@tdk-landscape/tdk-cli-core 1.3.14 → 1.3.22

package/engine/topologies/platform/docker/layers/prisma/filesystem_setup.star

@@ -0,0 +1,109 @@
+"""
+Filesystem Setup Dockerfile Fragment
+
+Generates the RUN/COPY instructions that:
+  - Install Alpine utilities needed by migrate.sh at runtime (curl, jq, nc)
+  - Create required directories and fix ownership so Prisma can write generated files
+  - Ensure @prisma/engines is resolvable for the CLI (engines may land under
+    prisma/node_modules in Bun hoisting layouts)
+
+All functions return Dockerfile instruction strings.
+"""
+
+load(
+    '../bun_helpers.star',
+    'bun_hoisted_packages_symlink_fix',
+)
+load(
+    './constants.star',
+    'APP_BUN_STORE_DIR',
+    'APP_GENERATED_CLIENT_DIR',
+    'APP_NODE_MODULES_BIN_DIR',
+    'APP_NODE_MODULES_DIR',
+    'APP_PRISMA_DIR',
+    'APP_PRISMA_PACKAGE_DIR',
+    'APP_PRISMA_SCOPE_DIR',
+    'APP_SRC_DIR',
+    'BUN_USER',
+    'PRISMA_BIN_ABS_PATH',
+    'PRISMA_BIN_SYMLINK_TARGET',
+    'PRISMA_CONFIG_ABS_PATH',
+    'PRISMA_SCHEMA_PATH',
+)
+
+
+def apk_runtime_tools():
+    """
+    Install runtime utilities required by migrate.sh: bash, curl, jq, netcat-openbsd, postgresql-client.
+    """
+    return "RUN apk add --no-cache bash curl jq netcat-openbsd postgresql-client\n"
+
+
+def prisma_dir_and_permissions():
+    """
+    Create directories that Prisma writes to at runtime and ensure the `bun` user owns
+    them.  Handles both the standard `node_modules/.prisma/client` path and custom
+    output paths like `../src/generated` or `../generated-client`.
+    """
+    return (
+        "# Ensure Prisma can write generated files including custom output paths\n"
+        + "RUN mkdir -p " + APP_NODE_MODULES_DIR + " " + APP_SRC_DIR + " " + APP_GENERATED_CLIENT_DIR
+        + " && chown -R " + BUN_USER + ":" + BUN_USER
+        + " " + APP_PRISMA_DIR + " " + APP_NODE_MODULES_DIR + " " + APP_SRC_DIR + " " + APP_GENERATED_CLIENT_DIR
+        + " " + PRISMA_CONFIG_ABS_PATH + " || true\n"
+    )
+
+
+def prisma_engines_symlink():
+    """
+    Rebuild @prisma links from Bun's isolated store after cross-stage COPY.
+    Service-level node_modules symlinks are relative and can break when copied to
+    `/app/node_modules`. We relink from `/app/node_modules/.bun`.
+    
+    Handles two types of packages:
+    1. Nested packages: @prisma/client, @prisma/adapter-pg (under node_modules/@prisma/)
+    2. Top-level package: @prisma/engines (copied as real files, not symlinked)
+    """
+    return (
+        "# Re-link @prisma packages from Bun store so Prisma CLI can resolve engines\n"
+        + "COPY shared-platform-engineering/docker-templates/prisma-runtime-relink.sh /usr/local/bin/prisma-runtime-relink.sh\n"
+        + "RUN chmod +x /usr/local/bin/prisma-runtime-relink.sh && /usr/local/bin/prisma-runtime-relink.sh\n"
+    )
+
+
+def prisma_config_inline():
+    """
+    Inline-generate /app/prisma.config.ts so Prisma v7 migration commands pick up
+    the datasource URL from the environment without requiring a build-time file copy.
+    """
+    return (
+        "# Prisma v7 migration commands require datasource.url in prisma.config.ts\n"
+        + "RUN cat > " + PRISMA_CONFIG_ABS_PATH + " << 'EOF'\n"
+        + "export default {\n"
+        + "  schema: '" + PRISMA_SCHEMA_PATH + "',\n"
+        + "  datasource: {\n"
+        + "    url: process.env.DATABASE_URL,\n"
+        + "  },\n"
+        + "};\n"
+        + "EOF\n"
+    )
+
+
+def migrator_filesystem_setup():
+    """
+    Convenience wrapper – returns all filesystem setup instructions in order:
+      1. Inline prisma.config.ts
+      2. Permission fixes
+      3. @prisma/engines symlink
+      4. Alpine utilities
+      5. General Bun hoisted packages symlink fix
+
+    The caller is responsible for wrapping these in `USER root` / `USER bun` guards.
