repopo 0.7.1 → 0.9.0

package/esm/policies/NoLargeBinaryFiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"NoLargeBinaryFiles.js","sourceRoot":"","sources":["../../src/policies/NoLargeBinaryFiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,IAAI,MAAM,OAAO,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AA2BxD;;GAEG;AACH,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C;;GAEG;AACH,MAAM,0BAA0B,GAAG;IAClC,KAAK;IACL,MAAM;IACN,OAAO;IACP,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,SAAS;CACT,CAAC;AAEF;;;GAGG;AACH,SAAS,WAAW,CAAC,OAAe;IACnC,+CAA+C;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAC9D,wCAAwC;IACxC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClD,OAAO,IAAI,MAAM,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAClB,QAAgB,EAChB,eAAyB,EACzB,iBAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjD,mBAAmB;IACnB,IAAI,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,6CAA6C;IAC7C,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACb,CAAC;QACF,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAa;IACjC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC;IACf,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CACjB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EACzC,KAAK,CAAC,MAAM,GAAG,CAAC,CAChB,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,GAAG,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC9B,oBAAoB,CACnB,oBAAoB;AACpB,kBAAkB;AAClB,IAAI,EACJ,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;IAChC,MAAM,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,gBAAgB,CAAC;IAC9D,MAAM,iBAAiB,GACtB,MAAM,EAAE,iBAAiB,IAAI,0BAA0B,CAAC;IACzD,MAAM,eAAe,GAAG,MAAM,EAAE,eAAe,IAAI,EAAE,CAAC;IAEtD,sBAAsB;IACtB,IAAI,UAAU,CAAC,IAAI,EAAE,eAAe,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEjC,mBAAmB;QACnB,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,GAAG,YAAY,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAkB;gBAC7B,IAAI,EAAE,kBAAkB,CAAC,IAAI;gBAC7B,IAAI;gBACJ,WAAW,EAAE,KAAK;gBAClB,YAAY,EAAE,sBAAsB,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,WAAW,CAAC,YAAY,CAAC,iDAAiD;aAC/I,CAAC;YAEF,OAAO,MAAM,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,MAAe,EAAE,CAAC;QAC1B,mDAAmD;QACnD,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC,CACD,CAAC","sourcesContent":["import { statSync } from \"node:fs\";\nimport path from \"pathe\";\nimport { makePolicyDefinition } from \"../makePolicy.js\";\nimport type { PolicyDefinition, PolicyFailure } from \"../policy.js\";\n\n/**\n * Policy settings for the NoLargeBinaryFiles repo policy.\n *\n * @alpha\n */\nexport interface NoLargeBinaryFilesSettings {\n\t/**\n\t * Maximum file size in bytes. Defaults to 10MB.\n\t */\n\tmaxSizeBytes?: number;\n\n\t/**\n\t * File extensions to exclude from size checking.\n\t * Useful for known large files that should be allowed.\n\t */\n\texcludeExtensions?: string[];\n\n\t/**\n\t * File patterns to exclude from size checking.\n\t * Uses glob-style patterns.\n\t */\n\texcludePatterns?: string[];\n}\n\n/**\n * Default maximum file size (10MB in bytes).\n */\nconst DEFAULT_MAX_SIZE = 10 * 1024 * 1024;\n\n/**\n * Default file extensions that are typically safe to exclude from size limits.\n */\nconst DEFAULT_EXCLUDE_EXTENSIONS = [\n\t\".md\",\n\t\".txt\",\n\t\".json\",\n\t\".js\",\n\t\".ts\",\n\t\".jsx\",\n\t\".tsx\",\n\t\".css\",\n\t\".scss\",\n\t\".sass\",\n\t\".less\",\n\t\".html\",\n\t\".xml\",\n\t\".yml\",\n\t\".yaml\",\n\t\".toml\",\n\t\".ini\",\n\t\".conf\",\n\t\".config\",\n];\n\n/**\n * Convert a glob pattern to a regex pattern by escaping special characters\n * and converting * to .* for wildcard matching.\n */\nfunction globToRegex(pattern: string): RegExp {\n\t// Escape all regex special characters except *\n\tconst escaped = pattern.replace(/[.+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n\t// Convert * to .* for wildcard matching\n\tconst regexPattern = escaped.replace(/\\*/g, \".*\");\n\treturn new RegExp(`^${regexPattern}$`);\n}\n\n/**\n * Check if a file matches any of the exclude patterns.\n */\nfunction isExcluded(\n\tfilePath: string,\n\texcludePatterns: string[],\n\texcludeExtensions: string[],\n): boolean {\n\tconst ext = path.extname(filePath).toLowerCase();\n\n\t// Check extensions\n\tif (excludeExtensions.includes(ext)) {\n\t\treturn true;\n\t}\n\n\t// Check patterns (simple glob-like matching)\n\tfor (const pattern of excludePatterns) {\n\t\tif (pattern.includes(\"*\")) {\n\t\t\tconst regex = globToRegex(pattern);\n\t\t\tif (regex.test(filePath)) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t} else if (filePath.includes(pattern)) {\n\t\t\treturn true;\n\t\t}\n\t}\n\n\treturn false;\n}\n\n/**\n * Format bytes in a human-readable format.\n */\nfunction formatBytes(bytes: number): string {\n\tif (bytes === 0) {\n\t\treturn \"0 B\";\n\t}\n\tconst k = 1024;\n\tconst sizes = [\"B\", \"KB\", \"MB\", \"GB\", \"TB\"];\n\tconst i = Math.min(\n\t\tMath.floor(Math.log(bytes) / Math.log(k)),\n\t\tsizes.length - 1,\n\t);\n\tconst formatted = (bytes / k ** i).toFixed(1);\n\treturn `${formatted} ${sizes[i]}`;\n}\n\n/**\n * A repo policy that prevents large binary files from being committed to the repository.\n * Large files can bloat the repository and slow down clones. Consider using Git LFS for large assets.\n *\n * @alpha\n */\nexport const NoLargeBinaryFiles: PolicyDefinition<NoLargeBinaryFilesSettings> =\n\tmakePolicyDefinition(\n\t\t\"NoLargeBinaryFiles\",\n\t\t// Match all files\n\t\t/.*/,\n\t\tasync ({ file, root, config }) => {\n\t\t\tconst maxSizeBytes = config?.maxSizeBytes ?? DEFAULT_MAX_SIZE;\n\t\t\tconst excludeExtensions =\n\t\t\t\tconfig?.excludeExtensions ?? DEFAULT_EXCLUDE_EXTENSIONS;\n\t\t\tconst excludePatterns = config?.excludePatterns ?? [];\n\n\t\t\t// Skip excluded files\n\t\t\tif (isExcluded(file, excludePatterns, excludeExtensions)) {\n\t\t\t\treturn true;\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst filePath = path.resolve(root, file);\n\t\t\t\tconst stats = statSync(filePath);\n\n\t\t\t\t// Skip directories\n\t\t\t\tif (stats.isDirectory()) {\n\t\t\t\t\treturn true;\n\t\t\t\t}\n\n\t\t\t\tif (stats.size > maxSizeBytes) {\n\t\t\t\t\tconst result: PolicyFailure = {\n\t\t\t\t\t\tname: NoLargeBinaryFiles.name,\n\t\t\t\t\t\tfile,\n\t\t\t\t\t\tautoFixable: false,\n\t\t\t\t\t\terrorMessage: `File is too large: ${formatBytes(stats.size)} (max: ${formatBytes(maxSizeBytes)}). Consider using Git LFS or removing the file.`,\n\t\t\t\t\t};\n\n\t\t\t\t\treturn result;\n\t\t\t\t}\n\n\t\t\t\treturn true;\n\t\t\t} catch (_error: unknown) {\n\t\t\t\t// File doesn't exist or can't be accessed, skip it\n\t\t\t\treturn true;\n\t\t\t}\n\t\t},\n\t);\n"]}
