@flisk-sh/flisk-import 0.2.3 → 0.3.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 TDK Landscape
+Copyright (c) 2026 Flisk
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,24 +1,61 @@
-# tdk import
+# flisk import
 
-Import the services in a repo's root `docker-compose.yml` into [TDK](https://github.com/flisk-sh/flisk) as `service.json` files. This is the Compose first tier of flisk-sh/flisk#511.
+Import the services in a repo's root `docker-compose.yml` into [Flisk](https://github.com/flisk-sh/flisk) as `service.json` files. This is the Compose first tier of flisk-sh/flisk#511.
 
 ```bash
-tdk import . --dry-run     # plan only
-tdk import .               # plan, then ask before writing
-tdk import . --yes         # write service.json files and project setup
+flisk import . --dry-run     # plan only
+flisk import .               # plan, then ask before writing
+flisk import . --yes         # write service.json files and project setup
 ```
 
 ## What to expect
 
 - **Reads one file:** the root `docker-compose.yml`. Not `compose.yaml`, override files, nested Compose files, Dockerfiles on their own, `package.json`, or Procfiles.
-- **Writes:** one bring-your-own `service.json` per Compose service, plus `.tdk/project.json` if the repo is not a TDK project yet. It never edits the Compose file or overwrites a `service.json` without `--force`.
-- **Keeps:** the build context and Dockerfile (or the image), the container port, `depends_on`, and an HTTP health path. Databases and brokers are private, with no proxy route.
-- **Drops, and says so:** env values, volumes, `command`, `env_file` and every other untranslated key; services with `profiles`, `extends`, an out-of-tree build or a `${VAR}` image.
-- **Does not start anything.** Put env values in `.env`, then run `tdk up` with TDK core **1.3.145 or later**. The importer does not check the core version.
+- **Writes:** one bring-your-own `service.json` per Compose service, plus `.flisk/project.json` if the repo is not a Flisk project yet. It never edits the Compose file or overwrites a `service.json` without `--force`.
+- **Keeps:** the service names (`db` stays `db`, so it stays the hostname), the build context and Dockerfile (or the image), the container port as written (3000, 80, 5432), `depends_on`, and an HTTP health path. Databases and brokers are private, with no proxy route.
+- **Environment:** names go into `service.json` as `secrets.required`; literal values are copied to the project `.env`, which is added to `.gitignore`. Values in `.env` already are kept, and `${VAR}` values are left for you.
+- **Drops, and says so:** volumes, `command`, `env_file` and every other untranslated key; services with `profiles`, `extends`, an out-of-tree build or a `${VAR}` image.
+- **Does not start anything.** Run `flisk up` with Flisk core **1.4.11 or later**. The importer does not check the core version.
 - **Exit codes:** `0` when the plan succeeds (`--dry-run`, files written, or all `service.json` files already exist), `1` when no root `docker-compose.yml` or mappable service is found, and `2` when the write prompt is declined or closed without an answer (`Nothing written.`).
 
-See [docs/import.md](docs/import.md) for the full mapping and limits. `tdk import` is the core CLI command backed by this package.
+See [docs/import.md](docs/import.md) for the full mapping and limits. `flisk import` is the core CLI command backed by this package.
 
 ```bash
 bun install && bun run build && bun run test
 ```
+
+## Publishing
+
+`flisk-import` is published to npmjs.org by the workflow in
+[`.github/workflows/publish-npm.yml`](.github/workflows/publish-npm.yml), triggered by a
+GitHub release. It uses **npm trusted publishing (OIDC)**, so no long-lived npm token
+lives in this repository. The package is published under two names: the unscoped
+`flisk-import` and the scoped `@flisk-sh/flisk-import` (the same archive with the name
+rewritten in the packed manifest).
+
+### One-time owner setup
+
+A trusted publisher has to exist on npm before the first OIDC publish succeeds, and it is
+configured per package name:
+
+1. Open the package on npmjs.com → **Settings** → **Trusted Publisher** → **GitHub Actions**
+2. Fill in:
+   - Organization: `flisk-sh`
+   - Repository: `flisk-import`
+   - Workflow filename: `publish-npm.yml`
+   - Allowed actions: `npm publish`
+3. Repeat for `@flisk-sh/flisk-import` once that package exists
+
+The same thing from the command line, for either name:
+
+```bash
+npm trust github flisk-import --file publish-npm.yml --repo flisk-sh/flisk-import --allow-publish
+npm trust list flisk-import
+```
+
+### The first version
+
+A package's first version cannot be published through OIDC — npm has no trusted publisher
+for a name that does not exist yet. Version 0.2.2 was therefore published once with a
+token; every version after that publishes over OIDC from the release workflow.
+

