@flisk-sh/flisk-import 0.2.4 → 0.4.0

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 TDK Landscape
+Copyright (c) 2026 Flisk
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,6 +1,6 @@
 # flisk import
 
-Import the services in a repo's root `docker-compose.yml` into [Flisk](https://github.com/flisk-sh/flisk) as `service.json` files. This is the Compose first tier of flisk-sh/flisk#511.
+Import the services in a repo's root `docker-compose.yml` into [Flisk](https://github.com/flisk-sh/flisk) as `service.json` files, or register the repo's own Tiltfile so `flisk up` runs it. This is the Compose first tier of flisk-sh/flisk#511.
 
 ```bash
 flisk import . --dry-run     # plan only
@@ -11,14 +11,33 @@ flisk import . --yes         # write service.json files and project setup
 ## What to expect
 
 - **Reads one file:** the root `docker-compose.yml`. Not `compose.yaml`, override files, nested Compose files, Dockerfiles on their own, `package.json`, or Procfiles.
-- **Writes:** one bring-your-own `service.json` per Compose service, plus `.tdk/project.json` if the repo is not a Flisk project yet. It never edits the Compose file or overwrites a `service.json` without `--force`.
-- **Keeps:** the build context and Dockerfile (or the image), the container port, `depends_on`, and an HTTP health path. Databases and brokers are private, with no proxy route.
-- **Drops, and says so:** env values, volumes, `command`, `env_file` and every other untranslated key; services with `profiles`, `extends`, an out-of-tree build or a `${VAR}` image.
-- **Does not start anything.** Put env values in `.env`, then run `flisk up` with Flisk core **1.3.145 or later**. The importer does not check the core version.
+- **Writes:** one bring-your-own `service.json` per Compose service, plus `.flisk/project.json` if the repo is not a Flisk project yet. It never edits the Compose file or overwrites a `service.json` without `--force`.
+- **Keeps:** the service names (`db` stays `db`, so it stays the hostname), the build context and Dockerfile (or the image), the container port as written (3000, 80, 5432), `depends_on`, and an HTTP health path. Databases and brokers are private, with no proxy route.
+- **Environment:** names go into `service.json` as `secrets.required`; literal values are copied to the project `.env`, which is added to `.gitignore`. Values in `.env` already are kept, and `${VAR}` values are left for you.
+- **Drops, and says so:** volumes, `command`, `env_file` and every other untranslated key; services with `profiles`, `extends`, an out-of-tree build or a `${VAR}` image.
+- **Does not start anything.** Run `flisk up` with Flisk core **1.4.11 or later**. The importer does not check the core version.
 - **Exit codes:** `0` when the plan succeeds (`--dry-run`, files written, or all `service.json` files already exist), `1` when no root `docker-compose.yml` or mappable service is found, and `2` when the write prompt is declined or closed without an answer (`Nothing written.`).
 
 See [docs/import.md](docs/import.md) for the full mapping and limits. `flisk import` is the core CLI command backed by this package.
 
+## Import a Tiltfile
+
+A repo that already runs on Tilt keeps its own Tiltfile. `flisk-import tiltfile` registers it in `.flisk/project.json`, so `flisk up` runs it unchanged.
+
+```bash
+flisk import tiltfile --dry-run          # plan only
+flisk import tiltfile                    # plan, then ask before writing
+flisk import tiltfile dev/Tiltfile --yes # a named file, or a folder that holds a Tiltfile
+```
+
+- **Path:** `[path]` defaults to `Tiltfile`; a folder means `<folder>/Tiltfile`. It is resolved from the current directory. The project root is the nearest folder with `.flisk/project.json`, else the current directory.
+- **Writes:** only `.flisk/project.json`, with `"orchestration": { "source": "tiltfile", "path": "<path from the project root>" }`. Every other key is kept. Without a `project.json`, it creates the same minimal one as the Compose import, with only the proxy stack. It never edits the Tiltfile.
+- **Refuses (exit 1):** a missing Tiltfile, a path inside `.flisk/`, a path with a quote or control character, and a `project.json` that already sets `orchestration` (pass `--force` to replace it).
+- **Exit codes:** the same as the Compose import: `0` for `--dry-run` or a write, `1` for a refusal, `2` when the prompt is declined or closed (`Nothing written.`).
