@nirvana-labs/nirvana-mcp 1.31.1 → 1.33.0

package/oidc/node_modules/npm/man/man7/dependency-selectors.7

@@ -0,0 +1,331 @@
+.TH "QUERYING" "7" "October 2025" "NPM@11.6.2" ""
+.SH "NAME"
+\fBQuerying\fR - Dependency Selector Syntax & Querying
+.SS "Description"
+.P
+The npm help query command exposes a new dependency selector syntax (informed by & respecting many aspects of the \fBCSS Selectors 4 Spec\fR \fI\(lahttps://dev.w3.org/csswg/selectors4/#relational\(ra\fR) which:
+.RS 0
+.IP \(bu 4
+Standardizes the shape of, & querying of, dependency graphs with a robust object model, metadata & selector syntax
+.IP \(bu 4
+Leverages existing, known language syntax & operators from CSS to make disparate package information broadly accessible
+.IP \(bu 4
+Unlocks the ability to answer complex, multi-faceted questions about dependencies, their relationships & associative metadata
+.IP \(bu 4
+Consolidates redundant logic of similar query commands in \fBnpm\fR (ex. \fBnpm fund\fR, \fBnpm ls\fR, \fBnpm outdated\fR, \fBnpm audit\fR ...)
+.RE 0
+
+.SS "Dependency Selector Syntax"
+.SS "Overview:"
+.RS 0
+.IP \(bu 4
+there is no "type" or "tag" selectors (ex. \fBdiv, h1, a\fR) as a dependency/target is the only type of \fBNode\fR that can be queried
+.IP \(bu 4
+the term "dependencies" is in reference to any \fBNode\fR found in a \fBtree\fR returned by \fBArborist\fR
+.RE 0
+
+.SS "Combinators"
+.RS 0
+.IP \(bu 4
+\fB>\fR direct descendant/child
+.IP \(bu 4
+\fB \fR any descendant/child
+.IP \(bu 4
+\fB~\fR sibling
+.RE 0
+
+.SS "Selectors"
+.RS 0
+.IP \(bu 4
+\fB*\fR universal selector
+.IP \(bu 4
+\fB#<name>\fR dependency selector (equivalent to \fB\[lB]name="..."\[rB]\fR)
+.IP \(bu 4
+\fB#<name>@<version>\fR (equivalent to \fB\[lB]name=<name>\[rB]:semver(<version>)\fR)
+.IP \(bu 4
+\fB,\fR selector list delimiter
+.IP \(bu 4
+\fB.\fR dependency type selector
+.IP \(bu 4
+\fB:\fR pseudo selector
+.RE 0
+
+.SS "Dependency Type Selectors"
+.RS 0
+.IP \(bu 4
+\fB.prod\fR dependency found in the \fBdependencies\fR section of \fBpackage.json\fR, or is a child of said dependency
+.IP \(bu 4
+\fB.dev\fR dependency found in the \fBdevDependencies\fR section of \fBpackage.json\fR, or is a child of said dependency
+.IP \(bu 4
+\fB.optional\fR dependency found in the \fBoptionalDependencies\fR section of \fBpackage.json\fR, or has \fB"optional": true\fR set in its entry in the \fBpeerDependenciesMeta\fR section of \fBpackage.json\fR, or a child of said dependency
+.IP \(bu 4
+\fB.peer\fR dependency found in the \fBpeerDependencies\fR section of \fBpackage.json\fR
+.IP \(bu 4
+\fB.workspace\fR dependency found in the \fB\[rs]fBworkspaces\[rs]fR\fR \fI\(lahttps://docs.npmjs.com/cli/v8/using-npm/workspaces\(ra\fR section of \fBpackage.json\fR
+.IP \(bu 4
+\fB.bundled\fR dependency found in the \fBbundleDependencies\fR section of \fBpackage.json\fR, or is a child of said dependency
+.RE 0
+
+.SS "Pseudo Selectors"
+.RS 0
+.IP \(bu 4
+\fB\[rs]fB:not(<selector>)\[rs]fR\fR \fI\(lahttps://developer.mozilla.org/en-US/docs/Web/CSS/:not\(ra\fR
+.IP \(bu 4
+\fB\[rs]fB:has(<selector>)\[rs]fR\fR \fI\(lahttps://developer.mozilla.org/en-US/docs/Web/CSS/:has\(ra\fR