package/dist/cli.js

@@ -5,9 +5,9 @@ import { createInterface } from "node:readline/promises";
 import { Command } from "commander";
 import "./detectors/index.js";
 import { ImportError } from "./errors.js";
+import { MIN_CORE_VERSION } from "./flisk.js";
 import { formatPlan } from "./format.js";
 import { buildPlan } from "./plan.js";
-import { MIN_CORE_VERSION } from "./tdk.js";
 import { applyWrites, manifestRelPath, planWrites } from "./write.js";
 async function confirm(message) {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
@@ -46,7 +46,7 @@ const program = new Command("flisk-import")
         return void console.log("Nothing to write: every service.json already exists.");
     }
     if (!options.yes &&
-        !(await confirm(`Write ${pending.length} service.json file(s)${writes.projectConfig ? " and create .tdk/project.json" : ""}?`))) {
+        !(await confirm(`Write ${pending.length} service.json file(s)${writes.projectConfig ? " and create .flisk/project.json" : ""}?`))) {
         console.log("Nothing written.");
         process.exitCode = 2;
         return;
@@ -55,11 +55,14 @@ const program = new Command("flisk-import")
     for (const item of written) {
         console.log(`  wrote ${relative(process.cwd(), item.path) || manifestRelPath(plan, item)}`);
     }
-    console.log(`\nWrote ${written.length} service.json file(s)${writes.projectConfig ? " and created .tdk/project.json" : ""}.`);
+    console.log(`\nWrote ${written.length} service.json file(s)${writes.projectConfig ? " and created .flisk/project.json" : ""}.`);
     const envFile = relative(process.cwd(), join(writes.projectRoot, ".env")) || ".env";
     console.log("\nNext:");
-    if (plan.services.some((s) => s.envKeys.length))
-        console.log(`  - Put the environment values these services need in ${envFile}; values in docker-compose.yml were not copied.`);
+    const copied = Object.keys(writes.env.add);
+    if (copied.length)
+        console.log(`  - Copied ${copied.length} environment value(s) from docker-compose.yml to ${envFile} (gitignored).`);
+    if (writes.items.some((item) => item.notes.some((note) => note.startsWith("no literal value"))))
+        console.log(`  - Add the values listed above as missing to ${envFile}.`);
     console.log(`  - Run \`flisk up\` with Flisk core ${MIN_CORE_VERSION} or later. The import did not start anything.`);
 });
 try {

package/dist/detectors/compose.js

@@ -1,8 +1,8 @@
 import { readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, normalize } from "node:path/posix";
 import { isAlias, isMap, parseDocument, visit } from "yaml";
+import { HEALTH_CHECK_PATH_PATTERN } from "../flisk.js";
 import { registerDetector } from "../registry.js";
-import { HEALTH_CHECK_PATH_PATTERN } from "../tdk.js";
 const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 /** Container-side port of one `ports:` entry, in short or long syntax. */
 function containerPort(entry) {
@@ -41,6 +41,26 @@ function envNames(environment) {
     }
     return isObj(environment) ? Object.keys(environment) : [];
 }
+/** Literal environment values; interpolated ones (`${VAR}`) and empty entries are left for the user. */
+function envValues(environment) {
+    const pairs = Array.isArray(environment)
+        ? environment
+            .filter((e) => typeof e === "string" && e.includes("="))
+            .map((e) => [e.slice(0, e.indexOf("=")), e.slice(e.indexOf("=") + 1)])
+        : isObj(environment)
+            ? Object.entries(environment)
+            : [];
+    const out = {};
+    for (const [key, raw] of pairs) {
+        if (raw === null || raw === undefined || typeof raw === "object")
+            continue;
+        const value = String(raw);
+        if (value.includes("${") || value.includes("\n"))
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
 function commandOf(command) {
     if (typeof command === "string")
         return command;
@@ -176,6 +196,7 @@ registerDetector({
                     : [];
             const command = commandOf(raw.command);
             const envKeys = envNames(raw.environment);
+            const env = envValues(raw.environment);
             const foundHealthPath = healthPathOf(raw.healthcheck);
             const healthCheckPath = foundHealthPath && HEALTH_CHECK_PATH_PATTERN.test(foundHealthPath)
                 ? foundHealthPath
@@ -208,6 +229,7 @@ registerDetector({
                 ...(healthCheckPath ? { healthCheckPath } : {}),
                 exposeViaProxy,
                 ...(envKeys.length ? { envKeys } : {}),
+                ...(Object.keys(env).length ? { env } : {}),
                 ...(dependsOn.length ? { dependsOn } : {}),
                 confidence: "high",
                 sources: [base],

