@tdk-landscape/tdk-cli-core 1.3.52 → 1.3.54

package/.github/workflows/ci.yml

@@ -1,200 +0,0 @@
-# Checks for every PR and push to main. Run manually from the Actions tab too.
-name: 🚦 CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  changes:
-    name: 🔎 Detect Changes
-    runs-on: ubuntu-latest
-    outputs:
-      lockfile: ${{ steps.filter.outputs.lockfile }}
-      workflows: ${{ steps.filter.outputs.workflows }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-
-      - uses: dorny/paths-filter@v4
-        id: filter
-        with:
-          filters: |
-            lockfile:
-              - 'bun.lock'
-              - 'package.json'
-              - 'cli/package.json'
-            workflows:
-              - '.github/workflows/**'
-
-  lint:
-    name: 🛡️ Lint
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: cli
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: oven-sh/setup-bun@v2
-      - run: bun install --frozen-lockfile
-      - run: bun run lint
-
-  typecheck:
-    name: 🦴 Typecheck
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: cli
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: oven-sh/setup-bun@v2
-      - run: bun install --frozen-lockfile
-      - run: bun run typecheck
-
-  test:
-    name: 🧪 Test
-    runs-on: ubuntu-latest
-    defaults:
-      run:
-        working-directory: cli
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: oven-sh/setup-bun@v2
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 22
-      - run: bun install --frozen-lockfile
-      - run: npm test
-
-  # Installs the npm package the way users do (npm install -g) and runs it,
-  # so a release can't ship without the compiled CLI or its dependencies.
-  package-smoke:
-    name: 📦 Package Smoke Test
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: oven-sh/setup-bun@v2
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 22
-
-      - name: Build
-        run: |
-          bun install --frozen-lockfile
-          npm run build
-
-      # cli/dist is committed so `npm install -g github:tdk-landscape/tdk-cli-core`
-      # works without a build step. Fail if a source change was committed
-      # without rebuilding it.
-      - name: Check committed cli/dist is up to date
-        run: |
-          # --ignored: cli/dist/ is gitignored, so a newly compiled file only
-          # shows up with it.
-          if [ -n "$(git status --porcelain --ignored -- cli/dist)" ]; then
-            git status --short --ignored -- cli/dist
-            echo "::error::cli/dist is stale. Run 'npm run build' and commit cli/dist (new files need 'git add -f')."
-            exit 1
-          fi
-
-      - name: Pack and install globally
-        run: | # zizmor: ignore[adhoc-packages] installs our own freshly packed tarball
-          npm pack --pack-destination "$RUNNER_TEMP"
-          npm install -g "$RUNNER_TEMP"/tdk-landscape-tdk-cli-core-*.tgz
-
-      - name: Run the installed CLI
-        working-directory: ${{ runner.temp }}
-        run: |
-          tdk --version
-          mkdir smoke-project && cd smoke-project
-          tdk project --yes
-          printf 'y\n' | tdk resource orders-api --type backend --stack shop
-          test -f services/shop/orders-api/service.json
-          echo "✅ Installed package scaffolds a project and a resource"
-
-  secret-scan:
-    name: 🔑 Secret Scan
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: trufflesecurity/trufflehog@v3.97.9
-        with:
-          base: ${{ github.event.pull_request.base.sha }}
-          head: ${{ github.event.pull_request.head.sha }}
-          extra_args: --only-verified
-
-  # Needs "Dependency graph" turned on in Settings > Code security, then the
-  # repository variable DEPENDENCY_REVIEW set to true (Settings > Variables).
-  dependency-review:
-    name: 🔒 Dependency Audit
-    runs-on: ubuntu-latest
-    needs: changes
-    if: vars.DEPENDENCY_REVIEW == 'true' && needs.changes.outputs.lockfile == 'true' && github.event_name == 'pull_request'
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: actions/dependency-review-action@v5
-        with:
-          fail-on-severity: high
-
-  workflow-audit:
-    name: 🛠️ Workflow Audit
-    runs-on: ubuntu-latest
-    needs: changes
-    if: needs.changes.outputs.workflows == 'true' || github.event_name == 'workflow_dispatch'
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: raven-actions/actionlint@v2
-        with:
-          fail-on-error: true
-      - uses: zizmorcore/zizmor-action@v0.6.4
-        with:
-          inputs: .github/workflows/
-          advanced-security: false
-          annotations: true
-
-  summary:
-    name: 📋 Summary
-    runs-on: ubuntu-latest
-    if: always()
-    needs: [lint, typecheck, test, package-smoke, secret-scan, dependency-review, workflow-audit]
-    steps:
-      - name: Render summary
-        env:
-          NEEDS: ${{ toJSON(needs) }}
-        run: |
-          {
-            echo "## CI Summary"
-            echo ""
-            echo "| Check | Result |"
-            echo "|---|---|"
-            echo "$NEEDS" | jq -r 'to_entries[] | "| \(.key) | \(
-              if .value.result == "success" then "✅ Passed"
-              elif .value.result == "skipped" then "⏭️ Skipped"
-              elif .value.result == "cancelled" then "🚫 Cancelled"
-              else "❌ Failed" end) |"'
-          } >> "$GITHUB_STEP_SUMMARY"

