@tdk-landscape/tdk-cli-core 1.3.144 → 1.3.146

package/cli/dist-bundle/{cold-preflight-CGPSYGDB.js → cold-preflight-2ZV2PDU2.js}

@@ -1,2 +1,2 @@
 import{createRequire as __tdkRequire}from'node:module';const require=__tdkRequire(import.meta.url);
-import{sb as a,tb as b,ub as c,vb as d,wb as e}from"./chunk-2PTDOT3Y.js";import"./chunk-42IVF3YT.js";import"./chunk-6EA4DGCY.js";export{e as assertMachineReadyOrExit,d as formatColdPreflight,a as nodeTooOld,b as requireVerifiedDockerVersions,c as runColdPreflight};
+import{sb as a,tb as b,ub as c,vb as d,wb as e}from"./chunk-SWAGCVPQ.js";import"./chunk-42IVF3YT.js";import"./chunk-6EA4DGCY.js";export{e as assertMachineReadyOrExit,d as formatColdPreflight,a as nodeTooOld,b as requireVerifiedDockerVersions,c as runColdPreflight};

package/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tdk-cli-internal",
   "private": true,
-  "version": "1.3.144",
+  "version": "1.3.146",
   "description": "TDK CLI — start services on your machine.",
   "keywords": [
     "tdk",

package/cli/templates/Tiltfile.hbs

@@ -85,6 +85,7 @@ load('ext://tdk-cli',
 'Watchers',
 'Infra',
 'Docker',
+'FrontendBuildPlan',
 'load_ui_enhancements',
 'APP_RESOURCES',
 'GLOBAL_CONFIG_EXPORT',
@@ -266,6 +267,13 @@ for _KNOWN_SVC in _app_resources_list:
                 _KNOWN_TILT_RESOURCES.add(_KNOWN_RES_NAME)
                 _KNOWN_TILT_RESOURCES.add(_KNOWN_RES_NAME + '-run-only')
                 _KNOWN_TILT_RESOURCES.add(_KNOWN_RES_NAME + '-config-gen')
+                # A frontend whose build script is the standard `tsc && vite build` gets a
+                # non-blocking <service>-typecheck resource (see Docker frontend registration).
+                # Name it here, from the same plan and path, so focus mode can enable it.
+                if _KNOWN_RES.get('frontend', False) and not should_enable('backends-only'):
+                    _KNOWN_RES_DIR = PROJECT_ROOT + '/' + _KNOWN_RES.get('_resource_path', _KNOWN_SVC.get('path', '') + '/' + _KNOWN_RES_NAME)
+                    if FrontendBuildPlan(_KNOWN_RES_DIR + '/package.json')['typecheck']:
+                        _KNOWN_TILT_RESOURCES.add(_KNOWN_RES_NAME + '-typecheck')
                 _KNOWN_RES_MANIFEST = _KNOWN_RES.get('_manifest', {})
                 _KNOWN_RES_SABLIER = _KNOWN_RES_MANIFEST.get('sablier', {})
                 # Mirrors _register_single_resource: the prebuild only exists for
@@ -280,6 +288,8 @@ if FOCUS_MODE and FOCUS_ENABLED_RESOURCES:
     for _R in FOCUS_ENABLED_RESOURCES:
         if _R in _KNOWN_TILT_RESOURCES:
             _FILTERED_RESOURCES.append(_R)
+            if _R + '-typecheck' in _KNOWN_TILT_RESOURCES:
+                _FILTERED_RESOURCES.append(_R + '-typecheck')
             # Focus expansion normally resolves stack names to concrete
             # resources before this loop, so the stack branch below is not
             # reached for the common `tdk up <stack>` path. Keep a deferred
@@ -301,6 +311,8 @@ if FOCUS_MODE and FOCUS_ENABLED_RESOURCES:
                 # enabled name it cannot find.
                 if _STACK_RES_NAME + '-image' in _DEFERRED_IMAGE_RESOURCES:
                     _FILTERED_RESOURCES.append(_STACK_RES_NAME + '-image')
+                if _STACK_RES_NAME + '-typecheck' in _KNOWN_TILT_RESOURCES:
+                    _FILTERED_RESOURCES.append(_STACK_RES_NAME + '-typecheck')
         else:
             _MATCHED = [kr for kr in _KNOWN_TILT_RESOURCES if kr != 'service-discovery-daemon' and kr.startswith(_R + '-')]
             _FILTERED_RESOURCES.extend(_MATCHED)

