@tdk-landscape/tdk-cli-core 1.3.108 → 1.3.110

package/CHANGELOG.md

@@ -4,6 +4,8 @@ Notable changes to the `tdk` CLI. Versions match [npm](https://www.npmjs.com/pac
 
 ## Unreleased
 
+- `tdk config verify` no longer fails on a root `.tiltignore` the repository already had. `tdk project` never overwrote it, but verify compared it with the generated one and reported `Out of sync: .tiltignore`; it now warns `not generated by TDK, left as is`. A `.tiltignore` carrying TDK's generated header that was edited is still reported. Refs #568.
+- A repo can pin the oldest CLI it works with: add `"minTdkVersion": "1.3.80"` to `.tdk/project.json`, and `tdk doctor` fails with `Run: tdk upgrade` on an older `tdk` (a value that is not `MAJOR.MINOR.PATCH` also fails). It is a floor, not an exact pin. Documented in `docs/upgrading.md`. Refs #564.
 - `tdk doctor` warns when a backend or worker applies database migrations from its own start-up (a `start`/`dev` script, a Dockerfile `CMD`/`ENTRYPOINT`, a shell entrypoint or its source: Prisma, Drizzle, Knex, TypeORM, MikroORM, Sequelize, dbmate, Atlas, Alembic). It is a warning, not a failure: such services work, but migrations belong in a `migrator` resource that runs once before the services that depend on it. `migrator` and bring-your-own resources are not checked.
 - Go services can opt in to a live development loop with `"dev": { "liveReload": true }` in `service.json`: edits are copied into the running container and recompiled without an image rebuild, while `go.mod`, `go.sum` and the generated Dockerfile still rebuild the image. The watcher compiles into a staging binary while the old build keeps serving and swaps only on success, so a compile error shows in the Tilt log and the last good build keeps answering (Air, tried first, stopped the app before compiling and left it down for the whole compile; in 2 of 6 edits a Traefik health check then returned 503 for 10 s). Measured on one loaded Mac: median edit-to-ready 1.63 s for the scaffold. The default Go image (`golang:1.23`) now sets `GOTOOLCHAIN=auto`, so a `go.mod` that needs a newer Go, such as Gin 1.12 (`go 1.25`), downloads that toolchain instead of stopping with `requires go >= 1.25`. Offline or air-gapped builds of a go.mod newer than 1.23 still fail, but now at the toolchain download rather than at the version check. `scripts/e2e/go-dev-loop.sh` checks all of this through a real `tdk up`. Refs #369.
 - `tdk up` keeps each smoke step's status and response body under `.tdk/smoke/<service>/<step>/` (`latest.json` and `body.txt`, body capped at 64 KiB), plus `last-success.json` and `last-success-body.txt` that a later failure never overwrites, so a regression can be diffed against the last good response. The failure line ends with the record path, and `tdk project` gitignores `.tdk/smoke/`. A new `smoke-e2e` workflow runs `scripts/verify-smoke.sh` and uploads the records. Before its first step a smoke check now waits for the service's health path (`healthCheckPath`, default `/health` for backends) with GETs until it answers something other than a connection error, 404 or 5xx, so a write is no longer the first request to hit a service that is still building; write retry rules are unchanged.

package/README.md

@@ -2,7 +2,7 @@
 
 [![npm version](https://img.shields.io/npm/v/@tdk-landscape/tdk-cli-core.svg?style=flat&color=blue)](https://www.npmjs.com/package/@tdk-landscape/tdk-cli-core)
 [![unpacked size](https://img.shields.io/npm/unpacked-size/@tdk-landscape/tdk-cli-core)](https://packagephobia.com/result?p=@tdk-landscape/tdk-cli-core)
-[![install size](https://packagephobia.com/badge?p=@tdk-landscape/tdk-cli-core)](https://packagephobia.com/result?p=@tdk-landscape/tdk-cli-core)
+[![install size](https://badgen.net/packagephobia/install/@tdk-landscape/tdk-cli-core)](https://packagephobia.com/result?p=@tdk-landscape/tdk-cli-core)
 [![CI](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/ci.yml/badge.svg)](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/ci.yml)
 [![Quickstart E2E](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/quickstart-e2e.yml/badge.svg)](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/quickstart-e2e.yml)
 [![ERP fixture scale E2E](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/erp-scale-e2e.yml/badge.svg)](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/erp-scale-e2e.yml)

