@flisk-sh/flisk 1.3.207 → 1.4.0

package/cli/dist/utils/down-cleanup.js

@@ -22,7 +22,7 @@ export function projectNetworkNames(projectName) {
  * `backend` also occur in non-Flisk compose projects, so a prefix counts only if it has a Traefik network, which
  * only Flisk creates.
  */
-export function tdkNetworkPrefixes(networkNames) {
+export function fliskNetworkPrefixes(networkNames) {
     const prefixes = new Set();
     for (const name of networkNames) {
         for (const marker of ["traefik-public", "traefik-private"]) {
@@ -33,7 +33,7 @@ export function tdkNetworkPrefixes(networkNames) {
     return prefixes;
 }
 /** The Flisk project prefix a network belongs to (`umami` for `umami_backend`), or null. */
-export function tdkNetworkOwner(name, prefixes) {
+export function fliskNetworkOwner(name, prefixes) {
     for (const suffix of PROJECT_NETWORK_SUFFIXES) {
         if (name.endsWith(`_${suffix}`)) {
             const prefix = name.slice(0, -(suffix.length + 1));

package/cli/dist/utils/env-compat-init.js

@@ -0,0 +1,8 @@
+// Copyright (c) 2026 Flisk Landscape contributors
+// SPDX-License-Identifier: MIT
+import { applyEnvAliases } from "./env-compat.js";
+// Imported first in cli.ts so every later module sees the aliased variables.
+const deprecated = applyEnvAliases(process.env);
+if (deprecated.length > 0 && process.env.FLISK_QUIET_DEPRECATIONS === undefined) {
+    console.error(`flisk: ${deprecated.join(", ")} ${deprecated.length > 1 ? "are" : "is"} deprecated; rename the TDK_ prefix to FLISK_ (set FLISK_QUIET_DEPRECATIONS=1 to silence).`);
+}

package/cli/dist/utils/env-compat.js

@@ -0,0 +1,27 @@
+// Copyright (c) 2026 Flisk Landscape contributors
+// SPDX-License-Identifier: MIT
+const NEW_PREFIX = "FLISK_";
+const LEGACY_PREFIX = "TDK_";
+/**
+ * Bridges the TDK_* → FLISK_* rename. FLISK_X is the preferred name; the engine and
+ * subprocesses (Tilt, Starlark) still read TDK_X, so FLISK_X is mirrored onto TDK_X
+ * unless TDK_X is already set. Returns the legacy names that were used without a
+ * FLISK_ equivalent, so callers can print one deprecation notice.
+ */
+export function applyEnvAliases(env) {
+    const deprecated = [];
+    for (const key of Object.keys(env)) {
+        if (key.startsWith(NEW_PREFIX)) {
+            const legacy = LEGACY_PREFIX + key.slice(NEW_PREFIX.length);
+            if (env[legacy] === undefined)
+                env[legacy] = env[key];
+        }
+    }
+    for (const key of Object.keys(env)) {
+        if (key.startsWith(LEGACY_PREFIX) &&
+            env[NEW_PREFIX + key.slice(LEGACY_PREFIX.length)] === undefined) {
+            deprecated.push(key);
+        }
+    }
+    return deprecated;
+}

