Configuration

The configuration entry points the Deno CLI reads, in roughly the order it consults them.

Source-of-truth files

File	Parsed by	Purpose
deno.json / deno.jsonc	libs/config/lib.rs	Project config: imports, compilerOptions, lint, fmt, tasks, workspace
package.json	libs/package_json/	npm-style metadata; respected for dependencies, exports, imports, scripts
deno.lock	libs/lockfile/	Resolved dep versions and integrity hashes
.npmrc	libs/npmrc/	Per-scope registries, auth tokens
.env (only with --env-file)	libs/dotenv/	Environment variables loaded into Deno.env
import_map.json	libs/config/ (via imports in deno.json)	External import map

cli/args/mod.rs is where these are merged with parsed CLI flags; the result is the CliOptions value that CliFactory exposes.

deno.json fields

The full schema is in cli/schemas/config-file.v1.json. The most relevant fields:

Field	What it does
imports	Import map — "foo": "jsr:@scope/foo@1"
scopes	Per-scope import overrides
compilerOptions	TypeScript compiler options (a subset of tsc's)
lint	Lint rules + include/exclude
fmt	Formatter options + include/exclude
tasks	Named scripts runnable via deno task <name>
test	Test config
bench	Bench config
exclude	Top-level exclude list (applied to most subcommands)
nodeModulesDir	"auto" or "manual" (BYONM)
unstable	List of unstable feature flags to enable
lock	Path to the lockfile (default deno.lock)
name / version / exports	JSR publishing metadata
workspace	List of workspace member directories
vendor	Whether to vendor remote deps locally
license	SPDX license string (used by deno publish)

Environment variables

A non-exhaustive list — search cli/args/flags.rs and cli/args/mod.rs for the rest. The most commonly-used:

Variable	Effect
DENO_DIR	Override the cache directory (default: platform-specific user cache)
DENO_AUTH_TOKENS	Bearer tokens for HTTPS imports (e.g., private registries)
DENO_INSTALL_ROOT	Where deno install <pkg> puts global binaries
DENO_NO_PACKAGE_JSON	Disable package.json discovery
DENO_NO_PROMPT	Equivalent to --no-prompt (auto-deny permission prompts)
DENO_NO_UPDATE_CHECK	Suppress version-check pings
DENO_TLS_CA_STORE	system,mozilla — which CA stores to trust
DENO_CERT	Path to extra CA cert
DENO_LOG	Log level (e.g., debug, deno_core=trace)
DENO_V8_FLAGS	Forwarded to V8 (e.g., --print-bytecode)
DENO_USR2_MEMORY_TRIM	Linux: trigger memory trim on SIGUSR2
NPM_CONFIG_REGISTRY	npm registry URL
NO_COLOR	Disable terminal colors
FORCE_COLOR	Force color output
HTTP_PROXY / HTTPS_PROXY / NO_PROXY	Standard proxy support
RUST_BACKTRACE	Standard Rust backtrace control (1, full)
V8_FROM_SOURCE	Build V8 from source instead of using prebuilt

Permission-related flags (CLI)

cli/args/flags.rs defines the entire flag set. For permissions specifically:

Flag	Allow	Deny
--allow-read[=paths] / --deny-read=...	Filesystem reads
--allow-write[=paths] / --deny-write=...	Filesystem writes
--allow-net[=hosts] / --deny-net=...	Network
--allow-env[=names] / --deny-env=...	Environment
--allow-sys[=names] / --deny-sys=...	System info
--allow-run[=names] / --deny-run=...	Subprocess
--allow-ffi[=paths] / --deny-ffi=...	Native libs
--allow-import[=hosts]	Remote imports
-A / --allow-all	All permissions
--no-prompt	Auto-deny prompts

Each --allow-<name> without a value grants the entire category; with = it scopes to a list.

CLI flag categories of note

The full list is huge. Some categories worth knowing:

• Module/runtime: --check, --no-check, --unstable-*, --watch, --no-watch
• Cache: --cached-only, --reload, --lock, --lock-write, --frozen-lockfile
• TLS: --unsafely-ignore-certificate-errors, --cert
• V8: --v8-flags=..., --inspect, --inspect-brk, --inspect-wait
• Output: --quiet, -q, --log-level
• Workspace: --recursive, --filter

Run deno <subcommand> --help for the per-subcommand surface.

Where flags live in code

cli/args/
├── flags.rs        # The clap derive structs and parsers
├── flags_net.rs    # Network-specific flag parsing
└── mod.rs          # Merging flags with deno.json into CliOptions

If you're adding a flag:

1. Add the field to the relevant *Flags struct in flags.rs.
2. Add the #[arg(...)] attribute.
3. If it should be persistable, add a corresponding deno.json field in the schema and merge in mod.rs.
4. Use it from the relevant cli/tools/<subcommand>/.