@sidebase/base-config 0.1.0 → 0.2.1

package/README.md

@@ -19,10 +19,10 @@ pnpm add -D @sidebase/base-config eslint jiti
 required because the config file is TypeScript. `prisma` and `@prisma/client` (`^6.19`)
 are optional peers, install them only if you use `/prisma`.
 
-**`jiti` is not a declared peer** -- `peerDependencies` is `eslint`, `prisma` and
-`@prisma/client`. It is in the command above because `/eslint` genuinely needs it, but
-since nothing declares it, **pnpm emits no missing-peer warning if you leave it out**.
-This README is the only thing that will tell you. See Requirements below.
+**`jiti` is not a declared peer.** `peerDependencies` is `eslint`, `prisma` and
+`@prisma/client`. It is in the command above because `/eslint` genuinely needs it. Since
+nothing declares it, pnpm emits no missing-peer warning if you leave it out. This README is
+the only thing that will tell you. See Requirements below.
 
 For the file-sync channel, see Adopting below. The CLI wires the dependency itself.
 
@@ -134,9 +134,10 @@ The payload is validated and dogfooded against the CLI, so `@sidebase/streamctl`
 `validate:presets` imports the CLI's exported manifest schema and the e2e dry-run drives the
 real CLI binary, so both resolve `@sidebase/streamctl` from the registry.
 
-The root `streamctl.config.ts` this payload documents needs **streamctl >= 0.2.0**, so the
-pin and the `pnpm-workspace.yaml` c12 override both move when that release lands. See
-"Config location" below.
+This payload needs **streamctl >= 0.3.0**: its manifest declares `schemaVersion` 3 (the
+`fromDependency` placeholder behind the derived Prisma ARG), which a 0.2.x CLI rejects with
+`SCHEMA_UNSUPPORTED`. The root `streamctl.config.ts` location it documents arrived in
+0.2.0. See "Config location" below.
 
 ## Typed config
 
@@ -174,7 +175,7 @@ covers both.
 
 `defineNuxtBaseConfig` returns the config unchanged. Its job is typed editor inference
 for this payload's knobs: completion and type checking on `ci`, `versions`, `docker`,
-`automation`, `security`, `pnpm`, and the whole `eslint` option surface, plus `profile`
+`automation`, `security`, `pnpm`, `editor`, and the whole `eslint` option surface, plus `profile`
 narrowed to the profile names that actually exist. Without it the object is an untyped
 literal, so a typo such as `ci: { unitTest: true }` stays silent in your editor.
 
@@ -274,7 +275,7 @@ The custom bans map to these ESLint rule IDs. Use the exact ID in an
 "Re-export" is not a figure of speech: a barrel file doing `export * from "node:process"`
 reports, as do `export { env } from "node:process"` and `export { default as p } from
 "node:process"`. The one shape that does **not** report is a bare side-effect import with
-no bindings, `import "node:process"` -- it cannot reach `env`, so there is nothing to ban.
+no bindings, `import "node:process"`. It cannot reach `env`, so there is nothing to ban.
 
 The `process.env` ban is enforced by **two** rules, and which one reports depends on the
 shape, so suppressing the wrong one fails twice over: the directive does not suppress
@@ -302,14 +303,15 @@ entirely, as does running on Deno or Bun, which import TypeScript directly.
 #### Type-aware linting prerequisite
 
 Type-aware linting is gated behind `LINT_TYPEAWARE=true` (off by default), so this only
-matters on the opt-in / CI path. When type-aware lint is on, the Prisma client and Nuxt types must be
-generated **before** `lint` runs, otherwise type-aware rules fail on missing generated types. This is
-satisfied by ordering, not a preflight check:
+matters on the opt-in and CI path. When type-aware lint is on, the Prisma client and Nuxt
+types must be generated **before** `lint` runs, otherwise type-aware rules fail on missing
+generated types. Ordering satisfies this, not a preflight check:
 
 - the managed `ci.yml` runs `prisma generate` (and `nuxi prepare`) before `pnpm lint`, and
 - `scripts.postinstall: "nuxt prepare"` regenerates Nuxt types on install.
 
-So a standard `pnpm install` + the managed CI ordering covers the prerequisite; no separate check is run.
+A standard `pnpm install` plus the managed CI ordering covers the prerequisite. No separate
+check runs.
 