+{"version":3,"file":"NoLargeBinaryFiles.js","sourceRoot":"","sources":["../../src/policies/NoLargeBinaryFiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,IAAI,MAAM,OAAO,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AA2BxD;;GAEG;AACH,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C;;GAEG;AACH,MAAM,0BAA0B,GAAG;IAClC,KAAK;IACL,MAAM;IACN,OAAO;IACP,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,OAAO;IACP,SAAS;CACT,CAAC;AAEF;;;GAGG;AACH,SAAS,WAAW,CAAC,OAAe;IACnC,+CAA+C;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAC9D,wCAAwC;IACxC,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClD,OAAO,IAAI,MAAM,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAClB,QAAgB,EAChB,eAAyB,EACzB,iBAA2B;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjD,mBAAmB;IACnB,IAAI,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,6CAA6C;IAC7C,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACvC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACb,CAAC;QACF,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACvC,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IAED,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAa;IACjC,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACjB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC;IACf,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CACjB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EACzC,KAAK,CAAC,MAAM,GAAG,CAAC,CAChB,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,GAAG,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC9B,oBAAoB,CAAC;IACpB,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EACV,sHAAsH;IACvH,kBAAkB;IAClB,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QACzC,MAAM,YAAY,GAAG,MAAM,EAAE,YAAY,IAAI,gBAAgB,CAAC;QAC9D,MAAM,iBAAiB,GACtB,MAAM,EAAE,iBAAiB,IAAI,0BAA0B,CAAC;QACzD,MAAM,eAAe,GAAG,MAAM,EAAE,eAAe,IAAI,EAAE,CAAC;QAEtD,sBAAsB;QACtB,IAAI,UAAU,CAAC,IAAI,EAAE,eAAe,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC1C,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAEjC,mBAAmB;YACnB,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzB,OAAO,IAAI,CAAC;YACb,CAAC;YAED,IAAI,KAAK,CAAC,IAAI,GAAG,YAAY,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAkB;oBAC7B,IAAI,EAAE,kBAAkB,CAAC,IAAI;oBAC7B,IAAI;oBACJ,WAAW,EAAE,KAAK;oBAClB,aAAa,EAAE;wBACd,sBAAsB,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,WAAW,CAAC,YAAY,CAAC,iDAAiD;qBACjI;iBACD,CAAC;gBAEF,OAAO,MAAM,CAAC;YACf,CAAC;YAED,OAAO,IAAI,CAAC;QACb,CAAC;QAAC,OAAO,MAAe,EAAE,CAAC;YAC1B,mDAAmD;YACnD,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;CACD,CAAC,CAAC","sourcesContent":["import { statSync } from \"node:fs\";\nimport path from \"pathe\";\nimport { makePolicyDefinition } from \"../makePolicy.js\";\nimport type { PolicyDefinition, PolicyFailure } from \"../policy.js\";\n\n/**\n * Policy settings for the NoLargeBinaryFiles repo policy.\n *\n * @alpha\n */\nexport interface NoLargeBinaryFilesSettings {\n\t/**\n\t * Maximum file size in bytes. Defaults to 10MB.\n\t */\n\tmaxSizeBytes?: number;\n\n\t/**\n\t * File extensions to exclude from size checking.\n\t * Useful for known large files that should be allowed.\n\t */\n\texcludeExtensions?: string[];\n\n\t/**\n\t * File patterns to exclude from size checking.\n\t * Uses glob-style patterns.\n\t */\n\texcludePatterns?: string[];\n}\n\n/**\n * Default maximum file size (10MB in bytes).\n */\nconst DEFAULT_MAX_SIZE = 10 * 1024 * 1024;\n\n/**\n * Default file extensions that are typically safe to exclude from size limits.\n */\nconst DEFAULT_EXCLUDE_EXTENSIONS = [\n\t\".md\",\n\t\".txt\",\n\t\".json\",\n\t\".js\",\n\t\".ts\",\n\t\".jsx\",\n\t\".tsx\",\n\t\".css\",\n\t\".scss\",\n\t\".sass\",\n\t\".less\",\n\t\".html\",\n\t\".xml\",\n\t\".yml\",\n\t\".yaml\",\n\t\".toml\",\n\t\".ini\",\n\t\".conf\",\n\t\".config\",\n];\n\n/**\n * Convert a glob pattern to a regex pattern by escaping special characters\n * and converting * to .* for wildcard matching.\n */\nfunction globToRegex(pattern: string): RegExp {\n\t// Escape all regex special characters except *\n\tconst escaped = pattern.replace(/[.+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n\t// Convert * to .* for wildcard matching\n\tconst regexPattern = escaped.replace(/\\*/g, \".*\");\n\treturn new RegExp(`^${regexPattern}$`);\n}\n\n/**\n * Check if a file matches any of the exclude patterns.\n */\nfunction isExcluded(\n\tfilePath: string,\n\texcludePatterns: string[],\n\texcludeExtensions: string[],\n): boolean {\n\tconst ext = path.extname(filePath).toLowerCase();\n\n\t// Check extensions\n\tif (excludeExtensions.includes(ext)) {\n\t\treturn true;\n\t}\n\n\t// Check patterns (simple glob-like matching)\n\tfor (const pattern of excludePatterns) {\n\t\tif (pattern.includes(\"*\")) {\n\t\t\tconst regex = globToRegex(pattern);\n\t\t\tif (regex.test(filePath)) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t} else if (filePath.includes(pattern)) {\n\t\t\treturn true;\n\t\t}\n\t}\n\n\treturn false;\n}\n\n/**\n * Format bytes in a human-readable format.\n */\nfunction formatBytes(bytes: number): string {\n\tif (bytes === 0) {\n\t\treturn \"0 B\";\n\t}\n\tconst k = 1024;\n\tconst sizes = [\"B\", \"KB\", \"MB\", \"GB\", \"TB\"];\n\tconst i = Math.min(\n\t\tMath.floor(Math.log(bytes) / Math.log(k)),\n\t\tsizes.length - 1,\n\t);\n\tconst formatted = (bytes / k ** i).toFixed(1);\n\treturn `${formatted} ${sizes[i]}`;\n}\n\n/**\n * A repo policy that prevents large binary files from being committed to the repository.