@tdk-landscape/tdk-cli-core 1.3.91 → 1.3.92

package/engine/schemas/service-schema.json

@@ -107,7 +107,7 @@
       "type": "string"
     },
     "appType": {
-      "description": "Resource type determining build strategy:\n• backend - Hono/Express API server\n• frontend - Vite single-page application (React, Vue, Svelte, Preact, Lit, Solid, Qwik or Vanilla TypeScript, see framework)\n• sdk - Shared library package\n• worker - Background job processor\n• migrator - Database migration runner\n• library - Shared code library\n• bring-your-own - Wrap an existing service. No app scaffold. Needs Dockerfile or --image.",
+      "description": "Resource type determining build strategy:\n• backend - Hono/Express API server\n• frontend - Vite single-page application (React, Vue, Svelte, Preact, Lit, Solid, Qwik or Vanilla TypeScript, see framework)\n• sdk - Shared library package\n• worker - Background job processor\n• migrator - Database migration runner\n• library - Shared code library\n• mcp - Model Context Protocol server (an HTTP service on Bun, run like a backend)\n• bring-your-own - Wrap an existing service. No app scaffold. Needs Dockerfile or --image.",
       "enum": [
         "backend",
         "frontend",
@@ -115,6 +115,7 @@
         "worker",
         "migrator",
         "library",
+        "mcp",
         "bring-your-own"
       ],
       "type": "string"
@@ -179,10 +180,10 @@
       "type": "object"
     },
     "secrets": {
-      "description": "Secret references resolved via Infisical. NO secrets in params/envVars - security violation.",
+      "description": "Names of secrets the resource needs. By default each is read from the project .env (gitignored) and injected into the container; with TDK_SECRET_PROVIDER=infisical they are left to Infisical. NO secret values in params/envVars or anywhere in service.json.",
       "properties": {
         "required": {
-          "description": "Required secret names. Resource CRASHES if any are missing.",
+          "description": "Required secret names. The resource does not start if any is missing from the project .env.",
           "items": {
             "type": "string",
             "pattern": "^[A-Z_][A-Z0-9_]*$"
@@ -191,7 +192,7 @@
           "uniqueItems": true
         },
         "optional": {
-          "description": "Optional secret names. Resource starts but warns if missing.",
+          "description": "Optional secret names. The resource starts with the variable empty when it is missing from the project .env.",
           "items": {
             "type": "string",
             "pattern": "^[A-Z_][A-Z0-9_]*$"
@@ -226,34 +227,13 @@
     },
     "framework": {
       "description": "Framework provider id. For frontend resources it selects the Vite and TypeScript config (omitted means react, legacy manifests). For backend resources it selects the HTTP framework on the Bun runtime (omitted means hono; not used with a language that owns its runtime, such as python). Valid ids come from the CLI provider registries, which reject unknown ids before writing a resource.",
-      "examples": [
-        "react",
-        "vue",
-        "svelte",
-        "preact",
-        "lit",
-        "solid",
-        "qwik",
-        "vanilla",
-        "hono",
-        "express",
-        "elysia",
-        "fastify",
-        "nestjs",
-        "koa",
-        "h3"
-      ],
+      "examples": ["react", "vue", "solid"],
       "pattern": "^[a-z][a-z0-9-]*$",
       "type": "string"
     },
     "language": {
       "description": "Backend language provider id used to scaffold and run the service. Only meaningful for backend resources; omitted means bun (legacy manifests). Valid ids come from the CLI provider registry.",
-      "examples": [
-        "bun",
-        "python",
-        "go",
-        "rust"
-      ],
+      "examples": ["bun", "python", "go"],
       "pattern": "^[a-z][a-z0-9-]*$",
       "type": "string"
     },
@@ -360,6 +340,72 @@
       },
       "type": "array"
     },
+    "smoke": {
+      "description": "Post-start check run by `tdk up` through the public proxy URL (not inside the container): write a record, read it back. `tdk up` fails if a step misses. Absent means no smoke check. Workers and resources with exposeViaProxy false are skipped.",
+      "type": "object",
+      "required": [
+        "via",
+        "steps"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "via": {
+          "const": "proxy",
+          "description": "Only `proxy` is supported: the request goes to the URL `tdk up` prints."
+        },
+        "timeoutSeconds": {
+          "type": "number",
+          "exclusiveMinimum": 0,
+          "default": 60,
+          "description": "How long to wait for the route to come up. Connection errors and 404/502/503/504 are retried until then; any other wrong answer fails at once."
+        },
+        "steps": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": [
+              "path"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "name": {
+                "type": "string"
+              },
+              "method": {
+                "type": "string",
+                "default": "GET"
+              },
+              "path": {
+                "type": "string",
+                "pattern": "^/(?!/)",
+                "description": "Appended to the service's public base URL. `{{name}}` is replaced by a value saved by an earlier step."
+              },
+              "body": {
+                "description": "JSON request body."
+              },
+              "expect": {
+                "type": "integer",
+                "minimum": 100,
+                "maximum": 599,
+                "default": 200
+              },
+              "bodyContains": {
+                "type": "string"
+              },
+              "save": {
+                "type": "object",
+                "additionalProperties": {
+                  "type": "string",
+                  "pattern": "^\\$\\."
+                },
+                "description": "Saves response fields for later steps, for example {\"id\": \"$.id\"}."
+              }
+            }
+          }
+        }
+      }
+    },
     "traefik": {
       "description": "Custom Traefik routing. Auto-generated if not specified.",
       "properties": {

