@flisk-sh/flisk 1.4.2 → 1.4.6

package/runtime/engine/topologies/platform/docker/dockerfile/next_dockerfile.star

@@ -0,0 +1,83 @@
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+# Dockerfile for a Next.js frontend (`framework: next`). Node image, not the Bun + nginx SPA image; see
+# language_dockerfile.star for the other provider-owned runtimes.
+
+load('../build/golden_image_constants.star', 'get_layer_reference')
+
+BASE_PORT_FRONTEND = 3000
+
+# Same RUN line as the backend templates in language_dockerfile.star (Starlark does not export underscored names).
+_NEXT_CURL = """RUN apt-get update && apt-get install -y --no-install-recommends curl \\
+  && rm -rf /var/lib/apt/lists/*
+"""
+
+# Next.js frontend (`framework: next`): a Node image, not the Bun + nginx SPA image. `development` runs `next dev` (what Tilt builds, with
+# the sources live-updated into it); `production` is the standalone server `next build` writes. The engine's env file becomes `.env`,
+# which Next loads in both modes, so next.config.mjs sees FLISK_BASE_PATH and the browser bundle gets NEXT_PUBLIC_API_URL.
+# The Node runtime comes from the approved golden layer `l4-backend-node` when the golden image is enabled (the same
+# `use_golden` switch the Bun generators use); otherwise it is the upstream node image.
+# The `production` stage is the last one, so a plain `docker build` of the file also produces it.
+_BASE_ARG = "ARG BASE_IMAGE="
+
+_NEXT = """# Generated by Flisk for a Next.js frontend. Do not edit; change service.json instead.
+# The default is the upstream node image, pinned by digest like the backend Node template; the golden path replaces it.
+ARG BASE_IMAGE=node:22-slim@sha256:c3de60bf2f9dd0ac6370e6117950ff62d6e339527e7472301c9c78a017978392
+FROM ${{BASE_IMAGE}} AS base
+ENV NEXT_TELEMETRY_DISABLED=1
+# The golden runtime runs as a non-root user; install and build as root, then drop to {run_user} for the running stages.
+USER root
+WORKDIR /app/{res_path}
+
+{curl}
+COPY {res_path}/package.json {res_path}/package-lock.jso[n] ./
+RUN if [ -f package-lock.json ]; then npm ci --no-audit --no-fund; else npm install --no-audit --no-fund; fi
+
+COPY {res_path}/.autogenerated/.env.frontend.autogenerated ./.env
+COPY {res_path}/next.config.mjs ./next.config.mjs
+COPY {res_path}/tsconfig.json ./tsconfig.json
+COPY {res_path}/public ./public
+COPY {res_path}/src ./src
+
+FROM base AS development
+# WORKDIR is created by root, and next dev writes .next (and next-env.d.ts) inside it as {run_user}:
+# without this the dev server dies with EACCES: mkdir '.next'. Give the run user the app folder.
+ENV PORT={port} HOSTNAME=0.0.0.0
+RUN chown -R {run_user}:{run_user} /app/{res_path}
+USER {run_user}
+EXPOSE {port}
+CMD ["npx", "next", "dev", "--hostname", "0.0.0.0", "--port", "{port}"]
+
+FROM base AS build
+RUN npx next build
+
+FROM ${{BASE_IMAGE}} AS production
+ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 PORT={port} HOSTNAME=0.0.0.0
+WORKDIR /app/{res_path}
+{curl}
+COPY --from=build --chown={run_user}:{run_user} /app/{res_path}/.next/standalone ./
+COPY --from=build --chown={run_user}:{run_user} /app/{res_path}/.next/static ./.next/static
+COPY --from=build --chown={run_user}:{run_user} /app/{res_path}/public ./public
+USER {run_user}
+EXPOSE {port}
+CMD ["node", "server.js"]
+"""
+
+def generate_next_dockerfile(res_path, port = BASE_PORT_FRONTEND, use_golden = True):
+    """Dockerfile text for a Next.js frontend: `development` (next dev), `build`, and `production` (standalone server).
+
+    With `use_golden` the base is the approved golden `l4-backend-node` layer (alpine, curl already present, non-root `app`);
+    without it, the upstream node image (debian slim, which needs curl installed, non-root `node`).
+    """
+    if use_golden:
+        run_user = 'app'
+        curl = ''
+    else:
+        run_user = 'node'
+        curl = _NEXT_CURL
+    text = _NEXT.format(res_path = res_path, port = port, run_user = run_user, curl = curl)
+    if use_golden:
+        head, _, rest = text.partition(_BASE_ARG)
+        _, _, tail = rest.partition("\n")
+        text = head + _BASE_ARG + get_layer_reference('l4-backend-node') + "\n" + tail
+    return text

