@tdk-landscape/tdk-cli-core 1.3.91 → 1.3.93

package/engine/schemas/service-schema.json

@@ -9,7 +9,10 @@
           "appType": {
             "const": "backend"
           }
-        }
+        },
+        "required": [
+          "appType"
+        ]
       },
       "then": {
         "properties": {
@@ -29,7 +32,10 @@
           "appType": {
             "const": "frontend"
           }
-        }
+        },
+        "required": [
+          "appType"
+        ]
       },
       "then": {
         "properties": {
@@ -46,7 +52,10 @@
           "appType": {
             "const": "worker"
           }
-        }
+        },
+        "required": [
+          "appType"
+        ]
       },
       "then": {
         "properties": {
@@ -67,7 +76,10 @@
           "appType": {
             "const": "bring-your-own"
           }
-        }
+        },
+        "required": [
+          "appType"
+        ]
       },
       "then": {
         "properties": {
@@ -107,7 +119,7 @@
       "type": "string"
     },
     "appType": {
-      "description": "Resource type determining build strategy:\n• backend - Hono/Express API server\n• frontend - Vite single-page application (React, Vue, Svelte, Preact, Lit, Solid, Qwik or Vanilla TypeScript, see framework)\n• sdk - Shared library package\n• worker - Background job processor\n• migrator - Database migration runner\n• library - Shared code library\n• bring-your-own - Wrap an existing service. No app scaffold. Needs Dockerfile or --image.",
+      "description": "Resource type determining build strategy:\n• backend - Hono/Express API server\n• frontend - Vite single-page application (React, Vue, Svelte, Preact, Lit, Solid, Qwik or Vanilla TypeScript, see framework)\n• sdk - Shared library package\n• worker - Background job processor\n• migrator - Database migration runner\n• library - Shared code library\n• mcp - Model Context Protocol server (an HTTP service on Bun, run like a backend)\n• bring-your-own - Wrap an existing service. No app scaffold. Needs Dockerfile or --image.",
       "enum": [
         "backend",
         "frontend",
@@ -115,6 +127,7 @@
         "worker",
         "migrator",
         "library",
+        "mcp",
         "bring-your-own"
       ],
       "type": "string"
@@ -179,10 +192,10 @@
       "type": "object"
     },
     "secrets": {
-      "description": "Secret references resolved via Infisical. NO secrets in params/envVars - security violation.",
+      "description": "Names of secrets the resource needs. By default each is read from the project .env (gitignored) and injected into the container; with TDK_SECRET_PROVIDER=infisical they are left to Infisical. NO secret values in params/envVars or anywhere in service.json.",
       "properties": {
         "required": {
-          "description": "Required secret names. Resource CRASHES if any are missing.",
+          "description": "Required secret names. The resource does not start if any is missing from the project .env.",
           "items": {
             "type": "string",
             "pattern": "^[A-Z_][A-Z0-9_]*$"
@@ -191,7 +204,7 @@
           "uniqueItems": true
         },
         "optional": {
-          "description": "Optional secret names. Resource starts but warns if missing.",
+          "description": "Optional secret names. The resource starts with the variable empty when it is missing from the project .env.",
           "items": {
             "type": "string",
             "pattern": "^[A-Z_][A-Z0-9_]*$"
@@ -206,7 +219,7 @@
       "type": "object"
     },
     "featuresEnabled": {
-      "description": "Platform features:\n• nats - NATS JetStream eventing\n• prisma - DB ORM & migrations\n• redis - Caching layer\n• infisical - Secrets management\n• vitest - Test framework\n• traefik - Reverse proxy routing\n• websocket - WS support\n• graphql - GraphQL server\n• grpc - gRPC protocol",
+      "description": "Platform features:\n• nats - NATS JetStream eventing\n• prisma - DB ORM & migrations\n• redis - Caching layer\n• infisical - Secrets management\n• vitest - Test framework\n• traefik - Reverse proxy routing\n• websocket - WS support\n• graphql - GraphQL server\n• grpc - gRPC protocol\n• vite, tsconfig, dockerfile, nginx, ... - generator features that `tdk resource` writes into new files",
       "items": {
         "enum": [
           "nats",
@@ -217,7 +230,21 @@
           "traefik",
           "websocket",
           "graphql",
-          "grpc"
+          "grpc",
+          "api-client",
+          "env-config",
+          "api-index",
+          "vite",
+          "tsconfig",
+          "dockerfile",
+          "npmrc",
+          "bunfig",
+          "nginx",
+          "env",
+          "playwright",
+          "agents-md",
+          "ddd",
+          "sablier"
         ],
         "type": "string"
       },
@@ -229,19 +256,7 @@
       "examples": [
         "react",
         "vue",
-        "svelte",
-        "preact",
-        "lit",
-        "solid",
-        "qwik",
-        "vanilla",
-        "hono",
-        "express",
-        "elysia",
-        "fastify",
-        "nestjs",
-        "koa",
-        "h3"
+        "solid"
       ],
       "pattern": "^[a-z][a-z0-9-]*$",
       "type": "string"
@@ -251,8 +266,7 @@
       "examples": [
         "bun",
         "python",
-        "go",
-        "rust"
+        "go"
       ],
       "pattern": "^[a-z][a-z0-9-]*$",
       "type": "string"
@@ -360,6 +374,77 @@
       },
       "type": "array"
     },
+    "smoke": {
+      "description": "Post-start check run by `tdk up` through the public proxy URL (not inside the container): write a record, read it back. `tdk up` fails if a step misses. Absent means no smoke check. Workers and resources with exposeViaProxy false are skipped.",
+      "type": "object",
+      "required": [
+        "via",
+        "steps"
+      ],
+      "additionalProperties": false,
+      "properties": {
+        "via": {
+          "const": "proxy",
+          "description": "Only `proxy` is supported: the request goes to the URL `tdk up` prints."
+        },
+        "timeoutSeconds": {
+          "type": "number",
+          "exclusiveMinimum": 0,
+          "default": 60,
+          "description": "How long to wait for the route to come up. Connection errors and 404/502/503/504 are retried until then; any other wrong answer fails at once."
+        },
+        "steps": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "object",
+            "required": [
+              "path"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "name": {
+                "type": "string",
+                "description": "Optional display name for this check."
+              },
+              "method": {
+                "type": "string",
+                "default": "GET",
+                "description": "HTTP method. Defaults to GET."
+              },
+              "path": {
+                "type": "string",
+                "pattern": "^/(?!/)",
+                "description": "Appended to the service's public base URL. `{{name}}` is replaced by a value saved by an earlier step."
+              },
+              "body": {
+                "description": "JSON request body."
+              },
+              "expect": {
+                "type": "integer",
+                "minimum": 100,
+                "maximum": 599,
+                "default": 200,
+                "description": "Expected HTTP status code, from 100 through 599."
+              },
+              "bodyContains": {
+                "type": "string",
+                "description": "Optional text that must occur in the response body."
+              },
+              "save": {
+                "type": "object",
+                "additionalProperties": {
+                  "type": "string",
+                  "pattern": "^\\$\\."
+                },
+                "description": "Saves response fields for later steps, for example {\"id\": \"$.id\"}."
+              }
+            }
+          },
+          "description": "Non-empty ordered list of HTTP checks to run after the resource starts."
+        }
+      }
+    },
     "traefik": {
       "description": "Custom Traefik routing. Auto-generated if not specified.",
       "properties": {
@@ -377,14 +462,47 @@
         }
       },
       "type": "object"
+    },
+    "type": {
+      "description": "Legacy alias for appType, still read from older service.json files. Use appType in new files.",
+      "enum": [
+        "backend",
+        "frontend",
+        "sdk",
+        "worker",
+        "migrator",
+        "library",
+        "mcp",
+        "bring-your-own"
+      ],
+      "type": "string"
+    },
+    "enabled": {
+      "description": "Whether this resource is enabled in its project configuration.",
+      "type": "boolean"
+    },
+    "apiPath": {
+      "description": "API path exposed by this resource, when applicable.",
+      "type": "string"
     }
   },
   "required": [
     "appName",
-    "appType",
     "stack",
     "schemaVersion"
   ],
   "title": "TDK Landscape Resource Configuration",
-  "type": "object"
+  "type": "object",
+  "anyOf": [
+    {
+      "required": [
+        "appType"
+      ]
+    },
+    {
+      "required": [
+        "type"
+      ]
+    }
+  ]
 }

package/engine/topologies/platform/docker/auth/auth.star

@@ -12,38 +12,80 @@
 #          them as the auth_config dict.
 # =============================================================================
 
