@tdk-landscape/tdk-cli-core 1.3.124 → 1.3.126

package/cli/dist/utils/ui-keymap.js

@@ -0,0 +1,118 @@
+export const TABS = [
+    { id: "overview", label: "OVERVIEW", shortcut: "1" },
+    { id: "resources", label: "RESOURCES", shortcut: "2" },
+    { id: "events", label: "EVENTS", shortcut: "3" },
+    { id: "files", label: "FILES", shortcut: "4" },
+    { id: "config", label: "CONFIG", shortcut: "5" },
+];
+const tabRange = `${TABS[0].shortcut}-${TABS[TABS.length - 1].shortcut}`;
+const uiKeymap = [
+    {
+        id: "list-navigation",
+        keys: ["ArrowUp", "ArrowDown", "j", "k"],
+        label: "Navigate list items",
+        group: "Navigation",
+        display: { ascii: "UP/DOWN or k/j", unicode: "↑/↓ or k/j" },
+    },
+    {
+        id: "first-last",
+        keys: ["g", "G", "Home", "End"],
+        label: "First/last item",
+        group: "Navigation",
+        display: { ascii: "g/G or Home/End", unicode: "g/G or Home/End" },
+    },
+    {
+        id: "page-list",
+        keys: ["PageUp", "PageDown"],
+        label: "Move one page",
+        group: "Navigation",
+        display: { ascii: "PgUp/PgDn", unicode: "PgUp/PgDn" },
+    },
+    {
+        id: "select",
+        keys: ["Enter", "Space"],
+        label: "Select item / Open detail",
+        group: "Navigation",
+        display: { ascii: "Enter or Space", unicode: "Enter or Space" },
+    },
+    {
+        id: "cycle-tabs",
+        keys: ["Tab", "Shift+Tab"],
+        label: "Next / previous tab",
+        group: "Navigation",
+        display: { ascii: "Tab/Shift+Tab", unicode: "Tab/Shift+Tab" },
+    },
+    {
+        id: "direct-tabs",
+        keys: TABS.map((tab) => tab.shortcut),
+        label: "Direct tab access",
+        group: "Navigation",
+        display: { ascii: tabRange, unicode: tabRange },
+    },
+    {
+        id: "toggle-mouse",
+        keys: ["m"],
+        label: "Toggle mouse support",
+        group: "Actions",
+    },
+    {
+        id: "toggle-tooltips",
+        keys: ["t"],
+        label: "Toggle tooltips",
+        group: "Actions",
+    },
+    {
+        id: "toggle-enabled",
+        keys: ["e"],
+        label: "Toggle enabled/disabled services",
+        group: "Actions",
+    },
+    {
+        id: "refresh",
+        keys: ["r"],
+        label: "Refresh data",
+        group: "Actions",
+    },
+    {
+        id: "search",
+        keys: ["/"],
+        label: "Search/filter",
+        group: "Actions",
+    },
+    {
+        id: "help",
+        keys: ["?"],
+        label: "Show this help",
+        group: "Actions",
+    },
+    {
+        id: "quit",
+        keys: ["q"],
+        label: "Quit",
+        group: "Actions",
+    },
+    {
+        id: "back",
+        keys: ["Esc"],
+        label: "Back",
+        group: "Actions",
+    },
+];
+export const UI_KEYMAP = uiKeymap;
+function getUiKeymapEntry(id) {
+    const entry = UI_KEYMAP.find((shortcut) => shortcut.id === id);
+    if (!entry) {
+        throw new Error(`Unknown TDK UI shortcut: ${id}`);
+    }
+    return entry;
+}
+export function formatUiKeyNames(id, ascii = false) {
+    const entry = getUiKeymapEntry(id);
+    const display = ascii ? entry.display?.ascii : entry.display?.unicode;
+    return display ?? entry.keys.join("/");
+}
+export function formatUiKeyHint(id, label, ascii = false) {
+    const entry = getUiKeymapEntry(id);
+    return `[${formatUiKeyNames(id, ascii)}] ${label ?? entry.label}`;
+}
+//# sourceMappingURL=ui-keymap.js.map

package/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tdk-cli-internal",
   "private": true,
-  "version": "1.3.124",
+  "version": "1.3.126",
   "description": "TDK CLI — start services on your laptop.",
   "keywords": [
     "tdk",

package/discovery/manifest/loading.star

@@ -8,6 +8,7 @@
 # Priority: service.json → synthesize from path
 # =============================================================================
 
