@tdk-landscape/tdk-cli-core 1.3.76 → 1.3.78

package/cli/dist/utils/cold-preflight.js

@@ -0,0 +1,198 @@
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { checkDockerCompose, checkDockerRuntime, checkDockerVersions, checkTilt, } from "../commands/doctor.js";
+import { checkHostPorts, checkIngressPorts } from "./doctor-runtime.js";
+import { checkNatsBroker } from "./doctor-wiring.js";
+import { findProjectRoot } from "./paths.js";
+import { discoverResourcesFromRoot } from "./services.js";
+import { findOnPath } from "./which.js";
+/** Converts a doctor check result into the preflight's compact display item. */
+function item(id, result) {
+    return {
+        id,
+        ok: result.didPass || Boolean(result.isSkipped),
+        message: result.message,
+        fix: result.fix,
+    };
+}
+/** Returns whether a Node version is below the CLI's 22.12 minimum. */
+export function nodeTooOld(version) {
+    const [major = 0, minor = 0] = String(version)
+        .split(".")
+        .map((part) => Number.parseInt(part, 10));
+    return (!Number.isFinite(major) || !Number.isFinite(minor) || major < 22 || (major === 22 && minor < 12));
+}
+async function safeCheck(id, check, fallback) {
+    try {
+        return item(id, await check());
+    }
+    catch {
+        return { id, ok: false, message: fallback };
+    }
+}
+/** Requires a Docker engine and Compose version check to complete successfully. */
+export function requireVerifiedDockerVersions(result) {
+    if (!result.isSkipped)
+        return result;
+    return {
+        ...result,
+        didPass: false,
+        isSkipped: false,
+        message: `Could not verify Docker Engine/Compose minimum versions: ${result.message}`,
+        fix: result.fix ?? "Start Docker and ensure Docker Engine 25+ and Compose 2.20.2+ are installed.",
+    };
+}
+function usesPrisma(projectRoot) {
+    try {
+        return discoverResourcesFromRoot(projectRoot).some((resource) => {
+            return resource.config?.featuresEnabled?.includes("prisma") ?? false;
+        });
+    }
+    catch {
+        return false;
+    }
+}
+export async function runColdPreflight(opts = {}) {
+    const cwd = opts.cwd ?? process.cwd();
+    const projectRoot = findProjectRoot(cwd);
+    const inProject = Boolean(projectRoot);
+    const items = [];
+    const nodeVersion = process.versions.node;
+    items.push({
+        id: "node",
+        ok: !nodeTooOld(nodeVersion),
+        message: nodeVersion,
+        fix: nodeTooOld(nodeVersion)
+            ? `Install Node.js 22.12+ (current: ${nodeVersion}). https://nodejs.org`
+            : undefined,
+    });
+    items.push(await safeCheck("docker", checkDockerRuntime, "Docker daemon is not running"));
+    items.push(await safeCheck("compose", async () => {
+        const [compose, versions] = await Promise.all([
+            checkDockerCompose(),
+            checkDockerVersions(),
+        ]);
+        if (!compose.didPass)
+            return compose;
+        return requireVerifiedDockerVersions(versions);
+    }, "Docker Engine or Compose version check failed"));
+    items.push(await safeCheck("tilt", checkTilt, "Tilt CLI not found"));
+    let bun = false;
+    const bunPath = findOnPath("bun");
+    if (bunPath) {
+        try {
+            const version = execFileSync(bunPath, ["--version"], {
+                encoding: "utf-8",
+                timeout: 3000,
+            }).trim();
+            const [major = 0, minor = 0] = version.split(".").map((part) => Number.parseInt(part, 10));
+            bun = major > 1 || (major === 1 && minor >= 2);
+        }
+        catch {
+            /* reported as a failed runtime check */
+        }
+    }
+    items.push({
+        id: "bun",
+        ok: bun,
+        message: bun ? "Bun 1.2+ is available on PATH" : "Bun 1.2+ not found on PATH",
+        fix: bun ? undefined : "curl -fsSL https://bun.sh/install | bash",
+    });
+    const [hostPorts, ingressPorts] = await Promise.all([
+        safeCheck("ports", checkHostPorts, "Could not check required host ports"),
+        safeCheck("ports", checkIngressPorts, "Could not check ingress ports"),
+    ]);
+    if (!hostPorts.ok || !ingressPorts.ok) {
+        const port5432 = !hostPorts.ok && /(?:^|\n)\s*5432\s*\(/.test(hostPorts.message);
