@tdk-landscape/tdk-cli-core 1.3.75 → 1.3.77

package/cli/dist/utils/windows-doctor.js

@@ -0,0 +1,175 @@
+import { execFileSync } from "node:child_process";
+import { lookup } from "node:dns/promises";
+import { parsePublishedPortHolders, probeHostPort } from "./doctor-runtime.js";
+import { findProjectRoot } from "./paths.js";
+import { getProjectName } from "./service-urls.js";
+import { findOnPath } from "./which.js";
+const WINDOWS_DNS_FAILURE = "Windows did not resolve *.tdk.localhost to 127.0.0.1. Browser URLs with hostnames will fail until you fix hosts or use the 127.0.0.1 URLs printed by tdk networks.";
+function loopbackAddresses(addresses) {
+    return (addresses.length > 0 &&
+        addresses.every((address) => address === "127.0.0.1" || address === "::1"));
+}
+export function parseExcludedPortRanges(output) {
+    return output.split(/\r?\n/).flatMap((line) => {
+        const match = line.match(/^\s*(\d+)\s+(\d+)(?:\s|$)/);
+        return match ? [[Number(match[1]), Number(match[2])]] : [];
+    });
+}
+export function findExternallyOccupiedPorts(occupied, dockerHolders, projectName) {
+    const prefix = projectName.replace(/-/g, "_").toLowerCase();
+    return occupied.filter((port) => {
+        const holder = dockerHolders.find((candidate) => candidate.publishedPorts.includes(port));
+        if (!holder || !prefix)
+            return true;
+        const name = holder.name.toLowerCase();
+        return !name.startsWith(`${prefix}_`) && !name.startsWith(`${prefix}-`);
+    });
+}
+function checkDockerTool() {
+    return findOnPath("docker");
+}
+export function checkWindowsRuntimeTools() {
+    const docker = checkDockerTool();
+    if (!docker) {
+        return {
+            name: "Windows Runtime Tools",
+            didPass: false,
+            message: "Docker is not running. Start Docker Desktop, wait until it is Running, then retry tdk doctor.",
+            fix: "Install Docker Desktop and start it in Linux container mode.",
+        };
+    }
+    if (!findOnPath("tilt")) {
+        return {
+            name: "Windows Runtime Tools",
+            didPass: false,
+            message: "tilt.exe not found on PATH. Install Tilt from https://docs.tilt.dev/install.html",
+        };
+    }
+    const bun = findOnPath("bun");
+    const npmInstall = (process.argv[1] ?? "").toLowerCase().includes("node_modules");
+    const node = npmInstall ? findOnPath("node") : true;
+    if (!node) {
+        return {
+            name: "Windows Runtime Tools",
+            didPass: false,
+            message: "node.exe not found on PATH for this npm installation.",
+        };
+    }
+    return {
+        name: "Windows Runtime Tools",
+        didPass: true,
+        message: bun
+            ? `Docker (${docker}), Tilt, and Bun found on PATH`
+            : `Docker (${docker}) and Tilt found on PATH; ⚠️ Bun was not found (generated services need Bun)`,
+    };
+}
+export function checkWindowsDockerMode() {
+    try {
+        const osType = execFileSync(findOnPath("docker") ?? "docker", ["info", "--format", "{{.OSType}}"], {
+            encoding: "utf-8",
+            timeout: 10_000,
+            windowsHide: true,
+        }).trim();
+        if (osType.toLowerCase() === "windows") {
+            return {
+                name: "Docker container mode",
+                didPass: false,
+                message: "Docker Desktop is using Windows containers. Switch to Linux containers. TDK stacks are Linux images.",
+                fix: "Switch Docker Desktop to Linux containers. TDK does not run Windows containers.",
+            };
+        }
+        return {
+            name: "Docker container mode",
+            didPass: true,
+            message: "Docker Desktop is using Linux containers",
+        };
+    }
+    catch {
+        return {
+            name: "Docker container mode",
+            didPass: false,
+            message: "Docker is not running. Start Docker Desktop, wait until it is Running, then retry tdk doctor.",
+        };
+    }
+}
+export async function checkWindowsHostConfiguration() {
+    const warnings = [];
+    let excludedRanges = [];
+    try {
+        const output = execFileSync("netsh", ["interface", "ipv4", "show", "excludedportrange", "protocol=tcp"], { encoding: "utf-8", timeout: 10_000, windowsHide: true });
