@tdk-landscape/tdk-cli-core 1.3.15 → 1.3.22

package/engine/topologies/tilt/resources/orchestrator/apply_compose_resource_registration.star

@@ -0,0 +1,431 @@
+# =============================================================================
+# 🧩 ORCHESTRATOR APPLY - COMPOSE RESOURCE REGISTRATION (Refactored)
+# =============================================================================
+
+# === INLINED CONSTANTS for pure extension loading ===
+OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
+# === END INLINED CONSTANTS ===
+
+
+load('../../../platform/docker/index.star', 'Docker')
+load('../../../platform/docker/constants.star', 'PlatformDockerConstants')
+load('../../../tilt/manifest/constants.star', 'BASE_PORT_FRONTEND')
+
+load('./builders/typescript.star', 'TypescriptBuilders')
+
+
+def _env_file_if_exists(env_file):
+    """.env is gitignored (no .env.example shipped) across every TDK example repo, so a
+    fresh clone must not hard-require it: docker_compose()'s env_file kwarg type-checks as
+    path|string (rejects None), so only return a path when the file actually exists."""
+    exists = str(local("test -f '" + env_file + "' && echo yes || echo no", quiet=True, echo_off=True)).strip() == 'yes'
+    return env_file if exists else None
+
+
+def _docker_compose_app(compose_paths, project_name, env_file):
+    resolved_env_file = _env_file_if_exists(env_file)
+    if resolved_env_file:
+        docker_compose(compose_paths, project_name=project_name, env_file=resolved_env_file)
+    else:
+        docker_compose(compose_paths, project_name=project_name)
+
+
+def _build_infra_dependencies(resource_name, should_enable, ctx, has_backend=False):
+    infra_deps = []
+    if should_enable('database-management'):
+        infra_deps.append('postgres')
+        if has_backend:
+            infra_deps.append('provision-db-' + resource_name)
+    if should_enable(PlatformDockerConstants.VERDACCIO_RESOURCE_NAME):
+        project_root = ctx.get('project_root', '')
+        verdaccio_compose = ((project_root.rstrip('/') + '/') if project_root else '') + 'docker-compose.verdaccio.yml'
+        if str(local("test -f '" + verdaccio_compose + "' && echo yes || echo no", quiet=True, echo_off=True)).strip() == 'yes':
+            infra_deps.append(PlatformDockerConstants.VERDACCIO_RESOURCE_NAME)
+    if should_enable('golden-image') and ctx.get('golden_image_resource'):
+        infra_deps.append(ctx['golden_image_resource'])
+    return infra_deps
+
+
+def _resolve_dependency_to_resource(dep_name, all_services_map):
+    """
+    Resolve a short dependency name (e.g., 'identity') to the full YAML resource name.
+    
+    The discovery registry creates YAML resources with names like:
+    - 'identity-management-backend-yaml' for identity backend
+    - 'api-gateway-yaml' for api-gateway
+    
+    But manifests reference them as short names like 'identity' or 'api-gateway'.
