid semver string, or a
-valid second argument to semver.inc (one of patch, minor, major,
-prepatch, preminor, premajor, prerelease). In the second case,
-the existing version will be incremented by 1 in the specified field.
-
If run in a git repo, it will also create a version commit and tag.
-This behavior is controlled by git-tag-version (see below), and can
-be disabled on the command line by running npm --no-git-tag-version version.
-It will fail if the working directory is not clean, unless the --force
-flag is set.
-
If supplied with --message (shorthand: -m) config option, npm will
-use it as a commit message when creating a version commit. If the
-message config contains %s then that will be replaced with the
-resulting version number. For example:
-
npm version patch -m "Upgrade to %s for reasons"
-
If the sign-git-tag config is set, then the tag will be signed using
-the -s flag to git. Note that you must have a default GPG key set up
-in your git config for this to work properly. For example:
-
$ npm config set sign-git-tag true
-$ npm version patch
-
-You need a passphrase to unlock the secret key for
-user: "isaacs (http://blog.izs.me/) <i@izs.me>"
-2048-bit RSA key, ID 6C481CF6, created 2010-08-31
-
-Enter passphrase:
-
If preversion, version, or postversion are in the scripts property of
-the package.json, they will be executed as part of running npm version.
-
The exact order of execution is as follows:
-
-
Check to make sure the git working directory is clean before we get started.
-Your scripts may add files to the commit in future steps.
-This step is skipped if the --force flag is set.
-
Run the preversion script. These scripts have access to the old version in package.json.
-A typical use would be running your full test suite before deploying.
-Any files you want added to the commit should be explicitly added using git add.
-
Bump version in package.json as requested (patch, minor, major, etc).
-
Run the version script. These scripts have access to the new version in package.json
-(so they can incorporate it into file headers in generated files for example).
-Again, scripts should explicitly add generated files to the commit using git add.
-
Commit and tag.
-
Run the postversion script. Use it to clean up the file system or automatically push
-the commit and/or tag.
This runs all your tests, and proceeds only if they pass. Then runs your build script, and
-adds everything in the dist directory to the commit. After the commit, it pushes the new commit
-and tag up to the server, and deletes the build/temp directory.
npm view [@<scope>/]<name>[@<version>] [<field>[.<subfield>]...]
-npm v [@<scope>/]<name>[@<version>] [<field>[.<subfield>]...]
-
DESCRIPTION
-
This command shows data about a package and prints it to the stream
-referenced by the outfd config, which defaults to stdout.
-
To show the package registry entry for the connect package, you can do
-this:
-
npm view connect
-
The default version is "latest" if unspecified.
-
Field names can be specified after the package descriptor.
-For example, to show the dependencies of the ronn package at version
-0.3.5, you could do the following:
-
npm view ronn@0.3.5 dependencies
-
You can view child fields by separating them with a period.
-To view the git repository URL for the latest version of npm, you could
-do this:
-
npm view npm repository.url
-
This makes it easy to view information about a dependency with a bit of
-shell scripting. For example, to view all the data about the version of
-opts that ronn depends on, you can do this:
-
npm view opts@$(npm view ronn dependencies.opts)
-
For fields that are arrays, requesting a non-numeric field will return
-all of the values from the objects in the list. For example, to get all
-the contributor names for the "express" project, you can do this:
-
npm view express contributors.email
-
You may also use numeric indices in square braces to specifically select
-an item in an array field. To just get the email address of the first
-contributor in the list, you can do this:
-
npm view express contributors[0].email
-
Multiple fields may be specified, and will be printed one after another.
-For exampls, to get all the contributor names and email addresses, you
-can do this:
"Person" fields are shown as a string if they would be shown as an
-object. So, for example, this will show the list of npm contributors in
-the shortened string format. (See package.json(5) for more on this.)
-
npm view npm contributors
-
If a version range is provided, then data will be printed for every
-matching version of the package. This will show which version of jsdom
-was required by each matching version of yui3:
-
npm view yui3@'>0.5.4' dependencies.jsdom
-
OUTPUT
-
If only a single string field for a single version is output, then it
-will not be colorized or quoted, so as to enable piping the output to
-another command. If the field is an object, it will be output as a JavaScript object literal.
-
If the --json flag is given, the outputted fields will be JSON.
-
If the version range matches multiple versions, than each printed value
-will be prefixed with the version it applies to.
-
If multiple fields are requested, than each of them are prefixed with
-the field name.
npm is the package manager for the Node JavaScript platform. It puts
-modules in place so that node can find them, and manages dependency
-conflicts intelligently.
-
It is extremely configurable to support a wide variety of use cases.
-Most commonly, it is used to publish, discover, install, and develop node
-programs.
-
Run npm help to get a list of available commands.
-
INTRODUCTION
-
You probably got npm because you want to install stuff.
-
Use npm install blerg to install the latest version of "blerg". Check out
-npm-install(1) for more info. It can do a lot of stuff.
-
Use the npm search command to show everything that's available.
-Use npm ls to show everything you've installed.
-
DEPENDENCIES
-
If a package references to another package with a git URL, npm depends
-on a preinstalled git.
-
If one of the packages npm tries to install is a native node module and
-requires compiling of C++ Code, npm will use
-node-gyp for that task.
-For a Unix system, node-gyp
-needs Python, make and a buildchain like GCC. On Windows,
-Python and Microsoft Visual Studio C++ is needed. Python 3 is
-not supported by node-gyp.
-For more information visit
-the node-gyp repository and
-the node-gyp Wiki.
global mode: npm installs packages into the install prefix at
-prefix/lib/node_modules and bins are installed in prefix/bin.
-
local mode: npm installs packages into the current project directory, which
-defaults to the current working directory. Packages are installed to
-./node_modules, and bins are installed to ./node_modules/.bin.
-
-
Local mode is the default. Use --global or -g on any command to
-operate in global mode instead.
-
DEVELOPER USAGE
-
If you're using npm to develop and publish your code, check out the
-following help topics:
link:
-For linking your current working code into Node's path, so that you
-don't have to reinstall every time you make a change. Use
-npm link to do this.
-
install:
-It's a good idea to install things if you don't need the symbolic link.
-Especially, installing other peoples code from the registry is done via
-npm install
-
adduser:
-Create an account or log in. Credentials are stored in the
-user config file.
-
publish:
-Use the npm publish command to upload your code to the registry.
-
-
CONFIGURATION
-
npm is extremely configurable. It reads its configuration options from
-5 places.
-
-
Command line switches: Set a config with --key val. All keys take a value, even if they
-are booleans (the config parser doesn't know what the options are at
-the time of parsing.) If no value is provided, then the option is set
-to boolean true.
-
Environment Variables: Set any config by prefixing the name in an environment variable with
-npm_config_. For example, export npm_config_key=val.
-
User Configs: The file at $HOME/.npmrc is an ini-formatted list of configs. If
-present, it is parsed. If the userconfig option is set in the cli
-or env, then that will be used instead.
-
Global Configs: The file found at ../etc/npmrc (from the node executable, by default
-this resolves to /usr/local/etc/npmrc) will be parsed if it is found.
-If the globalconfig option is set in the cli, env, or user config,
-then that file is parsed instead.
-
Defaults: npm's default configuration options are defined in
-lib/utils/config-defs.js. These must not be changed.
code:
-Read through npm-coding-style(7) if you plan to submit code.
-You don't have to agree with it, but you do have to follow it.
-
docs:
-If you find an error in the documentation, edit the appropriate markdown
-file in the "doc" folder. (Don't worry about generating the man page.)
-
-
Contributors are listed in npm's package.json file. You can view them
-easily by doing npm view npm contributors.
-
If you would like to contribute, but don't know what to work on, check
-the issues list or ask on the mailing list.
npm puts various things on your computer. That's its job.
-
This document will tell you what it puts where.
-
tl;dr
-
-
Local install (default): puts stuff in ./node_modules of the current
-package root.
-
Global install (with -g): puts stuff in /usr/local or wherever node
-is installed.
-
Install it locally if you're going to require() it.
-
Install it globally if you're going to run it on the command line.
-
If you need both, then install it in both places, or use npm link.
-
-
prefix Configuration
-
The prefix config defaults to the location where node is installed.
-On most systems, this is /usr/local, and most of the time is the same
-as node's process.installPrefix.
-
On windows, this is the exact location of the node.exe binary. On Unix
-systems, it's one level up, since node is typically installed at
-{prefix}/bin/node rather than {prefix}/node.exe.
-
When the global flag is set, npm installs things into this prefix.
-When it is not set, it uses the root of the current package, or the
-current working directory if not in a package already.
-
Node Modules
-
Packages are dropped into the node_modules folder under the prefix.
-When installing locally, this means that you can
-require("packagename") to load its main module, or
-require("packagename/lib/path/to/sub/module") to load other modules.
-
Global installs on Unix systems go to {prefix}/lib/node_modules.
-Global installs on Windows go to {prefix}/node_modules (that is, no
-lib folder.)
-
Scoped packages are installed the same way, except they are grouped together
-in a sub-folder of the relevant node_modules folder with the name of that
-scope prefix by the @ symbol, e.g. npm install @myorg/package would place
-the package in {prefix}/node_modules/@myorg/package. See scopes(7) for
-more details.
-
If you wish to require() a package, then install it locally.
-
Executables
-
When in global mode, executables are linked into {prefix}/bin on Unix,
-or directly into {prefix} on Windows.
-
When in local mode, executables are linked into
-./node_modules/.bin so that they can be made available to scripts run
-through npm. (For example, so that a test runner will be in the path
-when you run npm test.)
-
Man Pages
-
When in global mode, man pages are linked into {prefix}/share/man.
-
When in local mode, man pages are not installed.
-
Man pages are not installed on Windows systems.
-
Cache
-
See npm-cache(1). Cache files are stored in ~/.npm on Posix, or
-~/npm-cache on Windows.
-
This is controlled by the cache configuration param.
-
Temp Files
-
Temporary files are stored by default in the folder specified by the
-tmp config, which defaults to the TMPDIR, TMP, or TEMP environment
-variables, or /tmp on Unix and c:\windows\temp on Windows.
-
Temp files are given a unique folder under this root for each run of the
-program, and are deleted upon successful exit.
-
More Information
-
When installing locally, npm first tries to find an appropriate
-prefix folder. This is so that npm install foo@1.2.3 will install
-to the sensible root of your package, even if you happen to have cded
-into some other folder.
-
Starting at the $PWD, npm will walk up the folder tree checking for a
-folder that contains either a package.json file, or a node_modules
-folder. If such a thing is found, then that is treated as the effective
-"current directory" for the purpose of running npm commands. (This
-behavior is inspired by and similar to git's .git-folder seeking
-logic when running git commands in a working dir.)
-
If no package root is found, then the current folder is used.
-
When you run npm install foo@1.2.3, then the package is loaded into
-the cache, and then unpacked into ./node_modules/foo. Then, any of
-foo's dependencies are similarly unpacked into
-./node_modules/foo/node_modules/....
-
Any bin files are symlinked to ./node_modules/.bin/, so that they may
-be found by npm scripts when necessary.
-
Global Installation
-
If the global configuration is set to true, then npm will
-install packages "globally".
-
For global installation, packages are installed roughly the same way,
-but using the folders described above.
-
Cycles, Conflicts, and Folder Parsimony
-
Cycles are handled using the property of node's module system that it
-walks up the directories looking for node_modules folders. So, at every
-stage, if a package is already installed in an ancestor node_modules
-folder, then it is not installed at the current location.
-
Consider the case above, where foo -> bar -> baz. Imagine if, in
-addition to that, baz depended on bar, so you'd have:
-foo -> bar -> baz -> bar -> baz .... However, since the folder
-structure is: foo/node_modules/bar/node_modules/baz, there's no need to
-put another copy of bar into .../baz/node_modules, since when it calls
-require("bar"), it will get the copy that is installed in
-foo/node_modules/bar.
-
This shortcut is only used if the exact same
-version would be installed in multiple nested node_modules folders. It
-is still possible to have a/node_modules/b/node_modules/a if the two
-"a" packages are different versions. However, without repeating the
-exact same package multiple times, an infinite regress will always be
-prevented.
-
Another optimization can be made by installing dependencies at the
-highest level possible, below the localized "target" folder.
Since foo depends directly on bar@1.2.3 and baz@1.2.3, those are
-installed in foo's node_modules folder.
-
Even though the latest copy of blerg is 1.3.7, foo has a specific
-dependency on version 1.2.5. So, that gets installed at [A]. Since the
-parent installation of blerg satisfies bar's dependency on blerg@1.x,
-it does not install another copy under [B].
-
Bar [B] also has dependencies on baz and asdf, so those are installed in
-bar's node_modules folder. Because it depends on baz@2.x, it cannot
-re-use the baz@1.2.3 installed in the parent node_modules folder [D],
-and must install its own copy [C].
-
Underneath bar, the baz -> quux -> bar dependency creates a cycle.
-However, because bar is already in quux's ancestry [B], it does not
-unpack another copy of bar into that folder.
-
Underneath foo -> baz [D], quux's [E] folder tree is empty, because its
-dependency on bar is satisfied by the parent folder copy installed at [B].
-
For a graphical breakdown of what is installed where, use npm ls.
-
Publishing
-
Upon publishing, npm will look in the node_modules folder. If any of
-the items there are not in the bundledDependencies array, then they will
-not be included in the package tarball.
-
This allows a package maintainer to install all of their dependencies
-(and dev dependencies) locally, but only re-publish those items that
-cannot be found elsewhere. See package.json(5) for more information.
npm puts various things on your computer. That's its job.
-
This document will tell you what it puts where.
-
tl;dr
-
-
Local install (default): puts stuff in ./node_modules of the current
-package root.
-
Global install (with -g): puts stuff in /usr/local or wherever node
-is installed.
-
Install it locally if you're going to require() it.
-
Install it globally if you're going to run it on the command line.
-
If you need both, then install it in both places, or use npm link.
