@tdk-landscape/tdk-cli-core 1.3.76 → 1.3.77

package/discovery/registry.star

@@ -303,6 +303,16 @@ def _render_product_stacks_index(resources):
 
 def _write_file_if_changed(path, content):
     """Write file only if content changed. Returns True if written."""
+    normalized = path.replace('\\', '/').replace('./', '', 1)
+    if '..' in normalized.split('/') or not (
+        '/.autogenerated/' in normalized or
+        normalized.startswith('.autogenerated/') or
+        normalized.startswith('.tdk/.tdk-out/') or
+        normalized in ['Tiltfile', '.tiltignore'] or
+        (normalized.startswith('TILT_') and normalized.endswith('.star') and '/' not in normalized)
+    ):
+        fail("TDK discovery refused to write outside its generated-file allowlist: " + path)
+
     # Read existing file (returns empty string on error via shell)
     existing = str(local("cat " + path + " 2>/dev/null || echo ''", quiet=True, echo_off=True))
     
@@ -322,6 +332,8 @@ def generate_product_stack_topology():
     changes = 0
     for resource in APP_RESOURCES:
         stack = resource.get("name", "unknown")
+        if not stack or '/' in stack or '\\' in stack or stack == '..':
+            fail("Invalid stack name for generated topology path: " + str(stack))
         stack_file = PRODUCT_TOPOLOGY_DIR + "/" + stack + "/stack.star"
         if _write_file_if_changed(stack_file, _render_product_stack_file(resource)):
             changes += 1
@@ -443,7 +455,8 @@ def _generate_yaml_from_json_manifests():
         json_files = _find_manifest_files(root, MANIFEST_FILENAME)
         
         for json_file in json_files:
-            yaml_file = json_file.replace(MANIFEST_FILENAME, MANIFEST_FILENAME_YAML)
+            resource_dir = json_file.rsplit('/', 1)[0]
+            yaml_file = resource_dir + "/.autogenerated/" + MANIFEST_FILENAME_YAML
             load_result = ManifestLoader.load_from_file(json_file)
             if not load_result.error and load_result.manifest:
                 yaml_content = _json_to_yaml(load_result.manifest)
@@ -461,7 +474,7 @@ def load_yaml_manifests_as_resources():
     for root in DISCOVERY_SCAN_ROOTS:
         files = _find_manifest_files(root, MANIFEST_FILENAME_YAML)
         for f in files:
-            if f not in yaml_files:
+            if '/.autogenerated/' + MANIFEST_FILENAME_YAML in f and f not in yaml_files:
                 yaml_files.append(f)
     
     if not yaml_files:
@@ -469,7 +482,8 @@ def load_yaml_manifests_as_resources():
     
     created_resources = {}
     for yaml_file in yaml_files:
-        json_file = yaml_file.replace(MANIFEST_FILENAME_YAML, MANIFEST_FILENAME)
+        service_dir = yaml_file.rsplit('/.autogenerated/', 1)[0]
+        json_file = service_dir + '/' + MANIFEST_FILENAME
         load_result = ManifestLoader.load_from_file(json_file)
         resource_name = ""
         

package/engine/README.md

@@ -1,5 +1,7 @@
 # .tilt-engine/
 
+> **Contributing to the current engine:** follow the [engine and discovery recipe](../docs/contributing/02-feature-recipes.md#change-the-engine-or-service-discovery). This README contains older architecture notes; check paths against the current `engine/topologies/` source before relying on them.
+
 **Tilt Platform Framework Code**
 
 This directory contains the TDK Landscape Tilt infrastructure framework - the code that powers our local development orchestration.