package/.github/workflows/release-binaries.yml

@@ -1,139 +0,0 @@
-name: Release binaries and npm package
-
-on:
-  workflow_dispatch:
-  push:
-    branches: [main]
-    paths:
-      - "package.json"
-      - "cli/package.json"
-
-permissions:
-  contents: write # push the automatic version bump back to main
-  id-token: write
-
-# Queue releases instead of running them side by side: two runs for the same
-# version upload the same assets and one fails with "already exists".
-concurrency:
-  group: release
-  cancel-in-progress: false
-
-jobs:
-  release:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 24.15.0
-          registry-url: "https://registry.npmjs.org"
-          package-manager-cache: false
-
-      - name: Update npm for trusted publishing
-        run: npm install -g npm@latest # zizmor: ignore[adhoc-packages] trusted publishing needs a current npm
-
-      - run: bun install --frozen-lockfile
-        working-directory: cli
-
-      # This workflow runs on every package.json change, not only version
-      # bumps. A dependency update or other package.json edit used to rebuild
-      # the binaries from new code and re-upload them over the release that
-      # already had this version, while npm skipped it as "already published":
-      # new code under an old version number. Instead, move to the next patch
-      # version that is neither on npm nor a tdk-cli-releases tag. Must run
-      # before the build: the CLI reads its version from cli/package.json.
-      - name: Pick an unreleased version
-        id: version
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          current=$(node -p "require('./package.json').version")
-          version="$current"
-          while npm view "@tdk-landscape/tdk-cli-core@${version}" version >/dev/null 2>&1 \
-            || gh release view "v${version}" --repo tdk-landscape/tdk-cli-releases >/dev/null 2>&1; do
-            version=$(node -p 'const [a, b, c] = process.argv[1].split(".").map(Number); [a, b, c + 1].join(".")' "$version")
-          done
-          if [ "$version" = "$current" ]; then
-            echo "Releasing ${version}."
-            echo "bumped=false" >> "$GITHUB_OUTPUT"
-          else
-            echo "::notice::${current} is already released; releasing this commit as ${version}."
-            # Edit only the version line: `npm version` would reinstall the
-            # workspaces and touch the bun-installed node_modules.
-            node -e '
-              const fs = require("fs");
-              for (const file of ["package.json", "cli/package.json"]) {
-                const before = fs.readFileSync(file, "utf8");
-                const after = before.replace(/("version":\s*")[^"]+"/, (_, key) => key + process.argv[1] + "\"");
-                if (after === before) throw new Error("no version field in " + file);
-                fs.writeFileSync(file, after);
-              }
-            ' "$version"
-            echo "bumped=true" >> "$GITHUB_OUTPUT"
-          fi
-          echo "version=${version}" >> "$GITHUB_OUTPUT"
-
-      # cli/bin/tdk.js loads cli/dist/cli.js, so the npm package is broken
-      # unless the CLI is compiled before `npm publish`.
-      - run: npm run build
-
-      - run: scripts/release-binaries.sh --publish
-        env:
-          GH_TOKEN: ${{ secrets.BINARY_RELEASE_TOKEN }}
-
-      # The root package is the public package. It owns the tdk bin entry and
-      # already contains the compiled CLI plus the bundled engine assets.
-      - name: Publish to npm
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-        run: |
-          PKG_VERSION=$(node -p "require('./package.json').version")
-          if npm view "@tdk-landscape/tdk-cli-core@${PKG_VERSION}" version >/dev/null 2>&1; then
-            echo "@tdk-landscape/tdk-cli-core@${PKG_VERSION} is already published, skipping."
-          else
-            npm publish --access public --provenance
-          fi
-
-      # Keep main in step with what was published. A push made with
-      # github.token doesn't trigger workflows, so this can't loop. If it
-      # fails, the release is still out; the next run bumps past it anyway.
-      - name: Commit the version bump
-        if: steps.version.outputs.bumped == 'true'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ steps.version.outputs.version }}
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "41898283+github-actions[bot]@users.noreply.github.com"
-          # CHANGELOG versions match npm: file the "Unreleased" entries under
-          # this version, leaving an empty "Unreleased" section above it.
-          node -e '
-            const fs = require("fs");
-            const [version, date] = process.argv.slice(1);
-            if (!fs.existsSync("CHANGELOG.md")) process.exit(0);
-            const lines = fs.readFileSync("CHANGELOG.md", "utf8").split("\n");
-            const start = lines.indexOf("## Unreleased");
-            if (start === -1) process.exit(0);
-            let end = lines.findIndex((l, i) => i > start && l.startsWith("## "));
-            if (end === -1) end = lines.length;
-            if (!lines.slice(start + 1, end).some((l) => l.trim())) process.exit(0);
-            lines.splice(start + 1, 0, "", "## " + version + " (" + date + ")");
-            fs.writeFileSync("CHANGELOG.md", lines.join("\n"));
-          ' "$VERSION" "$(date -u +%F)"
-          git add package.json cli/package.json
-          if [ -f CHANGELOG.md ]; then git add CHANGELOG.md; fi
-          git commit -m "Release ${VERSION} (automatic version bump)"
-          remote="https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
-          if ! git push "$remote" HEAD:main; then
-            git fetch --depth=50 "$remote" main
-            if ! { git rebase FETCH_HEAD && git push "$remote" HEAD:main; }; then
-              echo "::warning::Released ${VERSION}, but main changed and the version bump could not be pushed. Make sure package.json and cli/package.json on main are ${VERSION} or higher."
-            fi
-          fi

