@tdk-landscape/tdk-cli-core 1.3.34 → 1.3.36

package/dist/utils/resource-features.js

@@ -2,7 +2,7 @@
  * Resource-Level Features
  *
  * These are code generators and configurations that run per-service/resource.
- * They are controlled via the features: [] array in each service.json file.
+ * They are controlled via the featuresEnabled: [] array in each service.json file.
  *
  * Frontend services: api-client, env-config, api-index (enabled by default)
  * Backend services: prisma (enabled by default)

package/dist/utils/service-urls.d.ts

@@ -0,0 +1,30 @@
+import type { DiscoveredResource } from "../types/index.js";
+export interface HealthTarget {
+    name: string;
+    appType: "frontend" | "backend";
+    url: string;
+}
+export interface HealthProbe extends HealthTarget {
+    ok: boolean;
+    /** HTTP status code, or undefined when the request never completed. */
+    status?: number;
+    /** Failure reason when the request never completed (DNS, refused, timeout). */
+    error?: string;
+}
+export declare function getProjectName(): string;
+export declare function resolveSubdomainBases(): {
+    appBase: string;
+    apiBase: string;
+};
+export declare function appendHealthPath(path: string): string;
+/** The route `tdk up` advertises for a service, without the /health suffix. */
+export declare function resolveServicePath(resource: DiscoveredResource): string;
+/**
+ * Health URLs for every routable service, matching what `tdk up` prints.
+ * Workers, libraries, SDKs and migrators have no Traefik route, so they are
+ * skipped rather than reported as unreachable.
+ */
+export declare function buildHealthTargets(resources: DiscoveredResource[]): HealthTarget[];
+export declare function pingHealthTarget(target: HealthTarget, timeoutMs: number): Promise<HealthProbe>;
+export declare function pingHealthTargets(targets: HealthTarget[], timeoutMs: number): Promise<HealthProbe[]>;
+//# sourceMappingURL=service-urls.d.ts.map

package/dist/utils/service-urls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-urls.d.ts","sourceRoot":"","sources":["../../src/utils/service-urls.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAG5D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,UAAU,GAAG,SAAS,CAAC;IAChC,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,EAAE,EAAE,OAAO,CAAC;IACZ,uEAAuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,cAAc,IAAI,MAAM,CAYvC;AAED,wBAAgB,qBAAqB,IAAI;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAuB5E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAMvE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,kBAAkB,EAAE,GAAG,YAAY,EAAE,CAkBlF;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,CAAC,CAiBtB;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,YAAY,EAAE,EACvB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,WAAW,EAAE,CAAC,CAExB"}

