@sidebase/base-config 0.2.1 → 0.3.0

package/README.md

@@ -175,9 +175,9 @@ covers both.
 
 `defineNuxtBaseConfig` returns the config unchanged. Its job is typed editor inference
 for this payload's knobs: completion and type checking on `ci`, `versions`, `docker`,
-`automation`, `security`, `pnpm`, `editor`, and the whole `eslint` option surface, plus `profile`
-narrowed to the profile names that actually exist. Without it the object is an untyped
-literal, so a typo such as `ci: { unitTest: true }` stays silent in your editor.
+`automation`, `security`, `pnpm` and `editor`, plus `profile` narrowed to the profile
+names that actually exist. Without it the object is an untyped literal, so a typo such as
+`ci: { unitTest: true }` stays silent in your editor.
 
 The CLI shape-checks the config against the manifest when it loads it, so a sync still
 works without the helper. The helper is what moves that feedback into your editor.
@@ -390,6 +390,7 @@ minimumReleaseAgeExclude:
   - "@sidebase/*"
 onlyBuiltDependencies:            # the postinstall-script allowlist
   - "@prisma/client"
+  - "@prisma/engines"
   - "esbuild"
   - "prisma"
 ```
@@ -399,7 +400,7 @@ onlyBuiltDependencies:            # the postinstall-script allowlist
 installs it. It needs pnpm 10.16 or newer and gates *fresh resolution only*, so
 `pnpm install --frozen-lockfile` replays the lockfile untouched and CI is unaffected.
 
-The pnpm baseline shipped to consumers is 10.28.1 (`presets/*/preset.json`). This repo's
+The pnpm baseline shipped to consumers is 10.34.5 (`presets/*/preset.json`). This repo's
 own `packageManager` pin tracks separately and is usually newer; the two are independent
 by design, not drift.
 
@@ -460,7 +461,7 @@ The `nuxt-app` preset ships a managed `.github/workflows/ci.yml`. Its `lint-type
 | ---- | ------- | ------ |
 | `ci.unitTests` | `false` | Add the `test` job (`pnpm test`) |
 | `ci.e2e` | `false` | Add the `e2e` job, with a health-checked postgres service |
-| `ci.aptPackages` | `[]` | System packages `apt-get`-installed in the `test` and `e2e` jobs |
+| `ci.aptPackages` | `[]` | System packages `apt-get`-installed in the `test` and `e2e` jobs and the upgrade validation |
 
 `ci.aptPackages` is the CI counterpart to `docker.aptPackages` below: extra system packages
 on top of what the runner image already carries, for a binary the suite needs and
@@ -498,7 +499,7 @@ out:
 | `docker.buildSteps` | the build-command block | `nuxi prepare` / `prisma generate` / `run build` |
 | `docker.finalStage` | final stage, before `CMD` | `""` |
 | `docker.prismaRuntime` | final stage | copy the schema + install the `migrate deploy` CLI |
-| `docker.startCommand` | inside `CMD` | `prisma migrate deploy` then the node server |
+| `docker.startCommand` | shell-form `CMD`, one line | `prisma migrate deploy` then `exec node ...` |
 
 A seventh knob is different in kind: a validated version, not raw text.
 
@@ -517,7 +518,7 @@ export default {
     preInstall: "COPY ./vendor ./vendor", // vendored dep needed at install time
     buildSteps: "RUN pnpm nuxi prepare\nRUN pnpm run build", // a repo with no Prisma
     prismaRuntime: "", // drop Prisma entirely
-    startCommand: "node .output/server/index.mjs",
+    startCommand: "exec node .output/server/index.mjs",
   },
 };
 ```
@@ -540,7 +541,7 @@ three default to `""`.
 