package/engine/schemas/service-schema.json

@@ -1,7 +1,7 @@
 {
   "$id": "https://tdk-landscape.github.io/schema.service.json",
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "additionalProperties": false,
+  "additionalProperties": true,
   "allOf": [
     {
       "if": {
@@ -60,6 +60,27 @@
           "featuresEnabled"
         ]
       }
+    },
+    {
+      "if": {
+        "properties": {
+          "appType": {
+            "const": "bring-your-own"
+          }
+        }
+      },
+      "then": {
+        "properties": {
+          "port": {
+            "maximum": 5999,
+            "minimum": 4000
+          }
+        },
+        "required": [
+          "port",
+          "healthCheckPath"
+        ]
+      }
     }
   ],
   "description": "Configuration for TDK Landscape resources. Drives Tilt orchestration, Docker Compose generation, and dependency resolution. Supports both explicit service.json files and synthesis from directory structure.",
@@ -86,14 +107,15 @@
       "type": "string"
     },
     "appType": {
-      "description": "Resource type determining build strategy:\n• backend - Hono/Express API server\n• frontend - Vite single-page application (React or Vue, see framework)\n• sdk - Shared library package\n• worker - Background job processor\n• migrator - Database migration runner\n• library - Shared code library",
+      "description": "Resource type determining build strategy:\n• backend - Hono/Express API server\n• frontend - Vite single-page application (React or Vue, see framework)\n• sdk - Shared library package\n• worker - Background job processor\n• migrator - Database migration runner\n• library - Shared code library\n• bring-your-own - Wrap an existing service. No app scaffold. Needs Dockerfile or --image.",
       "enum": [
         "backend",
         "frontend",
         "sdk",
         "worker",
         "migrator",
-        "library"
+        "library",
+        "bring-your-own"
       ],
       "type": "string"
     },
@@ -124,26 +146,19 @@
     },
     "dockerfile": {
       "default": "autogenerated/Dockerfile.app.autogenerated",
-      "description": "Custom Dockerfile path relative to resource directory.",
+      "description": "Custom Dockerfile path relative to resource directory. Optional for bring-your-own type.",
+      "type": "string"
+    },
+    "exposeViaProxy": {
+      "description": "Whether this bring-your-own resource receives a Traefik route. Defaults to true.",
+      "type": "boolean"
+    },
+    "image": {
+      "description": "Docker image name instead of building from Dockerfile. Optional for bring-your-own type.",
       "type": "string"
     },
     "stack": {
       "description": "Technology stack this resource belongs to.\nUsed for:\n• Database naming: TDK_{stack}\n• Traefik routing: /api/{stack}\n• NATS queue: {stack}_backend_svc",
-      "enum": [
-        "user",
-        "team",
-        "auth",
-        "order",
-        "order-planner",
-        "service",
-        "inventory",
-        "billing",
-        "notification",
-        "analytics",
-        "profile",
-        "platform",
-        "product"
-      ],
       "type": "string"
     },
     "params": {
@@ -273,6 +288,11 @@
       ],
       "type": "string"
     },
+    "schemaVersion": {
+      "const": 1,
+      "description": "Version of the TDK service manifest contract.",
+      "type": "integer"
+    },
     "sablier": {
       "description": "On-demand scaling: stop this container when idle, wake it on the next request.\nNot recommended for databases or other stateful resources with in-flight writes.\n(Premium - requires TDK_LICENSE_KEY; see hasSablierLicense() in extension-fetch.ts)",
       "properties": {
@@ -281,6 +301,11 @@
           "description": "Scale this resource to zero when idle",
           "type": "boolean"
         },
+        "deferStart": {
+          "default": false,
+          "description": "Build the image during tdk up, then create and start the container on its first request",
+          "type": "boolean"
+        },
         "group": {
           "description": "Resources sharing a group wake and sleep together. Defaults to `stack`.",
           "type": "string"
@@ -322,8 +347,9 @@
   "required": [
     "appName",
     "appType",
-    "stack"
+    "stack",
+    "schemaVersion"
   ],
   "title": "TDK Landscape Resource Configuration",
   "type": "object"
-}
+}

package/engine/scripts/generate-manifest.sh

@@ -170,12 +170,13 @@ main() {
     cat > "$manifest_file" << EOF
 {
   "\$schema": "../../.tilt/schemas/service-schema.json",
+  "schemaVersion": 1,
   "appName": "${full_name}",
   "appType": "${resource_type}",
   "stack": "${stack}",
   "port": ${port},
   "replicas": 1,
-  "features": ${features},
+  "featuresEnabled": ${features},
   "dependsOn": ${deps}
 }
 EOF

package/engine/topologies/platform/docker/compose/compose.star

@@ -217,7 +217,26 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
     auth_env = AuthConfig.generate_docker_compose_auth_env(auth_config)
     