-
-
prefix Configuration
-
The prefix config defaults to the location where node is installed.
-On most systems, this is /usr/local, and most of the time is the same
-as node's process.installPrefix.
-
On windows, this is the exact location of the node.exe binary. On Unix
-systems, it's one level up, since node is typically installed at
-{prefix}/bin/node rather than {prefix}/node.exe.
-
When the global flag is set, npm installs things into this prefix.
-When it is not set, it uses the root of the current package, or the
-current working directory if not in a package already.
-
Node Modules
-
Packages are dropped into the node_modules folder under the prefix.
-When installing locally, this means that you can
-require("packagename") to load its main module, or
-require("packagename/lib/path/to/sub/module") to load other modules.
-
Global installs on Unix systems go to {prefix}/lib/node_modules.
-Global installs on Windows go to {prefix}/node_modules (that is, no
-lib folder.)
-
Scoped packages are installed the same way, except they are grouped together
-in a sub-folder of the relevant node_modules folder with the name of that
-scope prefix by the @ symbol, e.g. npm install @myorg/package would place
-the package in {prefix}/node_modules/@myorg/package. See scopes(7) for
-more details.
-
If you wish to require() a package, then install it locally.
-
Executables
-
When in global mode, executables are linked into {prefix}/bin on Unix,
-or directly into {prefix} on Windows.
-
When in local mode, executables are linked into
-./node_modules/.bin so that they can be made available to scripts run
-through npm. (For example, so that a test runner will be in the path
-when you run npm test.)
-
Man Pages
-
When in global mode, man pages are linked into {prefix}/share/man.
-
When in local mode, man pages are not installed.
-
Man pages are not installed on Windows systems.
-
Cache
-
See npm-cache(1). Cache files are stored in ~/.npm on Posix, or
-~/npm-cache on Windows.
-
This is controlled by the cache configuration param.
-
Temp Files
-
Temporary files are stored by default in the folder specified by the
-tmp config, which defaults to the TMPDIR, TMP, or TEMP environment
-variables, or /tmp on Unix and c:\windows\temp on Windows.
-
Temp files are given a unique folder under this root for each run of the
-program, and are deleted upon successful exit.
-
More Information
-
When installing locally, npm first tries to find an appropriate
-prefix folder. This is so that npm install foo@1.2.3 will install
-to the sensible root of your package, even if you happen to have cded
-into some other folder.
-
Starting at the $PWD, npm will walk up the folder tree checking for a
-folder that contains either a package.json file, or a node_modules
-folder. If such a thing is found, then that is treated as the effective
-"current directory" for the purpose of running npm commands. (This
-behavior is inspired by and similar to git's .git-folder seeking
-logic when running git commands in a working dir.)
-
If no package root is found, then the current folder is used.
-
When you run npm install foo@1.2.3, then the package is loaded into
-the cache, and then unpacked into ./node_modules/foo. Then, any of
-foo's dependencies are similarly unpacked into
-./node_modules/foo/node_modules/....
-
Any bin files are symlinked to ./node_modules/.bin/, so that they may
-be found by npm scripts when necessary.
-
Global Installation
-
If the global configuration is set to true, then npm will
-install packages "globally".
-
For global installation, packages are installed roughly the same way,
-but using the folders described above.
-
Cycles, Conflicts, and Folder Parsimony
-
Cycles are handled using the property of node's module system that it
-walks up the directories looking for node_modules folders. So, at every
-stage, if a package is already installed in an ancestor node_modules
-folder, then it is not installed at the current location.
-
Consider the case above, where foo -> bar -> baz. Imagine if, in
-addition to that, baz depended on bar, so you'd have:
-foo -> bar -> baz -> bar -> baz .... However, since the folder
-structure is: foo/node_modules/bar/node_modules/baz, there's no need to
-put another copy of bar into .../baz/node_modules, since when it calls
-require("bar"), it will get the copy that is installed in
-foo/node_modules/bar.
-
This shortcut is only used if the exact same
-version would be installed in multiple nested node_modules folders. It
-is still possible to have a/node_modules/b/node_modules/a if the two
-"a" packages are different versions. However, without repeating the
-exact same package multiple times, an infinite regress will always be
-prevented.
-
Another optimization can be made by installing dependencies at the
-highest level possible, below the localized "target" folder.
Since foo depends directly on bar@1.2.3 and baz@1.2.3, those are
-installed in foo's node_modules folder.
-
Even though the latest copy of blerg is 1.3.7, foo has a specific
-dependency on version 1.2.5. So, that gets installed at [A]. Since the
-parent installation of blerg satisfies bar's dependency on blerg@1.x,
-it does not install another copy under [B].
-
Bar [B] also has dependencies on baz and asdf, so those are installed in
-bar's node_modules folder. Because it depends on baz@2.x, it cannot
-re-use the baz@1.2.3 installed in the parent node_modules folder [D],
-and must install its own copy [C].
-
Underneath bar, the baz -> quux -> bar dependency creates a cycle.
-However, because bar is already in quux's ancestry [B], it does not
-unpack another copy of bar into that folder.
-
Underneath foo -> baz [D], quux's [E] folder tree is empty, because its
-dependency on bar is satisfied by the parent folder copy installed at [B].
-
For a graphical breakdown of what is installed where, use npm ls.
-
Publishing
-
Upon publishing, npm will look in the node_modules folder. If any of
-the items there are not in the bundledDependencies array, then they will
-not be included in the package tarball.
-
This allows a package maintainer to install all of their dependencies
-(and dev dependencies) locally, but only re-publish those items that
-cannot be found elsewhere. See package.json(5) for more information.
This document is all you need to know about what's required in your package.json
-file. It must be actual JSON, not just a JavaScript object literal.
-
A lot of the behavior described in this document is affected by the config
-settings described in npm-config(7).
-
name
-
The most important things in your package.json are the name and version fields.
-Those are actually required, and your package won't install without
-them. The name and version together form an identifier that is assumed
-to be completely unique. Changes to the package should come along with
-changes to the version.
-
The name is what your thing is called.
-
Some rules:
-
-
The name must be shorter than 214 characters. This includes the scope for
-scoped packages.
-
The name can't start with a dot or an underscore.
-
New packages must not have uppercase letters in the name.
-
The name ends up being part of a URL, an argument on the command line, and a
-folder name. Therefore, the name can't contain any non-URL-safe characters.
-
-
Some tips:
-
-
Don't use the same name as a core Node module.
-
Don't put "js" or "node" in the name. It's assumed that it's js, since you're
-writing a package.json file, and you can specify the engine using the "engines"
-field. (See below.)
-
The name will probably be passed as an argument to require(), so it should
-be something short, but also reasonably descriptive.
-
You may want to check the npm registry to see if there's something by that name
-already, before you get too attached to it. https://www.npmjs.com/
-
-
A name can be optionally prefixed by a scope, e.g. @myorg/mypackage. See
-npm-scope(7) for more detail.
-
version
-
The most important things in your package.json are the name and version fields.
-Those are actually required, and your package won't install without
-them. The name and version together form an identifier that is assumed
-to be completely unique. Changes to the package should come along with
-changes to the version.
-
Version must be parseable by
-node-semver, which is bundled
-with npm as a dependency. (npm install semver to use it yourself.)
Put a description in it. It's a string. This helps people discover your
-package, as it's listed in npm search.
-
keywords
-
Put keywords in it. It's an array of strings. This helps people
-discover your package as it's listed in npm search.
-
homepage
-
The url to the project homepage.
-
NOTE: This is not the same as "url". If you put a "url" field,
-then the registry will think it's a redirection to your package that has
-been published somewhere else, and spit at you.
-
Literally. Spit. I'm so not kidding.
-
bugs
-
The url to your project's issue tracker and / or the email address to which
-issues should be reported. These are helpful for people who encounter issues
-with your package.
You can specify either one or both values. If you want to provide only a url,
-you can specify the value for "bugs" as a simple string instead of an object.
-
If a url is provided, it will be used by the npm bugs command.
-
license
-
You should specify a license for your package so that people know how they are
-permitted to use it, and any restrictions you're placing on it.
-
If you're using a common license such as BSD-2-Clause or MIT, add a
-current SPDX license identifier for the license you're using, like this:
If you are using a license that hasn't been assigned an SPDX identifier, or if
-you are using a custom license, use the following valid SPDX expression:
-
{ "license" : "SEE LICENSE IN <filename>" }
-
Then include a file named <filename> at the top level of the package.
-
Some old packages used license objects or a "licenses" property containing an
-array of license objects:
Finally, if you do not wish to grant others the right to use a private or
-unpublished package under any terms:
-
{ "license": "UNLICENSED"}
-
Consider also setting "private": true to prevent accidental publication.
-
people fields: author, contributors
-
The "author" is one person. "contributors" is an array of people. A "person"
-is an object with a "name" field and optionally "url" and "email", like this:
npm also sets a top-level "maintainers" field with your npm user info.
-
files
-
The "files" field is an array of files to include in your project. If
-you name a folder in the array, then it will also include the files
-inside that folder. (Unless they would be ignored by another rule.)
-
You can also provide a ".npmignore" file in the root of your package,
-which will keep files from being included, even if they would be picked
-up by the files array. The ".npmignore" file works just like a
-".gitignore".
-
Certain files are always included, regardless of settings:
The main field is a module ID that is the primary entry point to your program.
-That is, if your package is named foo, and a user installs it, and then does
-require("foo"), then your main module's exports object will be returned.
-
This should be a module ID relative to the root of your package folder.
-
For most modules, it makes the most sense to have a main script and often not
-much else.
-
bin
-
A lot of packages have one or more executable files that they'd like to
-install into the PATH. npm makes this pretty easy (in fact, it uses this
-feature to install the "npm" executable.)
-
To use this, supply a bin field in your package.json which is a map of
-command name to local file name. On install, npm will symlink that file into
-prefix/bin for global installs, or ./node_modules/.bin/ for local
-installs.
-
For example, myapp could have this:
-
{ "bin" : { "myapp" : "./cli.js" } }
-
So, when you install myapp, it'll create a symlink from the cli.js script to
-/usr/local/bin/myapp.
-
If you have a single executable, and its name should be the name
-of the package, then you can just supply it as a string. For example:
Man files must end with a number, and optionally a .gz suffix if they are
-compressed. The number dictates which man section the file is installed into.
The CommonJS Packages spec details a
-few ways that you can indicate the structure of your package using a directories
-object. If you look at npm's package.json,
-you'll see that it has directories for doc, lib, and man.
-
In the future, this information may be used in other creative ways.
-
directories.lib
-
Tell people where the bulk of your library is. Nothing special is done
-with the lib folder in any way, but it's useful meta info.
-
directories.bin
-
If you specify a bin directory in directories.bin, all the files in
-that folder will be added.
-
Because of the way the bin directive works, specifying both a
-bin path and setting directories.bin is an error. If you want to
-specify individual files, use bin, and for all the files in an
-existing bin directory, use directories.bin.
-
directories.man
-
A folder that is full of man pages. Sugar to generate a "man" array by
-walking the folder.
-
directories.doc
-
Put markdown files in here. Eventually, these will be displayed nicely,
-maybe, someday.
-
directories.example
-
Put example scripts in here. Someday, it might be exposed in some clever way.
-
repository
-
Specify the place where your code lives. This is helpful for people who
-want to contribute. If the git repo is on GitHub, then the npm docs
-command will be able to find you.
The URL should be a publicly available (perhaps read-only) url that can be handed
-directly to a VCS program without any modification. It should not be a url to an
-html project page that you put in your browser. It's for computers.
-
For GitHub, GitHub gist, Bitbucket, or GitLab repositories you can use the same
-shortcut syntax you use for npm install:
The "scripts" property is a dictionary containing script commands that are run
-at various times in the lifecycle of your package. The key is the lifecycle
-event, and the value is the command to run at that point.
-
See npm-scripts(7) to find out more about writing package scripts.
-
config
-
A "config" object can be used to set configuration parameters used in package
-scripts that persist across upgrades. For instance, if a package had the
-following:
and then had a "start" command that then referenced the
-npm_package_config_port environment variable, then the user could
-override that by doing npm config set foo:port 8001.
Dependencies are specified in a simple object that maps a package name to a
-version range. The version range is a string which has one or more
-space-separated descriptors. Dependencies can also be identified with a
-tarball or git URL.
-
Please do not put test harnesses or transpilers in your
-dependencies object. See devDependencies, below.
-
See semver(7) for more details about specifying version ranges.
-
-
version Must match version exactly
-
>version Must be greater than version
-
>=version etc
-
<version
-
<=version
-
~version "Approximately equivalent to version" See semver(7)
The commit-ish can be any tag, sha, or branch which can be supplied as
-an argument to git checkout. The default is master.
-
GitHub URLs
-
As of version 1.1.65, you can refer to GitHub urls as just "foo":
-"user/foo-project". Just as with git URLs, a commit-ish suffix can be
-included. For example:
As of version 2.0.0 you can provide a path to a local directory that contains a
-package. Local paths can be saved using npm install --save, using any of
-these forms:
-
../foo/bar
-~/foo/bar
-./foo/bar
-/foo/bar
-
in which case they will be normalized to a relative path and added to your
-package.json. For example:
This feature is helpful for local offline development and creating
-tests that require npm installing where you don't want to hit an
-external server, but should not be used when publishing packages
-to the public registry.
-
devDependencies
-
If someone is planning on downloading and using your module in their
-program, then they probably don't want or need to download and build
-the external test or documentation framework that you use.
-
In this case, it's best to map these additional items in a devDependencies
-object.
-
These things will be installed when doing npm link or npm install
-from the root of a package, and can be managed like any other npm
-configuration param. See npm-config(7) for more on the topic.
-
For build steps that are not platform-specific, such as compiling
-CoffeeScript or other languages to JavaScript, use the prepublish
-script to do this, and make the required package a devDependency.
The prepublish script will be run before publishing, so that users
-can consume the functionality without requiring them to compile it
-themselves. In dev mode (ie, locally running npm install), it'll
-run this script as well, so that you can test it easily.
