@flisk-sh/flisk 0.0.0-stage → 1.3.190

package/engine/topologies/platform/docker/layers/l3_builder_layers.star

@@ -0,0 +1,229 @@
+# Copyright (c) 2026 Flisk contributors
+# SPDX-License-Identifier: MIT
+# === INLINED CONSTANTS for pure extension loading ===
+WEB_FRAMEWORK = "hono"
+RUNTIME_CONFIG = {"bun": {"image_base": "oven/bun:1.3.11-alpine", "package_manager": "bun", "lockfile": "bun.lock", "backend_start_command": "bun run start", "frontend_start_command": "bun run dev"}, "node": {"image_base": "node:22-alpine", "package_manager": "npm", "lockfile": "package-lock.json", "backend_start_command": "node dist/index.js"}}
+OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
+# === END INLINED CONSTANTS ===
+
+
+"""
+L3 Builder Layers - Compilation and Build Stages
+
+Handles the build stages for different application types:
+- l3_backend_compiler: TypeScript backend compilation
+- l3_frontend_builder: Frontend application building
+- l3_migration_engine: Prisma migration preparation
+- l3_production_purger: Production dependency stripping
+"""
+
+load('./l1_base_layers.star', 'BUN_BASE')
+load('./l2_dependency_layers.star', 'GOLDEN_L2_IMAGE', 'normalize_res_path')
+load('../../../../../discovery/config.star', 'GLOBAL_CONFIG')
+load('../../../tilt/manifest/constants.star', 'AUTOGENERATED_CONFIG_PATHS')
+
+
+
+load('./prisma/prisma_build.star',
+    'prisma_copy_instructions',
+    'prisma_generate_instructions',
+    'prisma_normalize_output',
+    'L3_generate_migration_engine',
+)
+# Infisical is opt-in: use_infisical defaults to False and nothing in the free engine passes True, so the generator behind this
+# (tilt/generators/infisical/secrets_generator.star) is not on the default path. It is an older contract with fixed secret names and
+# ports. Do not wire `secrets.required` through it; the default provider is platform/docker/secrets/env_secrets.star.
+load('./infisical/infisical_docker.star', 'InfisicalDocker')
+
+# Load project name for dynamic golden image naming
+# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+def _load_golden_prefix():
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_json_path = '.tdk/project.json'
+    if project_root:
+        project_json_path = project_root + '/' + project_json_path
+    
+    if os.path.exists(project_json_path):
+        _project_json = read_json(project_json_path)
+        return _project_json.get('project', {}).get('name', 'tdk-project')
+    return 'tdk-project'
+
+_GOLDEN_PREFIX = _load_golden_prefix()
+
+_docker_cfg = GLOBAL_CONFIG['docker']
+GOLDEN_L3_BACKEND_IMAGE = _docker_cfg.get('golden_l3_backend_image', _GOLDEN_PREFIX + '-l3-backend:latest')
+GOLDEN_L3_FRONTEND_IMAGE = _docker_cfg.get('golden_l3_frontend_image', _GOLDEN_PREFIX + '-l3-frontend:latest')
+
+
+def L3_generate_backend_compiler(res_path, build_cmd = RUNTIME_CONFIG["bun"]["backend_start_command"], use_prisma = True, use_shared_libs = True, use_infisical = False, use_golden = True, has_prisma_config = False):
+    """
+    Generate the backend compiler layer for TypeScript services.