+    """
+    # Check if already a full YAML resource name
+    if dep_name in all_services_map:
+        return dep_name
+    
+    # Try with -yaml suffix (for resources already resolved)
+    yaml_name = dep_name + '-yaml'
+    if yaml_name in all_services_map:
+        return yaml_name
+    
+    # Try to find matching service by stack/short name
+    for resource_name, resource_info in all_services_map.items():
+        # Check if this service's stack matches the dependency
+        resource_domain = resource_info.get('stack', '')
+        if resource_domain == dep_name:
+            # Return the first resource of this service with -yaml suffix
+            resources = resource_info.get('resources', [])
+            if resources:
+                # Prefer backend resources over frontends
+                for res in resources:
+                    if not res.get('frontend', False):
+                        return res['name'] + '-yaml'
+                # Fallback to first resource
+                return resources[0]['name'] + '-yaml'
+    
+    # Try pattern matching: identity -> identity-*-yaml
+    for resource_name in all_services_map.keys():
+        if resource_name.startswith(dep_name + '-') and resource_name.endswith('-yaml'):
+            return resource_name
+    
+    # Return original with -yaml suffix as last resort
+    return dep_name + '-yaml'
+
+
+def _build_resource_deps(res, res_name, manifest, resource_config, infra_deps, config_gen_resources, resource_manifests, runtime_flags, all_services_map=None):
+    res_deps = list(infra_deps)
+    if res_name in config_gen_resources:
+        res_deps.append(config_gen_resources[res_name])
+    if res.get('frontend', False):
+        backend_name = manifest.get('backendName', res_name.replace('frontend', 'backend'))
+        if backend_name != res_name and backend_name in resource_manifests:
+            res_deps.append(backend_name)
+    elif runtime_flags['enforce_migrator_deps'] and resource_config.get('has_migrator', False):
+        migrator_name = resource_config['name'] + '-db-migrator'
+        if migrator_name not in res_deps:
+            res_deps.append(migrator_name)
+    
+    # NEW: Resolve dependsOn from manifest
+    internal_deps = manifest.get('dependsOn', [])
+    for dep in internal_deps:
+        resolved_dep = _resolve_dependency_to_resource(dep, all_services_map)
+        if resolved_dep and resolved_dep not in res_deps:
+            res_deps.append(resolved_dep)
+    
+    return res_deps
+
+
+def _register_replicas(config, auto_init_apps):
+    """Register additional replica resources for high-availability services."""
+    replicas = config.get('replicas', 1)
+    if replicas <= 1:
+        return
+    # Docker compose generates replicas starting from 1 (e.g., service-1, service-2)
+    # Primary is the base name (service), replicas are service-1, service-2, etc.
+    for i in range(1, replicas):
+        replica_name = config['res_name'] + '-' + str(i)
+        dc_resource(
+            replica_name,
+            labels=config['labels'],
+            resource_deps=config['res_deps'],
+            auto_init=auto_init_apps,
+        )
+
+
+def _build_live_update_rules(res_path, full_res_path, syncs):
+    """Build live update sync and run rules for a resource."""
+    live_update_rules = []
+    for sync_path in syncs:
+        full_sync_path = full_res_path + '/' + sync_path
+        dest = '/app/' + full_res_path + '/' + sync_path
+        live_update_rules.append(sync(full_sync_path, dest))
+    
+    package_json_path = '/app/' + full_res_path + '/package.json'
+    bun_lock_path = '/app/' + full_res_path + '/bun.lock'
+    live_update_rules.append(run('cd /app/' + full_res_path + ' && bun install', 
+                                 trigger=[package_json_path, bun_lock_path]))
+    return live_update_rules
+
+
+def _register_docker_build(config, live_update_rules):
+    """Register docker_build with live_update for hot-reload support."""
+    image_name = config['resource_name'] + '_' + config['res_name'] + ':dev'
+    project_root = config.get('project_root', '')
+    # Use custom dockerfile from config if specified, otherwise use autogenerated default
+    # The res_path is relative to project_root (e.g., 'services/product/...')
+    # The dockerfile config is relative to res_path (e.g., '.autogenerated/Dockerfile...')
+    rel_dockerfile = config.get('dockerfile', '')
+    if rel_dockerfile:
+        if rel_dockerfile.startswith('/'):
+            dockerfile = config['res_path'] + rel_dockerfile
+        else:
+            dockerfile = config['res_path'] + '/' + rel_dockerfile
+    else:
+        dockerfile = config['res_path'] + '/' + OUTPUT.AUTOGENERATED_FOLDER + '/Dockerfile.app.autogenerated'
+    # Prepend project_root to make absolute path from the Tilt working directory
+    if project_root:
+        if dockerfile.startswith('/'):
+            dockerfile = project_root + dockerfile
+        else:
+            dockerfile = project_root + '/' + dockerfile
+    TypescriptBuilders.build_typescript_service(
+        image_name,
+        project_root or '.',
+        dockerfile,
+        live_update_rules,
+        config['res_deps'],
+    )
+
+
+def _register_run_only_resource(config, resource_path, compose_project_name, auto_init_apps=True):
+    """Register a run-only local resource for docker compose up."""
