Apa iku npm lan apa sing diduweni package.json lan lockfile?

Question

Accepted Answer

**npm** (Node Package Manager) yaiku alat baku Node kanggo ngestalasi lan ngatur pakét pihak katelu (dependencies) lan njalanake script proyek. Rong berkas nggolongke proyék: **`package.json`** (manifest) lan **`package-lock.json`** (wit dependencies sing tepat).

## package.json — manifest proyék

```json
{
  "name": "my-app",
  "version": "1.0.0",
  "type": "module",
  "scripts": {
    "start": "node server.js",
    "dev": "nodemon server.js",
    "test": "vitest"
  },
  "dependencies": {        // needed at RUNTIME
    "express": "^4.18.0"
  },
  "devDependencies": {     // needed only for DEVELOPMENT (testing, building)
    "vitest": "^1.0.0"
  }
}
```

Ngrekam metadata, script, lan dependencies. `^4.18.0` yaiku **semver range** — `^` ngidini pembaruan minor/patch sing cocok (4.x.x nanging ora 5.0.0).

## Lockfile — tepat, instalasi sing bisa diulang maneh

```text
package.json says:  express ^4.18.0  (a RANGE — could install 4.18.0 or 4.19.2...)
package-lock.json:  express 4.18.2   (the EXACT version + every nested dependency)
```

Lockfile mendheg versi **pancet-pancet** saben pakét (kalebu dependencies transitif) sing wis diinstalasi. Iki njamin yen kabeh wong ing tim — lan CI, lan produksi — oleh wit dependencies sing *padha tunggal*, nyegah bug "works on my machine" saka pergeseran versi.

## Perintah penting

```bash
npm install              # install all deps from package.json (updates lockfile)
npm install express      # add a dependency
npm install -D vitest    # add a devDependency
npm ci                   # install EXACTLY from the lockfile (used in CI — fast, strict)
npm run dev              # run a script defined in package.json
```

`npm ci` (lawan `npm install`) ngestalasi ketat saka lockfile tanpa ngowahi — perintah sing bener kanggo reprodukabilitas CI/produksi.

## Commit lockfile

```text
✓ ALWAYS commit package-lock.json → reproducible installs across the team & CI
```

## Apa sebabe dadi penting

npm lan rong berkas iki yaiku fondasi saben proyék Node.

Paham `package.json` (dependencies vs devDependencies, semver ranges, script) lan utamane **apa sebabe lockfile ana** (instalasi deterministic, bisa diulang saka kabeh wit dependencies) penting banget — commit lockfile lan gunakake `npm ci` ing CI nyegah kegagalan halus, sulit debug sing kakaseh saka kanca tim utawa produksi sing oleh versi pakét beda.