@ck0/pnpm-plugin-config 1.0.0

package/README.md

@@ -0,0 +1,58 @@
+# @ck0/pnpm-plugin-config
+
+A pnpm **config dependency** that re-applies the settings pnpm 11 stopped
+reading from a *global* `~/.config/pnpm/config.yaml`. pnpm 11 ignores these in a
+global config file (it warns *"cannot be set in the global config file … move
+them to a project-level pnpm-workspace.yaml … to share across projects use
+config dependencies"*), so the intended strictness silently stopped applying.
+
+This package is the "share across projects" path: one pinned source of truth,
+distributed via the npm registry (config dependencies require an integrity hash,
+so a `file:`/`workspace:` spec is rejected).
+
+## Settings it applies
+
+Via a `pnpmfile.mjs` `updateConfig` hook:
+
+| setting | value | why |
+|---|---|---|
+| `hoistPattern` | `[]` | no hoisting — packages import only what they declare |
+| `dedupePeerDependents` | `true` | single-instance peers across the workspace |
+| `resolvePeersFromWorkspaceRoot` | `true` | one react/etc. for the whole workspace |
+| `dedupePeers` | `true` | version-only peer suffixes, fewer dup instances |
+| `dedupeDirectDeps` | `true` | don't re-symlink root-linked deps into subprojects |
+| `ignorePatchFailures` | `false` | a stale patch is a hard failure, never silent |
+| `enablePrePostScripts` | `false` | `pnpm foo` runs foo only, no pre/post chaining |
+
+## Why the name is `@ck0/pnpm-plugin-config`
+
+pnpm **auto-loads** a config dependency's `pnpmfile.mjs` only when the package
+name matches `pnpm-plugin-*`, `@*/pnpm-plugin-*`, or `@pnpm/plugin-*`. With this
+name, consuming repos need **no local `.pnpmfile.mjs`** — just the
+`configDependencies` entry.
+
+## Consuming it (each repo)
+
+In `pnpm-workspace.yaml`:
+
+```yaml
+configDependencies:
+  "@ck0/pnpm-plugin-config": "1.0.0"   # exact version — ranges are rejected
+```
+
+Because config dependencies resolve from the registry, the global
+`minimumReleaseAge` (10-day) cooldown would otherwise block a fresh publish.
+Exempt this package in the global `~/.config/pnpm/config.yaml`:
+
+```yaml
+minimumReleaseAgeExclude:
+  - "@ck0/pnpm-plugin-config"   # or "@ck0/*"
+```
+
+## Maintenance
+
+This is **not a workspace member** (it's excluded from the `packages:` globs in
+`pnpm-workspace.yaml`): it has no build/deps, is consumed from npm rather than
+via `workspace:`, and lives here only so it's versioned and published from one
+place. To change a setting: edit `pnpmfile.mjs`, bump `version`, `pnpm publish`,
+then bump the `configDependencies` pin in each repo.

package/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@ck0/pnpm-plugin-config",
+  "version": "1.0.0",
+  "description": "pnpm config-dependency plugin: re-applies the settings pnpm 11 no longer reads from a global ~/.config/pnpm/config.yaml, so they apply per-project from one pinned source. Auto-loaded by pnpm because the name matches @*/pnpm-plugin-*.",
+  "keywords": [
+    "pnpm",
+    "pnpm-plugin",
+    "config-dependency",
+    "pnpmfile"
+  ],
+  "license": "MIT",
+  "author": "Chirayu Krishnappa",
+  "type": "module",
+  "files": [
+    "pnpmfile.mjs",
+    "README.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/pnpmfile.mjs

@@ -0,0 +1,28 @@
+// pnpm config-dependency plugin. pnpm auto-loads this file because the package
+// name matches the `@*/pnpm-plugin-*` pattern; consuming repos only need a
+// `configDependencies` entry (no local pnpmfile).
+//
+// Purpose: re-apply the pnpm settings that pnpm 11 refuses to read from a
+// *global* ~/.config/pnpm/config.yaml (it warns "cannot be set in the global
+// config file"). Without this, the intended strictness (no-hoist,
+// patch-failure-is-error, etc.) silently stops applying. The `updateConfig`
+// hook receives pnpm's resolved settings object and returns it mutated; keys
+// are camelCase, matching pnpm's setting names.
+export const hooks = {
+    updateConfig(config) {
+        return Object.assign(config, {
+            // No hoisting: packages may import only what they declare.
+            hoistPattern: [],
+            // Single-instance peer guarantees across the workspace.
+            dedupePeerDependents: true,
+            resolvePeersFromWorkspaceRoot: true,
+            dedupePeers: true,
+            dedupeDirectDeps: true,
+            // A patch that no longer applies is a hard failure, never a
+            // silent skip.
+            ignorePatchFailures: false,
+            // `pnpm foo` runs foo only — no implicit pre/post chaining.
+            enablePrePostScripts: false,
+        });
+    },
+};