@sidebase/base-config 0.1.0 → 0.2.1

package/presets/base/github/workflows/streamctl-upgrade.yml

@@ -1,18 +1,11 @@
-# Managed by streamctl (full-own, render: automation-upgrade). OFF BY DEFAULT: this
-# file only lands when a repo sets `automation: { upgradePr: true }` in
-# streamctl.config.ts. See the payload README "Upgrade-PR workflow" for enabling.
+# Managed by streamctl. Off by default; lands only when a repo sets
+# `automation: { upgradePr: true }`. See the README section "Upgrade-PR workflow".
 #
-# TOKEN: the PR is opened with `secrets.STREAMCTL_PR_TOKEN` (a GitHub App
-# installation token or a machine-account PAT), NOT the default `GITHUB_TOKEN`.
-# A PR created with `GITHUB_TOKEN` does NOT trigger `pull_request` workflows, so
-# this repo's own `check` gate would never run on the bot's PR. The bot identity
-# for the fleet is still being decided; treat this file as inert and provide the
-# secret before enabling. No registry token is needed: the payload is public npm.
-# A repo with OTHER private dependencies must opt this file out
-# (`files: { ".github/workflows/streamctl-upgrade.yml": "off" }`) and wire its own auth.
+# Needs `secrets.STREAMCTL_PR_TOKEN`: a PR opened with `GITHUB_TOKEN` does not trigger
+# `pull_request` workflows, so the repo's own `check` gate would never run on it.
 #
-# Actions are pinned by full commit SHA (this workflow handles a token); the version
-# tag is in the trailing comment.
+# A repo with private dependencies must opt this file out and wire its own auth:
+# `files: { ".github/workflows/streamctl-upgrade.yml": "off" }`.
 name: streamctl upgrade
 
 on:
@@ -20,8 +13,8 @@ on:
     - cron: "0 6 * * 1" # Mondays 06:00 UTC
   workflow_dispatch:
 
-# Least privilege: every PR/issue write below uses STREAMCTL_PR_TOKEN, so the
-# default token only needs to read the repo for checkout.
+# Every PR and issue write below uses STREAMCTL_PR_TOKEN, so the default token
+# only needs to read the repo for checkout.
 permissions:
   contents: read
 
@@ -32,9 +25,8 @@ jobs:
   upgrade:
     runs-on: ubuntu-latest
     steps:
-      # A bot identity is REQUIRED for the PR (see the header). To mint an App token
-      # in-workflow instead of storing a PAT, uncomment and wire the App credentials,
-      # then use `${{ steps.bot.outputs.token }}` in place of STREAMCTL_PR_TOKEN below:
+      # To mint an App token in-workflow instead of storing a PAT, uncomment this
+      # and use `${{ steps.bot.outputs.token }}` in place of STREAMCTL_PR_TOKEN:
       #
       # - id: bot
       #   uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
@@ -59,8 +51,7 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      # Exit codes drive the branch: 4 = an update is available (proceed); 0 = up to
-      # date (stop, no PR); 3 = the repo already has drift (open an issue, not a PR).
+      # Exit codes: 4 = update available, 0 = up to date, 3 = repo already drifted.
       - id: check
         name: Check for a payload update
         run: |
@@ -91,9 +82,8 @@ jobs:
           set -e
           cat streamctl-upgrade.json
 
-      # exit 2 = the chained sync hit conflicts and ROLLED BACK. Re-run bumping only the
-      # pin + devDependency (no sync) so the PR carries a reviewable diff a human then
-      # reconciles with `streamctl sync --interactive`.
+      # Exit 2 means the sync hit conflicts and rolled back. Bump only the pin and
+      # devDependency so the PR carries a diff a human reconciles interactively.
       - name: Prepare a plan-only bump (interactive sync required)
         if: ${{ steps.upgrade.outputs.code == '2' }}
         run: pnpm streamctl upgrade --no-install --json > streamctl-upgrade.json

