@flisk-sh/flisk 0.0.0-stage → 1.3.190

package/cli/dist/frontend-frameworks/vue.js

@@ -0,0 +1,72 @@
+export const vueFrontendProvider = {
+    id: "vue",
+    label: "Vue + Vite",
+    dependencies: {
+        vue: "^3.5.0",
+    },
+    devDependencies: {
+        "@vitejs/plugin-vue": "^5.2.4",
+    },
+    compilerOptions: {},
+    createFiles(name) {
+        return [
+            {
+                filename: "index.html",
+                content: `<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <title>${name}</title>
+  </head>
+  <body>
+    <div id="app"></div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>
+`,
+                description: "Generating HTML template",
+                emoji: "💻",
+            },
+            {
+                filename: "src/main.ts",
+                content: `import { createApp } from 'vue';
+import App from './App.vue';
+
+createApp(App).mount('#app');
+`,
+                description: "Generating Vue entry",
+                emoji: "💻",
+            },
+            {
+                filename: "src/App.vue",
+                content: `<script setup lang="ts">
+const message = 'Frontend resource created with Flisk';
+</script>
+
+<template>
+  <main style="padding: 2rem; font-family: system-ui">
+    <h1>${name}</h1>
+    <p>{{ message }}</p>
+  </main>
+</template>
+`,
+                description: "Generating Vue app",
+                emoji: "💻",
+            },
+            {
+                filename: "src/vite-env.d.ts",
+                content: `/// <reference types="vite/client" />
+
+declare module '*.vue' {
+  import type { Component } from 'vue';
+  const component: Component;
+  export default component;
+}
+`,
+                description: "Generating Vue module types",
+                emoji: "⚙️",
+            },
+        ];
+    },
+};

package/cli/dist/generator/__tests__/golden-helpers.js

@@ -0,0 +1,43 @@
+// Copyright (c) 2026 Flisk Landscape contributors
+// SPDX-License-Identifier: MIT
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+const normalize = (text) => text.replace(/\r\n/g, "\n");
+export const UPDATE_COMMAND = "UPDATE_GOLDEN=1 bun run test -- golden-generated-output";
+/**
+ * Compares generated files with the committed golden copies in `goldenDir`. Returns one problem per file that
+ * changed, is missing a golden, or has a golden nothing generates any more. With `update` it rewrites the goldens
+ * instead and returns nothing, which is how an intentional change is accepted.
+ */
+export function compareWithGolden(actual, goldenDir, update = false) {
+    if (update) {
+        for (const [name, content] of Object.entries(actual)) {
+            const target = join(goldenDir, name);
+            mkdirSync(dirname(target), { recursive: true });
+            writeFileSync(target, normalize(content));
+        }
+        for (const stale of staleGoldens(actual, goldenDir)) {
+            rmSync(join(goldenDir, stale), { force: true });
+        }
+        return [];
+    }
+    const problems = [];
+    for (const [name, content] of Object.entries(actual)) {
+        const path = join(goldenDir, name);
+        if (!existsSync(path)) {
+            problems.push(`${name}: no golden file yet`);
+        }
+        else if (normalize(readFileSync(path, "utf-8")) !== normalize(content)) {
+            problems.push(`${name}: generated output differs from its golden file`);
+        }
+    }
+    for (const stale of staleGoldens(actual, goldenDir)) {
+        problems.push(`${stale}: golden file that nothing generates any more`);
+    }
+    return problems;
+}
+function staleGoldens(actual, goldenDir) {
+    if (!existsSync(goldenDir))
+        return [];
+    return readdirSync(goldenDir).filter((name) => !(name in actual));
+}

package/cli/dist/generator/extension-fetch.js

@@ -0,0 +1,291 @@
+// Copyright (c) 2026 Flisk Landscape contributors
+// SPDX-License-Identifier: MIT
+// Fetches the paid-tier "premium" resource bundle (playwright, c4-diagram,
+// logging, agents-md, sablier, verdaccio, and a few other extras - see
+// tdk-cli-extensions/premium/) from the gated distribution worker, when a
+// license key is configured. The free engine never needs this for its own
+// resources - docker-compose, npm, bun, etc. are already public in this
+// repo, no key required.
+//
+// DDD (domain-driven-design scaffolding) is the one paid feature that is
+// NOT a file overlay: it's gated separately by hasDddLicense() below, via
+// the shared hasLiveResourceLicense() helper, since its code stays in this
+// public repo and is turned on/off by a runtime check rather than swapped
+// in - see that helper's own comment for why it can't just be added to
+// KNOWN_RESOURCES. hasVerdaccioLicense()/hasSablierLicense() also use that
+// same helper, but only to print a "this needs a license" warning in
+// template-engine.ts - Verdaccio and Sablier's real gate is the file
+// overlay above (their public files are disabled stubs, not gated code).