+    """
+    return (
+        prisma_config_inline()
+        + prisma_dir_and_permissions()
+        + prisma_engines_symlink()
+        + apk_runtime_tools()
+        + bun_hoisted_packages_symlink_fix()
+    )

package/engine/topologies/platform/docker/layers/prisma/migrate_script.star

@@ -0,0 +1,98 @@
+"""
+Migrate Script Builder
+
+Assembles the complete /app/migrate.sh entrypoint that runs inside the
+l4_migrator_runtime container.  Delegates each logical section to a
+dedicated module so this file stays focused on overall script structure.
+
+  secret_resolution  – resolves DATABASE_URL (Infisical or env vars)
+  db_readiness       – waits for PostgreSQL to accept connections
+"""
+
+load('../../../../tilt/common/utils_debug.star', 'DEBUG_MODE')
+load('./secret_resolution.star', 'secret_resolution_script')
+load('./db_readiness.star', 'db_readiness_script')
+load(
+    './constants.star',
+    'APP_DIR',
+    'MIGRATE_SH_ABS_PATH',
+    'PRISMA_BIN_ABS_PATH',
+    'PRISMA_GENERATE_SUBCOMMAND',
+    'PRISMA_MIGRATE_DEPLOY_SUBCOMMAND',
+)
+
+
+def _log(debug_msg, prod_msg = ""):
+    """Return debug_msg when DEBUG_MODE is on, prod_msg otherwise."""
+    return debug_msg if DEBUG_MODE else prod_msg
+
+
+def _prisma_run_block():
+    """
+    Shell fragment that locates the local Prisma CLI binary and runs
+    `migrate deploy` followed by `generate`.  Avoids `bunx prisma` to
+    prevent accidental network fetches of the latest Prisma version.
+    """
+    return (
+        "# Use locally installed Prisma CLI – avoids bunx fetching prisma@latest\n"
+        + "PRISMA_BIN=\"" + PRISMA_BIN_ABS_PATH + "\"\n"
+        + "if [ ! -x \"$PRISMA_BIN\" ]; then\n"
+        + "  echo \"\\u274c ERROR: Prisma CLI not found at $PRISMA_BIN\"\n"
+        + "  exit 1\n"
+        + "fi\n"
+        + "# Ensure DATABASE_URL is exported for Prisma CLI\n"
+        + "export DATABASE_URL\n"
+        + _log("echo \"\\U0001f504 Running Prisma migrations...\"\n")
+        + "cd " + APP_DIR + " && \"$PRISMA_BIN\" " + PRISMA_MIGRATE_DEPLOY_SUBCOMMAND + "\n"
+        + _log("echo \"\\U0001f527 Generating Prisma client...\"\n")
+        + "\"$PRISMA_BIN\" " + PRISMA_GENERATE_SUBCOMMAND + "\n"
+    )
+
+
+def migrate_sh_content(resource_name):
+    """
+    Return the full text of migrate.sh for the given service.
+
+    Args:
+        resource_name: Used in RESOURCE_NAME env var and Infisical secret path
+                      (e.g. 'user-service', 'order-service').
+    """
+    done_msg = (
+        _log("echo \"\\U0001f389 Database migration completed successfully!\"\n")
+        or "echo \"Database migration completed\"\n"
+    )
+
+    return (
+        "#!/bin/sh\n"
+        + "set -e\n"
+        + _log(
+            "echo \"\\U0001f5c4\\ufe0f Starting database migration for $RESOURCE_NAME...\"\n",
+            "echo \"Starting database migration...\"\n",
+        )
+        + "\n# --- 1. Resolve DATABASE_URL ---\n"
+        + secret_resolution_script()
+        + "\n# --- 2. Wait for PostgreSQL ---\n"
+        + db_readiness_script()
+        + "\n# --- 3. Run Prisma migrate + generate ---\n"
+        + _prisma_run_block()
+        + "\n"
+        + done_msg
+    )
+
+
+def migrate_sh_dockerfile_block(resource_name):
+    """
+    Return the Dockerfile fragment that writes migrate.sh and makes it executable.
