@tdk-landscape/tdk-cli-core 1.3.104 → 1.3.106

package/cli/dist/utils/discovery-context.js

@@ -1,5 +1,6 @@
 import { createCacheValidator } from "./cache.js";
-import { discoverResources, discoverStacks, getAllStacks } from "./services.js";
+import { findProjectRoot } from "./paths.js";
+import { discoverResources, discoverResourcesWithProblems, discoverStacks, getAllStacks, warnAboutSkippedFiles, } from "./services.js";
 let cachedContext = null;
 const cacheValidator = createCacheValidator(1000);
 export function clearDiscoveryCache() {
@@ -13,9 +14,13 @@ export function createDiscoveryContext(forceRefresh = false) {
     if (!forceRefresh && isCacheValid() && cachedContext) {
         return cachedContext;
     }
-    const resources = discoverResources();
-    const stacks = discoverStacks();
+    const projectRoot = findProjectRoot();
+    const { resources, problems } = projectRoot
+        ? discoverResourcesWithProblems(projectRoot)
+        : { resources: discoverResources(), problems: [] };
+    const stacks = discoverStacks(resources);
     const stackNames = getAllStacks(resources);
+    warnAboutSkippedFiles(problems);
     const unassignedResources = resources.filter((r) => !r.stack);
     const resourcesByStack = new Map();
     for (const resource of resources) {
@@ -27,6 +32,7 @@ export function createDiscoveryContext(forceRefresh = false) {
     }
     const context = {
         resources,
+        problems,
         stacks,
         stackNames,
         unassignedResources,

package/cli/dist/utils/doctor-report.js

@@ -20,8 +20,12 @@ export async function collectDoctorChecks(machineChecks, projectChecks) {
     }
     return { checks, errors };
 }
+function containerRuntimeReachable(checks) {
+    const runtime = checks.find((check) => check.name === "Container Runtime");
+    return runtime ? runtime.didPass : null;
+}
 /** Produce the same readiness decision for human and machine consumers. */
-export function createDoctorReport(checks, inProject, errors = [], portPlan) {
+export function createDoctorReport(checks, inProject, errors = [], portPlan, host) {
     return {
         schemaVersion: 1,
         data: {
@@ -29,6 +33,15 @@ export function createDoctorReport(checks, inProject, errors = [], portPlan) {
                 checks.every((check) => check.didPass || check.isSkipped || check.isWarning),
             inProject,
             checks,
+            ...(host
+                ? {
+                    host: {
+                        ...host,
+                        containerRuntimeReachable: containerRuntimeReachable(checks),
+                        canUp: host.canUp && containerRuntimeReachable(checks) !== false,
+                    },
+                }
+                : {}),
             ...(portPlan !== undefined
                 ? {
                     ports: {