 ## Prisma factory
 
@@ -441,13 +443,47 @@ existing `onlyBuiltDependencies` allowlist and `ignoredBuiltDependencies` are bo
 by the baked-in baseline, and **nothing warns about it**. Most affected packages ship a
 prebuilt native binary and keep working either way, so the practical breakage is limited to
 architectures with no prebuild and to postinstalls doing essential non-native work. Capture
-the old list before you adopt and re-add it via `pnpm.onlyBuiltDependencies` above. A repo that genuinely needs its own `packages:` list
-(a real monorepo) or its own exclude list should opt the file out entirely instead:
+the old list before you adopt and re-add it via `pnpm.onlyBuiltDependencies` above. A repo
+that genuinely needs its own `packages:` list (a real monorepo) or its own exclude list
+should opt the file out entirely instead:
 
 ```ts
 files: { "pnpm-workspace.yaml": "off" },
 ```
 
+## CI knobs
+
+The `nuxt-app` preset ships a managed `.github/workflows/ci.yml`. Its `lint-typecheck` and
+`build` jobs always run; the rest is knobs:
+
+| Knob | Default | Effect |
+| ---- | ------- | ------ |
+| `ci.unitTests` | `false` | Add the `test` job (`pnpm test`) |
+| `ci.e2e` | `false` | Add the `e2e` job, with a health-checked postgres service |
+| `ci.aptPackages` | `[]` | System packages `apt-get`-installed in the `test` and `e2e` jobs |
+
+`ci.aptPackages` is the CI counterpart to `docker.aptPackages` below: extra system packages
+on top of what the runner image already carries, for a binary the suite needs and
+`ubuntu-latest` does not ship. The motivating case is `libxml2-utils`, for `xmllint`.
+
+It applies to the `test` and `e2e` jobs only, never `lint-typecheck` or `build`. The step
+installs directly after `checkout`, before `pnpm install`, so a package needed by an install
+lifecycle script is covered as well as one needed by the tests. Leave it unset and the step
+is skipped entirely: it renders with a guard on the value being non-empty, so the default
+costs a no-op step rather than an `apt-get` call.
+
+```ts
+export default {
+  // ...
+  ci: { unitTests: true, e2e: true, aptPackages: ["libxml2-utils"] },
+};
+```
+
+Package names only. Every element is rejected if it contains a shell metacharacter, and the
+joined string is then re-validated against the Debian package-name character set (lowercase,
+digits, `+`, `-`, `.`). Both checks exist because the rendered command deliberately leaves
+the value unquoted, which is how several packages word-split into one `apt-get` call.
+
 ## Dockerfile knobs
 
 The `nuxt-app` preset ships a managed `Dockerfile`. Beyond `docker.aptPackages`
@@ -464,6 +500,16 @@ out:
 | `docker.prismaRuntime` | final stage | copy the schema + install the `migrate deploy` CLI |
 | `docker.startCommand` | inside `CMD` | `prisma migrate deploy` then the node server |
 
