@flisk-sh/flisk 0.0.0-stage → 1.3.189

package/engine/assets/docker/wake-gateway/server.ts

@@ -0,0 +1,363 @@
+// Copyright (c) 2026 Flisk contributors
+// SPDX-License-Identifier: MIT
+/**
+ * Wake gateway: fronts every `sablier.deferStart` resource's Traefik static
+ * route (see openspec/changes/prioritized-cold-start). On the first request
+ * for a resource with no running container, it triggers the resource (and
+ * its cold dependencies) via `tilt trigger`, and/or Sablier's own start for
+ * an already-created container, then holds the request until the resource
+ * answers its healthcheck or the configured timeout elapses.
+ *
+ * Config for each request comes from headers a Traefik `headers` middleware
+ * injects (set by the file-provider entry generated in
+ * traefik_static_routes.star) rather than the path, so the original request
+ * path/query reach the real backend unchanged once it's ready:
+ *   X-Wake-Resource        Tilt/Compose resource name (for `tilt trigger` and
+ *                          `docker compose up <service>`).
+ *   X-Wake-Container       The actual Docker container name (for `docker
+ *                          inspect` state/health and the proxy target -- NOT the same string as
+ *                          the resource name; Compose derives it as
+ *                          <project>-<service>-<replica>, confirmed empirically
+ *                          against a live Flisk container, e.g.
+ *                          "tdk-erp-system-analytics-autogenerated-data-governance-api-1"
+ *                          for the "data-governance-api" resource).
+ *   X-Wake-Deps            Comma-separated "resourceName=containerName" pairs
+ *                          for required dependencies (task 1.5: Tilt never
+ *                          cascades a trigger to these on its own).
+ *   X-Wake-Compose-Project The resource's Compose project (e.g. "tdk-erp-system-analytics-autogenerated").
+ *   X-Wake-Compose-Files   Comma-separated absolute compose file paths, the
+ *                          same ones Tilt's `<resource>-run-only` resource
+ *                          passes. The project root is mounted into this
+ *                          container at the same absolute path, so relative
+ *                          paths inside those files resolve exactly as for Tilt.
+ *   X-Wake-Env-File        Absolute path of the project's .env (optional).
+ *   X-Wake-Image           The image the compose service declares
+ *                          (<project>_<stack>_<resource>:dev).
+ *   X-Wake-Timeout-Ms, X-Wake-Proxy-Port, X-Wake-Session-Duration
+ *   X-Wake-Respond-Within-Ms  How long to hold the request before answering
+ *                          503 + Retry-After while the start continues in the
+ *                          background (default decide.ts EARLY_RESPONSE_MS).
+ */
+import {
+  RETRY_AFTER_SECONDS,
+  decideWakeAction,
+  earlyResponseMs,
+  evaluateReadiness,
+  isGatewayLivenessProbe,
+  wakeTimeoutMs,
+  type ContainerState,
+} from "./decide";
+
+const TILT_HOST = process.env.TILT_HOST || "host.docker.internal";
+const TILT_PORT = process.env.TILT_PORT || "10350";
+const SABLIER_URL = process.env.SABLIER_URL || "http://sablier:10000";
+const POLL_INTERVAL_MS = 1000;
+
+async function run(cmd: string[]): Promise<{ code: number; stdout: string; stderr: string }> {
+  const proc = Bun.spawn(cmd, { stdout: "pipe", stderr: "pipe" });
+  const [stdout, stderr, code] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+    proc.exited,
+  ]);
+  return { code, stdout, stderr };
+}
+
+async function containerState(name: string): Promise<ContainerState> {
+  const { code, stdout } = await run([
+    "docker", "inspect", "--format", "{{.State.Status}}", name,
+  ]);
+  if (code !== 0) return "absent";
+  const status = stdout.trim();
+  if (status === "running") return "running";
+  if (status === "created") return "created";
+  return "exited";
+}
+
+async function isHealthy(name: string): Promise<boolean> {
+  const { code, stdout } = await run([
+    "docker", "inspect",
+    "--format", "{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}",
+    name,
+  ]);
+  if (code !== 0) return false;
+  const status = stdout.trim();
+  return status === "healthy" || status === "running";
+}
+
+async function tiltTrigger(name: string): Promise<void> {
+  const { code, stderr } = await run(["tilt", "trigger", name, "--host", TILT_HOST, "--port", TILT_PORT]);
+  console.log(`tilt trigger ${name}: ${code === 0 ? "queued" : `failed (${stderr.trim()})`}`);
+}
+
+interface ComposeInvocation {
+  project: string;
+  files: string[];
+  envFile: string;
+  image: string;
+}
+
+/**
+ * Make sure the compose service's declared image exists locally. Tilt tags its
+ * own builds `<repo>:tilt-<hash>` and injects that tag when it runs compose, so
+ * the declared `<repo>:dev` tag may be missing even though the resource was
+ * built; retag Tilt's newest build in that case. False when nothing was ever
+ * built -- only `tilt trigger` (which builds) can wake the resource then.