package/dist/utils/service-urls.js

@@ -0,0 +1,93 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { findProjectRoot } from "./paths.js";
+export function getProjectName() {
+    const root = findProjectRoot();
+    if (root) {
+        try {
+            const content = readFileSync(join(root, ".tdk", "project.json"), "utf-8");
+            const parsed = JSON.parse(content);
+            if (parsed?.project?.name) {
+                return parsed.project.name;
+            }
+        }
+        catch { }
+    }
+    return "beauty-crm";
+}
+export function resolveSubdomainBases() {
+    const projectName = getProjectName();
+    const raw = process.env.TDK_SERVICE_BASE_URL ?? `http://${projectName}.localhost`;
+    try {
+        const u = new URL(raw.includes("://") ? raw : `http://${raw}`);
+        const host = u.hostname;
+        if (host === "localhost" || /^\d+\.\d+\.\d+\.\d+$/.test(host)) {
+            return {
+                appBase: `${u.protocol}//${host}${u.port ? `:${u.port}` : ""}`,
+                apiBase: `${u.protocol}//${host}${u.port ? `:${u.port}` : ""}`,
+            };
+        }
+        const bare = host.replace(/^(app|api)\./, "");
+        return {
+            appBase: `${u.protocol}//app.${bare}${u.port ? `:${u.port}` : ""}`,
+            apiBase: `${u.protocol}//api.${bare}${u.port ? `:${u.port}` : ""}`,
+        };
+    }
+    catch {
+        return {
+            appBase: `http://app.${projectName}.localhost`,
+            apiBase: `http://api.${projectName}.localhost`,
+        };
+    }
+}
+export function appendHealthPath(path) {
+    return `${path.replace(/\/+$/, "")}/health`;
+}
+/** The route `tdk up` advertises for a service, without the /health suffix. */
+export function resolveServicePath(resource) {
+    if (resource.config?.appType === "backend") {
+        const servicePathName = resource.name.replace(/-api$/, "");
+        return resource.config?.apiPath ?? `/api/${servicePathName}`;
+    }
+    return resource.config?.basePath ?? `/${resource.name}`;
+}
+/**
+ * Health URLs for every routable service, matching what `tdk up` prints.
+ * Workers, libraries, SDKs and migrators have no Traefik route, so they are
+ * skipped rather than reported as unreachable.
+ */
+export function buildHealthTargets(resources) {
+    const { appBase, apiBase } = resolveSubdomainBases();
+    return resources
+        .filter((resource) => resource.config?.appType === "frontend" || resource.config?.appType === "backend")
+        .map((resource) => {
+        const base = resource.config.appType === "backend" ? apiBase : appBase;
+        return {
+            name: resource.name,
+            appType: resource.config.appType,
+            url: `${base}${appendHealthPath(resolveServicePath(resource))}`,
+        };
+    });
+}
+export async function pingHealthTarget(target, timeoutMs) {
+    try {
+        const response = await fetch(target.url, {
+            method: "GET",
+            redirect: "manual",
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        return { ...target, ok: response.ok, status: response.status };
+    }
+    catch (err) {
+        const error = err instanceof Error && err.name === "TimeoutError"
+            ? `no response within ${timeoutMs}ms`
+            : err instanceof Error
+                ? err.message
+                : String(err);
+        return { ...target, ok: false, error };
+    }
+}
+export async function pingHealthTargets(targets, timeoutMs) {
+    return Promise.all(targets.map((target) => pingHealthTarget(target, timeoutMs)));
+}
+//# sourceMappingURL=service-urls.js.map

package/dist/utils/service-urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-urls.js","sourceRoot":"","sources":["../../src/utils/service-urls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAgB7C,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;gBAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YAC7B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;IACZ,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,UAAU,WAAW,YAAY,CAAC;IAClF,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;QACxB,IAAI,IAAI,KAAK,WAAW,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,OAAO;gBACL,OAAO,EAAE,GAAG,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC9D,OAAO,EAAE,GAAG,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;aAC/D,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC9C,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,CAAC,QAAQ,SAAS,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAClE,OAAO,EAAE,GAAG,CAAC,CAAC,QAAQ,SAAS,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;SACnE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,OAAO,EAAE,cAAc,WAAW,YAAY;YAC9C,OAAO,EAAE,cAAc,WAAW,YAAY;SAC/C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,QAA4B;IAC7D,IAAI,QAAQ,CAAC,MAAM,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,QAAQ,CAAC,MAAM,EAAE,OAAO,IAAI,QAAQ,eAAe,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,EAAE,QAAQ,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAA+B;IAChE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;IAErD,OAAO,SAAS;SACb,MAAM,CACL,CACE,QAAQ,EAC0E,EAAE,CACpF,QAAQ,CAAC,MAAM,EAAE,OAAO,KAAK,UAAU,IAAI,QAAQ,CAAC,MAAM,EAAE,OAAO,KAAK,SAAS,CACpF;SACA,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACvE,OAAO;YACL,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO;YAChC,GAAG,EAAE,GAAG,IAAI,GAAG,gBAAgB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,EAAE;SAChE,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAoB,EACpB,SAAiB;IAEjB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE;YACvC,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;SACvC,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACjE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,KAAK,GACT,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc;YACjD,CAAC,CAAC,sBAAsB,SAAS,IAAI;YACrC,CAAC,CAAC,GAAG,YAAY,KAAK;gBACpB,CAAC,CAAC,GAAG,CAAC,OAAO;gBACb,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAuB,EACvB,SAAiB;IAEjB,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;AACnF,CAAC"}