 **`prismaRuntime` and `startCommand` are coupled.** Override one and you must override the
 other. `prismaRuntime` is what installs the Prisma CLI into the final stage, and the
-DEFAULT `startCommand` is `npm exec prisma migrate deploy && node ...`. Setting only
+DEFAULT `startCommand` is `npm exec prisma migrate deploy && exec node ...`. Setting only
 `prismaRuntime: ""` therefore produces an image whose `CMD` invokes a CLI that is no longer
 installed, and the container fails to start. The example above overrides both, which is why
 it is safe to copy; a single-knob change is not. Drop the `migrate deploy` half of
@@ -590,47 +591,80 @@ sync. A repo that genuinely needs a different layout should opt the file out
 
 The base preset ships `.github/workflows/streamctl-upgrade.yml`, a scheduled workflow
 that opens a PR when a payload update is available. It is an `enabledBy`-gated managed
-file, off by default: it only lands once a repo opts in, and it is inert until the
-required token exists.
+file, off by default. It only lands once a repo opts in.
 
 Enable it in `streamctl.config.ts`, then `streamctl sync`:
 
 ```ts
 export default {
   // ...
-  automation: { upgradePr: true },
+  automation: {
+    upgradePr: true,
+    // allowWorkflowUpdates: true,
+    // prTokenSecret: "STREAMCTL_PR_TOKEN",
+  },
   // optional: version pins, default to the payload's baseline. `node` feeds
-  // ci.yml + the Dockerfile; `pnpm` feeds the Dockerfile only (CI pins pnpm
-  // via package.json#packageManager):
-  // versions: { node: "24.13.0", pnpm: "10.28.1" },
+  // ci.yml, the Dockerfile and this workflow; `pnpm` feeds the Dockerfile only
+  // (CI pins pnpm via package.json#packageManager):
+  // versions: { node: "24.21.0", pnpm: "10.34.5" },
 };
 ```
 
-Required secrets:
-
-| Secret | Purpose |
-| ------ | ------- |
-| `STREAMCTL_PR_TOKEN` | A GitHub App installation token or machine-account PAT used to open the PR. **Not** the default `GITHUB_TOKEN`: a PR opened with `GITHUB_TOKEN` does not trigger `pull_request` workflows, so the repo's own `check` gate would never run on the bot PR. |
-
-That is the only one, because the payload is public npm, so the install step needs no registry
-token. A repo whose *other* dependencies are private must opt this full-owned workflow
-out and wire its own auth.
+By default, the workflow uses `GITHUB_TOKEN` and omits changes under
+`.github/workflows/**`. If an update contains workflow changes, it opens a draft PR
+with every other safe change and lists the omitted files and completion commands.
 
-The workflow branches on the CLI exit codes: `check` exit 4 opens a PR; exit 0 stops;
-exit 3 (pre-existing drift) opens a drift issue instead. A clean `upgrade` (exit 0)
-produces a reconcile PR; a conflicted `upgrade` (exit 2, rolled back) produces a
-plan-only PR labelled `needs-interactive-upgrade` for a human to finish with
-`streamctl sync --interactive`.
+Set `automation.allowWorkflowUpdates` to `true` to include workflow changes. Add a
+`STREAMCTL_PR_TOKEN` repository secret with `Contents`, `Pull requests`, and
+`Workflows` write access. Change `automation.prTokenSecret` when the secret has another
+name. A fine-grained PAT or GitHub App token works. The built-in `GITHUB_TOKEN` cannot
+receive `Workflows` permission.
 
