@tdk-landscape/tdk-cli-core 1.3.155 → 1.3.157

package/cli/dist-bundle/{cold-preflight-3RDK76RY.js → cold-preflight-OQUN7OFG.js}

@@ -1,2 +1,2 @@
 import{createRequire as __tdkRequire}from'node:module';const require=__tdkRequire(import.meta.url);
-import{ub as a,vb as b,wb as c,xb as d,yb as e}from"./chunk-XTSHWDDE.js";import"./chunk-42IVF3YT.js";import"./chunk-6EA4DGCY.js";export{e as assertMachineReadyOrExit,d as formatColdPreflight,a as nodeTooOld,b as requireVerifiedDockerVersions,c as runColdPreflight};
+import{Ib as a,Jb as b,Kb as c,Lb as d,Mb as e}from"./chunk-O2SVXNG5.js";import"./chunk-42IVF3YT.js";import"./chunk-6EA4DGCY.js";export{e as assertMachineReadyOrExit,d as formatColdPreflight,a as nodeTooOld,b as requireVerifiedDockerVersions,c as runColdPreflight};

package/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tdk-cli-internal",
   "private": true,
-  "version": "1.3.155",
+  "version": "1.3.157",
   "description": "TDK CLI — start services on your machine.",
   "keywords": [
     "tdk",

package/discovery/manifest/loading.star

@@ -218,7 +218,13 @@ def _apply_manifest_defaults(manifest, resource_path):
     for key, default_value in MANIFEST_DEFAULTS.items():
         if key not in result or result[key] == None:
             result[key] = default_value
-    
+
+    # A bring-your-own service may not speak HTTP, so only an explicit healthCheckPath gives it one. compose.star and
+    # l4_runtime_layers.star read a missing path as "no HTTP probe"; the default above would otherwise hide that.
+    # (ManifestParser.normalize applies the same rule, but `tdk up` does not load manifests through it.)
+    if result.get('appType') == 'bring-your-own' and not manifest.get('healthCheckPath'):
+        result.pop('healthCheckPath', None)
+
     # 🎯 CEO REVIEW: Traefik-native port strategy
     # Port is constant per appType, not dynamically assigned
     # Traefik routes by hostname (e.g., booking.backend.{project}.local), not port

package/engine/topologies/platform/docker/build/golden_image_dockerfile.star

@@ -165,9 +165,10 @@ ENV BUN_OPTIONS=--smol
 
 USER bun
 
-# Backend-specific healthcheck (checks Bun runtime)
+# Backend-specific healthcheck: probes the service over HTTP. The image is shared by every backend,
+# so the port and path come from the container env (PORT is set by compose, TDK_HEALTH_PATH is optional).
 HEALTHCHECK {hc_flags} \
-  CMD bun --version || exit 1
+  CMD bun -e "fetch('http://127.0.0.1:'+process.env.PORT+(process.env.TDK_HEALTH_PATH||'/health')).then(r=>process.exit(r.ok?0:1),()=>process.exit(1))" || exit 1
 
 WORKDIR /app
 
@@ -194,9 +195,9 @@ RUN addgroup -S app && adduser -S app -G app
 
 USER app
 
-# Backend-specific healthcheck (checks Node.js runtime)
+# Backend-specific healthcheck: probes the service over HTTP (port and path from container env, see the Bun stage)
 HEALTHCHECK {hc_flags} \
-  CMD node --version || exit 1
+  CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+(process.env.TDK_HEALTH_PATH||'/health')).then(r=>process.exit(r.ok?0:1),()=>process.exit(1))" || exit 1
 
 WORKDIR /app
 

package/engine/topologies/platform/docker/compose/compose.star

@@ -14,6 +14,7 @@ BASE_PORT_BACKEND = 4000
 # emits a fixed `EXPOSE 80` and the generated nginx.conf has a fixed `listen 80`.
 NGINX_CONTAINER_PORT = 80
 HEALTH_CHECK_PATH = "/health"
+NO_HTTP_HEALTHCHECK = "    healthcheck:\n      disable: true\n"
 OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
 # === END INLINED CONSTANTS ===
 
@@ -266,11 +267,14 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
         restart_policy = manifest.get('restart')
     restart_policy = '"no"' if restart_policy == 'no' else restart_policy
 
+    # No HTTP server means no HTTP probe. Disable explicitly: the image HEALTHCHECK would otherwise probe a port nothing listens on.
+    no_http_healthcheck_section = NO_HTTP_HEALTHCHECK if (is_worker or health_path == None) else ""
+    # Backends with a health path get it in the env, so the shared golden image's HEALTHCHECK can probe it.
+    health_env = "      - TDK_HEALTH_PATH={}\n".format(health_path) if health_path else ""
+
     if is_worker or is_proxy_disabled_byo:
         traefik_labels = '      - "traefik.enable=false"'
-        healthcheck_section = "" if is_worker or is_byo else """    healthcheck:
-      test: ["CMD", "curl", "-f", "--max-time", "5", "http://localhost:{internal_port}{health_path}"]
-""".format(internal_port=internal_port, health_path=health_path) + compose_healthcheck_timing()
+        healthcheck_section = no_http_healthcheck_section
     else:
         # Traefik's load-balancer check can be overridden separately in service.json
         # (`traefik.healthCheck`); it defaults to the container check's path.
@@ -287,7 +291,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
         # BYO images may not contain curl. Traefik uses its own HTTP health
         # check labels above, so don't mark an otherwise healthy container
         # unhealthy because the image lacks a command TDK cannot require.
-        healthcheck_section = "" if is_byo else """    healthcheck:
+        healthcheck_section = no_http_healthcheck_section if no_http_healthcheck_section else "" if is_byo else """    healthcheck:
       test: ["CMD", "curl", "-f", "--max-time", "5", "http://localhost:{internal_port}{health_path}"]
 """.format(internal_port=internal_port, health_path=health_path) + compose_healthcheck_timing()
     infisical_env = get_infisical_environment_vars(as_array=True, resource_name=res_name)
@@ -307,7 +311,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
 {infisical_env}
       - RESOURCE_NAME={stack}
       - PORT={port_anchor}
-      - INSTANCE_ID={instance_label}
+{health_env}      - INSTANCE_ID={instance_label}
       - NATS_QUEUE_GROUP={nats_queue}
       - TILT_DATABASE_URL={db_url_for_tilt}
       - TILT_NATS_URL={nats_url}
@@ -363,6 +367,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
         nats_url=nats_url,
         traefik_labels=traefik_labels,
         healthcheck_section=healthcheck_section,
+        health_env=health_env,
         infisical_env=infisical_env,
         auth_env=auth_env,
         secrets_env=secrets_env,