+A seventh knob is different in kind: a validated version, not raw text.
+
+| Knob | Position | Default |
+| ---- | -------- | ------- |
+| `docker.prismaVersion` | the `ARG PRISMA_VERSION=` default inside `docker.prismaRuntime` | derived from the repo's `prisma` pin (its range floor); the baseline only when no full `x.y.z` pin exists |
+
+It is pattern-checked (`x.y.z`, optional prerelease), so unlike the six raw-text
+knobs it cannot inject arbitrary Dockerfile content. `--build-arg PRISMA_VERSION=`
+still overrides at build time.
+
 ```ts
 export default {
   // ...
@@ -481,8 +527,10 @@ export default {
 > shell-metacharacter check runs on them. The trust level is exactly that of
 > `files: { "Dockerfile": "off" }`, which any consumer can already set: whoever
 > can edit `streamctl.config.ts` can already replace the whole file. The
-> `USER node` switch and the `.output` ownership stay FIXED outside every knob,
-> so an override cannot re-root the container or drop the runtime user.
+> `.output` ownership stays FIXED outside every knob. The container itself runs
+> as **root**: a fixed `USER node` broke every deployment that overrides the image
+> CMD with a root-requiring command, so a repo that wants an unprivileged runtime
+> opts in with `docker.finalStage: "USER node"`.
 
 Setting a knob replaces its default outright, it does not append. So a `docker.buildSteps`
 override must restate every build command you still want, and `docker.prismaRuntime: ""`
@@ -490,8 +538,8 @@ removes the Prisma runtime block entirely. The three knobs that default to real
 (`buildSteps`, `prismaRuntime`, `startCommand`) are the ones where this matters; the other
 three default to `""`.
 
-**`prismaRuntime` and `startCommand` are coupled -- override one and you must override the
-other.** `prismaRuntime` is what installs the Prisma CLI into the final stage, and the
+**`prismaRuntime` and `startCommand` are coupled.** Override one and you must override the
+other. `prismaRuntime` is what installs the Prisma CLI into the final stage, and the
 DEFAULT `startCommand` is `npm exec prisma migrate deploy && node ...`. Setting only
 `prismaRuntime: ""` therefore produces an image whose `CMD` invokes a CLI that is no longer
 installed, and the container fails to start. The example above overrides both, which is why
@@ -502,6 +550,42 @@ Global installs in `docker.preInstall` must use `npm i -g <tool>`, not
 `pnpm add -g`: the image sets no `PNPM_HOME`, so pnpm's global bin dir is
 undefined.
 
+## Editor settings (`.vscode/settings.json`)
+
+The base preset owns its own keys in `.vscode/settings.json` and leaves the rest of the file
+to the project. Among them is i18n-ally, configured for the fleet's standard setup:
+`@nuxtjs/i18n` with flat dotted keys under `i18n/locales`.
+
+Everything the payload does not write is yours and survives a sync untouched: your
+`editor.fontSize`, your `files.exclude`, any unrelated key at all. Six of those are named in
+the manifest as project-owned on top of that (`editor.fontSize`, `editor.rulers`,
+`editor.formatOnSave`, `files.exclude`, `search.exclude`, `files.watcherExclude`), which
+keeps them yours even if a later payload version starts setting them. Only the keys the
+payload writes are reverted, and they are the ones below.
+
+| Knob | Default | Effect |
+| ---- | ------- | ------ |
+| `editor.i18nSourceLanguage` | `"de"` | The locale i18n-ally translates FROM (`i18n-ally.sourceLanguage`). Payload-enforced; see below |
+
+```ts
+export default {
+  // ...
+  editor: { i18nSourceLanguage: "en" },
+};
+```
+
+**If your repo authors its source strings in English, set this.** The source language is
+payload-owned, so leaving it unset does not mean "keep what I have". Every sync writes
+`"de"` into the file, over the top of an `"en"` you put there by hand. Nothing warns, and
+`streamctl check` stays green afterwards, because the value it finds is the value the payload
+intends. Setting the knob is the only thing that makes `"en"` survive a sync.
+
+`i18n-ally.localesPaths` and `i18n-ally.keystyle` are deliberately NOT configurable: the
+locales path and the flat key style are fleet-wide conventions, so they are enforced rather
+than offered. Editing either one in your own `.vscode/settings.json` is reverted on the next
+sync. A repo that genuinely needs a different layout should opt the file out
+(`files: { ".vscode/settings.json": "off" }`) rather than fight the merge.
+
 ## Upgrade-PR workflow
 
 The base preset ships `.github/workflows/streamctl-upgrade.yml`, a scheduled workflow
@@ -543,9 +627,9 @@ plan-only PR labelled `needs-interactive-upgrade` for a human to finish with
 
 ### Action pinning policy
 
-Every action in every managed workflow and CI job fragment is pinned by full commit
