@tdk-landscape/tdk-cli-core 1.3.32 → 1.3.36

package/engine/topologies/platform/security/AGENTS.md

@@ -0,0 +1,49 @@
+# AGENTS.md - Security & Secrets
+
+## Purpose
+
+Secrets management, Infisical integration, and security configuration.
+
+## Key Files
+
+### Secrets Management
+- **`infisical.star`** - Infisical secrets provider integration
+- **`secrets.star`** - Generic secrets handling
+- **`encryption.star`** - Encryption utilities
+
+### Configuration
+- **`tokens.star`** - Token generation and validation
+- **`keys.star`** - Key management
+
+## Common Tasks
+
+### Load secrets from Infisical
+```starlark
+load("./infisical.star", "Infisical")
+secrets = Infisical.load_secrets(resource_name, environment)
+```
+
+### Get database credentials
+```starlark
+load("./infisical.star", "Infisical")
+db_url = Infisical.get_database_url(resource_name)
+```
+
+## Integration
+
+- Called by `resources/` when setting up service environment
+- Used in Docker Compose for injecting secrets
+- Part of service startup chain
+
+## Local Development
+
+Without Infisical, falls back to:
+- Environment variables
+- Default values in `spec.master`
+
+## Security Notes
+
+- Never commit real secrets
+- Use Infisical for production
+- Local development uses safe defaults
+- Secrets injected at runtime, not in images

package/engine/topologies/platform/state/AGENTS.md

@@ -0,0 +1,64 @@
+# AGENTS.md - Database & State Management
+
+## Purpose
+
+PostgreSQL database virtualization, per-service database provisioning, and state management.
+
+## Key Files
+
+### Database Provisioning
+- **`relational.star`** - Main database provisioning logic
+- **`compose.star`** - Docker Compose entries for databases
+
+### Prisma Integration
+- **`prisma/migrate_script.star`** - Migration script generation
+- **`prisma/db_readiness.star`** - Database readiness checks
+- **`prisma/prisma_build.star`** - Prisma in Docker builds
+- **`prisma/prisma_runtime.star`** - Prisma client in runtime
+
+### Utilities
+- **`utils.star`** - Database utilities
+- **`constants.star`** - Database constants (ports, users)
+
+## Common Tasks
+
+### Provision database for service
+```starlark
+load("./relational.star", "provision_database")
+compose_entry = provision_database("order-management-backend", "{project}_order")
+```
+
+### Get database URL
+```starlark
+load("./relational.star", "get_database_url")
+url = get_database_url("order-management-backend")
+# Returns: postgresql://postgres:postgres@order-management-backend-db:5432/{project}_order
+```
+
+### Wait for database
+```starlark
+load("./prisma/db_readiness.star", "wait_for_db")
+script = wait_for_db(db_url, timeout=30)
+```
+
+## Architecture
+
+Each service with `databaseName` in manifest gets:
+1. PostgreSQL container in Docker Compose
+2. Volume for persistence
+3. Readiness check before migrations
+4. Dedicated port mapping (avoids conflicts)
+
+## Integration
+
+- Called by `resources/deps.star` - when setting up service dependencies
+- Used by `platform/docker/` - for Docker Compose generation
+- Part of service resource dependencies chain
+
+## Database Naming
+
+```
+{project}_{domain}  // e.g., {project}_order, {project}_user
+```
+
+Each domain gets one database shared by its services (backend, migrator, etc).

