@sidebase/base-config 0.1.0

package/package.json

@@ -0,0 +1,94 @@
+{
+  "name": "@sidebase/base-config",
+  "version": "0.1.0",
+  "description": "Shared @sidebase base configuration for Nuxt repos: ESLint / Prisma / tsconfig factories on npm, plus the streamctl file-sync preset payload",
+  "keywords": [
+    "sidebase",
+    "config-sync",
+    "nuxt",
+    "eslint",
+    "prisma",
+    "streamctl"
+  ],
+  "type": "module",
+  "license": "MIT",
+  "sideEffects": false,
+  "homepage": "https://github.com/sidebase/base-config#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sidebase/base-config.git"
+  },
+  "bugs": {
+    "url": "https://github.com/sidebase/base-config/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "docs/migration.md",
+    "presets",
+    "tsconfig.base.json"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/config.d.ts",
+      "import": "./dist/config.mjs"
+    },
+    "./tsconfig.base": "./tsconfig.base.json",
+    "./config": {
+      "types": "./dist/config.d.ts",
+      "import": "./dist/config.mjs"
+    },
+    "./eslint": {
+      "types": "./dist/eslint/index.d.ts",
+      "import": "./dist/eslint/index.mjs"
+    },
+    "./prisma": {
+      "types": "./dist/prisma/index.d.ts",
+      "import": "./dist/prisma/index.mjs"
+    }
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "dependencies": {
+    "@antfu/eslint-config": "^7.4",
+    "ufo": "^1.6.4"
+  },
+  "peerDependencies": {
+    "@prisma/client": "^6.19",
+    "eslint": "^10.5.0",
+    "prisma": "^6.19"
+  },
+  "peerDependenciesMeta": {
+    "@prisma/client": {
+      "optional": true
+    },
+    "prisma": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "^0.18.5",
+    "@prisma/client": "^6.19.3",
+    "@sidebase/streamctl": "^0.2.0",
+    "@types/node": "^24.0.0",
+    "eslint": "^10.5.0",
+    "jiti": "^2.7.0",
+    "prisma": "^6.19.3",
+    "publint": "^0.3.21",
+    "typescript": "^6.0.0",
+    "unbuild": "^3.5.0",
+    "vitest": "^3.0.0",
+    "yaml": "^2.9.0"
+  },
+  "scripts": {
+    "build": "unbuild",
+    "typecheck": "tsc --noEmit -p tsconfig.json && tsc -p tsconfig.test.json",
+    "test": "vitest run",
+    "lint": "eslint .",
+    "validate:presets": "node scripts/validate-presets.mjs",
+    "e2e:dry-run": "pnpm build && node scripts/e2e-dry-run.mjs"
+  }
+}

package/presets/base/AGENTS.md

@@ -0,0 +1,31 @@
+# Agent instructions
+
+These are the shared conventions every coding agent working in this repository must
+follow. They are the same across every repo in the fleet.
+
+## Golden rules
+
+- Prefer small, reviewable changes; explain the intent, not just the diff.
+- Match the surrounding code and existing patterns before introducing new ones.
+- Never commit secrets, credentials, or generated build artifacts.
+- Keep all code, comments and identifiers in English.
+
+## Types & correctness
+
+- Use precise types; avoid `any` and unchecked casts. Parse and validate external input at the boundary instead of trusting it downstream.
+- Handle the error and empty-result paths, not just the happy path.
+
+## Tests & verification
+
+- Run the project's typecheck, lint, and test scripts before proposing a change.
+- Add or update tests for the behavior you change; don't weaken existing assertions to make a change pass.
+
+## Commits & pull requests
+
+- Use Conventional Commits (`feat:`, `fix:`, `refactor:`, `test:`, `docs:`).
+- Keep one logical change per commit and describe the WHAT and WHY.
+
+## Dependencies
+
+- Use the repository's pinned package manager; do not switch tools ad hoc.
+- Justify every new dependency; prefer existing utilities or the standard library.