+        const messages = [
+            !hostPorts.ok
+                ? port5432
+                    ? "Port 5432 is taken (usually local Postgres). Stop it or TDK cannot bind the bundled Postgres."
+                    : hostPorts.message
+                : undefined,
+            !ingressPorts.ok ? ingressPorts.message : undefined,
+        ].filter((message) => Boolean(message));
+        const fixes = [hostPorts.fix, ingressPorts.fix].filter((fix) => Boolean(fix));
+        items.push({
+            id: "ports",
+            ok: false,
+            message: messages.join("\n"),
+            fix: fixes.join(" "),
+        });
+    }
+    if (projectRoot) {
+        const nats = await safeCheck("nats", () => checkNatsBroker(projectRoot), "NATS broker check failed");
+        if (!nats.ok)
+            items.push(nats);
+        if (usesPrisma(projectRoot)) {
+            let dbUp = false;
+            try {
+                const config = JSON.parse(readFileSync(join(projectRoot, ".tdk", "project.json"), "utf-8"));
+                const projectName = String(config?.project?.name ?? "").replace(/-/g, "_");
+                if (projectName) {
+                    const running = execFileSync(findOnPath("docker") ?? "docker", [
+                        "ps",
+                        "--filter",
+                        `label=com.docker.compose.project=${projectName}`,
+                        "--filter",
+                        "label=com.docker.compose.service=postgres",
+                        "--filter",
+                        "health=healthy",
+                        "--format",
+                        "{{.Names}}",
+                    ], { encoding: "utf-8", timeout: 3000 }).trim();
+                    dbUp = running.length > 0;
+                }
+            }
+            catch {
+                /* Docker unavailable is already represented by the machine checks. */
+            }
+            if (!dbUp)
+                items.push({
+                    id: "prisma",
+                    ok: false,
+                    message: "A Prisma resource is configured, but the project Postgres service is not healthy",
+                    fix: "Run `tdk up` to start the bundled Postgres, then check `tdk doctor`.",
+                });
+        }
+    }
+    const failures = items.filter((check) => !check.ok).slice(0, 8);
+    const machineFailed = failures.some((check) => ["node", "docker", "compose", "tilt", "bun", "ports"].includes(check.id));
+    const bunFailed = failures.some((check) => check.id === "bun");
+    const header = failures.length
+        ? machineFailed
+            ? bunFailed
+                ? "Cold start blocked. Bun 1.2+ must be installed on PATH.\nPrisma/NATS configuration is project-specific and generated after `tdk project`. Fix the machine checks below."
+                : "Cold start blocked. Bun/Prisma/NATS are not the first failure.\nThey are generated after `tdk project`. Fix the machine checks below."
+            : "Machine is ready. Project wiring is not."
+        : "";
+    const footer = failures.length
+        ? ""
+        : inProject
+            ? "Environment ready for TDK"
+            : "This machine is ready for TDK.\nNext: tdk project --yes";
+    return { ok: failures.length === 0, inProject, items: failures, header, footer };
+}
+/** Formats only failed preflight checks and the applicable readiness message. */
+export function formatColdPreflight(result, options = {}) {
+    const lines = [result.header];
+    for (const check of result.items) {
+        lines.push(`FAIL ${check.id.padEnd(7)} ${check.message}`);
+        if (check.fix)
+            lines.push(`  ${check.fix}`);
+    }
+    if (result.footer && (options.includeSuccessFooter ?? true))
+        lines.push(result.footer);
+    return lines.filter(Boolean).join("\n");
+}
+/** Exits before machine-dependent command work when any machine check fails. */
+export async function assertMachineReadyOrExit() {
+    const result = await runColdPreflight();
+    const machineFailure = result.items.some((check) => ["node", "docker", "compose", "tilt", "bun", "ports"].includes(check.id));
+    if (machineFailure) {
+        console.error(formatColdPreflight(result));
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=cold-preflight.js.map