package/presets/base/gitignore

@@ -11,9 +11,10 @@ pglite-debug.log
 prisma/*.db
 prisma/migrations/dev
 .DS_Store
-# streamctl local scratch dirs/files (e.g. local.concept) stay untracked.
-local.*
-local.*/
-# CLAUDE.md is managed by streamctl; a user-global gitignore that ignores the
-# filename everywhere would silently untrack it. Force-allow it here.
+# streamctl scratch. Root-anchored so `src/path/local.ts` stays tracked.
+/local.*
+/local.*/
+prisma/local.*
+# CLAUDE.md is managed by streamctl. A user-global gitignore matching the name
+# everywhere would silently untrack it, so force-allow it.
 !CLAUDE.md

package/presets/base/oxlintrc.json

@@ -3,8 +3,9 @@
     "browser": true
   },
   "ignorePatterns": [
-    "local.*",
-    "local.*/"
+    "/local.*",
+    "/local.*/",
+    "prisma/local.*"
   ],
   "plugins": [
     "unicorn",
@@ -24,6 +25,7 @@
     "max-depth": "off",
     "max-nested-callbacks": "off",
     "max-lines": "off",
+    "no-underscore-dangle": "off",
     "no-warning-comments": "off",
     "no-inline-comments": "off",
     "no-map-spread": "off"

package/presets/base/pnpm-workspace.yaml

@@ -1,22 +1,15 @@
-# Managed by streamctl (full-own, render: security). pnpm's own settings file.
+# Managed by streamctl. pnpm's own settings file.
 #
-# SUPPLY-CHAIN COOLDOWN: a version must have been published for ${MIN_RELEASE_AGE}
-# minutes before pnpm will resolve it, so a compromised release has time to be caught
-# and yanked before the fleet installs it. Requires pnpm >= 10.16 (baseline: 10.28.1);
-# it gates fresh resolution only, so `--frozen-lockfile` installs are unaffected.
-# `@sidebase/*` is exempt: the first-party scope (this payload + the streamctl CLI),
-# published by the org itself, so a payload release reaches the fleet the same day.
+# Cooldown: a version must be ${MIN_RELEASE_AGE} minutes old before pnpm resolves it,
+# giving a compromised release time to be yanked. Needs pnpm >= 10.16. Gates fresh
+# resolution only, so `--frozen-lockfile` is unaffected. `@sidebase/*` is exempt.
 #
-# `packages: []` is REQUIRED, not decorative: pnpm defaults it to `**` whenever a
-# pnpm-workspace.yaml exists, which would silently promote every nested package.json
-# (test fixtures, examples) to a workspace project and break `--frozen-lockfile`.
-# A real monorepo owns this key itself, so opt the file out with
-# `files: { "pnpm-workspace.yaml": "off" }` in .streamctl/config.ts.
+# `packages: []` is required: pnpm otherwise defaults it to `**`, promoting every nested
+# package.json to a workspace project and breaking `--frozen-lockfile`. A monorepo should
+# opt out with `files: { "pnpm-workspace.yaml": "off" }`.
 #
-# `onlyBuiltDependencies` is the postinstall-script allowlist: everything else installs
-# with its lifecycle scripts blocked. The baseline covers what the fleet universally
-# needs; add extras via `pnpm: { onlyBuiltDependencies: [...] }` rather than running
-# `pnpm approve-builds` (which writes here and would be reverted on the next sync).
+# `onlyBuiltDependencies` allowlists postinstall scripts. Add extras through the `pnpm`
+# knob, not `pnpm approve-builds`, which writes here and is reverted on the next sync.
 packages: []
 minimumReleaseAge: ${MIN_RELEASE_AGE}
 minimumReleaseAgeExclude:

package/presets/base/preset.json

@@ -3,11 +3,11 @@
   "files": [
     { "path": ".editorconfig", "strategy": "block", "source": "base/editorconfig", "blockMark": "editorconfig" },
     { "path": "tsconfig.json", "strategy": "full", "source": "base/tsconfig.json", "adoption": "expected" },
-    { "path": ".dockerignore", "strategy": "full", "source": "base/dockerignore", "adoption": "expected" },
+    { "path": ".dockerignore", "strategy": "block", "source": "base/dockerignore", "blockMark": "dockerignore" },
     { "path": "pnpm-workspace.yaml", "strategy": "full", "source": "base/pnpm-workspace.yaml", "render": "security", "adoption": "expected" },
     { "path": ".gitignore", "strategy": "block", "source": "base/gitignore", "blockMark": "core" },
     { "path": ".oxlintrc.json", "strategy": "full", "source": "base/oxlintrc.json", "adoption": "expected" },
-    { "path": ".vscode/settings.json", "strategy": "merge", "source": "base/vscode/settings.json", "projectFields": ["editor.fontSize", "editor.rulers", "editor.formatOnSave", "files.exclude", "search.exclude", "files.watcherExclude"] },
+    { "path": ".vscode/settings.json", "strategy": "merge", "source": "base/vscode/settings.json", "render": "editor", "projectFields": ["editor.fontSize", "editor.rulers", "editor.formatOnSave", "files.exclude", "search.exclude", "files.watcherExclude"] },
     { "path": ".vscode/extensions.json", "strategy": "merge", "source": "base/vscode/extensions.json", "projectFields": ["unwantedRecommendations"] },
     { "path": "AGENTS.md", "strategy": "full", "source": "base/AGENTS.md", "adoption": "expected" },
     { "path": "CLAUDE.md", "strategy": "scaffold", "source": "base/CLAUDE.md", "adoption": "expected" },
@@ -19,6 +19,11 @@
         "NODE_VERSION": { "configPath": "versions.node", "default": "24.13.0", "pattern": "^[\\w.+-]+$" }
       }
     },
+    "editor": {
+      "placeholders": {
+        "I18N_SOURCE_LANGUAGE": { "configPath": "editor.i18nSourceLanguage", "default": "de", "pattern": "^[a-z]{2,3}(-[A-Za-z0-9]{2,8})*$" }
+      }
+    },
     "security": {
       "placeholders": {
         "MIN_RELEASE_AGE": { "configPath": "security.minimumReleaseAge", "default": "10080", "pattern": "^\\d+$" }
@@ -30,6 +35,7 @@
   },
   "configKeys": {
     "automation.upgradePr": "boolean",
+    "editor.i18nSourceLanguage": "string",
     "security.minimumReleaseAge": "string",
     "pnpm.onlyBuiltDependencies": "string[]",
     "versions.node": "string",

package/presets/base/vscode/settings.json

@@ -39,5 +39,11 @@
     "toml",
     "gql",
     "graphql"
-  ]
+  ],
+
+  // i18n-ally: the fleet standard is @nuxtjs/i18n with flat dotted keys in
+  // i18n/locales. sourceLanguage is the one field that varies, so it is a knob.
+  "i18n-ally.localesPaths": ["i18n/locales"],
+  "i18n-ally.keystyle": "flat",
+  "i18n-ally.sourceLanguage": "${I18N_SOURCE_LANGUAGE}"
 }

package/presets/config.template.ts

@@ -1,7 +1,7 @@
 import { defineNuxtBaseConfig } from '@sidebase/base-config'
 
-// Scaffolded by `streamctl init`. `defineNuxtBaseConfig` gives typed editor
-// inference for this payload's knobs; the CLI validates the file on every sync.
+// Scaffolded by `streamctl init`. `defineNuxtBaseConfig` types the knobs below.
+// The CLI validates this file on every sync.
 export default defineNuxtBaseConfig({
   package: '__PACKAGE__',
   base: '__BASE__',
@@ -9,10 +9,11 @@ export default defineNuxtBaseConfig({
   profile: '__PROFILE__',
 
