Importing a bundle

What is inside

lodash/-/lodash-4.17.21.tgz
@babel/core/-/core-7.24.0.tgz
bundle-manifest.json
IMPORT.md

That path structure is exactly what every dist.tarball URL npm publishes looks like, which is why the same tree imports into Artifactory, Nexus and Verdaccio without translation.

Artifactory

Unpack, then upload the tree into a local npm repository:

tar -xzf react-dom@19.2.8.tgz -C ./bundle
jf rt upload "bundle/(**)" "npm-local/{1}" --flat=false

Verdaccio, Nexus, or any npm registry

Publish each tarball individually:

find ./bundle -name '*.tgz' -exec npm publish --registry <url> {} \;

The manifest

bundle-manifest.json is the audit trail a security review will ask for. Every package carries its integrity string, the URL it came from, its size, and why it is in the bundle:

{
	"name": "ms",
	"version": "2.1.3",
	"path": "ms/-/ms-2.1.3.tgz",
	"tarball": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
	"integrity": "sha512-6Flzub…",
	"shasum": "574c8138ce1d2b5861f0b44579dbadd60c6615b2",
	"bytes": 2967,
	"reasons": ["root:ms@2.1.3"]
}

reasons names each edge that pulled the package in — root:react-dom@19.2.8, prod:scheduler@0.27.0, optional:esbuild@0.21.5 — so "why is this here" has an answer that does not require re-running anything.

The manifest header records the registry the packages came from, the options the run used, and the tool version that produced it.

Verifying after the crossing

Every tarball was checked against the registry's checksum at download time. To check the bundle again on the far side, the integrity strings are all in the manifest:

node -e "const m=require('./bundle/bundle-manifest.json');console.log(m.packages.length+' packages')"

Each bundle also ships an IMPORT.md with these commands filled in for the bundle it sits in.