@tdk-landscape/tdk-cli-core 1.3.91 → 1.3.92

package/engine/topologies/tilt/common/utils_env.star

@@ -3,39 +3,86 @@
 # =============================================================================
 
 
+_DOTENV_NAME_FIRST = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz_'
+_DOTENV_NAME_REST = _DOTENV_NAME_FIRST + '0123456789'
+
+
+def _is_dotenv_name(name):
+    if not name or name[0] not in _DOTENV_NAME_FIRST:
+        return False
+    for i in range(len(name)):
+        if name[i] not in _DOTENV_NAME_REST:
+            return False
+    return True
+
+
+def _dotenv_value(raw):
+    """One layer of matching quotes is removed, like a dotenv parser would.
+
+    Single quotes are literal. Inside double quotes a backslash escapes a quote, a backslash or a dollar sign, and \\n, \\r and \\t
+    become a newline, a carriage return and a tab. An unquoted value is used as is (inline comments are not stripped).
+    This reads the project .env; it does not undo the `$$` that the generated env files use for Docker Compose.
+    """
+    value = raw.strip()
+    if len(value) < 2 or value[0] not in ('"', "'") or value[-1] != value[0]:
+        return value
+
+    inner = value[1:-1]
+    if value[0] == "'":
+        return inner
+
+    result = ''
+    i = 0
+    while i < len(inner):
+        char = inner[i]
+        if char == '\\' and i + 1 < len(inner):
+            following = inner[i + 1]
+            if following == 'n':
+                result += '\n'
+            elif following == 'r':
+                result += '\r'
+            elif following == 't':
+                result += '\t'
+            elif following in ('"', '\\', '$'):
+                result += following
+            else:
+                result += char + following
+            i += 2
+            continue
+        result += char
+        i += 1
+    return result
+
+
 def load_dotenv(project_root=''):
-    """Load .env file into os.environ.
+    """Load the project .env file into os.environ.
 
     The Tiltfile lives in `.tdk/.tdk-out/`, so a bare `.env` lookup misses the
     project-root file. Prefer an explicit project_root, then TDK_PROJECT_ROOT.
+
+    The file is read with `read_file` and parsed here: nothing goes through a shell, so a path containing a quote is fine, and Tilt
+    re-evaluates the Tiltfile when the .env changes. Lines may be `NAME=value` or `export NAME=value`; comments, blank lines and
+    lines that are not an assignment to a valid name are ignored. A missing file does nothing.
     """
     if not project_root:
         project_root = os.environ.get('TDK_PROJECT_ROOT', '')
     env_path = (project_root + '/.env') if project_root else '.env'
-    content = str(local("cat '" + env_path + "' 2>/dev/null || true", quiet=True, echo_off=True))
-    if content:
-        for line in content.split('\n'):
-            line = line.strip()
-            if line and not line.startswith('#') and '=' in line:
-                key, value = line.split('=', 1)
-                os.environ[key.strip()] = value.strip().strip('"').strip("'")
-
-
-def validate_infisical_environment():
-    """Validate required Infisical environment variables are set."""
-    required_vars = ["INFISICAL_CLIENT_ID", "INFISICAL_CLIENT_SECRET", "INFISICAL_PROJECT_ID"]
-    missing_vars = [var for var in required_vars if not os.environ.get(var)]
-    if missing_vars:
-        fail("""
-🛑 MISSING REQUIRED ENVIRONMENT VARIABLES FOR INFISICAL:
-{missing_vars}
-
-Please set these variables in your environment or .env file.
-Example:
-  export INFISICAL_CLIENT_ID=your_client_id
-  export INFISICAL_CLIENT_SECRET=your_client_secret
-  export INFISICAL_PROJECT_ID=your_project_id
-""".format(missing_vars=", ".join(missing_vars)))
+    content = str(read_file(env_path, default=''))
+    if not content:
+        return
+
+    for line in content.split('\n'):
+        line = line.strip()
+        if not line or line.startswith('#'):
+            continue
+        if line.startswith('export '):
+            line = line[len('export '):].strip()
+        equals = line.find('=')
+        if equals <= 0:
+            continue
+        name = line[:equals].strip()
+        if _is_dotenv_name(name):
+            os.environ[name] = _dotenv_value(line[equals + 1:])
 
 
 def should_enable(resource_name, cfg, defaults):

package/engine/topologies/tilt/manifest/constants.star

@@ -61,6 +61,7 @@ VALID_RESOURCE_TYPES = [
     "sdk",
     "worker",
     "infra",
+    "mcp",
     "bring-your-own",
 ]
 
@@ -88,6 +89,7 @@ PORT_RANGES = {
     "frontend": {"min": 3000, "max": 5999},
     "backend": {"min": 4000, "max": 5999},
     "bring-your-own": {"min": 4000, "max": 5999},
+    "mcp": {"min": 4000, "max": 5999},
     "worker": {"min": 6000, "max": 6999},
     "migrator": {"min": 7000, "max": 7999},
     "sdk": {"min": 3000, "max": 9999},

package/engine/topologies/tilt/manifest/json_to_yaml.py

@@ -15,6 +15,10 @@ try:
     with open(json_file, 'r') as f:
         data = json.load(f)
     