package/engine/Tiltfile

@@ -13,6 +13,7 @@
 load('./topologies/tilt/common/utils.star', _Utils='Utils')
 load('./topologies/tilt/discovery/loading.star', _Manifest='Manifest')
 load('./topologies/tilt/config/global.star', _Config='Config')
+load('./topologies/platform/docker/build/frontend_build_plan.star', _frontend_build_plan='frontend_build_plan')
 
 # Registry
 load('./topologies/tilt/discovery/registry.star',
@@ -49,6 +50,7 @@ load('./topologies/tilt/resources/orchestrator/apply_compose_resource_registrati
 Utils = _Utils
 Manifest = _Manifest
 Config = _Config
+FrontendBuildPlan = _frontend_build_plan
 
 # Registry Data
 GLOBAL_CONFIG_EXPORT = _GLOBAL_CONFIG_EXPORT

package/engine/assets/scripts/cleanup-tilt-images.sh

@@ -81,13 +81,13 @@ for repo in $REPOS; do
   while IFS= read -r row; do
     [[ -z "$row" ]] && continue
     if (( i < KEEP_COUNT )); then
-      ((i++))
+      ((++i))
       continue
     fi
     image_id="$(awk '{print $3}' <<< "$row")"
     tag="$(awk '{print $2}' <<< "$row")"
     TO_DELETE+=("$image_id|$repo:$tag")
-    ((i++))
+    ((++i))
   done <<< "$repo_blob"
 done
 

package/engine/topologies/platform/docker/build/frontend_build_plan.star

@@ -0,0 +1,65 @@
+# =============================================================================
+# 🏗️ TILT SDK - FRONTEND BUILD PLAN
+# =============================================================================
+# Decides how a frontend image runs its production build.
+#
+# A `"build": "tsc --noEmit && vite build"` script (the restaurant example uses it). Running that script
+# inside the image build makes the type-check block the image and compete for
+# CPU with other builds. When the script has exactly that standard shape, the
+# image runs `vite build` directly and the type-check becomes a separate,
+# non-blocking Tilt resource. Any other script runs unchanged.
+# =============================================================================
+
+DEFAULT_FRONTEND_BUILD_CMD = 'bun run build'
+
+# Only a non-emitting type-check is moved out of the image. A plain `tsc` writes output that the build may
+# use (the CLI scaffold's tsconfig emits to ./dist), so that script keeps running unchanged in the image.
+_TSC_FORMS = ['tsc --noEmit']
+# The generated config is copied into the image; any other config file is not, so a script that selects one is not used.
+_IMAGE_CONFIG_DIR = '.autogenerated/'
+_VITE_BUILD = 'vite build'
+
+
+def _default_plan():
+    return {'build_cmd': DEFAULT_FRONTEND_BUILD_CMD, 'typecheck': False, 'typecheck_cmd': ''}
+
+
+def frontend_build_plan(package_json_path):
+    """Returns {'build_cmd', 'typecheck', 'typecheck_cmd'} for the package.json at package_json_path.
+
+    build_cmd is the command the image runs; the generated Vite config is appended to it.
+    typecheck is True only when the standard `tsc --noEmit && vite build` form was recognised;
+    typecheck_cmd is then the host command for the non-blocking type-check resource.
+    A missing or unreadable package.json, or any other script, gets the default plan.
+    """
+    if not os.path.exists(package_json_path):
+        return _default_plan()
+
+    scripts = read_json(package_json_path).get('scripts', {})
+    script = scripts.get('build', '').strip()
+    steps = script.split(' && ')
+    if len(steps) != 2:
+        return _default_plan()
+
+    typecheck_step = steps[0].strip()
+    vite_step = steps[1].strip()
+    if typecheck_step not in _TSC_FORMS:
+        return _default_plan()
+    if vite_step != _VITE_BUILD and not vite_step.startswith(_VITE_BUILD + ' '):
+        return _default_plan()
+
+    # Flags after `vite build` are kept. A --config must name the generated config, which the image copies.
+    extra_args = vite_step[len(_VITE_BUILD):]
+    tokens = extra_args.split()
+    for i, token in enumerate(tokens):
+        value = ''
+        if token == '--config' and i + 1 < len(tokens):
+            value = tokens[i + 1]
+        elif token.startswith('--config='):
+            value = token[len('--config='):]
+        else:
+            continue
+        if not value.startswith(_IMAGE_CONFIG_DIR):
+            return _default_plan()
+
+    return {'build_cmd': 'bunx vite build' + extra_args, 'typecheck': True, 'typecheck_cmd': 'bunx tsc --noEmit'}