-> The org bot identity is still being decided. Until the runbook lands, leave the
-> workflow disabled. Design only; nothing is enabled anywhere.
+| Knob | Default | Effect |
+| ---- | ------- | ------ |
+| `automation.upgradePr` | `false` | Sync the scheduled upgrade workflow |
+| `automation.allowWorkflowUpdates` | `false` | Include `.github/workflows/**` changes in upgrade PRs |
+| `automation.prTokenSecret` | `"STREAMCTL_PR_TOKEN"` | Secret used when workflow updates are enabled |
+| `automation.prepare` | `"pnpm prisma generate"` | One-line command run before validation |
+
+`automation.prepare` generates what `pnpm install` does not, before validation. One line;
+chain with `&&`. Set `""` for a repo without Prisma.
+
+The upgrade job runs `streamctl check` and every available lint, typecheck, test, and
+build script before opening a ready PR. PRs created with `GITHUB_TOKEN` do not trigger
+their own `pull_request` workflows, so these inline checks are required. The external
+token allows the new PR to trigger them normally.
+
+The workflow handles CLI results as follows:
+
+- `check` exit 0: stop without a PR.
+- `check` exit 3: open or update one drift issue.
+- `check` exit 4: attempt the upgrade.
+- `upgrade` exit 0: validate and open a ready PR, or a draft when workflow files were omitted.
+- `upgrade` exit 2: inspect conflicts using the pre-upgrade status.
+- Any other exit: fail the workflow.
+
+A conflict is safe to apply when the same path was previously `full` managed and
+`in-sync`. The workflow retries those generated replacements with `--force`. Any new,
+modified, malformed, or structurally conflicting path produces a draft PR instead.
+Workflow changes also produce a draft unless explicitly allowed. Drafts contain every
+safe change, keep conflicting and omitted workflow files at their current content, list
+what remains, and give the commands needed to finish the upgrade. When a malformed or
+structurally invalid file blocks `--force`, the draft only updates the payload version
+and lockfile.
+
+Diagnostic JSON stays under the runner's temporary directory. Upgrade branches include
+the target version, so a later release does not overwrite an older open PR.
+
+The payload is public npm. A repo with other private dependencies must opt this workflow
+out and provide its own install authentication.
 
 ### Action pinning policy
 
 Every action in every managed workflow and CI job fragment is pinned by full commit SHA,
 with the version tag in a trailing comment. Moving tags can be re-pointed, so tags are
-never trusted, secrets or not. `test/workflow-pins.test.ts` sweeps all preset
-templates and fails on any `uses:` that is not a 40-hex SHA.
+never trusted, secrets or not. `test/payload.test.ts` renders every managed workflow
+and fails on any `uses:` that is not a 40-hex SHA.
 
 The shipped pins track `actions/checkout` v6, `actions/setup-node` v6, and
 `pnpm/action-setup` v6. These majors run on the node24 action runtime, which needs a

package/dist/config.d.mts

@@ -1,5 +1,3 @@
-import { C as CreateSidebaseEslintOptions } from './shared/base-config.BoberVUk.mjs';
-
 /**
  * Version-baseline profile, named for the framework and its major so two majors can
  * coexist during a migration.
@@ -18,8 +16,8 @@ interface NuxtBaseCiConfig {
     /** Include the e2e job + postgres service. */
     e2e?: boolean;
     /**
-     * Packages apt-installed in the `test` and `e2e` jobs, for a binary the suite needs
-     * that `ubuntu-latest` lacks. Empty renders the install step inert, not absent.
+     * Packages apt-installed in the `test` and `e2e` jobs and the upgrade validation, for
+     * a binary the suite needs that `ubuntu-latest` lacks. Empty renders the step inert.
      *
      * Package names only: the rendered `run:` line is unquoted so word splitting reaches
      * apt-get, so every element is metacharacter-checked.
@@ -30,7 +28,7 @@ interface NuxtBaseCiConfig {
  * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yml`,
  * the Dockerfile, the upgrade workflow); `pnpm` feeds the Dockerfile only, because CI
  * takes pnpm from `package.json#packageManager`. Defaults come from the version
- * baseline (node 24.13.0, pnpm 10.28.1).
+ * baseline (node 24.21.0, pnpm 10.34.5).
  */
 interface NuxtBaseVersionsConfig {
     /** Node version for CI jobs, the Docker base image, and the upgrade workflow. */
@@ -86,9 +84,8 @@ interface NuxtBaseDockerConfig {
      */
     prismaVersion?: string;
     /**
-     * The `sh -c` argument of the final `CMD`. Defaults to
-     * `prisma migrate deploy` then the node server; override e.g. for `db push`
-     * or a repo with no Prisma. Lands verbatim.
+     * The shell-form final `CMD`, one line. Defaults to `prisma migrate deploy` then
+     * `exec node ...`; override e.g. for `db push` or a repo with no Prisma.
      */
     startCommand?: string;
 }
@@ -99,6 +96,12 @@ interface NuxtBaseDockerConfig {
 interface NuxtBaseAutomationConfig {
     /** Sync the weekly streamctl upgrade-PR workflow (default: off, no workflow lands). */
     upgradePr?: boolean;
+    /** Let upgrade PRs change GitHub Actions workflows (default: false). */
+    allowWorkflowUpdates?: boolean;
+    /** Repository secret used when workflow updates are allowed. */
+    prTokenSecret?: string;
+    /** One-line shell command run before validation (default: `pnpm prisma generate`, `""` skips). */
+    prepare?: string;
 }
 /**
  * Supply-chain knobs (`config.security.*`): the pnpm install cooldown rendered into
@@ -119,8 +122,9 @@ interface NuxtBaseSecurityConfig {
 interface NuxtBasePnpmConfig {
     /**
      * Packages allowed to run install lifecycle scripts, on top of the baseline
-     * (`@prisma/client`, `esbuild`, `prisma`). Use this instead of `pnpm approve-builds`,
-     * which writes to the managed file and is reverted on the next sync.
+     * (`@prisma/client`, `@prisma/engines`, `esbuild`, `prisma`). Use this instead of
+     * `pnpm approve-builds`, which writes to the managed file and is reverted on the next
+     * sync.
      */
     onlyBuiltDependencies?: string[];
 }
@@ -171,8 +175,6 @@ interface NuxtBaseConfig {
     pnpm?: NuxtBasePnpmConfig;
     /** Optional editor knobs (the i18n-ally source language). */
     editor?: NuxtBaseEditorConfig;
-    /** ESLint factory options, typed with the payload's own option surface. */
-    eslint?: CreateSidebaseEslintOptions;
 }
 /**
  * Identity helper giving editor inference for this payload's knobs, the analog of the