\n * Large files can bloat the repository and slow down clones. Consider using Git LFS for large assets.\n *\n * @alpha\n */\nexport const NoLargeBinaryFiles: PolicyDefinition<NoLargeBinaryFilesSettings> =\n\tmakePolicyDefinition({\n\t\tname: \"NoLargeBinaryFiles\",\n\t\tdescription:\n\t\t\t\"Prevents large binary files from being committed to avoid repository bloat; consider using Git LFS for large assets.\",\n\t\t// Match all files\n\t\tmatch: /.*/,\n\t\thandler: async ({ file, root, config }) => {\n\t\t\tconst maxSizeBytes = config?.maxSizeBytes ?? DEFAULT_MAX_SIZE;\n\t\t\tconst excludeExtensions =\n\t\t\t\tconfig?.excludeExtensions ?? DEFAULT_EXCLUDE_EXTENSIONS;\n\t\t\tconst excludePatterns = config?.excludePatterns ?? [];\n\n\t\t\t// Skip excluded files\n\t\t\tif (isExcluded(file, excludePatterns, excludeExtensions)) {\n\t\t\t\treturn true;\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst filePath = path.resolve(root, file);\n\t\t\t\tconst stats = statSync(filePath);\n\n\t\t\t\t// Skip directories\n\t\t\t\tif (stats.isDirectory()) {\n\t\t\t\t\treturn true;\n\t\t\t\t}\n\n\t\t\t\tif (stats.size > maxSizeBytes) {\n\t\t\t\t\tconst result: PolicyFailure = {\n\t\t\t\t\t\tname: NoLargeBinaryFiles.name,\n\t\t\t\t\t\tfile,\n\t\t\t\t\t\tautoFixable: false,\n\t\t\t\t\t\terrorMessages: [\n\t\t\t\t\t\t\t`File is too large: ${formatBytes(stats.size)} (max: ${formatBytes(maxSizeBytes)}). Consider using Git LFS or removing the file.`,\n\t\t\t\t\t\t],\n\t\t\t\t\t};\n\n\t\t\t\t\treturn result;\n\t\t\t\t}\n\n\t\t\t\treturn true;\n\t\t\t} catch (_error: unknown) {\n\t\t\t\t// File doesn't exist or can't be accessed, skip it\n\t\t\t\treturn true;\n\t\t\t}\n\t\t},\n\t});\n"]}

package/esm/policies/NoPrivateWorkspaceDependencies.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Configuration for the NoPrivateWorkspaceDependencies policy.
+ */
+export interface NoPrivateWorkspaceDependenciesSettings {
+    /**
+     * Whether to check devDependencies in addition to dependencies.
+     * @default false
+     */
+    checkDevDependencies?: boolean;
+}
+/**
+ * Policy that prevents publishable packages from depending on private workspace packages.
+ *
+ * A package is considered "publishable" if it does not have `"private": true` in its package.json.
+ * Such packages cannot have `workspace:` dependencies on packages that are marked as private,
+ * because those dependencies won't be resolvable when the package is published to npm.
+ *
+ * This policy uses the workspace configuration (pnpm-workspace.yaml or package.json workspaces field)
+ * to locate workspace packages, rather than hardcoding directory conventions.
+ *
+ * @example
+ * ```typescript
+ * // In repopo.config.ts
+ * import { NoPrivateWorkspaceDependencies } from "repopo/policies";
+ *
+ * makePolicy(NoPrivateWorkspaceDependencies, {
+ *   checkDevDependencies: false, // Only check production dependencies (default)
+ * });
+ *
+ * // Or check both dependencies and devDependencies
+ * makePolicy(NoPrivateWorkspaceDependencies, {
+ *   checkDevDependencies: true,
+ * });
+ * ```
+ */
+export declare const NoPrivateWorkspaceDependencies: import("../policy.js").PolicyDefinition<NoPrivateWorkspaceDependenciesSettings | undefined>;
+//# sourceMappingURL=NoPrivateWorkspaceDependencies.d.ts.map

package/esm/policies/NoPrivateWorkspaceDependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NoPrivateWorkspaceDependencies.d.ts","sourceRoot":"","sources":["../../src/policies/NoPrivateWorkspaceDependencies.ts"],"names":[],"mappings":"AAYA;;GAEG;AACH,MAAM,WAAW,sCAAsC;IACtD;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B;AA6ED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,8BAA8B,6FAyEzC,CAAC"}

package/esm/policies/NoPrivateWorkspaceDependencies.js

@@ -0,0 +1,145 @@
+import { readFileSync } from "node:fs";
+// Use default import + destructure for CJS/ESM interop
+// (resolve-workspace-root is a bundled CJS module)
+import resolveWorkspaceRoot from "resolve-workspace-root";
+const { getWorkspaceGlobs } = resolveWorkspaceRoot;
+import { globSync } from "tinyglobby";
+import { definePackagePolicy } from "../policyDefiners/definePackagePolicy.js";
+/**
+ * Cache for workspace package lookups to avoid repeated filesystem operations.
+ */
+const workspacePackageCache = new Map();
+/**
+ * Builds a map of package name to package.json for all packages in the workspace.
+ * Uses the workspace configuration (pnpm-workspace.yaml or package.json workspaces) to find packages.
+ */
+function buildWorkspacePackageMap(root) {
+    // Check cache first
+    const cached = workspacePackageCache.get(root);
+    if (cached !== undefined) {
+        return cached;
+    }
+    const packageMap = new Map();
+    // Get workspace globs from pnpm-workspace.yaml or package.json
+    const workspaceGlobs = getWorkspaceGlobs(root);
+    if (workspaceGlobs === null) {
+        // Not a workspace - return empty map
+        workspacePackageCache.set(root, packageMap);
+        return packageMap;
+    }
+    // Find all package.json files matching the workspace globs
+    const packageGlobs = workspaceGlobs.map((g) => `${g}/package.json`);
+    const packageJsonPaths = globSync(packageGlobs, {
+        cwd: root,
+        ignore: ["**/node_modules/**"],
+        onlyFiles: true,
+        absolute: true,
+    });
+    // Load each package.json and map by name
+    for (const pkgPath of packageJsonPaths) {
+        try {
+            const content = readFileSync(pkgPath, "utf-8");
+            const pkg = JSON.parse(content);
+            if (pkg.name) {
+                packageMap.set(pkg.name, pkg);
+            }
+        }
+        catch {
+            // Ignore parse errors
+        }
+    }
+    workspacePackageCache.set(root, packageMap);
+    return packageMap;
+}
+/**
+ * Looks up a workspace package by name using the workspace configuration.