package/engine/topologies/tilt/config/profiles.star

@@ -321,13 +321,27 @@ def apply_focus_filter(cfg):
     # Logic toggles (e.g. "golden-image", "database-management") are excluded since they're config flags, not resources.
     # Infrastructure resources (postgres, nats, traefik, etc.) are loaded via Infra.load_all()
     # and excluded here since they may not be available in all projects.
-    # Only include resources that exist as discovered services (in resource aliases).
+    # Only include resources that exist as discovered services.
+    #
+    # NOTE: resource_aliases (from get_resource_aliases_ref()) only maps top-level
+    # STACK/domain names (e.g. "app", "billing") to a path - it does not contain an
+    # entry per concrete resource (e.g. "dashboard-api", "checkout-app"). _get_resources_for_domain()
+    # already expanded stack names into concrete resource names above (all_needed), so those
+    # concrete names must be recognized here too, or they get silently dropped and their
+    # services never start. Build that set directly from the discovered service resources.
     resource_aliases = get_resource_aliases_ref()
+    known_service_resource_names = {}
+    for _svc in get_app_resources_ref():
+        for _res in _svc.get("resources", []):
+            _res_name = _res.get("name", "")
+            if _res_name:
+                known_service_resource_names[_res_name] = True
+                known_service_resource_names[_res_name + "-yaml"] = True
     resource_only_needed = []
     for r in all_needed:
         if r in logic_toggles:
             continue
-        if r not in resource_aliases:
+        if r not in resource_aliases and r not in known_service_resource_names:
             continue
         resource_only_needed.append(r)
 

package/engine/topologies/tilt/generators/typescript/frontend_tsconfig.star

@@ -38,12 +38,17 @@ def generate_frontend_tsconfig(resource_path, write_fn, internal_deps=None, is_d
             is_docker,
             internal_deps != None
         ))
-    # When tsconfig is in .autogenerated/ folder, paths are relative to parent
+    # Local dev tsconfig lives in .autogenerated/, so "src" etc. are one level up (../src).
+    # The Docker-variant tsconfig is written to the same .autogenerated/ path on disk, but the
+    # Dockerfile COPYs it to the image's app root as ./tsconfig.json (sibling of ./src, not
+    # nested under .autogenerated/) - so its own paths must be relative to that root instead,
+    # or tsc reports "No inputs were found" because it looks one directory too high.
+    src_prefix = "./" if is_docker else "../"
     paths = {
-        "@/*": ["../src/*"],
+        "@/*": [src_prefix + "src/*"],
         "@/autogenerated/*": ["./.autogenerated/*"]
     }
-    include_paths = ["../src/**/*"]
+    include_paths = [src_prefix + "src/**/*"]
     
     # =============================================================================
     # CRITICAL FIX: Only add path aliases for internal deps in LOCAL builds
@@ -81,16 +86,23 @@ def generate_frontend_tsconfig(resource_path, write_fn, internal_deps=None, is_d
             "paths": paths,
             "skipLibCheck": True,
             "strict": True,
-            "types": ["node"],
+            "esModuleInterop": True,
+            "allowSyntheticDefaultImports": True,
+            # "bun" (not "node"): matches backend_tsconfig.star - @types/bun is a direct
+            # devDependency so it's always linked at the top level under any linker mode
+            # (including Docker's isolated linker), while @types/node (when only pulled in
+            # transitively, e.g. via bun-types) isn't hoisted under the isolated linker and
+            # "types": ["node"] fails to resolve there even though it works locally.
+            "types": ["bun"],
         },
         "exclude": [
             "node_modules",
             "dist",
-            "../__tests__/**/*",
-            "../**/*.test.ts",
-            "../**/tests/**/*",
-            "../**/*.steps.ts",
-            "../**/*.spec.ts"
+            src_prefix + "__tests__/**/*",
+            src_prefix + "**/*.test.ts",
+            src_prefix + "**/tests/**/*",
+            src_prefix + "**/*.steps.ts",
+            src_prefix + "**/*.spec.ts"
         ],
         "include": include_paths
     }

package/engine/topologies/tilt/generators/vite/backend.star

@@ -45,7 +45,7 @@ def generate_backend(manifest, write_fn=None):
     
     # 🔥 SMART DETECTION: Check if service uses vite-plugin-node for HMR
     use_vite_node = manifest.get('useViteNode', False)
-    features = manifest.get('features', [])
+    features = manifest.get('featuresEnabled', [])
     if 'vite-node' in features or 'vite-plugin-node' in features or 'hmr' in features:
         use_vite_node = True
     

package/engine/topologies/tilt/generators/vite/frontend.star

@@ -16,6 +16,7 @@ load('../../../../topologies/tilt/manifest/constants.star', 'GENERATED_CONFIG_FI
 