+    project_root = config.get('project_root', '')
+    compose_dir = resource_path + '/' + OUTPUT.AUTOGENERATED_FOLDER
+    compose_file = compose_dir + '/docker-compose.app.autogenerated.yml'
+    port_override = compose_dir + '/docker-compose.port-override.yml'
+    env_file = '.env'
+    if project_root:
+        root = project_root.rstrip('/')
+        compose_file = root + '/' + compose_file
+        port_override = root + '/' + port_override
+        env_file = root + '/.env'
+    compose_files = '-f ' + compose_file
+    if str(local("test -f '" + port_override + "' && echo yes || echo no", quiet=True, echo_off=True)).strip() == 'yes':
+        compose_files = compose_files + ' -f ' + port_override
+    # .env is gitignored (no .env.example shipped) across every TDK example repo, so a
+    # fresh clone must not hard-require it: only pass --env-file when it actually exists.
+    env_file_flag = ''
+    if str(local("test -f '" + env_file + "' && echo yes || echo no", quiet=True, echo_off=True)).strip() == 'yes':
+        env_file_flag = ' --env-file ' + env_file
+    local_resource(
+        name=config['res_name'] + '-run-only',
+        cmd='docker compose -p '
+            + compose_project_name
+            + ' '
+            + compose_files
+            + env_file_flag
+            + ' up -d --no-build '
+            + config['res_name'],
+        labels=config['labels'] + ['run-only'],
+        resource_deps=config['res_deps'],
+        auto_init=auto_init_apps,
+        allow_parallel=True,
+    )
+
+
+def _register_single_resource(config, resource_path, compose_project_name, auto_init_apps):
+    """Register a single dc_resource with optional docker_build and run-only resource."""
+    app_type = config.get('app_type', 'backend')
+    res_name = config['res_name']
+    
+    print("DEBUG REGISTER: Registering '{}' app_type='{}' auto_init={}".format(res_name, app_type, auto_init_apps))
+    
+    # Skip docker_build for libraries and SDKs - they don't have Dockerfiles
+    if app_type not in ['library', 'sdk'] and config.get('syncs'):
+        print("DEBUG REGISTER: '{}' has syncs, calling docker_build".format(res_name))
+        live_update_rules = _build_live_update_rules(
+            config['res_path'],
+            config['res_path'],
+            config['syncs']
+        )
+        _register_docker_build(config, live_update_rules)
+    else:
+        print("DEBUG REGISTER: '{}' skipping docker_build (app_type='{}', syncs={})".format(res_name, app_type, config.get('syncs')))
+
+    print("DEBUG REGISTER: Calling dc_resource for '{}' with deps={}".format(res_name, config['res_deps']))
+    dc_resource(
+        config['res_name'],
+        labels=config['labels'],
+        resource_deps=config['res_deps'],
+        auto_init=auto_init_apps,
+    )
+    print("DEBUG REGISTER: dc_resource completed for '{}'".format(res_name))
+
+    _register_run_only_resource(config, resource_path, compose_project_name, auto_init_apps)
+    _register_replicas(config, auto_init_apps)
+
+
+def _register_dc_resources(resource_configs, resource_path, compose_project_name, auto_init_apps):
+    """Register all dc_resources for the service."""
+    for config in resource_configs:
+        _register_single_resource(config, resource_path, compose_project_name, auto_init_apps)
+
+
+def _has_backend_resource(resource_config, resource_manifests):
+    """Check if service has a backend resource."""
+    for resource in resource_config.get('resources', []):
+        manifest = resource_manifests.get(resource['name'], {})
+        if manifest.get('appType') == 'backend':
+            return True
+    return False
+
+
+def _should_skip_frontend(res, should_enable):
+    """Check if frontend resource should be skipped (backends-only mode)."""
+    return res.get('frontend', False) and should_enable('backends-only')
+
+
+def _process_frontend_resource(res, manifest, full_res_path, resource_path, resource_name, should_enable):
+    """Process a frontend resource and return compose entry."""