   // Optional knobs, uncomment to enable:
-  // ci: { unitTests: true, e2e: true },
+  // ci: { unitTests: true, e2e: true, aptPackages: ['libxml2-utils'] }, // apt extras for the test/e2e jobs
   // versions: { node: '24.13.0', pnpm: '10.28.1' },
   // docker: { aptPackages: ['ffmpeg'] }, // extras; openssl is always installed
   // security: { minimumReleaseAge: '10080' }, // minutes before pnpm installs a release; '0' disables
   // pnpm: { onlyBuiltDependencies: ['sharp'] }, // extras on top of prisma + esbuild
+  // editor: { i18nSourceLanguage: 'en' }, // i18n-ally source language (default: 'de')
   // eslint: { trpcGuard: true },
 })

package/presets/manifest.json

@@ -1,5 +1,5 @@
 {
-  "schemaVersion": 2,
+  "schemaVersion": 3,
   "presets": [
     "base",
     "nuxt-app"

package/presets/nuxt-app/Dockerfile

@@ -5,24 +5,22 @@ ARG PNPM_VERSION=${PNPM_VERSION}
 # --- BUILD STAGE ---
 FROM $NODE_VERSION AS production-base
 
-# A pre-`FROM` ARG is visible only to `FROM`. Re-declare it bare to inherit the
-# global value inside this stage, or $PNPM_VERSION expands to empty below.
+# A pre-`FROM` ARG is visible only to `FROM`. Re-declare it bare here, or
+# $PNPM_VERSION expands to empty below and pnpm installs at latest.
 ARG PNPM_VERSION
 
 WORKDIR /app
 
-# Installed directly rather than through corepack: Node 25 no longer bundles
-# corepack, and `versions.node` declares no ceiling. npm's global bin is already
-# on PATH, so no PNPM_HOME wiring is needed.
+# Not corepack: Node 25 no longer bundles it. npm's global bin is already on
+# PATH, so this needs no PNPM_HOME wiring.
 RUN npm i -g pnpm@$PNPM_VERSION
 
 # Copy pnpm files
 COPY package.json pnpm-lock.yaml .npmrc* ./
 ${DOCKER_PRE_INSTALL}
-# load packages into the virtual store using only information from a lockfile.
-# --ignore-scripts: only package files exist at this layer, so lifecycle scripts
-# (e.g. `postinstall: nuxt prepare`) would run against no sources; the explicit
-# build steps below (docker.buildSteps) cover them against the full tree.
+# --ignore-scripts: only package files exist at this layer, so a `postinstall`
+# like `nuxt prepare` would run against no sources. The build steps below run it
+# against the full tree instead.
 RUN pnpm install --ignore-scripts --frozen-lockfile --prefer-offline
 
 ARG ARG_NUXT_BUILD_CLIENT_SOURCE_MAPS=false
@@ -31,33 +29,30 @@ ${DOCKER_BUILD_ARGS}
 # copy the app, note .dockerignore
 COPY . .
 
-# split commands into seperate RUN to not invalidate entire cache layers
+# split commands into separate RUN to not invalidate entire cache layers
 ${DOCKER_BUILD_STEPS}
 
 # --- FINAL PRODUCTION STAGE ---
 FROM $NODE_VERSION-slim AS production
 
-# openssl is always installed: the Prisma query engine generated in the build
-# stage (debian-openssl-3.0.x) dynamically links libssl3, which slim images do
-# not ship. Without it the app crashes on its first query. APT_PACKAGES adds
-# project-owned extras on top (docker.aptPackages knob, e.g. "ffmpeg").
+# openssl is always installed: the Prisma query engine links libssl3, which slim
+# images do not ship, and the app would crash on its first query without it.
+# APT_PACKAGES adds project extras on top (docker.aptPackages).
 ARG APT_PACKAGES="${APT_PACKAGES}"
 RUN apt-get update && apt-get install -y --no-install-recommends openssl $APT_PACKAGES \
     && rm -rf /var/lib/apt/lists/*
 
-# copy necessary directories from the production-base stage to the final production
-# stage, owned by the runtime uid 1000 rather than root (see the USER switch below)
+# Owned by uid 1000 so a future non-root switch needs no extra chown pass.
 COPY --chown=node:node --from=production-base /app/.output /app/.output
 