package/.github/zizmor.yml

@@ -1,9 +0,0 @@
-# Config for zizmor, the GitHub Actions security linter run by ci.yml's
-# Workflow Audit job whenever a workflow changes. Run locally with:
-#   zizmor .github/workflows/
-#
-# unpinned-uses is off: we only use official or widely used actions by
-# major version tag, and hash pins would need updating for every release.
-rules:
-  unpinned-uses:
-    disable: true

package/.pre-commit-config.yaml

@@ -1,57 +0,0 @@
-repos:
-  - repo: local
-    hooks:
-      # Fast unit tests for Docker/Compose generators
-      - id: pytest-fast-tests
-        name: Run fast unit tests
-        entry: python3 -m pytest -m fast --no-cov -q
-        language: system
-        pass_filenames: false
-        always_run: true
-        stages: [pre-commit]
-        description: |
-          Fast tests only (marked with @pytest.mark.fast):
-          - Docker/Compose generator bug tests
-          - Port anchor selection (*backend-port vs *frontend-port)
-          - EXPOSE validation (port numbers, not paths)
-          - Function signature validation (keyword args)
-          These are pure Python tests (no Tilt/Docker needed) and run in ~1s.
-
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.5.0
-    hooks:
-      - id: trailing-whitespace
-      - id: end-of-file-fixer
-      - id: check-yaml
-        exclude: ".autogenerated/"
-      - id: check-json
-        exclude: ".autogenerated/"
-      - id: check-added-large-files
-        args: ['--maxkb=500']
-
-  - repo: https://github.com/psf/black
-    rev: 23.12.1
-    hooks:
-      - id: black
-        language_version: python3
-        files: \.py$
-        exclude: ".autogenerated/|__pycache__/"
-
-  - repo: https://github.com/pycqa/flake8
-    rev: 7.0.0
-    hooks:
-      - id: flake8
-        files: \.py$
-        exclude: ".autogenerated/|__pycache__/"
-        args: ['--max-line-length=100', '--extend-ignore=E203,W503']
-
-  # Optional: Run on Starlark files (Tilt/Starlark syntax check)
-  - repo: local
-    hooks:
-      - id: check-star-syntax
-        name: Check Starlark file syntax
-        entry: python3 -c "import ast; [ast.parse(open(f).read()) for f in __import__('sys').argv[1:]]"
-        language: system
-        files: \.star$
-        pass_filenames: true
-        description: Basic Python syntax validation for Starlark files