+    # The YAML is a generated, committed mirror used only for Tilt resource tracking. A secret that someone put in service.json must
+    # not be copied into it (the JWT secret belongs in the project .env; `tdk doctor` warns about it).
+    data = {key: value for key, value in data.items() if key not in ("jwtSecret",)}
+
     now = datetime.datetime.now(datetime.timezone.utc).isoformat().replace("+00:00", "Z")
     uid = str(uuid.uuid4())
     

package/engine/topologies/tilt/manifest/loader.star

@@ -64,6 +64,13 @@ def load_from_file(path):
     if manifest == None:
         return struct(manifest=None, error="Invalid manifest: " + path)
     
+    # An `mcp` resource is a Model Context Protocol server: an HTTP service on Bun that is built, routed and health-checked
+    # exactly like a backend. Every backend code path keys off appType == 'backend', so normalise here, once, at the single
+    # place a service.json becomes a manifest, and keep a flag so the original type is not lost.
+    if type(manifest) == "dict" and manifest.get("appType") == "mcp":
+        manifest["appType"] = "backend"
+        manifest["mcp"] = True
+    
     return struct(manifest=manifest, error=None)
 
 def _synthesize_manifest(resource_path, stack, app_type):

package/engine/topologies/tilt/resources/orchestrator/generators/env.star

@@ -80,11 +80,45 @@ def _build_dependency_env_lines(manifest):
     return lines
 
 
+# Characters that can appear in a dotenv value without quoting.
+_ENV_BARE_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-./:@%+=,'
+
+
+def _format_env_value(value):
+    """Format a param value so the generated file stays valid dotenv.
+
+    A plain value stays bare. Anything else (a space, `#`, `$`, a quote, a backslash, a newline, or an empty string) is wrapped in double
+    quotes with backslash, quote and newline escaped, which is how dotenv parsers (including Docker Compose's) read it back.
+
+    `$` is written as `$$`: Docker Compose expands `$NAME` and `${NAME}` in env files, so an unescaped dollar would silently pick up
+    some other variable (checked in a real container: "price $$FOO" arrives as the literal `price $FOO`).
+    """
+    text = str(value)
+    bare = text != ''
+    for i in range(len(text)):
+        if text[i] not in _ENV_BARE_CHARS:
+            bare = False
+            break
+    if bare:
+        return text
+
+    escaped = text.replace('\\', '\\\\').replace('"', '\\"').replace('$', '$$').replace('\r', '\\r').replace('\n', '\\n')
+    return '"' + escaped + '"'
+
+
+def _uses_prisma(manifest):
+    """Prisma is opt-in: an explicit usePrisma, or `prisma` in featuresEnabled (the same rule the Dockerfile generator uses)."""
+    if manifest.get('usePrisma'):
+        return True
+    return 'prisma' in manifest.get('featuresEnabled', [])
+
+
 def _generate_params_env(manifest, backend_manifest=None, write_fn=None):
     """Generate params (non-secret) environment variables from manifest.
 
-    This generates config like BASE_URL, PORT, etc. - NEVER secrets.
-    Secrets are handled separately by _generate_secrets_env().
+    This generates config like BASE_URL, PORT, etc. - NEVER secrets. The file is generated and verified by `tdk config verify`, so
+    nothing secret may be written here: the JWT secret and `secrets.required` / `secrets.optional` reach the container from the
+    project `.env` through the Compose entry instead.
 
     Args:
         manifest: Service manifest dict with configuration
@@ -103,31 +137,10 @@ def _generate_params_env(manifest, backend_manifest=None, write_fn=None):
     api_url = 'http://' + PlatformDockerConstants.LOCAL_DOMAIN + api_path
     target_filename = '/' + OUTPUT.AUTOGENERATED_FOLDER + '/.env.backend.autogenerated'
     
-    # Auth configuration - support both identity service and local JWT modes
-    # Use centralized auth utilities for consistency
-    # Extract auth config from manifest to pass as a separate dict
-    # Auto-detect identity-service mode if 'identity' is in dependsOn
-    internal_deps = manifest.get('dependsOn', []) if manifest else []
-    has_identity_dep = 'identity' in internal_deps
-    
-    # If manifest has authMode, use it; otherwise auto-detect based on identity dependency
-    manifest_auth_mode = manifest.get('authMode') if manifest else None
-    if manifest_auth_mode:
-        auth_mode = manifest_auth_mode
-    elif has_identity_dep:
-        auth_mode = 'identity-service'
-    else:
-        auth_mode = None
-    
-    auth_config = {
-        'authMode': auth_mode,
-        'jwtSecret': manifest.get('jwtSecret') if manifest else None,
-        'identityServiceUrl': manifest.get('identityServiceUrl') if manifest else None,
-    }
-    
-    # If we auto-detected identity-service mode but no URL is set, use default
-    if auth_mode == 'identity-service' and not auth_config['identityServiceUrl']:
-        auth_config['identityServiceUrl'] = AuthConfig.get_identity_resource_url(None)
+    # Auth configuration: the same builder Compose uses, so the two outputs cannot disagree. A missing value is None and AuthConfig
+    # treats None as "use the default". `jwtSecret` is deliberately not read: a secret in a committed service.json would be copied into
+    # a generated file, so the secret comes from the project .env instead.
+    auth_config = AuthConfig.from_manifest(manifest)
     
