@flisk-sh/flisk 0.0.0-stage → 1.3.190

package/engine/topologies/tilt/generators/infisical/secrets_generator.star

@@ -0,0 +1,422 @@
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+# =============================================================================
+# 🔐 INFISICAL SECRETS GENERATOR
+# =============================================================================
+# Generates secret injection configuration for services
+# Replaces: Shell-based infisical-entrypoint.sh injection
+# =============================================================================
+#
+# This module generates:
+#   - Environment variable mappings for secret paths
+#   - Docker Compose secret injection configuration
+#   - Kubernetes secret references (future)
+#   - Local development .env templates
+#
+# Usage:
+#   load("./infisical/secrets_generator.star", "SecretsGenerator")
+#   config = SecretsGenerator.generate_for_service("my-service", "/services/my-service")
+# =============================================================================
+
+def _get_timestamp():
+    """Get current timestamp string"""
+    return str(local("date +%Y-%m-%dT%H:%M:%S", quiet=True)).strip()
+
+# =============================================================================
+# Secret Path Configuration
+# =============================================================================
+
+DEFAULT_SECRET_KEYS = [
+    "DATABASE_URL",
+    "JWT_SECRET",
+    "RESOURCE_API_KEY",
+    "REDIS_URL",
+    "NATS_URL",
+    "STRIPE_SECRET_KEY",
+    "STRIPE_WEBHOOK_SECRET",
+    "API_GATEWAY_TOKEN",
+]
+
+# Required secrets for each service type
+RESOURCE_TYPE_SECRETS = {
+    "backend": [
+        "DATABASE_URL",
+        "JWT_SECRET",
+        "RESOURCE_API_KEY",
+    ],
+    "frontend": [
+        "API_GATEWAY_TOKEN",
+    ],
+    "api-gateway": [
+        "JWT_SECRET",
+        "RESOURCE_API_KEY",
+    ],
+    "payment": [
+        "DATABASE_URL",
+        "JWT_SECRET",
+        "RESOURCE_API_KEY",
+        "STRIPE_SECRET_KEY",
+        "STRIPE_WEBHOOK_SECRET",
+    ],
+    "notification": [
+        "DATABASE_URL",
+        "JWT_SECRET",
+        "RESOURCE_API_KEY",
+        "SMTP_PASSWORD",
+        "SENDGRID_API_KEY",
+    ],
+}
+
+# =============================================================================
+# Secret Injection Patterns
+# =============================================================================
+
+def _generate_docker_compose_env(resource_name, secret_path, additional_vars=None):
+    """
+    Generate Docker Compose environment section for secret injection.
+    
+    Args:
+        resource_name: Name of the service
+        secret_path: Infisical path (e.g., /services/my-service)
+        additional_vars: Additional environment variables dict
+    
+    Returns:
+        Dictionary for docker-compose environment section
+    """
+    env = {
+        # Core Infisical configuration
+        "RESOURCE_NAME": resource_name,
+        "INFISICAL_SECRET_PATH": secret_path,
+        
+        # Token injection (from host env or Infisical)
+        "INFISICAL_TOKEN": "${INFISICAL_TOKEN:-}",
+        "INFISICAL_CLIENT_ID": "${INFISICAL_CLIENT_ID:-}",
+        "INFISICAL_CLIENT_SECRET": "${INFISICAL_CLIENT_SECRET:-}",
+        
+        # API configuration
+        "INFISICAL_API_URL": "${INFISICAL_API_URL:-http://infisical:8080}",
+        "INFISICAL_PROJECT_ID": "${INFISICAL_PROJECT_ID:-}",
+        "INFISICAL_ENVIRONMENT": "${INFISICAL_ENVIRONMENT:-dev}",
+        
+        # Fallback policy: this generator only feeds local Tilt/docker-compose dev
+        # environments (see topologies/platform/docker/compose/compose.star). There's
+        # rarely a real Infisical server running locally, so default to allowing the
+        # entrypoint to fall back to the plain env vars already in the compose file
+        # instead of failing to start. Production/CI paths (Kubernetes secrets, etc.)
+        # are generated separately and are unaffected by this default.
+        "INFISICAL_ALLOW_FALLBACK": "${INFISICAL_ALLOW_FALLBACK:-true}",
+    }
+    
+    if additional_vars:
+        env.update(additional_vars)
+    
+    return env
+
+def _generate_entrypoint_env(resource_name, secret_path, command):
+    """
+    Generate environment for entrypoint.sh-based secret injection.
+    
+    This is the zero-code pattern - entrypoint handles all secret fetching.
+    
+    Args:
+        resource_name: Name of the service
+        secret_path: Infisical path
+        command: Command to run after secret injection
+    
+    Returns:
+        Dict with entrypoint configuration
+    """
+    return {
+        "RESOURCE_NAME": resource_name,
+        "INFISICAL_SECRET_PATH": secret_path,
+        "INFISICAL_TOKEN": "${INFISICAL_TOKEN:-}",
+        "INFISICAL_CLIENT_ID": "${INFISICAL_CLIENT_ID:-}",
+        "INFISICAL_CLIENT_SECRET": "${INFISICAL_CLIENT_SECRET:-}",
+        "INFISICAL_API_URL": "${INFISICAL_API_URL:-http://infisical:8080}",
+        "INFISICAL_PROJECT_ID": "${INFISICAL_PROJECT_ID:-}",
+        "INFISICAL_ENVIRONMENT": "${INFISICAL_ENVIRONMENT:-dev}",
+        "ENTRYPOINT_COMMAND": command,
+        "INFISICAL_ALLOW_FALLBACK": "false",
+    }
+
+def _generate_kubernetes_secret_ref(resource_name, secret_path):
+    """
+    Generate Kubernetes secret reference configuration.
+    
+    Args:
+        resource_name: Name of the service
+        secret_path: Infisical path
+    
+    Returns:
+        Dict with Kubernetes secret configuration
+    """
+    return {
+        "apiVersion": "v1",
+        "kind": "Secret",
+        "metadata": {
+            "name": "{}-secrets".format(resource_name),
+            "annotations": {
+                "infisical.path": secret_path,
+                "infisical.operator.kubernetes.io/auto-reload": "true",
+            },
+        },
+        "type": "Opaque",
+    }
+
+# =============================================================================
+# Local Development Configuration
+# =============================================================================
+
+def _generate_local_env_template(resource_name, secret_path, resource_type="backend"):
+    """
+    Generate .env file template for local development.
+    
+    Args:
+        resource_name: Name of the service
+        secret_path: Infisical path
+        resource_type: Type of service for determining required secrets
+    
+    Returns:
+        String content for .env file
+    """
+    required_secrets = RESOURCE_TYPE_SECRETS.get(resource_type, RESOURCE_TYPE_SECRETS["backend"])
+    timestamp = _get_timestamp()
+    
+    lines = [
+        "# Infisical Local Development Configuration",
+        "# Service: {}".format(resource_name),
+        "# Path: {}".format(secret_path),
+        "# Generated: {}".format(timestamp),
+        "#",
+        "# ⚠️  SECURITY WARNING: Do not commit this file to Git!",
+        "# This file should be in .gitignore",
+        "",
+        "# Infisical Connection",
+        "INFISICAL_API_URL=http://localhost:8089",
+        "INFISICAL_ENVIRONMENT=dev",
+        "INFISICAL_SECRET_PATH={}".format(secret_path),
+        "RESOURCE_NAME={}".format(resource_name),
+        "",
+        "# Authentication (Machine Identity)",
+        "# Get these from Infisical Dashboard > Identities > machine1",
+        "INFISICAL_CLIENT_ID=your-client-id-here",
+        "INFISICAL_CLIENT_SECRET=your-client-secret-here",
+        "INFISICAL_PROJECT_ID=your-project-id-here",
+        "",
+        "# Required Secrets (to be fetched from Infisical):",
+    ]
+    
+    for secret in required_secrets:
+        lines.append("# {}=__will_be_fetched_from_infisical__".format(secret))
+    
+    lines.extend([
+        "",
+        "# Tilt Integration (optional)",
+        "# These are injected by Tilt during local development",
+        "TILT_ENV=local",
+        "TILT_HOST=localhost",
+    ])
+    
+    return "\n".join(lines)
+
+# =============================================================================
+# Validation
+# =============================================================================
+
+def _validate_secret_path(secret_path):
+    """
+    Validate Infisical secret path format.
+    
+    Args:
+        secret_path: Path to validate
+    
+    Returns:
+        Tuple (is_valid, error_message)
+    """
+    if not secret_path:
+        return False, "Secret path cannot be empty"
+    
+    if not secret_path.startswith("/"):
+        return False, "Secret path must start with /"
+    
+    # Valid characters: alphanumeric, hyphen, underscore, forward slash
+    valid_chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_/"
+    invalid = []
+    for i in range(len(secret_path)):
+        c = secret_path[i]
+        if c not in valid_chars:
+            invalid.append(c)
+    if len(invalid) > 0:
+        return False, "Invalid characters in path: {}".format(invalid)
+    
+    # Path depth limit (Infisical limitation)
+    parts = []
+    for x in secret_path.split("/"):
+        if x:
+            parts.append(x)
+    depth = len(parts)
+    if depth > 20:
+        return False, "Path depth exceeds maximum (20)"
+    
+    return True, ""
+
+def _validate_resource_name(resource_name):
+    """
+    Validate service name format.
+    
+    Args:
+        resource_name: Name to validate
+    
+    Returns:
+        Tuple (is_valid, error_message)
+    """
+    if not resource_name:
+        return False, "Service name cannot be empty"
+    
+    # Valid characters: alphanumeric, hyphen, underscore
+    valid_chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_"
+    invalid = []
+    for i in range(len(resource_name)):
+        c = resource_name[i]
+        if c not in valid_chars:
+            invalid.append(c)
+    if len(invalid) > 0:
+        return False, "Invalid characters in service name: {}".format(invalid)
+    
+    if len(resource_name) > 64:
+        return False, "Service name too long (max 64 characters)"
+    
+    return True, ""
+
+# =============================================================================
+# Main Generator Functions
+# =============================================================================
+
+def generate_for_service(resource_name, secret_path, resource_type="backend", command=None, additional_vars=None):
+    """
+    Generate complete secret injection configuration for a service.
+    
+    This is the main entry point for secret generation.
+    
+    Args:
+        resource_name: Name of the service (e.g., "user-management-backend")
+        secret_path: Infisical path (e.g., "/services/user")
+        resource_type: Type of service (backend, frontend, api-gateway, payment, notification)
+        command: Command to run after secret injection (for entrypoint pattern)
+        additional_vars: Additional environment variables
+    
+    Returns:
+        Dict with all secret configurations:
+        {
+            "resource_name": str,
+            "secret_path": str,
+            "resource_type": str,
+            "validation": {"valid": bool, "errors": [str]},
+            "docker_compose": {"environment": dict},
+            "entrypoint": {"environment": dict},
+            "kubernetes": {"secret_ref": dict},
+            "local_template": str,
+            "required_secrets": [str],
+        }
+    """
+    # Validate inputs
+    path_valid, path_error = _validate_secret_path(secret_path)
+    name_valid, name_error = _validate_resource_name(resource_name)
+    
+    errors = []
+    if not path_valid:
+        errors.append(path_error)
+    if not name_valid:
+        errors.append(name_error)
+    
+    validation = {
+        "valid": path_valid and name_valid,
+        "errors": errors,
+    }
+    
+    # Generate configurations
+    docker_compose_env = _generate_docker_compose_env(resource_name, secret_path, additional_vars)
+    
+    entrypoint_env = None
+    if command:
+        entrypoint_env = _generate_entrypoint_env(resource_name, secret_path, command)
+    
+    k8s_secret = _generate_kubernetes_secret_ref(resource_name, secret_path)
+    local_template = _generate_local_env_template(resource_name, secret_path, resource_type)
+    required_secrets = RESOURCE_TYPE_SECRETS.get(resource_type, RESOURCE_TYPE_SECRETS["backend"])
+    
+    return {
+        "resource_name": resource_name,
+        "secret_path": secret_path,
+        "resource_type": resource_type,
+        "validation": validation,
+        "docker_compose": {
+            "environment": docker_compose_env,
+        },
+        "entrypoint": {
+            "environment": entrypoint_env,
+        } if entrypoint_env else None,
+        "kubernetes": {
+            "secret_ref": k8s_secret,
+        },
+        "local_template": local_template,
+        "required_secrets": required_secrets,
+    }
+
+def generate_for_services_batch(services_config):
+    """
+    Generate secret configurations for multiple services.
+    
+    Args:
+        services_config: List of dicts with keys:
+            - name: Service name
+            - path: Infisical path
+            - type: Service type (optional, default "backend")
+            - command: Entrypoint command (optional)
+            - additional_vars: Additional env vars (optional)
+    
+    Returns:
+        Dict mapping service names to their configurations
+    """
+    results = {}
+    
+    for config in services_config:
+        name = config.get("name")
+        path = config.get("path")
+        svc_type = config.get("type", "backend")
+        command = config.get("command")
+        additional = config.get("additional_vars")
+        
+        if not name or not path:
+            results[name or "unknown"] = {
+                "validation": {"valid": False, "errors": ["Missing name or path"]},
+            }
+            continue
+        
+        results[name] = generate_for_service(name, path, svc_type, command, additional)
+    
+    return results
+
+# =============================================================================
+# Public API
+# =============================================================================
+
+SecretsGenerator = struct(
+    # Main generator functions
+    generate_for_service=generate_for_service,
+    generate_for_services_batch=generate_for_services_batch,
+    
+    # Validation
+    validate_secret_path=_validate_secret_path,
+    validate_resource_name=_validate_resource_name,
+    
+    # Configuration constants
+    DEFAULT_SECRET_KEYS=DEFAULT_SECRET_KEYS,
+    RESOURCE_TYPE_SECRETS=RESOURCE_TYPE_SECRETS,
+    
+    # Individual generators (for advanced use)
+    generate_docker_compose_env=_generate_docker_compose_env,
+    generate_entrypoint_env=_generate_entrypoint_env,
+    generate_kubernetes_secret_ref=_generate_kubernetes_secret_ref,
+    generate_local_env_template=_generate_local_env_template,
+)

package/engine/topologies/tilt/generators/nginx_conf.star

@@ -0,0 +1,145 @@
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+# =============================================================================
+# 🌐 TILT SDK - NGINX PROVIDER
+# =============================================================================
+# Path: .tilt/providers/nginx.star
+# Purpose: Generate nginx configs for frontend services
+# =============================================================================
+
+
+# === INLINED CONSTANTS for pure extension loading ===
+BASE_PORT_FRONTEND = 3000
+OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
+# === END INLINED CONSTANTS ===
+
+
+load('../../../topologies/tilt/common/utils.star', 'Utils')
+load('../../../topologies/tilt/manifest/constants.star', 'GENERATED_CONFIG_FILENAMES')
+
+# NOTE: api_gateway.star loaded by caller to avoid circular imports
+
+
+def api_proxy_location(backend_name, port=BASE_PORT_FRONTEND, base_path='', stack=''):
+    """Return nginx location /api block that proxy_passes to the given backend (Vite-proxy style in prod)."""
+    return """
+    location /api {{
+        proxy_pass http://{backend}:{port};
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }}""".format(backend=backend_name, port=port)
+
+
+def generate_frontend_nginx(manifest, write_fn=None, referer_map_block=''):
+    """
+    Generate nginx config for frontend services.
+    
+    Args:
+        manifest: Service manifest dict
+        write_fn: Function to write files
+        referer_map_block: Generated referer map block (from ApiGateway)
+
+    Output:
+      {resource_path}/.autogenerated/nginx.autogenerated.conf
+    """
+    if manifest.get('appType') != 'frontend':
+        return ''
+
+    resource_path = manifest.get('_resource_path', '')
+    app_name = manifest.get('appName', 'unknown-frontend')
+    backend_name = manifest.get('backendName', 'backend')
+    header = Utils.get_template_header(
+        'nginx',
+        'Nginx.frontend()',
+        app_name,
+        'Output: .autogenerated/' + GENERATED_CONFIG_FILENAMES['nginx'],
+    )
+
+    base_path = manifest.get('basePath', '')
+    stack = manifest.get('stack', '')
+    port = manifest.get('port', BASE_PORT_FRONTEND)
+    # NOTE: referer_map_block now passed as parameter to avoid circular import
+
+    conf = """{header}
+    # Docker DNS resolver
+    resolver 127.0.0.11 valid=30s ipv6=off;
+
+{referer_map_block}
+
+    server {{
+        listen 80;
+        server_name _;
+        root /usr/share/nginx/html;
+        index index.html;
+
+        gzip on;
+        gzip_vary on;
+        gzip_min_length 1024;
+        gzip_proxied any;
+        gzip_comp_level 6;
+        gzip_types
+            text/plain
+            text/css
+            text/xml
+            text/javascript
+            application/json
+            application/javascript
+            application/xml+rss
+            application/atom+xml
+            image/svg+xml;
+
+        location / {{
+            try_files $uri $uri/ /index.html;
+            add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+            add_header Pragma "no-cache" always;
+            add_header Expires "0" always;
+        }}
+
+        location ~* \\.(js|css)$ {{
+            expires 2m;
+            add_header Cache-Control "public, max-age=120, must-revalidate";
+            add_header Last-Modified $date_gmt;
+            add_header ETag off;
+            if_modified_since off;
+        }}
+
+        location ~* \\.(png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {{
+            expires 1y;
+            add_header Cache-Control "public, immutable";
+        }}
+
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-XSS-Protection "1; mode=block" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+        location /api {{
+            proxy_pass $api_backend;
+            proxy_http_version 1.1;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header X-Referer $http_referer;
+        }}
+
+        location /health {{
+            access_log off;
+            return 200 "healthy\\n";
+            add_header Content-Type text/plain;
+        }}
+    }}""".format(header=header, referer_map_block=referer_map_block)
+
+    if write_fn:
+        write_fn(resource_path + '/' + OUTPUT.AUTOGENERATED_FOLDER + '/' + GENERATED_CONFIG_FILENAMES['nginx'], conf)
+
+    return conf
+
+
+Nginx = struct(
+    api_proxy_location = api_proxy_location,
+    frontend = generate_frontend_nginx,
+)

package/engine/topologies/tilt/generators/npmrc.star

@@ -0,0 +1,132 @@
+# Copyright (c) 2026 Flisk contributors
+# SPDX-License-Identifier: MIT
+# =============================================================================
+# 📦 TILT SDK - NPM/BUN CONFIG PROVIDER
+# =============================================================================
+# Path: .tilt/providers/npmrc.star
+# Purpose: Generate .npmrc and bunfig.toml for Verdaccio registry
+# =============================================================================
+#
+# Generates configuration files for:
+# - .npmrc / .npmrc.docker.autogenerated - NPM registry configuration
+# - bunfig.toml / bunfig.docker.autogenerated.toml - Bun package manager configuration
+#
+# These files ensure services can install @{npm_scope}/* packages from
+# the local Verdaccio registry during development.
+# =============================================================================
+
+load("../../../topologies/tilt/common/utils.star", "Utils")
+
+# Output folder constant (consistent with other generators)
+OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
+
+# Load npm scope from project.json (or use project name as default)
+# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+def _load_npm_scope():
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_json_path = '.tdk/project.json'
+    if project_root:
+        project_json_path = project_root + '/' + project_json_path
+    
+    if os.path.exists(project_json_path):
+        _project_json = read_json(project_json_path)
+        return _project_json.get('project', {}).get('name', 'tdk-project')
+    return 'tdk-project'
+
+_NPM_SCOPE = _load_npm_scope()
+load("../../../topologies/tilt/manifest/constants.star", "PACKAGE_CONFIG_FILENAMES")
+
+# =============================================================================
+# 📝 NPMRC GENERATORS
+# =============================================================================
+
+def generate_npmrc(resource_path, registry_url, is_docker, write_fn, verdaccio_enabled=True):
+    """
+    Generate .npmrc for NPM registry configuration.
+
+    Args:
+        resource_path: Path to service directory
+        registry_url: Verdaccio registry URL
+        is_docker: If True, generates .npmrc.docker.autogenerated, else .npmrc
+        write_fn: File writer function
+        verdaccio_enabled: If False, scoped packages fall back to public npm (default True)
+    """
+    target_dir = resource_path + "/" + OUTPUT.AUTOGENERATED_FOLDER
+    generated_filename = PACKAGE_CONFIG_FILENAMES['npmrc_docker_autogenerated'] if is_docker else PACKAGE_CONFIG_FILENAMES['npmrc']
+    header = Utils.get_template_header("npmrc", target_dir + "/" + generated_filename)
+
+    if verdaccio_enabled:
+        # Verdaccio's default policy permits anonymous reads and requires
+        # authentication only for publishing. Keep user credentials in the
+        # user's npm config; generated project files must not contain defaults.
+        content = """{header}
+registry=https://registry.npmjs.org/
+@{npm_scope}:registry={registry_url}/
+@tdk-landscape:registry={registry_url}/
+@identity:registry={registry_url}/""".format(header=header, registry_url=registry_url, npm_scope=_NPM_SCOPE)
+    else:
+        # Verdaccio not enabled (no license key) — all scopes use public npm
+        content = """{header}
+registry=https://registry.npmjs.org/
+@{npm_scope}:registry=https://registry.npmjs.org/
+@tdk-landscape:registry=https://registry.npmjs.org/
+@identity:registry=https://registry.npmjs.org/""".format(header=header, npm_scope=_NPM_SCOPE)
+    
+    filename = generated_filename
+    write_fn(target_dir + '/' + filename, content)
+
+
+# =============================================================================
+# 📝 BUNFIG GENERATORS
+# =============================================================================
+
+def generate_bunfig(resource_path, registry_url, is_docker, write_fn, verdaccio_enabled=True):
+    """
+    Generate bunfig.toml for Bun package manager configuration.
+
+    Args:
+        resource_path: Path to service directory
+        registry_url: Verdaccio registry URL
+        is_docker: If True, generates bunfig.docker.autogenerated.toml, else bunfig.toml
+        write_fn: File writer function
+        verdaccio_enabled: If False, scoped packages fall back to public npm (default True)
+    """
+    target_dir = resource_path + "/" + OUTPUT.AUTOGENERATED_FOLDER
+    generated_filename = PACKAGE_CONFIG_FILENAMES['bunfig_docker_autogenerated'] if is_docker else PACKAGE_CONFIG_FILENAMES['bunfig']
+    header = Utils.get_template_header("bunfig", target_dir + "/" + generated_filename)
+
+    if verdaccio_enabled:
+        content = """{header}
+[install]
+linker = "isolated"
+linkWorkspacePackages = true
+registry = "https://registry.npmjs.org"
+
+[install.scopes]
+"@{npm_scope}" = {{ url = "{registry_url}/" }}
+"@tdk-landscape" = {{ url = "{registry_url}/" }}
+"@identity" = {{ url = "{registry_url}/" }}
+
+""".format(header=header, registry_url=registry_url, npm_scope=_NPM_SCOPE)
+    else:
+        # Verdaccio not enabled (no license key) — all scopes use public npm
+        content = """{header}
+[install]
+linker = "isolated"
+linkWorkspacePackages = true
+registry = "https://registry.npmjs.org"
+
+""".format(header=header)
+
+    filename = generated_filename
+    write_fn(target_dir + '/' + filename, content)
+
+
+# =============================================================================
+# 🎯 PUBLIC API - Struct-based Exports
+# =============================================================================
+
+PackageConfig = struct(
+    npmrc = generate_npmrc,
+    bunfig = generate_bunfig,
+)