package/dist/config.d.ts

@@ -1,5 +1,3 @@
-import { C as CreateSidebaseEslintOptions } from './shared/base-config.BoberVUk.js';
-
 /**
  * Version-baseline profile, named for the framework and its major so two majors can
  * coexist during a migration.
@@ -18,8 +16,8 @@ interface NuxtBaseCiConfig {
     /** Include the e2e job + postgres service. */
     e2e?: boolean;
     /**
-     * Packages apt-installed in the `test` and `e2e` jobs, for a binary the suite needs
-     * that `ubuntu-latest` lacks. Empty renders the install step inert, not absent.
+     * Packages apt-installed in the `test` and `e2e` jobs and the upgrade validation, for
+     * a binary the suite needs that `ubuntu-latest` lacks. Empty renders the step inert.
      *
      * Package names only: the rendered `run:` line is unquoted so word splitting reaches
      * apt-get, so every element is metacharacter-checked.
@@ -30,7 +28,7 @@ interface NuxtBaseCiConfig {
  * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yml`,
  * the Dockerfile, the upgrade workflow); `pnpm` feeds the Dockerfile only, because CI
  * takes pnpm from `package.json#packageManager`. Defaults come from the version
- * baseline (node 24.13.0, pnpm 10.28.1).
+ * baseline (node 24.21.0, pnpm 10.34.5).
  */
 interface NuxtBaseVersionsConfig {
     /** Node version for CI jobs, the Docker base image, and the upgrade workflow. */
@@ -86,9 +84,8 @@ interface NuxtBaseDockerConfig {
      */
     prismaVersion?: string;
     /**
-     * The `sh -c` argument of the final `CMD`. Defaults to
-     * `prisma migrate deploy` then the node server; override e.g. for `db push`
-     * or a repo with no Prisma. Lands verbatim.
+     * The shell-form final `CMD`, one line. Defaults to `prisma migrate deploy` then
+     * `exec node ...`; override e.g. for `db push` or a repo with no Prisma.
      */
     startCommand?: string;
 }
@@ -99,6 +96,12 @@ interface NuxtBaseDockerConfig {
 interface NuxtBaseAutomationConfig {
     /** Sync the weekly streamctl upgrade-PR workflow (default: off, no workflow lands). */
     upgradePr?: boolean;
+    /** Let upgrade PRs change GitHub Actions workflows (default: false). */
+    allowWorkflowUpdates?: boolean;
+    /** Repository secret used when workflow updates are allowed. */
+    prTokenSecret?: string;
+    /** One-line shell command run before validation (default: `pnpm prisma generate`, `""` skips). */
+    prepare?: string;
 }
 /**
  * Supply-chain knobs (`config.security.*`): the pnpm install cooldown rendered into
@@ -119,8 +122,9 @@ interface NuxtBaseSecurityConfig {
 interface NuxtBasePnpmConfig {
     /**
      * Packages allowed to run install lifecycle scripts, on top of the baseline
-     * (`@prisma/client`, `esbuild`, `prisma`). Use this instead of `pnpm approve-builds`,
-     * which writes to the managed file and is reverted on the next sync.
+     * (`@prisma/client`, `@prisma/engines`, `esbuild`, `prisma`). Use this instead of
+     * `pnpm approve-builds`, which writes to the managed file and is reverted on the next
+     * sync.
      */
     onlyBuiltDependencies?: string[];
 }
@@ -171,8 +175,6 @@ interface NuxtBaseConfig {
     pnpm?: NuxtBasePnpmConfig;
     /** Optional editor knobs (the i18n-ally source language). */
     editor?: NuxtBaseEditorConfig;
-    /** ESLint factory options, typed with the payload's own option surface. */
-    eslint?: CreateSidebaseEslintOptions;
 }
 /**
  * Identity helper giving editor inference for this payload's knobs, the analog of the