package/cli/dist/commands/__tests__/ui-loading-screen.test.js

@@ -0,0 +1,16 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { renderToString } from "ink";
+import { describe, expect, it } from "vitest";
+import { LoadingScreen } from "../ui.js";
+describe("ui LoadingScreen", () => {
+    it("shows honest text with no percentage", () => {
+        const out = renderToString(_jsx(LoadingScreen, { animated: false }));
+        expect(out).toContain("Discovering resources...");
+        expect(out).not.toContain("%");
+    });
+    it("renders a spinner frame only when animated", () => {
+        expect(renderToString(_jsx(LoadingScreen, { animated: true }))).toMatch(/[⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏] Discovering/);
+        expect(renderToString(_jsx(LoadingScreen, { animated: false }))).not.toMatch(/[⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏]/);
+    });
+});
+//# sourceMappingURL=ui-loading-screen.test.js.map

package/cli/dist/commands/doctor.js

@@ -15,7 +15,7 @@ import { execAsync, isExecTimeout } from "../utils/exec-async.js";
 import { formatCount } from "../utils/formatting.js";
 import { getHostPortPlan } from "../utils/host-port-config.js";
 import { createHostPortPlan } from "../utils/host-port-plan.js";
-import { findProjectRoot } from "../utils/paths.js";
+import { findProjectRoot, getPackageVersion } from "../utils/paths.js";
 import { isApiServiceType } from "../utils/resource-kind.js";
 import { buildHealthTargets, pingHealthTargets } from "../utils/service-urls.js";
 import { discoverResourcesFromRoot } from "../utils/services.js";
@@ -416,6 +416,60 @@ function checkMasterConfigs() {
         fix: "Run: tdk project",
     };
 }
+/**
+ * A repo can pin the oldest CLI it works with: `"minTdkVersion": "1.3.80"` in
+ * .tdk/project.json. An older `tdk` fails here, so a team sees one clear line
+ * instead of a half-working `tdk up`.
+ */
+export function checkTdkVersion(currentVersion = getPackageVersion()) {
+    const projectRoot = findProjectRoot();
+    if (!projectRoot) {
+        return {
+            name: "TDK version",
+            didPass: true,
+            isSkipped: true,
+            message: "Not in a project - skipping TDK version check",
+        };
+    }
+    let minimum;
+    try {
+        const parsed = JSON.parse(readFileSync(join(projectRoot, ".tdk", "project.json"), "utf-8"));
+        minimum = parsed?.minTdkVersion;
+    }
+    catch {
+        minimum = undefined;
+    }
+    if (minimum === undefined) {
+        return {
+            name: "TDK version",
+            didPass: true,
+            isSkipped: true,
+            message: `tdk ${currentVersion} (no minTdkVersion in .tdk/project.json)`,
+        };
+    }
+    const required = typeof minimum === "string" ? parseVersion(minimum) : null;
+    if (!required || !/^\d+\.\d+\.\d+$/.test(String(minimum).trim())) {
+        return {
+            name: "TDK version",
+            didPass: false,
+            message: `.tdk/project.json minTdkVersion ${JSON.stringify(minimum)} is not a version like "1.3.80"`,
+            fix: 'Set minTdkVersion to a MAJOR.MINOR.PATCH string, for example "1.3.80".',
+        };
+    }
+    if (!versionMeetsMinimum(currentVersion, required)) {
+        return {
+            name: "TDK version",
+            didPass: false,
+            message: `tdk ${currentVersion} is older than the ${required.join(".")} this project requires (minTdkVersion)`,
+            fix: "Run: tdk upgrade",
+        };
+    }
+    return {
+        name: "TDK version",
+        didPass: true,
+        message: `tdk ${currentVersion} meets minTdkVersion ${required.join(".")}`,
+    };
+}
 /**
  * Tilt only builds resources under `discovery.paths`, but the CLI finds every service.json,
  * so a resource outside them is listed and given a URL by `tdk up` yet never started.
@@ -1092,6 +1146,7 @@ export const doctorCommand = new Command("doctor")
         () => checkDockerNetworkCapacity(),
     ];
     const projectChecks = [
+        () => checkTdkVersion(),
         checkMasterConfigs,
         checkGeneratedProjectRuntimeAssets,
         checkStarlarkLoadExports,

