@sidebase/base-config 0.2.2 → 0.3.1

package/dist/config.d.mts

@@ -1,5 +1,3 @@
-import { C as CreateSidebaseEslintOptions } from './shared/base-config.BoberVUk.mjs';
-
 /**
  * Version-baseline profile, named for the framework and its major so two majors can
  * coexist during a migration.
@@ -18,8 +16,8 @@ interface NuxtBaseCiConfig {
     /** Include the e2e job + postgres service. */
     e2e?: boolean;
     /**
-     * Packages apt-installed in the `test` and `e2e` jobs, for a binary the suite needs
-     * that `ubuntu-latest` lacks. Empty renders the install step inert, not absent.
+     * Packages apt-installed in the `test` and `e2e` jobs and the upgrade validation, for
+     * a binary the suite needs that `ubuntu-latest` lacks. Empty renders the step inert.
      *
      * Package names only: the rendered `run:` line is unquoted so word splitting reaches
      * apt-get, so every element is metacharacter-checked.
@@ -30,7 +28,7 @@ interface NuxtBaseCiConfig {
  * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yml`,
  * the Dockerfile, the upgrade workflow); `pnpm` feeds the Dockerfile only, because CI
  * takes pnpm from `package.json#packageManager`. Defaults come from the version
- * baseline (node 24.13.0, pnpm 10.28.1).
+ * baseline (node 24.21.0, pnpm 10.34.5).
  */
 interface NuxtBaseVersionsConfig {
     /** Node version for CI jobs, the Docker base image, and the upgrade workflow. */
@@ -86,9 +84,8 @@ interface NuxtBaseDockerConfig {
      */
     prismaVersion?: string;
     /**
-     * The `sh -c` argument of the final `CMD`. Defaults to
-     * `prisma migrate deploy` then the node server; override e.g. for `db push`
-     * or a repo with no Prisma. Lands verbatim.
+     * The shell-form final `CMD`, one line. Defaults to `prisma migrate deploy` then
+     * `exec node ...`; override e.g. for `db push` or a repo with no Prisma.
      */
     startCommand?: string;
 }
@@ -103,6 +100,8 @@ interface NuxtBaseAutomationConfig {
     allowWorkflowUpdates?: boolean;
     /** Repository secret used when workflow updates are allowed. */
     prTokenSecret?: string;
+    /** One-line shell command run before validation (default: `pnpm prisma generate` when Prisma is installed, `""` skips). */
+    prepare?: string;
 }
 /**
  * Supply-chain knobs (`config.security.*`): the pnpm install cooldown rendered into
@@ -123,8 +122,9 @@ interface NuxtBaseSecurityConfig {
 interface NuxtBasePnpmConfig {
     /**
      * Packages allowed to run install lifecycle scripts, on top of the baseline
-     * (`@prisma/client`, `esbuild`, `prisma`). Use this instead of `pnpm approve-builds`,
-     * which writes to the managed file and is reverted on the next sync.
+     * (`@prisma/client`, `@prisma/engines`, `esbuild`, `prisma`). Use this instead of
+     * `pnpm approve-builds`, which writes to the managed file and is reverted on the next
+     * sync.
      */
     onlyBuiltDependencies?: string[];
 }
@@ -175,8 +175,6 @@ interface NuxtBaseConfig {
     pnpm?: NuxtBasePnpmConfig;
     /** Optional editor knobs (the i18n-ally source language). */
     editor?: NuxtBaseEditorConfig;
-    /** ESLint factory options, typed with the payload's own option surface. */
-    eslint?: CreateSidebaseEslintOptions;
 }
 /**
  * Identity helper giving editor inference for this payload's knobs, the analog of the