+
+    Args:
+        res_path: Resource path (service directory)
+        build_cmd: Build command to run (default: from RUNTIME_CONFIG)
+        use_prisma: Include Prisma setup (default: True)
+        use_shared_libs: Include shared library copies (default: True)
+        use_infisical: Include Infisical CLI installation (default: True)
+        use_golden: Whether to use golden L3-backend image (default: True)
+        has_prisma_config: Whether the service has Prisma config (default: False)
+
+    Returns:
+        Dockerfile content string for the l3_backend_build stage
+    """
+    # Normalize res_path for Docker COPY (must be relative to build context)
+    res_path_rel = normalize_res_path(res_path)
+    
+    base_image = GOLDEN_L3_BACKEND_IMAGE if use_golden else BUN_BASE
+    prisma_copy = prisma_copy_instructions(res_path) if use_prisma else ""
+    prisma_generate = prisma_generate_instructions() if use_prisma else ""
+    prisma_compat = prisma_normalize_output() if use_prisma else ""
+    parts = [
+        "# ---- L3: backend_compiler ----\n",
+        "FROM " + base_image + " AS l3_backend_build\n",
+        "WORKDIR /app/" + res_path + "\n",
+        "# Build argument to skip Infisical setup (for local dev / fast builds)\n",
+        "ARG SKIP_INFISICAL_SETUP=0\n",
+        "# Reuse resolved dependencies from l2_deps_manifest to avoid reinstalling in L3\n",
+        "COPY --link --from=l2_deps_manifest /app/" + res_path + "/node_modules ./node_modules\n",
+        "# Bun isolated linker symlinks may resolve through /app/node_modules/.bun\n",
+        "COPY --link --from=l2_deps_manifest /app/node_modules/.bun /app/node_modules/.bun\n",
+        "# Copy manifest files for dependency installation (in case L2 is stale)\n",
+        "COPY " + res_path_rel + "/package.json ./package.json\n",
+        "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['bunfig_docker'] + " ./bunfig.toml\n",
+        "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['npmrc_docker'] + " ./.npmrc\n",
+        "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/tsconfig.docker.autogenerated.json ./tsconfig.json\n",
+        "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/tsconfig.autogenerated.json ./" + OUTPUT.AUTOGENERATED_FOLDER + "/tsconfig.autogenerated.json\n",
+        "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/*.ts ./" + OUTPUT.AUTOGENERATED_FOLDER + "/\n",
+        "COPY " + res_path_rel + "/src ./src\n",
+        prisma_copy,
+        prisma_generate,
+        prisma_compat,
+    ]
+    # shared libs (@{npm_scope}/*) are resolved from Verdaccio by l2_deps_manifest
+    # and already present in node_modules — no COPY of shared-* source dirs needed.
+    # Use InfisicalDocker generator for CLI setup (if not using golden image)
+    if use_infisical and not use_golden:
+        parts.append(InfisicalDocker.builder_setup(
+            use_infisical=use_infisical,
+            use_golden=use_golden,
+        ))
+    parts.append("ENV NODE_ENV=production\n")
+    parts.append("RUN " + build_cmd + "\n")
+    parts.append("# Fix " + WEB_FRAMEWORK + "/cors subpath import for Bun runtime compatibility\n")
+    parts.append("RUN find ./dist -type f -name \"*.js\" -exec sed -i \"s|from '" + WEB_FRAMEWORK + "/cors'|from '../node_modules/" + WEB_FRAMEWORK + "/dist/middleware/cors/index.js'|g\" {} + || true\n")
+    return "".join(parts)
+
+
+def L3_generate_frontend_builder(res_path, build_cmd = RUNTIME_CONFIG["bun"]["backend_start_command"], use_infisical = False, use_shared_libs = True, use_golden = True):
+    """
+    Generate the frontend builder layer for Vue/React applications.
+
+    Args:
+        res_path: Resource path (service directory)
+        build_cmd: Build command to run (default: from RUNTIME_CONFIG)
+        use_infisical: Include Infisical CLI installation (default: False)
+        use_shared_libs: Include shared library copies (default: True)
+        use_golden: Whether to use golden L3-frontend image (default: True)
+
+    Returns:
+        Dockerfile content string for the l3_frontend_build stage
+    """
+    # Normalize res_path for Docker COPY (must be relative to build context)
+    res_path_rel = normalize_res_path(res_path)
+    
+    # Use golden L3-frontend image if enabled (no Prisma)
+    base_image = GOLDEN_L3_FRONTEND_IMAGE if use_golden else BUN_BASE
+
+    parts = [
+        "# ---- L3: frontend_builder ----\n",
+        "FROM " + base_image + " AS l3_frontend_build\n",
+        "WORKDIR /app/" + res_path + "\n",
+        "# Build argument to skip Infisical setup (for local dev / fast builds)\n",
+        "ARG SKIP_INFISICAL_SETUP=1\n",
+        "# Reuse resolved dependencies from l2_deps_manifest to avoid reinstalling in L3\n",
+        "COPY --link --from=l2_deps_manifest /app/" + res_path + "/node_modules ./node_modules\n",
+        # Bun isolated linker symlinks may resolve through /app/node_modules/.bun.
+        "COPY --link --from=l2_deps_manifest /app/node_modules/.bun /app/node_modules/.bun\n",
+        "# Copy manifest files required by the build\n",
+        "COPY " + res_path_rel + "/package.json ./package.json\n",
+        "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['bunfig_docker'] + " ./bunfig.toml\n",
+        "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/tsconfig.docker.autogenerated.json ./tsconfig.json\n",
+        "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/tsconfig.autogenerated.json ./" + OUTPUT.AUTOGENERATED_FOLDER + "/tsconfig.autogenerated.json\n",
+        # Copy ALL TypeScript files from autogenerated directory (env.ts, api-client.ts, vite configs, etc.)