+ */
+async function ensureImage(image: string): Promise<boolean> {
+  if ((await run(["docker", "image", "inspect", "--format", "{{.Id}}", image])).code === 0) return true;
+  const repo = image.split(":")[0];
+  // `docker images` lists newest first.
+  const { code, stdout } = await run(["docker", "images", repo, "--format", "{{.Tag}}"]);
+  if (code !== 0) return false;
+  const tiltTag = stdout.split("\n").map((t) => t.trim()).find((t) => t.startsWith("tilt-"));
+  if (!tiltTag) return false;
+  return (await run(["docker", "tag", `${repo}:${tiltTag}`, image])).code === 0;
+}
+
+/**
+ * Create and start the resource's container directly, with the same
+ * `docker compose ... up -d --no-build` its Tilt `-run-only` resource runs,
+ * bypassing Tilt's build queue (see decide.ts useComposeStart).
+ */
+async function composeStart(compose: ComposeInvocation, service: string): Promise<boolean> {
+  if (!(await ensureImage(compose.image))) {
+    console.log(`compose start ${service}: no local image for ${compose.image}, falling back to tilt trigger`);
+    return false;
+  }
+  const args = ["docker", "compose", "-p", compose.project];
+  for (const file of compose.files) args.push("-f", file);
+  if (compose.envFile) args.push("--env-file", compose.envFile);
+  args.push("up", "-d", "--no-build", "--no-deps", service);
+  const { code, stderr } = await run(args);
+  console.log(`compose start ${service}: ${code === 0 ? "started" : `failed (${stderr.trim()})`}`);
+  return code === 0;
+}
+
+/**
+ * Sablier's real blocking-strategy endpoint (GET /api/strategies/blocking,
+ * per https://sablierapp.dev/openapi.json): starts the named instance and
+ * holds until it's ready or `timeoutMs` elapses, returning that outcome via
+ * the X-Sablier-Session-Status header. Only valid for an instance Sablier
+ * already knows about (a container that exists with sablier.enable=true) --
+ * see decide.ts's useSablierStart.