package/dist/{tdk.js → flisk.js}

@@ -4,11 +4,12 @@ import { dirname, join, resolve } from "node:path";
 export const SERVICE_MANIFEST_SCHEMA_VERSION = 1;
 export const SERVICE_MANIFEST_SCHEMA_URL = "https://flisk.sh/schema.service.json";
 /**
- * Oldest Flisk core that starts an imported project: 1.3.104 added `buildContext`, and 1.3.145
- * (flisk#1018) bootstraps a project that has `.tdk/project.json` but no Tiltfile yet.
- * Stated, not checked: the importer does not read the installed core version.
+ * Oldest Flisk core that starts an imported project: 1.3.104 added `buildContext`, 1.3.145
+ * (flisk#1018) bootstraps a project that has `.flisk/project.json` but no Tiltfile yet, and the
+ * release after 1.4.10 (flisk#2646) accepts a bring-your-own port outside 4000-5999 and two-letter
+ * names, which this importer now writes. Stated, not checked: it does not read the installed version.
  */
-export const MIN_CORE_VERSION = "1.3.145";
+export const MIN_CORE_VERSION = "1.4.11";
 /** Flisk's bring-your-own port range. */
 export const BYO_PORT_RANGE = { min: 4000, max: 5999, label: "4000-5999" };
 /**
@@ -26,11 +27,11 @@ export function validateName(label, name) {
             error: `${label} "${name}" must use lowercase letters, numbers, and hyphens only`,
         };
 }
-/** Nearest directory at or above `start` holding `.tdk/project.json`. */
+/** Nearest directory at or above `start` holding `.flisk/project.json`. */
 export function findProjectRoot(start) {
     let dir = resolve(start);
     while (true) {
-        if (existsSync(join(dir, ".tdk", "project.json")))
+        if (existsSync(join(dir, ".flisk", "project.json")))
             return dir;
         const parent = dirname(dir);
         if (parent === dir)

package/dist/format.js

@@ -10,7 +10,7 @@ export function formatPlan(plan, writes) {
     const jobs = plan.services.filter((s) => s.kind === "job").length;
     out.push(`Found ${plan.services.length - jobs} service(s) and ${jobs} job(s) in ${plan.root}`, `Read only: ${plan.files.join(", ")}. Lines below name what was not translated.`, "");
     if (writes.projectConfig)
-        out.push(`  .tdk/project.json  [create Flisk project]`, "");
+        out.push(`  .flisk/project.json  [create Flisk project]`, "");
     for (const service of plan.services) {
         const item = writes.items.find((i) => i.service === service);
         out.push(`  ${service.name}  (${service.kind}${service.dir ? `, ${service.dir}/` : ""})`);

package/dist/merge.js

@@ -8,10 +8,11 @@ function slug(raw) {
 }
 export function toResourceName(raw) {
     let name = slug(raw) || "svc";
-    // Resource names must start with a letter and be at least 3 characters (service schema).
+    // Resource names must start with a letter and be at least 2 characters (service schema), so a
+    // Compose name such as `db` is kept and stays the container's hostname.
     if (!/^[a-z]/.test(name))
         name = `svc-${name}`;
-    if (name.length < 3)
+    if (name.length < 2)
         name = `${name}-svc`;
     return name;
 }
@@ -57,6 +58,7 @@ function mergeGroup(name, dir, members, resolve) {
         dir,
         kind: ordered[0].kind,
         envKeys: [...new Set(ordered.flatMap((c) => c.envKeys ?? []))].sort(),
+        env: Object.assign({}, ...[...ordered].reverse().map((c) => c.env ?? {})),
         dependsOn: [...new Set(ordered.flatMap((c) => (c.dependsOn ?? []).map(resolve)))].sort(),
         exposeViaProxy: ordered.find((c) => c.exposeViaProxy !== undefined)?.exposeViaProxy,
         procfileCommands: ordered.flatMap((c) => c.sources.some((source) => source.detector === "procfile") && c.command ? [c.command] : []),