package/runtime/engine/topologies/platform/docker/index.star

@@ -6,11 +6,13 @@ load(
     "generate_app_dockerfile",
     "generate_migrator_dockerfile",
 )
+load("./dockerfile/next_dockerfile.star", "generate_next_dockerfile")
 load(
     "./dockerfile/language_dockerfile.star",
     "generate_language_dockerfile",
     "is_provider_owned_language",
     "go_live_reload_enabled",
+    "is_next_frontend",
     "LANGUAGE_REQUIRED_FILES",
 )
 load("./config/dockerignore.star", "generate_dockerignore")
@@ -30,6 +32,8 @@ Docker = struct(
     backend_language = generate_language_dockerfile,
     is_provider_owned_language = is_provider_owned_language,
     go_live_reload = go_live_reload_enabled,
+    next_frontend = generate_next_dockerfile,
+    is_next_frontend = is_next_frontend,
     language_required_files = LANGUAGE_REQUIRED_FILES,
     generate_dockerignore = generate_dockerignore,
     frontend_compose = generate_frontend_compose,

package/runtime/engine/topologies/platform/docker/layers/prisma/filesystem_setup.star

@@ -19,6 +19,7 @@ load(
 load(
     './constants.star',
     'APP_BUN_STORE_DIR',
+    'APP_DIR',
     'APP_GENERATED_CLIENT_DIR',
     'APP_NODE_MODULES_BIN_DIR',
     'APP_NODE_MODULES_DIR',
@@ -46,10 +47,16 @@ def prisma_dir_and_permissions():
     Create directories that Prisma writes to at runtime and ensure the `bun` user owns
     them.  Handles both the standard `node_modules/.prisma/client` path and custom
     output paths like `../src/generated` or `../generated-client`.
+
+    `/app` itself is owned by `bun` too: `migrate.sh` runs `prisma generate` as `bun`,
+    and a generator output such as `../generated/prisma` (the `flisk resource
+    --feature prisma` scaffold) makes Prisma create a new directory directly under
+    `/app`, which fails with EACCES while root owns it.
     """
     return (
         "# Ensure Prisma can write generated files including custom output paths\n"
         + "RUN mkdir -p " + APP_NODE_MODULES_DIR + " " + APP_SRC_DIR + " " + APP_GENERATED_CLIENT_DIR
+        + " && chown " + BUN_USER + ":" + BUN_USER + " " + APP_DIR
         + " && chown -R " + BUN_USER + ":" + BUN_USER
         + " " + APP_PRISMA_DIR + " " + APP_NODE_MODULES_DIR + " " + APP_SRC_DIR + " " + APP_GENERATED_CLIENT_DIR
         + " " + PRISMA_CONFIG_ABS_PATH + " || true\n"

package/runtime/engine/topologies/platform/docker/networking/traefik.star

@@ -38,6 +38,31 @@ load("./sablier_container_cycle.star",
     "sablier_container_labels",
 )
 load("../compose/unsafe_value.star", "reject_unsafe_value")
+load("../constants.star", "PROJECT_NAME_HYPHEN")
+
+
+def _project_slug():
+    """The project name with every character except letters and digits written as `_` plus its six-digit hex code.
+
+    The result has no `-` in it, so the first `-` in a scoped name always separates the project from the resource. That
+    keeps the mapping one-to-one: `team` + `app-api` and `team-app` + `api` get different names, and so do `a-b` and `a_b`.
+    """
+    return "".join([ch if ch.isalnum() else "_" + _hex6(ord(ch)) for ch in PROJECT_NAME_HYPHEN.elems()])
+
+
+def _hex6(code):
+    """`code` in hex, zero-padded to six digits so every escape has the same width."""
+    return ("000000" + "%x" % code)[-6:]
+
+
+def traefik_scoped_name(name):
+    """Router, middleware and service name for `name`, prefixed with this Flisk project.
+
+    One Traefik instance serves every Flisk project on the machine, and it keys routers, middlewares and services by name
+    alone. Two projects that name a resource the same (`api`, say) would define the same router twice, and Traefik drops both.
+    The project prefix keeps them apart.
+    """
+    return _project_slug() + "-" + name
 
