@flisk-sh/flisk 0.0.0-stage → 1.3.190

package/engine/topologies/platform/docker/build/frontend_build_plan.star

@@ -0,0 +1,65 @@
+# =============================================================================
+# 🏗️ TILT SDK - FRONTEND BUILD PLAN
+# =============================================================================
+# Decides how a frontend image runs its production build.
+#
+# A `"build": "tsc --noEmit && vite build"` script (the restaurant example uses it). Running that script
+# inside the image build makes the type-check block the image and compete for
+# CPU with other builds. When the script has exactly that standard shape, the
+# image runs `vite build` directly and the type-check becomes a separate,
+# non-blocking Tilt resource. Any other script runs unchanged.
+# =============================================================================
+
+DEFAULT_FRONTEND_BUILD_CMD = 'bun run build'
+
+# Only a non-emitting type-check is moved out of the image. A plain `tsc` writes output that the build may
+# use (the CLI scaffold's tsconfig emits to ./dist), so that script keeps running unchanged in the image.
+_TSC_FORMS = ['tsc --noEmit']
+# The generated config is copied into the image; any other config file is not, so a script that selects one is not used.
+_IMAGE_CONFIG_DIR = '.autogenerated/'
+_VITE_BUILD = 'vite build'
+
+
+def _default_plan():
+    return {'build_cmd': DEFAULT_FRONTEND_BUILD_CMD, 'typecheck': False, 'typecheck_cmd': ''}
+
+
+def frontend_build_plan(package_json_path):
+    """Returns {'build_cmd', 'typecheck', 'typecheck_cmd'} for the package.json at package_json_path.
+
+    build_cmd is the command the image runs; the generated Vite config is appended to it.
+    typecheck is True only when the standard `tsc --noEmit && vite build` form was recognised;
+    typecheck_cmd is then the host command for the non-blocking type-check resource.
+    A missing or unreadable package.json, or any other script, gets the default plan.
+    """
+    if not os.path.exists(package_json_path):
+        return _default_plan()
+
+    scripts = read_json(package_json_path).get('scripts', {})
+    script = scripts.get('build', '').strip()
+    steps = script.split(' && ')
+    if len(steps) != 2:
+        return _default_plan()
+
+    typecheck_step = steps[0].strip()
+    vite_step = steps[1].strip()
+    if typecheck_step not in _TSC_FORMS:
+        return _default_plan()
+    if vite_step != _VITE_BUILD and not vite_step.startswith(_VITE_BUILD + ' '):
+        return _default_plan()
+
+    # Flags after `vite build` are kept. A --config must name the generated config, which the image copies.
+    extra_args = vite_step[len(_VITE_BUILD):]
+    tokens = extra_args.split()
+    for i, token in enumerate(tokens):
+        value = ''
+        if token == '--config' and i + 1 < len(tokens):
+            value = tokens[i + 1]
+        elif token.startswith('--config='):
+            value = token[len('--config='):]
+        else:
+            continue
+        if not value.startswith(_IMAGE_CONFIG_DIR):
+            return _default_plan()
+
+    return {'build_cmd': 'bunx vite build' + extra_args, 'typecheck': True, 'typecheck_cmd': 'bunx tsc --noEmit'}

package/engine/topologies/platform/docker/build/golden_image.star

@@ -0,0 +1,37 @@
+# =============================================================================
+# 🏗️ TILT SDK - GOLDEN LAYERED IMAGES PROVIDER
+# =============================================================================
+# Purpose: Public API facade for golden layered image orchestration.
