@tdk-landscape/tdk-cli-core 1.3.51 → 1.3.52

package/engine/assets/docker/golden-layers.Dockerfile

@@ -7,7 +7,7 @@
 # 2. Or update service.json
 #
 # Generation Source: GoldenImage.generate_layered_dockerfile()
-# Service: beauty-crm-l1-l4
+# Service: tdk-project-l1-l4
 # Type: GOLDEN LAYERED IMAGES | L1-L4 Pre-built Layers
 ###############################################################################
 
@@ -15,14 +15,14 @@
 # 🏗️ GOLDEN LAYERED IMAGES - Multi-Stage Base Images
 # =============================================================================
 # This Dockerfile builds 8 golden images:
-#   - beauty-crm-l1:latest - OS base + Bun runtime
-#   - beauty-crm-l2:latest - Dependencies installed
-#   - beauty-crm-l3-backend:latest - Backend build tools (Prisma, no Infisical CLI)
-#   - beauty-crm-l3-frontend:latest - Frontend build tools (no Prisma)
-#   - beauty-crm-l3-migrator:latest - Migrator build tools (Prisma, no Infisical CLI)
-#   - beauty-crm-l4-backend:latest - Backend production runtime
-#   - beauty-crm-l4-frontend:latest - Frontend production runtime (Nginx)
-#   - beauty-crm-l4-migrator:latest - Migrator production runtime
+#   - tdk-project-l1:latest - OS base + Bun runtime
+#   - tdk-project-l2:latest - Dependencies installed
+#   - tdk-project-l3-backend:latest - Backend build tools (Prisma, no Infisical CLI)
+#   - tdk-project-l3-frontend:latest - Frontend build tools (no Prisma)
+#   - tdk-project-l3-migrator:latest - Migrator build tools (Prisma, no Infisical CLI)
+#   - tdk-project-l4-backend:latest - Backend production runtime
+#   - tdk-project-l4-frontend:latest - Frontend production runtime (Nginx)
+#   - tdk-project-l4-migrator:latest - Migrator production runtime
 #
 # Services use these as base images to skip heavy dependency installation.
 #
@@ -38,7 +38,7 @@
 # =============================================================================
 FROM oven/bun:1.3.11-alpine AS l1_golden
 
-LABEL layer="l1"       description="OS base with runtime environment"       maintainer="beauty-crm"
+LABEL layer="l1"       description="OS base with runtime environment"       maintainer="tdk-project"
 
 # System dependencies for all services
 RUN apk add --no-cache     ca-certificates     tzdata     curl     file     bash     openssl
@@ -57,7 +57,7 @@ WORKDIR /app
 # =============================================================================
 FROM l1_golden AS l2_golden
 
-LABEL layer="l2"       description="Base with common dependencies installed"       maintainer="beauty-crm"
+LABEL layer="l2"       description="Base with common dependencies installed"       maintainer="tdk-project"
 
 # Install minimal debugging tools (removed: vim, python3, make, g++ = -67MB)
 RUN apk add --no-cache     curl     netcat-openbsd     jq     bind-tools
@@ -74,7 +74,7 @@ RUN echo "Bun version: $(bun --version)"
 # =============================================================================
 FROM l2_golden AS l3_backend_golden
 
-LABEL layer="l3-backend"       description="Backend build tools with Prisma"       maintainer="beauty-crm"
+LABEL layer="l3-backend"       description="Backend build tools with Prisma"       maintainer="tdk-project"
 
 # Install Prisma CLI globally (pinned for deterministic builds)
 RUN bun add -g prisma@7.5.0 @prisma/client@7.5.0
@@ -94,7 +94,7 @@ RUN echo "Prisma version: $(bunx prisma --version | head -1)"
 # =============================================================================
 FROM l2_golden AS l3_frontend_golden
 