+        excludedRanges = parseExcludedPortRanges(output);
+    }
+    catch {
+        warnings.push("Could not inspect Windows Hyper-V excluded TCP port ranges.");
+    }
+    const requiredPorts = [80, 443, 5432];
+    const excluded = requiredPorts.filter((port) => excludedRanges.some(([start, end]) => port >= start && port <= end));
+    if (excluded.length > 0) {
+        warnings.push(`⚠️ Windows reserved port${excluded.length > 1 ? "s" : ""} ${excluded.join(", ")} for Hyper-V/WSL. Fix: disable the conflicting Windows feature or change TDK ports in project config. Common fix: run \`net stop winnat\` then \`net start winnat\` in an Administrator terminal, then retry \`tdk doctor\`.`);
+    }
+    const occupied = [];
+    for (const port of requiredPorts) {
+        if ((await probeHostPort(port)) === "in-use")
+            occupied.push(port);
+    }
+    let dockerHolders = [];
+    try {
+        const dockerPs = execFileSync(findOnPath("docker") ?? "docker", ["ps", "--format", "{{.Names}}\\t{{.Ports}}"], { encoding: "utf-8", timeout: 10_000, windowsHide: true });
+        dockerHolders = parsePublishedPortHolders(dockerPs, requiredPorts);
+    }
+    catch {
+        // Runtime checks report Docker daemon errors independently.
+    }
+    const projectName = findProjectRoot() ? getProjectName() : "";
+    const externallyOccupied = findExternallyOccupiedPorts(occupied, dockerHolders, projectName);
+    if (externallyOccupied.length > 0) {
+        try {
+            const owners = execFileSync("powershell.exe", [
+                "-NoProfile",
+                "-Command",
+                `$ports = '${externallyOccupied.join(",")}'.Split(','); foreach ($port in $ports) { Get-NetTCPConnection -LocalPort ([int]$port) -State Listen -ErrorAction SilentlyContinue | ForEach-Object { $connection = $_; $service = Get-CimInstance Win32_Service | Where-Object { $_.ProcessId -eq $connection.OwningProcess } | Select-Object -First 1; if ([int]$port -eq 80 -and ($service.Name -eq 'W3SVC' -or $connection.OwningProcess -eq 4)) { '80: IIS / World Wide Web Publishing (HTTP.sys)' } elseif ($service) { '{0}: {1}' -f $port, $service.DisplayName } else { '{0}: PID {1}' -f $port, $connection.OwningProcess } } }`,
+            ], { encoding: "utf-8", timeout: 10_000, windowsHide: true }).trim();
+            warnings.push(`⚠️ Ports ${externallyOccupied.join(", ")} are already listening${owners ? `:\n${owners}` : "."}`);
+        }
+        catch {
+            warnings.push(`⚠️ Ports ${externallyOccupied.join(", ")} are already in use.`);
+        }
+    }
+    let dnsOk = true;
+    for (const host of ["tdk.localhost", "example.tdk.localhost"]) {
+        try {
+            const records = await lookup(host, { all: true, verbatim: true });
+            if (!loopbackAddresses(records.map((record) => record.address)))
+                dnsOk = false;
+        }
+        catch {
+            dnsOk = false;
+        }
+    }
+    if (!dnsOk) {
+        warnings.push(`${WINDOWS_DNS_FAILURE}\nAdd these lines to C:\\Windows\\System32\\drivers\\etc\\hosts (Administrator Notepad):\n127.0.0.1 tdk.localhost\n127.0.0.1 example.tdk.localhost`);
+    }
+    try {
+        const autocrlf = execFileSync("git", ["config", "core.autocrlf"], {
+            encoding: "utf-8",
+            timeout: 5_000,
+            windowsHide: true,
+        }).trim();
+        if (autocrlf.toLowerCase() === "true") {
+            warnings.push("git core.autocrlf is true; generated files may get CRLF while Docker Linux containers expect LF. Recommended: git config core.autocrlf input in TDK repos.");
+        }
+    }
+    catch {
+        // No repository-local setting to report.
+    }
+    warnings.push("Docker Desktop Settings → Resources → File sharing must include this project directory.");
+    return {
+        name: "Windows ports and DNS",
+        didPass: dnsOk && externallyOccupied.length === 0,
+        message: warnings.length > 0
+            ? warnings.join("\n")
+            : "Required ports are available and TDK localhost DNS resolves to loopback",
+        ...(dnsOk ? {} : { fix: WINDOWS_DNS_FAILURE }),
+    };
+}
+//# sourceMappingURL=windows-doctor.js.map