package/cli/dist/utils/env-selection.js

@@ -3,13 +3,13 @@
 import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { isAbsolute, relative, resolve, sep } from "node:path";
 import { COMPLETED_ENV_VARS, parseEnv } from "./env-validator.js";
-import { TdkError } from "./errors.js";
+import { FliskError } from "./errors.js";
 /**
  * The environment variable the engine reads the env file of the run from. The CLI resolves the
  * requested path and exports it, so the engine reads one file for the whole run: the Tilt
  * environment (engine/topologies/tilt/common/utils_env.star) and the Compose interpolation alike.
  */
-export const PROJECT_ENV_FILE_VAR = "TDK_ENV_FILE";
+export const PROJECT_ENV_FILE_VAR = "FLISK_ENV_FILE";
 /**
  * The keys the platform needs in the env file of a run. They are the keys `completeEnvFile` keeps
  * complete in the project `.env`: the Tilt environment, the Postgres password and the JWT secret.
@@ -22,9 +22,9 @@ export const ENV_FILE_ERROR_EXIT_CODE = 2;
 export const ENV_FILE_ENGINE_EXIT_CODE = 1;
 /**
  * A rejected `--env-file`. It carries a code so a JSON consumer can tell an unusable file from
- * another failure, and it is a TdkError so the CLI shows it in the house style.
+ * another failure, and it is a FliskError so the CLI shows it in the house style.
  */
-export class EnvFileError extends TdkError {
+export class EnvFileError extends FliskError {
     code;
     constructor(code, message, suggestions = [], exitCode = ENV_FILE_ERROR_EXIT_CODE) {
         super(message, suggestions, exitCode);
@@ -52,7 +52,7 @@ export function isInsideProject(projectRoot, path) {
  * (which mounts the project read-only and runs Compose itself) can only read a file inside it. A
  * path outside the project would also turn the flag into a way to read any file on the machine.
  *
- * @throws TdkError when the path is empty, leaves the project, or does not exist
+ * @throws FliskError when the path is empty, leaves the project, or does not exist
  */
 export function resolveEnvFilePath(projectRoot, requested, options = {}) {
     const trimmed = requested.trim();
@@ -99,7 +99,7 @@ function realPathOrSelf(path) {
  * Reads the env file. The values are secrets, so they are only used to configure the run and to
  * mask output; they are never printed.
  *
- * @throws TdkError when the file cannot be read
+ * @throws FliskError when the file cannot be read
  */
 export function readEnvFileValues(path) {
     let content;
@@ -122,7 +122,7 @@ export function missingRequiredEnvKeys(values) {
  * does not complete it: a file the user named may well be committed, and writing a generated
  * credential into it would leak one.
  *
- * @throws TdkError when the file is unusable or misses a key the platform needs
+ * @throws FliskError when the file is unusable or misses a key the platform needs
  */
 export function selectEnvFile(projectRoot, requested, options = {}) {
     const path = resolveEnvFilePath(projectRoot, requested, options);
@@ -152,12 +152,12 @@ export function applyEnvFileSelection(selection) {
  * The vendored engine copy that resolves the env file of the run. A project vendors it at generation
  * time, so a project created before this option existed runs an engine that ignores the selection.
  */
-const VENDORED_ENGINE_ENV_FILE = ".tdk/.tdk-out/tdk-cli-ext/engine/topologies/tilt/common/utils_env.star";
+const VENDORED_ENGINE_ENV_FILE = ".flisk/.flisk-out/flisk-cli-ext/engine/topologies/tilt/common/utils_env.star";
 /**
  * Refuses the run when the project's vendored engine cannot honour the selection. Without this check
  * the flag would be ignored silently and the run would use the project .env after all.
  *
- * @throws TdkError when the vendored engine is older than this option
+ * @throws FliskError when the vendored engine is older than this option
  */
 export function assertEngineSupportsEnvFile(projectRoot) {
     const vendored = resolve(projectRoot, VENDORED_ENGINE_ENV_FILE);