package/cli/dist/utils/constants.js

@@ -10,10 +10,12 @@ export const VALID_RESOURCE_TYPES = [
     "sdk",
     "worker",
     "migrator",
+    "bring-your-own",
 ];
 // Frontend/library/sdk services are served statically or consumed as
 // packages, so they never need a "start" script - only backend/worker/
 // migrator processes are run in production via `<runtime> run start`.
+// bring-your-own doesn't generate application code, so no scripts required.
 export const REQUIRED_PACKAGE_SCRIPTS = {
     backend: ["dev", "build", "start"],
     worker: ["dev", "build", "start"],
@@ -21,6 +23,7 @@ export const REQUIRED_PACKAGE_SCRIPTS = {
     frontend: ["dev", "build"],
     library: ["dev", "build"],
     sdk: ["dev", "build"],
+    "bring-your-own": [],
 };
 // Version specifiers that pin nothing at all - a fresh `bun install`/`npm install`
 // can pull a different (possibly breaking) version on every run.
@@ -35,6 +38,7 @@ export const OPTIONAL_INFRA_SERVICES = [
 export const PORT_RANGES = {
     frontend: { base: 3000, min: 3000, max: 3999, range: "3000-3999" },
     backend: { base: 4000, min: 4000, max: 4999, range: "4000-4999" },
+    "bring-your-own": { base: 4000, min: 4000, max: 5999, range: "4000-5999" },
     worker: { base: 6000, min: 6000, max: 6999, range: "6000-6999" },
     health: { base: 5000, min: 5000, max: 5999, range: "5000-5999" },
     migrator: { base: 7000, min: 7000, max: 7999, range: "7000-7999" },

package/cli/dist/utils/docker.js

@@ -1,9 +1,23 @@
-import { execSync } from "node:child_process";
+import { execFileSync, execSync } from "node:child_process";
+import { findOnPath } from "./which.js";
 // A wedged daemon makes `docker ps` block forever instead of failing.
 const RUNTIME_CHECK_TIMEOUT_MS = 10_000;
 /** Whether Docker, Colima, or Podman is reachable, hung, or absent. */
 export function getContainerRuntimeStatus() {
     let sawTimeout = false;
+    if (process.platform === "win32") {
+        try {
+            execFileSync(findOnPath("docker") ?? "docker", ["ps"], {
+                stdio: "ignore",
+                timeout: RUNTIME_CHECK_TIMEOUT_MS,
+                windowsHide: true,
+            });
+            return "running";
+        }
+        catch (err) {
+            return err.code === "ETIMEDOUT" ? "unresponsive" : "missing";
+        }
+    }
     for (const command of ["docker ps", "colima status", "podman ps"]) {
         try {
             execSync(command, { stdio: "ignore", timeout: RUNTIME_CHECK_TIMEOUT_MS });

