@tdk-landscape/tdk-cli-core 1.3.75 → 1.3.77

package/cli/dist/utils/cold-preflight.js

@@ -0,0 +1,198 @@
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { checkDockerCompose, checkDockerRuntime, checkDockerVersions, checkTilt, } from "../commands/doctor.js";
+import { checkHostPorts, checkIngressPorts } from "./doctor-runtime.js";
+import { checkNatsBroker } from "./doctor-wiring.js";
+import { findProjectRoot } from "./paths.js";
+import { discoverResourcesFromRoot } from "./services.js";
+import { findOnPath } from "./which.js";
+/** Converts a doctor check result into the preflight's compact display item. */
+function item(id, result) {
+    return {
+        id,
+        ok: result.didPass || Boolean(result.isSkipped),
+        message: result.message,
+        fix: result.fix,
+    };
+}
+/** Returns whether a Node version is below the CLI's 22.12 minimum. */
+export function nodeTooOld(version) {
+    const [major = 0, minor = 0] = String(version)
+        .split(".")
+        .map((part) => Number.parseInt(part, 10));
+    return (!Number.isFinite(major) || !Number.isFinite(minor) || major < 22 || (major === 22 && minor < 12));
+}
+async function safeCheck(id, check, fallback) {
+    try {
+        return item(id, await check());
+    }
+    catch {
+        return { id, ok: false, message: fallback };
+    }
+}
+/** Requires a Docker engine and Compose version check to complete successfully. */
+export function requireVerifiedDockerVersions(result) {
+    if (!result.isSkipped)
+        return result;
+    return {
+        ...result,
+        didPass: false,
+        isSkipped: false,
+        message: `Could not verify Docker Engine/Compose minimum versions: ${result.message}`,
+        fix: result.fix ?? "Start Docker and ensure Docker Engine 25+ and Compose 2.20.2+ are installed.",
+    };
+}
+function usesPrisma(projectRoot) {
+    try {
+        return discoverResourcesFromRoot(projectRoot).some((resource) => {
+            return resource.config?.featuresEnabled?.includes("prisma") ?? false;
+        });
+    }
+    catch {
+        return false;
+    }
+}
+export async function runColdPreflight(opts = {}) {
+    const cwd = opts.cwd ?? process.cwd();
+    const projectRoot = findProjectRoot(cwd);
+    const inProject = Boolean(projectRoot);
+    const items = [];
+    const nodeVersion = process.versions.node;
+    items.push({
+        id: "node",
+        ok: !nodeTooOld(nodeVersion),
+        message: nodeVersion,
+        fix: nodeTooOld(nodeVersion)
+            ? `Install Node.js 22.12+ (current: ${nodeVersion}). https://nodejs.org`
+            : undefined,
+    });
+    items.push(await safeCheck("docker", checkDockerRuntime, "Docker daemon is not running"));
+    items.push(await safeCheck("compose", async () => {
+        const [compose, versions] = await Promise.all([
+            checkDockerCompose(),
+            checkDockerVersions(),
+        ]);
+        if (!compose.didPass)
+            return compose;
+        return requireVerifiedDockerVersions(versions);
+    }, "Docker Engine or Compose version check failed"));
+    items.push(await safeCheck("tilt", checkTilt, "Tilt CLI not found"));
+    let bun = false;
+    const bunPath = findOnPath("bun");
+    if (bunPath) {
+        try {
+            const version = execFileSync(bunPath, ["--version"], {
+                encoding: "utf-8",
+                timeout: 3000,
+            }).trim();
+            const [major = 0, minor = 0] = version.split(".").map((part) => Number.parseInt(part, 10));
+            bun = major > 1 || (major === 1 && minor >= 2);
+        }
+        catch {
+            /* reported as a failed runtime check */
+        }
+    }
+    items.push({
+        id: "bun",
+        ok: bun,
+        message: bun ? "Bun 1.2+ is available on PATH" : "Bun 1.2+ not found on PATH",
+        fix: bun ? undefined : "curl -fsSL https://bun.sh/install | bash",
+    });
+    const [hostPorts, ingressPorts] = await Promise.all([
+        safeCheck("ports", checkHostPorts, "Could not check required host ports"),
+        safeCheck("ports", checkIngressPorts, "Could not check ingress ports"),
+    ]);
+    if (!hostPorts.ok || !ingressPorts.ok) {
+        const port5432 = !hostPorts.ok && /(?:^|\n)\s*5432\s*\(/.test(hostPorts.message);
+        const messages = [
+            !hostPorts.ok
+                ? port5432
+                    ? "Port 5432 is taken (usually local Postgres). Stop it or TDK cannot bind the bundled Postgres."