+.IP \(bu 4
+\fB\[rs]fB:is(<selector list>)\[rs]fR\fR \fI\(lahttps://developer.mozilla.org/en-US/docs/Web/CSS/:is\(ra\fR
+.IP \(bu 4
+\fB\[rs]fB:root\[rs]fR\fR \fI\(lahttps://developer.mozilla.org/en-US/docs/Web/CSS/:root\(ra\fR matches the root node/dependency
+.IP \(bu 4
+\fB\[rs]fB:scope\[rs]fR\fR \fI\(lahttps://developer.mozilla.org/en-US/docs/Web/CSS/:scope\(ra\fR matches node/dependency it was queried against
+.IP \(bu 4
+\fB\[rs]fB:empty\[rs]fR\fR \fI\(lahttps://developer.mozilla.org/en-US/docs/Web/CSS/:empty\(ra\fR when a dependency has no dependencies
+.IP \(bu 4
+\fB\[rs]fB:private\[rs]fR\fR \fI\(lahttps://docs.npmjs.com/cli/v8/configuring-npm/package-json#private\(ra\fR when a dependency is private
+.IP \(bu 4
+\fB:link\fR when a dependency is linked (for instance, workspaces or packages manually \fB\[rs]fBlinked\[rs]fR\fR \fI\(lahttps://docs.npmjs.com/cli/v8/commands/npm-link\(ra\fR
+.IP \(bu 4
+\fB:deduped\fR when a dependency has been deduped (note that this does \fInot\fR always mean the dependency has been hoisted to the root of node_modules)
+.IP \(bu 4
+\fB:overridden\fR when a dependency has been overridden
+.IP \(bu 4
+\fB:extraneous\fR when a dependency exists but is not defined as a dependency of any node
+.IP \(bu 4
+\fB:invalid\fR when a dependency version is out of its ancestors specified range
+.IP \(bu 4
+\fB:missing\fR when a dependency is not found on disk
+.IP \(bu 4
+\fB:semver(<spec>, \[lB]selector\[rB], \[lB]function\[rB])\fR match a valid \fB\[rs]fBnode-semver\[rs]fR\fR \fI\(lahttps://github.com/npm/node-semver\(ra\fR version or range to a selector
+.IP \(bu 4
+\fB:path(<path>)\fR \fBglob\fR \fI\(lahttps://www.npmjs.com/package/glob\(ra\fR matching based on dependencies path relative to the project
+.IP \(bu 4
+\fB:type(<type>)\fR \fBbased on currently recognized types\fR \fI\(lahttps://github.com/npm/npm-package-arg#result-object\(ra\fR
+.IP \(bu 4
+\fB:outdated(<type>)\fR when a dependency is outdated
+.IP \(bu 4
+\fB:vuln(<selector>)\fR when a dependency has a known vulnerability
+.RE 0
+
+.SS "\fB:semver(<spec>, \[lB]selector\[rB], \[lB]function\[rB])\fR"
+.P
+The \fB:semver()\fR pseudo selector allows comparing fields from each node's \fBpackage.json\fR using \fBsemver\fR \fI\(lahttps://github.com/npm/node-semver#readme\(ra\fR methods. It accepts up to 3 parameters, all but the first of which are optional.
+.RS 0
+.IP \(bu 4
+\fBspec\fR a semver version or range
+.IP \(bu 4
+\fBselector\fR an attribute selector for each node (default \fB\[lB]version\[rB]\fR)
+.IP \(bu 4
+\fBfunction\fR a semver method to apply, one of: \fBsatisfies\fR, \fBintersects\fR, \fBsubset\fR, \fBgt\fR, \fBgte\fR, \fBgtr\fR, \fBlt\fR, \fBlte\fR, \fBltr\fR, \fBeq\fR, \fBneq\fR or the special function \fBinfer\fR (default \fBinfer\fR)
+.RE 0
+
+.P
+When the special \fBinfer\fR function is used the \fBspec\fR and the actual value from the node are compared. If both are versions, according to \fBsemver.valid()\fR, \fBeq\fR is used. If both values are ranges, according to \fB!semver.valid()\fR, \fBintersects\fR is used. If the values are mixed types \fBsatisfies\fR is used.