package/engine/topologies/platform/docker/auth/auth.star

@@ -12,38 +12,80 @@
 #          them as the auth_config dict.
 # =============================================================================
 
-# Default values for auth configuration
+# Default values for auth configuration.
+#
+# There is deliberately no default JWT secret: a secret that is the same in every project is not a secret. The JWT secret is
+# generated once per project by the CLI into the project `.env` (JWT_SECRET) and Compose reads it from there.
 DEFAULT_AUTH_MODE = 'local-jwt'
-DEFAULT_JWT_SECRET = 'local-development-secret-min-32-chars-long'
 DEFAULT_IDENTITY_RESOURCE_URL = 'http://identity-service:3000'
 
+# Shown by Compose when the project `.env` has no JWT_SECRET.
+JWT_SECRET_MISSING_MESSAGE = 'JWT_SECRET is not set. Run `tdk up` (it adds a generated one to the project .env) or add JWT_SECRET to .env'
+
+
+def _setting(auth_config, key, default):
+    """A configured value, or the default when the key is missing OR present with a None value.
+
+    Callers build the config dict with every key present and None for anything unset, and `dict.get(key, default)` returns that
+    None instead of the default, which used to turn into the literal text `AUTH_MODE=None` in generated files.
+    """
+    if not auth_config:
+        return default
+    value = auth_config.get(key)
+    if value == None or value == '':
+        return default
+    return value
 
-def get_auth_mode(auth_config):
-    """Get auth mode from auth config with default fallback.
+
+def _first_set(*values):
+    """The first value that is not None or an empty string, else None."""
+    for value in values:
+        if value != None and value != '':
+            return value
+    return None
+
+
+def auth_config_from_manifest(manifest):
+    """Build the auth configuration both the env file and the Compose entry use, from one place.
+
+    The two writers used to build this separately and drifted: the env file read `identityServiceUrl` while Compose read
+    `envVars.IDENTITY_RESOURCE_URL`, so setting one field changed only one output.
+
+    - authMode: the manifest's `authMode`, else `identity-service` when `dependsOn` contains `identity`, else unset (local-jwt).
+    - identityServiceUrl: the manifest's `identityServiceUrl`. The deprecated `params` / `envVars` entry named
+      `IDENTITY_RESOURCE_URL` is still honoured when the field is absent, so an existing manifest keeps working.
 
     Args:
-        auth_config: Auth configuration dictionary (may be None or empty)
+        manifest: The service manifest dict (may be None)
 
     Returns:
-        str: Auth mode ('local-jwt' or 'identity-service')
+        dict: {'authMode': str or None, 'identityServiceUrl': str or None}; None means "use the default"
     """
-    if not auth_config:
-        return DEFAULT_AUTH_MODE
-    return auth_config.get('authMode', DEFAULT_AUTH_MODE)
+    if not manifest:
+        return {'authMode': None, 'identityServiceUrl': None}
+
+    auth_mode = _first_set(
+        manifest.get('authMode'),
+        'identity-service' if 'identity' in (manifest.get('dependsOn') or []) else None,
+    )
+    identity_url = _first_set(
+        manifest.get('identityServiceUrl'),
+        (manifest.get('params') or {}).get('IDENTITY_RESOURCE_URL'),
+        (manifest.get('envVars') or {}).get('IDENTITY_RESOURCE_URL'),
+    )
+    return {'authMode': auth_mode, 'identityServiceUrl': identity_url}
 
 
-def get_jwt_secret(auth_config):
-    """Get JWT secret from auth config with default fallback.
+def get_auth_mode(auth_config):
+    """Get auth mode from auth config with default fallback.
 