 
 load('./templates.star', 'TEMPLATE_VITE_FRONTEND', 'TEMPLATE_VITE_FRONTEND_BUILD')
+load('../../../platform/docker/networking/api_path_constants.star', 'get_frontend_base_path')
 load('./helpers.star', 
     'build_header', 
     'generate_frontend_internal_aliases', 
@@ -56,7 +57,7 @@ def generate_frontend(manifest, backend_manifest=None, write_fn=None):
     stack = manifest.get('stack', 'app')
     port = manifest.get('port', BASE_PORT_FRONTEND)
     hmr_port = port + 1000  # HMR port is always port + 1000
-    base_path = manifest.get('basePath', '/' + stack + 's')
+    base_path = get_frontend_base_path(manifest)
     vite_base_path = _normalize_vite_base_path(base_path)
     app_name = manifest.get('appName', 'unknown')
 

package/engine/topologies/tilt/generators/vite/helpers.star

@@ -164,7 +164,7 @@ def generate_backend_path_aliases(resource_path, manifest):
     # hand-edited features: ["ddd"] with no key at all is still blocked, but real
     # entitlement is checked client-side by hasDddLicense() in extension-fetch.ts
     # before the CLI ever writes "ddd" into a resource's features array.
-    ddd_enabled = 'ddd' in manifest.get('features', []) and os.environ.get('TDK_LICENSE_KEY', '') != ''
+    ddd_enabled = 'ddd' in manifest.get('featuresEnabled', []) and os.environ.get('TDK_LICENSE_KEY', '') != ''
 
     if ddd_enabled:
         ddd_aliases = [

package/engine/topologies/tilt/manifest/constants.star

@@ -155,7 +155,7 @@ MANIFEST_DEFAULTS = {
     'healthCheckPath': HEALTH_CHECK_PATH,
     'internalPort': BASE_PORT_FRONTEND,
     'replicas': 1,
-    'features': [],
+    'featuresEnabled': [],
     'envVars': {},
     'syncs': None,
     'dependsOn': [],

package/engine/topologies/tilt/manifest/mapper.star

@@ -31,7 +31,7 @@ FIELD_MAPPINGS = {
     'replicas': ['replicas', 'instances', 'count', 'spec.replicas', 'metadata.replicas'],
     
     # Feature flags
-    'features': ['features', 'capabilities', 'spec.features', 'enabledFeatures', 'app.features'],
+    'featuresEnabled': ['featuresEnabled', 'capabilities', 'spec.features', 'enabledFeatures', 'app.features'],
     
     # Dependencies
     'dependsOn': [
@@ -199,7 +199,7 @@ def _to_yaml_format(internal_manifest):
             'port': internal_manifest.get('port', 4000),
             'runtime': internal_manifest.get('runtime', 'bun'),
             'replicas': internal_manifest.get('replicas', 1),
-            'features': internal_manifest.get('features', []),
+            'featuresEnabled': internal_manifest.get('featuresEnabled', []),
             'envVars': internal_manifest.get('envVars', {}),
             'dependencies': {
                 'internal': internal_manifest.get('dependsOn', []),

package/engine/topologies/tilt/manifest/parser.star

@@ -90,7 +90,7 @@ def normalize(manifest, resource_path=""):
     # Copy all existing fields
     for key, value in manifest.items():
         normalized[key] = value
-    
+
     # 1. Apply defaults for missing fields
     for field, default_value in MANIFEST_DEFAULTS.items():
         if field not in normalized or normalized[field] == None:
@@ -111,7 +111,7 @@ def normalize(manifest, resource_path=""):
     if normalized.get('syncs') == None or normalized.get('syncs') == []:
         normalized['syncs'] = _compute_syncs(
             normalized['appType'],
-            normalized.get('features', [])
+            normalized.get('featuresEnabled', [])
         )
     