+                    : hostPorts.message
+                : undefined,
+            !ingressPorts.ok ? ingressPorts.message : undefined,
+        ].filter((message) => Boolean(message));
+        const fixes = [hostPorts.fix, ingressPorts.fix].filter((fix) => Boolean(fix));
+        items.push({
+            id: "ports",
+            ok: false,
+            message: messages.join("\n"),
+            fix: fixes.join(" "),
+        });
+    }
+    if (projectRoot) {
+        const nats = await safeCheck("nats", () => checkNatsBroker(projectRoot), "NATS broker check failed");
+        if (!nats.ok)
+            items.push(nats);
+        if (usesPrisma(projectRoot)) {
+            let dbUp = false;
+            try {
+                const config = JSON.parse(readFileSync(join(projectRoot, ".tdk", "project.json"), "utf-8"));
+                const projectName = String(config?.project?.name ?? "").replace(/-/g, "_");
+                if (projectName) {
+                    const running = execFileSync(findOnPath("docker") ?? "docker", [
+                        "ps",
+                        "--filter",
+                        `label=com.docker.compose.project=${projectName}`,
+                        "--filter",
+                        "label=com.docker.compose.service=postgres",
+                        "--filter",
+                        "health=healthy",
+                        "--format",
+                        "{{.Names}}",
+                    ], { encoding: "utf-8", timeout: 3000 }).trim();
+                    dbUp = running.length > 0;
+                }
+            }
+            catch {
+                /* Docker unavailable is already represented by the machine checks. */
+            }
+            if (!dbUp)
+                items.push({
+                    id: "prisma",
+                    ok: false,
+                    message: "A Prisma resource is configured, but the project Postgres service is not healthy",
+                    fix: "Run `tdk up` to start the bundled Postgres, then check `tdk doctor`.",
+                });
+        }
+    }
+    const failures = items.filter((check) => !check.ok).slice(0, 8);
+    const machineFailed = failures.some((check) => ["node", "docker", "compose", "tilt", "bun", "ports"].includes(check.id));
+    const bunFailed = failures.some((check) => check.id === "bun");
+    const header = failures.length
+        ? machineFailed
+            ? bunFailed
+                ? "Cold start blocked. Bun 1.2+ must be installed on PATH.\nPrisma/NATS configuration is project-specific and generated after `tdk project`. Fix the machine checks below."
+                : "Cold start blocked. Bun/Prisma/NATS are not the first failure.\nThey are generated after `tdk project`. Fix the machine checks below."
+            : "Machine is ready. Project wiring is not."