-LABEL layer="l3-frontend"       description="Frontend build tools without Prisma"       maintainer="beauty-crm"
+LABEL layer="l3-frontend"       description="Frontend build tools without Prisma"       maintainer="tdk-project"
 
 # Frontend doesn't need Prisma, just verify Bun
 RUN echo "Bun version: $(bun --version)"
@@ -105,7 +105,7 @@ RUN echo "Bun version: $(bun --version)"
 # =============================================================================
 FROM l2_golden AS l3_migrator_golden
 
-LABEL layer="l3-migrator"       description="Migrator build tools with Prisma"       maintainer="beauty-crm"
+LABEL layer="l3-migrator"       description="Migrator build tools with Prisma"       maintainer="tdk-project"
 
 # Install Prisma CLI globally (required for migrations, pinned)
 RUN bun add -g prisma@7.5.0 @prisma/client@7.5.0
@@ -125,7 +125,7 @@ RUN echo "Prisma version: $(bunx prisma --version | head -1)"
 # =============================================================================
 FROM l1_golden AS l4_backend_bun
 
-LABEL layer="l4-backend-bun"       description="Backend production runtime (Bun)"       maintainer="beauty-crm"
+LABEL layer="l4-backend-bun"       description="Backend production runtime (Bun)"       maintainer="tdk-project"
 
 ENV NODE_ENV=production
 
@@ -150,7 +150,7 @@ WORKDIR /app
 # =============================================================================
 FROM node:22-alpine AS l4_backend_node
 
-LABEL layer="l4-backend-node"       description="Backend production runtime (Node.js - lightweight)"       maintainer="beauty-crm"
+LABEL layer="l4-backend-node"       description="Backend production runtime (Node.js - lightweight)"       maintainer="tdk-project"
 
 ENV NODE_ENV=production
 
@@ -180,7 +180,7 @@ FROM l4_backend_bun AS l4_backend_golden
 # =============================================================================
 FROM nginx:alpine AS l4_frontend_golden
 
-LABEL layer="l4-frontend"       description="Frontend production runtime with Nginx"       maintainer="beauty-crm"
+LABEL layer="l4-frontend"       description="Frontend production runtime with Nginx"       maintainer="tdk-project"
 
 ENV NODE_ENV=production
 
@@ -198,7 +198,7 @@ WORKDIR /usr/share/nginx/html
 # =============================================================================
 FROM l1_golden AS l4_migrator_golden
 
-LABEL layer="l4-migrator"       description="Migrator runtime with Prisma"       maintainer="beauty-crm"
+LABEL layer="l4-migrator"       description="Migrator runtime with Prisma"       maintainer="tdk-project"
 
 ENV NODE_ENV=production
 

package/engine/assets/docker/wake-gateway/decide.test.ts

@@ -1,8 +1,12 @@
 import { describe, expect, test } from "bun:test";
 import {
   COMPOSE_START_TIMEOUT_MS,
+  EARLY_RESPONSE_MS,
+  MAX_EARLY_RESPONSE_MS,
+  RETRY_AFTER_SECONDS,
   TILT_TRIGGER_TIMEOUT_MS,
   decideWakeAction,
+  earlyResponseMs,
   evaluateReadiness,
   wakeTimeoutMs,
 } from "./decide";
@@ -112,6 +116,27 @@ describe("wakeTimeoutMs", () => {
   });
 });
 