+ */
+async function sablierBlockingWait(resource: string, sessionDuration: string, timeoutMs: number): Promise<boolean> {
+  const params = new URLSearchParams({
+    names: resource,
+    session_duration: sessionDuration,
+    timeout: `${Math.max(1, Math.round(timeoutMs / 1000))}s`,
+  });
+  try {
+    const res = await fetch(`${SABLIER_URL}/api/strategies/blocking?${params}`);
+    return res.headers.get("X-Sablier-Session-Status") === "ready";
+  } catch {
+    return false;
+  }
+}
+
+interface NamedDep {
+  resourceName: string;
+  containerName: string;
+}
+
+function parseDeps(raw: string): NamedDep[] {
+  return raw
+    .split(",")
+    .filter(Boolean)
+    .map((pair) => {
+      const [resourceName, containerName] = pair.split("=");
+      return { resourceName, containerName: containerName || resourceName };
+    });
+}
+
+function parseRequest(req: Request) {
+  const resource = req.headers.get("X-Wake-Resource") || "";
+  const container = req.headers.get("X-Wake-Container") || resource;
+  const deps = parseDeps(req.headers.get("X-Wake-Deps") || "");
+  const timeoutOverrideMs = Number(req.headers.get("X-Wake-Timeout-Ms")) || undefined;
+  const respondWithinOverrideMs = Number(req.headers.get("X-Wake-Respond-Within-Ms")) || undefined;
+  const proxyPort = req.headers.get("X-Wake-Proxy-Port") || "80";
+  const sessionDuration = req.headers.get("X-Wake-Session-Duration") || "10m";
+  const composeFiles = (req.headers.get("X-Wake-Compose-Files") || "").split(",").filter(Boolean);
+  const compose: ComposeInvocation = {
+    project: req.headers.get("X-Wake-Compose-Project") || "",
+    files: composeFiles,
+    envFile: req.headers.get("X-Wake-Env-File") || "",
+    image: req.headers.get("X-Wake-Image") || "",
+  };
+  const hasCompose = Boolean(compose.project && compose.files.length && compose.image);
+  return {
+    resource,
+    container,
+    deps,
+    timeoutOverrideMs,
+    respondWithinOverrideMs,
+    proxyPort,
+    sessionDuration,
+    compose,
+    hasCompose,
+  };
+}
+
+type WakeParams = ReturnType<typeof parseRequest>;
+type WakeOutcome = { ready: true } | { ready: false; timeoutMs: number };
+
+// One wake per resource at a time: a caller that got an early 503 and retries,
+// or a second caller arriving meanwhile, joins the wake already in progress
+// instead of starting the container again.
+const inflight = new Map<string, Promise<WakeOutcome>>();
+
+function wakeOnce(params: WakeParams): Promise<WakeOutcome> {
+  let wake = inflight.get(params.resource);
+  if (!wake) {
+    wake = runWake(params).finally(() => inflight.delete(params.resource));
+    inflight.set(params.resource, wake);
+  }
+  return wake;
+}
+
+async function handleWake(req: Request): Promise<Response> {
+  const params = parseRequest(req);
+  if (!params.resource) {
+    return new Response("wake gateway: missing X-Wake-Resource header (set by the generated Traefik static route)", { status: 400 });
+  }
+
+  const holdMs = earlyResponseMs(params.respondWithinOverrideMs);
+  const outcome = await Promise.race([wakeOnce(params), Bun.sleep(holdMs).then(() => null)]);
+  if (outcome === null) {
+    console.log(`wake ${params.resource}: still starting after ${holdMs}ms, answering 503`);
+    return new Response(
+      `wake gateway: ${params.resource} is starting; retry in ${RETRY_AFTER_SECONDS}s`,
+      { status: 503, headers: { "Retry-After": String(RETRY_AFTER_SECONDS) } },
+    );
+  }
+  if (outcome.ready) {
+    return proxyThrough(req, params.container, params.proxyPort);
+  }
+  return new Response(
+    `wake gateway: timed out after ${outcome.timeoutMs}ms waiting for ${params.resource} and its dependencies to become healthy`,
+    { status: 504 },
+  );
+}
+
+async function runWake(params: WakeParams): Promise<WakeOutcome> {
+  const { resource, container, deps, timeoutOverrideMs, sessionDuration, compose, hasCompose } = params;
+  const resourceState = await containerState(container);
+  const dependencies = await Promise.all(
+    deps.map(async (dep) => ({ name: dep.resourceName, state: await containerState(dep.containerName) })),
+  );
+
+  const action = decideWakeAction({
+    resourceContainerName: resource,
+    resourceState,
+    dependencies,
+    hasComposeInvocation: hasCompose,
+  });
+  console.log(
+    `wake ${resource}: state=${resourceState} compose=${action.useComposeStart} ` +
+      `trigger=[${action.tiltTriggerNames.join(",")}] sablier=${action.useSablierStart}`,
+  );
+
+  // Dependencies (and the resource itself when it can't be started directly)
+  // go through tilt trigger (task 1.5: Tilt never cascades this on its own).