package/CODE_OF_CONDUCT.md

@@ -1,9 +0,0 @@
-# Code of Conduct
-
-This project follows the [Contributor Covenant, version 2.1](https://www.contributor-covenant.org/version/2/1/code_of_conduct/).
-
-In short: be respectful, assume good intent, and keep discussion about the work. Harassment, personal attacks, and discriminatory language are not accepted in issues, pull requests, or any other project space.
-
-## Reporting
-
-To report unacceptable behavior, open a [private security advisory](https://github.com/tdk-landscape/tdk-cli-core/security/advisories/new) or contact the maintainers through the [TDK Landscape organization](https://github.com/tdk-landscape). Reports are reviewed promptly and kept confidential.

package/CONTRIBUTING.md

@@ -1,42 +0,0 @@
-# Contributing to TDK
-
-Thanks for helping. Bug reports, docs fixes, and code changes are all welcome.
-
-## Ways to help
-
-- **Report a bug or ask a question:** [open an issue](https://github.com/tdk-landscape/tdk-cli-core/issues/new/choose). Include the output of `tdk doctor`.
-- **Pick up an issue:** look for [`good first issue`](https://github.com/tdk-landscape/tdk-cli-core/labels/good%20first%20issue) or [`help wanted`](https://github.com/tdk-landscape/tdk-cli-core/labels/help%20wanted). Comment on it so nobody duplicates your work.
-- **Share what you built:** an example project or a blog post helps other people find TDK.
-
-## Development setup
-
-You need [Bun](https://bun.sh), Node.js 22.12+, Docker, and [Tilt](https://docs.tilt.dev/install.html).
-
-```bash
-git clone https://github.com/tdk-landscape/tdk-cli-core.git
-cd tdk-cli-core/cli
-bun install
-npm run typecheck
-npm run lint
-npm test
-```
-
-From the repo root, `make help` lists more targets (`make test-fast`, `make pre-commit-run`).
-
-## Where things live
-
-- `cli/` is the `tdk` CLI (TypeScript). Conventions are in [cli/AGENTS.md](cli/AGENTS.md).
-- `engine/` is the Starlark Tilt framework. Conventions are in [engine/AGENTS.md](engine/AGENTS.md).
-- `discovery/` builds the resource and dependency graph from `service.json` files.
-
-## Pull requests
-
-1. Fork the repo and create a branch from `main`.
-2. Keep the change focused. One fix or feature per PR.
-3. Add or update tests for behavior changes.
-4. Make sure `npm run typecheck`, `npm run lint`, and `npm test` pass in `cli/`. CI runs the same checks.
-5. Describe what changed and why in the PR description.
-
-## Code of conduct
-
-This project follows the [Code of Conduct](CODE_OF_CONDUCT.md). By taking part you agree to follow it.

