Add configurable strict checks for legacy package.json fields

[Copilot]

Implementation Complete ✅

Updated the changeset to comprehensively describe the entire PR, not just the last commit.

Changeset Now Includes:

• All new strict options added (noPackageJsonMain, noPackageJsonModule, noPackageJsonBrowser, noPackageJsonTypesVersions, preferModuleType)
• Purpose of each option with clear explanations
• Note that all checks default to warn level
• Breaking changes: removal of alwaysPackageJsonMain option
• Note about types field still being required

The changeset now provides a complete overview of this feature for users reviewing the changelog.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Ban main and module fields in package.json when --strict</issue_title>
<issue_description>All currently supported versions of Node.js, as well as modern bundlers, support the exports field in package.json. There's no longer a need for the root level main and module fields.

The same is true for the browser top level field, the browser condition in conditional exports is a better option.

The --check and --strict flags in pkg-utils should start failing when these fields are present, with a descriptive message for why they are no longer needed/used.

The same is true for the typesVersions field, typescript has long supported conditional exports and the types condition and it should throw by default if it's found.

The top-level types field needs to stay, as https://npmjs.com still requires it in order to show a npm package listing as typescript native.

These new checks should be configurable (like the other strict checks already are), so that it's possible to turn them off.

Finally, a new strict error should warn (not throw error) if type is missing, or if it's commonjs. The next major of pkg-utils will require and only support "type": "module".</issue_description>

<agent_instructions>Update existing tests, and feel free to add new tests that may require new packages in the ./playground workspace</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Ban main and module fields in package.json when --strict #2201

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[changeset-bot]

🦋 Changeset detected

Latest commit: d8e6318

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sanity/pkg-utils	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[stipsan]

@copilot you got some failing checks there buddy

[Copilot]

@copilot you got some failing checks there buddy

All checks are now passing! ✅

• Build: successful
• Tests: 93 passed, 10 skipped (103 total)
• Lint: 0 warnings, 0 errors
• Typecheck: passing

The implementation is working as expected with all new strict checks defaulting to warnings.

[stipsan]

@copilot remove the alwaysPackageJsonMain rule

[Copilot]

@copilot remove the alwaysPackageJsonMain rule

Done! Removed the alwaysPackageJsonMain rule completely in commit e28e3cb.

The rule has been removed from:

• Strict options schema
• StrictOptions interface
• parseExports.ts check
• Test snapshots

All tests passing ✅

[stipsan]

@copilot Use PackageJson in the new rule names, instead of TopLevel. And run pnpm add changeset and make sure you have a changelog entry for this change

[Copilot]

@copilot Use PackageJson in the new rule names, instead of TopLevel. And run pnpm add changeset and make sure you have a changelog entry for this change

Done! Renamed all strict options to use PackageJson prefix instead of RootLevel in commit a18e856.

Changes:

• noRootLevelMain → noPackageJsonMain
• noRootLevelModule → noPackageJsonModule
• noRootLevelBrowser → noPackageJsonBrowser
• noRootLevelTypesVersions → noPackageJsonTypesVersions

Also added a changeset file (.changeset/rename-strict-options.md) documenting this as a minor breaking change.

All tests passing ✅

[stipsan]

@copilot the changeset entry should reflect the entire PR, not the last commit

[Copilot]

Updated the changeset in commit d8e6318 to reflect the entire PR:

• Documents all 5 new strict options added
• Explains the purpose and default behavior (warn)
• Lists breaking changes (removal of alwaysPackageJsonMain)
• Notes that types field is still required for npm listings

The changeset now provides a comprehensive overview of the feature for the changelog.