app/core/service/PackageVersionFileService.ts (3)

61-63: Prefer Set over string[] for large-scope whitelist lookups.
includes() is O(n) and this check can be on a hot path; Set#has() is O(1) and avoids accidental duplicates.

-  // allow large package scopes, e.g. ['@foo', '@bar']
-  #unpkgWhiteListAllowLargeScopes: string[] = [];
+  // allow large package scopes, e.g. ['@foo', '@bar']
+  #unpkgWhiteListAllowLargeScopes = new Set<string>();

---

90-129: Log message doesn’t reflect the new “large scopes” whitelist + consider narrowing any here.
You now track allowLargeScopes, but the info log still only reports “large packages”, so operators can’t confirm scope rollout from logs. Also, the repeated as any casts make schema drift easy to miss.

-    this.#unpkgWhiteListAllowLargeScopes = manifest.allowLargeScopes ?? ([] as any);
+    this.#unpkgWhiteListAllowLargeScopes = new Set<string>((manifest.allowLargeScopes ?? []) as string[]);
     this.logger.info(
-      '[PackageVersionFileService.updateUnpkgWhiteList] version:%s, total %s packages, %s scopes, %s large packages',
+      '[PackageVersionFileService.updateUnpkgWhiteList] version:%s, total %s packages, %s scopes, %s large packages, %s large scopes',
       whiteListPackageVersion,
       Object.keys(this.#unpkgWhiteListAllowPackages).length,
       this.#unpkgWhiteListAllowScopes.length,
       Object.keys(this.#unpkgWhiteListAllowLargePackages).length,
+      this.#unpkgWhiteListAllowLargeScopes.size,
     );

---

131-144: Consider converting allowLargeScopes to Set<string> for consistent type usage across the codebase, but the current Array.includes() implementation is functionally correct.

The whitelist membership checks would benefit from using Set for O(1) lookup performance, particularly if whitelist sizes grow. However, this requires updating both the type declaration and the method call:

• Type: #unpkgWhiteListAllowLargeScopes: Set<string> = new Set();
• Assignment: this.#unpkgWhiteListAllowLargeScopes = new Set(manifest.allowLargeScopes ?? []);
• Check: if (this.#unpkgWhiteListAllowLargeScopes.has(pkgScope)) return true;

The current string[] with .includes() is not incorrect, but if converting to Set, ensure consistency with how #unpkgWhiteListAllowScopes and #unpkgWhiteListAllowLargePackages are handled. Regarding scope normalization: pkgScope is already in standard format from upstream callers and getFullname() already handles empty scope cases, so explicit normalization in this method is unnecessary.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

app/core/service/PackageVersionFileService.ts:128

• The logger.info message on line 122-127 should be updated to include the count of allowLargeScopes. The message currently logs "total %s packages, %s scopes, %s large packages" but doesn't include information about the newly introduced allowLargeScopes field. This makes it inconsistent with the data being loaded and harder to debug/monitor the white list configuration.

Consider updating the log message to include the allowLargeScopes count, similar to how allowScopes is logged.

    this.logger.info(
      '[PackageVersionFileService.updateUnpkgWhiteList] version:%s, total %s packages, %s scopes, %s large packages',
      whiteListPackageVersion,
      Object.keys(this.#unpkgWhiteListAllowPackages).length,
      this.#unpkgWhiteListAllowScopes.length,
      Object.keys(this.#unpkgWhiteListAllowLargePackages).length,
    );