flog
Documentation menu

Flog documentation

Flog is a predictable JavaScript workspace package manager written in Go. It uses npm-compatible manifests and registries while keeping dependency resolution, lifecycle scripts, publishing, and updates explicit and auditable.

Start here#

Install flog, then materialize the reviewed lock committed by the project:

curl -fsSL https://flog.run/install | sh
flog install

For a new project with no lock, run flog lock, inspect and commit the generated flog.lock, then run flog install. Plain install is the same command for development and CI: it validates the manifests and current platform against the lock, then installs that exact graph without rewriting it. Use flog add, flog remove, or flog upgrade when you intend to change dependencies.

The everyday monorepo source workflow is equally direct:

flog install
flog build

For a deployment builder that needs one app rather than every editor/test adapter, install and build the same production workspace closure:

flog install --workspace apps/website --prod
flog build --workspace apps/website --prod

New to the project? Continue with dependency installation, then read the package and workspace model and the lockfile guide.

Everyday commands#

  • flog install validates and materializes the committed lock.
  • flog lock creates or deliberately reconciles a lock without installing.
  • flog add and flog remove deliberately change direct dependencies.
  • flog build builds source workspaces once in dependency-first order.
  • flog run <script> runs package scripts, including workspace selections.
  • flog x <binary> executes an installed or direct workspace package binary.
  • flog pack creates an inspectable npm-compatible tarball.
  • flog publish performs publication preflight before registry mutation.
  • flog login, whoami, and logout manage npm registry authentication.
  • flog update securely replaces flog from a verified release.
  • flog upgrade plans and applies deliberate direct dependency updates.
  • flog view <package> <field> reads one published metadata value.
  • flog check peers audits explicit dependencies used as peer providers.

See workspace builds, scripts and package binaries, dependency updates, packing, and publishing for complete behavior and examples. See workspace release sets for publication closure and version bump safeguards, and peer-provider auditing for conservative dependency cleanup checks.

Predictable by default#

Flog writes a strict deterministic flog.lock, installs an intentionally nested node_modules layout, verifies downloaded package integrity, and only runs dependency lifecycle scripts explicitly allowed by the root manifest.

Registry configuration and authentication follow familiar npm conventions; release installation and self-update use immutable manifests and SHA-256 verification. Read about registries and authentication or installer and release channels next.