package/presets/base/CLAUDE.md

@@ -0,0 +1,3 @@
+# CLAUDE.md
+
+@AGENTS.md

package/presets/base/dockerignore

@@ -0,0 +1,18 @@
+.git
+.github
+node_modules
+npm-debug*
+.nuxt
+.output
+.data
+dist
+tests
+*.log
+.env
+.env.*
+!.env.example
+# The build-stage COPY globs `.npmrc*`; keep token-bearing backups
+# (`.npmrc.local`, `.npmrc.bak`, ...) out of the build context. `.npmrc` itself
+# is intentionally allowed through.
+.npmrc.*
+.DS_Store

package/presets/base/editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+indent_style = space
+indent_size = 2
+insert_final_newline = true
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

package/presets/base/github/workflows/streamctl-upgrade.yml

@@ -0,0 +1,130 @@
+# Managed by streamctl (full-own, render: automation-upgrade). OFF BY DEFAULT: this
+# file only lands when a repo sets `automation: { upgradePr: true }` in
+# streamctl.config.ts. See the payload README "Upgrade-PR workflow" for enabling.
+#
+# TOKEN: the PR is opened with `secrets.STREAMCTL_PR_TOKEN` (a GitHub App
+# installation token or a machine-account PAT), NOT the default `GITHUB_TOKEN`.
+# A PR created with `GITHUB_TOKEN` does NOT trigger `pull_request` workflows, so
+# this repo's own `check` gate would never run on the bot's PR. The bot identity
+# for the fleet is still being decided; treat this file as inert and provide the
+# secret before enabling. No registry token is needed: the payload is public npm.
+# A repo with OTHER private dependencies must opt this file out
+# (`files: { ".github/workflows/streamctl-upgrade.yml": "off" }`) and wire its own auth.
+#
+# Actions are pinned by full commit SHA (this workflow handles a token); the version
+# tag is in the trailing comment.
+name: streamctl upgrade
+
+on:
+  schedule:
+    - cron: "0 6 * * 1" # Mondays 06:00 UTC
+  workflow_dispatch:
+
+# Least privilege: every PR/issue write below uses STREAMCTL_PR_TOKEN, so the
+# default token only needs to read the repo for checkout.
+permissions:
+  contents: read
+
+env:
+  NODE_VERSION: "${NODE_VERSION}"
+
+jobs:
+  upgrade:
+    runs-on: ubuntu-latest
+    steps:
+      # A bot identity is REQUIRED for the PR (see the header). To mint an App token
+      # in-workflow instead of storing a PAT, uncomment and wire the App credentials,
+      # then use `${{ steps.bot.outputs.token }}` in place of STREAMCTL_PR_TOKEN below:
+      #
+      # - id: bot
+      #   uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
+      #   with:
+      #     app-id: ${{ secrets.STREAMCTL_APP_ID }}
+      #     private-key: ${{ secrets.STREAMCTL_APP_PRIVATE_KEY }}
+
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          run_install: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      # Exit codes drive the branch: 4 = an update is available (proceed); 0 = up to
+      # date (stop, no PR); 3 = the repo already has drift (open an issue, not a PR).
+      - id: check
+        name: Check for a payload update
+        run: |
+          set +e
+          pnpm streamctl check --fail-on outdated --json > streamctl-check.json
+          echo "code=$?" >> "$GITHUB_OUTPUT"
+          set -e
+          cat streamctl-check.json
+
+      - name: Open a drift issue (repo already diverged)
+        if: ${{ steps.check.outputs.code == '3' }}
+        env:
+          GH_TOKEN: ${{ secrets.STREAMCTL_PR_TOKEN }}
+        run: |
+          gh issue create \
+            --title "streamctl: managed files have drifted" \
+            --label streamctl \
+            --body "\`streamctl check\` reports pre-existing drift, so the automated upgrade was skipped. Run \`pnpm streamctl sync\` locally, commit the result, then re-run this workflow."
+
+      # Only upgrade when an update is actually available (check exit 4).
+      - id: upgrade
+        name: Upgrade the payload
+        if: ${{ steps.check.outputs.code == '4' }}
+        run: |
+          set +e
+          pnpm streamctl upgrade --json > streamctl-upgrade.json
+          echo "code=$?" >> "$GITHUB_OUTPUT"
+          set -e
+          cat streamctl-upgrade.json
+
+      # exit 2 = the chained sync hit conflicts and ROLLED BACK. Re-run bumping only the
+      # pin + devDependency (no sync) so the PR carries a reviewable diff a human then
+      # reconciles with `streamctl sync --interactive`.
+      - name: Prepare a plan-only bump (interactive sync required)
+        if: ${{ steps.upgrade.outputs.code == '2' }}
+        run: pnpm streamctl upgrade --no-install --json > streamctl-upgrade.json
+
+      - name: Open the upgrade PR (clean reconcile)
+        if: ${{ steps.upgrade.outputs.code == '0' }}
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ secrets.STREAMCTL_PR_TOKEN }}
+          branch: chore/streamctl-upgrade
+          commit-message: "chore: upgrade the streamctl payload"
+          title: "chore: upgrade the streamctl payload"
+          body: |
+            Automated payload upgrade: the managed files were reconciled cleanly by
+            `streamctl upgrade`. Review the diff; `streamctl-upgrade.json` (in the run
+            logs) has the full sync summary and dependency bumps.
+          labels: streamctl
+
+      - name: Open a plan-only PR (conflicts need interactive sync)
+        if: ${{ steps.upgrade.outputs.code == '2' }}
+        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        with:
+          token: ${{ secrets.STREAMCTL_PR_TOKEN }}
+          branch: chore/streamctl-upgrade
+          commit-message: "chore: bump the streamctl payload pin (interactive sync required)"
+          title: "chore: streamctl payload upgrade needs interactive sync"
+          body: |
+            The automated `streamctl upgrade` hit conflicts and rolled the sync back, so
+            only the payload pin + devDependency were bumped here. Finish the upgrade by
+            hand: check out this branch, run `pnpm streamctl sync --interactive`, resolve
+            each conflict, and push.
+          labels: |
+            streamctl
+            needs-interactive-upgrade

