@tdk-landscape/tdk-cli-core 1.3.14 → 1.3.22

package/engine/topologies/platform/docker/layers/l3_builder_layers.star

@@ -0,0 +1,209 @@
+# === INLINED CONSTANTS for pure extension loading ===
+WEB_FRAMEWORK = "hono"
+RUNTIME_CONFIG = {"bun": {"image_base": "oven/bun:latest", "package_manager": "bun", "lockfile": "bun.lock", "backend_start_command": "bun run start", "frontend_start_command": "bun run dev"}, "node": {"image_base": "node:20-alpine", "package_manager": "npm", "lockfile": "package-lock.json", "backend_start_command": "node dist/index.js"}}
+OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
+# === END INLINED CONSTANTS ===
+
+
+"""
+L3 Builder Layers - Compilation and Build Stages
+
+Handles the build stages for different application types:
+- l3_backend_compiler: TypeScript backend compilation
+- l3_frontend_builder: Frontend application building
+- l3_migration_engine: Prisma migration preparation
+- l3_production_purger: Production dependency stripping
+"""
+
+load('./l1_base_layers.star', 'BUN_BASE')
+load('./l2_dependency_layers.star', 'GOLDEN_L2_IMAGE', 'normalize_res_path')
+load('../../../../../discovery/config.star', 'GLOBAL_CONFIG')
+load('../../../tilt/manifest/constants.star', 'AUTOGENERATED_CONFIG_PATHS')
+
+
+
+load('./prisma/prisma_build.star',
+    'prisma_copy_instructions',
+    'prisma_generate_instructions',
+    'prisma_normalize_output',
+    'L3_generate_migration_engine',
+)
+load('./infisical/infisical_docker.star', 'InfisicalDocker')
+
+# Load project name for dynamic golden image naming
+# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+def _load_golden_prefix():
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_json_path = '.tdk/project.json'
+    if project_root:
+        project_json_path = project_root + '/' + project_json_path
+    
+    if os.path.exists(project_json_path):
+        _project_json = read_json(project_json_path)
+        return _project_json.get('project', {}).get('name', 'tdk-project')
+    return 'tdk-project'
+
+_GOLDEN_PREFIX = _load_golden_prefix()
+
+_docker_cfg = GLOBAL_CONFIG['docker']
+GOLDEN_L3_BACKEND_IMAGE = _docker_cfg.get('golden_l3_backend_image', _GOLDEN_PREFIX + '-l3-backend:latest')
+GOLDEN_L3_FRONTEND_IMAGE = _docker_cfg.get('golden_l3_frontend_image', _GOLDEN_PREFIX + '-l3-frontend:latest')
+
+
+def L3_generate_backend_compiler(res_path, build_cmd = RUNTIME_CONFIG["bun"]["backend_start_command"], use_prisma = True, use_shared_libs = True, use_infisical = True, use_golden = True, has_prisma_config = False):
+    """
+    Generate the backend compiler layer for TypeScript services.
+
+    Args:
+        res_path: Resource path (service directory)
+        build_cmd: Build command to run (default: from RUNTIME_CONFIG)
+        use_prisma: Include Prisma setup (default: True)
+        use_shared_libs: Include shared library copies (default: True)
+        use_infisical: Include Infisical CLI installation (default: True)
+        use_golden: Whether to use golden L3-backend image (default: True)
+        has_prisma_config: Whether the service has Prisma config (default: False)
+
+    Returns:
+        Dockerfile content string for the l3_backend_build stage
+    """
+    # Normalize res_path for Docker COPY (must be relative to build context)
+    res_path_rel = normalize_res_path(res_path)
+    
+    base_image = GOLDEN_L3_BACKEND_IMAGE if use_golden else BUN_BASE
+    prisma_copy = prisma_copy_instructions(res_path) if use_prisma else ""
+    prisma_generate = prisma_generate_instructions() if use_prisma else ""
+    prisma_compat = prisma_normalize_output() if use_prisma else ""
+    parts = [
+        "# ---- L3: backend_compiler ----\n",
+        "FROM " + base_image + " AS l3_backend_build\n",
+        "WORKDIR /app/" + res_path + "\n",
+        "# Build argument to skip Infisical setup (for local dev / fast builds)\n",
+        "ARG SKIP_INFISICAL_SETUP=0\n",
+        "# Reuse resolved dependencies from l2_deps_manifest to avoid reinstalling in L3\n",
+        "COPY --link --from=l2_deps_manifest /app/" + res_path + "/node_modules ./node_modules\n",
+        "# Bun isolated linker symlinks may resolve through /app/node_modules/.bun\n",
+        "COPY --link --from=l2_deps_manifest /app/node_modules/.bun /app/node_modules/.bun\n",
+        "# Copy manifest files for dependency installation (in case L2 is stale)\n",
+        "COPY " + res_path_rel + "/package.json ./package.json\n",
+        "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['bunfig_docker'] + " ./bunfig.toml\n",
+        "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['npmrc_docker'] + " ./.npmrc\n",
+        "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/tsconfig.docker.autogenerated.json ./tsconfig.json\n",
+        "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/tsconfig.autogenerated.json ./" + OUTPUT.AUTOGENERATED_FOLDER + "/tsconfig.autogenerated.json\n",
+        "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/*.ts ./" + OUTPUT.AUTOGENERATED_FOLDER + "/\n",
+        "COPY " + res_path_rel + "/src ./src\n",
+        prisma_copy,
+        prisma_generate,
+        prisma_compat,
+    ]
+    # shared libs (@{npm_scope}/*) are resolved from Verdaccio by l2_deps_manifest
+    # and already present in node_modules — no COPY of shared-* source dirs needed.
+    # Use InfisicalDocker generator for CLI setup (if not using golden image)
+    if use_infisical and not use_golden:
+        parts.append(InfisicalDocker.builder_setup(
+            use_infisical=use_infisical,
+            use_golden=use_golden,
+        ))
+    parts.append("ENV NODE_ENV=production\n")
+    parts.append("RUN " + build_cmd + "\n")
+    parts.append("# Fix " + WEB_FRAMEWORK + "/cors subpath import for Bun runtime compatibility\n")
+    parts.append("RUN find ./dist -type f -name \"*.js\" -exec sed -i \"s|from '" + WEB_FRAMEWORK + "/cors'|from '../node_modules/" + WEB_FRAMEWORK + "/dist/middleware/cors/index.js'|g\" {} + || true\n")
+    return "".join(parts)
+
+
+def L3_generate_frontend_builder(res_path, build_cmd = RUNTIME_CONFIG["bun"]["backend_start_command"], use_infisical = False, use_shared_libs = True, use_golden = True):
+    """
+    Generate the frontend builder layer for Vue/React applications.
+
+    Args:
+        res_path: Resource path (service directory)
+        build_cmd: Build command to run (default: from RUNTIME_CONFIG)
+        use_infisical: Include Infisical CLI installation (default: False)
+        use_shared_libs: Include shared library copies (default: True)
+        use_golden: Whether to use golden L3-frontend image (default: True)
+
+    Returns:
+        Dockerfile content string for the l3_frontend_build stage
+    """
+    # Normalize res_path for Docker COPY (must be relative to build context)
+    res_path_rel = normalize_res_path(res_path)
+    
+    # Use golden L3-frontend image if enabled (no Prisma)
+    base_image = GOLDEN_L3_FRONTEND_IMAGE if use_golden else BUN_BASE
+
+    parts = [
+        "# ---- L3: frontend_builder ----\n",
+        "FROM " + base_image + " AS l3_frontend_build\n",
+        "WORKDIR /app/" + res_path + "\n",
+        "# Build argument to skip Infisical setup (for local dev / fast builds)\n",
+        "ARG SKIP_INFISICAL_SETUP=1\n",
+        "# Reuse resolved dependencies from l2_deps_manifest to avoid reinstalling in L3\n",
+        "COPY --link --from=l2_deps_manifest /app/" + res_path + "/node_modules ./node_modules\n",
+        # Bun isolated linker symlinks may resolve through /app/node_modules/.bun.
+        "COPY --link --from=l2_deps_manifest /app/node_modules/.bun /app/node_modules/.bun\n",
+        "# Copy manifest files required by the build\n",
+        "COPY " + res_path_rel + "/package.json ./package.json\n",
+        "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['bunfig_docker'] + " ./bunfig.toml\n",
+        "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/tsconfig.docker.autogenerated.json ./tsconfig.json\n",
+        "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/tsconfig.autogenerated.json ./" + OUTPUT.AUTOGENERATED_FOLDER + "/tsconfig.autogenerated.json\n",
+        # Copy ALL TypeScript files from autogenerated directory (env.ts, api-client.ts, vite configs, etc.)
+        "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/*.ts ./" + OUTPUT.AUTOGENERATED_FOLDER + "/\n",
+        "COPY " + res_path_rel + "/src ./src\n",
+        "COPY " + res_path_rel + "/public ./public\n",
+        "COPY " + res_path_rel + "/index.html ./index.html\n",
+    ]
+    # shared libs (@{npm_scope}/*) are resolved from Verdaccio by l2_deps_manifest
+    # and already present in node_modules — no COPY of shared-* source dirs needed.
+    # Use InfisicalDocker generator for CLI setup (if not using golden image)
+    if use_infisical and not use_golden:
+        parts.append(InfisicalDocker.builder_setup(
+            use_infisical=use_infisical,
+            use_golden=use_golden,
+        ))
+    parts.append("ENV NODE_ENV=production\n")
+    parts.append("RUN " + build_cmd + "\n")
+    return "".join(parts)
+
+
+# L3_generate_migration_engine is now loaded from prisma/prisma_build.star
+
+
+def L3_generate_production_purger(res_path, use_golden = True):
+    """
+    Generate the production purger layer that removes development dependencies.
+
+    Implements Option 2: Reduce node_modules size by:
+    1. Installing only production dependencies (--production flag)
+    2. Removing unnecessary files (.md, .ts, .map, test files, etc.)
+    3. Pruning package.json files from node_modules
+    4. Removing optional dependencies not needed at runtime
+
+    Args:
+        res_path: Resource path (service directory)
+        use_golden: Whether to use golden L2 image (default: True)
+
+    Returns:
+        Dockerfile content string for the l3_production_purger stage
+    """
+    # Normalize res_path for Docker COPY (must be relative to build context)
+    res_path_rel = normalize_res_path(res_path)
+    
+    # Use golden L2 image if enabled (Bun + system deps pre-installed)
+    base_image = GOLDEN_L2_IMAGE if use_golden else BUN_BASE
+
+    return (
+        "# ---- L3: production_purger ----\n"
+        + "FROM " + base_image + " AS l3_production_purger\n"
+        + "WORKDIR /app/" + res_path + "\n"
+        + "COPY " + res_path_rel + "/package.json ./package.json\n"
+        + "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['bunfig_docker'] + " ./bunfig.toml\n"
+        + "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['npmrc_docker'] + " ./.npmrc\n"
+        + "COPY --link --from=l2_deps_manifest /cache/bun /cache/bun\n"
+        # sharing=shared allows parallel builds without lock contention (Bun cache is atomic)
+        + "RUN --mount=type=cache,target=/cache/bun,sharing=shared bun install --production --cache-dir=/cache/bun\n"
+        + "# Option 2: Aggressive node_modules pruning to reduce size\n"
+        + "# NOTE: Keep .d.ts files - they are needed for Bun module resolution with subpath exports\n"
+        + "RUN find node_modules -type f \\( -name '*.md' -o -name '*.ts' ! -name '*.d.ts' -o -name '*.map' -o -name '*.test.js' -o -name '*.spec.js' -o -name 'README*' -o -name 'CHANGELOG*' -o -name 'LICENSE*' \\) -delete\n"
+        + "RUN find node_modules -type d \\( -name '.bin' -o -name 'test' -o -name 'tests' -o -name '__tests__' -o -name 'spec' -o -name 'specs' -o -name '.github' -o -name 'docs' -o -name 'examples' \\) -exec rm -rf {} + 2>/dev/null || true\n"
+    )
+
+GLOBAL_CONFIG = {}

package/engine/topologies/platform/docker/layers/l4_runtime_layers.star

@@ -0,0 +1,214 @@
+# === INLINED CONSTANTS for pure extension loading ===
+BASE_PORT_FRONTEND = 3000
+BASE_PORT_BACKEND = 4000
+get_docker_healthcheck_config = lambda: {"path": "/health", "interval": "10s", "timeout": "5s"}
+OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
+# === END INLINED CONSTANTS ===
+
+
+"""
+L4 Runtime Layers - Final Application Runtime Stages
+
+Handles the final runtime stages for deployed applications:
+- l4_backend_runtime: Backend service runtime with Bun
+- l4_frontend_runtime: Frontend runtime with Nginx or Bun static
+- l4_migrator_runtime: Database migration runner with Infisical integration
+"""
+
+load('./l1_base_layers.star', 'BUN_BASE')
+load('./l2_dependency_layers.star', 'normalize_res_path')
+load('../../../../../discovery/config.star', 'GLOBAL_CONFIG')
+load('../../../tilt/common/utils_debug.star', 'DEBUG_MODE')
+load('../../../tilt/manifest/constants.star', 'AUTOGENERATED_CONFIG_PATHS')
+load('./prisma/prisma_runtime.star',
+    'prisma_runtime_copy',
+    'prisma_bun_symlink_fix',
+    'prisma_config_copy',
+    'L4_generate_migrator_runtime',
+)
+
+load('./bun_helpers.star', 'bun_hoisted_packages_symlink_fix')
+load('./infisical/infisical_docker.star', 'InfisicalDocker')
+
+
+# Load project name for dynamic golden image naming
+# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+def _load_golden_prefix():
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_json_path = '.tdk/project.json'
+    if project_root:
+        project_json_path = project_root + '/' + project_json_path
+    
+    if os.path.exists(project_json_path):
+        _project_json = read_json(project_json_path)
+        return _project_json.get('project', {}).get('name', 'tdk-project')
+    return 'tdk-project'
+
+_GOLDEN_PREFIX = _load_golden_prefix()
+
+_docker_cfg = GLOBAL_CONFIG['docker']
+GOLDEN_L4_BACKEND_IMAGE = _docker_cfg.get('golden_l4_backend_image', _GOLDEN_PREFIX + '-l4-backend:latest')
+GOLDEN_L4_FRONTEND_IMAGE = _docker_cfg.get('golden_l4_frontend_image', _GOLDEN_PREFIX + '-l4-frontend:latest')
+
+# Load Docker healthcheck configuration
+_docker_health = get_docker_healthcheck_config()
+
+
+def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun run start', use_infisical = True, resource_name = 'service', use_golden = True, has_prisma_config = False, manifest = None):
+    """
+    Generate the backend runtime layer for deployed services.
+    
+    Args:
+        res_path: Resource path (service directory)
+        port: Port to expose (default: BASE_PORT_BACKEND from master config)
+        cmd: Command to run (default: 'bun run start')
+        use_infisical: Enable Infisical secret management (default: True)
+        resource_name: Service name for logging and configuration (default: 'service')
+        use_golden: Whether to use golden L4-backend image (default: True)
+        has_prisma_config: Whether service has Prisma config (default: False)
+        manifest: Service manifest dict for feature detection (default: None)
+    
+    Returns:
+        Dockerfile content string for the l4_backend_runtime stage
+    """
+    # Normalize res_path for Docker COPY (must be relative to build context)
+    res_path_rel = normalize_res_path(res_path)
+    
+    # Use golden L4-backend image if enabled (production-optimized backend runtime)
+    base_image = GOLDEN_L4_BACKEND_IMAGE if use_golden else BUN_BASE
+    
+    parts = [
+        "# ---- L4: backend_runtime ----\n",
+        "FROM " + base_image + " AS l4_backend_runtime\n",
+        "WORKDIR /app/" + res_path + "\n",
+        "# Build argument to skip Infisical setup (for local dev / fast builds)\n",
+        "ARG SKIP_INFISICAL_SETUP=0\n",
+        "ENV NODE_ENV=production\n",
+        "COPY --from=l3_production_purger /app/" + res_path + "/node_modules ./node_modules\n",
+        # Bun isolated linker creates service symlinks that resolve through /app/node_modules/.bun.
+        # Copy from production_purger to avoid dragging full dev dependency store into runtime.
+        "COPY --from=l3_production_purger /app/" + res_path + "/node_modules/.bun /app/node_modules/.bun\n",
+        prisma_runtime_copy(res_path),
+        "COPY --from=l3_backend_build /app/" + res_path + "/dist ./dist\n",
+        "COPY " + res_path_rel + "/package.json ./package.json\n",
+        prisma_bun_symlink_fix(),
+        bun_hoisted_packages_symlink_fix(),
+    ]
+    
+    # Check for special tooling requirements from manifest features
+    # Services requiring Hugo (or other tools) should specify in manifest features array
+    manifest_features = manifest.get('features', []) if manifest else []
+    if "hugo" in manifest_features:
+        parts.append("USER root\n")
+        parts.append("RUN apk add --no-cache hugo\n")
+        parts.append("USER bun\n")
+
+    if has_prisma_config:
+        # Prisma v7 migrate deploy reads datasource.url from prisma.config.ts in CWD
+        parts.append(prisma_config_copy(res_path))
+    
+    # Only set USER if not using golden image (already set in golden L4)
+    if not use_golden:
+        parts.append("USER bun\n")
+    
+    parts.extend([
+        "EXPOSE " + str(port) + "\n",
+    ])
+    
+    # Only add healthcheck if not using golden image (already in golden L4)
+    if not use_golden:
+        parts.append("HEALTHCHECK --interval={}s --timeout={}s --start-period={}s --retries={} CMD bun --version || exit 1\n".format(
+            _docker_health["interval_seconds"],
+            _docker_health["timeout_seconds"],
+            _docker_health["start_period_seconds"],
+            _docker_health["retries"],
+        ))
+    
+    if use_infisical:
+        # Use InfisicalDocker generator for proper secret injection setup
+        # This uses Starlark generators instead of hardcoded values
+        infisical_setup = InfisicalDocker.runtime_setup(
+            resource_name=resource_name,
+            secret_path=None,  # Auto-generate from resource_name
+            resource_type="backend",
+            command=cmd,
+            use_entrypoint=True,
+        )
+        parts.append(infisical_setup)
+    else:
+        parts.append("CMD [\"" + cmd + "\"]\n")
+
+    # Provide build targets that match external tooling (e.g. --target production/ development)
+    parts.append("\nFROM l4_backend_runtime AS production\nFROM l4_backend_runtime AS development\n")
+
+    return "".join(parts)
+
+
+def L4_generate_frontend_runtime(res_path, target_path = '/usr/share/nginx/html', use_nginx = True, use_golden = True, port = None):
+    """
+    Generate the frontend runtime layer for static site serving.
+    
+    Args:
+        res_path: Resource path (service directory)
+        target_path: Target path for static files (default: Nginx html directory)
+        use_nginx: Use Nginx for serving (default: True, uses Bun static if False)
+        use_golden: Whether to use golden L4-frontend image (default: True)
+        port: Port to expose (default: None, uses BASE_PORT_FRONTEND or 80 for nginx)
+    
+    Returns:
+        Dockerfile content string for the l4_frontend_runtime stage
+    """
+    # Use provided port or fall back to base port constant
+    expose_port = port if port else BASE_PORT_FRONTEND
+    # Normalize res_path for Docker COPY (must be relative to build context)
+    res_path_rel = normalize_res_path(res_path)
+    
+    if use_nginx:
+        # Use golden L4-frontend image if enabled (Nginx pre-configured)
+        base_image = GOLDEN_L4_FRONTEND_IMAGE if use_golden else "nginx:alpine"
+        
+        # If using golden image, skip curl installation (already there)
+        healthcheck_setup = "" if use_golden else "RUN apk add --no-cache curl\n"
+        
+        return (
+            "# ---- L4: frontend_runtime (nginx) ----\n"
+            + "FROM " + base_image + " AS l4_frontend_runtime\n"
+            + healthcheck_setup
+            + "COPY --from=l3_frontend_build /app/" + res_path + "/dist " + target_path + "\n"
+            + "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/nginx.autogenerated.conf /etc/nginx/conf.d/default.conf\n"
+            + "EXPOSE 80\n"
+            + ("" if use_golden else "HEALTHCHECK --interval={}s --timeout={}s --start-period={}s --retries={} CMD curl -f http://localhost/ || exit 1\n".format(
+                _docker_health["interval_seconds"],
+                _docker_health["timeout_seconds"],
+                _docker_health["frontend_start_period_seconds"],
+                _docker_health["retries"],
+            ))
+            + "CMD [\"nginx\", \"-g\", \"daemon off;\"]\n"
+            + "FROM l4_frontend_runtime AS production\n"
+            + "FROM l4_frontend_runtime AS development\n"
+        )
+    # Use golden L4-frontend image even for Bun static serving (or BUN_BASE as fallback)
+    # NOTE: When use_nginx=False, we MUST use BUN_BASE because the golden L4 frontend
+    # image is nginx-based and doesn't have Bun installed
+    base_image = GOLDEN_L4_FRONTEND_IMAGE if (use_golden and use_nginx) else BUN_BASE
+    
+    return (
+        "# ---- L4: frontend_runtime (bun static) ----\n"
+        + "FROM " + base_image + " AS l4_frontend_runtime\n"
+        + "WORKDIR /app/" + res_path + "\n"
+        + "COPY --from=l3_frontend_build /app/" + res_path + "/dist ./dist\n"
+        + "COPY --from=l3_frontend_build /app/" + res_path + "/node_modules ./node_modules\n"
+        + "COPY --from=l3_frontend_build /app/" + res_path + "/" + OUTPUT.AUTOGENERATED_FOLDER + " ./" + OUTPUT.AUTOGENERATED_FOLDER + "\n"
+        + "COPY " + res_path_rel + "/package.json ./package.json\n"
+        + "EXPOSE " + str(expose_port) + "\n"
+        + 'CMD ["bun", "run", "start"]\n'
+        + "FROM l4_frontend_runtime AS production\n"
+        + "FROM l4_frontend_runtime AS development\n"
+    )
+
+
+# L4_generate_migrator_runtime is now loaded from prisma/prisma_runtime.star
+
+DEBUG = {}
+
+GLOBAL_CONFIG = {}

package/engine/topologies/platform/docker/layers/prisma/constants.star

@@ -0,0 +1,135 @@
+# === INLINED CONSTANTS for pure extension loading ===
+RUNTIME = "bun"
+# === END INLINED CONSTANTS ===
+
+
+"""
+Shared constants/helpers for Prisma Docker layer generators.
+
+Centralizes repeated paths/defaults used across prisma_*.star modules so
+string-heavy Dockerfile/script fragments stay consistent and reusable.
+"""
+
+
+
+APP_DIR = "/app"
+NODE_MODULES_DIR = "node_modules"
+NODE_MODULES_BIN_DIR = NODE_MODULES_DIR + "/.bin"
+APP_NODE_MODULES_DIR = APP_DIR + "/" + NODE_MODULES_DIR
+APP_NODE_MODULES_BIN_DIR = APP_NODE_MODULES_DIR + "/.bin"
+APP_BUN_STORE_DIR = APP_NODE_MODULES_DIR + "/.bun"
+
+PRISMA_DIR_NAME = "prisma"
+PRISMA_SCOPE_DIR_NAME = "@prisma"
+PRISMA_SCHEMA_PATH = PRISMA_DIR_NAME + "/schema.prisma"
+
+PRISMA_CONFIG_FILE = "prisma.config.ts"
+PRISMA_CONFIG_WORKDIR_PATH = "./" + PRISMA_CONFIG_FILE
+PRISMA_CONFIG_ABS_PATH = APP_DIR + "/" + PRISMA_CONFIG_FILE
+
+APP_SRC_DIR = APP_DIR + "/src"
+APP_GENERATED_CLIENT_DIR = APP_DIR + "/generated-client"
+APP_PRISMA_DIR = APP_DIR + "/" + PRISMA_DIR_NAME
+
+PRISMA_DOT_DIR_REL_PATH = NODE_MODULES_DIR + "/.prisma"
+PRISMA_DOT_CLIENT_REL_PATH = PRISMA_DOT_DIR_REL_PATH + "/client"
+PRISMA_DOT_CLIENT_ABS_PATH = APP_DIR + "/" + PRISMA_DOT_CLIENT_REL_PATH
+
+PRISMA_BIN_REL_PATH = NODE_MODULES_DIR + "/.bin/prisma"
+PRISMA_BIN_ABS_PATH = APP_DIR + "/" + PRISMA_BIN_REL_PATH
+PRISMA_BIN_SYMLINK_TARGET = "../prisma/build/index.js"
+
+PRISMA_PACKAGE_REL_PATH = NODE_MODULES_DIR + "/prisma"
+PRISMA_SCOPE_REL_PATH = NODE_MODULES_DIR + "/" + PRISMA_SCOPE_DIR_NAME
+PRISMA_ENGINES_REL_PATH = PRISMA_SCOPE_REL_PATH + "/engines"
+PRISMA_PACKAGE_NODE_MODULES_REL_PATH = PRISMA_PACKAGE_REL_PATH + "/node_modules"
+
+APP_PRISMA_PACKAGE_DIR = APP_NODE_MODULES_DIR + "/" + PRISMA_DIR_NAME
+APP_PRISMA_SCOPE_DIR = APP_NODE_MODULES_DIR + "/" + PRISMA_SCOPE_DIR_NAME
+APP_PRISMA_ENGINES_DIR = APP_PRISMA_SCOPE_DIR + "/engines"
+APP_PRISMA_PACKAGE_NODE_MODULES_DIR = APP_PRISMA_PACKAGE_DIR + "/node_modules"
+APP_PRISMA_PACKAGE_ENGINES_DIR = APP_PRISMA_PACKAGE_NODE_MODULES_DIR + "/" + PRISMA_SCOPE_DIR_NAME + "/engines"
+
+PRISMA_CLIENT_PACKAGE_REL_PATH = PRISMA_SCOPE_REL_PATH + "/client"
+BUN_PRISMA_CLIENT_LINKER_NODE_MODULES_GLOB = NODE_MODULES_DIR + "/.bun/@prisma+client*/node_modules"
+
+MIGRATE_SH_FILE = "migrate.sh"
+MIGRATE_SH_ABS_PATH = APP_DIR + "/" + MIGRATE_SH_FILE
+
+L3_MIGRATION_BUILD_STAGE = "l3_migration_build"
+
+ROOT_USER = "root"
+BUN_USER = RUNTIME
+
+PRISMA_GENERATE_COMMAND = "bunx prisma generate"
+PRISMA_GENERATE_RUN = "RUN " + PRISMA_GENERATE_COMMAND + "\n"
+PRISMA_MIGRATE_DEPLOY_SUBCOMMAND = "migrate deploy"
+PRISMA_GENERATE_SUBCOMMAND = "generate"
+
+# Load project name for dynamic golden image naming
+# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+def _load_golden_prefix():
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_json_path = '.tdk/project.json'
+    if project_root:
+        project_json_path = project_root + '/' + project_json_path
+    
+    if os.path.exists(project_json_path):
+        _project_json = read_json(project_json_path)
+        return _project_json.get('project', {}).get('name', 'tdk-project')
+    return 'tdk-project'
+
+_GOLDEN_PREFIX = _load_golden_prefix()
+
+DEFAULT_GOLDEN_L3_MIGRATOR_IMAGE = _GOLDEN_PREFIX + "-l3-migrator:latest"
+DEFAULT_GOLDEN_L4_MIGRATOR_IMAGE = _GOLDEN_PREFIX + "-l4-migrator:latest"
+
+DEFAULT_DB_PORT = "5432"
+DEFAULT_DB_WAIT_TIMEOUT_SECS = 120
+DB_URL_HOSTPORT_WITH_AUTH_SED = "sed -n 's#^[^/]*//[^@]*@\\([^/]*\\)/.*#\\1#p'"
+DB_URL_HOSTPORT_NO_AUTH_SED = "sed -n 's#^[^/]*//\\([^/]*\\)/.*#\\1#p'"
+
+DEFAULT_INFISICAL_URL = "http://" + _GOLDEN_PREFIX + "-infisical:8081"
+DATABASE_URL_UNSET_CONDITION = "[ -z \"$DATABASE_URL\" ] || [ \"$DATABASE_URL\" = \"null\" ]"
+INFISICAL_SECRET_ENV_KEYS = [
+    "DATABASE_URL",
+    "DB_USER",
+    "DB_PASSWORD",
+    "DB_HOST",
+    "DB_PORT",
+    "DB_NAME",
+]
+DB_URL_COMPONENT_ENV_KEYS = [
+    "DB_USER",
+    "DB_PASSWORD",
+    "DB_HOST",
+    "DB_PORT",
+    "DB_NAME",
+]
+DB_URL_FROM_COMPONENTS = "postgresql://$DB_USER:$DB_PASSWORD@$DB_HOST:$DB_PORT/$DB_NAME"
+
+
+def app_resource_dir(res_path):
+    return APP_DIR + "/" + res_path
+
+
+def resource_node_modules_dir(res_path):
+    return app_resource_dir(res_path) + "/" + NODE_MODULES_DIR
+
+
+def prisma_normalize_output_block(include_generated_client_export = True):
+    """
+    Shared Prisma client normalization instructions used in both generic and
+    migration-engine build flows.
+
+    Args:
+        include_generated_client_export: Include generated-client.ts shim line.
+    """
+    export_flag = "1" if include_generated_client_export else "0"
+    return (
+        "# Normalize Prisma output for both import styles using shared script\n"
+        + "COPY shared-platform-engineering/docker-templates/prisma-normalize-client.sh /usr/local/bin/prisma-normalize-client.sh\n"
+        + "RUN chmod +x /usr/local/bin/prisma-normalize-client.sh && PRISMA_EXPORT_GENERATED_CLIENT="
+        + export_flag
+        + " /usr/local/bin/prisma-normalize-client.sh\n"
+    )

package/engine/topologies/platform/docker/layers/prisma/db_readiness.star

@@ -0,0 +1,96 @@
+"""
+DB Readiness Shell Fragment
+
+Generates the shell script block that:
+  1. Parses DB_HOST / DB_PORT from DATABASE_URL when the separate vars are absent
+  2. Loops with `nc` until PostgreSQL accepts connections (120 s timeout)
+
+Returns a plain string that is embedded verbatim inside migrate.sh.