package/dist/config.mjs

@@ -24,7 +24,10 @@ const NUXT_BASE_DOCKER_KEYS = knobKeys({
   startCommand: 0
 });
 const NUXT_BASE_AUTOMATION_KEYS = knobKeys({
-  upgradePr: 0
+  upgradePr: 0,
+  allowWorkflowUpdates: 0,
+  prTokenSecret: 0,
+  prepare: 0
 });
 const NUXT_BASE_SECURITY_KEYS = knobKeys({
   minimumReleaseAge: 0
@@ -35,9 +38,7 @@ const NUXT_BASE_PNPM_KEYS = knobKeys({
 const NUXT_BASE_EDITOR_KEYS = knobKeys({
   i18nSourceLanguage: 0
 });
-const NUXT_BASE_TOP_LEVEL_KNOBS = knobKeys({
-  eslint: 0
-});
+const NUXT_BASE_TOP_LEVEL_KNOBS = knobKeys({});
 const NUXT_BASE_CONFIG_KEYS = [
   ...NUXT_BASE_CI_KEYS.map((key) => `ci.${key}`),
   ...NUXT_BASE_VERSIONS_KEYS.map((key) => `versions.${key}`),

package/dist/eslint/index.d.mts

@@ -1,7 +1,46 @@
-import { C as CreateSidebaseEslintOptions } from '../shared/base-config.BoberVUk.mjs';
-export { E as ESLINT_OPTION_KEYS } from '../shared/base-config.BoberVUk.mjs';
 import antfu, { TypedFlatConfigItem } from '@antfu/eslint-config';
 