-
peerDependencies
-
In some cases, you want to express the compatibility of your package with a
-host tool or library, while not necessarily doing a require of this host.
-This is usually referred to as a plugin. Notably, your module may be exposing
-a specific interface, expected and specified by the host documentation.
This ensures your package tea-latte can be installed along with the second
-major version of the host package tea only. npm install tea-latte could
-possibly yield the following dependency graph:
-
├── tea-latte@1.3.5
-└── tea@2.2.0
-
NOTE: npm versions 1 and 2 will automatically install peerDependencies if
-they are not explicitly depended upon higher in the dependency tree. In the
-next major version of npm (npm@3), this will no longer be the case. You will
-receive a warning that the peerDependency is not installed instead. The
-behavior in npms 1 & 2 was frequently confusing and could easily put you into
-dependency hell, a situation that npm is designed to avoid as much as possible.
-
Trying to install another plugin with a conflicting requirement will cause an
-error. For this reason, make sure your plugin requirement is as broad as
-possible, and not to lock it down to specific patch versions.
-
Assuming the host complies with semver, only changes in
-the host package's major version will break your plugin. Thus, if you've worked
-with every 1.x version of the host package, use "^1.0" or "1.x" to express
-this. If you depend on features introduced in 1.5.2, use ">= 1.5.2 < 2".
-
bundledDependencies
-
Array of package names that will be bundled when publishing the package.
-
If this is spelled "bundleDependencies", then that is also honorable.
-
optionalDependencies
-
If a dependency can be used, but you would like npm to proceed if it cannot be
-found or fails to install, then you may put it in the optionalDependencies
-object. This is a map of package name to version or url, just like the
-dependencies object. The difference is that build failures do not cause
-installation to fail.
-
It is still your program's responsibility to handle the lack of the
-dependency. For example, something like this:
-
try {
- var foo = require('foo')
- var fooVersion = require('foo/package.json').version
-} catch (er) {
- foo = null
-}
-if ( notGoodFooVersion(fooVersion) ) {
- foo = null
-}
-
-// .. then later in your program ..
-
-if (foo) {
- foo.doFooThings()
-}
-
Entries in optionalDependencies will override entries of the same name in
-dependencies, so it's usually best to only put in one place.
-
engines
-
You can specify the version of node that your stuff works on:
-
{ "engines" : { "node" : ">=0.10.3 <0.12" } }
-
And, like with dependencies, if you don't specify the version (or if you
-specify "*" as the version), then any version of node will do.
-
If you specify an "engines" field, then npm will require that "node" be
-somewhere on that list. If "engines" is omitted, then npm will just assume
-that it works on node.
-
You can also use the "engines" field to specify which versions of npm
-are capable of properly installing your program. For example:
-
{ "engines" : { "npm" : "~1.0.20" } }
-
Note that, unless the user has set the engine-strict config flag, this
-field is advisory only.
-
engineStrict
-
NOTE: This feature is deprecated and will be removed in npm 3.0.0.
-
If you are sure that your module will definitely not run properly on
-versions of Node/npm other than those specified in the engines object,
-then you can set "engineStrict": true in your package.json file.
-This will override the user's engine-strict config setting.
-
Please do not do this unless you are really very very sure. If your
-engines object is something overly restrictive, you can quite easily and
-inadvertently lock yourself into obscurity and prevent your users from
-updating to new versions of Node. Consider this choice carefully.
-
os
-
You can specify which operating systems your
-module will run on:
-
"os" : [ "darwin", "linux" ]
-
You can also blacklist instead of whitelist operating systems,
-just prepend the blacklisted os with a '!':
-
"os" : [ "!win32" ]
-
The host operating system is determined by process.platform
-
It is allowed to both blacklist, and whitelist, although there isn't any
-good reason to do this.
-
cpu
-
If your code only runs on certain cpu architectures,
-you can specify which ones.
-
"cpu" : [ "x64", "ia32" ]
-
Like the os option, you can also blacklist architectures:
-
"cpu" : [ "!arm", "!mips" ]
-
The host architecture is determined by process.arch
-
preferGlobal
-
If your package is primarily a command-line application that should be
-installed globally, then set this value to true to provide a warning
-if it is installed locally.
-
It doesn't actually prevent users from installing it locally, but it
-does help prevent some confusion if it doesn't work as expected.
-
private
-
If you set "private": true in your package.json, then npm will refuse
-to publish it.
-
This is a way to prevent accidental publication of private repositories. If
-you would like to ensure that a given package is only ever published to a
-specific registry (for example, an internal registry), then use the
-publishConfig dictionary described below to override the registry config
-param at publish-time.
-
publishConfig
-
This is a set of config values that will be used at publish-time. It's
-especially handy if you want to set the tag, registry or access, so that
-you can ensure that a given package is not tagged with "latest", published
-to the global public registry or that a scoped module is private by default.
-
Any config values can be overridden, but of course only "tag", "registry" and
-"access" probably matter for the purposes of publishing.
-
See npm-config(7) to see the list of config options that can be
-overridden.
-
DEFAULT VALUES
-
npm will default some values based on package contents.
-
-
"scripts": {"start": "node server.js"}
-
If there is a server.js file in the root of your package, then npm
-will default the start command to node server.js.
-
-
"scripts":{"preinstall": "node-gyp rebuild"}
-
If there is a binding.gyp file in the root of your package, npm will
-default the preinstall command to compile using node-gyp.
-
-
"contributors": [...]
-
If there is an AUTHORS file in the root of your package, npm will
-treat each line as a Name <email> (url) format, where email and url
-are optional. Lines which start with a # or are blank, will be
-ignored.
All npm config files are an ini-formatted list of key = value
-parameters. Environment variables can be replaced using
-${VARIABLE_NAME}. For example:
-
prefix = ${HOME}/.npm-packages
-
Each of these files is loaded, and config options are resolved in
-priority order. For example, a setting in the userconfig file would
-override the setting in the globalconfig file.
-
Array values are specified by adding "[]" after the key name. For
-example:
-
key[] = "first value"
-key[] = "second value"
-
NOTE: Because local (per-project or per-user) .npmrc files can contain
-sensitive credentials, they must be readable and writable only by your user
-account (i.e. must have a mode of 0600), otherwise they will be ignored by
-npm!
-
Per-project config file
-
When working locally in a project, a .npmrc file in the root of the
-project (ie, a sibling of node_modules and package.json) will set
-config values specific to this project.
-
Note that this only applies to the root of the project that you're
-running npm in. It has no effect when your module is published. For
-example, you can't publish a module that forces itself to install
-globally, or in a different location.
-
Additionally, this file is not read in global mode, such as when running
-npm install -g.
-
Per-user config file
-
$HOME/.npmrc (or the userconfig param, if set in the environment
-or on the command line)
-
Global config file
-
$PREFIX/etc/npmrc (or the globalconfig param, if set above):
-This file is an ini-file formatted list of key = value parameters.
-Environment variables can be replaced as above.
-
Built-in config file
-
path/to/npm/itself/npmrc
-
This is an unchangeable "builtin" configuration file that npm keeps
-consistent across updates. Set fields in here using the ./configure
-script that comes with npm. This is primarily for distribution
-maintainers to override default configs in a standard and consistent
-manner.
This document is all you need to know about what's required in your package.json
-file. It must be actual JSON, not just a JavaScript object literal.
-
A lot of the behavior described in this document is affected by the config
-settings described in npm-config(7).
-
name
-
The most important things in your package.json are the name and version fields.
-Those are actually required, and your package won't install without
-them. The name and version together form an identifier that is assumed
-to be completely unique. Changes to the package should come along with
-changes to the version.
-
The name is what your thing is called.
-
Some rules:
-
-
The name must be shorter than 214 characters. This includes the scope for
-scoped packages.
-
The name can't start with a dot or an underscore.
-
New packages must not have uppercase letters in the name.
-
The name ends up being part of a URL, an argument on the command line, and a
-folder name. Therefore, the name can't contain any non-URL-safe characters.
-
-
Some tips:
-
-
Don't use the same name as a core Node module.
-
Don't put "js" or "node" in the name. It's assumed that it's js, since you're
-writing a package.json file, and you can specify the engine using the "engines"
-field. (See below.)
-
The name will probably be passed as an argument to require(), so it should
-be something short, but also reasonably descriptive.
-
You may want to check the npm registry to see if there's something by that name
-already, before you get too attached to it. https://www.npmjs.com/
-
-
A name can be optionally prefixed by a scope, e.g. @myorg/mypackage. See
-npm-scope(7) for more detail.
-
version
-
The most important things in your package.json are the name and version fields.
-Those are actually required, and your package won't install without
-them. The name and version together form an identifier that is assumed
-to be completely unique. Changes to the package should come along with
-changes to the version.
-
Version must be parseable by
-node-semver, which is bundled
-with npm as a dependency. (npm install semver to use it yourself.)
Put a description in it. It's a string. This helps people discover your
-package, as it's listed in npm search.
-
keywords
-
Put keywords in it. It's an array of strings. This helps people
-discover your package as it's listed in npm search.
-
homepage
-
The url to the project homepage.
-
NOTE: This is not the same as "url". If you put a "url" field,
-then the registry will think it's a redirection to your package that has
-been published somewhere else, and spit at you.
-
Literally. Spit. I'm so not kidding.
-
bugs
-
The url to your project's issue tracker and / or the email address to which
-issues should be reported. These are helpful for people who encounter issues
-with your package.
You can specify either one or both values. If you want to provide only a url,
-you can specify the value for "bugs" as a simple string instead of an object.
-
If a url is provided, it will be used by the npm bugs command.
-
license
-
You should specify a license for your package so that people know how they are
-permitted to use it, and any restrictions you're placing on it.
-
If you're using a common license such as BSD-2-Clause or MIT, add a
-current SPDX license identifier for the license you're using, like this:
If you are using a license that hasn't been assigned an SPDX identifier, or if
-you are using a custom license, use the following valid SPDX expression:
-
{ "license" : "SEE LICENSE IN <filename>" }
-
Then include a file named <filename> at the top level of the package.
-
Some old packages used license objects or a "licenses" property containing an
-array of license objects:
Finally, if you do not wish to grant others the right to use a private or
-unpublished package under any terms:
-
{ "license": "UNLICENSED"}
-
Consider also setting "private": true to prevent accidental publication.
-
people fields: author, contributors
-
The "author" is one person. "contributors" is an array of people. A "person"
-is an object with a "name" field and optionally "url" and "email", like this:
npm also sets a top-level "maintainers" field with your npm user info.
-
files
-
The "files" field is an array of files to include in your project. If
-you name a folder in the array, then it will also include the files
-inside that folder. (Unless they would be ignored by another rule.)
-
You can also provide a ".npmignore" file in the root of your package,
-which will keep files from being included, even if they would be picked
-up by the files array. The ".npmignore" file works just like a
-".gitignore".
-
Certain files are always included, regardless of settings:
The main field is a module ID that is the primary entry point to your program.
-That is, if your package is named foo, and a user installs it, and then does
-require("foo"), then your main module's exports object will be returned.
-
This should be a module ID relative to the root of your package folder.
-
For most modules, it makes the most sense to have a main script and often not
-much else.
-
bin
-
A lot of packages have one or more executable files that they'd like to
-install into the PATH. npm makes this pretty easy (in fact, it uses this
-feature to install the "npm" executable.)
-
To use this, supply a bin field in your package.json which is a map of
-command name to local file name. On install, npm will symlink that file into
-prefix/bin for global installs, or ./node_modules/.bin/ for local
-installs.
-
For example, myapp could have this:
-
{ "bin" : { "myapp" : "./cli.js" } }
-
So, when you install myapp, it'll create a symlink from the cli.js script to
-/usr/local/bin/myapp.
-
If you have a single executable, and its name should be the name
-of the package, then you can just supply it as a string. For example:
Man files must end with a number, and optionally a .gz suffix if they are
-compressed. The number dictates which man section the file is installed into.
The CommonJS Packages spec details a
-few ways that you can indicate the structure of your package using a directories
-object. If you look at npm's package.json,
-you'll see that it has directories for doc, lib, and man.
-
In the future, this information may be used in other creative ways.
-
directories.lib
-
Tell people where the bulk of your library is. Nothing special is done
-with the lib folder in any way, but it's useful meta info.
-
directories.bin
-
If you specify a bin directory in directories.bin, all the files in
-that folder will be added.
-
Because of the way the bin directive works, specifying both a
-bin path and setting directories.bin is an error. If you want to
-specify individual files, use bin, and for all the files in an
-existing bin directory, use directories.bin.
-
directories.man
-
A folder that is full of man pages. Sugar to generate a "man" array by
-walking the folder.
-
directories.doc
-
Put markdown files in here. Eventually, these will be displayed nicely,
-maybe, someday.
-
directories.example
-
Put example scripts in here. Someday, it might be exposed in some clever way.
-
repository
-
Specify the place where your code lives. This is helpful for people who
-want to contribute. If the git repo is on GitHub, then the npm docs
-command will be able to find you.
The URL should be a publicly available (perhaps read-only) url that can be handed
-directly to a VCS program without any modification. It should not be a url to an
-html project page that you put in your browser. It's for computers.
-
For GitHub, GitHub gist, Bitbucket, or GitLab repositories you can use the same
-shortcut syntax you use for npm install:
The "scripts" property is a dictionary containing script commands that are run
-at various times in the lifecycle of your package. The key is the lifecycle
-event, and the value is the command to run at that point.
-
See npm-scripts(7) to find out more about writing package scripts.
-
config
-
A "config" object can be used to set configuration parameters used in package
-scripts that persist across upgrades. For instance, if a package had the
-following:
and then had a "start" command that then referenced the
-npm_package_config_port environment variable, then the user could
-override that by doing npm config set foo:port 8001.
Dependencies are specified in a simple object that maps a package name to a
-version range. The version range is a string which has one or more
-space-separated descriptors. Dependencies can also be identified with a
-tarball or git URL.
-
Please do not put test harnesses or transpilers in your
-dependencies object. See devDependencies, below.
-
See semver(7) for more details about specifying version ranges.
-
-
version Must match version exactly
-
>version Must be greater than version
-
>=version etc
-
<version
-
<=version
-
~version "Approximately equivalent to version" See semver(7)
The commit-ish can be any tag, sha, or branch which can be supplied as
-an argument to git checkout. The default is master.
-
GitHub URLs
-
As of version 1.1.65, you can refer to GitHub urls as just "foo":
-"user/foo-project". Just as with git URLs, a commit-ish suffix can be
-included. For example:
As of version 2.0.0 you can provide a path to a local directory that contains a
-package. Local paths can be saved using npm install --save, using any of
-these forms:
-
../foo/bar
-~/foo/bar
-./foo/bar
-/foo/bar
-
in which case they will be normalized to a relative path and added to your
-package.json. For example:
This feature is helpful for local offline development and creating
-tests that require npm installing where you don't want to hit an
-external server, but should not be used when publishing packages
-to the public registry.
-
devDependencies
-
If someone is planning on downloading and using your module in their
-program, then they probably don't want or need to download and build
-the external test or documentation framework that you use.
-
In this case, it's best to map these additional items in a devDependencies
-object.
-
These things will be installed when doing npm link or npm install
-from the root of a package, and can be managed like any other npm
-configuration param. See npm-config(7) for more on the topic.
-
For build steps that are not platform-specific, such as compiling
-CoffeeScript or other languages to JavaScript, use the prepublish
-script to do this, and make the required package a devDependency.
The prepublish script will be run before publishing, so that users
-can consume the functionality without requiring them to compile it
-themselves. In dev mode (ie, locally running npm install), it'll
-run this script as well, so that you can test it easily.
-
peerDependencies
-
In some cases, you want to express the compatibility of your package with a
-host tool or library, while not necessarily doing a require of this host.
-This is usually referred to as a plugin. Notably, your module may be exposing
-a specific interface, expected and specified by the host documentation.
This ensures your package tea-latte can be installed along with the second
-major version of the host package tea only. npm install tea-latte could
-possibly yield the following dependency graph:
-
├── tea-latte@1.3.5
-└── tea@2.2.0
-
NOTE: npm versions 1 and 2 will automatically install peerDependencies if
-they are not explicitly depended upon higher in the dependency tree. In the
-next major version of npm (npm@3), this will no longer be the case. You will
-receive a warning that the peerDependency is not installed instead. The
-behavior in npms 1 & 2 was frequently confusing and could easily put you into
-dependency hell, a situation that npm is designed to avoid as much as possible.
-
Trying to install another plugin with a conflicting requirement will cause an
-error. For this reason, make sure your plugin requirement is as broad as
-possible, and not to lock it down to specific patch versions.
-
Assuming the host complies with semver, only changes in
-the host package's major version will break your plugin. Thus, if you've worked
-with every 1.x version of the host package, use "^1.0" or "1.x" to express
-this. If you depend on features introduced in 1.5.2, use ">= 1.5.2 < 2".
-
bundledDependencies
-
Array of package names that will be bundled when publishing the package.
-
If this is spelled "bundleDependencies", then that is also honorable.
-
optionalDependencies
-
If a dependency can be used, but you would like npm to proceed if it cannot be
-found or fails to install, then you may put it in the optionalDependencies
-object. This is a map of package name to version or url, just like the
-dependencies object. The difference is that build failures do not cause
-installation to fail.
-
It is still your program's responsibility to handle the lack of the
-dependency. For example, something like this:
-
try {
- var foo = require('foo')
- var fooVersion = require('foo/package.json').version
-} catch (er) {
- foo = null
-}
-if ( notGoodFooVersion(fooVersion) ) {
- foo = null
-}
-
-// .. then later in your program ..
-
-if (foo) {
- foo.doFooThings()
-}
-
Entries in optionalDependencies will override entries of the same name in
-dependencies, so it's usually best to only put in one place.
-
engines
-
You can specify the version of node that your stuff works on:
-
{ "engines" : { "node" : ">=0.10.3 <0.12" } }
-
And, like with dependencies, if you don't specify the version (or if you
-specify "*" as the version), then any version of node will do.
-
If you specify an "engines" field, then npm will require that "node" be
-somewhere on that list. If "engines" is omitted, then npm will just assume
-that it works on node.
-
You can also use the "engines" field to specify which versions of npm
-are capable of properly installing your program. For example:
-
{ "engines" : { "npm" : "~1.0.20" } }
-
Note that, unless the user has set the engine-strict config flag, this
-field is advisory only.
-
engineStrict
-
NOTE: This feature is deprecated and will be removed in npm 3.0.0.
-
If you are sure that your module will definitely not run properly on
-versions of Node/npm other than those specified in the engines object,
-then you can set "engineStrict": true in your package.json file.
-This will override the user's engine-strict config setting.
-
Please do not do this unless you are really very very sure. If your
-engines object is something overly restrictive, you can quite easily and
-inadvertently lock yourself into obscurity and prevent your users from
-updating to new versions of Node. Consider this choice carefully.
-
os
-
You can specify which operating systems your
-module will run on:
-
"os" : [ "darwin", "linux" ]
-
You can also blacklist instead of whitelist operating systems,
-just prepend the blacklisted os with a '!':
-
"os" : [ "!win32" ]
-
The host operating system is determined by process.platform
-
It is allowed to both blacklist, and whitelist, although there isn't any
-good reason to do this.
-
cpu
-
If your code only runs on certain cpu architectures,
-you can specify which ones.
-
"cpu" : [ "x64", "ia32" ]
-
Like the os option, you can also blacklist architectures:
-
"cpu" : [ "!arm", "!mips" ]
-
The host architecture is determined by process.arch
-
preferGlobal
-
If your package is primarily a command-line application that should be
-installed globally, then set this value to true to provide a warning
-if it is installed locally.
-
It doesn't actually prevent users from installing it locally, but it
-does help prevent some confusion if it doesn't work as expected.
-
private
-
If you set "private": true in your package.json, then npm will refuse
-to publish it.
-
This is a way to prevent accidental publication of private repositories. If
-you would like to ensure that a given package is only ever published to a
-specific registry (for example, an internal registry), then use the
-publishConfig dictionary described below to override the registry config
-param at publish-time.
-
publishConfig
-
This is a set of config values that will be used at publish-time. It's
-especially handy if you want to set the tag, registry or access, so that
-you can ensure that a given package is not tagged with "latest", published
-to the global public registry or that a scoped module is private by default.
-
Any config values can be overridden, but of course only "tag", "registry" and
-"access" probably matter for the purposes of publishing.
-
See npm-config(7) to see the list of config options that can be
-overridden.
-
DEFAULT VALUES
-
npm will default some values based on package contents.
-
-
"scripts": {"start": "node server.js"}
-
If there is a server.js file in the root of your package, then npm
-will default the start command to node server.js.
-
-
"scripts":{"preinstall": "node-gyp rebuild"}
-
If there is a binding.gyp file in the root of your package, npm will
-default the preinstall command to compile using node-gyp.
-
-
"contributors": [...]
-
If there is an AUTHORS file in the root of your package, npm will
-treat each line as a Name <email> (url) format, where email and url
-are optional. Lines which start with a # or are blank, will be
-ignored.
npm's coding style is a bit unconventional. It is not different for
-difference's sake, but rather a carefully crafted style that is
-designed to reduce visual clutter and make bugs more apparent.
-
If you want to contribute to npm (which is very encouraged), you should
-make your code conform to npm's style.
-
Note: this concerns npm's code not the specific packages that you can download from the npm registry.
-
Line Length
-
Keep lines shorter than 80 characters. It's better for lines to be
-too short than to be too long. Break up long lists, objects, and other
-statements onto multiple lines.
-
Indentation
-
Two-spaces. Tabs are better, but they look like hell in web browsers
-(and on GitHub), and node uses 2 spaces, so that's that.
-
Configure your editor appropriately.
-
Curly braces
-
Curly braces belong on the same line as the thing that necessitates them.
-
Bad:
-
function ()
-{
-
Good:
-
function () {
-
If a block needs to wrap to the next line, use a curly brace. Don't
-use it if it doesn't.
-
Bad:
-
if (foo) { bar() }
-while (foo)
- bar()
-
Good:
-
if (foo) bar()
-while (foo) {
- bar()
-}
-
Semicolons
-
Don't use them except in four situations:
-
-
for (;;) loops. They're actually required.
-
null loops like: while (something) ; (But you'd better have a good
-reason for doing that.)
-
case "foo": doSomething(); break
-
In front of a leading ( or [ at the start of the line.
-This prevents the expression from being interpreted
-as a function call or property access, respectively.
-
-
Some examples of good semicolon usage:
-
;(x || y).doSomething()
-;[a, b, c].forEach(doSomething)
-for (var i = 0; i < 10; i ++) {
- switch (state) {
- case "begin": start(); continue
- case "end": finish(); break
- default: throw new Error("unknown state")
- }
- end()
-}
-
Note that starting lines with - and + also should be prefixed
-with a semicolon, but this is much less common.
-
Comma First
-
If there is a list of things separated by commas, and it wraps
-across multiple lines, put the comma at the start of the next
-line, directly below the token that starts the list. Put the
-final token in the list on a line by itself. For example:
Put a single space in front of ( for anything other than a function call.
-Also use a single space wherever it makes things more readable.
-
Don't leave trailing whitespace at the end of lines. Don't indent empty
-lines. Don't use more spaces than are helpful.
-
Functions
-
Use named functions. They make stack traces a lot easier to read.
-
Callbacks, Sync/async Style
-
Use the asynchronous/non-blocking versions of things as much as possible.
-It might make more sense for npm to use the synchronous fs APIs, but this
-way, the fs and http and child process stuff all uses the same callback-passing
-methodology.
-
The callback should always be the last argument in the list. Its first
-argument is the Error or null.
-
Be very careful never to ever ever throw anything. It's worse than useless.
-Just send the error message back as the first argument to the callback.
-
Errors
-
Always create a new Error object with your message. Don't just return a
-string message to the callback. Stack traces are handy.
Please clean up logs when they are no longer helpful. In particular,
-logging the same object over and over again is not helpful. Logs should
-report what's happening so that it's easier to track down where a fault
-occurs.
-
Use appropriate log levels. See npm-config(7) and search for
-"loglevel".
-
Case, naming, etc.
-
Use lowerCamelCase for multiword identifiers when they refer to objects,
-functions, methods, properties, or anything not specified in this section.
-
Use UpperCamelCase for class names (things that you'd pass to "new").
-
Use all-lower-hyphen-css-case for multiword filenames and config keys.
-
Use named functions. They make stack traces easier to follow.
-
Use CAPS_SNAKE_CASE for constants, things that should never change
-and are rarely used.
-
Use a single uppercase letter for function names where the function
-would normally be anonymous, but needs to call itself recursively. It
-makes it clear that it's a "throwaway" function.
-
null, undefined, false, 0
-
Boolean variables and functions should always be either true or
-false. Don't set it to 0 unless it's supposed to be a number.
-
When something is intentionally missing or removed, set it to null.
-
Don't set things to undefined. Reserve that value to mean "not yet
-set to anything."
More than you probably want to know about npm configuration
-
DESCRIPTION
-
npm gets its configuration values from the following sources, sorted by priority:
-
Command Line Flags
-
Putting --foo bar on the command line sets the foo configuration
-parameter to "bar". A -- argument tells the cli parser to stop
-reading flags. A --flag parameter that is at the end of the
-command will be given the value of true.
-
Environment Variables
-
Any environment variables that start with npm_config_ will be
-interpreted as a configuration parameter. For example, putting
-npm_config_foo=bar in your environment will set the foo
-configuration parameter to bar. Any environment configurations that
-are not given a value will be given the value of true. Config
-values are case-insensitive, so NPM_CONFIG_FOO=bar will work the
-same.
A set of configuration parameters that are internal to npm, and are
-defaults if nothing else is specified.
-
Shorthands and Other CLI Niceties
-
The following shorthands are parsed on the command-line:
-
-
-v: --version
-
-h, -?, --help, -H: --usage
-
-s, --silent: --loglevel silent
-
-q, --quiet: --loglevel warn
-
-d: --loglevel info
-
-dd, --verbose: --loglevel verbose
-
-ddd: --loglevel silly
-
-g: --global
-
-C: --prefix
-
-l: --long
-
-m: --message
-
-p, --porcelain: --parseable
-
-reg: --registry
-
-f: --force
-
-desc: --description
-
-S: --save
-
-D: --save-dev
-
-O: --save-optional
-
-B: --save-bundle
-
-E: --save-exact
-
-y: --yes
-
-n: --yes false
-
ll and la commands: ls --long
-
-
If the specified configuration param resolves unambiguously to a known
-configuration parameter, then it is expanded to that configuration
-parameter. For example:
-
npm ls --par
-# same as:
-npm ls --parseable
-
If multiple single-character shorthands are strung together, and the
-resulting combination is unambiguously not some other configuration
-param, then it is expanded to its various component pieces. For
-example:
-
npm ls -gpld
-# same as:
-npm ls --global --parseable --long --loglevel info
-
Per-Package Config Settings
-
When running scripts (see npm-scripts(7)) the package.json "config"
-keys are overwritten in the environment if there is a config param of
-<name>[@<version>]:<key>. For example, if the package.json has
-this:
When publishing scoped packages, the access level defaults to restricted. If
-you want your scoped package to be publicly viewable (and installable) set
---access=public. The only valid values for access are public and
-restricted. Unscoped packages always have an access level of public.
-
always-auth
-
-
Default: false
-
Type: Boolean
-
-
Force npm to always require authentication when accessing the registry,
-even for GET requests.
-
bin-links
-
-
Default: true
-
Type: Boolean
-
-
Tells npm to create symlinks (or .cmd shims on Windows) for package
-executables.
