Policy file

Policy lives in .rn-doctor.yml at the repo root (or wherever --policy points). Everything is optional — omitted keys use the defaults shown here, so an empty or absent file means "the default policy", and a one-line file changes exactly one thing.

rules:
  newArchitecture: error        # directory says "does not support New Arch"
  newArchUnknown: warn          # support unknown — missing data warns, not errors
  lastPublish:                  # staleness of the latest npm publish
    warnMonths: 12
    errorMonths: 24             # or the string "off"
  githubArchived: error         # GitHub repository is archived
  npmDeprecated: error          # latest version deprecated on npm
  directoryUnmaintained: warn   # RN Directory "unmaintained" flag
 
scope: rn-native-only           # or all-deps
 
allow: []                       # see the Allowlist page

Each rule takes error | warn | off; lastPublish takes thresholds or "off".

Validation is strict on purpose#

Unknown keys — a misspelled rule, a stray top-level key — are rejected with an error naming the offending key, and the run exits 2 (tool failure). A typo'd policy must never silently weaken the gate: newArchitecure: off failing loudly is a feature.

The same applies to --policy pointing at a missing file: that's an error, not a silent fallback to defaults.

New Architecture verdicts#

Support data is imperfect, so verdicts are tiered rather than binary:

The distinction matters: "the directory says this package doesn't support New Arch" is a claim with evidence; "we don't know" is not, and the default policy treats them differently.

Scope#

rn-native-only (default) checks packages that couple to React Native: listed in the RN Directory, peer-depending on react-native, or shipping android/ios directories. Pure-JS utility packages are skipped — lodash being two years quiet is not a React Native problem. all-deps checks everything under dependencies.

devDependencies are never checked in either scope; they don't ship in your app.