+# =============================================================================
+
+load('./golden_image_constants.star',
+    'GOLDEN_IMAGE_PREFIX',
+    'GOLDEN_LAYERS',
+    'get_layer_reference',
+)
+load('./golden_image_build.star', 'build_golden_layers')
+load('./golden_image_dockerfile.star', 'generate_golden_dockerfile')
+
+
+GoldenImage = struct(
+    # Build functions
+    build = build_golden_layers,
+
+    # Reference getters
+    get_layer = get_layer_reference,
+    l1 = lambda: get_layer_reference('l1'),
+    l2 = lambda: get_layer_reference('l2'),
+    l3_backend = lambda: get_layer_reference('l3-backend'),
+    l3_frontend = lambda: get_layer_reference('l3-frontend'),
+    l3_migrator = lambda: get_layer_reference('l3-migrator'),
+    l4_backend = lambda: get_layer_reference('l4-backend'),
+    l4_frontend = lambda: get_layer_reference('l4-frontend'),
+    l4_migrator = lambda: get_layer_reference('l4-migrator'),
+
+    # Constants
+    layers = GOLDEN_LAYERS,
+    prefix = GOLDEN_IMAGE_PREFIX,
+
+    # Generators
+    generate_dockerfile = generate_golden_dockerfile,
+)

package/engine/topologies/platform/docker/build/golden_image_build.star

@@ -0,0 +1,144 @@
+# =============================================================================
+# 🏗️ TILT SDK - GOLDEN IMAGE BUILDERS
+# =============================================================================
+
+load('./golden_image_constants.star', 'GOLDEN_DOCKERFILE', 'GOLDEN_IMAGE_PREFIX', 'GOLDEN_LAYERS', 'LEGACY_GOLDEN_IMAGES')
+
+# Label that records which golden Dockerfile an image was built from.
+GOLDEN_HASH_LABEL = 'tdk.golden.hash'
+
+# Shell template for the golden build. Placeholders (@@...@@) are replaced in
+# build_golden_layers(); plain `$VAR` references are expanded by the shell.
+_GOLDEN_BUILD_TEMPLATE = '''
+DF_REL=@@DF_REL@@
+ROOT_REL=@@ROOT_REL@@
+DF="$(cd "$(dirname "$DF_REL")" && pwd)/$(basename "$DF_REL")"
+ROOT="$(cd "$ROOT_REL" && pwd)"
+HASH="$(cat "$DF" | (sha256sum 2>/dev/null || shasum -a 256) | cut -c1-64)"
+IMAGES="@@IMAGES@@"
+
+if [ -z "$TDK_GOLDEN_REBUILD" ]; then
+  fresh=1
+  for img in $IMAGES; do
+    [ "$(docker image inspect -f '{{index .Config.Labels "@@HASH_LABEL@@"}}' "$img" 2>/dev/null)" = "$HASH" ] || fresh=0
+  done
+  if [ "$fresh" = 1 ]; then
+    echo "✅ Golden images are up to date (hash $HASH) - skipping build"
+    exit 0
+  fi
+fi
+
+echo "🏗️  Building golden layered images (@@COUNT@@ total)..."
+if docker buildx version >/dev/null 2>&1; then
+  echo "  🧩 Building all golden targets with one docker buildx bake (independent stages run in parallel)"
+  cat > golden-layers.bake.hcl <<HCL
+variable "HASH" {
+  default = ""
+}
+
+group "default" {
+  targets = [@@TARGET_NAMES@@]
+}
+@@BAKE_TARGETS@@
+HCL
+  # Buildx 0.19 and later ask for read access outside the bake file's directory; older releases do not know the flag.
+  BUILDX_VER="$(docker buildx version 2>/dev/null | sed -n 's/.* v\\([0-9]*\\)\\.\\([0-9]*\\).*/\\1 \\2/p')"
+  BUILDX_MAJOR="${BUILDX_VER%% *}"
+  BUILDX_MINOR="${BUILDX_VER##* }"
+  BAKE_ALLOW=""
+  if [ "${BUILDX_MAJOR:-0}" -gt 0 ] || [ "${BUILDX_MINOR:-0}" -ge 19 ]; then BAKE_ALLOW="--allow fs.read=$ROOT"; fi
+  HASH="$HASH" docker buildx bake $BAKE_ALLOW -f golden-layers.bake.hcl --load
+else
+  echo "  ⚠️  docker buildx is not available - building golden targets one at a time"
+  @@SERIAL_BUILDS@@
+fi
+
+# Untag golden images that older engines built and nothing uses now; an image still in use is left alone.
+for img in @@LEGACY_IMAGES@@; do
+  docker image rm "$img" >/dev/null 2>&1 && echo "  🧹 Removed legacy golden image $img"
+done
+
+echo "✅ Golden layers built (@@COUNT@@ images):"
+@@SUMMARY@@
+'''
+
+
+def _sh_quote(text):
+    return "'" + text.replace("'", "'\\''") + "'"
+
+
+def build_golden_layers(project_root='.'):
+    """
+    Build all golden layer images using local_resource.
+    Returns the resource name for dependency tracking.