package/cli/dist/utils/errors.js

@@ -10,17 +10,17 @@ export function getErrorMessage(err) {
     return err instanceof Error ? err.message : String(err);
 }
 export function logVerbose(message, err) {
-    if (process.env.TDK_VERBOSE) {
+    if (process.env.FLISK_VERBOSE) {
         const errMsg = err !== undefined ? `: ${getErrorMessage(err)}` : "";
         console.warn(chalk.gray(`${message}${errMsg}`));
     }
 }
-export class TdkError extends Error {
+export class FliskError extends Error {
     suggestions;
     exitCode;
     constructor(message, suggestions = [], exitCode = 1) {
         super(message);
-        this.name = "TdkError";
+        this.name = "FliskError";
         this.suggestions = suggestions;
         this.exitCode = exitCode;
     }
@@ -56,28 +56,28 @@ function closestNameSuggestions(names, candidates, includeInput = false) {
     return [...suggestions];
 }
 export const errorFactories = {
-    tiltNotInstalled: () => new TdkError("Tilt CLI is not installed", [
+    tiltNotInstalled: () => new FliskError("Tilt CLI is not installed", [
         "Install Tilt: `brew install tilt` (macOS)",
         "Or download from: https://docs.tilt.dev/install.html",
         "Verify with: `tilt version`",
         `Setup guide: ${QUICKSTART_DOCS_URL}`,
     ]),
-    dockerNotAvailable: () => new TdkError("Docker (or a compatible container runtime) is not running", [
+    dockerNotAvailable: () => new FliskError("Docker (or a compatible container runtime) is not running", [
         "Start Docker Desktop, then verify with: `docker ps`",
         "Or start Colima: `colima start`",
         "Or start the Docker service on Linux: `sudo systemctl start docker`",
         `Setup guide: ${QUICKSTART_DOCS_URL}`,
     ]),
-    dockerNotResponding: () => new TdkError("Docker is running but not responding (`docker ps` hung for 10s)", [
+    dockerNotResponding: () => new FliskError("Docker is running but not responding (`docker ps` hung for 10s)", [
         "Quit and reopen Docker Desktop, or run `colima restart`",
         "Then verify with: `docker ps`",
     ]),
-    stackNotFound: (name, stackNames = []) => new TdkError(`Stack "${name}" not found`, [
+    stackNotFound: (name, stackNames = []) => new FliskError(`Stack "${name}" not found`, [
         ...closestNameSuggestions([name], stackNames),
         "Run `flisk stacks` to see available stacks",
         "Run `flisk stack` to assign resources to a stack",
     ]),
-    resourceNotFound: (name, resourceNames = []) => new TdkError(`Resource "${name}" not found`, [
+    resourceNotFound: (name, resourceNames = []) => new FliskError(`Resource "${name}" not found`, [
         ...closestNameSuggestions([name], resourceNames),
         "Run `flisk resources` to list all resources",
         "Check the resource name spelling",
@@ -85,17 +85,17 @@ export const errorFactories = {
     unknownServices: (names, validNames) => {
         // Service selectors are Tilt resource names, so share the resource suggestion path.
         const suggestions = closestNameSuggestions(names, validNames, names.length > 1);
-        return new TdkError(`Unknown service ${names.join(", ")}. Valid names: ${validNames.join(", ")}`, suggestions, 2);
+        return new FliskError(`Unknown service ${names.join(", ")}. Valid names: ${validNames.join(", ")}`, suggestions, 2);
     },
-    directoryExists: (path) => new TdkError(`Directory already exists: ${path}`, [
+    directoryExists: (path) => new FliskError(`Directory already exists: ${path}`, [
         "Use `--path` to specify a different location",
         "Remove the existing directory if no longer needed",
     ]),
-    invalidPath: (path) => new TdkError(`Invalid path: ${path}`, [
+    invalidPath: (path) => new FliskError(`Invalid path: ${path}`, [
         "Path must be within the project directory",
         'Path cannot contain special characters like <>:"|?*',
     ]),
-    notInProject: () => new TdkError("Could not find project root (no .tdk/project.json found)", [
+    notInProject: () => new FliskError("Could not find project root (no .flisk/project.json found)", [
         "Run this from within a Flisk project",
         "Run `flisk project --yes` to initialize a new project",
     ]),
@@ -108,7 +108,7 @@ export function requireProjectRoot() {
     return projectRoot;
 }
 function handleCommandError(err) {
-    if (err instanceof TdkError) {
+    if (err instanceof FliskError) {
         err.exit();
     }
     showError(getErrorMessage(err));

