Config

Prefer inrepo.json at the project root:

{
  "packages": [
    {
      "name": "example-package",
      "git": "https://github.com/owner/repo",
      "ref": "main",
      "dev": false,
      "keep": ["src", "package.json"],
      "exclude": ["test", "/\\.snap$/"]
    }
  ],
  "keep": ["LICENSE"],
  "exclude": [".github"]
}

You can also put the same object under package.json#inrepo. A bare array of package entries is accepted, but only the object form can carry root keep or exclude lists.

{
  "dependencies": {
    "example-package": "file:inrepo_modules/example-package"
  },
  "inrepo": {
    "packages": [
      {
        "name": "example-package",
        "git": "https://github.com/owner/repo"
      }
    ]
  }
}

Package fields:

Field	Meaning
`name`	Package name and destination under `inrepo_modules/`.
`git`	Optional git clone URL. Required when npm registry lookup cannot resolve a GitHub repository.
`ref`	Optional branch, tag, or commit to pin before resolving the lockfile commit.
`dev`	When `true`, sync wires the root `package.json#devDependencies`; otherwise it uses `dependencies`.
`keep`	Optional allowlist of relative path prefixes to retain before exclusions run.
`exclude`	Optional relative paths or slash-delimited regexes to remove from the vendored tree.

Root and per-package keep lists are merged. Root and per-package exclude lists are also merged.

Filtering always runs in this order:

keep limits the vendored tree to matching paths.
exclude removes paths from what remains.

If keep is set, list every root file you still need, such as package.json or LICENSE. Nothing is kept implicitly.

inrepo add <package> updates config by default after a successful checkout. Use --no-save for a one-off vendoring operation that should not upsert config.