+"""
+
+load('../../../../tilt/common/utils_debug.star', 'DEBUG_MODE')
+load(
+    './constants.star',
+    'DB_URL_HOSTPORT_NO_AUTH_SED',
+    'DB_URL_HOSTPORT_WITH_AUTH_SED',
+    'DEFAULT_DB_PORT',
+    'DEFAULT_DB_WAIT_TIMEOUT_SECS',
+)
+
+
+def _host_port_parse_block():
+    """
+    Extract DB_HOST_VAL / DB_PORT_VAL from DATABASE_URL when the individual
+    DB_HOST / DB_PORT env vars are not available.
+
+    Handles both:
+      postgresql://user:pass@host:port/db   (with auth)
+      postgresql://host:port/db             (without auth)
+    """
+    return (
+        "# Extract host and port for the readiness probe\n"
+        + "DB_HOST_VAL=\"$DB_HOST\"\n"
+        + "DB_PORT_VAL=\"$DB_PORT\"\n"
+        + "if [ -z \"$DB_HOST_VAL\" ]; then\n"
+        + "  HOSTPORT=$(printf '%s\\n' \"$DATABASE_URL\" | "
+        + DB_URL_HOSTPORT_WITH_AUTH_SED + " | head -n1)\n"
+        + "  if [ -z \"$HOSTPORT\" ]; then\n"
+        + "    HOSTPORT=$(printf '%s\\n' \"$DATABASE_URL\" | "
+        + DB_URL_HOSTPORT_NO_AUTH_SED + " | head -n1)\n"
+        + "  fi\n"
+        + "  if printf '%s\\n' \"$HOSTPORT\" | grep -q '^\\['; then\n"
+        + "    DB_HOST_VAL=$(printf '%s\\n' \"$HOSTPORT\" | sed -n 's/^\\[\\([^]]*\\)\\]\\(:[0-9][0-9]*\\)\\?$/\\1/p' || true)\n"
+        + "    DB_PORT_VAL=$(printf '%s\\n' \"$HOSTPORT\" | sed -n 's/^\\[[^]]*\\]:\\([0-9][0-9]*\\)$/\\1/p' || true)\n"
+        + "  else\n"
+        + "    DB_HOST_VAL=$(printf '%s\\n' \"$HOSTPORT\" | awk -F: '{print $1}' || true)\n"
+        + "    DB_PORT_VAL=$(printf '%s\\n' \"$HOSTPORT\" | awk -F: 'NF>1{print $NF}' || true)\n"
+        + "  fi\n"
+        + "fi\n"
+        + "DB_PORT_VAL=\"${DB_PORT_VAL:-" + DEFAULT_DB_PORT + "}\"\n"
+        + "if [ -z \"$DB_HOST_VAL\" ]; then\n"
+        + "  echo \"\\u274c ERROR: Unable to parse DB host from DATABASE_URL\"\n"
+        + "  exit 1\n"
+        + "fi\n"
+    )
+
+
+def _wait_loop_block(log_wait, log_ready, timeout_secs = DEFAULT_DB_WAIT_TIMEOUT_SECS):
+    """
+    nc-based polling loop.  Retries every second up to `timeout_secs`.
+    """
+    return (
+        log_wait
+        + "i=0\n"
+        + "while ! nc -z \"${DB_HOST_VAL}\" \"${DB_PORT_VAL}\"; do\n"
+        + "  i=$((i+1))\n"
+        + "  if [ $i -gt " + str(timeout_secs) + " ]; then\n"
+        + "    echo \"\\u274c Timeout waiting for DB at ${DB_HOST_VAL}:${DB_PORT_VAL}\"\n"
+        + "    exit 1\n"
+        + "  fi\n"
+        + "  sleep 1\n"
+        + "done\n"
+        + log_ready
+    )
+
+
+def db_readiness_script(timeout_secs = DEFAULT_DB_WAIT_TIMEOUT_SECS):
+    """
+    Return the complete shell fragment that waits for PostgreSQL to accept
+    connections before proceeding to migration.
+
+    Args:
+        timeout_secs: Seconds to wait before aborting (default: 120)
+    """
+    if DEBUG_MODE:
+        log_wait  = "echo \"\\u23f3 Waiting for PostgreSQL at ${DB_HOST_VAL}:${DB_PORT_VAL}...\"\n"
+        log_ready = "echo \"\\u2705 PostgreSQL is ready!\"\n"
+    else:
+        log_wait = ""
+        log_ready = ""
+
+    return (
+        _host_port_parse_block()
+        + _wait_loop_block(log_wait, log_ready, timeout_secs)
+    )
+
+DEBUG = {}