package.json Generator

type: module makes .js files use ES module syntax (import/export). type: commonjs (the default when omitted) makes .js files use CommonJS syntax (require/module.exports). Choose module for modern Node.js projects, Vite, and libraries targeting ESM consumers. Choose commonjs for older Node.js projects or tools that don't support ESM. You can always use .mjs and .cjs extensions to override the type field for individual files.

At minimum: 'dev' (development server), 'build' (production build), 'test' (test runner), 'lint' (code quality). Good additions: 'typecheck' (tsc --noEmit for type validation), 'format' (prettier --write), 'clean' (rm -rf dist). Keep script names consistent across projects — dev, build, test, lint are the standard npm conventions most tools expect.

Setting private: true prevents accidental npm publish. Use it for any project that's not intended to be a reusable npm package — apps, monorepo roots, internal tools. Without private: true, anyone with npm credentials on your machine could accidentally run npm publish and push your app to the public registry.

The engines field specifies which Node.js (and npm/yarn) versions your package supports: { "node": ">=20.0.0" }. Tools like npm warn when installing on incompatible versions. In .nvmrc or .node-version files you set the exact version for local development; in engines you set the minimum supported version for consumers.

dependencies are packages needed at runtime — they're installed when someone runs 'npm install' in your project. devDependencies are only needed during development (tests, build tools, linters) — they're not installed when your package is used as a library. For apps deployed to servers, both are installed since you control the environment. For libraries published to npm, only list dependencies that consumers need to run your code.

Yes, always commit package-lock.json (npm), yarn.lock (Yarn), or pnpm-lock.yaml (pnpm). Lock files record exact versions of every installed package, ensuring reproducible installs across machines and CI. Without a lock file, 'npm install' could install different versions on different machines. Add it to .gitignore only for globally-installed CLI tools, never for apps or libraries.