+- **Needs** a Flisk core that runs an imported Tiltfile ([flisk#2849](https://github.com/flisk-sh/flisk/pull/2849)). The importer does not check the core version.
+
+Plain `flisk-import [dir]` is still the Compose import. To import Compose from a folder named `tiltfile`, write `flisk-import ./tiltfile`.
+
 ```bash
 bun install && bun run build && bun run test
 ```

package/dist/cli.js

@@ -5,9 +5,10 @@ import { createInterface } from "node:readline/promises";
 import { Command } from "commander";
 import "./detectors/index.js";
 import { ImportError } from "./errors.js";
+import { MIN_CORE_VERSION, TILTFILE_CORE } from "./flisk.js";
 import { formatPlan } from "./format.js";
 import { buildPlan } from "./plan.js";
-import { MIN_CORE_VERSION } from "./tdk.js";
+import { applyTiltfileImport, formatTiltfilePlan, planTiltfileImport } from "./tiltfile.js";
 import { applyWrites, manifestRelPath, planWrites } from "./write.js";
 async function confirm(message) {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
@@ -26,6 +27,8 @@ async function confirm(message) {
 const program = new Command("flisk-import")
     .version(JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version)
     .description("Import services from the root docker-compose.yml into Flisk")
+    // Options after `tiltfile` belong to it, so `tiltfile --dry-run` is not read as the Compose import's --dry-run.
+    .enablePositionalOptions()
     .argument("[dir]", "Directory containing docker-compose.yml", ".")
     .option("--dry-run", "Print the plan and write nothing", false)
     .option("--yes", "Write without prompting", false)
@@ -46,7 +49,7 @@ const program = new Command("flisk-import")
         return void console.log("Nothing to write: every service.json already exists.");
     }
     if (!options.yes &&
-        !(await confirm(`Write ${pending.length} service.json file(s)${writes.projectConfig ? " and create .tdk/project.json" : ""}?`))) {
+        !(await confirm(`Write ${pending.length} service.json file(s)${writes.projectConfig ? " and create .flisk/project.json" : ""}?`))) {
         console.log("Nothing written.");
         process.exitCode = 2;
         return;
@@ -55,13 +58,48 @@ const program = new Command("flisk-import")
     for (const item of written) {
         console.log(`  wrote ${relative(process.cwd(), item.path) || manifestRelPath(plan, item)}`);
     }
-    console.log(`\nWrote ${written.length} service.json file(s)${writes.projectConfig ? " and created .tdk/project.json" : ""}.`);
+    console.log(`\nWrote ${written.length} service.json file(s)${writes.projectConfig ? " and created .flisk/project.json" : ""}.`);
     const envFile = relative(process.cwd(), join(writes.projectRoot, ".env")) || ".env";
     console.log("\nNext:");
-    if (plan.services.some((s) => s.envKeys.length))
-        console.log(`  - Put the environment values these services need in ${envFile}; values in docker-compose.yml were not copied.`);
+    const copied = Object.keys(writes.env.add);
+    if (copied.length)
+        console.log(`  - Copied ${copied.length} environment value(s) from docker-compose.yml to ${envFile} (gitignored).`);
+    if (writes.items.some((item) => item.notes.some((note) => note.startsWith("no literal value"))))
+        console.log(`  - Add the values listed above as missing to ${envFile}.`);
     console.log(`  - Run \`flisk up\` with Flisk core ${MIN_CORE_VERSION} or later. The import did not start anything.`);
 });
+program
+    .command("tiltfile")
+    .description("Register an existing Tiltfile in .flisk/project.json so flisk up runs it unchanged (never edits the Tiltfile)")
+    .argument("[path]", "The Tiltfile, or a directory holding one", "Tiltfile")
+    .option("--dry-run", "Print the plan and write nothing", false)
+    .option("--yes", "Write without prompting", false)
+    .option("--force", "Replace an orchestration already set in .flisk/project.json", false)
+    .action(async (path, local) => {
+    // Also honour the flags when they come before `tiltfile`, where the top-level command reads them.