+        "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/*.ts ./" + OUTPUT.AUTOGENERATED_FOLDER + "/\n",
+        "COPY " + res_path_rel + "/src ./src\n",
+        "COPY " + res_path_rel + "/public ./public\n",
+        "COPY " + res_path_rel + "/index.html ./index.html\n",
+    ]
+    # shared libs (@{npm_scope}/*) are resolved from Verdaccio by l2_deps_manifest
+    # and already present in node_modules — no COPY of shared-* source dirs needed.
+    # Use InfisicalDocker generator for CLI setup (if not using golden image)
+    if use_infisical and not use_golden:
+        parts.append(InfisicalDocker.builder_setup(
+            use_infisical=use_infisical,
+            use_golden=use_golden,
+        ))
+    parts.append("ENV NODE_ENV=production\n")
+    # Point Vite at the generated build config. Without --config, `vite build`
+    # looks for vite.config.ts in the service root (which is never generated
+    # there) and silently falls back to defaults - losing `base`, so the built
+    # index.html references /assets/* instead of /<service>/assets/*.
+    # Args passed after the script name are appended to the end of the script
+    # command, so they reach `vite build` while any preceding steps in the
+    # script (e.g. `tsc --noEmit &&`) still run.
+    # A build script that already names a config (the CLI scaffold does) keeps its own; a second --config is not added.
+    config_flag = "" if "--config" in build_cmd else " --config " + AUTOGENERATED_CONFIG_PATHS['vite_build']
+    parts.append(
+        "RUN " + build_cmd + config_flag + "\n"
+    )
+    return "".join(parts)
+
+
+# L3_generate_migration_engine is now loaded from prisma/prisma_build.star
+
+
+def L3_generate_production_purger(res_path, use_golden = True):
+    """
+    Generate the production purger layer that removes development dependencies.
+
+    Implements Option 2: Reduce node_modules size by:
+    1. Installing only production dependencies (--production flag)
+    2. Removing unnecessary files (.md, .ts, .map, test files, etc.)
+    3. Pruning package.json files from node_modules
+    4. Removing optional dependencies not needed at runtime
+
+    Args:
+        res_path: Resource path (service directory)
+        use_golden: Whether to use golden L2 image (default: True)
+
+    Returns:
+        Dockerfile content string for the l3_production_purger stage
+    """
+    # Normalize res_path for Docker COPY (must be relative to build context)
+    res_path_rel = normalize_res_path(res_path)
+    
+    # Use golden L2 image if enabled (Bun + system deps pre-installed)
+    base_image = GOLDEN_L2_IMAGE if use_golden else BUN_BASE
+
+    return (
+        "# ---- L3: production_purger ----\n"
+        + "FROM " + base_image + " AS l3_production_purger\n"
+        + "WORKDIR /app/" + res_path + "\n"
+        + "COPY " + res_path_rel + "/package.json ./package.json\n"
+        + "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['bunfig_docker'] + " ./bunfig.toml\n"
+        + "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['npmrc_docker'] + " ./.npmrc\n"
+        # NOTE: no COPY --from=l2_deps_manifest /cache/bun here - a cache mount's
+        # contents are never committed to a stage's filesystem, so COPY --from can't
+        # read them (BuildKit fails with "snapshot ... does not exist" on finalize).
+        # The --mount=type=cache below already shares the same warmed /cache/bun
+        # cache across stages via its target+sharing=shared, with no COPY needed.
