@savvy-web/pnpm-plugin-silk 0.2.0 → 0.4.0

package/README.md

@@ -6,19 +6,22 @@
 [![pnpm](https://img.shields.io/badge/pnpm-%3E%3D10-orange)](https://pnpm.io/)
 
 Centralized dependency version management for the Silk ecosystem via pnpm
-config dependencies. Share curated dependency catalogs, patches, and overrides
-across multiple repositories from a single source of truth.
+config dependencies. Share curated dependency catalogs, security overrides,
+and build configurations across multiple repositories from a single source
+of truth.
 
 ## Features
 
 - **Dual catalog strategy** - Current versions for direct dependencies
   (`catalog:silk`), permissive ranges for peer dependencies (`catalog:silkPeers`)
-- **Non-destructive merging** - Plugin catalogs merge with local definitions;
-  local entries always take precedence
-- **Override warnings** - Clear console output when local versions override
-  Silk-managed defaults
-- **Zero runtime dependencies** - Self-contained CommonJS bundle that pnpm loads
-  directly
+- **Security overrides** - Centralized CVE fixes via `silkOverrides` that
+  propagate to all consuming repositories
+- **Build configuration sync** - Shared `onlyBuiltDependencies` and
+  `publicHoistPattern` settings across repositories
+- **Biome schema sync** - Automatically updates `$schema` URLs in
+  `biome.json`/`biome.jsonc` files to match the catalog version
+- **Non-destructive merging** - Local definitions always take precedence with
+  clear warnings for divergences
 
 ## Installation
 
@@ -33,12 +36,9 @@ hash:
 
 ```yaml
 configDependencies:
-  "@savvy-web/pnpm-plugin-silk": "0.1.0+sha512-abc123..."
+  "@savvy-web/pnpm-plugin-silk": "0.3.0+sha512-..."
 ```
 
-> **Note:** Config dependencies require exact versions with SHA-512 integrity
-> checksums. The `pnpm add --config` command generates this automatically.
-
 ## Quick Start
 