package/cli/dist/utils/file-helpers.js

@@ -46,9 +46,9 @@ export function ensureDirectory(dirPath) {
 /** Generated files that must never be committed: .env holds a generated DB password. */
 const GITIGNORE_ENTRIES = [
     ".env",
-    ".tdk/.tdk-out/",
-    ".tdk/.project-id",
-    ".tdk/smoke/",
+    ".flisk/.flisk-out/",
+    ".flisk/.project-id",
+    ".flisk/smoke/",
     "node_modules/",
 ];
 /**
@@ -86,7 +86,7 @@ export function isInsideGitWorkTree(startPath) {
     }
 }
 /**
- * Makes sure the smoke records cannot be committed by accident: the project .gitignore must ignore `.tdk/smoke/` before
+ * Makes sure the smoke records cannot be committed by accident: the project .gitignore must ignore `.flisk/smoke/` before
  * `flisk up` writes a record. Only meaningful inside a git working tree, so nothing is written outside one. Returns the
  * warning to show when the entry could not be ensured, and undefined when it is.
  */
@@ -99,6 +99,6 @@ export function ensureSmokeRecordsIgnored(projectRoot) {
     }
     catch (error) {
         const reason = error instanceof Error ? error.message : String(error);
-        return `Could not add .tdk/smoke/ to ${resolve(projectRoot, ".gitignore")}: ${reason}. Git may track the smoke response records.`;
+        return `Could not add .flisk/smoke/ to ${resolve(projectRoot, ".gitignore")}: ${reason}. Git may track the smoke response records.`;
     }
 }

package/cli/dist/utils/{tdk-version.js → flisk-version.js}

@@ -7,25 +7,25 @@ function toParts(raw) {
     const match = raw.trim().match(/(\d+)\.(\d+)(?:\.(\d+))?/);
     return match ? [Number(match[1]), Number(match[2]), Number(match[3] ?? 0)] : null;
 }
-function readMinTdkVersion(projectRoot) {
+function readMinFliskVersion(projectRoot) {
     try {
-        const parsed = JSON.parse(readFileSync(join(projectRoot, ".tdk", PROJECT_JSON), "utf-8"));
-        return parsed?.minTdkVersion;
+        const parsed = JSON.parse(readFileSync(join(projectRoot, ".flisk", PROJECT_JSON), "utf-8"));
+        return parsed?.minFliskVersion;
     }
     catch {
         return undefined;
     }
 }
-export function evaluateTdkVersionFloor(projectRoot, currentVersion) {
-    const minimum = readMinTdkVersion(projectRoot);
+export function evaluateFliskVersionFloor(projectRoot, currentVersion) {
+    const minimum = readMinFliskVersion(projectRoot);
     if (minimum === undefined)
         return { status: "none" };
     const required = typeof minimum === "string" ? toParts(minimum) : null;
     if (!required || !/^\d+\.\d+\.\d+$/.test(String(minimum).trim())) {
         return {
             status: "malformed",
-            message: `.tdk/project.json minTdkVersion ${JSON.stringify(minimum)} is not a version like "1.3.80"`,
-            fix: 'Set minTdkVersion to a MAJOR.MINOR.PATCH string, for example "1.3.80".',
+            message: `.flisk/project.json minFliskVersion ${JSON.stringify(minimum)} is not a version like "1.3.80"`,
+            fix: 'Set minFliskVersion to a MAJOR.MINOR.PATCH string, for example "1.3.80".',
         };
     }
     const current = toParts(currentVersion);
@@ -43,7 +43,7 @@ export function evaluateTdkVersionFloor(projectRoot, currentVersion) {
         return {
             status: "too-old",
             required: requiredText,
-            message: `flisk ${currentVersion} is older than the ${requiredText} this project requires (minTdkVersion)`,
+            message: `flisk ${currentVersion} is older than the ${requiredText} this project requires (minFliskVersion)`,
             fix: "Run: flisk upgrade",
         };
     }

package/cli/dist/utils/generated-paths.js

@@ -4,9 +4,9 @@ import { existsSync, lstatSync } from "node:fs";
 import { isAbsolute, normalize, relative, sep } from "node:path";
 import { AUTOGENERATED_DIR, PACKAGE_JSON, TILTIGNORE_FILE } from "./constants.js";
 /** Reviewed Flisk-owned destinations written by `flisk config regenerate` or Tilt generation. */
-export const TDK_GENERATED_PATH_ALLOWLIST = [
+export const FLISK_GENERATED_PATH_ALLOWLIST = [
     `${AUTOGENERATED_DIR}/**`,
-    ".tdk/.tdk-out/**",
+    ".flisk/.flisk-out/**",
     "Tiltfile",
     "TILT_*.star",
     TILTIGNORE_FILE,
@@ -16,12 +16,12 @@ export const TDK_GENERATED_PATH_ALLOWLIST = [
     "product_autogenerated_resource_manifests/**",
     "product_autogenerated_services_list/**",
 ];
-export function isTdkGeneratedPath(path) {
+export function isFliskGeneratedPath(path) {
     const normalized = normalize(path).split(sep).join("/");
     if (isAbsolute(path) || normalized === ".." || normalized.startsWith("../"))
         return false;
     if (normalized.split("/").includes(AUTOGENERATED_DIR) ||
-        normalized.startsWith(".tdk/.tdk-out/") ||
+        normalized.startsWith(".flisk/.flisk-out/") ||
         normalized === "shared-platform-engineering/docker-templates" ||
         normalized.startsWith("shared-platform-engineering/docker-templates/") ||
         normalized.startsWith("product_autogenerated_resource_manifests/") ||
@@ -34,10 +34,10 @@ export function isTdkGeneratedPath(path) {
         normalized === PACKAGE_JSON ||
         normalized === "services/platform/database-management/docker-compose.yml");
 }
-export function assertTdkGeneratedPath(projectRoot, path) {
+export function assertFliskGeneratedPath(projectRoot, path) {
     const absolute = isAbsolute(path) ? normalize(path) : normalize(`${projectRoot}/${path}`);
     const projectRelative = relative(projectRoot, absolute).split(sep).join("/");
-    if (!isTdkGeneratedPath(projectRelative)) {
+    if (!isFliskGeneratedPath(projectRelative)) {
         throw new Error(`Refusing to write outside Flisk's generated-file allowlist: ${projectRelative}`);
     }
     let cursor = projectRoot;

package/cli/dist/utils/host-port-config.js

@@ -5,7 +5,7 @@ import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from
 import { join, resolve, sep } from "node:path";
 import { PROJECT_JSON } from "./constants.js";
 import { createHostPortPlan, isHostPortAvailable, PREFERRED_HOST_PORTS, } from "./host-port-plan.js";
-const CONFIG_PATH = join(".tdk", ".tdk-out", "host-ports.json");
+const CONFIG_PATH = join(".flisk", ".flisk-out", "host-ports.json");
 export function isDockerPortOwnedByProject(dockerPs, projectPrefix, port) {
     return dockerPs.split("\n").some((line) => {
         const [name = "", ports = ""] = line.split("|");
@@ -39,18 +39,18 @@ export function readSavedHostPortPlan(projectRoot) {
 }
 export function writeSavedHostPortPlan(projectRoot, plan) {
     const path = join(projectRoot, CONFIG_PATH);
-    mkdirSync(join(projectRoot, ".tdk", ".tdk-out"), { recursive: true });
+    mkdirSync(join(projectRoot, ".flisk", ".flisk-out"), { recursive: true });
     writeFileSync(path, `${JSON.stringify(plan, null, 2)}\n`, { encoding: "utf-8", mode: 0o600 });
 }
 export function exportHostPortPlan(plan) {
-    process.env.TDK_HTTP_PORT = String(plan.ingressHttp);
-    process.env.TDK_HTTPS_PORT = String(plan.ingressHttps);
-    process.env.TDK_POSTGRES_PORT = String(plan.postgres);
+    process.env.FLISK_HTTP_PORT = String(plan.ingressHttp);
+    process.env.FLISK_HTTPS_PORT = String(plan.ingressHttps);
+    process.env.FLISK_POSTGRES_PORT = String(plan.postgres);
 }
 const COMPOSE_WORKING_DIR_LABEL = "com.docker.compose.project.working_dir";
 /**
  * True when a container whose Compose working directory is inside this project publishes the port. A container-name prefix is not
- * enough: tdk_shop_ also matches the containers of a different project called tdk-shop-extra. Compose records the directory each
+ * enough: flisk_shop_ also matches the containers of a different project called flisk-shop-extra. Compose records the directory each
  * project was started from, so that identifies the project exactly. Containers without the label never count.
  */
 export function isPortHeldByProjectContainers(dockerPs, projectRoot, port) {
@@ -91,20 +91,20 @@ export function resolveRuntimeIngressPort(projectRoot, plannedPort, readDockerPs
 /** Reuse this project's last selection when its ports are still free or held by its own containers. */
 export async function getHostPortPlan(projectRoot, options = {}) {
     const saved = readSavedHostPortPlan(projectRoot);
-    const hasOverride = ["TDK_HTTP_PORT", "TDK_HTTPS_PORT", "TDK_POSTGRES_PORT"].some((key) => process.env[key]);
+    const hasOverride = ["FLISK_HTTP_PORT", "FLISK_HTTPS_PORT", "FLISK_POSTGRES_PORT"].some((key) => process.env[key]);
     // Dry-run must not call Docker. A saved plan is the best representation of
     // the current landscape in that mode; explicit overrides are still planned.
     if (options.inspectDocker === false && saved && !hasOverride)
         return saved;
     let prefix = "";
     try {
-        const project = JSON.parse(readFileSync(join(projectRoot, ".tdk", PROJECT_JSON), "utf-8"));
-        prefix = String(project?.project?.name ?? "tdk-project")
+        const project = JSON.parse(readFileSync(join(projectRoot, ".flisk", PROJECT_JSON), "utf-8"));
+        prefix = String(project?.project?.name ?? "flisk-project")
             .replace(/-/g, "_")
             .toLowerCase();
     }
     catch {
-        prefix = "tdk_project";
+        prefix = "flisk_project";
     }
     let dockerPs = "";
     if (options.inspectDocker !== false) {