     # Use .autogenerated/Dockerfile.app.autogenerated by default for build config (primary only)
-    build_config = compose_build_config(resource_path, res_name)
+    if manifest and manifest.get('appType') == 'bring-your-own':
+        if manifest.get('image'):
+            build_config = ""
+        else:
+            # A BYO Dockerfile copies paths relative to the service directory
+            # (for example, `COPY app.py .`). Build with that directory as the
+            # context instead of the project root used by generated TDK apps.
+            context_prefix = '/'.join(['..'] * (len(resource_path.split('/')) + 1))
+            build_context = context_prefix + '/' + full_resource_path
+            dockerfile = manifest.get('dockerfile', 'Dockerfile')
+            if dockerfile.startswith('./'):
+                dockerfile = dockerfile[2:]
+            build_config = """    build:
+      context: {build_context}
+      dockerfile: {dockerfile}""".format(
+                build_context=build_context,
+                dockerfile=dockerfile,
+            )
+    else:
+        build_config = compose_build_config(resource_path, res_name)
     
     # REMOVED: External port exposure - all services accessed via Traefik only
     # Services are available at {project}.localhost/api/v1/{service}
@@ -243,10 +262,16 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
     # them a Traefik route advertises an endpoint that can never answer, and giving
     # them an HTTP healthcheck marks a perfectly healthy worker as unhealthy forever.
     is_worker = manifest.get('appType') == 'worker' if manifest else False
+    is_byo = manifest.get('appType') == 'bring-your-own' if manifest else False
+    is_proxy_disabled_byo = (
+        is_byo and not manifest.get('exposeViaProxy', True)
+    ) if manifest else False
 
-    if is_worker:
+    if is_worker or is_proxy_disabled_byo:
         traefik_labels = '      - "traefik.enable=false"'
-        healthcheck_section = ""
+        healthcheck_section = "" if is_worker or is_byo else """    healthcheck:
+      test: ["CMD", "curl", "-f", "--max-time", "5", "http://localhost:{internal_port}{health_path}"]
+""".format(internal_port=internal_port, health_path=health_path) + compose_healthcheck_timing()
     else:
         # Traefik's load-balancer check can be overridden separately in service.json
         # (`traefik.healthCheck`); it defaults to the container check's path.
@@ -260,7 +285,10 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
             health_path=traefik_health_path,
             manifest=manifest,
         )
-        healthcheck_section = """    healthcheck:
+        # BYO images may not contain curl. Traefik uses its own HTTP health
+        # check labels above, so don't mark an otherwise healthy container
+        # unhealthy because the image lacks a command TDK cannot require.
+        healthcheck_section = "" if is_byo else """    healthcheck:
       test: ["CMD", "curl", "-f", "--max-time", "5", "http://localhost:{internal_port}{health_path}"]
 """.format(internal_port=internal_port, health_path=health_path) + compose_healthcheck_timing()
     infisical_env = get_infisical_environment_vars(as_array=True, resource_name=res_name)
@@ -311,7 +339,11 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
         resource_entry_name=resource_entry_name,
         res_name=res_name,
         resource_name=resource_name,
-        image_name=with_runtime_image_tag(resource_name + '_' + res_name),
+        image_name=(
+            manifest.get('image')
+            if manifest and manifest.get('appType') == 'bring-your-own' and manifest.get('image')
+            else with_runtime_image_tag(resource_name + '_' + res_name)
+        ),
         build_config=build_config,
         ports_section=ports_section,
         env_file_rel_path=env_file_rel_path,

package/engine/topologies/tilt/common/utils.star

@@ -260,6 +260,37 @@ def encode_json(obj, _depth=0):
 # 📁 FILE I/O UTILITIES
 # =============================================================================
 
