@tdk-landscape/tdk-cli-core 1.3.45 → 1.3.48

package/cli/src/utils/validation.ts

@@ -0,0 +1,67 @@
+import type { ValidationResult } from "../types/index.js";
+import { OPTIONAL_INFRA_SERVICES } from "./constants.js";
+
+export const KEBAB_CASE_REGEX = /^[a-z0-9-]+$/;
+
+function isKebabCase(value: string): boolean {
+  return KEBAB_CASE_REGEX.test(value);
+}
+
+export function validateResourceName(name: string): ValidationResult {
+  if (!name.trim()) {
+    return { valid: false, error: "Resource name is required" };
+  }
+  if (!isKebabCase(name)) {
+    return {
+      valid: false,
+      error: "Use lowercase letters, numbers, and hyphens only",
+    };
+  }
+  return { valid: true };
+}
+
+export function createKebabCaseValidator(context: "resource" | "stack") {
+  return (input: string): true | string => {
+    if (!input.trim()) {
+      return context === "resource" ? "Resource name is required" : "Stack name is required";
+    }
+    if (!isKebabCase(input)) {
+      return context === "resource"
+        ? "Use lowercase letters, numbers, and hyphens only"
+        : "Use kebab-case (lowercase, numbers, hyphens only)";
+    }
+    return true;
+  };
+}
+
+export function validateOptionalInfraService(service: string): ValidationResult {
+  if (includes(OPTIONAL_INFRA_SERVICES, service)) {
+    return { valid: true };
+  }
+  return {
+    valid: false,
+    error: `Invalid service. Must be one of: ${OPTIONAL_INFRA_SERVICES.join(", ")}`,
+  };
+}
+
+export function isValidPort(port: number): boolean {
+  return Number.isInteger(port) && port > 0 && port <= 65535;
+}
+
+/**
+ * Check a filesystem path segment for characters that are unsafe to use in a
+ * path (null bytes, or characters that are invalid on common filesystems).
+ * Does not check for path traversal (`..`) - callers that resolve the path
+ * against a base directory should check that separately.
+ */
+export function isPathSafe(path: string): boolean {
+  return !path.includes("\0") && !/[<>:"|?*]/.test(path);
+}
+
+export function sanitizeForShell(value: string, replacement: string = "_"): string {
+  return value.replace(/[^a-zA-Z0-9-]/g, replacement).substring(0, 100);
+}
+
+export function includes<T extends readonly string[]>(array: T, value: string): value is T[number] {
+  return (array as readonly string[]).includes(value);
+}

package/{templates → cli/templates}/Tiltfile.hbs

@@ -166,7 +166,7 @@ FOCUS_MODE, FOCUS_ENABLED_ALL, FOCUS_ENABLED_RESOURCES = Config.apply_focus(cfg)
 ALWAYS_ENABLED_INFRA = {{starlarkArray alwaysEnabledInfra}}
 
 def should_enable(resource_name):
-    # Always-enabled infra (proxy/Traefik, verdaccio, database-management, infisical) must stay
+    # Always-enabled infra (proxy/Traefik, verdaccio, database-management) must stay
     # enabled independent of focus mode: FOCUS_MODE collapses to False whenever the pre-alpha
     # stack bucket is empty (the default on a freshly generated project.json), which used to
     # silently disable Traefik and friends on every out-of-the-box `tdk up`.