     # Compute backendName for frontends if missing

package/engine/topologies/tilt/manifest/schema.star

@@ -117,7 +117,7 @@ MANIFEST_SCHEMA = {
         'description': 'Runtime environment',
         'default': RUNTIME,
     },
-    'features': {
+    'featuresEnabled': {
         'type': 'list',
         'required': False,
         'constraints': {
@@ -263,7 +263,7 @@ CROSS_FIELD_CONSTRAINTS = {
         'message': 'Frontend resources must specify backendName and basePath',
     },
     'prisma_requires_database': {
-        'condition': {'field': 'features', 'contains': 'prisma'},
+        'condition': {'field': 'featuresEnabled', 'contains': 'prisma'},
         'requires': ['databaseName'],
         'severity': 'warning',
         'message': 'Resources using Prisma should specify databaseName',

package/engine/topologies/tilt/manifest/tests/test_loader_parser.star

@@ -281,7 +281,7 @@ def _test_manifest_merging():
         'appName': 'test-service',
         'appType': 'backend',
         'port': 4000,
-        'features': ['nats'],
+        'featuresEnabled': ['nats'],
         'envVars': {
             'SHARED_VAR': 'base_value',
         },
@@ -289,7 +289,7 @@ def _test_manifest_merging():
     
     overlay = {
         'port': 4001,  # Override
-        'features': ['prisma'],  # Override
+        'featuresEnabled': ['prisma'],  # Override
         'envVars': {
             'SHARED_VAR': 'overlay_value',  # Override
             'NEW_VAR': 'new_value',  # Add
@@ -300,7 +300,7 @@ def _test_manifest_merging():
     
     assert_equal('test-service', merged['appName'], "Should preserve base appName")
     assert_equal(4001, merged['port'], "Should overlay port")
-    assert_equal(['prisma'], merged['features'], "Should overlay features")
+    assert_equal(['prisma'], merged['featuresEnabled'], "Should overlay features")
     assert_equal('overlay_value', merged['envVars']['SHARED_VAR'], "Should overlay nested env var")
     assert_equal('new_value', merged['envVars']['NEW_VAR'], "Should add new env var")
     

package/engine/topologies/tilt/manifest/tests/test_validator.star

@@ -213,7 +213,7 @@ def _test_cross_field_validation():
         'appType': 'backend',
         'stack': 'user',
         'port': 4001,
-        'features': ['prisma'],
+        'featuresEnabled': ['prisma'],
         # Missing databaseName
     }
     
@@ -312,7 +312,7 @@ def _test_full_validation():
         'port': 4000,
         'replicas': 1,
         'runtime': 'bun',
-        'features': ['nats', 'prisma'],
+        'featuresEnabled': ['nats', 'prisma'],
         'databaseName': 'TDK_user',
         'dependsOn': [],
         'traefik': {

package/engine/topologies/tilt/manifest/validator.star

@@ -316,16 +316,16 @@ def _validate_values(manifest, context):
             stats['rules_passed'] += 1
     
     # Validate features length
-    if 'features' in manifest:
+    if 'featuresEnabled' in manifest:
         stats['fields_checked'] += 1
-        features = manifest['features']
-        
+        features = manifest.get('featuresEnabled', [])
+
         if len(features) > VALIDATION_THRESHOLDS['max_features']:
             warnings.append(ManifestErrors.new(
                 message="Too many features ({}), consider splitting resource".format(len(features)),
                 category=ManifestErrors.CATEGORY['VALIDATION'],
                 severity=ManifestErrors.SEVERITY['WARNING'],
-                context={'field': 'features', 'count': len(features), 'max': VALIDATION_THRESHOLDS['max_features']},
+                context={'field': 'featuresEnabled', 'count': len(features), 'max': VALIDATION_THRESHOLDS['max_features']},
             ))
         else:
             stats['rules_passed'] += 1
@@ -374,16 +374,16 @@ def _validate_cross_field(manifest, context):
             stats['rules_passed'] += 1
     