+
+    Args:
+        resource_name: Forwarded to migrate_sh_content().
+    """
+    return (
+        "# Provide the migrate entrypoint\n"
+        + "RUN cat > " + MIGRATE_SH_ABS_PATH + " << 'EOF'\n"
+        + migrate_sh_content(resource_name)
+        + "EOF\n"
+        + "RUN chmod +x " + MIGRATE_SH_ABS_PATH + "\n"
+    )
+
+DEBUG = {}

package/engine/topologies/platform/docker/layers/prisma/prisma_build.star

@@ -0,0 +1,126 @@
+# === INLINED CONSTANTS for pure extension loading ===
+OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
+# === END INLINED CONSTANTS ===
+
+
+"""
+Prisma Build Layers - L3 Prisma Client Generation and Migration Engine
+
+Encapsulates all Prisma-related Dockerfile instructions for the build stage:
+- Client generation (`bunx prisma generate`)
+- Output normalization (generated-client ↔ node_modules/.prisma/client)
+- Default module shim for Prisma v7 / @prisma/client compatibility
+- Migration engine stage for Prisma migrate deploy
+"""
+
+load('../l1_base_layers.star', 'BUN_BASE')
+load('../l2_dependency_layers.star', 'normalize_res_path')
+load('../../../../../../discovery/config.star', 'GLOBAL_CONFIG')
+load('../../../../tilt/manifest/constants.star', 'AUTOGENERATED_CONFIG_PATHS')
+
+load(
+    './constants.star',
+    'APP_BUN_STORE_DIR',
+    'DEFAULT_GOLDEN_L3_MIGRATOR_IMAGE',
+    'NODE_MODULES_DIR',
+    'PRISMA_CONFIG_WORKDIR_PATH',
+    'PRISMA_DIR_NAME',
+    'PRISMA_GENERATE_RUN',
+    'PRISMA_PACKAGE_NODE_MODULES_REL_PATH',
+    'PRISMA_SCHEMA_PATH',
+    'app_resource_dir',
+    'prisma_normalize_output_block',
+)
+
+_docker_cfg = GLOBAL_CONFIG['docker']
+GOLDEN_L3_MIGRATOR_IMAGE = _docker_cfg.get('golden_l3_migrator_image', DEFAULT_GOLDEN_L3_MIGRATOR_IMAGE)
+
+
+def prisma_copy_instructions(res_path, has_prisma_config = False):
+    """
+    Generate Dockerfile COPY instructions for Prisma schema and config.
+
+    Args:
+        res_path: Resource path (service directory)
+        has_prisma_config: Whether prisma.config.ts exists (Prisma v7)
+
+    Returns:
+        Dockerfile content string for copying Prisma files
+    """
+    # Normalize res_path for Docker COPY (must be relative to build context)
+    res_path_rel = normalize_res_path(res_path)
+    
+    parts = "COPY " + res_path_rel + "/" + PRISMA_DIR_NAME + " ./" + PRISMA_DIR_NAME + "\n"
+    if has_prisma_config:
+        # Prisma v7 requires prisma.config.ts in CWD for correct client generation
+        parts += "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['prisma'] + " " + PRISMA_CONFIG_WORKDIR_PATH + "\n"
+    return parts
+
+
+def prisma_generate_instructions():
+    """
+    Generate Dockerfile RUN instruction for Prisma client generation.
+
+    Returns:
+        Dockerfile content string that runs `bunx prisma generate`
+    """
+    return PRISMA_GENERATE_RUN
+
+
+def prisma_normalize_output():
+    """
+    Generate Dockerfile instructions to normalize Prisma output for both
+    import styles: ../generated-client and node_modules/.prisma/client.
+
+    Also creates a default.js shim required by @prisma/client v7 which
+    resolves `.prisma/client/default` at runtime.
+
+    Returns:
+        Dockerfile content string for Prisma output normalization
+    """
+    return prisma_normalize_output_block(include_generated_client_export = True)
+
+
+def L3_generate_migration_engine(res_path, use_golden = True):
+    """
+    Generate the migration engine layer for Prisma database migrations.