package/dist/config.d.ts

@@ -1,5 +1,3 @@
-import { C as CreateSidebaseEslintOptions } from './shared/base-config.BoberVUk.js';
-
 /**
  * Version-baseline profile, named for the framework and its major so two majors can
  * coexist during a migration.
@@ -18,8 +16,8 @@ interface NuxtBaseCiConfig {
     /** Include the e2e job + postgres service. */
     e2e?: boolean;
     /**
-     * Packages apt-installed in the `test` and `e2e` jobs, for a binary the suite needs
-     * that `ubuntu-latest` lacks. Empty renders the install step inert, not absent.
+     * Packages apt-installed in the `test` and `e2e` jobs and the upgrade validation, for
+     * a binary the suite needs that `ubuntu-latest` lacks. Empty renders the step inert.
      *
      * Package names only: the rendered `run:` line is unquoted so word splitting reaches
      * apt-get, so every element is metacharacter-checked.
@@ -30,7 +28,7 @@ interface NuxtBaseCiConfig {
  * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yml`,
  * the Dockerfile, the upgrade workflow); `pnpm` feeds the Dockerfile only, because CI
  * takes pnpm from `package.json#packageManager`. Defaults come from the version
- * baseline (node 24.13.0, pnpm 10.28.1).
+ * baseline (node 24.21.0, pnpm 10.34.5).
  */
 interface NuxtBaseVersionsConfig {
     /** Node version for CI jobs, the Docker base image, and the upgrade workflow. */
@@ -86,9 +84,8 @@ interface NuxtBaseDockerConfig {
      */
     prismaVersion?: string;
     /**
-     * The `sh -c` argument of the final `CMD`. Defaults to
-     * `prisma migrate deploy` then the node server; override e.g. for `db push`
-     * or a repo with no Prisma. Lands verbatim.
+     * The shell-form final `CMD`, one line. Defaults to `prisma migrate deploy` then
+     * `exec node ...`; override e.g. for `db push` or a repo with no Prisma.
      */
     startCommand?: string;
 }
@@ -103,6 +100,8 @@ interface NuxtBaseAutomationConfig {
     allowWorkflowUpdates?: boolean;
     /** Repository secret used when workflow updates are allowed. */
     prTokenSecret?: string;
+    /** One-line shell command run before validation (default: `pnpm prisma generate` when Prisma is installed, `""` skips). */
+    prepare?: string;
 }
 /**
  * Supply-chain knobs (`config.security.*`): the pnpm install cooldown rendered into
@@ -123,8 +122,9 @@ interface NuxtBaseSecurityConfig {
 interface NuxtBasePnpmConfig {
     /**
      * Packages allowed to run install lifecycle scripts, on top of the baseline
-     * (`@prisma/client`, `esbuild`, `prisma`). Use this instead of `pnpm approve-builds`,
-     * which writes to the managed file and is reverted on the next sync.
+     * (`@prisma/client`, `@prisma/engines`, `esbuild`, `prisma`). Use this instead of
+     * `pnpm approve-builds`, which writes to the managed file and is reverted on the next
+     * sync.
      */
     onlyBuiltDependencies?: string[];
 }
@@ -175,8 +175,6 @@ interface NuxtBaseConfig {
     pnpm?: NuxtBasePnpmConfig;
     /** Optional editor knobs (the i18n-ally source language). */
     editor?: NuxtBaseEditorConfig;
-    /** ESLint factory options, typed with the payload's own option surface. */
-    eslint?: CreateSidebaseEslintOptions;
 }
 /**
  * Identity helper giving editor inference for this payload's knobs, the analog of the

package/dist/config.mjs

@@ -26,7 +26,8 @@ const NUXT_BASE_DOCKER_KEYS = knobKeys({
 const NUXT_BASE_AUTOMATION_KEYS = knobKeys({
   upgradePr: 0,
   allowWorkflowUpdates: 0,
-  prTokenSecret: 0
+  prTokenSecret: 0,
+  prepare: 0
 });
 const NUXT_BASE_SECURITY_KEYS = knobKeys({
   minimumReleaseAge: 0
@@ -37,9 +38,7 @@ const NUXT_BASE_PNPM_KEYS = knobKeys({
 const NUXT_BASE_EDITOR_KEYS = knobKeys({
   i18nSourceLanguage: 0
 });
-const NUXT_BASE_TOP_LEVEL_KNOBS = knobKeys({
-  eslint: 0
-});
+const NUXT_BASE_TOP_LEVEL_KNOBS = knobKeys({});
 const NUXT_BASE_CONFIG_KEYS = [
   ...NUXT_BASE_CI_KEYS.map((key) => `ci.${key}`),
   ...NUXT_BASE_VERSIONS_KEYS.map((key) => `versions.${key}`),