package/engine/topologies/platform/docker/build/golden_image_build.star

@@ -2,7 +2,64 @@
 # 🏗️ TILT SDK - GOLDEN IMAGE BUILDERS
 # =============================================================================
 
-load('./golden_image_constants.star', 'GOLDEN_DOCKERFILE', 'GOLDEN_IMAGE_PREFIX')
+load('./golden_image_constants.star', 'GOLDEN_DOCKERFILE', 'GOLDEN_IMAGE_PREFIX', 'GOLDEN_LAYERS')
+
+# Label that records which golden Dockerfile an image was built from.
+GOLDEN_HASH_LABEL = 'tdk.golden.hash'
+
+# Shell template for the golden build. Placeholders (@@...@@) are replaced in
+# build_golden_layers(); plain `$VAR` references are expanded by the shell.
+_GOLDEN_BUILD_TEMPLATE = '''
+DF_REL=@@DF_REL@@
+ROOT_REL=@@ROOT_REL@@
+DF="$(cd "$(dirname "$DF_REL")" && pwd)/$(basename "$DF_REL")"
+ROOT="$(cd "$ROOT_REL" && pwd)"
+HASH="$(cat "$DF" | (sha256sum 2>/dev/null || shasum -a 256) | cut -c1-64)"
+IMAGES="@@IMAGES@@"
+
+if [ -z "$TDK_GOLDEN_REBUILD" ]; then
+  fresh=1
+  for img in $IMAGES; do
+    [ "$(docker image inspect -f '{{index .Config.Labels "@@HASH_LABEL@@"}}' "$img" 2>/dev/null)" = "$HASH" ] || fresh=0
+  done
+  if [ "$fresh" = 1 ]; then
+    echo "✅ Golden images are up to date (hash $HASH) - skipping build"
+    exit 0
+  fi
+fi
+
+echo "🏗️  Building golden layered images (@@COUNT@@ total)..."
+if docker buildx version >/dev/null 2>&1; then
+  echo "  🧩 Building all golden targets with one docker buildx bake (independent stages run in parallel)"
+  cat > golden-layers.bake.hcl <<HCL
+variable "HASH" {
+  default = ""
+}
+
+group "default" {
+  targets = [@@TARGET_NAMES@@]
+}
+@@BAKE_TARGETS@@
+HCL
+  # Buildx 0.19 and later ask for read access outside the bake file's directory; older releases do not know the flag.
+  BUILDX_VER="$(docker buildx version 2>/dev/null | sed -n 's/.* v\\([0-9]*\\)\\.\\([0-9]*\\).*/\\1 \\2/p')"
+  BUILDX_MAJOR="${BUILDX_VER%% *}"
+  BUILDX_MINOR="${BUILDX_VER##* }"
+  BAKE_ALLOW=""
+  if [ "${BUILDX_MAJOR:-0}" -gt 0 ] || [ "${BUILDX_MINOR:-0}" -ge 19 ]; then BAKE_ALLOW="--allow fs.read=$ROOT"; fi
+  HASH="$HASH" docker buildx bake $BAKE_ALLOW -f golden-layers.bake.hcl --load
+else
+  echo "  ⚠️  docker buildx is not available - building golden targets one at a time"
+  @@SERIAL_BUILDS@@
+fi
+
+echo "✅ Golden layers built (@@COUNT@@ images):"
+@@SUMMARY@@
+'''
+
+
+def _sh_quote(text):
+    return "'" + text.replace("'", "'\\''") + "'"
 
