@tdk-landscape/tdk-cli-core 1.3.14 → 1.3.22

package/engine/topologies/platform/docker/networking/traefik_helpers.star

@@ -0,0 +1,160 @@
+# =============================================================================
+# 🐳 TILT SDK - TRAEFIK HELPERS
+# =============================================================================
+
+# === INLINED CONSTANTS for pure extension loading ===
+TRAEFIK_API_BASE_PATH = "/api"
+# === END INLINED CONSTANTS ===
+
+
+load(
+    "./traefik_constants.star",
+    "TRAEFIK_PROJECT_HOST",
+    "TRAEFIK_PROJECT_APP_HOST",
+    "TRAEFIK_PROJECT_API_HOST",
+    "TRAEFIK_ENABLE_BACKEND_PATH_RULE",
+    "TRAEFIK_ENABLE_BACKEND_HOST_RULE",
+    "TRAEFIK_ENABLE_FRONTEND_HOST_RULE",
+    "TRAEFIK_ENABLE_FRONTEND_PATH_RULE",
+    "TRAEFIK_FRONTEND_LOCALHOST_SUFFIX",
+    "TRAEFIK_WEB_ENTRYPOINT",
+    "TRAEFIK_WEBSECURE_ENTRYPOINT",
+    "TRAEFIK_API_VERSION",
+)
+
+
+
+def build_entrypoints(enable_http, enable_https):
+    entrypoints = []
+    if enable_http:
+        entrypoints.append(TRAEFIK_WEB_ENTRYPOINT)
+    if enable_https:
+        entrypoints.append(TRAEFIK_WEBSECURE_ENTRYPOINT)
+    if len(entrypoints) == 0:
+        entrypoints.append(TRAEFIK_WEB_ENTRYPOINT)
+    return ",".join(entrypoints)
+
+
+def frontend_rule(res_name, base_path, traefik_host):
+    parts = []
+    if TRAEFIK_ENABLE_FRONTEND_HOST_RULE:
+        parts.append(
+            "Host(`{res_name}{suffix}`)".format(
+                res_name=res_name,
+                suffix=TRAEFIK_FRONTEND_LOCALHOST_SUFFIX,
+            ),
+        )
+    if traefik_host:
+        parts.append("Host(`{traefik_host}`)".format(traefik_host=traefik_host))
+    if TRAEFIK_ENABLE_FRONTEND_PATH_RULE:
+        parts.append(
+            "(Host(`{host}`) && PathPrefix(`{base_path}`))".format(
+                host=TRAEFIK_PROJECT_APP_HOST,
+                base_path=base_path,
+            ),
+        )
+        # Also accept localhost for local testing
+        parts.append(
+            "(Host(`localhost`) && PathPrefix(`{base_path}`))".format(
+                base_path=base_path,
+            ),
+        )
+    return " || ".join(parts)
+
+
+def backend_rule(traefik_host, traefik_path):
+    parts = []
+    if TRAEFIK_ENABLE_BACKEND_HOST_RULE:
+        parts.append("Host(`{host}`)".format(host=traefik_host))
+    if TRAEFIK_ENABLE_BACKEND_PATH_RULE and traefik_path:
+        parts.append("PathPrefix(`{path}`)".format(path=traefik_path))
+    return " || ".join(parts)
+
+
+def _pluralize_stack(stack):
+    """Convert stack to proper plural form.
+
+    Handles irregular plurals and special cases.
+
+    Args:
+        stack: Singular stack name (e.g., "user", "order", "product")
+
+    Returns:
+        str: Pluralized stack name (e.g., "users", "orders", "products")
+    """
+    # Already plural
+    if stack.endswith("s"):
+        return stack
+
+    # Irregular plurals that don't follow normal rules
+    irregulars = {
+        "identity": "identity",
+        "profile": "profile",  # profiles is wrong, profile is correct
+        "staff": "staff",
+        "inventory": "inventory",
+    }
+
+    if stack in irregulars:
+        return irregulars[stack]
+
+    # Words ending in 'y' preceded by a consonant -> 'ies'
+    if stack.endswith("y") and len(stack) > 1 and stack[-2] not in "aeiou":
+        return stack[:-1] + "ies"
+
+    # Words ending in ch, sh, ss, x, z, o -> 'es'
+    if stack.endswith(("ch", "sh", "ss", "x", "z", "o")):
+        return stack + "es"
+
+    return stack + "s"
+
+
+def get_api_path(stack, manifest=None):
+    """Generate API path from stack. Converts stack to proper resource name.
+
+    URL Restructuring: Changed from /api/v1/{stack} to /api/{resource-name}
+
+    Args:
+        stack: Resource stack from manifest (from service.json)
+
+    Returns:
+        str: API path like "/api/{stack}-management"
+    """
+    # NEW: Use {stack}-management pattern instead of pluralized stack
+    # This matches the resource naming convention ({stack}-management)
+    return "{base}/{stack}-management".format(
+        base=TRAEFIK_API_BASE_PATH,
+        stack=stack,
+    )
+
+
+def cli_api_path(resource_name, manifest=None):
+    """API path printed by `tdk up` and served on api.{project}.localhost.
+
+    Matches cli/src/commands/up.ts: `/api/{name}` with a trailing `-api` stripped.
+    """
+    if manifest and manifest.get("apiPath"):
+        return manifest.get("apiPath")
+    name = resource_name or (manifest.get("appName", "") if manifest else "")
+    if name.endswith("-api"):
+        name = name[:-4]
+    return TRAEFIK_API_BASE_PATH + "/" + name
+
+
+def project_backend_rule(manifest, resource_name=None):
+    """Generate routing rule for api.{project}.localhost from manifest.
+
+    Args:
+        manifest: Service manifest dictionary
+        resource_name: Runtime resource name (e.g. auth-api-backend)
+
+    Returns:
+        str: Traefik routing rule for project localhost domain
+    """
+    if not manifest and not resource_name:
+        return ""
+
+    api_path = cli_api_path(resource_name, manifest)
+    return "Host(`{host}`) && PathPrefix(`{path}`)".format(
+        host=TRAEFIK_PROJECT_API_HOST,
+        path=api_path,
+    )