package/cli/dist/utils/doctor-runtime.js

@@ -1,4 +1,4 @@
-import { execSync } from "node:child_process";
+import { execFileSync, execSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { createServer } from "node:net";
 import { join } from "node:path";
@@ -6,9 +6,23 @@ import { formatCount } from "./formatting.js";
 import { findProjectRoot } from "./paths.js";
 import { getProjectName } from "./service-urls.js";
 import { discoverResources, discoverResourcesFromRoot } from "./services.js";
+import { findOnPath } from "./which.js";
 const EXEC_TIMEOUT_MS = 10_000;
 const REGISTRY_PROBE_TIMEOUT_MS = 3_000;
 const DEFAULT_VERDACCIO_URL = "http://localhost:4873";
+export const HOST_PORT_FIXES = {
+    port80: "Stop the process bound to port 80, or stop local nginx/caddy. Then: tdk doctor",
+    port5432: "Stop local Postgres or change the host port. Then: tdk doctor",
+};
+function runHostCommand(exec, command, args, shellCommand, options) {
+    if (process.platform === "win32") {
+        return execFileSync(findOnPath(command) ?? command, args, {
+            ...options,
+            windowsHide: true,
+        });
+    }
+    return exec(shellCommand, options);
+}
 /** Host ports Traefik publishes for local ingress. Without these, app routes never come up. */
 export const INGRESS_PORTS = [80, 443];
 export function toComposeProjectPrefix(projectName) {
@@ -232,7 +246,7 @@ export function checkPrivateNpmRegistry(exec = execSync, projectRoot = findProje
     }
     let containerRunning = false;
     try {
-        const names = exec("docker ps --format '{{.Names}}'", {
+        const names = runHostCommand(exec, "docker", ["ps", "--format", "{{.Names}}"], "docker ps --format '{{.Names}}'", {
             stdio: "pipe",
             encoding: "utf-8",
             timeout: EXEC_TIMEOUT_MS,
@@ -246,11 +260,18 @@ export function checkPrivateNpmRegistry(exec = execSync, projectRoot = findProje
     let httpDetail = "";
     try {
         // curl is more reliable than fetch in the compiled CLI binary environments.
-        const probe = exec(`curl -fsS -o /dev/null -w '%{http_code}' --max-time 2 ${JSON.stringify(registryUrl)}`, {
-            stdio: "pipe",
-            encoding: "utf-8",
-            timeout: REGISTRY_PROBE_TIMEOUT_MS + 1_000,
-        }).trim();
+        const probe = process.platform === "win32"
+            ? execFileSync("curl.exe", ["-fsS", "-o", "NUL", "-w", "%{http_code}", "--max-time", "2", registryUrl], {
+                stdio: "pipe",
+                encoding: "utf-8",
+                timeout: REGISTRY_PROBE_TIMEOUT_MS + 1_000,
+                windowsHide: true,
+            }).trim()
+            : exec(`curl -fsS -o /dev/null -w '%{http_code}' --max-time 2 ${JSON.stringify(registryUrl)}`, {
+                stdio: "pipe",
+                encoding: "utf-8",
+                timeout: REGISTRY_PROBE_TIMEOUT_MS + 1_000,
+            }).trim();
         httpOk = /^[23]\d\d$/.test(probe);
         httpDetail = `HTTP ${probe}`;
     }
@@ -288,7 +309,7 @@ export function checkIngressPorts(exec = execSync, projectName = getProjectName(
     const projectPrefix = toComposeProjectPrefix(projectName);
     let dockerPs = "";
     try {
-        dockerPs = exec("docker ps --format '{{.Names}}\\t{{.Ports}}'", {
+        dockerPs = runHostCommand(exec, "docker", ["ps", "--format", "{{.Names}}\\t{{.Ports}}"], "docker ps --format '{{.Names}}\\t{{.Ports}}'", {
             stdio: "pipe",
             encoding: "utf-8",
             timeout: EXEC_TIMEOUT_MS,
@@ -422,7 +443,8 @@ export function summarizeServiceProbes(probes) {
  * containers here.
  */
 export async function checkHostPorts(exec = execSync, projectName = getProjectName(), probe = probeHostPort) {
-    const ports = Object.keys(HOST_PORTS).map(Number);