+
+    Args:
+        res_path: Resource path (service directory)
+        use_golden: Whether to use golden L3-migrator image (default: True)
+
+    Returns:
+        Dockerfile content string for the l3_migration_build stage
+    """
+    # Normalize res_path for Docker COPY (must be relative to build context)
+    res_path_rel = normalize_res_path(res_path)
+    
+    # Use golden L3-migrator image if enabled (Prisma pre-installed)
+    base_image = GOLDEN_L3_MIGRATOR_IMAGE if use_golden else BUN_BASE
+    app_res_path = app_resource_dir(res_path)
+
+    return (
+        "# ---- L3: migration_engine ----\n"
+        + "FROM " + base_image + " AS l3_migration_build\n"
+        + "WORKDIR " + app_res_path + "\n"
+        + "# Copy manifest files for dependency installation\n"
+        + "COPY " + res_path_rel + "/package.json ./package.json\n"
+        + "COPY " + res_path_rel + "/" + PRISMA_DIR_NAME + " ./" + PRISMA_DIR_NAME + "\n"
+        + "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/.npmrc.docker.autogenerated .npmrc\n"
+        + "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/bunfig.docker.autogenerated.toml ./bunfig.toml\n"
+        + "COPY bun.lock* ./\n"
+        + "# Install runtime deps only for migrator image (skip test/dev toolchain)\n"
+        + "# NOTE: keep bunfig.toml (it carries the @beauty-crm/@tdk-landscape registry\n"
+        + "# scopes pointing at Verdaccio) - deleting it forces scoped packages to fall\n"
+        + "# back to the public npm registry and fail with ConnectionRefused/404.\n"
+        + "RUN --mount=type=cache,target=/cache/bun,sharing=shared rm -f bun.lock bun.lockb && env -u CI BUN_CONFIG_FROZEN_LOCKFILE=false BUN_TMPDIR=/tmp BUN_INSTALL=/tmp/bun-install bun install --production --no-frozen-lockfile --concurrent-scripts --cache-dir=/cache/bun\n"
+        + "# Prisma CLI is often in devDependencies; install it explicitly without mutating manifest files\n"
+        + "RUN --mount=type=cache,target=/cache/bun,sharing=shared PRISMA_VERSION=$(sed -n 's/.*\"prisma\"[[:space:]]*:[[:space:]]*\"[~^]*\\([^\"]*\\)\".*/\\1/p' package.json | head -n 1) && [ -n \"$PRISMA_VERSION\" ] && BUN_TMPDIR=/tmp BUN_INSTALL=/tmp/bun-install bun add --no-save --exact prisma@\"$PRISMA_VERSION\" --cache-dir=/cache/bun\n"
+        + "# Generate Prisma client and normalize output location for runtime compatibility\n"
+        + PRISMA_GENERATE_RUN
+        + prisma_normalize_output_block(include_generated_client_export = False)
+        + "RUN mkdir -p " + PRISMA_PACKAGE_NODE_MODULES_REL_PATH + "\n"
+        + "RUN test -f " + PRISMA_SCHEMA_PATH + "\n"
+    )
+
+GLOBAL_CONFIG = {}

package/engine/topologies/platform/docker/layers/prisma/prisma_runtime.star

@@ -0,0 +1,161 @@
+"""
+Prisma Runtime Layers - L4 Prisma Runtime Copy and Resolution
+
+Public API (preserved for backward compatibility with l4_runtime_layers.star):
+  prisma_runtime_copy(res_path)       – copy .prisma artifacts from build stage
+  prisma_bun_symlink_fix()            – fix Bun linker resolution for .prisma/client
+  prisma_config_copy(res_path)        – copy prisma.config.ts (Prisma v7)
+  L4_generate_migrator_runtime(...)   – full migrator stage (delegates to sub-modules)
+
+Internal heavy-lifting is split across:
+  filesystem_setup.star   – apk, dirs, permissions, engines symlink
+  shared docker template  – generic migrate.sh entrypoint script
+"""
+
+load('../l1_base_layers.star', 'BUN_BASE')
+load('../l2_dependency_layers.star', 'normalize_res_path')
+load('../../../../../../discovery/config.star', 'GLOBAL_CONFIG')
+load('../../../../tilt/manifest/constants.star', 'AUTOGENERATED_CONFIG_PATHS')
