refactor: modernize toolchain, migrate to ESM, and remove axios/lodash

.github/workflows/code-quality.yml

@@ -8,17 +8,17 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [20.x]
+        node-version: [ 24.x ]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version: ${{ matrix.node-version }}
       - run: npm ci
       - run: npm run linter
-      - run: npm test
+      - run: npm run test:coverage
       - run: npm run build --if-present
         env:
           CI: true

.github/workflows/publish.yml

@@ -2,7 +2,7 @@ name: Publish to NPM
 
 on:
   release:
-    types: [published]
+    types: [ published ]
 
 jobs:
   build:
@@ -12,11 +12,11 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v6
         with:
-          node-version: '20.x'
-          registry-url: 'https://registry.npmjs.org'
+          node-version: "24.x"
+          registry-url: "https://registry.npmjs.org"
       - run: npm install
       - run: npm run linter
       - run: npm run test

.gitignore

@@ -56,3 +56,8 @@ src/analysis
 .tago-lock.ty.lock
 .tagoio
 .tago-lock.dev.lock
+*.lock
+exportBackup
+.tago-lock.dev-ue.lock
+.tago-lock.dev-ue-2.lock
+.tago-lock.dev-1.lock

.oxfmtrc.json

@@ -0,0 +1,8 @@
+{
+  "$schema": "./node_modules/oxfmt/configuration_schema.json",
+  "useTabs": false,
+  "tabWidth": 2,
+  "endOfLine": "lf",
+  "printWidth": 160,
+  "singleAttributePerLine": false
+}

.oxlintrc.json

@@ -0,0 +1,29 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "ignorePatterns": ["build/**", ".tagoio/**", "coverage/**"],
+  "env": {
+    "node": true,
+    "es2024": true
+  },
+  "rules": {
+    "typescript/no-explicit-any": "warn",
+    "unicorn/prefer-node-protocol": "warn",
+    "eslint/no-unused-vars": ["error", { "argsIgnorePattern": "^_", "varsIgnorePattern": "^_", "destructuredArrayIgnorePattern": "^_" }],
+
+    "no-empty": "error",
+    "no-fallthrough": "error",
+    "no-prototype-builtins": "error",
+    "no-redeclare": "error",
+    "getter-return": "error",
+    "curly": "error",
+
+    "typescript/no-namespace": "error",
+    "typescript/no-empty-object-type": "warn",
+    "typescript/no-unnecessary-type-constraint": "error",
+
+    "unicorn/no-array-for-each": "warn",
+    "unicorn/prefer-array-flat-map": "warn",
+
+    "import/no-default-export": "warn"
+  }
+}

.vscode/settings.json

@@ -0,0 +1,7 @@
+{
+  "[typescript]": {
+    "editor.defaultFormatter": "oxc.oxc-vscode",
+    "editor.formatOnSave": true,
+    "editor.formatOnSaveMode": "file"
+  },
+}

README.md

@@ -102,7 +102,7 @@ Analysis.use(startAnalysis, { token: process.env.T_ANALYSIS_TOKEN });
 
 ```
 
-If you want to use the Debugger with -D, make sure you have a **.swcrc** file with sourceMaps activated. This repository contains a .swcrc.example file if you prefer to just copy to your folder.
+`tagoio run` executes your TypeScript file directly using Node's native experimental-transform-types runtime, so no build step or loader configuration is required. The `-d` flag forwards to Node so you can attach a debugger.
 
 ## Working with Environments
 
@@ -198,6 +198,37 @@ Having a `tagoconfig.json` file is essential for executing several commands, suc
   ```
 
 
+## Using in CI/CD Pipelines
+
+Deploy every analysis from `tagoconfig.json` directly from a GitHub Actions workflow — no need to maintain a custom deploy script per project:
+
+```yaml
+- name: Install TagoIO CLI and builder
+  run: npm install -g @tago-io/cli @tago-io/builder
+
+- name: Deploy analyses to TagoIO
+  run: tagoio deploy --all --env production -t ${{ secrets.TAGOIO_TOKEN }} --silent
+```
+
+The flag combination:
+- `--all` — deploys every analysis registered in `tagoconfig.json` without any interactive prompt
+- `--env, --environment` — picks the environment block from `tagoconfig.json`
+- `-t, --token` — a TagoIO token. Accepts either a **profile token** or an **external-analysis token** (see permissions below). Bypasses the local `.tago-lock` file, which doesn't exist in CI runners
+- `--silent` — skips confirmation prompts
+
+Together, the command runs fully non-interactively — suitable for any CI/CD system. No call to `tagoio init` or `tagoio login` is required before deploy, but your repository **must** include a pre-configured `tagoconfig.json` mapping each analysis file to its analysis ID.
+
+### Required permissions when using an external-analysis token
+
+Profile tokens always have full access and need no extra setup. If you'd rather use a scoped external-analysis token (recommended for least-privilege CI pipelines), create an Access Management rule in TagoIO with the **Analysis** resource type and the following permissions enabled:
+
+- **Access Analysis**
+- **Edit Analysis**
+- **Upload Analysis Script**
+
+Attach that rule to the token you pass via `-t, --token`. Without these permissions, `tagoio deploy` will fail with an Authorization Denied error from the TagoIO API.
+
+
 ## License
 
 TagoIO SDK for JavaScript in the browser and Node.js is released under the [Apache-2.0 License](https://github.com/tagoio-cli/blob/master/LICENSE.md).