+    // Postgres is the most common environment blocker and must be surfaced first.
+    const ports = [5432, 80, 443];
     const inUse = [];
     for (const port of ports) {
         if ((await probe(port)) === "in-use")
@@ -437,7 +459,7 @@ export async function checkHostPorts(exec = execSync, projectName = getProjectNa
     }
     let dockerPs = "";
     try {
-        dockerPs = exec("docker ps --format '{{.Names}}\\t{{.Ports}}'", {
+        dockerPs = runHostCommand(exec, "docker", ["ps", "--format", "{{.Names}}\\t{{.Ports}}"], "docker ps --format '{{.Names}}\\t{{.Ports}}'", {
             stdio: "pipe",
             encoding: "utf-8",
             timeout: EXEC_TIMEOUT_MS,
@@ -456,7 +478,8 @@ export async function checkHostPorts(exec = execSync, projectName = getProjectNa
     for (const port of inUse) {
         const holder = holders.find((h) => h.publishedPorts.includes(port));
         if (!holder) {
-            problems.push(`${port} (${HOST_PORTS[port]}) is used by a program on this machine`);
+            const detail = port === 5432 ? "; inspect it with lsof -nP -iTCP:5432" : "";
+            problems.push(`${port} (${HOST_PORTS[port]}) is used by a program on this machine${detail}`);
         }
         else if (port === 5432 && !isOwn(holder.name)) {
             problems.push(`${port} (${HOST_PORTS[port]}) is published by container ${holder.name}`);
@@ -466,12 +489,21 @@ export async function checkHostPorts(exec = execSync, projectName = getProjectNa
         return { name: "Host Ports", didPass: true, message: "Host ports are held by this project" };
     }
     const first = inUse.find((port) => problems.some((p) => p.startsWith(`${port} `))) ?? inUse[0];
+    let fix;
+    if (first === 80) {
+        fix = HOST_PORT_FIXES.port80;
+    }
+    else if (first === 5432) {
+        fix = HOST_PORT_FIXES.port5432;
+    }
+    else {
+        fix = `Stop the process bound to port ${first}. Then: tdk doctor`;
+    }
     return {
         name: "Host Ports",
         didPass: false,
         message: `Ports TDK needs are taken:\n    ${problems.join("\n    ")}`,
-        fix: `Find what holds a port with \`lsof -nP -iTCP:${first} -sTCP:LISTEN\` and stop it ` +
-            "(for a local Postgres: `brew services stop postgresql` or quit Postgres.app), then run `tdk up`.",
+        fix,
     };
 }
 /**
@@ -482,7 +514,7 @@ export async function checkHostPorts(exec = execSync, projectName = getProjectNa
 export function checkTiltResourceHealth(exec = execSync) {
     let jsonText = "";
     try {
-        jsonText = exec("tilt get uiresources -o json", {
+        jsonText = runHostCommand(exec, "tilt", ["get", "uiresources", "-o", "json"], "tilt get uiresources -o json", {
             stdio: "pipe",
             encoding: "utf-8",
             timeout: EXEC_TIMEOUT_MS,
@@ -588,7 +620,7 @@ export function orderTiltFailures(failures) {
  */
 export function probeContainerRuntimeError(resourceName, exec = execSync) {
     try {
-        const names = exec("docker ps -a --format '{{.Names}}'", {
+        const names = runHostCommand(exec, "docker", ["ps", "-a", "--format", "{{.Names}}"], "docker ps -a --format '{{.Names}}'", {
             stdio: "pipe",
             encoding: "utf-8",
             timeout: EXEC_TIMEOUT_MS,
@@ -600,7 +632,7 @@ export function probeContainerRuntimeError(resourceName, exec = execSync) {
             names.find((name) => name.includes(resourceName));
         if (!match)
             return null;
-        const logs = exec(`docker logs --tail 120 ${JSON.stringify(match)} 2>&1`, {
+        const logs = runHostCommand(exec, "docker", ["logs", "--tail", "120", match], `docker logs --tail 120 ${JSON.stringify(match)} 2>&1`, {
             stdio: "pipe",
             encoding: "utf-8",
             timeout: EXEC_TIMEOUT_MS,