+
+    project_root: path back to the project root from wherever
+    local_resource cmds actually run (the Tiltfile's own directory,
+    .tdk/.tdk-out/ - not the project root), e.g. '../../'. GOLDEN_DOCKERFILE
+    is itself project-root-relative, so it must be prefixed with this to
+    resolve correctly - passing project_root='.' (the default) only works
+    when the Tiltfile happens to live at the project root.
+
+    The build is skipped when every golden image already exists with a
+    `tdk.golden.hash` label matching the current Dockerfile. Set
+    TDK_GOLDEN_REBUILD=1 to force a rebuild. Otherwise all targets are built
+    with one `docker buildx bake`, falling back to serial `docker build` when
+    buildx is not installed.
+    """
+    resource_name = 'golden-layers-build'
+    dockerfile_from_tiltfile = (
+        GOLDEN_DOCKERFILE if project_root in (None, '.', '')
+        else project_root.rstrip('/') + '/' + GOLDEN_DOCKERFILE
+    )
+    context = project_root or '.'
+
+    images = []
+    summary = []
+    bake_targets = []
+    serial_builds = []
+    target_names = []
+    for key in GOLDEN_LAYERS:
+        layer = GOLDEN_LAYERS[key]
+        ref = layer['name'] + ':' + layer['tag']
+        images.append(ref)
+        summary.append('echo "  ✓ ' + ref + '"')
+        target_names.append('"' + key + '"')
+        bake_targets.append('''target "{key}" {{
+  dockerfile = "$DF"
+  context = "$ROOT"
+  target = "{target}"
+  tags = ["{ref}"]
+  labels = {{
+    "{label}" = HASH
+  }}
+}}
+'''.format(key=key, target=layer['target'], ref=ref, label=GOLDEN_HASH_LABEL))
+        serial_builds.append(
+            'docker build --label "{label}=$HASH" -f "$DF" --target {target} -t {ref} "$ROOT" || exit 1'.format(
+                label=GOLDEN_HASH_LABEL, target=layer['target'], ref=ref,
+            )
+        )
+
+    cmd = (_GOLDEN_BUILD_TEMPLATE
+        .replace('@@DF_REL@@', _sh_quote(dockerfile_from_tiltfile))
+        .replace('@@ROOT_REL@@', _sh_quote(context))
+        .replace('@@IMAGES@@', ' '.join(images))
+        .replace('@@LEGACY_IMAGES@@', ' '.join(LEGACY_GOLDEN_IMAGES))
+        .replace('@@HASH_LABEL@@', GOLDEN_HASH_LABEL)
+        .replace('@@COUNT@@', str(len(images)))
+        .replace('@@TARGET_NAMES@@', ', '.join(target_names))
+        .replace('@@BAKE_TARGETS@@', '\n'.join(bake_targets))
+        .replace('@@SERIAL_BUILDS@@', '\n  '.join(serial_builds))
+        .replace('@@SUMMARY@@', '\n'.join(summary))
+    )
+
+    local_resource(
+        resource_name,
+        cmd=cmd,
+        labels=['infra.docker', 'golden-layers'],
+        deps=[dockerfile_from_tiltfile],
+        allow_parallel=True,
+        auto_init=True,
+    )
+
+    return resource_name

package/engine/topologies/platform/docker/build/golden_image_constants.star

@@ -0,0 +1,100 @@
+# =============================================================================
+# 🏗️ TILT SDK - GOLDEN IMAGE CONSTANTS
+# =============================================================================
+
+# Load project configuration to get the project name as prefix
+# Falls back to 'tdk-project' if project.json is not found
+# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+def _load_golden_prefix():
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_json_path = '.tdk/project.json'
+    if project_root:
+        project_json_path = project_root + '/' + project_json_path
+    
+    if os.path.exists(project_json_path):
+        _project_json = read_json(project_json_path)
+        return _project_json.get('project', {}).get('name', 'tdk-project')
+    return 'tdk-project'
+
+_GOLDEN_IMAGE_PREFIX = _load_golden_prefix()
+
+GOLDEN_IMAGE_PREFIX = _GOLDEN_IMAGE_PREFIX
+GOLDEN_DOCKERFILE = '.tdk/.tdk-out/golden-layers.Dockerfile'
+
+GOLDEN_LAYERS = {
+    'l1': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l1',
+        'tag': 'latest',
+        'description': 'OS base + runtime environment',
+        'target': 'l1_golden',
+    },
+    'l2': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l2',
+        'tag': 'latest',
+        'description': 'Dependencies + node_modules',
+        'target': 'l2_golden',
+    },
+    'l3-backend': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l3-backend',
+        'tag': 'latest',
+        'description': 'Backend build tools (Prisma only, Infisical CLI skipped to avoid CDN hangs)',
+        'target': 'l3_backend_golden',
