@flisk-sh/flisk 0.0.0-stage → 1.3.190

package/engine/topologies/platform/docker/constants.star

@@ -0,0 +1,211 @@
+# Copyright (c) 2026 Flisk contributors
+# SPDX-License-Identifier: MIT
+# =============================================================================
+# 🐳 PLATFORM DOCKER CONSTANTS
+# =============================================================================
+# Centralized configuration constants for Docker Compose generation.
+# All DATABASE_URL formats, project names, runtime versions, and other
+# shared constants are defined here to ensure consistency across the topology.
+# =============================================================================
+
+# Load project name from project.json (makes Flisk CLI portable across projects)
+# Falls back to 'tdk_project' / 'tdk-project' if project.json not found
+# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+def _load_project_names():
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_json_path = '.tdk/project.json'
+    if project_root:
+        project_json_path = project_root + '/' + project_json_path
+    
+    if os.path.exists(project_json_path):
+        _project_json = read_json(project_json_path)
+        _PROJECT_NAME_HYPHEN = _project_json.get('project', {}).get('name', 'tdk-project')
+        # Convert hyphenated name to underscore (e.g., "my-project" -> "my_project")
+        _PROJECT_NAME = _PROJECT_NAME_HYPHEN.replace('-', '_')
+        return _PROJECT_NAME, _PROJECT_NAME_HYPHEN
+    return "tdk_project", "tdk-project"
+
+_PROJECT_NAME, _PROJECT_NAME_HYPHEN = _load_project_names()
+
+# Project name constants
+PROJECT_NAME = _PROJECT_NAME
+PROJECT_NAME_HYPHEN = _PROJECT_NAME_HYPHEN
+
+# Domain constants
+LOCAL_DOMAIN = PROJECT_NAME_HYPHEN + ".localhost"
+APP_SUBDOMAIN_PREFIX = "app"
+API_SUBDOMAIN_PREFIX = "api"
+APP_LOCAL_DOMAIN = APP_SUBDOMAIN_PREFIX + "." + LOCAL_DOMAIN
+API_LOCAL_DOMAIN = API_SUBDOMAIN_PREFIX + "." + LOCAL_DOMAIN
+EMAIL_DOMAIN = PROJECT_NAME_HYPHEN + ".local"
+
+# Published resource-config JSON Schema, same for every project (not project-specific like EMAIL_DOMAIN)
+RESOURCE_SCHEMA_URL = "https://tdk-landscape.github.io/schema.service.json"
+
+# NPM scope constant
+NPM_SCOPE = "@" + PROJECT_NAME_HYPHEN + "/"
+
+# Bun runtime constants
+BUN_VERSION = "1.3.11"
+BUN_IMAGE = "oven/bun:" + BUN_VERSION + "-alpine"
+
+# Database connection constants
+DB_USER = PROJECT_NAME
+DB_HOST = PROJECT_NAME + "_postgres"
+DB_PORT = "5432"
+# ⚠️ SECURITY: No default password - must be provided via DB_PASSWORD env var
+DB_PASSWORD_SHELL = "${DB_PASSWORD}"  # Requires DB_PASSWORD to be set
+DB_SCHEMA = "public"
+
+# Network names
+NETWORK_TRAEFIK_PUBLIC = PROJECT_NAME + "_traefik-public"
+NETWORK_BACKEND = PROJECT_NAME + "_backend"
+NETWORK_DATABASE = PROJECT_NAME + "_database"
+NETWORK_INFISICAL = PROJECT_NAME + "_infisical-network"
+NETWORK_PROXY = PROJECT_NAME + "_proxy"
+
+# Traefik file-provider dynamic config: one generated YAML per `sablier.deferStart`
+# resource's static route (see openspec/changes/prioritized-cold-start), mounted
+# read-only into the standalone Traefik container at /etc/traefik/dynamic.