package/presets/base/gitignore

@@ -0,0 +1,19 @@
+node_modules
+.output
+.nuxt
+.data
+dist
+.env
+.env.*
+!.env.example
+*.log
+pglite-debug.log
+prisma/*.db
+prisma/migrations/dev
+.DS_Store
+# streamctl local scratch dirs/files (e.g. local.concept) stay untracked.
+local.*
+local.*/
+# CLAUDE.md is managed by streamctl; a user-global gitignore that ignores the
+# filename everywhere would silently untrack it. Force-allow it here.
+!CLAUDE.md

package/presets/base/oxlintrc.json

@@ -0,0 +1,31 @@
+{
+  "env": {
+    "browser": true
+  },
+  "ignorePatterns": [
+    "local.*",
+    "local.*/"
+  ],
+  "plugins": [
+    "unicorn",
+    "typescript",
+    "oxc"
+  ],
+  "categories": {
+    "correctness": "deny",
+    "perf": "deny",
+    "suspicious": "deny",
+    "pedantic": "deny"
+  },
+  "rules": {
+    "unicorn/no-useless-undefined": "off",
+    "eslint/no-console": "error",
+    "max-lines-per-function": "off",
+    "max-depth": "off",
+    "max-nested-callbacks": "off",
+    "max-lines": "off",
+    "no-warning-comments": "off",
+    "no-inline-comments": "off",
+    "no-map-spread": "off"
+  }
+}