-
Set to false to have it not do this. This can be used to work around
-the fact that some file systems don't support symlinks, even on
-ostensibly Unix systems.
-
browser
-
-
Default: OS X: "open", Windows: "start", Others: "xdg-open"
-
Type: String
-
-
The browser that is called by the npm docs command to open websites.
-
ca
-
-
Default: The npm CA certificate
-
Type: String, Array or null
-
-
The Certificate Authority signing certificate that is trusted for SSL
-connections to the registry. Values should be in PEM format with newlines
-replaced by the string "\n". For example:
Set to null to only allow "known" registrars, or to a specific CA cert
-to trust only that specific signing authority.
-
Multiple CAs can be trusted by specifying an array of certificates:
-
ca[]="..."
-ca[]="..."
-
See also the strict-ssl config.
-
cafile
-
-
Default: null
-
Type: path
-
-
A path to a file containing one or multiple Certificate Authority signing
-certificates. Similar to the ca setting, but allows for multiple CA's, as
-well as for the CA information to be stored in a file on disk.
The location of npm's cache directory. See npm-cache(1)
-
cache-lock-stale
-
-
Default: 60000 (1 minute)
-
Type: Number
-
-
The number of ms before cache folder lockfiles are considered stale.
-
cache-lock-retries
-
-
Default: 10
-
Type: Number
-
-
Number of times to retry to acquire a lock on cache folder lockfiles.
-
cache-lock-wait
-
-
Default: 10000 (10 seconds)
-
Type: Number
-
-
Number of ms to wait for cache lock files to expire.
-
cache-max
-
-
Default: Infinity
-
Type: Number
-
-
The maximum time (in seconds) to keep items in the registry cache before
-re-checking against the registry.
-
Note that no purging is done unless the npm cache clean command is
-explicitly used, and that only GET requests use the cache.
-
cache-min
-
-
Default: 10
-
Type: Number
-
-
The minimum time (in seconds) to keep items in the registry cache before
-re-checking against the registry.
-
Note that no purging is done unless the npm cache clean command is
-explicitly used, and that only GET requests use the cache.
-
cert
-
-
Default: null
-
Type: String
-
-
A client certificate to pass when accessing the registry.
-
color
-
-
Default: true on Posix, false on Windows
-
Type: Boolean or "always"
-
-
If false, never shows colors. If "always" then always shows colors.
-If true, then only prints color codes for tty file descriptors.
-
depth
-
-
Default: Infinity
-
Type: Number
-
-
The depth to go when recursing directories for npm ls,
-npm cache ls, and npm outdated.
-
For npm outdated, a setting of Infinity will be treated as 0
-since that gives more useful information. To show the outdated status
-of all packages and dependents, use a large integer value,
-e.g., npm outdated --depth 9999
-
description
-
-
Default: true
-
Type: Boolean
-
-
Show the description in npm search
-
dev
-
-
Default: false
-
Type: Boolean
-
-
Install dev-dependencies along with packages.
-
Note that dev-dependencies are also installed if the npat flag is
-set.
-
editor
-
-
Default: EDITOR environment variable if set, or "vi" on Posix,
-or "notepad" on Windows.
-
Type: path
-
-
The command to run for npm edit or npm config edit.
-
engine-strict
-
-
Default: false
-
Type: Boolean
-
-
If set to true, then npm will stubbornly refuse to install (or even
-consider installing) any package that claims to not be compatible with
-the current Node.js version.
-
force
-
-
Default: false
-
Type: Boolean
-
-
Makes various commands more forceful.
-
-
lifecycle script failure does not block progress.
-
publishing clobbers previously published versions.
-
skips cache when requesting from the registry.
-
prevents checks against clobbering non-npm files.
-
-
fetch-retries
-
-
Default: 2
-
Type: Number
-
-
The "retries" config for the retry module to use when fetching
-packages from the registry.
-
fetch-retry-factor
-
-
Default: 10
-
Type: Number
-
-
The "factor" config for the retry module to use when fetching
-packages.
-
fetch-retry-mintimeout
-
-
Default: 10000 (10 seconds)
-
Type: Number
-
-
The "minTimeout" config for the retry module to use when fetching
-packages.
-
fetch-retry-maxtimeout
-
-
Default: 60000 (1 minute)
-
Type: Number
-
-
The "maxTimeout" config for the retry module to use when fetching
-packages.
-
git
-
-
Default: "git"
-
Type: String
-
-
The command to use for git commands. If git is installed on the
-computer, but is not in the PATH, then set this to the full path to
-the git binary.
-
git-tag-version
-
-
Default: true
-
Type: Boolean
-
-
Tag the commit when using the npm version command.
-
global
-
-
Default: false
-
Type: Boolean
-
-
Operates in "global" mode, so that packages are installed into the
-prefix folder instead of the current working directory. See
-npm-folders(5) for more on the differences in behavior.
-
-
packages are installed into the {prefix}/lib/node_modules folder, instead of the
-current working directory.
-
bin files are linked to {prefix}/bin
-
man pages are linked to {prefix}/share/man
-
-
globalconfig
-
-
Default: {prefix}/etc/npmrc
-
Type: path
-
-
The config file to read for global config options.
-
group
-
-
Default: GID of the current process
-
Type: String or Number
-
-
The group to use when running package scripts in global mode as the root
-user.
-
heading
-
-
Default: "npm"
-
Type: String
-
-
The string that starts all the debugging log output.
-
https-proxy
-
-
Default: null
-
Type: url
-
-
A proxy to use for outgoing https requests. If the HTTPS_PROXY or
-https_proxy or HTTP_PROXY or http_proxy environment variables are set,
-proxy settings will be honored by the underlying request library.
-
if-present
-
-
Default: false
-
Type: Boolean
-
-
If true, npm will not exit with an error code when run-script is invoked for
-a script that isn't defined in the scripts section of package.json. This
-option can be used when it's desirable to optionally run a script when it's
-present and fail if the script fails. This is useful, for example, when running
-scripts that may only apply for some builds in an otherwise generic CI setup.
-
ignore-scripts
-
-
Default: false
-
Type: Boolean
-
-
If true, npm does not run scripts specified in package.json files.
-
init-module
-
-
Default: ~/.npm-init.js
-
Type: path
-
-
A module that will be loaded by the npm init command. See the
-documentation for the
-init-package-json module
-for more information, or npm-init(1).
-
init-author-name
-
-
Default: ""
-
Type: String
-
-
The value npm init should use by default for the package author's name.
-
init-author-email
-
-
Default: ""
-
Type: String
-
-
The value npm init should use by default for the package author's email.
-
init-author-url
-
-
Default: ""
-
Type: String
-
-
The value npm init should use by default for the package author's homepage.
-
init-license
-
-
Default: "ISC"
-
Type: String
-
-
The value npm init should use by default for the package license.
-
init-version
-
-
Default: "1.0.0"
-
Type: semver
-
-
The value that npm init should use by default for the package
-version number, if not already set in package.json.
-
json
-
-
Default: false
-
Type: Boolean
-
-
Whether or not to output JSON data, rather than the normal output.
-
This feature is currently experimental, and the output data structures
-for many commands is either not implemented in JSON yet, or subject to
-change. Only the output from npm ls --json is currently valid.
-
key
-
-
Default: null
-
Type: String
-
-
A client key to pass when accessing the registry.
-
link
-
-
Default: false
-
Type: Boolean
-
-
If true, then local installs will link if there is a suitable globally
-installed package.
-
Note that this means that local installs can cause things to be
-installed into the global space at the same time. The link is only done
-if one of the two conditions are met:
-
-
The package is not already installed globally, or
-
the globally installed version is identical to the version that is
-being installed locally.
-
-
local-address
-
-
Default: undefined
-
Type: IP Address
-
-
The IP address of the local interface to use when making connections
-to the npm registry. Must be IPv4 in versions of Node prior to 0.12.
What level of logs to report. On failure, all logs are written to
-npm-debug.log in the current working directory.
-
Any logs of a higher level than the setting are shown.
-The default is "warn", which shows warn and error output.
-
logstream
-
-
Default: process.stderr
-
Type: Stream
-
-
This is the stream that is passed to the
-npmlog module at run time.
-
It cannot be set from the command line, but if you are using npm
-programmatically, you may wish to send logs to somewhere other than
-stderr.
-
If the color config is set to true, then this stream will receive
-colored output if it is a TTY.
-
long
-
-
Default: false
-
Type: Boolean
-
-
Show extended information in npm ls and npm search.
-
message
-
-
Default: "%s"
-
Type: String
-
-
Commit message which is used by npm version when creating version commit.
-
Any "%s" in the message will be replaced with the version number.
-
node-version
-
-
Default: process.version
-
Type: semver or false
-
-
The node version to use when checking a package's engines map.
-
npat
-
-
Default: false
-
Type: Boolean
-
-
Run tests on installation.
-
onload-script
-
-
Default: false
-
Type: path
-
-
A node module to require() when npm loads. Useful for programmatic
-usage.
-
optional
-
-
Default: true
-
Type: Boolean
-
-
Attempt to install packages in the optionalDependencies object. Note
-that if these packages fail to install, the overall installation
-process is not aborted.
-
parseable
-
-
Default: false
-
Type: Boolean
-
-
Output parseable results from commands that write to
-standard output.
The location to install global items. If set on the command line, then
-it forces non-global commands to run in the specified folder.
-
production
-
-
Default: false
-
Type: Boolean
-
-
Set to true to run in "production" mode.
-
-
devDependencies are not installed at the topmost level when running
-local npm install without any arguments.
-
Set the NODE_ENV="production" for lifecycle scripts.
-
-
proprietary-attribs
-
-
Default: true
-
Type: Boolean
-
-
Whether or not to include proprietary extended attributes in the
-tarballs created by npm.
-
Unless you are expecting to unpack package tarballs with something other
-than npm -- particularly a very outdated tar implementation -- leave
-this as true.
-
proxy
-
-
Default: null
-
Type: url
-
-
A proxy to use for outgoing http requests. If the HTTP_PROXY or
-http_proxy environment variables are set, proxy settings will be
-honored by the underlying request library.
Save installed packages to a package.json file as dependencies.
-
When used with the npm rm command, it removes it from the dependencies
-object.
-
Only works if there is already a package.json file present.
-
save-bundle
-
-
Default: false
-
Type: Boolean
-
-
If a package would be saved at install time by the use of --save,
---save-dev, or --save-optional, then also put it in the
-bundleDependencies list.
-
When used with the npm rm command, it removes it from the
-bundledDependencies list.
-
save-dev
-
-
Default: false
-
Type: Boolean
-
-
Save installed packages to a package.json file as devDependencies.
-
When used with the npm rm command, it removes it from the
-devDependencies object.
-
Only works if there is already a package.json file present.
-
save-exact
-
-
Default: false
-
Type: Boolean
-
-
Dependencies saved to package.json using --save, --save-dev or
---save-optional will be configured with an exact version rather than
-using npm's default semver range operator.
-
save-optional
-
-
Default: false
-
Type: Boolean
-
-
Save installed packages to a package.json file as
-optionalDependencies.
-
When used with the npm rm command, it removes it from the
-devDependencies object.
-
Only works if there is already a package.json file present.
-
save-prefix
-
-
Default: '^'
-
Type: String
-
-
Configure how versions of packages installed to a package.json file via
---save or --save-dev get prefixed.
-
For example if a package has version 1.2.3, by default its version is
-set to ^1.2.3 which allows minor upgrades for that package, but after
-npm config set save-prefix='~' it would be set to ~1.2.3 which only allows
-patch upgrades.
-
scope
-
-
Default: ""
-
Type: String
-
-
Associate an operation with a scope for a scoped registry. Useful when logging
-in to a private registry for the first time:
-npm login --scope=@organization --registry=registry.organization.com, which
-will cause @organization to be mapped to the registry for future installation
-of packages specified according to the pattern @organization/package.
-
searchopts
-
-
Default: ""
-
Type: String
-
-
Space-separated options that are always passed to search.
-
searchexclude
-
-
Default: ""
-
Type: String
-
-
Space-separated options that limit the results from search.
Indication of which field to sort search results by. Prefix with a -
-character to indicate reverse sort.
-
shell
-
-
Default: SHELL environment variable, or "bash" on Posix, or "cmd" on
-Windows
-
Type: path
-
-
The shell to run for the npm explore command.
-
shrinkwrap
-
-
Default: true
-
Type: Boolean
-
-
If set to false, then ignore npm-shrinkwrap.json files when
-installing.
-
sign-git-tag
-
-
Default: false
-
Type: Boolean
-
-
If set to true, then the npm version command will tag the version
-using -s to add a signature.
-
Note that git requires you to have set up GPG keys in your git configs
-for this to work properly.
-
spin
-
-
Default: true
-
Type: Boolean or "always"
-
-
When set to true, npm will display an ascii spinner while it is doing
-things, if process.stderr is a TTY.
-
Set to false to suppress the spinner, or set to always to output
-the spinner even for non-TTY outputs.
-
strict-ssl
-
-
Default: true
-
Type: Boolean
-
-
Whether or not to do SSL key validation when making requests to the
-registry via https.
-
See also the ca config.
-
tag
-
-
Default: latest
-
Type: String
-
-
If you ask npm to install a package and don't tell it a specific version, then
-it will install the specified tag.
-
Also the tag that is added to the package@version specified by the npm
-tag command, if no explicit tag is given.
-
tag-version-prefix
-
-
Default: "v"
-
Type: String
-
-
If set, alters the prefix used when tagging a new version when performing a
-version increment using npm-version. To remove the prefix altogether, set it
-to the empty string: "".
-
Because other tools may rely on the convention that npm version tags look like
-v1.0.0, only use this property if it is absolutely necessary. In
-particular, use care when overriding this setting for public packages.
-
tmp
-
-
Default: TMPDIR environment variable, or "/tmp"
-
Type: path
-
-
Where to store temporary files and folders. All temp files are deleted
-on success, but left behind on failure for forensic purposes.
