@sidebase/base-config 0.2.2 → 0.3.0

package/README.md

@@ -175,9 +175,9 @@ covers both.
 
 `defineNuxtBaseConfig` returns the config unchanged. Its job is typed editor inference
 for this payload's knobs: completion and type checking on `ci`, `versions`, `docker`,
-`automation`, `security`, `pnpm`, `editor`, and the whole `eslint` option surface, plus `profile`
-narrowed to the profile names that actually exist. Without it the object is an untyped
-literal, so a typo such as `ci: { unitTest: true }` stays silent in your editor.
+`automation`, `security`, `pnpm` and `editor`, plus `profile` narrowed to the profile
+names that actually exist. Without it the object is an untyped literal, so a typo such as
+`ci: { unitTest: true }` stays silent in your editor.
 
 The CLI shape-checks the config against the manifest when it loads it, so a sync still
 works without the helper. The helper is what moves that feedback into your editor.
@@ -390,6 +390,7 @@ minimumReleaseAgeExclude:
   - "@sidebase/*"
 onlyBuiltDependencies:            # the postinstall-script allowlist
   - "@prisma/client"
+  - "@prisma/engines"
   - "esbuild"
   - "prisma"
 ```
@@ -399,7 +400,7 @@ onlyBuiltDependencies:            # the postinstall-script allowlist
 installs it. It needs pnpm 10.16 or newer and gates *fresh resolution only*, so
 `pnpm install --frozen-lockfile` replays the lockfile untouched and CI is unaffected.
 
-The pnpm baseline shipped to consumers is 10.28.1 (`presets/*/preset.json`). This repo's
+The pnpm baseline shipped to consumers is 10.34.5 (`presets/*/preset.json`). This repo's
 own `packageManager` pin tracks separately and is usually newer; the two are independent
 by design, not drift.
 
@@ -460,7 +461,7 @@ The `nuxt-app` preset ships a managed `.github/workflows/ci.yml`. Its `lint-type
 | ---- | ------- | ------ |
 | `ci.unitTests` | `false` | Add the `test` job (`pnpm test`) |
 | `ci.e2e` | `false` | Add the `e2e` job, with a health-checked postgres service |
-| `ci.aptPackages` | `[]` | System packages `apt-get`-installed in the `test` and `e2e` jobs |
+| `ci.aptPackages` | `[]` | System packages `apt-get`-installed in the `test` and `e2e` jobs and the upgrade validation |
 
 `ci.aptPackages` is the CI counterpart to `docker.aptPackages` below: extra system packages
 on top of what the runner image already carries, for a binary the suite needs and
@@ -498,7 +499,7 @@ out:
 | `docker.buildSteps` | the build-command block | `nuxi prepare` / `prisma generate` / `run build` |
 | `docker.finalStage` | final stage, before `CMD` | `""` |
 | `docker.prismaRuntime` | final stage | copy the schema + install the `migrate deploy` CLI |
-| `docker.startCommand` | inside `CMD` | `prisma migrate deploy` then the node server |
+| `docker.startCommand` | shell-form `CMD`, one line | `prisma migrate deploy` then `exec node ...` |
 
 A seventh knob is different in kind: a validated version, not raw text.
 
@@ -517,7 +518,7 @@ export default {
     preInstall: "COPY ./vendor ./vendor", // vendored dep needed at install time
     buildSteps: "RUN pnpm nuxi prepare\nRUN pnpm run build", // a repo with no Prisma
     prismaRuntime: "", // drop Prisma entirely
-    startCommand: "node .output/server/index.mjs",
+    startCommand: "exec node .output/server/index.mjs",
   },
 };
 ```
@@ -540,7 +541,7 @@ three default to `""`.
 
 **`prismaRuntime` and `startCommand` are coupled.** Override one and you must override the
 other. `prismaRuntime` is what installs the Prisma CLI into the final stage, and the
-DEFAULT `startCommand` is `npm exec prisma migrate deploy && node ...`. Setting only
+DEFAULT `startCommand` is `npm exec prisma migrate deploy && exec node ...`. Setting only
 `prismaRuntime: ""` therefore produces an image whose `CMD` invokes a CLI that is no longer
 installed, and the container fails to start. The example above overrides both, which is why
 it is safe to copy; a single-knob change is not. Drop the `migrate deploy` half of
@@ -603,9 +604,9 @@ export default {
     // prTokenSecret: "STREAMCTL_PR_TOKEN",
   },
   // optional: version pins, default to the payload's baseline. `node` feeds
-  // ci.yml + the Dockerfile; `pnpm` feeds the Dockerfile only (CI pins pnpm
-  // via package.json#packageManager):
-  // versions: { node: "24.13.0", pnpm: "10.28.1" },
+  // ci.yml, the Dockerfile and this workflow; `pnpm` feeds the Dockerfile only
+  // (CI pins pnpm via package.json#packageManager):
+  // versions: { node: "24.21.0", pnpm: "10.34.5" },
 };
 ```
 
@@ -624,6 +625,10 @@ receive `Workflows` permission.
 | `automation.upgradePr` | `false` | Sync the scheduled upgrade workflow |
 | `automation.allowWorkflowUpdates` | `false` | Include `.github/workflows/**` changes in upgrade PRs |
 | `automation.prTokenSecret` | `"STREAMCTL_PR_TOKEN"` | Secret used when workflow updates are enabled |
+| `automation.prepare` | `"pnpm prisma generate"` | One-line command run before validation |
+
+`automation.prepare` generates what `pnpm install` does not, before validation. One line;
+chain with `&&`. Set `""` for a repo without Prisma.