+def _is_allowed_generated_path(file_path, project_root):
+    path = file_path.replace('\\', '/').strip()
+    root = project_root.replace('\\', '/').rstrip('/')
+    if root and path.startswith(root + '/'):
+        path = path[len(root) + 1:]
+    if path.startswith('./'):
+        path = path[2:]
+    parts = path.split('/')
+    if '..' in parts or path.startswith('/'):
+        return False
+    if '.autogenerated' in parts:
+        return True
+    if path.startswith('.tdk/.tdk-out/'):
+        return True
+    if path.startswith('product_autogenerated_resource_manifests/') or path.startswith('product_autogenerated_services_list/'):
+        return True
+    if path == 'Tiltfile' or path == '.tiltignore':
+        return True
+    if len(parts) == 1 and path.startswith('TILT_') and path.endswith('.star'):
+        return True
+    return False
+
+def _write_generated_file(file_path, content):
+    expected = str(content).rstrip()
+    dir_path = file_path.rsplit('/', 1)[0]
+    if not dir_path:
+        dir_path = '/'
+    safe_content = (expected + '\n').replace("'", "'\\''")
+    cmd = "mkdir -p '" + dir_path + "' && printf '%s' '" + safe_content + "' > '" + file_path + "'"
+    local(cmd, quiet=True, echo_off=True)
+
 def write_file_if_changed(file_path, content):
     """
     Writes content to file only if it differs from existing content.
@@ -272,28 +303,40 @@ def write_file_if_changed(file_path, content):
         content = ""
 
     # For relative paths, prepend project root to ensure files go to correct location
+    project_root = os.environ.get('TDK_PROJECT_ROOT', '.')
     if not file_path.startswith('/'):
-        project_root = os.environ.get('TDK_PROJECT_ROOT', '.')
         # Remove leading ./ if present in file_path
         clean_file_path = file_path[2:] if file_path.startswith('./') else file_path
         file_path = project_root + '/' + clean_file_path
 
+    if not _is_allowed_generated_path(file_path, project_root):
+        fail("TDK refused to write outside its generated-file allowlist: " + file_path)
+
     expected = str(content).rstrip()
     existing_blob = read_file(file_path, default='')
     existing = str(existing_blob).rstrip()
 
     if existing == expected:
         print("DEBUG WRITE: Skipping {} (no changes)".format(file_path))
-        return
-
-    dir_path = file_path.rsplit('/', 1)[0]
-    if not dir_path:
-        dir_path = '/'
-    safe_content = (expected + '\n').replace("'", "'\\''")
-    cmd = "mkdir -p '" + dir_path + "' && printf '%s' '" + safe_content + "' > '" + file_path + "'"
-    print("DEBUG WRITE: Writing {} bytes to {}".format(len(expected), file_path))
-    local(cmd, quiet=True, echo_off=True)
-    print("DEBUG WRITE: Completed {}".format(file_path))
+    else:
+        print("DEBUG WRITE: Writing {} bytes to {}".format(len(expected), file_path))
+        _write_generated_file(file_path, expected)
+        print("DEBUG WRITE: Completed {}".format(file_path))
+
+    # Keep a generated-content snapshot beside the service outputs. `tdk config verify`
+    # compares these snapshots with the files and the source manifest, detecting both
+    # hand edits and stale generated output without needing to run Tilt from CI.
+    normalized = file_path.replace('\\', '/')
+    generated_marker = '/.autogenerated/'
+    marker_index = normalized.rfind(generated_marker)
+    if marker_index >= 0 and '/.tdk-contract/' not in normalized:
+        service_root = normalized[:marker_index]
+        generated_rel = normalized[marker_index + len(generated_marker):]
+        contract_root = service_root + '/.autogenerated/.tdk-contract'
+        _write_generated_file(contract_root + '/' + generated_rel, expected)
+        manifest_content = read_file(service_root + '/service.json', default='')
+        if manifest_content:
+            _write_generated_file(contract_root + '/service.json.source', str(manifest_content))
 