package/cli/tsconfig.json

@@ -0,0 +1,25 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": ["ES2022", "DOM"],
+    "types": ["node", "react"],
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "declaration": true,
+    "declarationMap": true,
+    "sourceMap": true,
+    "resolveJsonModule": true,
+    "allowSyntheticDefaultImports": true,
+    "isolatedModules": true,
+    "noEmitOnError": true,
+    "jsx": "react-jsx"
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist", "**/*.test.ts"]
+}

package/cli/tsconfig.typecheck.json

@@ -0,0 +1,8 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist"]
+}

package/docs/FEATURES.md

@@ -0,0 +1,279 @@
+# TDK Features Reference
+
+This document describes all available features in TDK and how to control them.
+
+## Overview
+
+TDK has two levels of feature control:
+
+1. **Project-Level Features** - Infrastructure services available to all resources (proxy, database, etc.)
+2. **Resource-Level Features** - Code generators for individual services (api-client, prisma, etc.)
+
+---
+
+## Project-Level Features
+
+Project-level features are configured in `.tdk/project.json` and control infrastructure services.
+
+### CORE Features (Pre-Enabled)
+
+These are always enabled in the `pre_alpha` stack:
+
+#### `proxy` (Traefik)
+- **Purpose**: Reverse proxy and API gateway for routing all services
+- **Default**: ✅ Enabled
+- **Service Name**: `proxy`
+- **Port**: 80 (HTTP), 443 (HTTPS)
+- **Configuration**: Routes all HTTP traffic based on path/domain rules
+
+#### `database-management` (PostgreSQL)
+- **Purpose**: Primary relational database for data persistence
+- **Default**: ✅ Enabled
+- **Service Name**: `database-management`
+- **Port**: 5432
+- **Database**: `app_dev` (default)
+- **Configuration**: Backend services use `DATABASE_URL` env var
+
+### PREMIUM Features (Requires License Key)
+
+Enable these with a premium license key set via `export TDK_LICENSE_KEY=<key>`:
+
+#### `verdaccio` (Verdaccio)
+- **Purpose**: Local npm registry for package management and publishing
+- **Default**: ❌ Disabled (Premium feature)
+- **Service Name**: `verdaccio`
+- **Port**: 4873
+- **License**: Premium (requires `TDK_LICENSE_KEY` environment variable)
+- **Configuration**: Services use this for `npm install` and `bun install` when enabled
+
+### OPTIONAL Features (Disabled by Default)
+
+Enable these in `.tdk/project.json` under `optional_infra`:
+
+```json
+{
+  "optional_infra": {
+    "monitoring": true,
+    "elk": true,
+    "debezium": true,
+    "golden_image": true
+  }
+}
+```
+
+#### `monitoring` (SigNoz/SkyWalking)
+- **Purpose**: Observability platform for metrics, traces, and logs
+- **Default**: ❌ Disabled
+- **Resource Usage**: High (requires database-management)
+
+#### `elk` (Elasticsearch, Logstash, Kibana)
+- **Purpose**: Log aggregation and analysis stack
+- **Default**: ❌ Disabled
+- **Resource Usage**: High
+
+#### `debezium` (Change Data Capture)
+- **Purpose**: Stream database changes in real-time
+- **Default**: ❌ Disabled
+- **Requires**: PostgreSQL (database-management)
+
+#### `golden-image` (Pre-built Docker Layer)
+- **Purpose**: Faster Docker builds by caching dependencies
+- **Default**: ✅ Enabled
+- **Benefit**: Reduces build time from minutes to seconds
+
+### Enable/Disable
+
+To enable optional or premium features, edit `.tdk/project.json`:
+
+```bash
+# Edit .tdk/project.json
+{
+  "optional_infra": {
+    "monitoring": true,    # Optional feature (Free)
+    "verdaccio": true      # Premium feature (requires TDK_LICENSE_KEY)
+  }
+}
+
+# Regenerate
+tdk config regenerate
+```
+
+**For Premium Features:** Set your license key before running `tdk up`:
+
+```bash
+export TDK_LICENSE_KEY=<your-premium-key>
+tdk up
+```
+
+---
+
+## Resource-Level Features
+
+Resource-level features are configured in each `service.json` file via the `features: []` array.
+
+### Frontend Services
+
+Default features for frontend services (appType: "frontend"):
+
+```json
+{