+  const tiltNames = [...action.tiltTriggerNames];
+  let startedViaCompose = false;
+  if (action.useComposeStart) {
+    startedViaCompose = await composeStart(compose, resource);
+    if (!startedViaCompose) tiltNames.unshift(resource);
+  }
+  const timeoutMs = wakeTimeoutMs(startedViaCompose, timeoutOverrideMs);
+  const deadline = Date.now() + timeoutMs;
+
+  // Sablier's blocking call, when applicable, both starts AND waits for the
+  // resource itself in one round trip.
+  const [, resourceReadyViaSablier] = await Promise.all([
+    Promise.all(tiltNames.map(tiltTrigger)),
+    action.useSablierStart
+      ? sablierBlockingWait(resource, sessionDuration, timeoutMs)
+      : Promise.resolve(false),
+  ]);
+
+  const requiredNames = [resource, ...deps.map((d) => d.resourceName)];
+
+  while (Date.now() < deadline) {
+    const healthy: Record<string, boolean> = {};
+    // Sablier's blocking call already confirmed the resource itself; re-check
+    // it too (cheap) so a false result from Sablier still gets a fair retry.
+    healthy[resource] = resourceReadyViaSablier || (await isHealthy(container));
+    for (const dep of deps) {
+      healthy[dep.resourceName] = await isHealthy(dep.containerName);
+    }
+    if (evaluateReadiness(requiredNames, healthy).ready) {
+      return { ready: true };
+    }
+    await Bun.sleep(POLL_INTERVAL_MS);
+  }
+  return { ready: false, timeoutMs };
+}
+
+// Headers that must not be forwarded verbatim to the upstream fetch: Host
+// would otherwise carry the gateway's own address, and the X-Wake-* control
+// headers are gateway-internal, not part of the real app request.
+const STRIPPED_REQUEST_HEADERS = new Set([
+  "host",
+  "x-wake-resource",
+  "x-wake-container",
+  "x-wake-deps",
+  "x-wake-timeout-ms",
+  "x-wake-respond-within-ms",
+  "x-wake-proxy-port",
+  "x-wake-session-duration",
+  "x-wake-compose-project",
+  "x-wake-compose-files",
+  "x-wake-env-file",
+  "x-wake-image",
+]);
+
+// Proxies to the container name rather than the Compose service name: every
+// Flisk project's resources share the traefik-public network, where a bare
+// service name is only an alias and could collide across projects.
+async function proxyThrough(req: Request, container: string, port: string): Promise<Response> {
+  // The original path/query reach the gateway untouched (config travels via
+  // X-Wake-* headers, not the path), so they're forwarded as-is.
+  const target = new URL(req.url);
+  target.protocol = "http:";
+  // Set hostname/port separately, not via `.host` -- confirmed empirically
+  // that `target.host = "name:port"` silently keeps the URL's original port
+  // when one is already present instead of replacing it.
+  target.hostname = container;
+  target.port = port;
+
+  const headers = new Headers();
+  for (const [key, value] of req.headers) {
+    if (!STRIPPED_REQUEST_HEADERS.has(key.toLowerCase())) headers.set(key, value);
+  }
+
+  const upstream = await fetch(target.toString(), {
+    method: req.method,
+    headers,
+    body: req.method === "GET" || req.method === "HEAD" ? undefined : await req.arrayBuffer(),
+  });
+  return new Response(upstream.body, { status: upstream.status, headers: upstream.headers });
+}
+
+Bun.serve({
+  port: Number(process.env.PORT) || 9999,
+  // Bun's default idleTimeout (10s) is shorter than a real wake can take
+  // (tilt trigger + healthcheck polling) -- confirmed empirically: a request
+  // was killed mid-wait with "request timed out after 10 seconds" before this
+  // was raised. 255s is Bun's own max for this setting.