 
 # =============================================================================

package/engine/topologies/tilt/manifest/AGENTS.md

@@ -46,7 +46,7 @@ load("./constants.star", "MANIFEST_FILENAME")
 ```json
 {
   "appName": "resource-name-backend",
-  "appType": "backend",  // frontend, backend, library, migrator, sdk, worker
+  "appType": "backend",  // frontend, backend, library, migrator, sdk, worker, bring-your-own
   "stack": "order",
   "port": 4000,
   "features": ["nats", "prisma", "vite-node"],

package/engine/topologies/tilt/manifest/constants.star

@@ -61,6 +61,7 @@ VALID_RESOURCE_TYPES = [
     "sdk",
     "worker",
     "infra",
+    "bring-your-own",
 ]
 
 VALID_FEATURES = [
@@ -86,6 +87,7 @@ VALID_FEATURES = [
 PORT_RANGES = {
     "frontend": {"min": 3000, "max": 5999},
     "backend": {"min": 4000, "max": 5999},
+    "bring-your-own": {"min": 4000, "max": 5999},
     "worker": {"min": 6000, "max": 6999},
     "migrator": {"min": 7000, "max": 7999},
     "sdk": {"min": 3000, "max": 9999},
@@ -186,6 +188,7 @@ DEFAULT_SYNCS = {
     'migrator': ['prisma'],
     'library': ['src', 'package.json'],
     'sdk': ['src', 'package.json'],
+    'bring-your-own': [],
 }
 
 RUNTIME_CONFIGS = {

package/engine/topologies/tilt/manifest/schema.star

@@ -64,11 +64,9 @@ MANIFEST_SCHEMA = {
         'default': 'backend',
     },
     'stack': {
-        'type': 'enum',
+        'type': 'string',
         'required': True,
-        'constraints': {
-            'values': VALID_STACKS,
-        },
+        'constraints': {'min_length': 1},
         'description': 'Technology stack this resource belongs to',
         'example': 'user',
     },

package/engine/topologies/tilt/manifest/validator.star

@@ -9,7 +9,7 @@
 # === INLINED CONSTANTS for pure extension loading ===
 VALID_STACKS = ()  # Stacks are project-specific, discovered dynamically
 VALID_FEATURES = "api-client", "env-config", "api-index", "prisma", "ddd", "nats", "redis", "infisical", "vitest", "traefik", "websocket", "graphql", "grpc", "vite-node", "maintenance", "sablier"
-PORT_RANGES = {"frontend": {"min": 3000, "max": 5999}, "backend": {"min": 4000, "max": 5999}, "worker": {"min": 6000, "max": 6999}, "migrator": {"min": 7000, "max": 7999}, "sdk": {"min": 3000, "max": 9999}, "library": {"min": 3000, "max": 9999}}
+PORT_RANGES = {"frontend": {"min": 3000, "max": 5999}, "backend": {"min": 4000, "max": 5999}, "bring-your-own": {"min": 4000, "max": 5999}, "worker": {"min": 6000, "max": 6999}, "migrator": {"min": 7000, "max": 7999}, "sdk": {"min": 3000, "max": 9999}, "library": {"min": 3000, "max": 9999}}
 DEFAULTS = {}
 
 # === END INLINED CONSTANTS ===

package/engine/topologies/tilt/resources/infra-loader.star

@@ -7,7 +7,7 @@
 #
 # This module centralizes infrastructure loading:
 # - Database (PostgreSQL, Redis)
-# - Messaging (NATS, Kafka)
+# - Messaging (Redis, NATS, Kafka)
 # - Secrets (Infisical)
 # - Registry (Verdaccio)
 # - Proxy (Traefik)
@@ -33,6 +33,13 @@ def _file_exists(path):
     return result == 'yes'
 
 
+def _compose_has_service(compose_path, service_name):
+    """Check whether a Compose file declares a named service."""
+    document = read_yaml(compose_path, default={})
+    services = document.get('services', {}) if type(document) == 'dict' else {}
+    return service_name in services
+
+
 def _docker_compose(compose_paths, env_file):
     """docker_compose() wrapper: Tilt's builtin rejects env_file=None outright
     (it type-checks the kwarg as path|string, not Optional), so the keyword must be
@@ -116,8 +123,12 @@ def _load_database_management(should_enable, root_prefix="", env_file=None, writ
     if _file_exists(messaging_compose):
         print("DEBUG INFRA: Loading messaging compose from {}".format(messaging_compose))
