feat(tsconfig): app.json, for a workspace that emits no declarations

[btravers]

base.json with declaration and declarationMap off, for a workspace that emits no declarations — an application, a deployment, an example, a test workspace.

Why it earns a preset. Declaration emit is type-checked even under noEmit, so declaration: true costs an application the errors it buys a library. Measured on a DI composition root with one unmet dependency:

error TS4023: Exported variable 'Root' has or is using name 'ID' from external module "…/di/dist/index" but cannot be named.
error TS4023: … name 'SERVICE' …
error TS2345: … but required in type '{ readonly "UNSATISFIED DEPENDENCIES — nothing provides": "OrpcRouter"; }'.

The two lines about a library's internal brand symbols come first; the sentence naming the missing port comes third. With app.json the actionable diagnostic is the only one. An application that ships no .d.ts has nothing to gain from that check and pays for it on every wiring mistake, internals-first.

A library keeps base.json: there the declaration check is the guarantee that its consumers can build.

scripts/validate.mjs covers the new file — the files allow-list and one structural assertion (extends ./base.json, declaration: false).

Downstream of btravstack/btravstack#205.

https://claude.ai/code/session_01GGixjxi5AQ2cNK62bBymfF

Summary by CodeRabbit

• New Features

  • Added an app.json TypeScript configuration preset for applications, deployment packages, examples, and test workspaces.
  • The preset disables declaration and declaration-map generation and is available as a public package export.

• Documentation

  • Documented when and how to use the application preset.
  • Added guidance for choosing between application and library configurations.

• Security

  • Updated the fast-uri security override to address additional parsing and regular-expression denial-of-service advisories.

• Tests

  • Added validation for both presets and the application preset’s settings.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: c83388fa-38dd-4914-bdca-26be8bdc6837

📥 Commits

Reviewing files that changed from the base of the PR and between 592123d and eaab57c.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !pnpm-lock.yaml

📒 Files selected for processing (1)

• pnpm-workspace.yaml

---

📝 Walkthrough

Walkthrough

Added an app.json TypeScript preset that extends base.json and disables declaration output. Package exports, validation checks, documentation, and a changeset now cover the preset. The workspace also raises the fast-uri override floor to 3.1.6.

Changes

Application TypeScript preset

Layer / File(s)	Summary
Define the application preset packages/tsconfig/app.json, packages/tsconfig/README.md, .changeset/tsconfig-app-preset.md	Added app.json with declaration and declaration-map output disabled. Documented its use for applications and its distinction from base.json for libraries.
Publish and validate the preset packages/tsconfig/package.json, scripts/validate.mjs	Added app.json to published files and package exports. Validation now checks its presence, inheritance from base.json, and both disabled declaration options.

fast-uri security override

Layer / File(s)	Summary
Raise the override floor pnpm-workspace.yaml	Changed the fast-uri override floor from versions below 3.1.5 to versions below 3.1.6. Expanded comments describe the covered advisories and transitive tooling path.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 59212

This PR adds an application TypeScript preset and validates its structure; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the addition of the app.json TypeScript preset for workspaces that emit no declarations. It matches the main change, although “a workspace” is narrower than the broader …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title clearly identifies the addition of the app.json TypeScript preset for workspaces that emit no declarations. It matches the main change, although “a workspace” is narrower than the broader scope.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/tsconfig-app-preset

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟡 Changes recommended

The new preset promises declarationMap: false, but the added validation only asserts declaration: false, leaving a gap that could allow regressions undetected.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a new TypeScript config preset intended for application-style workspaces (deployments/examples/tests) that do not ship .d.ts, so they can avoid declaration-emit diagnostics while keeping the strict base settings.

Changes:

• Introduces packages/tsconfig/app.json extending base.json with declaration/declarationMap disabled.
• Exposes and packages app.json via files + exports and documents when to use it.
• Extends scripts/validate.mjs to include the new shipped file and basic structural assertions.

File summaries

File	Description
scripts/validate.mjs	Adds app.json to shipped allow-list and validates key app.json structure.
packages/tsconfig/README.md	Documents the new app.json preset and rationale for apps vs libraries.
packages/tsconfig/package.json	Publishes app.json via files and subpath exports.
packages/tsconfig/app.json	New tsconfig preset disabling declaration outputs while extending the base config.
.changeset/tsconfig-app-preset.md	Declares a minor release and describes the new preset behavior.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[btravers]

CI is green: Format, Lint, Security Audit and Validate configs all pass.

Security Audit was failing on main rather than on anything in this PR — four advisories published into fast-uri since the last bump (GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp), reaching this repo through @commitlint/cli → ajv. The override commit is now the third commit here, so this PR is green on its own; #9 was the same fix as a standalone PR and I have closed it as redundant.

The floor moves on the existing entry rather than a second one being added — two overlapping ranges for one package is how a floor stops applying without anybody noticing (in unthrown I tried the second-entry form first and pnpm resolved the older, still-vulnerable pin). 3.1.6 published 2026-08-23, well past minimumReleaseAge: 10080.