 
 def get_frontend_traefik_labels(res_name, domain, base_path, port, traefik_host=None, manifest=None):
@@ -55,8 +80,9 @@ def get_frontend_traefik_labels(res_name, domain, base_path, port, traefik_host=
         TRAEFIK_FRONTEND_ENABLE_HTTP,
         TRAEFIK_FRONTEND_ENABLE_HTTPS,
     )
-    middleware_name = res_name + TRAEFIK_MIDDLEWARE_SUFFIX
-    
+    router_name = traefik_scoped_name(res_name)
+    middleware_name = router_name + TRAEFIK_MIDDLEWARE_SUFFIX
+
     # Check if maintenance feature is enabled
     features = manifest.get('featuresEnabled', []) if manifest else []
     maintenance_middleware = ""
@@ -66,20 +92,31 @@ def get_frontend_traefik_labels(res_name, domain, base_path, port, traefik_host=
     # On-demand scaling: attach the Sablier middleware when opted in via the manifest
     sablier_middleware, sablier_enabled = sablier_middleware_suffix(manifest, res_name)
 
-    labels = """        - "{traefik_enable_label}"
-        - 'traefik.http.routers.{res_name}.rule={frontend_route_rule}'
-        - "traefik.http.routers.{res_name}.entrypoints={frontend_entrypoints}"
-        - "traefik.http.routers.{res_name}.priority={router_priority}"
-        - "traefik.http.routers.{res_name}.middlewares={middleware_name}{maintenance_middleware}{sablier_middleware}"
+    # Next.js serves under its own basePath, so the prefix must reach it: the route keeps /<name> and adds no stripprefix middleware.
+    strips_prefix = not manifest or manifest.get('framework') != 'next'
+    if strips_prefix:
+        middlewares = middleware_name + maintenance_middleware + sablier_middleware
+        middleware_labels = """        - "traefik.http.routers.{router_name}.middlewares={middlewares}"
         - "traefik.http.middlewares.{middleware_name}.stripprefix.prefixes={base_path}"
-        - "traefik.http.services.{res_name}.loadbalancer.server.port={port}"
+""".format(router_name=router_name, middlewares=middlewares, middleware_name=middleware_name, base_path=base_path)
+    else:
+        middlewares = (maintenance_middleware + sablier_middleware).lstrip(",")
+        middleware_labels = ""
+        if middlewares:
+            middleware_labels = """        - "traefik.http.routers.{router_name}.middlewares={middlewares}"
+""".format(router_name=router_name, middlewares=middlewares)
+
+    labels = """        - "{traefik_enable_label}"
+        - 'traefik.http.routers.{router_name}.rule={frontend_route_rule}'
+        - "traefik.http.routers.{router_name}.entrypoints={frontend_entrypoints}"
+        - "traefik.http.routers.{router_name}.priority={router_priority}"
+{middleware_labels}        - "traefik.http.services.{router_name}.loadbalancer.server.port={port}"
         - "traefik.docker.network={traefik_network}\"""".format(
-        res_name=res_name,
+        router_name=router_name,
         traefik_enable_label=TRAEFIK_ENABLE_LABEL,
         frontend_route_rule=frontend_route_rule,
         frontend_entrypoints=frontend_entrypoints,
-        middleware_name=middleware_name,
-        base_path=base_path,
+        middleware_labels=middleware_labels,
         port=port,
         router_priority=router_priority,
         traefik_network=TRAEFIK_DOCKER_NETWORK,
@@ -135,8 +172,10 @@ def get_backend_traefik_labels(
         TRAEFIK_BACKEND_ENABLE_HTTP,
         TRAEFIK_BACKEND_ENABLE_HTTPS,
     )
-    middleware_name = resource_entry_name + TRAEFIK_MIDDLEWARE_SUFFIX
-    
+    router_name = traefik_scoped_name(resource_entry_name)
+    service_name = traefik_scoped_name(traefik_resource_name)
+    middleware_name = router_name + TRAEFIK_MIDDLEWARE_SUFFIX
+
     # Check if maintenance feature is enabled
     features = manifest.get('featuresEnabled', []) if manifest else []
     maintenance_middleware = ""
@@ -149,13 +188,13 @@ def get_backend_traefik_labels(
     # Build middleware config only if traefik_path is not empty
     if traefik_path:
         middleware_config_lines = [
-            '      - "traefik.http.routers.' + resource_entry_name + '.middlewares=' + middleware_name + maintenance_middleware + sablier_middleware + '"',
+            '      - "traefik.http.routers.' + router_name + '.middlewares=' + middleware_name + maintenance_middleware + sablier_middleware + '"',
             '      - "traefik.http.middlewares.' + middleware_name + '.stripprefix.prefixes=' + traefik_path + '"',
         ]
         middleware_config = "\n".join(middleware_config_lines)
     elif sablier_middleware:
         # No strip-prefix path, but still front the router with the Sablier middleware
-        middleware_config = '      - "traefik.http.routers.' + resource_entry_name + '.middlewares=' + sablier_middleware.lstrip(",") + '"'
+        middleware_config = '      - "traefik.http.routers.' + router_name + '.middlewares=' + sablier_middleware.lstrip(",") + '"'
     else:
         # No middleware if path is empty - router has no middlewares
         middleware_config = ""
@@ -171,15 +210,15 @@ def get_backend_traefik_labels(
     if stack_shared and not backend_route_rule:
         backend_router_labels = ""
     else:
-        backend_router_labels = """      - "traefik.http.routers.{resource_entry_name}.rule={backend_route_rule}"
-      - "traefik.http.routers.{resource_entry_name}.entrypoints={backend_entrypoints}"
-      - "traefik.http.routers.{resource_entry_name}.service={traefik_resource_name}"
+        backend_router_labels = """      - "traefik.http.routers.{router_name}.rule={backend_route_rule}"
+      - "traefik.http.routers.{router_name}.entrypoints={backend_entrypoints}"
+      - "traefik.http.routers.{router_name}.service={service_name}"
 {middleware_config}
 """.format(
-            resource_entry_name=resource_entry_name,
+            router_name=router_name,
             backend_route_rule=backend_route_rule,
             backend_entrypoints=backend_entrypoints,
-            traefik_resource_name=traefik_resource_name,
+            service_name=service_name,
             middleware_config=middleware_config,
         )
 
