@tdk-landscape/tdk-cli-core 1.3.135 → 1.3.137

package/CHANGELOG.md

@@ -4,6 +4,10 @@ Notable changes to the `tdk` CLI. Versions match [npm](https://www.npmjs.com/pac
 
 ## Unreleased
 
+- Shared platform stacks (postgres, traefik, proxy, messaging, infisical, monitoring, cdc, elk) now run in Compose projects named `<project>-<stack>` (for example `tdk-erp-system-database-management`) instead of the directory-named `database-management`, `tdk-out` and so on. Two TDK projects on one Docker daemon no longer share them.
+
+- Two TDK projects that each have a stack with the same name (for example `people`) no longer share Docker names. Compose projects are now `<project>-<stack>-autogenerated`, containers `<project>-<stack>-autogenerated-<service>-1` and images `<project>_<stack>_<service>:dev` (migrators `<project>_<stack>-db-migrator:dev`). Before, the second project's `tdk up` removed the first project's containers as orphans and overwrote its image. Containers from before this change keep the old names and are not removed by the new engine: stop them once, see [docs/layout.md](docs/layout.md).
+
 ## 1.3.130 (2026-10-08)
 
 - Releases now come with a signed checksum list: `checksums.txt.sigstore.json` (keyless Sigstore signature from the release workflow) is attached next to the binaries in [tdk-cli-releases](https://github.com/tdk-landscape/tdk-cli-releases/releases) and to a release with the same tag here. How to verify is in [docs/security.md](docs/security.md#releases). The binaries themselves are not signed individually (#869, #840).

package/cli/dist/commands/doctor.js

@@ -8,7 +8,7 @@ import { Command } from "commander";
 import { hasVerdaccioLicense } from "../generator/extension-fetch.js";
 import { DEVCONTAINER_DOCKER_FIX, detectHost, isContainerHost, WEBCONTAINER_DOCS, WEBCONTAINER_UP_MESSAGE, } from "../utils/agent-host.js";
 import { projectNeedsBun } from "../utils/bun-requirement.js";
-import { MASTER_CONFIG_FILES, REQUIRED_PACKAGE_SCRIPTS } from "../utils/constants.js";
+import { CONTAINER_RUNTIME_CHECK, MASTER_CONFIG_FILES, REQUIRED_PACKAGE_SCRIPTS, } from "../utils/constants.js";
 import { isPathDiscovered, readDiscoveryPaths } from "../utils/discovery-paths.js";
 import { collectDoctorChecks, createDoctorReport, getDoctorExitCode, } from "../utils/doctor-report.js";
 import { checkHealthRoutes, checkIngressPorts, checkPrivateNpmRegistry, checkTiltResourceHealth, projectConfigEnablesVerdaccio, summarizeServiceProbes, } from "../utils/doctor-runtime.js";
@@ -169,14 +169,14 @@ export async function checkDockerRuntime() {
         try {
             await execAsync("docker ps", EXEC_TIMEOUT_MS);
             return {
-                name: "Container Runtime",
+                name: CONTAINER_RUNTIME_CHECK,
                 didPass: true,
                 message: "Docker Desktop Linux container engine is running",
             };
         }
         catch {
             return {
-                name: "Container Runtime",
+                name: CONTAINER_RUNTIME_CHECK,
                 didPass: false,
                 message: "Docker is not running",
                 fix: DOCTOR_FIXES.dockerDaemonDown,
@@ -187,7 +187,7 @@ export async function checkDockerRuntime() {
     try {
         await execAsync("docker ps", EXEC_TIMEOUT_MS);
         return {
-            name: "Container Runtime",
+            name: CONTAINER_RUNTIME_CHECK,
             didPass: true,
             message: "Docker daemon is running",
         };
@@ -195,7 +195,7 @@ export async function checkDockerRuntime() {
     catch (err) {
         if (isTimeout(err)) {
             return {
-                name: "Container Runtime",
+                name: CONTAINER_RUNTIME_CHECK,
                 didPass: false,
                 message: "Docker daemon is not responding",
                 fix: DOCTOR_FIXES.dockerDaemonDown,
@@ -205,14 +205,14 @@ export async function checkDockerRuntime() {
     // Docker not running: check for Colima, then Podman
     if (await succeeds("colima status")) {
         return {
-            name: "Container Runtime",
+            name: CONTAINER_RUNTIME_CHECK,
             didPass: true,
             message: "Colima (Docker runtime) is running",
         };
     }
     if (findOnPath("colima")) {
         return {
-            name: "Container Runtime",
+            name: CONTAINER_RUNTIME_CHECK,
             didPass: false,
             message: "Colima is installed but not running",
             fix: DOCTOR_FIXES.dockerDaemonDown,
@@ -220,21 +220,21 @@ export async function checkDockerRuntime() {
     }
     if (await succeeds("podman ps")) {
         return {
-            name: "Container Runtime",
+            name: CONTAINER_RUNTIME_CHECK,
             didPass: true,
             message: "Podman is running",
         };
     }
     if (hasDockerCli) {
         return {
-            name: "Container Runtime",
+            name: CONTAINER_RUNTIME_CHECK,
             didPass: false,
             message: "Docker daemon is not running",
             fix: DOCTOR_FIXES.dockerDaemonDown,
         };
     }
     return {
-        name: "Container Runtime",
+        name: CONTAINER_RUNTIME_CHECK,
         didPass: false,
         message: "Docker is not running",
         fix: DOCTOR_FIXES.dockerMissing,
@@ -831,8 +831,8 @@ function parseDockerStats(raw) {
         const [name, memPctRaw, cpuPctRaw] = line.split(",");
         return {
             name: name ?? "unknown",
-            memPct: Number.parseFloat((memPctRaw ?? "").replace("%", "")),
-            cpuPct: Number.parseFloat((cpuPctRaw ?? "").replace("%", "")),
+            memPct: Number.parseFloat((memPctRaw ?? "").replace(/%/g, "")),
+            cpuPct: Number.parseFloat((cpuPctRaw ?? "").replace(/%/g, "")),
         };
     })
         .filter((stat) => Number.isFinite(stat.memPct) && Number.isFinite(stat.cpuPct));
@@ -1089,7 +1089,7 @@ export const doctorCommand = new Command("doctor")
     const { checks: results, errors } = await collectDoctorChecks(machineChecks, inProject ? projectChecks : []);
     if (isContainerHost(host.kind)) {
         for (const result of results) {
-            if (result.name === "Container Runtime" && !result.didPass) {
+            if (result.name === CONTAINER_RUNTIME_CHECK && !result.didPass) {
                 result.fix = DEVCONTAINER_DOCKER_FIX;
             }
         }