-SHA (with the version tag in a trailing comment), since moving tags can be re-pointed, so
-tags are never trusted, secrets or not. `test/workflow-pins.test.ts` sweeps all preset
+Every action in every managed workflow and CI job fragment is pinned by full commit SHA,
+with the version tag in a trailing comment. Moving tags can be re-pointed, so tags are
+never trusted, secrets or not. `test/workflow-pins.test.ts` sweeps all preset
 templates and fails on any `uses:` that is not a 40-hex SHA.
 
 The shipped pins track `actions/checkout` v6, `actions/setup-node` v6, and

package/dist/config.d.mts

@@ -1,32 +1,36 @@
-import { C as CreateSidebaseEslintOptions } from './shared/base-config.CuUhyvQo.mjs';
+import { C as CreateSidebaseEslintOptions } from './shared/base-config.BoberVUk.mjs';
 
 /**
- * Version-baseline profile, named for the framework AND its major so two majors can
- * coexist during a migration: the manifest declares one profile per major with its own
- * `detect.majorIs`, and each repo detects the one matching its own Nuxt version.
+ * Version-baseline profile, named for the framework and its major so two majors can
+ * coexist during a migration.
  *
- * The name MUST match a `versionProfiles` key in the preset chain. The CLI resolves the
- * baseline with `versionProfiles?.[profile] ?? {}`, so a name nothing declares reconciles
- * NOTHING, silently. `scripts/validate-presets.mjs` fails the build on that mismatch.
+ * An unknown name reconciles nothing, silently. `scripts/validate-presets.mjs` fails
+ * the build on that mismatch.
  */
 type Profile = "nuxt-4";
 /**
- * Optional CI knobs (`config.ci.*`) the nuxt-app preset understands: the job
- * toggles. Keys mirror the manifest's `ci.*` `configKeys`; the consistency test
- * in `test/config.test.ts` proves they stay in lockstep.
+ * CI job knobs (`config.ci.*`). Keys mirror the manifest's `ci.*` `configKeys`, and
+ * `test/config.test.ts` proves the two stay in lockstep.
  */
 interface NuxtBaseCiConfig {
     /** Include the `pnpm test` job. */
     unitTests?: boolean;
     /** Include the e2e job + postgres service. */
     e2e?: boolean;
+    /**
+     * Packages apt-installed in the `test` and `e2e` jobs, for a binary the suite needs
+     * that `ubuntu-latest` lacks. Empty renders the install step inert, not absent.
+     *
+     * Package names only: the rendered `run:` line is unquoted so word splitting reaches
+     * apt-get, so every element is metacharacter-checked.
+     */
+    aptPackages?: string[];
 }
 /**
- * Optional runtime version pins (`config.versions.*`). `node` feeds every
- * render (`ci.yml`, the Dockerfile, the upgrade-PR workflow); `pnpm` feeds the
- * Dockerfile only. CI takes its pnpm from `package.json#packageManager`, the
- * single reconciled source, so it is never passed to `pnpm/action-setup`.
- * Defaults come from the version baseline (node 24.13.0, pnpm 10.28.1).
+ * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yml`,
+ * the Dockerfile, the upgrade workflow); `pnpm` feeds the Dockerfile only, because CI
+ * takes pnpm from `package.json#packageManager`. Defaults come from the version
+ * baseline (node 24.13.0, pnpm 10.28.1).
  */
 interface NuxtBaseVersionsConfig {
     /** Node version for CI jobs, the Docker base image, and the upgrade workflow. */
@@ -42,16 +46,15 @@ interface NuxtBaseVersionsConfig {
  */
 interface NuxtBaseDockerConfig {
     /**
-     * Project-owned apt packages for the production stage, ON TOP of the baked-in
-     * baseline (`openssl`: the Prisma query engine generated in the build stage
-     * dynamically links libssl3, which slim images do not ship).
+     * Apt packages for the production stage, on top of the baked-in `openssl`, which is
+     * always installed because the Prisma query engine links libssl3 and slim images do
+     * not ship it.
      */
     aptPackages?: string[];
     /**
-     * Raw Dockerfile text injected in the build stage BEFORE `pnpm install`, e.g.
-     * a `COPY ./vendor ./vendor` a repo needs present at install time. Lands
-     * verbatim; see the trust note below. Global installs must use `npm i -g`
-     * (`PNPM_HOME` is not set, so `pnpm add -g` fails to find its bin dir).
+     * Raw Dockerfile text injected in the build stage before `pnpm install`, e.g. a
+     * `COPY ./vendor ./vendor` needed at install time. Lands verbatim. Global installs
+     * must use `npm i -g`: `PNPM_HOME` is unset, so `pnpm add -g` cannot find its bin dir.
      */
     preInstall?: string;
     /**
@@ -67,17 +70,21 @@ interface NuxtBaseDockerConfig {
     buildSteps?: string;
     /**
      * Raw Dockerfile text injected in the final stage BEFORE `CMD`, e.g. extra
-     * `ENV`, `COPY --from`, or `RUN`. Lands verbatim. Cannot drop the fixed
