Drop the private workspace reservation from public mapsight

.github/workflows/ci.yml

@@ -285,23 +285,6 @@ jobs:
         env:
           GITHUB_STEP_SUMMARY: /dev/null
 
-  no-private-leak:
-    name: No private leak
-    timeout-minutes: 2
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-          submodules: false
-          fetch-depth: 0 # setup action needs PR base SHA for turbo affected comparisons
-
-      - uses: $/.github/actions/setup/
-
-      - name: Check for private content on public branch
-        run: pnpm run check:no-private-leak -- --mode workspace --visibility auto
-
   check:
     name: Repository checks
     timeout-minutes: 2
@@ -551,7 +534,6 @@ jobs:
         starters-copy-out,
         ssr-sidecar-image,
         lint-dependencies,
-        no-private-leak,
         zizmor,
         check-changeset,
       ]

.husky/pre-commit

@@ -1,4 +1,3 @@
 #!/usr/bin/env sh
 
 pnpm run lint-staged
-node scripts/check-no-private-leak.mts --mode staged --visibility auto

.husky/pre-push

@@ -51,5 +51,3 @@ if [ -n "$blocked" ]; then
 	printf 'Blocked branch(es):%s\n' "$blocked"
 	exit 1
 fi
-
-printf '%s' "$push_data" | node scripts/check-no-private-leak.mts --mode push --visibility public --remote "$remote"

configs/lint-staged.mts

@@ -6,23 +6,14 @@ import type {Configuration} from "lint-staged";
 type PackageInfo = {
 	filter: string;
 	relativePath: string;
-	workspaceDir: "packages" | "apps" | "private/packages" | "private/apps";
+	workspaceDir: "packages" | "apps";
 };
 
 export const PRETTIER_WRITE = "pnpx prettier --write";
 
 const toRepoRelativePath = (filePath: string): string => {
 	const parts = path.normalize(filePath).split(path.sep).filter(Boolean);
 
-	const privateIdx = parts.indexOf("private");
-	if (
-		privateIdx !== -1 &&
-		(parts[privateIdx + 1] === "apps" ||
-			parts[privateIdx + 1] === "packages")
-	) {
-		return parts.slice(privateIdx).join(path.sep);
-	}
-
 	const packagesIdx = parts.indexOf("packages");
 	if (packagesIdx !== -1) {
 		return parts.slice(packagesIdx).join(path.sep);
@@ -39,24 +30,6 @@ const toRepoRelativePath = (filePath: string): string => {
 export const getPackageInfo = (filePath: string): PackageInfo | null => {
 	const parts = toRepoRelativePath(filePath).split(path.sep);
 
-	if (
-		parts[0] === "private" &&
-		(parts[1] === "apps" || parts[1] === "packages") &&
-		parts[2]
-	) {
-		const relativePath = parts.slice(3).join(path.sep);
-		if (!relativePath) {
-			return null;
-		}
-
-		return {
-			filter: parts[2],
-			relativePath,
-			workspaceDir: `${parts[0]}/${parts[1]}` as
-				"private/packages" | "private/apps",
-		};
-	}
-
 	if ((parts[0] === "packages" || parts[0] === "apps") && parts[1]) {
 		const relativePath = parts.slice(2).join(path.sep);
 		if (!relativePath) {

configs/lint-staged.test.mts

@@ -16,17 +16,6 @@ describe("getPackageInfo", () => {
 		});
 	});
 
-	it("resolves private package paths", () => {
-		assert.deepEqual(
-			getPackageInfo("/repo/private/packages/foo/src/index.ts"),
-			{
-				filter: "foo",
-				relativePath: "src/index.ts",
-				workspaceDir: "private/packages",
-			},
-		);
-	});
-
 	it("returns null for paths outside packages or apps", () => {
 		assert.equal(getPackageInfo("/repo/scripts/check.mts"), null);
 	});

docs/development/LINKED_HOST_APPS.md

@@ -6,8 +6,8 @@ pre-OSS migration / parity work.
 