 
 The upgrade job runs `streamctl check` and every available lint, typecheck, test, and
 build script before opening a ready PR. PRs created with `GITHUB_TOKEN` do not trigger
@@ -658,8 +663,8 @@ out and provide its own install authentication.
 
 Every action in every managed workflow and CI job fragment is pinned by full commit SHA,
 with the version tag in a trailing comment. Moving tags can be re-pointed, so tags are
-never trusted, secrets or not. `test/workflow-pins.test.ts` sweeps all preset
-templates and fails on any `uses:` that is not a 40-hex SHA.
+never trusted, secrets or not. `test/payload.test.ts` renders every managed workflow
+and fails on any `uses:` that is not a 40-hex SHA.
 
 The shipped pins track `actions/checkout` v6, `actions/setup-node` v6, and
 `pnpm/action-setup` v6. These majors run on the node24 action runtime, which needs a

package/dist/config.d.mts

@@ -1,5 +1,3 @@
-import { C as CreateSidebaseEslintOptions } from './shared/base-config.BoberVUk.mjs';
-
 /**
  * Version-baseline profile, named for the framework and its major so two majors can
  * coexist during a migration.
@@ -18,8 +16,8 @@ interface NuxtBaseCiConfig {
     /** Include the e2e job + postgres service. */
     e2e?: boolean;
     /**
-     * Packages apt-installed in the `test` and `e2e` jobs, for a binary the suite needs
-     * that `ubuntu-latest` lacks. Empty renders the install step inert, not absent.
+     * Packages apt-installed in the `test` and `e2e` jobs and the upgrade validation, for
+     * a binary the suite needs that `ubuntu-latest` lacks. Empty renders the step inert.
      *
      * Package names only: the rendered `run:` line is unquoted so word splitting reaches
      * apt-get, so every element is metacharacter-checked.
@@ -30,7 +28,7 @@ interface NuxtBaseCiConfig {
  * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yml`,
  * the Dockerfile, the upgrade workflow); `pnpm` feeds the Dockerfile only, because CI
  * takes pnpm from `package.json#packageManager`. Defaults come from the version
- * baseline (node 24.13.0, pnpm 10.28.1).
+ * baseline (node 24.21.0, pnpm 10.34.5).
  */
 interface NuxtBaseVersionsConfig {
     /** Node version for CI jobs, the Docker base image, and the upgrade workflow. */
@@ -86,9 +84,8 @@ interface NuxtBaseDockerConfig {
      */
     prismaVersion?: string;
     /**
-     * The `sh -c` argument of the final `CMD`. Defaults to
-     * `prisma migrate deploy` then the node server; override e.g. for `db push`
-     * or a repo with no Prisma. Lands verbatim.
+     * The shell-form final `CMD`, one line. Defaults to `prisma migrate deploy` then
+     * `exec node ...`; override e.g. for `db push` or a repo with no Prisma.
      */
     startCommand?: string;
 }
@@ -103,6 +100,8 @@ interface NuxtBaseAutomationConfig {
     allowWorkflowUpdates?: boolean;
     /** Repository secret used when workflow updates are allowed. */
     prTokenSecret?: string;
+    /** One-line shell command run before validation (default: `pnpm prisma generate`, `""` skips). */
+    prepare?: string;
 }
 /**
  * Supply-chain knobs (`config.security.*`): the pnpm install cooldown rendered into
@@ -123,8 +122,9 @@ interface NuxtBaseSecurityConfig {
 interface NuxtBasePnpmConfig {
     /**
      * Packages allowed to run install lifecycle scripts, on top of the baseline
-     * (`@prisma/client`, `esbuild`, `prisma`). Use this instead of `pnpm approve-builds`,
-     * which writes to the managed file and is reverted on the next sync.
+     * (`@prisma/client`, `@prisma/engines`, `esbuild`, `prisma`). Use this instead of
+     * `pnpm approve-builds`, which writes to the managed file and is reverted on the next
+     * sync.
      */
     onlyBuiltDependencies?: string[];
 }
@@ -175,8 +175,6 @@ interface NuxtBaseConfig {
     pnpm?: NuxtBasePnpmConfig;
     /** Optional editor knobs (the i18n-ally source language). */
     editor?: NuxtBaseEditorConfig;
-    /** ESLint factory options, typed with the payload's own option surface. */
-    eslint?: CreateSidebaseEslintOptions;
 }
 /**
  * Identity helper giving editor inference for this payload's knobs, the analog of the

package/dist/config.d.ts

@@ -1,5 +1,3 @@
-import { C as CreateSidebaseEslintOptions } from './shared/base-config.BoberVUk.js';
-
 /**
  * Version-baseline profile, named for the framework and its major so two majors can
  * coexist during a migration.
@@ -18,8 +16,8 @@ interface NuxtBaseCiConfig {
     /** Include the e2e job + postgres service. */
     e2e?: boolean;
     /**
-     * Packages apt-installed in the `test` and `e2e` jobs, for a binary the suite needs
-     * that `ubuntu-latest` lacks. Empty renders the install step inert, not absent.
