@savvy-web/pnpm-plugin-silk 0.2.0 → 0.3.0

package/README.md

@@ -6,19 +6,20 @@
 [![pnpm](https://img.shields.io/badge/pnpm-%3E%3D10-orange)](https://pnpm.io/)
 
 Centralized dependency version management for the Silk ecosystem via pnpm
-config dependencies. Share curated dependency catalogs, patches, and overrides
-across multiple repositories from a single source of truth.
+config dependencies. Share curated dependency catalogs, security overrides,
+and build configurations across multiple repositories from a single source
+of truth.
 
 ## Features
 
 - **Dual catalog strategy** - Current versions for direct dependencies
   (`catalog:silk`), permissive ranges for peer dependencies (`catalog:silkPeers`)
-- **Non-destructive merging** - Plugin catalogs merge with local definitions;
-  local entries always take precedence
-- **Override warnings** - Clear console output when local versions override
-  Silk-managed defaults
-- **Zero runtime dependencies** - Self-contained CommonJS bundle that pnpm loads
-  directly
+- **Security overrides** - Centralized CVE fixes via `silkOverrides` that
+  propagate to all consuming repositories
+- **Build configuration sync** - Shared `onlyBuiltDependencies` and
+  `publicHoistPattern` settings
+- **Non-destructive merging** - Local definitions always take precedence with
+  clear warnings for divergences
 
 ## Installation
 
@@ -33,12 +34,9 @@ hash:
 
 ```yaml
 configDependencies:
-  "@savvy-web/pnpm-plugin-silk": "0.1.0+sha512-abc123..."
+  "@savvy-web/pnpm-plugin-silk": "0.2.0+sha512-..."
 ```
 
-> **Note:** Config dependencies require exact versions with SHA-512 integrity
-> checksums. The `pnpm add --config` command generates this automatically.
-
 ## Quick Start
 