+.P
+Some examples:
+.RS 0
+.IP \(bu 4
+\fB:semver(^1.0.0)\fR returns every node that has a \fBversion\fR satisfied by the provided range \fB^1.0.0\fR
+.IP \(bu 4
+\fB:semver(16.0.0, :attr(engines, \[lB]node\[rB]))\fR returns every node which has an \fBengines.node\fR property satisfying the version \fB16.0.0\fR
+.IP \(bu 4
+\fB:semver(1.0.0, \[lB]version\[rB], lt)\fR every node with a \fBversion\fR less than \fB1.0.0\fR
+.RE 0
+
+.SS "\fB:outdated(<type>)\fR"
+.P
+The \fB:outdated\fR pseudo selector retrieves data from the registry and returns information about which of your dependencies are outdated. The type parameter may be one of the following:
+.RS 0
+.IP \(bu 4
+\fBany\fR (default) a version exists that is greater than the current one
+.IP \(bu 4
+\fBin-range\fR a version exists that is greater than the current one, and satisfies at least one if its parent's dependencies
+.IP \(bu 4
+\fBout-of-range\fR a version exists that is greater than the current one, does not satisfy at least one of its parent's dependencies
+.IP \(bu 4
+\fBmajor\fR a version exists that is a semver major greater than the current one
+.IP \(bu 4
+\fBminor\fR a version exists that is a semver minor greater than the current one
+.IP \(bu 4
+\fBpatch\fR a version exists that is a semver patch greater than the current one
+.RE 0
+
+.P
+In addition to the filtering performed by the pseudo selector, some extra data is added to the resulting objects. The following data can be found under the \fBqueryContext\fR property of each node.
+.RS 0
+.IP \(bu 4
+\fBversions\fR an array of every available version of the given node
+.IP \(bu 4
+\fBoutdated.inRange\fR an array of objects, each with a \fBfrom\fR and \fBversions\fR, where \fBfrom\fR is the on-disk location of the node that depends on the current node and \fBversions\fR is an array of all available versions that satisfies that dependency. This is only populated if \fB:outdated(in-range)\fR is used.
+.IP \(bu 4
+\fBoutdated.outOfRange\fR an array of objects, identical in shape to \fBinRange\fR, but where the \fBversions\fR array is every available version that does not satisfy the dependency. This is only populated if \fB:outdated(out-of-range)\fR is used.
+.RE 0
+
+.P
+Some examples:
+.RS 0
+.IP \(bu 4
+\fB:root > :outdated(major)\fR returns every direct dependency that has a new semver major release
+.IP \(bu 4
+\fB.prod:outdated(in-range)\fR returns production dependencies that have a new release that satisfies at least one of its parent's dependencies
+.RE 0
+
+.SS "\fB:vuln\fR"
+.P
+The \fB:vuln\fR pseudo selector retrieves data from the registry and returns information about which if your dependencies has a known vulnerability. Only dependencies whose current version matches a vulnerability will be returned. For example if you have \fBsemver@7.6.0\fR in your tree, a vulnerability for \fBsemver\fR which affects versions \fB<=6.3.1\fR will not match.
+.P
+You can also filter results by certain attributes in advisories. Currently that includes \fBseverity\fR and \fBcwe\fR. Note that severity filtering is done per severity, it does not include severities "higher" or "lower" than the one specified.
+.P
+In addition to the filtering performed by the pseudo selector, info about each relevant advisory will be added to the \fBqueryContext\fR attribute of each node under the \fBadvisories\fR attribute.
+.P
+Some examples:
+.RS 0
+.IP \(bu 4
+\fB:root > .prod:vuln\fR returns direct production dependencies with any known vulnerability
+.IP \(bu 4
+\fB:vuln(\[lB]severity=high\[rB])\fR returns only dependencies with a vulnerability with a \fBhigh\fR severity.
+.IP \(bu 4
+\fB:vuln(\[lB]severity=high\[rB],\[lB]severity=moderate\[rB])\fR returns only dependencies with a vulnerability with a \fBhigh\fR or \fBmoderate\fR severity.
