npm with a committed lockfile

Rule

The package manager is npm. package-lock.json is committed, and installs use npm ci --ignore-scripts. Do not add pnpm-lock.yaml or yarn.lock. Agents never run npm install to add, remove or upgrade a package; they raise ESC-DEP instead.

Do

npm ci --ignore-scripts
npm run preflight

Don’t

pnpm install
npm install lodash

Rationale

npm ci installs exactly what the lockfile records and fails if package.json and the lockfile disagree. The A7 governance checker, fixtures and CI commands are written for npm, so a second package manager would bypass them.

Related

• STD-PKG-001
• CGD-18