@bensandee/tooling 0.57.4 → 0.58.0

package/README.md

@@ -78,6 +78,28 @@ Custom blocks are anchored to the nearest preceding non-blank line. When `repo:s
 
 To skip a workflow file entirely, add `# @bensandee/tooling:ignore` as the first line — `repo:sync` will leave the file untouched.
 
+### pnpm-workspace.yaml
+
+`repo:sync` manages `pnpm-workspace.yaml` with a narrow contract — mandated keys, a few seeded-on-creation keys, and everything else passed through verbatim.
+
+**Mandated** (drift fails `repo:sync --check`):
+
+- `blockExoticSubdeps: true`
+- `minimumReleaseAge` — any non-negative number (`0` is valid)
+
+**Seeded on creation only** (free to change or remove afterward):
+
+- `minimumReleaseAgeExclude: ["@bensandee/*"]`
+- `packages: ["packages/*"]` (monorepos only)
+
+All other keys — `allowBuilds`, custom entries — are preserved verbatim through `repo:sync`. The generator emits the file for single-package repos too, not just monorepos.
+
+Opt out entirely with `"pnpmWorkspace": false` in `.tooling.json`; the generator then never inspects or writes the file.
+
+### packageManager force-bump
+
+`repo:sync` rewrites `package.json#packageManager` when an existing value is `pnpm@<N>.x` with `N < 11`, setting it to the tooling's pinned pnpm version (currently `11.1.1`). This is delivered through `repo:sync` rather than Renovate because the mandated `pnpm-workspace.yaml` keys (`blockExoticSubdeps`) require pnpm 11+. Within-major bumps (`pnpm@11.x → 11.y`) remain Renovate's job; non-pnpm package managers (yarn, npm) are out of scope.
+
 ### Repository setup
 
 | Command                   | Description                                                                                                                            |
@@ -350,6 +372,7 @@ Available override fields:
 | `releaseStrategy`    | string  | Detected from existing config, else monorepo: `"changesets"`, single: `"simple"` |
 | `projectType`        | string  | Auto-detected from `package.json` deps                                           |
 | `detectPackageTypes` | boolean | `true`                                                                           |
+| `pnpmWorkspace`      | `false` | Set to `false` to opt out of `pnpm-workspace.yaml` management                    |
 