-# Default values for auth configuration
+# Default values for auth configuration.
+#
+# There is deliberately no default JWT secret: a secret that is the same in every project is not a secret. The JWT secret is
+# generated once per project by the CLI into the project `.env` (JWT_SECRET) and Compose reads it from there.
 DEFAULT_AUTH_MODE = 'local-jwt'
-DEFAULT_JWT_SECRET = 'local-development-secret-min-32-chars-long'
 DEFAULT_IDENTITY_RESOURCE_URL = 'http://identity-service:3000'
 
+# Shown by Compose when the project `.env` has no JWT_SECRET.
+JWT_SECRET_MISSING_MESSAGE = 'JWT_SECRET is not set. Run `tdk up` (it adds a generated one to the project .env) or add JWT_SECRET to .env'
+
+
+def _setting(auth_config, key, default):
+    """A configured value, or the default when the key is missing OR present with a None value.
+
+    Callers build the config dict with every key present and None for anything unset, and `dict.get(key, default)` returns that
+    None instead of the default, which used to turn into the literal text `AUTH_MODE=None` in generated files.
+    """
+    if not auth_config:
+        return default
+    value = auth_config.get(key)
+    if value == None or value == '':
+        return default
+    return value
 
-def get_auth_mode(auth_config):
-    """Get auth mode from auth config with default fallback.
+
+def _first_set(*values):
+    """The first value that is not None or an empty string, else None."""
+    for value in values:
+        if value != None and value != '':
+            return value
+    return None
+
+
+def auth_config_from_manifest(manifest):
+    """Build the auth configuration both the env file and the Compose entry use, from one place.
+
+    The two writers used to build this separately and drifted: the env file read `identityServiceUrl` while Compose read
+    `envVars.IDENTITY_RESOURCE_URL`, so setting one field changed only one output.
+
+    - authMode: the manifest's `authMode`, else `identity-service` when `dependsOn` contains `identity`, else unset (local-jwt).
+    - identityServiceUrl: the manifest's `identityServiceUrl`. The deprecated `params` / `envVars` entry named
+      `IDENTITY_RESOURCE_URL` is still honoured when the field is absent, so an existing manifest keeps working.
 
     Args:
-        auth_config: Auth configuration dictionary (may be None or empty)
+        manifest: The service manifest dict (may be None)
 
     Returns:
-        str: Auth mode ('local-jwt' or 'identity-service')
+        dict: {'authMode': str or None, 'identityServiceUrl': str or None}; None means "use the default"
     """
-    if not auth_config:
-        return DEFAULT_AUTH_MODE
-    return auth_config.get('authMode', DEFAULT_AUTH_MODE)
+    if not manifest:
+        return {'authMode': None, 'identityServiceUrl': None}
+
+    auth_mode = _first_set(
+        manifest.get('authMode'),
+        'identity-service' if 'identity' in (manifest.get('dependsOn') or []) else None,
+    )
+    identity_url = _first_set(
+        manifest.get('identityServiceUrl'),
+        (manifest.get('params') or {}).get('IDENTITY_RESOURCE_URL'),
+        (manifest.get('envVars') or {}).get('IDENTITY_RESOURCE_URL'),
+    )
+    return {'authMode': auth_mode, 'identityServiceUrl': identity_url}
 
 
-def get_jwt_secret(auth_config):
-    """Get JWT secret from auth config with default fallback.
+def get_auth_mode(auth_config):
+    """Get auth mode from auth config with default fallback.
 