+        # sharing=shared allows parallel builds without lock contention (Bun cache is atomic)
+        + "RUN --mount=type=cache,target=/cache/bun,sharing=shared bun install --production --cache-dir=/cache/bun\n"
+        + "# Option 2: Aggressive node_modules pruning to reduce size\n"
+        + "# NOTE: Keep .d.ts files - they are needed for Bun module resolution with subpath exports\n"
+        + "RUN find node_modules -type f \\( -name '*.md' -o -name '*.ts' ! -name '*.d.ts' -o -name '*.map' -o -name '*.test.js' -o -name '*.spec.js' -o -name 'README*' -o -name 'CHANGELOG*' -o -name 'LICENSE*' \\) -delete\n"
+        + "RUN find node_modules -type d \\( -name '.bin' -o -name 'test' -o -name 'tests' -o -name '__tests__' -o -name 'spec' -o -name 'specs' -o -name '.github' -o -name 'docs' -o -name 'examples' \\) -exec rm -rf {} + 2>/dev/null || true\n"
+    )
+
+GLOBAL_CONFIG = {}

package/engine/topologies/platform/docker/layers/l4_runtime_layers.star

@@ -0,0 +1,282 @@
+# Copyright (c) 2026 Flisk contributors
+# SPDX-License-Identifier: MIT
+# === INLINED CONSTANTS for pure extension loading ===
+BASE_PORT_FRONTEND = 3000
+BASE_PORT_BACKEND = 4000
+OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
+# === END INLINED CONSTANTS ===
+
+
+"""
+L4 Runtime Layers - Final Application Runtime Stages
+
+Handles the final runtime stages for deployed applications:
+- l4_backend_runtime: Backend service runtime with Bun
+- l4_frontend_runtime: Frontend runtime with Nginx or Bun static
+- l4_migrator_runtime: Database migration runner with Infisical integration
+"""
+
+load('./l1_base_layers.star', 'BUN_BASE')
+load('./l2_dependency_layers.star', 'normalize_res_path')
+load('../../../../../discovery/config.star', 'GLOBAL_CONFIG')
+load('../../../tilt/common/utils_debug.star', 'DEBUG_MODE')
+load('../../../tilt/manifest/constants.star', 'AUTOGENERATED_CONFIG_PATHS')
+load('./prisma/prisma_runtime.star',
+    'prisma_runtime_copy',
+    'prisma_cli_runtime_copy',
+    'prisma_bun_symlink_fix',
+    'prisma_config_copy',
+    'L4_generate_migrator_runtime',
+)
+
+load('./bun_helpers.star', 'bun_hoisted_packages_symlink_fix')
+load('../config/healthcheck.star', 'DOCKER_HEALTHCHECK', 'dockerfile_healthcheck_flags')
+# Infisical is opt-in: use_infisical defaults to False and nothing in the free engine passes True, so the generator behind this
+# (tilt/generators/infisical/secrets_generator.star) is not on the default path. It is an older contract with fixed secret names and
+# ports. Do not wire `secrets.required` through it; the default provider is platform/docker/secrets/env_secrets.star.
+load('./infisical/infisical_docker.star', 'InfisicalDocker')
+
+
+# Load project name for dynamic golden image naming
+# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+def _load_golden_prefix():
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_json_path = '.tdk/project.json'
+    if project_root:
+        project_json_path = project_root + '/' + project_json_path
+    
+    if os.path.exists(project_json_path):
+        _project_json = read_json(project_json_path)
+        return _project_json.get('project', {}).get('name', 'tdk-project')
+    return 'tdk-project'
+
+_GOLDEN_PREFIX = _load_golden_prefix()
+
+_docker_cfg = GLOBAL_CONFIG['docker']
+GOLDEN_L4_BACKEND_IMAGE = _docker_cfg.get('golden_l4_backend_image', _GOLDEN_PREFIX + '-l4-backend:latest')
+GOLDEN_L4_FRONTEND_IMAGE = _docker_cfg.get('golden_l4_frontend_image', _GOLDEN_PREFIX + '-l4-frontend:latest')
+
+DEFAULT_BUN_START_COMMAND = 'bun run start'
+
+_ENTRY_FILE_EXTENSIONS = ['.js', '.mjs', '.cjs', '.ts', '.mts', '.cts', '.jsx', '.tsx']
+_SHELL_CHARS = ['=', '&', '|', ';', '$', '`', '<', '>', '(', ')', '"', "'", '*', '\\']
+
+
+def _is_entry_file(token):
+    if token.startswith('-'):
+        return False
+    for ch in _SHELL_CHARS:
+        if ch in token:
+            return False
+    for ext in _ENTRY_FILE_EXTENSIONS:
+        if token.endswith(ext):
+            return True
+    return False
+
+
+def start_command_from_script(start_script):
+    """
+    `bun run start` starts a Bun wrapper that spawns a second Bun runtime for the
+    real server. When the start script only runs one entry file, run that file
+    directly so each container holds a single Bun process. Anything else keeps
+    `bun run start` so custom start scripts behave exactly as before.
+    """
+    tokens = (start_script or '').split()
+    if len(tokens) == 3 and tokens[0] == 'bun' and tokens[1] == 'run' and _is_entry_file(tokens[2]):
+        return 'bun ' + tokens[2]
+    if len(tokens) == 2 and tokens[0] == 'bun' and _is_entry_file(tokens[1]):
+        return 'bun ' + tokens[1]
+    return DEFAULT_BUN_START_COMMAND
+
+
+def resolve_bun_start_command(res_path, cmd = DEFAULT_BUN_START_COMMAND):
+    """Resolve the runtime command from the service's package.json `start` script."""
