@sidebase/base-config 0.1.0 → 0.2.0

package/README.md

@@ -134,9 +134,10 @@ The payload is validated and dogfooded against the CLI, so `@sidebase/streamctl`
 `validate:presets` imports the CLI's exported manifest schema and the e2e dry-run drives the
 real CLI binary, so both resolve `@sidebase/streamctl` from the registry.
 
-The root `streamctl.config.ts` this payload documents needs **streamctl >= 0.2.0**, so the
-pin and the `pnpm-workspace.yaml` c12 override both move when that release lands. See
-"Config location" below.
+This payload needs **streamctl >= 0.3.0**: its manifest declares `schemaVersion` 3 (the
+`fromDependency` placeholder behind the derived Prisma ARG), which a 0.2.x CLI rejects with
+`SCHEMA_UNSUPPORTED`. The root `streamctl.config.ts` location it documents arrived in
+0.2.0 — see "Config location" below.
 
 ## Typed config
 
@@ -174,7 +175,7 @@ covers both.
 
 `defineNuxtBaseConfig` returns the config unchanged. Its job is typed editor inference
 for this payload's knobs: completion and type checking on `ci`, `versions`, `docker`,
-`automation`, `security`, `pnpm`, and the whole `eslint` option surface, plus `profile`
+`automation`, `security`, `pnpm`, `editor`, and the whole `eslint` option surface, plus `profile`
 narrowed to the profile names that actually exist. Without it the object is an untyped
 literal, so a typo such as `ci: { unitTest: true }` stays silent in your editor.
 
@@ -448,6 +449,39 @@ the old list before you adopt and re-add it via `pnpm.onlyBuiltDependencies` abo
 files: { "pnpm-workspace.yaml": "off" },
 ```
 
+## CI knobs
+
+The `nuxt-app` preset ships a managed `.github/workflows/ci.yml`. Its `lint-typecheck` and
+`build` jobs always run; the rest is knobs:
+
+| Knob | Default | Effect |
+| ---- | ------- | ------ |
+| `ci.unitTests` | `false` | Add the `test` job (`pnpm test`) |
+| `ci.e2e` | `false` | Add the `e2e` job, with a health-checked postgres service |
+| `ci.aptPackages` | `[]` | System packages `apt-get`-installed in the `test` and `e2e` jobs |
+
+`ci.aptPackages` is the CI counterpart to `docker.aptPackages` below: extra system packages
+on top of what the runner image already carries, for a binary the suite needs and
+`ubuntu-latest` does not ship. The motivating case is `libxml2-utils`, for `xmllint`.
+
+It applies to the `test` and `e2e` jobs **only** -- never `lint-typecheck` or `build` -- and
+installs directly after `checkout`, before `pnpm install`, so a package needed by an install
+lifecycle script is covered as well as one needed by the tests. Leave it unset and the step
+is skipped entirely: it renders with a guard on the value being non-empty, so the default
+costs a no-op step rather than an `apt-get` call.
+
+```ts
+export default {
+  // ...
+  ci: { unitTests: true, e2e: true, aptPackages: ["libxml2-utils"] },
+};
+```
+
+Package names only. Every element is rejected if it contains a shell metacharacter, and the
+joined string is then re-validated against the Debian package-name character set (lowercase,
+digits, `+`, `-`, `.`). Both checks exist because the rendered command deliberately leaves
+the value unquoted, which is how several packages word-split into one `apt-get` call.
+
 ## Dockerfile knobs
 
 The `nuxt-app` preset ships a managed `Dockerfile`. Beyond `docker.aptPackages`
@@ -464,6 +498,16 @@ out:
 | `docker.prismaRuntime` | final stage | copy the schema + install the `migrate deploy` CLI |
 | `docker.startCommand` | inside `CMD` | `prisma migrate deploy` then the node server |
 
+A seventh knob is different in kind — a validated version, not raw text:
+
+| Knob | Position | Default |
+| ---- | -------- | ------- |
+| `docker.prismaVersion` | the `ARG PRISMA_VERSION=` default inside `docker.prismaRuntime` | derived from the repo's `prisma` pin (its range floor); the baseline only when no full `x.y.z` pin exists |
+
+It is pattern-checked (`x.y.z`, optional prerelease), so unlike the six raw-text
+knobs it cannot inject arbitrary Dockerfile content. `--build-arg PRISMA_VERSION=`
+still overrides at build time.
+
 ```ts
 export default {
   // ...
@@ -502,6 +546,42 @@ Global installs in `docker.preInstall` must use `npm i -g <tool>`, not
 `pnpm add -g`: the image sets no `PNPM_HOME`, so pnpm's global bin dir is
 undefined.
 
