# npm

Recommend AXM extensions from an npm package and target npm packages from an extension.

AXM reads npm extension metadata from a top-level `agentExtensions` field in
`package.json`. This is the [two-way linking](/docs/package-ecosystems/overview)
model applied to the npm ecosystem.

## Recommend extensions from a package

Add an `agentExtensions` array to `package.json`. Each entry is an extension
reference (`@owner/<type>/<name>`):

```jsonc
// package.json
{
  "name": "@agentxm/example-tinyflags",
  "version": "0.1.0",
  "agentExtensions": [{ "ref": "@examples/packs/javascript-npm-tinyflags" }],
}
```

Keep recommendations **identity-only** — no `versionRange`. AXM resolves the
reference to the newest matching extension version and pins it in the user's
`axm.lock`. Prefer recommending a single **pack** so you keep one stable
reference while its contents evolve.

Add a semver `versionRange` only when your package genuinely pairs with a
bounded major line of the extension:

```jsonc
{
  "agentExtensions": [
    {
      "ref": "@examples/packs/javascript-npm-tinyflags",
      "versionRange": "^1.0.0",
    },
  ],
}
```

## Target npm packages from an extension

On the extension manifest (`skill.json`, `pack.json`, `subagent.json`, …), add a
`packages` array with an npm [purl](https://github.com/package-url/purl-spec):

```jsonc
// pack.json
{
  "packages": [{ "purl": "pkg:npm/%40agentxm/example-tinyflags" }],
}
```

### Scoped packages

npm scopes contain an `@`, which must be percent-encoded as `%40` inside a purl.
The scope separator stays a literal `/`:

```jsonc
{
  "packages": [{ "purl": "pkg:npm/%40agentxm/example-tinyflags" }],
}
```

### Version ranges

Default to identity-only. Add a [VERS](https://github.com/package-url/vers-spec)
`versionRange` with the `npm` scheme only when the extension depends on package
APIs introduced or removed in a known range:

```jsonc
{
  "packages": [
    {
      "purl": "pkg:npm/%40agentxm/example-tinyflags",
      "versionRange": "vers:npm/>=0.1.0|<1.0.0",
    },
  ],
}
```

## Official status

When the npm package recommends an extension through the AgentXM Registry
**and** that extension names the package as a companion via its purl, AXM
derives **official** status for the pair — no extra flag. See
[Official extensions](/docs/package-ecosystems/overview#official-extensions).

## Reference fixture

The
[`javascript-npm-lib`](https://github.com/agentxm/polyglot-examples/tree/main/javascript-npm-lib)
and
[`javascript-npm-app`](https://github.com/agentxm/polyglot-examples/tree/main/javascript-npm-app)
directories in `polyglot-examples` are the working fixtures for everything
above. The library publishes a TinyFlags companion pack and recommends it from
`package.json`; the pack and each skill declare the library's npm purl as a
companion package — including the optional `versionRange` shape.