package/dist/eslint/index.d.mts

@@ -1,7 +1,46 @@
-import { C as CreateSidebaseEslintOptions } from '../shared/base-config.BoberVUk.mjs';
-export { E as ESLINT_OPTION_KEYS } from '../shared/base-config.BoberVUk.mjs';
 import antfu, { TypedFlatConfigItem } from '@antfu/eslint-config';
 
+/** Options for the published ESLint factory (`@sidebase/base-config/eslint`). */
+interface CreateSidebaseEslintOptions {
+    /** Zod `.extend()/.merge()/.passthrough()` bans and/or `import * as z` enforcement. Default `"none"` (opt-in). */
+    zod?: "full" | "import-style" | "none";
+    /** Allow-list of permitted console methods, or a hard error. Default `"error"`. */
+    console?: string[] | "error";
+    /** Ban `publicProcedure` in `server/trpc/routers/**`. Default `false`. */
+    trpcGuard?: boolean;
+    /** Restrict `~~/prisma/` client imports on the app side. Default `false`. */
+    prismaImportGuard?: boolean;
+    /** `ts/consistent-type-definitions`. Default `"interface"`. */
+    typeDefStyle?: "interface" | "type";
+    /** Paths banned from direct import (Nuxt auto-import). Default `["utils/", "composables/", "~~/shared/types/"]`. */
+    autoImportPaths?: string[];
+    /**
+     * Subset of {@link autoImportPaths} where `import type { ... }` is still allowed
+     * (value imports stay banned), for repos that import a path like `composables/`
+     * only for its types. Default `[]` (opt-in).
+     */
+    autoImportTypeOnly?: string[];
+    /**
+     * Files excluded from antfu's type-aware program (only relevant when
+     * type-aware). Default excludes `prisma.config.ts`, `eslint.config.ts`, the
+     * root `streamctl.config.ts`, and the legacy `.streamctl` TS files (see
+     * `resolveEslintOptions`).
+     */
+    ignoresTypeAware?: string[];
+    /**
+     * Globs for test / spec / story files where the `process.env` + auto-import
+     * bans are relaxed. Defaults to the standard `.test.`/`.spec.`/
+     * `.stories.` `ts`/`tsx` globs (see `resolveEslintOptions`).
+     */
+    testFilePattern?: string[];
+}
+/**
+ * Runtime list of every {@link CreateSidebaseEslintOptions} key. The `satisfies` map
+ * keeps it exhaustive: a new option fails to compile until it is listed here, so the
+ * validator allow-list cannot drift.
+ */
+declare const ESLINT_OPTION_KEYS: string[];
+
 /** {@link CreateSidebaseEslintOptions} with all defaults applied + the computed type-aware gate. */
 interface ResolvedEslintOptions {
     zod: "full" | "import-style" | "none";
@@ -48,5 +87,5 @@ declare function buildEslintLayers(options: ResolvedEslintOptions): TypedFlatCon
  */
 declare function createSidebaseEslint(options?: CreateSidebaseEslintOptions): ReturnType<typeof antfu>;
 
-export { CreateSidebaseEslintOptions, buildEslintLayers, createSidebaseEslint, isTypeAware, resolveEslintOptions };
-export type { ResolvedEslintOptions };
+export { ESLINT_OPTION_KEYS, buildEslintLayers, createSidebaseEslint, isTypeAware, resolveEslintOptions };
+export type { CreateSidebaseEslintOptions, ResolvedEslintOptions };

package/dist/eslint/index.d.ts

@@ -1,7 +1,46 @@
-import { C as CreateSidebaseEslintOptions } from '../shared/base-config.BoberVUk.js';
-export { E as ESLINT_OPTION_KEYS } from '../shared/base-config.BoberVUk.js';
 import antfu, { TypedFlatConfigItem } from '@antfu/eslint-config';
 