+ */
+function findWorkspacePackage(depName, root) {
+    const packageMap = buildWorkspacePackageMap(root);
+    return packageMap.get(depName);
+}
+/**
+ * Checks if a dependency version uses the workspace protocol.
+ */
+function isWorkspaceDependency(version) {
+    return version?.startsWith("workspace:") ?? false;
+}
+/**
+ * Policy that prevents publishable packages from depending on private workspace packages.
+ *
+ * A package is considered "publishable" if it does not have `"private": true` in its package.json.
+ * Such packages cannot have `workspace:` dependencies on packages that are marked as private,
+ * because those dependencies won't be resolvable when the package is published to npm.
+ *
+ * This policy uses the workspace configuration (pnpm-workspace.yaml or package.json workspaces field)
+ * to locate workspace packages, rather than hardcoding directory conventions.
+ *
+ * @example
+ * ```typescript
+ * // In repopo.config.ts
+ * import { NoPrivateWorkspaceDependencies } from "repopo/policies";
+ *
+ * makePolicy(NoPrivateWorkspaceDependencies, {
+ *   checkDevDependencies: false, // Only check production dependencies (default)
+ * });
+ *
+ * // Or check both dependencies and devDependencies
+ * makePolicy(NoPrivateWorkspaceDependencies, {
+ *   checkDevDependencies: true,
+ * });
+ * ```
+ */
+export const NoPrivateWorkspaceDependencies = definePackagePolicy({
+    name: "NoPrivateWorkspaceDependencies",
+    description: "Prevents publishable packages from depending on private workspace packages that won't be available on npm.",
+    // biome-ignore lint/correctness/useYield: no yield needed
+    handler: function* (json, { file, root, config }) {
+        // Private packages can depend on anything - they won't be published
+        if (json.private === true) {
+            return true;
+        }
+        const checkDevDeps = config?.checkDevDependencies ?? false;
+        // Collect dependencies to check
+        const depsToCheck = {
+            ...(json.dependencies ?? {}),
+        };
+        if (checkDevDeps) {
+            Object.assign(depsToCheck, json.devDependencies ?? {});
+        }
+        const privateWorkspaceDeps = [];
+        const unresolvableDeps = [];
+        for (const [depName, version] of Object.entries(depsToCheck)) {
+            if (!isWorkspaceDependency(version)) {
+                continue;
+            }
+            const depPackageJson = findWorkspacePackage(depName, root);
+            if (depPackageJson === undefined) {
+                // Could not find the package - might be a configuration issue
+                // We'll warn but not fail, as this could be a valid setup we don't understand
+                unresolvableDeps.push(depName);
+                continue;
+            }
+            if (depPackageJson.private === true) {
+                privateWorkspaceDeps.push(depName);
+            }
+        }
+        const errorMessages = [];
+        if (privateWorkspaceDeps.length > 0) {
+            errorMessages.push(`Publishable package has workspace dependencies on private packages that won't be available on npm:\n\t${privateWorkspaceDeps.join("\n\t")}`);
+        }
+        if (unresolvableDeps.length > 0) {
+            errorMessages.push(`Could not resolve workspace dependencies (verify they exist):\n\t${unresolvableDeps.join("\n\t")}`);
+        }
+        if (errorMessages.length > 0) {
+            const failResult = {
+                name: NoPrivateWorkspaceDependencies.name,
+                file,
+                autoFixable: false,
+                errorMessages,
+            };
+            return failResult;
+        }
+        return true;
+    },
+});
+//# sourceMappingURL=NoPrivateWorkspaceDependencies.js.map

package/esm/policies/NoPrivateWorkspaceDependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NoPrivateWorkspaceDependencies.js","sourceRoot":"","sources":["../../src/policies/NoPrivateWorkspaceDependencies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,uDAAuD;AACvD,mDAAmD;AACnD,OAAO,oBAAoB,MAAM,wBAAwB,CAAC;AAE1D,MAAM,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CAAC;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAa/E;;GAEG;AACH,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAGlC,CAAC;AAEJ;;;GAGG;AACH,SAAS,wBAAwB,CAChC,IAAY;IAEZ,oBAAoB;IACpB,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmC,CAAC;IAE9D,+DAA+D;IAC/D,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC7B,qCAAqC;QACrC,qBAAqB,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC5C,OAAO,UAAU,CAAC;IACnB,CAAC;IAED,2DAA2D;IAC3D,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,QAAQ,CAAC,YAAY,EAAE;QAC/C,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,CAAC,oBAAoB,CAAC;QAC9B,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,yCAAyC;IACzC,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACxC,IAAI,CAAC;YACJ,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC;YAC/C,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACd,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC;QACF,CAAC;QAAC,MAAM,CAAC;YACR,sBAAsB;QACvB,CAAC;IACF,CAAC;IAED,qBAAqB,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC5C,OAAO,UAAU,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAC5B,OAAe,EACf,IAAY;IAEZ,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,OAA2B;IACzD,OAAO,OAAO,EAAE,UAAU,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,mBAAmB,CAG/D;IACD,IAAI,EAAE,gCAAgC;IACtC,WAAW,EACV,4GAA4G;IAC7G,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;QAC/C,oEAAoE;QACpE,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,EAAE,oBAAoB,IAAI,KAAK,CAAC;QAE3D,gCAAgC;QAChC,MAAM,WAAW,GAAuC;YACvD,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;SAC5B,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YAClB,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,oBAAoB,GAAa,EAAE,CAAC;QAC1C,MAAM,gBAAgB,GAAa,EAAE,CAAC;QAEtC,KAAK,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,SAAS;YACV,CAAC;YAED,MAAM,cAAc,GAAG,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAE3D,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBAClC,8DAA8D;gBAC9D,8EAA8E;gBAC9E,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC/B,SAAS;YACV,CAAC;YAED,IAAI,cAAc,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,CAAC;QACF,CAAC;QAED,MAAM,aAAa,GAAa,EAAE,CAAC;QAEnC,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrC,aAAa,CAAC,IAAI,CACjB,yGAAyG,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAC5I,CAAC;QACH,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,aAAa,CAAC,IAAI,CACjB,oEAAoE,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CACnG,CAAC;QACH,CAAC;QAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,UAAU,GAAkB;gBACjC,IAAI,EAAE,8BAA8B,CAAC,IAAI;gBACzC,IAAI;gBACJ,WAAW,EAAE,KAAK;gBAClB,aAAa;aACb,CAAC;YACF,OAAO,UAAU,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;CACD,CAAC,CAAC","sourcesContent":["import { readFileSync } from \"node:fs\";\n// Use default import + destructure for CJS/ESM interop\n// (resolve-workspace-root is a bundled CJS module)\nimport resolveWorkspaceRoot from \"resolve-workspace-root\";\n\nconst { getWorkspaceGlobs } = resolveWorkspaceRoot;\n\nimport { globSync } from \"tinyglobby\";\nimport type { PackageJson } from \"type-fest\";\nimport type { PolicyFailure } from \"../policy.js\";\nimport { definePackagePolicy } from \"../policyDefiners/definePackagePolicy.js\";\n\n/**\n * Configuration for the NoPrivateWorkspaceDependencies policy.