+    const top = program.opts();
+    const options = {
+        dryRun: local.dryRun || top.dryRun,
+        yes: local.yes || top.yes,
+        force: local.force || top.force,
+    };
+    const plan = planTiltfileImport(path, { force: options.force });
+    console.log(formatTiltfilePlan(plan));
+    if (options.dryRun)
+        return void console.log("Dry run: nothing written.");
+    const target = plan.action === "create" ? "Create .flisk/project.json" : "Update .flisk/project.json";
+    if (!options.yes &&
+        !(await confirm(`${target} with orchestration ${plan.orchestration.path}?`))) {
+        console.log("Nothing written.");
+        process.exitCode = 2;
+        return;
+    }
+    applyTiltfileImport(plan);
+    console.log(`  wrote ${relative(process.cwd(), plan.projectJson) || ".flisk/project.json"}`);
+    console.log(`\nRegistered ${plan.orchestration.path} as the orchestration source.`);
+    console.log("\nNext:");
+    console.log(`  - Run \`flisk up\` with a Flisk core that runs an imported Tiltfile (${TILTFILE_CORE}). It runs ${plan.orchestration.path} unchanged; the import did not start anything.`);
+});
 try {
     await program.parseAsync();
 }

package/dist/detectors/compose.js

@@ -1,8 +1,8 @@
 import { readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, normalize } from "node:path/posix";
 import { isAlias, isMap, parseDocument, visit } from "yaml";
+import { HEALTH_CHECK_PATH_PATTERN } from "../flisk.js";
 import { registerDetector } from "../registry.js";
-import { HEALTH_CHECK_PATH_PATTERN } from "../tdk.js";
 const isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 /** Container-side port of one `ports:` entry, in short or long syntax. */
 function containerPort(entry) {
@@ -41,6 +41,26 @@ function envNames(environment) {
     }
     return isObj(environment) ? Object.keys(environment) : [];
 }
+/** Literal environment values; interpolated ones (`${VAR}`) and empty entries are left for the user. */
+function envValues(environment) {
+    const pairs = Array.isArray(environment)
+        ? environment
+            .filter((e) => typeof e === "string" && e.includes("="))
+            .map((e) => [e.slice(0, e.indexOf("=")), e.slice(e.indexOf("=") + 1)])
+        : isObj(environment)
+            ? Object.entries(environment)
+            : [];
+    const out = {};
+    for (const [key, raw] of pairs) {
+        if (raw === null || raw === undefined || typeof raw === "object")
+            continue;
+        const value = String(raw);
+        if (value.includes("${") || value.includes("\n"))
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
 function commandOf(command) {
     if (typeof command === "string")
         return command;
@@ -176,6 +196,7 @@ registerDetector({
                     : [];
             const command = commandOf(raw.command);
             const envKeys = envNames(raw.environment);
+            const env = envValues(raw.environment);
             const foundHealthPath = healthPathOf(raw.healthcheck);
             const healthCheckPath = foundHealthPath && HEALTH_CHECK_PATH_PATTERN.test(foundHealthPath)
                 ? foundHealthPath
@@ -208,6 +229,7 @@ registerDetector({
                 ...(healthCheckPath ? { healthCheckPath } : {}),
                 exposeViaProxy,
                 ...(envKeys.length ? { envKeys } : {}),
+                ...(Object.keys(env).length ? { env } : {}),
                 ...(dependsOn.length ? { dependsOn } : {}),
                 confidence: "high",
                 sources: [base],

package/dist/flisk.js

@@ -0,0 +1,72 @@
+import { existsSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+/** Manifest constants of the Flisk service.json this tool writes. */
+export const SERVICE_MANIFEST_SCHEMA_VERSION = 1;
+export const SERVICE_MANIFEST_SCHEMA_URL = "https://flisk.sh/schema.service.json";
+/**
+ * Oldest Flisk core that starts an imported project: 1.3.104 added `buildContext`, 1.3.145
+ * (flisk#1018) bootstraps a project that has `.flisk/project.json` but no Tiltfile yet, and the
+ * release after 1.4.10 (flisk#2646) accepts a bring-your-own port outside 4000-5999 and two-letter
+ * names, which this importer now writes. Stated, not checked: it does not read the installed version.
+ */
+export const MIN_CORE_VERSION = "1.4.11";
+/**
+ * The core change that runs a registered Tiltfile (`orchestration.source: "tiltfile"`) from `flisk up`. Stated, not
+ * checked, like MIN_CORE_VERSION.