+        : "";
+    const footer = failures.length
+        ? ""
+        : inProject
+            ? "Environment ready for TDK"
+            : "This machine is ready for TDK.\nNext: tdk project --yes";
+    return { ok: failures.length === 0, inProject, items: failures, header, footer };
+}
+/** Formats only failed preflight checks and the applicable readiness message. */
+export function formatColdPreflight(result, options = {}) {
+    const lines = [result.header];
+    for (const check of result.items) {
+        lines.push(`FAIL ${check.id.padEnd(7)} ${check.message}`);
+        if (check.fix)
+            lines.push(`  ${check.fix}`);
+    }
+    if (result.footer && (options.includeSuccessFooter ?? true))
+        lines.push(result.footer);
+    return lines.filter(Boolean).join("\n");
+}
+/** Exits before machine-dependent command work when any machine check fails. */
+export async function assertMachineReadyOrExit() {
+    const result = await runColdPreflight();
+    const machineFailure = result.items.some((check) => ["node", "docker", "compose", "tilt", "bun", "ports"].includes(check.id));
+    if (machineFailure) {
+        console.error(formatColdPreflight(result));
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=cold-preflight.js.map

package/cli/dist/utils/constants.js

@@ -10,10 +10,12 @@ export const VALID_RESOURCE_TYPES = [
     "sdk",
     "worker",
     "migrator",
+    "bring-your-own",
 ];
 // Frontend/library/sdk services are served statically or consumed as
 // packages, so they never need a "start" script - only backend/worker/
 // migrator processes are run in production via `<runtime> run start`.
+// bring-your-own doesn't generate application code, so no scripts required.
 export const REQUIRED_PACKAGE_SCRIPTS = {
     backend: ["dev", "build", "start"],
     worker: ["dev", "build", "start"],
@@ -21,6 +23,7 @@ export const REQUIRED_PACKAGE_SCRIPTS = {
     frontend: ["dev", "build"],
     library: ["dev", "build"],
     sdk: ["dev", "build"],
+    "bring-your-own": [],
 };
 // Version specifiers that pin nothing at all - a fresh `bun install`/`npm install`
 // can pull a different (possibly breaking) version on every run.
@@ -35,6 +38,7 @@ export const OPTIONAL_INFRA_SERVICES = [
 export const PORT_RANGES = {
     frontend: { base: 3000, min: 3000, max: 3999, range: "3000-3999" },
     backend: { base: 4000, min: 4000, max: 4999, range: "4000-4999" },
+    "bring-your-own": { base: 4000, min: 4000, max: 5999, range: "4000-5999" },
     worker: { base: 6000, min: 6000, max: 6999, range: "6000-6999" },
     health: { base: 5000, min: 5000, max: 5999, range: "5000-5999" },
     migrator: { base: 7000, min: 7000, max: 7999, range: "7000-7999" },

package/cli/dist/utils/docker.js

@@ -1,9 +1,23 @@
-import { execSync } from "node:child_process";
+import { execFileSync, execSync } from "node:child_process";
+import { findOnPath } from "./which.js";
 // A wedged daemon makes `docker ps` block forever instead of failing.
 const RUNTIME_CHECK_TIMEOUT_MS = 10_000;
 /** Whether Docker, Colima, or Podman is reachable, hung, or absent. */
 export function getContainerRuntimeStatus() {
     let sawTimeout = false;
+    if (process.platform === "win32") {
+        try {
+            execFileSync(findOnPath("docker") ?? "docker", ["ps"], {
+                stdio: "ignore",
+                timeout: RUNTIME_CHECK_TIMEOUT_MS,
+                windowsHide: true,
+            });
+            return "running";
+        }
+        catch (err) {
+            return err.code === "ETIMEDOUT" ? "unresponsive" : "missing";
+        }
+    }
     for (const command of ["docker ps", "colima status", "podman ps"]) {
         try {
             execSync(command, { stdio: "ignore", timeout: RUNTIME_CHECK_TIMEOUT_MS });

package/cli/dist/utils/doctor-runtime.js

