{ "name": "mandrel", "version": "2.52.0", "description": "Claude Code-first opinionated workflow framework: instructions, skills, rules, and SDLC workflows that govern AI coding assistants.", "files": [ ".agents/", "bin/", "docs/CHANGELOG.md", "lib/", "!lib/**/__tests__", "!.agents/**/__tests__" ], "publishConfig": { "access": "public", "provenance": true }, "scripts": { "//test-preflight": "There are deliberately NO pretest* scripts (Story #4936). .npmrc sets ignore-scripts=true as supply-chain defence (CWE-1357), and that suppresses every pre*/post* lifecycle script for `npm run` too — so a pretest entry here would look like a gate and never execute. Each tier's preflight is declared once in .agents/scripts/lib/test-runner-contract.js and invoked by the runners themselves, which is why it fires for `npm test`, `npm run test:coverage` and a bare `node .agents/scripts/run-tests.js` alike.", "test": "node .agents/scripts/run-tests.js", "test:quick": "node .agents/scripts/run-tests.js --tier quick", "test:integration": "node .agents/scripts/run-tests.js --tier integration", "test:e2e": "node .agents/scripts/run-tests.js --tier e2e", "test:profile": "node .agents/scripts/run-test-profile.js", "test:census": "SPAWN_CENSUS_OUT=\"${SPAWN_CENSUS_OUT:-temp/census.json}\" NODE_OPTIONS=\"--require $PWD/tests/fixtures/spawn-census.cjs\" node .agents/scripts/run-tests.js", "test:isolate": "node .agents/scripts/test-isolate.js", "verify": "node .agents/scripts/run-verify.js", "typecheck": "node -e \"process.exit(0)\"", "test:coverage": "node .agents/scripts/run-coverage.js", "coverage:check": "node .agents/scripts/check-baselines.js --gate coverage", "coverage:update": "node .agents/scripts/update-coverage-baseline.js", "coverage:reanchor": "node .agents/scripts/update-coverage-baseline.js --full-scope", "baseline:agents-loc": "node baselines/agents-loc-baseline.mjs", "baselines:scope": "node .agents/scripts/check-baseline-scope.js", "baselines:prune": "node .agents/scripts/prune-baseline-orphans.js", "lint:md": "markdownlint-cli2 \".agents/**/*.md\" \"*.md\" \"!node_modules/**\" \"!.worktrees/**\"", "lint": "node .agents/scripts/run-lint.js && node .agents/scripts/check-generated-validator.js --check && npm run docs:check", "docs:gen": "node .agents/scripts/generate-config-docs.js && node .agents/scripts/generate-workflows-doc.js && node .agents/scripts/generate-lens-checklists.js", "docs:check": "node .agents/scripts/generate-config-docs.js --check && node .agents/scripts/generate-workflows-doc.js --check && node .agents/scripts/generate-lens-checklists.js --check && node .agents/scripts/check-doc-links.js && npm run skills:check", "skills:index": "node .agents/scripts/generate-skills-index.js", "skills:check": "node .agents/scripts/generate-skills-index.js --check", "format": "biome format --write .", "format:check": "biome ci .", "maintainability:check": "node .agents/scripts/check-baselines.js --gate maintainability", "maintainability:update": "node .agents/scripts/update-maintainability-baseline.js", "maintainability:reanchor": "node .agents/scripts/update-maintainability-baseline.js --full-scope", "check:arch": "node .agents/scripts/check-arch-cycles.js", "check:context-budget": "node .agents/scripts/check-context-budget.js", "check:cyclomatic": "node .agents/scripts/check-cyclomatic.js", "cyclomatic:update": "node .agents/scripts/check-cyclomatic.js --update", "dead-exports:update": "node .agents/scripts/update-dead-exports-baseline.js && node .agents/scripts/update-dead-exports-baseline.js --production", "check:knip-entries": "node .agents/scripts/check-knip-entries.js", "validator:gen": "node .agents/scripts/check-generated-validator.js", "validator:check": "node .agents/scripts/check-generated-validator.js --check", "check:schema-refs": "node .agents/scripts/check-schema-references.js", "check:workflow-citations": "node .agents/scripts/check-workflow-citations.js", "crap:check": "node .agents/scripts/check-baselines.js --gate