     # Prisma requires databaseName
-    features = manifest.get('features', [])
+    features = manifest.get('featuresEnabled', [])
     if 'prisma' in features:
         stats['fields_checked'] += 1
-        
+
         if not manifest.get('databaseName'):
             warnings.append(ManifestErrors.new(
                 message="Resource with 'prisma' feature should specify databaseName",
                 category=ManifestErrors.CATEGORY['VALIDATION'],
                 severity=ManifestErrors.SEVERITY['WARNING'],
-                context={'field': 'databaseName', 'features': features},
+                context={'field': 'databaseName', 'featuresEnabled': features},
             ))
         else:
             stats['rules_passed'] += 1

package/engine/topologies/tilt/resources/orchestrator/generators/env.star

@@ -14,6 +14,7 @@ OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
 
 load("../../../../platform/docker/auth/auth.star", "AuthConfig")
 load("../../../../platform/docker/networking/traefik_helpers.star", "get_api_path")
+load("../../../../platform/docker/networking/api_path_constants.star", "get_frontend_base_path")
 load("../../../../platform/docker/constants.star", "PlatformDockerConstants")
 
 
@@ -133,8 +134,8 @@ def _generate_params_env(manifest, backend_manifest=None, write_fn=None):
         backend_name = manifest.get('backendName', stack + '-backend')
         target_filename = '/' + OUTPUT.AUTOGENERATED_FOLDER + '/.env.frontend.autogenerated'
         
-        # Get basePath from manifest or default to /{stack}
-        base_path = manifest.get('basePath', '/' + stack)
+        # Shared with the Traefik route and the Vite `base` -- see get_frontend_base_path.
+        base_path = get_frontend_base_path(manifest)
         public_url = 'http://' + PlatformDockerConstants.LOCAL_DOMAIN + base_path
         
         content = """# Generated by Tilt SDK - DO NOT EDIT

package/engine/topologies/tilt/resources/orchestrator/generators/manifest_resource.star

@@ -360,7 +360,8 @@ def _generate_all_configs_for_resource(
         dockerfile_content = Docker.backend(
             res_path=resource_path,
             resource_name=resource_name,
-            use_golden=should_enable('golden-image')
+            use_golden=should_enable('golden-image'),
+            use_prisma='prisma' in manifest.get('featuresEnabled', [])
         )
     
     write_file(resource_path + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/" + GENERATED_CONFIG_FILENAMES['dockerfile_app'], dockerfile_content)
@@ -404,7 +405,7 @@ def _generate_all_configs_for_resource(
         TSConfig.frontend(resource_path, write_file, internal_deps=internal_deps_map, is_docker=False)
     else:
         prisma_path = resource_config.get('prisma_client_path', './node_modules/.prisma/client')
-        resource_features = manifest.get('features', [])
+        resource_features = manifest.get('featuresEnabled', [])
         TSConfig.backend(resource_path, prisma_path, write_file, internal_deps=internal_deps_map, is_docker=True, features=resource_features)
         TSConfig.backend(resource_path, prisma_path, write_file, internal_deps=internal_deps_map, is_docker=False, features=resource_features)
         

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdk-landscape/tdk-cli-core",
-  "version": "1.3.32",
+  "version": "1.3.36",
   "description": "TDK CLI - Tilt Development Kit command line interface",
   "keywords": [
     "tdk",

package/templates/Tiltfile.hbs

@@ -229,7 +229,12 @@ for app_service in _app_resources_list:
 Watchers.setup_package_json(_app_resources_list, should_enable)
 