+ */
+export const TILTFILE_CORE = "flisk-sh/flisk#2849";
+/** Flisk's bring-your-own port range. */
+export const BYO_PORT_RANGE = { min: 4000, max: 5999, label: "4000-5999" };
+/**
+ * Values Flisk copies into generated Compose and Traefik config must match these, or `flisk up` refuses
+ * the manifest (flisk `cli/src/utils/service-manifest.ts`, engine `manifest/parser.star`).
+ */
+export const HEALTH_CHECK_PATH_PATTERN = /^\/[a-z0-9/-]*$/;
+export const IMAGE_PATTERN = /^[A-Za-z0-9._/:@-]+$/;
+const KEBAB = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+export function validateName(label, name) {
+    return KEBAB.test(name)
+        ? { valid: true }
+        : {
+            valid: false,
+            error: `${label} "${name}" must use lowercase letters, numbers, and hyphens only`,
+        };
+}
+/** Nearest directory at or above `start` holding `.flisk/project.json`. */
+export function findProjectRoot(start) {
+    let dir = resolve(start);
+    while (true) {
+        if (existsSync(join(dir, ".flisk", "project.json")))
+            return dir;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * The minimal `.flisk/project.json` an import writes when the repo is not a Flisk project yet: the given stacks in
+ * Pre-Alpha, no optional infrastructure, and discovery of every `services/<stack>/<name>` folder. A copy of the minimum
+ * Flisk accepts today, so it can drift from flisk.
+ */
+export function defaultProjectConfig(projectRoot, preAlpha) {
+    return {
+        version: "1.0",
+        project: { name: basename(projectRoot), version: "1.0.0" },
+        phases: {
+            pre_alpha: { name: "Pre-Alpha", ...preAlpha },
+            alpha: { name: "Alpha", description: "", enabledStacks: [] },
+            beta: { name: "Beta", description: "", enabledStacks: [] },
+            out_of_scope: { name: "Out of Scope", description: "", enabledStacks: [] },
+        },
+        optional_infra: {
+            monitoring: false,
+            elk: false,
+            debezium: false,
+            golden_image: false,
+            verdaccio: false,
+        },
+        discovery: { paths: ["services/*/*"] },
+        overrides: {},
+    };
+}

package/dist/format.js

@@ -10,7 +10,7 @@ export function formatPlan(plan, writes) {
     const jobs = plan.services.filter((s) => s.kind === "job").length;
     out.push(`Found ${plan.services.length - jobs} service(s) and ${jobs} job(s) in ${plan.root}`, `Read only: ${plan.files.join(", ")}. Lines below name what was not translated.`, "");
     if (writes.projectConfig)
-        out.push(`  .tdk/project.json  [create Flisk project]`, "");
+        out.push(`  .flisk/project.json  [create Flisk project]`, "");
     for (const service of plan.services) {
         const item = writes.items.find((i) => i.service === service);
         out.push(`  ${service.name}  (${service.kind}${service.dir ? `, ${service.dir}/` : ""})`);

package/dist/merge.js

@@ -8,10 +8,11 @@ function slug(raw) {
 }
 export function toResourceName(raw) {
     let name = slug(raw) || "svc";
-    // Resource names must start with a letter and be at least 3 characters (service schema).
+    // Resource names must start with a letter and be at least 2 characters (service schema), so a
+    // Compose name such as `db` is kept and stays the container's hostname.
     if (!/^[a-z]/.test(name))
         name = `svc-${name}`;
-    if (name.length < 3)
+    if (name.length < 2)
         name = `${name}-svc`;
     return name;
 }
@@ -57,6 +58,7 @@ function mergeGroup(name, dir, members, resolve) {
         dir,
         kind: ordered[0].kind,
         envKeys: [...new Set(ordered.flatMap((c) => c.envKeys ?? []))].sort(),
+        env: Object.assign({}, ...[...ordered].reverse().map((c) => c.env ?? {})),
         dependsOn: [...new Set(ordered.flatMap((c) => (c.dependsOn ?? []).map(resolve)))].sort(),
         exposeViaProxy: ordered.find((c) => c.exposeViaProxy !== undefined)?.exposeViaProxy,
         procfileCommands: ordered.flatMap((c) => c.sources.some((source) => source.detector === "procfile") && c.command ? [c.command] : []),

package/dist/scan.js

@@ -8,7 +8,7 @@ export const HARD_SKIPS = new Set([
     "dist",
     ".autogenerated",
     // Output of `flisk project`: never a source of services.