+  "appName": "my-app",
+  "appType": "frontend",
+  "features": ["api-client", "env-config", "api-index"]
+}
+```
+
+#### `api-client`
+- **Generates**: `.autogenerated/api-client.ts`
+- **Purpose**: Pre-configured API client wrapper for backend communication
+- **Imports**: `import { apiClient } from './.autogenerated/api-client'`
+- **Customize**: Edit `service.json` → `apiClient` config section
+
+#### `env-config`
+- **Generates**: `.autogenerated/env.ts`
+- **Purpose**: Environment constants and configuration
+- **Imports**: `import { API_URL } from './.autogenerated/env'`
+- **Default**: Uses `VITE_API_URL` env var with fallback to local dev URL
+
+#### `api-index`
+- **Generates**: `.autogenerated/api-index.ts`
+- **Purpose**: Barrel export for cleaner imports
+- **Imports**: `import { apiClient, API_URL } from './.autogenerated'`
+
+### Backend Services
+
+Default features for backend services (appType: "backend", "worker", "migrator"):
+
+```json
+{
+  "appName": "my-api",
+  "appType": "backend",
+  "features": ["prisma"]
+}
+```
+
+#### `prisma`
+- **Generates**: `.autogenerated/prisma.config.autogenerated.ts`
+- **Purpose**: Prisma CLI configuration for database access
+- **Usage**: `npx prisma generate`, `npx prisma migrate`, `npx prisma db push`
+- **Database**: Uses `DATABASE_URL` env var from project-level database
+
+#### `ddd` (Premium)
+- **Generates**: Domain-driven design folders and backend path aliases
+- **Purpose**: Scaffolds `domain`, `application`, `infrastructure`, and `presentation` layers
+- **License**: Premium (requires `TDK_LICENSE_KEY` with the `ddd` resource grant)
+- **Usage**: `tdk resource add <name> --type backend --ddd`
+
+### Enable/Disable Features
+
+**To enable a feature**, add it to `features: []`:
+
+```json
+{
+  "features": ["api-client", "env-config", "api-index", "prisma"]
+}
+```
+
+**To disable a feature**, remove it from `features: []`:
+
+```json
+{
+  "features": ["api-client"]  // Only api-client runs
+}
+```
+
+After editing `service.json`, regenerate:
+
+```bash
+tdk config regenerate
+```
+
+---
+
+## Always-Enabled Generators
+
+These generators always run and don't have a feature flag:
+
+- **vite** - Frontend/backend build configuration
+- **tsconfig** - TypeScript configuration (local and Docker)
+- **dockerfile** - Container configuration
+- **npmrc/bunfig** - Package manager configuration
+- **nginx** - Static file serving (frontend)
+- **env** - Backend environment setup
+- **agents-md** - AI safety guard rail
+
+---
+
+## Quick Reference
+
+### Frontend (appType: "frontend")
+
+| Feature | Default | Customizable |
+|---------|---------|--------------|
+| api-client | ✅ | Yes |
+| env-config | ✅ | Yes |
+| api-index | ✅ | Yes |
+| vite | ✅ (always) | No |
+| tsconfig | ✅ (always) | No |
+| dockerfile | ✅ (always) | No |
+| nginx | ✅ (always) | No |
+
+### Backend (appType: "backend")
+
+| Feature | Default | Customizable |
+|---------|---------|--------------|
+| prisma | ✅ | Yes |
+| ddd | ❌ | Yes (Premium) |
+| vite | ✅ (always) | No |
+| tsconfig | ✅ (always) | No |
+| dockerfile | ✅ (always) | No |
+| npmrc | ✅ (always) | No |
+| env | ✅ (always) | No |
+
+### Project Infrastructure
+
+| Feature | Default | Customizable | License |
+|---------|---------|--------------|---------|
+| proxy | ✅ | No | Free |
+| database | ✅ | No | Free |
+| verdaccio | ❌ | Yes | Premium |
+| monitoring | ❌ | Yes | Free |
+| elk | ❌ | Yes | Free |
+| debezium | ❌ | Yes | Free |
+| golden-image | ✅ | Yes | Free |
+
+---
+
+## Examples
+
+### Disable API Client Generation
+
+```json
+{
+  "appName": "dashboard-app",
+  "appType": "frontend",
+  "features": ["env-config", "api-index"]  // Remove api-client
+}
+```
+
+### Backend Without Prisma
+
+```json
+{
+  "appName": "worker",
+  "appType": "backend",
+  "features": []  // No prisma
+}
+```
+
+### Enable Monitoring
+
+```json
+{
+  "optional_infra": {
+    "monitoring": true
+  }
+}
+```
+
+Then run `tdk config regenerate && tdk up`.

package/engine/topologies/platform/docker/dockerfile/dockerfile.star

@@ -8,7 +8,7 @@ BASE_PORT_BACKEND = 4000
 load('../generators/golden_docker_generator_v2.star', 'L4_generate_orchestrator')
 
 
-def generate_frontend_dockerfile(res_path, resource_name, port=BASE_PORT_FRONTEND, target_path='/app/dist', build_cmd='bun run build', cmd='bun run start', use_nginx=False, use_infisical=True, use_shared_libs=True, use_prisma=False, use_golden=True, manifest=None):
+def generate_frontend_dockerfile(res_path, resource_name, port=BASE_PORT_FRONTEND, target_path='/app/dist', build_cmd='bun run build', cmd='bun run start', use_nginx=False, use_infisical=False, use_shared_libs=True, use_prisma=False, use_golden=True, manifest=None):
     """Generate Dockerfile for frontend services."""
     return L4_generate_orchestrator(
         res_path=res_path,
@@ -26,7 +26,7 @@ def generate_frontend_dockerfile(res_path, resource_name, port=BASE_PORT_FRONTEN
         manifest=manifest,
     )
 
-def generate_app_dockerfile(res_path, resource_name, port=BASE_PORT_BACKEND, build_cmd='bun run build', cmd='bun run start', use_infisical=True, use_shared_libs=True, use_prisma=True, use_golden=True, manifest=None):
+def generate_app_dockerfile(res_path, resource_name, port=BASE_PORT_BACKEND, build_cmd='bun run build', cmd='bun run start', use_infisical=False, use_shared_libs=True, use_prisma=True, use_golden=True, manifest=None):
     """Generate Dockerfile for backend/app services."""
     return L4_generate_orchestrator(
         res_path=res_path,
@@ -42,7 +42,7 @@ def generate_app_dockerfile(res_path, resource_name, port=BASE_PORT_BACKEND, bui
         manifest=manifest,
     )
 
-def generate_migrator_dockerfile(res_path, resource_name, use_infisical=True, use_golden=True, manifest=None):
+def generate_migrator_dockerfile(res_path, resource_name, use_infisical=False, use_golden=True, manifest=None):
     """Generate Dockerfile for database migrator services."""
     return L4_generate_orchestrator(
         res_path=res_path,

package/engine/topologies/platform/docker/generators/golden_docker_generator_v2.star

@@ -25,7 +25,7 @@ load('../layers/l4_runtime_layers.star',
     'L4_generate_frontend_runtime',
 )
 
-def L4_generate_orchestrator(res_path, res_type = 'backend', resource_name = 'service', use_nginx = False, port = 3000, target_path = '/app/dist', build_cmd = 'bun run build', cmd = 'bun run start', use_infisical = True, use_shared_libs = True, use_prisma = True, use_golden = True, manifest = None):
+def L4_generate_orchestrator(res_path, res_type = 'backend', resource_name = 'service', use_nginx = False, port = 3000, target_path = '/app/dist', build_cmd = 'bun run build', cmd = 'bun run start', use_infisical = False, use_shared_libs = True, use_prisma = True, use_golden = True, manifest = None):
     parts = []
     migrator_name_match = (
         resource_name == 'migrator'

package/engine/topologies/platform/docker/layers/l2_dependency_layers.star

@@ -86,8 +86,6 @@ def L2_generate_dependency_manifest(res_path, manager = RUNTIME, use_golden = Tr
     # Normalize res_path for Docker COPY (must be relative to build context)
     res_path_rel = normalize_res_path(res_path)
 
-    lockfile = "bun.lock*"
-
     # Prefer golden L2 image when enabled and defined; fall back to plain Bun image.
     base_image = GOLDEN_L2_IMAGE if (use_golden and GOLDEN_L2_IMAGE) else BUN_BASE
     use_golden_for_manifest = base_image == GOLDEN_L2_IMAGE
@@ -125,7 +123,6 @@ RUN echo '🔍 DEPENDENCY INSTALLATION DIAGNOSTICS (debug)' && \\
         + "WORKDIR /app/" + res_path + "\n"
         + "COPY " + res_path_rel + "/package.json ./package.json\n"
         + "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['npmrc_docker'] + " .npmrc\n"
-        + "COPY " + lockfile + " ./\n"
         + "COPY " + res_path_rel + "/" + AUTOGENERATED_CONFIG_PATHS['bunfig_docker'] + " .bunfig.toml\n"
         + "\n"
         + diagnostics_block

package/engine/topologies/platform/docker/layers/l3_builder_layers.star

@@ -50,7 +50,7 @@ GOLDEN_L3_BACKEND_IMAGE = _docker_cfg.get('golden_l3_backend_image', _GOLDEN_PRE
 GOLDEN_L3_FRONTEND_IMAGE = _docker_cfg.get('golden_l3_frontend_image', _GOLDEN_PREFIX + '-l3-frontend:latest')
 
 
-def L3_generate_backend_compiler(res_path, build_cmd = RUNTIME_CONFIG["bun"]["backend_start_command"], use_prisma = True, use_shared_libs = True, use_infisical = True, use_golden = True, has_prisma_config = False):
+def L3_generate_backend_compiler(res_path, build_cmd = RUNTIME_CONFIG["bun"]["backend_start_command"], use_prisma = True, use_shared_libs = True, use_infisical = False, use_golden = True, has_prisma_config = False):
     """
     Generate the backend compiler layer for TypeScript services.
 

package/engine/topologies/platform/docker/layers/l4_runtime_layers.star

@@ -55,7 +55,7 @@ GOLDEN_L4_FRONTEND_IMAGE = _docker_cfg.get('golden_l4_frontend_image', _GOLDEN_P
 _docker_health = get_docker_healthcheck_config()
 
 
-def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun run start', use_infisical = True, resource_name = 'service', use_golden = True, use_prisma = True, has_prisma_config = False, manifest = None):
+def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun run start', use_infisical = False, resource_name = 'service', use_golden = True, use_prisma = True, has_prisma_config = False, manifest = None):
     """
     Generate the backend runtime layer for deployed services.
 

package/engine/topologies/platform/docker/secrets/infisical.star

@@ -1,12 +1,13 @@
 # =============================================================================
-# 🔐 INFISICAL ENVIRONMENT GENERATOR (Refactored)
+# 🔐 LOCAL ENVIRONMENT GENERATOR
 # =============================================================================
-# Uses Starlark generators for consistent secret management
+# Free-tier service env injection. Premium overlays may replace this module with
+# Infisical-backed secret injection.
 # =============================================================================
 #
 # This module provides:
-#   - Environment variable generation for Infisical integration
-#   - Uses SecretsGenerator for consistent configuration
+#   - Environment variable generation for docker-compose/.env injection
+#   - No external secret manager required in the public/free engine
 #
 # Usage:
 #   load("../secrets/infisical.star", "InfisicalEnv")
@@ -14,8 +15,6 @@
 # =============================================================================
 
