Breaking changes

• turbot compose: a directive's literal path that matches no file or names a directory now fails; it used to render nothing. Every command that composes is affected (up, inspect, test, install, template build).
• turbot compose: a linked turbot.dist.json or turbot.head.json is replaced with a regular file, not written through.
• turbot configure and login: credential files are written 0600 (they were usually 0644), and an existing one is tightened; one another user owns now fails.
• turbot hub up: refused unless the installation allows Hub data upload (not allowed by default, never on SaaS).
• turbot inspect, test, up, publish, install and template: use only a turbot_mods or turbot_templates folder you own that is not a link. The error names each folder skipped. Use a real folder, or pass --peer-path to inspect, test, up or publish.
• turbot install: exits 1 when a dependency is NOT OK (it used to exit 0), and refuses to write through a link at a dependency's folder or file.
• turbot login, install, download, publish and registry modify: no longer read credentials from a pipe. With no terminal, pass --username and --password.
• turbot template: removed cleanup and the yaml filter (use toYaml). Directive names in a version's template.yml are reserved, and tests/ and partials/ are not rendered.
• turbot template build: no longer creates git branches, commits or pushes, and its git options and --save are removed. It fails without --yes when stdin is not a terminal.
• turbot template outdated: --template is a regular expression, so a glob such as * fails.
• turbot test: exits 1 when its tests could not run; it used to exit 0.
• turbot test: test data and multi-stanza input queries are now validated, so a mod that passed can fail. --skip-test-data-validation skips the data check.
• turbot up: removed --mode, --build-script and --pack, which did nothing.

What's new?

• turbot graphql: new shortcuts action-stats, control-stats, control-response-stats and policy-value-stats. Pass the fields to return with --output.
• turbot inspect --format json: prints a machine-readable summary (the mod, its counts and validation items) as the last line of stdout.
• turbot inspect --validate-queries: checks every runnable's input query, and its policy(uri:)-style references, against a schema built locally from the mod and its dependencies. No workspace needed.
• turbot login --aws-iam: signs in to the registry with AWS IAM. install, download, publish, registry publish and registry modify take --aws-iam and --aws-profile too, so CI needs no password.
• turbot template: a usage error prints one short message naming the option, with "did you mean", instead of the whole help.
• turbot template: a version's template.yml can declare directives (header, outputs, computed, each, files and others), and templates can call fail() and use toYaml.
• turbot template: finds the template definitions in the instance's lock files, or a new-templates folder above it, when no option or config sets them.
• turbot template build: renders each instance in memory and writes nothing unless every file renders. Adds --check, --diff, --format=json, --no-compose, --manifest and --force-overwrite.
• turbot template describe: prints the fields, defaults and files a template version expects.
• turbot template init: adds a template to an instance, with a stub config holding each required field.
• turbot template outdated: --template-definitions overrides the folder in every lock file, and --format=json is supported.
• turbot template owner <file>: shows which template and instance render a file, and whether the file matches their render.
• turbot template test: runs a template version's golden tests.
• turbot template validate: reports every problem in matching instances' config without rendering, each once, at its cause.

Bug fixes

• turbot: command help and the update notice linked to docs pages that don't exist; they now link to each command's reference page.
• turbot: output written just before the CLI exits could be cut off when stdout or stderr was a pipe; both are now written synchronously.
• turbot compose: output order depended on the filesystem; directive glob matches are sorted again, so array and merge order are the same on every machine.
• turbot control diagnose: never reported "not found or denied" or "service not enabled", because broader patterns matched those errors first.
• turbot install: a local copy that meets the requirement is OK when the registry lacks that version, an optional dependency that cannot install is skipped, and a 401 or 403 is reported as a sign-in failure.
• turbot login, download, publish and registry modify: the help described a different tool (another credentials file, other registries, a logout command); it now describes the CLI as it is.
• turbot template build and validate: run below the instance root, or with an absolute or multi-level --dir, they found no instances; they now find the root, and build glob matches in sorted order.
• turbot template outdated: stopped checking an instance's templates at one without a lock file; it now warns and checks the rest.
• turbot test: input query validation failed with … is not a function in every shipped binary; it now runs.
• turbot test: reported test data as valid even when the validator could not run; it now runs, and a query it cannot parse is a visible warning.
• turbot test: a test data schema error during setup ended the run with no tests and exit 0; it is now a warning for that runnable, and the rest run.
• turbot up --help: described steps up no longer does; it now describes what up does.