+    target_path = res.get('target_path', manifest.get('target_path', '/usr/share/nginx/html'))
+    use_nginx = 'nginx' in target_path or target_path == '/usr/share/nginx/html'
+    port = res.get('port', manifest.get('port', BASE_PORT_FRONTEND))
+    Docker.frontend(
+        res_path=full_res_path,
+        resource_name=res['name'],
+        port=port,
+        target_path=target_path,
+        use_nginx=use_nginx,
+        use_golden=should_enable('golden-image'),
+    )
+    return Docker.frontend_compose(resource_path=resource_path, resource_name=resource_name, res=res, manifest=manifest)
+
+
+def _process_backend_resource(res, manifest, full_res_path, resource_path, resource_name, should_enable):
+    """Process a backend resource and return compose entry."""
+    Docker.backend(
+        res_path=full_res_path,
+        resource_name=res['name'],
+        port=None,  # Use default BASE_PORT_BACKEND
+        build_cmd=res.get('start_command', 'bun run build'),
+        use_golden=should_enable('golden-image'),
+    )
+    return Docker.backend_compose(resource_path=resource_path, resource_name=resource_name, res=res, manifest=manifest)
+
+
+def _build_resource_config(res, manifest, resource_config, full_res_path, infra_deps,
+                          config_gen_resources, resource_manifests, runtime_flags, all_services_map=None, project_root=''):
+    """Build configuration dict for a single resource."""
+    res_name = res['name']
+    res_deps = _build_resource_deps(
+        res, res_name, manifest, resource_config, infra_deps,
+        config_gen_resources, resource_manifests, runtime_flags, all_services_map,
+    )
+    replicas = manifest.get('replicas', 1)
+    if runtime_flags['disable_app_replicas']:
+        replicas = 1
+
+    # Extract environment variables from manifest params
+    env_vars = manifest.get('params', {})
+
+    return {
+        'res_name': res_name,
+        'resource_name': resource_config['name'],
+        'res_deps': res_deps,
+        'labels': ['app.' + res_name],
+        'replicas': replicas,
+        'syncs': res.get('syncs', []),
+        'app_type': manifest.get('appType', 'backend'),
+        'dockerfile': res.get('dockerfile', OUTPUT.AUTOGENERATED_FOLDER + '/Dockerfile.app.autogenerated'),
+        'res_path': full_res_path,
+        'env': env_vars,
+        'project_root': project_root,
+    }
+
+
+def register_compose_resources(resource_config, ctx, runtime_flags, manifest_state):
+    """Register all compose resources for a service."""
+    resource_name = resource_config.get('name', '')
+    resource_path = resource_config.get('path', '')
+    
+    print("DEBUG COMPOSE: register_compose_resources called for '{}' path='{}'".format(resource_name, resource_path))
+    
+    if not resource_name:
+        print("⚠️  Skipping service without name")
+        return {'compose_project_name': ''}
+    
+    if not resource_path:
+        # Silently skip services without paths - these may be library references
+        # or incomplete manifests
+        print("DEBUG COMPOSE: SKIPPING '{}' - no path".format(resource_name))
+        return {'compose_project_name': ''}
+    
+    print("DEBUG COMPOSE: Proceeding with '{}' - creating compose resources".format(resource_name))
+    should_enable = ctx['should_enable']
+    write_file = ctx['write_file']
+    compose_project_name = resource_name + '-autogenerated'
+    
+    resource_manifests = manifest_state['resource_manifests']
+    config_gen_resources = manifest_state['config_gen_resources']
+    has_backend = _has_backend_resource(resource_config, resource_manifests)
+    infra_deps = _build_infra_dependencies(resource_name, should_enable, ctx, has_backend)
+    
+    # Build map of all services for dependency resolution
+    # This maps short names like 'identity' to full resource names
+    all_services_map = {}
+    all_services = ctx.get('all_services', [])
+    for svc in all_services:
+        svc_name = svc.get('name', '')
+        if svc_name:
+            all_services_map[svc_name] = svc
+        # Also map resource names
+        for res in svc.get('resources', []):
+            res_name = res.get('name', '')
+            if res_name:
+                all_services_map[res_name] = svc
+
+    resource_entries = []
+    resource_configs = []
+
+    for res in resource_config.get('resources', []):
+        if _should_skip_frontend(res, should_enable):
+            continue
+        