@@ -1,4 +1,4 @@
-import { execSync } from "node:child_process";
+import { execFileSync, execSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { createServer } from "node:net";
 import { join } from "node:path";
@@ -6,9 +6,23 @@ import { formatCount } from "./formatting.js";
 import { findProjectRoot } from "./paths.js";
 import { getProjectName } from "./service-urls.js";
 import { discoverResources, discoverResourcesFromRoot } from "./services.js";
+import { findOnPath } from "./which.js";
 const EXEC_TIMEOUT_MS = 10_000;
 const REGISTRY_PROBE_TIMEOUT_MS = 3_000;
 const DEFAULT_VERDACCIO_URL = "http://localhost:4873";
+export const HOST_PORT_FIXES = {
+    port80: "Stop the process bound to port 80, or stop local nginx/caddy. Then: tdk doctor",
+    port5432: "Stop local Postgres or change the host port. Then: tdk doctor",
+};
+function runHostCommand(exec, command, args, shellCommand, options) {
+    if (process.platform === "win32") {
+        return execFileSync(findOnPath(command) ?? command, args, {
+            ...options,
+            windowsHide: true,
+        });
+    }
+    return exec(shellCommand, options);
+}
 /** Host ports Traefik publishes for local ingress. Without these, app routes never come up. */
 export const INGRESS_PORTS = [80, 443];
 export function toComposeProjectPrefix(projectName) {
@@ -232,7 +246,7 @@ export function checkPrivateNpmRegistry(exec = execSync, projectRoot = findProje
     }
     let containerRunning = false;
     try {
-        const names = exec("docker ps --format '{{.Names}}'", {
+        const names = runHostCommand(exec, "docker", ["ps", "--format", "{{.Names}}"], "docker ps --format '{{.Names}}'", {
             stdio: "pipe",
             encoding: "utf-8",
             timeout: EXEC_TIMEOUT_MS,
@@ -246,11 +260,18 @@ export function checkPrivateNpmRegistry(exec = execSync, projectRoot = findProje
     let httpDetail = "";
     try {
         // curl is more reliable than fetch in the compiled CLI binary environments.
-        const probe = exec(`curl -fsS -o /dev/null -w '%{http_code}' --max-time 2 ${JSON.stringify(registryUrl)}`, {
-            stdio: "pipe",
-            encoding: "utf-8",
-            timeout: REGISTRY_PROBE_TIMEOUT_MS + 1_000,
-        }).trim();
+        const probe = process.platform === "win32"
+            ? execFileSync("curl.exe", ["-fsS", "-o", "NUL", "-w", "%{http_code}", "--max-time", "2", registryUrl], {
+                stdio: "pipe",
+                encoding: "utf-8",
+                timeout: REGISTRY_PROBE_TIMEOUT_MS + 1_000,
+                windowsHide: true,
+            }).trim()
+            : exec(`curl -fsS -o /dev/null -w '%{http_code}' --max-time 2 ${JSON.stringify(registryUrl)}`, {
+                stdio: "pipe",
+                encoding: "utf-8",
+                timeout: REGISTRY_PROBE_TIMEOUT_MS + 1_000,
+            }).trim();
         httpOk = /^[23]\d\d$/.test(probe);
         httpDetail = `HTTP ${probe}`;
     }
@@ -288,7 +309,7 @@ export function checkIngressPorts(exec = execSync, projectName = getProjectName(
     const projectPrefix = toComposeProjectPrefix(projectName);
     let dockerPs = "";
     try {
-        dockerPs = exec("docker ps --format '{{.Names}}\\t{{.Ports}}'", {
+        dockerPs = runHostCommand(exec, "docker", ["ps", "--format", "{{.Names}}\\t{{.Ports}}"], "docker ps --format '{{.Names}}\\t{{.Ports}}'", {
             stdio: "pipe",
             encoding: "utf-8",
             timeout: EXEC_TIMEOUT_MS,
@@ -422,7 +443,8 @@ export function summarizeServiceProbes(probes) {
  * containers here.
  */
 export async function checkHostPorts(exec = execSync, projectName = getProjectName(), probe = probeHostPort) {
-    const ports = Object.keys(HOST_PORTS).map(Number);
+    // Postgres is the most common environment blocker and must be surfaced first.