@@ -187,25 +226,25 @@ def get_backend_traefik_labels(
     # probing a path the service never serves.
     traefik_healthcheck_labels = ""
     if health_path:
-        traefik_healthcheck_labels = """      - "traefik.http.services.{traefik_resource_name}.loadbalancer.healthcheck.path={health_path}"
-      - "traefik.http.services.{traefik_resource_name}.loadbalancer.healthcheck.interval={health_interval}"
-      - "traefik.http.services.{traefik_resource_name}.loadbalancer.healthcheck.timeout={health_timeout}"
-      - "traefik.http.services.{traefik_resource_name}.loadbalancer.healthcheck.followredirects=false"
+        traefik_healthcheck_labels = """      - "traefik.http.services.{service_name}.loadbalancer.healthcheck.path={health_path}"
+      - "traefik.http.services.{service_name}.loadbalancer.healthcheck.interval={health_interval}"
+      - "traefik.http.services.{service_name}.loadbalancer.healthcheck.timeout={health_timeout}"
+      - "traefik.http.services.{service_name}.loadbalancer.healthcheck.followredirects=false"
 """.format(
-            traefik_resource_name=traefik_resource_name,
+            service_name=service_name,
             health_path=health_path,
             health_interval=TRAEFIK_HEALTHCHECK_INTERVAL,
             health_timeout=TRAEFIK_HEALTHCHECK_TIMEOUT,
         )
 
     labels = """      - "{traefik_enable_label}"
-{backend_router_labels}      - "traefik.http.services.{traefik_resource_name}.loadbalancer.server.port={internal_port}"
+{backend_router_labels}      - "traefik.http.services.{service_name}.loadbalancer.server.port={internal_port}"
 {traefik_healthcheck_labels}      - "traefik.docker.network={traefik_network}"
 """.format(
-        resource_entry_name=resource_entry_name,
+        router_name=router_name,
         traefik_enable_label=TRAEFIK_ENABLE_LABEL,
         backend_router_labels=backend_router_labels,
-        traefik_resource_name=traefik_resource_name,
+        service_name=service_name,
         internal_port=internal_port,
         traefik_healthcheck_labels=traefik_healthcheck_labels,
         traefik_network=TRAEFIK_DOCKER_NETWORK,
@@ -233,15 +272,15 @@ def get_backend_traefik_labels(
         management_path = get_api_path(stack, manifest) if stack else ""
 