package/engine/topologies/platform/docker/secrets/infisical.star

@@ -0,0 +1,135 @@
+# =============================================================================
+# 🔐 INFISICAL ENVIRONMENT GENERATOR (Refactored)
+# =============================================================================
+# Uses Starlark generators for consistent secret management
+# =============================================================================
+#
+# This module provides:
+#   - Environment variable generation for Infisical integration
+#   - Uses SecretsGenerator for consistent configuration
+#
+# Usage:
+#   load("../secrets/infisical.star", "InfisicalEnv")
+#   env_vars = InfisicalEnv.get_for_service("my-service")
+# =============================================================================
+
+load("../constants.star", "PlatformDockerConstants")
+load("../../../tilt/generators/infisical/secrets_generator.star", "SecretsGenerator")
+load("../../../tilt/generators/infisical/path_manager.star", "PathManager")
+
+def _get_infisical_base_url():
+    """Get the Infisical base URL."""
+    return "http://{}-infisical:8080".format(PlatformDockerConstants.PROJECT_NAME)
+
+def get_infisical_environment_vars(as_array=True, resource_name=None, resource_type="backend"):
+    """
+    Generate environment variables for Infisical integration.
+    
+    Uses Starlark generators for consistent configuration.
+    
+    Args:
+        as_array: If True, return as YAML array format; else as dict format
+        resource_name: Optional service name for service-specific configuration
+        resource_type: Service type for path generation
+    
+    Returns:
+        String with environment variables in YAML format
+    """
+    infisical_url = _get_infisical_base_url()
+    
+    if resource_name:
+        # Use generator for service-specific configuration
+        secret_path = PathManager.get_known_resource_path(resource_name)
+        if not secret_path:
+            path_plan = PathManager.plan_resource_path(resource_name, resource_type)
+            secret_path = path_plan["full_path"]
+        
+        config = SecretsGenerator.generate_for_service(
+            resource_name=resource_name,
+            secret_path=secret_path,
+            resource_type=resource_type,
+        )
+        
+        env = config["docker_compose"]["environment"]
+        
+        if as_array:
+            lines = []
+            for key, value in env.items():
+                lines.append("      - {}={}".format(key, value))
+            return "\n".join(lines)
+        else:
+            lines = []
+            for key, value in env.items():
+                lines.append("      {}: {}".format(key, value))
+            return "\n".join(lines)
+    
+    # Fallback to base configuration (no service-specific paths)
+    base_env = {
+        "INFISICAL_CLIENT_ID": "${INFISICAL_CLIENT_ID:-}",
+        "INFISICAL_CLIENT_SECRET": "${INFISICAL_CLIENT_SECRET:-}",
+        "INFISICAL_PROJECT_ID": "${INFISICAL_PROJECT_ID:-}",
+        "INFISICAL_SITE_URL": "${INFISICAL_SITE_URL:-" + infisical_url + "}",
+        "INFISICAL_ENV": "${INFISICAL_ENV:-dev}",
+        "INFISICAL_ENABLED": "${INFISICAL_ENABLED:-true}",
+    }
+    
+    if as_array:
+        lines = []
+        for key, value in base_env.items():
+            lines.append("      - {}={}".format(key, value))
+        return "\n".join(lines)
+    else:
+        lines = []
+        for key, value in base_env.items():
+            lines.append("      {}: {}".format(key, value))
+        return "\n".join(lines)
+
+def get_for_service(resource_name, resource_type="backend", as_array=True):
+    """
+    Get Infisical environment variables for a specific service.
+    
+    Args:
+        resource_name: Name of the service
+        resource_type: Type of service
+        as_array: Return format (array or dict style)
+    
+    Returns:
+        String with environment variables
+    """
+    return get_infisical_environment_vars(
+        as_array=as_array,
+        resource_name=resource_name,
+        resource_type=resource_type,
+    )
+
+def get_batch_for_services(resource_configs):
+    """
+    Get Infisical environment variables for multiple services.
+    
+    Args:
+        resource_configs: List of dicts with 'name' and optional 'type'
+    
+    Returns:
+        Dict mapping service names to environment variable strings
+    """
+    results = {}
+    
+    for config in resource_configs:
+        name = config.get("name")
+        svc_type = config.get("type", "backend")
+        
+        if name:
+            results[name] = get_for_service(name, svc_type)
+    
+    return results
+
+# =============================================================================
+# Public API
+# =============================================================================
+
+InfisicalEnv = struct(
+    get_base_url=_get_infisical_base_url,
+    get_infisical_environment_vars=get_infisical_environment_vars,
+    get_for_service=get_for_service,
+    get_batch_for_services=get_batch_for_services,
+)

package/engine/topologies/platform/net/proxy.star

@@ -0,0 +1,4 @@
+load("../../tilt/resources/infra-loader.star", _Infra = "Infra")
+
+def load(should_enable):
+    return _Infra.load_proxy(should_enable)

package/engine/topologies/platform/registries/local.star

@@ -0,0 +1,4 @@
+load("../../tilt/resources/infra-loader.star", _Infra = "Infra")
+
+def load(should_enable):
+    return _Infra.load_verdaccio(should_enable)