package/cli/dist/commands/ui.js

@@ -5,16 +5,27 @@ import { useCallback, useEffect, useMemo, useState } from "react";
 import { DetailPanel, FileTree, ResourceSelectInput, ResourceTable, TabBar, } from "../components/index.js";
 import { errorFactories, requireProjectRoot } from "../utils/errors.js";
 import { findProjectRoot } from "../utils/paths.js";
+import { describeSearch } from "../utils/search-status.js";
 import { clearMetadataCache, discoverResources, discoverStacks, getResourceMetadata, getStackMetadata, } from "../utils/services.js";
 import { createStatusMessageController } from "../utils/status-message.js";
 import { isTiltAvailable } from "../utils/tilt.js";
 // biome-ignore lint/correctness/noUnusedFunctionParameters: reserved callback prop kept in the component API
 const HelpPanel = ({ onClose }) => (_jsxs(Box, { borderStyle: "single", borderColor: "cyan", paddingX: 2, paddingY: 1, flexDirection: "column", width: 60, children: [_jsx(Text, { bold: true, color: "cyan", children: "Keyboard Shortcuts" }), _jsxs(Box, { marginY: 1, flexDirection: "column", children: [_jsx(Text, { bold: true, underline: true, children: "Navigation" }), _jsx(Text, { children: " \u2191/\u2193 Navigate list items" }), _jsx(Text, { children: " Enter Select item / Open detail" }), _jsx(Text, { children: " Space Toggle expand (tree view)" }), _jsx(Text, { children: " Tab Next tab" }), _jsx(Text, { children: " 1-5 Direct tab access" }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { bold: true, underline: true, children: "Actions" }) }), _jsx(Text, { children: " m Toggle mouse support" }), _jsx(Text, { children: " t Toggle tooltips" }), _jsx(Text, { children: " e Toggle enabled/disabled services" }), _jsx(Text, { children: " r Refresh data" }), _jsx(Text, { children: " / Search/filter" }), _jsx(Text, { children: " ? Show this help" }), _jsx(Text, { children: " q Quit \u2502 Esc Back" })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { color: "gray", dimColor: true, children: "Press any key to close..." }) })] }));
-const LoadingScreen = ({ progress, message }) => (_jsxs(Box, { flexDirection: "column", padding: 2, children: [_jsx(Text, { bold: true, color: "cyan", children: "\u2593\u2592\u2591 TDK NEON EDITION \u2591\u2592\u2593" }), _jsx(Box, { marginY: 1 }), _jsxs(Text, { children: ["Loading: ", message] }), _jsxs(Box, { marginY: 1, borderStyle: "single", borderColor: "gray", width: 50, children: [_jsx(Box, { width: progress / 2, backgroundColor: "cyan", children: _jsx(Text, { children: " ".repeat(progress / 2) }) }), _jsxs(Text, { children: [" ", progress, "%"] })] })] }));
+const SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+export const LoadingScreen = ({ message = "Discovering resources...", animated = true, }) => {
+    const [frame, setFrame] = useState(0);
+    useEffect(() => {
+        if (!animated)
+            return;
+        const timer = setInterval(() => setFrame((f) => (f + 1) % SPINNER_FRAMES.length), 80);
+        return () => clearInterval(timer);
+    }, [animated]);
+    return (_jsxs(Box, { flexDirection: "column", padding: 2, children: [_jsx(Text, { bold: true, color: "cyan", children: "\u2593\u2592\u2591 TDK NEON EDITION \u2591\u2592\u2593" }), _jsx(Box, { marginY: 1 }), _jsxs(Text, { children: [animated && _jsxs(Text, { color: "cyan", children: [SPINNER_FRAMES[frame], " "] }), message] })] }));
+};