+load('../../engine/topologies/tilt/manifest/parser.star', 'generated_string_error')
 load('../../engine/topologies/tilt/manifest/constants.star',
      'MANIFEST_DEFAULTS',
      'DEFAULT_SYNCS',
@@ -100,6 +101,10 @@ def load_manifest(resource_path, persist_to_disk=False):
     
     if content and str(content).strip():
         manifest = decode_json(content)
+        # Refuse service.json values that would add keys to generated config (GHSA-phgf-pww4-7jxc)
+        unsafe_field_error = generated_string_error(manifest, manifest_full_path) if type(manifest) == "dict" else None
+        if unsafe_field_error:
+            fail(unsafe_field_error)
         manifest_source = 'service.json'
         manifest_path = manifest_full_path
     else:

package/discovery/manifest/normalize.star

@@ -5,6 +5,7 @@
 # Purpose: Normalize manifests and provide helper accessors
 # =============================================================================
 
+load('../../engine/topologies/tilt/manifest/parser.star', 'generated_string_error')
 load('./constants.star', 'MANIFEST_DEFAULTS', 'MANIFEST_FILENAME')
 load('./loading.star', 'apply_manifest_defaults', 'check_prisma_folder', 'get_default_syncs_for_type')
 load('./validation.star', 'validate_manifest')
@@ -56,6 +57,11 @@ def _load_and_normalize(manifest_path, warn_only=True):
             print("   ⚠️  Invalid JSON in manifest: " + manifest_path)
             return None
         fail("Invalid JSON in manifest: " + manifest_path)
+
+    # Refuse service.json values that would add keys to generated config (GHSA-phgf-pww4-7jxc)
+    unsafe_field_error = generated_string_error(manifest, manifest_path) if type(manifest) == "dict" else None
+    if unsafe_field_error:
+        fail(unsafe_field_error)
     
     # Validate
     issues = validate_manifest(manifest)

package/engine/topologies/tilt/common/utils.star

@@ -318,11 +318,11 @@ def write_file_if_changed(file_path, content):
     existing = str(existing_blob).rstrip()
 
     if existing == expected:
-        print("DEBUG WRITE: Skipping {} (no changes)".format(file_path))
+        debug_log("WRITE: Skipping {} (no changes)".format(file_path))
     else:
-        print("DEBUG WRITE: Writing {} bytes to {}".format(len(expected), file_path))
+        debug_log("WRITE: Writing {} bytes to {}".format(len(expected), file_path))
         _write_generated_file(file_path, expected)
-        print("DEBUG WRITE: Completed {}".format(file_path))
+        debug_log("WRITE: Completed {}".format(file_path))
 
     # Keep a generated-content snapshot beside the service outputs. `tdk config verify`
     # compares these snapshots with the files and the source manifest, detecting both

package/engine/topologies/tilt/common/utils_debug.star

@@ -2,7 +2,7 @@
 # 🛠️ TILT SDK - DEBUG UTILITIES
 # =============================================================================
 
-DEBUG_MODE = os.environ.get('TILT_DEBUG', 'false').lower() in ['true', '1', 'yes']
+DEBUG_MODE = (os.environ.get('TDK_DEBUG') or os.environ.get('TILT_DEBUG', 'false')).lower() in ['true', '1', 'yes']
 
 
 def debug_log(message, data=None):

package/engine/topologies/tilt/generators/typescript/frontend_tsconfig.star

@@ -3,6 +3,7 @@ OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
 # === END INLINED CONSTANTS ===
 
 
+load("../../common/utils_debug.star", "debug_log")
 load("../../../../topologies/tilt/common/utils.star", "Utils")
 load("../../../../topologies/tilt/manifest/constants.star", "GENERATED_CONFIG_FILENAMES")
 
@@ -126,15 +127,12 @@ def generate_frontend_tsconfig(resource_path, write_fn, internal_deps=None, is_d
     }
     if is_docker:
         output_path = resource_path + '/' + OUTPUT.AUTOGENERATED_FOLDER + '/' + GENERATED_CONFIG_FILENAMES['tsconfig_docker']
-        if is_verbose:
-            print("📝 DEBUG: Writing Docker tsconfig to: {}".format(output_path))
+        debug_log("📝 Writing Docker tsconfig to: {}".format(output_path))
         write_fn(output_path, Utils.encode_json(content))
-        if is_verbose:
-            print("📝 DEBUG: Docker tsconfig write complete")
+        debug_log("📝 Docker tsconfig write complete")
     else:
         output_path = resource_path + '/' + OUTPUT.AUTOGENERATED_FOLDER + '/' + GENERATED_CONFIG_FILENAMES['tsconfig_local']
-        if is_verbose:
-            print("📝 DEBUG: Writing Local tsconfig to: {}".format(output_path))
+        debug_log("📝 Writing Local tsconfig to: {}".format(output_path))
         write_fn(output_path, Utils.encode_json(content))
 