+## Editor settings (`.vscode/settings.json`)
+
+The base preset owns its own keys in `.vscode/settings.json` and leaves the rest of the file
+to the project. Among them is i18n-ally, configured for the fleet's standard setup:
+`@nuxtjs/i18n` with flat dotted keys under `i18n/locales`.
+
+Everything the payload does not write is yours and survives a sync untouched -- your
+`editor.fontSize`, your `files.exclude`, any unrelated key at all. Six of those are named in
+the manifest as project-owned on top of that (`editor.fontSize`, `editor.rulers`,
+`editor.formatOnSave`, `files.exclude`, `search.exclude`, `files.watcherExclude`), which
+keeps them yours even if a later payload version starts setting them. Only the keys the
+payload writes are reverted, and they are the ones below.
+
+| Knob | Default | Effect |
+| ---- | ------- | ------ |
+| `editor.i18nSourceLanguage` | `"de"` | The locale i18n-ally translates FROM (`i18n-ally.sourceLanguage`). Payload-enforced -- see below |
+
+```ts
+export default {
+  // ...
+  editor: { i18nSourceLanguage: "en" },
+};
+```
+
+**If your repo authors its source strings in English, set this.** The source language is
+payload-owned, so leaving it unset does not mean "keep what I have" -- every sync writes
+`"de"` into the file, over the top of an `"en"` you put there by hand. Nothing warns, and
+`streamctl check` stays green afterwards, because the value it finds is the value the payload
+intends. Setting the knob is the only thing that makes `"en"` survive a sync.
+
+`i18n-ally.localesPaths` and `i18n-ally.keystyle` are deliberately NOT configurable: the
+locales path and the flat key style are fleet-wide conventions, so they are enforced rather
+than offered. Editing either one in your own `.vscode/settings.json` is reverted on the next
+sync. A repo that genuinely needs a different layout should opt the file out
+(`files: { ".vscode/settings.json": "off" }`) rather than fight the merge.
+
 ## Upgrade-PR workflow
 
 The base preset ships `.github/workflows/streamctl-upgrade.yml`, a scheduled workflow

package/dist/config.d.mts

@@ -20,6 +20,16 @@ interface NuxtBaseCiConfig {
     unitTests?: boolean;
     /** Include the e2e job + postgres service. */
     e2e?: boolean;
+    /**
+     * System packages apt-installed in the `test` and `e2e` jobs before
+     * `pnpm install`, for a binary the suite needs that `ubuntu-latest` does not
+     * ship (the motivating case: `libxml2-utils` for `xmllint`). Empty by default,
+     * which renders the install step inert rather than absent. Package names only:
+     * each element is metacharacter-checked, then the joined string is re-validated
+     * by the manifest pattern, because the rendered `run:` line is deliberately
+     * unquoted so word splitting reaches apt-get.
+     */
+    aptPackages?: string[];
 }
 /**
  * Optional runtime version pins (`config.versions.*`). `node` feeds every
@@ -78,6 +88,11 @@ interface NuxtBaseDockerConfig {
      * this knob, so an override cannot re-root the container. Lands verbatim.
      */
     prismaRuntime?: string;
+    /**
+     * Override for the runtime Prisma CLI `ARG PRISMA_VERSION` default. Derived
+     * from the repo's `prisma` pin when unset.
+     */
+    prismaVersion?: string;
     /**
      * The `sh -c` argument of the final `CMD`. Defaults to
      * `prisma migrate deploy` then the node server; override e.g. for `db push`
@@ -121,6 +136,20 @@ interface NuxtBasePnpmConfig {
      */
     onlyBuiltDependencies?: string[];
 }
+/**
+ * Optional editor knobs (`config.editor.*`) rendered into the managed
+ * `.vscode/settings.json`. Only the i18n-ally source language varies across the
+ * fleet; the locales path and key style are payload-enforced.
+ */
+interface NuxtBaseEditorConfig {
+    /**
+     * Source locale i18n-ally translates FROM (`i18n-ally.sourceLanguage`).
+     * Default `"de"`, the fleet majority; repos authoring in English set `"en"`.
+     * A BCP-47-ish tag (`de`, `pt-BR`, `zh-Hans-CN`); the manifest's `pattern`
+     * rejects anything that could break the rendered JSON string.
+     */
+    i18nSourceLanguage?: string;
+}
 /**
  * The typed `streamctl.config.ts` shape for the `@sidebase/base-config` payload:
  * the CLI-universal fields plus this payload's declared knobs (`ci`, `versions`,
@@ -155,6 +184,8 @@ interface NuxtBaseConfig {
     security?: NuxtBaseSecurityConfig;
     /** Optional pnpm knobs (extra build-script allowances). */
     pnpm?: NuxtBasePnpmConfig;
+    /** Optional editor knobs (the i18n-ally source language). */
+    editor?: NuxtBaseEditorConfig;
     /** ESLint factory options, typed with the payload's own option surface. */
     eslint?: CreateSidebaseEslintOptions;
 }
@@ -176,6 +207,8 @@ declare const NUXT_BASE_AUTOMATION_KEYS: string[];
 declare const NUXT_BASE_SECURITY_KEYS: string[];
 /** Runtime list of every {@link NuxtBasePnpmConfig} key. */
 declare const NUXT_BASE_PNPM_KEYS: string[];
+/** Runtime list of every {@link NuxtBaseEditorConfig} key. */
+declare const NUXT_BASE_EDITOR_KEYS: string[];
 /**
  * Every payload KNOB dot-path {@link NuxtBaseConfig} declares (the `ci.*` and
  * `automation.*` leaves plus the top-level knobs); excludes the CLI-universal
@@ -185,5 +218,5 @@ declare const NUXT_BASE_PNPM_KEYS: string[];
  */
 declare const NUXT_BASE_CONFIG_KEYS: string[];
 
-export { NUXT_BASE_AUTOMATION_KEYS, NUXT_BASE_CI_KEYS, NUXT_BASE_CONFIG_KEYS, NUXT_BASE_DOCKER_KEYS, NUXT_BASE_PNPM_KEYS, NUXT_BASE_SECURITY_KEYS, NUXT_BASE_VERSIONS_KEYS, defineNuxtBaseConfig };
-export type { NuxtBaseAutomationConfig, NuxtBaseCiConfig, NuxtBaseConfig, NuxtBaseDockerConfig, NuxtBasePnpmConfig, NuxtBaseSecurityConfig, NuxtBaseVersionsConfig, Profile };
+export { NUXT_BASE_AUTOMATION_KEYS, NUXT_BASE_CI_KEYS, NUXT_BASE_CONFIG_KEYS, NUXT_BASE_DOCKER_KEYS, NUXT_BASE_EDITOR_KEYS, NUXT_BASE_PNPM_KEYS, NUXT_BASE_SECURITY_KEYS, NUXT_BASE_VERSIONS_KEYS, defineNuxtBaseConfig };
+export type { NuxtBaseAutomationConfig, NuxtBaseCiConfig, NuxtBaseConfig, NuxtBaseDockerConfig, NuxtBaseEditorConfig, NuxtBasePnpmConfig, NuxtBaseSecurityConfig, NuxtBaseVersionsConfig, Profile };

package/dist/config.d.ts

@@ -20,6 +20,16 @@ interface NuxtBaseCiConfig {
     unitTests?: boolean;
     /** Include the e2e job + postgres service. */
     e2e?: boolean;
+    /**
+     * System packages apt-installed in the `test` and `e2e` jobs before
+     * `pnpm install`, for a binary the suite needs that `ubuntu-latest` does not
+     * ship (the motivating case: `libxml2-utils` for `xmllint`). Empty by default,
+     * which renders the install step inert rather than absent. Package names only:
+     * each element is metacharacter-checked, then the joined string is re-validated
+     * by the manifest pattern, because the rendered `run:` line is deliberately
+     * unquoted so word splitting reaches apt-get.
+     */
+    aptPackages?: string[];
 }
 /**
  * Optional runtime version pins (`config.versions.*`). `node` feeds every
@@ -78,6 +88,11 @@ interface NuxtBaseDockerConfig {
      * this knob, so an override cannot re-root the container. Lands verbatim.
      */
     prismaRuntime?: string;
+    /**
+     * Override for the runtime Prisma CLI `ARG PRISMA_VERSION` default. Derived
+     * from the repo's `prisma` pin when unset.
+     */
+    prismaVersion?: string;
     /**
      * The `sh -c` argument of the final `CMD`. Defaults to
      * `prisma migrate deploy` then the node server; override e.g. for `db push`
@@ -121,6 +136,20 @@ interface NuxtBasePnpmConfig {
      */
     onlyBuiltDependencies?: string[];
 }
+/**
+ * Optional editor knobs (`config.editor.*`) rendered into the managed
+ * `.vscode/settings.json`. Only the i18n-ally source language varies across the
+ * fleet; the locales path and key style are payload-enforced.
+ */
+interface NuxtBaseEditorConfig {
+    /**
+     * Source locale i18n-ally translates FROM (`i18n-ally.sourceLanguage`).
+     * Default `"de"`, the fleet majority; repos authoring in English set `"en"`.
+     * A BCP-47-ish tag (`de`, `pt-BR`, `zh-Hans-CN`); the manifest's `pattern`
+     * rejects anything that could break the rendered JSON string.
+     */
+    i18nSourceLanguage?: string;
+}
 /**
  * The typed `streamctl.config.ts` shape for the `@sidebase/base-config` payload:
  * the CLI-universal fields plus this payload's declared knobs (`ci`, `versions`,
@@ -155,6 +184,8 @@ interface NuxtBaseConfig {
     security?: NuxtBaseSecurityConfig;
     /** Optional pnpm knobs (extra build-script allowances). */
     pnpm?: NuxtBasePnpmConfig;
+    /** Optional editor knobs (the i18n-ally source language). */
+    editor?: NuxtBaseEditorConfig;
     /** ESLint factory options, typed with the payload's own option surface. */
     eslint?: CreateSidebaseEslintOptions;
 }
@@ -176,6 +207,8 @@ declare const NUXT_BASE_AUTOMATION_KEYS: string[];
 declare const NUXT_BASE_SECURITY_KEYS: string[];
 /** Runtime list of every {@link NuxtBasePnpmConfig} key. */
 declare const NUXT_BASE_PNPM_KEYS: string[];
+/** Runtime list of every {@link NuxtBaseEditorConfig} key. */
+declare const NUXT_BASE_EDITOR_KEYS: string[];
 /**
  * Every payload KNOB dot-path {@link NuxtBaseConfig} declares (the `ci.*` and
  * `automation.*` leaves plus the top-level knobs); excludes the CLI-universal
@@ -185,5 +218,5 @@ declare const NUXT_BASE_PNPM_KEYS: string[];
  */
 declare const NUXT_BASE_CONFIG_KEYS: string[];
 