 
 def build_golden_layers(project_root='.'):
@@ -16,63 +73,62 @@ def build_golden_layers(project_root='.'):
     is itself project-root-relative, so it must be prefixed with this to
     resolve correctly - passing project_root='.' (the default) only works
     when the Tiltfile happens to live at the project root.
+
+    The build is skipped when every golden image already exists with a
+    `tdk.golden.hash` label matching the current Dockerfile. Set
+    TDK_GOLDEN_REBUILD=1 to force a rebuild. Otherwise all targets are built
+    with one `docker buildx bake`, falling back to serial `docker build` when
+    buildx is not installed.
     """
     resource_name = 'golden-layers-build'
     dockerfile_from_tiltfile = (
         GOLDEN_DOCKERFILE if project_root in (None, '.', '')
         else project_root.rstrip('/') + '/' + GOLDEN_DOCKERFILE
     )
+    context = project_root or '.'
 
-    build_cmd = """
-echo "🏗️  Building golden layered images (8 total)..."
-echo "  📦 L1: OS base + runtime"
-echo "  📦 L2: Dependencies"
-echo "  📦 L3-Backend: Backend build tools (Prisma)"
-echo "  📦 L3-Frontend: Frontend build tools"
-echo "  📦 L3-Migrator: Migrator build tools (Prisma)"
-echo "  📦 L4-Backend: Backend runtime"
-echo "  📦 L4-Frontend: Frontend runtime"
-echo "  📦 L4-Migrator: Migrator runtime"
-
-docker build -f {dockerfile} \\
-  --target l1_golden -t {prefix}-l1:{tag} {context} && \\
-docker build -f {dockerfile} \\
-  --target l2_golden -t {prefix}-l2:{tag} {context} && \\
-docker build -f {dockerfile} \\
-  --target l3_backend_golden -t {prefix}-l3-backend:{tag} {context} && \\
-docker build -f {dockerfile} \\
-  --target l3_frontend_golden -t {prefix}-l3-frontend:{tag} {context} && \\
-docker build -f {dockerfile} \\
-  --target l3_migrator_golden -t {prefix}-l3-migrator:{tag} {context} && \\
-docker build -f {dockerfile} \\
-  --target l4_backend_bun -t {prefix}-l4-backend:{tag} {context} && \\
-docker build -f {dockerfile} \\
-  --target l4_backend_node -t {prefix}-l4-backend-node:{tag} {context} && \\
-docker build -f {dockerfile} \\
-  --target l4_frontend_golden -t {prefix}-l4-frontend:{tag} {context} && \\
-docker build -f {dockerfile} \\
-  --target l4_migrator_golden -t {prefix}-l4-migrator:{tag} {context}
-
-echo "✅ Golden layers built (9 images):"
-echo "  ✓ {prefix}-l1:{tag}"
-echo "  ✓ {prefix}-l2:{tag}"
-echo "  ✓ {prefix}-l3-backend:{tag}"
-echo "  ✓ {prefix}-l3-frontend:{tag}"
-echo "  ✓ {prefix}-l3-migrator:{tag}"
-echo "  ✓ {prefix}-l4-backend:{tag} (Bun - 128MB)"
-echo "  ✓ {prefix}-l4-backend-node:{tag} (Node.js - 20MB, LIGHTWEIGHT)"
-echo "  ✓ {prefix}-l4-frontend:{tag}"
-echo "  ✓ {prefix}-l4-migrator:{tag}"
-""".format(
-        dockerfile=dockerfile_from_tiltfile,
-        prefix=GOLDEN_IMAGE_PREFIX,
-        tag='latest',
-        context=project_root,
-    ).strip()
+    images = []
+    summary = []
+    bake_targets = []
+    serial_builds = []
+    target_names = []
+    for key in GOLDEN_LAYERS:
+        layer = GOLDEN_LAYERS[key]
+        ref = layer['name'] + ':' + layer['tag']
+        images.append(ref)
+        summary.append('echo "  ✓ ' + ref + '"')
+        target_names.append('"' + key + '"')
+        bake_targets.append('''target "{key}" {{
+  dockerfile = "$DF"
+  context = "$ROOT"
+  target = "{target}"
+  tags = ["{ref}"]
+  labels = {{
+    "{label}" = HASH
+  }}
+}}
+'''.format(key=key, target=layer['target'], ref=ref, label=GOLDEN_HASH_LABEL))
+        serial_builds.append(
+            'docker build --label "{label}=$HASH" -f "$DF" --target {target} -t {ref} "$ROOT" || exit 1'.format(
+                label=GOLDEN_HASH_LABEL, target=layer['target'], ref=ref,
+            )
+        )
+
+    cmd = (_GOLDEN_BUILD_TEMPLATE
+        .replace('@@DF_REL@@', _sh_quote(dockerfile_from_tiltfile))
+        .replace('@@ROOT_REL@@', _sh_quote(context))
+        .replace('@@IMAGES@@', ' '.join(images))
+        .replace('@@HASH_LABEL@@', GOLDEN_HASH_LABEL)
+        .replace('@@COUNT@@', str(len(images)))
+        .replace('@@TARGET_NAMES@@', ', '.join(target_names))
+        .replace('@@BAKE_TARGETS@@', '\n'.join(bake_targets))
+        .replace('@@SERIAL_BUILDS@@', '\n  '.join(serial_builds))
+        .replace('@@SUMMARY@@', '\n'.join(summary))
+    )
 