+TRAEFIK_DYNAMIC_DIR_REL = ".tdk/.tdk-out/traefik-dynamic"
+TRAEFIK_WAKE_GATEWAY_CONTAINER = PROJECT_NAME_HYPHEN + "-wake-gateway"
+TRAEFIK_WAKE_GATEWAY_PORT = 9999
+
+# NATS constants
+NATS_HOST = PROJECT_NAME + "_nats"
+NATS_PORT = "4222"
+NATS_URL = "nats://" + NATS_HOST + ":" + NATS_PORT
+
+# Verdaccio constants
+VERDACCIO_PORT = 4873
+VERDACCIO_HOST = "localhost"
+VERDACCIO_HOST_DOCKER = "host.docker.internal"
+VERDACCIO_CONTAINER_NAME = PROJECT_NAME_HYPHEN + "-verdaccio"
+VERDACCIO_URL_LOCAL = "http://" + VERDACCIO_HOST + ":" + str(VERDACCIO_PORT)
+VERDACCIO_URL_DOCKER = "http://" + VERDACCIO_HOST_DOCKER + ":" + str(VERDACCIO_PORT)
+VERDACCIO_NETWORK = PROJECT_NAME + "_verdaccio-network"
+VERDACCIO_NPM_REGISTRY = "https://registry.npmjs.org/"
+# Resource and service names
+VERDACCIO_RESOURCE_NAME = "verdaccio"
+VERDACCIO_CONNECT_NETWORK_RESOURCE = "verdaccio-connect-network"
+VERDACCIO_DOMAIN = "verdaccio"
+VERDACCIO_TRAEFIK_HOST = "verdaccio.localhost"
+
+# Docker names for one stack's generated services. Every name carries the Flisk
+# project, so two projects that both have a stack called `people` (two Tilt
+# instances on one Docker daemon) never share a Compose project, container or
+# image. Without it, the second `flisk up` runs `--remove-orphans` against the
+# first project's containers and overwrites its images.
+def compose_project_name(stack):
+    """Compose project for a stack: <project>-<stack>-autogenerated (e.g. tdk-erp-system-analytics-autogenerated)."""
+    return PROJECT_NAME_HYPHEN + "-" + stack + "-autogenerated"
+
+def app_image_name(stack, res_name):
+    """Image tag (:dev) of one service: <project>_<stack>_<resource>:dev."""
+    return PROJECT_NAME + "_" + stack + "_" + res_name + ":dev"
+
+def infra_compose_project_name(infra):
+    """Compose project for a shared platform stack: <project>-<infra> (e.g. tdk-erp-system-database-management)."""
+    return PROJECT_NAME_HYPHEN + "-" + infra
+
+def migrator_image_name(stack):
+    """Image tag (:dev) of a stack's migrator: <project>_<stack>-db-migrator:dev."""
+    return PROJECT_NAME + "_" + stack + "-db-migrator:dev"
+
+# Helper function to generate database name
+def get_db_name(domain_or_service):
+    """Returns standardized database name for a domain or service."""
+    return PROJECT_NAME + "_" + domain_or_service.replace("-", "_")
+
+# Base JDBC URL format (without database name)
+def get_database_url_base():
+    """Returns base DATABASE_URL format without database name."""
+    return "postgresql://" + DB_USER + ":" + DB_PASSWORD_SHELL + "@" + DB_HOST + ":" + DB_PORT + "/"
+
+# Complete DATABASE_URL with database name (for .env files)
+def get_database_url_for_env(db_name):
+    """Returns DATABASE_URL format for .env files (shell syntax preserved)."""
+    return get_database_url_base() + db_name + "?schema=" + DB_SCHEMA
+
+# Complete DATABASE_URL with database name (for shell scripts)
+def get_database_url_for_shell(db_name):
+    """Returns DATABASE_URL format for shell scripts."""
+    return "postgresql://" + DB_USER + ":$DB_PASSWORD@" + DB_HOST + ":" + DB_PORT + "/" + db_name + "?schema=" + DB_SCHEMA
+
+# Docker Compose environment variable format with fallback
+def get_compose_env_database_url(db_name):
+    """Returns Docker Compose environment variable format with fallback."""
+    base_url = get_database_url_for_env(db_name)
+    return "${{DATABASE_URL:-" + base_url + "}}"
+
+# Tilt resource DATABASE_URL format (for Starlark .format() with host/port placeholders)
+def get_tilt_database_url_template():
+    """Returns DATABASE_URL template with {host} and {port} placeholders for .format()."""