package/engine/topologies/platform/security/secrets.star

@@ -0,0 +1,239 @@
+# =============================================================================
+# 🔐 INFISICAL SECURITY MODULE
+# =============================================================================
+# Centralizes Infisical secrets management configuration
+# =============================================================================
+#
+# This module provides:
+#   - Infrastructure loading (Infisical containers)
+#   - Secret injection configuration for services
+#   - Machine identity management
+#   - Organization and path management
+#
+# Usage:
+#   load("../../platform/security/secrets.star", "Secrets")
+#   
+#   # Load Infisical infrastructure
+#   Secrets.load_infra(should_enable_fn)
+#   
+#   # Configure service secrets
+#   config = Secrets.configure_service("my-service", "/services/my-service")
+# =============================================================================
+
+# Infrastructure loader
+load("../../tilt/resources/infra-loader.star", _Infra="Infra")
+
+# Generators
+load("../../tilt/generators/infisical/index.star", _Infisical="Infisical")
+
+# Docker layers integration
+load("../../platform/docker/layers/infisical/index.star", "InfisicalLayers")
+
+# =============================================================================
+# Infrastructure Loading
+# =============================================================================
+
+def _load_infra(should_enable):
+    """Load Infisical infrastructure containers."""
+    return _Infra.load_infisical(should_enable)
+
+# =============================================================================
+# Resource Secret Configuration
+# =============================================================================
+
+def _configure_service(resource_name, secret_path, resource_type="backend", command=None):
+    """
+    Configure secret injection for a resource.
+
+    Args:
+        resource_name: Name of the resource
+        secret_path: Infisical path (e.g., "/services/my-service")
+        resource_type: Type of resource (backend, frontend, worker, etc.)
+        command: Entrypoint command (optional)
+
+    Returns:
+        Configuration dict for the resource
+    """
+    return _Infisical.Secrets.generate_for_service(
+        resource_name=resource_name,
+        secret_path=secret_path,
+        resource_type=resource_type,
+        command=command,
+    )
+
+def _configure_services_batch(services_config):
+    """
+    Configure secrets for multiple resources.
+
+    Args:
+        services_config: List of dicts with resource configuration
+
+    Returns:
+        Dict mapping resource names to configurations
+    """
+    return _Infisical.Secrets.generate_for_services_batch(services_config)
+
+# =============================================================================
+# Path Management
+# =============================================================================
+
+def _plan_resource_path(resource_name, resource_type="backend"):
+    """Plan Infisical path for a resource."""
+    return _Infisical.Paths.plan_resource_path(resource_name, resource_type)
+
+def _plan_batch_paths(resource_names, resource_type="backend"):
+    """Plan paths for multiple resources."""
+    return _Infisical.Paths.plan_batch_resource_paths(resource_names, resource_type)
+
+def _get_known_resource_path(resource_name):
+    """Get predefined path for a known resource."""
+    return _Infisical.Paths.get_known_resource_path(resource_name)
+
+# =============================================================================
+# Machine Identity
+# =============================================================================
+
+def _generate_machine_identity(identity_name, access_paths=None, project_id=None):
+    """
+    Generate machine identity configuration.
+    
+    Args:
+        identity_name: Name of the machine identity
+        access_paths: List of paths the identity can access
+        project_id: Project ID
+    
+    Returns:
+        Machine identity configuration
+    """
+    return _Infisical.Identity.generate_universal_auth(
+        identity_name=identity_name,
