@tdk-landscape/tdk-cli-core 1.3.71 → 1.3.73

package/CHANGELOG.md

@@ -4,6 +4,14 @@ Notable changes to the `tdk` CLI. Versions match [npm](https://www.npmjs.com/pac
 
 ## Unreleased
 
+- Free-tier projects no longer start the `sablier` and `wake-gateway` containers, and Traefik no longer downloads the Sablier plugin from GitHub on every start. They were always launched (the `sablier` one with a read-write Docker socket) even though the license only gated the per-service labels, so nothing could use them. They are now generated only when a license grants Sablier. Fewer containers, one image build less, and no network fetch at Traefik boot. Spotted in the ERP CI run log.
+
+## 1.3.72 (2026-09-28)
+
+- `tdk doctor` no longer fails with "Verdaccio is not reachable" when the project config enables Verdaccio but no Premium license grants it. TDK does not start Verdaccio in that case, so the check could never pass; it is now skipped with a note. A registry your own `.npmrc` points at (`:4873`) is still checked. Found by the ERP CI workflow.
+
+## 1.3.71 (2026-09-28)
+
 - `tdk project` in a freshly cloned repo (one that already has `.tdk/project.json`) now creates the missing `.env` with working defaults. Before, it regenerated the configs but left no `.env`, and `tdk doctor` then failed with "set VERDACCIO_URL_DOCKER=<value>". Doctor now says to run `tdk project` when there is no `.env` at all. Found by the ERP CI workflow.
 
 ## 1.3.70 (2026-09-28)

package/cli/dist/commands/doctor.js

@@ -3,8 +3,9 @@ import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { dirname, join, normalize } from "node:path";
 import chalk from "chalk";
 import { Command } from "commander";
+import { hasVerdaccioLicense } from "../generator/extension-fetch.js";
 import { MASTER_CONFIG_FILES, QUICKSTART_DOCS_URL, REQUIRED_PACKAGE_SCRIPTS, } from "../utils/constants.js";
-import { checkHealthRoutes, checkHostPorts, checkIngressPorts, checkPrivateNpmRegistry, checkTiltResourceHealth, summarizeServiceProbes, } from "../utils/doctor-runtime.js";
+import { checkHealthRoutes, checkHostPorts, checkIngressPorts, checkPrivateNpmRegistry, checkTiltResourceHealth, projectConfigEnablesVerdaccio, summarizeServiceProbes, } from "../utils/doctor-runtime.js";
 import { validateEnvFile } from "../utils/env-validator.js";
 import { formatCount } from "../utils/formatting.js";
 import { findProjectRoot } from "../utils/paths.js";
@@ -755,7 +756,13 @@ export const doctorCommand = new Command("doctor")
         // Preflight: a local Postgres or web server on 5432/80/443.
         () => checkHostPorts(),
         // Preflight: Verdaccio down causes ImageBuild bun install ConnectionRefused.
-        checkPrivateNpmRegistry,
+        async () => {
+            const root = findProjectRoot() ?? process.cwd();
+            const licensed = projectConfigEnablesVerdaccio(root)
+                ? await hasVerdaccioLicense(root)
+                : true;
+            return checkPrivateNpmRegistry(execSync, root, undefined, licensed);
+        },
         // Runtime checks: skip gracefully if the stack isn't started yet.
         checkContainerResourceHealth,
         // When Tilt is up, surface red resources (Traefik/apps never started).

package/cli/dist/utils/doctor-runtime.js

@@ -175,23 +175,20 @@ export function summarizeTiltBuildError(error) {
 export function isRegistryRelatedBuildError(error) {
     return /ConnectionRefused downloading package manifest|Verdaccio|private registry|dependency install failed during ImageBuild|install-deps\.sh|bun install/i.test(error);
 }
-export function projectExpectsVerdaccio(projectRoot = findProjectRoot() ?? process.cwd()) {
+export function projectConfigEnablesVerdaccio(projectRoot = findProjectRoot() ?? process.cwd()) {
     const projectJsonPath = join(projectRoot, ".tdk", "project.json");
-    if (existsSync(projectJsonPath)) {
-        try {
-            const parsed = JSON.parse(readFileSync(projectJsonPath, "utf-8"));
-            if (parsed.optional_infra?.verdaccio === true) {
-                return true;
-            }
-            if (Object.values(parsed.phases ?? {}).some((phase) => (phase.enabledStacks ?? []).includes("verdaccio"))) {
-                return true;
-            }
-        }
-        catch {
-            // Fall through to npmrc heuristics.
-        }
+    if (!existsSync(projectJsonPath))
+        return false;
+    try {
+        const parsed = JSON.parse(readFileSync(projectJsonPath, "utf-8"));
+        return (parsed.optional_infra?.verdaccio === true ||
+            Object.values(parsed.phases ?? {}).some((phase) => (phase.enabledStacks ?? []).includes("verdaccio")));
     }
-    // Heuristic: scoped private registry pointed at :4873
+    catch {
+        return false;
+    }
+}
+function npmrcPointsAtVerdaccio(projectRoot) {
     for (const candidate of [join(projectRoot, ".npmrc"), join(projectRoot, "package.json")]) {
         if (!existsSync(candidate))
             continue;
@@ -207,13 +204,24 @@ export function projectExpectsVerdaccio(projectRoot = findProjectRoot() ?? proce
     }
     return false;
 }
+export function projectExpectsVerdaccio(projectRoot = findProjectRoot() ?? process.cwd()) {
+    return projectConfigEnablesVerdaccio(projectRoot) || npmrcPointsAtVerdaccio(projectRoot);
+}
 /**
  * When the project uses a local Verdaccio registry, fail early with a clear
  * fix instead of only showing truncated ImageBuild exit codes later.
  */
 export function checkPrivateNpmRegistry(exec = execSync, projectRoot = findProjectRoot() ?? process.cwd(), registryUrl = process.env.VERDACCIO_URL ??
     process.env.NPM_REGISTRY_URL ??
-    DEFAULT_VERDACCIO_URL) {
+    DEFAULT_VERDACCIO_URL, verdaccioLicensed = true) {
+    if (!verdaccioLicensed && !npmrcPointsAtVerdaccio(projectRoot)) {
+        return {
+            name: "Private npm registry",
+            didPass: true,
+            isSkipped: true,
+            message: "Verdaccio is enabled in the project config but needs a Premium license, so TDK will not start it - skipped",
+        };
+    }
     if (!projectExpectsVerdaccio(projectRoot)) {
         return {
             name: "Private npm registry",