+    # ⚠️ SECURITY: No default password - DB_PASSWORD must be set
+    return "postgresql://" + PROJECT_NAME + ":${DB_PASSWORD}@{host}:{port}/{db}?schema=public"
+
+# Database config entry for config.star
+DB_CONFIG = {
+    "host": DB_HOST,
+    "port": int(DB_PORT),
+    "user": DB_USER,
+    "password": DB_PASSWORD_SHELL,
+    "name_prefix": PROJECT_NAME + "_",
+}
+
+PlatformDockerConstants = struct(
+    PROJECT_NAME = PROJECT_NAME,
+    PROJECT_NAME_HYPHEN = PROJECT_NAME_HYPHEN,
+    LOCAL_DOMAIN = LOCAL_DOMAIN,
+    APP_SUBDOMAIN_PREFIX = APP_SUBDOMAIN_PREFIX,
+    API_SUBDOMAIN_PREFIX = API_SUBDOMAIN_PREFIX,
+    APP_LOCAL_DOMAIN = APP_LOCAL_DOMAIN,
+    API_LOCAL_DOMAIN = API_LOCAL_DOMAIN,
+    EMAIL_DOMAIN = EMAIL_DOMAIN,
+    RESOURCE_SCHEMA_URL = RESOURCE_SCHEMA_URL,
+    NPM_SCOPE = NPM_SCOPE,
+    BUN_VERSION = BUN_VERSION,
+    BUN_IMAGE = BUN_IMAGE,
+    DB_USER = DB_USER,
+    DB_HOST = DB_HOST,
+    DB_PORT = DB_PORT,
+    DB_PASSWORD_SHELL = DB_PASSWORD_SHELL,
+    DB_SCHEMA = DB_SCHEMA,
+    NETWORK_TRAEFIK_PUBLIC = NETWORK_TRAEFIK_PUBLIC,
+    NETWORK_BACKEND = NETWORK_BACKEND,
+    NETWORK_DATABASE = NETWORK_DATABASE,
+    NETWORK_INFISICAL = NETWORK_INFISICAL,
+    NETWORK_PROXY = NETWORK_PROXY,
+    TRAEFIK_DYNAMIC_DIR_REL = TRAEFIK_DYNAMIC_DIR_REL,
+    TRAEFIK_WAKE_GATEWAY_CONTAINER = TRAEFIK_WAKE_GATEWAY_CONTAINER,
+    TRAEFIK_WAKE_GATEWAY_PORT = TRAEFIK_WAKE_GATEWAY_PORT,
+    NATS_HOST = NATS_HOST,
+    NATS_PORT = NATS_PORT,
+    NATS_URL = NATS_URL,
+    # Verdaccio constants
+    VERDACCIO_PORT = VERDACCIO_PORT,
+    VERDACCIO_HOST = VERDACCIO_HOST,
+    VERDACCIO_HOST_DOCKER = VERDACCIO_HOST_DOCKER,
+    VERDACCIO_CONTAINER_NAME = VERDACCIO_CONTAINER_NAME,
+    VERDACCIO_URL_LOCAL = VERDACCIO_URL_LOCAL,
+    VERDACCIO_URL_DOCKER = VERDACCIO_URL_DOCKER,
+    VERDACCIO_NETWORK = VERDACCIO_NETWORK,
+    VERDACCIO_NPM_REGISTRY = VERDACCIO_NPM_REGISTRY,
+    VERDACCIO_RESOURCE_NAME = VERDACCIO_RESOURCE_NAME,
+    VERDACCIO_CONNECT_NETWORK_RESOURCE = VERDACCIO_CONNECT_NETWORK_RESOURCE,
+    VERDACCIO_DOMAIN = VERDACCIO_DOMAIN,
+    VERDACCIO_TRAEFIK_HOST = VERDACCIO_TRAEFIK_HOST,
+    DB_CONFIG = DB_CONFIG,
+    get_db_name = get_db_name,
+    compose_project_name = compose_project_name,
+    infra_compose_project_name = infra_compose_project_name,
+    app_image_name = app_image_name,
+    migrator_image_name = migrator_image_name,
+    get_database_url_base = get_database_url_base,
+    get_database_url_for_env = get_database_url_for_env,
+    get_database_url_for_shell = get_database_url_for_shell,
+    get_compose_env_database_url = get_compose_env_database_url,
+    get_tilt_database_url_template = get_tilt_database_url_template,
+)
+
+CONSTANTS = {}

package/engine/topologies/platform/docker/dockerfile/dockerfile.star

@@ -0,0 +1,56 @@
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+# Dockerfile generation exports
+# === INLINED CONSTANTS for pure extension loading ===
+BASE_PORT_FRONTEND = 3000
+BASE_PORT_BACKEND = 4000
+# === END INLINED CONSTANTS ===
+
+
+load('../generators/golden_docker_generator_v2.star', 'L4_generate_orchestrator')
+
+
+def generate_frontend_dockerfile(res_path, resource_name, port=BASE_PORT_FRONTEND, target_path='/app/dist', build_cmd='bun run build', cmd='bun run start', use_nginx=False, use_infisical=False, use_shared_libs=True, use_prisma=False, use_golden=True, manifest=None):
+    """Generate Dockerfile for frontend services."""