         labels += """
-      - "traefik.http.routers.{resource_entry_name}-project.rule={project_rule}"
-      - "traefik.http.routers.{resource_entry_name}-project.entrypoints={project_entrypoints}"
-      - "traefik.http.routers.{resource_entry_name}-project.service={traefik_resource_name}"
-      - "traefik.http.routers.{resource_entry_name}-project.middlewares={middleware_name}-project{maintenance_middleware}{sablier_middleware}"
+      - "traefik.http.routers.{router_name}-project.rule={project_rule}"
+      - "traefik.http.routers.{router_name}-project.entrypoints={project_entrypoints}"
+      - "traefik.http.routers.{router_name}-project.service={service_name}"
+      - "traefik.http.routers.{router_name}-project.middlewares={middleware_name}-project{maintenance_middleware}{sablier_middleware}"
       - "traefik.http.middlewares.{middleware_name}-project.stripprefix.prefixes={api_path}"
-      - "traefik.http.routers.{resource_entry_name}-project.priority={router_priority}"
+      - "traefik.http.routers.{router_name}-project.priority={router_priority}"
 """.format(
-            resource_entry_name=resource_entry_name,
-            traefik_resource_name=traefik_resource_name,
+            router_name=router_name,
+            service_name=service_name,
             project_rule=project_rule,
             project_entrypoints=project_entrypoints,
             middleware_name=middleware_name,
@@ -253,15 +292,15 @@ def get_backend_traefik_labels(
 
         if management_path and management_path != api_path and not stack_shared:
             labels += """
-      - "traefik.http.routers.{resource_entry_name}-management.rule=Host(`{api_host}`) && PathPrefix(`{management_path}`)"
-      - "traefik.http.routers.{resource_entry_name}-management.entrypoints={project_entrypoints}"
-      - "traefik.http.routers.{resource_entry_name}-management.service={traefik_resource_name}"
-      - "traefik.http.routers.{resource_entry_name}-management.middlewares={middleware_name}-management{sablier_middleware}"
+      - "traefik.http.routers.{router_name}-management.rule=Host(`{api_host}`) && PathPrefix(`{management_path}`)"
+      - "traefik.http.routers.{router_name}-management.entrypoints={project_entrypoints}"
+      - "traefik.http.routers.{router_name}-management.service={service_name}"
+      - "traefik.http.routers.{router_name}-management.middlewares={middleware_name}-management{sablier_middleware}"
       - "traefik.http.middlewares.{middleware_name}-management.stripprefix.prefixes={management_path}"
-      - "traefik.http.routers.{resource_entry_name}-management.priority={mgmt_priority}"
+      - "traefik.http.routers.{router_name}-management.priority={mgmt_priority}"
 """.format(
-                resource_entry_name=resource_entry_name,
-                traefik_resource_name=traefik_resource_name,
+                router_name=router_name,
+                service_name=service_name,
                 api_host=TRAEFIK_PROJECT_API_HOST,
                 management_path=management_path,
                 project_entrypoints=project_entrypoints,
@@ -273,11 +312,11 @@ def get_backend_traefik_labels(
         if old_path_pattern:
             labels += """
       # Redirect middleware for URL restructuring: old path -> new path
-      - "traefik.http.middlewares.{resource_entry_name}-redirect.redirectregex.regex=^`{old_path_pattern}/(.*)`"
-      - "traefik.http.middlewares.{resource_entry_name}-redirect.redirectregex.replacement=`{api_path}/$$1`"
-      - "traefik.http.middlewares.{resource_entry_name}-redirect.redirectregex.permanent=true"
+      - "traefik.http.middlewares.{router_name}-redirect.redirectregex.regex=^`{old_path_pattern}/(.*)`"
+      - "traefik.http.middlewares.{router_name}-redirect.redirectregex.replacement=`{api_path}/$$1`"
+      - "traefik.http.middlewares.{router_name}-redirect.redirectregex.permanent=true"
 """.format(
-                resource_entry_name=resource_entry_name,
+                router_name=router_name,
                 old_path_pattern=old_path_pattern,
                 api_path=api_path,
             )

package/runtime/engine/topologies/platform/docker/networking/traefik_static_routes.star