package/cli/dist/commands/resource.js

@@ -12,6 +12,7 @@ import { hasDddLicense } from "../generator/extension-fetch.js";
 import { getDockerfileTemplate, getTestTemplate, getWorkerIndexTemplate, } from "../generator/resource-templates.js";
 import { CREATABLE_RESOURCE_TYPES } from "../types/index.js";
 import { assertValid, confirmOrCancel } from "../utils/command-helpers.js";
+import { BRING_YOUR_OWN_TYPE, SERVICE_JSON } from "../utils/constants.js";
 import { chooseResourcePath, isPathDiscovered, readDiscoveryPaths, } from "../utils/discovery-paths.js";
 import { errorFactories, requireProjectRoot, runCommand, TdkError } from "../utils/errors.js";
 import { writeFilesWithProgress } from "../utils/file-helpers.js";
@@ -55,7 +56,7 @@ export const TYPE_SPECIFIC = {
     mcp: {
         healthCheckPath: "/health",
     },
-    "bring-your-own": {
+    [BRING_YOUR_OWN_TYPE]: {
         healthCheckPath: "/health",
     },
 };
@@ -123,7 +124,7 @@ export function createByoServiceJson(name, stack, port, options) {
         $schema: SERVICE_MANIFEST_SCHEMA_URL,
         schemaVersion: SERVICE_MANIFEST_SCHEMA_VERSION,
         appName: name,
-        appType: "bring-your-own",
+        appType: BRING_YOUR_OWN_TYPE,
         stack,
         port,
         healthCheckPath: options.healthCheckPath,
@@ -251,7 +252,7 @@ export const TSCONFIG_TEMPLATE = {
 export { getBackendIndexTemplate };
 /** Resource types `tdk resource --type` accepts; `byo` is an alias of `bring-your-own`. */
 export function parseResourceType(type) {
-    const normalized = type === "byo" ? "bring-your-own" : type;
+    const normalized = type === "byo" ? BRING_YOUR_OWN_TYPE : type;
     const validTypes = [...CREATABLE_RESOURCE_TYPES, "sdk"];
     if (!validTypes.includes(normalized)) {
         throw new TdkError(`Unknown resource type "${type}". Supported types: ${validTypes.join(", ")}.`, [`Use one of: ${validTypes.join(", ")}`, "Omit --type to create a backend"]);
@@ -412,7 +413,7 @@ export const resourceCommand = new Command("resource")
                 frontend: `apps/${resourceName}`,
                 worker: `workers/${resourceName}`,
                 mcp: `services/${stackName}/${resourceName}`,
-                "bring-your-own": `services/${stackName}/${resourceName}`,
+                [BRING_YOUR_OWN_TYPE]: `services/${stackName}/${resourceName}`,
                 sdk: `packages/${resourceName}`,
             };
             finalResourcePath = defaultPaths[resourceType];
@@ -434,7 +435,7 @@ export const resourceCommand = new Command("resource")
         }
         // Check if resource already exists
         const isExistingResource = existsSync(fullPath);
-        const hasServiceJson = existsSync(resolve(fullPath, "service.json"));
+        const hasServiceJson = existsSync(resolve(fullPath, SERVICE_JSON));
         if (resourceType === "sdk" && !hasServiceJson) {
             throw new TdkError(`No service.json in ${finalResourcePath}`, [
                 'Add one with "appType": "sdk", then run this again to register it',
@@ -443,14 +444,14 @@ export const resourceCommand = new Command("resource")
         const shouldRegisterExisting = options.registerExisting ||
             resourceType === "sdk" ||
             (isExistingResource && hasServiceJson);
-        if (isExistingResource && !shouldRegisterExisting && resourceType !== "bring-your-own") {
+        if (isExistingResource && !shouldRegisterExisting && resourceType !== BRING_YOUR_OWN_TYPE) {
             errorFactories.directoryExists(fullPath).exit();
         }
         const nextPort = resourceType === "sdk"
             ? 0
             : assignPort(resourceType, allResources);
         if (options.restart !== undefined) {
-            if (resourceType !== "bring-your-own") {
+            if (resourceType !== BRING_YOUR_OWN_TYPE) {
                 throw new TdkError("--restart can only be used with --type bring-your-own.", [
                     "Add --type bring-your-own, or drop --restart",
                 ]);
@@ -461,7 +462,7 @@ export const resourceCommand = new Command("resource")
                 ]);
             }
         }
-        const assignedPort = resourceType === "bring-your-own"
+        const assignedPort = resourceType === BRING_YOUR_OWN_TYPE
             ? resolveByoPort(options.port, nextPort, allResources)
             : nextPort;
         console.log(chalk.gray("\nResource details:"));
@@ -483,7 +484,7 @@ export const resourceCommand = new Command("resource")
         if (shouldRegisterExisting && hasServiceJson) {
             // Read existing service.json
             const { readFileSync } = await import("node:fs");
-            const existingServiceJsonPath = resolve(fullPath, "service.json");
+            const existingServiceJsonPath = resolve(fullPath, SERVICE_JSON);
             const existingContent = readFileSync(existingServiceJsonPath, "utf-8");
             const existingServiceJson = JSON.parse(existingContent);
             // Update with new values while preserving existing fields
@@ -506,7 +507,7 @@ export const resourceCommand = new Command("resource")
             return;
         }
         // Handle bring-your-own type
-        if (resourceType === "bring-your-own") {
+        if (resourceType === BRING_YOUR_OWN_TYPE) {
             console.log(chalk.blue("\n📁 Creating bring-your-own resource..."));
             // Parse port option
             const port = assignedPort;
@@ -528,7 +529,7 @@ export const resourceCommand = new Command("resource")
                 ...(options.restart ? { restart: options.restart } : {}),
             });
             const { writeFileSync } = await import("node:fs");
-            writeFileSync(resolve(fullPath, "service.json"), JSON.stringify(byoServiceJson, null, 2));
+            writeFileSync(resolve(fullPath, SERVICE_JSON), JSON.stringify(byoServiceJson, null, 2));
             // Create Dockerfile stub if no image provided and dockerfile doesn't exist
             if (!options.image && !existsSync(dockerfilePath)) {
                 mkdirSync(resolve(dockerfilePath, ".."), { recursive: true });
@@ -599,7 +600,7 @@ This file contains the resource configuration for TDK.
         const tasks = [
             {
                 type: "json",
-                filename: "service.json",
+                filename: SERVICE_JSON,
                 content: serviceJson,
                 description: "Generating service.json",
                 emoji: "📝",
@@ -676,7 +677,7 @@ This file contains the resource configuration for TDK.
         const languageFiles = backendLanguage?.createFiles?.(resourceName);
         if (languageFiles) {
             const owned = new Set(languageFiles.map((file) => file.filename));
-            const sharedTasks = tasks.filter((task) => task.filename === "service.json" ||
+            const sharedTasks = tasks.filter((task) => task.filename === SERVICE_JSON ||
                 !(owned.has(task.filename) ||
                     task.filename === "Dockerfile" ||
                     task.filename === "src/index.ts" ||
@@ -715,7 +716,7 @@ This file contains the resource configuration for TDK.
             writeFilesWithProgress(migratorPath, [
                 {
                     type: "json",
-                    filename: "service.json",
+                    filename: SERVICE_JSON,
                     content: migratorConfig,
                     description: "Generating Prisma migrator manifest",
                     emoji: "🗃️",