-     * `USER node` switch, which sits below it.
+     * `ENV`, `COPY --from`, or `RUN`. Lands verbatim. The container runs as root,
+     * so a repo that wants an unprivileged runtime appends its own `USER` here.
      */
     finalStage?: string;
     /**
      * The final-stage Prisma runtime block (copy the schema, install the CLI for
      * `migrate deploy`). Defaults to that block; set `""` for a repo with no
-     * Prisma. The `USER node` switch and the `.output` ownership are FIXED outside
-     * this knob, so an override cannot re-root the container. Lands verbatim.
+     * Prisma. The `.output` ownership is FIXED outside this knob. Lands verbatim.
      */
     prismaRuntime?: string;
+    /**
+     * Override for the runtime Prisma CLI `ARG PRISMA_VERSION` default. Derived
+     * from the repo's `prisma` pin when unset.
+     */
+    prismaVersion?: string;
     /**
      * The `sh -c` argument of the final `CMD`. Defaults to
      * `prisma migrate deploy` then the node server; override e.g. for `db push`
@@ -86,25 +93,22 @@ interface NuxtBaseDockerConfig {
     startCommand?: string;
 }
 /**
- * Optional automation knobs (`config.automation.*`) the base preset understands:
- * the opt-in upgrade-PR workflow and its runtime version pins. Keys mirror the
- * manifest's `automation.*` `configKeys`; the consistency test in
- * `test/config.test.ts` proves they stay in lockstep.
+ * Automation knobs (`config.automation.*`) for the opt-in upgrade-PR workflow. Keys
+ * mirror the manifest's `automation.*` `configKeys`, checked by `test/config.test.ts`.
  */
 interface NuxtBaseAutomationConfig {
     /** Sync the weekly streamctl upgrade-PR workflow (default: off, no workflow lands). */
     upgradePr?: boolean;
 }
 /**
- * Optional supply-chain knobs (`config.security.*`) the base preset understands:
- * the pnpm install cooldown rendered into the managed `pnpm-workspace.yaml`.
+ * Supply-chain knobs (`config.security.*`): the pnpm install cooldown rendered into
+ * the managed `pnpm-workspace.yaml`.
  */
 interface NuxtBaseSecurityConfig {
     /**
-     * Minutes a version must have been published before pnpm resolves it
-     * (`minimumReleaseAge`). Default `"10080"` (7 days); `"0"` disables the cooldown.
-     * A STRING because the manifest's `configKeys` has no number type, same as the
-     * `versions.*` pins.
+     * Minutes a version must have been published before pnpm resolves it. Default
+     * `"10080"` (7 days), `"0"` disables it. A string because the manifest's
+     * `configKeys` has no number type, same as the `versions.*` pins.
      */
     minimumReleaseAge?: string;
 }
@@ -114,19 +118,29 @@ interface NuxtBaseSecurityConfig {
  */
 interface NuxtBasePnpmConfig {
     /**
-     * Packages allowed to run install lifecycle scripts, ON TOP of the baked-in
-     * baseline (`@prisma/client`, `esbuild`, `prisma`). Use this instead of
-     * `pnpm approve-builds`, which writes to the managed file and is reverted on
-     * the next sync.
+     * Packages allowed to run install lifecycle scripts, on top of the baseline
+     * (`@prisma/client`, `esbuild`, `prisma`). Use this instead of `pnpm approve-builds`,
+     * which writes to the managed file and is reverted on the next sync.
      */
     onlyBuiltDependencies?: string[];
 }
 /**
- * The typed `streamctl.config.ts` shape for the `@sidebase/base-config` payload:
- * the CLI-universal fields plus this payload's declared knobs (`ci`, `versions`,
- * `docker`, `automation`, `eslint`) with their real option types. The generic CLI only
- * shape-checks these against the manifest's `configKeys`, so the precise types live
- * here, next to the payload that owns them, and consumers keep a fully typed config.
+ * Editor knobs (`config.editor.*`) rendered into the managed `.vscode/settings.json`.
+ * Only the i18n-ally source language varies across the fleet.
+ */
+interface NuxtBaseEditorConfig {
+    /**
+     * Source locale i18n-ally translates from. Default `"de"`; repos authoring in
+     * English set `"en"`. A BCP-47-ish tag (`de`, `pt-BR`, `zh-Hans-CN`); the manifest
+     * pattern rejects anything that could break the rendered JSON string.
+     */
+    i18nSourceLanguage?: string;
+}
+/**
+ * The typed `streamctl.config.ts` shape for this payload: the CLI-universal fields plus
+ * the declared knobs with their real option types. The CLI only shape-checks knobs
+ * against the manifest's `configKeys`, so the precise types live here, next to the
+ * payload that owns them, and consumers keep a fully typed config.
  */
 interface NuxtBaseConfig {
     /** The payload package this repo syncs from. */
@@ -155,13 +169,14 @@ interface NuxtBaseConfig {
     security?: NuxtBaseSecurityConfig;