+        full_res_path = res.get('_resource_path', resource_path + '/' + res['name'])
+        manifest = resource_manifests.get(res['name'], {})
+        
+        # Skip library/sdk type resources - they don't have Docker builds
+        app_type = manifest.get('appType', 'backend')
+        if app_type in ['library', 'sdk']:
+            continue
+        
+        if res.get('frontend', False):
+            entry = _process_frontend_resource(res, manifest, full_res_path, resource_path, resource_name, should_enable)
+        else:
+            entry = _process_backend_resource(res, manifest, full_res_path, resource_path, resource_name, should_enable)
+        
+        resource_entries.append(entry)
+        resource_configs.append(_build_resource_config(
+            res, manifest, resource_config, full_res_path, infra_deps,
+            config_gen_resources, resource_manifests, runtime_flags, all_services_map,
+            ctx.get('project_root', ''),
+        ))
+
+    print("DEBUG COMPOSE: Calling Docker.app_compose for '{}' with write_fn={}".format(resource_name, write_file))
+    Docker.app_compose(resource_path, resource_entries, write_file)
+    
+    print("DEBUG COMPOSE: {} resource_entries count = {}".format(resource_name, len(resource_entries)))
+    
+    # Prepend project root to make path absolute from project root
+    project_root = ctx.get('project_root', '')
+    
+    # Only register docker_compose if we have actual services (not just libraries)
+    if resource_entries:
+        compose_file_rel = resource_path + '/' + OUTPUT.AUTOGENERATED_FOLDER + '/docker-compose.app.autogenerated.yml'
+        compose_file = project_root + '/' + compose_file_rel if project_root else compose_file_rel
+        # Load env file from project root for docker-compose variables (DB_PASSWORD, etc.)
+        env_file = project_root + '/.env' if project_root else '.env'
+        print("DEBUG COMPOSE: Calling docker_compose for '{}' with {} env_file={}".format(resource_name, compose_file, env_file))
+        _docker_compose_app(compose_file, compose_project_name, env_file)
+        port_override_rel = resource_path + '/' + OUTPUT.AUTOGENERATED_FOLDER + '/docker-compose.port-override.yml'
+        port_override = project_root + '/' + port_override_rel if project_root else port_override_rel
+        if str(local("test -f '" + port_override + "' && echo yes || echo no", quiet=True, echo_off=True)).strip() == 'yes':
+            print("DEBUG COMPOSE: Applying port override {}".format(port_override))
+            _docker_compose_app(port_override, compose_project_name, env_file)
+    else:
+        print("DEBUG COMPOSE: SKIPPING docker_compose for '{}' - no resource_entries".format(resource_name))
+
+    for compose_file in resource_config.get('compose_files', []):
+        if compose_file != '.autogenerated/docker-compose.app.autogenerated.yml':
+            compose_file_full = project_root + '/' + resource_path + '/' + compose_file if project_root else resource_path + '/' + compose_file
+            env_file = project_root + '/.env' if project_root else '.env'
+            _docker_compose_app(compose_file_full, compose_project_name, env_file)
+
+    print("DEBUG COMPOSE: Calling _register_dc_resources for '{}' with {} configs, auto_init={}".format(resource_name, len(resource_configs), runtime_flags['auto_init_apps']))
+    _register_dc_resources(resource_configs, resource_path, compose_project_name, runtime_flags['auto_init_apps'])
+
+    return {'compose_project_name': compose_project_name}
+
+
+ComposeResourceRegistration = struct(
+    register = register_compose_resources,
+)
+
+DEBUG = {}

package/engine/topologies/tilt/resources/orchestrator/apply_manifest_orchestration.star

@@ -0,0 +1,81 @@
+# =============================================================================
+# 📄 ORCHESTRATOR APPLY - MANIFEST ORCHESTRATION
+# =============================================================================
+
+# === INLINED CONSTANTS for pure extension loading ===
+BASE_PORT_FRONTEND = 3000
+BASE_PORT_BACKEND = 4000
+# === END INLINED CONSTANTS ===
+
+
+load('../../../../../discovery/loading.star', 'Manifest')
+load('./generators/manifest_resource.star', 'ManifestResource')
+
+
+
+def prepare_resource_manifests(resource_config, ctx):
+    resource_name = resource_config['name']
+    resource_manifests = {}
+    backend_manifest_cache = {}
+    config_gen_resources = {}
+    
+    all_resources = resource_config.get('resources', [])
+
+    # First pass: load all manifests.