 Reference Silk catalogs in your `package.json`:
@@ -55,15 +55,22 @@ Reference Silk catalogs in your `package.json`:
 }
 ```
 
-The `silk` catalog provides current/latest versions for your direct
-dependencies, while `silkPeers` provides permissive ranges that allow consumers
-to use older compatible versions.
+The `silk` catalog provides current/latest versions for direct dependencies,
+while `silkPeers` provides permissive ranges for peer dependencies. Security
+overrides, build script allowlists, and hoist patterns are automatically
+merged during `pnpm install`.
+
+## Documentation
+
+For configuration details, architecture overview, and advanced usage, see
+[docs/](./docs/).
 
 ## More Information
 
+- [Changelog](./CHANGELOG.md) - Release history
 - [Contributing](./CONTRIBUTING.md) - Development setup and guidelines
 - [Security Policy](./SECURITY.md) - Vulnerability reporting
-- [Design Documentation](./.claude/design/pnpm-plugin-silk/catalog-management.md) - Architecture and implementation details
+- [Code of Conduct](./CODE_OF_CONDUCT.md) - Community guidelines
 
 ## License
 

package/index.cjs

@@ -27,13 +27,14 @@ __webpack_require__.d(__webpack_exports__, {
 });
 const silkCatalogs = {
     silk: {
+        "@biomejs/biome": "2.3.14",
         "@changesets/cli": "^2.29.8",
         "@commitlint/cli": "^20.4.1",
         "@commitlint/config-conventional": "^20.4.1",
-        "@microsoft/api-extractor": "^7.56.0",
-        "@rslib/core": "^0.19.4",
-        "@types/node": "^25.2.0",
-        "@typescript/native-preview": "^7.0.0-dev.20260203.1",
+        "@microsoft/api-extractor": "^7.56.2",
+        "@rslib/core": "^0.19.5",
+        "@types/node": "^25.2.1",
+        "@typescript/native-preview": "^7.0.0-dev.20260206.1",
         "@vitest/coverage-v8": "^4.0.18",
         commitizen: "^4.3.1",
         husky: "^9.1.7",
@@ -46,10 +47,10 @@ const silkCatalogs = {
         vitest: "^4.0.18"
     },
     silkPeers: {
-        "@biomejs/biome": "^2.3.12",
+        "@biomejs/biome": "2.3.14",
         "@commitlint/cli": "^20.4.1",
         "@commitlint/config-conventional": "^20.4.1",
-        "@microsoft/api-extractor": "^7.55.2",
+        "@microsoft/api-extractor": "^7.56.2",
         "@types/node": "^25.0.10",
         "@typescript/native-preview": "^7.0.0-dev.20260124.1",
         commitizen: "^4.3.1",
@@ -60,7 +61,29 @@ const silkCatalogs = {
         "@isaacs/brace-expansion": ">=5.0.1",
         lodash: ">=4.17.23",
         tmp: ">=0.2.4"
-    }
+    },
+    silkOnlyBuiltDependencies: [
+        "@parcel/watcher",
+        "@savvy-web/commitlint",
+        "@savvy-web/lint-staged",
+        "core-js",
+        "esbuild",
+        "msgpackr-extract"
+    ],
+    silkPublicHoistPattern: [
+        "@commitlint/cli",
+        "@commitlint/config-conventional",
+        "@commitlint/cz-commitlint",
+        "@microsoft/api-extractor",
+        "@rslib/core",
+        "@typescript/native-preview",
+        "husky",
+        "lint-staged",
+        "markdownlint-cli2",
+        "markdownlint-cli2-formatter-codequality",
+        "turbo",
+        "typescript"
+    ]
 };
 exports.silkCatalogs = __webpack_exports__.silkCatalogs;
 for(var __rspack_i in __webpack_exports__)if (-1 === [

package/index.d.ts

@@ -77,6 +77,16 @@ export declare interface SilkCatalogs {
      * Synced to pnpm `overrides` configuration.
      */
     readonly silkOverrides: Catalog;
+    /**
+     * Packages allowed to run build scripts during install.
+     * Synced to pnpm `onlyBuiltDependencies` configuration.
+     */
+    readonly silkOnlyBuiltDependencies: readonly string[];
+    /**
+     * Packages to hoist to the virtual store root.
+     * Synced to pnpm `publicHoistPattern` configuration.
+     */
+    readonly silkPublicHoistPattern: readonly string[];
 }
 
 /**
@@ -85,6 +95,8 @@ export declare interface SilkCatalogs {
  * - `silk`: Current/latest versions for direct dependencies
  * - `silkPeers`: Permissive ranges for peerDependencies
  * - `silkOverrides`: Security overrides for known CVEs
+ * - `silkOnlyBuiltDependencies`: Packages allowed to run build scripts
+ * - `silkPublicHoistPattern`: Packages to hoist to virtual store root
  */
 export declare const silkCatalogs: SilkCatalogs;
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@savvy-web/pnpm-plugin-silk",
-	"version": "0.2.0",
+	"version": "0.4.0",
 	"private": false,
 	"description": "pnpm config dependency for centralized catalog management across the Silk ecosystem.",
 	"keywords": [
@@ -32,14 +32,21 @@
 			"import": "./index.js"
 		}
 	},
-	"optionalDependencies": {
-		"@commitlint/cli": "^20.4.1",
-		"@commitlint/config-conventional": "^20.4.1",
-		"commitizen": "^4.3.1",
-		"husky": "^9.1.7",
-		"lint-staged": "^16.2.7",
-		"markdownlint-cli2": "^0.20.0",
-		"markdownlint-cli2-formatter-codequality": "^0.0.7"
+	"peerDependencies": {
+		"@types/node": "^25.2.1",
+		"@typescript/native-preview": "^7.0.0-dev.20260206.1",
+		"typescript": "^5.9.3"
+	},
+	"peerDependenciesMeta": {
+		"@types/node": {
+			"optional": false
+		},
+		"@typescript/native-preview": {
+			"optional": false
+		},
+		"typescript": {
+			"optional": false
+		}
 	},
 	"files": [
 		"!pnpm-plugin-silk.api.json",