     local_resource(
         resource_name,
-        cmd=build_cmd,
+        cmd=cmd,
         labels=['infra.docker', 'golden-layers'],
         deps=[dockerfile_from_tiltfile],
         allow_parallel=True,

package/engine/topologies/platform/docker/layers/l3_builder_layers.star

@@ -172,8 +172,10 @@ def L3_generate_frontend_builder(res_path, build_cmd = RUNTIME_CONFIG["bun"]["ba
     # Args passed after the script name are appended to the end of the script
     # command, so they reach `vite build` while any preceding steps in the
     # script (e.g. `tsc --noEmit &&`) still run.
+    # A build script that already names a config (the CLI scaffold does) keeps its own; a second --config is not added.
+    config_flag = "" if "--config" in build_cmd else " --config " + AUTOGENERATED_CONFIG_PATHS['vite_build']
     parts.append(
-        "RUN " + build_cmd + " --config " + AUTOGENERATED_CONFIG_PATHS['vite_build'] + "\n"
+        "RUN " + build_cmd + config_flag + "\n"
     )
     return "".join(parts)
 

package/engine/topologies/tilt/resources/build_concurrency.star

@@ -0,0 +1,56 @@
+# =============================================================================
+# 🏗️ TILT SDK - BUILD CONCURRENCY
+# =============================================================================
+# Sets Tilt's maximum parallel updates from the Docker engine's CPU count and
+# memory, instead of Tilt's default, so a warm `tdk up` on a machine with spare
+# capacity builds more than three images at once.
+#
+# Override with TDK_MAX_PARALLEL_BUILDS=<positive integer>.
+# =============================================================================
+
+MIN_PARALLEL_BUILDS = 3
+MAX_PARALLEL_BUILDS = 8
+# CPUs kept free for Tilt, the Traefik/Postgres containers and the host.
+RESERVED_CPUS = 2
+# Rough peak memory per concurrent image build (Vite and tsc dominate).
+BUILD_MEMORY_BUDGET_BYTES = 1610612736  # 1.5 GiB
+
+
+def _is_positive_int(text):
+    return len(text) > 0 and text.isdigit() and int(text) > 0
+
+
+def _engine_resources():
+    """Returns (cpus, memory_bytes) from `docker info`, or None when unavailable."""
+    out = str(local(
+        "docker info --format '{{.NCPU}} {{.MemTotal}}' 2>/dev/null || true",
+        quiet=True,
+        echo_off=True,
+    )).strip()
+    parts = out.split(' ')
+    if len(parts) != 2 or not parts[0].isdigit() or not parts[1].isdigit():
+        return None
+    return (int(parts[0]), int(parts[1]))
+
+
+def compute_max_parallel_builds(cpus, memory_bytes):
+    """The concurrency for an engine with `cpus` CPUs and `memory_bytes` of memory."""
+    by_cpu = cpus - RESERVED_CPUS
+    by_memory = memory_bytes // BUILD_MEMORY_BUDGET_BYTES
+    return max(MIN_PARALLEL_BUILDS, min(MAX_PARALLEL_BUILDS, min(by_cpu, by_memory)))
+
+
+def configure_build_concurrency():
+    """Calls update_settings once with the chosen max_parallel_updates. Call at Tiltfile load."""
+    override = os.environ.get('TDK_MAX_PARALLEL_BUILDS', '').strip()
+    if _is_positive_int(override):
+        value = int(override)
+        print("🧮 Parallel builds: " + str(value) + " (TDK_MAX_PARALLEL_BUILDS)")
+    else:
+        resources = _engine_resources()
+        if resources == None:
+            print("🧮 Parallel builds: Tilt default (docker info unavailable, so the engine's CPU and memory could not be read)")
+            return
+        value = compute_max_parallel_builds(resources[0], resources[1])
+        print("🧮 Parallel builds: " + str(value) + " (from Docker engine: " + str(resources[0]) + " CPUs)")
+    update_settings(max_parallel_updates=value)