-
unicode
-
-
Default: true
-
Type: Boolean
-
-
When set to true, npm uses unicode characters in the tree output. When
-false, it uses ascii characters to draw trees.
-
unsafe-perm
-
-
Default: false if running as root, true otherwise
-
Type: Boolean
-
-
Set to true to suppress the UID/GID switching when running package
-scripts. If set explicitly to false, then installing as a non-root user
-will fail.
-
usage
-
-
Default: false
-
Type: Boolean
-
-
Set to show short usage output (like the -H output)
-instead of complete help when doing npm-help(1).
-
user
-
-
Default: "nobody"
-
Type: String or Number
-
-
The UID to set to when running package scripts as root.
-
userconfig
-
-
Default: ~/.npmrc
-
Type: path
-
-
The location of user-level configuration settings.
-
umask
-
-
Default: 022
-
Type: Octal numeric string in range 0000..0777 (0..511)
-
-
The "umask" value to use when setting the file creation mode on files
-and folders.
-
Folders and executables are given a mode which is 0777 masked against
-this value. Other files are given a mode which is 0666 masked against
-this value. Thus, the defaults are 0755 and 0644 respectively.
So, you've decided to use npm to develop (and maybe publish/deploy)
-your project.
-
Fantastic!
-
There are a few things that you need to do above the simple steps
-that your users will do to install your program.
-
About These Documents
-
These are man pages. If you install npm, you should be able to
-then do man npm-thing to get the documentation on a particular
-topic, or npm help thing to see the same information.
-
What is a package
-
A package is:
-
-
a) a folder containing a program described by a package.json file
-
b) a gzipped tarball containing (a)
-
c) a url that resolves to (b)
-
d) a <name>@<version> that is published on the registry with (c)
-
e) a <name>@<tag> that points to (d)
-
f) a <name> that has a "latest" tag satisfying (e)
-
g) a git url that, when cloned, results in (a).
-
-
Even if you never publish your package, you can still get a lot of
-benefits of using npm if you just want to write a node program (a), and
-perhaps if you also want to be able to easily install it elsewhere
-after packing it up into a tarball (b).
The commit-ish can be any tag, sha, or branch which can be supplied as
-an argument to git checkout. The default is master.
-
The package.json File
-
You need to have a package.json file in the root of your project to do
-much of anything with npm. That is basically the whole interface.
-
See package.json(5) for details about what goes in that file. At the very
-least, you need:
-
-
name:
-This should be a string that identifies your project. Please do not
-use the name to specify that it runs on node, or is in JavaScript.
-You can use the "engines" field to explicitly state the versions of
-node (or whatever else) that your program requires, and it's pretty
-well assumed that it's javascript.
-
It does not necessarily need to match your github repository name.
-
So, node-foo and bar-js are bad names. foo or bar are better.
-
-
version:
-A semver-compatible version.
-
-
engines:
-Specify the versions of node (or whatever else) that your program
-runs on. The node API changes a lot, and there may be bugs or new
-functionality that you depend on. Be explicit.
-
-
author:
-Take some credit.
-
-
scripts:
-If you have a special compilation or installation script, then you
-should put it in the scripts object. You should definitely have at
-least a basic smoke-test command as the "scripts.test" field.
-See npm-scripts(7).
-
-
main:
-If you have a single module that serves as the entry point to your
-program (like what the "foo" package gives you at require("foo")),
-then you need to specify that in the "main" field.
-
-
directories:
-This is an object mapping names to folders. The best ones to include are
-"lib" and "doc", but if you use "man" to specify a folder full of man pages,
-they'll get installed just like these ones.
-
-
-
You can use npm init in the root of your package in order to get you
-started with a pretty basic package.json file. See npm-init(1) for
-more info.
-
Keeping files out of your package
-
Use a .npmignore file to keep stuff out of your package. If there's
-no .npmignore file, but there is a .gitignore file, then npm will
-ignore the stuff matched by the .gitignore file. If you want to
-include something that is excluded by your .gitignore file, you can
-create an empty .npmignore file to override it.
You can end patterns with a forward slash / to specify a directory.
-
You can negate a pattern by starting it with an exclamation point !.
-
-
By default, the following paths and files are ignored, so there's no
-need to add them to .npmignore explicitly:
-
-
.*.swp
-
._*
-
.DS_Store
-
.git
-
.hg
-
.lock-wscript
-
.svn
-
.wafpickle-*
-
CVS
-
npm-debug.log
-
-
Additionally, everything in node_modules is ignored, except for
-bundled dependencies. npm automatically handles this for you, so don't
-bother adding node_modules to .npmignore.
-
The following paths and files are never ignored, so adding them to
-.npmignore is pointless:
npm link is designed to install a development package and see the
-changes in real time without having to keep re-installing it. (You do
-need to either re-link or npm rebuild -g to update compiled packages,
-of course.)
Before Publishing: Make Sure Your Package Installs and Works
-
This is important.
-
If you can not install it locally, you'll have
-problems trying to publish it. Or, worse yet, you'll be able to
-publish it, but you'll be publishing a broken or pointless package.
-So don't do that.
-
In the root of your package, do this:
-
npm install . -g
-
That'll show you that it's working. If you'd rather just create a symlink
-package that points to your working directory, then do this:
-
npm link
-
Use npm ls -g to see if it's there.
-
To test a local install, go into some other folder, and then do:
-
cd ../some-other-folder
-npm install ../my-package
-
to install it locally into the node_modules folder in that other place.
-
Then go into the node-repl, and try using require("my-thing") to
-bring in your module's main module.
-
Create a User Account
-
Create a user with the adduser command. It works like this:
This part's easy. IN the root of your folder, do this:
-
npm publish
-
You can give publish a url to a tarball, or a filename of a tarball,
-or a path to a folder.
-
Note that pretty much everything in that folder will be exposed
-by default. So, if you have secret stuff in there, use a
-.npmignore file to list out the globs to ignore, or publish
-from a fresh checkout.
-
Brag about it
-
Send emails, write blogs, blab in IRC.
-
Tell the world how easy it is to install your program!
After a few weeks, if there's no resolution, we'll sort it out.
-
-
Don't squat on package names. Publish code or move out of the way.
-
DESCRIPTION
-
There sometimes arise cases where a user publishes a module, and then
-later, some other user wants to use that name. Here are some common
-ways that happens (each of these is based on actual events.)
-
-
Joe writes a JavaScript module foo, which is not node-specific.
-Joe doesn't use node at all. Bob wants to use foo in node, so he
-wraps it in an npm module. Some time later, Joe starts using node,
-and wants to take over management of his program.
-
Bob writes an npm module foo, and publishes it. Perhaps much
-later, Joe finds a bug in foo, and fixes it. He sends a pull
-request to Bob, but Bob doesn't have the time to deal with it,
-because he has a new job and a new baby and is focused on his new
-erlang project, and kind of not involved with node any more. Joe
-would like to publish a new foo, but can't, because the name is
-taken.
-
Bob writes a 10-line flow-control library, and calls it foo, and
-publishes it to the npm registry. Being a simple little thing, it
-never really has to be updated. Joe works for Foo Inc, the makers
-of the critically acclaimed and widely-marketed foo JavaScript
-toolkit framework. They publish it to npm as foojs, but people are
-routinely confused when npm install foo is some different thing.
-
Bob writes a parser for the widely-known foo file format, because
-he needs it for work. Then, he gets a new job, and never updates the
-prototype. Later on, Joe writes a much more complete foo parser,
-but can't publish, because Bob's foo is in the way.
-
-
The validity of Joe's claim in each situation can be debated. However,
-Joe's appropriate course of action in each case is the same.
-
-
npm owner ls foo. This will tell Joe the email address of the
-owner (Bob).
-
Joe emails Bob, explaining the situation as respectfully as
-possible, and what he would like to do with the module name. He
-adds the npm support staff support@npmjs.com to the CC list of
-the email. Mention in the email that Bob can run npm owner add
-joe foo to add Joe as an owner of the foo package.
-
After a reasonable amount of time, if Bob has not responded, or if
-Bob and Joe can't come to any sort of resolution, email support
-support@npmjs.com and we'll sort it out. ("Reasonable" is
-usually at least 4 weeks, but extra time is allowed around common
-holidays.)
-
-
REASONING
-
In almost every case so far, the parties involved have been able to reach
-an amicable resolution without any major intervention. Most people
-really do want to be reasonable, and are probably not even aware that
-they're in your way.
-
Module ecosystems are most vibrant and powerful when they are as
-self-directed as possible. If an admin one day deletes something you
-had worked on, then that is going to make most people quite upset,
-regardless of the justification. When humans solve their problems by
-talking to other humans with respect, everyone has the chance to end up
-feeling good about the interaction.
-
EXCEPTIONS
-
Some things are not allowed, and will be removed without discussion if
-they are brought to the attention of the npm registry admins, including
-but not limited to:
-
-
Malware (that is, a package designed to exploit or harm the machine on
-which it is installed).
-
Violations of copyright or licenses (for example, cloning an
-MIT-licensed program, and then removing or changing the copyright and
-license statement).
-
Illegal content.
-
"Squatting" on a package name that you plan to use, but aren't
-actually using. Sorry, I don't care how great the name is, or how
-perfect a fit it is for the thing that someday might happen. If
-someone wants to use it today, and you're just taking up space with
-an empty tarball, you're going to be evicted.
-
Putting empty packages in the registry. Packages must have SOME
-functionality. It can be silly, but it can't be nothing. (See
-also: squatting.)
-
Doing weird things with the registry, like using it as your own
-personal application database or otherwise putting non-packagey
-things into it.
-
-
If you see bad behavior like this, please report it right away.
Use the npm root command to see where modules go, and the npm bin
-command to see where executables go
-
Global installs are different from local installs. If you install
-something with the -g flag, then its executables go in npm bin -g
-and its modules go in npm root -g.
-
-
How do I install something on my computer in a central location?
-
Install it globally by tacking -g or --global to the command. (This
-is especially important for command line utilities that need to add
-their bins to the global system PATH.)
-
I installed something globally, but I can't require() it
-
Install it locally.
-
The global install location is a place for command-line utilities
-to put their bins in the system PATH. It's not for use with require().
-
If you require() a module in your code, then that means it's a
-dependency, and a part of your program. You need to install it locally
-in your program.
-
Why can't npm just put everything in one place, like other package managers?
-
Not every change is an improvement, but every improvement is a change.
-This would be like asking git to do network IO for every commit. It's
-not going to happen, because it's a terrible idea that causes more
-problems than it solves.
-
It is much harder to avoid dependency conflicts without nesting
-dependencies. This is fundamental to the way that npm works, and has
-proven to be an extremely successful approach. See npm-folders(5) for
-more details.
-
If you want a package to be installed in one place, and have all your
-programs reference the same copy of it, then use the npm link command.
-That's what it's for. Install it globally, then link it into each
-program that uses it.
-
Whatever, I really want the old style 'everything global' style.
-
Write your own package manager. You could probably even wrap up npm
-in a shell script if you really wanted to.
-
npm will not help you do something that is known to be a bad idea.
-
Should I check my node_modules folder into git?
-
Usually, no. Allow npm to resolve dependencies for your packages.
-
For packages you deploy, such as websites and apps,
-you should use npm shrinkwrap to lock down your full dependency tree:
If you are paranoid about depending on the npm ecosystem,
-you should run a private npm mirror or a private cache.
-
If you want 100% confidence in being able to reproduce the specific bytes
-included in a deployment, you should use an additional mechanism that can
-verify contents rather than versions. For example,
-Amazon machine images, DigitalOcean snapshots, Heroku slugs, or simple tarballs.
-
Is it 'npm' or 'NPM' or 'Npm'?
-
npm should never be capitalized unless it is being displayed in a
-location that is customarily all-caps (such as the title of man pages.)
-
If 'npm' is an acronym, why is it never capitalized?
-
Contrary to the belief of many, "npm" is not in fact an abbreviation for
-"Node Package Manager". It is a recursive bacronymic abbreviation for
-"npm is not an acronym". (If it was "ninaa", then it would be an
-acronym, and thus incorrectly named.)
-
"NPM", however, is an acronym (more precisely, a capitonym) for the
-National Association of Pastoral Musicians. You can learn more
-about them at http://npm.org/.
-
In software, "NPM" is a Non-Parametric Mapping utility written by
-Chris Rorden. You can analyze pictures of brains with it. Learn more
-about the (capitalized) NPM program at http://www.cabiatl.com/mricro/npm/.
-
The first seed that eventually grew into this flower was a bash utility
-named "pm", which was a shortened descendent of "pkgmakeinst", a
-bash function that was used to install various different things on different
-platforms, most often using Yahoo's yinst. If npm was ever an
-acronym for anything, it was node pm or maybe new pm.
-
So, in all seriousness, the "npm" project is named after its command-line
-utility, which was organically selected to be easily typed by a right-handed
-programmer using a US QWERTY keyboard layout, ending with the
-right-ring-finger in a postition to type the - key for flags and
-other command-line arguments. That command-line utility is always
-lower-case, though it starts most sentences it is a part of.
-
How do I list installed packages?
-
npm ls
-
How do I search for packages?
-
npm search
-
Arguments are greps. npm search jsdom shows jsdom packages.
-
How do I update npm?
-
npm install npm -g
-
You can also update all outdated local packages by doing npm update without
-any arguments, or global packages by doing npm update -g.
-
Occasionally, the version of npm will progress such that the current
-version cannot be properly installed with the version that you have
-installed already. (Consider, if there is ever a bug in the update
-command.)
-
In those cases, you can do this:
-
curl https://www.npmjs.com/install.sh | sh
-
What is a package?
-
A package is:
-
-
a) a folder containing a program described by a package.json file
-
b) a gzipped tarball containing (a)
-
c) a url that resolves to (b)
-
d) a <name>@<version> that is published on the registry with (c)
-
e) a <name>@<tag> that points to (d)
-
f) a <name> that has a "latest" tag satisfying (e)
-
g) a git url that, when cloned, results in (a).