     /** Optional pnpm knobs (extra build-script allowances). */
     pnpm?: NuxtBasePnpmConfig;
+    /** Optional editor knobs (the i18n-ally source language). */
+    editor?: NuxtBaseEditorConfig;
     /** ESLint factory options, typed with the payload's own option surface. */
     eslint?: CreateSidebaseEslintOptions;
 }
 /**
- * Identity helper for a typed `streamctl.config.ts`, the payload analog of the
- * CLI's `defineStreamctlConfig`, adding editor inference for this payload's knobs.
- * Returns the config unchanged; the CLI validates it at load.
+ * Identity helper giving editor inference for this payload's knobs, the analog of the
+ * CLI's `defineStreamctlConfig`. Returns the config unchanged; the CLI validates it.
  */
 declare function defineNuxtBaseConfig(config: NuxtBaseConfig): NuxtBaseConfig;
 /** Runtime list of every {@link NuxtBaseCiConfig} key. */
@@ -176,14 +191,14 @@ declare const NUXT_BASE_AUTOMATION_KEYS: string[];
 declare const NUXT_BASE_SECURITY_KEYS: string[];
 /** Runtime list of every {@link NuxtBasePnpmConfig} key. */
 declare const NUXT_BASE_PNPM_KEYS: string[];
+/** Runtime list of every {@link NuxtBaseEditorConfig} key. */
+declare const NUXT_BASE_EDITOR_KEYS: string[];
 /**
- * Every payload KNOB dot-path {@link NuxtBaseConfig} declares (the `ci.*` and
- * `automation.*` leaves plus the top-level knobs); excludes the CLI-universal
- * fields. The consistency test asserts this set equals the RESOLVED preset chain's
- * declared `configKeys` (base + nuxt-app), catching drift between the type and the
- * manifest in either direction.
+ * Every knob dot-path {@link NuxtBaseConfig} declares, excluding the CLI-universal
+ * fields. The consistency test asserts this set equals the resolved preset chain's
+ * `configKeys`, catching drift between the type and the manifest in either direction.
  */
 declare const NUXT_BASE_CONFIG_KEYS: string[];
 
-export { NUXT_BASE_AUTOMATION_KEYS, NUXT_BASE_CI_KEYS, NUXT_BASE_CONFIG_KEYS, NUXT_BASE_DOCKER_KEYS, NUXT_BASE_PNPM_KEYS, NUXT_BASE_SECURITY_KEYS, NUXT_BASE_VERSIONS_KEYS, defineNuxtBaseConfig };
-export type { NuxtBaseAutomationConfig, NuxtBaseCiConfig, NuxtBaseConfig, NuxtBaseDockerConfig, NuxtBasePnpmConfig, NuxtBaseSecurityConfig, NuxtBaseVersionsConfig, Profile };
+export { NUXT_BASE_AUTOMATION_KEYS, NUXT_BASE_CI_KEYS, NUXT_BASE_CONFIG_KEYS, NUXT_BASE_DOCKER_KEYS, NUXT_BASE_EDITOR_KEYS, NUXT_BASE_PNPM_KEYS, NUXT_BASE_SECURITY_KEYS, NUXT_BASE_VERSIONS_KEYS, defineNuxtBaseConfig };
+export type { NuxtBaseAutomationConfig, NuxtBaseCiConfig, NuxtBaseConfig, NuxtBaseDockerConfig, NuxtBaseEditorConfig, NuxtBasePnpmConfig, NuxtBaseSecurityConfig, NuxtBaseVersionsConfig, Profile };

package/dist/config.d.ts

@@ -1,32 +1,36 @@
-import { C as CreateSidebaseEslintOptions } from './shared/base-config.CuUhyvQo.js';
+import { C as CreateSidebaseEslintOptions } from './shared/base-config.BoberVUk.js';
 
 /**
- * Version-baseline profile, named for the framework AND its major so two majors can
- * coexist during a migration: the manifest declares one profile per major with its own
- * `detect.majorIs`, and each repo detects the one matching its own Nuxt version.
+ * Version-baseline profile, named for the framework and its major so two majors can
+ * coexist during a migration.
  *
- * The name MUST match a `versionProfiles` key in the preset chain. The CLI resolves the
- * baseline with `versionProfiles?.[profile] ?? {}`, so a name nothing declares reconciles
- * NOTHING, silently. `scripts/validate-presets.mjs` fails the build on that mismatch.
+ * An unknown name reconciles nothing, silently. `scripts/validate-presets.mjs` fails
+ * the build on that mismatch.
  */
 type Profile = "nuxt-4";
 /**
- * Optional CI knobs (`config.ci.*`) the nuxt-app preset understands: the job
- * toggles. Keys mirror the manifest's `ci.*` `configKeys`; the consistency test
- * in `test/config.test.ts` proves they stay in lockstep.
+ * CI job knobs (`config.ci.*`). Keys mirror the manifest's `ci.*` `configKeys`, and
+ * `test/config.test.ts` proves the two stay in lockstep.
  */
 interface NuxtBaseCiConfig {
     /** Include the `pnpm test` job. */
     unitTests?: boolean;
     /** Include the e2e job + postgres service. */
     e2e?: boolean;
+    /**
+     * Packages apt-installed in the `test` and `e2e` jobs, for a binary the suite needs
+     * that `ubuntu-latest` lacks. Empty renders the install step inert, not absent.
+     *
+     * Package names only: the rendered `run:` line is unquoted so word splitting reaches
+     * apt-get, so every element is metacharacter-checked.
+     */
+    aptPackages?: string[];
 }
 /**
- * Optional runtime version pins (`config.versions.*`). `node` feeds every
- * render (`ci.yml`, the Dockerfile, the upgrade-PR workflow); `pnpm` feeds the
