fix: refresh Prisma 8 starters and deployment configuration

[AmanVarshney01]

Changes

• Align starters and the existing-app ORM init path with Prisma 8.0.0-rc.21 (engine 0.6.3), ORM 8.0.0-rc.16, and Composer 0.28.0.
• Refresh all ten starters against current framework docs: Next.js 16.4 / React 19.3, SvelteKit 3 / Node adapter 6, Astro 7 / Node adapter 11, Nuxt 4.6, TanStack Start 1.168, Nest 12, Hono 4.13 / Node server 2, Elysia 1.4, and Turbo 2.11.
• Keep TypeScript 6.0.3, not 7, in every starter. SvelteKit 3 requires TypeScript 6. Move SvelteKit configuration into Vite and replace $lib with package imports as its migration guide specifies.
• Use Vite's built-in TypeScript path resolution for TanStack Start; remove the extra paths plugin and unused Router plugin dependency. Remove the deprecated baseUrl setting.
• Use Elysia's current @elysia/node adapter package. Match Node engine ranges to the updated tools.
• Put extensions/state in the official composer: composer(...) section of prisma.config.ts. Remove the retired separate Composer config; retain explicit deployment region and adapters for prebuilt apps.
• Consolidate identical Yarn configs into one shared template. Use Yarn's documented release-age allowlist for first-party Prisma packages; keep the gate for other publishers. Require Yarn 4.10+.
• Read DATABASE_URL in Mongo's standalone ORM config, matching native init, .env.example and the runtime. Composer's MONGODB_URL secret is unchanged.
• Format hydrated Nuxt/SvelteKit timestamps in UTC to avoid server/client mismatches. Exclude generated Composer bundles from Next.js lint.
• Update Bun's declared version to 1.4.2, matching Compute. Keep pnpm on the latest 11.x release: the installed pnpm 11 launcher was reproduced attempting to interpret pnpm 12's native binary as JavaScript.
• Give the existing TypeScript integration tests unique database names so separate runs cannot reuse persisted schema markers.
• Run CI on the CLI's published minimum Node 22.22 and npm 11.6. Verify the packed CLI with strict dependency engines, then scaffold, build and typecheck a Minimal app before either preview or production publication. This catches dependency Node support drifting beyond the declared minimum.

Alchemy 2.0.0-beta.78 and the template's Effect family 4.0.0-rc.115 remain aligned with published Composer 0.28.0. Latest Alchemy uses Effect stable and cannot be substituted into that release independently. The CLI's own dependencies are unchanged. No compatibility shim, migration bypass, new test suite, or new CI workflow.

Verified with the actual CLI

Fresh scaffolds used both PSL and TypeScript contracts. All 20 template/style combinations are verified in the cloud and locally. The first cloud matrix passed 19 of 20; TanStack/PSL was blocked by workspace database quota. After approved cleanup of older test projects, its generated deploy script passed without any code change. Checks require HTTP 200 and Alice/Bob/Carol on consecutive queries, plus a working home route.

Template	PSL cloud	TypeScript cloud	Local / typecheck
Minimal	Pass	Pass	Pass / Pass
Hono	Pass	Pass	Pass / Pass
Elysia	Pass	Pass	Pass / Pass
Nest	Pass	Pass	Pass / Pass
Next.js	Pass	Pass	Pass / Pass
Turborepo	Pass	Pass	Pass / Pass
SvelteKit	Pass	Pass	Pass / Pass
Astro	Pass	Pass	Pass / Pass
Nuxt	Pass	Pass	Pass / Pass
TanStack Start	Pass after quota cleanup	Pass	Pass / Pass

Additional checks:

• All five frontend cloud pages loaded in a browser in both contract styles with seeded data and no errors after hydration. TanStack's client-side Home navigation also passes in both styles.
• Astro's actual checker reports zero errors/warnings in both styles. Next.js lint passes in both styles after excluding Composer output.
• Default agent skills, native init, contract emit and build pass with npm (Minimal), pnpm 11 (Next/TypeScript), Yarn 4 (SvelteKit) and Deno (Minimal/TypeScript). npm 12 scaffolding also passes. Fresh Mongo npm scaffolding, build and typecheck pass.
• The generated deploy scripts additionally pass with npm/Minimal, pnpm/Next.js and Yarn/SvelteKit, with two live seeded queries each.
• Deno: actual local Postgres migration and repeated seeded queries. MongoDB: both contract styles, db init, db verify, build/typecheck and repeated queries against a real local Mongo replica set.
• The merged existing-app flow from feat(create): offer safe actions for occupied directories #124 was retested interactively against the coordinated release: native init succeeds, the existing app file stays unchanged, and no starter/deployment is added. Ctrl+C before writes leaves files unchanged; JSON collisions reject without writes.
• All five frontend builds additionally pass on Node 22.23.3 with Bun 1.4.2.
• 98 unit tests and all 12 existing end-to-end tests pass. Formatting, lint, CLI typecheck and registry-backed pin checks pass. Current-head Windows creation/build CI passes. Published preview 0.13.5-pr.125.407.1 additionally scaffolds, builds and typechecks Next.js/TypeScript (Bun), SvelteKit/PSL (Yarn) and TanStack/PSL (Bun). All three installed TypeScript 6.0.3, and the packaged SvelteKit/TanStack configurations match the final source. Current-head preview 0.13.5-pr.125.408.1 additionally passed fresh Minimal/PSL scaffolding, skills setup, cloud deployment, build/typecheck and two live seeded queries on Bun 1.4.2.
• All three frontend fixtures created by published preview 407.1 subsequently passed their generated cloud deploy scripts and two live seeded queries: Next.js, SvelteKit, TanStack. The only source change between 407.1 and current 408.1 is a corrected comment and an existing-test assertion for TypeScript 6; template assets are unchanged.
• TanStack/TypeScript was also redeployed with the final tsconfig (deprecated baseUrl removed), passing typecheck and two live seeded queries against its existing cloud database. Its configuration matches the fresh final CLI scaffold.
• The new packed-package smoke script passes locally on exact Node 22.22.0 / npm 11.6.0 with strict dependency-engine checks. Node 22.18 was also verified to reject before writing a project. The first smoke attempt exhausted local disk space; the rerun passed after removing only reinstallable dependencies from completed test fixtures.