         _docker_compose(messaging_compose, env_file)
-        dc_resource('redis', labels=['infra.messaging'], auto_init=False)
-        dc_resource('nats', labels=['infra.messaging'], auto_init=True)
+        # Register only services present in the project compose file. Minimal
+        # NATS-only examples should not need to add an unrelated Redis broker.
+        if _compose_has_service(messaging_compose, 'redis'):
+            dc_resource('redis', labels=['infra.messaging'], auto_init=False)
+        if _compose_has_service(messaging_compose, 'nats'):
+            dc_resource('nats', labels=['infra.messaging'], auto_init=True)
     else:
         print("DEBUG INFRA: Skipping messaging (compose file not found)")
     

package/engine/topologies/tilt/resources/orchestrator/apply_compose_resource_registration.star

@@ -137,10 +137,13 @@ def resource_defers_start(manifest):
     static route wakes it on first request (see openspec/changes/
     prioritized-cold-start)."""
     _, sablier_licensed_and_enabled = sablier_middleware_suffix(manifest, '')
+    sablier = manifest.get('sablier', {}) if manifest else {}
+    defers_start = bool(sablier.get('enable', False) and sablier.get('deferStart', False))
+    if defers_start and not sablier_licensed_and_enabled:
+        print("⚠️  '{}' requests sablier.deferStart but the licensed Sablier overlay is disabled; starting normally".format(manifest.get('name', 'resource')))
     if not sablier_licensed_and_enabled:
         return False
-    sablier = manifest.get('sablier', {}) if manifest else {}
-    return bool(sablier.get('deferStart', False))
+    return defers_start
 
 
 def resolve_manifest_dependency_names(manifest, all_services_map):
@@ -365,7 +368,7 @@ def _register_single_resource(config, resource_path, compose_project_name, auto_
     print("DEBUG REGISTER: Registering '{}' app_type='{}' auto_init={}".format(res_name, app_type, effective_auto_init))
 
     # Skip docker_build for libraries and SDKs - they don't have Dockerfiles
-    if app_type not in ['library', 'sdk'] and config.get('syncs'):
+    if app_type not in ['library', 'sdk', 'bring-your-own'] and config.get('syncs'):
         print("DEBUG REGISTER: '{}' has syncs, calling docker_build".format(res_name))
         live_update_rules = _build_live_update_rules(
             config['res_path'],
@@ -429,13 +432,14 @@ def _process_frontend_resource(res, manifest, full_res_path, resource_path, reso
 
 def _process_backend_resource(res, manifest, full_res_path, resource_path, resource_name, should_enable):
     """Process a backend resource and return compose entry."""
-    Docker.backend(
-        res_path=full_res_path,
-        resource_name=res['name'],
-        port=None,  # Use default BASE_PORT_BACKEND
-        build_cmd=res.get('start_command', 'bun run build'),
-        use_golden=should_enable('golden-image'),
-    )
+    if manifest.get('appType') != 'bring-your-own':
+        Docker.backend(
+            res_path=full_res_path,
+            resource_name=res['name'],
+            port=None,  # Use default BASE_PORT_BACKEND
+            build_cmd=res.get('start_command', 'bun run build'),
+            use_golden=should_enable('golden-image'),
+        )
     return Docker.backend_compose(resource_path=resource_path, resource_name=resource_name, res=res, manifest=manifest)
 
 
@@ -462,7 +466,7 @@ def _build_resource_config(res, manifest, resource_config, full_res_path, infra_
         'replicas': replicas,
         'syncs': res.get('syncs', []),
         'app_type': manifest.get('appType', 'backend'),
-        'dockerfile': res.get('dockerfile', OUTPUT.AUTOGENERATED_FOLDER + '/Dockerfile.app.autogenerated'),
+        'dockerfile': res.get('dockerfile', manifest.get('dockerfile', OUTPUT.AUTOGENERATED_FOLDER + '/Dockerfile.app.autogenerated')),