-export { NUXT_BASE_AUTOMATION_KEYS, NUXT_BASE_CI_KEYS, NUXT_BASE_CONFIG_KEYS, NUXT_BASE_DOCKER_KEYS, NUXT_BASE_PNPM_KEYS, NUXT_BASE_SECURITY_KEYS, NUXT_BASE_VERSIONS_KEYS, defineNuxtBaseConfig };
-export type { NuxtBaseAutomationConfig, NuxtBaseCiConfig, NuxtBaseConfig, NuxtBaseDockerConfig, NuxtBasePnpmConfig, NuxtBaseSecurityConfig, NuxtBaseVersionsConfig, Profile };
+export { NUXT_BASE_AUTOMATION_KEYS, NUXT_BASE_CI_KEYS, NUXT_BASE_CONFIG_KEYS, NUXT_BASE_DOCKER_KEYS, NUXT_BASE_EDITOR_KEYS, NUXT_BASE_PNPM_KEYS, NUXT_BASE_SECURITY_KEYS, NUXT_BASE_VERSIONS_KEYS, defineNuxtBaseConfig };
+export type { NuxtBaseAutomationConfig, NuxtBaseCiConfig, NuxtBaseConfig, NuxtBaseDockerConfig, NuxtBaseEditorConfig, NuxtBasePnpmConfig, NuxtBaseSecurityConfig, NuxtBaseVersionsConfig, Profile };

package/dist/config.mjs

@@ -6,7 +6,8 @@ function knobKeys(shape) {
 }
 const NUXT_BASE_CI_KEYS = knobKeys({
   unitTests: 0,
-  e2e: 0
+  e2e: 0,
+  aptPackages: 0
 });
 const NUXT_BASE_VERSIONS_KEYS = knobKeys({
   node: 0,
@@ -19,6 +20,7 @@ const NUXT_BASE_DOCKER_KEYS = knobKeys({
   buildSteps: 0,
   finalStage: 0,
   prismaRuntime: 0,
+  prismaVersion: 0,
   startCommand: 0
 });
 const NUXT_BASE_AUTOMATION_KEYS = knobKeys({
@@ -30,6 +32,9 @@ const NUXT_BASE_SECURITY_KEYS = knobKeys({
 const NUXT_BASE_PNPM_KEYS = knobKeys({
   onlyBuiltDependencies: 0
 });
+const NUXT_BASE_EDITOR_KEYS = knobKeys({
+  i18nSourceLanguage: 0
+});
 const NUXT_BASE_TOP_LEVEL_KNOBS = knobKeys({
   eslint: 0
 });
@@ -40,7 +45,8 @@ const NUXT_BASE_CONFIG_KEYS = [
   ...NUXT_BASE_AUTOMATION_KEYS.map((key) => `automation.${key}`),
   ...NUXT_BASE_SECURITY_KEYS.map((key) => `security.${key}`),
   ...NUXT_BASE_PNPM_KEYS.map((key) => `pnpm.${key}`),
+  ...NUXT_BASE_EDITOR_KEYS.map((key) => `editor.${key}`),
   ...NUXT_BASE_TOP_LEVEL_KNOBS
 ];
 