 // biome-ignore lint/correctness/noUnusedFunctionParameters: reserved callback prop kept in the component API
 const ErrorScreen = ({ error, onRetry }) => (_jsxs(Box, { flexDirection: "column", padding: 2, alignItems: "center", children: [_jsx(Text, { bold: true, color: "red", children: "Could Not Load Services" }), _jsx(Box, { marginY: 1 }), _jsxs(Text, { color: "red", children: ["\u2717 ", error] }), _jsx(Box, { marginY: 1 }), _jsx(Text, { color: "gray", children: "Troubleshooting:" }), _jsx(Text, { color: "gray", children: " 1. Check that every service.json is valid JSON" }), _jsx(Text, { color: "gray", children: " 2. Run tdk from your project (the folder with the Tiltfile)" }), _jsx(Text, { color: "gray", children: " 3. Try: tdk status --verbose" }), _jsx(Box, { marginY: 1 }), _jsx(Text, { color: "cyan", children: "Press [r] to retry or [q] to quit" })] }));
 const EmptyState = ({ message }) => (_jsxs(Box, { flexDirection: "column", padding: 2, alignItems: "center", children: [_jsx(Text, { bold: true, color: "yellow", children: "No Services Found" }), _jsx(Box, { marginY: 1 }), _jsx(Text, { color: "gray", children: "\u25C9 No service.json files found" }), _jsx(Box, { marginY: 1 }), _jsx(Text, { children: "To get started:" }), _jsx(Text, { children: " 1. Run: tdk project" }), _jsx(Text, { children: " 2. Run: tdk resource api --type backend" }), _jsx(Box, { marginY: 1 }), _jsx(Text, { color: "cyan", children: "Press [r] to refresh or [q] to quit" }), message && (_jsx(Box, { paddingX: 1, height: 1, children: _jsxs(Text, { color: "cyan", children: ["\u2593\u2592\u2591 ", message, " \u2591\u2592\u2593"] }) }))] }));
-const TUIApp = () => {
+const TUIApp = ({ animated = true }) => {
     const { exit } = useApp();
     const { stdout } = useStdout();
     const { stdin, setRawMode } = useStdin();
@@ -149,6 +160,15 @@ const TUIApp = () => {
         return [];
     }, [activeTab, filteredStacks, filteredServices, selectedStackData, selectedServiceData]);
     const items = getItems();
+    // Only the stack and service lists are filtered by the query; drilled-in views are not.
+    const searchList = activeTab === "overview" || (activeTab === "resources" && !selectedStackData)
+        ? { total: stacks.length }
+        : (activeTab === "files" && !selectedServiceData) || activeTab === "config"
+            ? { total: services.length }
+            : null;
+    const searchStatus = searchList
+        ? describeSearch(searchQuery, items.length, searchList.total)
+        : null;
     useEffect(() => {
         if (highlightedIndex >= items.length && items.length > 0) {
             setHighlightedIndex(items.length - 1);
@@ -401,7 +421,7 @@ const TUIApp = () => {
     const compactTabBar = terminalWidth < 100;
     const compact = terminalWidth < 80;
     if (loading) {
-        return _jsx(LoadingScreen, { progress: 100, message: "Initializing..." });
+        return _jsx(LoadingScreen, { message: "Discovering resources...", animated: animated });
     }
     if (error) {
         return _jsx(ErrorScreen, { error: error, onRetry: refresh });
@@ -409,7 +429,7 @@ const TUIApp = () => {
     if (services.length === 0) {
         return _jsx(EmptyState, { message: message });
     }