- * Dockerfile only. CI takes its pnpm from `package.json#packageManager`, the
- * single reconciled source, so it is never passed to `pnpm/action-setup`.
- * Defaults come from the version baseline (node 24.13.0, pnpm 10.28.1).
+ * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yml`,
+ * the Dockerfile, the upgrade workflow); `pnpm` feeds the Dockerfile only, because CI
+ * takes pnpm from `package.json#packageManager`. Defaults come from the version
+ * baseline (node 24.13.0, pnpm 10.28.1).
  */
 interface NuxtBaseVersionsConfig {
     /** Node version for CI jobs, the Docker base image, and the upgrade workflow. */
@@ -42,16 +46,15 @@ interface NuxtBaseVersionsConfig {
  */
 interface NuxtBaseDockerConfig {
     /**
-     * Project-owned apt packages for the production stage, ON TOP of the baked-in
-     * baseline (`openssl`: the Prisma query engine generated in the build stage
-     * dynamically links libssl3, which slim images do not ship).
+     * Apt packages for the production stage, on top of the baked-in `openssl`, which is
+     * always installed because the Prisma query engine links libssl3 and slim images do
+     * not ship it.
      */
     aptPackages?: string[];
     /**
-     * Raw Dockerfile text injected in the build stage BEFORE `pnpm install`, e.g.
-     * a `COPY ./vendor ./vendor` a repo needs present at install time. Lands
-     * verbatim; see the trust note below. Global installs must use `npm i -g`
-     * (`PNPM_HOME` is not set, so `pnpm add -g` fails to find its bin dir).
+     * Raw Dockerfile text injected in the build stage before `pnpm install`, e.g. a
+     * `COPY ./vendor ./vendor` needed at install time. Lands verbatim. Global installs
+     * must use `npm i -g`: `PNPM_HOME` is unset, so `pnpm add -g` cannot find its bin dir.
      */
     preInstall?: string;
     /**
@@ -67,17 +70,21 @@ interface NuxtBaseDockerConfig {
     buildSteps?: string;
     /**
      * Raw Dockerfile text injected in the final stage BEFORE `CMD`, e.g. extra
-     * `ENV`, `COPY --from`, or `RUN`. Lands verbatim. Cannot drop the fixed
-     * `USER node` switch, which sits below it.
+     * `ENV`, `COPY --from`, or `RUN`. Lands verbatim. The container runs as root,
+     * so a repo that wants an unprivileged runtime appends its own `USER` here.
      */
     finalStage?: string;
     /**
      * The final-stage Prisma runtime block (copy the schema, install the CLI for
      * `migrate deploy`). Defaults to that block; set `""` for a repo with no
-     * Prisma. The `USER node` switch and the `.output` ownership are FIXED outside
-     * this knob, so an override cannot re-root the container. Lands verbatim.
+     * Prisma. The `.output` ownership is FIXED outside this knob. Lands verbatim.
      */
     prismaRuntime?: string;
+    /**
+     * Override for the runtime Prisma CLI `ARG PRISMA_VERSION` default. Derived
+     * from the repo's `prisma` pin when unset.
+     */
+    prismaVersion?: string;
     /**
      * The `sh -c` argument of the final `CMD`. Defaults to
      * `prisma migrate deploy` then the node server; override e.g. for `db push`
@@ -86,25 +93,22 @@ interface NuxtBaseDockerConfig {
     startCommand?: string;
 }
 /**
- * Optional automation knobs (`config.automation.*`) the base preset understands:
- * the opt-in upgrade-PR workflow and its runtime version pins. Keys mirror the
- * manifest's `automation.*` `configKeys`; the consistency test in
- * `test/config.test.ts` proves they stay in lockstep.
+ * Automation knobs (`config.automation.*`) for the opt-in upgrade-PR workflow. Keys
+ * mirror the manifest's `automation.*` `configKeys`, checked by `test/config.test.ts`.
  */
 interface NuxtBaseAutomationConfig {
     /** Sync the weekly streamctl upgrade-PR workflow (default: off, no workflow lands). */
     upgradePr?: boolean;
 }
 /**
- * Optional supply-chain knobs (`config.security.*`) the base preset understands:
- * the pnpm install cooldown rendered into the managed `pnpm-workspace.yaml`.
+ * Supply-chain knobs (`config.security.*`): the pnpm install cooldown rendered into
+ * the managed `pnpm-workspace.yaml`.
  */
 interface NuxtBaseSecurityConfig {
     /**
-     * Minutes a version must have been published before pnpm resolves it
-     * (`minimumReleaseAge`). Default `"10080"` (7 days); `"0"` disables the cooldown.
-     * A STRING because the manifest's `configKeys` has no number type, same as the
-     * `versions.*` pins.
+     * Minutes a version must have been published before pnpm resolves it. Default
+     * `"10080"` (7 days), `"0"` disables it. A string because the manifest's
+     * `configKeys` has no number type, same as the `versions.*` pins.
      */
     minimumReleaseAge?: string;
 }