 ## Prefer a stable checkout
 
-Point `link:../mapsight/packages/...` at a **stable** tree (`main` or
-`private/develop`), not an ephemeral PR worktree under `mapsight-worktrees/`.
+Point `link:../mapsight/packages/...` at a **stable** tree (`main`), not an
+ephemeral PR worktree under `mapsight-worktrees/`.
 Worktrees disappear after merge and leave broken Vite/Sass absolute paths
 (e.g. missing `ol/ol.css` still resolving into a deleted directory).
 
@@ -56,17 +56,3 @@ pnpm worktrees:stale
 ```
 
 Does not delete anything. Skips `private/*` and `wip/*` branches.
-
-## Private sync
-
-When this checkout includes `private/`, integrate public `main` **into**
-private branches only — see [`private/README.md`](../../private/README.md)
-(if present):
-
-```bash
-git fetch origin
-git switch private/develop
-git merge origin/main
-pnpm install
-git push private private/develop
-```

docs/development/STANDARDS.md

@@ -75,7 +75,7 @@ Pre-commit: Husky runs `lint-staged` on staged files.
 
 | Script                          | Purpose                                                     |
 | ------------------------------- | ----------------------------------------------------------- |
-| `check:no-private-leak`         | No `private/` paths on public branches; lockfile importers  |
+| `check:starter-pins`            | Starter apps pin published `@mapsight/*` (no workspace:)    |
 | `check:node-ts-runtime`         | Node scripts use plain `node file.ts` — no ts-node/tsx/jiti |
 | `check:typecheck-test-coverage` | Packages with tests must include them in `tsconfig.json`    |
 
@@ -102,34 +102,6 @@ Aligned with [Decision 005](../architecture/decisions/005-fetch-and-tanstack-que
 
 ---
 
-## Private workspace
-
-Mapsight is open source, but some development still happens outside this tree. The monorepo reserves workspace paths for
-that (`private/apps/*`, `private/packages/*` in [`pnpm-workspace.yaml`](../../pnpm-workspace.yaml)) without publishing
-anything under `private/` here.
-
-On checkouts that include a private workspace:
-
-- Never leak customer-specific deployment details into public paths (`apps/`, `packages/`, `docs/`, root config, CI,
-  hooks, etc.)
-- `pnpm run check:no-private-leak` enforces on public branches; `pnpm-lock.yaml` must not list importers under
-  `private/` on public branches
-- On **`private/*` branches**, these checks are skipped
-- Merge direction: integrate **open source into private**, not the reverse — see [
-  `private/README.md`](../../private/README.md)
-  when present
-
-To prevent accidental leaks, this repository enforces checks locally and in CI:
-
-- Git hooks: [`.husky/pre-commit`](../../.husky/pre-commit), [`.husky/pre-push`](../../.husky/pre-push)
-- Script: [`scripts/check-no-private-leak.mts`](../../scripts/check-no-private-leak.mts) —
-  `pnpm run check:no-private-leak`
-- CI: `no-private-leak` job in [`.github/workflows/ci.yml`](../../.github/workflows/ci.yml)
-
-**Please do not open pull requests that remove or weaken these guards.**
-
----
-
 ## Project docs
 
 - Architecture, integration, and contributor docs live in `docs/`

package.json

@@ -42,8 +42,7 @@
 	},
 	"scripts": {
 		"build": "turbo build",
-		"check": "run-p check:no-private-leak check:starter-pins",
-		"check:no-private-leak": "node scripts/check-no-private-leak.mts",
+		"check": "pnpm run check:starter-pins",
 		"check:starter-pins": "node scripts/check-starter-package-pins.mts",
 		"check:typecheck-test-coverage": "node scripts/check-typecheck-test-coverage.mts",
 		"clean": "turbo clean",

pnpm-workspace.yaml

@@ -2,8 +2,6 @@ minimumReleaseAge: 1440
 packages:
   - "packages/*"
   - "apps/*"
-  - "private/apps/*"
-  - "private/packages/*"
   - "starters/*"
 allowBuilds:
   "@parcel/watcher": true