+    },
+    'l3-frontend': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l3-frontend',
+        'tag': 'latest',
+        'description': 'Frontend build tools (no Prisma)',
+        'target': 'l3_frontend_golden',
+    },
+    'l4-backend': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l4-backend',
+        'tag': 'latest',
+        'description': 'Backend production runtime (Bun, no Infisical CLI)',
+        'target': 'l4_backend_bun',
+    },
+    'l4-backend-node': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l4-backend-node',
+        'tag': 'latest',
+        'description': 'Backend production runtime (Node.js - lightweight, no Infisical CLI)',
+        'target': 'l4_backend_node',
+    },
+    'l4-frontend': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l4-frontend',
+        'tag': 'latest',
+        'description': 'Frontend production runtime',
+        'target': 'l4_frontend_golden',
+    },
+    'l4-migrator': {
+        'name': GOLDEN_IMAGE_PREFIX + '-l4-migrator',
+        'tag': 'latest',
+        'description': 'Migrator production runtime (no Infisical CLI - uses env vars)',
+        'target': 'l4_migrator_golden',
+    },
+}
+
+
+# Layers that are no longer built, mapped to the layer that replaced them.
+# l3-migrator installed the same Prisma as l3-backend and produced identical layers.
+LAYER_ALIASES = {
+    'l3-migrator': 'l3-backend',
+}
+
+# Image names older engines built that nothing uses now; the golden build untags them.
+LEGACY_GOLDEN_IMAGES = [
+    GOLDEN_IMAGE_PREFIX + '-l3-migrator:latest',
+]
+
+
+def get_layer_reference(layer):
+    """Returns the full image reference for a specific layer."""
+    layer = LAYER_ALIASES.get(layer, layer)
+    if layer not in GOLDEN_LAYERS:
+        fail("Invalid layer: " + layer + ". Must be one of: l1, l2, l3, l4")
+
+    layer_info = GOLDEN_LAYERS[layer]
+    return '{name}:{tag}'.format(
+        name=layer_info['name'],
+        tag=layer_info['tag'],
+    )
+
+CONSTANTS = {}

package/engine/topologies/platform/docker/build/golden_image_dockerfile.star

@@ -0,0 +1,263 @@
+# =============================================================================
+# 🏗️ TILT SDK - GOLDEN IMAGE DOCKERFILE GENERATOR
+# =============================================================================
+
+load('../../../tilt/common/utils.star', 'Utils')
+load('../config/healthcheck.star', 'DOCKER_HEALTHCHECK', 'dockerfile_healthcheck_flags')
+
+
+# Load project name for dynamic naming
+# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+def _load_golden_prefix():
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_json_path = '.tdk/project.json'
+    if project_root:
+        project_json_path = project_root + '/' + project_json_path
+    
+    if os.path.exists(project_json_path):
+        _project_json = read_json(project_json_path)
+        return _project_json.get('project', {}).get('name', 'tdk-project')
+    return 'tdk-project'
+
+_GOLDEN_PREFIX = _load_golden_prefix()
+
+def generate_golden_dockerfile():
+    """Generate the multi-stage golden-layers.Dockerfile."""
+    prefix = _GOLDEN_PREFIX
+    header = Utils.get_template_header(
+        'dockerfile',
+        'GoldenImage.generate_layered_dockerfile()',
+        prefix + '-l1-l4',
+        'GOLDEN LAYERED IMAGES | L1-L4 Pre-built Layers',
+    )
+
+    return header + """
+# =============================================================================
+# 🏗️ GOLDEN LAYERED IMAGES - Multi-Stage Base Images
+# =============================================================================
+# This Dockerfile builds 8 golden images:
+#   - """ + prefix + """-l1:latest - OS base + Bun runtime
+#   - """ + prefix + """-l2:latest - Dependencies installed
+#   - """ + prefix + """-l3-backend:latest - Backend and migrator build tools (Prisma, no Infisical CLI)
+#   - """ + prefix + """-l3-frontend:latest - Frontend build tools (no Prisma)
+#   - """ + prefix + """-l4-backend:latest - Backend production runtime (Bun)
+#   - """ + prefix + """-l4-backend-node:latest - Backend production runtime (Node.js)
+#   - """ + prefix + """-l4-frontend:latest - Frontend production runtime (Nginx)
+#   - """ + prefix + """-l4-migrator:latest - Migrator production runtime
+#
+# Migrators build on l3-backend: a separate l3-migrator stage installed the same Prisma
+# and produced identical layers under a second image name.