+    for resource in resource_config.get('resources', []):
+        # Use the resource's _resource_path if available (for services from different scan roots)
+        # Otherwise fall back to constructing path from resource_config path + resource name
+        resource_path = resource.get('_resource_path', resource_config['path'] + '/' + resource['name'])
+
+        # Load the manifest from the resource path
+        manifest = Manifest.load_manifest(resource_path)
+        resource_manifests[resource['name']] = manifest
+
+        app_name = manifest.get('appName', resource['name'])
+        stack = manifest.get('stack', resource_name)
+        port = manifest.get('port', BASE_PORT_FRONTEND)
+        app_type = manifest.get('appType', 'backend')
+
+        print(
+            "   [Tilt] ✅ Loaded: " + app_name
+            + " | Stack: " + stack
+            + " | Port: " + str(port)
+            + " | Type: " + app_type
+        )
+
+        if manifest.get('appType') == 'backend':
+            backend_manifest_cache[manifest.get('appName')] = manifest
+
+    # Second pass: create config generation resources.
+    for resource in resource_config.get('resources', []):
+        manifest = resource_manifests.get(resource['name'], {})
+        backend_manifest = None
+
+        if resource.get('frontend', False) or manifest.get('appType') == 'frontend':
+            backend_name = manifest.get('backendName', resource['name'].replace('-frontend', '-backend'))
+            backend_manifest = backend_manifest_cache.get(backend_name)
+            if not backend_manifest:
+                backend_manifest = Manifest.load_related(manifest)
+
+        # Use the resource's actual service path for config generation
+        resource_path = resource.get('_resource_path', resource_config['path'] + '/' + resource['name'])
+        
+        config_gen_resource = ManifestResource.create_config_resource(
+            resource_name,
+            resource,
+            resource_path,  # Pass correct path instead of resource_config['path']
+            manifest,
+            backend_manifest,
+            ctx,
+        )
+        config_gen_resources[resource['name']] = config_gen_resource
+
+    return {
+        'resource_manifests': resource_manifests,
+        'config_gen_resources': config_gen_resources,
+    }
+
+
+ManifestOrchestration = struct(
+    prepare = prepare_resource_manifests,
+)

package/engine/topologies/tilt/resources/orchestrator/apply_migrator_orchestration.star

@@ -0,0 +1,148 @@
+# =============================================================================
+# 🗃️ ORCHESTRATOR APPLY - MIGRATOR ORCHESTRATION
+# =============================================================================
+# BLOCKER FIX #2: Sequential migration execution to prevent race conditions
+# =============================================================================
+
+# === INLINED CONSTANTS for pure extension loading ===
+OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
+# === END INLINED CONSTANTS ===
+
+
+load('../../../platform/docker/index.star', 'Docker')
+
+load('../../../platform/docker/generators/golden_docker_generator_v2.star', 'L4_generate_orchestrator')
+
+
+def _find_backend_resource_path(resource_config):
+    resource_path = resource_config.get('path', '')
+    if not resource_path:
+        return None
+    backend_resource_path = None
+
+    for res in resource_config.get('resources', []):
+        if res.get('frontend', False):
+            continue
+
+        candidate = resource_path + '/' + res['name']
+        prisma_check = local("test -d " + candidate + "/prisma && echo yes || echo no", quiet=True)
+        prisma_check_stdout = getattr(prisma_check, "stdout", prisma_check)
+        has_prisma = str(prisma_check_stdout).strip() == 'yes'
+
+        if has_prisma:
+            return candidate
+
+        if backend_resource_path == None:
+            backend_resource_path = candidate
+
+    return backend_resource_path
+
+
+def register_migrators(resource_config, ctx, runtime_flags, compose_project_name):
+    should_enable = ctx['should_enable']
+    write_file = ctx['write_file']
+    resource_name = resource_config.get('name', '')
+    resource_path = resource_config.get('path', '')
+
+    if not resource_name:
+        print("⚠️  Skipping migrator registration for service without name")