+/** Options for the published ESLint factory (`@sidebase/base-config/eslint`). */
+interface CreateSidebaseEslintOptions {
+    /** Zod `.extend()/.merge()/.passthrough()` bans and/or `import * as z` enforcement. Default `"none"` (opt-in). */
+    zod?: "full" | "import-style" | "none";
+    /** Allow-list of permitted console methods, or a hard error. Default `"error"`. */
+    console?: string[] | "error";
+    /** Ban `publicProcedure` in `server/trpc/routers/**`. Default `false`. */
+    trpcGuard?: boolean;
+    /** Restrict `~~/prisma/` client imports on the app side. Default `false`. */
+    prismaImportGuard?: boolean;
+    /** `ts/consistent-type-definitions`. Default `"interface"`. */
+    typeDefStyle?: "interface" | "type";
+    /** Paths banned from direct import (Nuxt auto-import). Default `["utils/", "composables/", "~~/shared/types/"]`. */
+    autoImportPaths?: string[];
+    /**
+     * Subset of {@link autoImportPaths} where `import type { ... }` is still allowed
+     * (value imports stay banned), for repos that import a path like `composables/`
+     * only for its types. Default `[]` (opt-in).
+     */
+    autoImportTypeOnly?: string[];
+    /**
+     * Files excluded from antfu's type-aware program (only relevant when
+     * type-aware). Default excludes `prisma.config.ts`, `eslint.config.ts`, the
+     * root `streamctl.config.ts`, and the legacy `.streamctl` TS files (see
+     * `resolveEslintOptions`).
+     */
+    ignoresTypeAware?: string[];
+    /**
+     * Globs for test / spec / story files where the `process.env` + auto-import
+     * bans are relaxed. Defaults to the standard `.test.`/`.spec.`/
+     * `.stories.` `ts`/`tsx` globs (see `resolveEslintOptions`).
+     */
+    testFilePattern?: string[];
+}
+/**
+ * Runtime list of every {@link CreateSidebaseEslintOptions} key. The `satisfies` map
+ * keeps it exhaustive: a new option fails to compile until it is listed here, so the
+ * validator allow-list cannot drift.
+ */
+declare const ESLINT_OPTION_KEYS: string[];
+
 /** {@link CreateSidebaseEslintOptions} with all defaults applied + the computed type-aware gate. */
 interface ResolvedEslintOptions {
     zod: "full" | "import-style" | "none";
@@ -48,5 +87,5 @@ declare function buildEslintLayers(options: ResolvedEslintOptions): TypedFlatCon
  */
 declare function createSidebaseEslint(options?: CreateSidebaseEslintOptions): ReturnType<typeof antfu>;
 
-export { CreateSidebaseEslintOptions, buildEslintLayers, createSidebaseEslint, isTypeAware, resolveEslintOptions };
-export type { ResolvedEslintOptions };
+export { ESLINT_OPTION_KEYS, buildEslintLayers, createSidebaseEslint, isTypeAware, resolveEslintOptions };
+export type { CreateSidebaseEslintOptions, ResolvedEslintOptions };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sidebase/base-config",
-  "version": "0.2.2",
+  "version": "0.3.1",
   "description": "Shared @sidebase base configuration for Nuxt repos: ESLint / Prisma / tsconfig factories on npm, plus the streamctl file-sync preset payload",
   "keywords": [
     "sidebase",
@@ -50,9 +50,9 @@
     }
   },
   "engines": {
-    "node": ">=22"
+    "node": ">=24.13"
   },
-  "packageManager": "pnpm@10.29.1",
+  "packageManager": "pnpm@10.34.5",
   "scripts": {
     "build": "unbuild",
     "typecheck": "tsc --noEmit -p tsconfig.json && tsc -p tsconfig.test.json",
@@ -60,10 +60,11 @@
     "lint": "eslint .",
     "validate:presets": "node scripts/validate-presets.mjs",
     "e2e:dry-run": "pnpm build && node scripts/e2e-dry-run.mjs",
+    "e2e:docker": "pnpm build && node scripts/docker-build-leg.mjs",
     "prepack": "pnpm build"
   },
   "dependencies": {
-    "@antfu/eslint-config": "^7.4",
+    "@antfu/eslint-config": "^9.5.1",
     "ufo": "^1.6.4"
   },
   "peerDependencies": {
@@ -83,14 +84,14 @@
     "@arethetypeswrong/cli": "^0.18.5",
     "@prisma/client": "^6.19.3",
     "@sidebase/streamctl": "^0.3.0",
-    "@types/node": "^24.0.0",
-    "eslint": "^10.5.0",
+    "@types/node": "^24.13.5",
+    "eslint": "^10.10.0",
     "jiti": "^2.7.0",
     "prisma": "^6.19.3",
-    "publint": "^0.3.21",
-    "typescript": "^6.0.0",
-    "unbuild": "^3.5.0",
-    "vitest": "^3.0.0",
-    "yaml": "^2.9.0"
+    "publint": "^0.3.24",
+    "typescript": "^6.0.3",
+    "unbuild": "^3.6.1",
+    "vitest": "^5.0.1",
+    "yaml": "^2.9.1"
   }
 }