package/engine/topologies/tilt/resources/infra-loader.star

@@ -21,6 +21,7 @@
 # =============================================================================
 
 load("../common/utils_debug.star", "debug_log")
+load("./build_concurrency.star", "configure_build_concurrency")
 load("../../platform/docker/constants.star", "PlatformDockerConstants")
 load("../../platform/docker/compose/traefik_standalone.star", "generate_standalone_traefik_compose")
 load("../../platform/docker/networking/sablier_container_cycle.star", "sablier_middleware_suffix")
@@ -442,6 +443,9 @@ def load_all_infrastructure(should_enable, fix_docker_networks_fn=None, docker_p
     if should_enable('monitoring') and should_enable('elk'):
         fail("Incompatible flags: 'monitoring' and 'elk' cannot both be enabled at the same time. Disable one of them.")
 
+    # Size Tilt's parallel image builds to the Docker engine before any build is queued
+    configure_build_concurrency()
+
     # Build golden image before other infrastructure (if enabled)
     golden_image_resource = None
     if docker_provider and write_fn:

package/engine/topologies/tilt/resources/orchestrator/apply_compose_resource_registration.star

@@ -11,6 +11,7 @@ OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
 
 load("../../common/utils_debug.star", "debug_log")
 load('../../../platform/docker/index.star', 'Docker')
+load('../../../platform/docker/build/frontend_build_plan.star', 'frontend_build_plan')
 load('../../../platform/docker/constants.star', 'PlatformDockerConstants')
 load('../../../tilt/manifest/constants.star', 'BASE_PORT_FRONTEND', 'BASE_PORT_BACKEND')
 load('../../../platform/docker/networking/traefik_static_routes.star', 'generate_static_wake_route', 'normalize_abs_path')
@@ -575,11 +576,29 @@ def _should_skip_frontend(res, should_enable):
     return res.get('frontend', False) and should_enable('backends-only')
 