-
-
Even if you never publish your package, you can still get a lot of
-benefits of using npm if you just want to write a node program (a), and
-perhaps if you also want to be able to easily install it elsewhere
-after packing it up into a tarball (b).
The commit-ish can be any tag, sha, or branch which can be supplied as
-an argument to git checkout. The default is master.
-
What is a module?
-
A module is anything that can be loaded with require() in a Node.js
-program. The following things are all examples of things that can be
-loaded as modules:
-
-
A folder with a package.json file containing a main field.
-
A folder with an index.js file in it.
-
A JavaScript file.
-
-
Most npm packages are modules, because they are libraries that you
-load with require. However, there's no requirement that an npm
-package be a module! Some only contain an executable command-line
-interface, and don't provide a main field for use in Node programs.
-
Almost all npm packages (at least, those that are Node programs)
-contain many modules within them (because every file they load with
-require() is a module).
-
In the context of a Node program, the module is also the thing that
-was loaded from a file. For example, in the following program:
-
var req = require('request')
-
we might say that "The variable req refers to the request module".
-
So, why is it the "node_modules" folder, but "package.json" file? Why not node_packages or module.json?
-
The package.json file defines the package. (See "What is a
-package?" above.)
-
The node_modules folder is the place Node.js looks for modules.
-(See "What is a module?" above.)
-
For example, if you create a file at node_modules/foo.js and then
-had a program that did var f = require('foo.js') then it would load
-the module. However, foo.js is not a "package" in this case,
-because it does not have a package.json.
-
Alternatively, if you create a package which does not have an
-index.js or a "main" field in the package.json file, then it is
-not a module. Even if it's installed in node_modules, it can't be
-an argument to require().
-
"node_modules" is the name of my deity's arch-rival, and a Forbidden Word in my religion. Can I configure npm to use a different folder?
-
No. This will never happen. This question comes up sometimes,
-because it seems silly from the outside that npm couldn't just be
-configured to put stuff somewhere else, and then npm could load them
-from there. It's an arbitrary spelling choice, right? What's the big
-deal?
-
At the time of this writing, the string 'node_modules' appears 151
-times in 53 separate files in npm and node core (excluding tests and
-documentation).
-
Some of these references are in node's built-in module loader. Since
-npm is not involved at all at run-time, node itself would have to
-be configured to know where you've decided to stick stuff. Complexity
-hurdle #1. Since the Node module system is locked, this cannot be
-changed, and is enough to kill this request. But I'll continue, in
-deference to your deity's delicate feelings regarding spelling.
-
Many of the others are in dependencies that npm uses, which are not
-necessarily tightly coupled to npm (in the sense that they do not read
-npm's configuration files, etc.) Each of these would have to be
-configured to take the name of the node_modules folder as a
-parameter. Complexity hurdle #2.
-
Furthermore, npm has the ability to "bundle" dependencies by adding
-the dep names to the "bundledDependencies" list in package.json,
-which causes the folder to be included in the package tarball. What
-if the author of a module bundles its dependencies, and they use a
-different spelling for node_modules? npm would have to rename the
-folder at publish time, and then be smart enough to unpack it using
-your locally configured name. Complexity hurdle #3.
-
Furthermore, what happens when you change this name? Fine, it's
-easy enough the first time, just rename the node_modules folders to
-./blergyblerp/ or whatever name you choose. But what about when you
-change it again? npm doesn't currently track any state about past
-configuration settings, so this would be rather difficult to do
-properly. It would have to track every previous value for this
-config, and always accept any of them, or else yesterday's install may
-be broken tomorrow. Complexity hurdle #4.
-
Never going to happen. The folder is named node_modules. It is
-written indelibly in the Node Way, handed down from the ancient times
-of Node 0.3.
-
How do I install node with npm?
-
You don't. Try one of these node version managers:
You'll most likely want to npm link your development folder. That's
-awesomely handy.
-
To set up your own private registry, check out npm-registry(7).
-
Can I list a url as a dependency?
-
Yes. It should be a url to a gzipped tarball containing a single folder
-that has a package.json in its root, or a git url.
-(See "what is a package?" above.)
-
How do I symlink to a dev folder so I don't have to keep re-installing?
Either the registry is down, or node's DNS isn't able to reach out.
-
To check if the registry is down, open up
-https://registry.npmjs.org/ in a web browser. This will also tell
-you if you are just unable to access the internet for some reason.
-
If the registry IS down, let us know by emailing support@npmjs.com
-or posting an issue at https://github.com/npm/npm/issues. If it's
-down for the world (and not just on your local network) then we're
-probably already being pinged about it.
-
You can also often get a faster response by visiting the #npm channel
-on Freenode IRC.
-
Why no namespaces?
-
npm has only one global namespace. If you want to namespace your own packages,
-you may: simply use the - character to separate the names or use scoped
-packages. npm is a mostly anarchic system. There is not sufficient need to
-impose namespace rules on everyone.
-
As of 2.0, npm supports scoped packages, which allow you to publish a group of
-related modules without worrying about name collisions.
-
Every npm user owns the scope associated with their username. For example, the
-user named npm owns the scope @npm. Scoped packages are published inside a
-scope by naming them as if they were files under the scope directory, e.g., by
-setting name in package.json to @npm/npm.
-
Scoped packages are supported by the public npm registry. The npm client is
-backwards-compatible with un-scoped registries, so it can be used to work with
-scoped and un-scoped registries at the same time.
-
Unscoped packages can only depend on other unscoped packages. Scoped packages
-can depend on packages from their own scope, a different scope, or the public
-registry (unscoped).
For the reasoning behind the "one global namespace", please see this
-discussion: https://github.com/npm/npm/issues/798 (TL;DR: It doesn't
-actually make things better, and can make them worse.)
To resolve packages by name and version, npm talks to a registry website
-that implements the CommonJS Package Registry specification for reading
-package info.
-
Additionally, npm's package registry implementation supports several
-write APIs as well, to allow for publishing packages and managing user
-account information.
The registry URL used is determined by the scope of the package (see
-npm-scope(7)). If no scope is specified, the default registry is used, which is
-supplied by the registry config parameter. See npm-config(1),
-npmrc(5), and npm-config(7) for more on managing npm's configuration.
-
Can I run my own private registry?
-
Yes!
-
The easiest way is to replicate the couch database, and use the same (or
-similar) design doc to implement the APIs.
-
If you set up continuous replication from the official CouchDB, and then
-set your internal CouchDB as the registry config, then you'll be able
-to read any published packages, in addition to your private ones, and by
-default will only publish internally.
-
If you then want to publish a package for the whole world to see, you can
-simply override the --registry option for that publish command.
-
I don't want my package published in the official registry. It's private.
-
Set "private": true in your package.json to prevent it from being
-published at all, or
-"publishConfig":{"registry":"http://my-internal-registry.local"}
-to force it to be published only to your internal registry.
-
See package.json(5) for more info on what goes in the package.json file.
-
Will you replicate from my registry into the public one?
-
No. If you want things to be public, then publish them into the public
-registry using npm. What little security there is would be for nought
-otherwise.
-
Do I have to use couchdb to build a registry that npm can talk to?
-
No, but it's way easier. Basically, yes, you do, or you have to
-effectively implement the entire CouchDB API anyway.
-
Is there a website or something to see package docs and such?
All npm packages have a name. Some package names also have a scope. A scope
-follows the usual rules for package names (url-safe characters, no leading dots
-or underscores). When used in package names, preceded by an @-symbol and
-followed by a slash, e.g.
-
@somescope/somepackagename
-
Scopes are a way of grouping related packages together, and also affect a few
-things about the way npm treats the package.
-
Scoped packages are supported by the public npm registry. The npm
-client is backwards-compatible with un-scoped registries, so it can be
-used to work with scoped and un-scoped registries at the same time.
-
Installing scoped packages
-
Scoped packages are installed to a sub-folder of the regular installation
-folder, e.g. if your other packages are installed in node_modules/packagename,
-scoped modules will be in node_modules/@myorg/packagename. The scope folder
-(@myorg) is simply the name of the scope preceded by an @-symbol, and can
-contain any number of scoped packages.
-
A scoped package is installed by referencing it by name, preceded by an
-@-symbol, in npm install:
Note that if the @-symbol is omitted in either case npm will instead attempt to
-install from GitHub; see npm-install(1).
-
Requiring scoped packages
-
Because scoped packages are installed into a scope folder, you have to
-include the name of the scope when requiring them in your code, e.g.
-
require('@myorg/mypackage')
-
There is nothing special about the way Node treats scope folders, this is
-just specifying to require the module mypackage in the folder called @myorg.
-
Publishing scoped packages
-
Scoped packages can be published to any registry that supports them, including
-the public npm registry.
-
(As of 2015-04-19, the public npm registry does support scoped packages)
-
If you wish, you may associate a scope with a registry; see below.
-
Publishing public scoped packages to the public npm registry
-
To publish a public scoped package, you must specify --access public with
-the initial publication. This will publish the package and set access
-to public as if you had run npm access public after publishing.
-
Publishing private scoped packages to the npm registry
-
To publish a private scoped package to the npm registry, you must have
-an npm Private Modules
-account.
-
You can then publish the module with npm publish or npm publish
---access restricted, and it will be present in the npm registry, with
-restricted access. You can then change the access permissions, if
-desired, with npm access or on the npmjs.com website.
-
Associating a scope with a registry
-
Scopes can be associated with a separate registry. This allows you to
-seamlessly use a mix of packages from the public npm registry and one or more
-private registries, such as npm Enterprise.
-
You can associate a scope with a registry at login, e.g.
Scopes have a many-to-one relationship with registries: one registry can
-host multiple scopes, but a scope only ever points to one registry.
-
You can also associate a scope with a registry using npm config:
-
npm config set @myco:registry http://reg.example.com
-
Once a scope is associated with a registry, any npm install for a package
-with that scope will request packages from that registry instead. Any
-npm publish for a package name that contains the scope will be published to
-that registry instead.
npm supports the "scripts" property of the package.json script, for the
-following scripts:
-
-
prepublish:
-Run BEFORE the package is published. (Also run on local npm
-install without any arguments.)
-
publish, postpublish:
-Run AFTER the package is published.
-
preinstall:
-Run BEFORE the package is installed
-
install, postinstall:
-Run AFTER the package is installed.
-
preuninstall, uninstall:
-Run BEFORE the package is uninstalled.
-
postuninstall:
-Run AFTER the package is uninstalled.
-
preversion, version:
-Run BEFORE bump the package version.
-
postversion:
-Run AFTER bump the package version.
-
pretest, test, posttest:
-Run by the npm test command.
-
prestop, stop, poststop:
-Run by the npm stop command.
-
prestart, start, poststart:
-Run by the npm start command.
-
prerestart, restart, postrestart:
-Run by the npm restart command. Note: npm restart will run the
-stop and start scripts if no restart script is provided.
-
-
Additionally, arbitrary scripts can be executed by running npm
-run-script <pkg> <stage>. Pre and post commands with matching
-names will be run for those as well (e.g. premyscript, myscript,
-postmyscript).
-
COMMON USES
-
If you need to perform operations on your package before it is used, in a way
-that is not dependent on the operating system or architecture of the
-target system, use a prepublish script. This includes
-tasks such as:
-
-
Compiling CoffeeScript source code into JavaScript.
-
Creating minified versions of JavaScript source code.
-
Fetching remote resources that your package will use.
-
-
The advantage of doing these things at prepublish time is that they can be done once, in a
-single place, thus reducing complexity and variability.
-Additionally, this means that:
-
-
You can depend on coffee-script as a devDependency, and thus
-your users don't need to have it installed.
-
You don't need to include minifiers in your package, reducing
-the size for your users.
-
You don't need to rely on your users having curl or wget or
-other system tools on the target machines.
-
-
DEFAULT VALUES
-
npm will default some script values based on package contents.
-
-
"start": "node server.js":
-
If there is a server.js file in the root of your package, then npm
-will default the start command to node server.js.
If there is a wscript file in the root of your package, npm will
-default the preinstall command to compile using node-waf.
-
-
-
USER
-
If npm was invoked with root privileges, then it will change the uid
-to the user account or uid specified by the user config, which
-defaults to nobody. Set the unsafe-perm flag to run scripts with
-root privileges.
-
ENVIRONMENT
-
Package scripts run in an environment where many pieces of information
-are made available regarding the setup of npm and the current state of
-the process.
-
path
-
If you depend on modules that define executable scripts, like test
-suites, then those executables will be added to the PATH for
-executing the scripts. So, if your package.json has this:
then you could run npm start to execute the bar script, which is
-exported into the node_modules/.bin directory on npm install.
-
package.json vars
-
The package.json fields are tacked onto the npm_package_ prefix. So,
-for instance, if you had {"name":"foo", "version":"1.2.5"} in your
-package.json file, then your package scripts would have the
-npm_package_name environment variable set to "foo", and the
-npm_package_version set to "1.2.5"
-
configuration
-
Configuration parameters are put in the environment with the
-npm_config_ prefix. For instance, you can view the effective root
-config by checking the npm_config_root environment variable.
-
Special: package.json "config" object
-
The package.json "config" keys are overwritten in the environment if
-there is a config param of <name>[@<version>]:<key>. For example,
-if the package.json has this:
Lastly, the npm_lifecycle_event environment variable is set to
-whichever stage of the cycle is being executed. So, you could have a
-single script used for different parts of the process which switches
-based on what's currently happening.
-
Objects are flattened following this format, so if you had
-{"scripts":{"install":"foo.js"}} in your package.json, then you'd
-see this in the script:
then the scripts/install.js will be called for the install,
-post-install, stages of the lifecycle, and the scripts/uninstall.js
-would be called when the package is uninstalled. Since
-scripts/install.js is running for three different phases, it would
-be wise in this case to look at the npm_lifecycle_event environment
-variable.
-
If you want to run a make command, you can do so. This works just
-fine:
Scripts are run by passing the line as a script argument to sh.