package/cli/dist/utils/doctor-wiring.js

@@ -165,6 +165,94 @@ export function checkFrontendBackendUrls(projectRoot = findProjectRoot() ?? proc
         fix: `Backends are only reachable through Traefik: http://api.${project}.localhost/api/<name without -api>/... (for example catalog-api is /api/catalog). Use that URL, or the generated .autogenerated/env.ts`,
     };
 }
+/** The common ways to apply schema changes from a command line: Prisma, Drizzle, Knex, TypeORM, MikroORM, Sequelize, dbmate, Atlas, Alembic. */
+const MIGRATION_COMMAND = /\b(?:prisma\s+(?:migrate\s+(?:deploy|dev|resolve)|db\s+push)|drizzle-kit\s+(?:migrate|push)|knex\s+migrate:\w+|typeorm\s+migration:run|mikro-orm\s+migration:up|sequelize(?:-cli)?\s+db:migrate|dbmate\s+(?:up|migrate)|atlas\s+migrate\s+apply|alembic\s+upgrade)\b/;
+const START_SCRIPTS = new Set(["start", "dev", "serve", "prestart", "predev", "preserve"]);
+const SHELL_ENTRYPOINT = /\.(?:sh|bash)$/;
+const DOCKERFILE_START = /^\s*(?:CMD|ENTRYPOINT)\b/i;
+function readText(path) {
+    try {
+        return readFileSync(path, "utf-8");
+    }
+    catch {
+        return undefined;
+    }
+}
+function startScriptMigrations(resourceDir) {
+    const text = readText(join(resourceDir, "package.json"));
+    if (text === undefined)
+        return [];
+    let scripts = {};
+    try {
+        scripts = JSON.parse(text)?.scripts ?? {};
+    }
+    catch {
+        return [];
+    }
+    return Object.entries(scripts)
+        .filter(([name, command]) => START_SCRIPTS.has(name) && typeof command === "string" && MIGRATION_COMMAND.test(command))
+        .map(([name]) => `package.json "${name}" script`);
+}
+function fileMigrations(path, onlyStartLines) {
+    const text = readText(path);
+    if (text === undefined)
+        return false;
+    return text.split("\n").some((line) => 
+    // `["prisma", "migrate", "deploy"]` is the same command as `prisma migrate deploy`.
+    MIGRATION_COMMAND.test(line.replace(/["'`,[\]]+/g, " ")) &&
+        !COMMENT_LINE.test(line) &&
+        (!onlyStartLines || DOCKERFILE_START.test(line)));
+}
+/**
+ * A backend or worker that applies migrations from its own start-up (a `start` script, a Dockerfile CMD,
+ * an entrypoint script or its source) races its siblings and runs again on every restart. TDK has a
+ * `migrator` app type for this: it runs once, before the services that depend on it. This is a warning,
+ * not a failure: such services work, and the opt-in Infisical entrypoint is one of them.
+ */
+export function checkMigrationsInApi(projectRoot = findProjectRoot() ?? process.cwd()) {
+    const findings = [];
+    for (const resource of discoverResourcesFromRoot(projectRoot)) {
+        const appType = resource.config?.appType ?? resource.type;
+        if (appType !== "backend" && appType !== "worker")
+            continue;
+        const dir = resource.path;
+        for (const finding of startScriptMigrations(dir))
+            findings.push(`${resource.name}: ${finding}`);
+        const dockerfile = join(dir, resource.config?.dockerfile ?? "Dockerfile");
+        if (fileMigrations(dockerfile, true)) {
+            findings.push(`${resource.name}: ${relative(projectRoot, dockerfile)} CMD or ENTRYPOINT`);
+        }
+        let entries = [];
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch { }
+        for (const entry of entries) {
+            const path = join(dir, entry.name);
+            if (entry.isFile() && SHELL_ENTRYPOINT.test(entry.name) && fileMigrations(path, false)) {
+                findings.push(`${resource.name}: ${relative(projectRoot, path)}`);
+            }
+        }
+        for (const path of listSourceFiles(join(dir, "src"))) {
+            if (fileMigrations(path, false))
+                findings.push(`${resource.name}: ${relative(projectRoot, path)}`);
+        }
+    }
+    if (findings.length === 0) {
+        return {
+            name: "Migrations outside the API",
+            didPass: true,
+            message: "No backend or worker runs a migration command from its own start-up",
+        };
+    }
+    return {
+        name: "Migrations outside the API",
+        didPass: false,
+        isWarning: true,
+        message: `${formatCount(findings.length, "migration command")} run from a backend or worker's own start-up:\n    ${findings.join("\n    ")}`,
+        fix: "Move the migration into a `migrator` resource (appType migrator) that the service depends on, so it runs once before the service starts instead of on every start and restart",
+    };
+}
 export function checkNatsBroker(projectRoot = findProjectRoot() ?? process.cwd()) {
     const users = discoverResourcesFromRoot(projectRoot)
         .filter((resource) => resource.config?.featuresEnabled?.includes("nats"))