+describe("earlyResponseMs", () => {
+  test("holds a waking request for EARLY_RESPONSE_MS by default", () => {
+    expect(earlyResponseMs()).toBe(EARLY_RESPONSE_MS);
+  });
+
+  test("the default answers well before Bun's 255s idle cap drops the connection", () => {
+    expect(EARLY_RESPONSE_MS).toBeLessThan(255_000);
+  });
+
+  test("an explicit X-Wake-Respond-Within-Ms wins, but is capped under Bun's idle limit", () => {
+    expect(earlyResponseMs(5_000)).toBe(5_000);
+    expect(earlyResponseMs(600_000)).toBe(MAX_EARLY_RESPONSE_MS);
+    expect(MAX_EARLY_RESPONSE_MS).toBeLessThan(255_000);
+  });
+
+  test("tells the caller to retry soon", () => {
+    expect(RETRY_AFTER_SECONDS).toBeGreaterThan(0);
+    expect(RETRY_AFTER_SECONDS * 1000).toBeLessThan(EARLY_RESPONSE_MS);
+  });
+});
+
 describe("evaluateReadiness", () => {
   test("ready once every required name reports healthy", () => {
     const outcome = evaluateReadiness(["a", "b"], { a: true, b: true });

package/engine/assets/docker/wake-gateway/decide.ts

@@ -84,6 +84,25 @@ export function wakeTimeoutMs(startedViaCompose: boolean, overrideMs?: number):
   return startedViaCompose ? COMPOSE_START_TIMEOUT_MS : TILT_TRIGGER_TIMEOUT_MS;
 }
 
+/**
+ * How long a waking request is held before the gateway answers
+ * `503` + `Retry-After` while the start keeps going in the background.
+ * Found live (task 7.2): during a full `tdk up` bring-up the Docker daemon
+ * took ~5 min to start one container, and Bun.serve's 255s idle cap dropped
+ * the held connection with no response at all.
+ */
+export const EARLY_RESPONSE_MS = 60_000;
+/** Largest hold allowed: stays under Bun.serve's 255s idle cap. */
+export const MAX_EARLY_RESPONSE_MS = 240_000;
+/** The `Retry-After` value sent with the early 503. */
+export const RETRY_AFTER_SECONDS = 10;
+
+/** How long to hold a request: an explicit X-Wake-Respond-Within-Ms wins, capped under Bun's idle limit. */
+export function earlyResponseMs(overrideMs?: number): number {
+  if (overrideMs && overrideMs > 0) return Math.min(overrideMs, MAX_EARLY_RESPONSE_MS);
+  return EARLY_RESPONSE_MS;
+}
+
 export interface WaitOutcome {
   ready: boolean;
   /** Names still not running/healthy when the wait ended (empty when ready). */

package/engine/assets/docker/wake-gateway/server.ts

@@ -32,9 +32,14 @@
  *   X-Wake-Image           The image the compose service declares
  *                          (<service>_<resource>:dev).
  *   X-Wake-Timeout-Ms, X-Wake-Proxy-Port, X-Wake-Session-Duration
+ *   X-Wake-Respond-Within-Ms  How long to hold the request before answering
+ *                          503 + Retry-After while the start continues in the
+ *                          background (default decide.ts EARLY_RESPONSE_MS).
  */
 import {
+  RETRY_AFTER_SECONDS,
   decideWakeAction,
+  earlyResponseMs,
   evaluateReadiness,
   wakeTimeoutMs,
   type ContainerState,
@@ -168,6 +173,7 @@ function parseRequest(req: Request) {
   const container = req.headers.get("X-Wake-Container") || resource;
   const deps = parseDeps(req.headers.get("X-Wake-Deps") || "");
   const timeoutOverrideMs = Number(req.headers.get("X-Wake-Timeout-Ms")) || undefined;
+  const respondWithinOverrideMs = Number(req.headers.get("X-Wake-Respond-Within-Ms")) || undefined;
   const proxyPort = req.headers.get("X-Wake-Proxy-Port") || "80";
   const sessionDuration = req.headers.get("X-Wake-Session-Duration") || "10m";
   const composeFiles = (req.headers.get("X-Wake-Compose-Files") || "").split(",").filter(Boolean);
@@ -178,16 +184,62 @@ function parseRequest(req: Request) {
     image: req.headers.get("X-Wake-Image") || "",
   };
   const hasCompose = Boolean(compose.project && compose.files.length && compose.image);
-  return { resource, container, deps, timeoutOverrideMs, proxyPort, sessionDuration, compose, hasCompose };
+  return {
+    resource,
+    container,
+    deps,
+    timeoutOverrideMs,
+    respondWithinOverrideMs,
+    proxyPort,
+    sessionDuration,
+    compose,
+    hasCompose,
+  };
+}
+
+type WakeParams = ReturnType<typeof parseRequest>;
+type WakeOutcome = { ready: true } | { ready: false; timeoutMs: number };
+
+// One wake per resource at a time: a caller that got an early 503 and retries,
+// or a second caller arriving meanwhile, joins the wake already in progress
+// instead of starting the container again.
+const inflight = new Map<string, Promise<WakeOutcome>>();
+
+function wakeOnce(params: WakeParams): Promise<WakeOutcome> {
+  let wake = inflight.get(params.resource);
+  if (!wake) {
+    wake = runWake(params).finally(() => inflight.delete(params.resource));
+    inflight.set(params.resource, wake);
+  }
+  return wake;
 }
 