\n */\nexport interface NoPrivateWorkspaceDependenciesSettings {\n\t/**\n\t * Whether to check devDependencies in addition to dependencies.\n\t * @default false\n\t */\n\tcheckDevDependencies?: boolean;\n}\n\n/**\n * Cache for workspace package lookups to avoid repeated filesystem operations.\n */\nconst workspacePackageCache = new Map<\n\tstring,\n\tMap<string, PackageJson | undefined>\n>();\n\n/**\n * Builds a map of package name to package.json for all packages in the workspace.\n * Uses the workspace configuration (pnpm-workspace.yaml or package.json workspaces) to find packages.\n */\nfunction buildWorkspacePackageMap(\n\troot: string,\n): Map<string, PackageJson | undefined> {\n\t// Check cache first\n\tconst cached = workspacePackageCache.get(root);\n\tif (cached !== undefined) {\n\t\treturn cached;\n\t}\n\n\tconst packageMap = new Map<string, PackageJson | undefined>();\n\n\t// Get workspace globs from pnpm-workspace.yaml or package.json\n\tconst workspaceGlobs = getWorkspaceGlobs(root);\n\tif (workspaceGlobs === null) {\n\t\t// Not a workspace - return empty map\n\t\tworkspacePackageCache.set(root, packageMap);\n\t\treturn packageMap;\n\t}\n\n\t// Find all package.json files matching the workspace globs\n\tconst packageGlobs = workspaceGlobs.map((g) => `${g}/package.json`);\n\tconst packageJsonPaths = globSync(packageGlobs, {\n\t\tcwd: root,\n\t\tignore: [\"**/node_modules/**\"],\n\t\tonlyFiles: true,\n\t\tabsolute: true,\n\t});\n\n\t// Load each package.json and map by name\n\tfor (const pkgPath of packageJsonPaths) {\n\t\ttry {\n\t\t\tconst content = readFileSync(pkgPath, \"utf-8\");\n\t\t\tconst pkg = JSON.parse(content) as PackageJson;\n\t\t\tif (pkg.name) {\n\t\t\t\tpackageMap.set(pkg.name, pkg);\n\t\t\t}\n\t\t} catch {\n\t\t\t// Ignore parse errors\n\t\t}\n\t}\n\n\tworkspacePackageCache.set(root, packageMap);\n\treturn packageMap;\n}\n\n/**\n * Looks up a workspace package by name using the workspace configuration.\n */\nfunction findWorkspacePackage(\n\tdepName: string,\n\troot: string,\n): PackageJson | undefined {\n\tconst packageMap = buildWorkspacePackageMap(root);\n\treturn packageMap.get(depName);\n}\n\n/**\n * Checks if a dependency version uses the workspace protocol.\n */\nfunction isWorkspaceDependency(version: string | undefined): boolean {\n\treturn version?.startsWith(\"workspace:\") ?? false;\n}\n\n/**\n * Policy that prevents publishable packages from depending on private workspace packages.\n *\n * A package is considered \"publishable\" if it does not have `\"private\": true` in its package.json.\n * Such packages cannot have `workspace:` dependencies on packages that are marked as private,\n * because those dependencies won't be resolvable when the package is published to npm.\n *\n * This policy uses the workspace configuration (pnpm-workspace.yaml or package.json workspaces field)\n * to locate workspace packages, rather than hardcoding directory conventions.\n *\n * @example\n * ```typescript\n * // In repopo.config.ts\n * import { NoPrivateWorkspaceDependencies } from \"repopo/policies\";\n *\n * makePolicy(NoPrivateWorkspaceDependencies, {\n *   checkDevDependencies: false, // Only check production dependencies (default)\n * });\n *\n * // Or check both dependencies and devDependencies\n * makePolicy(NoPrivateWorkspaceDependencies, {\n *   checkDevDependencies: true,\n * });\n * ```\n */\nexport const NoPrivateWorkspaceDependencies = definePackagePolicy<\n\tPackageJson,\n\tNoPrivateWorkspaceDependenciesSettings | undefined\n>({\n\tname: \"NoPrivateWorkspaceDependencies\",\n\tdescription:\n\t\t\"Prevents publishable packages from depending on private workspace packages that won't be available on npm.\",\n\t// biome-ignore lint/correctness/useYield: no yield needed\n\thandler: function* (json, { file, root, config }) {\n\t\t// Private packages can depend on anything - they won't be published\n\t\tif (json.private === true) {\n\t\t\treturn true;\n\t\t}\n\n\t\tconst checkDevDeps = config?.checkDevDependencies ?? false;\n\n\t\t// Collect dependencies to check\n\t\tconst depsToCheck: Record<string, string | undefined> = {\n\t\t\t...(json.dependencies ?? {}),\n\t\t};\n\n\t\tif (checkDevDeps) {\n\t\t\tObject.assign(depsToCheck, json.devDependencies ?? {});\n\t\t}\n\n\t\tconst privateWorkspaceDeps: string[] = [];\n\t\tconst unresolvableDeps: string[] = [];\n\n\t\tfor (const [depName, version] of Object.entries(depsToCheck)) {\n\t\t\tif (!isWorkspaceDependency(version)) {\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tconst depPackageJson = findWorkspacePackage(depName, root);\n\n\t\t\tif (depPackageJson === undefined) {\n\t\t\t\t// Could not find the package - might be a configuration issue\n\t\t\t\t// We'll warn but not fail, as this could be a valid setup we don't understand\n\t\t\t\tunresolvableDeps.push(depName);\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (depPackageJson.private === true) {\n\t\t\t\tprivateWorkspaceDeps.push(depName);\n\t\t\t}\n\t\t}\n\n\t\tconst errorMessages: string[] = [];\n\n\t\tif (privateWorkspaceDeps.length > 0) {\n\t\t\terrorMessages.push(\n\t\t\t\t`Publishable package has workspace dependencies on private packages that won't be available on npm:\\n\\t${privateWorkspaceDeps.join(\"\\n\\t\")}`,\n\t\t\t);\n\t\t}\n\n\t\tif (unresolvableDeps.length > 0) {\n\t\t\terrorMessages.push(\n\t\t\t\t`Could not resolve workspace dependencies (verify they exist):\\n\\t${unresolvableDeps.join(\"\\n\\t\")}`,\n\t\t\t);\n\t\t}\n\n\t\tif (errorMessages.length > 0) {\n\t\t\tconst failResult: PolicyFailure = {\n\t\t\t\tname: NoPrivateWorkspaceDependencies.name,\n\t\t\t\tfile,\n\t\t\t\tautoFixable: false,\n\t\t\t\terrorMessages,\n\t\t\t};\n\t\t\treturn failResult;\n\t\t}\n\n\t\treturn true;\n\t},\n});\n"]}

package/esm/policies/PackageAllowedScopes.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Configuration for the PackageAllowedScopes policy.