-    ".tdk",
+    ".flisk",
     "shared-platform-engineering",
 ]);
 export const MAX_DEPTH = 8;
@@ -84,8 +84,8 @@ export function scanTree(root, limits = { depth: MAX_DEPTH, files: MAX_FILES })
     let depthCapped = false;
     let fileCapped = false;
     // In a Flisk project, `services/` holds manifests and generated compose files, not sources.
-    const isTdkProject = existsSync(join(root, ".tdk", "project.json"));
-    if (isTdkProject)
+    const isFliskProject = existsSync(join(root, ".flisk", "project.json"));
+    if (isFliskProject)
         notes.push("Flisk project detected: services/ was not scanned");
     const walk = (rel, depth, inherited) => {
         const abs = join(root, rel);
@@ -106,7 +106,7 @@ export function scanTree(root, limits = { depth: MAX_DEPTH, files: MAX_FILES })
             if (entry.isDirectory()) {
                 if (HARD_SKIPS.has(entry.name) || isIgnored(rules, entryRel, entry.name, true))
                     continue;
-                if (isTdkProject && entryRel === "services")
+                if (isFliskProject && entryRel === "services")
                     continue;
                 if (depth >= limits.depth) {
                     depthCapped = true;

package/dist/tiltfile.js

@@ -0,0 +1,109 @@
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { ImportError } from "./errors.js";
+import { defaultProjectConfig, findProjectRoot } from "./flisk.js";
+const RERUN = "flisk import tiltfile <path>";
+/** Describes an `orchestration` value for a message, for example `tiltfile: Tiltfile`. */
+export function describeOrchestration(value) {
+    if (value && typeof value === "object" && "source" in value) {
+        const { source, path } = value;
+        return `${String(source)}: ${typeof path === "string" && path ? path : "default"}`;
+    }
+    return JSON.stringify(value);
+}
+/**
+ * Plans registering an existing Tiltfile as the project's orchestration source, so `flisk up` runs it unchanged.
+ * `pathArg` is a file or a directory holding `Tiltfile`, resolved from `cwd`. Nothing is written here.
+ */
+export function planTiltfileImport(pathArg = "Tiltfile", options = {}) {
+    const cwd = resolve(options.cwd ?? process.cwd());
+    // flisk up puts this path in a generated Tiltfile as a Starlark string, so refuse it before touching the disk.
+    const hasUnsafeChar = (value) => [...value].some((char) => char === '"' || char === "'" || char.charCodeAt(0) < 0x20);
+    if (hasUnsafeChar(pathArg)) {
+        throw new ImportError(`Tiltfile path ${JSON.stringify(pathArg)} has a quote or control character`, ["Rename the file or folder, then run: flisk import tiltfile <path>"]);
+    }
+    let tiltfile = resolve(cwd, pathArg);
+    if (statSync(tiltfile, { throwIfNoEntry: false })?.isDirectory())
+        tiltfile = join(tiltfile, "Tiltfile");
+    const projectRoot = findProjectRoot(cwd) ?? cwd;
+    const path = relative(projectRoot, tiltfile).split("\\").join("/");
+    if (hasUnsafeChar(path)) {
+        throw new ImportError(`Tiltfile path ${JSON.stringify(path)} has a quote or control character`, ["Rename the file or folder, then run: flisk import tiltfile <path>"]);
+    }
+    if (path === ".flisk" || path.startsWith(".flisk/")) {
+        throw new ImportError(`${path} is inside .flisk/, where Flisk writes its generated files; import your own Tiltfile instead`, [`Point it at the Tiltfile you maintain: ${RERUN}`]);
+    }
+    if (!statSync(tiltfile, { throwIfNoEntry: false })?.isFile()) {
+        throw new ImportError(`No Tiltfile found at ${pathArg}`, [
+            `Pass the path of an existing Tiltfile, or a folder that holds one: ${RERUN}`,
+        ]);
+    }
+    const projectJson = join(projectRoot, ".flisk", "project.json");
+    const orchestration = { source: "tiltfile", path };
+    if (!existsSync(projectJson)) {
+        const config = {
+            ...defaultProjectConfig(projectRoot, {
+                description: "Flisk proxy; flisk up runs the project's own Tiltfile",
+                enabledStacks: ["proxy"],
+            }),
+            orchestration,
+        };
+        return {
+            tiltfile,
+            projectRoot,
+            projectJson,
+            orchestration,
+            action: "create",
+            content: `${JSON.stringify(config, null, 2)}\n`,
+        };
+    }
+    let existing;
+    try {
+        existing = JSON.parse(readFileSync(projectJson, "utf8"));
+    }
+    catch (err) {
+        throw new ImportError(`Cannot read ${projectJson}: ${err instanceof Error ? err.message : String(err)}`, ["Fix the JSON in .flisk/project.json, then run the import again"]);
+    }
+    if (!existing || typeof existing !== "object" || Array.isArray(existing)) {
+        throw new ImportError(`${projectJson} is not a JSON object`, [
+            "Fix .flisk/project.json, then run the import again",
+        ]);
+    }
+    const config = existing;
+    const replaced = config.orchestration;
+    if (replaced !== undefined && !options.force) {
+        throw new ImportError(`.flisk/project.json already sets orchestration (${describeOrchestration(replaced)})`, ["Pass --force to replace it; every other key is kept"]);
+    }
+    // Spreading keeps every key, and keeps `orchestration` where it was when --force replaces it.