 Reference Silk catalogs in your `package.json`:
@@ -55,9 +53,10 @@ Reference Silk catalogs in your `package.json`:
 }
 ```
 
-The `silk` catalog provides current/latest versions for your direct
-dependencies, while `silkPeers` provides permissive ranges that allow consumers
-to use older compatible versions.
+The `silk` catalog provides current/latest versions for direct dependencies,
+while `silkPeers` provides permissive ranges for peer dependencies. Security
+overrides, build script allowlists, and hoist patterns are automatically
+merged during `pnpm install`.
 
 ## More Information
 

package/index.cjs

@@ -30,7 +30,7 @@ const silkCatalogs = {
         "@changesets/cli": "^2.29.8",
         "@commitlint/cli": "^20.4.1",
         "@commitlint/config-conventional": "^20.4.1",
-        "@microsoft/api-extractor": "^7.56.0",
+        "@microsoft/api-extractor": "^7.56.2",
         "@rslib/core": "^0.19.4",
         "@types/node": "^25.2.0",
         "@typescript/native-preview": "^7.0.0-dev.20260203.1",
@@ -49,7 +49,7 @@ const silkCatalogs = {
         "@biomejs/biome": "^2.3.12",
         "@commitlint/cli": "^20.4.1",
         "@commitlint/config-conventional": "^20.4.1",
-        "@microsoft/api-extractor": "^7.55.2",
+        "@microsoft/api-extractor": "^7.56.2",
         "@types/node": "^25.0.10",
         "@typescript/native-preview": "^7.0.0-dev.20260124.1",
         commitizen: "^4.3.1",
@@ -60,7 +60,29 @@ const silkCatalogs = {
         "@isaacs/brace-expansion": ">=5.0.1",
         lodash: ">=4.17.23",
         tmp: ">=0.2.4"
-    }
+    },
+    silkOnlyBuiltDependencies: [
+        "@parcel/watcher",
+        "@savvy-web/commitlint",
+        "@savvy-web/lint-staged",
+        "core-js",
+        "esbuild",
+        "msgpackr-extract"
+    ],
+    silkPublicHoistPattern: [
+        "@commitlint/cli",
+        "@commitlint/config-conventional",
+        "@commitlint/cz-commitlint",
+        "@microsoft/api-extractor",
+        "@rslib/core",
+        "@typescript/native-preview",
+        "husky",
+        "lint-staged",
+        "markdownlint-cli2",
+        "markdownlint-cli2-formatter-codequality",
+        "turbo",
+        "typescript"
+    ]
 };
 exports.silkCatalogs = __webpack_exports__.silkCatalogs;
 for(var __rspack_i in __webpack_exports__)if (-1 === [

package/index.d.ts

@@ -77,6 +77,16 @@ export declare interface SilkCatalogs {
      * Synced to pnpm `overrides` configuration.
      */
     readonly silkOverrides: Catalog;
+    /**
+     * Packages allowed to run build scripts during install.
+     * Synced to pnpm `onlyBuiltDependencies` configuration.
+     */
+    readonly silkOnlyBuiltDependencies: readonly string[];
+    /**
+     * Packages to hoist to the virtual store root.
+     * Synced to pnpm `publicHoistPattern` configuration.
+     */
+    readonly silkPublicHoistPattern: readonly string[];
 }
 
 /**
@@ -85,6 +95,8 @@ export declare interface SilkCatalogs {
  * - `silk`: Current/latest versions for direct dependencies
  * - `silkPeers`: Permissive ranges for peerDependencies
  * - `silkOverrides`: Security overrides for known CVEs
+ * - `silkOnlyBuiltDependencies`: Packages allowed to run build scripts
+ * - `silkPublicHoistPattern`: Packages to hoist to virtual store root
  */
 export declare const silkCatalogs: SilkCatalogs;
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@savvy-web/pnpm-plugin-silk",
-	"version": "0.2.0",
+	"version": "0.3.0",
 	"private": false,
 	"description": "pnpm config dependency for centralized catalog management across the Silk ecosystem.",
 	"keywords": [
@@ -32,14 +32,21 @@
 			"import": "./index.js"
 		}
 	},
-	"optionalDependencies": {
-		"@commitlint/cli": "^20.4.1",
-		"@commitlint/config-conventional": "^20.4.1",
-		"commitizen": "^4.3.1",
-		"husky": "^9.1.7",
-		"lint-staged": "^16.2.7",
-		"markdownlint-cli2": "^0.20.0",
-		"markdownlint-cli2-formatter-codequality": "^0.0.7"
+	"peerDependencies": {
+		"@types/node": "^25.2.0",
+		"@typescript/native-preview": "^7.0.0-dev.20260203.1",
+		"typescript": "^5.9.3"
+	},
+	"peerDependenciesMeta": {
+		"@types/node": {
+			"optional": false
+		},
+		"@typescript/native-preview": {
+			"optional": false
+		},
+		"typescript": {
+			"optional": false
+		}
 	},
 	"files": [
 		"!pnpm-plugin-silk.api.json",

package/pnpmfile.cjs

@@ -5,7 +5,7 @@ const silkCatalogs = {
         "@changesets/cli": "^2.29.8",
         "@commitlint/cli": "^20.4.1",
         "@commitlint/config-conventional": "^20.4.1",
-        "@microsoft/api-extractor": "^7.56.0",
+        "@microsoft/api-extractor": "^7.56.2",
         "@rslib/core": "^0.19.4",
         "@types/node": "^25.2.0",
         "@typescript/native-preview": "^7.0.0-dev.20260203.1",
@@ -24,7 +24,7 @@ const silkCatalogs = {
         "@biomejs/biome": "^2.3.12",
         "@commitlint/cli": "^20.4.1",
         "@commitlint/config-conventional": "^20.4.1",
-        "@microsoft/api-extractor": "^7.55.2",
+        "@microsoft/api-extractor": "^7.56.2",
         "@types/node": "^25.0.10",
         "@typescript/native-preview": "^7.0.0-dev.20260124.1",
         commitizen: "^4.3.1",
@@ -35,7 +35,29 @@ const silkCatalogs = {
         "@isaacs/brace-expansion": ">=5.0.1",
         lodash: ">=4.17.23",
         tmp: ">=0.2.4"
-    }
+    },
+    silkOnlyBuiltDependencies: [
+        "@parcel/watcher",
+        "@savvy-web/commitlint",
+        "@savvy-web/lint-staged",
+        "core-js",
+        "esbuild",
+        "msgpackr-extract"
+    ],
+    silkPublicHoistPattern: [
+        "@commitlint/cli",
+        "@commitlint/config-conventional",
+        "@commitlint/cz-commitlint",
+        "@microsoft/api-extractor",
+        "@rslib/core",
+        "@typescript/native-preview",
+        "husky",
+        "lint-staged",
+        "markdownlint-cli2",
+        "markdownlint-cli2-formatter-codequality",
+        "turbo",
+        "typescript"
+    ]
 };
 const WARNING_BOX_WIDTH = 75;
 function formatOverrideWarning(overrides) {
@@ -98,6 +120,13 @@ function mergeOverrides(silkOverrides, localOverrides, overrideWarnings) {
     }
     return merged;
 }
+function mergeStringArrays(silkArray, localArray) {
+    const merged = new Set(silkArray);
+    if (localArray) for (const item of localArray)merged.add(item);
+    return [
+        ...merged
+    ].sort((a, b)=>a.localeCompare(b));
+}
 function updateConfig(config) {
     try {
         const warnings = [];
@@ -105,6 +134,8 @@ function updateConfig(config) {
         const mergedSilk = mergeSingleCatalog("silk", silkCatalogs.silk, existingCatalogs.silk, warnings);
         const mergedSilkPeers = mergeSingleCatalog("silkPeers", silkCatalogs.silkPeers, existingCatalogs.silkPeers, warnings);
         const mergedOverrides = mergeOverrides(silkCatalogs.silkOverrides, config.overrides, warnings);
+        const mergedOnlyBuiltDependencies = mergeStringArrays(silkCatalogs.silkOnlyBuiltDependencies, config.onlyBuiltDependencies);
+        const mergedPublicHoistPattern = mergeStringArrays(silkCatalogs.silkPublicHoistPattern, config.publicHoistPattern);
         warnOverrides(warnings);
         return {
             ...config,
@@ -113,7 +144,9 @@ function updateConfig(config) {
                 silk: mergedSilk,
                 silkPeers: mergedSilkPeers
             },
-            overrides: mergedOverrides
+            overrides: mergedOverrides,
+            onlyBuiltDependencies: mergedOnlyBuiltDependencies,
+            publicHoistPattern: mergedPublicHoistPattern
         };
     } catch (error) {
         console.warn("[pnpm-plugin-silk] Error merging catalogs, using local config only:", error instanceof Error ? error.message : String(error));

package/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.56.1"
+      "packageVersion": "7.56.2"
     }
   ]
 }