         'res_path': full_res_path,
         'env': env_vars,
         'project_root': project_root,

package/engine/topologies/tilt/resources/orchestrator/generators/manifest_resource.star

@@ -126,6 +126,8 @@ def _build_generated_file_list(resource_config, resource_path, manifest):
     """
     files = []
     app_type = manifest.get('appType', 'backend')
+    if app_type == 'bring-your-own':
+        return []
     is_frontend = resource_config.get('frontend', False) or app_type == 'frontend'
 
     # Vite
@@ -267,6 +269,16 @@ def _generate_all_configs_for_resource(
     write_file = ctx['write_file']
     should_enable = ctx['should_enable']
     global_config = ctx['global_config']
+
+    # Env generation needs the actual service directory on the manifest. Set it
+    # before the BYO fast path too; otherwise Compose references an env file that
+    # was never written for bring-your-own resources.
+    manifest['_resource_path'] = resource_path
+
+    if manifest.get('appType') == 'bring-your-own':
+        _generate_env_file(manifest, backend_manifest, write_file)
+        _generate_yaml_manifest(resource_path, manifest, write_file)
+        return
     
     # WORKAROUND: Prevent infinite recursion by checking recursion depth
     # Use a unique key per resource to track depth, avoiding interference between different resources
@@ -279,9 +291,6 @@ def _generate_all_configs_for_resource(
     ctx = dict(ctx)
     ctx[recursion_key] = recursion_depth + 1
     
-    # Add resource_path to manifest so generators can access it
-    manifest['_resource_path'] = resource_path
-    
     # ==========================================================================
     # NEW: PRE-FLIGHT VALIDATIONS (v2.0)
     # Run validations BEFORE generating configs to catch issues early
@@ -444,8 +453,8 @@ def _generate_all_configs_for_resource(
 
 
 def _generate_yaml_manifest(resource_path, manifest, write_file):
-    """Generate YAML version of manifest for verification (idempotent)."""
-    yaml_path = resource_path + "/" + MANIFEST_FILENAME_YAML
+    """Generate an allowlisted YAML shadow beside other TDK-owned outputs."""
+    yaml_path = resource_path + "/.autogenerated/" + MANIFEST_FILENAME_YAML
     
     # Check if YAML already exists and is up-to-date by comparing with JSON
     json_path = resource_path + "/" + MANIFEST_FILENAME
@@ -525,7 +534,7 @@ def create_manifest_config_resource(
     local_resource(
         name=config_gen_resource_name,
         cmd=log_cmd,
-        deps=[manifest_path, package_json_path],
+        deps=[manifest_path] if manifest.get('appType') == 'bring-your-own' else [manifest_path, package_json_path],
         labels=['config-gen', resource_name],
         allow_parallel=True,
         auto_init=auto_init_config_gen

package/examples/tdk-example/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 TDK Landscape
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/examples/tdk-example/README.md

@@ -0,0 +1,23 @@
+# TDK product example
+
+A small working landscape with a Hono API, PostgreSQL, a NATS worker, a Vite UI, and Traefik routes.
+
+This is a local demo, not a Helm chart.
+
+```sh
+tdk doctor
+tdk project --yes
+tdk up
+```
+
+Open `http://app.tdk-example.localhost/orders-app/` and create an order, or use the routed API:
+
+```sh
+curl -fsS -X POST http://api.tdk-example.localhost/api/orders \
+  -H 'content-type: application/json' -d '{"item":"coffee"}'
+```
+
+The API stores each order in PostgreSQL and publishes its id to NATS. The worker consumes the
+event, reads the stored row, and marks it observed. Poll `GET /api/orders/<id>` through the API
+route until `workerSeenAt` is set. `tdk config verify` checks generated output. Stop the landscape
+with `tdk down`.