+     * Packages apt-installed in the `test` and `e2e` jobs and the upgrade validation, for
+     * a binary the suite needs that `ubuntu-latest` lacks. Empty renders the step inert.
      *
      * Package names only: the rendered `run:` line is unquoted so word splitting reaches
      * apt-get, so every element is metacharacter-checked.
@@ -30,7 +28,7 @@ interface NuxtBaseCiConfig {
  * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yml`,
  * the Dockerfile, the upgrade workflow); `pnpm` feeds the Dockerfile only, because CI
  * takes pnpm from `package.json#packageManager`. Defaults come from the version
- * baseline (node 24.13.0, pnpm 10.28.1).
+ * baseline (node 24.21.0, pnpm 10.34.5).
  */
 interface NuxtBaseVersionsConfig {
     /** Node version for CI jobs, the Docker base image, and the upgrade workflow. */
@@ -86,9 +84,8 @@ interface NuxtBaseDockerConfig {
      */
     prismaVersion?: string;
     /**
-     * The `sh -c` argument of the final `CMD`. Defaults to
-     * `prisma migrate deploy` then the node server; override e.g. for `db push`
-     * or a repo with no Prisma. Lands verbatim.
+     * The shell-form final `CMD`, one line. Defaults to `prisma migrate deploy` then
+     * `exec node ...`; override e.g. for `db push` or a repo with no Prisma.
      */
     startCommand?: string;
 }
@@ -103,6 +100,8 @@ interface NuxtBaseAutomationConfig {
     allowWorkflowUpdates?: boolean;
     /** Repository secret used when workflow updates are allowed. */
     prTokenSecret?: string;
+    /** One-line shell command run before validation (default: `pnpm prisma generate`, `""` skips). */
+    prepare?: string;
 }
 /**
  * Supply-chain knobs (`config.security.*`): the pnpm install cooldown rendered into
@@ -123,8 +122,9 @@ interface NuxtBaseSecurityConfig {
 interface NuxtBasePnpmConfig {
     /**
      * Packages allowed to run install lifecycle scripts, on top of the baseline
-     * (`@prisma/client`, `esbuild`, `prisma`). Use this instead of `pnpm approve-builds`,
-     * which writes to the managed file and is reverted on the next sync.
+     * (`@prisma/client`, `@prisma/engines`, `esbuild`, `prisma`). Use this instead of
+     * `pnpm approve-builds`, which writes to the managed file and is reverted on the next
+     * sync.
      */
     onlyBuiltDependencies?: string[];
 }
@@ -175,8 +175,6 @@ interface NuxtBaseConfig {
     pnpm?: NuxtBasePnpmConfig;
     /** Optional editor knobs (the i18n-ally source language). */
     editor?: NuxtBaseEditorConfig;
-    /** ESLint factory options, typed with the payload's own option surface. */
-    eslint?: CreateSidebaseEslintOptions;
 }
 /**
  * Identity helper giving editor inference for this payload's knobs, the analog of the

package/dist/config.mjs

@@ -26,7 +26,8 @@ const NUXT_BASE_DOCKER_KEYS = knobKeys({
 const NUXT_BASE_AUTOMATION_KEYS = knobKeys({
   upgradePr: 0,
   allowWorkflowUpdates: 0,
-  prTokenSecret: 0
+  prTokenSecret: 0,
+  prepare: 0
 });
 const NUXT_BASE_SECURITY_KEYS = knobKeys({
   minimumReleaseAge: 0
@@ -37,9 +38,7 @@ const NUXT_BASE_PNPM_KEYS = knobKeys({
 const NUXT_BASE_EDITOR_KEYS = knobKeys({
   i18nSourceLanguage: 0
 });
-const NUXT_BASE_TOP_LEVEL_KNOBS = knobKeys({
-  eslint: 0
-});
+const NUXT_BASE_TOP_LEVEL_KNOBS = knobKeys({});
 const NUXT_BASE_CONFIG_KEYS = [
   ...NUXT_BASE_CI_KEYS.map((key) => `ci.${key}`),
   ...NUXT_BASE_VERSIONS_KEYS.map((key) => `versions.${key}`),

package/dist/eslint/index.d.mts

@@ -1,7 +1,46 @@
-import { C as CreateSidebaseEslintOptions } from '../shared/base-config.BoberVUk.mjs';
-export { E as ESLINT_OPTION_KEYS } from '../shared/base-config.BoberVUk.mjs';
 import antfu, { TypedFlatConfigItem } from '@antfu/eslint-config';
 
+/** Options for the published ESLint factory (`@sidebase/base-config/eslint`). */
+interface CreateSidebaseEslintOptions {
+    /** Zod `.extend()/.merge()/.passthrough()` bans and/or `import * as z` enforcement. Default `"none"` (opt-in). */
+    zod?: "full" | "import-style" | "none";
+    /** Allow-list of permitted console methods, or a hard error. Default `"error"`. */
+    console?: string[] | "error";
+    /** Ban `publicProcedure` in `server/trpc/routers/**`. Default `false`. */
+    trpcGuard?: boolean;
+    /** Restrict `~~/prisma/` client imports on the app side. Default `false`. */
+    prismaImportGuard?: boolean;
+    /** `ts/consistent-type-definitions`. Default `"interface"`. */
+    typeDefStyle?: "interface" | "type";
+    /** Paths banned from direct import (Nuxt auto-import). Default `["utils/", "composables/", "~~/shared/types/"]`. */
+    autoImportPaths?: string[];
+    /**
+     * Subset of {@link autoImportPaths} where `import type { ... }` is still allowed
+     * (value imports stay banned), for repos that import a path like `composables/`
+     * only for its types. Default `[]` (opt-in).