@@ -114,19 +118,29 @@ interface NuxtBaseSecurityConfig {
  */
 interface NuxtBasePnpmConfig {
     /**
-     * Packages allowed to run install lifecycle scripts, ON TOP of the baked-in
-     * baseline (`@prisma/client`, `esbuild`, `prisma`). Use this instead of
-     * `pnpm approve-builds`, which writes to the managed file and is reverted on
-     * the next sync.
+     * Packages allowed to run install lifecycle scripts, on top of the baseline
+     * (`@prisma/client`, `esbuild`, `prisma`). Use this instead of `pnpm approve-builds`,
+     * which writes to the managed file and is reverted on the next sync.
      */
     onlyBuiltDependencies?: string[];
 }
 /**
- * The typed `streamctl.config.ts` shape for the `@sidebase/base-config` payload:
- * the CLI-universal fields plus this payload's declared knobs (`ci`, `versions`,
- * `docker`, `automation`, `eslint`) with their real option types. The generic CLI only
- * shape-checks these against the manifest's `configKeys`, so the precise types live
- * here, next to the payload that owns them, and consumers keep a fully typed config.
+ * Editor knobs (`config.editor.*`) rendered into the managed `.vscode/settings.json`.
+ * Only the i18n-ally source language varies across the fleet.
+ */
+interface NuxtBaseEditorConfig {
+    /**
+     * Source locale i18n-ally translates from. Default `"de"`; repos authoring in
+     * English set `"en"`. A BCP-47-ish tag (`de`, `pt-BR`, `zh-Hans-CN`); the manifest
+     * pattern rejects anything that could break the rendered JSON string.
+     */
+    i18nSourceLanguage?: string;
+}
+/**
+ * The typed `streamctl.config.ts` shape for this payload: the CLI-universal fields plus
+ * the declared knobs with their real option types. The CLI only shape-checks knobs
+ * against the manifest's `configKeys`, so the precise types live here, next to the
+ * payload that owns them, and consumers keep a fully typed config.
  */
 interface NuxtBaseConfig {
     /** The payload package this repo syncs from. */
@@ -155,13 +169,14 @@ interface NuxtBaseConfig {
     security?: NuxtBaseSecurityConfig;
     /** Optional pnpm knobs (extra build-script allowances). */
     pnpm?: NuxtBasePnpmConfig;
+    /** Optional editor knobs (the i18n-ally source language). */
+    editor?: NuxtBaseEditorConfig;
     /** ESLint factory options, typed with the payload's own option surface. */
     eslint?: CreateSidebaseEslintOptions;
 }
 /**
- * Identity helper for a typed `streamctl.config.ts`, the payload analog of the
- * CLI's `defineStreamctlConfig`, adding editor inference for this payload's knobs.
- * Returns the config unchanged; the CLI validates it at load.
+ * Identity helper giving editor inference for this payload's knobs, the analog of the
+ * CLI's `defineStreamctlConfig`. Returns the config unchanged; the CLI validates it.
  */
 declare function defineNuxtBaseConfig(config: NuxtBaseConfig): NuxtBaseConfig;
 /** Runtime list of every {@link NuxtBaseCiConfig} key. */
@@ -176,14 +191,14 @@ declare const NUXT_BASE_AUTOMATION_KEYS: string[];
 declare const NUXT_BASE_SECURITY_KEYS: string[];
 /** Runtime list of every {@link NuxtBasePnpmConfig} key. */
 declare const NUXT_BASE_PNPM_KEYS: string[];
+/** Runtime list of every {@link NuxtBaseEditorConfig} key. */
+declare const NUXT_BASE_EDITOR_KEYS: string[];
 /**
- * Every payload KNOB dot-path {@link NuxtBaseConfig} declares (the `ci.*` and
- * `automation.*` leaves plus the top-level knobs); excludes the CLI-universal
- * fields. The consistency test asserts this set equals the RESOLVED preset chain's
- * declared `configKeys` (base + nuxt-app), catching drift between the type and the
- * manifest in either direction.
+ * Every knob dot-path {@link NuxtBaseConfig} declares, excluding the CLI-universal
+ * fields. The consistency test asserts this set equals the resolved preset chain's
+ * `configKeys`, catching drift between the type and the manifest in either direction.
  */
 declare const NUXT_BASE_CONFIG_KEYS: string[];
 
-export { NUXT_BASE_AUTOMATION_KEYS, NUXT_BASE_CI_KEYS, NUXT_BASE_CONFIG_KEYS, NUXT_BASE_DOCKER_KEYS, NUXT_BASE_PNPM_KEYS, NUXT_BASE_SECURITY_KEYS, NUXT_BASE_VERSIONS_KEYS, defineNuxtBaseConfig };
-export type { NuxtBaseAutomationConfig, NuxtBaseCiConfig, NuxtBaseConfig, NuxtBaseDockerConfig, NuxtBasePnpmConfig, NuxtBaseSecurityConfig, NuxtBaseVersionsConfig, Profile };
+export { NUXT_BASE_AUTOMATION_KEYS, NUXT_BASE_CI_KEYS, NUXT_BASE_CONFIG_KEYS, NUXT_BASE_DOCKER_KEYS, NUXT_BASE_EDITOR_KEYS, NUXT_BASE_PNPM_KEYS, NUXT_BASE_SECURITY_KEYS, NUXT_BASE_VERSIONS_KEYS, defineNuxtBaseConfig };
+export type { NuxtBaseAutomationConfig, NuxtBaseCiConfig, NuxtBaseConfig, NuxtBaseDockerConfig, NuxtBaseEditorConfig, NuxtBasePnpmConfig, NuxtBaseSecurityConfig, NuxtBaseVersionsConfig, Profile };