package/engine/topologies/platform/docker/generators/golden_docker_generator_v2.star

@@ -4,7 +4,7 @@ OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
 
 
 BUN_BASE = "oven/bun:1.3.11-alpine"
-ALPINE_BASE = "alpine:3.18"
+ALPINE_BASE = "alpine:3.22"
 
 
 load('../../../tilt/common/utils.star', 'Utils')

package/engine/topologies/platform/docker/layers/l1_base_layers.star

@@ -9,7 +9,7 @@ Provides the foundational layers for all Dockerfiles:
 """
 
 BUN_BASE = "oven/bun:1.3.11-alpine"
-ALPINE_BASE = "alpine:3.18"
+ALPINE_BASE = "alpine:3.22"
 load('../../../../../discovery/config.star', 'GLOBAL_CONFIG')
 
 # Load project name for dynamic golden image naming

package/engine/topologies/platform/docker/layers/l3_builder_layers.star

@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: MIT
 # === INLINED CONSTANTS for pure extension loading ===
 WEB_FRAMEWORK = "hono"
-RUNTIME_CONFIG = {"bun": {"image_base": "oven/bun:1.3.11-alpine", "package_manager": "bun", "lockfile": "bun.lock", "backend_start_command": "bun run start", "frontend_start_command": "bun run dev"}, "node": {"image_base": "node:20-alpine", "package_manager": "npm", "lockfile": "package-lock.json", "backend_start_command": "node dist/index.js"}}
+RUNTIME_CONFIG = {"bun": {"image_base": "oven/bun:1.3.11-alpine", "package_manager": "bun", "lockfile": "bun.lock", "backend_start_command": "bun run start", "frontend_start_command": "bun run dev"}, "node": {"image_base": "node:22-alpine", "package_manager": "npm", "lockfile": "package-lock.json", "backend_start_command": "node dist/index.js"}}
 OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
 # === END INLINED CONSTANTS ===
 

package/engine/topologies/platform/docker/layers/l4_runtime_layers.star

@@ -107,6 +107,19 @@ def _cmd_instruction(command):
     return "CMD [" + ", ".join(["\"" + part + "\"" for part in command.split()]) + "]\n"
 
 
+def _backend_healthcheck_instruction(port, manifest = None):
+    # Probe the service over HTTP, not the runtime binary: `bun --version` passes even when the server has crashed.
+    # Workers and bring-your-own services without healthCheckPath serve no HTTP, so they get no probe (HEALTHCHECK NONE).
+    if manifest and (manifest.get('appType') == 'worker' or (manifest.get('appType') == 'bring-your-own' and not manifest.get('healthCheckPath'))):
+        return "HEALTHCHECK NONE\n"
+    health_path = manifest.get('healthCheckPath', '/health') if manifest else '/health'
+    # The Dockerfile generator passes the manifest but not the port, so the service's own port wins over the 4000 default.
+    probe_port = manifest.get('port', port) if manifest else port
+    # fetch() is built into bun, so no extra package is needed in the image. Path is schema-limited to [a-z0-9/-].
+    probe = "fetch('http://127.0.0.1:" + str(probe_port) + health_path + "').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"
+    return "HEALTHCHECK " + dockerfile_healthcheck_flags() + " CMD bun -e \"" + probe + "\" || exit 1\n"
+
+
 def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun run start', use_infisical = False, resource_name = 'service', use_golden = True, use_prisma = True, has_prisma_config = False, manifest = None):
     """
     Generate the backend runtime layer for deployed services.
@@ -174,7 +187,7 @@ def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun r
     
     # Only add healthcheck if not using golden image (already in golden L4)
     if not use_golden:
-        parts.append("HEALTHCHECK " + dockerfile_healthcheck_flags() + " CMD bun --version || exit 1\n")
+        parts.append(_backend_healthcheck_instruction(port, manifest))
     
     if use_infisical:
         # Use InfisicalDocker generator for proper secret injection setup

package/engine/topologies/tilt/manifest/constants.star

@@ -202,7 +202,7 @@ RUNTIME_CONFIGS = {
         'lockfile': 'bun.lock',
     },
     'node': {
-        'image_base': 'node:20-alpine',
+        'image_base': 'node:22-alpine',
         'package_manager': 'npm',
         'lockfile': 'package-lock.json',
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdk-landscape/tdk-cli-core",
-  "version": "1.3.155",
+  "version": "1.3.157",
   "description": "TDK CLI — start services on your machine.",
   "homepage": "https://tdk-landscape.github.io/tdk-website",
   "repository": {