 DEBUG = {}

package/engine/topologies/tilt/manifest/loader.star

@@ -19,6 +19,7 @@ DEFAULTS = {}
 # === END INLINED CONSTANTS ===
 
 
+load("./parser.star", "generated_string_error")
 load("./constants.star",
     "MANIFEST_FILENAME",
     "MANIFEST_DEFAULTS",
@@ -63,6 +64,12 @@ def load_from_file(path):
     
     if manifest == None:
         return struct(manifest=None, error="Invalid manifest: " + path)
+
+    # Refuse service.json values that would add keys to generated config (GHSA-phgf-pww4-7jxc). Every Tilt discovery path loads service.json here.
+    if type(manifest) == "dict":
+        unsafe_field_error = generated_string_error(manifest, path)
+        if unsafe_field_error:
+            fail(unsafe_field_error)
     
     # An `mcp` resource is a Model Context Protocol server: an HTTP service on Bun that is built, routed and health-checked
     # exactly like a backend. Every backend code path keys off appType == 'backend', so normalise here, once, at the single

package/engine/topologies/tilt/manifest/parser.star

@@ -73,24 +73,106 @@ def parse(content, path=""):
         warnings=warnings,
     )
 
+# Characters allowed in the string fields that are written into generated Compose, Traefik and NATS config as they are. A line break
+# or YAML syntax in one of them adds keys to the generated service (GHSA-phgf-pww4-7jxc). Keep in step with GENERATED_STRING_FIELDS
+# in cli/src/utils/service-manifest.ts.
+_ALPHANUM = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
+_PATH_CHARS = "abcdefghijklmnopqrstuvwxyz0123456789/-"
+_GENERATED_STRING_RULES = [
+    # (field path, allowed characters, required first character or "")
+    (['healthCheckPath'], _PATH_CHARS, '/'),
+    (['traefik', 'host'], _ALPHANUM + '.-', ''),
+    (['traefik', 'pathPrefix'], _PATH_CHARS, '/'),
+    (['traefik', 'healthCheck'], _PATH_CHARS, '/'),
+    (['nats', 'queueGroup'], _ALPHANUM + '_.-', ''),
+    (['databaseName'], _ALPHANUM + '_-', ''),
+    (['stack'], _ALPHANUM + '_-', ''),
+    (['image'], _ALPHANUM + '._/:@-', ''),
+]
+
+def generated_string_error(manifest, resource_path=""):
+    """
+    Return an error message if a value that is written into generated config has unsafe characters, else None.
+
+    The value is not echoed, because it may contain the line break that makes it dangerous.
+    """
+    for keys, allowed, first in _GENERATED_STRING_RULES:
+        value = manifest
+        for key in keys:
+            value = value.get(key) if type(value) == "dict" else None
+        if value == None or value == "":
+            continue
+        field = '.'.join(keys)
+        where = " in " + resource_path if resource_path else ""
+        if type(value) != "string":
+            return "MANIFEST ERROR: '{}' must be a string{}".format(field, where)
+        if first and not value.startswith(first):
+            return "MANIFEST ERROR: '{}' must start with '{}'{}".format(field, first, where)
+        for c in value.elems():
+            if c not in allowed:
+                return "MANIFEST ERROR: '{}' has characters that are not allowed (no spaces, line breaks or YAML syntax){}".format(field, where)
+    return _line_break_error(manifest, resource_path)
+
+# Line breaks (including the Unicode ones YAML 1.1 honours) and other control characters.
+_LINE_BREAK_OR_CONTROL = [chr(i) for i in range(32)] + [chr(127), "\u0085", "
", "
"]
+
+def _has_line_break(text):
+    for bad in _LINE_BREAK_OR_CONTROL:
+        if bad in text:
+            return True
+    return False
+
+def _line_break_error(manifest, resource_path):
+    """
+    Many more values than _GENERATED_STRING_RULES reach generated config (port, appName, dockerfile, buildContext, basePath, envVars,
+    ...). A key can only be added through a line break, so no string key or value may contain one. `smoke` is skipped: it is never
+    written into generated config. Keep in step with lineBreakErrors in cli/src/utils/service-manifest.ts.
+    """
+    where = " in " + resource_path if resource_path else ""
+    pending = [(value, key) for key, value in manifest.items() if key != 'smoke']
+    for key in manifest.keys():
+        if type(key) == "string" and _has_line_break(key):
+            return "MANIFEST ERROR: a key contains a line break{}".format(where)
+    # Starlark has no recursion or while loops; a service.json never nests anywhere near this many values.
+    for _ in range(100000):
+        if not pending:
+            return None
+        value, field = pending.pop()
+        if type(value) == "string":
+            if _has_line_break(value):
+                return "MANIFEST ERROR: '{}' must not contain line breaks or control characters{}".format(field, where)
+        elif type(value) == "list":
+            for index, item in enumerate(value):
+                pending.append((item, "{}[{}]".format(field, index)))
+        elif type(value) == "dict":
+            for key, item in value.items():
+                if type(key) == "string" and _has_line_break(key):
+                    return "MANIFEST ERROR: a key in '{}' contains a line break{}".format(field, where)
+                pending.append((item, "{}.{}".format(field, key)))
+    return "MANIFEST ERROR: service.json is nested too deeply{}".format(where)
+
 def normalize(manifest, resource_path=""):
     """
     Normalize manifest with default values and computed fields.
-    
+
     Args:
         manifest: Raw parsed manifest dict
         resource_path: Resource directory path for context
-    
+
     Returns:
         Normalized manifest dict with all fields populated
     """
     normalized = {}
     warnings = []
-    
+
     # Copy all existing fields
     for key, value in manifest.items():
         normalized[key] = value
 