     Args:
         auth_config: Auth configuration dictionary (may be None or empty)
 
     Returns:
-        str: JWT secret for local-jwt mode
+        str: Auth mode ('local-jwt' or 'identity-service')
     """
-    if not auth_config:
-        return DEFAULT_JWT_SECRET
-    return auth_config.get('jwtSecret', DEFAULT_JWT_SECRET)
+    return _setting(auth_config, 'authMode', DEFAULT_AUTH_MODE)
 
 
 def get_identity_resource_url(auth_config):
@@ -55,9 +97,7 @@ def get_identity_resource_url(auth_config):
     Returns:
         str: URL for identity service
     """
-    if not auth_config:
-        return DEFAULT_IDENTITY_RESOURCE_URL
-    return auth_config.get('identityServiceUrl', DEFAULT_IDENTITY_RESOURCE_URL)
+    return _setting(auth_config, 'identityServiceUrl', DEFAULT_IDENTITY_RESOURCE_URL)
 
 
 def get_auth_config(auth_config):
@@ -67,11 +107,10 @@ def get_auth_config(auth_config):
         auth_config: Auth configuration dictionary (may be None or empty)
 
     Returns:
-        struct: Auth configuration with mode, jwt_secret, and identity_resource_url
+        struct: Auth configuration with mode and identity_resource_url (the JWT secret lives in the project .env, not here)
     """
     return struct(
         mode = get_auth_mode(auth_config),
-        jwt_secret = get_jwt_secret(auth_config),
         identity_resource_url = get_identity_resource_url(auth_config),
     )
 
@@ -113,12 +152,12 @@ def generate_docker_compose_auth_env(auth_config):
         str: Formatted auth environment variables for docker-compose
     """
     auth_mode = get_auth_mode(auth_config)
-    jwt_secret = get_jwt_secret(auth_config)
     identity_resource_url = get_identity_resource_url(auth_config)
 
     if auth_mode == 'local-jwt':
+        # Required from the project .env (see JWT_SECRET_MISSING_MESSAGE); there is no shared default.
         return """      - AUTH_MODE=local-jwt
-      - JWT_SECRET=${JWT_SECRET:-%(jwt_secret)s}""" % {'jwt_secret': jwt_secret}
+      - JWT_SECRET=${JWT_SECRET:?%(message)s}""" % {'message': JWT_SECRET_MISSING_MESSAGE}
     else:
         return """      - AUTH_MODE=identity-service
       - IDENTITY_RESOURCE_URL=${IDENTITY_RESOURCE_URL:-%(identity_resource_url)s}""" % {'identity_resource_url': identity_resource_url}
@@ -128,7 +167,9 @@ def generate_env_file_auth_section(auth_config):
     """Generate .env file auth section content.
 
     This function returns the formatted authentication configuration section
-    for .env.backend.autogenerated files.
+    for .env.backend.autogenerated files. These files are generated, checked by
+    `tdk config verify` and never carry secrets, so there is no JWT secret here:
+    in local-jwt mode Compose takes JWT_SECRET from the project .env.
 
     Args:
         auth_config: Auth configuration dictionary (may be None or empty)
@@ -137,7 +178,6 @@ def generate_env_file_auth_section(auth_config):
         str: Formatted auth section for .env files
     """
     auth_mode = get_auth_mode(auth_config)
-    jwt_secret = get_jwt_secret(auth_config)
     identity_resource_url = get_identity_resource_url(auth_config)
 
     content = """
@@ -146,9 +186,7 @@ def generate_env_file_auth_section(auth_config):
 AUTH_MODE={auth_mode}
 """.format(auth_mode=auth_mode)
 
-    if auth_mode == 'local-jwt':
-        content += "JWT_SECRET={jwt_secret}\n".format(jwt_secret=jwt_secret)
-    else:
+    if auth_mode != 'local-jwt':
         content += "IDENTITY_RESOURCE_URL={identity_resource_url}\n".format(identity_resource_url=identity_resource_url)
 
     return content
@@ -156,8 +194,8 @@ AUTH_MODE={auth_mode}
 
 # Export all functions as a struct for easy importing
 AuthConfig = struct(
+    from_manifest = auth_config_from_manifest,
     get_auth_mode = get_auth_mode,
-    get_jwt_secret = get_jwt_secret,
     get_identity_resource_url = get_identity_resource_url,
     get_auth_config = get_auth_config,
     is_local_jwt_mode = is_local_jwt_mode,