+load('./filesystem_setup.star', 'migrator_filesystem_setup')
+load(
+    './constants.star',
+    'APP_DIR',
+    'BUN_USER',
+    'DEFAULT_GOLDEN_L4_MIGRATOR_IMAGE',
+    'MIGRATE_SH_ABS_PATH',
+    'PRISMA_CONFIG_WORKDIR_PATH',
+    'PRISMA_DOT_DIR_REL_PATH',
+    'PRISMA_DIR_NAME',
+    'ROOT_USER',
+    'app_resource_dir',
+    'resource_node_modules_dir',
+)
+
+_docker_cfg = GLOBAL_CONFIG['docker']
+GOLDEN_L4_MIGRATOR_IMAGE = _docker_cfg.get('golden_l4_migrator_image', DEFAULT_GOLDEN_L4_MIGRATOR_IMAGE)
+MIGRATE_SH_TEMPLATE_PATH = "shared-platform-engineering/docker-templates/migrate.sh"
+
+
+# ---------------------------------------------------------------------------
+# Small copy/fix helpers (used by l4_runtime_layers.star for backend runtime)
+# ---------------------------------------------------------------------------
+
+def prisma_runtime_copy(res_path):
+    """
+    Copy .prisma generated client and prisma schema from the build stage.
+
+    Args:
+        res_path: Service directory relative to /app (e.g. 'services/product/users/...')
+    """
+    base = app_resource_dir(res_path)
+    return (
+        "COPY --from=l3_backend_build " + base + "/" + PRISMA_DOT_DIR_REL_PATH + " ./" + PRISMA_DOT_DIR_REL_PATH + "\n"
+        + "COPY --from=l3_backend_build " + base + "/" + PRISMA_DIR_NAME + " ./" + PRISMA_DIR_NAME + "\n"
+    )
+
+
+def prisma_bun_symlink_fix():
+    """
+    Symlink .prisma/client into every Bun linker path so runtime imports resolve.
+
+    Bun hoists @prisma/client under node_modules/.bun/@prisma+client*/node_modules/
+    and looks for .prisma relative to that path.  The loop below covers all versions
+    that may be present.
+    """
+    return (
+        "# Fix Bun module resolution: .prisma/client must be reachable from .bun/ linker paths\n"
+        + "USER " + ROOT_USER + "\n"
+        + "COPY shared-platform-engineering/docker-templates/prisma-bun-client-link-fix.sh /usr/local/bin/prisma-bun-client-link-fix.sh\n"
+        + "RUN chmod +x /usr/local/bin/prisma-bun-client-link-fix.sh && /usr/local/bin/prisma-bun-client-link-fix.sh\n"
+        + "USER " + BUN_USER + "\n"
+    )
+
+
+def prisma_config_copy(res_path):
+    """
+    Copy the auto-generated prisma.config.ts into the WORKDIR (required by Prisma v7).
+
+    Args:
+        res_path: Service directory relative to workspace root
+    """
+    # Normalize res_path for Docker COPY (must be relative to build context)
+    res_path_rel = normalize_res_path(res_path)
+    return "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['prisma'] + " " + PRISMA_CONFIG_WORKDIR_PATH + "\n"
+
+
+# ---------------------------------------------------------------------------
+# Migrator stage builder
+# ---------------------------------------------------------------------------
+
+def _migrator_artifact_copies(res_path):
+    """
+    Runtime setup for migrator:
+      1. Copy schema from l3 migration build stage
+      2. Copy resolved node_modules from l3 migration build stage
+
+    This avoids Bun lockfile/frozen-lockfile edge cases in the l4 runtime image
+    while still keeping migrator logic simple (no pruner stage).
+    """
+    app_res_path = app_resource_dir(res_path)
+    base = resource_node_modules_dir(res_path)
+    return (
+        "# Copy migration schema + resolved deps from l3 stage\n"
+        + "COPY --from=l3_migration_build " + app_res_path + "/" + PRISMA_DIR_NAME + " ./" + PRISMA_DIR_NAME + "\n"
+        + "COPY --from=l3_migration_build " + base + " ./node_modules\n"
+    )
+
+
+def _migrate_script_copy_block():
+    """
+    Keep Dockerfile concise by copying the shared migrate entrypoint script
+    instead of inlining a long heredoc.
