docs(npm): clarify node dependency behavior

docs/dev-tools/backends/npm.md

@@ -13,8 +13,10 @@ the npm registry directly over HTTP, and packages are installed with mise's
 embedded [aube](https://github.com/jdx/aube) package manager. The registry,
 scoped registries (`@scope:registry`), and auth tokens configured in `~/.npmrc`
 (or `NPM_CONFIG_USERCONFIG`) and `NPM_CONFIG_*` environment variables are honored
-by both. `node` is only needed to _run_ the installed tools (and any package
-lifecycle scripts), not to install them.
+by both. An installed package may still require `node` at runtime, and enabled
+package lifecycle scripts may require it during installation. When `node` is
+already configured, mise orders its installation before `npm:` tools, but the
+npm backend does not add or install `node` automatically.
 
 To shell out to the npm CLI instead — `npm view` for metadata and
 `npm install -g` for installs — set
@@ -44,15 +46,6 @@ If you want transitive protection when shelling out, install and use a package
 manager version that meets the corresponding requirement above. Older versions
 may fail while processing the forwarded argument.
 
-`node` is installed automatically as a dependency. To use a specific package
-manager CLI instead of the embedded installer:
-
-```sh
-mise use -g pnpm
-# or
-mise use -g bun
-```
-
 ## Socket security
 
 There are two ways to use [Socket](https://socket.dev) with `npm:` tools installed

src/backend/npm.rs

@@ -277,9 +277,11 @@ impl Backend for NPMBackend {
     fn get_dependencies(&self) -> eyre::Result<Vec<&str>> {
         // Version queries hit the npm registry over HTTP and installs use the
         // embedded aube package manager, so by default neither needs a
-        // package-manager binary. `node` is still listed because installed JS
-        // tools (and any lifecycle scripts) need a runtime. Explicit non-aube
-        // package managers — or `npm.shell_out` — need their CLI on PATH.
+        // package-manager binary. `node` is listed so an already-configured node
+        // installs first when a package or lifecycle script needs it; backend
+        // dependencies do not add missing tools, and not every package needs node.
+        // Explicit non-aube package managers — or `npm.shell_out` — need their CLI
+        // on PATH.
         let settings = Settings::get();
         let shell_out = settings.npm.shell_out;
         let tool_name = self.tool_name();
@@ -1052,9 +1054,9 @@ impl NPMBackend {
         eyre::eyre!(build_aube_install_error_message(&err, &self.ba().full()))
     }
 
-    /// The `node` mise resolved as a dependency, handed to the embedded aube
-    /// installer so lifecycle scripts spawn on it. `None` (no node dependency
-    /// resolved) lets aube fall back to an ambient `node`.
+    /// A configured `node`, when available, is handed to the embedded aube
+    /// installer so lifecycle scripts spawn on it. `None` lets aube fall back
+    /// to an ambient `node`.
     ///
     /// `selector` is the version-manager shape: mise hands over a real bin dir
     /// holding `node`/`npm`/`npx`, aube prepends it to PATH and uses that node
@@ -1601,17 +1603,17 @@ mod tests {
 
     #[test]
     fn test_get_dependencies_for_npm_itself() {
-        // When the tool is npm itself (npm:npm) with default settings (npm as package manager),
-        // it should only depend on node. With bun/pnpm configured, it would include those too.
+        // The node dependency only orders a node that is already in the install
+        // set; it does not cause node to be installed automatically.
         let backend = create_npm_backend("npm");
         let deps = backend.get_dependencies().unwrap();
         assert_eq!(deps, vec!["node"]);
     }
 
     #[test]
     fn test_get_dependencies_default_package_manager() {
-        // Default (auto) installs via the embedded aube package manager, so a
-        // package only needs node at runtime — no npm/aube/bun/pnpm binary.
+        // Default (auto) needs no external installer. Node remains an ordering
+        // dependency for configured packages that need it at runtime.
         let backend = create_npm_backend("prettier");
         let deps = backend.get_dependencies().unwrap();
         assert_eq!(deps, vec!["node"]);