 WORKDIR /app
 
 ${DOCKER_PRISMA_RUNTIME}
 ${DOCKER_FINAL_STAGE}
-# Drop to the unprivileged `node` user (uid 1000) the base image already ships.
-# FIXED and outside every knob, so an override cannot re-root the container.
-# Everything the runtime reads or executes is node-owned, and `npm exec` writes
-# its npx cache under /home/node/.npm, which the official image creates writable.
-USER node
+# The container stays root on purpose. A `USER node` switch here breaks any
+# deployment that overrides the CMD with a command needing root: the prisma-studio
+# pods apt-install postgresql-client on start, which fails as an unprivileged user.
+# Set docker.finalStage to "USER node" to opt back in.
 
 # start the app
 CMD [ "sh", "-c", "${DOCKER_START_COMMAND}" ]

package/presets/nuxt-app/github/workflows/ci.yml

@@ -1,15 +1,14 @@
-# Managed by streamctl (full-own, render: ci). NODE_VERSION is a render knob
-# sourced from the version baseline. pnpm is not pinned here: action-setup reads
-# `packageManager` from package.json, the single reconciled source.
-# The build-and-deploy-* preview/staging/production suite is deferred to 0.2.0.
+# Managed by streamctl (full-own, render: ci). Edits here are overwritten on sync.
+# NODE_VERSION comes from the version baseline. pnpm is not pinned here because
+# action-setup reads `packageManager` from package.json.
 name: CI
 
 on:
   pull_request:
     branches: [main]
 
-# Least privilege: the jobs only read the repo. Install/build steps run
-# third-party code, so a read-only default token limits a malicious script.
+# The jobs only read the repo. Install and build run third-party code, so a
+# read-only default token limits what a malicious package can do.
 permissions:
   contents: read
 
@@ -19,6 +18,9 @@ concurrency:
 
 env:
   NODE_VERSION: "${NODE_VERSION}"
+  # Extra apt packages for the test/e2e jobs (ci.aptPackages). Empty by default;
+  # the install step is skipped when unset.
+  CI_APT_PACKAGES: "${CI_APT_PACKAGES}"
 
 jobs:
   lint-typecheck:

package/presets/nuxt-app/github/workflows/pr-preview-cleanup.yml

@@ -5,8 +5,8 @@ on:
     types:
       - unlabeled
 
-# Default-deny at workflow level so any future job starts read-only; the
-# cleanup job below grants itself the exact write scopes it needs.
+# Default-deny so any future job starts read-only. The cleanup job below grants
+# itself the exact write scopes it needs.
 permissions:
   contents: read
 
@@ -28,14 +28,14 @@ jobs:
             const { owner, repo } = context.repo;
             const issue_number = context.issue.number;
 
-              // check first if the label exists on the PR
-              const { data: labels } = await github.rest.issues.listLabelsOnIssue({
-                owner,
-                repo,
-                issue_number
-              });
+            // check first if the label exists on the PR
+            const { data: labels } = await github.rest.issues.listLabelsOnIssue({
+              owner,
+              repo,
+              issue_number
+            });
 
-              const hasPreviewDeployedLabel = labels.some(label => label.name === 'preview-deployed');
-              if (hasPreviewDeployedLabel) {
-                await github.rest.issues.removeLabel({ owner, repo, issue_number, name: 'preview-deployed'});
-              }
+            const hasPreviewDeployedLabel = labels.some(label => label.name === 'preview-deployed');
+            if (hasPreviewDeployedLabel) {
+              await github.rest.issues.removeLabel({ owner, repo, issue_number, name: 'preview-deployed'});
+            }