Verification notes

The test workspace prisma-build-test ran out of database slots during the initial matrix. Running the native prisma postgres create command confirmed:

{
  "code": "POSTGRES.API_ERROR",
  "why": "You have reached the maximum number of databases allowed for your plan.",
  "meta": { "status": 409, "apiCode": "quota-exceeded" }
}

Published Alchemy's database provider catches every Conflict as a duplicate resource. It replaces this quota error with Generated Prisma database '...' already exists but is not visible yet. No template workaround was added. The eight specifically approved older cp21-{minimal,hono,elysia,nest}-{psl,ts}-eksrvt test projects were validated against local deployment records and remote workspace/name/id before permanent deletion. Local source and logs remain, and no plan was changed. TanStack/PSL and the current-head preview deployed successfully after freeing capacity.

The remaining package-manager and published-preview cloud checks are complete and passed. The PR remains unmerged; no production release was made.

Docs checked

• Next.js installation
• SvelteKit 3 migration, Node adapter
• Astro 7 migration, Node adapter
• Nuxt installation, deployment, TypeScript
• TanStack Start setup, hosting with Nitro
• Hono Node adapter, Elysia Node adapter
• Nest migration guide, Turborepo installation
• Vite path resolution, tsdown dependencies, TypeScript 6 migration

Scope

Cloud tests use Postgres in prisma-build-test, on macOS ARM64 with Bun 1.4.0 or 1.4.2 / Node 26.7.0. npm/pnpm/Yarn checks cover representative combinations, not the full package-manager/OS cross-product. Windows CI checks creation/build, not Windows cloud deployment. Mongo was verified locally, not against an external cloud database. Deno remains local-only.

CLI/framework telemetry was disabled for test runs. The cloud service still records test deployments. No merge, production release, upstream release or latest tag change is part of this PR.

[coderabbitai]

Summary by CodeRabbit

• New Features
  • Generated projects now keep Prisma Composer settings in prisma.config.ts and use DATABASE_URL for database connections.
  • Generated Yarn projects include Prisma packages in the approved package list.
  • Svelte projects include #lib import aliases.
• Updates
  • Refreshed framework, Prisma, and package-manager versions in generated projects.
  • Updated Node.js support ranges; Node 25 is no longer included in supported ranges.
  • Updated generated SvelteKit projects to configure the Node adapter explicitly.
• Bug Fixes
  • Generated Nuxt and Svelte pages format dates in UTC.

Walkthrough

Generated projects now place Prisma Composer settings in prisma.config.ts and use DATABASE_URL for Prisma connections across providers. Package-manager versions and Yarn handling have changed. Framework templates include dependency and Node engine updates, alongside framework-specific configuration and UTC date-format changes. The pull request also adds a packed-CLI smoke test to preview and release workflows.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 547b0

The publishing smoke test checks the intended generated app on the minimum supported Node version. No actionable merge-blocking risk remains from the reviewed changes.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 10 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely summarizes the main changes: refreshing Prisma 8 starters and deployment configuration.
Description check	✅ Passed	The description directly covers the changeset, objectives, verification results, and known test limitations.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 10 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

PR preview published

• Version: 0.13.5-pr.125.410.1
• Tag: pr125
• Run with Bun: bunx create-prisma@pr125
• Run with npm: npx create-prisma@pr125
• Run with Yarn: yarn dlx create-prisma@pr125
• Run with pnpm: pnpm dlx create-prisma@pr125
• Run with Deno: deno run -A --minimum-dependency-age=0 npm:create-prisma@pr125
• Workflow run: https://github.com/prisma/create-prisma/actions/runs/37657433786

[coderabbitai]

🔇 Additional comments (4)

scripts/smoke-node.mjs (2)

6-13: 📐 Maintainability & Code Quality | 💤 Low value

env is not merged with the full parent environment explicitly, and the npm pack call omits it.

execa merges env with process.env by default, so npm_config_engine_strict reaches the child processes. This is correct. The npm pack call passes no env, so telemetry flags do not apply there. This is harmless for npm pack.

---

1-66: LGTM!

.github/workflows/publish.yml (1)

44-44: LGTM!

Also applies to: 85-85, 254-254

.github/workflows/publish.yml-109-109 (1)

109-109: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

⚠️ Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Ad-hoc npm install -g npm@11.6.0 is flagged by zizmor.

The install sits outside a lockfile. The version is pinned, so the practical risk is low. The pin is needed for trusted publishing. Accept the warning, or add a zizmor ignore with a reason.

Also applies to: 294-294

Source: Linters/SAST tools

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Essentials
• Run ID: 6873c2ef-d951-4639-b360-7207778fbd72

📥 Commits

Reviewing files that changed from the base of the PR and between a6a49f7 and 547b058.

📒 Files selected for processing (2)

• .github/workflows/publish.yml
• scripts/smoke-node.mjs

Included review availability: This review used your included allowance. 3 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

[AmanVarshney01]

@coderabbitai approve

[coderabbitai]

✅ Action performed

Comments resolved and changes approved.