+#
+# Services use these as base images to skip heavy dependency installation.
+#
+# ⚠️ SKIP_INFISICAL_SETUP Support:
+#   All generated Dockerfiles support --build-arg SKIP_INFISICAL_SETUP=1
+#   to bypass Infisical CLI installation (avoids Cloudsmith CDN hangs).
+#   When SKIP_INFISICAL_SETUP=1, secrets are read from env vars only.
+#   See: engine/topologies/platform/docker/layers/l3_builder_layers.star
+# =============================================================================
+
+# =============================================================================
+# L1: OS BASE + RUNTIME ENVIRONMENT
+# =============================================================================
+FROM oven/bun:1.3.11-alpine@sha256:7ed9f74c326d1c260abe247ac423ccbf5ac92af62bb442d515d1f92f21e8ea9b AS l1_golden
+
+LABEL layer="l1" \
+      description="OS base with runtime environment" \
+      maintainer="{prefix}"
+
+# System dependencies for all services
+RUN apk add --no-cache \
+    ca-certificates \
+    tzdata \
+    curl \
+    bash \
+    openssl
+
+# Create app user/group for security
+RUN addgroup -S app && adduser -S app -G app
+
+# Runtime environment
+ENV NODE_ENV=development \
+    BUN_INSTALL_CACHE_DIR=/cache/bun
+
+WORKDIR /app
+
+
+# =============================================================================
+# L2: DEPENDENCY RESOLVER
+# =============================================================================
+FROM l1_golden AS l2_golden
+
+LABEL layer="l2" \
+      description="Base with common dependencies installed" \
+      maintainer="{prefix}"
+
+# Install minimal debugging tools (removed: vim, python3, make, g++ = -67MB)
+RUN apk add --no-cache \
+    curl \
+    netcat-openbsd \
+    jq \
+    bind-tools
+
+# Pre-create cache directories
+RUN mkdir -p /cache/bun /cache/prisma
+
+# Bun is already installed in base image
+RUN echo "Bun version: $(bun --version)"
+
+
+# =============================================================================
+# L3-BACKEND: BACKEND BUILD TOOLS (PRISMA)
+# =============================================================================
+FROM l2_golden AS l3_backend_golden
+
+LABEL layer="l3-backend" \
+      description="Backend build tools with Prisma" \
+      maintainer="{prefix}"
+
+# Install Prisma CLI globally (pinned for deterministic builds)
+RUN bun add -g prisma@7.5.0 @prisma/client@7.5.0
+
+# Verify Prisma installation
+RUN echo "Prisma version: $(bunx prisma --version | head -1)"
+
+# ⚠️ CRITICAL: Infisical CLI is NOT installed in golden L3 images
+# Reason: curl to dl.cloudsmith.io hangs during Docker builds when CDN is slow
+# Solution: Use SKIP_INFISICAL_SETUP=1 build arg or runtime env var injection
+# Services read secrets from environment variables at runtime (no CLI needed)
+# See: .tilt/topologies/platform/docker/layers/l3_builder_layers.star
+
+
+# =============================================================================
+# L3-FRONTEND: FRONTEND BUILD TOOLS (NO PRISMA)
+# =============================================================================
+FROM l2_golden AS l3_frontend_golden
+
+LABEL layer="l3-frontend" \
+      description="Frontend build tools without Prisma" \
+      maintainer="{prefix}"
+
+# Frontend doesn't need Prisma, just verify Bun
+RUN echo "Bun version: $(bun --version)"
+
+
+# =============================================================================
+# L4-BACKEND-BUN: BACKEND PRODUCTION RUNTIME (BUN)
+# =============================================================================
+FROM l1_golden AS l4_backend_bun
+
+LABEL layer="l4-backend-bun" \
+      description="Backend production runtime (Bun)" \
+      maintainer="{prefix}"
+
+ENV NODE_ENV=production
+# Smaller heap growth and more frequent GC: idle services dominate a 100-service landscape.
+ENV BUN_OPTIONS=--smol
+
+# Service-specific tooling (e.g. hugo) is installed per service by the L4 runtime
+# layer when the manifest lists it in featuresEnabled - not here for every backend.