+/** Options for the published ESLint factory (`@sidebase/base-config/eslint`). */
+interface CreateSidebaseEslintOptions {
+    /** Zod `.extend()/.merge()/.passthrough()` bans and/or `import * as z` enforcement. Default `"none"` (opt-in). */
+    zod?: "full" | "import-style" | "none";
+    /** Allow-list of permitted console methods, or a hard error. Default `"error"`. */
+    console?: string[] | "error";
+    /** Ban `publicProcedure` in `server/trpc/routers/**`. Default `false`. */
+    trpcGuard?: boolean;
+    /** Restrict `~~/prisma/` client imports on the app side. Default `false`. */
+    prismaImportGuard?: boolean;
+    /** `ts/consistent-type-definitions`. Default `"interface"`. */
+    typeDefStyle?: "interface" | "type";
+    /** Paths banned from direct import (Nuxt auto-import). Default `["utils/", "composables/", "~~/shared/types/"]`. */
+    autoImportPaths?: string[];
+    /**
+     * Subset of {@link autoImportPaths} where `import type { ... }` is still allowed
+     * (value imports stay banned), for repos that import a path like `composables/`
+     * only for its types. Default `[]` (opt-in).
+     */
+    autoImportTypeOnly?: string[];
+    /**
+     * Files excluded from antfu's type-aware program (only relevant when
+     * type-aware). Default excludes `prisma.config.ts`, `eslint.config.ts`, the
+     * root `streamctl.config.ts`, and the legacy `.streamctl` TS files (see
+     * `resolveEslintOptions`).
+     */
+    ignoresTypeAware?: string[];
+    /**
+     * Globs for test / spec / story files where the `process.env` + auto-import
+     * bans are relaxed. Defaults to the standard `.test.`/`.spec.`/
+     * `.stories.` `ts`/`tsx` globs (see `resolveEslintOptions`).
+     */
+    testFilePattern?: string[];
+}
+/**
+ * Runtime list of every {@link CreateSidebaseEslintOptions} key. The `satisfies` map
+ * keeps it exhaustive: a new option fails to compile until it is listed here, so the
+ * validator allow-list cannot drift.
+ */
+declare const ESLINT_OPTION_KEYS: string[];
+
 /** {@link CreateSidebaseEslintOptions} with all defaults applied + the computed type-aware gate. */
 interface ResolvedEslintOptions {
     zod: "full" | "import-style" | "none";
@@ -48,5 +87,5 @@ declare function buildEslintLayers(options: ResolvedEslintOptions): TypedFlatCon
  */
 declare function createSidebaseEslint(options?: CreateSidebaseEslintOptions): ReturnType<typeof antfu>;
 
-export { CreateSidebaseEslintOptions, buildEslintLayers, createSidebaseEslint, isTypeAware, resolveEslintOptions };
-export type { ResolvedEslintOptions };
+export { ESLINT_OPTION_KEYS, buildEslintLayers, createSidebaseEslint, isTypeAware, resolveEslintOptions };
+export type { CreateSidebaseEslintOptions, ResolvedEslintOptions };

package/dist/eslint/index.d.ts

@@ -1,7 +1,46 @@
-import { C as CreateSidebaseEslintOptions } from '../shared/base-config.BoberVUk.js';
-export { E as ESLINT_OPTION_KEYS } from '../shared/base-config.BoberVUk.js';
 import antfu, { TypedFlatConfigItem } from '@antfu/eslint-config';
 
+/** Options for the published ESLint factory (`@sidebase/base-config/eslint`). */
+interface CreateSidebaseEslintOptions {
+    /** Zod `.extend()/.merge()/.passthrough()` bans and/or `import * as z` enforcement. Default `"none"` (opt-in). */
+    zod?: "full" | "import-style" | "none";
+    /** Allow-list of permitted console methods, or a hard error. Default `"error"`. */
+    console?: string[] | "error";
+    /** Ban `publicProcedure` in `server/trpc/routers/**`. Default `false`. */
+    trpcGuard?: boolean;
+    /** Restrict `~~/prisma/` client imports on the app side. Default `false`. */
+    prismaImportGuard?: boolean;
+    /** `ts/consistent-type-definitions`. Default `"interface"`. */
+    typeDefStyle?: "interface" | "type";
+    /** Paths banned from direct import (Nuxt auto-import). Default `["utils/", "composables/", "~~/shared/types/"]`. */
+    autoImportPaths?: string[];
+    /**
+     * Subset of {@link autoImportPaths} where `import type { ... }` is still allowed
+     * (value imports stay banned), for repos that import a path like `composables/`
+     * only for its types. Default `[]` (opt-in).
+     */
+    autoImportTypeOnly?: string[];
+    /**
+     * Files excluded from antfu's type-aware program (only relevant when
+     * type-aware). Default excludes `prisma.config.ts`, `eslint.config.ts`, the
+     * root `streamctl.config.ts`, and the legacy `.streamctl` TS files (see
+     * `resolveEslintOptions`).
+     */
+    ignoresTypeAware?: string[];
+    /**
+     * Globs for test / spec / story files where the `process.env` + auto-import
+     * bans are relaxed. Defaults to the standard `.test.`/`.spec.`/
+     * `.stories.` `ts`/`tsx` globs (see `resolveEslintOptions`).
+     */
+    testFilePattern?: string[];
+}
+/**
+ * Runtime list of every {@link CreateSidebaseEslintOptions} key. The `satisfies` map
+ * keeps it exhaustive: a new option fails to compile until it is listed here, so the
+ * validator allow-list cannot drift.
+ */
+declare const ESLINT_OPTION_KEYS: string[];
+
 /** {@link CreateSidebaseEslintOptions} with all defaults applied + the computed type-aware gate. */
 interface ResolvedEslintOptions {
     zod: "full" | "import-style" | "none";
@@ -48,5 +87,5 @@ declare function buildEslintLayers(options: ResolvedEslintOptions): TypedFlatCon
  */
 declare function createSidebaseEslint(options?: CreateSidebaseEslintOptions): ReturnType<typeof antfu>;
 