+.IP \(bu 4
+\fB:vuln(\[lB]cwe=1333\[rB])\fR returns only dependencies with a vulnerability that includes CWE-1333 (ReDoS)
+.RE 0
+
+.SS "\fBAttribute Selectors\fR \fI\(lahttps://developer.mozilla.org/en-US/docs/Web/CSS/Attribute_selectors\(ra\fR"
+.P
+The attribute selector evaluates the key/value pairs in \fBpackage.json\fR if they are \fBString\fRs.
+.RS 0
+.IP \(bu 4
+\fB\[lB]\[rB]\fR attribute selector (ie. existence of attribute)
+.IP \(bu 4
+\fB\[lB]attribute=value\[rB]\fR attribute value is equivalent...
+.IP \(bu 4
+\fB\[lB]attribute~=value\[rB]\fR attribute value contains word...
+.IP \(bu 4
+\fB\[lB]attribute*=value\[rB]\fR attribute value contains string...
+.IP \(bu 4
+\fB\[lB]attribute|=value\[rB]\fR attribute value is equal to or starts with...
+.IP \(bu 4
+\fB\[lB]attribute^=value\[rB]\fR attribute value starts with...
+.IP \(bu 4
+\fB\[lB]attribute$=value\[rB]\fR attribute value ends with...
+.RE 0
+
+.SS "\fBArray\fR & \fBObject\fR Attribute Selectors"
+.P
+The generic \fB:attr()\fR pseudo selector standardizes a pattern which can be used for attribute selection of \fBObject\fRs, \fBArray\fRs or \fBArrays\fR of \fBObject\fRs accessible via \fBArborist\fR's \fBNode.package\fR metadata. This allows for iterative attribute selection beyond top-level \fBString\fR evaluation. The last argument passed to \fB:attr()\fR must be an \fBattribute\fR selector or a nested \fB:attr()\fR. See examples below:
+.SS "\fBObjects\fR"
+.P
+.RS 2
+.nf
+/* return dependencies that have a `scripts.test` containing `"tap"` */
+*:attr(scripts, \[lB]test~=tap\[rB])
+.fi
+.RE
+.SS "Nested \fBObjects\fR"
+.P
+Nested objects are expressed as sequential arguments to \fB:attr()\fR.
+.P
+.RS 2
+.nf
+/* return dependencies that have a \[lB]testling config\[rB](https://ci.testling.com/guide/advanced_configuration) for opera browsers */
+*:attr(testling, browsers, \[lB]~=opera\[rB])
+.fi
+.RE
+.SS "\fBArrays\fR"
+.P
+\fBArray\fRs specifically uses a special/reserved \fB.\fR character in place of a typical attribute name. \fBArrays\fR also support exact \fBvalue\fR matching when a \fBString\fR is passed to the selector.
+.SS "Example of an \fBArray\fR Attribute Selection:"
+.P
+.RS 2
+.nf
+/* removes the distinction between properties & arrays */
+/* ie. we'd have to check the property & iterate to match selection */
+*:attr(\[lB]keywords^=react\[rB])
+*:attr(contributors, :attr(\[lB]name~=Jordan\[rB]))
+.fi
+.RE
+.SS "Example of an \fBArray\fR matching directly to a value:"
+.P
+.RS 2
+.nf
+/* return dependencies that have the exact keyword "react" */
+/* this is equivalent to `*:keywords(\[lB]value="react"\[rB])` */
+*:attr(\[lB]keywords=react\[rB])
+.fi
+.RE
+.SS "Example of an \fBArray\fR of \fBObject\fRs:"
+.P
+.RS 2
+.nf
+/* returns */
+*:attr(contributors, \[lB]email=ruyadorno@github.com\[rB])
+.fi
+.RE
+.SS "Groups"
+.P
+Dependency groups are defined by the package relationships to their ancestors (ie. the dependency types that are defined in \fBpackage.json\fR). This approach is user-centric as the ecosystem has been taught to think about dependencies in these groups first-and-foremost. Dependencies are allowed to be included in multiple groups (ex. a \fBprod\fR dependency may also be a \fBdev\fR dependency (in that it's also required by another \fBdev\fR dependency) & may also be \fBbundled\fR - a selector for that type of dependency would look like: \fB*.prod.dev.bundled\fR).