-export { NUXT_BASE_AUTOMATION_KEYS, NUXT_BASE_CI_KEYS, NUXT_BASE_CONFIG_KEYS, NUXT_BASE_DOCKER_KEYS, NUXT_BASE_PNPM_KEYS, NUXT_BASE_SECURITY_KEYS, NUXT_BASE_VERSIONS_KEYS, defineNuxtBaseConfig };
+export { NUXT_BASE_AUTOMATION_KEYS, NUXT_BASE_CI_KEYS, NUXT_BASE_CONFIG_KEYS, NUXT_BASE_DOCKER_KEYS, NUXT_BASE_EDITOR_KEYS, NUXT_BASE_PNPM_KEYS, NUXT_BASE_SECURITY_KEYS, NUXT_BASE_VERSIONS_KEYS, defineNuxtBaseConfig };

package/docs/migration.md

@@ -35,11 +35,12 @@ order, so the second one is the binding constraint:
 The widening came after the guard, so **a build containing the widening also contains the
 guard, and the widening is the effective minimum.** Requiring it is sufficient.
 
-> **Minimum version: `0.2.0`.**
-> That release carries both prerequisites above, and one more that binds harder: it reads
-> `streamctl.config.ts` from the repo root, which is the layout this payload's fixtures,
-> docs, and `ignoresTypeAware` default all assume. `0.1.0` already has the widening, so on
-> that build the payload loads — it just cannot find a root config file.
+> **Minimum version: `0.3.0`.**
+> The binding constraint is the payload manifest's `schemaVersion: 3` (the
+> `PRISMA_VERSION_DEFAULT` placeholder uses `fromDependency`, a schema-3 feature): a 0.2.x
+> CLI rejects the whole payload with `SCHEMA_UNSUPPORTED` ("Upgrade the CLI or the
+> payload"). 0.2.0's own prerequisites (both above, plus reading `streamctl.config.ts`
+> from the repo root) are of course included.
 
 ### Verify your CLI has both, without needing the version number
 
@@ -170,7 +171,7 @@ harder to tell which change caused what.
 Do this BEFORE touching the config.
 
 ```sh
-pnpm add -D @sidebase/streamctl@^0.2.0
+pnpm add -D @sidebase/streamctl@^0.3.0
 ```
 
 ### 3. Swap the payload package
@@ -356,14 +357,13 @@ pnpm install
 migrating from `@sidestream-tech/nuxt-config` it reports something like:
 
 ```
-  [!]  adoption (4)  pre-existing file(s) streamctl now manages
+  [!]  adoption (3)  pre-existing file(s) streamctl now manages
       tsconfig.json - pre-existing file streamctl now manages; adopting is expected
-      .dockerignore - pre-existing file streamctl now manages; adopting is expected
       pnpm-workspace.yaml - pre-existing file streamctl now manages; adopting is expected
       Dockerfile - pre-existing file streamctl now manages; adopting is expected
       -> `sync --interactive` to adopt per file, `sync --force` to take ownership, or `--only <glob>` to scope
 
-4 conflict(s) pending; see the per-kind guidance above.
+3 conflict(s) pending; see the per-kind guidance above.
 ```
 
 This is not a failure and it is not something to route around. A fully-managed file whose
@@ -539,6 +539,68 @@ strategy only inspects its own markers, and the block is present and correct; an
 outside it is invisible to the check. That is why this is a manual step rather than
 something drift detection reports.
 
+### 8b. Reconcile `.dockerignore` by hand
+
+**Same cause as step 8, and equally not migration-specific.** `.dockerignore` is block-managed
+too, so on first sync the payload appends its block to whatever your repository already had.
+Your existing lines stay above it. Nothing is overwritten and nothing is reported.
+
+Most of the leftovers are harmless. Ignore patterns are additive, so a duplicated `node_modules`
+or `.env` above the block is genuinely inert -- it changes nothing about what the build context
+carries. Delete them anyway, for a reason that is not tidiness: the detector below is the only
+thing that will ever tell you a payload entry has started shadowing something of yours, and it
+is not a one-shot check. A future payload version can add an entry that collides with a line you
+kept above the block, and a file with leftover duplicates reads `AFFECTED` forever, so it can no
+longer distinguish that from the noise. Clearing them is what keeps the check able to answer next
+time.
+
+**The case that bites is a negation.** `.dockerignore` is last-match-wins, and the managed block
+is appended at the BOTTOM, so every payload entry beats anything you wrote above it. A repository
+that deliberately un-ignored something now silently loses that:
+
+```
+!tests               <- yours, above the block. Now dead.
+
+# BEGIN streamctl MANAGED BLOCK dockerignore
+...
+tests                <- payload's, below yours. Wins.
+# END streamctl MANAGED BLOCK dockerignore
+```
+
+The build context stops carrying `tests/`, and the failure surfaces later and somewhere else --
+as a `COPY` that lands nothing, or an in-image test run that cannot find its fixtures. The build
+itself succeeds.
+
+Check what sits above the block:
+
+```sh
+awk '/# BEGIN streamctl MANAGED BLOCK dockerignore/{exit} {print}' .dockerignore \
+  | command grep -qv '^[[:space:]]*\(#.*\)\?$' && echo AFFECTED || echo clean
+```
+
+As in step 8, use `command grep` -- the detector reads its exit code as its entire answer, and a
+wrapped `grep` can report `clean` on an affected file.
+
+`AFFECTED` does not mean something broke; it means read those lines and decide. Anything you
+actually need, and every negation without exception, moves **below** the `# END` marker, which is
+the supported extension point:
+
+```
+# END streamctl MANAGED BLOCK dockerignore
+
+!tests
+my-project-specific-dir
+```
+
+Finish by re-running the `AFFECTED`/`clean` detector above; it only says `clean` once nothing but
+comments and blank lines is left above the block, so clear the harmless duplicates out too rather
+than keeping a detector that can never go green.
+
+**`streamctl check` will never flag any of this.** Block drift detection inspects only the marker
+region, so the block is present and correct and the check exits 0 while your dead negation sits
+three lines above it, permanently. This is the one step here that no tooling will ever remind you
+to do.
+
 ### 9. Clean up what the payload no longer manages
 