     if app_type == 'frontend':
         backend_port = backend_manifest.get('port', BASE_PORT_BACKEND) if backend_manifest else BASE_PORT_BACKEND
@@ -161,7 +174,7 @@ DATABASE_NAME={db_name}
 API_URL={api_url}
 """.format(port=port, db_name=db_name, api_url=api_url)
         
-        if manifest.get('usePrisma', True):
+        if _uses_prisma(manifest):
             content += """
 # Prisma
 DATABASE_URL=""" + PlatformDockerConstants.get_database_url_for_env(db_name) + """
@@ -171,14 +184,14 @@ DATABASE_URL=""" + PlatformDockerConstants.get_database_url_for_env(db_name) + "
         content += AuthConfig.generate_env_file_auth_section(auth_config)
     
     # Add params (non-secret config variables)
-    # NOTE: Secrets are NEVER added here - they come from Infisical only
+    # NOTE: Secrets are NEVER added here (see the docstring).
     params = manifest.get('params', manifest.get('envVars', {}))  # Fallback to envVars during migration
     if params:
         content += '\n# Params (non-secret config)\n'
         # Sort keys for deterministic output to avoid unnecessary file rewrites.
         for key in sorted(params.keys()):
             value = params.get(key)
-            content += key + '=' + str(value) + '\n'
+            content += key + '=' + _format_env_value(value) + '\n'
     
     if write_fn and resource_path:
         write_fn(resource_path + target_filename, content)
@@ -186,74 +199,8 @@ DATABASE_URL=""" + PlatformDockerConstants.get_database_url_for_env(db_name) + "
     return content
 
 
-def _generate_secrets_env(manifest, write_fn=None):
-    """Generate secrets environment variables from Infisical.
-
-    This function returns a dict of secrets that will be resolved
-    from Infisical at runtime. The actual values are NOT embedded here.
-
-    CRITICAL: This function NEVER reads secrets from files - only from Infisical.
-
-    Args:
-        manifest: Service manifest dict with secrets configuration
-        write_fn: Optional write function for file output (callable)
-
-    Returns:
-        dict: Map of secret names to Infisical placeholder values
-    """
-    resource_path = manifest.get('_resource_path', '')
-    secrets_config = manifest.get('secrets', {})
-    
-    if not secrets_config:
-        return {}
-    
-    required = secrets_config.get('required', [])
-    optional = secrets_config.get('optional', [])
-    
-    # Build a placeholder map - actual values come from Infisical at runtime
-    secrets_env = {}
-    
-    for secret_name in required:
-        # Placeholder - value resolved by Infisical
-        secrets_env[secret_name] = "${INFISICAL_SECRET:" + secret_name + "}"
-    
-    for secret_name in optional:
-        # Placeholder - value resolved by Infisical
-        secrets_env[secret_name] = "${INFISICAL_SECRET:" + secret_name + "}"
-    
-    return secrets_env
-
-
-def _get_all_env(manifest, backend_manifest=None, write_fn=None):
-    """Generate complete environment (params + secrets placeholder).
-
-    Returns a dict with both params and secrets keys.
-    Actual secret values resolved by Infisical at container runtime.
-
-    Args:
-        manifest: Service manifest dict with configuration
-        backend_manifest: Optional backend manifest for frontend services
-        write_fn: Optional write function for file output (callable)
-
-    Returns:
-        dict: Contains 'params' (str) and 'secrets' (dict) keys
-    """
-    # Phase 1: Generate params (non-secret config)
-    params_content = _generate_params_env(manifest, backend_manifest, write_fn)
-    
-    # Phase 2: Get secrets configuration (resolved by Infisical)
-    secrets_env = _generate_secrets_env(manifest, write_fn)
-    
-    return {
-        'params': params_content,
-        'secrets': secrets_env,
-    }
-
-
 EnvGenerators = struct(
     generate_params_env = _generate_params_env,
-    generate_secrets_env = _generate_secrets_env,
-    get_all_env = _get_all_env,
     # Legacy alias for backward compatibility during migration
     generate_env_file = _generate_params_env,
 )

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tdk-landscape/tdk-cli-core",
-  "version": "1.3.91",
+  "version": "1.3.92",
   "description": "TDK CLI — start services on your laptop.",
   "homepage": "https://tdk-landscape.github.io/tdk-website",
   "repository": {