+ *
+ * This policy ensures packages in a monorepo use only approved scopes or package names.
+ * This prevents accidental introduction of new scopes and ensures naming consistency.
+ *
+ * @example
+ * ```typescript
+ * const config: PackageAllowedScopesConfig = {
+ *   // Only packages in these scopes are allowed
+ *   allowedScopes: ["@myorg", "@internal", "@experimental"],
+ *   // These specific unscoped packages are also allowed
+ *   unscopedPackages: ["my-legacy-tool", "special-package"],
+ * };
+ * ```
+ *
+ * @alpha
+ */
+export interface PackageAllowedScopesConfig {
+    /**
+     * A list of npm scopes that are allowed for packages in this repository.
+     *
+     * Scopes should start with `@` (e.g., `@myorg`). A package like `@myorg/foo`
+     * would match the scope `@myorg`.
+     *
+     * @remarks
+     *
+     * If a package's scope is not in this list and the package is not in
+     * `unscopedPackages`, the policy will fail.
+     *
+     * @example
+     * ```typescript
+     * allowedScopes: ["@myorg", "@myorg-tools", "@myorg-internal"]
+     * ```
+     */
+    allowedScopes?: string[];
+    /**
+     * A list of unscoped package names that are explicitly allowed.
+     *
+     * Use this for legacy packages or special cases where an unscoped name is needed.
+     *
+     * @remarks
+     *
+     * Unscoped packages not in this list will cause the policy to fail.
+     *
+     * @example
+     * ```typescript
+     * unscopedPackages: ["my-legacy-tool", "special-package"]
+     * ```
+     */
+    unscopedPackages?: string[];
+}
+/**
+ * A policy that ensures packages use only allowed scopes and package names.
+ *
+ * This policy prevents accidental introduction of new npm scopes or unscoped packages
+ * in a monorepo. It helps maintain naming consistency and prevents typos or mistakes
+ * when creating new packages.
+ *
+ * @remarks
+ *
+ * The policy checks packages in the following order:
+ *
+ * 1. If the package is scoped (starts with `@`), check if its scope is in `allowedScopes`
+ * 2. If the package is unscoped, check if it's in `unscopedPackages`
+ * 3. If neither check passes, the policy fails
+ *
+ * The "root" package (common in monorepos) is automatically skipped.
+ *
+ * @example
+ * ```typescript
+ * import { makePolicy } from "repopo";
+ * import { PackageAllowedScopes } from "repopo/policies";
+ *
+ * const config: RepopoConfig = {
+ *   policies: [
+ *     makePolicy(PackageAllowedScopes, {
+ *       allowedScopes: ["@myorg", "@internal"],
+ *       unscopedPackages: ["legacy-package"],
+ *     }),
+ *   ],
+ * };
+ * ```
+ *
+ * @alpha
+ */
+export declare const PackageAllowedScopes: import("../policy.js").PolicyDefinition<PackageAllowedScopesConfig | undefined>;
+//# sourceMappingURL=PackageAllowedScopes.d.ts.map

package/esm/policies/PackageAllowedScopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PackageAllowedScopes.d.ts","sourceRoot":"","sources":["../../src/policies/PackageAllowedScopes.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,0BAA0B;IAC1C;;;;;;;;;;;;;;;OAeG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAiDD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,oBAAoB,iFAuD/B,CAAC"}

package/esm/policies/PackageAllowedScopes.js

@@ -0,0 +1,118 @@
+import { definePackagePolicy } from "../policyDefiners/definePackagePolicy.js";
+import { getPackageScope, isScoped } from "../utils/packageName.js";
+/**
+ * Check if a package's scope is in the allowed list.
+ *
+ * @param packageName - The package name to check
+ * @param allowedScopes - List of allowed scopes
+ * @returns `true` if the package's scope is allowed
+ */
+function isScopeAllowed(packageName, allowedScopes) {
+    if (allowedScopes === undefined || allowedScopes.length === 0) {
+        return false;
+    }
+    const scope = getPackageScope(packageName);
+    if (scope === undefined) {
+        // Package is unscoped, so scope check doesn't apply
+        return false;
+    }
+    return allowedScopes.includes(scope);
+}
+/**
+ * Check if an unscoped package name is in the allowed list.
+ *
+ * @param packageName - The package name to check
+ * @param unscopedPackages - List of allowed unscoped package names
+ * @returns `true` if the unscoped package is allowed
+ */
+function isUnscopedPackageAllowed(packageName, unscopedPackages) {
+    if (unscopedPackages === undefined || unscopedPackages.length === 0) {
+        return false;
+    }
+    // Only applies to unscoped packages
+    if (isScoped(packageName)) {
+        return false;
+    }
+    return unscopedPackages.includes(packageName);
+}
+/**
+ * A policy that ensures packages use only allowed scopes and package names.
+ *
+ * This policy prevents accidental introduction of new npm scopes or unscoped packages
+ * in a monorepo. It helps maintain naming consistency and prevents typos or mistakes
+ * when creating new packages.
+ *
+ * @remarks
+ *
+ * The policy checks packages in the following order:
+ *
+ * 1. If the package is scoped (starts with `@`), check if its scope is in `allowedScopes`
+ * 2. If the package is unscoped, check if it's in `unscopedPackages`
+ * 3. If neither check passes, the policy fails
+ *
+ * The "root" package (common in monorepos) is automatically skipped.