+     */
+    autoImportTypeOnly?: string[];
+    /**
+     * Files excluded from antfu's type-aware program (only relevant when
+     * type-aware). Default excludes `prisma.config.ts`, `eslint.config.ts`, the
+     * root `streamctl.config.ts`, and the legacy `.streamctl` TS files (see
+     * `resolveEslintOptions`).
+     */
+    ignoresTypeAware?: string[];
+    /**
+     * Globs for test / spec / story files where the `process.env` + auto-import
+     * bans are relaxed. Defaults to the standard `.test.`/`.spec.`/
+     * `.stories.` `ts`/`tsx` globs (see `resolveEslintOptions`).
+     */
+    testFilePattern?: string[];
+}
+/**
+ * Runtime list of every {@link CreateSidebaseEslintOptions} key. The `satisfies` map
+ * keeps it exhaustive: a new option fails to compile until it is listed here, so the
+ * validator allow-list cannot drift.
+ */
+declare const ESLINT_OPTION_KEYS: string[];
+
 /** {@link CreateSidebaseEslintOptions} with all defaults applied + the computed type-aware gate. */
 interface ResolvedEslintOptions {
     zod: "full" | "import-style" | "none";
@@ -48,5 +87,5 @@ declare function buildEslintLayers(options: ResolvedEslintOptions): TypedFlatCon
  */
 declare function createSidebaseEslint(options?: CreateSidebaseEslintOptions): ReturnType<typeof antfu>;
 
-export { CreateSidebaseEslintOptions, buildEslintLayers, createSidebaseEslint, isTypeAware, resolveEslintOptions };
-export type { ResolvedEslintOptions };
+export { ESLINT_OPTION_KEYS, buildEslintLayers, createSidebaseEslint, isTypeAware, resolveEslintOptions };
+export type { CreateSidebaseEslintOptions, ResolvedEslintOptions };

package/dist/eslint/index.d.ts

@@ -1,7 +1,46 @@
-import { C as CreateSidebaseEslintOptions } from '../shared/base-config.BoberVUk.js';
-export { E as ESLINT_OPTION_KEYS } from '../shared/base-config.BoberVUk.js';
 import antfu, { TypedFlatConfigItem } from '@antfu/eslint-config';
 
+/** Options for the published ESLint factory (`@sidebase/base-config/eslint`). */
+interface CreateSidebaseEslintOptions {
+    /** Zod `.extend()/.merge()/.passthrough()` bans and/or `import * as z` enforcement. Default `"none"` (opt-in). */
+    zod?: "full" | "import-style" | "none";
+    /** Allow-list of permitted console methods, or a hard error. Default `"error"`. */
+    console?: string[] | "error";
+    /** Ban `publicProcedure` in `server/trpc/routers/**`. Default `false`. */
+    trpcGuard?: boolean;
+    /** Restrict `~~/prisma/` client imports on the app side. Default `false`. */
+    prismaImportGuard?: boolean;
+    /** `ts/consistent-type-definitions`. Default `"interface"`. */
+    typeDefStyle?: "interface" | "type";
+    /** Paths banned from direct import (Nuxt auto-import). Default `["utils/", "composables/", "~~/shared/types/"]`. */
+    autoImportPaths?: string[];
+    /**
+     * Subset of {@link autoImportPaths} where `import type { ... }` is still allowed
+     * (value imports stay banned), for repos that import a path like `composables/`
+     * only for its types. Default `[]` (opt-in).
+     */
+    autoImportTypeOnly?: string[];
+    /**
+     * Files excluded from antfu's type-aware program (only relevant when
+     * type-aware). Default excludes `prisma.config.ts`, `eslint.config.ts`, the
+     * root `streamctl.config.ts`, and the legacy `.streamctl` TS files (see
+     * `resolveEslintOptions`).
+     */
+    ignoresTypeAware?: string[];
+    /**
+     * Globs for test / spec / story files where the `process.env` + auto-import
+     * bans are relaxed. Defaults to the standard `.test.`/`.spec.`/
+     * `.stories.` `ts`/`tsx` globs (see `resolveEslintOptions`).
+     */
+    testFilePattern?: string[];
+}
+/**
+ * Runtime list of every {@link CreateSidebaseEslintOptions} key. The `satisfies` map
+ * keeps it exhaustive: a new option fails to compile until it is listed here, so the
+ * validator allow-list cannot drift.