+    return L4_generate_orchestrator(
+        res_path=res_path,
+        res_type='frontend',
+        resource_name=resource_name,
+        use_nginx=use_nginx,
+        port=port,
+        target_path=target_path,
+        build_cmd=build_cmd,
+        cmd=cmd,
+        use_infisical=use_infisical,
+        use_shared_libs=use_shared_libs,
+        use_prisma=use_prisma,
+        use_golden=use_golden,
+        manifest=manifest,
+    )
+
+def generate_app_dockerfile(res_path, resource_name, port=BASE_PORT_BACKEND, build_cmd='bun run build', cmd='bun run start', use_infisical=False, use_shared_libs=True, use_prisma=True, use_golden=True, manifest=None):
+    """Generate Dockerfile for backend/app services."""
+    return L4_generate_orchestrator(
+        res_path=res_path,
+        res_type='backend',
+        resource_name=resource_name,
+        port=port,
+        build_cmd=build_cmd,
+        cmd=cmd,
+        use_infisical=use_infisical,
+        use_shared_libs=use_shared_libs,
+        use_prisma=use_prisma,
+        use_golden=use_golden,
+        manifest=manifest,
+    )
+
+def generate_migrator_dockerfile(res_path, resource_name, use_infisical=False, use_golden=True, manifest=None):
+    """Generate Dockerfile for database migrator services."""
+    return L4_generate_orchestrator(
+        res_path=res_path,
+        res_type='migrator',
+        resource_name=resource_name,
+        use_infisical=use_infisical,
+        use_golden=use_golden,
+        manifest=manifest,
+    )

package/engine/topologies/platform/docker/dockerfile/language_dockerfile.star

@@ -0,0 +1,264 @@
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+# Dockerfiles for backends whose `language` is not the Bun default.
+#
+# Bun backends use the golden-image generator. Python backends are a small
+# standalone image: language-specific base image and reload command, while the build
+# context (project root), `production` target, health check, and PORT contract stay the
+# same as every other backend.
+
+BASE_PORT_BACKEND = 4000
+
+# Languages whose runtime files are owned by the provider (no Vite/tsconfig/Bun config).
+PROVIDER_OWNED_LANGUAGES = ["python", "go", "rust", "node"]
+
+# Files a provider-owned language must scaffold; checked before generating anything.
+LANGUAGE_REQUIRED_FILES = {
+    "python": ["pyproject.toml", "src/main.py"],
+    "go": ["go.mod", "main.go"],
+    "rust": ["Cargo.toml", "src/main.rs"],
+    "node": ["package.json", "src/index.js"],
+}
+
+_CURL = """RUN apt-get update && apt-get install -y --no-install-recommends curl \\
+  && rm -rf /var/lib/apt/lists/*
+"""
+
+_HEALTHCHECK = """HEALTHCHECK --interval=10s --timeout=5s --retries=3 \\
+  CMD curl -f http://localhost:${{PORT:-{port}}}/health || exit 1
+"""
+
+_PYTHON = """# Generated by Flisk for a Python backend. Do not edit; change service.json instead.
+FROM python:3.12-slim@sha256:05cda9777409a9c3ffddd94a4c476b79f0769a0b4857f0c7ed9226b6800b0d6f AS base
+
+WORKDIR /app/{res_path}
+
+{curl}
+COPY {res_path}/pyproject.toml ./
+# Wheel then install the wheel only. Scorecard treats a pip install of a
+# .whl as hash-pinned; `pip install .` is not.
+RUN python -m pip wheel --no-cache-dir --wheel-dir /tmp/wheels .