package/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "tdk-cli-internal",
   "private": true,
-  "version": "1.3.75",
+  "version": "1.3.77",
   "description": "TDK CLI - Tilt Development Kit command line interface",
   "keywords": [
     "tdk",

package/cli/templates/TILT_RESOURCE_DEFAULTS.star.hbs

@@ -6,7 +6,6 @@
 # SYSTEM-GENERATED BY TDK CLI - DO NOT EDIT
 # Source: TDK Platform Standards v{{version}}
 # Output: .tdk/.tdk-out/
-# Generated: {{timestamp}}
 # Run 'tdk project' to update
 # =============================================================================
 
@@ -218,4 +217,4 @@ __all__ = [
     "HEALTH_CHECK_TIMEOUT",
     "NAMING_PATTERNS",
     "TRAEFIK_CONFIG",
-]
+]

package/cli/templates/TILT_TECH_STACK.star.hbs

@@ -6,7 +6,6 @@
 # SYSTEM-GENERATED BY TDK CLI - DO NOT EDIT
 # Source: TDK Platform Standards v{{version}}
 # Output: .tdk/.tdk-out/
-# Generated: {{timestamp}}
 # Run 'tdk project' to update
 # =============================================================================
 

package/cli/templates/Tiltfile.hbs

@@ -5,7 +5,6 @@
 # =============================================================================
 # SYSTEM-GENERATED BY TDK CLI - DO NOT EDIT
 # Source: .tdk/project.json
-# Generated: {{timestamp}}
 # Run 'tdk project' to regenerate
 # =============================================================================
 
@@ -279,9 +278,30 @@ if FOCUS_MODE and FOCUS_ENABLED_RESOURCES:
         else:
             _MATCHED = [kr for kr in _KNOWN_TILT_RESOURCES if kr != 'service-discovery-daemon' and kr.startswith(_R + '-')]
             _FILTERED_RESOURCES.extend(_MATCHED)
-    for _INFRA in ['init-networks', 'postgres', 'traefik', 'golden-layers-build']:
-        if _INFRA in _KNOWN_TILT_RESOURCES:
-            _FILTERED_RESOURCES.append(_INFRA)
+    # NATS is gated by the same 'database-management' should_enable() check as
+    # postgres (see infra-loader.star), so it belongs with the infra that is
+    # always kept enabled here -- otherwise config.set_enabled_resources()
+    # below disables it on every out-of-the-box `tdk up` (pre-alpha always
+    # activates this focus-filter branch), and any resource that enables the
+    # 'nats' feature never gets a broker to connect to.
+    #
+    # services/platform/messaging/docker-compose.yml is user-authored (TDK
+    # does not generate it) and may declare more than nats/redis -- e.g. a
+    # local mail catcher standing in for a managed email provider. Every
+    # service it declares is loaded via docker_compose() in infra-loader.star,
+    # so it must be enabled here too, or it is silently disabled the same way.
+    _ALWAYS_ENABLED_INFRA_RESOURCES = ['init-networks', 'postgres', 'traefik', 'golden-layers-build']
+    _messaging_compose_path = PROJECT_ROOT + '/services/platform/messaging/docker-compose.yml'
+    if str(local("test -f '" + _messaging_compose_path + "' && echo yes || echo no", quiet=True, echo_off=True)).strip() == 'yes':
+        # infra-loader.star only creates these Tilt resources when this file
+        # exists, so only add them here when they actually exist to add.
+        _messaging_compose_doc = read_yaml(_messaging_compose_path, default={})
+        for _messaging_svc_name in _messaging_compose_doc.get('services', {}).keys():
+            _ALWAYS_ENABLED_INFRA_RESOURCES.append(_messaging_svc_name)
+        if 'nats' not in _ALWAYS_ENABLED_INFRA_RESOURCES:
+            _ALWAYS_ENABLED_INFRA_RESOURCES.append('nats')
+    for _INFRA in _ALWAYS_ENABLED_INFRA_RESOURCES:
+        _FILTERED_RESOURCES.append(_INFRA)
     for _KR in _KNOWN_TILT_RESOURCES:
         if _KR.startswith('provision-db-'):
             _FILTERED_RESOURCES.append(_KR)