package/presets/base/AGENTS.md

@@ -24,11 +24,6 @@ follow. They are the same across every repo in the fleet.
 - Use precise types; avoid `any` and unchecked casts. Parse and validate external input at the boundary instead of trusting it downstream.
 - Handle the error and empty-result paths, not just the happy path.
 
-## Tests & verification
-
-- Run the project's typecheck, lint, and test scripts before proposing a change.
-- Add or update tests for the behavior you change; don't weaken existing assertions to make a change pass.
-
 ## Commits & pull requests
 
 - Use Conventional Commits (`feat:`, `fix:`, `refactor:`, `test:`, `docs:`).

package/presets/base/github/workflows/streamctl-upgrade.yml

@@ -16,23 +16,27 @@ permissions:
 env:
   ALLOW_WORKFLOW_UPDATES: "${ALLOW_WORKFLOW_UPDATES}"
   NODE_VERSION: "${NODE_VERSION}"
+  CI_APT_PACKAGES: "${CI_APT_PACKAGES}"
+  # Block scalar so quotes, `#` and `: ` in the command stay literal.
+  PREPARE_COMMAND: >-
+    ${PREPARE_COMMAND}
 
 jobs:
   upgrade:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           run_install: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
@@ -225,6 +229,14 @@ jobs:
           done < "$RUNNER_TEMP/streamctl-held.txt"
           echo "applied=true" >> "$GITHUB_OUTPUT"
 
+      - name: Install apt packages
+        if: ${{ steps.outcome.outputs.completed == 'true' && env.CI_APT_PACKAGES != '' }}
+        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends $CI_APT_PACKAGES
+
+      - name: Prepare the validation
+        if: ${{ steps.outcome.outputs.completed == 'true' && env.PREPARE_COMMAND != '' }}
+        run: eval "$PREPARE_COMMAND"
+
       - name: Validate the completed upgrade
         if: ${{ steps.outcome.outputs.completed == 'true' && steps.workflow_changes.outputs.blocked == 'false' }}
         run: |
@@ -277,7 +289,7 @@ jobs:
 
       - name: Open the completed upgrade PR
         if: ${{ steps.outcome.outputs.completed == 'true' && steps.workflow_changes.outputs.blocked == 'false' }}
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
         with:
           token: ${{ env.ALLOW_WORKFLOW_UPDATES == 'true' && secrets.${PR_TOKEN_SECRET} || github.token }}
           branch: chore/streamctl-upgrade-${{ steps.check.outputs.target }}
@@ -320,7 +332,8 @@ jobs:
           {
             echo "## Status"
             echo
-            echo "This update omits GitHub Actions workflow changes. Do not merge this pull request yet."
+            echo "> [!CAUTION]"
+            echo "> This update omits GitHub Actions workflow changes. Do not merge this pull request yet."
             echo
             printf -- '- Updated the streamctl payload from `%s` to `%s`.\n' "$from" "$TARGET"
             echo "- Applied every other safe managed-file change."
@@ -335,7 +348,7 @@ jobs:
 
       - name: Open the workflow-update PR
         if: ${{ steps.workflow_changes.outputs.blocked == 'true' }}
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
         with:
           token: ${{ env.ALLOW_WORKFLOW_UPDATES == 'true' && secrets.${PR_TOKEN_SECRET} || github.token }}
           branch: chore/streamctl-upgrade-${{ steps.check.outputs.target }}
@@ -357,7 +370,8 @@ jobs:
           {
             echo "## Status"
             echo
-            echo "This update needs manual conflict resolution. Do not merge this pull request yet."
+            echo "> [!CAUTION]"
+            echo "> This update needs manual conflict resolution. Do not merge this pull request yet."
             echo
             printf -- '- Updated the streamctl payload from `%s` to `%s`.\n' "$from" "$TARGET"
             if [[ "$APPLIED" == "true" ]]; then
@@ -388,7 +402,7 @@ jobs:
 
       - name: Open the manual upgrade PR
         if: ${{ steps.upgrade.outputs.code == '2' && steps.conflicts.outputs.safe == 'false' }}
-        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
         with:
           token: ${{ env.ALLOW_WORKFLOW_UPDATES == 'true' && secrets.${PR_TOKEN_SECRET} || github.token }}
           branch: chore/streamctl-upgrade-${{ steps.check.outputs.target }}

package/presets/base/pnpm-workspace.yaml

@@ -16,5 +16,6 @@ minimumReleaseAgeExclude:
   - "@sidebase/*"
 onlyBuiltDependencies:
   - "@prisma/client"
+  - "@prisma/engines"
   - "esbuild"
   - "prisma"

package/presets/base/preset.json

@@ -16,8 +16,10 @@
     "automation-upgrade": {
       "placeholders": {
         "ALLOW_WORKFLOW_UPDATES": { "configPath": "automation.allowWorkflowUpdates", "default": "false", "pattern": "^(?:true|false)$" },
-        "NODE_VERSION": { "configPath": "versions.node", "default": "24.13.0", "pattern": "^[\\w.+-]+$" },
-        "PR_TOKEN_SECRET": { "configPath": "automation.prTokenSecret", "default": "STREAMCTL_PR_TOKEN", "pattern": "^(?![Gg][Ii][Tt][Hh][Uu][Bb]_)[A-Za-z_][A-Za-z0-9_]*$" }
+        "CI_APT_PACKAGES": { "configPath": "ci.aptPackages", "default": "", "pattern": "^$|^[a-z0-9][a-z0-9 +.-]*$", "join": "space" },
+        "NODE_VERSION": { "configPath": "versions.node", "default": "24.21.0", "pattern": "^[\\w.+-]+$" },
+        "PR_TOKEN_SECRET": { "configPath": "automation.prTokenSecret", "default": "STREAMCTL_PR_TOKEN", "pattern": "^(?![Gg][Ii][Tt][Hh][Uu][Bb]_)[A-Za-z_][A-Za-z0-9_]*$" },
+        "PREPARE_COMMAND": { "configPath": "automation.prepare", "default": "if [ -e node_modules/.bin/prisma ]; then pnpm prisma generate; fi", "pattern": "^[^\\r\\n]*$" }
       }
     },
     "editor": {
@@ -37,7 +39,9 @@
   "configKeys": {
     "automation.allowWorkflowUpdates": "boolean",
     "automation.prTokenSecret": "string",
+    "automation.prepare": "string",
     "automation.upgradePr": "boolean",
+    "ci.aptPackages": "string[]",
     "editor.i18nSourceLanguage": "string",
     "security.minimumReleaseAge": "string",
     "pnpm.onlyBuiltDependencies": "string[]",