package/cli/dist/utils/doctor-wiring.js

@@ -1,6 +1,7 @@
-import { execSync } from "node:child_process";
+import { execFileSync, execSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join, relative } from "node:path";
+import { execAsync } from "./exec-async.js";
 import { formatCount } from "./formatting.js";
 import { findProjectRoot } from "./paths.js";
 import { discoverResourcesFromRoot } from "./services.js";
@@ -185,17 +186,24 @@ export function checkNatsBroker(projectRoot = findProjectRoot() ?? process.cwd()
 export function parseTiltProcesses(psOutput) {
     const processes = [];
     for (const line of psOutput.split("\n")) {
-        const match = line.match(/^\s*(\d+)\s+.*\btilt up\b.*?\s-f\s+(\S+)/);
+        const match = line.match(/^\s*(\d+)\s+.*\btilt up\b.*?\s-f\s+(\S+)/i);
         if (!match)
             continue;
-        processes.push({ pid: Number(match[1]), root: match[2].split("/.tdk/")[0] });
+        processes.push({ pid: Number(match[1]), root: match[2].split(/[\\/]\.tdk[\\/]/i)[0] });
     }
     return processes;
 }
 export function checkTiltInstances(projectRoot = findProjectRoot() ?? process.cwd(), exec = execSync) {
     let output;
     try {
-        output = exec("ps -Ao pid=,command=", { encoding: "utf-8", timeout: EXEC_TIMEOUT_MS });
+        output =
+            process.platform === "win32"
+                ? execFileSync("powershell.exe", [
+                    "-NoProfile",
+                    "-Command",
+                    "Get-CimInstance Win32_Process | Where-Object { $_.Name -eq 'tilt.exe' } | ForEach-Object { '{0} {1}' -f $_.ProcessId, $_.CommandLine }",
+                ], { encoding: "utf-8", timeout: EXEC_TIMEOUT_MS, windowsHide: true })
+                : exec("ps -Ao pid=,command=", { encoding: "utf-8", timeout: EXEC_TIMEOUT_MS });
     }
     catch {
         return {
@@ -228,10 +236,10 @@ export function checkTiltInstances(projectRoot = findProjectRoot() ?? process.cw
     }
     return { name: "Tilt processes", didPass: true, message: "No stray Tilt processes" };
 }
-export function checkDockerNetworkCapacity(exec = execSync) {
+export async function checkDockerNetworkCapacity(exec = execAsync) {
     const probe = `tdk_doctor_probe_${process.pid}`;
     try {
-        exec(`docker network create ${probe}`, { stdio: "pipe", timeout: EXEC_TIMEOUT_MS });
+        await exec(`docker network create ${probe}`, EXEC_TIMEOUT_MS);
     }
     catch (error) {
         const stderr = String(error.stderr ?? error);
@@ -251,7 +259,7 @@ export function checkDockerNetworkCapacity(exec = execSync) {
         };
     }
     try {
-        exec(`docker network rm ${probe}`, { stdio: "pipe", timeout: EXEC_TIMEOUT_MS });
+        await exec(`docker network rm ${probe}`, EXEC_TIMEOUT_MS);
     }
     catch {
         // A leftover probe network is harmless and tdk_doctor_probe_* is easy to prune.

package/cli/dist/utils/errors.js

@@ -63,16 +63,16 @@ export const errorFactories = {
         "Path must be within the project directory",
         'Path cannot contain special characters like <>:"|?*',
     ]),
-    notInProject: () => new TdkError("Could not find project root (no Tiltfile found)", [
-        "Run this from within a project that has a Tiltfile",
-        "Run `tdk project` to initialize a new project",
+    notInProject: () => new TdkError("Could not find project root (no .tdk/project.json found)", [
+        "Run this from within a TDK project",
+        "Run `tdk project --yes` to initialize a new project",
     ]),
 };
 export function requireProjectRoot() {
     const projectRoot = findProjectRoot();
     if (!projectRoot) {
-        console.error(chalk.red("Error: Could not find project root (no Tiltfile found)."));
-        console.error(chalk.gray("Run this from within a project that has a Tiltfile."));
+        console.error(chalk.red("Error: Could not find project root (no .tdk/project.json found)."));
+        console.error(chalk.gray("Run `tdk project --yes` to initialize a new project."));
         process.exit(1);
     }
     return projectRoot;