 async function handleWake(req: Request): Promise<Response> {
-  const { resource, container, deps, timeoutOverrideMs, proxyPort, sessionDuration, compose, hasCompose } =
-    parseRequest(req);
-  if (!resource) {
+  const params = parseRequest(req);
+  if (!params.resource) {
     return new Response("wake gateway: missing X-Wake-Resource header (set by the generated Traefik static route)", { status: 400 });
   }
 
+  const holdMs = earlyResponseMs(params.respondWithinOverrideMs);
+  const outcome = await Promise.race([wakeOnce(params), Bun.sleep(holdMs).then(() => null)]);
+  if (outcome === null) {
+    console.log(`wake ${params.resource}: still starting after ${holdMs}ms, answering 503`);
+    return new Response(
+      `wake gateway: ${params.resource} is starting; retry in ${RETRY_AFTER_SECONDS}s`,
+      { status: 503, headers: { "Retry-After": String(RETRY_AFTER_SECONDS) } },
+    );
+  }
+  if (outcome.ready) {
+    return proxyThrough(req, params.container, params.proxyPort);
+  }
+  return new Response(
+    `wake gateway: timed out after ${outcome.timeoutMs}ms waiting for ${params.resource} and its dependencies to become healthy`,
+    { status: 504 },
+  );
+}
+
+async function runWake(params: WakeParams): Promise<WakeOutcome> {
+  const { resource, container, deps, timeoutOverrideMs, sessionDuration, compose, hasCompose } = params;
   const resourceState = await containerState(container);
   const dependencies = await Promise.all(
     deps.map(async (dep) => ({ name: dep.resourceName, state: await containerState(dep.containerName) })),
@@ -225,8 +277,6 @@ async function handleWake(req: Request): Promise<Response> {
   ]);
 
   const requiredNames = [resource, ...deps.map((d) => d.resourceName)];
-  const containerByName: Record<string, string> = { [resource]: container };
-  for (const dep of deps) containerByName[dep.resourceName] = dep.containerName;
 
   while (Date.now() < deadline) {
     const healthy: Record<string, boolean> = {};
@@ -236,17 +286,12 @@ async function handleWake(req: Request): Promise<Response> {
     for (const dep of deps) {
       healthy[dep.resourceName] = await isHealthy(dep.containerName);
     }
-    const outcome = evaluateReadiness(requiredNames, healthy);
-    if (outcome.ready) {
-      return proxyThrough(req, container, proxyPort);
+    if (evaluateReadiness(requiredNames, healthy).ready) {
+      return { ready: true };
     }
     await Bun.sleep(POLL_INTERVAL_MS);
   }
-
-  return new Response(
-    `wake gateway: timed out after ${timeoutMs}ms waiting for ${resource} and its dependencies to become healthy`,
-    { status: 504 },
-  );
+  return { ready: false, timeoutMs };
 }
 