package/cli/templates/spec.master.hbs

@@ -6,7 +6,6 @@
 # SYSTEM-GENERATED BY TDK CLI - DO NOT EDIT
 # Source: .tdk/project.json + TDK Platform Standards v{{version}}
 # Output: .tdk/.tdk-out/
-# Generated: {{timestamp}}
 # Run 'tdk project' to update
 #
 # 🏗️ ARCHITECTURE: Project → Stack → Service (PSR Model)
@@ -169,7 +168,7 @@ BETA = FOCUS_BETA,
 # =============================================================================
 # 📝 CHANGE LOG
 # =============================================================================
-# {{timestamp}}: Generated by TDK CLI v{{version}}
+# Generated by TDK CLI v{{version}}
 # =============================================================================
 
 # =============================================================================

package/discovery/AGENTS.md

@@ -195,7 +195,7 @@ The discovery system now validates all manifests during the scan process:
 | Field | Validation |
 |-------|------------|
 | `appName` | Required, 3-64 chars, kebab-case (lowercase, numbers, hyphens) |
-| `appType` | Required, must be: backend, frontend, library, migrator, sdk, worker |
+| `appType` | Required, must be: backend, frontend, library, migrator, sdk, worker, bring-your-own |
 | `domain` | Required, must be a valid domain from `constants.star` |
 | `port` | Required, integer 3000-9999, appType-specific ranges enforced |
 | `features` | Optional, each must be a valid feature from `constants.star` |

package/discovery/constants.star

@@ -149,7 +149,7 @@ MAX_SCAN_TIMEOUT_MS = 5000    # 5 seconds per root (warn if exceeded)
 MAX_MANIFESTS_PER_ROOT = 110  # Warn if root has more manifests
 
 # Autogenerated files directory (relative to this file's location)
-PRODUCT_SNAPSHOT_DIR = "../../product_autogenerated_resource_manifests"
+PRODUCT_SNAPSHOT_DIR = ".tdk/.tdk-out/product_autogenerated_resource_manifests"
 
 PRODUCT_SNAPSHOT_FILES = {
     "services": "services.autogenerated.star",
@@ -160,6 +160,6 @@ PRODUCT_SNAPSHOT_FILES = {
     "readme": "README.autogenerated.md",
 }
 
-PRODUCT_TOPOLOGY_DIR = "../../product_autogenerated_services_list"
+PRODUCT_TOPOLOGY_DIR = ".tdk/.tdk-out/product_autogenerated_services_list"
 PRODUCT_STACKS_INDEX_FILE = "stacks.autogenerated.star"
 PRODUCT_STACK_RESOURCES_FILE = "resources.autogenerated.star"

package/discovery/discovery_orchestrator.star

@@ -77,7 +77,7 @@ def _determine_app_type(manifest, resource_path):
     Determine app type from manifest or service path.
     """
     # Check if manifest has explicit appType
-    if manifest.get("appType") in ["frontend", "backend", "library", "migrator", "sdk", "worker", "infra"]:
+    if manifest.get("appType") in ["frontend", "backend", "library", "migrator", "sdk", "worker", "infra", "bring-your-own"]:
         return manifest["appType"]
     
     # Extract from path
@@ -120,7 +120,7 @@ def normalize_manifest(manifest, resource_path):
 
     resource = {
         "name": app_name,
-        "dockerfile": app_name + "/" + dockerfile,
+        "dockerfile": dockerfile if app_type == "bring-your-own" else app_name + "/" + dockerfile,
         "syncs": syncs,
         "port": port,
         "stack": stack,

package/discovery/manifest/constants.star

@@ -28,7 +28,7 @@ MANIFEST_DEFAULTS = {
 }
 
 # Valid app types
-VALID_APP_TYPES = ["backend", "frontend", "library", "migrator", "sdk", "worker"]
+VALID_APP_TYPES = ["backend", "frontend", "library", "migrator", "sdk", "worker", "bring-your-own"]
 
 # Default syncs
 DEFAULT_SYNCS = ["src", "prisma"]

package/discovery/manifest/loading.star

@@ -39,7 +39,7 @@ def get_default_syncs_for_type(app_type, features=None):
     if features == None:
         features = []
 
-    syncs = list(DEFAULT_SYNCS.get(app_type, ['src', 'package.json']))
+    syncs = list(DEFAULT_SYNCS.get(app_type, [] if app_type == 'bring-your-own' else ['src', 'package.json']))
 