package/presets/base/pnpm-workspace.yaml

@@ -0,0 +1,27 @@
+# Managed by streamctl (full-own, render: security). pnpm's own settings file.
+#
+# SUPPLY-CHAIN COOLDOWN: a version must have been published for ${MIN_RELEASE_AGE}
+# minutes before pnpm will resolve it, so a compromised release has time to be caught
+# and yanked before the fleet installs it. Requires pnpm >= 10.16 (baseline: 10.28.1);
+# it gates fresh resolution only, so `--frozen-lockfile` installs are unaffected.
+# `@sidebase/*` is exempt: the first-party scope (this payload + the streamctl CLI),
+# published by the org itself, so a payload release reaches the fleet the same day.
+#
+# `packages: []` is REQUIRED, not decorative: pnpm defaults it to `**` whenever a
+# pnpm-workspace.yaml exists, which would silently promote every nested package.json
+# (test fixtures, examples) to a workspace project and break `--frozen-lockfile`.
+# A real monorepo owns this key itself, so opt the file out with
+# `files: { "pnpm-workspace.yaml": "off" }` in .streamctl/config.ts.
+#
+# `onlyBuiltDependencies` is the postinstall-script allowlist: everything else installs
+# with its lifecycle scripts blocked. The baseline covers what the fleet universally
+# needs; add extras via `pnpm: { onlyBuiltDependencies: [...] }` rather than running
+# `pnpm approve-builds` (which writes here and would be reverted on the next sync).
+packages: []
+minimumReleaseAge: ${MIN_RELEASE_AGE}
+minimumReleaseAgeExclude:
+  - "@sidebase/*"
+onlyBuiltDependencies:
+  - "@prisma/client"
+  - "esbuild"
+  - "prisma"

package/presets/base/preset.json

@@ -0,0 +1,38 @@
+{
+  "name": "base",
+  "files": [
+    { "path": ".editorconfig", "strategy": "block", "source": "base/editorconfig", "blockMark": "editorconfig" },
+    { "path": "tsconfig.json", "strategy": "full", "source": "base/tsconfig.json", "adoption": "expected" },
+    { "path": ".dockerignore", "strategy": "full", "source": "base/dockerignore", "adoption": "expected" },
+    { "path": "pnpm-workspace.yaml", "strategy": "full", "source": "base/pnpm-workspace.yaml", "render": "security", "adoption": "expected" },
+    { "path": ".gitignore", "strategy": "block", "source": "base/gitignore", "blockMark": "core" },
+    { "path": ".oxlintrc.json", "strategy": "full", "source": "base/oxlintrc.json", "adoption": "expected" },
+    { "path": ".vscode/settings.json", "strategy": "merge", "source": "base/vscode/settings.json", "projectFields": ["editor.fontSize", "editor.rulers", "editor.formatOnSave", "files.exclude", "search.exclude", "files.watcherExclude"] },
+    { "path": ".vscode/extensions.json", "strategy": "merge", "source": "base/vscode/extensions.json", "projectFields": ["unwantedRecommendations"] },
+    { "path": "AGENTS.md", "strategy": "full", "source": "base/AGENTS.md", "adoption": "expected" },
+    { "path": "CLAUDE.md", "strategy": "scaffold", "source": "base/CLAUDE.md", "adoption": "expected" },
+    { "path": ".github/workflows/streamctl-upgrade.yml", "strategy": "full", "source": "base/github/workflows/streamctl-upgrade.yml", "render": "automation-upgrade", "enabledBy": "automation.upgradePr", "adoption": "unexpected" }
+  ],
+  "renders": {
+    "automation-upgrade": {
+      "placeholders": {
+        "NODE_VERSION": { "configPath": "versions.node", "default": "24.13.0", "pattern": "^[\\w.+-]+$" }
+      }
+    },
+    "security": {
+      "placeholders": {
+        "MIN_RELEASE_AGE": { "configPath": "security.minimumReleaseAge", "default": "10080", "pattern": "^\\d+$" }
+      },
+      "fragments": [
+        { "forEach": "pnpm.onlyBuiltDependencies", "source": "base/templates/pnpm/only-built-dependency.yml" }
+      ]
+    }
+  },
+  "configKeys": {
+    "automation.upgradePr": "boolean",
+    "security.minimumReleaseAge": "string",
+    "pnpm.onlyBuiltDependencies": "string[]",
+    "versions.node": "string",
+    "versions.pnpm": "string"
+  }
+}

package/presets/base/templates/pnpm/only-built-dependency.yml

@@ -0,0 +1 @@
+  - "${ITEM}"

