@tdk-landscape/tdk-cli-core 1.3.50 → 1.3.52

package/cli/src/commands/__tests__/doctor.test.ts

@@ -346,7 +346,7 @@ describe("doctor ingress + tilt runtime checks", () => {
   it("detects a foreign Traefik holding host port 80", () => {
     const dockerPs = [
       "tdk_saas_starter_traefik\t0.0.0.0:80->80/tcp,:::80->80/tcp,0.0.0.0:8080->8080/tcp",
-      "beauty_crm_postgres\t0.0.0.0:5432->5432/tcp",
+      "tdk_project_postgres\t0.0.0.0:5432->5432/tcp",
     ].join("\n");
 
     const holders = parsePublishedPortHolders(dockerPs, [80, 443]);
@@ -354,20 +354,20 @@ describe("doctor ingress + tilt runtime checks", () => {
     expect(holders[0]?.name).toBe("tdk_saas_starter_traefik");
     expect(holders[0]?.publishedPorts).toContain(80);
 
-    const foreign = findForeignIngressHolders(holders, "beauty_crm");
+    const foreign = findForeignIngressHolders(holders, "tdk_project");
     expect(foreign).toHaveLength(1);
 
-    const result = checkIngressPorts((() => dockerPs) as never, "beauty-crm");
+    const result = checkIngressPorts((() => dockerPs) as never, "tdk-project");
     expect(result.didPass).toBe(false);
     expect(result.message).toContain("tdk_saas_starter_traefik");
     expect(result.fix).toContain("docker stop");
   });
 
   it("passes when this project's Traefik owns the ingress ports", () => {
-    const dockerPs = "beauty_crm_traefik\t0.0.0.0:80->80/tcp,:::80->80/tcp,0.0.0.0:443->443/tcp";
-    const result = checkIngressPorts((() => dockerPs) as never, "beauty-crm");
+    const dockerPs = "tdk_project_traefik\t0.0.0.0:80->80/tcp,:::80->80/tcp,0.0.0.0:443->443/tcp";
+    const result = checkIngressPorts((() => dockerPs) as never, "tdk-project");
     expect(result.didPass).toBe(true);
-    expect(result.message).toContain("beauty_crm_traefik");
+    expect(result.message).toContain("tdk_project_traefik");
   });
 
   it("fails doctor when Tilt reports Traefik update errors that block apps", () => {
@@ -481,7 +481,7 @@ describe("doctor ingress + tilt runtime checks", () => {
   it("summarizes ConnectionRefused package manifest errors from build logs", () => {
     const raw = [
       "error: ConnectionRefused downloading package manifest @tdk-landscape/eventing",
-      "error: ConnectionRefused downloading package manifest @beauty-crm/identity-js-sdk",
+      "error: ConnectionRefused downloading package manifest @tdk-landscape/identity-js-sdk",
       "error: ConnectionRefused downloading package manifest @tdk-landscape/observability",
       'ImageBuild: process "/bin/sh -c bun install --production --cache-dir=/cache/bun" did not complete successfully: exit code: 1',
     ].join("\n");
@@ -672,7 +672,7 @@ describe("doctor ingress + tilt runtime checks", () => {
 
     const execUp = ((command: string) => {
       if (command.startsWith("docker ps")) {
-        return "beauty-crm-verdaccio\n";
+        return "tdk-project-verdaccio\n";
       }
       if (command.includes("curl")) {
         return "200";

package/cli/src/commands/__tests__/upgrade.test.ts

@@ -1,4 +1,5 @@
-import { chmodSync, mkdtempSync, rmSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { chmodSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
@@ -8,7 +9,7 @@ vi.mock("node:child_process", () => ({
   execSync: (...args: unknown[]) => execSyncMock(...args),
 }));
 
-const { upgradeViaBinary, isWritable } = await import("../upgrade.js");
+const { upgradeViaBinary, isWritable, parseChecksums } = await import("../upgrade.js");
 
 import type { BinaryRelease } from "../upgrade.js";
 
@@ -16,10 +17,31 @@ import type { BinaryRelease } from "../upgrade.js";
 // and leave the bundled tdk-cli/ engine+templates folder next to it stale or
 // missing, so an upgraded binary still crashed with the loadTemplate ENOENT
 // (the exact error this was meant to fix). It must refresh both, every time.
+const BINARY_BYTES = "fake tdk binary";
+const ENGINE_BYTES = "fake engine tarball";
+const sha256 = (text: string) => createHash("sha256").update(text).digest("hex");
+
 describe("upgradeViaBinary", () => {
   let installDir: string;
   let tdkPath: string;
   let release: BinaryRelease;
+  let checksums: string;
+  const downloaded: string[] = [];
+
+  // Stands in for curl: `curl -fsSL -o "<path>" "<url>"` writes the asset's
+  // bytes to <path>; `curl -fsSL "<checksums url>"` returns checksums.txt.
+  function fakeExec(command: string): string {
+    const download = command.match(/^curl -fsSL -o (".*?") (".*?")$/);
+    if (download) {
+      const path = JSON.parse(download[1]) as string;
+      const url = JSON.parse(download[2]) as string;
+      writeFileSync(path, url === release.engineDownloadUrl ? ENGINE_BYTES : BINARY_BYTES);
+      downloaded.push(path);
+      return "";
+    }
+    if (command.includes(release.checksumsUrl)) return checksums;
+    return "";
+  }
 
   beforeEach(() => {
     installDir = mkdtempSync(join(tmpdir(), "tdk-upgrade-test-"));
@@ -29,13 +51,20 @@ describe("upgradeViaBinary", () => {
       assetName: "tdk-darwin-arm64",
       downloadUrl: "https://example.test/tdk-darwin-arm64",
       engineDownloadUrl: "https://example.test/tdk-cli-engine.tar.gz",
+      checksumsUrl: "https://example.test/checksums.txt",
     };
+    checksums = [
+      `${sha256(BINARY_BYTES)}  tdk-darwin-arm64`,
+      `${sha256("other platform")}  tdk-linux-amd64`,
+      `${sha256(ENGINE_BYTES)}  tdk-cli-engine.tar.gz`,
+    ].join("\n");
     execSyncMock.mockReset();
-    execSyncMock.mockReturnValue("");
+    execSyncMock.mockImplementation(fakeExec);
   });
 
   afterEach(() => {
     rmSync(installDir, { recursive: true, force: true });
+    for (const path of downloaded.splice(0)) rmSync(path, { force: true });
   });
 
   function commandsRun(): string[] {
@@ -79,6 +108,50 @@ describe("upgradeViaBinary", () => {
     expect(tarIndex).toBeGreaterThan(engineCurlIndex);
   });
 
+  it("verifies checksums after both downloads and before installing anything", async () => {
+    await upgradeViaBinary(tdkPath, release);
+
+    const commands = commandsRun();
+    const checksumsIndex = commands.findIndex((c) => c.includes(release.checksumsUrl));
+    const engineCurlIndex = commands.findIndex((c) => c.includes(release.engineDownloadUrl));
+    const mvIndex = commands.findIndex((c) => c.startsWith("mv "));
+
+    expect(checksumsIndex).toBeGreaterThan(engineCurlIndex);
+    expect(mvIndex).toBeGreaterThan(checksumsIndex);
+  });
+
+  it.each([
+    [
+      "the binary does not match",
+      () => checksums.replace(sha256(BINARY_BYTES), sha256("tampered")),
+    ],
+    [
+      "the engine tarball does not match",
+      () => checksums.replace(sha256(ENGINE_BYTES), sha256("x")),
+    ],
+    ["checksums.txt has no entry for the binary", () => checksums.replace("tdk-darwin-arm64", "x")],
+  ])("refuses to install when %s", async (_case, makeChecksums) => {
+    checksums = makeChecksums();
+    const ok = await upgradeViaBinary(tdkPath, release);
+
+    expect(ok).toBe(false);
+    const commands = commandsRun();
+    expect(commands.some((c) => c.startsWith("mv "))).toBe(false);
+    expect(commands.some((c) => c.includes("tar -xzf"))).toBe(false);
+    expect(commands.some((c) => c.startsWith("rm -rf"))).toBe(false);
+  });
+
+  it("still installs releases whose checksums.txt predates the engine entry", async () => {
+    checksums = checksums
+      .split("\n")
+      .filter((line) => !line.endsWith("tdk-cli-engine.tar.gz"))
+      .join("\n");
+    const ok = await upgradeViaBinary(tdkPath, release);
+
+    expect(ok).toBe(true);
+    expect(commandsRun().some((c) => c.startsWith("mv "))).toBe(true);
+  });
+
   // root ignores the write-permission bit (accessSync(W_OK) legitimately
   // returns true even on a 0o555 dir), so these checks only hold for
   // non-root users.
@@ -109,3 +182,17 @@ describe("upgradeViaBinary", () => {
     }
   });
 });
+
+describe("parseChecksums", () => {
+  it("reads both text-mode and binary-mode (*name) shasum lines and ignores junk", () => {
+    const a = "a".repeat(64);
+    const b = "B".repeat(64);
+    const sums = parseChecksums(
+      `${a}  tdk-linux-amd64\n${b} *tdk-cli-engine.tar.gz\n\nnot a checksum line\n`,
+    );
+
+    expect(sums.get("tdk-linux-amd64")).toBe(a);
+    expect(sums.get("tdk-cli-engine.tar.gz")).toBe("b".repeat(64));
+    expect(sums.size).toBe(2);
+  });
+});

package/cli/src/commands/help.ts

@@ -1,24 +1,13 @@
 import chalk from "chalk";
+import pkg from "../../package.json" with { type: "json" };
 
 const TDK_BANNER = `
-${chalk.cyan("╔════════════════════════════════════════════════════════════╗")}
-${chalk.cyan("║")}                                                            ${chalk.cyan("║")}
-${chalk.cyan("║")}     ${chalk.bold.white("████████╗██████╗ ██╗  ██╗")}    ${chalk.bold.white("██████╗██╗     ██╗")}            ${chalk.cyan("║")}
-${chalk.cyan("║")}     ${chalk.bold.white("╚══██╔══╝██╔══██╗██║ ██╔╝")}   ${chalk.bold.white("██╔════╝██║     ██║")}            ${chalk.cyan("║")}
-${chalk.cyan("║")}        ${chalk.bold.white("██║   ██║  ██║█████╔╝")}    ${chalk.bold.white("██║     ██║     ██║")}            ${chalk.cyan("║")}
-${chalk.cyan("║")}        ${chalk.bold.white("██║   ██║  ██║██╔═██╗")}    ${chalk.bold.white("██║     ██║     ██║")}            ${chalk.cyan("║")}
-${chalk.cyan("║")}        ${chalk.bold.white("██║   ██████╔╝██║  ██╗")}${chalk.yellow("██╗")}${chalk.bold.white("╚██████╗███████╗██║")}            ${chalk.cyan("║")}
-${chalk.cyan("║")}        ${chalk.white("╚═╝   ╚═════╝ ╚═╝  ╚═╝╚═╝")} ${chalk.white("╚═════╝╚══════╝╚═╝")}            ${chalk.cyan("║")}
-${chalk.cyan("║")}                                                            ${chalk.cyan("║")}
-${chalk.cyan("║")}          ${chalk.bold.yellow("🚀 Tilt Development Kit - Local Microservices")}             ${chalk.cyan("║")}
-${chalk.cyan("║")}                                                            ${chalk.cyan("║")}
-${chalk.cyan("╚════════════════════════════════════════════════════════════╝")}
+  ${chalk.bold.cyan("tdk")} ${chalk.gray(`v${pkg.version}`)}  ${chalk.white("Tilt Development Kit: run your microservices locally")}
 `;
 
 const COMMAND_GROUPS = [
   {
-    title: "🌍 Project Level",
-    emoji: "📁",
+    title: "Project Level",
     color: chalk.blue,
     commands: [
       {
@@ -30,8 +19,7 @@ const COMMAND_GROUPS = [
     ],
   },
   {
-    title: "📦 Stack Level",
-    emoji: "📦",
+    title: "Stack Level",
     color: chalk.magenta,
     commands: [
       { name: "stack", desc: "Organize resources into stacks (interactive)", alias: "" },
@@ -39,8 +27,7 @@ const COMMAND_GROUPS = [
     ],
   },
   {
-    title: "⚡ Resource Level",
-    emoji: "⚡",
+    title: "Resource Level",
     color: chalk.yellow,
     commands: [
       { name: "resource", desc: "Create new resource with templates", alias: "" },
@@ -48,8 +35,7 @@ const COMMAND_GROUPS = [
     ],
   },
   {
-    title: "🔄 Lifecycle",
-    emoji: "🔄",
+    title: "Lifecycle",
     color: chalk.green,
     commands: [
       { name: "up, deploy", desc: "Start services (optionally by stack)", alias: "[stack-name]" },
@@ -58,8 +44,7 @@ const COMMAND_GROUPS = [
     ],
   },
   {
-    title: "🌐 Networking",
-    emoji: "🌐",
+    title: "Networking",
     color: chalk.blueBright,
     commands: [
       {
@@ -70,8 +55,7 @@ const COMMAND_GROUPS = [
     ],
   },
   {
-    title: "🛠️ Utilities",
-    emoji: "🛠️",
+    title: "Utilities",
     color: chalk.cyan,
     commands: [
       { name: "ui, interactive", desc: "Interactive TUI for managing services", alias: "" },
@@ -84,7 +68,7 @@ const COMMAND_GROUPS = [
       { name: "completion", desc: "Generate shell completions", alias: "--install --shell zsh" },
       { name: "upgrade, update", desc: "Self-update to latest version", alias: "--force" },
       { name: "version, -v", desc: "Display version number", alias: "" },
-      { name: "help", desc: "Show this colorful help", alias: "[command]" },
+      { name: "help", desc: "Show help", alias: "[command]" },
     ],
   },
 ];
@@ -104,7 +88,7 @@ function formatCommand(
 export function showHelp(): void {
   console.log(TDK_BANNER);
 
-  console.log(chalk.bold.white("\n  Project → Phase → Stack → Resource (PPSR) Model\n"));
+  console.log(chalk.bold.white("\n  Project → Phase → Stack → Resource\n"));
 
   console.log(chalk.gray("  Usage: tdk [command] [options]\n"));
 
@@ -117,7 +101,7 @@ export function showHelp(): void {
   console.log();
 
   for (const group of COMMAND_GROUPS) {
-    console.log(group.color.bold(`${group.emoji} ${group.title}`));
+    console.log(group.color.bold(`  ${group.title}`));
     console.log(group.color(`  ${"─".repeat(50)}`));
 
     for (const cmd of group.commands) {
@@ -126,7 +110,7 @@ export function showHelp(): void {
 
     console.log();
   }
-  console.log(chalk.bold.yellow("  🚀 Quick Start:"));
+  console.log(chalk.bold.yellow("  Quick start:"));
   console.log(chalk.gray(`  ${"─".repeat(50)}`));
   console.log(
     chalk.white(`
@@ -136,25 +120,24 @@ export function showHelp(): void {
   ${chalk.cyan("4.")} Start development:         ${chalk.green("tdk up my-stack")}
   `),
   );
-  console.log(chalk.bold.yellow("  💡 Examples:"));
+  console.log(chalk.bold.yellow("  Examples:"));
   console.log(chalk.gray(`  ${"─".repeat(50)}`));
   console.log(
     chalk.white(`
-  ${chalk.cyan("$")} tdk project                          # Create master configs
-  ${chalk.cyan("$")} tdk resource api --type backend      # Create backend service
-  ${chalk.cyan("$")} tdk resource app --type frontend       # Create frontend app
-  ${chalk.cyan("$")} tdk stacks --services                  # List stacks with resources
-  ${chalk.cyan("$")} tdk up my-stack                        # Start a stack
-  ${chalk.cyan("$")} tdk networks                          # Show Traefik-routed URLs
-  ${chalk.cyan("$")} tdk doctor                           # Check environment
-  ${chalk.cyan("$")} tdk upgrade                          # Self-update
+  ${chalk.cyan("$")} tdk project                       # Create master configs
+  ${chalk.cyan("$")} tdk resource api --type backend   # Create a backend service
+  ${chalk.cyan("$")} tdk resource app --type frontend  # Create a frontend app
+  ${chalk.cyan("$")} tdk stacks --services             # List stacks with their resources
+  ${chalk.cyan("$")} tdk up my-stack                   # Start a stack
+  ${chalk.cyan("$")} tdk networks                      # Show Traefik-routed URLs
+  ${chalk.cyan("$")} tdk doctor                        # Check your environment
+  ${chalk.cyan("$")} tdk upgrade                       # Self-update
   `),
   );
   console.log(chalk.gray(`  ${"═".repeat(50)}`));
-  console.log(chalk.gray(`  For more help: ${chalk.cyan("tdk help [command]}")}`));
+  console.log(chalk.gray(`  For more help: ${chalk.cyan("tdk help [command]")}`));
   console.log(
     chalk.gray(`  GitHub: ${chalk.cyan("https://github.com/tdk-landscape/tdk-cli-core")}`),
   );
   console.log();
-  console.log(chalk.green.bold("  Happy coding! 🚀\n"));
 }

package/cli/src/commands/project.ts

@@ -69,6 +69,26 @@ function syncDiscoveredStacksToPreAlpha(
   return missingStacks;
 }
 
+/**
+ * Adds stacks that have service.json files but aren't in any phase to
+ * pre_alpha, so a resource scaffolded after `tdk project` is picked up by
+ * `tdk up` without re-running `tdk project`. Returns the stacks it enabled.
+ */
+export function enableDiscoveredStacks(projectRoot: string): string[] {
+  const projectJsonPath = join(projectRoot, ".tdk", "project.json");
+  if (!existsSync(projectJsonPath)) return [];
+
+  const projectConfig = readProjectConfig(projectRoot);
+  const enabled = syncDiscoveredStacksToPreAlpha(
+    projectConfig,
+    discoverExistingServiceStacks(projectRoot),
+  );
+  if (enabled.length > 0) {
+    writeJsonFile(projectJsonPath, projectConfig);
+  }
+  return enabled;
+}
+
 /**
  * Get core infrastructure services from PROJECT_FEATURES that are enabled by default
  */

package/cli/src/commands/up.ts

@@ -15,6 +15,7 @@ import {
   stackExists,
 } from "../utils/services.js";
 import { buildTiltUpArgs, runTilt } from "../utils/tilt.js";
+import { enableDiscoveredStacks } from "./project.js";
 
 export const upCommand = new Command("up")
   .description("Start all services (optionally filtered by stack)")
@@ -32,6 +33,15 @@ export const upCommand = new Command("up")
         console.log(chalk.gray(`Refreshed runtime assets: ${copiedAssets.join(", ")}`));
       }
 
+      const newlyEnabledStacks = enableDiscoveredStacks(projectRoot);
+      if (newlyEnabledStacks.length > 0 && !options.quiet) {
+        console.log(
+          chalk.gray(
+            `Added ${newlyEnabledStacks.join(", ")} to the pre_alpha phase in .tdk/project.json`,
+          ),
+        );
+      }
+
       let servicesToStart: Awaited<ReturnType<typeof discoverResources>>;
       let stackDescription: string;
       let focusServiceNames: string[] = [];

package/cli/src/commands/upgrade.ts

@@ -1,5 +1,6 @@
 import { execSync } from "node:child_process";
-import { accessSync, constants, existsSync, realpathSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { accessSync, constants, existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import chalk from "chalk";
@@ -78,12 +79,48 @@ function binaryAssetName(): string | null {
 }
 
 const ENGINE_ASSET_NAME = "tdk-cli-engine.tar.gz";
+const CHECKSUMS_ASSET_NAME = "checksums.txt";
 
 export interface BinaryRelease {
   tag: string;
   assetName: string;
   downloadUrl: string;
   engineDownloadUrl: string;
+  checksumsUrl: string;
+}
+
+/** Parses `shasum -a 256` / `sha256sum` output ("<hash>  <name>" or "<hash> *<name>"). */
+export function parseChecksums(text: string): Map<string, string> {
+  const sums = new Map<string, string>();
+  for (const line of text.split("\n")) {
+    const match = line.trim().match(/^([0-9a-f]{64})\s+\*?(.+)$/i);
+    if (match) sums.set(match[2].trim(), match[1].toLowerCase());
+  }
+  return sums;
+}
+
+/**
+ * Throws unless `filePath` hashes to the checksum listed for `assetName`.
+ * A missing entry is an error when `required`; otherwise it is skipped, so
+ * releases published before an asset was added to checksums.txt (older
+ * releases list only the binaries, not the engine tarball) still install.
+ */
+function verifyChecksum(
+  filePath: string,
+  assetName: string,
+  sums: Map<string, string>,
+  required: boolean,
+): void {
+  const expected = sums.get(assetName);
+  if (!expected) {
+    if (required) throw new Error(`${CHECKSUMS_ASSET_NAME} has no entry for ${assetName}`);
+    logVerbose(`${CHECKSUMS_ASSET_NAME} has no entry for ${assetName}; skipping verification`);
+    return;
+  }
+  const actual = createHash("sha256").update(readFileSync(filePath)).digest("hex");
+  if (actual !== expected) {
+    throw new Error(`Checksum mismatch for ${assetName} (expected ${expected}, got ${actual})`);
+  }
 }
 
 async function getLatestBinaryRelease(): Promise<BinaryRelease | null> {
@@ -103,6 +140,7 @@ async function getLatestBinaryRelease(): Promise<BinaryRelease | null> {
       assetName,
       downloadUrl: `https://github.com/${BINARY_RELEASE_REPO}/releases/download/${data.tag_name}/${assetName}`,
       engineDownloadUrl: `https://github.com/${BINARY_RELEASE_REPO}/releases/download/${data.tag_name}/${ENGINE_ASSET_NAME}`,
+      checksumsUrl: `https://github.com/${BINARY_RELEASE_REPO}/releases/download/${data.tag_name}/${CHECKSUMS_ASSET_NAME}`,
     };
   } catch (err: unknown) {
     logVerbose("Binary release lookup error", err);
@@ -158,6 +196,19 @@ export async function upgradeViaBinary(tdkPath: string, release: BinaryRelease):
       { stdio: "pipe", timeout: 120000 },
     );
 
+    // Verify both downloads against the release's checksums.txt before
+    // touching the installed binary or engine.
+    spinner.text = `Verifying checksums (${release.tag})...`;
+    const sums = parseChecksums(
+      execSync(`curl -fsSL ${JSON.stringify(release.checksumsUrl)}`, {
+        encoding: "utf-8",
+        stdio: "pipe",
+        timeout: 30000,
+      }),
+    );
+    verifyChecksum(tmpPath, release.assetName, sums, true);
+    verifyChecksum(engineTmpPath, ENGINE_ASSET_NAME, sums, false);
+
     execSync(`mv ${JSON.stringify(tmpPath)} ${JSON.stringify(tdkPath)}`);
     execSync(`rm -rf ${JSON.stringify(engineDir)}`);
     execSync(`mkdir -p ${JSON.stringify(engineDir)}`);

package/cli/src/utils/constants.ts

@@ -54,7 +54,7 @@ export const STANDARD_PORTS = {
 
 export const QUICKSTART_DOCS_URL = "https://tdk-landscape.github.io/tdk-website/docs/quickstart/";
 
-export const BASE_DOMAIN_DEFAULT = "beauty-crm.localhost";
+export const BASE_DOMAIN_DEFAULT = "tdk-project.localhost";
 export const APP_SUBDOMAIN_PREFIX = "app";
 export const API_SUBDOMAIN_PREFIX = "api";
 

package/cli/src/utils/doctor-runtime.ts

@@ -62,7 +62,7 @@ export function parsePublishedPortHolders(
 export function isOwnIngressContainer(containerName: string, projectPrefix: string): boolean {
   const name = containerName.toLowerCase();
   const prefix = projectPrefix.toLowerCase();
-  // beauty_crm_traefik, beauty_crm-traefik-1, etc.
+  // tdk_project_traefik, tdk_project-traefik-1, etc.
   return name === `${prefix}_traefik` || name.startsWith(`${prefix}_traefik`);
 }
 
@@ -201,14 +201,14 @@ export function summarizeTiltBuildError(error: string): string {
   }
 
   if (
-    /failed to resolve source metadata for docker\.io\/library\/(beauty-crm-[^:\s]+)/i.test(
+    /failed to resolve source metadata for docker\.io\/library\/(tdk-project-[^:\s]+)/i.test(
       normalized,
     )
   ) {
     const image = normalized.match(
-      /failed to resolve source metadata for docker\.io\/library\/(beauty-crm-[^:\s]+)/i,
+      /failed to resolve source metadata for docker\.io\/library\/(tdk-project-[^:\s]+)/i,
     )?.[1];
-    return `base image ${image ?? "beauty-crm-*"} missing locally (golden-layer build not finished or failed)`;
+    return `base image ${image ?? "tdk-project-*"} missing locally (golden-layer build not finished or failed)`;
   }
 
