@flisk-sh/flisk 1.3.207 → 1.4.0

package/{discovery → runtime/discovery}/TILT_DISCOVERY.star

@@ -128,7 +128,7 @@ def get_synthesis_config():
 
         # Database naming pattern: {project}_{domain}_{resource_function}
         # Example: services/product/users/user-management-backend -> {project}_user_management
-        "database_name_pattern": "TDK_{domain}_{function}",
+        "database_name_pattern": "FLISK_{domain}_{function}",
 
         # Backend name pattern for frontends: {domain}-management-backend
         "backend_name_pattern": "{domain}-management-backend",
@@ -144,7 +144,7 @@ def get_synthesis_config():
 # =============================================================================
 # DOMAIN CONFIGURATION
 # =============================================================================
-# Business stacks are defined in .tdk/project.json per project.
+# Business stacks are defined in .flisk/project.json per project.
 # This function returns an empty list - stacks are discovered dynamically.
 
 
@@ -152,7 +152,7 @@ def get_valid_stacks():
     """Return list of valid business stacks from project config.
 
     Returns:
-        list: Valid stack names (loaded from .tdk/project.json)
+        list: Valid stack names (loaded from .flisk/project.json)
     """
     # Stacks are project-specific and loaded from project.json
     # Return empty list - actual stacks discovered from filesystem
@@ -213,7 +213,7 @@ def get_valid_resource_features():
         "grpc",
         "vite-node",
         "maintenance",
-        # Premium (requires TDK_LICENSE_KEY) - see generate_backend_path_aliases()
+        # Premium (requires FLISK_LICENSE_KEY) - see generate_backend_path_aliases()
         # in engine/topologies/tilt/generators/vite/helpers.star
         "ddd",
     ]
@@ -265,7 +265,7 @@ def get_dependency_resolution_config():
 
         # Library dependency patterns (package.json prefixes)
         "library_dependency_prefixes": [
-            "@tdk/",
+            "@flisk/",
         ],
 
         # Default internal dependencies for service types

package/{discovery → runtime/discovery}/Tiltfile

@@ -1,12 +1,12 @@
 # =============================================================================
-# 🎯 TDK-DISCOVERY - Service Discovery Plugin
+# 🎯 Flisk-DISCOVERY - Service Discovery Plugin
 # =============================================================================
-# This is the Tiltfile entry point for the tdk-discovery repo.
+# This is the Tiltfile entry point for the flisk-discovery repo.
 # It exports manifest loading, registry, and auto-discovery daemon.
 #
 # Usage:
-#   v1alpha1.extension_repo(name='tdk-discovery', url='https://github.com/flisk-sh/flisk')
-#   load('ext://tdk-discovery', 'get_discovery_path', 'run_daemon', ...)
+#   v1alpha1.extension_repo(name='flisk-discovery', url='https://github.com/flisk-sh/flisk')
+#   load('ext://flisk-discovery', 'get_discovery_path', 'run_daemon', ...)
 # =============================================================================
 
 # Constants
@@ -55,4 +55,4 @@ def get_daemon_command():
     """Return the command to run the discovery daemon."""
     return 'python3 ./resource_snapshot.py daemon'
 
-print("✅ TDK Discovery loaded: manifest scanning and auto-discovery")
+print("✅ Flisk Discovery loaded: manifest scanning and auto-discovery")

package/{discovery → runtime/discovery}/config.star

@@ -9,7 +9,7 @@ load("./constants.star", "RESOURCES_ROOT")
 load("../engine/topologies/platform/docker/constants.star", "PlatformDockerConstants")
 
 # NOTE: DEFAULTS and focus lists are now loaded dynamically in resource_registry.star
-# from the project's spec.master (using TDK_PROJECT_ROOT environment variable).
+# from the project's spec.master (using FLISK_PROJECT_ROOT environment variable).
 # This allows per-project resource configuration.
 
 # Default empty values - will be populated by _load_project_defaults() in resource_registry.star
@@ -31,13 +31,13 @@ def load_project_defaults(project_root):
     
     # Check multiple locations for spec.master (in order of preference)
     spec_paths = [
-        project_root + "/.tdk/.tdk-out/generated/spec.master",  # New unified output folder
+        project_root + "/.flisk/.flisk-out/generated/spec.master",  # New unified output folder
         project_root + "/spec.master",                       # Original location (legacy)
     ]
     
     spec_path = None
     for path in spec_paths:
-        check_cmd = "test -f '{}' && echo 'yes' || echo 'no'".format(path)
+        check_cmd = ["sh", "-c", 'test -f "$1" && echo yes || echo no', "sh", path]
         exists = str(local(check_cmd, quiet=True, echo_off=True)).strip() == 'yes'
         if exists:
             spec_path = path
@@ -141,7 +141,7 @@ def load_project_defaults(project_root):
 # 🎛️ RESOURCE DEFAULTS
 # -----------------------------------------------------------------------------
 # LOADED FROM: spec.master (searched in order):
-#   1. .tdk/.tdk-out/generated/spec.master (new unified output folder)
+#   1. .flisk/.flisk-out/generated/spec.master (new unified output folder)
 #   2. spec.master (legacy location in project root)
 # PURPOSE: Single source of truth for resource enable/disable configuration
 # 
@@ -156,7 +156,7 @@ def get_global_config():
     )
     # Verdaccio is a premium feature — only enabled when a license key is present.
     # Without a key, scoped packages fall back to the public npm registry.
-    verdaccio_license_key = os.environ.get("TDK_LICENSE_KEY", "")
+    verdaccio_license_key = os.environ.get("FLISK_LICENSE_KEY", "")
     verdaccio_enabled = verdaccio_license_key != ""
     return {
         "verdaccio_url_local": PlatformDockerConstants.VERDACCIO_URL_LOCAL,

package/{discovery → runtime/discovery}/constants.star

@@ -22,18 +22,18 @@ RESOURCES_ROOT_PREFIX = ""
 # Check for project-specific discovery patterns
 def _get_project_discovery_roots():
     """Get discovery roots from project spec.master if available."""
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
     if not project_root:
         return []
     
     # Try to read spec.master for custom discovery patterns
     spec_paths = [
-        project_root + "/.tdk/.tdk-out/spec.master",
+        project_root + "/.flisk/.flisk-out/spec.master",
         project_root + "/spec.master",
     ]
     
     for spec_path in spec_paths:
-        check_cmd = "test -f '{}' && echo 'yes' || echo 'no'".format(spec_path)
+        check_cmd = ["sh", "-c", 'test -f "$1" && echo yes || echo no', "sh", spec_path]
         exists = str(local(check_cmd, quiet=True, echo_off=True)).strip() == 'yes'
         if exists:
             # Read and parse spec.master for RESOURCE_PATTERNS
@@ -60,13 +60,13 @@ def _get_project_discovery_roots():
 _PROJECT_DISCOVERY_ROOTS = _get_project_discovery_roots()
 
 def _get_enabled_project_stacks():
-    """Read enabled stack names from .tdk/project.json phases.*.enabledStacks."""
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    """Read enabled stack names from .flisk/project.json phases.*.enabledStacks."""
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
     if not project_root:
         return []
 
-    project_config_path = project_root + "/.tdk/project.json"
-    exists = str(local("test -f '{}' && echo 'yes' || echo 'no'".format(project_config_path), quiet=True, echo_off=True)).strip() == 'yes'
+    project_config_path = project_root + "/.flisk/project.json"
+    exists = str(local(["sh", "-c", 'test -f "$1" && echo yes || echo no', "sh", project_config_path], quiet=True, echo_off=True)).strip() == 'yes'
     if not exists:
         return []
 
@@ -107,15 +107,15 @@ _DISCOVERY_ROOTS_RAW = _expand_enabled_stack_roots(_PROJECT_DISCOVERY_ROOTS) if
     "cli-platform-engineering",              # cli-platform-engineering/*/
 ]
 
-# SAFETY: Filter out tdk-cli's own directories to prevent self-modification
+# SAFETY: Filter out flisk-cli's own directories to prevent self-modification
 # The CLI should never scan or write to its own installation directory
 def _filter_cli_dirs(roots):
-    """Remove tdk-cli internal directories from scan roots."""
+    """Remove flisk-cli internal directories from scan roots."""
     filtered = []
     for root in roots:
-        # Skip if path contains tdk-cli internal paths
-        if "tdk-cli" in root and "discovery" in root:
-            print("⚠️  Skipping tdk-cli internal directory: {}".format(root))
+        # Skip if path contains flisk-cli internal paths
+        if "flisk-cli" in root and "discovery" in root:
+            print("⚠️  Skipping flisk-cli internal directory: {}".format(root))
             continue
         if root.startswith("discovery/") or root == "discovery":
             print("⚠️  Skipping discovery directory: {}".format(root))
@@ -151,7 +151,7 @@ MAX_SCAN_TIMEOUT_MS = 5000    # 5 seconds per root (warn if exceeded)
 MAX_MANIFESTS_PER_ROOT = 110  # Warn if root has more manifests
 
 # Autogenerated files directory (relative to this file's location)
-PRODUCT_SNAPSHOT_DIR = ".tdk/.tdk-out/product_autogenerated_resource_manifests"
+PRODUCT_SNAPSHOT_DIR = ".flisk/.flisk-out/product_autogenerated_resource_manifests"
 
 PRODUCT_SNAPSHOT_FILES = {
     "services": "services.autogenerated.star",
@@ -162,6 +162,6 @@ PRODUCT_SNAPSHOT_FILES = {
     "readme": "README.autogenerated.md",
 }
 
-PRODUCT_TOPOLOGY_DIR = ".tdk/.tdk-out/product_autogenerated_services_list"
+PRODUCT_TOPOLOGY_DIR = ".flisk/.flisk-out/product_autogenerated_services_list"
 PRODUCT_STACKS_INDEX_FILE = "stacks.autogenerated.star"
 PRODUCT_STACK_RESOURCES_FILE = "resources.autogenerated.star"

package/{discovery → runtime/discovery}/deterministic.star

@@ -35,7 +35,7 @@ def deterministic_find(path, pattern):
     """
     # Always use | sort to ensure alphabetical ordering
     # This makes output invariant to filesystem ordering (ext4 vs APFS vs NTFS)
-    cmd = "find {} -type f -name '{}' 2>/dev/null | sort".format(path, pattern)
+    cmd = ["sh", "-c", 'find "$1" -type f -name "$2" 2>/dev/null | sort', "sh", path, pattern]
     result = str(local(cmd, quiet=True, echo_off=True)).strip()
     if result:
         return result.split('\n')

package/{discovery → runtime/discovery}/discovery_daemon.star

@@ -172,7 +172,7 @@ def _handle_new_service(
 def _file_exists(path):
     """Check if a file exists."""
     result = local(
-        "test -f {} && echo 'yes' || echo 'no'".format(path),
+        ["sh", "-c", 'test -f "$1" && echo yes || echo no', "sh", path],
         quiet=True,
         echo_off=True
     )
@@ -185,7 +185,7 @@ def time_now():
 
 def sleep(seconds):
     """Sleep for specified seconds."""
-    local("sleep {}".format(seconds), quiet=True, echo_off=True)
+    local(["sleep", str(seconds)], quiet=True, echo_off=True)
 
 # Export daemon functions
 DiscoveryDaemon = struct(

package/{discovery → runtime/discovery}/discovery_orchestrator.star

@@ -50,17 +50,17 @@ def _to_project_relative_path(path, project_root):
     """
     if not path:
         return path
-    root = project_root if project_root else os.environ.get("TDK_PROJECT_ROOT", ".")
+    root = project_root if project_root else os.environ.get("FLISK_PROJECT_ROOT", ".")
     # Already project-relative (including ../sibling/...)
     if not path.startswith("/"):
         return path
-    cmd = (
-        "python3 -c \"import os; print(os.path.relpath(os.path.realpath('''" +
-        path +
-        "'''), os.path.realpath('''" +
-        root +
-        "''')))\""
-    )
+    cmd = [
+        "python3",
+        "-c",
+        "import os, sys; print(os.path.relpath(os.path.realpath(sys.argv[1]), os.path.realpath(sys.argv[2])))",
+        path,
+        root,
+    ]
     relative = str(local(cmd, quiet=True, echo_off=True)).strip()
     if relative:
         return relative
@@ -250,13 +250,13 @@ def _scan_resources():
             seen_paths[path] = True
             manifest_paths.append(path)
 
-    # CRITICAL FIX: Filter out tdk-cli internal paths to prevent self-scanning
-    # This prevents tdk-cli from discovering its own internal test stubs
-    def _is_tdk_cli_internal_path(path):
-        """Check if path is within tdk-cli's own directory structure."""
+    # CRITICAL FIX: Filter out flisk-cli internal paths to prevent self-scanning
+    # This prevents flisk-cli from discovering its own internal test stubs
+    def _is_flisk_cli_internal_path(path):
+        """Check if path is within flisk-cli's own directory structure."""
         internal_markers = [
-            "tdk-cli/discovery/services/",
-            "tdk-cli/discovery/identity-",
+            "flisk-cli/discovery/services/",
+            "flisk-cli/discovery/identity-",
         ]
         for marker in internal_markers:
             if marker in path:
@@ -265,8 +265,8 @@ def _scan_resources():
 
     filtered_manifest_paths = []
     for path in manifest_paths:
-        if _is_tdk_cli_internal_path(path):
-            print("⚠️  Skipping tdk-cli internal stub: {}".format(path))
+        if _is_flisk_cli_internal_path(path):
+            print("⚠️  Skipping flisk-cli internal stub: {}".format(path))
             continue
         filtered_manifest_paths.append(path)
 
@@ -275,7 +275,7 @@ def _scan_resources():
     if not manifest_paths:
         return resources
     
-    project_root = os.environ.get("TDK_PROJECT_ROOT", ".")
+    project_root = os.environ.get("FLISK_PROJECT_ROOT", ".")
 
     for manifest_path in manifest_paths:
         # manifest_path may be absolute (legacy find) or project-relative.

package/{discovery → runtime/discovery}/identity-management-backend/service.yaml

@@ -9,8 +9,8 @@ features:
 healthCheck: True
 healthCheckPath: /api/v1/health
 params:
-  BASE_URL: http://identity.backend.tdk-project.local
-  EMAIL_FROM: noreply@tdk-project.local
+  BASE_URL: http://identity.backend.flisk-project.local
+  EMAIL_FROM: noreply@flisk-project.local
   UPSTASH_REDIS_REST_URL: http://redis:6379
 path: identity-management-backend
 playwright: True

package/{discovery → runtime/discovery}/incremental_discovery.star

@@ -168,7 +168,7 @@ def validate_resource_structure(resource_path):
     for filename in required_files:
         filepath = resource_path + "/" + filename
         result = local(
-            "test -f {} && echo 'yes' || echo 'no'".format(filepath),
+            ["sh", "-c", 'test -f "$1" && echo yes || echo no', "sh", filepath],
             quiet=True,
             echo_off=True
         )

package/{discovery → runtime/discovery}/json_manifest_scanner.star

@@ -16,14 +16,14 @@ def discover_json_manifests(root_path):
     
     Args:
         root_path: Path relative to project root (e.g., "services/product")
-                   or absolute path. Uses TDK_PROJECT_ROOT env var if set.
+                   or absolute path. Uses FLISK_PROJECT_ROOT env var if set.
                    Supports glob patterns like "identity-*" for flat structures.
     
     Returns:
         List of manifest file paths (strings)
     """
     # Get project root from environment variable set by main Tiltfile
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '.')
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '.')
     
     # Check if root_path contains glob patterns
     if '*' in root_path or '?' in root_path:

package/{discovery → runtime/discovery}/libraries.star

@@ -11,7 +11,7 @@
 
 def autodiscover_libraries(root_path, prefix):
     libs = []
-    result = str(local("ls -d " + root_path + "/" + prefix + "*/ 2>/dev/null || true", quiet=True, echo_off=True))
+    result = str(local(["sh", "-c", 'ls -d "$1"/"$2"*/ 2>/dev/null || true', "sh", root_path, prefix], quiet=True, echo_off=True))
 
     if result:
         for line in result.strip().split("\n"):

package/{discovery → runtime/discovery}/manifest/constants.star

@@ -62,7 +62,7 @@ VALIDATION_THRESHOLDS = {
 }
 
 # Valid stacks - loaded dynamically from project config
-# Projects define their own stacks in .tdk/project.json
+# Projects define their own stacks in .flisk/project.json
 VALID_STACKS = []
 
 # Valid features

package/{discovery → runtime/discovery}/manifest/loading.star

@@ -26,7 +26,7 @@ def _check_prisma_folder(resource_path):
     Check if prisma/ directory exists in resource path (silent).
     Used to auto-detect has_migrator when not in features.
     """
-    check_cmd = "test -d '{path}/prisma' && echo 'yes' || echo 'no'".format(path=resource_path)
+    check_cmd = ["sh", "-c", 'test -d "$1/prisma" && echo yes || echo no', "sh", resource_path]
     result = str(local(check_cmd, quiet=True, echo_off=True)).strip()
     return result == 'yes'
 
@@ -91,7 +91,7 @@ def load_manifest(resource_path, persist_to_disk=False):
     manifest_path = None
     
     # Prepend project root to relative paths for correct resolution
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
     if project_root and not resource_path.startswith('/'):
         base_path = project_root + '/' + resource_path
     else:
@@ -252,12 +252,12 @@ def _apply_manifest_defaults(manifest, resource_path):
             dockerfile_path = resource_path + '/' + build_context + '/' + custom_dockerfile
         else:
             dockerfile_path = resource_path + '/' + custom_dockerfile
-        # BUG FIX: Run check from project root since Tilt may run from .tdk/.tdk-out/
-        project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+        # BUG FIX: Run check from project root since Tilt may run from .flisk/.flisk-out/
+        project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
         if project_root:
-            dockerfile_exists = local("cd '{root}' && test -f '{path}' && echo 'yes' || echo 'no'".format(root=project_root, path=dockerfile_path), quiet=True, echo_off=True)
+            dockerfile_exists = local(["sh", "-c", 'cd "$1" && test -f "$2" && echo yes || echo no', "sh", project_root, dockerfile_path], quiet=True, echo_off=True)
         else:
-            dockerfile_exists = local("test -f '{path}' && echo 'yes' || echo 'no'".format(path=dockerfile_path), quiet=True, echo_off=True)
+            dockerfile_exists = local(["sh", "-c", 'test -f "$1" && echo yes || echo no', "sh", dockerfile_path], quiet=True, echo_off=True)
         if str(dockerfile_exists).strip() != 'yes':
             fail("""
 ❌ ═══════════════════════════════════════════════════════════════════
@@ -411,7 +411,7 @@ def get_manifest_filename(resource_path):
     """
     # Check for manifest file (service.json)
     manifest_path = resource_path + '/' + MANIFEST_FILENAME
-    if local("test -f '{path}' && echo 'yes' || echo 'no'".format(path=manifest_path), quiet=True, echo_off=True) == 'yes':
+    if local(["sh", "-c", 'test -f "$1" && echo yes || echo no', "sh", manifest_path], quiet=True, echo_off=True) == 'yes':
         return MANIFEST_FILENAME
     
     # Manifest not found - synthesis will be used

package/{discovery → runtime/discovery}/manifest/normalize.star

@@ -37,7 +37,7 @@ def _load_and_normalize(manifest_path, warn_only=True):
         Normalized manifest dict or None on error (if warn_only=True)
     """
     # Prepend project root to relative paths for correct resolution
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
     if project_root and not manifest_path.startswith('/'):
         full_path = project_root + '/' + manifest_path
     else:
@@ -79,7 +79,7 @@ def _load_and_normalize(manifest_path, warn_only=True):
     
     # BUG FIX: Normalize various path patterns to project-relative paths
     # Pattern 1: Worktrees - .worktrees/task1-dry/services/platform/...
-    # Pattern 2: Flisk output - .tdk/.tdk-out/../.. or .tdk/.tdk-out/../../path
+    # Pattern 2: Flisk output - .flisk/.flisk-out/../.. or .flisk/.flisk-out/../../path
     
     if resource_path.startswith('.worktrees/'):
         # Extract the part after the worktree name
@@ -92,15 +92,15 @@ def _load_and_normalize(manifest_path, warn_only=True):
         parts = after_worktree.split('/')
         if len(parts) >= 3:
             resource_path = '/'.join(parts[2:])
-    elif '.tdk/.tdk-out/../..' in resource_path:
-        # Handle Flisk output paths like: /path/to/.tdk/.tdk-out/../.. or .tdk/.tdk-out/../../services/...
-        tdk_idx = resource_path.find('.tdk/.tdk-out/../..')
-        if tdk_idx != -1:
-            after_tdk = resource_path[tdk_idx + len('.tdk/.tdk-out/../..'):]
-            if after_tdk.startswith('/'):
-                after_tdk = after_tdk[1:]
-            resource_path = after_tdk
-    elif resource_path.endswith('.tdk/.tdk-out/../..'):
+    elif '.flisk/.flisk-out/../..' in resource_path:
+        # Handle Flisk output paths like: /path/to/.flisk/.flisk-out/../.. or .flisk/.flisk-out/../../services/...
+        flisk_idx = resource_path.find('.flisk/.flisk-out/../..')
+        if flisk_idx != -1:
+            after_flisk = resource_path[flisk_idx + len('.flisk/.flisk-out/../..'):]
+            if after_flisk.startswith('/'):
+                after_flisk = after_flisk[1:]
+            resource_path = after_flisk
+    elif resource_path.endswith('.flisk/.flisk-out/../..'):
         # Handle bare Flisk output path that ends with just the resolution pattern
         resource_path = ''
     
@@ -150,10 +150,7 @@ def _discover_manifests_in_path(root_path):
     Returns:
         List of manifest file paths
     """
-    find_cmd = "find {root} -name '{filename}' -type f 2>/dev/null | sort".format(
-        root=root_path,
-        filename=MANIFEST_FILENAME
-    )
+    find_cmd = ["sh", "-c", 'find "$1" -name "$2" -type f 2>/dev/null | sort', "sh", root_path, MANIFEST_FILENAME]
     result = str(local(find_cmd, quiet=True, echo_off=True))
     
     manifests = []

package/{discovery → runtime/discovery}/registry.star

@@ -8,7 +8,7 @@
 # This module discovers services from service.json manifest files.
 # It runs discovery at module load time to avoid frozen hash issues.
 #
-# IMPORTANT: Discovery runs when the module loads (if TDK_PROJECT_ROOT is set).
+# IMPORTANT: Discovery runs when the module loads (if FLISK_PROJECT_ROOT is set).
 # This ensures APP_RESOURCES and related variables are populated before export.
 # =============================================================================
 
@@ -75,10 +75,10 @@ def _run_discovery():
     print("")
     return working_cache
 
-# Run discovery immediately if TDK_PROJECT_ROOT is set
+# Run discovery immediately if FLISK_PROJECT_ROOT is set
 # This ensures data is available before module is frozen
 _DISCOVERY_RESULTS = {}
-if os.environ.get('TDK_PROJECT_ROOT', ''):
+if os.environ.get('FLISK_PROJECT_ROOT', ''):
     _DISCOVERY_RESULTS = _run_discovery()
 else:
     # Empty results if no project root set
@@ -309,17 +309,17 @@ def _write_file_if_changed(path, content):
     if '..' in normalized.split('/') or not (
         '/.autogenerated/' in normalized or
         normalized.startswith('.autogenerated/') or
-        normalized.startswith('.tdk/.tdk-out/') or
+        normalized.startswith('.flisk/.flisk-out/') or
         normalized in ['Tiltfile', '.tiltignore'] or
         (normalized.startswith('TILT_') and normalized.endswith('.star') and '/' not in normalized)
     ):
         fail("Flisk discovery refused to write outside its generated-file allowlist: " + path)
 
     # Read existing file (returns empty string on error via shell)
-    existing = str(local("cat " + path + " 2>/dev/null || echo ''", quiet=True, echo_off=True))
+    existing = str(local(["sh", "-c", 'cat "$1" 2>/dev/null || echo ""', "sh", path], quiet=True, echo_off=True))
     
     if existing != content:
-        local("mkdir -p $(dirname " + path + ") && echo '" + content + "' > " + path, quiet=True, echo_off=True)
+        local(["sh", "-c", 'mkdir -p "$(dirname "$1")" && echo "$2" > "$1"', "sh", path, content], quiet=True, echo_off=True)
         return True
     return False
 
@@ -329,7 +329,7 @@ def _render_star_file(description, var_name, data):
 
 def generate_product_stack_topology():
     """Generate product stack topology folders."""
-    local("mkdir -p " + PRODUCT_TOPOLOGY_DIR, quiet=True)
+    local(["mkdir", "-p", PRODUCT_TOPOLOGY_DIR], quiet=True)
     
     changes = 0
     for resource in APP_RESOURCES:
@@ -349,7 +349,7 @@ def generate_product_stack_topology():
 
 def generate_product_snapshot_topology():
     """Generate product snapshot topology files."""
-    local("mkdir -p " + PRODUCT_SNAPSHOT_DIR, quiet=True)
+    local(["mkdir", "-p", PRODUCT_SNAPSHOT_DIR], quiet=True)
     
     services_path = PRODUCT_SNAPSHOT_DIR + "/services.star"
     deps_path = PRODUCT_SNAPSHOT_DIR + "/dependencies.star"
@@ -426,7 +426,7 @@ def _find_manifest_files(root, manifest_filename):
     files = []
     
     # Check if root contains glob patterns
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '.')
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '.')
     if '*' in root or '?' in root:
         # Use bash to expand glob and find files
         cmd = "cd " + project_root + " && bash -c 'for dir in " + root + "; do if [ -d \"$dir\" ]; then find \"$dir\" -maxdepth 3 -type f -name \"" + manifest_filename + "\" 2>/dev/null; fi; done'"
@@ -510,7 +510,7 @@ def load_yaml_manifests_as_resources():
         
         local_resource(
             name=resource_name,
-            cmd="echo 'YAML manifest: " + yaml_path_display + "'",
+            cmd=['echo', 'YAML manifest: ' + yaml_path_display],
             deps=[yaml_file],
             labels=["yaml-manifest"],
         )
@@ -521,7 +521,7 @@ def load_yaml_manifests_as_resources():
 load_yaml_manifests_as_resources()
 
 # Load project defaults from spec.master if available
-project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
 if project_root:
     project_defaults = Config.load_project_defaults(project_root)
     if project_defaults:

package/{discovery → runtime/discovery}/resource_snapshot.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-# Copyright (c) 2026 TDK Landscape contributors
+# Copyright (c) 2026 Flisk Landscape contributors
 # SPDX-License-Identifier: MIT
 """
 Service Snapshot Utility
@@ -22,7 +22,7 @@ from datetime import datetime, timezone
 logging.basicConfig(level=logging.WARNING, format='%(levelname)s: %(message)s')
 logger = logging.getLogger(__name__)
 
-SNAPSHOT_FILE = Path(".tdk/.tdk-out/snapshots/resource-snapshot.json")
+SNAPSHOT_FILE = Path(".flisk/.flisk-out/snapshots/resource-snapshot.json")
 
 
 def compute_resource_hash(resource_path: str) -> Optional[str]:

package/{discovery → runtime/discovery}/resource_snapshot.star

@@ -7,12 +7,12 @@
 # =============================================================================
 
 # Python script path (relative to Tiltfile)
-_SNAPSHOT_SCRIPT = ".tdk/.tdk-out/snapshots/resource_snapshot.py"
+_SNAPSHOT_SCRIPT = ".flisk/.flisk-out/snapshots/resource_snapshot.py"
 
 def _run_snapshot_command(cmd):
     """Run a snapshot command via Python script."""
     result = local(
-        "python3 " + _SNAPSHOT_SCRIPT + " " + cmd,
+        ["python3", _SNAPSHOT_SCRIPT, cmd],
         quiet=True,
         echo_off=True
     )
@@ -27,7 +27,7 @@ def save_snapshot(resources):
     """
     # Use Python to save snapshot directly
     result = local(
-        "cd " + config.main_dir + " && python3 " + _SNAPSHOT_SCRIPT + " save",
+        ["sh", "-c", 'cd "$1" && python3 "$2" save', "sh", config.main_dir, _SNAPSHOT_SCRIPT],
         quiet=True,
         echo_off=True
     )
@@ -109,7 +109,7 @@ def get_current_resources(scan_roots=["services/product"]):
     
     for root in scan_roots:
         # Use find command to locate service.json files
-        cmd = "find " + root + " -type f -name 'service.json' 2>/dev/null | sort"
+        cmd = ["sh", "-c", 'find "$1" -type f -name service.json 2>/dev/null | sort', "sh", root]
         result = local(cmd, quiet=True, echo_off=True)
         
         if result:
@@ -124,7 +124,7 @@ def get_current_resources(scan_roots=["services/product"]):
 def snapshot_exists():
     """Check if snapshot file exists."""
     result = local(
-        "test -f .tdk/.tdk-out/snapshots/resource-snapshot.json && echo 'yes' || echo 'no'",
+        "test -f .flisk/.flisk-out/snapshots/resource-snapshot.json && echo 'yes' || echo 'no'",
         quiet=True,
         echo_off=True
     )
@@ -133,7 +133,7 @@ def snapshot_exists():
 # Get the path to the resource snapshot file
 def get_resource_snapshot_path():
     """Return the path to the resource snapshot JSON file."""
-    return ".tdk/.tdk-out/snapshots/resource-snapshot.json"
+    return ".flisk/.flisk-out/snapshots/resource-snapshot.json"
 
 # Export public API
 ResourceSnapshot = struct(

package/{discovery → runtime/discovery}/services/platform/orchestrator/orchestrator-glue-backend/service.yaml

@@ -2,7 +2,7 @@ appName: orchestrator-glue-backend
 appType: backend
 stack: platform
 port: 5001
-databaseName: tdk_project_orchestrator
+databaseName: flisk_project_orchestrator
 features:
   - nats
   - prisma
@@ -22,5 +22,5 @@ resources:
     memory: 256Mi
 runtime: bun
 traefik:
-  host: orchestrator.backend.tdk-project.local
+  host: orchestrator.backend.flisk-project.local
   pathPrefix: /api/orchestrator