-
If the script exits with a code other than 0, then this will abort the
-process.
-
Note that these script files don't have to be nodejs or even
-javascript programs. They just have to be some kind of executable
-file.
-
HOOK SCRIPTS
-
If you want to run a specific script at a specific lifecycle event for
-ALL packages, then you can use a hook script.
-
Place an executable file at node_modules/.hooks/{eventname}, and
-it'll get run for all packages when they are going through that point
-in the package lifecycle for any packages installed in that root.
-
Hook scripts are run exactly the same way as package.json scripts.
-That is, they are in a separate child process, with the env described
-above.
-
BEST PRACTICES
-
-
Don't exit with a non-zero error code unless you really mean it.
-Except for uninstall scripts, this will cause the npm action to
-fail, and potentially be rolled back. If the failure is minor or
-only will prevent some optional features, then it's better to just
-print a warning and exit successfully.
-
Try not to use scripts to do what npm can do for you. Read through
-package.json(5) to see all the things that you can specify and enable
-by simply describing your package appropriately. In general, this
-will lead to a more robust and consistent state.
-
Inspect the env to determine where to put things. For instance, if
-the npm_config_binroot environ is set to /home/user/bin, then
-don't try to install executables into /usr/local/bin. The user
-probably set it up that way for a reason.
-
Don't prefix your script commands with "sudo". If root permissions
-are required for some reason, then it'll fail with that error, and
-the user will sudo the npm command in question.
-
Don't use install. Use a .gyp file for compilation, and prepublish
-for anything else. You should almost never have to explicitly set a
-preinstall or install script. If you are doing this, please consider if
-there is another option. The only valid use of install or preinstall
-scripts is for compilation which must be done on the target architecture.
Or, if that fails, get the npm source code, and do:
-
sudo make uninstall
-
More Severe Uninstalling
-
Usually, the above instructions are sufficient. That will remove
-npm, but leave behind anything you've installed.
-
If that doesn't work, or if you require more drastic measures,
-continue reading.
-
Note that this is only necessary for globally-installed packages. Local
-installs are completely contained within a project's node_modules
-folder. Delete that folder, and everything is gone (unless a package's
-install script is particularly ill-behaved).
-
This assumes that you installed node and npm in the default place. If
-you configured node with a different --prefix, or installed npm with a
-different prefix setting, then adjust the paths accordingly, replacing
-/usr/local with your install prefix.
If you installed things with npm, then your best bet is to uninstall
-them with npm first, and then install them again once you have a
-proper install. This can help find any symlinks that are lying
-around:
-
ls -laF /usr/local/{lib/node{,/.npm},bin,share/man} | grep npm
-
Prior to version 0.3, npm used shim files for executables and node
-modules. To track those down, you can do the following:
$ semver -h
-
-Usage: semver <version> [<version> [...]] [-r <range> | -i <inc> | --preid <identifier> | -l | -rv]
-Test if version(s) satisfy the supplied range(s), and sort them.
-
-Multiple versions or ranges may be supplied, unless increment
-option is specified. In that case, only a single version may
-be used, and it is incremented by the specified level
-
-Program exits successfully if any valid version satisfies
-all supplied ranges, and prints all satisfying versions.
-
-If no versions are valid, or ranges are not satisfied,
-then exits failure.
-
-Versions are printed in ascending order, so supplying
-multiple versions to the utility will just sort them.
-
Versions
-
A "version" is described by the v2.0.0 specification found at
-http://semver.org/.
-
A leading "=" or "v" character is stripped off and ignored.
-
Ranges
-
A version range is a set of comparators which specify versions
-that satisfy the range.
-
A comparator is composed of an operator and a version. The set
-of primitive operators is:
-
-
< Less than
-
<= Less than or equal to
-
> Greater than
-
>= Greater than or equal to
-
= Equal. If no operator is specified, then equality is assumed,
-so this operator is optional, but MAY be included.
-
-
For example, the comparator >=1.2.7 would match the versions
-1.2.7, 1.2.8, 2.5.3, and 1.3.9, but not the versions 1.2.6
-or 1.1.0.
-
Comparators can be joined by whitespace to form a comparator set,
-which is satisfied by the intersection of all of the comparators
-it includes.
-
A range is composed of one or more comparator sets, joined by ||. A
-version matches a range if and only if every comparator in at least
-one of the ||-separated comparator sets is satisfied by the version.
-
For example, the range >=1.2.7 <1.3.0 would match the versions
-1.2.7, 1.2.8, and 1.2.99, but not the versions 1.2.6, 1.3.0,
-or 1.1.0.
-
The range 1.2.7 || >=1.2.9 <2.0.0 would match the versions 1.2.7,
-1.2.9, and 1.4.6, but not the versions 1.2.8 or 2.0.0.
-
Prerelease Tags
-
If a version has a prerelease tag (for example, 1.2.3-alpha.3) then
-it will only be allowed to satisfy comparator sets if at least one
-comparator with the same [major, minor, patch] tuple also has a
-prerelease tag.
-
For example, the range >1.2.3-alpha.3 would be allowed to match the
-version 1.2.3-alpha.7, but it would not be satisfied by
-3.4.5-alpha.9, even though 3.4.5-alpha.9 is technically "greater
-than" 1.2.3-alpha.3 according to the SemVer sort rules. The version
-range only accepts prerelease tags on the 1.2.3 version. The
-version 3.4.5would satisfy the range, because it does not have a
-prerelease flag, and 3.4.5 is greater than 1.2.3-alpha.7.
-
The purpose for this behavior is twofold. First, prerelease versions
-frequently are updated very quickly, and contain many breaking changes
-that are (by the author's design) not yet fit for public consumption.
-Therefore, by default, they are excluded from range matching
-semantics.
-
Second, a user who has opted into using a prerelease version has
-clearly indicated the intent to use that specific set of
-alpha/beta/rc versions. By including a prerelease tag in the range,
-the user is indicating that they are aware of the risk. However, it
-is still not appropriate to assume that they have opted into taking a
-similar risk on the next set of prerelease versions.
-
Prerelease Identifiers
-
The method .inc takes an additional identifier string argument that
-will append the value of the string as a prerelease identifier:
Advanced range syntax desugars to primitive comparators in
-deterministic ways.
-
Advanced ranges may be combined in the same way as primitive
-comparators using white space or ||.
-
Hyphen Ranges X.Y.Z - A.B.C
-
Specifies an inclusive set.
-
-
1.2.3 - 2.3.4 := >=1.2.3 <=2.3.4
-
-
If a partial version is provided as the first version in the inclusive
-range, then the missing pieces are replaced with zeroes.
-
-
1.2 - 2.3.4 := >=1.2.0 <=2.3.4
-
-
If a partial version is provided as the second version in the
-inclusive range, then all versions that start with the supplied parts
-of the tuple are accepted, but nothing that would be greater than the
-provided tuple parts.
-
-
1.2.3 - 2.3 := >=1.2.3 <2.4.0
-
1.2.3 - 2 := >=1.2.3 <3.0.0
-
-
X-Ranges 1.2.x1.X1.2.**
-
Any of X, x, or * may be used to "stand in" for one of the
-numeric values in the [major, minor, patch] tuple.
-
-
* := >=0.0.0 (Any version satisfies)
-
1.x := >=1.0.0 <2.0.0 (Matching major version)
-
1.2.x := >=1.2.0 <1.3.0 (Matching major and minor versions)
-
-
A partial version range is treated as an X-Range, so the special
-character is in fact optional.
-
-
"" (empty string) := * := >=0.0.0
-
1 := 1.x.x := >=1.0.0 <2.0.0
-
1.2 := 1.2.x := >=1.2.0 <1.3.0
-
-
Tilde Ranges ~1.2.3~1.2~1
-
Allows patch-level changes if a minor version is specified on the
-comparator. Allows minor-level changes if not.
-
-
~1.2.3 := >=1.2.3 <1.(2+1).0 := >=1.2.3 <1.3.0
-
~1.2 := >=1.2.0 <1.(2+1).0 := >=1.2.0 <1.3.0 (Same as 1.2.x)
-
~1 := >=1.0.0 <(1+1).0.0 := >=1.0.0 <2.0.0 (Same as 1.x)
-
~0.2.3 := >=0.2.3 <0.(2+1).0 := >=0.2.3 <0.3.0
-
~0.2 := >=0.2.0 <0.(2+1).0 := >=0.2.0 <0.3.0 (Same as 0.2.x)
-
~0 := >=0.0.0 <(0+1).0.0 := >=0.0.0 <1.0.0 (Same as 0.x)
-
~1.2.3-beta.2 := >=1.2.3-beta.2 <1.3.0 Note that prereleases in
-the 1.2.3 version will be allowed, if they are greater than or
-equal to beta.2. So, 1.2.3-beta.4 would be allowed, but
-1.2.4-beta.2 would not, because it is a prerelease of a
-different [major, minor, patch] tuple.
-
-
Caret Ranges ^1.2.3^0.2.5^0.0.4
-
Allows changes that do not modify the left-most non-zero digit in the
-[major, minor, patch] tuple. In other words, this allows patch and
-minor updates for versions 1.0.0 and above, patch updates for
-versions 0.X >=0.1.0, and no updates for versions 0.0.X.
-
Many authors treat a 0.x version as if the x were the major
-"breaking-change" indicator.
-
Caret ranges are ideal when an author may make breaking changes
-between 0.2.4 and 0.3.0 releases, which is a common practice.
-However, it presumes that there will not be breaking changes between
-0.2.4 and 0.2.5. It allows for changes that are presumed to be
-additive (but non-breaking), according to commonly observed practices.
-
-
^1.2.3 := >=1.2.3 <2.0.0
-
^0.2.3 := >=0.2.3 <0.3.0
-
^0.0.3 := >=0.0.3 <0.0.4
-
^1.2.3-beta.2 := >=1.2.3-beta.2 <2.0.0 Note that prereleases in
-the 1.2.3 version will be allowed, if they are greater than or
-equal to beta.2. So, 1.2.3-beta.4 would be allowed, but
-1.2.4-beta.2 would not, because it is a prerelease of a
-different [major, minor, patch] tuple.
-
^0.0.3-beta := >=0.0.3-beta <0.0.4 Note that prereleases in the
-0.0.3 version only will be allowed, if they are greater than or
-equal to beta. So, 0.0.3-pr.2 would be allowed.
-
-
When parsing caret ranges, a missing patch value desugars to the
-number 0, but will allow flexibility within that value, even if the
-major and minor versions are both 0.
-
-
^1.2.x := >=1.2.0 <2.0.0
-
^0.0.x := >=0.0.0 <0.1.0
-
^0.0 := >=0.0.0 <0.1.0
-
-
A missing minor and patch values will desugar to zero, but also
-allow flexibility within those values, even if the major version is
-zero.
-
-
^1.x := >=1.0.0 <2.0.0
-
^0.x := >=0.0.0 <1.0.0
-
-
Functions
-
All methods and classes take a final loose boolean argument that, if
-true, will be more forgiving about not-quite-valid semver strings.
-The resulting output will always be 100% strict, of course.
-
Strict-mode Comparators and Ranges will be strict about the SemVer
-strings that they parse.
-
-
valid(v): Return the parsed version, or null if it's not valid.
-
inc(v, release): Return the version incremented by the release
-type (major, premajor, minor, preminor, patch,
-prepatch, or prerelease), or null if it's not valid
-
premajor in one call will bump the version up to the next major
-version and down to a prerelease of that major version.
-preminor, and prepatch work the same way.
-
If called from a non-prerelease version, the prerelease will work the
-same as prepatch. It increments the patch version, then makes a
-prerelease. If the input version is already a prerelease it simply
-increments it.
-
-
-
major(v): Return the major version number.
-
minor(v): Return the minor version number.
-
patch(v): Return the patch version number.
-
-
Comparison
-
-
gt(v1, v2): v1 > v2
-
gte(v1, v2): v1 >= v2
-
lt(v1, v2): v1 < v2
-
lte(v1, v2): v1 <= v2
-
eq(v1, v2): v1 == v2 This is true if they're logically equivalent,
-even if they're not the exact same string. You already know how to
-compare strings.
-
neq(v1, v2): v1 != v2 The opposite of eq.
-
cmp(v1, comparator, v2): Pass in a comparison string, and it'll call
-the corresponding function above. "===" and "!==" do simple
-string comparison, but are included for completeness. Throws if an
-invalid comparison string is provided.
-
compare(v1, v2): Return 0 if v1 == v2, or 1 if v1 is greater, or -1 if
-v2 is greater. Sorts in ascending order if passed to Array.sort().
-
rcompare(v1, v2): The reverse of compare. Sorts an array of versions
-in descending order when passed to Array.sort().
-
diff(v1, v2): Returns difference between two versions by the release type
-(major, premajor, minor, preminor, patch, prepatch, or prerelease),
-or null if the versions are the same.
-
-
Ranges
-
-
validRange(range): Return the valid range or null if it's not valid
-
satisfies(version, range): Return true if the version satisfies the
-range.
-
maxSatisfying(versions, range): Return the highest version in the list
-that satisfies the range, or null if none of them do.
-
gtr(version, range): Return true if version is greater than all the
-versions possible in the range.
-
ltr(version, range): Return true if version is less than all the
-versions possible in the range.
-
outside(version, range, hilo): Return true if the version is outside
-the bounds of the range in either the high or low direction. The
-hilo argument must be either the string '>' or '<'. (This is
-the function called by gtr and ltr.)
-
-
Note that, since ranges may be non-contiguous, a version might not be
-greater than a range, less than a range, or satisfy a range! For
-example, the range 1.2 <1.2.9 || >2.0.0 would have a hole from 1.2.9
-until 2.0.0, so the version 1.2.10 would not be greater than the
-range (because 2.0.1 satisfies, which is higher), nor less than the
-range (since 1.2.8 satisfies, which is lower), and it also does not
-satisfy the range.
-
If you want to know if a version satisfies or does not satisfy a
-range, use the satisfies(version, range) function.