+RUN pip install --no-cache-dir /tmp/wheels/*.whl
+
+COPY {res_path}/src ./src
+
+FROM base AS test
+RUN python -m pip wheel --no-cache-dir --wheel-dir /tmp/wheels-dev ".[dev]"
+RUN pip install --no-cache-dir /tmp/wheels-dev/*.whl
+COPY {res_path}/tests ./tests
+RUN pytest
+
+FROM base AS production
+
+{healthcheck}
+EXPOSE {port}
+
+CMD ["sh", "-c", "uvicorn main:app --app-dir src --host 0.0.0.0 --port ${{PORT:-{port}}} --reload --reload-dir src"]
+"""
+
+_GO = """# Generated by Flisk for a Go backend. Do not edit; change service.json instead.
+FROM golang:1.23-bookworm@sha256:167053a2bb901972bf2c1611f8f52c44d5fe7e762e5cab213708d82c421614db AS build
+# The official image pins GOTOOLCHAIN=local, so a go.mod that needs a newer Go (Gin 1.12 needs 1.25) stops with "requires go >= 1.25".
+# `auto` lets Go fetch the toolchain go.mod asks for; a go.mod at or below the image's Go downloads nothing.
+ENV GOTOOLCHAIN=auto
+
+WORKDIR /app/{res_path}
+
+COPY {res_path}/go.* ./
+RUN go mod download
+
+COPY {res_path}/ ./
+RUN CGO_ENABLED=0 go build -o /out/app .
+
+FROM build AS test
+RUN go test ./...
+{go_development}
+FROM debian:bookworm-slim@sha256:7c7b2c966bc9ee8cedfeef67e0e279108992c77681fa595db4a9d65c06ccc587 AS production
+
+{curl}
+COPY --from=build /out/app /usr/local/bin/app
+
+{healthcheck}
+EXPOSE {port}
+
+CMD ["app"]
+"""
+
+_RUST = """# Generated by Flisk for a Rust backend. Do not edit; change service.json instead.
+# BuildKit cache mounts keep the registry and the target directory between builds, so a rebuild after a
+# source change recompiles only the crate itself, not every dependency.
+FROM rust:1-slim-bookworm@sha256:2c3a22f0a5533ea2dd5a16627bc841228151faa2d4de2644ac9987e4a2f1f2fa AS build
+
+WORKDIR /app/{res_path}
+
+COPY {res_path}/ ./
+RUN --mount=type=cache,target=/usr/local/cargo/registry \\
+    --mount=type=cache,target=/app/{res_path}/target \\
+    cargo build --release && mkdir -p /out && cp target/release/app /out/app
+
+FROM build AS test
+RUN --mount=type=cache,target=/usr/local/cargo/registry \\
+    --mount=type=cache,target=/app/{res_path}/target \\
+    cargo test
+
+FROM debian:bookworm-slim@sha256:7c7b2c966bc9ee8cedfeef67e0e279108992c77681fa595db4a9d65c06ccc587 AS production
+
+{curl}
+COPY --from=build /out/app /usr/local/bin/app
+
+{healthcheck}
+EXPOSE {port}
+
+CMD ["app"]
+"""
+
+_NODE = """# Generated by Flisk for a Node.js backend. Do not edit; change service.json instead.
+FROM node:22-slim@sha256:c3de60bf2f9dd0ac6370e6117950ff62d6e339527e7472301c9c78a017978392 AS base
+
+WORKDIR /app/{res_path}
+
+{curl}
+COPY {res_path}/package*.json ./
+RUN npm ci --omit=dev
+
+COPY {res_path}/src ./src
+
+FROM base AS test
+RUN npm ci
+COPY {res_path}/tests ./tests
+RUN npm test
+
+FROM base AS production
+
+{healthcheck}
+EXPOSE {port}
+
+CMD ["node", "src/index.js"]
+"""
+
+# The watcher the Go development target runs. It compiles a change into a staging binary while the running app keeps serving, and stops
+# and swaps the app only when that build succeeds. Air was tried first and stops the app as soon as it sees a change (engine.go `start`
+# calls stopBin before buildRun), so the service stayed down for the whole compile; a Traefik health check landing in that gap kept the
+# route at 503 for up to 10s. A compile error is printed to the log and the last good build keeps serving.