+ */
+declare const ESLINT_OPTION_KEYS: string[];
+
 /** {@link CreateSidebaseEslintOptions} with all defaults applied + the computed type-aware gate. */
 interface ResolvedEslintOptions {
     zod: "full" | "import-style" | "none";
@@ -48,5 +87,5 @@ declare function buildEslintLayers(options: ResolvedEslintOptions): TypedFlatCon
  */
 declare function createSidebaseEslint(options?: CreateSidebaseEslintOptions): ReturnType<typeof antfu>;
 
-export { CreateSidebaseEslintOptions, buildEslintLayers, createSidebaseEslint, isTypeAware, resolveEslintOptions };
-export type { ResolvedEslintOptions };
+export { ESLINT_OPTION_KEYS, buildEslintLayers, createSidebaseEslint, isTypeAware, resolveEslintOptions };
+export type { CreateSidebaseEslintOptions, ResolvedEslintOptions };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sidebase/base-config",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Shared @sidebase base configuration for Nuxt repos: ESLint / Prisma / tsconfig factories on npm, plus the streamctl file-sync preset payload",
   "keywords": [
     "sidebase",
@@ -50,9 +50,9 @@
     }
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24.13"
   },
-  "packageManager": "pnpm@10.29.1",
+  "packageManager": "pnpm@10.34.5",
   "scripts": {
     "build": "unbuild",
     "typecheck": "tsc --noEmit -p tsconfig.json && tsc -p tsconfig.test.json",
@@ -60,10 +60,11 @@
     "lint": "eslint .",
     "validate:presets": "node scripts/validate-presets.mjs",
     "e2e:dry-run": "pnpm build && node scripts/e2e-dry-run.mjs",
+    "e2e:docker": "pnpm build && node scripts/docker-build-leg.mjs",
     "prepack": "pnpm build"
   },
   "dependencies": {
-    "@antfu/eslint-config": "^7.4",
+    "@antfu/eslint-config": "^9.5.1",
     "ufo": "^1.6.4"
   },
   "peerDependencies": {
@@ -83,14 +84,14 @@
     "@arethetypeswrong/cli": "^0.18.5",
     "@prisma/client": "^6.19.3",
     "@sidebase/streamctl": "^0.3.0",
-    "@types/node": "^24.0.0",
-    "eslint": "^10.5.0",
+    "@types/node": "^24.13.5",
+    "eslint": "^10.10.0",
     "jiti": "^2.7.0",
     "prisma": "^6.19.3",
-    "publint": "^0.3.21",
-    "typescript": "^6.0.0",
-    "unbuild": "^3.5.0",
-    "vitest": "^3.0.0",
-    "yaml": "^2.9.0"
+    "publint": "^0.3.24",
+    "typescript": "^6.0.3",
+    "unbuild": "^3.6.1",
+    "vitest": "^5.0.1",
+    "yaml": "^2.9.1"
   }
 }

package/presets/base/AGENTS.md

@@ -24,11 +24,6 @@ follow. They are the same across every repo in the fleet.
 - Use precise types; avoid `any` and unchecked casts. Parse and validate external input at the boundary instead of trusting it downstream.
 - Handle the error and empty-result paths, not just the happy path.
 
-## Tests & verification
-
-- Run the project's typecheck, lint, and test scripts before proposing a change.
-- Add or update tests for the behavior you change; don't weaken existing assertions to make a change pass.
-
 ## Commits & pull requests
 
 - Use Conventional Commits (`feat:`, `fix:`, `refactor:`, `test:`, `docs:`).

package/presets/base/github/workflows/streamctl-upgrade.yml

@@ -16,23 +16,27 @@ permissions:
 env:
   ALLOW_WORKFLOW_UPDATES: "${ALLOW_WORKFLOW_UPDATES}"
   NODE_VERSION: "${NODE_VERSION}"
+  CI_APT_PACKAGES: "${CI_APT_PACKAGES}"
+  # Block scalar so quotes, `#` and `: ` in the command stay literal.
+  PREPARE_COMMAND: >-
+    ${PREPARE_COMMAND}
 
 jobs:
   upgrade:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           run_install: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
@@ -225,6 +229,14 @@ jobs:
           done < "$RUNNER_TEMP/streamctl-held.txt"
           echo "applied=true" >> "$GITHUB_OUTPUT"
 
+      - name: Install apt packages
+        if: ${{ steps.outcome.outputs.completed == 'true' && env.CI_APT_PACKAGES != '' }}
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends $CI_APT_PACKAGES
+
+      - name: Prepare the validation
+        if: ${{ steps.outcome.outputs.completed == 'true' && env.PREPARE_COMMAND != '' }}
+        run: eval "$PREPARE_COMMAND"
+