package/presets/base/tsconfig.json

@@ -0,0 +1,3 @@
+{
+  "extends": "@sidebase/base-config/tsconfig.base"
+}

package/presets/base/vscode/extensions.json

@@ -0,0 +1,8 @@
+{
+  "recommendations": [
+    "editorconfig.editorconfig",
+    "dbaeumer.vscode-eslint",
+    "vue.volar",
+    "bradlc.vscode-tailwindcss"
+  ]
+}

package/presets/base/vscode/settings.json

@@ -0,0 +1,43 @@
+{
+  // Disable the default formatter, use eslint instead
+  "prettier.enable": false,
+  "eslint.useFlatConfig": true,
+  "typescript.tsdk": "node_modules/typescript/lib",
+
+  // Auto fix
+  "editor.codeActionsOnSave": {
+    "source.fixAll.eslint": "explicit",
+    "source.organizeImports": "never"
+  },
+
+  // Silence the stylistic rules in the IDE, but still auto fix them
+  "eslint.rules.customizations": [
+    { "rule": "style/*", "severity": "off" },
+    { "rule": "format/*", "severity": "off" },
+    { "rule": "*-indent", "severity": "off" },
+    { "rule": "*-spacing", "severity": "off" },
+    { "rule": "*-spaces", "severity": "off" },
+    { "rule": "*-order", "severity": "off" },
+    { "rule": "*-dangle", "severity": "off" },
+    { "rule": "*-newline", "severity": "off" },
+    { "rule": "*quotes", "severity": "off" },
+    { "rule": "*semi", "severity": "off" }
+  ],
+
+  // Enable eslint for all supported languages
+  "eslint.validate": [
+    "javascript",
+    "javascriptreact",
+    "typescript",
+    "typescriptreact",
+    "vue",
+    "html",
+    "markdown",
+    "json",
+    "jsonc",
+    "yaml",
+    "toml",
+    "gql",
+    "graphql"
+  ]
+}

package/presets/config.template.ts

@@ -0,0 +1,18 @@
+import { defineNuxtBaseConfig } from '@sidebase/base-config'
+
+// Scaffolded by `streamctl init`. `defineNuxtBaseConfig` gives typed editor
+// inference for this payload's knobs; the CLI validates the file on every sync.
+export default defineNuxtBaseConfig({
+  package: '__PACKAGE__',
+  base: '__BASE__',
+  version: '__VERSION__',
+  profile: '__PROFILE__',
+
+  // Optional knobs, uncomment to enable:
+  // ci: { unitTests: true, e2e: true },
+  // versions: { node: '24.13.0', pnpm: '10.28.1' },
+  // docker: { aptPackages: ['ffmpeg'] }, // extras; openssl is always installed
+  // security: { minimumReleaseAge: '10080' }, // minutes before pnpm installs a release; '0' disables
+  // pnpm: { onlyBuiltDependencies: ['sharp'] }, // extras on top of prisma + esbuild
+  // eslint: { trpcGuard: true },
+})

package/presets/manifest.json

@@ -0,0 +1,17 @@
+{
+  "schemaVersion": 2,
+  "presets": [
+    "base",
+    "nuxt-app"
+  ],
+  "profiles": [
+    {
+      "name": "nuxt-4",
+      "detect": {
+        "dependency": "nuxt",
+        "majorIs": 4
+      }
+    }
+  ],
+  "defaultBase": "nuxt-app"
+}

