Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/ara-home/ara/llms.txt

Use this file to discover all available pages before exploring further.

ara add installs one or more packages directly by specifier and saves them to your package.json. It resolves the spec, checks the content-addressed cache, downloads the tarball if needed, scans the package for security issues, extracts it to node_modules/, and updates both package.json and ara.lock — all in a single command. Multiple packages can be added in one invocation.
ara install <spec> is a direct alias for ara add <spec>. Both commands are identical in behavior.

Usage

ara add <spec> [spec...] [flags]
At least one package specifier is required.

Supported spec formats

FormatExampleResolves to
namereactLatest version from the npm registry
name@versionreact@18.2.0Exact version from the npm registry
name@^rangezod@^3.23.0Registry version matching the semver range
@scope/name@angular/coreScoped package from the npm registry (latest)
@scope/name@version@angular/core@17.0.0Scoped package at an exact version
user/repofacebook/reactGitHub repository at the default branch
user/repo#reffacebook/react#v18.0.0GitHub repository at a specific tag or branch
Git URLhttps://github.com/user/repo.gitGit repository at HEAD
Git URL + refhttps://github.com/user/repo.git#v1.0Git repository at a specific tag or commit
Tarball URLhttps://example.com/pkg.tgzDirect tarball download
Local tarball./downloads/pkg.tar.gzLocal .tar.gz or .tgz file

Flags

--save-dev
boolean
default:"false"
Save the package(s) under devDependencies in package.json instead of dependencies.
--save-peer
boolean
default:"false"
Save the package(s) under peerDependencies in package.json.
--save-optional
boolean
default:"false"
Save the package(s) under optionalDependencies in package.json.
--range
string
default:"exact"
Controls the version range prefix written to package.json. Accepted values:
  • exact (default) — records the resolved version as-is, e.g. 1.2.3
  • caret — prefixes with ^, e.g. ^1.2.3
  • patch — prefixes with ~, e.g. ~1.2.3
--force
boolean
default:"false"
Re-download the package even if a cached copy exists in the content-addressed store. Use this if you suspect the tarball is stale or corrupted.
--refresh
boolean
default:"false"
Bypass the cache for mutable references such as branch names and floating tags. Guarantees you get the latest commit on a branch even when a cached version exists.
--offline
boolean
default:"false"
Fail immediately if the requested package is not already present in the local cache. No network requests are made in offline mode.
--non-interactive
boolean
default:"false"
Suppress interactive security prompts. Packages with findings are auto-approved and a warning is printed instead of asking for your decision.
--package-lock
boolean
default:"false"
Generate a package-lock.json (lockfile version 3) in addition to ara.lock. Temporary compatibility flag for deploy platforms that do not yet support ara.lock.

Examples

# Latest version
ara add react

# Exact version
ara add react@18.2.0

# Semver range (resolved to latest matching)
ara add zod@^3

# Scoped package
ara add @types/node --save-dev

# Multiple packages at once
ara add react zod typescript

How add works

For each spec provided, ara add runs the following steps:
  1. Parse — determines the target type (npm, GitHub, git, tarball URL, or local path).
  2. Resolve — queries the registry for the latest or best-matching version, or uses the provided ref directly for git and GitHub targets.
  3. Cache check — skips the network download if the package is already in the content-addressed store (unless --force or --refresh is passed).
  4. Fetch — downloads the tarball from the appropriate backend.
  5. Analyze — scans the package’s source files for 16+ security patterns.
  6. Prompt — if suspicious patterns are detected and --non-interactive is not set, you are asked to allow or deny the package.
  7. Extract — approved packages are written to node_modules/ and stored in the content-addressed store.
  8. Updatepackage.json is updated with the new dependency entry.
  9. Lockara.lock is rewritten with the full resolved graph.
After direct dependencies are installed, Ara also resolves and installs their transitive dependencies.

Security prompt

When a package has findings above the medium risk level, Ara pauses and asks for your decision:
🔍 Scanning some-pkg@2.0.0...
  ⚠  child-process-exec (high) — shell command execution in lib/build.js:17
  ⚠  credential-access (high) — process.env access in lib/config.js:5

Allow some-pkg@2.0.0?
  [y] Yes, install anyway
  [n] No, skip this package
  [s] Sandbox (restrict at runtime)
> y
  ✓ some-pkg@2.0.0 (sha256-abc123...) — allowed
Pass --non-interactive in CI to suppress this prompt and auto-approve all findings.
Packages denied at the security prompt are removed from node_modules/ immediately and are not written to package.json or ara.lock.

Build docs developers (and LLMs) love