-export { CreateSidebaseEslintOptions, buildEslintLayers, createSidebaseEslint, isTypeAware, resolveEslintOptions };
-export type { ResolvedEslintOptions };
+export { ESLINT_OPTION_KEYS, buildEslintLayers, createSidebaseEslint, isTypeAware, resolveEslintOptions };
+export type { CreateSidebaseEslintOptions, ResolvedEslintOptions };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sidebase/base-config",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Shared @sidebase base configuration for Nuxt repos: ESLint / Prisma / tsconfig factories on npm, plus the streamctl file-sync preset payload",
   "keywords": [
     "sidebase",
@@ -50,9 +50,9 @@
     }
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24.13"
   },
-  "packageManager": "pnpm@10.29.1",
+  "packageManager": "pnpm@10.34.5",
   "scripts": {
     "build": "unbuild",
     "typecheck": "tsc --noEmit -p tsconfig.json && tsc -p tsconfig.test.json",
@@ -60,10 +60,11 @@
     "lint": "eslint .",
     "validate:presets": "node scripts/validate-presets.mjs",
     "e2e:dry-run": "pnpm build && node scripts/e2e-dry-run.mjs",
+    "e2e:docker": "pnpm build && node scripts/docker-build-leg.mjs",
     "prepack": "pnpm build"
   },
   "dependencies": {
-    "@antfu/eslint-config": "^7.4",
+    "@antfu/eslint-config": "^9.5.1",
     "ufo": "^1.6.4"
   },
   "peerDependencies": {
@@ -83,14 +84,14 @@
     "@arethetypeswrong/cli": "^0.18.5",
     "@prisma/client": "^6.19.3",
     "@sidebase/streamctl": "^0.3.0",
-    "@types/node": "^24.0.0",
-    "eslint": "^10.5.0",
+    "@types/node": "^24.13.5",
+    "eslint": "^10.10.0",
     "jiti": "^2.7.0",
     "prisma": "^6.19.3",
-    "publint": "^0.3.21",
-    "typescript": "^6.0.0",
-    "unbuild": "^3.5.0",
-    "vitest": "^3.0.0",
-    "yaml": "^2.9.0"
+    "publint": "^0.3.24",
+    "typescript": "^6.0.3",
+    "unbuild": "^3.6.1",
+    "vitest": "^5.0.1",
+    "yaml": "^2.9.1"
   }
 }

package/presets/base/AGENTS.md

@@ -24,11 +24,6 @@ follow. They are the same across every repo in the fleet.
 - Use precise types; avoid `any` and unchecked casts. Parse and validate external input at the boundary instead of trusting it downstream.
 - Handle the error and empty-result paths, not just the happy path.
 
-## Tests & verification
-
-- Run the project's typecheck, lint, and test scripts before proposing a change.
-- Add or update tests for the behavior you change; don't weaken existing assertions to make a change pass.
-
 ## Commits & pull requests
 
 - Use Conventional Commits (`feat:`, `fix:`, `refactor:`, `test:`, `docs:`).