     # Add prisma to syncs if using prisma feature
     if app_type == 'backend' and 'prisma' in features and 'prisma' not in syncs:
@@ -261,7 +261,11 @@ def _apply_manifest_defaults(manifest, resource_path):
     features = result.get('featuresEnabled', [])
     result['usePrisma'] = 'prisma' in features
     result['useNats'] = 'nats' in features
-    result['useTraefik'] = 'traefik' in features or app_type in ['backend', 'sdk']
+    result['useTraefik'] = (
+        'traefik' in features
+        or app_type in ['backend', 'sdk']
+        or (app_type == 'bring-your-own' and result.get('exposeViaProxy', True))
+    )
 
     # Extract stack from path if not set
     if 'stack' not in result:
@@ -278,7 +282,7 @@ def _apply_manifest_defaults(manifest, resource_path):
     
     # 🎯 SMART TRAEFIK CONFIG (Convention over Configuration)
     # Apply to backends and SDKs that need Traefik routing
-    if result['useTraefik'] and app_type in ['backend', 'sdk']:
+    if result['useTraefik'] and app_type in ['backend', 'sdk', 'bring-your-own']:
         existing_traefik = result.get('traefik', {})
         # Use apiPath from root level if available, otherwise use default pattern
         root_api_path = result.get('apiPath')

package/discovery/registry.star

@@ -303,6 +303,16 @@ def _render_product_stacks_index(resources):
 
 def _write_file_if_changed(path, content):
     """Write file only if content changed. Returns True if written."""
+    normalized = path.replace('\\', '/').replace('./', '', 1)
+    if '..' in normalized.split('/') or not (
+        '/.autogenerated/' in normalized or
+        normalized.startswith('.autogenerated/') or
+        normalized.startswith('.tdk/.tdk-out/') or
+        normalized in ['Tiltfile', '.tiltignore'] or
+        (normalized.startswith('TILT_') and normalized.endswith('.star') and '/' not in normalized)
+    ):
+        fail("TDK discovery refused to write outside its generated-file allowlist: " + path)
+
     # Read existing file (returns empty string on error via shell)
     existing = str(local("cat " + path + " 2>/dev/null || echo ''", quiet=True, echo_off=True))
     
@@ -322,6 +332,8 @@ def generate_product_stack_topology():
     changes = 0
     for resource in APP_RESOURCES:
         stack = resource.get("name", "unknown")
+        if not stack or '/' in stack or '\\' in stack or stack == '..':
+            fail("Invalid stack name for generated topology path: " + str(stack))
         stack_file = PRODUCT_TOPOLOGY_DIR + "/" + stack + "/stack.star"
         if _write_file_if_changed(stack_file, _render_product_stack_file(resource)):
             changes += 1
@@ -443,7 +455,8 @@ def _generate_yaml_from_json_manifests():
         json_files = _find_manifest_files(root, MANIFEST_FILENAME)
         
         for json_file in json_files:
-            yaml_file = json_file.replace(MANIFEST_FILENAME, MANIFEST_FILENAME_YAML)
+            resource_dir = json_file.rsplit('/', 1)[0]
+            yaml_file = resource_dir + "/.autogenerated/" + MANIFEST_FILENAME_YAML
             load_result = ManifestLoader.load_from_file(json_file)
             if not load_result.error and load_result.manifest:
                 yaml_content = _json_to_yaml(load_result.manifest)
@@ -461,7 +474,7 @@ def load_yaml_manifests_as_resources():
     for root in DISCOVERY_SCAN_ROOTS:
         files = _find_manifest_files(root, MANIFEST_FILENAME_YAML)
         for f in files:
-            if f not in yaml_files:
+            if '/.autogenerated/' + MANIFEST_FILENAME_YAML in f and f not in yaml_files:
                 yaml_files.append(f)
     
     if not yaml_files:
@@ -469,7 +482,8 @@ def load_yaml_manifests_as_resources():
     
     created_resources = {}
     for yaml_file in yaml_files:
-        json_file = yaml_file.replace(MANIFEST_FILENAME_YAML, MANIFEST_FILENAME)
+        service_dir = yaml_file.rsplit('/.autogenerated/', 1)[0]
+        json_file = service_dir + '/' + MANIFEST_FILENAME
         load_result = ManifestLoader.load_from_file(json_file)
         resource_name = ""
         

package/engine/README.md

@@ -1,5 +1,7 @@
 # .tilt-engine/
 
+> **Contributing to the current engine:** follow the [engine and discovery recipe](../docs/contributing/02-feature-recipes.md#change-the-engine-or-service-discovery). This README contains older architecture notes; check paths against the current `engine/topologies/` source before relying on them.
+
 **Tilt Platform Framework Code**
 