+    const next = { ...config, orchestration };
+    return {
+        tiltfile,
+        projectRoot,
+        projectJson,
+        orchestration,
+        action: "update",
+        ...(replaced !== undefined ? { replaced } : {}),
+        content: `${JSON.stringify(next, null, 2)}\n`,
+    };
+}
+/** Writes `.flisk/project.json`, and nothing else. The Tiltfile is never touched. */
+export function applyTiltfileImport(plan) {
+    mkdirSync(dirname(plan.projectJson), { recursive: true });
+    writeFileSync(plan.projectJson, plan.content, plan.action === "create" ? { flag: "wx" } : {});
+}
+/** The printed plan for `flisk-import tiltfile`. */
+export function formatTiltfilePlan(plan) {
+    const status = plan.action === "create"
+        ? "create Flisk project"
+        : plan.replaced !== undefined
+            ? `update, replaces orchestration (${describeOrchestration(plan.replaced)}) (--force)`
+            : "update, other keys kept";
+    return [
+        `Found ${plan.orchestration.path} in ${plan.projectRoot}`,
+        "The Tiltfile is not changed: flisk up runs it as it is.",
+        "",
+        `  .flisk/project.json  [${status}]`,
+        `    orchestration:  ${JSON.stringify(plan.orchestration)}`,
+        "",
+    ].join("\n");
+}

package/dist/write.js

@@ -1,9 +1,25 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { ImportError } from "./errors.js";
+import { BYO_PORT_RANGE, defaultProjectConfig, findProjectRoot, IMAGE_PATTERN, SERVICE_MANIFEST_SCHEMA_URL, SERVICE_MANIFEST_SCHEMA_VERSION, validateName, } from "./flisk.js";
 import { toResourceName } from "./merge.js";
 import { usedManifestPorts } from "./plan.js";
-import { BYO_PORT_RANGE, findProjectRoot, IMAGE_PATTERN, SERVICE_MANIFEST_SCHEMA_URL, SERVICE_MANIFEST_SCHEMA_VERSION, validateName, } from "./tdk.js";
+/** Secret names the service schema accepts (`secrets.required`). */
+const ENV_NAME = /^[A-Z_][A-Z0-9_]*$/;
+function readEnvKeys(path) {
+    if (!existsSync(path))
+        return new Set();
+    return new Set(readFileSync(path, "utf8")
+        .split(/\r?\n/)
+        .map((line) => line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/)?.[1])
+        .filter((key) => key !== undefined));
+}
+/** A .env value, quoted when it holds characters a dotenv parser would split or strip. */
+function envLine(key, value) {
+    return /^[A-Za-z0-9_./:@+-]*$/.test(value)
+        ? `${key}=${value}`
+        : `${key}=${JSON.stringify(value)}`;
+}
 function existingPort(path) {
     try {
         const port = JSON.parse(readFileSync(path, "utf8")).port;
@@ -29,35 +45,19 @@ export function planWrites(plan, force) {
         ]);
     }
     const servicesDir = join(projectRoot, "services");
-    const projectConfigPath = join(projectRoot, ".tdk", "project.json");
+    const projectConfigPath = join(projectRoot, ".flisk", "project.json");
     const projectConfig = existsSync(projectConfigPath)
         ? undefined
         : {
             path: projectConfigPath,
-            content: `${JSON.stringify({
-                version: "1.0",
-                project: { name: basename(projectRoot), version: "1.0.0" },
-                phases: {
-                    pre_alpha: {
-                        name: "Pre-Alpha",
-                        description: "Flisk proxy and imported Compose services",
-                        enabledStacks: ["proxy", stack],
-                    },
-                    alpha: { name: "Alpha", description: "", enabledStacks: [] },
-                    beta: { name: "Beta", description: "", enabledStacks: [] },
-                    out_of_scope: { name: "Out of Scope", description: "", enabledStacks: [] },
-                },
-                optional_infra: {
-                    monitoring: false,
-                    elk: false,
-                    debezium: false,
-                    golden_image: false,
-                    verdaccio: false,