package/dist/scan.js

@@ -8,7 +8,7 @@ export const HARD_SKIPS = new Set([
     "dist",
     ".autogenerated",
     // Output of `flisk project`: never a source of services.
-    ".tdk",
+    ".flisk",
     "shared-platform-engineering",
 ]);
 export const MAX_DEPTH = 8;
@@ -84,8 +84,8 @@ export function scanTree(root, limits = { depth: MAX_DEPTH, files: MAX_FILES })
     let depthCapped = false;
     let fileCapped = false;
     // In a Flisk project, `services/` holds manifests and generated compose files, not sources.
-    const isTdkProject = existsSync(join(root, ".tdk", "project.json"));
-    if (isTdkProject)
+    const isFliskProject = existsSync(join(root, ".flisk", "project.json"));
+    if (isFliskProject)
         notes.push("Flisk project detected: services/ was not scanned");
     const walk = (rel, depth, inherited) => {
         const abs = join(root, rel);
@@ -106,7 +106,7 @@ export function scanTree(root, limits = { depth: MAX_DEPTH, files: MAX_FILES })
             if (entry.isDirectory()) {
                 if (HARD_SKIPS.has(entry.name) || isIgnored(rules, entryRel, entry.name, true))
                     continue;
-                if (isTdkProject && entryRel === "services")
+                if (isFliskProject && entryRel === "services")
                     continue;
                 if (depth >= limits.depth) {
                     depthCapped = true;