 This directory contains the TDK Landscape Tilt infrastructure framework - the code that powers our local development orchestration.

package/engine/schemas/service-schema.json

@@ -1,7 +1,7 @@
 {
   "$id": "https://tdk-landscape.github.io/schema.service.json",
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "additionalProperties": false,
+  "additionalProperties": true,
   "allOf": [
     {
       "if": {
@@ -60,6 +60,27 @@
           "featuresEnabled"
         ]
       }
+    },
+    {
+      "if": {
+        "properties": {
+          "appType": {
+            "const": "bring-your-own"
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "port": {
+            "maximum": 5999,
+            "minimum": 4000
+          }
+        },
+        "required": [
+          "port",
+          "healthCheckPath"
+        ]
+      }
     }
   ],
   "description": "Configuration for TDK Landscape resources. Drives Tilt orchestration, Docker Compose generation, and dependency resolution. Supports both explicit service.json files and synthesis from directory structure.",
@@ -86,14 +107,15 @@
       "type": "string"
     },
     "appType": {
-      "description": "Resource type determining build strategy:\n• backend - Hono/Express API server\n• frontend - Vite single-page application (React or Vue, see framework)\n• sdk - Shared library package\n• worker - Background job processor\n• migrator - Database migration runner\n• library - Shared code library",
+      "description": "Resource type determining build strategy:\n• backend - Hono/Express API server\n• frontend - Vite single-page application (React or Vue, see framework)\n• sdk - Shared library package\n• worker - Background job processor\n• migrator - Database migration runner\n• library - Shared code library\n• bring-your-own - Wrap an existing service. No app scaffold. Needs Dockerfile or --image.",
       "enum": [
         "backend",
         "frontend",
         "sdk",
         "worker",
         "migrator",
-        "library"
+        "library",
+        "bring-your-own"
       ],
       "type": "string"
     },
@@ -124,26 +146,19 @@
     },
     "dockerfile": {
       "default": "autogenerated/Dockerfile.app.autogenerated",
-      "description": "Custom Dockerfile path relative to resource directory.",
+      "description": "Custom Dockerfile path relative to resource directory. Optional for bring-your-own type.",
+      "type": "string"
+    },
+    "exposeViaProxy": {
+      "description": "Whether this bring-your-own resource receives a Traefik route. Defaults to true.",
+      "type": "boolean"
+    },
+    "image": {
+      "description": "Docker image name instead of building from Dockerfile. Optional for bring-your-own type.",
       "type": "string"
     },
     "stack": {
       "description": "Technology stack this resource belongs to.\nUsed for:\n• Database naming: TDK_{stack}\n• Traefik routing: /api/{stack}\n• NATS queue: {stack}_backend_svc",
-      "enum": [
-        "user",
-        "team",
-        "auth",
-        "order",
-        "order-planner",
-        "service",
-        "inventory",
-        "billing",
-        "notification",
-        "analytics",
-        "profile",
-        "platform",
-        "product"
-      ],
       "type": "string"
     },
     "params": {
@@ -273,6 +288,11 @@
       ],
       "type": "string"
     },
+    "schemaVersion": {
+      "const": 1,
+      "description": "Version of the TDK service manifest contract.",
+      "type": "integer"
+    },
     "sablier": {
       "description": "On-demand scaling: stop this container when idle, wake it on the next request.\nNot recommended for databases or other stateful resources with in-flight writes.\n(Premium - requires TDK_LICENSE_KEY; see hasSablierLicense() in extension-fetch.ts)",
       "properties": {
@@ -281,6 +301,11 @@
           "description": "Scale this resource to zero when idle",
           "type": "boolean"
         },
+        "deferStart": {
+          "default": false,
+          "description": "Build the image during tdk up, then create and start the container on its first request",
+          "type": "boolean"
+        },
         "group": {
           "description": "Resources sharing a group wake and sleep together. Defaults to `stack`.",
           "type": "string"
@@ -322,8 +347,9 @@
   "required": [
     "appName",
     "appType",
-    "stack"
+    "stack",
+    "schemaVersion"
   ],
   "title": "TDK Landscape Resource Configuration",
   "type": "object"
-}
+}