+    const ports = [5432, 80, 443];
     const inUse = [];
     for (const port of ports) {
         if ((await probe(port)) === "in-use")
@@ -437,7 +459,7 @@ export async function checkHostPorts(exec = execSync, projectName = getProjectNa
     }
     let dockerPs = "";
     try {
-        dockerPs = exec("docker ps --format '{{.Names}}\\t{{.Ports}}'", {
+        dockerPs = runHostCommand(exec, "docker", ["ps", "--format", "{{.Names}}\\t{{.Ports}}"], "docker ps --format '{{.Names}}\\t{{.Ports}}'", {
             stdio: "pipe",
             encoding: "utf-8",
             timeout: EXEC_TIMEOUT_MS,
@@ -456,7 +478,8 @@ export async function checkHostPorts(exec = execSync, projectName = getProjectNa
     for (const port of inUse) {
         const holder = holders.find((h) => h.publishedPorts.includes(port));
         if (!holder) {
-            problems.push(`${port} (${HOST_PORTS[port]}) is used by a program on this machine`);
+            const detail = port === 5432 ? "; inspect it with lsof -nP -iTCP:5432" : "";
+            problems.push(`${port} (${HOST_PORTS[port]}) is used by a program on this machine${detail}`);
         }
         else if (port === 5432 && !isOwn(holder.name)) {
             problems.push(`${port} (${HOST_PORTS[port]}) is published by container ${holder.name}`);
@@ -466,12 +489,21 @@ export async function checkHostPorts(exec = execSync, projectName = getProjectNa
         return { name: "Host Ports", didPass: true, message: "Host ports are held by this project" };
     }
     const first = inUse.find((port) => problems.some((p) => p.startsWith(`${port} `))) ?? inUse[0];
+    let fix;
+    if (first === 80) {
+        fix = HOST_PORT_FIXES.port80;
+    }
+    else if (first === 5432) {
+        fix = HOST_PORT_FIXES.port5432;
+    }
+    else {
+        fix = `Stop the process bound to port ${first}. Then: tdk doctor`;
+    }
     return {
         name: "Host Ports",
         didPass: false,
         message: `Ports TDK needs are taken:\n    ${problems.join("\n    ")}`,
-        fix: `Find what holds a port with \`lsof -nP -iTCP:${first} -sTCP:LISTEN\` and stop it ` +
-            "(for a local Postgres: `brew services stop postgresql` or quit Postgres.app), then run `tdk up`.",
+        fix,
     };
 }
 /**
@@ -482,7 +514,7 @@ export async function checkHostPorts(exec = execSync, projectName = getProjectNa
 export function checkTiltResourceHealth(exec = execSync) {
     let jsonText = "";
     try {
-        jsonText = exec("tilt get uiresources -o json", {
+        jsonText = runHostCommand(exec, "tilt", ["get", "uiresources", "-o", "json"], "tilt get uiresources -o json", {
             stdio: "pipe",
             encoding: "utf-8",
             timeout: EXEC_TIMEOUT_MS,
@@ -588,7 +620,7 @@ export function orderTiltFailures(failures) {
  */
 export function probeContainerRuntimeError(resourceName, exec = execSync) {
     try {
-        const names = exec("docker ps -a --format '{{.Names}}'", {
+        const names = runHostCommand(exec, "docker", ["ps", "-a", "--format", "{{.Names}}"], "docker ps -a --format '{{.Names}}'", {
             stdio: "pipe",
             encoding: "utf-8",
             timeout: EXEC_TIMEOUT_MS,
@@ -600,7 +632,7 @@ export function probeContainerRuntimeError(resourceName, exec = execSync) {
             names.find((name) => name.includes(resourceName));
         if (!match)
             return null;
-        const logs = exec(`docker logs --tail 120 ${JSON.stringify(match)} 2>&1`, {
+        const logs = runHostCommand(exec, "docker", ["logs", "--tail", "120", match], `docker logs --tail 120 ${JSON.stringify(match)} 2>&1`, {
             stdio: "pipe",
             encoding: "utf-8",
             timeout: EXEC_TIMEOUT_MS,

package/cli/dist/utils/doctor-wiring.js

@@ -0,0 +1,269 @@
+import { execFileSync, execSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, relative } from "node:path";
+import { execAsync } from "./exec-async.js";
+import { formatCount } from "./formatting.js";
+import { findProjectRoot } from "./paths.js";
+import { discoverResourcesFromRoot } from "./services.js";
+/**
+ * Checks for wiring mistakes that only show up minutes into `tdk up`: an image
+ * build that cannot find package.json, a token check that cannot reach its
+ * identity provider, a frontend calling a port nothing publishes, a queue
+ * feature with no broker. Each one is decidable from the files on disk.