package/engine/REFACTORING_MANIFEST_SYSTEM.md

@@ -632,7 +632,7 @@ VALIDATION_RULES = {
     
     'prisma_has_database': {
         'severity': 'warning',
-        'condition': lambda m: 'prisma' in m.get('features', []),
+        'condition': lambda m: 'prisma' in m.get('featuresEnabled', []),
         'check': lambda m: m.get('databaseName'),
         'message': 'Service with prisma feature should specify databaseName',
     },

package/engine/lifecycle/orchestrator.star

@@ -192,14 +192,15 @@ def should_wait_for_dependencies(resource_config):
     resources = resource_config.get('resources', [])
     for res in resources:
         manifest = res.get('_manifest', {})
-        if manifest.get('databaseName') or manifest.get('features', []).count('prisma') > 0:
+        features = manifest.get('featuresEnabled', [])
+        if manifest.get('databaseName') or features.count('prisma') > 0:
             dependencies.append('database-management')
             break
-    
+
     # Check for NATS dependency
     for res in resources:
         manifest = res.get('_manifest', {})
-        if 'nats' in manifest.get('features', []):
+        if 'nats' in manifest.get('featuresEnabled', []):
             dependencies.append('messaging')
             break
     

package/engine/schemas/service-schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://TDK Landscape.local/schemas/service-schema.json",
+  "$id": "https://tdk-landscape.github.io/schema.service.json",
   "$schema": "http://json-schema.org/draft-07/schema#",
   "additionalProperties": false,
   "allOf": [
@@ -50,14 +50,14 @@
       },
       "then": {
         "properties": {
-          "features": {
+          "featuresEnabled": {
             "contains": {
               "const": "nats"
             }
           }
         },
         "required": [
-          "features"
+          "featuresEnabled"
         ]
       }
     }
@@ -180,7 +180,7 @@
       ],
       "type": "object"
     },
-    "features": {
+    "featuresEnabled": {
       "description": "Platform features:\n• nats - NATS JetStream eventing\n• prisma - DB ORM & migrations\n• redis - Caching layer\n• infisical - Secrets management\n• vitest - Test framework\n• traefik - Reverse proxy routing\n• websocket - WS support\n• graphql - GraphQL server\n• grpc - gRPC protocol",
       "items": {
         "enum": [
@@ -215,7 +215,7 @@
       "uniqueItems": true
     },
     "nats": {
-      "description": "Custom NATS configuration. Auto-generated if 'nats' in features.",
+      "description": "Custom NATS configuration. Auto-generated if 'nats' in featuresEnabled.",
       "properties": {
         "queueGroup": {
           "description": "NATS queue group for load balancing",

package/engine/topologies/platform/docker/compose/compose.star

@@ -8,6 +8,9 @@
 # === INLINED CONSTANTS for pure extension loading ===
 BASE_PORT_FRONTEND = 3000
 BASE_PORT_BACKEND = 4000
+# The nginx frontend runtime layer always serves on 80: L4_generate_frontend_runtime
+# emits a fixed `EXPOSE 80` and the generated nginx.conf has a fixed `listen 80`.
+NGINX_CONTAINER_PORT = 80
 HEALTH_CHECK_PATH = "/health"
 OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
 # === END INLINED CONSTANTS ===
@@ -15,7 +18,7 @@ OUTPUT = struct(AUTOGENERATED_FOLDER = ".autogenerated")
 
 load("./compose_helpers.star", "with_runtime_image_tag", "compose_build_config")
 load("../networking/traefik.star", "get_frontend_traefik_labels", "get_backend_traefik_labels")
-load("../networking/api_path_constants.star", "get_api_path_for_domain")
+load("../networking/api_path_constants.star", "get_api_path_for_domain", "get_frontend_base_path")
 load("../secrets/infisical.star", "get_infisical_environment_vars")
 load("../auth/auth.star", "AuthConfig")
 