package/presets/nuxt-app/Dockerfile

@@ -0,0 +1,63 @@
+# see https://docs.docker.com/engine/reference/builder/#understand-how-arg-and-from-interact
+ARG NODE_VERSION=node:${NODE_VERSION}
+ARG PNPM_VERSION=${PNPM_VERSION}
+
+# --- BUILD STAGE ---
+FROM $NODE_VERSION AS production-base
+
+# A pre-`FROM` ARG is visible only to `FROM`. Re-declare it bare to inherit the
+# global value inside this stage, or $PNPM_VERSION expands to empty below.
+ARG PNPM_VERSION
+
+WORKDIR /app
+
+# Installed directly rather than through corepack: Node 25 no longer bundles
+# corepack, and `versions.node` declares no ceiling. npm's global bin is already
+# on PATH, so no PNPM_HOME wiring is needed.
+RUN npm i -g pnpm@$PNPM_VERSION
+
+# Copy pnpm files
+COPY package.json pnpm-lock.yaml .npmrc* ./
+${DOCKER_PRE_INSTALL}
+# load packages into the virtual store using only information from a lockfile.
+# --ignore-scripts: only package files exist at this layer, so lifecycle scripts
+# (e.g. `postinstall: nuxt prepare`) would run against no sources; the explicit
+# build steps below (docker.buildSteps) cover them against the full tree.
+RUN pnpm install --ignore-scripts --frozen-lockfile --prefer-offline
+
+ARG ARG_NUXT_BUILD_CLIENT_SOURCE_MAPS=false
+ENV NUXT_BUILD_CLIENT_SOURCE_MAPS=$ARG_NUXT_BUILD_CLIENT_SOURCE_MAPS
+${DOCKER_BUILD_ARGS}
+# copy the app, note .dockerignore
+COPY . .
+
+# split commands into seperate RUN to not invalidate entire cache layers
+${DOCKER_BUILD_STEPS}
+
+# --- FINAL PRODUCTION STAGE ---
+FROM $NODE_VERSION-slim AS production
+
+# openssl is always installed: the Prisma query engine generated in the build
+# stage (debian-openssl-3.0.x) dynamically links libssl3, which slim images do
+# not ship. Without it the app crashes on its first query. APT_PACKAGES adds
+# project-owned extras on top (docker.aptPackages knob, e.g. "ffmpeg").
+ARG APT_PACKAGES="${APT_PACKAGES}"
+RUN apt-get update && apt-get install -y --no-install-recommends openssl $APT_PACKAGES \
+    && rm -rf /var/lib/apt/lists/*
+
+# copy necessary directories from the production-base stage to the final production
+# stage, owned by the runtime uid 1000 rather than root (see the USER switch below)
+COPY --chown=node:node --from=production-base /app/.output /app/.output
+
+WORKDIR /app
+
+${DOCKER_PRISMA_RUNTIME}
+${DOCKER_FINAL_STAGE}
+# Drop to the unprivileged `node` user (uid 1000) the base image already ships.
+# FIXED and outside every knob, so an override cannot re-root the container.
+# Everything the runtime reads or executes is node-owned, and `npm exec` writes
+# its npx cache under /home/node/.npm, which the official image creates writable.
+USER node
+
+# start the app
+CMD [ "sh", "-c", "${DOCKER_START_COMMAND}" ]

package/presets/nuxt-app/eslint.config.ts

@@ -0,0 +1,5 @@
+import { createSidebaseEslint } from '@sidebase/base-config/eslint'
+
+// Project-owned wrapper: chain `.append(...)` for repo-local rules. Shared logic
+// updates via the @sidebase/base-config version bump, not file re-sync.
+export default createSidebaseEslint()

package/presets/nuxt-app/github/workflows/ci.yml

@@ -0,0 +1,66 @@
+# Managed by streamctl (full-own, render: ci). NODE_VERSION is a render knob
+# sourced from the version baseline. pnpm is not pinned here: action-setup reads
+# `packageManager` from package.json, the single reconciled source.
+# The build-and-deploy-* preview/staging/production suite is deferred to 0.2.0.
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+
+# Least privilege: the jobs only read the repo. Install/build steps run
+# third-party code, so a read-only default token limits a malicious script.
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  NODE_VERSION: "${NODE_VERSION}"
+
+jobs:
+  lint-typecheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          run_install: false
+
+      - name: Use Node.js ${{ env.NODE_VERSION }}
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm streamctl check
+      - run: pnpm prisma format && git diff --exit-code prisma/schema.prisma
+      - run: pnpm prisma generate
+      - run: pnpm lint
+      - run: pnpm jsonsort -c i18n/locales/{**/*,*}.json
+      - run: pnpm typecheck
+
+  build:
+    needs: lint-typecheck
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          run_install: false
+
+      - name: Use Node.js ${{ env.NODE_VERSION }}
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm nuxi prepare && pnpm prisma generate && pnpm build