 Two different kinds of leftover, with the same cause: streamctl manages by path, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sidebase/base-config",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Shared @sidebase base configuration for Nuxt repos: ESLint / Prisma / tsconfig factories on npm, plus the streamctl file-sync preset payload",
   "keywords": [
     "sidebase",
@@ -52,6 +52,16 @@
   "engines": {
     "node": ">=22"
   },
+  "packageManager": "pnpm@10.29.1",
+  "scripts": {
+    "build": "unbuild",
+    "typecheck": "tsc --noEmit -p tsconfig.json && tsc -p tsconfig.test.json",
+    "test": "vitest run",
+    "lint": "eslint .",
+    "validate:presets": "node scripts/validate-presets.mjs",
+    "e2e:dry-run": "pnpm build && node scripts/e2e-dry-run.mjs",
+    "prepack": "pnpm build"
+  },
   "dependencies": {
     "@antfu/eslint-config": "^7.4",
     "ufo": "^1.6.4"
@@ -72,7 +82,7 @@
   "devDependencies": {
     "@arethetypeswrong/cli": "^0.18.5",
     "@prisma/client": "^6.19.3",
-    "@sidebase/streamctl": "^0.2.0",
+    "@sidebase/streamctl": "^0.3.0",
     "@types/node": "^24.0.0",
     "eslint": "^10.5.0",
     "jiti": "^2.7.0",
@@ -82,13 +92,5 @@
     "unbuild": "^3.5.0",
     "vitest": "^3.0.0",
     "yaml": "^2.9.0"
-  },
-  "scripts": {
-    "build": "unbuild",
-    "typecheck": "tsc --noEmit -p tsconfig.json && tsc -p tsconfig.test.json",
-    "test": "vitest run",
-    "lint": "eslint .",
-    "validate:presets": "node scripts/validate-presets.mjs",
-    "e2e:dry-run": "pnpm build && node scripts/e2e-dry-run.mjs"
   }
-}
+}

package/presets/base/dockerignore

@@ -6,6 +6,7 @@ npm-debug*
 .output
 .data
 dist
+test
 tests
 *.log
 .env
@@ -16,3 +17,11 @@ tests
 # is intentionally allowed through.
 .npmrc.*
 .DS_Store
+# Local dev state written by `pnpm db` / `docker compose up`. `prisma/pglite-data`
+# is tens of MB; `prisma/local.postgres_data` is root-owned, which fails a rootless
+# `docker build` outright. Patterns are anchored to the context root here (unlike
+# .gitignore), so `**/local.*` is required to reach the nested paths.
+prisma/client
+prisma/pglite-data
+pgliteHealthz
+**/local.*

package/presets/base/oxlintrc.json

@@ -24,6 +24,7 @@
     "max-depth": "off",
     "max-nested-callbacks": "off",
     "max-lines": "off",
+    "no-underscore-dangle": "off",
     "no-warning-comments": "off",
     "no-inline-comments": "off",
     "no-map-spread": "off"

