package.json

{
  "name": "@rbbtsn0w/adg",
  "version": "0.10.1",
  "description": "Agent Directory Group (ADG) toolkit — two domains: plugins and skills.",
  "type": "module",
  "license": "MIT",
  "repository": {
    "type": "git",
    "url": "git+https://github.com/RbBtSn0w/adg.git"
  },
  "homepage": "https://github.com/RbBtSn0w/adg#readme",
  "bugs": {
    "url": "https://github.com/RbBtSn0w/adg/issues"
  },
  "publishConfig": {
    "access": "public"
  },
  "bin": {
    "adg": "dist/bin/adg.js"
  },
  "engines": {
    "node": ">=22.18.0"
  },
  "scripts": {
    "adg": "node ./bin/adg.ts",
    "build": "node scripts/build.mjs",
    "test": "node scripts/run-tests.mjs \"test/**/*.test.ts\" test/cache-sandbox.test.mjs",
    "test:codex-sandbox": "node --test test/codex-sandbox.test.mjs",
    "test:cache-sandbox": "node --test test/cache-sandbox.test.mjs",
    "check:docs": "node scripts/check-doc-links.mjs",
    "check:test-isolation": "node scripts/check-test-cli-isolation.mjs",
    "check:package-smoke": "node scripts/check-package-smoke.mjs",
    "check:vendor-deps": "node scripts/check-vendor-deps.mjs",
    "check:vendor-upstream": "node scripts/check-vendor-upstream.mjs",
    "audit:prod": "npm audit --omit=dev",
    "typecheck": "tsc --noEmit",
    "prepare": "npm run typecheck",
    "prepack": "npm run typecheck && npm run build"
  },
  "files": [
    "dist",
    "schemas",
    "vendor/skills/LICENSE",
    "vendor/skills/PROVENANCE.md",
    "vendor/skills/ThirdPartyNoticeText.txt",
    "docs"
  ],
  "comment:dependencies": "Runtime deps below are required only by the vendored skills CLI (vendor/skills); ADG's own plugins code has zero runtime deps. Root is the single source of truth: each range MUST be >= the floor declared in vendor/skills/package.json, since that is the version the vendored source was authored against. `npm run check:vendor-deps` enforces this and fails on drift.",
  "dependencies": {
    "@clack/prompts": "^1.2.0",
    "@opentelemetry/api": "^1.9.0",
    "@opentelemetry/exporter-trace-otlp-proto": "^0.222.0",
    "@opentelemetry/resources": "^2.11.0",
    "@opentelemetry/sdk-trace-base": "^2.11.0",
    "@opentelemetry/sdk-trace-node": "^2.11.0",
    "@opentelemetry/semantic-conventions": "^1.43.0",
    "@vercel/detect-agent": "^1.2.5",
    "picocolors": "^1.1.1",
    "simple-git": "^4.0.2",
    "tar": "^7.5.20",
    "xdg-basedir": "^5.1.0",
    "yaml": "^2.9.1"
  },
  "devDependencies": {
    "@semantic-release/changelog": "^6.0.3",
    "@semantic-release/commit-analyzer": "^13.0.1",
    "@semantic-release/git": "^10.0.1",
    "@semantic-release/github": "^12.0.8",
    "@semantic-release/npm": "^13.1.5",
    "@semantic-release/release-notes-generator": "^14.1.1",
    "@types/node": "^22.0.0",
    "conventional-changelog-conventionalcommits": "^8.0.0",
    "semantic-release": "^25.0.5",
    "typescript": "^5.6.0"
  },
  "comment:overrides": "Security floors for transitive development tooling: keep npm on a patched 11.x release, pin transitive packages to patch security advisories (handlebars, postcss-selector-parser, http-cache-semantics, brace-expansion, ip-address), and pin transitive undici/js-yaml branches to their patched versions.",
  "overrides": {
    "npm": "^11.21.0",
    "handlebars": "^4.7.10",
    "postcss-selector-parser": "^7.1.6",
    "http-cache-semantics": "^4.3.0",
    "brace-expansion": "^5.0.12",
    "ip-address": "^10.7.1",
    "@actions/http-client": {
      "undici": "^6.29.0"
    },
    "node-gyp": {
      "undici": "^6.29.0"
    },
    "@semantic-release/github": {
      "undici": "^7.30.0"
    },
    "cosmiconfig": {
      "js-yaml": "^4.3.1"
    }
  }
}