package/engine/topologies/platform/docker/compose/compose.star

@@ -20,6 +20,7 @@ load("./compose_helpers.star", "with_runtime_image_tag", "compose_build_config")
 load("../networking/traefik.star", "get_frontend_traefik_labels", "get_backend_traefik_labels")
 load("../networking/api_path_constants.star", "get_api_path_for_domain", "get_frontend_base_path")
 load("../secrets/infisical.star", "get_infisical_environment_vars")
+load("../secrets/env_secrets.star", "get_secret_environment_lines")
 load("../auth/auth.star", "AuthConfig")
 
 load("../constants.star", "PlatformDockerConstants")
@@ -189,32 +190,12 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
     nats_queue = nats_cfg.get('queueGroup', stack + '_backend_svc')
     nats_url = PlatformDockerConstants.NATS_URL
     
-    # Auth configuration - use centralized auth utilities
-    # Extract auth config from manifest to decouple auth.star from manifest structure
-    # Auto-detect identity-service mode if 'identity' is in dependsOn
-    internal_deps = manifest.get('dependsOn', []) if manifest else []
-    has_identity_dep = 'identity' in internal_deps
-    
-    # If manifest has authMode, use it; otherwise auto-detect based on identity dependency
-    manifest_auth_mode = manifest.get('authMode') if manifest else None
-    if manifest_auth_mode:
-        auth_mode = manifest_auth_mode
-    elif has_identity_dep:
-        auth_mode = 'identity-service'
-    else:
-        auth_mode = None
-    
-    auth_config = {
-        'authMode': auth_mode,
-        'jwtSecret': manifest.get('jwtSecret') if manifest else None,
-        'identityServiceUrl': manifest.get('envVars', {}).get('IDENTITY_RESOURCE_URL') if manifest else None,
-    }
-    
-    # If we auto-detected identity-service mode but no URL is set, use default
-    if auth_mode == 'identity-service' and not auth_config['identityServiceUrl']:
-        auth_config['identityServiceUrl'] = AuthConfig.get_identity_resource_url(None)
+    # Auth configuration: one shared builder keeps this identical to the generated env file (see AuthConfig.from_manifest).
+    auth_config = AuthConfig.from_manifest(manifest)
     
     auth_env = AuthConfig.generate_docker_compose_auth_env(auth_config)
+    # secrets.required / secrets.optional, read from the project .env by Compose (empty with TDK_SECRET_PROVIDER=infisical)
+    secrets_env = get_secret_environment_lines(manifest, res_name)
     
     # Use .autogenerated/Dockerfile.app.autogenerated by default for build config (primary only)
     if manifest and manifest.get('appType') == 'bring-your-own':
@@ -240,7 +221,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
     
     # REMOVED: External port exposure - all services accessed via Traefik only
     # Services are available at {project}.localhost/api/v1/{service}
-    # Internal port 3000 is accessible within Docker network for service-to-service communication
+    # Inside the Docker network a service listens on its own port (manifest.port, passed to it as PORT), for service-to-service calls
     ports_section = ""  # No external ports - Traefik-only access
     
     # Determine service name based on instance
@@ -325,7 +306,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
       # to skip Prisma auto-migration at container boot (e.g. while diagnosing a
       # migration/CLI issue) without touching the generator or any service code.
       - AUTO_MIGRATE=${{AUTO_MIGRATE:-true}}
-{auth_env}
+{auth_env}{secrets_env}
     labels:
 {traefik_labels}
     networks:
@@ -373,6 +354,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
         healthcheck_section=healthcheck_section,
         infisical_env=infisical_env,
         auth_env=auth_env,
+        secrets_env=secrets_env,
         network_traefik_public=PlatformDockerConstants.NETWORK_TRAEFIK_PUBLIC,
         network_backend=PlatformDockerConstants.NETWORK_BACKEND,
         network_database=PlatformDockerConstants.NETWORK_DATABASE,

package/engine/topologies/platform/docker/layers/l3_builder_layers.star

@@ -28,6 +28,9 @@ load('./prisma/prisma_build.star',
     'prisma_normalize_output',
     'L3_generate_migration_engine',
 )
+# Infisical is opt-in: use_infisical defaults to False and nothing in the free engine passes True, so the generator behind this
+# (tilt/generators/infisical/secrets_generator.star) is not on the default path. It is an older contract with fixed secret names and
+# ports. Do not wire `secrets.required` through it; the default provider is platform/docker/secrets/env_secrets.star.
 load('./infisical/infisical_docker.star', 'InfisicalDocker')
 