@@ -76,11 +79,17 @@ def generate_frontend_compose(resource_path, resource_name, res, manifest=None):
     
     target_path = res.get('target_path', manifest.get('target_path', '/usr/share/nginx/html'))
     use_nginx = 'nginx' in target_path or target_path == '/usr/share/nginx/html'
-    # Read port from manifest (service.json), fallback to BASE_PORT_FRONTEND or 80 for nginx
-    port = manifest.get('port', 80 if use_nginx else BASE_PORT_FRONTEND)
-    
-    # Base path for routing on {project}.localhost
-    base_path = '/' + manifest.get('basePath', stack + 's').lstrip('/')
+    # The manifest `port` is the Vite dev-server port. These compose entries always
+    # build the `production` target, so for an nginx runtime the port inside the
+    # container is 80, not the dev port. Using the dev port here made the container
+    # healthcheck probe a port nothing listens on, which left the container marked
+    # unhealthy -- and Traefik's Docker provider skips unhealthy containers, so the
+    # router was never registered and every request 404'd.
+    port = NGINX_CONTAINER_PORT if use_nginx else manifest.get('port', BASE_PORT_FRONTEND)
+    
+    # Base path for routing on {project}.localhost. Shared with the Vite config and
+    # PUBLIC_URL generators -- see get_frontend_base_path for why they must agree.
+    base_path = get_frontend_base_path(manifest, res_name)
     
     traefik_cfg = manifest.get('traefik', {}) if manifest else {}
     traefik_host = traefik_cfg.get('host')
@@ -232,15 +241,33 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
     # All instances share the same Traefik service for load balancing
     traefik_resource_name = res_name  # LB service name (shared)
     
-    traefik_labels = get_backend_traefik_labels(
-        resource_entry_name=resource_entry_name, 
-        traefik_host=traefik_host, 
-        traefik_path=traefik_path, 
-        traefik_resource_name=traefik_resource_name, 
-        internal_port=internal_port, 
-        health_path=health_path,
-        manifest=manifest,
-    )
+    # Workers have no HTTP server: they consume from NATS and exit-on-crash. Giving
+    # them a Traefik route advertises an endpoint that can never answer, and giving
+    # them an HTTP healthcheck marks a perfectly healthy worker as unhealthy forever.
+    is_worker = manifest.get('appType') == 'worker' if manifest else False
+
+    if is_worker:
+        traefik_labels = '      - "traefik.enable=false"'
+        healthcheck_section = ""
+    else:
+        traefik_labels = get_backend_traefik_labels(
+            resource_entry_name=resource_entry_name,
+            traefik_host=traefik_host,
+            traefik_path=traefik_path,
+            traefik_resource_name=traefik_resource_name,
+            internal_port=internal_port,
+            health_path=health_path,
+            manifest=manifest,
+        )
+        healthcheck_section = """    healthcheck:
+      test: ["CMD", "curl", "-f", "--max-time", "5", "http://localhost:{internal_port}{health_path}"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+      # STORY 4 FIX: 30s grace period to prevent 504 errors during startup
+      # Services get 30s to initialize before health checks begin
+      start_period: 30s
+""".format(internal_port=internal_port, health_path=health_path)
     infisical_env = get_infisical_environment_vars(as_array=True, resource_name=res_name)
     
     # Build auth environment variables section using centralized auth utilities
@@ -271,15 +298,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
       - {network_backend}
       - {network_database}
       - {network_infisical}
-    healthcheck:
-      test: ["CMD", "curl", "-f", "--max-time", "5", "http://localhost:{internal_port}{health_path}"]
-      interval: 10s
-      timeout: 5s
-      retries: 6
-      # STORY 4 FIX: 30s grace period to prevent 504 errors during startup
-      # Services get 30s to initialize before health checks begin
-      start_period: 30s
-    # Note: depends_on removed - Tilt manages service startup order
+{healthcheck_section}    # Note: depends_on removed - Tilt manages service startup order
     deploy:
       resources:
         limits:
@@ -311,6 +330,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
         nats_queue=nats_queue,
         nats_url=nats_url,
         traefik_labels=traefik_labels,
+        healthcheck_section=healthcheck_section,
         infisical_env=infisical_env,
         auth_env=auth_env,
         network_traefik_public=PlatformDockerConstants.NETWORK_TRAEFIK_PUBLIC,

package/engine/topologies/platform/docker/constants.star

@@ -37,6 +37,9 @@ APP_LOCAL_DOMAIN = APP_SUBDOMAIN_PREFIX + "." + LOCAL_DOMAIN
 API_LOCAL_DOMAIN = API_SUBDOMAIN_PREFIX + "." + LOCAL_DOMAIN
 EMAIL_DOMAIN = PROJECT_NAME_HYPHEN + ".local"
 