package/engine/scripts/generate-manifest.sh

@@ -170,12 +170,13 @@ main() {
     cat > "$manifest_file" << EOF
 {
   "\$schema": "../../.tilt/schemas/service-schema.json",
+  "schemaVersion": 1,
   "appName": "${full_name}",
   "appType": "${resource_type}",
   "stack": "${stack}",
   "port": ${port},
   "replicas": 1,
-  "features": ${features},
+  "featuresEnabled": ${features},
   "dependsOn": ${deps}
 }
 EOF

package/engine/topologies/platform/docker/compose/compose.star

@@ -217,7 +217,26 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
     auth_env = AuthConfig.generate_docker_compose_auth_env(auth_config)
     
     # Use .autogenerated/Dockerfile.app.autogenerated by default for build config (primary only)
-    build_config = compose_build_config(resource_path, res_name)
+    if manifest and manifest.get('appType') == 'bring-your-own':
+        if manifest.get('image'):
+            build_config = ""
+        else:
+            # A BYO Dockerfile copies paths relative to the service directory
+            # (for example, `COPY app.py .`). Build with that directory as the
+            # context instead of the project root used by generated TDK apps.
+            context_prefix = '/'.join(['..'] * (len(resource_path.split('/')) + 1))
+            build_context = context_prefix + '/' + full_resource_path
+            dockerfile = manifest.get('dockerfile', 'Dockerfile')
+            if dockerfile.startswith('./'):
+                dockerfile = dockerfile[2:]
+            build_config = """    build:
+      context: {build_context}
+      dockerfile: {dockerfile}""".format(
+                build_context=build_context,
+                dockerfile=dockerfile,
+            )
+    else:
+        build_config = compose_build_config(resource_path, res_name)
     
     # REMOVED: External port exposure - all services accessed via Traefik only
     # Services are available at {project}.localhost/api/v1/{service}
@@ -243,10 +262,16 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
     # them a Traefik route advertises an endpoint that can never answer, and giving
     # them an HTTP healthcheck marks a perfectly healthy worker as unhealthy forever.
     is_worker = manifest.get('appType') == 'worker' if manifest else False
+    is_byo = manifest.get('appType') == 'bring-your-own' if manifest else False
+    is_proxy_disabled_byo = (
+        is_byo and not manifest.get('exposeViaProxy', True)
+    ) if manifest else False
 
-    if is_worker:
+    if is_worker or is_proxy_disabled_byo:
         traefik_labels = '      - "traefik.enable=false"'
-        healthcheck_section = ""
+        healthcheck_section = "" if is_worker or is_byo else """    healthcheck:
+      test: ["CMD", "curl", "-f", "--max-time", "5", "http://localhost:{internal_port}{health_path}"]
+""".format(internal_port=internal_port, health_path=health_path) + compose_healthcheck_timing()
     else:
         # Traefik's load-balancer check can be overridden separately in service.json
         # (`traefik.healthCheck`); it defaults to the container check's path.
@@ -260,7 +285,10 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
             health_path=traefik_health_path,
             manifest=manifest,
         )
-        healthcheck_section = """    healthcheck:
+        # BYO images may not contain curl. Traefik uses its own HTTP health
+        # check labels above, so don't mark an otherwise healthy container
+        # unhealthy because the image lacks a command TDK cannot require.
+        healthcheck_section = "" if is_byo else """    healthcheck:
       test: ["CMD", "curl", "-f", "--max-time", "5", "http://localhost:{internal_port}{health_path}"]
 """.format(internal_port=internal_port, health_path=health_path) + compose_healthcheck_timing()
     infisical_env = get_infisical_environment_vars(as_array=True, resource_name=res_name)
@@ -311,7 +339,11 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
         resource_entry_name=resource_entry_name,
         res_name=res_name,
         resource_name=resource_name,
-        image_name=with_runtime_image_tag(resource_name + '_' + res_name),
+        image_name=(
+            manifest.get('image')
+            if manifest and manifest.get('appType') == 'bring-your-own' and manifest.get('image')
+            else with_runtime_image_tag(resource_name + '_' + res_name)
+        ),
         build_config=build_config,
         ports_section=ports_section,
         env_file_rel_path=env_file_rel_path,