package/dist/write.js

@@ -1,9 +1,25 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { ImportError } from "./errors.js";
+import { BYO_PORT_RANGE, findProjectRoot, IMAGE_PATTERN, SERVICE_MANIFEST_SCHEMA_URL, SERVICE_MANIFEST_SCHEMA_VERSION, validateName, } from "./flisk.js";
 import { toResourceName } from "./merge.js";
 import { usedManifestPorts } from "./plan.js";
-import { BYO_PORT_RANGE, findProjectRoot, IMAGE_PATTERN, SERVICE_MANIFEST_SCHEMA_URL, SERVICE_MANIFEST_SCHEMA_VERSION, validateName, } from "./tdk.js";
+/** Secret names the service schema accepts (`secrets.required`). */
+const ENV_NAME = /^[A-Z_][A-Z0-9_]*$/;
+function readEnvKeys(path) {
+    if (!existsSync(path))
+        return new Set();
+    return new Set(readFileSync(path, "utf8")
+        .split(/\r?\n/)
+        .map((line) => line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1])
+        .filter((key) => key !== undefined));
+}
+/** A .env value, quoted when it holds characters a dotenv parser would split or strip. */
+function envLine(key, value) {
+    return /^[A-Za-z0-9_./:@+-]*$/.test(value)
+        ? `${key}=${value}`
+        : `${key}=${JSON.stringify(value)}`;
+}
 function existingPort(path) {
     try {
         const port = JSON.parse(readFileSync(path, "utf8")).port;
@@ -29,7 +45,7 @@ export function planWrites(plan, force) {
         ]);
     }
     const servicesDir = join(projectRoot, "services");
-    const projectConfigPath = join(projectRoot, ".tdk", "project.json");
+    const projectConfigPath = join(projectRoot, ".flisk", "project.json");
     const projectConfig = existsSync(projectConfigPath)
         ? undefined
         : {
@@ -58,6 +74,9 @@ export function planWrites(plan, force) {
                 overrides: {},
             }, null, 2)}\n`,
         };
+    const envPath = join(projectRoot, ".env");
+    const envKept = readEnvKeys(envPath);
+    const envAdd = {};
     const used = usedManifestPorts(servicesDir);
     const items = [];
     const rejected = [];
@@ -97,8 +116,9 @@ export function planWrites(plan, force) {
             // Never written, so no port is needed; keep the one on disk for the plan.
             port = existingPort(path) ?? BYO_PORT_RANGE.min;
         }
-        else if (service.port !== undefined && free(service.port)) {
-            // The schema accepts this port for bring-your-own and no other service in the project uses it.
+        else if (service.port !== undefined) {
+            // A bring-your-own port is the port inside its own container (Traefik reaches it on the stack
+            // network; nothing is published on the host), so the Compose port is kept as written.
             port = service.port;
         }
         else if (keep !== undefined && free(keep)) {
@@ -112,11 +132,8 @@ export function planWrites(plan, force) {
                 }
             }
         }
-        if (status !== "exists" &&
-            service.port !== undefined &&
-            port !== undefined &&
-            port !== service.port)
-            notes.push(`Compose port ${service.port} is outside ${BYO_PORT_RANGE.label} or already used; assigned ${port}. The container must listen on $PORT (${port}) or it will not answer`);
+        if (status !== "exists" && service.port === undefined && !isPrivate && port !== undefined)
+            notes.push(`port ${port} assigned: Compose gives no single container port; the container must listen on $PORT (${port})`);
         if (port === undefined) {
             rejected.push({ name: service.name, reason: `no free port in ${BYO_PORT_RANGE.label}` });
             continue;
@@ -135,8 +152,23 @@ export function planWrites(plan, force) {
             notes.push("no health path: the service does not serve HTTP (non-HTTP image or job)");
         if (!isPrivate && !nonHttp && !service.healthCheckPath)
             notes.push("health path / is assumed: no HTTP health path could be read from Compose. Traefik routes only while it answers 2xx or 3xx");
-        if (service.envKeys.length)
-            notes.push("environment values are not written; put them in the project .env");
+        // Names go into service.json as secrets, so Flisk injects them; values go to the gitignored project .env.
+        const secretNames = service.envKeys.filter((key) => ENV_NAME.test(key));
+        const skippedNames = service.envKeys.filter((key) => !ENV_NAME.test(key));
+        if (skippedNames.length)
+            notes.push(`environment names not written (Flisk accepts A-Z, 0-9 and _): ${skippedNames.join(", ")}`);
+        const missing = [];
+        for (const key of secretNames) {
+            const value = service.env[key];
+            if (envKept.has(key) || key in envAdd)
+                continue;
+            if (value === undefined)
+                missing.push(key);
+            else
+                envAdd[key] = value;
+        }
+        if (missing.length)
+            notes.push(`no literal value in docker-compose.yml for ${missing.join(", ")}; add it to the project .env`);
         if (service.dockerfile && service.image)
             notes.push(`image "${service.image}" is not written: with build and image, Flisk builds from ${service.dockerfile} and does not pull the tag`);
         // With both build and image, Compose builds the Dockerfile and tags the result as `image`.
@@ -158,10 +190,18 @@ export function planWrites(plan, force) {
             ...source,
             ...(isPrivate ? { exposeViaProxy: false } : {}),
             ...(dependsOn.length ? { dependsOn } : {}),
+            ...(secretNames.length ? { secrets: { required: secretNames } } : {}),
         };
         items.push({ service, path, manifest, status, notes });
     }
-    return { projectRoot, stack, items, projectConfig, rejected };
+    return {
+        projectRoot,
+        stack,
+        items,
+        projectConfig,
+        rejected,
+        env: { path: envPath, add: envAdd },
+    };
 }
 export function applyWrites(writes) {
     const written = [];
@@ -176,8 +216,24 @@ export function applyWrites(writes) {
         writeFileSync(item.path, `${JSON.stringify(item.manifest, null, 2)}\n`);
         written.push(item);
     }
+    const keys = Object.keys(writes.env.add);
+    if (keys.length) {
+        const existing = existsSync(writes.env.path) ? readFileSync(writes.env.path, "utf8") : "";
+        const lines = keys.map((key) => envLine(key, writes.env.add[key]));
+        const block = `${existing && !existing.endsWith("\n") ? "\n" : ""}# From docker-compose.yml (flisk import)\n${lines.join("\n")}\n`;
+        writeFileSync(writes.env.path, existing + block);
+        ensureGitignored(writes.projectRoot, ".env");
+    }
     return written;
 }
 export function manifestRelPath(plan, item) {
     return relative(plan.root, item.path).split("\\").join("/");
 }
+/** Keeps the project .env out of git: it now holds values copied from docker-compose.yml. */
+function ensureGitignored(projectRoot, entry) {
+    const path = join(projectRoot, ".gitignore");
+    const content = existsSync(path) ? readFileSync(path, "utf8") : "";
+    if (content.split(/\r?\n/).some((line) => line.trim() === entry || line.trim() === `/${entry}`))
+        return;
+    writeFileSync(path, `${content}${content && !content.endsWith("\n") ? "\n" : ""}${entry}\n`);
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@flisk-sh/flisk-import",
-  "version": "0.2.3",
-  "description": "Import services from a repository's root docker-compose.yml into TDK service.json files.",
+  "version": "0.3.0",
+  "description": "Import services from a repository's root docker-compose.yml into Flisk service.json files.",
   "type": "module",
   "license": "MIT",
   "bin": {