+ */
+const EXEC_TIMEOUT_MS = 10_000;
+const SOURCE_EXTENSIONS = /\.(?:[cm]?[jt]sx?|vue)$/;
+const TEST_FILE = /(?:\.test\.|\.spec\.|\/tests?\/|\/__tests__\/)/;
+const SKIPPED_DIRS = new Set(["node_modules", ".autogenerated", "dist", "tests", "__tests__"]);
+function projectName(projectRoot) {
+    try {
+        const parsed = JSON.parse(readFileSync(join(projectRoot, ".tdk", "project.json"), "utf-8"));
+        return typeof parsed?.project?.name === "string" ? parsed.project.name : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readParams(configPath) {
+    try {
+        const params = JSON.parse(readFileSync(configPath, "utf-8")).params;
+        return params && typeof params === "object" ? params : {};
+    }
+    catch {
+        return {};
+    }
+}
+/** Backends are the only resources that listen on their `port`. */
+function backendPorts(resources) {
+    const ports = new Map();
+    for (const resource of resources) {
+        const port = resource.config?.port;
+        if (resource.config?.appType === "backend" && typeof port === "number") {
+            ports.set(resource.name, port);
+        }
+    }
+    return ports;
+}
+export function checkResourcePackageJson(projectRoot = findProjectRoot() ?? process.cwd()) {
+    const missing = discoverResourcesFromRoot(projectRoot)
+        .filter((resource) => !existsSync(join(resource.path, "package.json")))
+        .map((resource) => resource.name);
+    if (missing.length === 0) {
+        return {
+            name: "Resource package.json",
+            didPass: true,
+            message: "Every resource has a package.json",
+        };
+    }
+    return {
+        name: "Resource package.json",
+        didPass: false,
+        message: `${formatCount(missing.length, "resource")} without a package.json: ${missing.join(", ")}. The image build stops at "COPY .../package.json: not found"`,
+        fix: "Add a package.json next to each service.json (copy one from a working resource), or delete the folder's service.json if it is not a service",
+    };
+}
+const CONTAINER_URL = /https?:\/\/([a-z][a-z0-9-]*):(\d+)/g;
+export function checkServiceUrlPorts(projectRoot = findProjectRoot() ?? process.cwd()) {
+    const resources = discoverResourcesFromRoot(projectRoot);
+    const ports = backendPorts(resources);
+    const byPort = new Map([...ports].map(([name, port]) => [port, name]));
+    const problems = [];
+    for (const resource of resources) {
+        for (const [key, value] of Object.entries(readParams(resource.configPath))) {
+            for (const [, host, portText] of String(value).matchAll(CONTAINER_URL)) {
+                const port = Number(portText);
+                const expected = ports.get(host);
+                if (expected !== undefined && expected !== port) {
+                    problems.push(`${resource.name} param ${key}: ${host}:${port}, but ${host} listens on ${expected}`);
+                }
+                else if ((host === "localhost" || host === "127.0.0.1") &&
+                    byPort.has(port) &&
+                    byPort.get(port) !== resource.name) {
+                    problems.push(`${resource.name} param ${key}: localhost:${port} is ${resource.name} itself inside its container; ${byPort.get(port)} is reached as ${byPort.get(port)}:${port}`);
+                }
+            }
+        }
+    }
+    if (problems.length === 0) {
+        return {
+            name: "Service URL ports",
+            didPass: true,
+            message: "Service URLs in params point at the ports the services listen on",
+        };
+    }
+    return {
+        name: "Service URL ports",
+        didPass: false,
+        message: `${formatCount(problems.length, "service URL")} in params that cannot connect:\n    ${problems.join("\n    ")}`,
