NPM-DEVELOPERS(7)

📦
version 12.2.1 · 4 versions
, in arch rolling

💖 NPM-DEVELOPERS(7) 💖

ok so this is the NPM-DEVELOPERS page, aka the developer guide, and it's literally about to be your new personality. let's go 💅

🌸 NAME 🌸

Developers — Developer guide

✨ Description ✨

So, you've decided to use npm to develop (and maybe publish/deploy) your project.

Fantastic! 🎉

There are a few things that you need to do above the simple steps that your users will do to install your program. like, above and beyond, extra credit energy. keep reading 🫶

📚 About These Documents 📚

These are man pages. If you install npm, you should be able to then do man npm-thing to get the documentation on a particular topic, or npm help thing to see the same information. same tea, two mugs ☕

🎁 What is a Package 🎁

A package is:

  • a) a folder containing a program described by a package.json file
  • b) a gzipped tarball containing (a)
  • c) a url that resolves to (b)
  • d) a <name>@<version> that is published on the registry with (c)
  • e) a <name>@<tag> that points to (d)
  • f) a <name> that has a "latest" tag satisfying (e)
  • g) a git url that, when cloned, results in (a).

Even if you never publish your package, you can still get a lot of benefits of using npm if you just want to write a node program (a), and perhaps if you also want to be able to easily install it elsewhere after packing it up into a tarball (b). no publishing required, it still eats 💅

Git urls can be of the form:

git://github.com/user/project.git#commit-ish
git+ssh://user@hostname:project.git#commit-ish
git+http://user@hostname/project/blah.git#commit-ish
git+https://user@hostname/project/blah.git#commit-ish

The commit-ish can be any tag, sha, or branch which can be supplied as an argument to git checkout. The default is whatever the repository uses as its default branch. (so if you don't say anything, git picks, not you — main character behavior fr)

🗂️ The package.json File 🗂️

You need to have a package.json file in the root of your project to do much of anything with npm. That is basically the whole interface. like, the entire vibe check happens here.

See package.json at /configuring-npm/package-json for details about what goes in that file. At the very least, you need:

  • name: This should be a string that identifies your project. Please do not use the name to specify that it runs on node, or is in JavaScript. You can use the "engines" field to explicitly state the versions of node (or whatever else) that your program requires, and it's pretty well assumed that it's JavaScript.

It does not necessarily need to match your github repository name.

So, node-foo and bar-js are bad names. foo or bar are better. (bestie please, we're begging 🙈)

  • version: A semver-compatible version.
  • engines: Specify the versions of node (or whatever else) that your program runs on. The node API changes a lot, and there may be bugs or new functionality that you depend on. Be explicit.
  • author: Take some credit. 👑 you did that.
  • scripts: If you have a special compilation or installation script, then you should put it in the scripts object. You should definitely have at least a basic smoke-test command as the "scripts.test" field. See npm help scripts.
  • main: If you have a single module that serves as the entry point to your program (like what the "foo" package gives you at require("foo")), then you need to specify that in the "main" field.
  • directories: This is an object mapping names to folders. The best ones to include are "lib" and "doc", but if you use "man" to specify a folder full of man pages, they'll get installed just like these ones.

You can use npm init in the root of your package in order to get you started with a pretty basic package.json file. See npm help init for more info. lowkey the easiest win ever ✨

🙈 Keeping files out of your Package 🙈

Use a .npmignore file to keep stuff out of your package. If there's no .npmignore file, but there is a .gitignore file, then npm will ignore the stuff matched by the .gitignore file. If you want to include something that is excluded by your .gitignore file, you can create an empty .npmignore file to override it. (yes, empty — the absence is the message 💀) Like git, npm looks for .npmignore and .gitignore files in all subdirectories of your package, not only the root directory.

.npmignore files follow the same pattern rules as .gitignore files — the rules live at https://git-scm.com/book/en/v2/Git-Basics-Recording-Changes-to-the-Repository#_ignoring:

  • Blank lines or lines starting with # are ignored.
  • Standard glob patterns work.
  • You can end patterns with a forward slash / to specify a directory.
  • You can negate a pattern by starting it with an exclamation point !.