+# `-s -w` drops debug info, which shortens the link step; delve cannot attach to a binary built this way.
+# `\\n` in find's -printf format is written with a doubled backslash so the shell receives a backslash and an n.
+_GO_DEV_WATCH = """#!/bin/sh
+app=/tmp/app
+next=/tmp/app.next
+pid=
+
+# Path, mtime and size of every file a Go build can read. Dot-directories (.git, .autogenerated), tmp/, tests and docs are ignored.
+signature() {
+  find . -type f -not -path '*/.*' -not -path './tmp/*' -not -name '*_test.go' -not -name '*.md' -printf '%p %T@ %s\\n' | sort | cksum
+}
+
+# The app runs in its own session so a signal reaches everything it forked and no child keeps the listen socket.
+start_app() {
+  setsid "$app" &
+  pid=$!
+}
+
+# Succeeds only when the app is really gone; a swap on top of a live process would fail (ETXTBSY) or hit address-in-use.
+stop_app() {
+  [ -n "$pid" ] || return 0
+  kill -TERM -- "-$pid" 2>/dev/null || kill "$pid" 2>/dev/null
+  waited=0
+  while kill -0 "$pid" 2>/dev/null && [ "$waited" -lt 50 ]; do
+    sleep 0.1
+    waited=$((waited + 1))
+  done
+  kill -KILL -- "-$pid" 2>/dev/null || kill -9 "$pid" 2>/dev/null
+  wait "$pid" 2>/dev/null
+  if kill -0 "$pid" 2>/dev/null; then
+    return 1
+  fi
+  pid=
+}
+
+trap 'stop_app; exit 0' TERM INT
+
+last=$(signature)
+echo "[flisk] watching for Go changes; the running app keeps serving while a rebuild compiles"
+start_app
+
+while true; do
+  sleep 0.2 &
+  wait $!
+  if [ -n "$pid" ] && ! kill -0 "$pid" 2>/dev/null; then
+    wait "$pid"
+    echo "[flisk] the app exited with status $?; waiting for a change to rebuild"
+    pid=
+  fi
+  now=$(signature)
+  [ "$now" = "$last" ] && continue
+  last=$now
+  echo "[flisk] change detected, rebuilding..."
+  if go build -ldflags='-s -w' -o "$next" . ; then
+    if stop_app && mv "$next" "$app"; then
+      start_app
+      echo "[flisk] rebuilt and restarted"
+    else
+      echo "[flisk] could not stop the running app or install the new build; save again to retry"
+      last=
+    fi
+  else
+    echo "[flisk] build failed; the last good build keeps running. Fix the error and save again."
+  fi
+done
+"""
+
+# Opt-in Go development target (`dev.liveReload`): the toolchain image plus the watcher above, which rebuilds and restarts the app when a
+# source file changes. Dependencies are downloaded in their own layer and the module download is its own image layer, so an ordinary
+# source edit recompiles incrementally. `go.mod`, `go.sum` and the Dockerfile still rebuild the image. The heredoc needs BuildKit's
+# Dockerfile frontend 1.4 (Docker Engine 23+).
+_GO_DEVELOPMENT = """
+FROM golang:1.23-bookworm@sha256:167053a2bb901972bf2c1611f8f52c44d5fe7e762e5cab213708d82c421614db AS development
+ENV GOTOOLCHAIN=auto
+WORKDIR /app/{res_path}
+COPY {res_path}/go.* ./
+# A plain RUN (not a cache mount) keeps the modules in a layer keyed on go.mod and go.sum, so the priming build below reuses them.
+RUN go mod download
+COPY {res_path}/ ./
+ENV GOFLAGS=-buildvcs=false CGO_ENABLED=0
+# Prime the build cache inside the image (a cache mount would not be kept), so the first edit recompiles only what changed.
+# Same flags as the watcher's builds (and CGO off like the production stage), so the primed binary and cache match every later one.
+RUN go build -ldflags='-s -w' -o /tmp/app .
+COPY --chmod=755 <<'FLISK_GO_DEV_WATCH' /usr/local/bin/flisk-go-watch
+{watch_script}
+FLISK_GO_DEV_WATCH
+EXPOSE {port}
+CMD ["flisk-go-watch"]
+"""
+
+def generate_language_dockerfile(res_path, language, port = BASE_PORT_BACKEND, dev = False):
+    """Dockerfile text for a provider-owned backend language, or fail for an unknown one."""