       - name: Validate the completed upgrade
         if: ${{ steps.outcome.outputs.completed == 'true' && steps.workflow_changes.outputs.blocked == 'false' }}
         run: |
@@ -277,7 +289,7 @@ jobs:
 
       - name: Open the completed upgrade PR
         if: ${{ steps.outcome.outputs.completed == 'true' && steps.workflow_changes.outputs.blocked == 'false' }}
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
         with:
           token: ${{ env.ALLOW_WORKFLOW_UPDATES == 'true' && secrets.${PR_TOKEN_SECRET} || github.token }}
           branch: chore/streamctl-upgrade-${{ steps.check.outputs.target }}
@@ -335,7 +347,7 @@ jobs:
 
       - name: Open the workflow-update PR
         if: ${{ steps.workflow_changes.outputs.blocked == 'true' }}
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
         with:
           token: ${{ env.ALLOW_WORKFLOW_UPDATES == 'true' && secrets.${PR_TOKEN_SECRET} || github.token }}
           branch: chore/streamctl-upgrade-${{ steps.check.outputs.target }}
@@ -388,7 +400,7 @@ jobs:
 
       - name: Open the manual upgrade PR
         if: ${{ steps.upgrade.outputs.code == '2' && steps.conflicts.outputs.safe == 'false' }}
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
         with:
           token: ${{ env.ALLOW_WORKFLOW_UPDATES == 'true' && secrets.${PR_TOKEN_SECRET} || github.token }}
           branch: chore/streamctl-upgrade-${{ steps.check.outputs.target }}

package/presets/base/pnpm-workspace.yaml

@@ -16,5 +16,6 @@ minimumReleaseAgeExclude:
   - "@sidebase/*"
 onlyBuiltDependencies:
   - "@prisma/client"
+  - "@prisma/engines"
   - "esbuild"
   - "prisma"

package/presets/base/preset.json

@@ -16,8 +16,10 @@
     "automation-upgrade": {
       "placeholders": {
         "ALLOW_WORKFLOW_UPDATES": { "configPath": "automation.allowWorkflowUpdates", "default": "false", "pattern": "^(?:true|false)$" },
-        "NODE_VERSION": { "configPath": "versions.node", "default": "24.13.0", "pattern": "^[\\w.+-]+$" },
-        "PR_TOKEN_SECRET": { "configPath": "automation.prTokenSecret", "default": "STREAMCTL_PR_TOKEN", "pattern": "^(?![Gg][Ii][Tt][Hh][Uu][Bb]_)[A-Za-z_][A-Za-z0-9_]*$" }
+        "CI_APT_PACKAGES": { "configPath": "ci.aptPackages", "default": "", "pattern": "^$|^[a-z0-9][a-z0-9 +.-]*$", "join": "space" },
+        "NODE_VERSION": { "configPath": "versions.node", "default": "24.21.0", "pattern": "^[\\w.+-]+$" },
+        "PR_TOKEN_SECRET": { "configPath": "automation.prTokenSecret", "default": "STREAMCTL_PR_TOKEN", "pattern": "^(?![Gg][Ii][Tt][Hh][Uu][Bb]_)[A-Za-z_][A-Za-z0-9_]*$" },
+        "PREPARE_COMMAND": { "configPath": "automation.prepare", "default": "pnpm prisma generate", "pattern": "^[^\\r\\n]*$" }
       }
     },
     "editor": {
@@ -37,7 +39,9 @@
   "configKeys": {
     "automation.allowWorkflowUpdates": "boolean",
     "automation.prTokenSecret": "string",
+    "automation.prepare": "string",
     "automation.upgradePr": "boolean",
+    "ci.aptPackages": "string[]",
     "editor.i18nSourceLanguage": "string",
     "security.minimumReleaseAge": "string",
     "pnpm.onlyBuiltDependencies": "string[]",

package/presets/config.template.ts

@@ -10,10 +10,9 @@ export default defineNuxtBaseConfig({
 
   // Optional knobs, uncomment to enable:
   // ci: { unitTests: true, e2e: true, aptPackages: ['libxml2-utils'] }, // apt extras for the test/e2e jobs
-  // versions: { node: '24.13.0', pnpm: '10.28.1' },
+  // versions: { node: '24.21.0', pnpm: '10.34.5' },
   // docker: { aptPackages: ['ffmpeg'] }, // extras; openssl is always installed
   // security: { minimumReleaseAge: '10080' }, // minutes before pnpm installs a release; '0' disables
-  // pnpm: { onlyBuiltDependencies: ['sharp'] }, // extras on top of prisma + esbuild
+  // pnpm: { onlyBuiltDependencies: ['sharp'] }, // extras on top of the prisma packages + esbuild
   // editor: { i18nSourceLanguage: 'en' }, // i18n-ally source language (default: 'de')
-  // eslint: { trpcGuard: true },
 })

package/presets/nuxt-app/Dockerfile