+# Published resource-config JSON Schema, same for every project (not project-specific like EMAIL_DOMAIN)
+RESOURCE_SCHEMA_URL = "https://tdk-landscape.github.io/schema.service.json"
+
 # NPM scope constant
 NPM_SCOPE = "@" + PROJECT_NAME_HYPHEN + "/"
 
@@ -129,6 +132,7 @@ PlatformDockerConstants = struct(
     APP_LOCAL_DOMAIN = APP_LOCAL_DOMAIN,
     API_LOCAL_DOMAIN = API_LOCAL_DOMAIN,
     EMAIL_DOMAIN = EMAIL_DOMAIN,
+    RESOURCE_SCHEMA_URL = RESOURCE_SCHEMA_URL,
     NPM_SCOPE = NPM_SCOPE,
     BUN_VERSION = BUN_VERSION,
     BUN_IMAGE = BUN_IMAGE,

package/engine/topologies/platform/docker/generators/golden_docker_generator_v2.star

@@ -64,6 +64,7 @@ def L4_generate_orchestrator(res_path, res_type = 'backend', resource_name = 'se
                 use_infisical,
                 resource_name,
                 use_golden=use_golden,
+                use_prisma=use_prisma,
                 has_prisma_config=prisma_config_exists,
                 manifest=manifest,
             ),

package/engine/topologies/platform/docker/layers/l4_runtime_layers.star

@@ -54,10 +54,10 @@ GOLDEN_L4_FRONTEND_IMAGE = _docker_cfg.get('golden_l4_frontend_image', _GOLDEN_P
 _docker_health = get_docker_healthcheck_config()
 
 
-def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun run start', use_infisical = True, resource_name = 'service', use_golden = True, has_prisma_config = False, manifest = None):
+def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun run start', use_infisical = True, resource_name = 'service', use_golden = True, use_prisma = True, has_prisma_config = False, manifest = None):
     """
     Generate the backend runtime layer for deployed services.
-    
+
     Args:
         res_path: Resource path (service directory)
         port: Port to expose (default: BASE_PORT_BACKEND from master config)
@@ -65,7 +65,11 @@ def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun r
         use_infisical: Enable Infisical secret management (default: True)
         resource_name: Service name for logging and configuration (default: 'service')
         use_golden: Whether to use golden L4-backend image (default: True)
-        has_prisma_config: Whether service has Prisma config (default: False)
+        use_prisma: Whether the service has the "prisma" feature enabled - gates copying
+            the .prisma/prisma dirs from the L3 build stage, which only exist there when
+            L3 itself ran prisma generate (default: True)
+        has_prisma_config: Whether service has a generated prisma.config.ts to copy in
+            (default: False)
         manifest: Service manifest dict for feature detection (default: None)
     
     Returns:
@@ -88,16 +92,16 @@ def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun r
         # Bun isolated linker creates service symlinks that resolve through /app/node_modules/.bun.
         # Copy from production_purger to avoid dragging full dev dependency store into runtime.
         "COPY --from=l3_production_purger /app/" + res_path + "/node_modules/.bun /app/node_modules/.bun\n",
-        prisma_runtime_copy(res_path),
+        prisma_runtime_copy(res_path) if use_prisma else "",
         "COPY --from=l3_backend_build /app/" + res_path + "/dist ./dist\n",
         "COPY " + res_path_rel + "/package.json ./package.json\n",
-        prisma_bun_symlink_fix(),
+        prisma_bun_symlink_fix() if use_prisma else "",
         bun_hoisted_packages_symlink_fix(),
     ]
     
     # Check for special tooling requirements from manifest features
     # Services requiring Hugo (or other tools) should specify in manifest features array
-    manifest_features = manifest.get('features', []) if manifest else []
+    manifest_features = manifest.get('featuresEnabled', []) if manifest else []
     if "hugo" in manifest_features:
         parts.append("USER root\n")
         parts.append("RUN apk add --no-cache hugo\n")

package/engine/topologies/platform/docker/networking/api_path_constants.star

@@ -115,6 +115,36 @@ def get_api_path_for_stack(stack, manifest=None):
 # Backwards compatibility alias
 get_api_path_for_domain = get_api_path_for_stack
 