@@ -17,7 +17,7 @@
 # Config for a request travels to the gateway via headers (X-Wake-*), not
 # the path/query. The route still strips the same `apiPath` prefix the real
 # Docker-label `-project` router strips (get_backend_traefik_labels) before
-# forwarding -- confirmed live against tdk-erp-system (task 7.2) that a
+# forwarding -- confirmed live against flisk-erp-system (task 7.2) that a
 # backend's app only serves its bare health path (e.g. `/health`), not the
 # full `/api/{name}/health` the public route is matched on; without this, the
 # gateway's own proxy-through would forward the unstripped path once healthy
@@ -61,7 +61,7 @@ def _container_name(compose_project_name, res_name):
     Confirmed empirically against a live Flisk container (analytics-autogenerated
     -data-governance-api-1) -- see design.md D2 Context. Compose projects are now
     <project>-<stack>-autogenerated, so the name starts with the Flisk project too
-    (tdk-erp-system-analytics-autogenerated-data-governance-api-1). Always replica 1: a
+    (flisk-erp-system-analytics-autogenerated-data-governance-api-1). Always replica 1: a
     deferred resource's replica count is unrelated to which single instance
     the wake gateway needs to address."""
     return compose_project_name + "-" + res_name + "-1"

package/runtime/engine/topologies/tilt/common/utils_output.star

@@ -85,6 +85,7 @@ def get_template_header(file_type, generator_name, resource_name='', extra_info=
 {c} TO MODIFY THIS CONFIGURATION:
 {c} 1. Edit the source generator in: .tilt/topologies/
 {c} 2. Or update service.json
+{c} Regenerate with: flisk config regenerate
 {c}
 {c} Generation Source: {generator}{resource_line}{extra_line}
 {border}

package/runtime/engine/topologies/tilt/generators/validators.star

@@ -571,7 +571,7 @@ def generate_resource_health_check(resource_name, resource_path, manifest, check
     }.get(manifest.get("language", "bun"), ["package.json", "prisma/schema.prisma"])
     required_files = {
         "backend": backend_files,
-        "frontend": ["package.json", "index.html", frontend_entry],
+        "frontend": ["package.json", "next.config.mjs", "src/app/page.tsx"] if manifest.get("framework") == "next" else ["package.json", "index.html", frontend_entry],
         "library": ["package.json"],
     }.get(app_type, ["package.json"])
     

package/runtime/engine/topologies/tilt/generators/vite/frontend.star

@@ -111,9 +111,9 @@ def generate_frontend(manifest, backend_manifest=None, write_fn=None):
     stack = manifest.get('stack', 'app')
     port = manifest.get('port', BASE_PORT_FRONTEND)
     hmr_port = port + 1000  # HMR port is always port + 1000
-    base_path = get_frontend_base_path(manifest)
-    vite_base_path = _normalize_vite_base_path(base_path)
     app_name = manifest.get('appName', 'unknown')
+    base_path = get_frontend_base_path(manifest, app_name)
+    vite_base_path = _normalize_vite_base_path(base_path)
 
     backend_port = BASE_PORT_BACKEND
     if backend_manifest:

package/runtime/engine/topologies/tilt/generators/vite/generators.star

@@ -31,6 +31,9 @@ def generate_for_manifest(manifest, backend_manifest=None, write_fn=None):
         return None
     
     if app_type == 'frontend':
+        # Next.js owns its build config (next.config.mjs); there is no Vite config to generate.
+        if manifest.get('framework') == 'next':
+            return None
         return generate_frontend(manifest, backend_manifest, write_fn)
     elif app_type == 'backend':
         return generate_backend(manifest, write_fn)

package/runtime/engine/topologies/tilt/manifest/constants.star

@@ -196,6 +196,9 @@ DEFAULT_SYNCS = {
     'bring-your-own': [],
 }
 
+# Next.js owns its entry files (no index.html) and rebuilds from package.json or next.config.*, which are not synced.
+NEXT_FRONTEND_SYNCS = ['src', 'public']
+
 RUNTIME_CONFIGS = {
     'bun': {
         'image_base': 'oven/bun:1.3.11-alpine',

package/runtime/engine/topologies/tilt/manifest/mapper.star

@@ -190,7 +190,7 @@ def map_manifest(manifest, target_format='internal'):
 def _to_yaml_format(internal_manifest):
     """Convert internal format to YAML hierarchical format."""
     return {
-        'apiVersion': 'tilt.Flisk Landscape.io/v1',
+        'apiVersion': 'tilt.flisk.io/v1',
         'kind': 'ResourceManifest',
         'metadata': {
             'name': internal_manifest.get('appName', ''),

