@tdk-landscape/tdk-cli-core 1.3.75 → 1.3.77

package/cli/dist/commands/upgrade.js

@@ -1,18 +1,23 @@
-import { execSync } from "node:child_process";
+import { execFileSync, execSync } from "node:child_process";
 import { createHash } from "node:crypto";
-import { accessSync, constants, existsSync, readFileSync, realpathSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { accessSync, constants, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync, } from "node:fs";
+import { basename, dirname, join, resolve, win32 } from "node:path";
 import { fileURLToPath } from "node:url";
 import chalk from "chalk";
 import { Command } from "commander";
 import { getErrorMessage, logVerbose, showErrorAndExit } from "../utils/errors.js";
 import { showCancelled } from "../utils/formatting.js";
 import { getPackageVersion } from "../utils/paths.js";
+import { binaryAssetName, executableName, isWindows } from "../utils/platform.js";
 import { promptConfirm } from "../utils/prompt.js";
 import { startSpinner } from "../utils/spinner.js";
+import { extractTarball } from "../utils/tar.js";
+import { findOnPath } from "../utils/which.js";
 function isStandaloneBinary(tdkPath) {
+    if (isWindows() && tdkPath.toLowerCase().endsWith(".exe"))
+        return true;
     try {
-        const fileInfo = execSync(`file -b ${JSON.stringify(tdkPath)}`, { encoding: "utf-8" });
+        const fileInfo = execFileSync("file", ["-b", tdkPath], { encoding: "utf-8" });
         return /Mach-O|ELF/.test(fileInfo);
     }
     catch (err) {
@@ -20,9 +25,33 @@ function isStandaloneBinary(tdkPath) {
         return false;
     }
 }
+export function classifyRunningInstall(execPath, scriptPath, platformName = process.platform) {
+    const runningName = (platformName === "win32" ? win32.basename(execPath) : basename(execPath)).toLowerCase();
+    if (runningName === "tdk" || runningName === "tdk.exe") {
+        return { method: "binary", path: execPath };
+    }
+    if (runningName === "node" || runningName === "node.exe") {
+        const normalizedScriptPath = scriptPath.toLowerCase();
+        if (normalizedScriptPath.includes("node_modules") || normalizedScriptPath.includes(".npm")) {
+            return { method: "npm", path: scriptPath };
+        }
+    }
+    return null;
+}
+export function windowsNpmUpgradeMessage(platformName, installInfo) {
+    return platformName === "win32" && installInfo.method === "npm"
+        ? "use npm install -g @tdk-landscape/tdk-cli-core@latest"
+        : null;
+}
 function detectInstallation() {
+    const runningPath = process.execPath;
+    const runningInstall = classifyRunningInstall(runningPath, process.argv[1] ?? "");
+    if (runningInstall)
+        return runningInstall;
     try {
-        const tdkPath = execSync("which tdk", { encoding: "utf-8" }).trim();
+        const tdkPath = findOnPath(executableName());
+        if (!tdkPath)
+            return { method: "unknown" };
         // `readlink -f` is not available on macOS. Use Node's cross-platform
         // realpath implementation so standalone binaries are detected there too.
         const realPath = realpathSync(tdkPath);
@@ -57,13 +86,6 @@ function detectInstallation() {
     }
 }
 const BINARY_RELEASE_REPO = "tdk-landscape/tdk-cli-releases";
-function binaryAssetName() {
-    const osName = process.platform === "darwin" ? "darwin" : process.platform === "linux" ? "linux" : null;
-    const archName = process.arch === "arm64" ? "arm64" : process.arch === "x64" ? "amd64" : null;
-    if (!osName || !archName)
-        return null;
-    return `tdk-${osName}-${archName}`;
-}
 const ENGINE_ASSET_NAME = "tdk-cli-engine.tar.gz";
 const CHECKSUMS_ASSET_NAME = "checksums.txt";
 /** Parses `shasum -a 256` / `sha256sum` output ("<hash>  <name>" or "<hash> *<name>"). */
@@ -92,7 +114,7 @@ function verifyChecksum(filePath, assetName, sums, required) {
     }
     const actual = createHash("sha256").update(readFileSync(filePath)).digest("hex");
     if (actual !== expected) {
-        throw new Error(`Checksum mismatch for ${assetName} (expected ${expected}, got ${actual})`);
+        throw new Error(`${isWindows() ? "checksum mismatch" : "Checksum mismatch"} for ${assetName} (expected ${expected}, got ${actual})`);
     }
 }
 async function getLatestBinaryRelease() {
@@ -100,8 +122,12 @@ async function getLatestBinaryRelease() {
     if (!assetName)
         return null;
     try {
-        const raw = execSync(`curl -fsSL https://api.github.com/repos/${BINARY_RELEASE_REPO}/releases/latest`, { encoding: "utf-8", timeout: 10000 });
-        const data = JSON.parse(raw);
+        const response = await fetch(`https://api.github.com/repos/${BINARY_RELEASE_REPO}/releases/latest`, {
+            signal: AbortSignal.timeout(10_000),
+        });
+        if (!response.ok)
+            return null;
+        const data = (await response.json());
         if (!data.tag_name)
             return null;
         return {
@@ -134,22 +160,31 @@ export async function upgradeViaBinary(tdkPath, release) {
     if (!isWritable(installDir)) {
         console.log(chalk.yellow(`\n🔒 ${installDir} isn't writable by your user.`));
         console.log(chalk.yellow("💡 Upgrade manually instead:"));
-        console.log(chalk.cyan(`   curl -fsSL -o ${tdkPath} ${release.downloadUrl}`));
-        console.log(chalk.cyan(`   chmod +x ${tdkPath}`));
+        if (isWindows()) {
+            console.log(chalk.cyan("   Install TDK in a user-writable directory, then retry the upgrade."));
+        }
+        else {
+            console.log(chalk.cyan(`   curl -fsSL -o ${tdkPath} ${release.downloadUrl}`));
+            console.log(chalk.cyan(`   chmod +x ${tdkPath}`));
+        }
         return false;
     }
     const spinner = startSpinner(`Downloading ${release.assetName} (${release.tag})...`);
-    // Download to /tmp first (both the binary and the engine bundle below) so a
-    // failed network step can't leave a half-written binary at tdkPath.
-    const tmpPath = `/tmp/tdk-upgrade-${release.assetName}`;
-    const engineTmpPath = `/tmp/tdk-upgrade-engine-${release.tag}.tar.gz`;
+    const tempDir = join(installDir, `.tdk-upgrade-${process.pid}-${Date.now()}`);
+    const tmpPath = join(tempDir, release.assetName);
+    const engineTmpPath = join(tempDir, "engine.tar.gz");
     const engineDir = join(installDir, "tdk-cli");
+    const engineStageDir = join(tempDir, "tdk-cli");
+    const binaryBackup = join(tempDir, `${basename(tdkPath)}.previous`);
+    const engineBackup = join(tempDir, "tdk-cli.previous");
     try {
-        execSync(`curl -fsSL -o ${JSON.stringify(tmpPath)} ${JSON.stringify(release.downloadUrl)}`, {
-            stdio: "pipe",
-            timeout: 120000,
+        mkdirSync(tempDir, { recursive: true });
+        const binaryResponse = await fetch(release.downloadUrl, {
+            signal: AbortSignal.timeout(120_000),
         });
-        execSync(`chmod +x ${JSON.stringify(tmpPath)}`);
+        if (!binaryResponse.ok)
+            throw new Error(`Download failed (${binaryResponse.status})`);
+        writeFileSync(tmpPath, Buffer.from(await binaryResponse.arrayBuffer()));
         // The compiled binary has no source checkout to find engine/ or
         // cli/templates/ in, so it looks for a tdk-cli/ folder next to itself
         // (see template-engine.ts loadTemplate() / vendorTdkExtension()).
@@ -157,41 +192,63 @@ export async function upgradeViaBinary(tdkPath, release) {
         // stale/missing after an upgrade - refresh it here too, every time,
         // the same way install.sh does on a fresh install.
         spinner.text = `Downloading bundled engine (${release.tag})...`;
-        execSync(`curl -fsSL -o ${JSON.stringify(engineTmpPath)} ${JSON.stringify(release.engineDownloadUrl)}`, { stdio: "pipe", timeout: 120000 });
+        const engineResponse = await fetch(release.engineDownloadUrl, {
+            signal: AbortSignal.timeout(120_000),
+        });
+        if (!engineResponse.ok)
+            throw new Error(`Engine download failed (${engineResponse.status})`);
+        const engineBuffer = Buffer.from(await engineResponse.arrayBuffer());
+        writeFileSync(engineTmpPath, engineBuffer);
         // Verify both downloads against the release's checksums.txt before
         // touching the installed binary or engine.
         spinner.text = `Verifying checksums (${release.tag})...`;
-        const sums = parseChecksums(execSync(`curl -fsSL ${JSON.stringify(release.checksumsUrl)}`, {
-            encoding: "utf-8",
-            stdio: "pipe",
-            timeout: 30000,
-        }));
+        const checksumResponse = await fetch(release.checksumsUrl, {
+            signal: AbortSignal.timeout(30_000),
+        });
+        if (!checksumResponse.ok)
+            throw new Error(`Checksum download failed (${checksumResponse.status})`);
+        const sums = parseChecksums(await checksumResponse.text());
         verifyChecksum(tmpPath, release.assetName, sums, true);
         verifyChecksum(engineTmpPath, ENGINE_ASSET_NAME, sums, false);
-        execSync(`mv ${JSON.stringify(tmpPath)} ${JSON.stringify(tdkPath)}`);
-        execSync(`rm -rf ${JSON.stringify(engineDir)}`);
-        execSync(`mkdir -p ${JSON.stringify(engineDir)}`);
-        execSync(`tar -xzf ${JSON.stringify(engineTmpPath)} -C ${JSON.stringify(engineDir)} --strip-components=1`);
+        mkdirSync(engineStageDir, { recursive: true });
+        extractTarball(engineBuffer, engineStageDir);
+        if (existsSync(tdkPath))
+            renameSync(tdkPath, binaryBackup);
+        try {
+            renameSync(tmpPath, tdkPath);
+        }
+        catch (err) {
+            if (existsSync(binaryBackup))
+                renameSync(binaryBackup, tdkPath);
+            throw err;
+        }
+        if (existsSync(engineDir))
+            renameSync(engineDir, engineBackup);
+        try {
+            renameSync(engineStageDir, engineDir);
+        }
+        catch (err) {
+            if (existsSync(engineBackup))
+                renameSync(engineBackup, engineDir);
+            if (existsSync(binaryBackup)) {
+                rmSync(tdkPath, { force: true });
+                renameSync(binaryBackup, tdkPath);
+            }
+            throw err;
+        }
+        rmSync(binaryBackup, { force: true });
+        rmSync(engineBackup, { recursive: true, force: true });
         spinner.succeed(`Upgraded to ${release.tag}`);
         return true;
     }
     catch (err) {
         spinner.fail(`Binary upgrade failed: ${getErrorMessage(err)}`);
         logVerbose("Binary upgrade error", err);
-        console.log(chalk.yellow("\n💡 If this failed due to permissions, upgrade manually instead:"));
-        console.log(chalk.cyan(`   curl -fsSL -o ${tdkPath} ${release.downloadUrl}`));
-        console.log(chalk.cyan(`   chmod +x ${tdkPath}`));
-        console.log(chalk.cyan(`   rm -rf ${engineDir} && mkdir -p ${engineDir}`));
-        console.log(chalk.cyan(`   curl -fsSL ${release.engineDownloadUrl} | tar -xzf - -C ${engineDir} --strip-components=1`));
+        console.log(chalk.yellow("\n💡 If this failed due to permissions, use the platform installer or install command."));
         return false;
     }
     finally {
-        try {
-            execSync(`rm -f ${JSON.stringify(tmpPath)} ${JSON.stringify(engineTmpPath)}`);
-        }
-        catch {
-            // best-effort cleanup
-        }
+        rmSync(tempDir, { recursive: true, force: true });
     }
 }
 function getCurrentVersion() {
@@ -206,10 +263,24 @@ function getCurrentVersion() {
 async function getLatestVersion() {
     const spinner = startSpinner("Checking for latest version...");
     try {
-        const result = execSync("npm view @tdk-landscape/tdk-cli-core version", {
-            encoding: "utf-8",
-            timeout: 10000,
-        }).trim();
+        let result;
+        if (isWindows()) {
+            const response = await fetch("https://registry.npmjs.org/@tdk-landscape%2ftdk-cli-core/latest", {
+                signal: AbortSignal.timeout(10_000),
+            });
+            if (!response.ok)
+                throw new Error(`npm registry returned ${response.status}`);
+            const latest = (await response.json());
+            result = latest.version ?? "";
+            if (!result)
+                throw new Error("npm registry response did not include a version");
+        }
+        else {
+            result = execSync("npm view @tdk-landscape/tdk-cli-core version", {
+                encoding: "utf-8",
+                timeout: 10000,
+            }).trim();
+        }
         spinner.succeed(`Latest version: ${chalk.green(result)}`);
         return result;
     }
@@ -254,7 +325,7 @@ async function upgradeViaNpm() {
 async function upgradeViaBun() {
     const spinner = startSpinner("Upgrading via bun...");
     try {
-        execSync("bun install -g @tdk-landscape/tdk-cli-core@latest", {
+        execFileSync(findOnPath("bun") ?? "bun", ["install", "-g", "@tdk-landscape/tdk-cli-core@latest"], {
             stdio: "inherit",
             timeout: 120000,
         });
@@ -266,7 +337,7 @@ async function upgradeViaBun() {
         spinner.text = "bun registry failed, trying GitHub...";
         logVerbose("bun registry error", err);
         try {
-            execSync("bun install -g github:tdk-landscape/tdk-cli-core", {
+            execFileSync(findOnPath("bun") ?? "bun", ["install", "-g", "github:tdk-landscape/tdk-cli-core"], {
                 stdio: "inherit",
                 timeout: 120000,
             });
@@ -282,36 +353,41 @@ async function upgradeViaBun() {
 async function upgradeViaGit(path) {
     const spinner = startSpinner("Pulling latest changes from git...");
     try {
-        execSync("git rev-parse --git-dir", {
+        execFileSync("git", ["rev-parse", "--git-dir"], {
             cwd: path,
             stdio: "pipe",
         });
         spinner.text = "Fetching from origin...";
-        execSync("git fetch origin", {
+        execFileSync("git", ["fetch", "origin"], {
             cwd: path,
             stdio: "pipe",
             timeout: 30000,
         });
-        const branch = execSync("git rev-parse --abbrev-ref HEAD", {
+        const branch = execFileSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
             cwd: path,
             encoding: "utf-8",
         }).trim();
         spinner.text = `Pulling latest on ${branch}...`;
-        execSync(`git pull origin ${branch}`, {
+        execFileSync("git", ["pull", "origin", branch], {
             cwd: path,
             stdio: "pipe",
             timeout: 30000,
         });
         if (existsSync(join(path, "cli", "package.json"))) {
             spinner.text = "Rebuilding CLI...";
-            execSync("bun install && bun run build", {
+            execFileSync(findOnPath("bun") ?? "bun", ["install"], {
+                cwd: join(path, "cli"),
+                stdio: "pipe",
+                timeout: 60000,
+            });
+            execFileSync(findOnPath("bun") ?? "bun", ["run", "build"], {
                 cwd: join(path, "cli"),
                 stdio: "pipe",
                 timeout: 60000,
             });
         }
         spinner.text = "Re-linking CLI...";
-        execSync("bun link --force", {
+        execFileSync(findOnPath("bun") ?? "bun", ["link", "--force"], {
             cwd: join(path, "cli"),
             stdio: "pipe",
             timeout: 30000,
@@ -337,6 +413,11 @@ export const upgradeCommand = new Command("upgrade")
     const installInfo = detectInstallation();
     console.log(chalk.gray(`Installation method: ${installInfo.method}`));
     console.log();
+    const windowsNpmMessage = windowsNpmUpgradeMessage(process.platform, installInfo);
+    if (windowsNpmMessage) {
+        console.log(windowsNpmMessage);
+        return;
+    }
     if (installInfo.method === "unknown") {
         console.error(chalk.red("❌ Could not detect installation method"));
         console.log(chalk.yellow("\n💡 Manual upgrade (package not on npm yet, use GitHub):"));
@@ -351,7 +432,13 @@ export const upgradeCommand = new Command("upgrade")
         console.log(chalk.blue("📦 Standalone binary installation detected"));
         binaryRelease = await getLatestBinaryRelease();
         if (!binaryRelease) {
-            showErrorAndExit(`Could not determine latest release for this platform (${process.platform}/${process.arch})`);
+            if (process.platform === "win32" && process.arch === "arm64") {
+                showErrorAndExit("TDK Windows v1 supports AMD64 only. Use WSL2 Ubuntu or a 64-bit Intel/AMD PC.");
+            }
+            if (process.platform === "win32") {
+                showErrorAndExit("No Windows AMD64 binary in this TDK release. Need asset tdk-windows-amd64.exe.");
+            }
+            showErrorAndExit(`Unsupported OS: TDK does not support this OS: ${process.platform}. Supported: linux, darwin, win32.`);
         }
         latestVersion = binaryRelease.tag.replace(/^v/, "").split("-")[0];
         if (latestVersion === currentVersion && !options.force) {
@@ -369,12 +456,12 @@ export const upgradeCommand = new Command("upgrade")
     else if (installInfo.method === "git" && installInfo.path) {
         console.log(chalk.blue("📦 Git installation detected - will pull latest from origin"));
         try {
-            execSync("git fetch origin", { cwd: installInfo.path, stdio: "pipe" });
-            const localHash = execSync("git rev-parse HEAD", {
+            execFileSync("git", ["fetch", "origin"], { cwd: installInfo.path, stdio: "pipe" });
+            const localHash = execFileSync("git", ["rev-parse", "HEAD"], {
                 cwd: installInfo.path,
                 encoding: "utf-8",
             }).trim();
-            const remoteHash = execSync("git rev-parse origin/main", {
+            const remoteHash = execFileSync("git", ["rev-parse", "origin/main"], {
                 cwd: installInfo.path,
                 encoding: "utf-8",
             }).trim();
@@ -484,17 +571,25 @@ export const upgradeCommand = new Command("upgrade")
         }
         else if (installInfo.method === "binary" && binaryRelease && installInfo.path) {
             const engineDir = join(dirname(installInfo.path), "tdk-cli");
-            console.log(chalk.cyan(`   curl -fsSL -o ${installInfo.path} ${binaryRelease.downloadUrl}`));
-            console.log(chalk.cyan(`   chmod +x ${installInfo.path}`));
-            console.log(chalk.cyan(`   rm -rf ${engineDir} && mkdir -p ${engineDir}`));
-            console.log(chalk.cyan(`   curl -fsSL ${binaryRelease.engineDownloadUrl} | tar -xzf - -C ${engineDir} --strip-components=1`));
+            if (isWindows()) {
+                console.log(chalk.cyan("   irm https://tdk-landscape.github.io/install.ps1 | iex"));
+            }
+            else {
+                console.log(chalk.cyan(`   curl -fsSL -o ${installInfo.path} ${binaryRelease.downloadUrl}`));
+                console.log(chalk.cyan(`   chmod +x ${installInfo.path}`));
+                console.log(chalk.cyan(`   rm -rf ${engineDir} && mkdir -p ${engineDir}`));
+                console.log(chalk.cyan(`   curl -fsSL ${binaryRelease.engineDownloadUrl} | tar -xzf - -C ${engineDir} --strip-components=1`));
+            }
         }
         process.exit(1);
     }
     console.log();
     const verifySpinner = startSpinner("Verifying upgrade...");
     try {
-        const newVersion = execSync("tdk version", { encoding: "utf-8" }).trim();
+        const newVersion = execFileSync(findOnPath(executableName()) ?? executableName(), ["version"], {
+            encoding: "utf-8",
+            windowsHide: isWindows(),
+        }).trim();
         verifySpinner.succeed(`Verified: now running ${chalk.green(newVersion)}`);
         console.log();
         console.log(chalk.green.bold("✨ Upgrade complete!"));
@@ -508,7 +603,7 @@ export const upgradeCommand = new Command("upgrade")
         else {
             console.log(chalk.gray(`   Method:   ${installInfo.method}`));
         }
-        console.log(chalk.gray(`   Binary:   ${execSync("which tdk", { encoding: "utf-8" }).trim()}`));
+        console.log(chalk.gray(`   Binary:   ${installInfo.path ?? findOnPath(executableName()) ?? "unknown"}`));
         console.log();
         console.log(chalk.cyan.bold("🚀 Quick Start:"));
         console.log(chalk.white(`   tdk --help         Show all commands`));

package/cli/dist/generator/template-engine.js

@@ -4,7 +4,9 @@ import { fileURLToPath } from "node:url";
 import Handlebars from "handlebars";
 import { PLATFORM_STANDARDS } from "../config/platform-standards.js";
 import { writeTextFile } from "../utils/file-helpers.js";
-import { discoverResourcesFromRoot } from "../utils/services.js";
+import { assertTdkGeneratedPath } from "../utils/generated-paths.js";
+import { validateServiceManifestFile } from "../utils/service-manifest.js";
+import { discoverResourcesFromRoot, discoverServiceManifestPaths } from "../utils/services.js";
 import { isStackFeatureEnabledInStacks } from "../utils/stack-features.js";
 import { hasSablierLicense, hasVerdaccioLicense } from "./extension-fetch.js";
 const __filename = fileURLToPath(import.meta.url);
@@ -129,7 +131,6 @@ export class TemplateEngine {
     buildContext(projectConfig) {
         return {
             version: PLATFORM_STANDARDS.version,
-            timestamp: new Date().toISOString(),
             tech: PLATFORM_STANDARDS.tech,
             ports: PLATFORM_STANDARDS.ports,
             health: PLATFORM_STANDARDS.health,
@@ -351,7 +352,7 @@ function normalizeProjectConfig(value) {
 export function readProjectConfig(projectRoot) {
     const projectJsonPath = path.join(projectRoot, ".tdk", "project.json");
     if (!fs.existsSync(projectJsonPath)) {
-        throw new Error(`Project config not found: ${projectJsonPath}. Run 'tdk project init' first.`);
+        throw new Error(`Project config not found: ${projectJsonPath}. Run 'tdk project --yes' first.`);
     }
     const jsonContent = fs.readFileSync(projectJsonPath, "utf-8");
     const parsed = JSON.parse(jsonContent);
@@ -389,7 +390,7 @@ async function warnIfSablierUnlicensed(projectRoot) {
         "or remove the `sablier` block from the affected service.json file(s) to silence this warning.");
 }
 function ensureRootWorkspaceManifest(projectRoot, projectConfig) {
-    const packageJsonPath = path.join(projectRoot, "package.json");
+    const packageJsonPath = assertTdkGeneratedPath(projectRoot, "package.json");
     if (fs.existsSync(packageJsonPath)) {
         return false;
     }
@@ -437,21 +438,21 @@ export async function generateMasterConfigs(projectRoot) {
     const files = engine.generateAll(projectConfig);
     for (const filename of ALL_GENERATED_FILES) {
         const content = files[filename];
-        const filePath = path.join(outputDir, filename);
+        const filePath = assertTdkGeneratedPath(projectRoot, path.join(".tdk", ".tdk-out", filename));
         writeTextFile(filePath, content);
         console.log(`✓ Generated: .tdk/.tdk-out/${filename}`);
     }
     if (isStackFeatureEnabledInStacks(projectConfig.phases, "database-management")) {
-        const composeDir = path.join(projectRoot, "services", "platform", "database-management");
+        const composePath = assertTdkGeneratedPath(projectRoot, path.join("services", "platform", "database-management", "docker-compose.yml"));
+        const composeDir = path.dirname(composePath);
         fs.mkdirSync(composeDir, { recursive: true });
-        const composePath = path.join(composeDir, "docker-compose.yml");
         writeTextFile(composePath, generateDatabaseManagementCompose(projectConfig));
         console.log("✓ Generated: services/platform/database-management/docker-compose.yml");
     }
     // Copy .tiltignore to project root so Tilt uses it
     const tiltignoreSource = path.join(outputDir, ".tiltignore");
-    const tiltignoreTarget = path.join(projectRoot, ".tiltignore");
-    if (fs.existsSync(tiltignoreSource)) {
+    const tiltignoreTarget = assertTdkGeneratedPath(projectRoot, ".tiltignore");
+    if (fs.existsSync(tiltignoreSource) && !fs.existsSync(tiltignoreTarget)) {
         fs.copyFileSync(tiltignoreSource, tiltignoreTarget);
         console.log(`✓ Copied: .tiltignore → project root`);
     }
@@ -521,7 +522,7 @@ export function ensureProjectRuntimeAssets(projectRoot) {
     }
     for (const parts of PROJECT_RUNTIME_ASSET_DIRS) {
         const source = path.join(sourceRoot, ...parts);
-        const target = path.join(projectRoot, ...parts);
+        const target = assertTdkGeneratedPath(projectRoot, path.join(...parts));
         if (!fs.existsSync(source)) {
             continue;
         }
@@ -538,8 +539,7 @@ export function ensureProjectRuntimeAssets(projectRoot) {
     return copied;
 }
 async function vendorTdkExtension(projectRoot) {
-    const outputDir = path.join(projectRoot, ".tdk", ".tdk-out");
-    const vendoredDir = path.join(outputDir, "tdk-cli-ext");
+    const vendoredDir = assertTdkGeneratedPath(projectRoot, path.join(".tdk", ".tdk-out", "tdk-cli-ext"));
     // Source resolution order:
     //   1. $TDK_EXTENSION_SOURCE (explicit override)
     //   2. Self-contained repo (engine/ ships next to cli/ - public tdk-cli-core)
@@ -602,6 +602,7 @@ async function vendorTdkExtension(projectRoot) {
 }
 export function verifyMasterConfigs(projectRoot) {
     const errors = [];
+    const warnings = [];
     const projectConfig = readProjectConfig(projectRoot);
     const engine = new TemplateEngine();
     const expectedFiles = engine.generateAll(projectConfig);
@@ -618,6 +619,69 @@ export function verifyMasterConfigs(projectRoot) {
             errors.push(`Out of sync: .tdk/.tdk-out/${filename} (run 'tdk config regenerate')`);
         }
     }
-    return { valid: errors.length === 0, errors };
+    const rootTiltIgnore = path.join(projectRoot, ".tiltignore");
+    if (!fs.existsSync(rootTiltIgnore)) {
+        errors.push("Missing file: .tiltignore");
+    }
+    else if (fs.readFileSync(rootTiltIgnore, "utf-8") !== expectedFiles[".tiltignore"]) {
+        errors.push("Out of sync: .tiltignore (run 'tdk config regenerate')");
+    }
+    for (const manifestPath of discoverServiceManifestPaths(projectRoot)) {
+        const displayPath = path.relative(projectRoot, manifestPath).split(path.sep).join("/");
+        const validation = validateServiceManifestFile(manifestPath, displayPath);
+        errors.push(...validation.errors);
+        warnings.push(...validation.warnings);
+        errors.push(...verifyGeneratedResourceFiles(projectRoot, manifestPath));
+    }
+    return { valid: errors.length === 0, errors, warnings };
+}
+function verifyGeneratedResourceFiles(projectRoot, serviceJsonPath) {
+    const serviceDir = path.dirname(serviceJsonPath);
+    const generatedDir = path.join(serviceDir, ".autogenerated");
+    if (!fs.existsSync(generatedDir))
+        return [];
+    const generatedFiles = [];
+    const collect = (directory, relativeDir = "") => {
+        for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+            if (relativeDir === "" && entry.name === ".tdk-contract")
+                continue;
+            const relativeFile = path.join(relativeDir, entry.name);
+            const fullPath = path.join(directory, entry.name);
+            if (entry.isDirectory())
+                collect(fullPath, relativeFile);
+            else if (entry.isFile())
+                generatedFiles.push({ fullPath, relativeFile });
+        }
+    };
+    collect(generatedDir);
+    if (generatedFiles.length === 0)
+        return [];
+    const contractDir = path.join(generatedDir, ".tdk-contract");
+    const sourceSnapshot = path.join(contractDir, "service.json.source");
+    const errors = [];
+    if (!fs.existsSync(sourceSnapshot)) {
+        errors.push(path.relative(projectRoot, sourceSnapshot) +
+            ": generated-file contract snapshot is missing (run tdk up to regenerate)");
+    }
+    else if (fs.readFileSync(sourceSnapshot, "utf-8") !== fs.readFileSync(serviceJsonPath, "utf-8")) {
+        errors.push(path.relative(projectRoot, serviceJsonPath) +
+            ": service.json changed since generated outputs were written (run tdk up)");
+    }
+    for (const generated of generatedFiles) {
+        // service.yaml is a runtime discovery shadow generated by the Tilt
+        // extension. It is not produced by `tdk config regenerate`, and its
+        // timestamp/UID content has no committed TDK snapshot to verify.
+        if (generated.relativeFile === "service.yaml")
+            continue;
+        const snapshotPath = path.join(contractDir, generated.relativeFile);
+        const display = path.relative(projectRoot, generated.fullPath);
+        if (!fs.existsSync(snapshotPath)) {
+            errors.push(`${display}: generated-file snapshot is missing (run tdk up to regenerate)`);
+        }
+        else if (fs.readFileSync(generated.fullPath, "utf-8") !== fs.readFileSync(snapshotPath, "utf-8")) {
+            errors.push(`${display}: generated file differs from its TDK snapshot (run tdk up to regenerate)`);
+        }
+    }
+    return errors;
 }
 //# sourceMappingURL=template-engine.js.map

package/cli/dist/types/index.js

@@ -1,4 +1,9 @@
-export const CREATABLE_RESOURCE_TYPES = ["backend", "frontend", "worker"];
+export const CREATABLE_RESOURCE_TYPES = [
+    "backend",
+    "frontend",
+    "worker",
+    "bring-your-own",
+];
 export function isCreatableResourceType(value) {
     return (typeof value === "string" && CREATABLE_RESOURCE_TYPES.includes(value));
 }