@@ -1,3 +1,4 @@
+# check=skip=JSONArgsRecommended
 # see https://docs.docker.com/engine/reference/builder/#understand-how-arg-and-from-interact
 ARG NODE_VERSION=node:${NODE_VERSION}
 ARG PNPM_VERSION=${PNPM_VERSION}
@@ -55,4 +56,4 @@ ${DOCKER_FINAL_STAGE}
 # Set docker.finalStage to "USER node" to opt back in.
 
 # start the app
-CMD [ "sh", "-c", "${DOCKER_START_COMMAND}" ]
+CMD ${DOCKER_START_COMMAND}

package/presets/nuxt-app/github/workflows/ci.yml

@@ -26,15 +26,15 @@ jobs:
   lint-typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           run_install: false
 
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
@@ -51,15 +51,15 @@ jobs:
     needs: lint-typecheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           run_install: false
 
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm

package/presets/nuxt-app/preset.json

@@ -13,7 +13,7 @@
     "ci": {
       "placeholders": {
         "CI_APT_PACKAGES": { "configPath": "ci.aptPackages", "default": "", "pattern": "^$|^[a-z0-9][a-z0-9 +.-]*$", "join": "space" },
-        "NODE_VERSION": { "configPath": "versions.node", "default": "24.13.0", "pattern": "^[\\w.+-]+$" }
+        "NODE_VERSION": { "configPath": "versions.node", "default": "24.21.0", "pattern": "^[\\w.+-]+$" }
       },
       "fragments": [
         { "toggle": "ci.unitTests", "source": "nuxt-app/templates/ci/test-job.yml" },
@@ -23,15 +23,15 @@
     "dockerfile": {
       "placeholders": {
         "APT_PACKAGES": { "configPath": "docker.aptPackages", "default": "", "pattern": "^$|^[a-z0-9][a-z0-9 +.-]*$", "join": "space" },
-        "NODE_VERSION": { "configPath": "versions.node", "default": "24.13.0", "pattern": "^[\\w.+-]+$" },
-        "PNPM_VERSION": { "configPath": "versions.pnpm", "default": "10.28.1", "pattern": "^[\\w.+-]+$" },
+        "NODE_VERSION": { "configPath": "versions.node", "default": "24.21.0", "pattern": "^[\\w.+-]+$" },
+        "PNPM_VERSION": { "configPath": "versions.pnpm", "default": "10.34.5", "pattern": "^[\\w.+-]+$" },
         "DOCKER_PRE_INSTALL": { "configPath": "docker.preInstall", "default": "" },
         "DOCKER_BUILD_ARGS": { "configPath": "docker.buildArgs", "default": "" },
         "DOCKER_BUILD_STEPS": { "configPath": "docker.buildSteps", "default": "RUN pnpm nuxi prepare\nRUN pnpm prisma generate\nRUN pnpm run build" },
         "DOCKER_FINAL_STAGE": { "configPath": "docker.finalStage", "default": "" },
         "DOCKER_PRISMA_RUNTIME": { "configPath": "docker.prismaRuntime", "default": "COPY --chown=node:node --from=production-base /app/prisma /app/prisma\n\n# Prisma CLI for `migrate deploy`. Override the pin with --build-arg.\nARG PRISMA_VERSION=${PRISMA_VERSION_DEFAULT}\n\n# Chowned to uid 1000 in the same layer, so a later USER switch needs no\n# second pass over node_modules.\nRUN npm i -D prisma@${PRISMA_VERSION} && chown -R node:node /app/node_modules" },
-        "PRISMA_VERSION_DEFAULT": { "configPath": "docker.prismaVersion", "fromDependency": "prisma", "default": "6.19.1", "pattern": "^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$" },
-        "DOCKER_START_COMMAND": { "configPath": "docker.startCommand", "default": "npm exec prisma migrate deploy && node --max-old-space-size-percentage=75 .output/server/index.mjs" }
+        "PRISMA_VERSION_DEFAULT": { "configPath": "docker.prismaVersion", "fromDependency": "prisma", "default": "6.19.3", "pattern": "^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$" },
+        "DOCKER_START_COMMAND": { "configPath": "docker.startCommand", "default": "npm exec prisma migrate deploy && exec node --max-old-space-size-percentage=75 .output/server/index.mjs", "pattern": "^[^\\r\\n]+$" }
       },
       "passthrough": ["PRISMA_VERSION"]
     }
@@ -39,7 +39,6 @@
   "configKeys": {
     "ci.unitTests": "boolean",
     "ci.e2e": "boolean",
-    "ci.aptPackages": "string[]",
     "docker.aptPackages": "string[]",
     "docker.preInstall": "string",
     "docker.buildArgs": "string",
@@ -47,23 +46,22 @@
     "docker.finalStage": "string",
     "docker.prismaRuntime": "string",
     "docker.prismaVersion": "string",
-    "docker.startCommand": "string",
-    "eslint": "object"
+    "docker.startCommand": "string"
   },
   "versionProfiles": {
     "nuxt-4": {
-      "engines.node": ">=24.13.0",
-      "engines.pnpm": ">=10.28.1",
-      "packageManager": "pnpm@10.28.1",
-      "devDependencies.nuxt": "^4.3.0",
-      "devDependencies.typescript": "^6.0.2",
-      "devDependencies.eslint": "^10.5.0",
-      "devDependencies.oxlint": "^1.43.0",
-      "devDependencies.prisma": "^6.19.1",
-      "devDependencies.@prisma/client": "^6.19.1",
-      "devDependencies.jiti": "^2.2.0",
-      "devDependencies.json-sort-cli": "^4.1.3",
-      "devDependencies.vitest": "^3.0.0",
+      "engines.node": ">=24.21.0",
+      "engines.pnpm": ">=10.34.5",
+      "packageManager": "pnpm@10.34.5",
+      "devDependencies.nuxt": "^4.5.2",
+      "devDependencies.typescript": "^6.0.3",
+      "devDependencies.eslint": "^10.10.0",
+      "devDependencies.oxlint": "^1.83.0",
+      "devDependencies.prisma": "^6.19.3",
+      "devDependencies.@prisma/client": "^6.19.3",
+      "devDependencies.jiti": "^2.7.0",
+      "devDependencies.json-sort-cli": "^4.3.1",
+      "devDependencies.vitest": "^3.2.7",
       "scripts.postinstall": "nuxt prepare",
       "scripts.lint": "oxlint -c .oxlintrc.json --deny-warnings && eslint --max-warnings 0 ."