package/runtime/engine/topologies/tilt/manifest/parser.star

@@ -20,6 +20,7 @@ load("./constants.star",
     "MANIFEST_FILENAME",
     "VALID_APP_TYPES",
     "DEFAULT_SYNCS",
+    "NEXT_FRONTEND_SYNCS",
     "AUTOGENERATED_CONFIG_PATHS",
     "TRAEFIK_DEFAULTS",
 )
@@ -90,6 +91,7 @@ _GENERATED_STRING_RULES = [
     (['databaseName'], _ALPHANUM + '_-', ''),
     (['stack'], _ALPHANUM + '_-', ''),
     (['image'], _ALPHANUM + '._/:@-', ''),
+    (['basePath'], _PATH_CHARS, '/'),
 ]
 
 def generated_string_error(manifest, resource_path=""):
@@ -200,7 +202,8 @@ def normalize(manifest, resource_path=""):
     if normalized.get('syncs') == None or normalized.get('syncs') == []:
         normalized['syncs'] = _compute_syncs(
             normalized['appType'],
-            normalized.get('featuresEnabled', [])
+            normalized.get('featuresEnabled', []),
+            normalized.get('framework')
         )
     
     # Compute backendName for frontends if missing
@@ -339,13 +342,14 @@ def _determine_app_type(manifest, resource_path):
     # Default to backend
     return "backend"
 
-def _compute_syncs(app_type, features):
+def _compute_syncs(app_type, features, framework=None):
     """
     Compute default sync paths based on app type and features.
     
     Args:
         app_type: App type string
         features: List of feature strings
+        framework: Frontend framework id (Next.js has no index.html, so it syncs less than a Vite SPA)
     
     Returns:
         List of sync paths
@@ -353,7 +357,9 @@ def _compute_syncs(app_type, features):
     syncs = []
     
     # Start with default syncs for app type
-    if app_type in DEFAULT_SYNCS:
+    if app_type == 'frontend' and framework == 'next':
+        syncs.extend(NEXT_FRONTEND_SYNCS)
+    elif app_type in DEFAULT_SYNCS:
         syncs.extend(DEFAULT_SYNCS[app_type])
     
     # Add feature-specific syncs

package/runtime/engine/topologies/tilt/resources/orchestrator/apply_compose_resource_registration.star

@@ -321,7 +321,7 @@ def _live_update_sync_source(project_root, full_res_path, sync_path):
     return relative_path
 
 
-def _build_live_update_rules(res_path, full_res_path, syncs, project_root='', language='bun', go_live_reload=False):
+def _build_live_update_rules(res_path, full_res_path, syncs, project_root='', language='bun', go_live_reload=False, node_frontend=False):
     """Build live update sync and run rules for a resource.
 
     Python backends reload their own process after a sync (uvicorn --reload), so they have
@@ -363,7 +363,7 @@ def _build_live_update_rules(res_path, full_res_path, syncs, project_root='', la
         dest = '/app/' + full_res_path + '/' + sync_path
         live_update_rules.append(sync(full_sync_path, dest))
     
-    if language == 'python' or language == 'node':
+    if language == 'python' or language == 'node' or node_frontend:
         return live_update_rules
     
     package_json_path = '/app/' + full_res_path + '/package.json'
@@ -407,6 +407,9 @@ def _wake_compose_invocation(project_root, resource_path, res_name, resource_nam
 
 def _image_target(config):
     """The Dockerfile target Tilt builds and the deferStart prebuild must match: `development` for Go with `dev.liveReload`."""
+    # Next.js runs `next dev` in the development image, so a saved file hot-reloads through the synced sources.
+    if Docker.is_next_frontend(config.get('manifest', {})):
+        return 'development'
     return 'development' if Docker.go_live_reload(config.get('manifest', {})) else 'production'
 
 
@@ -426,7 +429,7 @@ def _register_deferred_image_prebuild(config, auto_init_apps):
     """Build a deferStart resource's image during `flisk up` without creating its container.
 