+        return
+
+    if not resource_path:
+        # Silently skip migrator registration for services without paths
+        return
+
+    if not resource_config.get('has_migrator', False):
+        return
+    if not should_enable('database-management'):
+        return
+
+    backend_resource_path = _find_backend_resource_path(resource_config)
+    dockerfile_res_path = backend_resource_path if backend_resource_path else resource_path
+
+    df_contents = L4_generate_orchestrator(
+        dockerfile_res_path,
+        res_type='migrator',
+        resource_name=resource_name,
+        use_nginx=False,
+        port=3000,
+        target_path='/app/dist',
+        build_cmd='echo "No build needed for migrator"',
+        cmd='bun run db:migrate',
+        use_infisical=True,
+        use_shared_libs=True,
+        use_prisma=True,
+        use_golden=should_enable('golden-image'),
+    )
+    write_file(dockerfile_res_path + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/Dockerfile.migrator.autogenerated", df_contents)
+
+    migrator_dockerignore_content = Docker.generate_dockerignore(dockerfile_res_path, 'migrator')
+    write_file(
+        dockerfile_res_path + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/Dockerfile.migrator.autogenerated.dockerignore",
+        migrator_dockerignore_content,
+    )
+
+    Docker.migrator_compose(
+        resource_path=resource_path,
+        resource_name=resource_name,
+        dockerfile_path=dockerfile_res_path + '/' + OUTPUT.AUTOGENERATED_FOLDER + '/Dockerfile.migrator.autogenerated',
+        write_fn=write_file,
+    )
+    docker_compose(
+        resource_path + '/' + OUTPUT.AUTOGENERATED_FOLDER + '/docker-compose.migrator.autogenerated.yml',
+        project_name=compose_project_name,
+    )
+
+    migrator_names = resource_config.get('migrator_names', [resource_name + '-db-migrator'])
+    for migrator_name in migrator_names:
+        # =============================================================================
+        # BLOCKER FIX #2: Sequential migration dependencies prevent race conditions
+        # =============================================================================
+        # Each migrator depends on postgres, its own provisioned DB, golden image,
+        # AND the previous migrator to ensure sequential execution
+        migrator_db_deps = ['postgres', 'provision-db-' + resource_name]
+        if should_enable('golden-image') and ctx.get('golden_image_resource'):
+            migrator_db_deps.append(ctx['golden_image_resource'])
+        
+        # Add sequential dependency on previous migrator to prevent parallel execution
+        # Use ctx to track sequence (mutable dict passed from caller)
+        migrator_index = ctx.setdefault('migrator_sequence', {})
+        previous_migrator = _get_previous_migrator(resource_name, migrator_index)
+        if previous_migrator:
+            migrator_db_deps.append(previous_migrator)
+            print("🔗 Sequential migration: " + migrator_name + " will run after " + previous_migrator)
+
+        dc_resource(
+            migrator_name,
+            labels=['app.' + resource_name, 'migrator'],
+            resource_deps=migrator_db_deps,
+            auto_init=runtime_flags['auto_init_migrators'],
+        )
+
+
+# =============================================================================
+# BLOCKER FIX #2: Migration sequencing tracker
+# =============================================================================
+# Pass migrator sequence via ctx to avoid frozen module-level state
+# The caller initializes ctx['migrator_sequence'] = {} before calling register_migrators
+
+def _get_previous_migrator(current_service, migrator_index):
+    """
+    Get the previous migrator in sequence for dependency chaining.
+    Returns the migrator name that should complete before this one starts.
+    """
+    if current_service not in migrator_index:
+        migrator_index[current_service] = len(migrator_index)
+    
+    idx = migrator_index[current_service]
+    if idx > 0:
+        # Find the service with index idx - 1
+        for svc, svc_idx in migrator_index.items():
+            if svc_idx == idx - 1:
+                return svc + '-db-migrator'
+    return None
+
+
+MigratorOrchestration = struct(
+    register = register_migrators,
+)