+  idleTimeout: 255,
+  fetch(req) {
+    if (isGatewayLivenessProbe(req.method, new URL(req.url).pathname, req.headers)) {
+      return new Response("ok");
+    }
+    return handleWake(req).catch((err) => {
+      console.error("wake gateway error:", err);
+      return new Response(`wake gateway error: ${String(err)}`, { status: 500 });
+    });
+  },
+});
+
+console.log(`wake gateway listening on :${Number(process.env.PORT) || 9999}`);

package/engine/assets/scripts/cleanup-completed-migrator-images.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+set -euo pipefail
+
+# Delete images for completed DB migrator containers to free disk space.
+# Safe guards:
+# - only containers with names ending in -db-migrator are considered
+# - only exited containers with exit code 0 are processed
+# - image deletion is best-effort (skips if still in use)
+
+mapfile -t migrator_containers < <(
+  docker ps -a --format '{{.Names}}' | grep -E -- '-db-migrator($|-)' 2>/dev/null || true
+)
+
+if [ "${#migrator_containers[@]}" -eq 0 ]; then
+  exit 0
+fi
+
+for name in "${migrator_containers[@]}"; do
+  state="$(docker inspect -f '{{.State.Status}}' "$name" 2>/dev/null || true)"
+  exit_code="$(docker inspect -f '{{.State.ExitCode}}' "$name" 2>/dev/null || true)"
+
+  if [ "$state" != "exited" ] || [ "$exit_code" != "0" ]; then
+    continue
+  fi
+
+  image_ref="$(docker inspect -f '{{.Config.Image}}' "$name" 2>/dev/null || true)"
+  if [ -z "$image_ref" ]; then
+    continue
+  fi
+
+  # Remove the stopped migrator container so image can be deleted if unused.
+  docker rm "$name" >/dev/null 2>&1 || true
+
+  if docker image rm "$image_ref" >/dev/null 2>&1; then
+    echo "$(date +%H:%M:%S) pruned migrator image: $image_ref"
+  fi
+done

package/engine/assets/scripts/cleanup-tilt-images.sh

@@ -0,0 +1,122 @@
+#!/bin/bash
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+
+set -euo pipefail
+
+# Keep the newest N Tilt-tagged images per repository.
+# Defaults to a safe dry-run unless --force is provided.
+
+KEEP_COUNT=0
+FORCE=0
+
+usage() {
+  cat <<USAGE
+Usage: $0 [--keep N] [--force]
+
+Options:
+  --keep N   Number of newest tilt-* images to keep per repository (default: 0)
+  --force    Actually remove images. Without this, runs in dry-run mode.
+USAGE
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --keep)
+      KEEP_COUNT="${2:-}"
+      shift 2
+      ;;
+    --force)
+      FORCE=1
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown option: $1"
+      usage
+      exit 1
+      ;;
+  esac
+done
+
+if ! [[ "$KEEP_COUNT" =~ ^[0-9]+$ ]] || [[ "$KEEP_COUNT" -lt 0 ]]; then
+  echo "--keep must be an integer >= 0"
+  exit 1
+fi
+
+echo "Scanning Tilt images (tag starts with tilt-) ..."
+
+# Format: REPO TAG IMAGE_ID CREATED_AT
+# Sort newest-first by creation time so first N are retained.
+IMAGES_RAW="$(
+  docker image ls --format '{{.Repository}} {{.Tag}} {{.ID}} {{.CreatedAt}}' \
+  | awk '$2 ~ /^tilt-/' \
+  | sort -rk4,5
+)"
+
+if [[ -z "${IMAGES_RAW}" ]]; then
+  echo "No tilt-* images found."
+  exit 0
+fi
+
+TO_DELETE=()
+
+echo "Retention policy: keep newest $KEEP_COUNT tilt-* images per repository"
+
+REPOS="$(printf '%s\n' "$IMAGES_RAW" | awk '{print $1}' | sort -u)"
+for repo in $REPOS; do
+  repo_blob="$(printf '%s\n' "$IMAGES_RAW" | awk -v r="$repo" '$1==r')"
+  total=$(printf '%s\n' "$repo_blob" | awk 'NF{c++} END{print c+0}')
+  echo "- $repo: $total tilt image(s)"
+
+  if (( total <= KEEP_COUNT )); then
+    continue
+  fi
+
+  # Delete rows after KEEP_COUNT newest.