package/presets/base/preset.json

@@ -3,11 +3,11 @@
   "files": [
     { "path": ".editorconfig", "strategy": "block", "source": "base/editorconfig", "blockMark": "editorconfig" },
     { "path": "tsconfig.json", "strategy": "full", "source": "base/tsconfig.json", "adoption": "expected" },
-    { "path": ".dockerignore", "strategy": "full", "source": "base/dockerignore", "adoption": "expected" },
+    { "path": ".dockerignore", "strategy": "block", "source": "base/dockerignore", "blockMark": "dockerignore" },
     { "path": "pnpm-workspace.yaml", "strategy": "full", "source": "base/pnpm-workspace.yaml", "render": "security", "adoption": "expected" },
     { "path": ".gitignore", "strategy": "block", "source": "base/gitignore", "blockMark": "core" },
     { "path": ".oxlintrc.json", "strategy": "full", "source": "base/oxlintrc.json", "adoption": "expected" },
-    { "path": ".vscode/settings.json", "strategy": "merge", "source": "base/vscode/settings.json", "projectFields": ["editor.fontSize", "editor.rulers", "editor.formatOnSave", "files.exclude", "search.exclude", "files.watcherExclude"] },
+    { "path": ".vscode/settings.json", "strategy": "merge", "source": "base/vscode/settings.json", "render": "editor", "projectFields": ["editor.fontSize", "editor.rulers", "editor.formatOnSave", "files.exclude", "search.exclude", "files.watcherExclude"] },
     { "path": ".vscode/extensions.json", "strategy": "merge", "source": "base/vscode/extensions.json", "projectFields": ["unwantedRecommendations"] },
     { "path": "AGENTS.md", "strategy": "full", "source": "base/AGENTS.md", "adoption": "expected" },
     { "path": "CLAUDE.md", "strategy": "scaffold", "source": "base/CLAUDE.md", "adoption": "expected" },
@@ -19,6 +19,11 @@
         "NODE_VERSION": { "configPath": "versions.node", "default": "24.13.0", "pattern": "^[\\w.+-]+$" }
       }
     },
+    "editor": {
+      "placeholders": {
+        "I18N_SOURCE_LANGUAGE": { "configPath": "editor.i18nSourceLanguage", "default": "de", "pattern": "^[a-z]{2,3}(-[A-Za-z0-9]{2,8})*$" }
+      }
+    },
     "security": {
       "placeholders": {
         "MIN_RELEASE_AGE": { "configPath": "security.minimumReleaseAge", "default": "10080", "pattern": "^\\d+$" }
@@ -30,6 +35,7 @@
   },
   "configKeys": {
     "automation.upgradePr": "boolean",
+    "editor.i18nSourceLanguage": "string",
     "security.minimumReleaseAge": "string",
     "pnpm.onlyBuiltDependencies": "string[]",
     "versions.node": "string",

package/presets/base/vscode/settings.json

@@ -39,5 +39,11 @@
     "toml",
     "gql",
     "graphql"
-  ]
+  ],
+
+  // i18n-ally: the fleet standard is @nuxtjs/i18n with flat dotted keys in
+  // i18n/locales. sourceLanguage is the one field that varies, so it is a knob.
+  "i18n-ally.localesPaths": ["i18n/locales"],
+  "i18n-ally.keystyle": "flat",
+  "i18n-ally.sourceLanguage": "${I18N_SOURCE_LANGUAGE}"
 }

package/presets/config.template.ts

@@ -9,10 +9,11 @@ export default defineNuxtBaseConfig({
   profile: '__PROFILE__',
 
   // Optional knobs, uncomment to enable:
-  // ci: { unitTests: true, e2e: true },
+  // ci: { unitTests: true, e2e: true, aptPackages: ['libxml2-utils'] }, // apt extras for the test/e2e jobs
   // versions: { node: '24.13.0', pnpm: '10.28.1' },
   // docker: { aptPackages: ['ffmpeg'] }, // extras; openssl is always installed
   // security: { minimumReleaseAge: '10080' }, // minutes before pnpm installs a release; '0' disables
   // pnpm: { onlyBuiltDependencies: ['sharp'] }, // extras on top of prisma + esbuild
+  // editor: { i18nSourceLanguage: 'en' }, // i18n-ally source language (default: 'de')
   // eslint: { trpcGuard: true },
 })

package/presets/manifest.json

@@ -1,5 +1,5 @@
 {
-  "schemaVersion": 2,
+  "schemaVersion": 3,
   "presets": [
     "base",
     "nuxt-app"

package/presets/nuxt-app/Dockerfile

@@ -31,7 +31,7 @@ ${DOCKER_BUILD_ARGS}
 # copy the app, note .dockerignore
 COPY . .
 
-# split commands into seperate RUN to not invalidate entire cache layers
+# split commands into separate RUN to not invalidate entire cache layers
 ${DOCKER_BUILD_STEPS}
 
 # --- FINAL PRODUCTION STAGE ---

package/presets/nuxt-app/github/workflows/ci.yml

@@ -19,6 +19,9 @@ concurrency:
 
 env:
   NODE_VERSION: "${NODE_VERSION}"
+  # Extra apt packages for the test/e2e jobs (ci.aptPackages). Empty by default;
+  # the install step is skipped when unset.
+  CI_APT_PACKAGES: "${CI_APT_PACKAGES}"
 
 jobs:
   lint-typecheck:

package/presets/nuxt-app/github/workflows/pr-preview-cleanup.yml

@@ -28,14 +28,14 @@ jobs:
             const { owner, repo } = context.repo;
             const issue_number = context.issue.number;
 
