Adding a package is easy. Owning it begins immediately afterward.

The package brings its own releases, transitive dependencies, security notices, configuration, compatibility window, and opinions about how the project should be arranged. Any one of those costs may be tiny. Enough tiny costs eventually become a second product hiding underneath the first.

DaftPlate is deliberately built with zero runtime dependencies. Its tests use Node’s built-in node:test runner. Layer composition, placeholder substitution, repository verification, provenance, skill installation, and curated publication are handled by small purpose-built scripts using the standard library.

This is not an argument that dependencies are bad. A mature library is often the responsible choice, especially when it replaces complicated security, parsing, or protocol work that a project has no business inventing. The question is whether the dependency removes more ownership than it adds.

For DaftPlate, the core work is intentionally narrow. Walk a known directory tree. Copy files according to explicit layer rules. Replace a constrained set of tokens. Hash the generated output. Check a written repository contract. Those operations fit comfortably inside the platform it already requires. Adding a templating engine and a separate test framework would create more installation and configuration surface without making the delivery model clearer.

That matters on the first day of a project and the first day of a handover. A new machine needs a supported Node version, not a small parade of global tools and framework-specific knowledge before it can verify the scaffolder. CI has fewer packages to download. The dependency graph has fewer supply-chain inputs. There is less infrastructure that can age underneath the actual work while nobody is looking.

The choice also keeps the generated repositories easier to explain. DaftPlate is meant to reduce the number of assumptions a project inherits. It would be odd if the system providing that simplicity arrived with a large private ecosystem of its own.

None of this makes the implementation free. Rejecting a templating engine means DaftPlate owns its layer semantics, collision behavior, token rules, and provenance format. Rejecting a test framework means it owns the test helpers and reporting conventions it needs. A dependency-free bug is still a bug, only with nobody upstream to fix it.

The answer is tests. The suite grew from 82 tests around the first scaffolder to 279 after all eight profiles and the architecture tooling were in place. End-to-end cases compose each real profile, substitute its values, and run the repository verifier over the result. Unit coverage checks the sharp edges: nested dotfiles, ignored secret twins, unresolved tokens, unnecessary overrides, invalid metadata, and the collisions that must stop a scaffold.

There is one amusing consequence of using the built-in runner: the project also tests the exact command used to invoke it. On current Node versions, passing the wrong positional path can match nothing and produce a reassuringly empty run. DaftPlate’s template verifier rejects that configuration. Zero dependencies does not mean zero traps; it means the traps belong to a smaller, inspectable surface.

Operational simplicity is rarely glamorous. It is useful when a laptop is replaced, CI is rebuilt, a security alert arrives, or another person takes over the project. Every component omitted is one less thing that must be understood, updated, and babysat.

The standard is not “never install a package.” It is “make every moving part earn its place.” For this tool, Node already supplied the parts the job needed. The rest would have been very capable company for code that was doing fine on its own.