     Args:
         auth_config: Auth configuration dictionary (may be None or empty)
 
     Returns:
-        str: JWT secret for local-jwt mode
+        str: Auth mode ('local-jwt' or 'identity-service')
     """
-    if not auth_config:
-        return DEFAULT_JWT_SECRET
-    return auth_config.get('jwtSecret', DEFAULT_JWT_SECRET)
+    return _setting(auth_config, 'authMode', DEFAULT_AUTH_MODE)
 
 
 def get_identity_resource_url(auth_config):
@@ -55,9 +97,7 @@ def get_identity_resource_url(auth_config):
     Returns:
         str: URL for identity service
     """
-    if not auth_config:
-        return DEFAULT_IDENTITY_RESOURCE_URL
-    return auth_config.get('identityServiceUrl', DEFAULT_IDENTITY_RESOURCE_URL)
+    return _setting(auth_config, 'identityServiceUrl', DEFAULT_IDENTITY_RESOURCE_URL)
 
 
 def get_auth_config(auth_config):
@@ -67,11 +107,10 @@ def get_auth_config(auth_config):
         auth_config: Auth configuration dictionary (may be None or empty)
 
     Returns:
-        struct: Auth configuration with mode, jwt_secret, and identity_resource_url
+        struct: Auth configuration with mode and identity_resource_url (the JWT secret lives in the project .env, not here)
     """
     return struct(
         mode = get_auth_mode(auth_config),
-        jwt_secret = get_jwt_secret(auth_config),
         identity_resource_url = get_identity_resource_url(auth_config),
     )
 
@@ -113,12 +152,12 @@ def generate_docker_compose_auth_env(auth_config):
         str: Formatted auth environment variables for docker-compose
     """
     auth_mode = get_auth_mode(auth_config)
-    jwt_secret = get_jwt_secret(auth_config)
     identity_resource_url = get_identity_resource_url(auth_config)
 
     if auth_mode == 'local-jwt':
+        # Required from the project .env (see JWT_SECRET_MISSING_MESSAGE); there is no shared default.
         return """      - AUTH_MODE=local-jwt
-      - JWT_SECRET=${JWT_SECRET:-%(jwt_secret)s}""" % {'jwt_secret': jwt_secret}
+      - JWT_SECRET=${JWT_SECRET:?%(message)s}""" % {'message': JWT_SECRET_MISSING_MESSAGE}
     else:
         return """      - AUTH_MODE=identity-service
       - IDENTITY_RESOURCE_URL=${IDENTITY_RESOURCE_URL:-%(identity_resource_url)s}""" % {'identity_resource_url': identity_resource_url}
@@ -128,7 +167,9 @@ def generate_env_file_auth_section(auth_config):
     """Generate .env file auth section content.
 
     This function returns the formatted authentication configuration section
-    for .env.backend.autogenerated files.
+    for .env.backend.autogenerated files. These files are generated, checked by
+    `tdk config verify` and never carry secrets, so there is no JWT secret here:
+    in local-jwt mode Compose takes JWT_SECRET from the project .env.
 
     Args:
         auth_config: Auth configuration dictionary (may be None or empty)
@@ -137,7 +178,6 @@ def generate_env_file_auth_section(auth_config):
         str: Formatted auth section for .env files
     """
     auth_mode = get_auth_mode(auth_config)
-    jwt_secret = get_jwt_secret(auth_config)
     identity_resource_url = get_identity_resource_url(auth_config)
 
     content = """
@@ -146,9 +186,7 @@ def generate_env_file_auth_section(auth_config):
 AUTH_MODE={auth_mode}
 """.format(auth_mode=auth_mode)
 
-    if auth_mode == 'local-jwt':
-        content += "JWT_SECRET={jwt_secret}\n".format(jwt_secret=jwt_secret)
-    else:
+    if auth_mode != 'local-jwt':
         content += "IDENTITY_RESOURCE_URL={identity_resource_url}\n".format(identity_resource_url=identity_resource_url)
 
     return content
@@ -156,8 +194,8 @@ AUTH_MODE={auth_mode}
 
 # Export all functions as a struct for easy importing
 AuthConfig = struct(
+    from_manifest = auth_config_from_manifest,
     get_auth_mode = get_auth_mode,
-    get_jwt_secret = get_jwt_secret,
     get_identity_resource_url = get_identity_resource_url,
     get_auth_config = get_auth_config,
     is_local_jwt_mode = is_local_jwt_mode,

package/engine/topologies/platform/docker/compose/compose.star

@@ -20,6 +20,7 @@ load("./compose_helpers.star", "with_runtime_image_tag", "compose_build_config")
 load("../networking/traefik.star", "get_frontend_traefik_labels", "get_backend_traefik_labels")
 load("../networking/api_path_constants.star", "get_api_path_for_domain", "get_frontend_base_path")
 load("../secrets/infisical.star", "get_infisical_environment_vars")
+load("../secrets/env_secrets.star", "get_secret_environment_lines")
 load("../auth/auth.star", "AuthConfig")
 
 load("../constants.star", "PlatformDockerConstants")
@@ -189,32 +190,12 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
     nats_queue = nats_cfg.get('queueGroup', stack + '_backend_svc')
     nats_url = PlatformDockerConstants.NATS_URL
     
-    # Auth configuration - use centralized auth utilities
-    # Extract auth config from manifest to decouple auth.star from manifest structure
-    # Auto-detect identity-service mode if 'identity' is in dependsOn
-    internal_deps = manifest.get('dependsOn', []) if manifest else []
-    has_identity_dep = 'identity' in internal_deps
-    
-    # If manifest has authMode, use it; otherwise auto-detect based on identity dependency
-    manifest_auth_mode = manifest.get('authMode') if manifest else None
-    if manifest_auth_mode:
-        auth_mode = manifest_auth_mode
-    elif has_identity_dep:
-        auth_mode = 'identity-service'
-    else:
-        auth_mode = None
-    
-    auth_config = {
-        'authMode': auth_mode,
-        'jwtSecret': manifest.get('jwtSecret') if manifest else None,
-        'identityServiceUrl': manifest.get('envVars', {}).get('IDENTITY_RESOURCE_URL') if manifest else None,
-    }
-    
-    # If we auto-detected identity-service mode but no URL is set, use default
-    if auth_mode == 'identity-service' and not auth_config['identityServiceUrl']:
-        auth_config['identityServiceUrl'] = AuthConfig.get_identity_resource_url(None)
+    # Auth configuration: one shared builder keeps this identical to the generated env file (see AuthConfig.from_manifest).
+    auth_config = AuthConfig.from_manifest(manifest)
     
     auth_env = AuthConfig.generate_docker_compose_auth_env(auth_config)
+    # secrets.required / secrets.optional, read from the project .env by Compose (empty with TDK_SECRET_PROVIDER=infisical)
+    secrets_env = get_secret_environment_lines(manifest, res_name)
     
     # Use .autogenerated/Dockerfile.app.autogenerated by default for build config (primary only)
     if manifest and manifest.get('appType') == 'bring-your-own':
@@ -240,7 +221,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
     
     # REMOVED: External port exposure - all services accessed via Traefik only
     # Services are available at {project}.localhost/api/v1/{service}
-    # Internal port 3000 is accessible within Docker network for service-to-service communication
+    # Inside the Docker network a service listens on its own port (manifest.port, passed to it as PORT), for service-to-service calls
     ports_section = ""  # No external ports - Traefik-only access
     
     # Determine service name based on instance
@@ -325,7 +306,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
       # to skip Prisma auto-migration at container boot (e.g. while diagnosing a
       # migration/CLI issue) without touching the generator or any service code.
       - AUTO_MIGRATE=${{AUTO_MIGRATE:-true}}
-{auth_env}
+{auth_env}{secrets_env}
     labels:
 {traefik_labels}
     networks:
@@ -373,6 +354,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
         healthcheck_section=healthcheck_section,
         infisical_env=infisical_env,
         auth_env=auth_env,
+        secrets_env=secrets_env,
         network_traefik_public=PlatformDockerConstants.NETWORK_TRAEFIK_PUBLIC,
         network_backend=PlatformDockerConstants.NETWORK_BACKEND,
         network_database=PlatformDockerConstants.NETWORK_DATABASE,

package/engine/topologies/platform/docker/layers/l3_builder_layers.star

@@ -28,6 +28,9 @@ load('./prisma/prisma_build.star',
     'prisma_normalize_output',
     'L3_generate_migration_engine',
 )
+# Infisical is opt-in: use_infisical defaults to False and nothing in the free engine passes True, so the generator behind this
+# (tilt/generators/infisical/secrets_generator.star) is not on the default path. It is an older contract with fixed secret names and
+# ports. Do not wire `secrets.required` through it; the default provider is platform/docker/secrets/env_secrets.star.
 load('./infisical/infisical_docker.star', 'InfisicalDocker')
 
 # Load project name for dynamic golden image naming

package/engine/topologies/platform/docker/layers/l4_runtime_layers.star

@@ -29,6 +29,9 @@ load('./prisma/prisma_runtime.star',
 
 load('./bun_helpers.star', 'bun_hoisted_packages_symlink_fix')
 load('../config/healthcheck.star', 'DOCKER_HEALTHCHECK', 'dockerfile_healthcheck_flags')
+# Infisical is opt-in: use_infisical defaults to False and nothing in the free engine passes True, so the generator behind this
+# (tilt/generators/infisical/secrets_generator.star) is not on the default path. It is an older contract with fixed secret names and
+# ports. Do not wire `secrets.required` through it; the default provider is platform/docker/secrets/env_secrets.star.
 load('./infisical/infisical_docker.star', 'InfisicalDocker')
 
 

package/engine/topologies/platform/docker/networking/api_path_constants.star

@@ -33,21 +33,6 @@ def generate_api_path(stack, app_name):
     # Examples: /api/user-management, /api/order-management
     return "/api/" + stack + "-management"
 
-# =============================================================================
-# SERVICE STACK TO API PATH MAPPING (Dynamic)
-# =============================================================================
-# This is populated at runtime from discovered manifests
-# No hardcoded resource names
-
-RESOURCE_STACK_TO_API_PATH = {}
-
-# =============================================================================
-# API PATH TO SERVICE MAPPING (Dynamic)
-# =============================================================================
-
-API_PATH_TO_RESOURCE_STACK = {}
-API_PATH_TO_RESOURCE_DOMAIN = API_PATH_TO_RESOURCE_STACK
-
 # =============================================================================
 # HELPER FUNCTIONS
 # =============================================================================
@@ -110,7 +95,7 @@ def get_api_path_for_stack(stack, manifest=None):
         return manifest.get("apiPath")
     
     # NEW: Use /api/{stack}-management pattern instead of /api/v1/{pluralized}
-    return RESOURCE_STACK_TO_API_PATH.get(stack, "/api/" + stack + "-management")
+    return "/api/" + stack + "-management"
 
 # Backwards compatibility alias
 get_api_path_for_domain = get_api_path_for_stack
@@ -176,20 +161,6 @@ def get_api_path_for_resource(resource_name):
 # Backwards compatibility alias
 get_api_path_for_service = get_api_path_for_resource
 
-def get_stack_for_api_path(api_path):
-    """Returns the service stack for an API path (reverse lookup).
-    
-    Args:
-        api_path: Full API path
-    
-    Returns:
-        Service stack string
-    """
-    return API_PATH_TO_RESOURCE_STACK.get(api_path, "")
-
-# Backwards compatibility alias
-get_domain_for_api_path = get_stack_for_api_path
-
 # Load project name for dynamic localhost domain
 # Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
 def _load_project_localhost():
@@ -231,30 +202,3 @@ def build_health_endpoint(api_path, health_path="/health"):
         Full health endpoint path
     """
     return api_path + health_path
-
-def get_all_api_paths():
-    """Returns a list of all defined API paths from discovered services.
-    
-    Returns:
-        List of API path strings
-    """
-    return RESOURCE_DOMAIN_TO_API_PATH.values()
-
-def is_valid_api_path(api_path):
-    """Checks if an API path is valid/defined.
-    
-    Args:
-        api_path: API path to check
-    
-    Returns:
-        True if valid, False otherwise
-    """
-    return api_path in API_PATH_TO_RESOURCE_DOMAIN
-
-# =============================================================================
-# LEGACY COMPATIBILITY (Deprecated - for migration only)
-# =============================================================================
-# All legacy paths removed - use dynamic path generation from manifests
-
-LEGACY_DOMAIN_TO_API_PATH = {}
-RESOURCE_DOMAIN_TO_API_PATH = LEGACY_DOMAIN_TO_API_PATH

package/engine/topologies/platform/docker/secrets/env_secrets.star

@@ -0,0 +1,72 @@
+# =============================================================================
+# 🔑 SECRETS FROM THE PROJECT .env
+# =============================================================================
+# Purpose: Make `secrets.required` / `secrets.optional` in service.json real for local development.
+#
+# The default provider is `env-file`: a secret's value lives in the project `.env` (gitignored) and reaches the container through
+# Docker Compose's own `${NAME}` interpolation, so nothing secret is ever written to a generated, committed file. A required secret
+# uses `${NAME:?message}`, so Compose refuses to start the service when the name is missing; an optional one defaults to empty.
+#
+# `TDK_SECRET_PROVIDER=infisical` leaves the names to Infisical instead, and nothing is injected here.
+# =============================================================================
+
+DEFAULT_SECRET_PROVIDER = 'env-file'
+
+_NAME_FIRST = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_'
+_NAME_REST = _NAME_FIRST + '0123456789'
+
+
+def get_secret_provider():
+    """The selected provider: `env-file` (default) or `infisical`."""
+    provider = str(os.environ.get('TDK_SECRET_PROVIDER', '')).strip().lower()
+    return provider if provider else DEFAULT_SECRET_PROVIDER
+
+
+def _is_valid_env_name(name):
+    if type(name) != 'string' or not name:
+        return False
+    if name[0] not in _NAME_FIRST:
+        return False
+    for i in range(len(name)):
+        if name[i] not in _NAME_REST:
+            return False
+    return True
+
+
+def _names(manifest, resource_name, kind):
+    secrets = manifest.get('secrets') or {}
+    names = secrets.get(kind) or []
+    if type(names) != 'list':
+        fail("{}: secrets.{} must be a list of environment variable names".format(resource_name, kind))
+    for name in names:
+        if not _is_valid_env_name(name):
+            fail("{}: invalid secret name '{}' in secrets.{}: use letters, digits and underscores, not starting with a digit".format(resource_name, name, kind))
+    return names
+
+
+def get_secret_environment_lines(manifest, resource_name):
+    """Compose `environment:` list lines (each starting with a newline) for a resource's secrets, or '' when there are none.
+
+    Args:
+        manifest: The service manifest (reads secrets.required and secrets.optional)
+        resource_name: Used in error messages and in the text Compose shows for a missing required secret
+
+    Returns:
+        str: Lines to append to the Compose environment block
+    """
+    if not manifest or not manifest.get('secrets'):
+        return ''
+
+    required = _names(manifest, resource_name, 'required')
+    optional = _names(manifest, resource_name, 'optional')
+
+    if get_secret_provider() != DEFAULT_SECRET_PROVIDER:
+        return ''
+
+    lines = ''
+    for name in required:
+        lines += '\n      - {name}=${{{name}:?{name} is required by {resource}. Add it to the project .env}}'.format(name=name, resource=resource_name)
+    for name in optional:
+        if name not in required:
+            lines += '\n      - {name}=${{{name}:-}}'.format(name=name)
+    return lines

package/engine/topologies/tilt/common/utils.star

@@ -7,7 +7,6 @@
 
 load('./utils_env.star',
     'load_dotenv',
-    'validate_infisical_environment',
     'should_enable',
 )
 load('./utils_debug.star',
@@ -371,7 +370,6 @@ Utils = struct(
 
     # Environment
     load_dotenv = load_dotenv,
-    validate_infisical_environment = validate_infisical_environment,
     should_enable = should_enable,
 
     # Debug utilities