-    return (_jsxs(Box, { flexDirection: "column", height: stdout.rows || 24, children: [_jsx(Box, { paddingX: 1, paddingY: 0, children: _jsxs(Text, { children: [_jsx(Text, { color: "cyan", bold: true, children: "\u2593\u2592\u2591 TDK NEON EDITION \u2591\u2592\u2593" }), _jsx(Text, { color: "gray", children: " \u2502 " }), _jsx(Text, { color: "white", children: projectRoot }), _jsx(Text, { color: "gray", children: " \u2502 " }), _jsxs(Text, { color: "green", children: [services.length, " services ready"] })] }) }), _jsx(Box, { paddingX: 1, children: _jsx(Text, { color: "gray", children: "─".repeat(compact ? 60 : Math.min(terminalWidth - 4, 100)) }) }), isSearching && (_jsx(Box, { paddingX: 1, height: 1, children: _jsxs(Text, { color: "yellow", children: ["Search: ", searchQuery, "_"] }) })), !isSearching && message && (_jsx(Box, { paddingX: 1, height: 1, children: _jsxs(Text, { color: "cyan", children: ["\u2593\u2592\u2591 ", message, " \u2591\u2592\u2593"] }) })), !isSearching && !message && showTooltips && !showHelp && (_jsx(Box, { paddingX: 1, height: 1, children: _jsx(Text, { color: "gray", dimColor: true, children: activeTab === "overview" && selectedStack
+    return (_jsxs(Box, { flexDirection: "column", height: stdout.rows || 24, children: [_jsx(Box, { paddingX: 1, paddingY: 0, children: _jsxs(Text, { children: [_jsx(Text, { color: "cyan", bold: true, children: "\u2593\u2592\u2591 TDK NEON EDITION \u2591\u2592\u2593" }), _jsx(Text, { color: "gray", children: " \u2502 " }), _jsx(Text, { color: "white", children: projectRoot }), _jsx(Text, { color: "gray", children: " \u2502 " }), _jsxs(Text, { color: "green", children: [services.length, " services ready"] })] }) }), _jsx(Box, { paddingX: 1, children: _jsx(Text, { color: "gray", children: "─".repeat(compact ? 60 : Math.min(terminalWidth - 4, 100)) }) }), isSearching && (_jsxs(Box, { paddingX: 1, height: 1, children: [_jsxs(Text, { color: "yellow", children: ["Search: ", searchQuery, "_"] }), searchStatus && _jsx(Text, { color: "gray", dimColor: true, children: `   ${searchStatus.summary}` })] })), searchStatus?.emptyMessage && (_jsx(Box, { paddingX: 1, height: 1, children: _jsx(Text, { color: "gray", children: searchStatus.emptyMessage }) })), !isSearching && message && (_jsx(Box, { paddingX: 1, height: 1, children: _jsxs(Text, { color: "cyan", children: ["\u2593\u2592\u2591 ", message, " \u2591\u2592\u2593"] }) })), !isSearching && !message && showTooltips && !showHelp && (_jsx(Box, { paddingX: 1, height: 1, children: _jsx(Text, { color: "gray", dimColor: true, children: activeTab === "overview" && selectedStack
                         ? `Stack "${selectedStack}" selected. [Enter] view │ [Esc] back │ [e] ${showEnabledOnly ? "show all" : "enabled only"} │ [?] help`
                         : activeTab === "overview" && !selectedStack
                             ? `[↑/↓] Navigate │ [Enter] Select │ [e] ${showEnabledOnly ? "show all" : "enabled only"} │ [?] help`
@@ -431,12 +451,12 @@ export const uiCommand = new Command("ui")
     .option("-v, --verbose", "Enable verbose output", false)
     .option("--no-animations", "Disable animations")
     .option("--high-contrast", "Enable high contrast mode")
-    .action(async () => {
+    .action(async (options) => {
     const tiltAvailable = await isTiltAvailable();
     if (!tiltAvailable) {
         errorFactories.tiltNotInstalled().exit();
     }
     requireProjectRoot();
-    render(_jsx(TUIApp, {}));
+    render(_jsx(TUIApp, { animated: options.animations }));
 });
 //# sourceMappingURL=ui.js.map