package/presets/nuxt-app/preset.json

@@ -12,6 +12,7 @@
   "renders": {
     "ci": {
       "placeholders": {
+        "CI_APT_PACKAGES": { "configPath": "ci.aptPackages", "default": "", "pattern": "^$|^[a-z0-9][a-z0-9 +.-]*$", "join": "space" },
         "NODE_VERSION": { "configPath": "versions.node", "default": "24.13.0", "pattern": "^[\\w.+-]+$" }
       },
       "fragments": [
@@ -28,7 +29,8 @@
         "DOCKER_BUILD_ARGS": { "configPath": "docker.buildArgs", "default": "" },
         "DOCKER_BUILD_STEPS": { "configPath": "docker.buildSteps", "default": "RUN pnpm nuxi prepare\nRUN pnpm prisma generate\nRUN pnpm run build" },
         "DOCKER_FINAL_STAGE": { "configPath": "docker.finalStage", "default": "" },
-        "DOCKER_PRISMA_RUNTIME": { "configPath": "docker.prismaRuntime", "default": "COPY --chown=node:node --from=production-base /app/prisma /app/prisma\n\n# Prisma CLI version for `migrate deploy`. Defaults to the baseline; override with --build-arg.\nARG PRISMA_VERSION=6.19.1\n\n# install prisma to run the `migrate deploy`. Runs as root because /app is\n# root-owned from WORKDIR; hand the install output to the runtime user in the\n# same layer so no later chown duplicates node_modules.\nRUN npm i -D prisma@${PRISMA_VERSION} && chown -R node:node /app/node_modules" },
+        "DOCKER_PRISMA_RUNTIME": { "configPath": "docker.prismaRuntime", "default": "COPY --chown=node:node --from=production-base /app/prisma /app/prisma\n\n# Prisma CLI for `migrate deploy`. Override the pin with --build-arg.\nARG PRISMA_VERSION=${PRISMA_VERSION_DEFAULT}\n\n# Chowned to uid 1000 in the same layer, so a later USER switch needs no\n# second pass over node_modules.\nRUN npm i -D prisma@${PRISMA_VERSION} && chown -R node:node /app/node_modules" },
+        "PRISMA_VERSION_DEFAULT": { "configPath": "docker.prismaVersion", "fromDependency": "prisma", "default": "6.19.1", "pattern": "^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$" },
         "DOCKER_START_COMMAND": { "configPath": "docker.startCommand", "default": "npm exec prisma migrate deploy && node --max-old-space-size-percentage=75 .output/server/index.mjs" }
       },
       "passthrough": ["PRISMA_VERSION"]
@@ -37,12 +39,14 @@
   "configKeys": {
     "ci.unitTests": "boolean",
     "ci.e2e": "boolean",
+    "ci.aptPackages": "string[]",
     "docker.aptPackages": "string[]",
     "docker.preInstall": "string",
     "docker.buildArgs": "string",
     "docker.buildSteps": "string",
     "docker.finalStage": "string",
     "docker.prismaRuntime": "string",
+    "docker.prismaVersion": "string",
     "docker.startCommand": "string",
     "eslint": "object"
   },

package/presets/nuxt-app/templates/ci/e2e-job.yml

@@ -23,6 +23,9 @@
           --health-retries 5
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Install apt packages
+        if: ${{ env.CI_APT_PACKAGES != '' }}
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends $CI_APT_PACKAGES
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -31,9 +34,6 @@
       - run: pnpm install --frozen-lockfile
       # tests may import the generated Prisma client
       - run: pnpm prisma generate
-      # Schema setup (db push / migrate) and seeding are left to the consumer's
-      # test:e2e script on purpose: they are coupled to fixture seeding, which only
-      # the app's own harness owns, and CI cannot guess the reset/migrate/seed
-      # strategy. This job provides a healthy, reachable DB (DATABASE_URL above) and
-      # the generated client; test:e2e must create and seed its own schema.
+      # This job provides a reachable DB and the generated client. Schema setup and
+      # seeding belong to test:e2e, which owns the fixture strategy CI cannot guess.
       - run: pnpm test:e2e

package/presets/nuxt-app/templates/ci/test-job.yml

@@ -2,6 +2,9 @@
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - name: Install apt packages
+        if: ${{ env.CI_APT_PACKAGES != '' }}
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends $CI_APT_PACKAGES
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with: