mcoda 0.1.0

package/.editorconfig

@@ -0,0 +1,9 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true

package/.eslintrc.cjs

@@ -0,0 +1,12 @@
+module.exports = {
+  root: true,
+  env: {
+    node: true,
+    es2020: true
+  },
+  parserOptions: {
+    ecmaVersion: 'latest',
+    sourceType: 'module'
+  },
+  ignorePatterns: ['dist', 'node_modules']
+};

package/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,29 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: "[Bug] "
+labels: bug
+assignees: ''
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. ...
+2. ...
+
+**Expected behavior**
+What you expected to happen.
+
+**Logs / output**
+Paste relevant logs/CLI output (redact secrets). Use code fences.
+
+**Environment**
+- OS/arch:
+- Node version:
+- mcoda version:
+
+**Additional context**
+Add any other context or screenshots about the problem here.

package/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security issues
+    url: https://github.com/bekirdag/mcoda/security/advisories
+    about: Please report security vulnerabilities privately.

package/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,19 @@
+---
+name: Feature request
+about: Suggest an idea for mcoda
+title: "[Feature] "
+labels: enhancement
+assignees: ''
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear description of the problem.
+
+**Describe the solution you'd like**
+What should mcoda do?
+
+**Describe alternatives you've considered**
+Other approaches or workarounds.
+
+**Additional context**
+Anything else we should know.

package/.github/workflows/ci.yml

@@ -0,0 +1,37 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - master
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install deps
+        run: pnpm install
+
+      - name: Build
+        run: pnpm -r run build
+
+      - name: Run tests
+        run: node tests/all.js
+
+      - name: Packaging guardrails
+        run: pnpm --filter mcoda run pack:verify

package/.github/workflows/nightly.yml

@@ -0,0 +1,38 @@
+name: Nightly Quality
+
+on:
+  schedule:
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Install deps
+        run: pnpm install
+
+      - name: Build
+        run: pnpm -r run build
+
+      - name: Run tests
+        run: node tests/all.js
+
+      - name: Packaging guardrails
+        run: pnpm --filter mcoda run pack:verify
+
+      - name: Security audit
+        run: pnpm audit --audit-level high

package/.github/workflows/release-dry-run.yml

@@ -0,0 +1,40 @@
+name: Release Dry Run
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  dry-run:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: https://registry.npmjs.org
+
+      - name: Install deps
+        run: pnpm install
+
+      - name: Build
+        run: pnpm -r run build
+
+      - name: Run tests
+        run: node tests/all.js
+
+      - name: Packaging guardrails
+        run: pnpm --filter mcoda run pack:verify
+
+      - name: npm publish dry run
+        run: pnpm -r publish --dry-run --access public --no-git-checks

package/.github/workflows/release-please.yml

@@ -0,0 +1,22 @@
+name: Release Please
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run release-please
+        uses: googleapis/release-please-action@v4
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

package/.github/workflows/release.yml

@@ -0,0 +1,149 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+
+env:
+  NPM_CONFIG_PROVENANCE: "true"
+
+jobs:
+  package:
+    name: Package (${{ matrix.archive }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-22.04
+            archive: mcoda-linux-x64-gnu
+          - os: ubuntu-22.04
+            archive: mcoda-linux-x64-musl
+          - os: ubuntu-22.04
+            archive: mcoda-linux-arm64-gnu
+          - os: macos-15
+            archive: mcoda-darwin-x64
+          - os: macos-latest
+            archive: mcoda-darwin-arm64
+          - os: windows-latest
+            archive: mcoda-win32-x64
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: https://registry.npmjs.org
+
+      - name: Install deps
+        run: pnpm install
+
+      - name: Build
+        run: pnpm -r run build
+
+      - name: Run tests
+        run: node tests/all.js
+
+      - name: Pack npm tarballs
+        run: node scripts/pack-npm-tarballs.js
+
+      - name: Bundle release archive
+        shell: bash
+        run: |
+          mkdir -p release
+          tar -czf "release/${{ matrix.archive }}.tar.gz" -C artifacts .
+
+      - name: Upload release package
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.archive }}
+          path: release/${{ matrix.archive }}.tar.gz
+
+  publish-npm:
+    needs: package
+    runs-on: ubuntu-latest
+    env:
+      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: https://registry.npmjs.org
+
+      - name: Install deps
+        run: pnpm install
+
+      - name: Build
+        run: pnpm -r run build
+
+      - name: Packaging guardrails
+        run: pnpm --filter mcoda run pack:verify
+
+      - name: Verify tag matches package versions
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          node -e "
+            const fs = require('fs');
+            const path = require('path');
+            const tag = process.env.TAG.replace(/^v/, '');
+            const packages = [
+              'packages/cli',
+              'packages/core',
+              'packages/shared',
+              'packages/db',
+              'packages/integrations',
+              'packages/agents'
+            ];
+            const mismatches = [];
+            for (const dir of packages) {
+              const pkgPath = path.join(dir, 'package.json');
+              const version = JSON.parse(fs.readFileSync(pkgPath, 'utf8')).version;
+              if (version !== tag) {
+                mismatches.push(`${dir}: ${version}`);
+              }
+            }
+            if (mismatches.length) {
+              console.error(`Tag v${tag} does not match package versions:\n${mismatches.join('\n')}`);
+              process.exit(1);
+            }
+            console.log(`✓ Tag matches all package versions: ${tag}`);
+          "
+
+      - name: Update npm to latest
+        run: npm install -g npm@latest
+
+      - name: Publish packages (token)
+        if: ${{ env.NPM_TOKEN != '' }}
+        env:
+          NODE_AUTH_TOKEN: ${{ env.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: "false"
+        run: pnpm -r publish --access public --no-git-checks
+
+      - name: Publish packages (OIDC)
+        if: ${{ env.NPM_TOKEN == '' }}
+        env:
+          NPM_CONFIG_PROVENANCE: "true"
+        run: pnpm -r publish --access public --no-git-checks

package/.prettierrc

@@ -0,0 +1,5 @@
+{
+  "singleQuote": true,
+  "semi": true,
+  "trailingComma": "es5"
+}

package/.release-please-manifest.json

@@ -0,0 +1,8 @@
+{
+  "packages/cli": "0.1.0",
+  "packages/core": "0.1.0",
+  "packages/shared": "0.1.0",
+  "packages/db": "0.1.0",
+  "packages/integrations": "0.1.0",
+  "packages/agents": "0.1.0"
+}

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# Changelog
+
+## Unreleased
+- Add OSS docs, CI, release automation, and npm packaging metadata.
+
+## 0.1.0
+- Initial public release of the mcoda CLI.

package/CLA.md

@@ -0,0 +1,42 @@
+# Mcoda Contributor License Agreement (CLA)
+
+Modeled after Apache ICLA + CCLA, simplified.
+
+1. Grant of Copyright License  
+   You grant Bekir Dag (Mcoda Project Owner) a worldwide, irrevocable, perpetual, transferable, sublicensable, royalty-free copyright license to:  
+   - use, reproduce, modify, adapt, publish, distribute, and create derivative works of your contributions;  
+   - include your contributions in future versions of Mcoda under any license (including commercial licenses).
+
+2. Grant of Patent License  
+   You grant the Project Owner a worldwide, perpetual, irrevocable, royalty-free patent license to:  
+   - make, use, sell, and distribute your contribution,  
+   - and derivative works that include your contribution.
+
+3. Your Rights Remain Yours  
+   - You keep copyright to your own contributions.  
+   - You may use your own contributions anywhere else without restriction.  
+   - This CLA does not transfer your ownership to the Project Owner.
+
+4. Original Work Only  
+   You confirm that:  
+   - Your contribution is your own original work,  
+   - OR you have the right to submit it under this agreement.  
+   You also agree not to knowingly contribute:  
+   - code or content you do not have permission to provide,  
+   - anything violating third-party IP rights.
+
+5. No Warranty  
+   You provide contributions "as is," without warranty.
+
+6. Contact Information  
+   You agree to provide a valid email address so the Project Owner can contact you for IP-related matters.
+
+7. Identification of Contribution  
+   A "Contribution" means any code, documentation, bug fixes, designs, tests, or other materials submitted via pull request, issue, or any communication explicitly intended to contribute to Mcoda.
+
+8. Acceptance of the CLA  
+   You accept this CLA by submitting a contribution and confirming agreement (e.g., via GitHub sign-off, CI CLA bot, or checkbox).
+
+## Signature / Assertion
+
+By submitting a contribution to the Mcoda repository, you agree to this Contributor License Agreement.

package/CONTRIBUTING.md

@@ -0,0 +1,38 @@
+# Contributing to mcoda
+
+Thanks for your interest in improving mcoda! This guide covers the basics for local setup, testing, and releases.
+
+## Prereqs
+- Node.js >= 20
+- pnpm (recommended) or npm
+- Git
+
+## Setup
+```bash
+git clone git@github.com:bekirdag/mcoda.git
+cd mcoda
+pnpm install
+pnpm -r run build
+pnpm -r run test
+```
+
+## Making changes
+- Keep versions aligned across published packages (cli, core, db, integrations, shared, agents).
+- Add or update docs when behavior or flags change.
+- Prefer small, focused PRs with clear commit messages.
+
+## Testing
+- Run the full test suite before opening a PR:
+  - `pnpm -r run build`
+  - `pnpm -r run test`
+- If you touch packaging or release logic, run:
+  - `pnpm --filter mcoda run pack:verify`
+
+## Releases
+- Releases are tagged as `vX.Y.Z` on `main`.
+- GitHub Actions runs release workflows and publishes to npm using trusted publishing (OIDC).
+- Release-please manages version bumps and changelogs.
+
+## Reporting issues
+- Include repro steps, expected/actual behavior, and environment details.
+- For security issues, use GitHub Security Advisories instead of filing a public issue.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 bekir dag
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.