+        fix: 'TDK runs each backend on the "port" in its service.json, and containers reach each other by resource name (http://<resource>:<port>). Use that port in the URL',
+    };
+}
+function listSourceFiles(dir) {
+    const files = [];
+    let entries;
+    try {
+        entries = readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return files;
+    }
+    for (const entry of entries) {
+        const path = join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (!SKIPPED_DIRS.has(entry.name))
+                files.push(...listSourceFiles(path));
+        }
+        else if (SOURCE_EXTENSIONS.test(entry.name) && !TEST_FILE.test(path)) {
+            files.push(path);
+        }
+    }
+    return files;
+}
+const LOCALHOST_PORT = /(?:localhost|127\.0\.0\.1):(\d{2,5})\b/g;
+const COMMENT_LINE = /^\s*(?:\/\/|\/\*|\*|<!--|#)/;
+export function checkFrontendBackendUrls(projectRoot = findProjectRoot() ?? process.cwd()) {
+    const resources = discoverResourcesFromRoot(projectRoot);
+    const byPort = new Map([...backendPorts(resources)].map(([name, port]) => [port, name]));
+    const problems = [];
+    for (const resource of resources.filter((r) => r.config?.appType === "frontend")) {
+        for (const file of listSourceFiles(join(resource.path, "src"))) {
+            readFileSync(file, "utf-8")
+                .split("\n")
+                .forEach((line, index) => {
+                if (COMMENT_LINE.test(line))
+                    return;
+                for (const [, portText] of line.matchAll(LOCALHOST_PORT)) {
+                    const backend = byPort.get(Number(portText));
+                    if (backend) {
+                        problems.push(`${relative(projectRoot, file)}:${index + 1} calls localhost:${portText} (${backend})`);
+                    }
+                }
+            });
+        }
+    }
+    if (problems.length === 0) {
+        return {
+            name: "Frontend backend URLs",
+            didPass: true,
+            message: "No frontend calls a backend through a localhost port",
+        };
+    }
+    const project = projectName(projectRoot) ?? "<project>";
+    return {
+        name: "Frontend backend URLs",
+        didPass: false,
+        message: `${formatCount(problems.length, "frontend call")} to a backend port that TDK does not publish on localhost:\n    ${problems.join("\n    ")}`,
+        fix: `Backends are only reachable through Traefik: http://api.${project}.localhost/api/<name without -api>/... (for example catalog-api is /api/catalog). Use that URL, or the generated .autogenerated/env.ts`,
+    };
+}
+export function checkNatsBroker(projectRoot = findProjectRoot() ?? process.cwd()) {
+    const users = discoverResourcesFromRoot(projectRoot)
+        .filter((resource) => resource.config?.featuresEnabled?.includes("nats"))
+        .map((resource) => resource.name);
+    if (users.length === 0) {
+        return {
+            name: "NATS broker",
+            didPass: true,
+            message: "No resource enables the nats feature",
+            isSkipped: true,
+        };
+    }
+    if (existsSync(join(projectRoot, "services", "platform", "messaging", "docker-compose.yml"))) {
+        return {
+            name: "NATS broker",
+            didPass: true,
+            message: `${formatCount(users.length, "resource")} enable nats and services/platform/messaging/docker-compose.yml is present`,
+        };
+    }
+    const name = (projectName(projectRoot) ?? "project").replace(/-/g, "_");
+    return {
+        name: "NATS broker",
+        didPass: false,
+        message: `${users.join(", ")} enable the nats feature, but no NATS server will start: TDK only starts one when services/platform/messaging/docker-compose.yml exists, and it does not generate that file`,