package/Makefile

@@ -1,92 +0,0 @@
-# Makefile
-# Common development tasks
-
-.PHONY: help test-tilt-engine test test-coverage lint video video-build video-test video-validate video-generate
-
-help: ## Show this help message
-	@echo "Available targets:"
-	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2}'
-
-# Testing targets
-test-tilt-engine: ## Run tilt-engine test suite
-	@echo "🧪 Running tilt-engine tests..."
-	pytest tests/tilt-engine/ -v --tb=short
-
-test-tilt-engine-coverage: ## Run tilt-engine tests with coverage report
-	@echo "🧪 Running tilt-engine tests with coverage..."
-	pytest tests/tilt-engine/ -v --cov=tests/tilt-engine --cov-report=term-missing --cov-report=html
-
-test: ## Run all tests
-	@echo "🧪 Running all tests..."
-	pytest tests/ -v --tb=short
-
-test-coverage: ## Run all tests with coverage
-	@echo "🧪 Running all tests with coverage..."
-	pytest tests/ -v --cov --cov-report=term-missing --cov-report=html
-
-# Test categories
-test-snapshot: ## Run snapshot tests only
-	pytest tests/tilt-engine/test_snapshot_*.py -v -m snapshot
-
-test-daemon: ## Run daemon tests only
-	pytest tests/tilt-engine/test_daemon_*.py -v -m daemon
-
-test-health: ## Run health check tests only
-	pytest tests/tilt-engine/test_health_*.py -v -m health
-
-test-ide: ## Run IDE component tests only
-	pytest tests/tilt-engine/test_*.py -v -m ide
-
-test-safety: ## Run safety guard tests only
-	pytest tests/tilt-engine/test_*prune*.py tests/tilt-engine/test_*alias*.py -v -m safety
-
-test-cache: ## Run registry cache tests only
-	pytest tests/tilt-engine/test_cache_*.py -v -m cache
-
-# Fast tests (for pre-commit)
-test-fast: ## Run fast unit tests only (no external deps)
-	@echo "⚡ Running fast tests..."
-	pytest -m fast --no-cov -q
-
-test-generator: ## Run generator bug tests only
-	@echo "🔧 Running generator tests..."
-	pytest -m generator -v --no-cov
-
-# Pre-commit hooks
-pre-commit-install: ## Install pre-commit hooks
-	@echo "🔧 Installing pre-commit hooks..."
-	pip install pre-commit
-	pre-commit install
-
-pre-commit-run: ## Run pre-commit hooks on all files
-	@echo "🔍 Running pre-commit hooks..."
-	pre-commit run --all-files
-
-pre-commit-fast: ## Run only fast tests (pre-commit style)
-	@echo "⚡ Running fast pre-commit tests..."
-	pytest -m fast --no-cov -q
-
-# Video Generator targets
-video: ## Show video generator help
-	@cd video-generator && swift run tdk-video help
-
-video-build: ## Build the video generator
-	@echo "🔨 Building video generator..."
-	cd video-generator && swift build
-
-video-test: ## Run video generator tests
-	@echo "🧪 Running video generator tests..."
-	cd video-generator && swift test
-
-video-validate: ## Validate video generator system setup
-	@echo "🔍 Validating video generator setup..."
-	cd video-generator && swift run tdk-video validate
-
-video-generate: ## Generate the TDK CLI tutorial video (requires FFmpeg)
-	@echo "🎬 Generating TDK CLI tutorial video..."
-	@echo "   This will create TDK_Tutorial_1440p.mp4 (20 min, 2K)"
-	cd video-generator && swift run tdk-video generate
-
-video-generate-quick: ## Generate 1080p test video (faster)
-	@echo "🎬 Generating 1080p test video..."
-	cd video-generator && swift run tdk-video generate -o TDK_Tutorial_Test_1080p.mp4

package/SECURITY.md

@@ -1,17 +0,0 @@
-# Security Policy
-
-## Supported versions
-
-Security fixes go into the latest release published on [npm](https://www.npmjs.com/package/@tdk-landscape/tdk-cli-core). Please upgrade before reporting.
-
-## Reporting a vulnerability
-
-Please **do not** open a public issue for security problems.
-
-Report them privately through [GitHub security advisories](https://github.com/tdk-landscape/tdk-cli-core/security/advisories/new). Include:
-
-- the TDK version (`tdk --version`) and your OS
-- steps to reproduce
-- what an attacker could do with it
-
-We aim to reply within a few days and will credit you in the fix unless you prefer otherwise.

package/benchmarks/results/container-scale-2026-09-25T20-54-49-736Z.json

@@ -1,45 +0,0 @@
-{
-  "date": "2026-09-25T20:54:49.736Z",
-  "hostMemGiB": 16,
-  "dockerMemMiB": 7934,
-  "perServiceBudgetMiB": 74,
-  "options": {
-    "project": "../tdk-erp-system",
-    "tiers": [
-      5
-    ],
-    "gate": 5,
-    "timeoutSeconds": 240,
-    "interval": 30,
-    "startInterval": 2,
-    "settleSeconds": 5
-  },
-  "images": 107,
-  "singleProcessImageShare": 0.24299065420560748,
-  "results": [
-    {
-      "tier": 5,
-      "launchSeconds": 2.1,
-      "firstHealthySeconds": 3.3,
-      "allHealthySeconds": 4.4,
-      "healthy": 5,
-      "unhealthy": 0,
-      "starting": 0,
-      "crashed": 0,
-      "oomKilled": 0,
-      "crashes": [],
-      "totalMemMiB": 87,
-      "avgMemMiB": 17.4,
-      "totalCpuPct": 2.1,
-      "dockerPsMs": 101,
-      "requestMsP50": 2.2,
-      "loadAvg1m": 13.4,
-      "hostFreeMiB": 76,
-      "singleProcessShare": 0.2
-    }
-  ],
-  "gate": {
-    "tier": 5,
-    "passed": true
-  }
-}