 ## Debug logging
 

package/dist/bin.mjs

@@ -39,7 +39,8 @@ const PackageJsonSchema = z.looseObject({
 	types: z.string().optional(),
 	typings: z.string().optional(),
 	engines: StringRecord.optional(),
-	repository: z.union([z.string(), z.looseObject({ url: z.string() })]).optional()
+	repository: z.union([z.string(), z.looseObject({ url: z.string() })]).optional(),
+	packageManager: z.string().optional()
 });
 const TsconfigSchema = z.looseObject({
 	extends: z.union([z.string(), z.array(z.string())]).optional(),
@@ -644,7 +645,8 @@ const ToolingConfigSchema = z.strictObject({
 	releaseAssets: z.array(ReleaseAssetSchema).optional().meta({ description: "Custom assets to build and upload to the release" }),
 	postReleaseHook: z.string().optional().meta({ description: "Override the post-release hook command (default: POST to POST_RELEASE_HOOK_URL with HMAC-SHA256 auth)" }),
 	postReleaseHookSecrets: z.array(z.string()).optional().meta({ description: "Additional secret names to inject as env vars in the post-release hook step (e.g. ['WEBHOOK_SECRET'])" }),
-	coverage: z.union([z.literal(false), CoverageConfigSchema]).optional().meta({ description: "Coverage tracking configuration. Set to false to disable; omit for default-on (when a vitest config is present)." })
+	coverage: z.union([z.literal(false), CoverageConfigSchema]).optional().meta({ description: "Coverage tracking configuration. Set to false to disable; omit for default-on (when a vitest config is present)." }),
+	pnpmWorkspace: z.literal(false).optional().meta({ description: "Set to false to opt out of pnpm-workspace.yaml management (skips both generation and the repo:sync --check validation)." })
 });
 /** Format a Zod issue as a human-readable bullet: location + plain-English explanation. */
 function formatIssue(issue) {
@@ -1591,7 +1593,7 @@ const PER_PACKAGE_DEV_DEPS = {
 		"tsdown": "0.22.0",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
-		"pnpm": "11.0.9"
+		"pnpm": "11.1.1"
 	}["@types/node"],
 	tsdown: {
 		"@changesets/cli": "2.31.0",
@@ -1607,7 +1609,7 @@ const PER_PACKAGE_DEV_DEPS = {
 		"tsdown": "0.22.0",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
-		"pnpm": "11.0.9"
+		"pnpm": "11.1.1"
 	}["tsdown"],
 	typescript: {
 		"@changesets/cli": "2.31.0",
@@ -1623,7 +1625,7 @@ const PER_PACKAGE_DEV_DEPS = {
 		"tsdown": "0.22.0",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
-		"pnpm": "11.0.9"
+		"pnpm": "11.1.1"
 	}["typescript"],
 	vitest: {
 		"@changesets/cli": "2.31.0",
@@ -1639,7 +1641,7 @@ const PER_PACKAGE_DEV_DEPS = {
 		"tsdown": "0.22.0",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
-		"pnpm": "11.0.9"
+		"pnpm": "11.1.1"
 	}["vitest"]
 };
 /** DevDeps that belong at the root regardless of structure. */
@@ -1658,7 +1660,7 @@ const ROOT_DEV_DEPS = {
 		"tsdown": "0.22.0",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
-		"pnpm": "11.0.9"
+		"pnpm": "11.1.1"
 	}["knip"],
 	lefthook: {
 		"@changesets/cli": "2.31.0",
@@ -1674,7 +1676,7 @@ const ROOT_DEV_DEPS = {
 		"tsdown": "0.22.0",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
-		"pnpm": "11.0.9"
+		"pnpm": "11.1.1"
 	}["lefthook"],
 	oxlint: {
 		"@changesets/cli": "2.31.0",
@@ -1690,7 +1692,7 @@ const ROOT_DEV_DEPS = {
 		"tsdown": "0.22.0",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
-		"pnpm": "11.0.9"
+		"pnpm": "11.1.1"
 	}["oxlint"]
 };
 /**
@@ -1731,7 +1733,7 @@ function addReleaseDeps(deps, config) {
 				"tsdown": "0.22.0",
 				"typescript": "6.0.3",
 				"vitest": "4.1.5",
-				"pnpm": "11.0.9"
+				"pnpm": "11.1.1"
 			}["release-it"];
 			if (config.structure === "monorepo") deps["@release-it/bumper"] = {
 				"@changesets/cli": "2.31.0",
@@ -1747,7 +1749,7 @@ function addReleaseDeps(deps, config) {
 				"tsdown": "0.22.0",
 				"typescript": "6.0.3",
 				"vitest": "4.1.5",
-				"pnpm": "11.0.9"
+				"pnpm": "11.1.1"
 			}["@release-it/bumper"];
 			break;
 		case "simple":
@@ -1765,7 +1767,7 @@ function addReleaseDeps(deps, config) {
 				"tsdown": "0.22.0",
 				"typescript": "6.0.3",
 				"vitest": "4.1.5",
-				"pnpm": "11.0.9"
+				"pnpm": "11.1.1"
 			}["commit-and-tag-version"];
 			break;
 		case "changesets":
@@ -1783,7 +1785,7 @@ function addReleaseDeps(deps, config) {
 				"tsdown": "0.22.0",
 				"typescript": "6.0.3",
 				"vitest": "4.1.5",
-				"pnpm": "11.0.9"
+				"pnpm": "11.1.1"
 			}["@changesets/cli"];
 			break;
 	}
@@ -1806,8 +1808,8 @@ async function generatePackageJson(ctx) {
 	}
 	const devDeps = { ...ROOT_DEV_DEPS };
 	if (!isMonorepo) Object.assign(devDeps, PER_PACKAGE_DEV_DEPS);
-	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.11.0";
-	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.57.4";
+	devDeps["@bensandee/config"] = isWorkspacePackage(ctx, "@bensandee/config") ? "workspace:*" : "0.11.1";
+	devDeps["@bensandee/tooling"] = isWorkspacePackage(ctx, "@bensandee/tooling") ? "workspace:*" : "0.58.0";
 	if (ctx.config.useEslintPlugin) devDeps["@bensandee/eslint-plugin"] = isWorkspacePackage(ctx, "@bensandee/eslint-plugin") ? "workspace:*" : "0.13.0";
 	if (ctx.config.formatter === "oxfmt") devDeps["oxfmt"] = {
 		"@changesets/cli": "2.31.0",
@@ -1823,7 +1825,7 @@ async function generatePackageJson(ctx) {
 		"tsdown": "0.22.0",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
-		"pnpm": "11.0.9"
+		"pnpm": "11.1.1"
 	}["oxfmt"];
 	if (ctx.config.formatter === "prettier") devDeps["prettier"] = {
 		"@changesets/cli": "2.31.0",
@@ -1839,7 +1841,7 @@ async function generatePackageJson(ctx) {
 		"tsdown": "0.22.0",
 		"typescript": "6.0.3",
 		"vitest": "4.1.5",
-		"pnpm": "11.0.9"
+		"pnpm": "11.1.1"
 	}["prettier"];
 	addReleaseDeps(devDeps, ctx.config);
 	if (existing) {