 // Headers that must not be forwarded verbatim to the upstream fetch: Host
@@ -258,6 +303,7 @@ const STRIPPED_REQUEST_HEADERS = new Set([
   "x-wake-container",
   "x-wake-deps",
   "x-wake-timeout-ms",
+  "x-wake-respond-within-ms",
   "x-wake-proxy-port",
   "x-wake-session-duration",
   "x-wake-compose-project",

package/engine/assets/scripts/mac-m1-resource-monitor.sh

@@ -84,7 +84,7 @@ while IFS= read -r container; do
         
         printf "%-20s\t%s%%\t%s\t%s\n" "$CONTAINER_DISPLAY" "$CPU_PERCENT" "$MEMORY_USAGE" "$STATUS"
     fi
-done <<< "$BEAUTY_CONTAINERS"
+done <<< "$PROJECT_CONTAINERS"
 
 echo ""
 echo -e "${BLUE}📈 Resource Summary:${NC}"

package/engine/scripts/debug-container.sh

@@ -13,6 +13,11 @@ YELLOW='\033[1;33m'
 BLUE='\033[0;34m'
 NC='\033[0m' # No Color
 
+# Container name filter: project name from .tdk/project.json (override with TDK_PROJECT_NAME)
+PROJECT_FILTER="${TDK_PROJECT_NAME:-$(sed -n 's/.*"name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' .tdk/project.json 2>/dev/null | head -1)}"
+PROJECT_FILTER="${PROJECT_FILTER:-tdk-project}"
+PROJECT_FILTER="${PROJECT_FILTER//-/[-_]}"
+
 # Help text
 show_help() {
     cat << EOF
@@ -68,11 +73,11 @@ EOF
 # List containers
 list_containers() {
     echo -e "${GREEN}=== Running Containers ===${NC}"
-    docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Image}}" | grep -i "beauty"
+    docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Image}}" | grep -iE "$PROJECT_FILTER"
     
     echo ""
     echo -e "${YELLOW}=== Recently Exited Containers ===${NC}"
-    docker ps -a --format "table {{.Names}}\t{{.Status}}\t{{.Image}}" | grep -i "beauty" | grep -i "exited"
+    docker ps -a --format "table {{.Names}}\t{{.Status}}\t{{.Image}}" | grep -iE "$PROJECT_FILTER" | grep -i "exited"
 }
 
 # Get container ID from service name
@@ -122,7 +127,7 @@ run_command() {
 # Show failed containers
 show_failed() {
     echo -e "${RED}=== Failed/Exited Containers ===${NC}"
-    docker ps -a --format "table {{.Names}}\t{{.Status}}\t{{.Image}}" | grep -i "beauty" | grep -iE "(exited|error)"
+    docker ps -a --format "table {{.Names}}\t{{.Status}}\t{{.Image}}" | grep -iE "$PROJECT_FILTER" | grep -iE "(exited|error)"
     
     echo ""
     echo -e "${YELLOW}To inspect logs of a failed container:${NC}"

package/engine/spec.master

@@ -62,7 +62,7 @@
 
 # PROJECT_ROOT is automatically set by Tiltfile based on where you run `tilt up`.
 # You don't need to set it. Example:
-#   - If you run in /home/dev/beauty-crm, PROJECT_ROOT = "/home/dev/beauty-crm"
+#   - If you run in /home/dev/tdk-project, PROJECT_ROOT = "/home/dev/tdk-project"
 #   - All other paths are built from this root.
 #
 # This file is manually maintained to match the directory structure.
@@ -563,7 +563,7 @@ FEATURES = struct(
 
 CONSTANTS = struct(
     # System identity - EXPLICIT
-    SYSTEM_NAME = "beauty-crm-tilt-platform",
+    SYSTEM_NAME = "tdk-project-tilt-platform",
     SYSTEM_VERSION = "2.0.0",
     
     # Runtimes - EXPLICIT supported options

package/engine/topologies/platform/docker/layers/prisma/prisma_build.star

@@ -110,7 +110,7 @@ def L3_generate_migration_engine(res_path, use_golden = True):
         + "COPY " + res_path_rel + "/" + OUTPUT.AUTOGENERATED_FOLDER + "/bunfig.docker.autogenerated.toml ./bunfig.toml\n"
         + "COPY bun.lock* ./\n"
         + "# Install runtime deps only for migrator image (skip test/dev toolchain)\n"
-        + "# NOTE: keep bunfig.toml (it carries the @beauty-crm/@tdk-landscape registry\n"
+        + "# NOTE: keep bunfig.toml (it carries the project/@tdk-landscape registry\n"
         + "# scopes pointing at Verdaccio) - deleting it forces scoped packages to fall\n"
         + "# back to the public npm registry and fail with ConnectionRefused/404.\n"
         + "RUN --mount=type=cache,target=/cache/bun,sharing=shared rm -f bun.lock bun.lockb && env -u CI BUN_CONFIG_FROZEN_LOCKFILE=false BUN_TMPDIR=/tmp BUN_INSTALL=/tmp/bun-install bun install --production --no-frozen-lockfile --concurrent-scripts --cache-dir=/cache/bun\n"

package/engine/topologies/tilt/common/utils.star

@@ -60,7 +60,7 @@ MIGRATED_PACKAGES = {
 load("../manifest/constants.star", "MANIFEST_FILENAME")
 
 # List of all shared platform networks
-# All networks use PROJECT_NAME format (e.g., beauty_crm_*)
+# All networks use PROJECT_NAME format (e.g., tdk_project_*)
 PLATFORM_NETWORKS = [
   PlatformDockerConstants.NETWORK_TRAEFIK_PUBLIC,
   PlatformDockerConstants.PROJECT_NAME + "_traefik-private",

package/engine/topologies/tilt/resources/orchestrator/apply_compose_resource_registration.star

@@ -244,7 +244,51 @@ def _wake_compose_invocation(project_root, resource_path, res_name, resource_nam
 
 def _register_docker_build(config, live_update_rules):
     """Register docker_build with live_update for hot-reload support."""
-    image_name = _app_image_name(config['resource_name'], config['res_name'])
+    TypescriptBuilders.build_typescript_service(
+        _app_image_name(config['resource_name'], config['res_name']),
+        config.get('project_root', '') or '.',
+        _resolve_dockerfile(config),
+        live_update_rules,
+        config['res_deps'],
+    )
+
+
+def _register_deferred_image_prebuild(config, auto_init_apps):
+    """Build a deferStart resource's image during `tdk up` without creating its container.
+
+    `auto_init=False` on the dc_resource skips its docker_build too (confirmed
+    live on tdk-erp-system, task 7.2), so a fresh project's first request would
+    find no image and the wake gateway would fall back to `tilt trigger`, which
+    queues behind every other build. This local_resource builds the same image
+    (same Dockerfile, `production` target, host network, and an allowlist
+    .dockerignore equivalent to docker_build's only=/ignore=) under the tag the
+    compose service declares, so the gateway can start it directly.
+    """
+    project_root = config.get('project_root', '')
+    dockerfile = _resolve_dockerfile(config)
+    prebuild_dockerfile = dockerfile + '.prebuild'
+    ignore_content = TypescriptBuilders.prebuild_dockerignore(dockerfile, project_root, config['res_path'])
+    # BuildKit reads `<dockerfile>.dockerignore` for `-f <dockerfile>`; the
+    # original Dockerfile already has a (denylist) one, hence the copy.
+    cmd = (
+        "cp '" + dockerfile + "' '" + prebuild_dockerfile + "'"
+        + " && printf '%s' '" + ignore_content + "' > '" + prebuild_dockerfile + ".dockerignore'"
+        + " && docker build --network host --target production"
+        + " -f '" + prebuild_dockerfile + "'"
+        + " -t '" + _app_image_name(config['resource_name'], config['res_name']) + "'"
+        + " '" + (project_root or '.') + "'"
+    )
+    local_resource(
+        name=config['res_name'] + '-image',
+        cmd=cmd,
+        labels=config['labels'],
+        resource_deps=config['res_deps'],
+        auto_init=auto_init_apps,
+    )
+
+
+def _resolve_dockerfile(config):
+    """Absolute (when project_root is set) path of a resource's Dockerfile."""
     project_root = config.get('project_root', '')
     # Use custom dockerfile from config if specified, otherwise use autogenerated default
     # The res_path is relative to project_root (e.g., 'services/product/...')
@@ -263,13 +307,7 @@ def _register_docker_build(config, live_update_rules):
             dockerfile = project_root + dockerfile
         else:
             dockerfile = project_root + '/' + dockerfile
-    TypescriptBuilders.build_typescript_service(
-        image_name,
-        project_root or '.',
-        dockerfile,
-        live_update_rules,
-        config['res_deps'],
-    )
+    return dockerfile
 