package/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tdk-cli-internal",
   "private": true,
-  "version": "1.3.71",
+  "version": "1.3.73",
   "description": "TDK CLI - Tilt Development Kit command line interface",
   "keywords": [
     "tdk",

package/engine/topologies/platform/docker/compose/traefik_standalone.star

@@ -10,8 +10,14 @@ load("../config/healthcheck.star", "compose_healthcheck_timing")
 load("../networking/traefik_static_routes.star", "normalize_abs_path")
 
 
-def generate_standalone_traefik_compose():
-    """Minimal Traefik that routes Docker labels on api.{project}.localhost."""
+def generate_standalone_traefik_compose(sablier_enabled = False):
+    """Minimal Traefik that routes Docker labels on api.{project}.localhost.
+
+    The Sablier plugin, the sablier container and the wake gateway are only
+    emitted when sablier_enabled is True (a license grants "sablier"). Without
+    it they would run for nothing: a container holding a read-write Docker
+    socket, an image build, and a plugin download from GitHub on every start.
+    """
     network = PlatformDockerConstants.NETWORK_TRAEFIK_PUBLIC
     name = PlatformDockerConstants.PROJECT_NAME
     return """###############################################################################
@@ -24,10 +30,7 @@ services:
     image: traefik:v3.6.8
     container_name: {name}_traefik
     restart: unless-stopped
-    depends_on:
-      - sablier
-      - wake-gateway
-    command:
+{traefik_depends_on}    command:
       - "--api.insecure=true"
       - "--ping=true"
       - "--providers.docker=true"
@@ -44,12 +47,7 @@ services:
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
       - "--log.level=INFO"
-      # On-demand scaling: routes to stopped containers (opt-in via a
-      # resource's `sablier:` manifest block), keeps idle services from
-      # burning memory. Requires Traefik >=3.6 (see allownonrunning below).
-      - "--experimental.plugins.sablier.moduleName=github.com/sablierapp/sablier-traefik-plugin"
-      - "--experimental.plugins.sablier.version=v1.3.1"
-    ports:
+{sablier_flags}    ports:
       - "80:80"
       - "8080:8080"
     volumes:
@@ -60,7 +58,66 @@ services:
     healthcheck:
       test: ["CMD", "traefik", "healthcheck", "--ping"]
 {healthcheck_timing}
-  sablier:
+{sablier_services}networks:
+  traefik-public:
+    name: {network}
+    external: true
+""".format(
+        name=name,
+        network=network,
+        healthcheck_timing=compose_healthcheck_timing(10),
+        traefik_depends_on=_SABLIER_DEPENDS_ON if sablier_enabled else "",
+        sablier_flags=_SABLIER_FLAGS if sablier_enabled else "",
+        sablier_services=_SABLIER_SERVICES.format(
+            name=name,
+            gateway_container=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_CONTAINER,
+            gateway_port=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_PORT,
+            vendored_gateway_dir="tdk-cli-ext/engine/assets/docker/wake-gateway",
+            tilt_dev_dir=os.environ.get("HOME", "") + "/.tilt-dev",
+            project_root_mount=_project_root_mount(),
+        ) if sablier_enabled else "",
+        dynamic_dir_name=PlatformDockerConstants.TRAEFIK_DYNAMIC_DIR_REL.split("/")[-1],
+        vendored_gateway_dir="tdk-cli-ext/engine/assets/docker/wake-gateway",
+        gateway_container=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_CONTAINER,
+        gateway_port=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_PORT,
+        tilt_dev_dir=os.environ.get("HOME", "") + "/.tilt-dev",
+        project_root_mount=_project_root_mount(),
+    )
+
+
+def _project_root_mount():
+    """Read-only mount of the project at its own absolute host path.
+
+    The gateway runs `docker compose up --no-build` for a deferred resource
+    itself (bypassing Tilt's build queue), using the compose files Tilt uses.
+    Compose resolves relative paths in them (env_file etc.) client-side, so
+    they must exist at the same absolute paths inside the gateway container.
+    Empty when TDK_PROJECT_ROOT is unset (the generated Tiltfile sets it).
+    """
+    root = project_root_abspath()
+    if not root:
+        return ""
+    return "\n      - " + root + ":" + root + ":ro"
+
+
+def project_root_abspath():
+    """Absolute, normalized project root (TDK_PROJECT_ROOT), or "" when unset."""
+    return normalize_abs_path(os.environ.get("TDK_PROJECT_ROOT", ""))
+
+
+_SABLIER_DEPENDS_ON = """    depends_on:
+      - sablier
+      - wake-gateway
+"""
+
+_SABLIER_FLAGS = """      # On-demand scaling: routes to stopped containers (opt-in via a
+      # resource's `sablier:` manifest block), keeps idle services from
+      # burning memory. Requires Traefik >=3.6 (see allownonrunning below).
+      - "--experimental.plugins.sablier.moduleName=github.com/sablierapp/sablier-traefik-plugin"
+      - "--experimental.plugins.sablier.version=v1.3.1"
+"""
+
+_SABLIER_SERVICES = """  sablier:
     image: sablierapp/sablier:1.18.0
     container_name: {name}_sablier
     restart: unless-stopped
@@ -96,38 +153,4 @@ services:
     networks:
       - traefik-public
 