+
+def get_frontend_base_path(manifest, res_name=None):
+    """Returns the public route a frontend is served under, e.g. "/floor-app".
+
+    Single source of truth. Three separate generators need this value and they
+    MUST agree, because they are three halves of one route:
+
+      - compose.star   -> the Traefik router rule and its stripprefix middleware
+      - vite/frontend  -> `base`, which prefixes every asset URL in index.html
+      - env.star       -> PUBLIC_URL
+
+    If they disagree the app still "starts" but serves a white page: Traefik
+    routes /a, index.html asks for /b/assets/*, and nothing answers. They used
+    to default to `stack + 's'`, `'/' + stack + 's'` and `'/' + stack`
+    respectively -- three different answers, one of which ("operations" + "s")
+    produced the nonsense route /operationss.
+
+    Defaults to the service name: it is unique per service (a stack with two
+    frontends would otherwise collide on one route) and it matches the URL
+    `tdk up` prints, so what the CLI advertises is what Traefik serves.
+    """
+    base_path = manifest.get('basePath') if manifest else None
+    if not base_path:
+        base_path = res_name or (manifest.get('appName') if manifest else None) or ''
+    if not base_path:
+        return ''
+    if not base_path.startswith('/'):
+        base_path = '/' + base_path
+    return base_path
+
 def get_api_path_for_resource(resource_name):
     """Returns the full API path for a resource name.
     

package/engine/topologies/platform/docker/networking/traefik.star

@@ -60,7 +60,7 @@ def get_frontend_traefik_labels(res_name, domain, base_path, port, traefik_host=
     middleware_name = res_name + TRAEFIK_MIDDLEWARE_SUFFIX
     
     # Check if maintenance feature is enabled
-    features = manifest.get('features', []) if manifest else []
+    features = manifest.get('featuresEnabled', []) if manifest else []
     maintenance_middleware = ""
     if 'maintenance' in features:
         maintenance_middleware = ",maintenance@file"
@@ -112,7 +112,7 @@ def get_backend_traefik_labels(
     middleware_name = resource_entry_name + TRAEFIK_MIDDLEWARE_SUFFIX
     
     # Check if maintenance feature is enabled
-    features = manifest.get('features', []) if manifest else []
+    features = manifest.get('featuresEnabled', []) if manifest else []
     maintenance_middleware = ""
     if 'maintenance' in features:
         maintenance_middleware = ",maintenance@file"

package/engine/topologies/platform/net/AGENTS.md

@@ -0,0 +1,64 @@
+# AGENTS.md - Networking & Proxy
+
+## Purpose
+
+Traefik reverse proxy, networking configuration, and service routing.
+
+## Key Files
+
+### Traefik
+- **`proxy.star`** - Traefik configuration generation
+- **`labels.star`** - Docker labels for Traefik routing
+
+### Network Management
+- **`network.star`** - Docker network setup
+- **`hosts.star`** - /etc/hosts file management
+
+## Common Tasks
+
+### Generate Traefik labels
+```starlark
+load("./proxy.star", "generate_traefik_labels")
+labels = generate_traefik_labels(
+    resource_name="order-management-backend",
+    port=4000,
+    host="order.backend.{project}.localhost",
+    path_prefix="/api/orders"
+)
+```
+
+### Output
+```python
+{
+    "traefik.enable": "true",
+    "traefik.http.routers.order-management-backend.rule": "Host(`order.backend.{project}.localhost`) && PathPrefix(`/api/orders`)",
+    "traefik.http.routers.order-management-backend.entrypoints": "web",
+    "traefik.http.services.order-management-backend.loadbalancer.server.port": "4000"
+}
+```
+
+## Architecture
+
+```
+Internet/localhost
+       ↓
+   Traefik (port 80/443)
+       ↓
+   Routes to services by Host/Path
+       ↓
+   Service containers
+```
+
+## Integration
+
+- Called by `resources/` when creating service resources
+- Used by `platform/docker/` for Docker Compose generation
+- Labels applied to docker_build and docker_compose
+
+## Local Development
+
+Services accessible at:
+- `{service}.backend.{project}.localhost`
+- `{service}.frontend.{project}.localhost`
+
+Managed in `/etc/hosts` automatically.

