npm:The world's largest software registry — and the de-facto JS package format

We type `pnpm install`, but every dependency still comes from registry.npmjs.org. package.json is the source; semver / lockfile is the glue.