+    """
+    return (
+        "# Provide the migrate entrypoint\n"
+        + "COPY " + MIGRATE_SH_TEMPLATE_PATH + " " + MIGRATE_SH_ABS_PATH + "\n"
+        + "RUN chmod +x " + MIGRATE_SH_ABS_PATH + "\n"
+    )
+
+
+def L4_generate_migrator_runtime(res_path, resource_name = 'migrator', use_golden = True):
+    """
+    Generate the complete l4_migrator_runtime Dockerfile stage.
+
+    The stage:
+      1. Copies Prisma artifacts from l3_migration_build
+      2. Writes prisma.config.ts, fixes permissions, symlinks engines (filesystem_setup)
+      3. Installs Alpine utilities (curl, jq, nc) needed at runtime
+      4. Copies and chmod's /app/migrate.sh from shared docker templates
+      5. Sets ENTRYPOINT to migrate.sh
+
+    Args:
+        res_path:     Service directory relative to /app
+        resource_name: Used in RESOURCE_NAME env and Infisical secret path
+        use_golden:   Always True – golden image is always preferred
+    """
+    # Golden image is mandatory – it ships Prisma + Infisical pre-built.
+    base_image = GOLDEN_L4_MIGRATOR_IMAGE
+
+    return (
+        "# ---- L4: migrator_runtime ----\n"
+        + "FROM " + base_image + " AS l4_migrator_runtime\n"
+        + "WORKDIR " + APP_DIR + "\n"
+        + "# Build argument to skip Infisical setup (for local dev / fast builds)\n"
+        + "ARG SKIP_INFISICAL_SETUP=0\n"
+        + "ENV NODE_ENV=production RESOURCE_NAME=" + resource_name + "\n"
+        + _migrator_artifact_copies(res_path)
+        + "USER " + ROOT_USER + "\n"
+        + migrator_filesystem_setup()
+        + "USER " + ROOT_USER + "\n"
+        + _migrate_script_copy_block()
+        # Migrators are one-shot jobs; they should not inherit long-running
+        # service healthchecks (e.g. HTTP probes on localhost:3000) from base layers.
+        + "HEALTHCHECK NONE\n"
+        + "USER " + BUN_USER + "\n"
+        + "ENTRYPOINT [\"" + MIGRATE_SH_ABS_PATH + "\"]\n"
+        + "\nFROM l4_migrator_runtime AS migrator\n"
+        + "FROM l4_migrator_runtime AS production\n"
+        + "FROM l4_migrator_runtime AS development\n"
+    )
+
+GLOBAL_CONFIG = {}

package/engine/topologies/platform/docker/layers/prisma/secret_resolution.star

@@ -0,0 +1,119 @@
+"""
+Secret Resolution Shell Fragment
+
+Generates the shell script block responsible for resolving DATABASE_URL at
+runtime.  Priority order:
+  1. Infisical API (when INFISICAL_TOKEN + INFISICAL_PROJECT_ID are present)
+  2. Individual DB_* env vars assembled into a connection string
+  3. Pre-injected DATABASE_URL (docker-compose / Tilt direct injection)
+
+Returns a plain string that is embedded verbatim inside migrate.sh.
+"""
+
+load('../../../../tilt/common/utils_debug.star', 'DEBUG_MODE')
+load(
+    './constants.star',
+    'DATABASE_URL_UNSET_CONDITION',
+    'DB_URL_COMPONENT_ENV_KEYS',
+    'DB_URL_FROM_COMPONENTS',
+    'DEFAULT_INFISICAL_URL',
+    'INFISICAL_SECRET_ENV_KEYS',
+)
+load('../../../../tilt/generators/infisical/path_manager.star', 'PathManager')
+
+
+def _export_secret_line(secret_key):
+    return (
+        "    export " + secret_key + "=$(echo \"$RESPONSE\" | jq -r --arg k \"" + secret_key + "\" "
+        + "'.secrets[] | select(.secretKey==$k) | .secretValue' || true)\n"
+    )
+
+
+def _infisical_export_block():
+    lines = []
+    for secret_key in INFISICAL_SECRET_ENV_KEYS:
+        lines.append(_export_secret_line(secret_key))
+    return "".join(lines)
+
+
+def _all_env_present_condition(env_keys):
+    checks = []
+    for env_key in env_keys:
+        checks.append("[ -n \"$" + env_key + "\" ]")
+    return " && ".join(checks)
+
+
+def _infisical_fetch_block(log_fetch, log_fetch_ok, log_fetch_fail):
+    """Build the Infisical curl block using Starlark path manager."""