+
+# ⚠️ Infisical CLI is NOT installed in golden L4 images
+# Services use TypeScript SDK (fetch API) or read from env vars - no CLI needed
+# The entrypoint.sh gracefully handles missing CLI (falls back to env vars)
+# Build with --build-arg SKIP_INFISICAL_SETUP=1 to skip CLI installation
+
+USER bun
+
+# Backend-specific healthcheck: probes the service over HTTP. The image is shared by every backend,
+# so the port and path come from the container env (PORT is set by compose, TDK_HEALTH_PATH is optional).
+HEALTHCHECK {hc_flags} \
+  CMD bun -e "fetch('http://127.0.0.1:'+process.env.PORT+(process.env.TDK_HEALTH_PATH||'/health')).then(r=>process.exit(r.ok?0:1),()=>process.exit(1))" || exit 1
+
+WORKDIR /app
+
+
+# =============================================================================
+# L4-BACKEND-NODE: BACKEND PRODUCTION RUNTIME (NODE.JS - LIGHTWEIGHT!)
+# =============================================================================
+FROM node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402 AS l4_backend_node
+
+LABEL layer="l4-backend-node" \
+      description="Backend production runtime (Node.js - lightweight)" \
+      maintainer="{prefix}"
+
+ENV NODE_ENV=production
+
+# Minimal runtime dependencies
+RUN apk add --no-cache ca-certificates tzdata curl
+
+# Create app user for security
+RUN addgroup -S app && adduser -S app -G app
+
+# ⚠️ Infisical CLI is NOT installed in golden L4 images
+# Services read secrets from environment variables at runtime
+
+USER app
+
+# Backend-specific healthcheck: probes the service over HTTP (port and path from container env, see the Bun stage)
+HEALTHCHECK {hc_flags} \
+  CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+(process.env.TDK_HEALTH_PATH||'/health')).then(r=>process.exit(r.ok?0:1),()=>process.exit(1))" || exit 1
+
+WORKDIR /app
+
+
+# Alias for backwards compatibility - defaults to Bun (most efficient)
+FROM l4_backend_bun AS l4_backend_golden
+
+
+# =============================================================================
+# L4-FRONTEND: FRONTEND PRODUCTION RUNTIME
+# =============================================================================
+FROM nginx:1.27-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10 AS l4_frontend_golden
+
+LABEL layer="l4-frontend" \
+      description="Frontend production runtime with Nginx" \
+      maintainer="{prefix}"
+
+ENV NODE_ENV=production
+
+# Install curl for healthchecks
+RUN apk add --no-cache curl
+
+# Frontend-specific healthcheck (checks Nginx)
+HEALTHCHECK {hc_flags_frontend} \
+  CMD curl -f http://localhost/ || exit 1
+
+WORKDIR /usr/share/nginx/html
+
+
+# =============================================================================
+# L4-MIGRATOR: MIGRATOR PRODUCTION RUNTIME
+# =============================================================================
+FROM l1_golden AS l4_migrator_golden
+
+LABEL layer="l4-migrator" \
+      description="Migrator runtime with Prisma" \
+      maintainer="{prefix}"
+
+ENV NODE_ENV=production
+
+# Copy global Prisma installation from L3 (l3-backend carries the same pinned Prisma)
+COPY --from=l3_backend_golden /root/.bun/install/global /root/.bun/install/global
+
+# ⚠️ Infisical CLI is NOT included in golden L4 images
+# The migrator reads secrets directly from environment variables at runtime
+# (no entrypoint wrapper needed for database migrations)
+# Use --build-arg SKIP_INFISICAL_SETUP=1 to skip CLI installation in derived images
+
+# Ensure Bun cache path is writable for non-root runtime healthcheck commands.
+RUN mkdir -p /cache/bun && chown -R bun:bun /cache/bun
+
+USER bun
+
+# Migrators are one-shot jobs (migrate.sh runs to completion), so no healthcheck.
+# The per-service l4_migrator_runtime stage sets HEALTHCHECK NONE as well.
+HEALTHCHECK NONE
+
+WORKDIR /app
+""".format(
+    hc_flags=dockerfile_healthcheck_flags(),
+    hc_flags_frontend=dockerfile_healthcheck_flags(DOCKER_HEALTHCHECK["frontend_start_period_seconds"]),
+    prefix=_GOLDEN_PREFIX,
+)