 
-def _process_frontend_resource(res, manifest, full_res_path, resource_path, resource_name, should_enable):
+def _register_frontend_typecheck(res, service_dir, typecheck_cmd):
+    """Non-blocking `<service>-typecheck` resource: runs the planned tsc command so type errors show in Tilt without gating the image.
+
+    The command runs on the host, so TypeScript must resolve from the service directory (`bun install`, at the
+    service or workspace root). Without it the resource fails with that instruction instead of a bare module error.
+    """
+    local_resource(
+        name=res['name'] + '-typecheck',
+        cmd="cd '" + service_dir + "' && { bunx tsc --version >/dev/null 2>&1 || { echo 'typecheck needs host dependencies: run bun install in " + service_dir + "'; exit 1; }; } && " + typecheck_cmd,
+        deps=[service_dir + '/src', service_dir + '/tsconfig.json'],
+        labels=['app.' + res['name'], 'typecheck'],
+        # tsc --noEmit writes no files, so it can run alongside the image builds.
+        allow_parallel=True,
+    )
+
+
+def _process_frontend_resource(res, manifest, full_res_path, resource_path, resource_name, should_enable, project_root=''):
     """Process a frontend resource and return compose entry."""
     target_path = res.get('target_path', manifest.get('target_path', '/usr/share/nginx/html'))
     use_nginx = 'nginx' in target_path or target_path == '/usr/share/nginx/html'
     port = res.get('port', manifest.get('port', BASE_PORT_FRONTEND))
+    service_dir = (project_root.rstrip('/') + '/' if project_root else '') + full_res_path
+    plan = frontend_build_plan(service_dir + '/package.json')
     Docker.frontend(
         res_path=full_res_path,
         resource_name=res['name'],
@@ -587,7 +606,10 @@ def _process_frontend_resource(res, manifest, full_res_path, resource_path, reso
         target_path=target_path,
         use_nginx=use_nginx,
         use_golden=should_enable('golden-image'),
+        build_cmd=plan['build_cmd'],
     )
+    if plan['typecheck']:
+        _register_frontend_typecheck(res, service_dir, plan['typecheck_cmd'])
     return Docker.frontend_compose(resource_path=resource_path, resource_name=resource_name, res=res, manifest=manifest)
 
 
@@ -735,7 +757,7 @@ def register_compose_resources(resource_config, ctx, runtime_flags, manifest_sta
             continue
         
         if res.get('frontend', False):
-            entry = _process_frontend_resource(res, manifest, full_res_path, resource_path, resource_name, should_enable)
+            entry = _process_frontend_resource(res, manifest, full_res_path, resource_path, resource_name, should_enable, ctx.get('project_root', ''))
         else:
             entry = _process_backend_resource(res, manifest, full_res_path, resource_path, resource_name, should_enable)
             # A deferStart resource has no container Traefik can discover via

package/engine/topologies/tilt/resources/orchestrator/generators/manifest_resource.star

@@ -32,6 +32,7 @@ load('../../../generators/nginx_conf.star', 'Nginx')
 load('../../../generators/api_gateway.star', 'ApiGateway')
 load('../../../generators/tsconfig.star', 'TSConfig')
 load('../../../../platform/docker/index.star', 'Docker')
+load('../../../../platform/docker/build/frontend_build_plan.star', 'frontend_build_plan')
 load('../../../generators/npmrc.star', 'PackageConfig')
 load('../../libs.star', 'Libs')
 load('./env.star', 'EnvGenerators')
@@ -371,13 +372,16 @@ def _generate_all_configs_for_resource(
         target_path = resource_config.get('target_path', '/usr/share/nginx/html')
         use_nginx = 'nginx' in target_path or target_path == '/usr/share/nginx/html'
         port = resource_config.get('port', manifest.get('port', BASE_PORT_FRONTEND))
+        root = ctx.get('project_root', '')
+        plan = frontend_build_plan((root.rstrip('/') + '/' if root else '') + resource_path + '/package.json')
         dockerfile_content = Docker.frontend(
             res_path=resource_path,
             resource_name=resource_config['name'],
             port=port,
             target_path=target_path,
             use_nginx=use_nginx,
-            use_golden=should_enable('golden-image')
+            use_golden=should_enable('golden-image'),
+            build_cmd=plan['build_cmd'],
         )
     elif provider_owned:
         dockerfile_content = Docker.backend_language(

package/engine/topologies/tilt/resources/watchers.star

@@ -89,14 +89,14 @@ def setup_utility_resources():
     )
     
     local_resource('prune-images',
-        cmd='./.tdk/.tdk-out/ext/assets/scripts/cleanup-tilt-images.sh --keep 0 --force && docker image prune -f',
+        cmd='./.tdk/.tdk-out/tdk-cli-ext/engine/assets/scripts/cleanup-tilt-images.sh --keep 0 --force && docker image prune -f',
         resource_deps=[],
         labels=['dev.maintenance'],
         auto_init=False
     )
 