-              // check first if the label exists on the PR
-              const { data: labels } = await github.rest.issues.listLabelsOnIssue({
-                owner,
-                repo,
-                issue_number
-              });
+            // check first if the label exists on the PR
+            const { data: labels } = await github.rest.issues.listLabelsOnIssue({
+              owner,
+              repo,
+              issue_number
+            });
 
-              const hasPreviewDeployedLabel = labels.some(label => label.name === 'preview-deployed');
-              if (hasPreviewDeployedLabel) {
-                await github.rest.issues.removeLabel({ owner, repo, issue_number, name: 'preview-deployed'});
-              }
+            const hasPreviewDeployedLabel = labels.some(label => label.name === 'preview-deployed');
+            if (hasPreviewDeployedLabel) {
+              await github.rest.issues.removeLabel({ owner, repo, issue_number, name: 'preview-deployed'});
+            }

package/presets/nuxt-app/preset.json

@@ -12,6 +12,7 @@
   "renders": {
     "ci": {
       "placeholders": {
+        "CI_APT_PACKAGES": { "configPath": "ci.aptPackages", "default": "", "pattern": "^$|^[a-z0-9][a-z0-9 +.-]*$", "join": "space" },
         "NODE_VERSION": { "configPath": "versions.node", "default": "24.13.0", "pattern": "^[\\w.+-]+$" }
       },
       "fragments": [
@@ -28,7 +29,8 @@
         "DOCKER_BUILD_ARGS": { "configPath": "docker.buildArgs", "default": "" },
         "DOCKER_BUILD_STEPS": { "configPath": "docker.buildSteps", "default": "RUN pnpm nuxi prepare\nRUN pnpm prisma generate\nRUN pnpm run build" },
         "DOCKER_FINAL_STAGE": { "configPath": "docker.finalStage", "default": "" },
-        "DOCKER_PRISMA_RUNTIME": { "configPath": "docker.prismaRuntime", "default": "COPY --chown=node:node --from=production-base /app/prisma /app/prisma\n\n# Prisma CLI version for `migrate deploy`. Defaults to the baseline; override with --build-arg.\nARG PRISMA_VERSION=6.19.1\n\n# install prisma to run the `migrate deploy`. Runs as root because /app is\n# root-owned from WORKDIR; hand the install output to the runtime user in the\n# same layer so no later chown duplicates node_modules.\nRUN npm i -D prisma@${PRISMA_VERSION} && chown -R node:node /app/node_modules" },
+        "DOCKER_PRISMA_RUNTIME": { "configPath": "docker.prismaRuntime", "default": "COPY --chown=node:node --from=production-base /app/prisma /app/prisma\n\n# Prisma CLI version for `migrate deploy`. Defaults to the baseline; override with --build-arg.\nARG PRISMA_VERSION=${PRISMA_VERSION_DEFAULT}\n\n# install prisma to run the `migrate deploy`. Runs as root because /app is\n# root-owned from WORKDIR; hand the install output to the runtime user in the\n# same layer so no later chown duplicates node_modules.\nRUN npm i -D prisma@${PRISMA_VERSION} && chown -R node:node /app/node_modules" },
+        "PRISMA_VERSION_DEFAULT": { "configPath": "docker.prismaVersion", "fromDependency": "prisma", "default": "6.19.1", "pattern": "^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$" },
         "DOCKER_START_COMMAND": { "configPath": "docker.startCommand", "default": "npm exec prisma migrate deploy && node --max-old-space-size-percentage=75 .output/server/index.mjs" }
       },
       "passthrough": ["PRISMA_VERSION"]
@@ -37,12 +39,14 @@
   "configKeys": {
     "ci.unitTests": "boolean",
     "ci.e2e": "boolean",
+    "ci.aptPackages": "string[]",
     "docker.aptPackages": "string[]",
     "docker.preInstall": "string",
     "docker.buildArgs": "string",
     "docker.buildSteps": "string",
     "docker.finalStage": "string",
     "docker.prismaRuntime": "string",
+    "docker.prismaVersion": "string",
     "docker.startCommand": "string",
     "eslint": "object"
   },

package/presets/nuxt-app/templates/ci/e2e-job.yml

@@ -23,6 +23,9 @@
           --health-retries 5
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Install apt packages
+        if: ${{ env.CI_APT_PACKAGES != '' }}
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends $CI_APT_PACKAGES
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:

package/presets/nuxt-app/templates/ci/test-job.yml

@@ -2,6 +2,9 @@
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Install apt packages
+        if: ${{ env.CI_APT_PACKAGES != '' }}
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends $CI_APT_PACKAGES
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: