@sidebase/base-config 0.3.2 → 0.3.4

package/README.md

@@ -23,9 +23,9 @@ instead.
 
 | File | Managed as | What it is |
 | ---- | ---------- | ---------- |
-| `.github/workflows/ci.yml` | owned | Lint, typecheck and build, plus optional test and e2e jobs |
-| `.github/workflows/pr-preview-cleanup.yml` | owned | Removes the `preview-deployed` label when `preview` is removed |
-| `.github/workflows/streamctl-upgrade.yml` | owned, opt-in | Weekly upgrade PRs (see [Upgrades](#upgrades)) |
+| `.github/workflows/ci.yaml` | owned | Lint, typecheck and build, plus optional test and e2e jobs |
+| `.github/workflows/pr-preview-cleanup.yaml` | owned | Removes the `preview-deployed` label when `preview` is removed |
+| `.github/workflows/streamctl-upgrade.yaml` | owned, opt-in | Weekly upgrade PRs (see [Upgrades](#upgrades)) |
 | `Dockerfile` | owned | Production image, runs `prisma migrate deploy` and then the server |
 | `tsconfig.json` | owned | Extends the shared strict base and Nuxt's generated config |
 | `pnpm-workspace.yaml` | owned | 7-day release cooldown and the install-script allowlist |
@@ -176,7 +176,7 @@ TypeScript config file) in your devDependencies; `sync` adds both.
 | `trpcGuard` | `false` | Ban `publicProcedure` in `server/trpc/routers/**` |
 | `prismaImportGuard` | `false` | Ban `~~/prisma/` client imports outside server code |
 | `typeDefStyle` | `"interface"` | Prefer `interface` or `type` |
-| `autoImportPaths` | `["utils/", "composables/", "~~/shared/types/"]` | Paths Nuxt auto-imports, so direct imports are banned |
+| `autoImportPaths` | `["utils/", "composables/", "~~/shared/types/"]` | Paths Nuxt auto-imports, so direct imports are banned in app code. The defaults cover `app/utils`, `shared/utils`, `app/composables` and `shared/types` under every Nuxt alias. Files in the root (or `layers/*`) `server/` and `shared/` dirs and relative imports are never matched |
 | `autoImportTypeOnly` | `[]` | Of those, paths where `import type` stays allowed |
 | `ignoresTypeAware` | config files | Files excluded from type-aware linting |
 | `testFilePattern` | `*.test`, `*.spec`, `*.stories` | Files where the `process.env` and auto-import bans are off |

package/dist/config.d.mts

@@ -25,7 +25,7 @@ interface NuxtBaseCiConfig {
     aptPackages?: string[];
 }
 /**
- * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yml`,
+ * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yaml`,
  * the Dockerfile, the upgrade workflow); `pnpm` feeds the Dockerfile only, because CI
  * takes pnpm from `package.json#packageManager`. Defaults come from the version
  * baseline (node 24.21.0, pnpm 10.34.5).

package/dist/config.d.ts

@@ -25,7 +25,7 @@ interface NuxtBaseCiConfig {
     aptPackages?: string[];
 }
 /**
- * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yml`,
+ * Runtime version pins (`config.versions.*`). `node` feeds every render (`ci.yaml`,
  * the Dockerfile, the upgrade workflow); `pnpm` feeds the Dockerfile only, because CI
  * takes pnpm from `package.json#packageManager`. Defaults come from the version
  * baseline (node 24.21.0, pnpm 10.34.5).

package/dist/eslint/index.d.mts

@@ -12,7 +12,12 @@ interface CreateSidebaseEslintOptions {
     prismaImportGuard?: boolean;
     /** `ts/consistent-type-definitions`. Default `"interface"`. */
     typeDefStyle?: "interface" | "type";
-    /** Paths banned from direct import (Nuxt auto-import). Default `["utils/", "composables/", "~~/shared/types/"]`. */
+    /**
+     * Paths banned from direct import (Nuxt auto-import). Default `["utils/", "composables/", "~~/shared/types/"]`.
+     * The defaults expand to the Nuxt 4 app-side dirs (`app/` and `shared/` utils) under every
+     * default alias. Paths starting with `~`, `@`, `#`, `/`, `./` or `../` are used as-is.
+     * Not applied to files in the root (or `layers/*`) `server/` and `shared/` dirs.
+     */
     autoImportPaths?: string[];
     /**
      * Subset of {@link autoImportPaths} where `import type { ... }` is still allowed

package/dist/eslint/index.d.ts

@@ -12,7 +12,12 @@ interface CreateSidebaseEslintOptions {
     prismaImportGuard?: boolean;
     /** `ts/consistent-type-definitions`. Default `"interface"`. */
     typeDefStyle?: "interface" | "type";
-    /** Paths banned from direct import (Nuxt auto-import). Default `["utils/", "composables/", "~~/shared/types/"]`. */
+    /**
+     * Paths banned from direct import (Nuxt auto-import). Default `["utils/", "composables/", "~~/shared/types/"]`.
+     * The defaults expand to the Nuxt 4 app-side dirs (`app/` and `shared/` utils) under every
+     * default alias. Paths starting with `~`, `@`, `#`, `/`, `./` or `../` are used as-is.
+     * Not applied to files in the root (or `layers/*`) `server/` and `shared/` dirs.
+     */
     autoImportPaths?: string[];
     /**
      * Subset of {@link autoImportPaths} where `import type { ... }` is still allowed

package/dist/eslint/index.mjs

@@ -35,6 +35,8 @@ const TRPC_ROUTERS_GLOB = "**/server/trpc/routers/**/*.{ts,js}";
 const ZOD_DEPRECATED_METHODS = ["extend", "merge", "passthrough"];
 const APP_FILES = ["**/*.{ts,vue}"];
 const APP_IGNORES = ["**/*.d.ts"];
+const SHARED_FILES = ["shared/**/*.{ts,vue}", "layers/*/shared/**/*.{ts,vue}"];
+const SERVER_FILES = ["server/**/*.{ts,vue}", "layers/*/server/**/*.{ts,vue}"];
 const PROCESS_ENV_PROPERTY = {
   object: "process",
   property: "env",
@@ -71,12 +73,26 @@ function zodImportStyleBans(options) {
     { selector: `ExportNamedDeclaration[source.value=${ZOD_SOURCE}][exportKind!='type'] ExportSpecifier[local.name='z'][exportKind!='type']`, message: ZOD_IMPORT_STYLE_MESSAGE }
   ];
 }
+const NUXT_AUTO_IMPORT_GLOBS = /* @__PURE__ */ new Map([
+  ["utils", [
+    "~/utils/**",
+    "@/utils/**",
+    "~~/app/utils/**",
+    "@@/app/utils/**",
+    "~~/shared/utils/**",
+    "@@/shared/utils/**",
+    "#shared/utils/**"
+  ]],
+  ["composables", ["~/composables/**", "@/composables/**", "~~/app/composables/**", "@@/app/composables/**"]],
+  ["~~/shared/types", ["~~/shared/types/**", "@@/shared/types/**", "#shared/types/**"]]
+]);
+function escapeGlob(glob) {
+  return glob.replace(/^#/, "\\#");
+}
 function anchoredGlobs(rawPath) {
   const path = rawPath.replace(/\/+$/, "");
-  if (/^(?:[~@#/]|\.{1,2}\/)/.test(path)) {
-    return [`${path}/**`];
-  }
-  return [`~/${path}/**`, `~~/${path}/**`, `@/${path}/**`];
+  const [first, ...rest] = NUXT_AUTO_IMPORT_GLOBS.get(path) ?? (/^(?:[~@#/]|\.{1,2}\/)/.test(path) ? [`${path}/**`] : [`~/${path}/**`, `~~/${path}/**`, `@/${path}/**`]);
+  return [escapeGlob(first), ...rest.map(escapeGlob)];
 }
 function importRestrictions(options) {
   const paths = [
@@ -150,18 +166,27 @@ function buildEslintLayers(options) {
     }
   });
   const { paths, patterns } = importRestrictions(options);
-  const appRules = {
-    "no-restricted-properties": ["error", PROCESS_ENV_PROPERTY]
-  };
-  if (paths.length > 0 || patterns.length > 0) {
-    appRules["ts/no-restricted-imports"] = ["error", { paths, patterns }];
+  const prismaPatterns = options.prismaImportGuard ? [{
+    group: ["~~/prisma/*", "~~/prisma/**"],
+    message: "Do not import the Prisma client on the app side. Use a server-only module."
+  }] : [];
+  const scopes = [
+    ["sidebase/restricted-app", APP_FILES, [...patterns, ...prismaPatterns]],
+    ["sidebase/restricted-shared", SHARED_FILES, prismaPatterns],
+    // Server code legitimately imports the Prisma client.
+    ["sidebase/restricted-server", SERVER_FILES, []]
+  ];
+  for (const [name, files, scopePatterns] of scopes) {
+    configs.push({
+      name,
+      files,
+      ignores: APP_IGNORES,
+      rules: {
+        "no-restricted-properties": ["error", PROCESS_ENV_PROPERTY],
+        "ts/no-restricted-imports": ["error", scopePatterns.length > 0 ? { paths, patterns: scopePatterns } : { paths }]
+      }
+    });
   }
-  configs.push({
-    name: "sidebase/restricted-app",
-    files: APP_FILES,
-    ignores: APP_IGNORES,
-    rules: appRules
-  });
   const zodSyntax = [...zodImportStyleBans(options), ...zodMethodBans(options)];
   if (zodSyntax.length > 0) {
     configs.push({
@@ -180,18 +205,6 @@ function buildEslintLayers(options) {
       rules: { "no-restricted-syntax": ["error", ...zodSyntax, PUBLIC_PROCEDURE_SELECTOR] }
     });
   }
-  if (options.prismaImportGuard) {
-    const prismaPattern = {
-      group: ["~~/prisma/*", "~~/prisma/**"],
-      message: "Do not import the Prisma client on the app side. Use a server-only module."
-    };
-    configs.push({
-      name: "sidebase/prisma-import-guard",
-      files: APP_FILES,
-      ignores: [...APP_IGNORES, "**/server/**"],
-      rules: { "ts/no-restricted-imports": ["error", { paths, patterns: [...patterns, prismaPattern] }] }
-    });
-  }
   if (options.testFilePattern.length > 0) {
     configs.push({
       name: "sidebase/test-overrides",

package/docs/migration.md

@@ -607,38 +607,40 @@ anything it managed under an old path or an old payload is simply dropped from t
 managed set rather than removed. `check` reports clean either way, because it only
 inspects paths that are currently managed. Nothing will ever tell you these are there.
 
-#### 9a. The two orphaned workflow files
+#### 9a. The orphaned `.yml` workflow files
 
-Do this only if your repository synced the payload before the workflow extensions were
-normalized, which is the case for every adoption branch cut before this release. Check:
+Do this only if your repository synced a payload that still shipped `.yml` workflows,
+which is the case for every adoption branch cut before this release. Check:
 
 ```sh
 ls .github/workflows/
 ```
 
-If you see `ci.yaml` or `pr-preview-cleanup.yaml` sitting next to `ci.yml` and
-`pr-preview-cleanup.yml`, remove the `.yaml` pair:
+If you see `ci.yml`, `pr-preview-cleanup.yml` or `streamctl-upgrade.yml` sitting next to
+its `.yaml` counterpart, remove the `.yml` copies:
 
 ```sh
-git rm --ignore-unmatch .github/workflows/ci.yaml .github/workflows/pr-preview-cleanup.yaml
-```
-
-`--ignore-unmatch` matters: the condition above is "either file", but `git rm` is atomic, so
-naming a path that does not exist aborts with `fatal: pathspec ... did not match any files`
-and removes NEITHER. A repository that opted one workflow out, or never enabled preview
-cleanup, would skim that error and keep running both copies of the other.
-
-This is required, not tidying. The payload renamed those two managed files from `.yaml` to
-`.yml`. streamctl manages files by path, so the sync in step 7 wrote the new `.yml` files
-but did NOT delete the old `.yaml` ones: they are simply no longer in the managed set.
-GitHub Actions runs every file in `.github/workflows/`, so if you leave them the
-repository runs BOTH copies. That means duplicate CI on every push, and two
-`pr-preview-cleanup` jobs racing to tear down the same preview environment. The leftover
-copies are also frozen forever, so they never receive later fixes, including security
-updates to pinned action SHAs.
-
-While you are here, if your config opts out of either workflow by its old path, for
-example `files: { ".github/workflows/ci.yaml": "off" }`, re-key it to the `.yml` path.
+git rm --ignore-unmatch .github/workflows/ci.yml .github/workflows/pr-preview-cleanup.yml .github/workflows/streamctl-upgrade.yml
+```
+
+`--ignore-unmatch` matters: the condition above is "any of these files", but `git rm` is
+atomic, so naming a path that does not exist aborts with `fatal: pathspec ... did not match
+any files` and removes NONE. A repository that opted one workflow out, or never enabled
+preview cleanup or upgrade PRs, would skim that error and keep running both copies of the
+others.
+
+This is required, not tidying. The payload renamed those managed files from `.yml` to
+`.yaml`, so every YAML file it ships uses the same extension as `pnpm-workspace.yaml`.
+streamctl manages files by path, so the sync in step 7 wrote the new `.yaml` files but did
+NOT delete the old `.yml` ones: they are simply no longer in the managed set. GitHub
+Actions runs every file in `.github/workflows/`, so if you leave them the repository runs
+BOTH copies. That means duplicate CI on every push, two `pr-preview-cleanup` jobs racing to
+tear down the same preview environment, and two weekly upgrade PRs. The leftover copies
+are also frozen forever, so they never receive later fixes, including security updates to
+pinned action SHAs.
+
+While you are here, if your config opts out of any of these workflows by its old path, for
+example `files: { ".github/workflows/ci.yml": "off" }`, re-key it to the `.yaml` path.
 An opt-out naming a path that is no longer managed does nothing, so the file you meant to
 suppress would start arriving on the next sync.
 
@@ -646,7 +648,7 @@ suppress would start arriving on the next sync.
 