+ *
+ * @example
+ * ```typescript
+ * import { makePolicy } from "repopo";
+ * import { PackageAllowedScopes } from "repopo/policies";
+ *
+ * const config: RepopoConfig = {
+ *   policies: [
+ *     makePolicy(PackageAllowedScopes, {
+ *       allowedScopes: ["@myorg", "@internal"],
+ *       unscopedPackages: ["legacy-package"],
+ *     }),
+ *   ],
+ * };
+ * ```
+ *
+ * @alpha
+ */
+export const PackageAllowedScopes = definePackagePolicy({
+    name: "PackageAllowedScopes",
+    description: "Ensures packages use only allowed npm scopes and package names.",
+    // biome-ignore lint/correctness/useYield: no yield needed
+    handler: function* (json, { file, config }) {
+        // If no config provided, skip validation
+        if (config === undefined) {
+            return true;
+        }
+        const packageName = json.name;
+        // Skip packages without a name
+        if (packageName === undefined) {
+            return true;
+        }
+        // Skip the root package (common in monorepos)
+        if (packageName === "root") {
+            return true;
+        }
+        // Check if the package uses an allowed scope
+        if (isScopeAllowed(packageName, config.allowedScopes)) {
+            return true;
+        }
+        // Check if the package is an allowed unscoped package
+        if (isUnscopedPackageAllowed(packageName, config.unscopedPackages)) {
+            return true;
+        }
+        // Package doesn't match any allowed pattern - build error message
+        const scope = getPackageScope(packageName);
+        let errorMessage;
+        if (scope !== undefined) {
+            // Package has an unexpected scope
+            errorMessage = `Package "${packageName}" uses scope "${scope}" which is not in the allowed scopes list. Allowed scopes: ${config.allowedScopes?.join(", ") ?? "(none)"}`;
+        }
+        else {
+            // Package is unscoped but not in the allowed list
+            errorMessage = `Package "${packageName}" is an unscoped package that is not in the allowed unscoped packages list. Allowed unscoped packages: ${config.unscopedPackages?.join(", ") ?? "(none)"}`;
+        }
+        const failResult = {
+            name: PackageAllowedScopes.name,
+            file,
+            autoFixable: false, // Can't auto-fix package names
+            errorMessages: [errorMessage],
+        };
+        return failResult;
+    },
+});
+//# sourceMappingURL=PackageAllowedScopes.js.map

package/esm/policies/PackageAllowedScopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PackageAllowedScopes.js","sourceRoot":"","sources":["../../src/policies/PackageAllowedScopes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAwDpE;;;;;;GAMG;AACH,SAAS,cAAc,CACtB,WAAmB,EACnB,aAAmC;IAEnC,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,oDAAoD;QACpD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAChC,WAAmB,EACnB,gBAAsC;IAEtC,IAAI,gBAAgB,KAAK,SAAS,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC;IACd,CAAC;IAED,oCAAoC;IACpC,IAAI,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,mBAAmB,CAGrD;IACD,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EACV,iEAAiE;IAClE,0DAA0D;IAC1D,OAAO,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QACzC,yCAAyC;QACzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC;QAE9B,+BAA+B;QAC/B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACb,CAAC;QAED,8CAA8C;QAC9C,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACb,CAAC;QAED,6CAA6C;QAC7C,IAAI,cAAc,CAAC,WAAW,EAAE,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YACvD,OAAO,IAAI,CAAC;QACb,CAAC;QAED,sDAAsD;QACtD,IAAI,wBAAwB,CAAC,WAAW,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC;QACb,CAAC;QAED,kEAAkE;QAClE,MAAM,KAAK,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,YAAoB,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,kCAAkC;YAClC,YAAY,GAAG,YAAY,WAAW,iBAAiB,KAAK,8DAA8D,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC1K,CAAC;aAAM,CAAC;YACP,kDAAkD;YAClD,YAAY,GAAG,YAAY,WAAW,0GAA0G,MAAM,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACnM,CAAC;QAED,MAAM,UAAU,GAAkB;YACjC,IAAI,EAAE,oBAAoB,CAAC,IAAI;YAC/B,IAAI;YACJ,WAAW,EAAE,KAAK,EAAE,+BAA+B;YACnD,aAAa,EAAE,CAAC,YAAY,CAAC;SAC7B,CAAC;QACF,OAAO,UAAU,CAAC;IACnB,CAAC;CACD,CAAC,CAAC","sourcesContent":["import type { PackageJson } from \"type-fest\";\nimport type { PolicyFailure } from \"../policy.js\";\nimport { definePackagePolicy } from \"../policyDefiners/definePackagePolicy.js\";\nimport { getPackageScope, isScoped } from \"../utils/packageName.js\";\n\n/**\n * Configuration for the PackageAllowedScopes policy.\n *\n * This policy ensures packages in a monorepo use only approved scopes or package names.\n * This prevents accidental introduction of new scopes and ensures naming consistency.\n *\n * @example\n * ```typescript\n * const config: PackageAllowedScopesConfig = {\n *   // Only packages in these scopes are allowed\n *   allowedScopes: [\"@myorg\", \"@internal\", \"@experimental\"],\n *   // These specific unscoped packages are also allowed\n *   unscopedPackages: [\"my-legacy-tool\", \"special-package\"],\n * };\n * ```\n *\n * @alpha\n */\nexport interface PackageAllowedScopesConfig {\n\t/**\n\t * A list of npm scopes that are allowed for packages in this repository.\n\t *\n\t * Scopes should start with `@` (e.g., `@myorg`). A package like `@myorg/foo`\n\t * would match the scope `@myorg`.\n\t *\n\t * @remarks\n\t *\n\t * If a package's scope is not in this list and the package is not in\n\t * `unscopedPackages`, the policy will fail.\n\t *\n\t * @example\n\t * ```typescript\n\t * allowedScopes: [\"@myorg\", \"@myorg-tools\", \"@myorg-internal\"]\n\t * ```\n\t */\n\tallowedScopes?: string[];\n\n\t/**\n\t * A list of unscoped package names that are explicitly allowed.\n\t *\n\t * Use this for legacy packages or special cases where an unscoped name is needed.\n\t *\n\t * @remarks\n\t *\n\t * Unscoped packages not in this list will cause the policy to fail.\n\t *\n\t * @example\n\t * ```typescript\n\t * unscopedPackages: [\"my-legacy-tool\", \"special-package\"]\n\t * ```\n\t */\n\tunscopedPackages?: string[];\n}\n\n/**\n * Check if a package's scope is in the allowed list.\n *\n * @param packageName - The package name to check\n * @param allowedScopes - List of allowed scopes\n * @returns `true` if the package's scope is allowed\n */\nfunction isScopeAllowed(\n\tpackageName: string,\n\tallowedScopes: string[] | undefined,\n): boolean {\n\tif (allowedScopes === undefined || allowedScopes.length === 0) {\n\t\treturn false;\n\t}\n\n\tconst scope = getPackageScope(packageName);\n\tif (scope === undefined) {\n\t\t// Package is unscoped, so scope check doesn't apply\n\t\treturn false;\n\t}\n\n\treturn allowedScopes.includes(scope);\n}\n\n/**\n * Check if an unscoped package name is in the allowed list.\n *\n * @param packageName - The package name to check\n * @param unscopedPackages - List of allowed unscoped package names\n * @returns `true` if the unscoped package is allowed\n */\nfunction isUnscopedPackageAllowed(\n\tpackageName: string,\n\tunscopedPackages: string[] | undefined,\n): boolean {\n\tif (unscopedPackages === undefined || unscopedPackages.length === 0) {\n\t\treturn false;\n\t}\n\n\t// Only applies to unscoped packages\n\tif (isScoped(packageName)) {\n\t\treturn false;\n\t}\n\n\treturn unscopedPackages.includes(packageName);\n}\n\n/**\n * A policy that ensures packages use only allowed scopes and package names.