+.RS 0
+.IP \(bu 4
+\fB.prod\fR
+.IP \(bu 4
+\fB.dev\fR
+.IP \(bu 4
+\fB.optional\fR
+.IP \(bu 4
+\fB.peer\fR
+.IP \(bu 4
+\fB.bundled\fR
+.IP \(bu 4
+\fB.workspace\fR
+.RE 0
+
+.P
+Please note that currently \fBworkspace\fR deps are always \fBprod\fR dependencies. Additionally the \fB.root\fR dependency is also considered a \fBprod\fR dependency.
+.SS "Programmatic Usage"
+.RS 0
+.IP \(bu 4
+\fBArborist\fR's \fBNode\fR Class has a \fB.querySelectorAll()\fR method
+.RS 4
+.IP \(bu 4
+this method will return a filtered, flattened dependency Arborist \fBNode\fR list based on a valid query selector
+.RE 0
+
+.RE 0
+
+.P
+.RS 2
+.nf
+const Arborist = require('@npmcli/arborist')
+const arb = new Arborist({})
+.fi
+.RE
+.P
+.RS 2
+.nf
+// root-level
+arb.loadActual().then(async (tree) => {
+  // query all production dependencies
+  const results = await tree.querySelectorAll('.prod')
+  console.log(results)
+})
+.fi
+.RE
+.P
+.RS 2
+.nf
+// iterative
+arb.loadActual().then(async (tree) => {
+  // query for the deduped version of react
+  const results = await tree.querySelectorAll('#react:not(:deduped)')
+  // query the deduped react for git deps
+  const deps = await results\[lB]0\[rB].querySelectorAll(':type(git)')
+  console.log(deps)
+})
+.fi
+.RE
+.SH "SEE ALSO"
+.RS 0
+.IP \(bu 4
+npm help query
+.IP \(bu 4
+\fB@npmcli/arborist\fR \fI\(lahttps://npm.im/@npmcli/arborist\(ra\fR
+.RE 0

package/oidc/node_modules/npm/man/man7/developers.7

@@ -0,0 +1,234 @@
+.TH "DEVELOPERS" "7" "October 2025" "NPM@11.6.2" ""
+.SH "NAME"
+\fBdevelopers\fR - Developer Guide
+.SS "Description"
+.P
+So, you've decided to use npm to develop (and maybe publish/deploy) your project.
+.P
+Fantastic!
+.P
+There are a few things that you need to do above the simple steps that your users will do to install your program.
+.SS "About These Documents"
+.P
+These are man pages. If you install npm, you should be able to then do \fBman npm-thing\fR to get the documentation on a particular topic, or \fBnpm help thing\fR to see the same information.
+.SS "What is a Package"
+.P
+A package is:
+.RS 0
+.IP \(bu 4
+a) a folder containing a program described by a package.json file
+.IP \(bu 4
+b) a gzipped tarball containing (a)
+.IP \(bu 4
+c) a url that resolves to (b)
+.IP \(bu 4
+d) a \fB<name>@<version>\fR that is published on the registry with (c)
+.IP \(bu 4
+e) a \fB<name>@<tag>\fR that points to (d)
+.IP \(bu 4
+f) a \fB<name>\fR that has a "latest" tag satisfying (e)
+.IP \(bu 4
+g) a \fBgit\fR url that, when cloned, results in (a).
+.RE 0
+
+.P
+Even if you never publish your package, you can still get a lot of benefits of using npm if you just want to write a node program (a), and perhaps if you also want to be able to easily install it elsewhere after packing it up into a tarball (b).
+.P
+Git urls can be of the form:
+.P
+.RS 2
+.nf
+git://github.com/user/project.git#commit-ish
+git+ssh://user@hostname:project.git#commit-ish
+git+http://user@hostname/project/blah.git#commit-ish
+git+https://user@hostname/project/blah.git#commit-ish
+.fi
+.RE
+.P
+The \fBcommit-ish\fR can be any tag, sha, or branch which can be supplied as an argument to \fBgit checkout\fR. The default is whatever the repository uses as its default branch.
+.SS "The package.json File"
+.P
+You need to have a \fBpackage.json\fR file in the root of your project to do much of anything with npm. That is basically the whole interface.
+.P
+See \fB\[rs]fBpackage.json\[rs]fR\fR \fI\(la/configuring-npm/package-json\(ra\fR for details about what goes in that file. At the very least, you need:
+.RS 0
+.IP \(bu 4
+name: This should be a string that identifies your project. Please do not use the name to specify that it runs on node, or is in JavaScript. You can use the "engines" field to explicitly state the versions of node (or whatever else) that your program requires, and it's pretty well assumed that it's JavaScript.