+    unsafe_field_error = generated_string_error(normalized, resource_path)
+    if unsafe_field_error:
+        fail(unsafe_field_error)
+
     # 1. Apply defaults for missing fields
     for field, default_value in MANIFEST_DEFAULTS.items():
         if field not in normalized or normalized[field] == None:
@@ -391,6 +473,7 @@ def get_resource_type_description(manifest):
 ManifestParser = struct(
     parse=parse,
     normalize=normalize,
+    generated_string_error=generated_string_error,
     extract_resource_path=extract_resource_path,
     extract_stack=extract_stack_from_path,
     parse_traefik=parse_traefik_config,

package/engine/topologies/tilt/manifest/tests/test_loader_parser.star

@@ -306,6 +306,67 @@ def _test_manifest_merging():
     
     print("✅ Manifest merging tests complete\n")
 
+# =============================================================================
+# TEST SUITE: Values written into generated config (GHSA-phgf-pww4-7jxc)
+# =============================================================================
+
+def _test_generated_string_fields():
+    """A line break or YAML syntax in a field that reaches generated compose output must be rejected."""
+    base = {'appName': 'api', 'stack': 'shop', 'traefik': {'pathPrefix': '/api/v1/shop-management'}}
+
+    assert_equal(None, ManifestParser.generated_string_error(base), "Clean manifest has no generated-field error")
+
+    safe = {
+        'appName': 'api',
+        'stack': 'shop-1',
+        'healthCheckPath': '/api/v1/health',
+        'databaseName': 'TDK_shop',
+        'image': 'ghcr.io/acme/app:1.0',
+        'traefik': {'host': 'shop.backend.my-project.local', 'pathPrefix': '/api/v1/shop', 'healthCheck': '/health'},
+        'nats': {'queueGroup': 'shop_backend_svc'},
+    }
+    assert_equal(None, ManifestParser.generated_string_error(safe), "Safe values are accepted")
+
+    hostile = [
+        {'healthCheckPath': '/health\n    privileged: true'},
+        {'healthCheckPath': '/health"'},
+        {'traefik': {'host': 'a.local\n    privileged: true', 'pathPrefix': '/api'}},
+        {'traefik': {'pathPrefix': '/api/v1/x\n    network_mode: host'}},
+        {'traefik': {'pathPrefix': '/api', 'healthCheck': '/h\n    volumes: []'}},
+        {'traefik': {'pathPrefix': '/api'}, 'nats': {'queueGroup': 'g: true'}},
+        {'traefik': {'pathPrefix': '/api'}, 'databaseName': 'TDK_x\n  privileged: true'},
+        {'traefik': {'pathPrefix': '/api'}, 'stack': 'shop # comment'},
+        {'traefik': {'pathPrefix': '/api'}, 'image': 'app\n    privileged: true'},
+        {'traefik': {'pathPrefix': '/api'}, 'healthCheckPath': 'health'},
+        {'traefik': {'pathPrefix': '/api'}, 'healthCheckPath': 42},
+    ]
+    for manifest in hostile:
+        assert_not_none(ManifestParser.generated_string_error(manifest), "Rejects unsafe value: " + str(manifest))
+
+    # The message names the field and never echoes the value
+    message = ManifestParser.generated_string_error(hostile[0], 'services/shop/api')
+    assert_true("healthCheckPath" in message, "Error names the field")
+    assert_true("\n" not in message, "Error does not echo the value")
+
+    # Fields outside the allowlist also reach generated config, so a line break anywhere is refused
+    clean = {'appName': 'api', 'stack': 'shop', 'traefik': {'pathPrefix': '/api'}}
+    line_breaks = [
+        {'port': '4000\n    privileged: true'},