+  i=0
+  while IFS= read -r row; do
+    [[ -z "$row" ]] && continue
+    if (( i < KEEP_COUNT )); then
+      ((++i))
+      continue
+    fi
+    image_id="$(awk '{print $3}' <<< "$row")"
+    tag="$(awk '{print $2}' <<< "$row")"
+    TO_DELETE+=("$image_id|$repo:$tag")
+    ((++i))
+  done <<< "$repo_blob"
+done
+
+if [[ ${#TO_DELETE[@]} -eq 0 ]]; then
+  echo "Nothing to remove."
+  exit 0
+fi
+
+echo
+echo "Images selected for cleanup: ${#TO_DELETE[@]}"
+for item in "${TO_DELETE[@]}"; do
+  IFS='|' read -r image_id ref <<< "$item"
+  echo "  $ref ($image_id)"
+done
+
+echo
+if [[ "$FORCE" -ne 1 ]]; then
+  echo "Dry-run only. Re-run with --force to remove these images."
+  exit 0
+fi
+
+echo "Removing old tilt images..."
+for item in "${TO_DELETE[@]}"; do
+  IFS='|' read -r image_id ref <<< "$item"
+  if docker rmi "$image_id" >/dev/null 2>&1; then
+    echo "  removed $ref ($image_id)"
+  else
+    echo "  skipped $ref ($image_id) - likely in use"
+  fi
+done
+
+echo "Cleanup complete."

package/engine/assets/scripts/mac-m1-resource-monitor.sh

@@ -0,0 +1,123 @@
+#!/bin/bash
+# Copyright (c) 2026 Flisk contributors
+# SPDX-License-Identifier: MIT
+
+# Flisk Mac M1 Resource Monitor
+# Monitors Docker container resource usage and provides optimization recommendations
+
+set -e
+
+# Colors for output
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m' # No Color
+
+echo -e "${BLUE}🍎 Flisk Mac M1 Resource Monitor${NC}"
+echo "=================================================="
+
+# Check if Docker is running
+if ! docker info >/dev/null 2>&1; then
+    echo -e "${RED}❌ Docker is not running${NC}"
+    exit 1
+fi
+
+# Get Docker Desktop memory limit
+DOCKER_MEMORY=$(docker system info 2>/dev/null | grep -i "total memory" | awk '{print $3 $4}' || echo "Unknown")
+echo -e "${BLUE}🐳 Docker Memory Limit:${NC} $DOCKER_MEMORY"
+
+# Get system memory info (macOS)
+SYSTEM_MEMORY=$(system_profiler SPHardwareDataType | grep "Memory:" | awk '{print $2 $3}' || echo "Unknown")
+echo -e "${BLUE}💻 System Memory:${NC} $SYSTEM_MEMORY"
+
+echo ""
+
+# Check running Flisk containers
+PROJECT_CONTAINERS=$(docker ps --format "{{.Names}}" | grep -E "(postgres|redis|nats|kafka|traefik|clickhouse|elasticsearch|verdaccio|infisical)" | sort)
+
+if [ -z "$PROJECT_CONTAINERS" ]; then
+    echo -e "${YELLOW}⚠️  No Flisk containers are currently running${NC}"
+    echo "Run 'tilt up' to start services"
+    exit 0
+fi
+
+echo -e "${GREEN}📊 Running Flisk Containers:${NC}"
+echo "=================================================="
+
+# Get detailed stats for Flisk containers
+TOTAL_MEMORY_MB=0
+HIGH_CPU_COUNT=0
+HIGH_MEMORY_COUNT=0
+
+echo -e "${BLUE}Container Name${NC}\t\t${BLUE}CPU%${NC}\t${BLUE}Memory${NC}\t${BLUE}Status${NC}"
+echo "------------------------------------------------------------------------"
+
+while IFS= read -r container; do
+    if [ -n "$container" ]; then
+        # Get container stats
+        STATS=$(docker stats --no-stream --format "{{.CPUPerc}}\t{{.MemUsage}}" "$container" 2>/dev/null || echo "N/A\tN/A")