+.P
+It does not necessarily need to match your github repository name.
+.P
+So, \fBnode-foo\fR and \fBbar-js\fR are bad names. \fBfoo\fR or \fBbar\fR are better.
+.IP \(bu 4
+version: A semver-compatible version.
+.IP \(bu 4
+engines: Specify the versions of node (or whatever else) that your program runs on. The node API changes a lot, and there may be bugs or new functionality that you depend on. Be explicit.
+.IP \(bu 4
+author: Take some credit.
+.IP \(bu 4
+scripts: If you have a special compilation or installation script, then you should put it in the \fBscripts\fR object. You should definitely have at least a basic smoke-test command as the "scripts.test" field. See npm help scripts.
+.IP \(bu 4
+main: If you have a single module that serves as the entry point to your program (like what the "foo" package gives you at require("foo")), then you need to specify that in the "main" field.
+.IP \(bu 4
+directories: This is an object mapping names to folders. The best ones to include are "lib" and "doc", but if you use "man" to specify a folder full of man pages, they'll get installed just like these ones.
+.RE 0
+
+.P
+You can use \fBnpm init\fR in the root of your package in order to get you started with a pretty basic package.json file. See npm help init for more info.
+.SS "Keeping files \fIout\fR of your Package"
+.P
+Use a \fB.npmignore\fR file to keep stuff out of your package. If there's no \fB.npmignore\fR file, but there \fIis\fR a \fB.gitignore\fR file, then npm will ignore the stuff matched by the \fB.gitignore\fR file. If you \fIwant\fR to include something that is excluded by your \fB.gitignore\fR file, you can create an empty \fB.npmignore\fR file to override it. Like \fBgit\fR, \fBnpm\fR looks for \fB.npmignore\fR and \fB.gitignore\fR files in all subdirectories of your package, not only the root directory.
+.P
+\fB.npmignore\fR files follow the \fBsame pattern rules\fR \fI\(lahttps://git-scm.com/book/en/v2/Git-Basics-Recording-Changes-to-the-Repository#_ignoring\(ra\fR as \fB.gitignore\fR files:
+.RS 0
+.IP \(bu 4
+Blank lines or lines starting with \fB#\fR are ignored.
+.IP \(bu 4
+Standard glob patterns work.
+.IP \(bu 4
+You can end patterns with a forward slash \fB/\fR to specify a directory.
+.IP \(bu 4
+You can negate a pattern by starting it with an exclamation point \fB!\fR.
+.RE 0
+
+.P
+By default, some paths and files are ignored, so there's no need to add them to \fB.npmignore\fR explicitly. Some examples are:
+.RS 0
+.IP \(bu 4
+\fB.*.swp\fR
+.IP \(bu 4
+\fB._*\fR
+.IP \(bu 4
+\fB.DS_Store\fR
+.IP \(bu 4
+\fB.git\fR
+.IP \(bu 4
+\fB.gitignore\fR
+.IP \(bu 4
+\fB.hg\fR
+.IP \(bu 4
+\fB.npmignore\fR
+.IP \(bu 4
+\fB.npmrc\fR
+.IP \(bu 4
+\fB.lock-wscript\fR
+.IP \(bu 4
+\fB.svn\fR
+.IP \(bu 4
+\fB.wafpickle-*\fR
+.IP \(bu 4
+\fBconfig.gypi\fR
+.IP \(bu 4
+\fBCVS\fR
+.IP \(bu 4
+\fBnpm-debug.log\fR
+.RE 0
+
+.P
+Additionally, everything in \fBnode_modules\fR is ignored, except for bundled dependencies. npm automatically handles this for you, so don't bother adding \fBnode_modules\fR to \fB.npmignore\fR.
+.P
+The following paths and files are never ignored, so adding them to \fB.npmignore\fR is pointless:
+.RS 0
+.IP \(bu 4
+\fBpackage.json\fR
+.IP \(bu 4
+\fBREADME\fR (and its variants)
+.IP \(bu 4
+\fBLICENSE\fR / \fBLICENCE\fR
+.RE 0
+
+.P
+If, given the structure of your project, you find \fB.npmignore\fR to be a maintenance headache, you might instead try populating the \fBfiles\fR property of \fBpackage.json\fR, which is an array of file or directory names that should be included in your package. Sometimes manually picking which items to allow is easier to manage than building a block list.
