@flisk-sh/flisk 1.3.207 → 1.4.0

package/{engine → runtime/engine}/topologies/platform/docker/compose/traefik_standalone.star

@@ -80,12 +80,13 @@ volumes:
             name=name,
             gateway_container=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_CONTAINER,
             gateway_port=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_PORT,
-            vendored_gateway_dir="tdk-cli-ext/engine/assets/docker/wake-gateway",
+            vendored_gateway_dir="flisk-cli-ext/engine/assets/docker/wake-gateway",
             tilt_dev_dir=os.environ.get("HOME", "") + "/.tilt-dev",
             project_root_mount=_project_root_mount(),
+            docker_socket_gid=_docker_socket_gid(),
         ) if sablier_enabled else "",
         dynamic_dir_name=PlatformDockerConstants.TRAEFIK_DYNAMIC_DIR_REL.split("/")[-1],
-        vendored_gateway_dir="tdk-cli-ext/engine/assets/docker/wake-gateway",
+        vendored_gateway_dir="flisk-cli-ext/engine/assets/docker/wake-gateway",
         gateway_container=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_CONTAINER,
         gateway_port=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_PORT,
         tilt_dev_dir=os.environ.get("HOME", "") + "/.tilt-dev",
@@ -95,6 +96,16 @@ volumes:
     )
 
 
+def _docker_socket_gid():
+    """Group ID the wake gateway joins to reach /var/run/docker.sock.
+
+    Docker Desktop exposes the socket as root:root (gid 0). On Linux hosts it
+    is usually root:docker, whose gid varies, so set FLISK_DOCKER_SOCKET_GID to
+    the socket's gid there (`stat -c %g /var/run/docker.sock`).
+    """
+    return os.environ.get("FLISK_DOCKER_SOCKET_GID", "0")
+
+
 def _project_root_mount():
     """Read-only mount of the project at its own absolute host path.
 
@@ -102,7 +113,7 @@ def _project_root_mount():
     itself (bypassing Tilt's build queue), using the compose files Tilt uses.
     Compose resolves relative paths in them (env_file etc.) client-side, so
     they must exist at the same absolute paths inside the gateway container.
-    Empty when TDK_PROJECT_ROOT is unset (the generated Tiltfile sets it).
+    Empty when FLISK_PROJECT_ROOT is unset (the generated Tiltfile sets it).
     """
     root = project_root_abspath()
     if not root:
@@ -111,8 +122,8 @@ def _project_root_mount():
 
 
 def project_root_abspath():
-    """Absolute, normalized project root (TDK_PROJECT_ROOT), or "" when unset."""
-    return normalize_abs_path(os.environ.get("TDK_PROJECT_ROOT", ""))
+    """Absolute, normalized project root (FLISK_PROJECT_ROOT), or "" when unset."""
+    return normalize_abs_path(os.environ.get("FLISK_PROJECT_ROOT", ""))
 
 
 _SABLIER_DEPENDS_ON = """    depends_on:
@@ -162,9 +173,13 @@ _SABLIER_SERVICES = """  sablier:
       - TILT_PORT=10350
       - SABLIER_URL=http://sablier:10000
       - PORT={gateway_port}
+    # Non-root (see the Dockerfile): the Docker socket is root-owned, so the
+    # gateway joins the socket's group instead of running as root.
+    group_add:
+      - "{docker_socket_gid}"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - {tilt_dev_dir}:/root/.tilt-dev:ro{project_root_mount}
+      - {tilt_dev_dir}:/home/bun/.tilt-dev:ro{project_root_mount}
     networks:
       - traefik-public
 

package/{engine → runtime/engine}/topologies/platform/docker/config/healthcheck.star

@@ -10,7 +10,7 @@
 # Compose 2.20.2+ (checked by `flisk doctor`).
 #
 # Override per run with environment variables, e.g.:
-#   TDK_HEALTHCHECK_INTERVAL_SECONDS=15 flisk up
+#   FLISK_HEALTHCHECK_INTERVAL_SECONDS=15 flisk up
 # =============================================================================
 
 
@@ -23,12 +23,12 @@ def _env_int(name, default):
 
 DOCKER_HEALTHCHECK = {
     "path": "/health",
-    "interval_seconds": _env_int("TDK_HEALTHCHECK_INTERVAL_SECONDS", 30),
-    "start_interval_seconds": _env_int("TDK_HEALTHCHECK_START_INTERVAL_SECONDS", 2),
-    "timeout_seconds": _env_int("TDK_HEALTHCHECK_TIMEOUT_SECONDS", 5),
-    "start_period_seconds": _env_int("TDK_HEALTHCHECK_START_PERIOD_SECONDS", 30),
-    "frontend_start_period_seconds": _env_int("TDK_HEALTHCHECK_START_PERIOD_SECONDS", 30),
-    "retries": _env_int("TDK_HEALTHCHECK_RETRIES", 3),
+    "interval_seconds": _env_int("FLISK_HEALTHCHECK_INTERVAL_SECONDS", 30),
+    "start_interval_seconds": _env_int("FLISK_HEALTHCHECK_START_INTERVAL_SECONDS", 2),
+    "timeout_seconds": _env_int("FLISK_HEALTHCHECK_TIMEOUT_SECONDS", 5),
+    "start_period_seconds": _env_int("FLISK_HEALTHCHECK_START_PERIOD_SECONDS", 30),
+    "frontend_start_period_seconds": _env_int("FLISK_HEALTHCHECK_START_PERIOD_SECONDS", 30),
+    "retries": _env_int("FLISK_HEALTHCHECK_RETRIES", 3),
 }
 
 

package/{engine → runtime/engine}/topologies/platform/docker/constants.star

@@ -9,21 +9,21 @@
 # =============================================================================
 
 # Load project name from project.json (makes Flisk CLI portable across projects)
-# Falls back to 'tdk_project' / 'tdk-project' if project.json not found
-# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+# Falls back to 'flisk_project' / 'flisk-project' if project.json not found
+# Use FLISK_PROJECT_ROOT env var set by Tilt, fallback to current directory
 def _load_project_names():
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
-    project_json_path = '.tdk/project.json'
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
+    project_json_path = '.flisk/project.json'
     if project_root:
         project_json_path = project_root + '/' + project_json_path
     
     if os.path.exists(project_json_path):
         _project_json = read_json(project_json_path)
-        _PROJECT_NAME_HYPHEN = _project_json.get('project', {}).get('name', 'tdk-project')
+        _PROJECT_NAME_HYPHEN = _project_json.get('project', {}).get('name', 'flisk-project')
         # Convert hyphenated name to underscore (e.g., "my-project" -> "my_project")
         _PROJECT_NAME = _PROJECT_NAME_HYPHEN.replace('-', '_')
         return _PROJECT_NAME, _PROJECT_NAME_HYPHEN
-    return "tdk_project", "tdk-project"
+    return "flisk_project", "flisk-project"
 
 _PROJECT_NAME, _PROJECT_NAME_HYPHEN = _load_project_names()
 
@@ -67,7 +67,7 @@ NETWORK_PROXY = PROJECT_NAME + "_proxy"
 # Traefik file-provider dynamic config: one generated YAML per `sablier.deferStart`
 # resource's static route (see openspec/changes/prioritized-cold-start), mounted
 # read-only into the standalone Traefik container at /etc/traefik/dynamic.
-TRAEFIK_DYNAMIC_DIR_REL = ".tdk/.tdk-out/traefik-dynamic"
+TRAEFIK_DYNAMIC_DIR_REL = ".flisk/.flisk-out/traefik-dynamic"
 TRAEFIK_WAKE_GATEWAY_CONTAINER = PROJECT_NAME_HYPHEN + "-wake-gateway"
 TRAEFIK_WAKE_GATEWAY_PORT = 9999
 

package/{engine → runtime/engine}/topologies/platform/docker/dockerfile/language_dockerfile.star

@@ -223,11 +223,11 @@ ENV GOFLAGS=-buildvcs=false CGO_ENABLED=0
 # Prime the build cache inside the image (a cache mount would not be kept), so the first edit recompiles only what changed.
 # Same flags as the watcher's builds (and CGO off like the production stage), so the primed binary and cache match every later one.
 RUN go build -ldflags='-s -w' -o /tmp/app .
-COPY --chmod=755 <<'TDK_GO_DEV_WATCH' /usr/local/bin/tdk-go-watch
+COPY --chmod=755 <<'FLISK_GO_DEV_WATCH' /usr/local/bin/flisk-go-watch
 {watch_script}
-TDK_GO_DEV_WATCH
+FLISK_GO_DEV_WATCH
 EXPOSE {port}
-CMD ["tdk-go-watch"]
+CMD ["flisk-go-watch"]
 """
 
 def generate_language_dockerfile(res_path, language, port = BASE_PORT_BACKEND, dev = False):

package/{engine → runtime/engine}/topologies/platform/docker/layers/l1_base_layers.star

@@ -13,17 +13,17 @@ ALPINE_BASE = "alpine:3.22"
 load('../../../../../discovery/config.star', 'GLOBAL_CONFIG')
 
 # Load project name for dynamic golden image naming
-# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+# Use FLISK_PROJECT_ROOT env var set by Tilt, fallback to current directory
 def _load_golden_prefix():
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
-    project_json_path = '.tdk/project.json'
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
+    project_json_path = '.flisk/project.json'
     if project_root:
         project_json_path = project_root + '/' + project_json_path
     
     if os.path.exists(project_json_path):
         _project_json = read_json(project_json_path)
-        return _project_json.get('project', {}).get('name', 'tdk-project')
-    return 'tdk-project'
+        return _project_json.get('project', {}).get('name', 'flisk-project')
+    return 'flisk-project'
 
 _GOLDEN_PREFIX = _load_golden_prefix()
 

package/{engine → runtime/engine}/topologies/platform/docker/layers/l2_dependency_layers.star

@@ -20,17 +20,17 @@ load('../../../tilt/manifest/constants.star', 'AUTOGENERATED_CONFIG_PATHS', 'GEN
 
 
 # Load project name for dynamic golden image naming
-# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+# Use FLISK_PROJECT_ROOT env var set by Tilt, fallback to current directory
 def _load_golden_prefix():
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
-    project_json_path = '.tdk/project.json'
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
+    project_json_path = '.flisk/project.json'
     if project_root:
         project_json_path = project_root + '/' + project_json_path
     
     if os.path.exists(project_json_path):
         _project_json = read_json(project_json_path)
-        return _project_json.get('project', {}).get('name', 'tdk-project')
-    return 'tdk-project'
+        return _project_json.get('project', {}).get('name', 'flisk-project')
+    return 'flisk-project'
 
 _GOLDEN_PREFIX = _load_golden_prefix()
 
@@ -55,14 +55,14 @@ def normalize_res_path(res_path):
         return res_path
     if not res_path.startswith('/'):
         return res_path
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '.')
-    cmd = (
-        "python3 -c \"import os; print(os.path.relpath(os.path.realpath('''" +
-        res_path +
-        "'''), os.path.realpath('''" +
-        project_root +
-        "''')))\""
-    )
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '.')
+    cmd = [
+        "python3",
+        "-c",
+        "import os, sys; print(os.path.relpath(os.path.realpath(sys.argv[1]), os.path.realpath(sys.argv[2])))",
+        res_path,
+        project_root,
+    ]
     relative = str(local(cmd, quiet=True, echo_off=True)).strip()
     if relative:
         return relative
@@ -137,7 +137,7 @@ RUN echo '🔍 DEPENDENCY INSTALLATION DIAGNOSTICS (debug)' && \\
         + "/usr/local/bin/install-deps.sh && end_ts=$(date +%s) && echo \"install-deps duration: $((end_ts-start_ts))s\"\n"
         # Guarantee /app/node_modules/.bun exists so L3's COPY --link never
         # fails with "not found". Bun's isolated linker only creates this dir
-        # when hoisted packages are present; without TDK_LICENSE_KEY the public-
+        # when hoisted packages are present; without FLISK_LICENSE_KEY the public-
         # npm install may skip it entirely.
         + "RUN mkdir -p /app/node_modules/.bun\n"
     )

package/{engine → runtime/engine}/topologies/platform/docker/layers/l3_builder_layers.star

@@ -36,17 +36,17 @@ load('./prisma/prisma_build.star',
 load('./infisical/infisical_docker.star', 'InfisicalDocker')
 
 # Load project name for dynamic golden image naming
-# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+# Use FLISK_PROJECT_ROOT env var set by Tilt, fallback to current directory
 def _load_golden_prefix():
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
-    project_json_path = '.tdk/project.json'
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
+    project_json_path = '.flisk/project.json'
     if project_root:
         project_json_path = project_root + '/' + project_json_path
     
     if os.path.exists(project_json_path):
         _project_json = read_json(project_json_path)
-        return _project_json.get('project', {}).get('name', 'tdk-project')
-    return 'tdk-project'
+        return _project_json.get('project', {}).get('name', 'flisk-project')
+    return 'flisk-project'
 
 _GOLDEN_PREFIX = _load_golden_prefix()
 

package/{engine → runtime/engine}/topologies/platform/docker/layers/l4_runtime_layers.star

@@ -38,17 +38,17 @@ load('./infisical/infisical_docker.star', 'InfisicalDocker')
 
 
 # Load project name for dynamic golden image naming
-# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+# Use FLISK_PROJECT_ROOT env var set by Tilt, fallback to current directory
 def _load_golden_prefix():
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
-    project_json_path = '.tdk/project.json'
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
+    project_json_path = '.flisk/project.json'
     if project_root:
         project_json_path = project_root + '/' + project_json_path
     
     if os.path.exists(project_json_path):
         _project_json = read_json(project_json_path)
-        return _project_json.get('project', {}).get('name', 'tdk-project')
-    return 'tdk-project'
+        return _project_json.get('project', {}).get('name', 'flisk-project')
+    return 'flisk-project'
 
 _GOLDEN_PREFIX = _load_golden_prefix()
 
@@ -95,7 +95,7 @@ def resolve_bun_start_command(res_path, cmd = DEFAULT_BUN_START_COMMAND):
         return cmd
     package_json_path = res_path + '/package.json'
     if not res_path.startswith('/'):
-        package_json_path = os.environ.get('TDK_PROJECT_ROOT', '.') + '/' + package_json_path
+        package_json_path = os.environ.get('FLISK_PROJECT_ROOT', '.') + '/' + package_json_path
     if not os.path.exists(package_json_path):
         return cmd
     package_json = read_json(package_json_path, default = {}) or {}
@@ -173,12 +173,12 @@ def L4_generate_backend_runtime(res_path, port = BASE_PORT_BACKEND, cmd = 'bun r
         parts.append("RUN apk add --no-cache hugo\n")
         parts.append("USER bun\n")
 
-    # A files-durability agent keeps its checkpoints in /var/lib/tdk-agent, a named volume. Docker seeds a new volume with the
+    # A files-durability agent keeps its checkpoints in /var/lib/flisk-agent, a named volume. Docker seeds a new volume with the
     # image directory's owner, so create the directory owned by bun, or the agent cannot write its first checkpoint (EACCES).
     agent_cfg = manifest.get('agent') if manifest else None
     if type(agent_cfg) == 'dict' and agent_cfg.get('durability', 'files') == 'files':
         parts.append("USER root\n")
-        parts.append("RUN mkdir -p /var/lib/tdk-agent && chown bun:bun /var/lib/tdk-agent\n")
+        parts.append("RUN mkdir -p /var/lib/flisk-agent && chown bun:bun /var/lib/flisk-agent\n")
         parts.append("USER bun\n")
 
     if has_prisma_config:

package/{engine → runtime/engine}/topologies/platform/docker/layers/prisma/constants.star

@@ -69,17 +69,17 @@ PRISMA_MIGRATE_DEPLOY_SUBCOMMAND = "migrate deploy"
 PRISMA_GENERATE_SUBCOMMAND = "generate"
 
 # Load project name for dynamic golden image naming
-# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+# Use FLISK_PROJECT_ROOT env var set by Tilt, fallback to current directory
 def _load_golden_prefix():
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
-    project_json_path = '.tdk/project.json'
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
+    project_json_path = '.flisk/project.json'
     if project_root:
         project_json_path = project_root + '/' + project_json_path
     
     if os.path.exists(project_json_path):
         _project_json = read_json(project_json_path)
-        return _project_json.get('project', {}).get('name', 'tdk-project')
-    return 'tdk-project'
+        return _project_json.get('project', {}).get('name', 'flisk-project')
+    return 'flisk-project'
 
 _GOLDEN_PREFIX = _load_golden_prefix()
 

package/{engine → runtime/engine}/topologies/platform/docker/networking/api_path_constants.star

@@ -164,17 +164,17 @@ def get_api_path_for_resource(resource_name):
 get_api_path_for_service = get_api_path_for_resource
 
 # Load project name for dynamic localhost domain
-# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+# Use FLISK_PROJECT_ROOT env var set by Tilt, fallback to current directory
 def _load_project_localhost():
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
-    project_json_path = '.tdk/project.json'
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
+    project_json_path = '.flisk/project.json'
     if project_root:
         project_json_path = project_root + '/' + project_json_path
     
     if os.path.exists(project_json_path):
         _project_json = read_json(project_json_path)
-        return _project_json.get('project', {}).get('name', 'tdk-project') + ".localhost"
-    return "tdk-project.localhost"
+        return _project_json.get('project', {}).get('name', 'flisk-project') + ".localhost"
+    return "flisk-project.localhost"
 
 _PROJECT_LOCALHOST = _load_project_localhost()
 

package/{engine → runtime/engine}/topologies/platform/docker/networking/sablier_container_cycle.star

@@ -8,7 +8,7 @@
 # The real generator (Sablier + Traefik label wiring that stops idle
 # containers and wakes them on the next request) is part of a paid Flisk
 # license. When a valid license grants the "sablier" resource,
-# cli/src/generator/template-engine.ts (vendorTdkExtension) overwrites this
+# cli/src/generator/template-engine.ts (vendorFliskExtension) overwrites this
 # file with the licensed version fetched via extension-fetch.ts before Tilt
 # loads it. Same function signatures either way, so nothing else in the
 # generator pipeline changes -- every call site just gets "disabled" back

package/{engine → runtime/engine}/topologies/platform/docker/networking/traefik_static_routes.star

@@ -36,7 +36,7 @@ def normalize_abs_path(path):
     """Absolute path with `.`/`..` segments collapsed, or "" for "".
 
     Tilt's os.path.abspath does not collapse `..` (confirmed:
-    abspath("/a/.tdk/.tdk-out/../..") comes back unchanged), and the
+    abspath("/a/.flisk/.flisk-out/../..") comes back unchanged), and the
     generated Tiltfile's project root is exactly that shape
     (config.main_dir + "/../.."). The gateway's project mount and the compose
     paths in its route headers must match byte-for-byte, so both go through here.

package/{engine → runtime/engine}/topologies/platform/docker/secrets/env_secrets.star

@@ -9,7 +9,7 @@
 # Docker Compose's own `${NAME}` interpolation, so nothing secret is ever written to a generated, committed file. A required secret
 # uses `${NAME:?message}`, so Compose refuses to start the service when the name is missing; an optional one defaults to empty.
 #
-# `TDK_SECRET_PROVIDER=infisical` leaves the names to Infisical instead, and nothing is injected here.
+# `FLISK_SECRET_PROVIDER=infisical` leaves the names to Infisical instead, and nothing is injected here.
 # =============================================================================
 
 DEFAULT_SECRET_PROVIDER = 'env-file'
@@ -20,7 +20,7 @@ _NAME_REST = _NAME_FIRST + '0123456789'
 
 def get_secret_provider():
     """The selected provider: `env-file` (default) or `infisical`."""
-    provider = str(os.environ.get('TDK_SECRET_PROVIDER', '')).strip().lower()
+    provider = str(os.environ.get('FLISK_SECRET_PROVIDER', '')).strip().lower()
     return provider if provider else DEFAULT_SECRET_PROVIDER
 
 

package/{engine → runtime/engine}/topologies/platform/docker/secrets/infisical.star

@@ -39,13 +39,13 @@ def get_infisical_environment_vars(as_array=True, resource_name=None, resource_t
         String with environment variables in YAML format
     """
     env = {
-        "TDK_SECRET_PROVIDER": "${TDK_SECRET_PROVIDER:-env-file}",
-        "TDK_ENV": "${TILT_ENV:-development}",
+        "FLISK_SECRET_PROVIDER": "${FLISK_SECRET_PROVIDER:-env-file}",
+        "FLISK_ENV": "${TILT_ENV:-development}",
     }
 
     if resource_name:
-        env["TDK_RESOURCE_NAME"] = resource_name
-        env["TDK_RESOURCE_TYPE"] = resource_type
+        env["FLISK_RESOURCE_NAME"] = resource_name
+        env["FLISK_RESOURCE_TYPE"] = resource_type
     
     if as_array:
         lines = []

package/{engine → runtime/engine}/topologies/platform/registries/verdaccio_loader.star

@@ -8,7 +8,7 @@
 # The real loader (stands up the Verdaccio private npm registry container and
 # wires it into the project's Docker network) is part of a paid Flisk license.
 # When a valid license grants the "verdaccio" resource,
-# cli/src/generator/template-engine.ts (vendorTdkExtension) overwrites this
+# cli/src/generator/template-engine.ts (vendorFliskExtension) overwrites this
 # file with the licensed version fetched via extension-fetch.ts before Tilt
 # loads it. Same function signature either way, so nothing else in the
 # loader pipeline changes.

package/{engine → runtime/engine}/topologies/platform/security/secrets.star

@@ -150,7 +150,7 @@ def _generate_org_config(org_name=None, environments=None, resource_names=None):
 # Predefined Services Configuration
 # =============================================================================
 
-# Project-specific service configurations should be defined in .tdk/project.json
+# Project-specific service configurations should be defined in .flisk/project.json
 # This dict is kept for backward compatibility but should be empty for generic Flisk CLI
 PREDEFINED_RESOURCES = {}
 

package/{engine → runtime/engine}/topologies/tilt/common/utils.star

@@ -62,7 +62,7 @@ MIGRATED_PACKAGES = {
 load("../manifest/constants.star", "MANIFEST_FILENAME")
 
 # List of all shared platform networks
-# All networks use PROJECT_NAME format (e.g., tdk_project_*)
+# All networks use PROJECT_NAME format (e.g., flisk_project_*)
 PLATFORM_NETWORKS = [
   PlatformDockerConstants.NETWORK_TRAEFIK_PUBLIC,
   PlatformDockerConstants.PROJECT_NAME + "_traefik-private",
@@ -79,7 +79,7 @@ PLATFORM_NETWORKS = [
 
 def get_internal_deps(resource_path):
     """
-    Extract all @tdk/* dependencies from a service's package.json.
+    Extract all @flisk/* dependencies from a service's package.json.
     """
     pkg_json_path = resource_path + '/package.json'
     pkg_content = read_file(pkg_json_path, default='')
@@ -105,7 +105,7 @@ def get_internal_deps(resource_path):
 
 def resolve_lib_path(package_name):
     """
-    Resolve @tdk/* package name to workspace path using naming conventions.
+    Resolve @flisk/* package name to workspace path using naming conventions.
     
     Checks MIGRATED_PACKAGES first for packages that have been moved from their
     conventional locations, then falls back to standard naming conventions.
@@ -274,7 +274,7 @@ def _is_allowed_generated_path(file_path, project_root):
         return False
     if '.autogenerated' in parts:
         return True
-    if path.startswith('.tdk/.tdk-out/'):
+    if path.startswith('.flisk/.flisk-out/'):
         return True
     if path == 'services/platform/database-management/docker-compose.yml':
         return True
@@ -291,8 +291,7 @@ def _write_generated_file(file_path, content):
     dir_path = file_path.rsplit('/', 1)[0]
     if not dir_path:
         dir_path = '/'
-    safe_content = (expected + '\n').replace("'", "'\\''")
-    cmd = "mkdir -p '" + dir_path + "' && printf '%s' '" + safe_content + "' > '" + file_path + "'"
+    cmd = ["sh", "-c", 'mkdir -p "$1" && printf "%s" "$2" > "$3"', "sh", dir_path, expected + '\n', file_path]
     local(cmd, quiet=True, echo_off=True)
 
 def write_file_if_changed(file_path, content):
@@ -301,13 +300,13 @@ def write_file_if_changed(file_path, content):
     Uses Tilt's native read_file() - fast and silent.
     
     If file_path is relative (doesn't start with /), it will be written relative
-    to the project root (TDK_PROJECT_ROOT env var) instead of Tilt working dir.
+    to the project root (FLISK_PROJECT_ROOT env var) instead of Tilt working dir.
     """
     if content == None:
         content = ""
 
     # For relative paths, prepend project root to ensure files go to correct location
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '.')
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '.')
     if not file_path.startswith('/'):
         # Remove leading ./ if present in file_path
         clean_file_path = file_path[2:] if file_path.startswith('./') else file_path
@@ -333,10 +332,10 @@ def write_file_if_changed(file_path, content):
     normalized = file_path.replace('\\', '/')
     generated_marker = '/.autogenerated/'
     marker_index = normalized.rfind(generated_marker)
-    if marker_index >= 0 and '/.tdk-contract/' not in normalized:
+    if marker_index >= 0 and '/.flisk-contract/' not in normalized:
         service_root = normalized[:marker_index]
         generated_rel = normalized[marker_index + len(generated_marker):]
-        contract_root = service_root + '/.autogenerated/.tdk-contract'
+        contract_root = service_root + '/.autogenerated/.flisk-contract'
         _write_generated_file(contract_root + '/' + generated_rel, expected)
         manifest_content = read_file(service_root + '/service.json', default='')
         if manifest_content:

package/{engine → runtime/engine}/topologies/tilt/common/utils_debug.star

@@ -4,7 +4,7 @@
 # 🛠️ TILT SDK - DEBUG UTILITIES
 # =============================================================================
 
-DEBUG_MODE = (os.environ.get('TDK_DEBUG') or os.environ.get('TILT_DEBUG', 'false')).lower() in ['true', '1', 'yes']
+DEBUG_MODE = (os.environ.get('FLISK_DEBUG') or os.environ.get('TILT_DEBUG', 'false')).lower() in ['true', '1', 'yes']
 
 
 def debug_log(message, data=None):

package/{engine → runtime/engine}/topologies/tilt/common/utils_deterministic.star

@@ -8,7 +8,7 @@
 # =============================================================================
 #
 # Usage:
-#   load('ext://tdk-cli', 'deterministic_find', 'deterministic_local')
+#   load('ext://flisk-cli', 'deterministic_find', 'deterministic_local')
 #
 #   files = deterministic_find('./services', 'service.json')
 #   result = deterministic_local('bun install')
@@ -46,7 +46,7 @@ def deterministic_find(path, pattern):
     Returns:
         Sorted list of files (alphabetical, cross-platform consistent)
     """
-    cmd = "find {} -type f -name '{}' 2>/dev/null | sort".format(path, pattern)
+    cmd = ["sh", "-c", 'find "$1" -type f -name "$2" 2>/dev/null | sort', "sh", path, pattern]
     result = str(local(cmd, quiet=True, echo_off=True)).strip()
     if result:
         return result.split('\n')

package/{engine → runtime/engine}/topologies/tilt/common/utils_env.star

@@ -10,7 +10,7 @@ _DOTENV_NAME_REST = _DOTENV_NAME_FIRST + '0123456789'
 
 # The environment variable `flisk up --env-file <path>` sets. The CLI resolves the path and
 # exports it, so the engine reads one file for the whole run.
-PROJECT_ENV_FILE_VAR = 'TDK_ENV_FILE'
+PROJECT_ENV_FILE_VAR = 'FLISK_ENV_FILE'
 
 
 def _is_dotenv_name(name):
@@ -63,7 +63,7 @@ def _dotenv_value(raw):
 def project_env_file(project_root=''):
     """The project env file of this run.
 
-    `flisk up --env-file <path>` exports TDK_ENV_FILE, and the run then reads that file instead of the
+    `flisk up --env-file <path>` exports FLISK_ENV_FILE, and the run then reads that file instead of the
     project `.env` - for the Tilt environment and for the Compose interpolation alike. Without the
     variable the project `.env` is used, which is what every run did before the option existed.
 
@@ -79,15 +79,15 @@ def project_env_file(project_root=''):
 def load_dotenv(project_root=''):
     """Load the project env file of this run into os.environ.
 
-    The Tiltfile lives in `.tdk/.tdk-out/`, so a bare `.env` lookup misses the
-    project-root file. Prefer an explicit project_root, then TDK_PROJECT_ROOT.
+    The Tiltfile lives in `.flisk/.flisk-out/`, so a bare `.env` lookup misses the
+    project-root file. Prefer an explicit project_root, then FLISK_PROJECT_ROOT.
 
     The file is read with `read_file` and parsed here: nothing goes through a shell, so a path containing a quote is fine, and Tilt
     re-evaluates the Tiltfile when the .env changes. Lines may be `NAME=value` or `export NAME=value`; comments, blank lines and
     lines that are not an assignment to a valid name are ignored. A missing file does nothing.
     """
     if not project_root:
-        project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+        project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
     env_path = project_env_file(project_root)
     content = str(read_file(env_path, default=''))
     if not content:

package/{engine → runtime/engine}/topologies/tilt/config/profiles.star

@@ -137,18 +137,18 @@ def get_all_needed_services(targets, skip_frontend = False):
 
 def _load_focus_lists():
     """Load focus lists from project spec.master directly."""
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
     if not project_root:
         return ([], [], [])
     
     # Load from spec.master
     spec_paths = [
-        project_root + "/.tdk/.tdk-out/spec.master",
+        project_root + "/.flisk/.flisk-out/spec.master",
         project_root + "/spec.master",
     ]
     
     for spec_path in spec_paths:
-        check_cmd = "test -f '{}' && echo 'yes' || echo 'no'".format(spec_path)
+        check_cmd = ["sh", "-c", "test -f \"$1\" && echo 'yes' || echo 'no'", "sh", spec_path]
         exists = str(local(check_cmd, quiet=True, echo_off=True)).strip() == 'yes'
         if exists:
             # Parse PRE_ALPHA_RESOURCES from spec.master
@@ -156,7 +156,7 @@ def _load_focus_lists():
             alpha = []
             beta = []
             
-            content = str(local("cat '" + spec_path + "' 2>/dev/null || true", quiet=True, echo_off=True))
+            content = str(local(["sh", "-c", "cat \"$1\" 2>/dev/null || true", "sh", spec_path], quiet=True, echo_off=True))
             
             # Simple parsing for PRE_ALPHA_RESOURCES = {"key": True, ...}
             if "PRE_ALPHA_RESOURCES" in content:

package/{engine → runtime/engine}/topologies/tilt/generators/agents_md.star

@@ -9,7 +9,7 @@
 # manifest-driven architecture, the do/don't table, and the emergency
 # override procedure) are a paid Flisk feature. When a valid license grants
 # the "agents-md" resource, cli/src/generator/template-engine.ts
-# (vendorTdkExtension) overwrites this file with the licensed version
+# (vendorFliskExtension) overwrites this file with the licensed version
 # fetched via extension-fetch.ts before Tilt loads it. Same function
 # signature either way, so nothing else in the generator pipeline changes.
 # =============================================================================

package/{engine → runtime/engine}/topologies/tilt/generators/infisical/README.md

@@ -354,7 +354,7 @@ print(result["deprecated"]) # False
 ## File Structure
 
 ```
-tdk-cli/engine/topologies/
+flisk-cli/engine/topologies/
 ├── tilt/generators/infisical/
 │   ├── index.star              # Master module export
 │   ├── secrets_generator.star  # Secret injection config