package/cli/dist/utils/exec-async.js

@@ -0,0 +1,30 @@
+import { exec, execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { findOnPath } from "./which.js";
+const execPromise = promisify(exec);
+export const execAsync = async (command, timeoutMs) => {
+    if (process.platform === "win32") {
+        // Doctor commands are simple executable/argument invocations. Tokenize
+        // their quoted arguments and bypass cmd.exe/PowerShell entirely.
+        const parts = command.match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) ?? [];
+        const [parsedFile, ...args] = parts.map((part) => part.startsWith('"') || part.startsWith("'") ? part.slice(1, -1) : part);
+        if (!parsedFile)
+            throw new Error("Command is empty");
+        const file = findOnPath(parsedFile) ?? parsedFile;
+        const { stdout } = await promisify(execFile)(file, args, {
+            encoding: "utf-8",
+            timeout: timeoutMs,
+            windowsHide: true,
+            shell: false,
+        });
+        return stdout;
+    }
+    const { stdout } = await execPromise(command, { encoding: "utf-8", timeout: timeoutMs });
+    return stdout;
+};
+/** `exec` kills a timed-out child and sets `killed`; `execSync` reports ETIMEDOUT. */
+export function isExecTimeout(err) {
+    const e = err;
+    return e?.code === "ETIMEDOUT" || e?.killed === true;
+}
+//# sourceMappingURL=exec-async.js.map

package/cli/dist/utils/generated-paths.js

@@ -0,0 +1,49 @@
+import { existsSync, lstatSync } from "node:fs";
+import { isAbsolute, normalize, relative, sep } from "node:path";
+/** Reviewed TDK-owned destinations written by `tdk config regenerate` or Tilt generation. */
+export const TDK_GENERATED_PATH_ALLOWLIST = [
+    ".autogenerated/**",
+    ".tdk/.tdk-out/**",
+    "Tiltfile",
+    "TILT_*.star",
+    ".tiltignore",
+    "package.json (create only)",
+    "shared-platform-engineering/docker-templates/**",
+    "services/platform/database-management/docker-compose.yml",
+    "product_autogenerated_resource_manifests/**",
+    "product_autogenerated_services_list/**",
+];
+export function isTdkGeneratedPath(path) {
+    const normalized = normalize(path).split(sep).join("/");
+    if (isAbsolute(path) || normalized === ".." || normalized.startsWith("../"))
+        return false;
+    if (normalized.split("/").includes(".autogenerated") ||
+        normalized.startsWith(".tdk/.tdk-out/") ||
+        normalized === "shared-platform-engineering/docker-templates" ||
+        normalized.startsWith("shared-platform-engineering/docker-templates/") ||
+        normalized.startsWith("product_autogenerated_resource_manifests/") ||
+        normalized.startsWith("product_autogenerated_services_list/")) {
+        return true;
+    }
+    return (normalized === "Tiltfile" ||
+        /^TILT_[^/]+\.star$/.test(normalized) ||
+        normalized === ".tiltignore" ||
+        normalized === "package.json" ||
+        normalized === "services/platform/database-management/docker-compose.yml");
+}
+export function assertTdkGeneratedPath(projectRoot, path) {
+    const absolute = isAbsolute(path) ? normalize(path) : normalize(`${projectRoot}/${path}`);
+    const projectRelative = relative(projectRoot, absolute).split(sep).join("/");
+    if (!isTdkGeneratedPath(projectRelative)) {
+        throw new Error(`Refusing to write outside TDK's generated-file allowlist: ${projectRelative}`);
+    }
+    let cursor = projectRoot;
+    for (const segment of projectRelative.split("/")) {
+        cursor = normalize(`${cursor}/${segment}`);
+        if (existsSync(cursor) && lstatSync(cursor).isSymbolicLink()) {
+            throw new Error(`Refusing to write through a symbolic link in generated path: ${projectRelative}`);
+        }
+    }
+    return absolute;
+}
+//# sourceMappingURL=generated-paths.js.map