+    if cmd != DEFAULT_BUN_START_COMMAND:
+        return cmd
+    package_json_path = res_path + '/package.json'
+    if not res_path.startswith('/'):
+        package_json_path = os.environ.get('TDK_PROJECT_ROOT', '.') + '/' + package_json_path
+    if not os.path.exists(package_json_path):
+        return cmd
+    package_json = read_json(package_json_path, default = {}) or {}
+    scripts = package_json.get('scripts', {}) or {}
+    return start_command_from_script(scripts.get('start', ''))
+
+
+def _cmd_instruction(command):
+    return "CMD [" + ", ".join(["\"" + part + "\"" for part in command.split()]) + "]\n"
+
+
+def _backend_healthcheck_instruction(port, manifest = None):
+    # Probe the service over HTTP, not the runtime binary: `bun --version` passes even when the server has crashed.
+    # Workers and bring-your-own services without healthCheckPath serve no HTTP, so they get no probe (HEALTHCHECK NONE).
+    if manifest and (manifest.get('appType') == 'worker' or (manifest.get('appType') == 'bring-your-own' and not manifest.get('healthCheckPath'))):
+        return "HEALTHCHECK NONE\n"
+    health_path = manifest.get('healthCheckPath', '/health') if manifest else '/health'
+    # The Dockerfile generator passes the manifest but not the port, so the service's own port wins over the 4000 default.
+    probe_port = manifest.get('port', port) if manifest else port
+    # fetch() is built into bun, so no extra package is needed in the image. Path is schema-limited to [a-z0-9/-].
+    probe = "fetch('http://127.0.0.1:" + str(probe_port) + health_path + "').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"
+    return "HEALTHCHECK " + dockerfile_healthcheck_flags() + " CMD bun -e \"" + probe + "\" || exit 1\n"
+
+
+def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun run start', use_infisical = False, resource_name = 'service', use_golden = True, use_prisma = True, has_prisma_config = False, manifest = None):
+    """
+    Generate the backend runtime layer for deployed services.
+
+    Args:
+        res_path: Resource path (service directory)
+        port: Port to expose (default: BASE_PORT_BACKEND from master config)
+        cmd: Command to run (default: 'bun run start')
+        use_infisical: Enable Infisical secret management (default: True)
+        resource_name: Service name for logging and configuration (default: 'service')
+        use_golden: Whether to use golden L4-backend image (default: True)
+        use_prisma: Whether the service has the "prisma" feature enabled - gates copying
+            the .prisma/prisma dirs from the L3 build stage, which only exist there when
+            L3 itself ran prisma generate, plus the pinned Prisma CLI from the L3
+            migration stage that the entrypoint needs to run migrations (default: True)
+        has_prisma_config: Whether service has a generated prisma.config.ts to copy in
+            (default: False)
+        manifest: Service manifest dict for feature detection (default: None)
+    
+    Returns:
+        Dockerfile content string for the l4_backend_runtime stage
+    """
+    # Normalize res_path for Docker COPY (must be relative to build context)
+    res_path_rel = normalize_res_path(res_path)
+    cmd = resolve_bun_start_command(res_path, cmd)
+    
+    # Use golden L4-backend image if enabled (production-optimized backend runtime)
+    base_image = GOLDEN_L4_BACKEND_IMAGE if use_golden else BUN_BASE
+    
+    parts = [
+        "# ---- L4: backend_runtime ----\n",
+        "FROM " + base_image + " AS l4_backend_runtime\n",
+        "WORKDIR /app/" + res_path + "\n",
+        "# Build argument to skip Infisical setup (for local dev / fast builds)\n",
+        "ARG SKIP_INFISICAL_SETUP=0\n",
+        "ENV NODE_ENV=production\n",
+        "COPY --from=l3_production_purger /app/" + res_path + "/node_modules ./node_modules\n",
+        prisma_runtime_copy(res_path) if use_prisma else "",
+        prisma_cli_runtime_copy(res_path) if use_prisma else "",
+        "COPY --from=l3_backend_build /app/" + res_path + "/dist ./dist\n",
+        "COPY " + res_path_rel + "/package.json ./package.json\n",
+        prisma_bun_symlink_fix() if use_prisma else "",
+        bun_hoisted_packages_symlink_fix(),
+    ]
+    
+    # Check for special tooling requirements from manifest features
+    # Services requiring Hugo (or other tools) should specify in manifest features array
+    manifest_features = manifest.get('featuresEnabled', []) if manifest else []
+    if "hugo" in manifest_features:
+        parts.append("USER root\n")
+        parts.append("RUN apk add --no-cache hugo\n")
+        parts.append("USER bun\n")
+
+    # A files-durability agent keeps its checkpoints in /var/lib/tdk-agent, a named volume. Docker seeds a new volume with the
+    # image directory's owner, so create the directory owned by bun, or the agent cannot write its first checkpoint (EACCES).
