npm (Node Package Manager) shi ne kayan Node na tiyya don sanya kuma gudanar da fakitin packages na jihar (dependencies) kuma gudanar da ayyukan jerin. Fayiloli biyu sune suna bayyana jerin: package.json (bayyanar jerin) da package-lock.json (gaggawar gida na dependencies na daidai).
Yana rubuta bayanai, ayyuka, da dependencies. ^4.18.0 shi ne semver range — ^ yana baiwa daidaitual ƙaramin/patch sauye (4.x.x amma ba 5.0.0).
package.json says: express ^4.18.0 (a RANGE — could install 4.18.0 or 4.19.2...)
package-lock.json: express 4.18.2 (the EXACT version + every nested dependency)
Lockfile yana dangantaka daidai sigar kowane package (har da dependencies na gida) wanda aka sanya. Wannan yana tabbatar da cewa kowa a cikin gida — kuma CI, kuma kasua — yana samun aidai gida na dependencies, yana bazo "aiki akan natona" gidaje daga sauye na sigar.
npm install # install all deps from package.json (updates lockfile)
npm install express # add a dependency
npm install -D vitest # add a devDependency
npm ci # install EXACTLY from the lockfile (used in CI — fast, strict)
npm run dev # run a script defined in package.json
npm ci (vs npm install) yana sanya daidai daga lockfile ba tare da canza shi ba — makamai daidai don CI/kasua maimaita.
✓ ALWAYS commit package-lock.json → reproducible installs across the team & CI
npm da waɗannan fayiloli biyu sune tushen kowane jerin Node.
Kalubale package.json (dependencies vs devDependencies, semver ranges, ayyuka) da kuma yasa lockfile ke akwai (tsada, maimaita sanya na gida na dependencies) shine dole — aika lockfile kuma yi amfani da npm ci a CI yana bambayi hankali, wahali-wahalin kuskure daga abokan aiki ko kasua da za su sami siffa daban-daban na packages.