+    template = {"python": _PYTHON, "go": _GO, "rust": _RUST, "node": _NODE}.get(language)
+    if template == None:
+        fail("No Dockerfile generator for backend language '{}'".format(language))
+    go_development = ""
+    if dev and language == "go":
+        go_development = _GO_DEVELOPMENT.format(res_path = res_path, port = port, watch_script = _GO_DEV_WATCH.rstrip("\n"))
+    return template.format(
+        res_path = res_path,
+        port = port,
+        go_development = go_development,
+        curl = _CURL,
+        healthcheck = _HEALTHCHECK.format(port = port),
+    )
+
+
+def is_provider_owned_language(manifest):
+    """True when the manifest selects a provider-owned language (a missing language means Bun)."""
+    if not manifest:
+        return False
+    return manifest.get("appType", "backend") == "backend" and manifest.get("language", "bun") in PROVIDER_OWNED_LANGUAGES
+
+
+def go_live_reload_enabled(manifest):
+    """True for a Go service that opted in with `dev.liveReload: true` (see _GO_DEVELOPMENT); anything else stays off."""
+    if not manifest or manifest.get("language", "bun") != "go":
+        return False
+    dev = manifest.get("dev")
+    if type(dev) != "dict":
+        return False
+    return dev.get("liveReload") == True

package/engine/topologies/platform/docker/generators/golden_docker_generator_v2.star

@@ -0,0 +1,76 @@
+# === INLINED CONSTANTS for pure extension loading ===
+OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
+# === END INLINED CONSTANTS ===
+
+
+BUN_BASE = "oven/bun:1.3.11-alpine"
+ALPINE_BASE = "alpine:3.22"
+
+
+load('../../../tilt/common/utils.star', 'Utils')
+load('../../../tilt/manifest/constants.star', 'GENERATED_CONFIG_FILENAMES')
+
+# Load layer generators from dedicated modules
+load('../layers/l1_base_layers.star', 'L1_generate_os_base', 'L1_generate_runtime_env')
+load('../layers/l2_dependency_layers.star', 'L2_generate_dependency_manifest')
+load('../layers/l3_builder_layers.star', 
+    'L3_generate_backend_compiler', 
+    'L3_generate_frontend_builder',
+    'L3_generate_production_purger'
+)
+load('../layers/prisma/prisma_build.star', 'L3_generate_migration_engine')
+load('../layers/prisma/prisma_runtime.star', 'L4_generate_migrator_runtime')
+load('../layers/l4_runtime_layers.star',
+    'L4_generate_backend_runtime',
+    'L4_generate_frontend_runtime',
+)
+
+def L4_generate_orchestrator(res_path, res_type = 'backend', resource_name = 'service', use_nginx = False, port = 3000, target_path = '/app/dist', build_cmd = 'bun run build', cmd = 'bun run start', use_infisical = False, use_shared_libs = True, use_prisma = True, use_golden = True, manifest = None):
+    parts = []
+    migrator_name_match = (
+        resource_name == 'migrator'
+        or resource_name.endswith('-migrator')
+        or resource_name.endswith('-db-migrator')
+    )
+    prisma_config_exists = use_prisma and read_file(res_path + '/' + OUTPUT.AUTOGENERATED_FOLDER + '/' + GENERATED_CONFIG_FILENAMES['prisma'], default='') != ''
+    parts.append(L1_generate_os_base(use_golden=use_golden))
+    parts.append(L1_generate_runtime_env(None))
+    parts.append(L2_generate_dependency_manifest(res_path, use_golden=use_golden))
+
+    if res_type == 'migrator' or (res_type == 'backend' and migrator_name_match):
+        # For migrators, skip backend_compiler and production_purger.
+        # Keep migration_engine only.
+        parts.append(L3_generate_migration_engine(res_path, use_golden=use_golden))
+    elif res_type == 'frontend':
+        parts.append(L3_generate_frontend_builder(res_path, build_cmd, use_infisical, use_shared_libs, use_golden=use_golden))
+    else:
+        parts.append(L3_generate_backend_compiler(res_path, build_cmd, use_prisma, use_shared_libs, use_infisical, use_golden=use_golden, has_prisma_config=prisma_config_exists))
+        # Backend runtime needs production-purged deps. Prisma migration stage
+        # is only required when Prisma is enabled for this resource.