+    else_block = ("  else\n" + log_fetch_fail + "  fi\n") if log_fetch_fail else "  fi\n"
+    # Use default database subpath from PathManager constants
+    default_secret_path = PathManager.RESOURCE_SUBPATHS[0] if PathManager.RESOURCE_SUBPATHS else ""
+    # Note: In shell, we use env var with fallback. The actual path resolution
+    # happens at runtime, but we document the Starlark-managed path convention here.
+    return (
+        "if [ -n \"$INFISICAL_TOKEN\" ] && [ -n \"$INFISICAL_PROJECT_ID\" ]; then\n"
+        + log_fetch
+        + "  INFISICAL_URL=\"${INFISICAL_API_URL:-${INFISICAL_URL:-" + DEFAULT_INFISICAL_URL + "}}\"\n"
+        + "  INFISICAL_ENV=\"${INFISICAL_ENVIRONMENT:-dev}\"\n"
+        + "  # Using Starlark-managed path: /services/$RESOURCE_NAME" + default_secret_path + "\n"
+        + "  SECRET_PATH=\"${INFISICAL_SECRET_PATH:-/services/$RESOURCE_NAME/database}\"\n"
+        + "  RESPONSE=$(curl -s -f -H \"Authorization: Bearer $INFISICAL_TOKEN\" "
+        + "\"${INFISICAL_URL}/api/v3/secrets/raw?environment=${INFISICAL_ENV}"
+        + "&workspaceId=${INFISICAL_PROJECT_ID}&secretPath=${SECRET_PATH}\") || true\n"
+        + "  if [ -n \"$RESPONSE\" ]; then\n"
+        + log_fetch_ok
+        + _infisical_export_block()
+        + else_block
+        + "fi\n"
+    )
+
+
+def _component_url_build_block(log_built):
+    """Build DATABASE_URL from individual DB_* parts when it is absent."""
+    components_ready = _all_env_present_condition(DB_URL_COMPONENT_ENV_KEYS)
+    return (
+        "# Build DATABASE_URL from components if not present\n"
+        + "if " + DATABASE_URL_UNSET_CONDITION + "; then\n"
+        + "  if " + components_ready + "; then\n"
+        + "    export DATABASE_URL=\"" + DB_URL_FROM_COMPONENTS + "\"\n"
+        + log_built
+        + "  fi\n"
+        + "fi\n"
+    )
+
+
+def _validate_url_block():
+    """Hard-fail when DATABASE_URL is still missing after all attempts."""
+    return (
+        "if " + DATABASE_URL_UNSET_CONDITION + "; then\n"
+        + "  echo \"\\u274c ERROR: DATABASE_URL is not set."
+        + " Set it via Infisical or environment variables.\"\n"
+        + "  exit 1\n"
+        + "fi\n"
+    )
+
+
+def secret_resolution_script():
+    """
+    Return the complete shell fragment that resolves DATABASE_URL.
+
+    Uses DEBUG_MODE to include/suppress verbose log lines.
+    """
+    if DEBUG_MODE:
+        log_fetch      = "  echo \"\\U0001f510 Fetching secrets from Infisical...\"\n"
+        log_fetch_ok   = "    echo \"\\u2705 Successfully fetched secrets from Infisical\"\n"
+        log_fetch_fail = "    echo \"\\u26a0\\ufe0f  Infisical did not return secrets (or not reachable)\"\n"
+        log_built      = "    echo \"\\U0001f511 Built DATABASE_URL from components\"\n"
+    else:
+        log_fetch = ""
+        log_fetch_ok = ""
+        log_fetch_fail = ""
+        log_built = ""
+
+    return (
+        _infisical_fetch_block(log_fetch, log_fetch_ok, log_fetch_fail)
+        + _component_url_build_block(log_built)
+        + _validate_url_block()
+    )
+
+DEBUG = {}