     }

package/presets/nuxt-app/templates/ci/e2e-job.yml

@@ -22,12 +22,12 @@
           --health-timeout 5s
           --health-retries 5
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Install apt packages
         if: ${{ env.CI_APT_PACKAGES != '' }}
         run: sudo apt-get update && sudo apt-get install -y --no-install-recommends $CI_APT_PACKAGES
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm

package/presets/nuxt-app/templates/ci/test-job.yml

@@ -1,12 +1,12 @@
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Install apt packages
         if: ${{ env.CI_APT_PACKAGES != '' }}
         run: sudo apt-get update && sudo apt-get install -y --no-install-recommends $CI_APT_PACKAGES
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm

package/dist/shared/base-config.BoberVUk.d.mts

@@ -1,43 +0,0 @@
-/** Options for the published ESLint factory (`@sidebase/base-config/eslint`). */
-interface CreateSidebaseEslintOptions {
-    /** Zod `.extend()/.merge()/.passthrough()` bans and/or `import * as z` enforcement. Default `"none"` (opt-in). */
-    zod?: "full" | "import-style" | "none";
-    /** Allow-list of permitted console methods, or a hard error. Default `"error"`. */
-    console?: string[] | "error";
-    /** Ban `publicProcedure` in `server/trpc/routers/**`. Default `false`. */
-    trpcGuard?: boolean;
-    /** Restrict `~~/prisma/` client imports on the app side. Default `false`. */
-    prismaImportGuard?: boolean;
-    /** `ts/consistent-type-definitions`. Default `"interface"`. */
-    typeDefStyle?: "interface" | "type";
-    /** Paths banned from direct import (Nuxt auto-import). Default `["utils/", "composables/", "~~/shared/types/"]`. */
-    autoImportPaths?: string[];
-    /**
-     * Subset of {@link autoImportPaths} where `import type { ... }` is still allowed
-     * (value imports stay banned), for repos that import a path like `composables/`
-     * only for its types. Default `[]` (opt-in).
-     */
-    autoImportTypeOnly?: string[];
-    /**
-     * Files excluded from antfu's type-aware program (only relevant when
-     * type-aware). Default excludes `prisma.config.ts`, `eslint.config.ts`, the
-     * root `streamctl.config.ts`, and the legacy `.streamctl` TS files (see
-     * `resolveEslintOptions`).
-     */
-    ignoresTypeAware?: string[];
-    /**
-     * Globs for test / spec / story files where the `process.env` + auto-import
-     * bans are relaxed. Defaults to the standard `.test.`/`.spec.`/
-     * `.stories.` `ts`/`tsx` globs (see `resolveEslintOptions`).
-     */
-    testFilePattern?: string[];
-}
-/**
- * Runtime list of every {@link CreateSidebaseEslintOptions} key. The `satisfies` map
- * keeps it exhaustive: a new option fails to compile until it is listed here, so the
- * validator allow-list cannot drift.
- */
-declare const ESLINT_OPTION_KEYS: string[];
-
-export { ESLINT_OPTION_KEYS as E };
-export type { CreateSidebaseEslintOptions as C };

package/dist/shared/base-config.BoberVUk.d.ts

@@ -1,43 +0,0 @@
-/** Options for the published ESLint factory (`@sidebase/base-config/eslint`). */
-interface CreateSidebaseEslintOptions {
-    /** Zod `.extend()/.merge()/.passthrough()` bans and/or `import * as z` enforcement. Default `"none"` (opt-in). */
-    zod?: "full" | "import-style" | "none";
-    /** Allow-list of permitted console methods, or a hard error. Default `"error"`. */
-    console?: string[] | "error";
-    /** Ban `publicProcedure` in `server/trpc/routers/**`. Default `false`. */
-    trpcGuard?: boolean;
-    /** Restrict `~~/prisma/` client imports on the app side. Default `false`. */
-    prismaImportGuard?: boolean;
-    /** `ts/consistent-type-definitions`. Default `"interface"`. */
-    typeDefStyle?: "interface" | "type";
-    /** Paths banned from direct import (Nuxt auto-import). Default `["utils/", "composables/", "~~/shared/types/"]`. */
-    autoImportPaths?: string[];
-    /**
-     * Subset of {@link autoImportPaths} where `import type { ... }` is still allowed
-     * (value imports stay banned), for repos that import a path like `composables/`
-     * only for its types. Default `[]` (opt-in).
-     */
-    autoImportTypeOnly?: string[];
-    /**
-     * Files excluded from antfu's type-aware program (only relevant when
-     * type-aware). Default excludes `prisma.config.ts`, `eslint.config.ts`, the
-     * root `streamctl.config.ts`, and the legacy `.streamctl` TS files (see
-     * `resolveEslintOptions`).
-     */
-    ignoresTypeAware?: string[];
-    /**
-     * Globs for test / spec / story files where the `process.env` + auto-import
-     * bans are relaxed. Defaults to the standard `.test.`/`.spec.`/
-     * `.stories.` `ts`/`tsx` globs (see `resolveEslintOptions`).
-     */
-    testFilePattern?: string[];
-}
-/**
- * Runtime list of every {@link CreateSidebaseEslintOptions} key. The `satisfies` map
- * keeps it exhaustive: a new option fails to compile until it is listed here, so the
- * validator allow-list cannot drift.
- */
-declare const ESLINT_OPTION_KEYS: string[];
-
-export { ESLINT_OPTION_KEYS as E };
-export type { CreateSidebaseEslintOptions as C };