+    agent_cfg = manifest.get('agent') if manifest else None
+    if type(agent_cfg) == 'dict' and agent_cfg.get('durability', 'files') == 'files':
+        parts.append("USER root\n")
+        parts.append("RUN mkdir -p /var/lib/tdk-agent && chown bun:bun /var/lib/tdk-agent\n")
+        parts.append("USER bun\n")
+
+    if has_prisma_config:
+        # Prisma v7 migrate deploy reads datasource.url from prisma.config.ts in CWD
+        parts.append(prisma_config_copy(res_path))
+    
+    # Only set USER if not using golden image (already set in golden L4)
+    if not use_golden:
+        parts.append("USER bun\n")
+    
+    parts.extend([
+        "EXPOSE " + str(port) + "\n",
+    ])
+    
+    # Only add healthcheck if not using golden image (already in golden L4)
+    if not use_golden:
+        parts.append(_backend_healthcheck_instruction(port, manifest))
+    
+    if use_infisical:
+        # Use InfisicalDocker generator for proper secret injection setup
+        # This uses Starlark generators instead of hardcoded values
+        infisical_setup = InfisicalDocker.runtime_setup(
+            resource_name=resource_name,
+            secret_path=None,  # Auto-generate from resource_name
+            resource_type="backend",
+            command=cmd,
+            use_entrypoint=True,
+        )
+        parts.append(infisical_setup)
+    else:
+        parts.append(_cmd_instruction(cmd))
+
+    # Provide build targets that match external tooling (e.g. --target production/ development)
+    parts.append("\nFROM l4_backend_runtime AS production\nFROM l4_backend_runtime AS development\n")
+
+    return "".join(parts)
+
+
+def L4_generate_frontend_runtime(res_path, target_path = '/usr/share/nginx/html', use_nginx = True, use_golden = True, port = None):
+    """
+    Generate the frontend runtime layer for static site serving.
+    
+    Args:
+        res_path: Resource path (service directory)
+        target_path: Target path for static files (default: Nginx html directory)
+        use_nginx: Use Nginx for serving (default: True, uses Bun static if False)
+        use_golden: Whether to use golden L4-frontend image (default: True)
+        port: Port to expose (default: None, uses BASE_PORT_FRONTEND or 80 for nginx)
+    
+    Returns:
+        Dockerfile content string for the l4_frontend_runtime stage
+    """
+    # Use provided port or fall back to base port constant
+    expose_port = port if port else BASE_PORT_FRONTEND
+    # Normalize res_path for Docker COPY (must be relative to build context)
+    res_path_rel = normalize_res_path(res_path)
+    
+    if use_nginx:
+        # Use golden L4-frontend image if enabled (Nginx pre-configured)
+        base_image = GOLDEN_L4_FRONTEND_IMAGE if use_golden else "nginx:1.27-alpine"
+        
+        # If using golden image, skip curl installation (already there)
+        healthcheck_setup = "" if use_golden else "RUN apk add --no-cache curl\n"
+        
+        return (
+            "# ---- L4: frontend_runtime (nginx) ----\n"
+            + "FROM " + base_image + " AS l4_frontend_runtime\n"
+            + healthcheck_setup
+            + "COPY --from=l3_frontend_build /app/" + res_path + "/dist " + target_path + "\n"
+            + "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/nginx.autogenerated.conf /etc/nginx/conf.d/default.conf\n"
+            + "EXPOSE 80\n"