package/presets/config.template.ts

@@ -10,10 +10,9 @@ export default defineNuxtBaseConfig({
 
   // Optional knobs, uncomment to enable:
   // ci: { unitTests: true, e2e: true, aptPackages: ['libxml2-utils'] }, // apt extras for the test/e2e jobs
-  // versions: { node: '24.13.0', pnpm: '10.28.1' },
+  // versions: { node: '24.21.0', pnpm: '10.34.5' },
   // docker: { aptPackages: ['ffmpeg'] }, // extras; openssl is always installed
   // security: { minimumReleaseAge: '10080' }, // minutes before pnpm installs a release; '0' disables
-  // pnpm: { onlyBuiltDependencies: ['sharp'] }, // extras on top of prisma + esbuild
+  // pnpm: { onlyBuiltDependencies: ['sharp'] }, // extras on top of the prisma packages + esbuild
   // editor: { i18nSourceLanguage: 'en' }, // i18n-ally source language (default: 'de')
-  // eslint: { trpcGuard: true },
 })

package/presets/nuxt-app/Dockerfile

@@ -1,3 +1,4 @@
+# check=skip=JSONArgsRecommended
 # see https://docs.docker.com/engine/reference/builder/#understand-how-arg-and-from-interact
 ARG NODE_VERSION=node:${NODE_VERSION}
 ARG PNPM_VERSION=${PNPM_VERSION}
@@ -55,4 +56,4 @@ ${DOCKER_FINAL_STAGE}
 # Set docker.finalStage to "USER node" to opt back in.
 
 # start the app
-CMD [ "sh", "-c", "${DOCKER_START_COMMAND}" ]
+CMD ${DOCKER_START_COMMAND}

package/presets/nuxt-app/github/workflows/ci.yml

@@ -26,15 +26,15 @@ jobs:
   lint-typecheck:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           run_install: false
 
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm
@@ -51,15 +51,15 @@ jobs:
     needs: lint-typecheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           run_install: false
 