package/cli/dist/commands/up.js

@@ -2,7 +2,7 @@ import { connect } from "node:net";
 import { join } from "node:path";
 import chalk from "chalk";
 import { Command } from "commander";
-import { ensureProjectRuntimeAssets } from "../generator/template-engine.js";
+import { ensureProjectRuntimeAssets, ProjectConfigNotFoundError, verifyMasterConfigs, } from "../generator/template-engine.js";
 import { DEVCONTAINER_DOCKER_FIX, detectHost, isContainerHost, WEBCONTAINER_UP_MESSAGE, } from "../utils/agent-host.js";
 import { handleDryRun } from "../utils/command-helpers.js";
 import { getDeferredResourceNames } from "../utils/doctor-runtime.js";
@@ -54,6 +54,48 @@ async function defaultDockerReachable() {
         execFile("docker", ["ps"], { timeout: 10_000 }, (error) => resolve(!error));
     });
 }
+/** Exit status for `tdk up` when generated files no longer match service.json / project.json. */
+export const DRIFT_EXIT_CODE = 2;
+/**
+ * Generated service files edited by hand. Only these block `tdk up`: when service.json itself changed, `tdk up` regenerates
+ * the outputs, so stale outputs are the normal edit-then-up loop and not drift.
+ */
+export function driftReport(projectRoot) {
+    let handEdited;
+    try {
+        ({ handEdited } = verifyMasterConfigs(projectRoot));
+    }
+    catch (error) {
+        // A project with no .tdk/project.json has no snapshots to compare. Anything else (a corrupt config) must not skip the gate.
+        if (error instanceof ProjectConfigNotFoundError)
+            return null;
+        throw error;
+    }
+    if (handEdited.length === 0)
+        return null;
+    return [
+        "Generated files were edited by hand and no longer match service.json:",
+        ...handEdited.map((file) => `  ${file}`),
+        "Run `tdk config regenerate` to discard the edits, or bypass with `tdk up --ignore-drift`.",
+    ];
+}
+/**
+ * Runs before Tilt is started: exits with DRIFT_EXIT_CODE on drift unless `ignoreDrift` is set. With `ignoreDrift` the
+ * warning is printed every time, whether or not anything drifted, because the check is skipped and cannot tell.
+ */
+export function enforceDriftGate(projectRoot, options, exit = process.exit) {
+    if (options.ignoreDrift) {
+        console.warn(chalk.yellow("Warning: --ignore-drift set; generated files were not checked."));
+        return;
+    }
+    const drift = driftReport(projectRoot);
+    if (!drift)
+        return;
+    options.onDrift?.(drift.join("\n"));
+    for (const line of drift)
+        console.error(chalk.red(line));
+    exit(DRIFT_EXIT_CODE);
+}
 function waitForTiltUi(port, timeoutMs = 30_000) {
     return new Promise((resolve) => {
         const deadline = Date.now() + timeoutMs;
@@ -84,6 +126,7 @@ export const upCommand = new Command("up")
     .option("-q, --quiet", "Suppress non-essential output", false)
     .option("--dry-run", "Show what would be started without starting", false)
     .option("-f, --force", "Kill existing Tilt process before starting", false)
+    .option("--ignore-drift", "Start even if generated files differ from service.json", false)
     .option("--only <services...>", "Start only these services plus what the Tiltfile enables for them (their dependsOn services and shared infrastructure). With a stack, names must belong to that stack; dependencies may cross stacks")
     .option("--json", "Print one JSON object on stdout when the stack is ready or the command fails; implies --quiet", false)
     .action(async (stackName, options) => {
@@ -109,9 +152,8 @@ export const upCommand = new Command("up")
         await assertMachineReadyOrExit();
     }
     const action = async () => {
-        const projectRoot = options.dryRun
-            ? requireProjectRoot()
-            : (findProjectRoot() ?? process.cwd());
+        const foundRoot = options.dryRun ? requireProjectRoot() : findProjectRoot();
+        const projectRoot = foundRoot ?? process.cwd();
         const discoveredResources = discoverResourcesStrict();
         // Reject a bad request before anything below can write to the project (.env, runtime assets, .tdk/project.json).
         if (options.only) {
@@ -127,13 +169,20 @@ export const upCommand = new Command("up")
                 showErrorAndExit(message, 2);
             }
         }
+        // Also under --dry-run: the check only reads, and a dry run should show what a real run would refuse.
+        if (foundRoot) {
+            enforceDriftGate(foundRoot, {
+                ignoreDrift: options.ignoreDrift,
+                onDrift: (message) => emit?.({ ok: false }, [{ code: "DRIFT_DETECTED", message }]),
+            });
+        }
         const hostPortPlan = await getHostPortPlan(projectRoot, {
             inspectDocker: !options.dryRun,
         });
         if (!options.dryRun) {
             // An older project's .env predates keys such as JWT_SECRET, which Compose now requires. Add what is missing (never
             // changing an existing value) before anything starts. Only inside a real project, so a stray run never writes a .env.
-            if (findProjectRoot()) {
+            if (foundRoot) {
                 const addedEnvKeys = completeEnvFile(projectRoot);
                 if (addedEnvKeys.length > 0 && !options.quiet) {
                     console.log(chalk.gray(`Added ${addedEnvKeys.join(", ")} to .env (generated; existing values unchanged)`));