package/cli/dist/utils/json-output.js

@@ -0,0 +1,27 @@
+import { writeSync } from "node:fs";
+/**
+ * Returns an emitter that writes at most one `{schemaVersion, data, errors}` object to stdout. If the process
+ * exits before anything was emitted (a preflight `process.exit`, Tilt ending early), a failure object is written
+ * so a JSON consumer never sees an empty stdout. Uses writeSync because `process.exit` does not flush async writes.
+ */
+export function createJsonEmitter(failureCode, command) {
+    let emitted = false;
+    const emit = (data, errors = []) => {
+        if (emitted)
+            return;
+        emitted = true;
+        writeSync(1, `${JSON.stringify({ schemaVersion: 1, data, errors })}\n`);
+    };
+    process.once("exit", (code) => {
+        emit({ ok: false }, [
+            {
+                code: failureCode,
+                message: code === 0
+                    ? `${command} exited before reporting a result`
+                    : `${command} exited with code ${code}`,
+            },
+        ]);
+    });
+    return emit;
+}
+//# sourceMappingURL=json-output.js.map

package/cli/dist/utils/services.js

@@ -48,11 +48,34 @@ const printedWarnings = new Set();
 export function resetPrintedServiceWarnings() {
     printedWarnings.clear();
 }
+class InvalidServiceJsonError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason);
+        this.reason = reason;
+        this.name = "InvalidServiceJsonError";
+    }
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
 function parseResource(serviceJsonPath) {
-    const content = readFileSync(serviceJsonPath, "utf-8");
-    const parsed = JSON.parse(content);
+    let content;
+    try {
+        content = readFileSync(serviceJsonPath, "utf-8");
+    }
+    catch (error) {
+        throw new InvalidServiceJsonError(`could not read file: ${errorMessage(error)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch (error) {
+        throw new InvalidServiceJsonError(`invalid JSON: ${errorMessage(error)}`);
+    }
     if (!isValidResourceConfig(parsed)) {
-        throw new Error(`Invalid service.json at ${serviceJsonPath}: missing required fields (appName, runtime or appType)`);
+        throw new InvalidServiceJsonError("missing required fields (appName, runtime or appType)");
     }
     const parsedConfig = parsed;
     for (const warning of validateServiceManifest(parsed, serviceJsonPath).warnings) {
@@ -76,12 +99,35 @@ function parseResource(serviceJsonPath) {
         stack: config.stack,
     };
 }
-export function discoverResourcesFromRoot(projectRoot) {
+export function discoverResourcesWithProblems(projectRoot) {
     const serviceJsonPaths = findServiceJsonFiles(projectRoot);
     const resources = [];
+    const problems = [];
     for (const path of serviceJsonPaths) {
-        resources.push(parseResource(path));
+        try {
+            resources.push(parseResource(path));
+        }
+        catch (error) {
+            problems.push({
+                path,
+                reason: error instanceof InvalidServiceJsonError ? error.reason : errorMessage(error),
+            });
+        }
+    }
+    return { resources, problems };
+}
+export function warnAboutSkippedFiles(problems) {
+    for (const problem of problems) {
+        const warning = `skipped ${problem.path}: ${problem.reason}`;
+        if (printedWarnings.has(warning))
+            continue;
+        printedWarnings.add(warning);
+        console.warn(`⚠️  ${warning}`);
     }
+}
+export function discoverResourcesFromRoot(projectRoot) {
+    const { resources, problems } = discoverResourcesWithProblems(projectRoot);
+    warnAboutSkippedFiles(problems);
     return resources;
 }
 export function discoverResources() {
@@ -91,6 +137,19 @@ export function discoverResources() {
     }
     return discoverResourcesFromRoot(projectRoot);
 }
+export function discoverResourcesStrict() {
+    const projectRoot = findProjectRoot();
+    if (!projectRoot) {
+        throw new Error("Could not find project root (no .tdk/project.json found). Run `tdk project --yes` first.");
+    }
+    const { resources, problems } = discoverResourcesWithProblems(projectRoot);
+    if (problems.length > 0) {
+        throw new Error(problems
+            .map((problem) => `Invalid service.json at ${problem.path}: ${problem.reason}`)
+            .join("\n"));
+    }
+    return resources;
+}
 /**
  * Unique, sorted `stack` values across discovered service.json files under `projectRoot`.
  * Tilt's discovery groups services by this same field (see tdk-cli-extensions
@@ -117,8 +176,7 @@ export function getAllStacks(resources) {
     }
     return Array.from(stacks).sort();
 }
-export function discoverStacks() {
-    const resources = discoverResources();
+export function discoverStacks(resources = discoverResources()) {
     const stackMap = new Map();
     for (const resource of resources) {
         if (resource.stack) {