     `auto_init=False` on the dc_resource skips its docker_build too (confirmed
-    live on tdk-erp-system, task 7.2), so a fresh project's first request would
+    live on flisk-erp-system, task 7.2), so a fresh project's first request would
     find no image and the wake gateway would fall back to `tilt trigger`, which
     queues behind every other build. This local_resource builds the same image
     (same Dockerfile and target as docker_build: `production`, or `development` for Go with `dev.liveReload`; host network, and an allowlist
@@ -548,6 +551,8 @@ def _register_single_resource(config, resource_path, compose_project_name, auto_
             config['syncs'],
             project_root=config.get('project_root', ''),
             language=config.get('manifest', {}).get('language', 'bun'),
+            # A Next.js image is Node with no Bun install step: syncing sources is enough, `next dev` reloads itself.
+            node_frontend=Docker.is_next_frontend(config.get('manifest', {})),
             go_live_reload=Docker.go_live_reload(config.get('manifest', {})),
         )
         _register_docker_build(config, live_update_rules)
@@ -610,7 +615,7 @@ def _register_frontend_typecheck(res, service_dir, typecheck_cmd):
         # Fixed script, variable parts passed as argv ($1 = service dir, $2 = typecheck command), never spliced into the shell text.
         cmd=[
             'sh', '-c',
-            'cd "$1" && { bunx tsc --version >/dev/null 2>&1 || { echo "typecheck needs host dependencies: run bun install in $1"; exit 1; }; } && eval "$2"',
+            'cd "$1" && { bunx tsc --version >/dev/null 2>&1 && test -f "$1/node_modules/vite/package.json" || { echo "typecheck needs host dependencies: run bun install in $1"; exit 1; }; } && eval "$2"',
             'sh', service_dir, typecheck_cmd,
         ],
         deps=[service_dir + '/src', service_dir + '/tsconfig.json'],

package/runtime/engine/topologies/tilt/resources/orchestrator/generators/dependencies/resolver.star

@@ -7,37 +7,63 @@
 #          Auto-inject configuration from internal dependencies
 # =============================================================================
 
-load("../../../../../../../discovery/registry.star", "get_resource_by_name")
+load("../../../../../../../discovery/registry.star", "get_app_resources", "get_resource_by_name")
+load("../../../../../platform/docker/networking/traefik_helpers.star", "cli_api_path")
+
+def _find_backend_resource(resource_name):
+    """Find a discovered resource by its own name, e.g. "api".
+
+    Registry services are stacks (`app`) whose resources are the runnable pieces (`api`, `web`), so the lookup
+    must search resources rather than service names. Frontends are skipped.
+    """
+    for service in get_app_resources():
+        for resource in service.get("resources", []):
+            if resource.get("name") != resource_name:
+                continue
+            app_type = resource.get("_manifest", {}).get("appType") or resource.get("appType")
+            if app_type == "frontend":
+                continue
+            return resource
+    return None
+
+
+def _find_frontend_backend(manifest):
+    """Find the backend a frontend talks to: `backendName` first, then the first API `dependsOn` entry.
+
+    Returns:
+        tuple: (backend resource name, backend manifest), or (None, None) when the frontend has no discovered backend
+    """
+    backend_name = manifest.get("backendName")
+    if backend_name:
+        backend = _find_backend_resource(backend_name)
+        if backend:
+            return backend_name, backend.get("_manifest", {})
+
+    for dep_name in manifest.get("dependsOn", []):
+        dep = _find_backend_resource(dep_name)
+        if dep and dep.get("_manifest", {}).get("appType") in ["backend", "mcp", "agent"]:
+            return dep_name, dep.get("_manifest", {})
+
+    return None, None
+
 
 def resolve_backend_api_path(manifest):
-    """Resolve API path from backend manifest if backendName is specified.
-    
-    Frontend manifests often reference a backend via backendName.
-    This function looks up the backend's apiPath for consistency.
-    
+    """Resolve the URL path a frontend uses to reach its backend, e.g. "/api/api".
+
+    The path is the backend's route on api.{project}.localhost: its explicit `apiPath` when set, otherwise
+    `/api/{name}` with a trailing `-api` stripped, the same rule `flisk up` prints and Traefik serves.
+    Frontends that have no discovered backend get None, so callers keep their stack-management fallback.
+
     Args:
         manifest: Frontend service manifest
-    
+
     Returns:
-        str: API path from backend manifest, or None if not found
+        str: API path of the frontend's backend, or None if there is no backend
     """
-    backend_name = manifest.get("backendName")
-    if not backend_name:
-        return None
-    
-    # Try to find the backend service
-    backend_service = get_resource_by_name(backend_name)
-    if not backend_service:
+    backend_name, backend_manifest = _find_frontend_backend(manifest)
+    if backend_name == None:
         return None
-    
-    # Get the backend manifest
-    backend_resources = backend_service.get("resources", [])
-    for resource in backend_resources:
-        if resource.get("name") == backend_name:
-            backend_manifest = resource.get("_manifest", {})
-            return backend_manifest.get("apiPath")
-    
-    return None
+    return cli_api_path(backend_name, backend_manifest)
 
 
 def resolve_dependency_api_urls(manifest):