+        CPU_PERCENT=$(echo "$STATS" | cut -f1 | sed 's/%//')
+        MEMORY_USAGE=$(echo "$STATS" | cut -f2)
+        
+        # Extract memory in MB for calculation
+        MEMORY_MB=$(echo "$MEMORY_USAGE" | grep -o '[0-9.]*MiB' | sed 's/MiB//' || echo "0")
+        if [ -z "$MEMORY_MB" ]; then
+            MEMORY_MB=0
+        fi
+        
+        # Status indicators
+        STATUS=""
+        if (( $(echo "$CPU_PERCENT > 50" | bc -l 2>/dev/null || echo 0) )); then
+            STATUS="${RED}🔥 HIGH CPU${NC}"
+            HIGH_CPU_COUNT=$((HIGH_CPU_COUNT + 1))
+        elif (( $(echo "$MEMORY_MB > 200" | bc -l 2>/dev/null || echo 0) )); then
+            STATUS="${YELLOW}⚠️  HIGH MEM${NC}"
+            HIGH_MEMORY_COUNT=$((HIGH_MEMORY_COUNT + 1))
+        else
+            STATUS="${GREEN}✅ OK${NC}"
+        fi
+        
+        # Add to total memory
+        TOTAL_MEMORY_MB=$(echo "$TOTAL_MEMORY_MB + $MEMORY_MB" | bc -l 2>/dev/null || echo "$TOTAL_MEMORY_MB")
+        
+        # Format container name for display
+        CONTAINER_DISPLAY=$(echo "$container" | sed 's/TDK_//' | cut -c1-20)
+        
+        printf "%-20s\t%s%%\t%s\t%s\n" "$CONTAINER_DISPLAY" "$CPU_PERCENT" "$MEMORY_USAGE" "$STATUS"
+    fi
+done <<< "$PROJECT_CONTAINERS"
+
+echo ""
+echo -e "${BLUE}📈 Resource Summary:${NC}"
+echo "=================================================="
+echo -e "Total Memory Usage: ${YELLOW}~${TOTAL_MEMORY_MB}MB${NC}"
+echo -e "High CPU Containers: ${RED}$HIGH_CPU_COUNT${NC}"
+echo -e "High Memory Containers: ${YELLOW}$HIGH_MEMORY_COUNT${NC}"
+
+# Recommendations
+echo ""
+echo -e "${BLUE}🔧 Mac M1 Optimization Recommendations:${NC}"
+echo "=================================================="
+
+if (( $(echo "$TOTAL_MEMORY_MB > 3000" | bc -l 2>/dev/null || echo 0) )); then
+    echo -e "${RED}⚠️  HIGH MEMORY USAGE DETECTED!${NC}"
+    echo "• Consider stopping unnecessary services with 'tilt down'"
+    echo "• Avoid running monitoring + elk + all apps simultaneously"
+    echo "• Use selective service loading: 'tilt up --focus <domain>' instead of all services"
+elif (( $(echo "$TOTAL_MEMORY_MB > 2000" | bc -l 2>/dev/null || echo 0) )); then
+    echo -e "${YELLOW}⚡ MODERATE MEMORY USAGE${NC}"
+    echo "• Memory usage is acceptable for Mac M1"
+    echo "• Monitor for performance issues"
+else
+    echo -e "${GREEN}✅ OPTIMAL MEMORY USAGE${NC}"
+    echo "• Memory usage is well optimized for Mac M1"
+fi
+
+echo ""
+echo "• Increase Docker Desktop memory limit to 6-8GB if experiencing issues"
+echo "• Use 'tilt trigger resource-monitor' for regular monitoring"
+echo "• Use 'tilt trigger memory-optimizer' for additional suggestions"
+
+echo ""
+echo -e "${BLUE}🔄 To refresh this report: ./.tilt/assets/scripts/mac-m1-resource-monitor.sh${NC}"

package/engine/config.star

@@ -0,0 +1,5 @@
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+load("./topologies/tilt/config/global.star", _Config = "Config")
+
+Config = _Config