     local_resource('memory-optimizer',
-        cmd='./.tdk/.tdk-out/ext/assets/scripts/mac-m1-resource-monitor.sh && ./.tdk/.tdk-out/ext/assets/scripts/cleanup-tilt-images.sh --keep 0 --force && docker image prune -f && docker builder prune -af --filter "until=24h"',
+        cmd='./.tdk/.tdk-out/tdk-cli-ext/engine/assets/scripts/mac-m1-resource-monitor.sh && ./.tdk/.tdk-out/tdk-cli-ext/engine/assets/scripts/cleanup-tilt-images.sh --keep 0 --force && docker image prune -f && docker builder prune -af --filter "until=24h"',
         resource_deps=[],
         labels=['dev.maintenance', 'mac-m1'],
         auto_init=False
@@ -121,12 +121,15 @@ def setup_utility_resources():
                 else
                     echo "$(date +%H:%M:%S) ✓ $count dangling images (threshold: 5)"
                 fi
+                # Tilt tags every build as tilt-<hash>, so superseded builds stay tagged
+                # and are never dangling. Keep the newest 2 per service; running images are skipped.
+                ./.tdk/.tdk-out/tdk-cli-ext/engine/assets/scripts/cleanup-tilt-images.sh --keep 2 --force >/dev/null 2>&1 || true
                 sleep 300
             done
         ''',
         resource_deps=[],
         labels=['dev.maintenance', 'mac-m1'],
-        auto_init=False,
+        auto_init=True,
     )
 
     # Continuously reclaim heavyweight migrator images once migration succeeds.
@@ -134,7 +137,7 @@ def setup_utility_resources():
         serve_cmd='''
             echo "🧹 Migrator image cleanup started (every 45s)"
             while true; do
-                ./.tdk/.tdk-out/ext/assets/scripts/cleanup-completed-migrator-images.sh || true
+                ./.tdk/.tdk-out/tdk-cli-ext/engine/assets/scripts/cleanup-completed-migrator-images.sh || true
                 sleep 45
             done
         ''',

package/ext/ide-components/shared/templates/base.html

@@ -71,14 +71,10 @@
       {title}
     </h1>
     <nav class="nav">
-      <!-- nosemgrep: html.security.plaintext-http-link.plaintext-http-link -- localhost dev tools; each listens on loopback over HTTP -->
-      <a href="http://localhost:9765" class="{active_browser}" id="filesLink" data-available="{files_available}">📁 Files</a>
-      <!-- nosemgrep: html.security.plaintext-http-link.plaintext-http-link -- localhost dev tools; each listens on loopback over HTTP -->
-      <a href="http://localhost:9766" class="{active_viewer}" id="viewerLink" data-available="{viewer_available}">👁️ Code</a>
-      <!-- nosemgrep: html.security.plaintext-http-link.plaintext-http-link -- localhost dev tools; each listens on loopback over HTTP -->
-      <a href="http://localhost:9767" class="{active_inspector}">⚙️ Configs</a>
-      <!-- nosemgrep: html.security.plaintext-http-link.plaintext-http-link -- localhost dev tools; each listens on loopback over HTTP -->
-      <a href="http://localhost:9768" class="{active_terminal}" id="terminalLink" data-available="{terminal_available}">💻 Terminal</a>
+      <a href="//localhost:9765" class="{active_browser}" id="filesLink" data-available="{files_available}">📁 Files</a>
+      <a href="//localhost:9766" class="{active_viewer}" id="viewerLink" data-available="{viewer_available}">👁️ Code</a>
+      <a href="//localhost:9767" class="{active_inspector}">⚙️ Configs</a>
+      <a href="//localhost:9768" class="{active_terminal}" id="terminalLink" data-available="{terminal_available}">💻 Terminal</a>
     </nav>
     <button class="theme-toggle" id="themeToggle" title="Toggle theme">
       🌓

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdk-landscape/tdk-cli-core",
-  "version": "1.3.144",
+  "version": "1.3.146",
   "description": "TDK CLI — start services on your machine.",
   "homepage": "https://tdk-landscape.github.io/tdk-website",
   "repository": {