+            + ("" if use_golden else "HEALTHCHECK " + dockerfile_healthcheck_flags(DOCKER_HEALTHCHECK["frontend_start_period_seconds"]) + " CMD curl -f http://localhost/ || exit 1\n")
+            + "CMD [\"nginx\", \"-g\", \"daemon off;\"]\n"
+            + "FROM l4_frontend_runtime AS production\n"
+            + "FROM l4_frontend_runtime AS development\n"
+        )
+    # Use golden L4-frontend image even for Bun static serving (or BUN_BASE as fallback)
+    # NOTE: When use_nginx=False, we MUST use BUN_BASE because the golden L4 frontend
+    # image is nginx-based and doesn't have Bun installed
+    base_image = GOLDEN_L4_FRONTEND_IMAGE if (use_golden and use_nginx) else BUN_BASE
+    
+    return (
+        "# ---- L4: frontend_runtime (bun static) ----\n"
+        + "FROM " + base_image + " AS l4_frontend_runtime\n"
+        + "WORKDIR /app/" + res_path + "\n"
+        + "COPY --from=l3_frontend_build /app/" + res_path + "/dist ./dist\n"
+        + "COPY --from=l3_frontend_build /app/" + res_path + "/node_modules ./node_modules\n"
+        + "COPY --from=l3_frontend_build /app/" + res_path + "/" + OUTPUT.AUTOGENERATED_FOLDER + " ./" + OUTPUT.AUTOGENERATED_FOLDER + "\n"
+        + "COPY " + res_path_rel + "/package.json ./package.json\n"
+        + "EXPOSE " + str(expose_port) + "\n"
+        + _cmd_instruction(resolve_bun_start_command(res_path))
+        + "FROM l4_frontend_runtime AS production\n"
+        + "FROM l4_frontend_runtime AS development\n"
+    )
+
+
+# L4_generate_migrator_runtime is now loaded from prisma/prisma_runtime.star
+
+DEBUG = {}
+
+GLOBAL_CONFIG = {}

package/engine/topologies/platform/docker/layers/prisma/constants.star

@@ -0,0 +1,138 @@
+# Copyright (c) 2026 Flisk contributors
+# SPDX-License-Identifier: MIT
+# === INLINED CONSTANTS for pure extension loading ===
+RUNTIME = "bun"
+# === END INLINED CONSTANTS ===
+
+
+"""
+Shared constants/helpers for Prisma Docker layer generators.
+
+Centralizes repeated paths/defaults used across prisma_*.star modules so
+string-heavy Dockerfile/script fragments stay consistent and reusable.
+"""
+
+
+
+APP_DIR = "/app"
+NODE_MODULES_DIR = "node_modules"
+NODE_MODULES_BIN_DIR = NODE_MODULES_DIR + "/.bin"
+APP_NODE_MODULES_DIR = APP_DIR + "/" + NODE_MODULES_DIR
+APP_NODE_MODULES_BIN_DIR = APP_NODE_MODULES_DIR + "/.bin"
+APP_BUN_STORE_DIR = APP_NODE_MODULES_DIR + "/.bun"
+
+PRISMA_DIR_NAME = "prisma"
+PRISMA_SCOPE_DIR_NAME = "@prisma"
+PRISMA_SCHEMA_PATH = PRISMA_DIR_NAME + "/schema.prisma"
+
+PRISMA_CONFIG_FILE = "prisma.config.ts"
+PRISMA_CONFIG_WORKDIR_PATH = "./" + PRISMA_CONFIG_FILE
+PRISMA_CONFIG_ABS_PATH = APP_DIR + "/" + PRISMA_CONFIG_FILE
+
+APP_SRC_DIR = APP_DIR + "/src"
+APP_GENERATED_CLIENT_DIR = APP_DIR + "/generated-client"
+APP_PRISMA_DIR = APP_DIR + "/" + PRISMA_DIR_NAME
+
+PRISMA_DOT_DIR_REL_PATH = NODE_MODULES_DIR + "/.prisma"
+PRISMA_DOT_CLIENT_REL_PATH = PRISMA_DOT_DIR_REL_PATH + "/client"
+PRISMA_DOT_CLIENT_ABS_PATH = APP_DIR + "/" + PRISMA_DOT_CLIENT_REL_PATH
+
+PRISMA_BIN_REL_PATH = NODE_MODULES_DIR + "/.bin/prisma"
+PRISMA_BIN_ABS_PATH = APP_DIR + "/" + PRISMA_BIN_REL_PATH
+PRISMA_BIN_SYMLINK_TARGET = "../prisma/build/index.js"
+
+PRISMA_PACKAGE_REL_PATH = NODE_MODULES_DIR + "/prisma"
+PRISMA_SCOPE_REL_PATH = NODE_MODULES_DIR + "/" + PRISMA_SCOPE_DIR_NAME
+PRISMA_ENGINES_REL_PATH = PRISMA_SCOPE_REL_PATH + "/engines"
+PRISMA_PACKAGE_NODE_MODULES_REL_PATH = PRISMA_PACKAGE_REL_PATH + "/node_modules"
+
+APP_PRISMA_PACKAGE_DIR = APP_NODE_MODULES_DIR + "/" + PRISMA_DIR_NAME