package/cli/dist/utils/status-ports.js

@@ -0,0 +1,32 @@
+import { STANDARD_PORTS } from "./constants.js";
+import { isApiServiceType } from "./resource-kind.js";
+import { resolveServicePath, resolveSubdomainBases } from "./service-urls.js";
+export function buildServicePorts(resource, ingressHttp) {
+    const appType = resource.config?.appType;
+    const routable = appType === "frontend" || isApiServiceType(appType);
+    let url = null;
+    if (routable) {
+        const { appBase, apiBase } = resolveSubdomainBases(ingressHttp);
+        url = `${isApiServiceType(appType) ? apiBase : appBase}${resolveServicePath(resource)}`;
+    }
+    return { url, containerPort: resource.port ?? resource.config?.port ?? null, hostPort: null };
+}
+/** Ports a client should forward or open: ingress, Tilt UI, and the published datastore. Not one per service. */
+export function buildStackPorts(plan, tiltPort) {
+    const ports = [];
+    if (plan) {
+        ports.push({ name: "ingress-http", hostPort: plan.ingressHttp, purpose: "Traefik HTTP ingress" }, { name: "ingress-https", hostPort: plan.ingressHttps, purpose: "Traefik HTTPS ingress" });
+    }
+    // `tdk up` may move Tilt off 10350 and records that only in its own process, so this is the default or TILT_PORT.
+    const validTiltPort = tiltPort !== undefined && Number.isInteger(tiltPort) && tiltPort > 0;
+    ports.push({
+        name: "tilt-ui",
+        hostPort: validTiltPort ? tiltPort : STANDARD_PORTS.tiltUi,
+        purpose: "Tilt UI",
+    });
+    if (plan) {
+        ports.push({ name: "postgres", hostPort: plan.postgres, purpose: "Published Postgres" });
+    }
+    return ports;
+}
+//# sourceMappingURL=status-ports.js.map

package/cli/dist/utils/tilt-logs.js

@@ -0,0 +1,62 @@
+export const DEFAULT_LOG_TAIL = 200;
+/** Upper bound for --tail so a snapshot stays small enough for an agent to read. */
+export const MAX_LOG_TAIL = 10_000;
+const NANOSECONDS = {
+    ns: 1,
+    us: 1e3,
+    µs: 1e3,
+    ms: 1e6,
+    s: 1e9,
+    m: 6e10,
+    h: 3.6e12,
+};
+// Go's time.Duration is an int64 of nanoseconds, so anything beyond this is rejected by `tilt logs`.
+const MAX_DURATION_NANOSECONDS = 2 ** 63 - 1;
+/**
+ * Go-style duration such as 30s, 5m, 1h or 1h30m, within roughly the range Go's ParseDuration accepts.
+ * The sum is a JS number, so values within a few nanoseconds of the int64 limit can disagree with Go; this only needs to
+ * reject absurd input, and Tilt remains the final judge (its rejection is reported as TILT_LOGS_FAILED).
+ */
+export function isValidSince(value) {
+    if (!/^(\d+(\.\d+)?(ns|us|µs|ms|s|m|h))+$/.test(value))
+        return false;
+    let total = 0;
+    for (const [, amount, unit] of value.matchAll(/(\d+(?:\.\d+)?)(ns|us|µs|ms|s|m|h)/g)) {
+        total += Number(amount) * (NANOSECONDS[unit] ?? 0);
+    }
+    return total <= MAX_DURATION_NANOSECONDS;
+}
+export function isValidPort(value) {
+    return /^[1-9]\d{0,4}$/.test(value) && Number(value) <= 65535;
+}
+export function isValidTail(value) {
+    return /^[1-9]\d*$/.test(value) && Number(value) <= MAX_LOG_TAIL;
+}
+/** Parse `tilt logs --json` (JSON Lines) into normalized lines, keeping at most the last `limit`. Unparseable lines are skipped. */
+export function parseTiltLogLines(output, limit) {
+    const lines = [];
+    for (const raw of output.split("\n")) {
+        if (!raw.trim())
+            continue;
+        try {
+            const entry = JSON.parse(raw);
+            const str = (value) => typeof value === "string" && value !== "" ? value : null;
+            lines.push({
+                time: str(entry.time),
+                resource: str(entry.resource),
+                level: str(entry.level),
+                source: str(entry.source),
+                text: typeof entry.message === "string" ? entry.message : "",
+            });
+        }
+        catch {
+            // Tilt can print a non-JSON notice before the stream; it is not a log line.
+        }
+    }
+    return lines.slice(-limit);
+}
+/** True when `tilt logs` failed because no Tilt server answered, as opposed to rejecting its arguments. */
+export function isTiltConnectionFailure(stderr) {
+    return /connection refused|connecting to Tilt|no such host|dial tcp|websocket_token/i.test(stderr);
+}
+//# sourceMappingURL=tilt-logs.js.map