By default, some paths and files are ignored, so there's no need to add them to .npmignore explicitly. Some examples are:

  • .*.swp
  • ._*
  • .DS_Store
  • .git
  • .gitignore
  • .hg
  • .npmignore
  • .npmrc
  • .lock-wscript
  • .svn
  • .wafpickle-*
  • config.gypi
  • CVS
  • npm-debug.log

Additionally, everything in node_modules is ignored, except for bundled dependencies. npm automatically handles this for you, so don't bother adding node_modules to .npmignore. it's already handled, bestie, put the pen down 🫶

The following paths and files are never ignored, so adding them to .npmignore is pointless:

  • package.json
  • README (and its variants)
  • LICENSE / LICENCE

If, given the structure of your project, you find .npmignore to be a maintenance headache, you might instead try populating the files property of package.json, which is an array of file or directory names that should be included in your package. Sometimes manually picking which items to allow is easier to manage than building a block list. allow-list era, we love to see it 🌈

See package.json at /configuring-npm/package-json for more info on what can and can't be ignored.

🧪 Testing whether your .npmignore or files config works 🧪

If you want to double check that your package will include only the files you intend it to when published, you can run the npm pack command locally which will generate a tarball in the working directory, the same way it does for publishing. sneak peek of your own package, iconic 👀

npm link is designed to install a development package and see the changes in real time without having to keep re-installing it. (You do need to either re-link or npm rebuild -g to update compiled packages, of course.) live-reload energy, but make it npm 💫

More info at npm help link.

🚨 Before Publishing: Make Sure Your Package Installs and Works 🚨

This is important. like, genuinely, do not skip this one.

If you cannot install it locally, you'll have problems trying to publish it. Or, worse yet, you'll be able to publish it, but you'll be publishing a broken or pointless package. So don't do that. not the broken-package-on-the-registry moment 😭

In the root of your package, do this:

npm install . -g

That'll show you that it's working. If you'd rather just create a symlink package that points to your working directory, then do this:

npm link

Use npm ls -g to see if it's there.

To test a local install, go into some other folder, and then do:

cd ../some-other-folder
npm install ../my-package

to install it locally into the node_modules folder in that other place.

Then go into the node-repl, and try using require("my-thing") to bring in your module's main module.

🕵️ Catching undeclared ( 🕵️

Under the default hoisted node_modules layout, your package can import a dependency it never declared and still resolve it. A transitive dependency hoisted alongside it, or your workspace root's node_modules, happens to satisfy the import. That undeclared ("phantom") dependency passes your own build silently, then fails for anyone who installs your package on its own. 💀 phantom dependency jumpscare fr fr

We recommend developing your package under install-strategy=linked (docs at /using-npm/config#install-strategy). The isolated layout only exposes a package's declared dependencies, so an import of an undeclared package fails for you during development instead of resolving by accident, shipping broken, and failing for your users:

npm install --install-strategy=linked
npm test
Note: This doesn't catch every case. A dependency that's still satisfied at your build by a devDependency or by your workspace root's node_modules can resolve fine for you and still be missing for whoever installs your package. So treat it as one check, not a guarantee, alongside auditing the dependencies your published package actually uses.

👑 Create a User Account 👑

Create a user account on the npm website at https://www.npmjs.com/signup. yes you need an account, no you can't skip it 🎀

🚀 Publish your Package 🚀

This part's easy. In the root of your folder, do this:

npm publish

You can give publish a url to a tarball, or a filename of a tarball, or a path to a folder.

Note that pretty much everything in that folder will be exposed by default. So, if you have secret stuff in there, use a .npmignore file to list out the globs to ignore, or publish from a fresh checkout. do NOT leak the secrets bestie 🙈

📣 Brag about it 📣

Send emails, write blogs, blab in IRC.

Tell the world how easy it is to install your program! you built a thing, say it loudly 💜

🌟 See also 🌟

  • npm help npm
  • npm help init
  • package.json at /configuring-npm/package-json
  • npm help scripts
  • npm help publish
  • npm help login
  • npm help registry

ok that's the whole thing, you're officially a package developer now, go be iconic 💅✨ this was NPM-DEVELOPERS(7) from NPM@12.2.1 — mwah, love u, go publish something slay 🦋🎀

📦 where this page comes from