+        fix: `Create it with a "nats" service (image nats with -js, container_name ${name}_nats, network ${name}_backend, external) and a "redis" service, which TDK registers alongside it`,
+    };
+}
+export function parseTiltProcesses(psOutput) {
+    const processes = [];
+    for (const line of psOutput.split("\n")) {
+        const match = line.match(/^\s*(\d+)\s+.*\btilt up\b.*?\s-f\s+(\S+)/i);
+        if (!match)
+            continue;
+        processes.push({ pid: Number(match[1]), root: match[2].split(/[\\/]\.tdk[\\/]/i)[0] });
+    }
+    return processes;
+}
+export function checkTiltInstances(projectRoot = findProjectRoot() ?? process.cwd(), exec = execSync) {
+    let output;
+    try {
+        output =
+            process.platform === "win32"
+                ? execFileSync("powershell.exe", [
+                    "-NoProfile",
+                    "-Command",
+                    "Get-CimInstance Win32_Process | Where-Object { $_.Name -eq 'tilt.exe' } | ForEach-Object { '{0} {1}' -f $_.ProcessId, $_.CommandLine }",
+                ], { encoding: "utf-8", timeout: EXEC_TIMEOUT_MS, windowsHide: true })
+                : exec("ps -Ao pid=,command=", { encoding: "utf-8", timeout: EXEC_TIMEOUT_MS });
+    }
+    catch {
+        return {
+            name: "Tilt processes",
+            didPass: true,
+            isSkipped: true,
+            message: "Could not list processes",
+        };
+    }
+    const running = parseTiltProcesses(output);
+    const mine = running.filter((p) => p.root === projectRoot);
+    const others = running.filter((p) => p.root !== projectRoot);
+    if (mine.length > 1) {
+        return {
+            name: "Tilt processes",
+            didPass: false,
+            message: `${mine.length} Tilt processes are running for this project (pids ${mine.map((p) => p.pid).join(", ")}). They fight over ports and containers`,
+            fix: `Stop them all, then start one: tdk down && kill ${mine.map((p) => p.pid).join(" ")} && tdk up`,
+        };
+    }
+    if (others.length > 0) {
+        const list = others.map((p) => `${p.root} (pid ${p.pid})`).join(", ");
+        return {
+            name: "Tilt processes",
+            didPass: true,
+            isSkipped: true,
+            message: `Another project's Tilt is running: ${list}`,
+            fix: "tdk up will use the next free Tilt UI port (10351, ...). If it is a leftover, run tdk down in that project",
+        };
+    }
+    return { name: "Tilt processes", didPass: true, message: "No stray Tilt processes" };
+}
+export async function checkDockerNetworkCapacity(exec = execAsync) {
+    const probe = `tdk_doctor_probe_${process.pid}`;
+    try {
+        await exec(`docker network create ${probe}`, EXEC_TIMEOUT_MS);
+    }
+    catch (error) {
+        const stderr = String(error.stderr ?? error);
+        if (/address pools/i.test(stderr)) {
+            return {
+                name: "Docker networks",
+                didPass: false,
+                message: "Docker cannot create another network: all predefined address pools are in use. Each TDK project needs several",
+                fix: "docker network prune  (removes unused networks), or run tdk down in projects you are not using",
+            };
+        }
+        return {
+            name: "Docker networks",
+            didPass: true,
+            isSkipped: true,
+            message: "Could not test network creation",
+        };
+    }
+    try {
+        await exec(`docker network rm ${probe}`, EXEC_TIMEOUT_MS);
+    }
+    catch {
+        // A leftover probe network is harmless and tdk_doctor_probe_* is easy to prune.
+    }
+    return { name: "Docker networks", didPass: true, message: "Docker can create networks" };
+}
+//# sourceMappingURL=doctor-wiring.js.map