+//
+// The worker (tdk-extension-dist) is the real access-control boundary: it
+// checks the key against BUNDLES_REPO/keys/*.json - existence, activation/
+// expiry dates, granted resources, and a per-key project limit - before
+// serving anything. This client just asks and, if granted, unpacks the
+// result over the vendored stub files so the generator pipeline picks up
+// the real implementations transparently. See
+// tdk-extension-dist/src/index.ts for the server-side enforcement and
+// tdk-extension-dist/src/project-limit.ts for the project-limit logic.
+import { randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { extractTarball } from "../utils/tar.js";
+const DEFAULT_ENDPOINT = "https://tdk-extension-dist.oranguman.workers.dev/v1/premium/bundle.tar.gz";
+// Tried in order until one is granted - the worker unlocks the whole
+// bundle on the first resource name a key is found to grant, since
+// premium.tar.gz ships all paid resources together. Keep in sync with
+// what issue-key.yml/update-key.yml accept as `resources` entries.
+const KNOWN_RESOURCES = [
+    "playwright",
+    "c4-diagram",
+    "logging",
+    "agents-md",
+    "sablier",
+    "verdaccio",
+];
+// Re-check the license periodically rather than trusting a local cache
+// forever - an expired or revoked key shouldn't keep unlocking premium
+// content indefinitely just because it worked once.
+const CACHE_TTL_MS = 12 * 60 * 60 * 1000;
+// Maps each file's path inside premium.tar.gz to where it belongs in the
+// vendored engine output, so the generator pipeline finds it in the same
+// place the free stub (or, for the never-wired items, nothing at all)
+// used to be.
+const PREMIUM_PATH_MAP = {
+    "typescript/playwright_config.star": "engine/topologies/tilt/generators/typescript/playwright_config.star",
+    "generators/agents_md.star": "engine/topologies/tilt/generators/agents_md.star",
+    "c4_diagram.star": "engine/topologies/tilt/generators/c4_diagram.star",
+    "observability/logging.star": "engine/topologies/platform/observability/logging.star",
+    "generators/database_provisioner.star": "engine/topologies/tilt/generators/database_provisioner.star",
+    "generators/dependency_manifest.star": "engine/topologies/tilt/generators/dependency_manifest.star",
+    "generators/fixed_frontend_tsconfig.star": "engine/topologies/tilt/generators/typescript/fixed_frontend_tsconfig.star",
+    "synthetic_monitor.star": "engine/resources/synthetic_monitor.star",
+    "synthetic-monitor-topology.star": "engine/topologies/platform/services/synthetic-monitor.star",
+    "database-management-service.yaml": "platform/services/platform/database-management/service.yaml",
+    "networking/sablier_container_cycle.star": "engine/topologies/platform/docker/networking/sablier_container_cycle.star",
+    "registries/verdaccio_loader.star": "engine/topologies/platform/registries/verdaccio_loader.star",
+};
+function getLicenseKey() {
+    return process.env.TDK_LICENSE_KEY?.trim() || null;
+}
+function getEndpoint() {
+    return process.env.TDK_PREMIUM_ENDPOINT?.trim() || DEFAULT_ENDPOINT;
+}
+// A stable per-project id for the worker's project-limit tracking - not a
+// device or user id. Generated once and persisted alongside the rest of
+// the project's .tdk/ state.
+function getOrCreateProjectId(projectRoot) {
+    const idPath = join(projectRoot, ".tdk", ".project-id");
+    if (existsSync(idPath)) {
+        return readFileSync(idPath, "utf-8").trim();
+    }
+    const id = randomUUID();
+    mkdirSync(join(projectRoot, ".tdk"), { recursive: true });
+    writeFileSync(idPath, `${id}\n`);
+    return id;
+}
+function cacheTarballPath(key) {
+    // Cache is per-key (not shared across different keys on the same
+    // machine) so switching license keys doesn't serve a stale bundle
+    // fetched under a different plan.
+    const safeName = key.replace(/[^a-zA-Z0-9_-]/g, "_");
+    return join(homedir(), ".tdk", "cache", `premium-${safeName}`, "premium.tar.gz");
+}
+function isCacheFresh(path) {
+    if (!existsSync(path))
+        return false;
+    return Date.now() - statSync(path).mtimeMs < CACHE_TTL_MS;
+}
+// Sends the key as `Authorization: Bearer`, never in the URL, where request
+// logs and proxies record it. A worker deployed before it read the header
+// answers 401 "missing key" (a current one only returns 401 when it gets no
+// key at all), so retry that once with the old `?key=` - premium keeps
+// working until the worker is updated. Drop the retry once it is.