 The same problem in a harder-to-see form. A `block` file keeps its markers after the
 payload stops managing that path, so the block sits there forever: never updated, never
-reported, and indistinguishable from a block that is still live. The two `.yaml`
+reported, and indistinguishable from a block that is still live. The `.yml`
 workflows above are the known orphaned FILES for this release; orphaned blocks are not
 enumerable in advance, because they depend on which payload version your repository
 adopted first.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sidebase/base-config",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Shared @sidebase base configuration for Nuxt repos: ESLint / Prisma / tsconfig factories on npm, plus the streamctl file-sync preset payload",
   "keywords": [
     "sidebase",

package/presets/base/preset.json

@@ -10,7 +10,7 @@
     { "path": ".vscode/settings.json", "strategy": "merge", "source": "base/vscode/settings.json", "render": "editor", "projectFields": ["editor.fontSize", "editor.rulers", "editor.formatOnSave", "files.exclude", "search.exclude", "files.watcherExclude"] },
     { "path": ".vscode/extensions.json", "strategy": "merge", "source": "base/vscode/extensions.json", "projectFields": ["unwantedRecommendations"] },
     { "path": "AGENTS.md", "strategy": "full", "source": "base/AGENTS.md", "adoption": "expected" },
-    { "path": ".github/workflows/streamctl-upgrade.yml", "strategy": "full", "source": "base/github/workflows/streamctl-upgrade.yml", "render": "automation-upgrade", "enabledBy": "automation.upgradePr", "adoption": "unexpected" }
+    { "path": ".github/workflows/streamctl-upgrade.yaml", "strategy": "full", "source": "base/github/workflows/streamctl-upgrade.yaml", "render": "automation-upgrade", "enabledBy": "automation.upgradePr", "adoption": "unexpected" }
   ],
   "renders": {
     "automation-upgrade": {
@@ -32,7 +32,7 @@
         "MIN_RELEASE_AGE": { "configPath": "security.minimumReleaseAge", "default": "10080", "pattern": "^\\d+$" }
       },
       "fragments": [
-        { "forEach": "pnpm.onlyBuiltDependencies", "source": "base/templates/pnpm/only-built-dependency.yml" }
+        { "forEach": "pnpm.onlyBuiltDependencies", "source": "base/templates/pnpm/only-built-dependency.yaml" }
       ]
     }
   },

package/presets/nuxt-app/preset.json

@@ -6,8 +6,8 @@
     { "path": "eslint.config.ts", "strategy": "scaffold", "source": "nuxt-app/eslint.config.ts", "shadowedBy": ["eslint.config.mjs", "eslint.config.js", "eslint.config.cjs"] },
     { "path": "prisma.config.ts", "strategy": "scaffold", "source": "nuxt-app/prisma.config.ts" },
     { "path": "Dockerfile", "strategy": "full", "source": "nuxt-app/Dockerfile", "render": "dockerfile", "adoption": "expected" },
-    { "path": ".github/workflows/pr-preview-cleanup.yml", "strategy": "full", "source": "nuxt-app/github/workflows/pr-preview-cleanup.yml", "adoption": "expected" },
-    { "path": ".github/workflows/ci.yml", "strategy": "full", "source": "nuxt-app/github/workflows/ci.yml", "render": "ci" }
+    { "path": ".github/workflows/pr-preview-cleanup.yaml", "strategy": "full", "source": "nuxt-app/github/workflows/pr-preview-cleanup.yaml", "adoption": "expected" },
+    { "path": ".github/workflows/ci.yaml", "strategy": "full", "source": "nuxt-app/github/workflows/ci.yaml", "render": "ci" }
   ],
   "renders": {
     "ci": {
@@ -16,8 +16,8 @@
         "NODE_VERSION": { "configPath": "versions.node", "default": "24.21.0", "pattern": "^[\\w.+-]+$" }
       },
       "fragments": [
-        { "toggle": "ci.unitTests", "source": "nuxt-app/templates/ci/test-job.yml" },
-        { "toggle": "ci.e2e", "source": "nuxt-app/templates/ci/e2e-job.yml" }
+        { "toggle": "ci.unitTests", "source": "nuxt-app/templates/ci/test-job.yaml" },
+        { "toggle": "ci.e2e", "source": "nuxt-app/templates/ci/e2e-job.yaml" }
       ]
     },
     "dockerfile": {