npm, package.json, and scripts

Every Node project is defined by a single file: `package.json`. It is the manifest that records the project's identity, its dependencies, the scripts that run and build it, and the metadata that npm and Node rely on. Understanding it thoroughly is understanding how a Node project is actually assembled. npm — the Node Package Manager — is the tool that reads this manifest to install dependencies, run scripts, and manage the project. It is the default package manager bundled with Node, and the npm registry it draws from is the largest software registry in the world, hosting the open-source packages that virtually every Node project builds upon. The relationship is straightforward: `package.json` declares what the project needs and what it can do, and npm carries those declarations out. You list a dependency, npm fetches it and its own dependencies into the `node_modules` folder; you define a script, npm runs it; you specify a version range, npm resolves a concrete version within it. Two ideas in this system repay careful attention. The first is the distinction between runtime dependencies and development-only dependencies, which determines what actually ships to production. The second is semantic versioning and the lock file, which together govern exactly which versions of code your project runs — the foundation of reproducible, reliable builds. Mastering `package.json`, the dependency model, npm scripts, and the difference between `npm install` and `npm ci` is essential groundwork: it is the substrate on which the entire MERN stack — Express, React's tooling, every library — is installed, scripted, and versioned.