+        {'appName': 'api\n    privileged: true'},
+        {'dockerfile': 'Dockerfile\r    privileged: true'},
+        {'buildContext': 'src\u2028privileged: true'},
+        {'envVars': [{'name': 'A', 'value': 'v\n    privileged: true'}]},
+        {'params': {'a\n    privileged': 'x'}},
+    ]
+    for extra in line_breaks:
+        manifest = dict(clean)
+        manifest.update(extra)
+        assert_not_none(ManifestParser.generated_string_error(manifest), "Rejects a line break: " + repr(extra))
+
+    smoke = dict(clean)
+    smoke['smoke'] = {'via': '/api', 'create': {'body': '{\n}'}}
+    assert_equal(None, ManifestParser.generated_string_error(smoke), "smoke is never written into generated config")
+
 # =============================================================================
 # TEST SUITE: Get Normalized Convenience Function
 # =============================================================================
@@ -366,12 +427,13 @@ def run_tests():
     _test_loader_functions()
     _test_parser_functions()
     _test_parse_and_normalize()
-    _test_domain_extraction()
+    _test_stack_extraction()
     _test_frontend_normalization()
     _test_traefik_config()
     _test_manifest_merging()
     _test_get_normalized()
     _test_resource_description()
+    _test_generated_string_fields()
     
     # Print results
     print("\n" + "="*70)

package/engine/topologies/tilt/resources/infra-loader.star

@@ -18,6 +18,7 @@
 #   Infra.load_all(should_enable_fn)
 # =============================================================================
 
+load("../common/utils_debug.star", "debug_log")
 load("../../platform/docker/constants.star", "PlatformDockerConstants")
 load("../../platform/docker/compose/traefik_standalone.star", "generate_standalone_traefik_compose")
 load("../../platform/docker/networking/sablier_container_cycle.star", "sablier_middleware_suffix")
@@ -130,14 +131,14 @@ def _register_platform_postgres(should_enable, root_prefix="", env_file=None, wr
     """
     postgres_compose = _ensure_database_management_compose(root_prefix, write_fn)
     if _file_exists(postgres_compose):
-        print("DEBUG INFRA: Loading postgres compose from {}".format(postgres_compose))
+        debug_log("INFRA: Loading postgres compose from {}".format(postgres_compose))
         _docker_compose(postgres_compose, env_file)
         dc_resource('postgres', labels=['infra.tools'], resource_deps=['init-networks'], auto_init=True)
         return
     message = "Shared platform Postgres compose was not materialized at {}".format(postgres_compose)
     if required:
         fail(message + " (write_fn present: {}). Refusing to register a postgres Tilt resource with no compose.".format(write_fn != None))
-    print("DEBUG INFRA: Skipping postgres (compose file not found): {}".format(message))
+    debug_log("INFRA: Skipping postgres (compose file not found): {}".format(message))
 
 
 def force_start_platform_postgres(should_enable, root_prefix="", env_file=None, write_fn=None):
@@ -161,7 +162,7 @@ def force_start_platform_postgres(should_enable, root_prefix="", env_file=None,
 def _load_database_management(should_enable, root_prefix="", env_file=None, write_fn=None):
     """Load database and messaging infrastructure."""
     if not should_enable('database-management'):
-        print("DEBUG INFRA: database-management not enabled")
+        debug_log("INFRA: database-management not enabled")
         return
 