package/engine/topologies/platform/security/AGENTS.md

@@ -0,0 +1,49 @@
+# AGENTS.md - Security & Secrets
+
+## Purpose
+
+Secrets management, Infisical integration, and security configuration.
+
+## Key Files
+
+### Secrets Management
+- **`infisical.star`** - Infisical secrets provider integration
+- **`secrets.star`** - Generic secrets handling
+- **`encryption.star`** - Encryption utilities
+
+### Configuration
+- **`tokens.star`** - Token generation and validation
+- **`keys.star`** - Key management
+
+## Common Tasks
+
+### Load secrets from Infisical
+```starlark
+load("./infisical.star", "Infisical")
+secrets = Infisical.load_secrets(resource_name, environment)
+```
+
+### Get database credentials
+```starlark
+load("./infisical.star", "Infisical")
+db_url = Infisical.get_database_url(resource_name)
+```
+
+## Integration
+
+- Called by `resources/` when setting up service environment
+- Used in Docker Compose for injecting secrets
+- Part of service startup chain
+
+## Local Development
+
+Without Infisical, falls back to:
+- Environment variables
+- Default values in `spec.master`
+
+## Security Notes
+
+- Never commit real secrets
+- Use Infisical for production
+- Local development uses safe defaults
+- Secrets injected at runtime, not in images

package/engine/topologies/platform/state/AGENTS.md

@@ -0,0 +1,64 @@
+# AGENTS.md - Database & State Management
+
+## Purpose
+
+PostgreSQL database virtualization, per-service database provisioning, and state management.
+
+## Key Files
+
+### Database Provisioning
+- **`relational.star`** - Main database provisioning logic
+- **`compose.star`** - Docker Compose entries for databases
+
+### Prisma Integration
+- **`prisma/migrate_script.star`** - Migration script generation
+- **`prisma/db_readiness.star`** - Database readiness checks
+- **`prisma/prisma_build.star`** - Prisma in Docker builds
+- **`prisma/prisma_runtime.star`** - Prisma client in runtime
+
+### Utilities
+- **`utils.star`** - Database utilities
+- **`constants.star`** - Database constants (ports, users)
+
+## Common Tasks
+
+### Provision database for service
+```starlark
+load("./relational.star", "provision_database")
+compose_entry = provision_database("order-management-backend", "{project}_order")
+```
+
+### Get database URL
+```starlark
+load("./relational.star", "get_database_url")
+url = get_database_url("order-management-backend")
+# Returns: postgresql://postgres:postgres@order-management-backend-db:5432/{project}_order
+```
+
+### Wait for database
+```starlark
+load("./prisma/db_readiness.star", "wait_for_db")
+script = wait_for_db(db_url, timeout=30)
+```
+
+## Architecture
+
+Each service with `databaseName` in manifest gets:
+1. PostgreSQL container in Docker Compose
+2. Volume for persistence
+3. Readiness check before migrations
+4. Dedicated port mapping (avoids conflicts)
+
+## Integration
+
+- Called by `resources/deps.star` - when setting up service dependencies
+- Used by `platform/docker/` - for Docker Compose generation
+- Part of service resource dependencies chain
+
+## Database Naming
+
+```
+{project}_{domain}  // e.g., {project}_order, {project}_user
+```
+
+Each domain gets one database shared by its services (backend, migrator, etc).

package/engine/topologies/tilt/generators/vite/backend.star

@@ -45,7 +45,7 @@ def generate_backend(manifest, write_fn=None):
     
     # 🔥 SMART DETECTION: Check if service uses vite-plugin-node for HMR
     use_vite_node = manifest.get('useViteNode', False)
-    features = manifest.get('features', [])
+    features = manifest.get('featuresEnabled', [])
     if 'vite-node' in features or 'vite-plugin-node' in features or 'hmr' in features:
         use_vite_node = True