+        access_paths=access_paths,
+        project_id=project_id,
+    )
+
+def _get_development_machine(project_id=None):
+    """Get development machine identity configuration."""
+    return _Infisical.Identity.generate_development_machine(
+        identity_name="dev-machine",
+        project_id=project_id,
+    )
+
+def _get_ci_machine(project_id=None):
+    """Get CI/CD machine identity configuration."""
+    return _Infisical.Identity.generate_ci_machine(project_id=project_id)
+
+# =============================================================================
+# Organization Setup
+# =============================================================================
+
+def _generate_org_config(org_name=None, environments=None, resource_names=None):
+    """
+    Generate organization configuration.
+    
+    Args:
+        org_name: Organization name
+        environments: List of environment names
+        resource_names: List of service names
+    
+    Returns:
+        Organization configuration dict
+    """
+    return _Infisical.Org.generate_config(
+        org_name=org_name,
+        env_names=environments,
+        resource_names=resource_names,
+    )
+
+# =============================================================================
+# Predefined Services Configuration
+# =============================================================================
+
+# Project-specific service configurations should be defined in .tdk/project.json
+# This dict is kept for backward compatibility but should be empty for generic TDK CLI
+PREDEFINED_RESOURCES = {}
+
+def _get_predefined_resource_config(resource_name):
+    """Get predefined configuration for a known resource."""
+    return PREDEFINED_RESOURCES.get(resource_name)
+
+def _configure_predefined_service(resource_name, command=None):
+    """
+    Configure a predefined resource by name.
+
+    Args:
+        resource_name: Name of the predefined resource
+        command: Entrypoint command (optional)
+
+    Returns:
+        Resource configuration or None if not predefined
+    """
+    config = _get_predefined_resource_config(resource_name)
+    if not config:
+        return None
+    
+    return _configure_service(
+        resource_name=resource_name,
+        secret_path=config["path"],
+        resource_type=config["type"],
+        command=command,
+    )
+
+# =============================================================================
+# Batch Configuration for All Resources
+# =============================================================================
+
+def _configure_all_predefined_services(command=None):
+    """
+    Configure all predefined resources.
+
+    Args:
+        command: Default entrypoint command (optional)
+
+    Returns:
+        Dict mapping resource names to configurations
+    """
+    results = {}
+    
+    for resource_name in PREDEFINED_RESOURCES:
+        config = _configure_predefined_service(resource_name, command)
+        if config:
+            results[resource_name] = config
+    
+    return results
+
+# =============================================================================
+# Public API
+# =============================================================================
+
+Secrets = struct(
+    # Infrastructure
+    load_infra=_load_infra,
+
+    # Resource configuration
+    configure_service=_configure_service,
+    configure_services_batch=_configure_services_batch,
+    configure_predefined_service=_configure_predefined_service,
+    configure_all_predefined_services=_configure_all_predefined_services,
+    
+    # Path management
+    plan_resource_path=_plan_resource_path,
+    plan_batch_paths=_plan_batch_paths,
+    get_known_resource_path=_get_known_resource_path,
+    
+    # Machine identity
+    generate_machine_identity=_generate_machine_identity,
+    get_development_machine=_get_development_machine,
+    get_ci_machine=_get_ci_machine,
+    
+    # Organization
+    generate_org_config=_generate_org_config,
+    
+    # Constants
+    PREDEFINED_RESOURCES=PREDEFINED_RESOURCES,
+    
+    # Direct access to submodules
+    Infisical=_Infisical,
+    
+    # Docker layers integration
+    Layers=InfisicalLayers,
+)