 # Load project name for dynamic golden image naming

package/engine/topologies/platform/docker/layers/l4_runtime_layers.star

@@ -29,6 +29,9 @@ load('./prisma/prisma_runtime.star',
 
 load('./bun_helpers.star', 'bun_hoisted_packages_symlink_fix')
 load('../config/healthcheck.star', 'DOCKER_HEALTHCHECK', 'dockerfile_healthcheck_flags')
+# Infisical is opt-in: use_infisical defaults to False and nothing in the free engine passes True, so the generator behind this
+# (tilt/generators/infisical/secrets_generator.star) is not on the default path. It is an older contract with fixed secret names and
+# ports. Do not wire `secrets.required` through it; the default provider is platform/docker/secrets/env_secrets.star.
 load('./infisical/infisical_docker.star', 'InfisicalDocker')
 
 

package/engine/topologies/platform/docker/networking/api_path_constants.star

@@ -33,21 +33,6 @@ def generate_api_path(stack, app_name):
     # Examples: /api/user-management, /api/order-management
     return "/api/" + stack + "-management"
 
-# =============================================================================
-# SERVICE STACK TO API PATH MAPPING (Dynamic)
-# =============================================================================
-# This is populated at runtime from discovered manifests
-# No hardcoded resource names
-
-RESOURCE_STACK_TO_API_PATH = {}
-
-# =============================================================================
-# API PATH TO SERVICE MAPPING (Dynamic)
-# =============================================================================
-
-API_PATH_TO_RESOURCE_STACK = {}
-API_PATH_TO_RESOURCE_DOMAIN = API_PATH_TO_RESOURCE_STACK
-
 # =============================================================================
 # HELPER FUNCTIONS
 # =============================================================================
@@ -110,7 +95,7 @@ def get_api_path_for_stack(stack, manifest=None):
         return manifest.get("apiPath")
     
     # NEW: Use /api/{stack}-management pattern instead of /api/v1/{pluralized}
-    return RESOURCE_STACK_TO_API_PATH.get(stack, "/api/" + stack + "-management")
+    return "/api/" + stack + "-management"
 
 # Backwards compatibility alias
 get_api_path_for_domain = get_api_path_for_stack
@@ -176,20 +161,6 @@ def get_api_path_for_resource(resource_name):
 # Backwards compatibility alias
 get_api_path_for_service = get_api_path_for_resource
 
-def get_stack_for_api_path(api_path):
-    """Returns the service stack for an API path (reverse lookup).
-    
-    Args:
-        api_path: Full API path
-    
-    Returns:
-        Service stack string
-    """
-    return API_PATH_TO_RESOURCE_STACK.get(api_path, "")
-
-# Backwards compatibility alias
-get_domain_for_api_path = get_stack_for_api_path
-
 # Load project name for dynamic localhost domain
 # Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
 def _load_project_localhost():
@@ -231,30 +202,3 @@ def build_health_endpoint(api_path, health_path="/health"):
         Full health endpoint path
     """
     return api_path + health_path
-
-def get_all_api_paths():
-    """Returns a list of all defined API paths from discovered services.
-    
-    Returns:
-        List of API path strings
-    """
-    return RESOURCE_DOMAIN_TO_API_PATH.values()
-
-def is_valid_api_path(api_path):
-    """Checks if an API path is valid/defined.
-    
-    Args:
-        api_path: API path to check
-    
-    Returns:
-        True if valid, False otherwise
-    """
-    return api_path in API_PATH_TO_RESOURCE_DOMAIN
-
-# =============================================================================
-# LEGACY COMPATIBILITY (Deprecated - for migration only)
-# =============================================================================
-# All legacy paths removed - use dynamic path generation from manifests
-
-LEGACY_DOMAIN_TO_API_PATH = {}
-RESOURCE_DOMAIN_TO_API_PATH = LEGACY_DOMAIN_TO_API_PATH