   if (
@@ -364,7 +364,7 @@ export function checkPrivateNpmRegistry(
   return {
     name: "Private npm registry",
     didPass: false,
-    message: `Private npm registry (Verdaccio) is not reachable at ${registryUrl}. Docker ImageBuilds will fail with ConnectionRefused downloading package manifests for @beauty-crm/* and @tdk-landscape/* packages.`,
+    message: `Private npm registry (Verdaccio) is not reachable at ${registryUrl}. Docker ImageBuilds will fail with ConnectionRefused downloading package manifests for @tdk-landscape/* and project-scoped packages.`,
     fix: "Start the registry with `bun run verdaccio:start` (or `docker compose -f docker-compose.verdaccio.yml up -d`), publish packages with `bun run publish:all` / `scripts/build/publish-to-verdaccio.sh`, then `tilt trigger` failed resources or re-run `tdk up`.",
   };
 }

package/cli/src/utils/prompt.ts

@@ -32,7 +32,14 @@ interface MultiSelectPromptOptions<T extends string> extends ChoicePromptOptions
 async function question(prompt: string): Promise<string> {
   const rl = createInterface({ input, output });
   try {
-    return (await rl.question(prompt)).trim();
+    // Without this, a closed stdin (CI, `< /dev/null`, a pipe) leaves the
+    // question pending forever and Node exits 0 having done nothing.
+    return await new Promise<string>((resolve, reject) => {
+      rl.once("close", () =>
+        reject(new Error("No input available to answer the prompt. Run this in a terminal.")),
+      );
+      rl.question(prompt).then((answer) => resolve(answer.trim()), reject);
+    });
   } finally {
     rl.close();
   }

package/cli/src/utils/service-urls.ts

@@ -28,7 +28,7 @@ export function getProjectName(): string {
       }
     } catch {}
   }
-  return "beauty-crm";
+  return "tdk-project";
 }
 
 export function resolveSubdomainBases(): { appBase: string; apiBase: string } {

package/discovery/identity-management-backend/service.yaml

@@ -9,8 +9,8 @@ features:
 healthCheck: True
 healthCheckPath: /api/v1/health
 params:
-  BASE_URL: http://identity.backend.beauty.local
-  EMAIL_FROM: noreply@beauty-crm.local
+  BASE_URL: http://identity.backend.tdk-project.local
+  EMAIL_FROM: noreply@tdk-project.local
   UPSTASH_REDIS_REST_URL: http://redis:6379
 path: identity-management-backend
 playwright: True

package/discovery/identity-management-frontend/service.yaml

@@ -18,7 +18,7 @@ federation:
     shared:
       - react
       - react-dom
-      - @beauty-crm/introvertic-ui
+      - @tdk-landscape/introvertic-ui
 healthCheck: True
 path: identity-management-frontend
 playwright: True

package/discovery/registry.star

@@ -423,7 +423,9 @@ def _find_manifest_files(root, manifest_filename):
             full_path = root
         else:
             full_path = project_root + "/" + root
-        cmd = "find " + full_path + " -type f -name '" + manifest_filename + "' 2>/dev/null"
+        # A stack listed in project.json may not have a directory yet (a fresh
+        # project lists "proxy"); find exits 1 on a missing path and local() fails.
+        cmd = "if [ -d '" + full_path + "' ]; then find '" + full_path + "' -type f -name '" + manifest_filename + "' 2>/dev/null; fi"
         result = str(local(cmd, quiet=True, echo_off=True)).strip()
     
     if result:

package/discovery/services/platform/orchestrator/orchestrator-glue-backend/service.yaml

@@ -2,7 +2,7 @@ appName: orchestrator-glue-backend
 appType: backend
 stack: platform
 port: 5001
-databaseName: beauty_crm_orchestrator
+databaseName: tdk_project_orchestrator
 features:
   - nats
   - prisma
@@ -22,5 +22,5 @@ resources:
     memory: 256Mi
 runtime: bun
 traefik:
-  host: orchestrator.backend.beauty.local
+  host: orchestrator.backend.tdk-project.local
   pathPrefix: /api/orchestrator