Summary

• Adds consumer-side cascadeFrom as the complement to cascadeTo, allowing packages to declare cascade relationships from either direction
• Both cascadeTo and cascadeFrom now support an array shorthand with sensible defaults (trigger: "patch", bumpAs: "match") alongside the object form for custom rules
• Both always apply regardless of the updateInternalDependencies setting

This solves the case where a package bundles a devDependency (e.g., astro-integration bundling vite-integration) and needs to re-release when that dependency is bumped — previously impossible with the default updateInternalDependencies: "out-of-range" setting.

Usage

// Simple — array of package names/globs
{ "cascadeFrom": ["@varlock/vite-integration"] }

// With custom rules
{ "cascadeFrom": { "@varlock/vite-integration": { "trigger": "minor", "bumpAs": "patch" } } }

Test plan

• 6 new tests for cascadeFrom (array shorthand, match default, trigger threshold, globs, proactive mode, coexistence with cascadeTo)
• All 218 existing tests pass
• Type check passes