-                },
-                discovery: { paths: ["services/*/*"] },
-                overrides: {},
-            }, null, 2)}\n`,
+            content: `${JSON.stringify(defaultProjectConfig(projectRoot, {
+                description: "Flisk proxy and imported Compose services",
+                enabledStacks: ["proxy", stack],
+            }), null, 2)}\n`,
         };
+    const envPath = join(projectRoot, ".env");
+    const envKept = readEnvKeys(envPath);
+    const envAdd = {};
     const used = usedManifestPorts(servicesDir);
     const items = [];
     const rejected = [];
@@ -97,8 +97,9 @@ export function planWrites(plan, force) {
             // Never written, so no port is needed; keep the one on disk for the plan.
             port = existingPort(path) ?? BYO_PORT_RANGE.min;
         }
-        else if (service.port !== undefined && free(service.port)) {
-            // The schema accepts this port for bring-your-own and no other service in the project uses it.
+        else if (service.port !== undefined) {
+            // A bring-your-own port is the port inside its own container (Traefik reaches it on the stack
+            // network; nothing is published on the host), so the Compose port is kept as written.
             port = service.port;
         }
         else if (keep !== undefined && free(keep)) {
@@ -112,11 +113,8 @@ export function planWrites(plan, force) {
                 }
             }
         }
-        if (status !== "exists" &&
-            service.port !== undefined &&
-            port !== undefined &&
-            port !== service.port)
-            notes.push(`Compose port ${service.port} is outside ${BYO_PORT_RANGE.label} or already used; assigned ${port}. The container must listen on $PORT (${port}) or it will not answer`);
+        if (status !== "exists" && service.port === undefined && !isPrivate && port !== undefined)
+            notes.push(`port ${port} assigned: Compose gives no single container port; the container must listen on $PORT (${port})`);
         if (port === undefined) {
             rejected.push({ name: service.name, reason: `no free port in ${BYO_PORT_RANGE.label}` });
             continue;
@@ -135,8 +133,23 @@ export function planWrites(plan, force) {
             notes.push("no health path: the service does not serve HTTP (non-HTTP image or job)");
         if (!isPrivate && !nonHttp && !service.healthCheckPath)
             notes.push("health path / is assumed: no HTTP health path could be read from Compose. Traefik routes only while it answers 2xx or 3xx");
-        if (service.envKeys.length)
-            notes.push("environment values are not written; put them in the project .env");
+        // Names go into service.json as secrets, so Flisk injects them; values go to the gitignored project .env.
+        const secretNames = service.envKeys.filter((key) => ENV_NAME.test(key));
+        const skippedNames = service.envKeys.filter((key) => !ENV_NAME.test(key));
+        if (skippedNames.length)
+            notes.push(`environment names not written (Flisk accepts A-Z, 0-9 and _): ${skippedNames.join(", ")}`);
+        const missing = [];
+        for (const key of secretNames) {
+            const value = service.env[key];
+            if (envKept.has(key) || key in envAdd)
+                continue;
+            if (value === undefined)
+                missing.push(key);
+            else
+                envAdd[key] = value;
+        }
+        if (missing.length)
+            notes.push(`no literal value in docker-compose.yml for ${missing.join(", ")}; add it to the project .env`);
         if (service.dockerfile && service.image)
             notes.push(`image "${service.image}" is not written: with build and image, Flisk builds from ${service.dockerfile} and does not pull the tag`);
         // With both build and image, Compose builds the Dockerfile and tags the result as `image`.