package/cli/dist/generator/template-engine.js

@@ -6,6 +6,7 @@ import { fileURLToPath } from "node:url";
 import Handlebars from "handlebars";
 import { PLATFORM_STANDARDS } from "../config/platform-standards.js";
 import { writeTextFileAtomic } from "../utils/atomic-write.js";
+import { DATABASE_MANAGEMENT_FEATURE, TILTIGNORE_FILE } from "../utils/constants.js";
 import { writeTextFile } from "../utils/file-helpers.js";
 import { assertTdkGeneratedPath } from "../utils/generated-paths.js";
 import { DEFAULT_ALWAYS_ENABLED_INFRA } from "../utils/project-config-defaults.js";
@@ -52,7 +53,7 @@ let embeddedTemplatesCache = null;
 function getEmbeddedTemplates() {
     if (!embeddedTemplatesCache) {
         embeddedTemplatesCache = {
-            ".tiltignore": loadTemplate(".tiltignore.hbs"),
+            [TILTIGNORE_FILE]: loadTemplate(".tiltignore.hbs"),
             "TILT_RESOURCE_DEFAULTS.star": loadTemplate("TILT_RESOURCE_DEFAULTS.star.hbs"),
             "TILT_TECH_STACK.star": loadTemplate("TILT_TECH_STACK.star.hbs"),
             Tiltfile: loadTemplate("Tiltfile.hbs"),
@@ -66,6 +67,7 @@ function getEmbeddedTemplates() {
 const RESOURCE_DESCRIPTIONS = {
     proxy: "Traefik reverse proxy",
     verdaccio: "Private npm registry",
+    // This key is emitted into spec.master, so it must stay the literal stack id.
     "database-management": "PostgreSQL database",
 };
 const INFRA_DESCRIPTIONS = {
@@ -93,12 +95,16 @@ export class TemplateEngine {
         this.templatesDir = templatesDir || path.join(currentDir, "..", "..", "templates");
         this.registerHelpers();
     }
+    // Backslashes must be escaped before quotes, or a value ending in a backslash escapes the closing quote.
+    quoteStarlarkString(s) {
+        return `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+    }
     formatStarlarkValue(val) {
         if (val === null || val === undefined) {
             return "None";
         }
         if (typeof val === "string") {
-            return `"${val.replace(/"/g, '\\"')}"`;
+            return this.quoteStarlarkString(val);
         }
         if (typeof val === "boolean") {
             return val ? "True" : "False";
@@ -112,7 +118,7 @@ export class TemplateEngine {
         }
         if (typeof val === "object") {
             const entries = Object.entries(val).map(([key, v]) => {
-                return `"${key}": ${this.formatStarlarkValue(v)}`;
+                return `${this.quoteStarlarkString(key)}: ${this.formatStarlarkValue(v)}`;
             });
             return `{${entries.join(", ")}}`;
         }
@@ -195,6 +201,7 @@ export class TemplateEngine {
             "TILT_RESOURCE_DEFAULTS.star": this.generateServiceDefaults(context),
             "spec.master": this.generateSpecMaster(context),
             Tiltfile: this.generateTiltfile(context),
+            // Key must stay the literal: Record<GeneratedFileName, ...> requires it.
             ".tiltignore": this.generateTiltIgnore(context),
         };
     }
@@ -456,16 +463,16 @@ export async function generateMasterConfigs(projectRoot, options = {}) {
         writeTextFileAtomic(filePath, content);
         console.log(`✓ Generated: .tdk/.tdk-out/${filename}`);
     }
-    if (isStackFeatureEnabledInStacks(projectConfig.phases, "database-management")) {
-        const composePath = assertTdkGeneratedPath(projectRoot, path.join("services", "platform", "database-management", "docker-compose.yml"));
+    if (isStackFeatureEnabledInStacks(projectConfig.phases, DATABASE_MANAGEMENT_FEATURE)) {
+        const composePath = assertTdkGeneratedPath(projectRoot, path.join("services", "platform", DATABASE_MANAGEMENT_FEATURE, "docker-compose.yml"));
         const composeDir = path.dirname(composePath);
         fs.mkdirSync(composeDir, { recursive: true });
         writeTextFileAtomic(composePath, generateDatabaseManagementCompose(projectConfig));
         console.log("✓ Generated: services/platform/database-management/docker-compose.yml");
     }
     // Copy .tiltignore to project root so Tilt uses it
-    const tiltignoreSource = path.join(outputDir, ".tiltignore");
-    const tiltignoreTarget = assertTdkGeneratedPath(projectRoot, ".tiltignore");
+    const tiltignoreSource = path.join(outputDir, TILTIGNORE_FILE);
+    const tiltignoreTarget = assertTdkGeneratedPath(projectRoot, TILTIGNORE_FILE);
     if (fs.existsSync(tiltignoreSource)) {
         if (!fs.existsSync(tiltignoreTarget)) {
             fs.copyFileSync(tiltignoreSource, tiltignoreTarget);
@@ -652,7 +659,7 @@ export function verifyMasterConfigs(projectRoot) {
     }
     // `tdk project` never overwrites a root .tiltignore the repo already has, so one
     // without TDK's header belongs to the team: it is not drift.
-    const rootTiltIgnore = path.join(projectRoot, ".tiltignore");
+    const rootTiltIgnore = path.join(projectRoot, TILTIGNORE_FILE);
     const rootTiltIgnoreText = fs.existsSync(rootTiltIgnore)
         ? fs.readFileSync(rootTiltIgnore, "utf-8")
         : undefined;
@@ -660,7 +667,7 @@ export function verifyMasterConfigs(projectRoot) {
         warnings.push(".tiltignore: not generated by TDK, left as is");
     }
     else {
-        addDrift(".tiltignore", rootTiltIgnoreText, expectedFiles[".tiltignore"]);
+        addDrift(TILTIGNORE_FILE, rootTiltIgnoreText, expectedFiles[TILTIGNORE_FILE]);
     }
     for (const manifestPath of discoverServiceManifestPaths(projectRoot)) {
         const displayPath = path.relative(projectRoot, manifestPath).split(path.sep).join("/");

package/cli/dist/utils/constants.js

@@ -1,3 +1,22 @@
+// Name of the doctor check that verifies a container runtime is reachable.
+// It is looked up by name in doctor-report.ts, so both sides must use this
+// constant instead of a bare string literal.
+export const CONTAINER_RUNTIME_CHECK = "Container Runtime";
+// Resource type id for services the user brings themselves. Referenced by
+// value in several modules, so a typo in one copy would compile and silently
+// stop matching. `types/index.ts` keeps its own literal: it is the leaf module
+// that defines ResourceType, so importing this file back would be circular.
+// Typed as the literal (not the wider ResourceType union): computed keys built
+// from it stay narrow enough to satisfy Record<ResourceType, ...>.
+export const BRING_YOUR_OWN_TYPE = "bring-your-own";
+// Compile-time check that the literal above really is a ResourceType member.
+const _bringYourOwnIsResourceType = BRING_YOUR_OWN_TYPE;
+// Stack feature id for the shared platform database.
+export const DATABASE_MANAGEMENT_FEATURE = "database-management";
+// Root .tiltignore written by the generator and checked by doctor drift.
+export const TILTIGNORE_FILE = ".tiltignore";
+// Manifest file name for a resource, used by discovery and the resource command.
+export const SERVICE_JSON = "service.json";
 export const MASTER_CONFIG_FILES = [
     "TILT_TECH_STACK.star",
     "TILT_RESOURCE_DEFAULTS.star",
@@ -11,7 +30,7 @@ export const VALID_RESOURCE_TYPES = [
     "worker",
     "migrator",
     "mcp",
-    "bring-your-own",
+    BRING_YOUR_OWN_TYPE,
 ];
 // Frontend/library/sdk services are served statically or consumed as
 // packages, so they never need a "start" script - only backend/worker/
@@ -25,7 +44,7 @@ export const REQUIRED_PACKAGE_SCRIPTS = {
     frontend: ["dev", "build"],
     library: ["dev", "build"],
     sdk: ["dev", "build"],
-    "bring-your-own": [],
+    [BRING_YOUR_OWN_TYPE]: [],
 };
 // Version specifiers that pin nothing at all - a fresh `bun install`/`npm install`
 // can pull a different (possibly breaking) version on every run.
@@ -42,7 +61,7 @@ export const PORT_RANGES = {
     backend: { base: 4000, min: 4000, max: 4999, range: "4000-4999" },
     // An MCP server is an HTTP service, so it shares the backend-compatible range with bring-your-own.
     mcp: { base: 4000, min: 4000, max: 5999, range: "4000-5999" },
-    "bring-your-own": { base: 4000, min: 4000, max: 5999, range: "4000-5999" },
+    [BRING_YOUR_OWN_TYPE]: { base: 4000, min: 4000, max: 5999, range: "4000-5999" },
     worker: { base: 6000, min: 6000, max: 6999, range: "6000-6999" },
     health: { base: 5000, min: 5000, max: 5999, range: "5000-5999" },
     migrator: { base: 7000, min: 7000, max: 7999, range: "7000-7999" },

package/cli/dist/utils/discovery-paths.js

@@ -11,12 +11,36 @@ const DEFAULT_DISCOVERY_PATHS = ["services/*/*"];
 function segments(path) {
     return path.split(sep).filter(Boolean);
 }
+// Wildcard match without building a RegExp: `*` matches any run of characters, `?` one character,
+// everything else is literal. Greedy with a single backtrack point, so it stays linear-ish on
+// hostile patterns such as "a*a*a*b".
 function segmentMatches(pattern, name) {
-    const source = pattern
-        .replace(/[.+^${}()|[\]\\]/g, "\\$&")
-        .replace(/\*/g, "[^/]*")
-        .replace(/\?/g, "[^/]");
-    return new RegExp(`^${source}$`).test(name);
+    let p = 0;
+    let n = 0;
+    let starP = -1;
+    let starN = 0;
+    while (n < name.length) {
+        if (p < pattern.length &&
+            pattern[p] !== "*" &&
+            (pattern[p] === "?" || pattern[p] === name[n])) {
+            p++;
+            n++;
+        }
+        else if (p < pattern.length && pattern[p] === "*") {
+            starP = p++;
+            starN = n;
+        }
+        else if (starP !== -1) {
+            p = starP + 1;
+            n = ++starN;
+        }
+        else {
+            return false;
+        }
+    }
+    while (p < pattern.length && pattern[p] === "*")
+        p++;
+    return p === pattern.length;
 }
 function globMatchesDir(patternSegments, dirSegments) {
     return (patternSegments.length === dirSegments.length &&

package/cli/dist/utils/doctor-report.js

@@ -1,3 +1,4 @@
+import { CONTAINER_RUNTIME_CHECK } from "./constants.js";
 /** Wait for concurrent probes to finish even if one throws, so they can release resources. */
 export async function collectDoctorChecks(machineChecks, projectChecks) {
     const checks = [];
@@ -21,7 +22,7 @@ export async function collectDoctorChecks(machineChecks, projectChecks) {
     return { checks, errors };
 }
 function containerRuntimeReachable(checks) {
-    const runtime = checks.find((check) => check.name === "Container Runtime");
+    const runtime = checks.find((check) => check.name === CONTAINER_RUNTIME_CHECK);
     return runtime ? runtime.didPass : null;
 }
 /** Produce the same readiness decision for human and machine consumers. */

package/cli/dist/utils/doctor-runtime.js

@@ -56,9 +56,12 @@ export function parsePublishedPortHolders(dockerPsOutput, ports) {
         const portsField = tab >= 0 ? trimmed.slice(tab + 1) : "";
         const publishedPorts = [];
         for (const port of wanted) {
-            // Matches 0.0.0.0:80->, :::80->, 127.0.0.1:80->
-            const pattern = new RegExp(`(?:^|[\\s,])(?:\\d[\\d.]*:|\\[::\\]:|::)?${port}->`);
-            if (pattern.test(portsField) || portsField.includes(`:${port}->`)) {
+            // Each mapping is "[ip:]hostPort->containerPort/proto"; match the host port exactly
+            // (80-> or 0.0.0.0:80->, :::80->, 127.0.0.1:80->), never a longer number such as 1080->.
+            const published = portsField
+                .split(/[\s,]+/)
+                .some((mapping) => mapping.startsWith(`${port}->`) || mapping.includes(`:${port}->`));
+            if (published) {
                 publishedPorts.push(port);
             }
         }
@@ -643,7 +646,7 @@ export function orderTiltFailures(failures) {
  * Best-effort root cause for runtime crashes when buildHistory has no error.
  * Reads recent docker logs for the matching container name.
  */
-export function probeContainerRuntimeError(resourceName, exec = execSync) {
+export function probeContainerRuntimeError(resourceName, exec = execSync, projectName = getProjectName()) {
     try {
         const names = runHostCommand(exec, "docker", ["ps", "-a", "--format", "{{.Names}}"], "docker ps -a --format '{{.Names}}'", {
             stdio: "pipe",
@@ -653,7 +656,12 @@ export function probeContainerRuntimeError(resourceName, exec = execSync) {
             .split("\n")
             .map((line) => line.trim())
             .filter(Boolean);
+        // Compose names the container <project>-<stack>-autogenerated-<resource>-1. Prefer this project's
+        // container: another TDK project can run a stack with the same name on the same Docker daemon.
+        const composeSuffix = `-autogenerated-${resourceName}-1`;
         const match = names.find((name) => name === resourceName) ??
+            names.find((name) => name.startsWith(`${projectName}-`) && name.endsWith(composeSuffix)) ??
+            names.find((name) => name.endsWith(composeSuffix)) ??
             names.find((name) => name.includes(resourceName));
         if (!match)
             return null;

package/cli/dist/utils/doctor-wiring.js

@@ -4,6 +4,7 @@ import { execFileSync, execSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { basename, dirname, join, relative } from "node:path";
 import { BACKEND_LANGUAGES } from "../backend-languages/registry.js";
+import { BRING_YOUR_OWN_TYPE, DATABASE_MANAGEMENT_FEATURE } from "./constants.js";
 import { execAsync } from "./exec-async.js";
 import { formatCount } from "./formatting.js";
 import { findProjectRoot } from "./paths.js";
@@ -123,7 +124,7 @@ export function checkPrismaConsistency(projectRoot = findProjectRoot() ?? proces
         findings.push(...prismaConfigFindings(resource.path).map((finding) => `${resource.name}: ${finding}`));
         const appType = resource.config?.appType ?? resource.type;
         if (appType === "migrator") {
-            const postgresDependency = resource.config?.dependsOn?.some((name) => name === "postgres" || name === "database-management");
+            const postgresDependency = resource.config?.dependsOn?.some((name) => name === "postgres" || name === DATABASE_MANAGEMENT_FEATURE);
             if (!postgresDependency)
                 findings.push(`${resource.name}: migrator must depend on postgres or database-management`);
         }
@@ -182,7 +183,7 @@ function ownsRuntimeFiles(resource) {
  * (or its `buildContext`), or pulls `image`, and never generates the golden-layer Dockerfile that COPYs a package.json.
  */
 function isBringYourOwn(resource) {
-    return (resource.config?.appType ?? resource.type) === "bring-your-own";
+    return (resource.config?.appType ?? resource.type) === BRING_YOUR_OWN_TYPE;
 }
 export function checkResourcePackageJson(projectRoot = findProjectRoot() ?? process.cwd()) {
     const missing = discoverResourcesFromRoot(projectRoot)
@@ -236,7 +237,7 @@ function isRoutedToPort(resource) {
     const appType = resource.config?.appType;
     if (isApiServiceType(appType))
         return true;
-    return appType === "bring-your-own" && resource.config?.exposeViaProxy !== false;
+    return appType === BRING_YOUR_OWN_TYPE && resource.config?.exposeViaProxy !== false;
 }
 /**
  * Two routed resources on one `port`. This is a warning, not a failure: the engine publishes no service
@@ -343,7 +344,7 @@ export function checkSharedStackRoutes(projectRoot = findProjectRoot() ?? proces
     for (const resource of discoverResourcesFromRoot(projectRoot)) {
         const config = resource.config;
         const routable = isApiServiceType(config?.appType) ||
-            (config?.appType === "bring-your-own" && config.exposeViaProxy !== false);
+            (config?.appType === BRING_YOUR_OWN_TYPE && config.exposeViaProxy !== false);
         if (!routable)
             continue;
         const directory = dirname(resource.path);

package/cli/dist/utils/generated-paths.js

@@ -2,13 +2,14 @@
 // SPDX-License-Identifier: MIT
 import { existsSync, lstatSync } from "node:fs";
 import { isAbsolute, normalize, relative, sep } from "node:path";
+import { TILTIGNORE_FILE } from "./constants.js";
 /** Reviewed TDK-owned destinations written by `tdk config regenerate` or Tilt generation. */
 export const TDK_GENERATED_PATH_ALLOWLIST = [
     ".autogenerated/**",
     ".tdk/.tdk-out/**",
     "Tiltfile",
     "TILT_*.star",
-    ".tiltignore",
+    TILTIGNORE_FILE,
     "package.json (create only)",
     "shared-platform-engineering/docker-templates/**",
     "services/platform/database-management/docker-compose.yml",
@@ -29,7 +30,7 @@ export function isTdkGeneratedPath(path) {
     }
     return (normalized === "Tiltfile" ||
         /^TILT_[^/]+\.star$/.test(normalized) ||
-        normalized === ".tiltignore" ||
+        normalized === TILTIGNORE_FILE ||
         normalized === "package.json" ||
         normalized === "services/platform/database-management/docker-compose.yml");
 }