-networks:
-  traefik-public:
-    name: {network}
-    external: true
-""".format(
-        name=name,
-        network=network,
-        healthcheck_timing=compose_healthcheck_timing(10),
-        dynamic_dir_name=PlatformDockerConstants.TRAEFIK_DYNAMIC_DIR_REL.split("/")[-1],
-        vendored_gateway_dir="tdk-cli-ext/engine/assets/docker/wake-gateway",
-        gateway_container=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_CONTAINER,
-        gateway_port=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_PORT,
-        tilt_dev_dir=os.environ.get("HOME", "") + "/.tilt-dev",
-        project_root_mount=_project_root_mount(),
-    )
-
-
-def _project_root_mount():
-    """Read-only mount of the project at its own absolute host path.
-
-    The gateway runs `docker compose up --no-build` for a deferred resource
-    itself (bypassing Tilt's build queue), using the compose files Tilt uses.
-    Compose resolves relative paths in them (env_file etc.) client-side, so
-    they must exist at the same absolute paths inside the gateway container.
-    Empty when TDK_PROJECT_ROOT is unset (the generated Tiltfile sets it).
-    """
-    root = project_root_abspath()
-    if not root:
-        return ""
-    return "\n      - " + root + ":" + root + ":ro"
-
-
-def project_root_abspath():
-    """Absolute, normalized project root (TDK_PROJECT_ROOT), or "" when unset."""
-    return normalize_abs_path(os.environ.get("TDK_PROJECT_ROOT", ""))
+"""

package/engine/topologies/tilt/resources/infra-loader.star

@@ -20,6 +20,7 @@
 
 load("../../platform/docker/constants.star", "PlatformDockerConstants")
 load("../../platform/docker/compose/traefik_standalone.star", "generate_standalone_traefik_compose")
+load("../../platform/docker/networking/sablier_container_cycle.star", "sablier_middleware_suffix")
 load("../../platform/registries/verdaccio_loader.star", "load_verdaccio")
 
 # =============================================================================
@@ -194,7 +195,11 @@ def _load_standalone_traefik(root_prefix, env_file, write_fn):
     """Generate and load a self-contained Traefik compose for standalone projects."""
     _stop_conflicting_traefik()
     compose_rel = ".tdk/.tdk-out/docker-compose.traefik.yml"
-    content = generate_standalone_traefik_compose()
+    # The free-tier stub always reports "disabled"; the licensed module reports
+    # enabled for a manifest that opts in. Probing it keeps this file free of any
+    # license logic while starting the sablier containers only when they can work.
+    _, sablier_enabled = sablier_middleware_suffix({"sablier": {"enable": True}}, "probe")
+    content = generate_standalone_traefik_compose(sablier_enabled)
     if write_fn:
         write_fn(compose_rel, content)
     compose_file = root_prefix + compose_rel if root_prefix else compose_rel

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdk-landscape/tdk-cli-core",
-  "version": "1.3.71",
+  "version": "1.3.73",
   "description": "Run 100 microservices on a 16 GB laptop without Kubernetes. Scaffold services and run them locally with hot reload, built on Tilt.",
   "homepage": "https://tdk-landscape.github.io/tdk-website",
   "repository": {