@tdk-landscape/tdk-cli-core 1.3.72 → 1.3.74

package/CHANGELOG.md

@@ -4,6 +4,12 @@ Notable changes to the `tdk` CLI. Versions match [npm](https://www.npmjs.com/pac
 
 ## Unreleased
 
+## 1.3.73 (2026-09-28)
+
+- Free-tier projects no longer start the `sablier` and `wake-gateway` containers, and Traefik no longer downloads the Sablier plugin from GitHub on every start. They were always launched (the `sablier` one with a read-write Docker socket) even though the license only gated the per-service labels, so nothing could use them. They are now generated only when a license grants Sablier. Fewer containers, one image build less, and no network fetch at Traefik boot. Spotted in the ERP CI run log.
+
+## 1.3.72 (2026-09-28)
+
 - `tdk doctor` no longer fails with "Verdaccio is not reachable" when the project config enables Verdaccio but no Premium license grants it. TDK does not start Verdaccio in that case, so the check could never pass; it is now skipped with a note. A registry your own `.npmrc` points at (`:4873`) is still checked. Found by the ERP CI workflow.
 
 ## 1.3.71 (2026-09-28)

package/README.md

@@ -2,12 +2,14 @@
 
 # TDK — Tilt Development Kit
 
-**Run 100 microservices on a 16 GB laptop. No Kubernetes.**
+**Run your whole microservice landscape locally. No Kubernetes.**
 
-One CLI that scaffolds your services and runs the whole landscape locally with hot reload, health checks, a proxy, and Postgres, all built on [Tilt](https://tilt.dev).
+One CLI that scaffolds your services and runs the whole landscape locally with hot reload, health checks, a proxy, and Postgres, all built on [Tilt](https://tilt.dev). Tested at scale: a 100-service fixture (small generated `/health` services) boots from nothing on a clean CI runner in about 8 minutes, and holds about 1.7 GiB of memory ([details](#cold-boot-on-a-clean-machine-ci)).
 
 [![npm version](https://img.shields.io/npm/v/@tdk-landscape/tdk-cli-core.svg?style=flat&color=blue)](https://www.npmjs.com/package/@tdk-landscape/tdk-cli-core)
 [![CI](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/ci.yml/badge.svg)](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/ci.yml)
+[![Quickstart E2E](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/quickstart-e2e.yml/badge.svg)](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/quickstart-e2e.yml)
+[![ERP scale E2E](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/erp-scale-e2e.yml/badge.svg)](https://github.com/tdk-landscape/tdk-cli-core/actions/workflows/erp-scale-e2e.yml)
 [![Known Vulnerabilities](https://snyk.io/test/github/tdk-landscape/tdk-cli-core/badge.svg)](https://snyk.io/test/github/tdk-landscape/tdk-cli-core)
 [![Socket Badge](https://badge.socket.dev/npm/package/@tdk-landscape/tdk-cli-core/latest)](https://socket.dev/npm/package/@tdk-landscape/tdk-cli-core/overview)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
@@ -56,10 +58,19 @@ Measured with [`scripts/benchmark/container-scale.ts`](scripts/benchmark/README.
 What this does and doesn't measure:
 
 - The ERP services are small generated Bun HTTP services (about 20 lines each) answering `/health`. Real services with real dependencies use more memory; the point is that TDK's per-service overhead (runtime image, healthchecks, proxy routing) stays small.
-- Images were already built. Build time isn't included, and a first `tdk up` of 100 services takes much longer.
+- Images were already built, so build time isn't included. The clean-machine run below includes it.
 - The script starts the service containers with the settings `tdk up` generates (512 MiB / 0.5 CPU limits, healthchecks), without Tilt running. The memory column counts only the service containers, not Postgres or Traefik.
 - Numbers vary between runs (a later run reached 100 healthy in 74 s). Run it yourself with `bun scripts/benchmark/container-scale.ts`.
 
+### Cold boot on a clean machine (CI)
+
+The table above is a warm start. Two workflows install the published CLI on a fresh GitHub-hosted Ubuntu runner and run `tdk up` from nothing, building every image:
+
+- [**Quickstart E2E**](.github/workflows/quickstart-e2e.yml): the commands from the top of this README, one scaffolded backend, until it answers `/health` through Traefik. About 4 minutes. Runs after each release and daily.
+- [**ERP scale E2E**](.github/workflows/erp-scale-e2e.yml): the 100-service example. [Run 36395860088](https://github.com/tdk-landscape/tdk-cli-core/actions/runs/36395860088) (CLI 1.3.72, 4 vCPU / 15 GB): **100 / 100 backends healthy through Traefik after 472 s**, 111 containers, 1.8 GiB used by all containers. Runs weekly.
+
+Both are the same kind of fixture: generated services answering `/health`, not a real business app. A green run means TDK can generate, build, route and health-check a landscape of that size on a machine that has never seen it. It doesn't cover Windows, Apple Silicon, or an existing repo you bring yourself.
+
 ## What is TDK?
 
 TDK organizes microservices using a **Project → Stack → Resource** hierarchy, then uses Tilt to build, run, and hot-reload them locally:

package/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tdk-cli-internal",
   "private": true,
-  "version": "1.3.72",
+  "version": "1.3.74",
   "description": "TDK CLI - Tilt Development Kit command line interface",
   "keywords": [
     "tdk",

package/engine/topologies/platform/docker/compose/traefik_standalone.star

@@ -10,8 +10,14 @@ load("../config/healthcheck.star", "compose_healthcheck_timing")
 load("../networking/traefik_static_routes.star", "normalize_abs_path")
 
 
-def generate_standalone_traefik_compose():
-    """Minimal Traefik that routes Docker labels on api.{project}.localhost."""
+def generate_standalone_traefik_compose(sablier_enabled = False):
+    """Minimal Traefik that routes Docker labels on api.{project}.localhost.
+
+    The Sablier plugin, the sablier container and the wake gateway are only
+    emitted when sablier_enabled is True (a license grants "sablier"). Without
+    it they would run for nothing: a container holding a read-write Docker
+    socket, an image build, and a plugin download from GitHub on every start.
+    """
     network = PlatformDockerConstants.NETWORK_TRAEFIK_PUBLIC
     name = PlatformDockerConstants.PROJECT_NAME
     return """###############################################################################
@@ -24,10 +30,7 @@ services:
     image: traefik:v3.6.8
     container_name: {name}_traefik
     restart: unless-stopped
-    depends_on:
-      - sablier
-      - wake-gateway
-    command:
+{traefik_depends_on}    command:
       - "--api.insecure=true"
       - "--ping=true"
       - "--providers.docker=true"
@@ -44,12 +47,7 @@ services:
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
       - "--log.level=INFO"
-      # On-demand scaling: routes to stopped containers (opt-in via a
-      # resource's `sablier:` manifest block), keeps idle services from
-      # burning memory. Requires Traefik >=3.6 (see allownonrunning below).
-      - "--experimental.plugins.sablier.moduleName=github.com/sablierapp/sablier-traefik-plugin"
-      - "--experimental.plugins.sablier.version=v1.3.1"
-    ports:
+{sablier_flags}    ports:
       - "80:80"
       - "8080:8080"
     volumes:
@@ -60,7 +58,66 @@ services:
     healthcheck:
       test: ["CMD", "traefik", "healthcheck", "--ping"]
 {healthcheck_timing}
-  sablier:
+{sablier_services}networks:
+  traefik-public:
+    name: {network}
+    external: true
+""".format(
+        name=name,
+        network=network,
+        healthcheck_timing=compose_healthcheck_timing(10),
+        traefik_depends_on=_SABLIER_DEPENDS_ON if sablier_enabled else "",
+        sablier_flags=_SABLIER_FLAGS if sablier_enabled else "",
+        sablier_services=_SABLIER_SERVICES.format(
+            name=name,
+            gateway_container=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_CONTAINER,
+            gateway_port=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_PORT,
+            vendored_gateway_dir="tdk-cli-ext/engine/assets/docker/wake-gateway",
+            tilt_dev_dir=os.environ.get("HOME", "") + "/.tilt-dev",
+            project_root_mount=_project_root_mount(),
+        ) if sablier_enabled else "",
+        dynamic_dir_name=PlatformDockerConstants.TRAEFIK_DYNAMIC_DIR_REL.split("/")[-1],
+        vendored_gateway_dir="tdk-cli-ext/engine/assets/docker/wake-gateway",
+        gateway_container=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_CONTAINER,
+        gateway_port=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_PORT,
+        tilt_dev_dir=os.environ.get("HOME", "") + "/.tilt-dev",
+        project_root_mount=_project_root_mount(),
+    )
+
+
+def _project_root_mount():
+    """Read-only mount of the project at its own absolute host path.
+
+    The gateway runs `docker compose up --no-build` for a deferred resource
+    itself (bypassing Tilt's build queue), using the compose files Tilt uses.
+    Compose resolves relative paths in them (env_file etc.) client-side, so
+    they must exist at the same absolute paths inside the gateway container.
+    Empty when TDK_PROJECT_ROOT is unset (the generated Tiltfile sets it).
+    """
+    root = project_root_abspath()
+    if not root:
+        return ""
+    return "\n      - " + root + ":" + root + ":ro"
+
+
+def project_root_abspath():
+    """Absolute, normalized project root (TDK_PROJECT_ROOT), or "" when unset."""
+    return normalize_abs_path(os.environ.get("TDK_PROJECT_ROOT", ""))
+
+
+_SABLIER_DEPENDS_ON = """    depends_on:
+      - sablier
+      - wake-gateway
+"""
+
+_SABLIER_FLAGS = """      # On-demand scaling: routes to stopped containers (opt-in via a
+      # resource's `sablier:` manifest block), keeps idle services from
+      # burning memory. Requires Traefik >=3.6 (see allownonrunning below).
+      - "--experimental.plugins.sablier.moduleName=github.com/sablierapp/sablier-traefik-plugin"
+      - "--experimental.plugins.sablier.version=v1.3.1"
+"""
+
+_SABLIER_SERVICES = """  sablier:
     image: sablierapp/sablier:1.18.0
     container_name: {name}_sablier
     restart: unless-stopped
@@ -96,38 +153,4 @@ services:
     networks:
       - traefik-public
 