package/cli/dist/utils/host-port-config.js

@@ -11,7 +11,7 @@ export function isDockerPortOwnedByProject(dockerPs, projectPrefix, port) {
         const containerName = name.toLowerCase();
         const prefix = projectPrefix.toLowerCase();
         return ((containerName.startsWith(`${prefix}_`) || containerName.startsWith(`${prefix}-`)) &&
-            new RegExp(`:${port}->`).test(ports));
+            ports.includes(`:${port}->`));
     });
 }
 export function readSavedHostPortPlan(projectRoot) {

package/cli/dist/utils/project-config-defaults.js

@@ -1,5 +1,6 @@
 // Copyright (c) 2026 TDK Landscape contributors
 // SPDX-License-Identifier: MIT
+import { DATABASE_MANAGEMENT_FEATURE } from "./constants.js";
 /**
  * Defaults shared by project generation and CLI predicates.
  *
@@ -13,5 +14,5 @@
  * they report Postgres-will-start while the engine does not start it (or
  * the reverse). See shared-platform-postgres.ts.
  */
-export const DEFAULT_ALWAYS_ENABLED_INFRA = ["database-management", "proxy"];
+export const DEFAULT_ALWAYS_ENABLED_INFRA = [DATABASE_MANAGEMENT_FEATURE, "proxy"];
 //# sourceMappingURL=project-config-defaults.js.map

package/cli/dist/utils/project-features.js

@@ -1,14 +1,6 @@
 // Copyright (c) 2026 TDK Landscape contributors
 // SPDX-License-Identifier: MIT
-/**
- * Project-Level Features
- *
- * These are infrastructure and optional services enabled at the project level.
- * They are available to all resources and are configured in project.json stacks.
- *
- * Default: All CORE features enabled in pre_alpha stack
- * Optional/premium: disabled by default (can be enabled in optional_infra)
- */
+import { DATABASE_MANAGEMENT_FEATURE } from "./constants.js";
 export const PROJECT_FEATURES = {
     // ============================================================================
     // CORE INFRASTRUCTURE (always enabled in pre_alpha)
@@ -33,8 +25,8 @@ export const PROJECT_FEATURES = {
         enabled_by_default: false,
         dependsOn: [],
     },
-    "database-management": {
-        name: "database-management",
+    [DATABASE_MANAGEMENT_FEATURE]: {
+        name: DATABASE_MANAGEMENT_FEATURE,
         description: "PostgreSQL database for data persistence and SQL operations",
         category: "core",
         phase: "pre_alpha",
@@ -50,7 +42,7 @@ export const PROJECT_FEATURES = {
         category: "optional",
         phase: "pre_alpha",
         enabled_by_default: false,
-        dependsOn: ["database-management"],
+        dependsOn: [DATABASE_MANAGEMENT_FEATURE],
     },
     elk: {
         name: "elk",
@@ -66,7 +58,7 @@ export const PROJECT_FEATURES = {
         category: "optional",
         phase: "pre_alpha",
         enabled_by_default: false,
-        dependsOn: ["database-management"],
+        dependsOn: [DATABASE_MANAGEMENT_FEATURE],
     },
     "golden-image": {
         name: "golden-image",

package/cli/dist/utils/resource-features.js

@@ -9,6 +9,7 @@
  * Frontend services: api-client, env-config, api-index (enabled by default)
  * Backend services: prisma (enabled by default)
  */
+import { BRING_YOUR_OWN_TYPE } from "./constants.js";
 export const RESOURCE_FEATURES = {
     // ============================================================================
     // FRONTEND GENERATORS
@@ -161,7 +162,7 @@ export const RESOURCE_FEATURES = {
  */
 export function getDefaultFeaturesForResourceType(appType) {
     // bring-your-own doesn't generate application code, so no features
-    if (appType === "bring-your-own") {
+    if (appType === BRING_YOUR_OWN_TYPE) {
         return [];
     }
     const defaults = [];