@@ -158,10 +171,18 @@ export function planWrites(plan, force) {
             ...source,
             ...(isPrivate ? { exposeViaProxy: false } : {}),
             ...(dependsOn.length ? { dependsOn } : {}),
+            ...(secretNames.length ? { secrets: { required: secretNames } } : {}),
         };
         items.push({ service, path, manifest, status, notes });
     }
-    return { projectRoot, stack, items, projectConfig, rejected };
+    return {
+        projectRoot,
+        stack,
+        items,
+        projectConfig,
+        rejected,
+        env: { path: envPath, add: envAdd },
+    };
 }
 export function applyWrites(writes) {
     const written = [];
@@ -176,8 +197,24 @@ export function applyWrites(writes) {
         writeFileSync(item.path, `${JSON.stringify(item.manifest, null, 2)}\n`);
         written.push(item);
     }
+    const keys = Object.keys(writes.env.add);
+    if (keys.length) {
+        const existing = existsSync(writes.env.path) ? readFileSync(writes.env.path, "utf8") : "";
+        const lines = keys.map((key) => envLine(key, writes.env.add[key]));
+        const block = `${existing && !existing.endsWith("\n") ? "\n" : ""}# From docker-compose.yml (flisk import)\n${lines.join("\n")}\n`;
+        writeFileSync(writes.env.path, existing + block);
+        ensureGitignored(writes.projectRoot, ".env");
+    }
     return written;
 }
 export function manifestRelPath(plan, item) {
     return relative(plan.root, item.path).split("\\").join("/");
 }
+/** Keeps the project .env out of git: it now holds values copied from docker-compose.yml. */
+function ensureGitignored(projectRoot, entry) {
+    const path = join(projectRoot, ".gitignore");
+    const content = existsSync(path) ? readFileSync(path, "utf8") : "";
+    if (content.split(/\r?\n/).some((line) => line.trim() === entry || line.trim() === `/${entry}`))
+        return;
+    writeFileSync(path, `${content}${content && !content.endsWith("\n") ? "\n" : ""}${entry}\n`);
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@flisk-sh/flisk-import",
-  "version": "0.2.4",
-  "description": "Import services from a repository's root docker-compose.yml into Flisk service.json files.",
+  "version": "0.4.0",
+  "description": "Import a repository's root docker-compose.yml into Flisk service.json files, or register its Tiltfile.",
   "type": "module",
   "license": "MIT",
   "bin": {

package/dist/tdk.js

@@ -1,40 +0,0 @@
-import { existsSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-/** Manifest constants of the Flisk service.json this tool writes. */
-export const SERVICE_MANIFEST_SCHEMA_VERSION = 1;
-export const SERVICE_MANIFEST_SCHEMA_URL = "https://flisk.sh/schema.service.json";
-/**
- * Oldest Flisk core that starts an imported project: 1.3.104 added `buildContext`, and 1.3.145
- * (flisk#1018) bootstraps a project that has `.tdk/project.json` but no Tiltfile yet.
- * Stated, not checked: the importer does not read the installed core version.
- */
-export const MIN_CORE_VERSION = "1.3.145";
-/** Flisk's bring-your-own port range. */
-export const BYO_PORT_RANGE = { min: 4000, max: 5999, label: "4000-5999" };
-/**
- * Values Flisk copies into generated Compose and Traefik config must match these, or `flisk up` refuses
- * the manifest (flisk `cli/src/utils/service-manifest.ts`, engine `manifest/parser.star`).
- */
-export const HEALTH_CHECK_PATH_PATTERN = /^\/[a-z0-9/-]*$/;
-export const IMAGE_PATTERN = /^[A-Za-z0-9._/:@-]+$/;
-const KEBAB = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
-export function validateName(label, name) {
-    return KEBAB.test(name)
-        ? { valid: true }
-        : {
-            valid: false,
-            error: `${label} "${name}" must use lowercase letters, numbers, and hyphens only`,
-        };
-}
-/** Nearest directory at or above `start` holding `.tdk/project.json`. */
-export function findProjectRoot(start) {
-    let dir = resolve(start);
-    while (true) {
-        if (existsSync(join(dir, ".tdk", "project.json")))
-            return dir;
-        const parent = dirname(dir);
-        if (parent === dir)
-            return null;
-        dir = parent;
-    }
-}