pnpm/pnpm: a plugin's package rules, without the plugin

pnpm keeps 201 workspace packages consistent with a 499-line plugin that rewrites every package.json on install. Its rules that set a fixed value, such as the MIT license, become JSON path rules; the computed ones stay with the plugin. This config was written to test alint; pnpm doesn't use alint.

The config

Two of the husky hooks are guardrails for coding agents: one refuses an amend from Claude Code, and the pre-commit hook stops it from committing on main. The config checks those hooks, the strict options in pnpm-workspace.yaml, the package fields meta-updater sets to fixed values, a tsconfig.json in every package and the changeset files. pnpm has since grown a Rust half, which the config checks too, and meta-updater itself runs from a command_idempotent rule.

.alint.yml

- id: pnpm-package-license-mit
  # fixed here: also covers the nested package groups
  when: facts.has_pnpm_workspace
  kind: json_path_matches
  paths:
    include:
      - "{agent,auth,bins,building,cache,catalogs,cli,config,core,crypto,deps,engine,exec,fetching,fs,global,hooks,installing,lockfile,modules-mounter,network,object,patching,pkg-manifest,registry-access,releasing,resolving,shell,store,testing,text,workspace,yaml}/*/package.json"
      - "{deps/compliance,deps/inspection,deps/security,engine/pm,engine/runtime,installing/dedupe,installing/linking,pnpm/artifacts,resolving/registry}/*/package.json"
      - "{pnpm,worker}/package.json"
    exclude: ["**/example/**", "**/test/**"]
  path: "$.license"
  matches: '^MIT$'
  level: warning

One of meta-updater's rules: every package is MIT-licensed. The type, engines.node, repository, funding and keyword rules work the same way.

.alint.yml

- id: pnpm-minimum-release-age
  # fixed here: the value is a number, which a regex can't match, so the rule reads the line
  when: facts.has_pnpm_workspace
  kind: file_content_matches
  paths: "pnpm-workspace.yaml"
  pattern: '(?m)^minimumReleaseAge:\s*[1-9][0-9]*\b'
  level: warning

One of the supply-chain options: pnpm won't install a package published less than minimumReleaseAge minutes ago. Four more rules keep the other strict options on.

.alint.yml

- id: pnpm-pre-commit-blocks-claude-main
  kind: file_content_matches
  paths: ".husky/pre-commit"
  pattern: 'CLAUDECODE'
  level: info

The pre-commit hook checks CLAUDECODE to stop an agent committing on main. This rule makes sure the guard stays in the hook.

What stays outside alint

What meta-updater computes stays with meta-updater:

sorted dependencies. alint's JSON rules compare values and ignore key order;
the 11 packages whose scripts meta-updater special-cases by name;
the release, dist-tag, benchmark, CodeQL and Docker workflows, which do work rather than check the tree.