+async function fetchPremium(key, resource, projectId) {
+    const url = `${getEndpoint()}?resource=${encodeURIComponent(resource)}` +
+        `&projectId=${encodeURIComponent(projectId)}`;
+    const res = await fetch(url, { headers: { Authorization: `Bearer ${key}` } });
+    if (res.status !== 401)
+        return res;
+    await res.arrayBuffer().catch(() => undefined);
+    return fetch(`${url}&key=${encodeURIComponent(key)}`);
+}
+async function fetchPremiumBundle(key, projectId) {
+    const attempts = [];
+    for (const resource of KNOWN_RESOURCES) {
+        let res;
+        try {
+            res = await fetchPremium(key, resource, projectId);
+        }
+        catch (err) {
+            console.warn(`⚠️  Premium fetch failed (network error): ${err.message}`);
+            return null;
+        }
+        if (res.ok) {
+            const bundle = Buffer.from(await res.arrayBuffer());
+            console.info(`🔎 Premium entitlement probe: granted resource=${resource} (HTTP ${res.status}); prior denials=${attempts.join(", ") || "none"}`);
+            console.info(`🔎 Premium bundle download: ${bundle.byteLength} bytes`);
+            return bundle;
+        }
+        if (res.status === 401 || res.status === 403) {
+            // Not granted for this specific resource name - try the next one
+            // before concluding the key has nothing to offer.
+            attempts.push(`${resource}=${res.status}`);
+            continue;
+        }
+        // Anything else (404 missing bundle release, 502 upstream failure,
+        // etc.) won't be fixed by trying a different resource name.
+        console.warn(`⚠️  Premium fetch failed: ${resource} returned HTTP ${res.status}; prior entitlement probes: ${attempts.join(", ") || "none"}`);
+        return null;
+    }
+    console.warn(`⚠️  Premium entitlement probes denied: ${attempts.join(", ")}`);
+    return null;
+}
+/**
+ * Fetches (with a local, time-limited cache) the premium bundle for the
+ * configured license key and overlays its files onto the already-vendored
+ * free engine at destDir. Best-effort: returns false (never throws) if
+ * there's no key configured, the key doesn't grant anything, or the fetch
+ * fails - the caller should keep going with the free engine either way.
+ */
+export async function applyPremiumOverlay(projectRoot, destDir) {
+    const key = getLicenseKey();
+    if (!key)
+        return false;
+    const tarballPath = cacheTarballPath(key);
+    if (!isCacheFresh(tarballPath)) {
+        console.info("🔎 Premium bundle cache: miss; requesting bundle from distribution service");
+        const projectId = getOrCreateProjectId(projectRoot);
+        const bundle = await fetchPremiumBundle(key, projectId);
+        if (!bundle) {
+            console.warn("⚠️  No premium resources unlocked for this key - using free tier only.");
+            return false;
+        }
+        mkdirSync(join(tarballPath, ".."), { recursive: true });
+        writeFileSync(tarballPath, bundle);
+    }
+    else {
+        console.info("🔎 Premium bundle cache: hit (cached bundle reused)");
+    }
+    try {
+        const extractDir = join(tarballPath, "..", "extracted");
+        mkdirSync(extractDir, { recursive: true });
+        extractTarball(readFileSync(tarballPath), extractDir);
+        let applied = 0;
+        const missing = [];
+        for (const [src, dest] of Object.entries(PREMIUM_PATH_MAP)) {
+            const from = join(extractDir, src);
+            if (!existsSync(from)) {
+                missing.push(src);
+                continue;
+            }
+            const to = join(destDir, dest);
+            mkdirSync(join(to, ".."), { recursive: true });
+            writeFileSync(to, readFileSync(from));
+            applied++;
+        }
+        const sablierPath = join(extractDir, "networking/sablier_container_cycle.star");
+        console.info(`🔎 Premium bundle contents: mapped=${applied}/${Object.keys(PREMIUM_PATH_MAP).length}; sablier_overlay=${existsSync(sablierPath) ? "present" : "MISSING"}`);
+        if (missing.length > 0) {
+            console.info(`🔎 Premium bundle missing mapped files: ${missing.join(", ")}`);
+        }
+        if (!existsSync(sablierPath) && process.env.TDK_PREMIUM_DIAGNOSTICS === "1") {
+            const sablierGranted = await hasSablierLicense(projectRoot);