-networks:
-  traefik-public:
-    name: {network}
-    external: true
-""".format(
-        name=name,
-        network=network,
-        healthcheck_timing=compose_healthcheck_timing(10),
-        dynamic_dir_name=PlatformDockerConstants.TRAEFIK_DYNAMIC_DIR_REL.split("/")[-1],
-        vendored_gateway_dir="tdk-cli-ext/engine/assets/docker/wake-gateway",
-        gateway_container=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_CONTAINER,
-        gateway_port=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_PORT,
-        tilt_dev_dir=os.environ.get("HOME", "") + "/.tilt-dev",
-        project_root_mount=_project_root_mount(),
-    )
-
-
-def _project_root_mount():
-    """Read-only mount of the project at its own absolute host path.
-
-    The gateway runs `docker compose up --no-build` for a deferred resource
-    itself (bypassing Tilt's build queue), using the compose files Tilt uses.
-    Compose resolves relative paths in them (env_file etc.) client-side, so
-    they must exist at the same absolute paths inside the gateway container.
-    Empty when TDK_PROJECT_ROOT is unset (the generated Tiltfile sets it).
-    """
-    root = project_root_abspath()
-    if not root:
-        return ""
-    return "\n      - " + root + ":" + root + ":ro"
-
-
-def project_root_abspath():
-    """Absolute, normalized project root (TDK_PROJECT_ROOT), or "" when unset."""
-    return normalize_abs_path(os.environ.get("TDK_PROJECT_ROOT", ""))
+"""

package/engine/topologies/tilt/resources/infra-loader.star

@@ -20,6 +20,7 @@
 
 load("../../platform/docker/constants.star", "PlatformDockerConstants")
 load("../../platform/docker/compose/traefik_standalone.star", "generate_standalone_traefik_compose")
+load("../../platform/docker/networking/sablier_container_cycle.star", "sablier_middleware_suffix")
 load("../../platform/registries/verdaccio_loader.star", "load_verdaccio")
 
 # =============================================================================
@@ -194,7 +195,11 @@ def _load_standalone_traefik(root_prefix, env_file, write_fn):
     """Generate and load a self-contained Traefik compose for standalone projects."""
     _stop_conflicting_traefik()
     compose_rel = ".tdk/.tdk-out/docker-compose.traefik.yml"
-    content = generate_standalone_traefik_compose()
+    # The free-tier stub always reports "disabled"; the licensed module reports
+    # enabled for a manifest that opts in. Probing it keeps this file free of any
+    # license logic while starting the sablier containers only when they can work.
+    _, sablier_enabled = sablier_middleware_suffix({"sablier": {"enable": True}}, "probe")
+    content = generate_standalone_traefik_compose(sablier_enabled)
     if write_fn:
         write_fn(compose_rel, content)
     compose_file = root_prefix + compose_rel if root_prefix else compose_rel

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@tdk-landscape/tdk-cli-core",
-  "version": "1.3.72",
-  "description": "Run 100 microservices on a 16 GB laptop without Kubernetes. Scaffold services and run them locally with hot reload, built on Tilt.",
+  "version": "1.3.74",
+  "description": "Run your whole microservice landscape locally without Kubernetes. Scaffold services and run them with hot reload, built on Tilt.",
   "homepage": "https://tdk-landscape.github.io/tdk-website",
   "repository": {
     "type": "git",