 load("../constants.star", "PlatformDockerConstants")
-load("../../../tilt/generators/infisical/secrets_generator.star", "SecretsGenerator")
-load("../../../tilt/generators/infisical/path_manager.star", "PathManager")
 
 def _get_infisical_base_url():
     """Get the Infisical base URL."""
@@ -23,9 +22,11 @@ def _get_infisical_base_url():
 
 def get_infisical_environment_vars(as_array=True, resource_name=None, resource_type="backend"):
     """
-    Generate environment variables for Infisical integration.
-    
-    Uses Starlark generators for consistent configuration.
+    Generate environment variables for local Compose/.env injection.
+
+    Kept under the historical function name so existing Starlark callers do not
+    break. The free engine intentionally avoids Infisical credentials; premium
+    overlays can replace this implementation with a real secret-provider bridge.
     
     Args:
         as_array: If True, return as YAML array format; else as dict format
@@ -35,52 +36,23 @@ def get_infisical_environment_vars(as_array=True, resource_name=None, resource_t
     Returns:
         String with environment variables in YAML format
     """
-    infisical_url = _get_infisical_base_url()
-    
-    if resource_name:
-        # Use generator for service-specific configuration
-        secret_path = PathManager.get_known_resource_path(resource_name)
-        if not secret_path:
-            path_plan = PathManager.plan_resource_path(resource_name, resource_type)
-            secret_path = path_plan["full_path"]
-        
-        config = SecretsGenerator.generate_for_service(
-            resource_name=resource_name,
-            secret_path=secret_path,
-            resource_type=resource_type,
-        )
-        
-        env = config["docker_compose"]["environment"]
-        
-        if as_array:
-            lines = []
-            for key, value in env.items():
-                lines.append("      - {}={}".format(key, value))
-            return "\n".join(lines)
-        else:
-            lines = []
-            for key, value in env.items():
-                lines.append("      {}: {}".format(key, value))
-            return "\n".join(lines)
-    
-    # Fallback to base configuration (no service-specific paths)
-    base_env = {
-        "INFISICAL_CLIENT_ID": "${INFISICAL_CLIENT_ID:-}",
-        "INFISICAL_CLIENT_SECRET": "${INFISICAL_CLIENT_SECRET:-}",
-        "INFISICAL_PROJECT_ID": "${INFISICAL_PROJECT_ID:-}",
-        "INFISICAL_SITE_URL": "${INFISICAL_SITE_URL:-" + infisical_url + "}",
-        "INFISICAL_ENV": "${INFISICAL_ENV:-dev}",
-        "INFISICAL_ENABLED": "${INFISICAL_ENABLED:-true}",
+    env = {
+        "TDK_SECRET_PROVIDER": "${TDK_SECRET_PROVIDER:-env-file}",
+        "TDK_ENV": "${TILT_ENV:-development}",
     }
+
+    if resource_name:
+        env["TDK_RESOURCE_NAME"] = resource_name
+        env["TDK_RESOURCE_TYPE"] = resource_type
     
     if as_array:
         lines = []
-        for key, value in base_env.items():
+        for key, value in env.items():
             lines.append("      - {}={}".format(key, value))
         return "\n".join(lines)
     else:
         lines = []
-        for key, value in base_env.items():
+        for key, value in env.items():
             lines.append("      {}: {}".format(key, value))
         return "\n".join(lines)
 

package/engine/topologies/tilt/resources/orchestrator/apply_migrator_orchestration.star

@@ -69,7 +69,7 @@ def register_migrators(resource_config, ctx, runtime_flags, compose_project_name
         target_path='/app/dist',
         build_cmd='echo "No build needed for migrator"',
         cmd='bun run db:migrate',
-        use_infisical=True,
+        use_infisical=False,
         use_shared_libs=True,
         use_prisma=True,
         use_golden=should_enable('golden-image'),