package/cli/dist/generator/template-engine.js

@@ -349,10 +349,13 @@ function normalizeProjectConfig(value) {
         overrides: config.overrides,
     };
 }
+/** The project has no .tdk/project.json yet, as opposed to one that exists but is unreadable or invalid. */
+export class ProjectConfigNotFoundError extends Error {
+}
 export function readProjectConfig(projectRoot) {
     const projectJsonPath = path.join(projectRoot, ".tdk", "project.json");
     if (!fs.existsSync(projectJsonPath)) {
-        throw new Error(`Project config not found: ${projectJsonPath}. Run 'tdk project --yes' first.`);
+        throw new ProjectConfigNotFoundError(`Project config not found: ${projectJsonPath}. Run 'tdk project --yes' first.`);
     }
     const jsonContent = fs.readFileSync(projectJsonPath, "utf-8");
     const parsed = JSON.parse(jsonContent);
@@ -600,10 +603,12 @@ async function vendorTdkExtension(projectRoot) {
         console.warn(`⚠️  Premium overlay skipped: ${err.message}`);
     }
 }
+const TDK_GENERATED_MARKER = "SYSTEM-GENERATED BY TDK CLI";
 export function verifyMasterConfigs(projectRoot) {
     const errors = [];
     const warnings = [];
     const diffs = [];
+    const handEdited = [];
     const addDrift = (displayPath, actual, expected) => {
         if (actual === expected)
             return;
@@ -622,16 +627,28 @@ export function verifyMasterConfigs(projectRoot) {
         const filePath = path.join(outputDir, filename);
         addDrift(`.tdk/.tdk-out/${filename}`, fs.existsSync(filePath) ? fs.readFileSync(filePath, "utf-8") : undefined, expectedContent);
     }
+    // `tdk project` never overwrites a root .tiltignore the repo already has, so one
+    // without TDK's header belongs to the team: it is not drift.
     const rootTiltIgnore = path.join(projectRoot, ".tiltignore");
-    addDrift(".tiltignore", fs.existsSync(rootTiltIgnore) ? fs.readFileSync(rootTiltIgnore, "utf-8") : undefined, expectedFiles[".tiltignore"]);
+    const rootTiltIgnoreText = fs.existsSync(rootTiltIgnore)
+        ? fs.readFileSync(rootTiltIgnore, "utf-8")
+        : undefined;
+    if (rootTiltIgnoreText !== undefined && !rootTiltIgnoreText.includes(TDK_GENERATED_MARKER)) {
+        warnings.push(".tiltignore: not generated by TDK, left as is");
+    }
+    else {
+        addDrift(".tiltignore", rootTiltIgnoreText, expectedFiles[".tiltignore"]);
+    }
     for (const manifestPath of discoverServiceManifestPaths(projectRoot)) {
         const displayPath = path.relative(projectRoot, manifestPath).split(path.sep).join("/");
         const validation = validateServiceManifestFile(manifestPath, displayPath);
         errors.push(...validation.errors);
         warnings.push(...validation.warnings);
-        errors.push(...verifyGeneratedResourceFiles(projectRoot, manifestPath));
+        const generated = verifyGeneratedResourceFiles(projectRoot, manifestPath);
+        errors.push(...generated.errors);
+        handEdited.push(...generated.handEdited);
     }
-    return { valid: errors.length === 0, errors, warnings, diffs };
+    return { valid: errors.length === 0, errors, warnings, diffs, handEdited };
 }
 function createUnifiedDiff(file, actual, expected) {
     const oldLines = actual.replace(/\n$/, "").split("\n");
@@ -651,7 +668,7 @@ function verifyGeneratedResourceFiles(projectRoot, serviceJsonPath) {
     const serviceDir = path.dirname(serviceJsonPath);
     const generatedDir = path.join(serviceDir, ".autogenerated");
     if (!fs.existsSync(generatedDir))
-        return [];
+        return { errors: [], handEdited: [] };
     const generatedFiles = [];
     const collect = (directory, relativeDir = "") => {
         for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
@@ -667,10 +684,11 @@ function verifyGeneratedResourceFiles(projectRoot, serviceJsonPath) {
     };
     collect(generatedDir);
     if (generatedFiles.length === 0)
-        return [];
+        return { errors: [], handEdited: [] };
     const contractDir = path.join(generatedDir, ".tdk-contract");
     const sourceSnapshot = path.join(contractDir, "service.json.source");
     const errors = [];
+    const handEdited = [];
     if (!fs.existsSync(sourceSnapshot)) {
         errors.push(path.relative(projectRoot, sourceSnapshot) +
             ": generated-file contract snapshot is missing (run tdk up to regenerate)");
@@ -691,9 +709,11 @@ function verifyGeneratedResourceFiles(projectRoot, serviceJsonPath) {
             errors.push(`${display}: generated-file snapshot is missing (run tdk up to regenerate)`);
         }
         else if (fs.readFileSync(generated.fullPath, "utf-8") !== fs.readFileSync(snapshotPath, "utf-8")) {
+            // Windows path.relative uses backslashes; report project-relative paths with forward slashes everywhere.
+            handEdited.push(display.split(path.sep).join("/"));
             errors.push(`${display}: generated file differs from its TDK snapshot (run tdk up to regenerate)`);
         }
     }
-    return errors;
+    return { errors, handEdited };
 }
 //# sourceMappingURL=template-engine.js.map