@@ -1897,6 +1899,36 @@ async function generatePackageJson(ctx) {
 			pkg["engines"] = { node: ">=24.13.0" };
 			changes.push("set engines.node >= 24.13.0");
 		}
+		const pinnedPnpm = {
+			"@changesets/cli": "2.31.0",
+			"@release-it/bumper": "7.0.5",
+			"@types/node": "24.12.3",
+			"commit-and-tag-version": "12.7.1",
+			"knip": "6.12.1",
+			"lefthook": "2.1.6",
+			"oxfmt": "0.48.0",
+			"oxlint": "1.63.0",
+			"prettier": "3.8.3",
+			"release-it": "20.0.1",
+			"tsdown": "0.22.0",
+			"typescript": "6.0.3",
+			"vitest": "4.1.5",
+			"pnpm": "11.1.1"
+		}["pnpm"];
+		const desiredPm = pinnedPnpm ? `pnpm@${pinnedPnpm}` : void 0;
+		if (desiredPm) {
+			const currentPm = pkg.packageManager;
+			if (!currentPm) {
+				pkg.packageManager = desiredPm;
+				changes.push(`set packageManager: ${desiredPm}`);
+			} else {
+				const match = /^pnpm@(\d+)\./.exec(currentPm);
+				if (match && Number(match[1]) < 11) {
+					pkg.packageManager = desiredPm;
+					changes.push(`bumped packageManager: ${currentPm} → ${desiredPm}`);
+				}
+			}
+		}
 		if (changes.length === 0) return {
 			filePath,
 			action: "skipped",
@@ -1933,7 +1965,7 @@ async function generatePackageJson(ctx) {
 			"tsdown": "0.22.0",
 			"typescript": "6.0.3",
 			"vitest": "4.1.5",
-			"pnpm": "11.0.9"
+			"pnpm": "11.1.1"
 		}["pnpm"]}`
 	};
 	ctx.write(filePath, JSON.stringify(pkg, null, 2) + "\n");
@@ -3842,26 +3874,92 @@ async function generateRenovate(ctx) {
 }
 //#endregion
 //#region src/generators/pnpm-workspace.ts
-const WORKSPACE_YAML = `packages:
+const FILE_PATH = "pnpm-workspace.yaml";
+const DEFAULT_MIN_RELEASE_AGE = 1440;
+const FRESH_MONOREPO = `packages:
   - "packages/*"
+
+blockExoticSubdeps: true
+
+minimumReleaseAge: ${DEFAULT_MIN_RELEASE_AGE}
+minimumReleaseAgeExclude:
+  - "@bensandee/*"
 `;
+const FRESH_SINGLE = `blockExoticSubdeps: true
+
+minimumReleaseAge: ${DEFAULT_MIN_RELEASE_AGE}
+minimumReleaseAgeExclude:
+  - "@bensandee/*"
+`;
+/** Minimal projection of `.tooling.json` needed by this generator. */
+const PnpmWorkspaceOptOutSchema = z.object({ pnpmWorkspace: z.literal(false).optional() });
+function isPnpmWorkspaceDisabled(ctx) {
+	const raw = ctx.read(".tooling.json");
+	if (!raw) return false;
+	try {
+		const result = PnpmWorkspaceOptOutSchema.safeParse(JSON.parse(raw));
+		return result.success && result.data.pnpmWorkspace === false;
+	} catch {
+		return false;
+	}
+}
+/**
+* Apply managed-key contract to an existing doc. Returns the list of changes made.
+*
+* Mandated:
+*   - `blockExoticSubdeps: true`
+*   - `minimumReleaseAge`: any non-negative number; seeded to 1440 if missing/invalid.
+*
+* Not enforced (left alone after creation):
+*   - `minimumReleaseAgeExclude`
+*   - everything else (`packages`, `allowBuilds`, etc.)
+*/
+function applyManagedKeys(doc) {
+	const changes = [];
+	if (doc.get("blockExoticSubdeps") !== true) {
+		doc.set("blockExoticSubdeps", true);
+		changes.push("set blockExoticSubdeps: true");
+	}
+	const minAge = doc.get("minimumReleaseAge");
+	if (typeof minAge !== "number" || !Number.isFinite(minAge) || minAge < 0) {
+		doc.set("minimumReleaseAge", DEFAULT_MIN_RELEASE_AGE);
+		changes.push(`set minimumReleaseAge: ${DEFAULT_MIN_RELEASE_AGE}`);
+	}
+	return changes;
+}
 async function generatePnpmWorkspace(ctx) {
-	const filePath = "pnpm-workspace.yaml";
-	if (ctx.config.structure !== "monorepo") return {
-		filePath,
+	if (isPnpmWorkspaceDisabled(ctx)) return {
+		filePath: FILE_PATH,
 		action: "skipped",
-		description: "Not a monorepo"
+		description: "pnpmWorkspace: false in .tooling.json"
 	};
-	if (ctx.exists(filePath)) return {
-		filePath,
+	const isMonorepo = ctx.config.structure === "monorepo";
+	const existing = ctx.read(FILE_PATH);
+	if (existing === void 0) {
+		ctx.write(FILE_PATH, isMonorepo ? FRESH_MONOREPO : FRESH_SINGLE);
+		return {
+			filePath: FILE_PATH,
+			action: "created",
+			description: "Generated pnpm-workspace.yaml"
+		};
+	}
+	const doc = parseDocument(existing);
+	if (doc.errors.length > 0) return {
+		filePath: FILE_PATH,
 		action: "skipped",
-		description: "pnpm-workspace.yaml already exists"
+		description: `Could not parse existing pnpm-workspace.yaml: ${doc.errors[0]?.message ?? "unknown error"}`
 	};
-	ctx.write(filePath, WORKSPACE_YAML);
+	const changes = applyManagedKeys(doc);
+	if (changes.length === 0) return {
+		filePath: FILE_PATH,
+		action: "skipped",
+		description: "Already up to spec"
+	};
+	ctx.write(FILE_PATH, doc.toString());
 	return {
-		filePath,
-		action: "created",
-		description: "Generated pnpm-workspace.yaml"
+		filePath: FILE_PATH,
+		action: "updated",
+		description: changes.join(", ")
 	};
 }
 //#endregion
@@ -4718,7 +4816,7 @@ async function runGenerators(ctx) {
 function generateMigratePrompt(results, config, detected) {
 	const sections = [];
 	const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.57.4 repo:sync\` on ${timestamp}_\n`);
+	sections.push(`# Migration Prompt\n\n_Generated by \`@bensandee/tooling@0.58.0 repo:sync\` on ${timestamp}_\n`);
 	const changed = results.filter((r) => r.action === "created" || r.action === "updated" || r.action === "archived");
 	if (changed.length > 0) {
 		const items = changed.map((r) => {
@@ -8173,7 +8271,7 @@ const out = (msg) => console.log(msg);
 const main = defineCommand({
 	meta: {
 		name: "bst",
-		version: "0.57.4",
+		version: "0.58.0",
 		description: "Bootstrap and maintain standardized TypeScript project tooling"
 	},
 	subCommands: {
@@ -8245,7 +8343,7 @@ const main = defineCommand({
 		})
 	}
 });
-console.log(`@bensandee/tooling v0.57.4`);
+console.log(`@bensandee/tooling v0.58.0`);
 async function run() {
 	await runMain(main);
 	process.exit(process.exitCode ?? 0);

