Public evidence: generated by OpenThunder’s keyless engine (no AI) from axios/axios@326843a on 2026-10-19. Reproduce it: openthunder lens generate --no-narrate && openthunder lens export. ← Evidence Gallery

axios: Architecture

axios · 326843a3902d · generated 2026-10-19T06:57:01.220Z · static analysis

Architecture health: 72/100 (C)

Overview

axios is a JavaScript/TypeScript npm project, built with Vue and Express. It runs as a backend service (axios). The main structural risks to watch: 3 oversized "god" files. The file with the widest blast radius is lib/utils.js: 30 files depend on it at runtime; oversized and doing too much.

_This entire analysis runs on your machine with no AI required. Connect a model provider to also narrate the reasoning and recover decisions._

Where to start

  1. index.js Start here: how the system boots and wires its subsystems together.
  2. lib/utils.js Core module: 46 other modules depend on it, so it shapes much of the system.
  3. lib/core/AxiosError.js Core module: 37 other modules depend on it, so it shapes much of the system.
  4. lib/core/AxiosHeaders.js Core module: 15 other modules depend on it, so it shapes much of the system.
  5. docs/.vitepress/tokenizeSearchText.js Key flow: Authentication, a high-risk path that enters at invoke tokenizeSearchText.js (docs/.vitepress/tokenizeSearchText.js).
  6. gulpfile.js Key flow: File changes / writes, a high-risk path that enters at invoke gulpfile.js (gulpfile.js).
  7. lib/helpers/resolveConfig.js Key flow: Background jobs, a medium-risk path that enters at scheduled trigger (lib/helpers/resolveConfig.js).
  8. lib/platform/index.js Change with care: 12 files depend on it at runtime.

System map

flowchart TD
  subgraph sys_boundary["axios"]
    axios(["axios"])
  end
  class axios service
  classDef frontend fill:#2563eb,stroke:#93c5fd,color:#fff,stroke-width:2px;
  classDef service fill:#059669,stroke:#6ee7b7,color:#fff,stroke-width:2px;
  classDef store fill:#d97706,stroke:#fcd34d,color:#fff,stroke-width:2px;
  classDef queue fill:#9333ea,stroke:#d8b4fe,color:#fff,stroke-width:2px;
  classDef job fill:#4f46e5,stroke:#a5b4fc,color:#fff,stroke-width:2px;
  classDef external fill:#475569,stroke:#cbd5e1,color:#fff,stroke-width:2px;
  classDef aiprovider fill:#e11d48,stroke:#fda4af,color:#fff,stroke-width:2px;
  classDef library fill:#0891b2,stroke:#67e8f9,color:#fff,stroke-width:2px;
  classDef cli fill:#0d9488,stroke:#5eead4,color:#fff,stroke-width:2px;
  classDef user fill:#64748b,stroke:#e2e8f0,color:#fff,stroke-width:2px;
  classDef muted fill:#334155,stroke:#64748b,color:#cbd5e1,stroke-width:1px;

Critical flows

Application startup medium risk

Entry: process start (index.js)

calls an external service (external API)

Boot wires every subsystem together; a fault here stops the whole process from starting.

sequenceDiagram
  actor C0 as Process
  participant F0 as index.js
  participant F1 as axios.js
  participant External as external API
  C0->>F0: process start
  F0->>External: calls an external service
  F0->>F1: calls
  F1->>External: calls an external service

Authentication high risk

Entry: invoke tokenizeSearchText.js (docs/.vitepress/tokenizeSearchText.js)

Authentication guards every protected resource; a regression here can expose data or grant unauthorized access.

sequenceDiagram
  actor C0 as Caller
  participant F0 as tokenizeSearchText.js
  participant F1 as CancelToken.js
  participant F2 as Http2Sessions.js
  C0->>F0: invoke tokenizeSearchText.js

File changes / writes high risk

Entry: invoke gulpfile.js (gulpfile.js)

writes files to the working tree (disk); calls an external service (external API)

Direct writes to the working tree are hard to reverse; an unguarded write can clobber user code.

sequenceDiagram
  actor C0 as Caller
  participant F0 as gulpfile.js
  participant F1 as process-sponsors.js
  participant F2 as dispatchRequest.js
  participant Disk as disk
  participant External as external API
  C0->>F0: invoke gulpfile.js
  F0->>Disk: writes files to the working tree
  F0->>External: calls an external service
  F1->>Disk: writes files to the working tree
  F1->>External: calls an external service

Background jobs medium risk

Entry: scheduled trigger (lib/helpers/resolveConfig.js)

moves work onto a queue (queue)

Background jobs run unattended; failures are silent and can pile up unnoticed.

sequenceDiagram
  actor C0 as Scheduler
  participant F0 as resolveConfig.js
  participant F1 as trackStream.js
  participant Queue as queue
  C0->>F0: scheduled trigger
  F1->>Queue: moves work onto a queue

Fragile zones

Architecture rules

blocking Change lib/utils.js with care: 30 files depend on it at runtime; oversized and doing too much. Preserve its public signatures, keep changes additive where possible, and run/extend its tests before and after.

This file has a wide blast radius (fan-in 46, fan-out 1, risk score 64.3); a careless edit ripples through many dependents.

blocking Change lib/core/AxiosError.js with care: 18 files depend on it at runtime. Preserve its public signatures, keep changes additive where possible, and run/extend its tests before and after.

This file has a wide blast radius (fan-in 37, fan-out 2, risk score 36.5); a careless edit ripples through many dependents.

blocking Change lib/platform/index.js with care: 12 files depend on it at runtime. Preserve its public signatures, keep changes additive where possible, and run/extend its tests before and after.

This file has a wide blast radius (fan-in 14, fan-out 2, risk score 24.5); a careless edit ripples through many dependents.

blocking Change lib/core/AxiosHeaders.js with care: 10 files depend on it at runtime. Preserve its public signatures, keep changes additive where possible, and run/extend its tests before and after.

This file has a wide blast radius (fan-in 15, fan-out 3, risk score 20.8); a careless edit ripples through many dependents.

blocking Change lib/cancel/CanceledError.js with care: 6 files depend on it at runtime. Preserve its public signatures, keep changes additive where possible, and run/extend its tests before and after.

This file has a wide blast radius (fan-in 9, fan-out 1, risk score 12.3); a careless edit ripples through many dependents.

warning Change lib/adapters/http.js with care: 1 file depends on it at runtime; oversized and doing too much. Preserve its public signatures, keep changes additive where possible, and run/extend its tests before and after.

This file has a wide blast radius (fan-in 4, fan-out 23, risk score 11.8); a careless edit ripples through many dependents.

advisory Do not add new responsibilities to oversized files (lib/adapters/http.js, lib/utils.js, lib/adapters/fetch.js); extract new logic into focused modules instead.

Large multi-purpose files are change magnets that accumulate coupling and resist testing; keeping them from growing limits the damage.