package/cli/dist/utils/search-status.js

@@ -0,0 +1,13 @@
+/** Describes a `/` search result for the `tdk ui` header; null when there is no query. */
+export function describeSearch(query, matches, total) {
+    if (!query)
+        return null;
+    if (matches === 0) {
+        return {
+            summary: "0 matches",
+            emptyMessage: `No resources match "${query}". Press Esc to clear.`,
+        };
+    }
+    return { summary: `${matches} of ${total}` };
+}
+//# sourceMappingURL=search-status.js.map

package/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tdk-cli-internal",
   "private": true,
-  "version": "1.3.108",
+  "version": "1.3.110",
   "description": "TDK CLI — start services on your laptop.",
   "keywords": [
     "tdk",

package/engine/assets/docker/golden-layers.Dockerfile

@@ -178,7 +178,7 @@ FROM l4_backend_bun AS l4_backend_golden
 # =============================================================================
 # L4-FRONTEND: FRONTEND PRODUCTION RUNTIME
 # =============================================================================
-FROM nginx:alpine AS l4_frontend_golden
+FROM nginx:1.27-alpine AS l4_frontend_golden
 
 LABEL layer="l4-frontend"       description="Frontend production runtime with Nginx"       maintainer="tdk-project"
 

package/engine/schemas/project-schema.json

@@ -16,6 +16,11 @@
     "version": {
       "type": "string"
     },
+    "minTdkVersion": {
+      "type": "string",
+      "pattern": "^\\d+\\.\\d+\\.\\d+$",
+      "description": "Oldest tdk CLI this project works with, as MAJOR.MINOR.PATCH. tdk doctor fails on an older CLI."
+    },
     "project": {
       "type": "object",
       "additionalProperties": true,

package/engine/topologies/platform/docker/build/golden_image_dockerfile.star

@@ -227,7 +227,7 @@ FROM l4_backend_bun AS l4_backend_golden
 # =============================================================================
 # L4-FRONTEND: FRONTEND PRODUCTION RUNTIME
 # =============================================================================
-FROM nginx:alpine AS l4_frontend_golden
+FROM nginx:1.27-alpine AS l4_frontend_golden
 
 LABEL layer="l4-frontend" \
       description="Frontend production runtime with Nginx" \

package/engine/topologies/platform/docker/layers/l3_builder_layers.star

@@ -1,6 +1,6 @@
 # === INLINED CONSTANTS for pure extension loading ===
 WEB_FRAMEWORK = "hono"
-RUNTIME_CONFIG = {"bun": {"image_base": "oven/bun:latest", "package_manager": "bun", "lockfile": "bun.lock", "backend_start_command": "bun run start", "frontend_start_command": "bun run dev"}, "node": {"image_base": "node:20-alpine", "package_manager": "npm", "lockfile": "package-lock.json", "backend_start_command": "node dist/index.js"}}
+RUNTIME_CONFIG = {"bun": {"image_base": "oven/bun:1.3.11-alpine", "package_manager": "bun", "lockfile": "bun.lock", "backend_start_command": "bun run start", "frontend_start_command": "bun run dev"}, "node": {"image_base": "node:20-alpine", "package_manager": "npm", "lockfile": "package-lock.json", "backend_start_command": "node dist/index.js"}}
 OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
 # === END INLINED CONSTANTS ===
 

package/engine/topologies/platform/docker/layers/l4_runtime_layers.star

@@ -215,7 +215,7 @@ def L4_generate_frontend_runtime(res_path, target_path = '/usr/share/nginx/html'
     
     if use_nginx:
         # Use golden L4-frontend image if enabled (Nginx pre-configured)
-        base_image = GOLDEN_L4_FRONTEND_IMAGE if use_golden else "nginx:alpine"
+        base_image = GOLDEN_L4_FRONTEND_IMAGE if use_golden else "nginx:1.27-alpine"
         
         # If using golden image, skip curl installation (already there)
         healthcheck_setup = "" if use_golden else "RUN apk add --no-cache curl\n"

package/engine/topologies/tilt/manifest/constants.star

@@ -195,7 +195,7 @@ DEFAULT_SYNCS = {
 
 RUNTIME_CONFIGS = {
     'bun': {
-        'image_base': 'oven/bun:latest',
+        'image_base': 'oven/bun:1.3.11-alpine',
         'package_manager': 'bun',
         'lockfile': 'bun.lock',
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdk-landscape/tdk-cli-core",
-  "version": "1.3.108",
+  "version": "1.3.110",
   "description": "TDK CLI — start services on your laptop.",
   "homepage": "https://tdk-landscape.github.io/tdk-website",
   "repository": {