+            console.info(`🔎 Sablier entitlement check: ${sablierGranted ? "granted" : "not confirmed"}; compare with sablier_overlay above to distinguish license access from bundle contents`);
+        }
+        if (applied > 0) {
+            console.log(`✓ Premium resources unlocked (${applied} file${applied === 1 ? "" : "s"})`);
+            return true;
+        }
+        return false;
+    }
+    catch (err) {
+        console.warn(`⚠️  Failed to apply premium overlay: ${err.message}`);
+        return false;
+    }
+}
+function liveResourceAccessCachePath(key, resource) {
+    const safeName = key.replace(/[^a-zA-Z0-9_-]/g, "_");
+    return join(homedir(), ".tdk", "cache", `premium-${safeName}`, `${resource}-access.json`);
+}
+/**
+ * Checks whether the configured license key grants a given "live" premium
+ * resource. Originally added for resources with nothing to swap on disk
+ * (ddd is still exactly that: gated code baked into the free engine, no
+ * file overlay). verdaccio and sablier also use this - not because they
+ * lack a PREMIUM_PATH_MAP entry (they have one now), but because their
+ * public files are already disabled stubs regardless of license, so this
+ * check only ever drives a "you need a license for this" warning in
+ * template-engine.ts, never an actual enable/disable decision. Can't reuse
+ * KNOWN_RESOURCES/fetchPremiumBundle for that warning either: that loop
+ * stops at the FIRST resource the key grants and would report false for a
+ * key that grants this resource but not, say, playwright (or vice versa).
+ *
+ * Best-effort: returns false (never throws) if there's no key, the fetch
+ * fails, or the worker denies the resource - the caller decides what "not
+ * licensed" means. Caches the grant/deny outcome (not the bundle itself,
+ * which we never need here) for CACHE_TTL_MS so repeated checks don't
+ * re-download the full premium.tar.gz just to read a status code.
+ */
+async function hasLiveResourceLicense(projectRoot, resource) {
+    const key = getLicenseKey();
+    if (!key)
+        return false;
+    const cachePath = liveResourceAccessCachePath(key, resource);
+    if (isCacheFresh(cachePath)) {
+        try {
+            const cached = JSON.parse(readFileSync(cachePath, "utf-8"));
+            console.info(`🔎 ${resource} entitlement probe: cache=${cached.granted === true ? "granted" : "denied"}`);
+            return cached.granted === true;
+        }
+        catch {
+            // Corrupt/unreadable cache - fall through and re-check live.
+        }
+    }
+    const projectId = getOrCreateProjectId(projectRoot);
+    let granted = false;
+    try {
+        const res = await fetchPremium(key, resource, projectId);
+        granted = res.ok;
+        console.info(`🔎 ${resource} entitlement probe: HTTP ${res.status} (${granted ? "granted" : "denied"})`);
+        // Drain the body (a full premium.tar.gz on success) so we don't leave
+        // it dangling - we only need the status, not the content.
+        if (res.body) {
+            await res.arrayBuffer().catch(() => undefined);
+        }
+    }
+    catch (err) {
+        console.warn(`⚠️  ${resource} license check failed (network error): ${err.message}`);
+        return false;
+    }
+    try {
+        mkdirSync(join(cachePath, ".."), { recursive: true });
+        writeFileSync(cachePath, JSON.stringify({ granted, checked: new Date().toISOString() }));
+    }
+    catch {
+        // Best-effort cache; a write failure just means we re-check next time.
+    }
+    return granted;
+}
+/** Checks whether the configured license key grants the "verdaccio" resource. */
+export async function hasVerdaccioLicense(projectRoot) {
+    return hasLiveResourceLicense(projectRoot, "verdaccio");
+}
+/**
+ * Checks whether the configured license key grants the "ddd" resource
+ * (domain-driven-design folder structure + path aliases for backend
+ * resources - see generate_backend_path_aliases() in
+ * engine/topologies/tilt/generators/vite/helpers.star).
+ */
+export async function hasDddLicense(projectRoot) {
+    return hasLiveResourceLicense(projectRoot, "ddd");
+}
+/**
+ * Checks whether the configured license key grants the "sablier" resource
+ * (on-demand start/stop for idle resources via a `sablier: {enable: true}`
+ * manifest block - see sablier_container_cycle.star in
+ * engine/topologies/platform/docker/networking/).