package/cli/dist/utils/platform.js

@@ -0,0 +1,53 @@
+import { delimiter, extname } from "node:path";
+export function isWindows() {
+    return process.platform === "win32";
+}
+export function tdkOsFor(platformName) {
+    if (platformName === "linux")
+        return "linux";
+    if (platformName === "darwin")
+        return "darwin";
+    if (platformName === "win32")
+        return "windows";
+    return null;
+}
+export function tdkOs() {
+    return tdkOsFor(process.platform);
+}
+export function tdkArchFor(architecture) {
+    if (architecture === "x64")
+        return "amd64";
+    if (architecture === "arm64")
+        return "arm64";
+    return null;
+}
+export function tdkArch() {
+    return tdkArchFor(process.arch);
+}
+export function binaryAssetNameFor(platformName, architecture) {
+    const osName = tdkOsFor(platformName);
+    const archName = tdkArchFor(architecture);
+    if (!osName || !archName)
+        return null;
+    if (osName === "windows" && archName !== "amd64")
+        return null;
+    const base = `tdk-${osName}-${archName}`;
+    return osName === "windows" ? `${base}.exe` : base;
+}
+export function binaryAssetName() {
+    return binaryAssetNameFor(process.platform, process.arch);
+}
+export function executableName() {
+    return isWindows() ? "tdk.exe" : "tdk";
+}
+export function pathLookups(binName, windows = isWindows()) {
+    if (!windows)
+        return [binName];
+    if (extname(binName))
+        return [binName];
+    return [binName, `${binName}.exe`, `${binName}.cmd`, `${binName}.bat`];
+}
+export function pathDelimiter(windows = isWindows()) {
+    return windows ? ";" : delimiter;
+}
+//# sourceMappingURL=platform.js.map

package/cli/dist/utils/port-assignment.js

@@ -1,5 +1,4 @@
-import { spawn } from "node:child_process";
-import { createConnection } from "node:net";
+import { createConnection, createServer } from "node:net";
 import { PORT_RANGES } from "./constants.js";
 function isPortAvailable(port) {
     return new Promise((resolve) => {
@@ -20,26 +19,20 @@ function isPortAvailable(port) {
 }
 export async function checkPortStatus(port) {
     return new Promise((resolve) => {
-        const child = spawn("lsof", ["-Pi", `:${port}`, "-sTCP:LISTEN"], {
-            timeout: 3000,
-            stdio: "pipe",
-        });
-        let hasOutput = false;
-        child.stdout?.on("data", () => {
-            hasOutput = true;
-        });
-        child.on("close", (code) => {
-            // lsof returns 0 if it found something, 1 if nothing found
-            if (code === 0) {
-                resolve("running");
-            }
-            else {
-                resolve(hasOutput ? "running" : "stopped");
-            }
-        });
-        child.on("error", () => {
+        const server = createServer();
+        const timer = setTimeout(() => {
+            server.close();
             resolve("unknown");
+        }, 3000);
+        server.once("error", (error) => {
+            clearTimeout(timer);
+            resolve(error.code === "EADDRINUSE" ? "running" : "unknown");
+        });
+        server.once("listening", () => {
+            clearTimeout(timer);
+            server.close(() => resolve("stopped"));
         });
+        server.listen(port, "127.0.0.1");
     });
 }
 export async function findAvailablePort(basePort, maxAttempts = 10) {