\n *\n * This policy prevents accidental introduction of new npm scopes or unscoped packages\n * in a monorepo. It helps maintain naming consistency and prevents typos or mistakes\n * when creating new packages.\n *\n * @remarks\n *\n * The policy checks packages in the following order:\n *\n * 1. If the package is scoped (starts with `@`), check if its scope is in `allowedScopes`\n * 2. If the package is unscoped, check if it's in `unscopedPackages`\n * 3. If neither check passes, the policy fails\n *\n * The \"root\" package (common in monorepos) is automatically skipped.\n *\n * @example\n * ```typescript\n * import { makePolicy } from \"repopo\";\n * import { PackageAllowedScopes } from \"repopo/policies\";\n *\n * const config: RepopoConfig = {\n *   policies: [\n *     makePolicy(PackageAllowedScopes, {\n *       allowedScopes: [\"@myorg\", \"@internal\"],\n *       unscopedPackages: [\"legacy-package\"],\n *     }),\n *   ],\n * };\n * ```\n *\n * @alpha\n */\nexport const PackageAllowedScopes = definePackagePolicy<\n\tPackageJson,\n\tPackageAllowedScopesConfig | undefined\n>({\n\tname: \"PackageAllowedScopes\",\n\tdescription:\n\t\t\"Ensures packages use only allowed npm scopes and package names.\",\n\t// biome-ignore lint/correctness/useYield: no yield needed\n\thandler: function* (json, { file, config }) {\n\t\t// If no config provided, skip validation\n\t\tif (config === undefined) {\n\t\t\treturn true;\n\t\t}\n\n\t\tconst packageName = json.name;\n\n\t\t// Skip packages without a name\n\t\tif (packageName === undefined) {\n\t\t\treturn true;\n\t\t}\n\n\t\t// Skip the root package (common in monorepos)\n\t\tif (packageName === \"root\") {\n\t\t\treturn true;\n\t\t}\n\n\t\t// Check if the package uses an allowed scope\n\t\tif (isScopeAllowed(packageName, config.allowedScopes)) {\n\t\t\treturn true;\n\t\t}\n\n\t\t// Check if the package is an allowed unscoped package\n\t\tif (isUnscopedPackageAllowed(packageName, config.unscopedPackages)) {\n\t\t\treturn true;\n\t\t}\n\n\t\t// Package doesn't match any allowed pattern - build error message\n\t\tconst scope = getPackageScope(packageName);\n\t\tlet errorMessage: string;\n\t\tif (scope !== undefined) {\n\t\t\t// Package has an unexpected scope\n\t\t\terrorMessage = `Package \"${packageName}\" uses scope \"${scope}\" which is not in the allowed scopes list. Allowed scopes: ${config.allowedScopes?.join(\", \") ?? \"(none)\"}`;\n\t\t} else {\n\t\t\t// Package is unscoped but not in the allowed list\n\t\t\terrorMessage = `Package \"${packageName}\" is an unscoped package that is not in the allowed unscoped packages list. Allowed unscoped packages: ${config.unscopedPackages?.join(\", \") ?? \"(none)\"}`;\n\t\t}\n\n\t\tconst failResult: PolicyFailure = {\n\t\t\tname: PackageAllowedScopes.name,\n\t\t\tfile,\n\t\t\tautoFixable: false, // Can't auto-fix package names\n\t\t\terrorMessages: [errorMessage],\n\t\t};\n\t\treturn failResult;\n\t},\n});\n"]}

package/esm/policies/PackageEsmType.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Configuration for the PackageEsmType policy.
+ *
+ * This policy ensures the `type` field in package.json is correctly set
+ * to indicate whether the package is an ESM or CommonJS module.
+ *
+ * @example
+ * ```typescript
+ * const config: PackageEsmTypeConfig = {
+ *   // Require ESM type field for all packages
+ *   requiredType: "module",
+ *   // Or detect based on exports/main field
+ *   detectFromExports: true,
+ * };
+ * ```
+ *
+ * @alpha
+ */
+export interface PackageEsmTypeConfig {
+    /**
+     * The required `type` field value for all packages.
+     *
+     * - `"module"` - All packages must be ESM (use import/export)
+     * - `"commonjs"` - All packages must be CommonJS (use require)
+     * - `undefined` - Use detection logic based on exports/main
+     *
+     * @remarks
+     *
+     * If set, this overrides automatic detection. Use `detectFromExports`
+     * for more flexible per-package type detection.
+     */
+    requiredType?: "module" | "commonjs";
+    /**
+     * Detect the expected `type` field from the exports or main field.
+     *
+     * When enabled, the policy analyzes the package's entry points:
+     * - If exports use `.mjs` or have `import` conditions → `"module"`
+     * - If exports use `.cjs` or have `require` conditions → `"commonjs"`
+     * - If main field uses `.mjs` → `"module"`
+     * - If main field uses `.cjs` → `"commonjs"`
+     *
+     * @defaultValue false
+     */
+    detectFromExports?: boolean;
+    /**
+     * Package names or scopes to exclude from validation.
+     *
+     * @example
+     * ```typescript
+     * excludePackages: ["@myorg/legacy-package", "old-cjs-lib"]
+     * ```
+     */
+    excludePackages?: string[];
+    /**
+     * Behavior when module type cannot be detected from exports/main.
+     *
+     * - `"skip"` (default) - Skip validation for packages where type cannot be detected
+     * - `"warn"` - Pass validation but include a warning in the output
+     * - `"fail"` - Fail validation when type cannot be detected
+     *
+     * This only applies when `detectFromExports` is true and no `requiredType` is set.
+     *
+     * @defaultValue "skip"
+     */
+    onDetectionFailure?: "skip" | "warn" | "fail";
+}
+/**
+ * A policy that ensures the `type` field in package.json is correctly set.
+ *
+ * This policy helps maintain consistency in how packages declare their module format,
+ * which is essential for proper module resolution in Node.js and bundlers.
+ *
+ * @remarks
+ *
+ * The policy can operate in two modes:
+ *
+ * 1. **Required Type**: Set `requiredType` to enforce a specific type for all packages
+ * 2. **Detection**: Set `detectFromExports: true` to detect the expected type from
+ *    the package's exports or main field
+ *
+ * When `detectFromExports` is enabled, the policy looks for:
+ * - `.mjs` extensions or `"import"` conditions → expects `"module"`
+ * - `.cjs` extensions or `"require"` conditions → expects `"commonjs"`
+ *
+ * @example
+ * ```typescript
+ * import { makePolicy } from "repopo";
+ * import { PackageEsmType } from "repopo/policies";
+ *
+ * // Require all packages to be ESM
+ * makePolicy(PackageEsmType, { requiredType: "module" })
+ *
+ * // Or detect based on exports
+ * makePolicy(PackageEsmType, { detectFromExports: true })
+ * ```
+ *
+ * @alpha
+ */
+export declare const PackageEsmType: import("../policy.js").PolicyDefinition<PackageEsmTypeConfig | undefined>;
+//# sourceMappingURL=PackageEsmType.d.ts.map

package/esm/policies/PackageEsmType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PackageEsmType.d.ts","sourceRoot":"","sources":["../../src/policies/PackageEsmType.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,oBAAoB;IACpC;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;IAErC;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;CAC9C;AAyPD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,cAAc,2EAgEzB,CAAC"}