+APP_PRISMA_SCOPE_DIR = APP_NODE_MODULES_DIR + "/" + PRISMA_SCOPE_DIR_NAME
+APP_PRISMA_ENGINES_DIR = APP_PRISMA_SCOPE_DIR + "/engines"
+APP_PRISMA_PACKAGE_NODE_MODULES_DIR = APP_PRISMA_PACKAGE_DIR + "/node_modules"
+APP_PRISMA_PACKAGE_ENGINES_DIR = APP_PRISMA_PACKAGE_NODE_MODULES_DIR + "/" + PRISMA_SCOPE_DIR_NAME + "/engines"
+
+PRISMA_CLIENT_PACKAGE_REL_PATH = PRISMA_SCOPE_REL_PATH + "/client"
+BUN_PRISMA_CLIENT_LINKER_NODE_MODULES_GLOB = NODE_MODULES_DIR + "/.bun/@prisma+client*/node_modules"
+
+MIGRATE_SH_FILE = "migrate.sh"
+MIGRATE_SH_ABS_PATH = APP_DIR + "/" + MIGRATE_SH_FILE
+
+L3_MIGRATION_BUILD_STAGE = "l3_migration_build"
+
+ROOT_USER = "root"
+BUN_USER = RUNTIME
+
+PRISMA_GENERATE_COMMAND = "bunx prisma generate"
+PRISMA_GENERATE_RUN = "RUN " + PRISMA_GENERATE_COMMAND + "\n"
+PRISMA_MIGRATE_DEPLOY_SUBCOMMAND = "migrate deploy"
+PRISMA_GENERATE_SUBCOMMAND = "generate"
+
+# Load project name for dynamic golden image naming
+# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+def _load_golden_prefix():
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_json_path = '.tdk/project.json'
+    if project_root:
+        project_json_path = project_root + '/' + project_json_path
+    
+    if os.path.exists(project_json_path):
+        _project_json = read_json(project_json_path)
+        return _project_json.get('project', {}).get('name', 'tdk-project')
+    return 'tdk-project'
+
+_GOLDEN_PREFIX = _load_golden_prefix()
+
+# Migrators build on l3-backend; the golden build no longer makes a separate l3-migrator image.
+DEFAULT_GOLDEN_L3_MIGRATOR_IMAGE = _GOLDEN_PREFIX + "-l3-backend:latest"
+DEFAULT_GOLDEN_L4_MIGRATOR_IMAGE = _GOLDEN_PREFIX + "-l4-migrator:latest"
+
+DEFAULT_DB_PORT = "5432"
+DEFAULT_DB_WAIT_TIMEOUT_SECS = 120
+DB_URL_HOSTPORT_WITH_AUTH_SED = "sed -n 's#^[^/]*//[^@]*@\\([^/]*\\)/.*#\\1#p'"
+DB_URL_HOSTPORT_NO_AUTH_SED = "sed -n 's#^[^/]*//\\([^/]*\\)/.*#\\1#p'"
+
+DEFAULT_INFISICAL_URL = "http://" + _GOLDEN_PREFIX + "-infisical:8081"
+DATABASE_URL_UNSET_CONDITION = "[ -z \"$DATABASE_URL\" ] || [ \"$DATABASE_URL\" = \"null\" ]"
+INFISICAL_SECRET_ENV_KEYS = [
+    "DATABASE_URL",
+    "DB_USER",
+    "DB_PASSWORD",
+    "DB_HOST",
+    "DB_PORT",
+    "DB_NAME",
+]
+DB_URL_COMPONENT_ENV_KEYS = [
+    "DB_USER",
+    "DB_PASSWORD",
+    "DB_HOST",
+    "DB_PORT",
+    "DB_NAME",
+]
+DB_URL_FROM_COMPONENTS = "postgresql://$DB_USER:$DB_PASSWORD@$DB_HOST:$DB_PORT/$DB_NAME"
+
+
+def app_resource_dir(res_path):
+    return APP_DIR + "/" + res_path
+
+
+def resource_node_modules_dir(res_path):
+    return app_resource_dir(res_path) + "/" + NODE_MODULES_DIR
+
+
+def prisma_normalize_output_block(include_generated_client_export = True):
+    """
+    Shared Prisma client normalization instructions used in both generic and
+    migration-engine build flows.
+
+    Args:
+        include_generated_client_export: Include generated-client.ts shim line.
+    """
+    export_flag = "1" if include_generated_client_export else "0"
+    return (
+        "# Normalize Prisma output for both import styles using shared script\n"
+        + "COPY shared-platform-engineering/docker-templates/prisma-normalize-client.sh /usr/local/bin/prisma-normalize-client.sh\n"
+        + "RUN chmod +x /usr/local/bin/prisma-normalize-client.sh && PRISMA_EXPORT_GENERATED_CLIENT="
+        + export_flag
+        + " /usr/local/bin/prisma-normalize-client.sh\n"
+    )