crap", "crap:update": "node .agents/scripts/update-crap-baseline.js", "crap:reanchor": "node .agents/scripts/update-crap-baseline.js --full-scope", "duplication:check": "node .agents/scripts/check-baselines.js --gate duplication", "duplication:update": "node .agents/scripts/update-duplication-baseline.js", "duplication:reanchor": "node .agents/scripts/update-duplication-baseline.js --full-scope", "quality:preview": "node .agents/scripts/check-dead-exports.js && node .agents/scripts/quality-preview.js", "quality:watch": "node .agents/scripts/quality-watch.js", "sync:commands": "node bin/mandrel.js sync-commands", "sync:agents": "node .agents/scripts/sync-claude-agents.js", "prepare": "husky && npm run sync:commands && npm run sync:agents", "postinstall": "node bin/postinstall.js mandrel sync" }, "repository": { "type": "git", "url": "git+https://github.com/dsj1984/mandrel.git" }, "keywords": [ "claude-code", "ai-agents", "sdlc", "workflow", "orchestration", "agentic" ], "author": "", "license": "MIT", "bin": { "mandrel": "./bin/mandrel.js" }, "type": "module", "bugs": { "url": "https://github.com/dsj1984/mandrel/issues" }, "homepage": "https://github.com/dsj1984/mandrel#readme", "engines": { "node": ">=22.22.1 <25" }, "devDependencies": { "@biomejs/biome": "^2.5.0", "@commitlint/cli": "^21.0.2", "@commitlint/config-conventional": "^21.0.2", "@cucumber/gherkin": "^42.0.1", "c8": "^11.0.0", "chokidar": "^5.0.0", "husky": "^9.1.7", "jscpd": "^4.2.5", "knip": "^6.17.1", "lint-staged": "^17.0.7", "markdownlint-cli2": "^0.22.1", "memfs": "^4.57.7", "node-pty": "^1.0.0", "typescript": "^6.0.3" }, "dependencies": { "ajv": "^8.20.0", "ajv-formats": "^3.0.1", "js-yaml": "^4.3.1", "minimatch": "^10.0.0", "picomatch": "^4.0.4", "typhonjs-escomplex": "^0.1.0" }, "peerDependencies": { "@cucumber/gherkin": ">=32.0.0", "typescript": ">=5.0.0" }, "peerDependenciesMeta": { "@cucumber/gherkin": { "optional": true }, "typescript": { "optional": true } }, "//": { "peerDependencies.@cucumber/gherkin": "OPTIONAL peer, mirroring the `typescript` precedent, and deliberately NOT a runtime dependency. `check-gherkin-corpus.js` is the only consumer and it is opt-in behind `qa.gherkinLint`, so a consumer with no BDD tier must gain nothing from an upgrade. The devDependency alongside it is what lets this repository's own suite drive the real parser. The gate resolves it through a require path anchored at the consumer project — `.agents/` reaches a consumer by plain file copy, so a bare specifier would resolve against the consumer's module chain, which under a non-hoisting linker need not hold it.", "overrides.js-yaml": "COUPLED to devDependencies.markdownlint-cli2 — do not bump either alone, and do NOT drop this override. It is load-bearing: markdownlint-cli2 0.22.x pulls js-yaml 4.1.1, which carries GHSA-52cp-r559-cp3m (high) and GHSA-h67p-54hq-rp68 (moderate); removing the override was measured to reintroduce both (1 high + 1 moderate), while with it in place `npm audit` is clean. An npm override also wins over a transitive package's own pin, so this tree-wide ^4.2.0 is imposed on every js-yaml consumer regardless of what they declare — and markdownlint-cli2 0.23.x declares an exact js-yaml 5.2.1. A dry-run bump confirmed the trap: markdownlint-cli2 0.23.1 resolves against js-yaml 4.3.0, two majors off what it declares, silently. The only safe move is to raise this override and bump markdownlint-cli2 in ONE reviewed commit (first confirming cosmiconfig, under @commitlint/cli, tolerates the same major). renovate.json excludes markdownlint-cli2 from devDependency auto-merge so that pair cannot drift apart unattended.", "dependencies.js-yaml": "States the SAME range as overrides.js-yaml above. The two are deliberate duplicates — npm has no way to reference the direct range from the overrides block — so they MUST move in lockstep; changing one without the other silently splits the direct and transitive resolutions." }, "overrides": { "js-yaml": "^4.3.1", "markdown-it": "^14.2.0" } }