javascript-ecosystem

Files (1)

• SKILL.md

SKILL.md (first lines)

# JavaScript ecosystem layout

This skill is the technique for the `package-npm` Flavor (`packaging=npm`). Select it
only with `lang-javascript`.

Use a conventional Node package: `package.json` at the package root, implementation
beneath `src/`, tests beneath `tests/` or `src/**/*.test.js` only when the Component
already requires co-located tests, and a complete `package-lock.json` beside the
manifest. Honor workspace boundaries when the Component is a workspace member; do
not flatten workspace packages into one directory merely to make generation
convenient.

Declare or use a package only when selected recipe authority establishes the exact
manifest and complete matching lockfile. Do not invent, derive, update, or repair
lockfile bytes during generation. Enumerate the same direct and transitive package
closure in the required CycloneDX source SBOM. The model emits only this source
authority: it never searches for tools, probes versions, runs a package manager, or
installs dependencies. The authorized lifecycle alone detects the selected Node.js
and npm toolchain, validates the manifest-lock-SBOM agreement, and replays the exact
lock (`npm ci` or equivalent) into `OBJ_DIR` before build and test. It fails closed
before package use when any of those inputs is missing, incomplete, mismatched, or
unauthorized.

Treat `node_modules`, npm/pnpm/yarn caches, coverage output, and bundler intermediates
as derived state. Project them under `OBJ_DIR`; never admit them as generated-source
authority. Do not copy `node_modules` into a source cache or a committed sample tree.

From jordanhubbard/project-tracker, BSD-2-Clause.