 # Apply focus mode filter
-# Build known Tilt resource names from discovered services to filter focus list
+# Build known Tilt resource names (and a stack-name -> resource-name index) from
+# discovered services to filter focus list. Focus targets are stack names (e.g.
+# "app", "billing") from spec.master, which do NOT always match the resource
+# name prefix (stack "app" maps to resources "dashboard-api"/"dashboard-app",
+# not "app-*") - so stack membership must be resolved explicitly rather than
+# assumed via string prefix.
 _KNOWN_TILT_RESOURCES = set()
 _KNOWN_TILT_RESOURCES.add('service-discovery-daemon')
 _KNOWN_TILT_RESOURCES.add('init-networks')
@@ -241,8 +246,10 @@ _KNOWN_TILT_RESOURCES.add('infisical-redis')
 _KNOWN_TILT_RESOURCES.add('traefik')
 _KNOWN_TILT_RESOURCES.add('verdaccio')
 _KNOWN_TILT_RESOURCES.add('golden-layers-build')
+_STACK_TO_RESOURCE_NAMES = {}
 for _KNOWN_SVC in _app_resources_list:
     _KNOWN_SVC_NAME = _KNOWN_SVC.get('name', '')
+    _KNOWN_SVC_STACK = _KNOWN_SVC.get('stack', '')
     if _KNOWN_SVC_NAME:
         for _KNOWN_RES in _KNOWN_SVC.get('resources', []):
             _KNOWN_RES_NAME = _KNOWN_RES.get('name', '')
@@ -250,11 +257,19 @@ for _KNOWN_SVC in _app_resources_list:
                 _KNOWN_TILT_RESOURCES.add(_KNOWN_RES_NAME)
                 _KNOWN_TILT_RESOURCES.add(_KNOWN_RES_NAME + '-run-only')
                 _KNOWN_TILT_RESOURCES.add(_KNOWN_RES_NAME + '-config-gen')
+                if _KNOWN_SVC_STACK:
+                    _STACK_TO_RESOURCE_NAMES.setdefault(_KNOWN_SVC_STACK, [])
+                    _STACK_TO_RESOURCE_NAMES[_KNOWN_SVC_STACK].append(_KNOWN_RES_NAME)
 if FOCUS_MODE and FOCUS_ENABLED_RESOURCES:
     _FILTERED_RESOURCES = []
     for _R in FOCUS_ENABLED_RESOURCES:
         if _R in _KNOWN_TILT_RESOURCES:
             _FILTERED_RESOURCES.append(_R)
+        elif _R in _STACK_TO_RESOURCE_NAMES:
+            for _STACK_RES_NAME in _STACK_TO_RESOURCE_NAMES[_R]:
+                _FILTERED_RESOURCES.append(_STACK_RES_NAME)
+                _FILTERED_RESOURCES.append(_STACK_RES_NAME + '-run-only')
+                _FILTERED_RESOURCES.append(_STACK_RES_NAME + '-config-gen')
         else:
             _MATCHED = [kr for kr in _KNOWN_TILT_RESOURCES if kr != 'service-discovery-daemon' and kr.startswith(_R + '-')]
             _FILTERED_RESOURCES.extend(_MATCHED)

package/templates/spec.master.hbs

@@ -40,7 +40,7 @@
 # Core infrastructure services - minimal footprint for rapid development
 
 PRE_ALPHA_RESOURCES = {
-{{#each stacks.pre_alpha.services}}
+{{#each phases.pre_alpha.enabledStacks}}
 "{{this}}": True, # {{lookup ../serviceDescriptions this}}
 {{/each}}
 }
@@ -51,7 +51,7 @@ PRE_ALPHA_RESOURCES = {
 # Essential business services for alpha launch.
 
 ALPHA_RESOURCES = {
-{{#each stacks.alpha.services}}
+{{#each phases.alpha.enabledStacks}}
 "{{this}}": False, # {{lookup ../serviceDescriptions this}}
 {{/each}}
 }
@@ -62,7 +62,7 @@ ALPHA_RESOURCES = {
 # Additional services for beta release.
 
 BETA_RESOURCES = {
-{{#each stacks.beta.services}}
+{{#each phases.beta.enabledStacks}}
 "{{this}}": False, # {{lookup ../serviceDescriptions this}}
 {{/each}}
 }
@@ -74,7 +74,7 @@ BETA_RESOURCES = {
 # To enable, remove from this list and add to appropriate stack above.
 
 OUT_OF_SCOPE_RESOURCES = [
-{{#each stacks.out_of_scope.services}}
+{{#each phases.out_of_scope.enabledStacks}}
 "{{this}}", # {{lookup ../serviceDescriptions this}}
 {{/each}}
 ]
@@ -152,6 +152,13 @@ PROJECT = struct(
 NAME = "{{project.name}}",
 VERSION = "{{project.version}}",
 
+PHASES = struct(
+PRE_ALPHA = FOCUS_PRE_ALPHA,
+ALPHA = FOCUS_ALPHA,
+BETA = FOCUS_BETA,
+),
+
+# Backward compatibility for older extension code that reads PROJECT.STACKS.
 STACKS = struct(
 PRE_ALPHA = FOCUS_PRE_ALPHA,
 ALPHA = FOCUS_ALPHA,