package/dist/index.d.mts

@@ -18,6 +18,7 @@ declare const PackageJsonSchema: z.ZodObject<{
   repository: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
     url: z.ZodString;
   }, z.core.$loose>]>>;
+  packageManager: z.ZodOptional<z.ZodString>;
 }, z.core.$loose>;
 type PackageJson = z.infer<typeof PackageJsonSchema>;
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bensandee/tooling",
-  "version": "0.57.4",
+  "version": "0.58.0",
   "description": "CLI tool to bootstrap and maintain standardized TypeScript project tooling",
   "license": "MIT",
   "repository": {
@@ -55,7 +55,7 @@
     "release-it": "20.0.1",
     "tsdown": "0.22.0",
     "@bensandee/claude-hooks": "0.7.4",
-    "@bensandee/config": "0.11.0"
+    "@bensandee/config": "0.11.1"
   },
   "scripts": {
     "build": "tsdown",

package/tooling.schema.json

@@ -258,6 +258,11 @@
           "additionalProperties": false
         }
       ]
+    },
+    "pnpmWorkspace": {
+      "description": "Set to false to opt out of pnpm-workspace.yaml management (skips both generation and the repo:sync --check validation).",
+      "type": "boolean",
+      "const": false
     }
   },
   "additionalProperties": false