+.P
+See \fB\[rs]fBpackage.json\[rs]fR\fR \fI\(la/configuring-npm/package-json\(ra\fR for more info on what can and can't be ignored.
+.SS "Testing whether your \fB.npmignore\fR or \fBfiles\fR config works"
+.P
+If you want to double check that your package will include only the files you intend it to when published, you can run the \fBnpm pack\fR command locally which will generate a tarball in the working directory, the same way it does for publishing.
+.SS "Link Packages"
+.P
+\fBnpm link\fR is designed to install a development package and see the changes in real time without having to keep re-installing it. (You do need to either re-link or \fBnpm rebuild -g\fR to update compiled packages, of course.)
+.P
+More info at npm help link.
+.SS "Before Publishing: Make Sure Your Package Installs and Works"
+.P
+\fBThis is important.\fR
+.P
+If you cannot install it locally, you'll have problems trying to publish it. Or, worse yet, you'll be able to publish it, but you'll be publishing a broken or pointless package. So don't do that.
+.P
+In the root of your package, do this:
+.P
+.RS 2
+.nf
+npm install . -g
+.fi
+.RE
+.P
+That'll show you that it's working. If you'd rather just create a symlink package that points to your working directory, then do this:
+.P
+.RS 2
+.nf
+npm link
+.fi
+.RE
+.P
+Use \fBnpm ls -g\fR to see if it's there.
+.P
+To test a local install, go into some other folder, and then do:
+.P
+.RS 2
+.nf
+cd ../some-other-folder
+npm install ../my-package
+.fi
+.RE
+.P
+to install it locally into the node_modules folder in that other place.
+.P
+Then go into the node-repl, and try using require("my-thing") to bring in your module's main module.
+.SS "Create a User Account"
+.P
+Create a user with the adduser command. It works like this:
+.P
+.RS 2
+.nf
+npm adduser
+.fi
+.RE
+.P
+and then follow the prompts.
+.P
+This is documented better in npm help adduser.
+.SS "Publish your Package"
+.P
+This part's easy. In the root of your folder, do this:
+.P
+.RS 2
+.nf
+npm publish
+.fi
+.RE
+.P
+You can give publish a url to a tarball, or a filename of a tarball, or a path to a folder.
+.P
+Note that pretty much \fBeverything in that folder will be exposed\fR by default. So, if you have secret stuff in there, use a \fB.npmignore\fR file to list out the globs to ignore, or publish from a fresh checkout.
+.SS "Brag about it"
+.P
+Send emails, write blogs, blab in IRC.
+.P
+Tell the world how easy it is to install your program!
+.SS "See also"
+.RS 0
+.IP \(bu 4
+npm help npm
+.IP \(bu 4
+npm help init
+.IP \(bu 4
+\fBpackage.json\fR \fI\(la/configuring-npm/package-json\(ra\fR
+.IP \(bu 4
+npm help scripts
+.IP \(bu 4
+npm help publish
+.IP \(bu 4
+npm help adduser
+.IP \(bu 4
+npm help registry
+.RE 0

package/oidc/node_modules/npm/man/man7/logging.7

@@ -0,0 +1,108 @@
+.TH "LOGGING" "7" "October 2025" "NPM@11.6.2" ""
+.SH "NAME"
+\fBLogging\fR - Why, What & How We Log
+.SS "Description"
+.P
+The \fBnpm\fR CLI has various mechanisms for showing different levels of information back to end-users for certain commands, configurations & environments.
+.SS "Setting Log File Location"
+.P
+All logs are written to a debug log, with the path to that file printed if the execution of a command fails.
+.P
+The default location of the logs directory is a directory named \fB_logs\fR inside the npm cache. This can be changed with the \fBlogs-dir\fR config option.
+.P
+For example, if you wanted to write all your logs to the current working directory, you could run: \fBnpm install --logs-dir=.\fR. This is especially helpful in debugging a specific \fBnpm\fR issue as you can run a command multiple times with different config values and then diff all the log files.
