@decohere/scaffold 0.0.1-dev.20261105.46 → 0.0.1-dev.20261105.64

package/commonjs/src/models/package-json.model.js

@@ -70,6 +70,7 @@ class PackageJson {
         this._devDependencies = {
             "@decohere/forge": _version.CREATE_VERSION,
             "@decohere/cli": _version.CREATE_VERSION,
+            "@types/node": "^24.0.0",
             typescript: "^6.0.3",
             "@biomejs/biome": "^2.0.0",
             vitest: "^3.2.4"

package/commonjs/src/webapi/create-api.js

@@ -124,6 +124,16 @@ function createWorkspace(targetDir, projectName, apiNames) {
     monoRepo.addModel(new _gitignoremodel.Gitignore());
     monoRepo.addModel(new _envfilemodel.EnvFile());
     monoRepo.addFile(new _hostscripts.DevContainerHostScripts());
+    // Current pnpm fails the install on any dependency's install script nobody has decided about.
+    // The app works without these two, so decide "don't run" rather than run third-party scripts.
+    monoRepo.addFile({
+        files: ()=>[
+                {
+                    filePath: "pnpm-workspace.yaml",
+                    content: 'allowBuilds:\n  "@swc/core": false\n  esbuild: false\n'
+                }
+            ]
+    });
     // Biome formatter/linter config
     monoRepo.addFile({
         files: ()=>[

package/commonjs/src/webapi/models/webapi-image.model.js

@@ -14,6 +14,15 @@ class WebapiDevContainer extends _dockerimagemodel.DockerfileModel {
     constructor(baseImage = `${_version.DEVCONTAINER_IMAGE_REPOSITORY}:${_version.CREATE_VERSION}`){
         super(baseImage);
     }
+    /**
+	 * The base image ends as the node user, and its build arguments don't carry over. So this image
+	 * declares its own, runs its layers as root, and hands back to that user at the end.
+	 */ registerBaseLayers() {
+        super.registerBaseLayers();
+        this.addLayer((0, _dockerimagemodel.withNodeUser)({
+            order: 1
+        })).addStep(_dockerimagemodel.DockerStep.raw("become-root", "USER root", 2));
+    }
     files() {
         return [
             {

package/es6/src/models/package-json.model.js

@@ -55,6 +55,7 @@ import { WELL_KNOWN_FILES } from "./const.js";
         this._devDependencies = {
             "@decohere/forge": CREATE_VERSION,
             "@decohere/cli": CREATE_VERSION,
+            "@types/node": "^24.0.0",
             typescript: "^6.0.3",
             "@biomejs/biome": "^2.0.0",
             vitest: "^3.2.4"

package/es6/src/webapi/create-api.js

@@ -104,6 +104,16 @@ function createWorkspace(targetDir, projectName, apiNames) {
     monoRepo.addModel(new Gitignore());
     monoRepo.addModel(new EnvFile());
     monoRepo.addFile(new DevContainerHostScripts());
+    // Current pnpm fails the install on any dependency's install script nobody has decided about.
+    // The app works without these two, so decide "don't run" rather than run third-party scripts.
+    monoRepo.addFile({
+        files: ()=>[
+                {
+                    filePath: "pnpm-workspace.yaml",
+                    content: 'allowBuilds:\n  "@swc/core": false\n  esbuild: false\n'
+                }
+            ]
+    });
     // Biome formatter/linter config
     monoRepo.addFile({
         files: ()=>[

package/es6/src/webapi/models/webapi-image.model.js

@@ -1,4 +1,4 @@
-import { DockerfileModel } from "../../models/docker-image.model.js";
+import { DockerfileModel, DockerStep, withNodeUser } from "../../models/docker-image.model.js";
 import { CREATE_VERSION, DEVCONTAINER_IMAGE_REPOSITORY } from "../../version.js";
 /**
  * Scaffolded app `.devcontainer/Dockerfile` — thin `FROM` the published base image.
@@ -7,6 +7,15 @@ import { CREATE_VERSION, DEVCONTAINER_IMAGE_REPOSITORY } from "../../version.js"
     constructor(baseImage = `${DEVCONTAINER_IMAGE_REPOSITORY}:${CREATE_VERSION}`){
         super(baseImage);
     }
+    /**
+	 * The base image ends as the node user, and its build arguments don't carry over. So this image
+	 * declares its own, runs its layers as root, and hands back to that user at the end.
+	 */ registerBaseLayers() {
+        super.registerBaseLayers();
+        this.addLayer(withNodeUser({
+            order: 1
+        })).addStep(DockerStep.raw("become-root", "USER root", 2));
+    }
     files() {
         return [
             {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/scaffold",
-  "version": "0.0.1-dev.20261105.46",
+  "version": "0.0.1-dev.20261105.64",
   "description": "Decohere project scaffolder (runs inside ghcr.io/typesmiths/decohere/create)",
   "keywords": [
     "decohere",
@@ -31,8 +31,8 @@
     "test": "echo \"Error: no test specified\" && exit 1"
   },
   "dependencies": {
-    "@decohere/crucible": "0.0.1-dev.20261105.46",
-    "@decohere/devkit": "0.0.1-dev.20261105.46",
+    "@decohere/crucible": "0.0.1-dev.20261105.64",
+    "@decohere/devkit": "0.0.1-dev.20261105.64",
     "commander": "^13.1.0",
     "openapi-to-postmanv2": "^5.0.0",
     "yaml": "^2.9.1"

package/types/src/webapi/models/webapi-image.model.d.ts

@@ -5,6 +5,11 @@ import { DockerfileModel } from "../../models/docker-image.model.js";
  */
 export declare class WebapiDevContainer extends DockerfileModel {
     constructor(baseImage?: string);
+    /**
+     * The base image ends as the node user, and its build arguments don't carry over. So this image
+     * declares its own, runs its layers as root, and hands back to that user at the end.
+     */
+    protected registerBaseLayers(): void;
     files(): {
         filePath: string;
         content: string;