package/engine/topologies/platform/state/relational.star

@@ -0,0 +1,4 @@
+load("../../tilt/resources/infra-loader.star", _Infra = "Infra")
+
+def load(should_enable):
+    return _Infra.load_database(should_enable)

package/engine/topologies/tilt/common/AGENTS.md

@@ -0,0 +1,59 @@
+# AGENTS.md - Common Utilities
+
+## Purpose
+
+Shared utility functions used across all Tilt topologies.
+
+## Key Files
+
+### Core Utilities
+- **`utils.star`** - `Utils` struct with file operations, path manipulation
+- **`paths.star`** - Path utilities, path joining, normalization
+- **`strings.star`** - String manipulation helpers
+
+### Tilt Helpers
+- **`tilt.star`** - Tilt-specific utilities
+- **`debug.star`** - Debug logging, tracing
+
+## Common Tasks
+
+### Read JSON file
+```starlark
+load("./utils.star", "Utils")
+content = Utils.read_json_file(path)
+```
+
+### Check if path exists
+```starlark
+load("./utils.star", "Utils")
+exists = Utils.path_exists(path)
+```
+
+### Join paths
+```starlark
+load("./utils.star", "Utils")
+full_path = Utils.join_paths(base, relative)
+```
+
+## Usage
+
+Most topology modules load this:
+```starlark
+load("../common/utils.star", "Utils")
+```
+
+## Important Notes
+
+- These are pure Starlark functions (no Tilt builtins)
+- Safe to use in any context
+- No side effects
+
+## Available Functions
+
+See `Utils` struct for full list:
+- `read_json_file(path)`
+- `path_exists(path)`
+- `join_paths(base, rel)`
+- `sanitize_name(name)`
+- `extract_domain(path)`
+- `get_relative_path(from, to)`