package/cli/dist/utils/host-port-plan.js

@@ -8,9 +8,9 @@ export const DEFAULT_HOST_PORT_RANGES = {
     postgres: { start: 15432, end: 15532 },
 };
 const ENV_KEYS = {
-    ingressHttp: "TDK_HTTP_PORT",
-    ingressHttps: "TDK_HTTPS_PORT",
-    postgres: "TDK_POSTGRES_PORT",
+    ingressHttp: "FLISK_HTTP_PORT",
+    ingressHttps: "FLISK_HTTPS_PORT",
+    postgres: "FLISK_POSTGRES_PORT",
 };
 const REQUESTED_PORTS = { ingressHttp: 80, ingressHttps: 443, postgres: 5432 };
 // Tried before the fallback range so routed URLs need no port. Postgres keeps

package/cli/dist/utils/machine-output.js

@@ -1,6 +1,6 @@
 // Copyright (c) 2026 Flisk Landscape contributors
 // SPDX-License-Identifier: MIT
-import { TdkError } from "./errors.js";
+import { FliskError } from "./errors.js";
 export const SCHEMA_VERSION = 1;
 export function createMachineEnvelope(data, errors = []) {
     return { schemaVersion: SCHEMA_VERSION, data, errors };
@@ -33,7 +33,7 @@ export function isMachineOutputEnvelope(value) {
     return envelope.errors.every(isMachineError);
 }
 export function toMachineError(error) {
-    if (error instanceof TdkError) {
+    if (error instanceof FliskError) {
         return {
             error: {
                 code: "COMMAND_FAILED",

package/cli/dist/utils/native-windows.js

@@ -11,7 +11,7 @@ export const NATIVE_WINDOWS_REFUSAL = "Landscape startup needs Ubuntu on WSL2. N
 /**
  * Why a command that starts a stack cannot run on this host, or null when it may proceed.
  *
- * `TDK_ALLOW_NATIVE_WINDOWS=1` is the unsupported escape hatch that lets it try anyway.
+ * `FLISK_ALLOW_NATIVE_WINDOWS=1` is the unsupported escape hatch that lets it try anyway.
  */
 export function nativeWindowsStackRefusal(platform, allowNativeWindows) {
     if (platform !== "win32" || allowNativeWindows === "1")