     print("🗃️  Loading database management services...")
@@ -172,7 +173,7 @@ def _load_database_management(should_enable, root_prefix="", env_file=None, writ
     # Load messaging if compose file exists
     messaging_compose = root_prefix + 'services/platform/messaging/docker-compose.yml'
     if _file_exists(messaging_compose):
-        print("DEBUG INFRA: Loading messaging compose from {}".format(messaging_compose))
+        debug_log("INFRA: Loading messaging compose from {}".format(messaging_compose))
         _docker_compose(messaging_compose, env_file)
         # Register only services present in the project compose file. Minimal
         # NATS-only examples should not need to add an unrelated Redis broker.
@@ -181,7 +182,7 @@ def _load_database_management(should_enable, root_prefix="", env_file=None, writ
         if _compose_has_service(messaging_compose, 'nats'):
             dc_resource('nats', labels=['infra.messaging'], auto_init=True)
     else:
-        print("DEBUG INFRA: Skipping messaging (compose file not found)")
+        debug_log("INFRA: Skipping messaging (compose file not found)")
 
     # Only create kafka resources if debezium is enabled AND messaging exists
     cdc_enabled = should_enable('debezium')
@@ -211,7 +212,7 @@ def _load_infisical(should_enable, root_prefix="", env_file=None):
 
     compose_file = root_prefix + 'docker-compose.infisical.yml'
     if not _file_exists(compose_file):
-        print("DEBUG INFRA: Skipping Infisical (compose file not found)")
+        debug_log("INFRA: Skipping Infisical (compose file not found)")
         return
 
     print("🔐 Loading Infisical...")
@@ -254,7 +255,7 @@ def _load_standalone_traefik(root_prefix, env_file, write_fn):
 def _load_proxy(should_enable, root_prefix="", env_file=None, write_fn=None):
     """Load Traefik reverse proxy with proper health check sequencing."""
     if not should_enable('proxy'):
-        print("DEBUG INFRA: proxy not enabled")
+        debug_log("INFRA: proxy not enabled")
         return
 
     compose_files = [
@@ -266,7 +267,7 @@ def _load_proxy(should_enable, root_prefix="", env_file=None, write_fn=None):
     ]
     missing = [path for path in compose_files if not _file_exists(path)]
     if missing:
-        print("DEBUG INFRA: Platform proxy compose missing ({}), using standalone Traefik".format(missing[0]))
+        debug_log("INFRA: Platform proxy compose missing ({}), using standalone Traefik".format(missing[0]))
         _load_standalone_traefik(root_prefix, env_file, write_fn)
         return
 
@@ -422,11 +423,11 @@ def load_all_infrastructure(should_enable, fix_docker_networks_fn=None, docker_p
     """
     # Initialize networks first
     if fix_docker_networks_fn:
-        print("DEBUG INFRA: Initializing networks...")
+        debug_log("INFRA: Initializing networks...")
         _init_networks(fix_docker_networks_fn)
-        print("DEBUG INFRA: Networks initialized")
+        debug_log("INFRA: Networks initialized")
     else:
-        print("DEBUG INFRA: SKIPPING network initialization (no fix_docker_networks_fn)")
+        debug_log("INFRA: SKIPPING network initialization (no fix_docker_networks_fn)")
 
     # These stacks both define an `elasticsearch` resource (and host port 9200).
     # Running both at once causes compose/resource collisions and unstable startup.

package/engine/topologies/tilt/resources/orchestrator/apply.star

@@ -4,6 +4,7 @@
 # Purpose: thin coordinator for service apply lifecycle.
 # =============================================================================
 
+load("../../common/utils_debug.star", "debug_log")
 load('../databases.star', 'Database')
 load('./apply_runtime_flags.star', 'RuntimeFlags')
 load('./apply_resource_validation.star', 'ResourceValidation')
@@ -38,7 +39,7 @@ def apply_app_service(resource_config, ctx):
         for nested in resource_config.get('resources', []):
             nested_name = nested.get('name', '')
             if nested_name and should_enable(nested_name):
-                print("DEBUG APPLY: stack '{}' not individually enabled, but nested service '{}' is - proceeding".format(resource_name, nested_name))
+                debug_log("APPLY: stack '{}' not individually enabled, but nested service '{}' is - proceeding".format(resource_name, nested_name))
                 service_enabled = True
                 break