+        if use_prisma:
+            parts.append(L3_generate_migration_engine(res_path, use_golden=use_golden))
+        parts.append(L3_generate_production_purger(res_path))
+
+    if res_type == 'frontend':
+        parts.append(L4_generate_frontend_runtime(res_path, target_path, use_nginx, use_golden=use_golden, port=port))
+    elif res_type == 'migrator' or (res_type == 'backend' and migrator_name_match):
+        parts.append(L4_generate_migrator_runtime(res_path, resource_name, use_golden=use_golden))
+    else:
+        parts.append(
+            L4_generate_backend_runtime(
+                res_path,
+                port,
+                cmd,
+                use_infisical,
+                resource_name,
+                use_golden=use_golden,
+                use_prisma=use_prisma,
+                has_prisma_config=prisma_config_exists,
+                manifest=manifest,
+            ),
+        )
+    dockerfile = "\n\n".join(parts)
+    footer = Utils.get_template_header("dockerfile", "golden_docker_generator_v2.L4_generate_orchestrator", resource_name, "Use docker_build(dockerfile_contents=...) in Tiltfile")
+    # Heredocs (RUN cat > ... << 'EOF') need the BuildKit frontend; without this line an older builder
+    # reads the heredoc body as instructions ("unknown instruction: export").
+    return "# syntax=docker/dockerfile:1\n" + dockerfile + "\n\n" + footer

package/engine/topologies/platform/docker/index.star

@@ -0,0 +1,40 @@
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+load(
+    "./dockerfile/dockerfile.star",
+    "generate_frontend_dockerfile",
+    "generate_app_dockerfile",
+    "generate_migrator_dockerfile",
+)
+load(
+    "./dockerfile/language_dockerfile.star",
+    "generate_language_dockerfile",
+    "is_provider_owned_language",
+    "go_live_reload_enabled",
+    "LANGUAGE_REQUIRED_FILES",
+)
+load("./config/dockerignore.star", "generate_dockerignore")
+load(
+    "./compose/compose.star",
+    "generate_frontend_compose",
+    "generate_backend_compose_entry",
+    "generate_app_compose_from_entries",
+    "generate_migrator_compose",
+)
+load("./build/golden_image.star", "GoldenImage")
+
+Docker = struct(
+    frontend = generate_frontend_dockerfile,
+    backend = generate_app_dockerfile,
+    migrator = generate_migrator_dockerfile,
+    backend_language = generate_language_dockerfile,
+    is_provider_owned_language = is_provider_owned_language,
+    go_live_reload = go_live_reload_enabled,
+    language_required_files = LANGUAGE_REQUIRED_FILES,
+    generate_dockerignore = generate_dockerignore,
+    frontend_compose = generate_frontend_compose,
+    backend_compose = generate_backend_compose_entry,
+    app_compose = generate_app_compose_from_entries,
+    migrator_compose = generate_migrator_compose,
+    golden_image = GoldenImage,
+)

package/engine/topologies/platform/docker/layers/bun_helpers.star

@@ -0,0 +1,25 @@
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+"""
+Bun Helper Functions
+"""
+
+def bun_hoisted_packages_symlink_fix():
+    """
+    Fix all Bun-hoisted package symlinks in node_modules.
+    
+    When packages are installed with Bun's isolated store, they may be symlinked
+    from node_modules to .bun/. These symlinks break when copied to Docker.
+    This function recreates the necessary symlinks for runtime resolution.
+    
+    Handles:
+    - Regular packages with nested node_modules (e.g., hono)
+    - Scoped packages (@hono/*, @prisma/*)
+    """
+    return (
+        "# Fix Bun hoisted package symlinks that break when copied to Docker\n"
+        + "USER root\n"
+        + "COPY shared-platform-engineering/docker-templates/bun-hoisted-symlink-fix.sh /usr/local/bin/bun-hoisted-symlink-fix.sh\n"
+        + "RUN chmod +x /usr/local/bin/bun-hoisted-symlink-fix.sh && /usr/local/bin/bun-hoisted-symlink-fix.sh\n"
+        + "USER bun\n"
+    )