 
 def _register_run_only_resource(config, resource_path, compose_project_name, auto_init_apps=True):
@@ -318,9 +356,11 @@ def _register_single_resource(config, resource_path, compose_project_name, auto_
 
     # A sablier.enable + sablier.deferStart resource is held back from tdk up's
     # normal bring-up: its container is never created or started here, only via
-    # the Traefik wake path on first request. docker_build below is unaffected
-    # (it has no auto_init gate), so the image still builds either way.
-    effective_auto_init = auto_init_apps and not resource_defers_start(config.get('manifest', {}))
+    # the Traefik wake path on first request. auto_init=False also skips the
+    # dc_resource's docker_build, so its image is built by a separate
+    # `<name>-image` resource instead (_register_deferred_image_prebuild).
+    defers_start = resource_defers_start(config.get('manifest', {}))
+    effective_auto_init = auto_init_apps and not defers_start
 
     print("DEBUG REGISTER: Registering '{}' app_type='{}' auto_init={}".format(res_name, app_type, effective_auto_init))
 
@@ -333,6 +373,8 @@ def _register_single_resource(config, resource_path, compose_project_name, auto_
             config['syncs']
         )
         _register_docker_build(config, live_update_rules)
+        if defers_start:
+            _register_deferred_image_prebuild(config, auto_init_apps)
     else:
         print("DEBUG REGISTER: '{}' skipping docker_build (app_type='{}', syncs={})".format(res_name, app_type, config.get('syncs')))
 

package/engine/topologies/tilt/resources/orchestrator/builders/typescript.star

@@ -162,9 +162,29 @@ def _build_typescript_service(name, context, dockerfile, live_update_rules, deps
     )
 
 
+def prebuild_dockerignore(dockerfile, project_root, res_path):
+    """Allowlist .dockerignore matching _build_typescript_service's only=/ignore=.
+
+    A plain `docker build` has no only= filter, so without this it would send
+    the whole project root as context. `res_path` is relative to the project
+    root (the build context); `dockerfile` may be absolute.
+    """
+    abs_res = project_root + '/' + res_path if project_root else res_path
+    lines = ['*']
+    for path in _get_resource_only_paths(abs_res):
+        lines.append('!' + (res_path if path == abs_res else path))
+    ignores = _load_autogenerated_dockerignore_patterns(dockerfile, res_path)
+    for pattern in get_filewatch_ignore_patterns(res_path):
+        if pattern not in ignores:
+            ignores.append(pattern)
+    lines.extend(ignores)
+    return '\n'.join(lines) + '\n'
+
+
 TypescriptBuilders = struct(
     build_typescript_service = _build_typescript_service,
     load_dockerignore_patterns = _load_autogenerated_dockerignore_patterns,
+    prebuild_dockerignore = prebuild_dockerignore,
 )
 
 DEBUG = {}