+.P
+Log files will be removed from the \fBlogs-dir\fR when the number of log files exceeds \fBlogs-max\fR, with the oldest logs being deleted first.
+.P
+To turn off logs completely set \fB--logs-max=0\fR.
+.SS "Setting Log Levels"
+.SS "\fBloglevel\fR"
+.P
+\fBloglevel\fR is a global argument/config that can be set to determine the type of information to be displayed.
+.P
+The default value of \fBloglevel\fR is \fB"notice"\fR but there are several levels/types of logs available, including:
+.RS 0
+.IP \(bu 4
+\fB"silent"\fR
+.IP \(bu 4
+\fB"error"\fR
+.IP \(bu 4
+\fB"warn"\fR
+.IP \(bu 4
+\fB"notice"\fR
+.IP \(bu 4
+\fB"http"\fR
+.IP \(bu 4
+\fB"info"\fR
+.IP \(bu 4
+\fB"verbose"\fR
+.IP \(bu 4
+\fB"silly"\fR
+.RE 0
+
+.P
+All logs pertaining to a level preceding the current setting will be shown.
+.SS "Aliases"
+.P
+The log levels listed above have various corresponding aliases, including:
+.RS 0
+.IP \(bu 4
+\fB-d\fR: \fB--loglevel info\fR
+.IP \(bu 4
+\fB--dd\fR: \fB--loglevel verbose\fR
+.IP \(bu 4
+\fB--verbose\fR: \fB--loglevel verbose\fR
+.IP \(bu 4
+\fB--ddd\fR: \fB--loglevel silly\fR
+.IP \(bu 4
+\fB-q\fR: \fB--loglevel warn\fR
+.IP \(bu 4
+\fB--quiet\fR: \fB--loglevel warn\fR
+.IP \(bu 4
+\fB-s\fR: \fB--loglevel silent\fR
+.IP \(bu 4
+\fB--silent\fR: \fB--loglevel silent\fR
+.RE 0
+
+.SS "\fBforeground-scripts\fR"
+.P
+The \fBnpm\fR CLI began hiding the output of lifecycle scripts for \fBnpm install\fR as of \fBv7\fR. Notably, this means you will not see logs/output from packages that may be using "install scripts" to display information back to you or from your own project's scripts defined in \fBpackage.json\fR. If you'd like to change this behavior & log this output you can set \fBforeground-scripts\fR to \fBtrue\fR.
+.SS "Timing Information"
+.P
+The \fB\[rs]fB--timing\[rs]fR config\fR \fI\(la/using-npm/config#timing\(ra\fR can be set which does a few things:
+.RS 0
+.IP 1. 4
+Always shows the full path to the debug log regardless of command exit status
+.IP 2. 4
+Write timing information to a process specific timing file in the cache or \fBlogs-dir\fR
+.IP 3. 4
+Output timing information to the terminal
+.RE 0
+
+.P
+This file contains a \fBtimers\fR object where the keys are an identifier for the portion of the process being timed and the value is the number of milliseconds it took to complete.
+.P
+Sometimes it is helpful to get timing information without outputting anything to the terminal. For example, the performance might be affected by writing to the terminal. In this case you can use \fB--timing --silent\fR which will still write the timing file, but not output anything to the terminal while running.
+.SS "Registry Response Headers"
+.SS "\fBnpm-notice\fR"
+.P
+The \fBnpm\fR CLI reads from & logs any \fBnpm-notice\fR headers that are returned from the configured registry. This mechanism can be used by third-party registries to provide useful information when network-dependent requests occur.
+.P
+This header is not cached, and will not be logged if the request is served from the cache.
+.SS "Logs and Sensitive Information"
+.P
+The \fBnpm\fR CLI makes a best effort to redact the following from terminal output and log files:
+.RS 0
+.IP \(bu 4
+Passwords inside basic auth URLs
+.IP \(bu 4
+npm tokens
+.RE 0
+
+.P
+However, this behavior should not be relied on to keep all possible sensitive information redacted. If you are concerned about secrets in your log file or terminal output, you can use \fB--loglevel=silent\fR and \fB--logs-max=0\fR to ensure no logs are written to your terminal or filesystem.
+.SS "See also"
+.RS 0
+.IP \(bu 4
+npm help config
+.RE 0