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm

package/presets/nuxt-app/preset.json

@@ -13,7 +13,7 @@
     "ci": {
       "placeholders": {
         "CI_APT_PACKAGES": { "configPath": "ci.aptPackages", "default": "", "pattern": "^$|^[a-z0-9][a-z0-9 +.-]*$", "join": "space" },
-        "NODE_VERSION": { "configPath": "versions.node", "default": "24.13.0", "pattern": "^[\\w.+-]+$" }
+        "NODE_VERSION": { "configPath": "versions.node", "default": "24.21.0", "pattern": "^[\\w.+-]+$" }
       },
       "fragments": [
         { "toggle": "ci.unitTests", "source": "nuxt-app/templates/ci/test-job.yml" },
@@ -23,15 +23,15 @@
     "dockerfile": {
       "placeholders": {
         "APT_PACKAGES": { "configPath": "docker.aptPackages", "default": "", "pattern": "^$|^[a-z0-9][a-z0-9 +.-]*$", "join": "space" },
-        "NODE_VERSION": { "configPath": "versions.node", "default": "24.13.0", "pattern": "^[\\w.+-]+$" },
-        "PNPM_VERSION": { "configPath": "versions.pnpm", "default": "10.28.1", "pattern": "^[\\w.+-]+$" },
+        "NODE_VERSION": { "configPath": "versions.node", "default": "24.21.0", "pattern": "^[\\w.+-]+$" },
+        "PNPM_VERSION": { "configPath": "versions.pnpm", "default": "10.34.5", "pattern": "^[\\w.+-]+$" },
         "DOCKER_PRE_INSTALL": { "configPath": "docker.preInstall", "default": "" },
         "DOCKER_BUILD_ARGS": { "configPath": "docker.buildArgs", "default": "" },
         "DOCKER_BUILD_STEPS": { "configPath": "docker.buildSteps", "default": "RUN pnpm nuxi prepare\nRUN pnpm prisma generate\nRUN pnpm run build" },
         "DOCKER_FINAL_STAGE": { "configPath": "docker.finalStage", "default": "" },
         "DOCKER_PRISMA_RUNTIME": { "configPath": "docker.prismaRuntime", "default": "COPY --chown=node:node --from=production-base /app/prisma /app/prisma\n\n# Prisma CLI for `migrate deploy`. Override the pin with --build-arg.\nARG PRISMA_VERSION=${PRISMA_VERSION_DEFAULT}\n\n# Chowned to uid 1000 in the same layer, so a later USER switch needs no\n# second pass over node_modules.\nRUN npm i -D prisma@${PRISMA_VERSION} && chown -R node:node /app/node_modules" },
-        "PRISMA_VERSION_DEFAULT": { "configPath": "docker.prismaVersion", "fromDependency": "prisma", "default": "6.19.1", "pattern": "^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$" },
-        "DOCKER_START_COMMAND": { "configPath": "docker.startCommand", "default": "npm exec prisma migrate deploy && node --max-old-space-size-percentage=75 .output/server/index.mjs" }
+        "PRISMA_VERSION_DEFAULT": { "configPath": "docker.prismaVersion", "fromDependency": "prisma", "default": "6.19.3", "pattern": "^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?$" },
+        "DOCKER_START_COMMAND": { "configPath": "docker.startCommand", "default": "npm exec prisma migrate deploy && exec node --max-old-space-size-percentage=75 .output/server/index.mjs", "pattern": "^[^\\r\\n]+$" }
       },
       "passthrough": ["PRISMA_VERSION"]
     }
@@ -39,7 +39,6 @@
   "configKeys": {
     "ci.unitTests": "boolean",
     "ci.e2e": "boolean",
-    "ci.aptPackages": "string[]",
     "docker.aptPackages": "string[]",
     "docker.preInstall": "string",
     "docker.buildArgs": "string",
@@ -47,23 +46,22 @@
     "docker.finalStage": "string",
     "docker.prismaRuntime": "string",
     "docker.prismaVersion": "string",
-    "docker.startCommand": "string",
-    "eslint": "object"
+    "docker.startCommand": "string"
   },
   "versionProfiles": {
     "nuxt-4": {
-      "engines.node": ">=24.13.0",
-      "engines.pnpm": ">=10.28.1",
-      "packageManager": "pnpm@10.28.1",
-      "devDependencies.nuxt": "^4.3.0",
-      "devDependencies.typescript": "^6.0.2",
-      "devDependencies.eslint": "^10.5.0",
-      "devDependencies.oxlint": "^1.43.0",
-      "devDependencies.prisma": "^6.19.1",
-      "devDependencies.@prisma/client": "^6.19.1",
-      "devDependencies.jiti": "^2.2.0",
-      "devDependencies.json-sort-cli": "^4.1.3",
-      "devDependencies.vitest": "^3.0.0",
+      "engines.node": ">=24.21.0",
+      "engines.pnpm": ">=10.34.5",
+      "packageManager": "pnpm@10.34.5",
+      "devDependencies.nuxt": "^4.5.2",
+      "devDependencies.typescript": "^6.0.3",
+      "devDependencies.eslint": "^10.10.0",
+      "devDependencies.oxlint": "^1.83.0",
+      "devDependencies.prisma": "^6.19.3",
+      "devDependencies.@prisma/client": "^6.19.3",
+      "devDependencies.jiti": "^2.7.0",
+      "devDependencies.json-sort-cli": "^4.3.1",
+      "devDependencies.vitest": "^3.2.7",
       "scripts.postinstall": "nuxt prepare",
       "scripts.lint": "oxlint -c .oxlintrc.json --deny-warnings && eslint --max-warnings 0 ."
     }

package/presets/nuxt-app/templates/ci/e2e-job.yml

@@ -22,12 +22,12 @@
           --health-timeout 5s
           --health-retries 5
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Install apt packages
         if: ${{ env.CI_APT_PACKAGES != '' }}
         run: sudo apt-get update && sudo apt-get install -y --no-install-recommends $CI_APT_PACKAGES
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm

package/presets/nuxt-app/templates/ci/test-job.yml

@@ -1,12 +1,12 @@
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Install apt packages
         if: ${{ env.CI_APT_PACKAGES != '' }}
         run: sudo apt-get update && sudo apt-get install -y --no-install-recommends $CI_APT_PACKAGES
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: pnpm