+ */
+export async function hasSablierLicense(projectRoot) {
+    return hasLiveResourceLicense(projectRoot, "sablier");
+}

package/cli/dist/generator/resource-templates.js

@@ -0,0 +1,133 @@
+// Copyright (c) 2026 Flisk Landscape contributors
+// SPDX-License-Identifier: MIT
+/**
+ * The plain `Dockerfile` written next to service.json. `flisk up` does not build it: for generated
+ * resources the engine builds `.autogenerated/Dockerfile.app.autogenerated`. It is a starting point
+ * for building the service image outside Flisk, so its port follows the service's `port`.
+ */
+export function getDockerfileTemplate(port, healthCheckPath) {
+    // `oven/bun` has no curl, so the probe uses bun itself.
+    const healthcheck = healthCheckPath
+        ? `# Health check
+HEALTHCHECK --interval=10s --timeout=5s --retries=3 \\
+  CMD bun -e "fetch('http://localhost:${port}${healthCheckPath}').then((r) => process.exit(r.ok ? 0 : 1), () => process.exit(1))"
+
+`
+        : "";
+    return `# Scaffolded by \`flisk resource\`. \`flisk up\` does NOT build this file: it builds
+# .autogenerated/Dockerfile.app.autogenerated (golden layers, project root as context).
+# Use this one as a starting point for building the image outside Flisk, and keep its
+# port in step with "port" in service.json.
+FROM oven/bun:1.2
+
+WORKDIR /app
+
+# Copy package files (bun.lock is optional: a Flisk workspace keeps it at the project root)
+COPY package.json bun.lock* ./
+
+# Install dependencies
+RUN bun install
+
+# Copy source
+COPY . .
+
+# Build if needed
+RUN bun run build
+
+${healthcheck}ENV PORT=${port}
+EXPOSE ${port}
+
+CMD ["bun", "run", "start"]
+`;
+}
+export function getShutdownHandlerTemplate(signal) {
+    return `process.on('${signal}', () => {
+  console.log('[Worker] ${signal} received, shutting down gracefully...');
+  process.exit(0);
+});`;
+}
+export function getWorkerIndexTemplate(name) {
+    return `console.log('🚀 ${name} worker started');
+
+interface Job {
+  id: string;
+  type: string;
+  payload: Record<string, unknown>;
+  priority?: number;
+  timestamp?: string;
+}
+
+const CONFIG = {
+  pollIntervalMs: parseInt(process.env.WORKER_POLL_INTERVAL || '5000'),
+  maxRetries: parseInt(process.env.WORKER_MAX_RETRIES || '3'),
+  batchSize: parseInt(process.env.WORKER_BATCH_SIZE || '10'),
+};
+
+async function processJob(job: Job): Promise<void> {
+  console.log('[Worker] Processing job:', job.id, 'type:', job.type);
+
+  // Add job processing logic here using job.payload
+
+  await new Promise(resolve => setTimeout(resolve, 1000));
+  console.log('[Worker] Job completed:', job.id);
+}
+
+let demoJobSent = false;
+
+async function fetchJobs(): Promise<Job[]> {
+  // Connect to your queue (Redis, RabbitMQ, etc.) and fetch jobs.
+  // Until you do, hand out one demo job on the first poll so the loop runs end to end; remove this with the queue.
+  if (demoJobSent) return [];
+  demoJobSent = true;
+  return [{ id: 'demo-1', type: 'demo', payload: {} }];
+}
+
+async function main() {
+  console.log('[Worker] Configuration:', CONFIG);
+
+  while (true) {
+    try {
+      const jobs = await fetchJobs();
+
+      if (jobs.length === 0) {
+        await new Promise(resolve => setTimeout(resolve, CONFIG.pollIntervalMs));
+        continue;
+      }
+
+      console.log(\`[Worker] Fetched \${jobs.length} jobs\`);
+
+      for (const job of jobs) {
+        try {
+          await processJob(job);
+        } catch (error: unknown) {
+          console.error('[Worker] Job failed:', error);
+        }
+      }
+    } catch (error: unknown) {
+      console.error('[Worker] Error in main loop:', error);
+      // Wait before retrying to avoid tight error loops
+      await new Promise(resolve => setTimeout(resolve, CONFIG.pollIntervalMs));
+    }
+  }
+}
+
+${getShutdownHandlerTemplate("SIGTERM")}
+
+${getShutdownHandlerTemplate("SIGINT")}
+
+main().catch((err) => {
+  console.error('[Worker] Fatal error:', err);
+  process.exit(1);
+});
+`;
+}
+export function getTestTemplate(name) {
+    return `import { describe, it, expect } from 'vitest';
+
+describe('${name}', () => {
+  it('should pass a basic test', () => {
+    expect(true).toBe(true);
+  });
+});
+`;
+}