package/cli/dist/utils/up-only.js

@@ -0,0 +1,29 @@
+/** Requested names that match no discovered service (the Tiltfile silently enables everything for an unknown focus name). */
+export function findUnknownServices(requested, candidates) {
+    const known = new Set(candidates.map((resource) => resource.name));
+    return requested.filter((name) => !known.has(name));
+}
+/**
+ * The requested services plus their `dependsOn` closure. This mirrors what the generated Tiltfile enables for
+ * `--focus=<service>` (see get_all_needed_services in engine/topologies/tilt/config/profiles.star) so the CLI can report
+ * the same set. Shared infrastructure (Postgres, Traefik, the golden images) is always enabled by the Tiltfile and is not listed here.
+ * A dependsOn entry that is not a discovered service is ignored.
+ */
+export function resolveOnlySelection(requested, all) {
+    const byName = new Map(all.map((resource) => [resource.name, resource]));
+    const wanted = new Set();
+    const visit = (name) => {
+        if (wanted.has(name) || !byName.has(name))
+            return;
+        wanted.add(name);
+        for (const dep of byName.get(name)?.config?.dependsOn ?? [])
+            visit(dep);
+    };
+    for (const name of requested)
+        visit(name);
+    return {
+        selected: all.filter((resource) => wanted.has(resource.name)),
+        dependencies: all.map((r) => r.name).filter((n) => wanted.has(n) && !requested.includes(n)),
+    };
+}
+//# sourceMappingURL=up-only.js.map

