Zero runtime dependencies
Rule
dependencies in package.json is absent or empty. Use Node built-ins and the language standard library. Never edit dependency fields or the lockfile; if a package is needed, stop and raise ESC-DEP. Exceptions are owner decisions recorded in the repo spec, not agent choices.
Do
{
"name": "@ap/search-bm25",
"type": "module",
"dependencies": {}
}Don’t
{
"name": "@ap/search-bm25",
"type": "module",
"dependencies": {
"lodash": "^4.17.21"
}
}Exceptions
An owner-approved exception names the package, its exact version and the reason in the repo spec. The engineering review treats zero dependencies as an A7 architectural choice, not a universal security rule, so other archetypes do not inherit this rule.
Rationale
Every consumer of an A7 library inherits its dependency tree. Zero runtime dependencies keep bundles small, remove supply-chain exposure for downstream repos, and make the library safe to vendor. The A7 governance checker rejects dependency-field changes in agent PRs. Source: Package Conventions.