package/cli/dist/utils/up-readiness.js

@@ -0,0 +1,115 @@
+import { execFile } from "node:child_process";
+import { getDeferredResourceNames, parseTiltResourceFailures } from "./doctor-runtime.js";
+import { findOnPath } from "./which.js";
+export function tiltGetUiResources(port) {
+    return new Promise((resolve) => {
+        execFile(findOnPath("tilt") ?? "tilt", ["get", "uiresources", "-o", "json", "--port", String(port)], { timeout: 15_000, maxBuffer: 16 * 1024 * 1024 }, (error, stdout) => resolve(error ? null : stdout));
+    });
+}
+/**
+ * Tilt lists resources outside the current focus (the other release phases, or everything but a `--only` selection) with
+ * `disableStatus.state: Disabled` and both statuses `none`, which would read as pending forever. A resource whose update
+ * status is `not_applicable` (a serve-only local resource) has nothing to build, so it counts as built.
+ */
+export function onlyEnabledResources(jsonText) {
+    const parsed = JSON.parse(jsonText);
+    const items = (parsed.items ?? [])
+        .filter((item) => item.status?.disableStatus?.state !== "Disabled")
+        .map((item) => item.status?.updateStatus === "not_applicable"
+        ? { ...item, status: { ...item.status, updateStatus: "ok" } }
+        : item);
+    return JSON.stringify({ items });
+}
+function enabledNames(jsonText) {
+    return (JSON.parse(jsonText).items ?? [])
+        .filter((item) => item.status?.disableStatus?.state !== "Disabled")
+        .flatMap((item) => (item.metadata?.name ? [item.metadata.name] : []));
+}
+/**
+ * Services the caller asked for must not vanish into the disabled filter: one that Tilt lists as disabled (it can be
+ * disabled while running) is a failure, and one Tilt does not list yet is still pending.
+ */
+export function checkExpectedResources(jsonText, expected) {
+    const items = JSON.parse(jsonText).items ?? [];
+    const byName = new Map(items.map((item) => [item.metadata?.name, item]));
+    return {
+        missing: expected.filter((name) => !byName.has(name)),
+        disabled: expected.filter((name) => byName.get(name)?.status?.disableStatus?.state === "Disabled"),
+    };
+}
+/**
+ * One look at `tilt get uiresources -o json`. `settled` means polling can stop: everything is ready, or the rest has
+ * finished with a failure (an errored resource, or an expected service Tilt has disabled).
+ */
+export function evaluateTiltReadiness(jsonText, deferred, expected) {
+    const parsed = parseTiltResourceFailures(onlyEnabledResources(jsonText), deferred);
+    let result = {
+        ready: parsed.failures.length === 0 && parsed.pendingCount === 0 && parsed.okCount > 0,
+        failures: parsed.failures.map((failure) => ({
+            name: failure.name,
+            message: failure.error || `${failure.updateStatus}/${failure.runtimeStatus}`,
+        })),
+        pending: parsed.pendingCount,
+        timedOut: false,
+        enabled: enabledNames(jsonText),
+    };
+    if (expected && expected.length > 0) {
+        const { missing, disabled } = checkExpectedResources(jsonText, expected);
+        if (missing.length > 0) {
+            result = { ...result, ready: false, pending: result.pending + missing.length };
+        }
+        if (disabled.length > 0) {
+            return {
+                settled: true,
+                result: {
+                    ...result,
+                    ready: false,
+                    failures: [
+                        ...result.failures,
+                        ...disabled.map((name) => ({ name, message: "disabled in Tilt" })),
+                    ],
+                },
+            };
+        }
+    }
+    return {
+        result,
+        settled: result.ready || (result.failures.length > 0 && result.pending === 0),
+    };
+}
+/**
+ * Waits until every non-deferred Tilt resource is built and running. Resolves not-ready as soon as the rest has settled
+ * with an errored resource, or at the deadline. Sablier-deferred resources are excluded: they stay idle by design.
+ */
+export async function waitForTiltResourcesReady(port, options = {}) {
+    const timeoutMs = options.timeoutMs ?? Number(process.env.TDK_UP_READY_TIMEOUT_MS ?? 900_000);
+    const intervalMs = options.intervalMs ?? 2_000;
+    const fetchJson = options.fetchJson ?? tiltGetUiResources;
+    const deferred = options.deferred ?? getDeferredResourceNames();
+    const deadline = Date.now() + timeoutMs;
+    let last = {
+        ready: false,
+        failures: [],
+        pending: 0,
+        timedOut: false,
+        enabled: [],
+    };
+    for (;;) {
+        const text = await fetchJson(port);
+        if (text) {
+            try {
+                const evaluation = evaluateTiltReadiness(text, deferred, options.expected);
+                last = evaluation.result;
+                if (evaluation.settled)
+                    return last;
+            }
+            catch {
+                /* Tilt may emit partial output while starting; retry. */
+            }
+        }
+        if (Date.now() >= deadline)
+            return { ...last, ready: false, timedOut: true };
+        await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    }
+}
+//# sourceMappingURL=up-readiness.js.map

package/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tdk-cli-internal",
   "private": true,
-  "version": "1.3.104",
+  "version": "1.3.106",
   "description": "TDK CLI — start services on your laptop.",
   "keywords": [
     "tdk",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdk-landscape/tdk-cli-core",
-  "version": "1.3.104",
+  "version": "1.3.106",
   "description": "TDK CLI — start services on your laptop.",
   "homepage": "https://tdk-landscape.github.io/tdk-website",
   "repository": {