package/cli/dist/utils/paths.js

@@ -7,16 +7,16 @@ import packageJson from "../../package.json" with { type: "json" };
 import { PROJECT_JSON } from "./constants.js";
 /**
  * Find the nearest enclosing Flisk project root by walking up from `startDir` until a
- * `.tdk/project.json` marker is found. Stops at the filesystem root without treating the
+ * `.flisk/project.json` marker is found. Stops at the filesystem root without treating the
  * root itself as a project.
  * @param startDir - Directory to start searching from (default: cwd)
- * @returns Absolute path of the project root, or null if no `.tdk/project.json` exists on any parent
+ * @returns Absolute path of the project root, or null if no `.flisk/project.json` exists on any parent
  */
 export function findProjectRoot(startDir = cwd()) {
     let currentDir = resolve(startDir);
     const root = resolve("/");
     while (currentDir !== root) {
-        if (existsSync(join(currentDir, ".tdk", PROJECT_JSON))) {
+        if (existsSync(join(currentDir, ".flisk", PROJECT_JSON))) {
             return currentDir;
         }
         const parentDir = dirname(currentDir);

package/cli/dist/utils/platform.js

@@ -4,7 +4,7 @@ import { delimiter, extname } from "node:path";
 export function isWindows() {
     return process.platform === "win32";
 }
-export function tdkOsFor(platformName) {
+export function fliskOsFor(platformName) {
     if (platformName === "linux")
         return "linux";
     if (platformName === "darwin")
@@ -13,22 +13,22 @@ export function tdkOsFor(platformName) {
         return "windows";
     return null;
 }
-export function tdkOs() {
-    return tdkOsFor(process.platform);
+export function fliskOs() {
+    return fliskOsFor(process.platform);
 }
-export function tdkArchFor(architecture) {
+export function fliskArchFor(architecture) {
     if (architecture === "x64")
         return "amd64";
     if (architecture === "arm64")
         return "arm64";
     return null;
 }
-export function tdkArch() {
-    return tdkArchFor(process.arch);
+export function fliskArch() {
+    return fliskArchFor(process.arch);
 }
 export function binaryAssetNameFor(platformName, architecture) {
-    const osName = tdkOsFor(platformName);
-    const archName = tdkArchFor(architecture);
+    const osName = fliskOsFor(platformName);
+    const archName = fliskArchFor(architecture);
     if (!osName || !archName)
         return null;
     if (osName === "windows" && archName !== "amd64")
@@ -40,7 +40,7 @@ export function binaryAssetName() {
     return binaryAssetNameFor(process.platform, process.arch);
 }
 export function executableName() {
-    return isWindows() ? "tdk.exe" : "flisk";
+    return isWindows() ? "flisk.exe" : "flisk";
 }
 export function pathLookups(binName, windows = isWindows()) {
     if (!windows)

package/cli/dist/utils/port-conflict-fix.js

@@ -2,9 +2,9 @@
 // SPDX-License-Identifier: MIT
 /** The env var that moves each host port Flisk publishes. Services publish no host ports, so only these conflict. */
 const PORT_ENV_VARS = {
-    "80": "TDK_HTTP_PORT",
-    "443": "TDK_HTTPS_PORT",
-    "5432": "TDK_POSTGRES_PORT",
+    "80": "FLISK_HTTP_PORT",
+    "443": "FLISK_HTTPS_PORT",
+    "5432": "FLISK_POSTGRES_PORT",
 };
 /**
  * The next step for a host port another process already holds. The occupant is not named: finding it needs the OS, so

package/cli/dist/utils/port-fallback-notice.js

@@ -1,7 +1,7 @@
 const PORT_KEYS = [
-    { key: "ingressHttp", label: "HTTP", env: "TDK_HTTP_PORT" },
-    { key: "ingressHttps", label: "HTTPS", env: "TDK_HTTPS_PORT" },
-    { key: "postgres", label: "Postgres", env: "TDK_POSTGRES_PORT" },
+    { key: "ingressHttp", label: "HTTP", env: "FLISK_HTTP_PORT" },
+    { key: "ingressHttps", label: "HTTPS", env: "FLISK_HTTPS_PORT" },
+    { key: "postgres", label: "Postgres", env: "FLISK_POSTGRES_PORT" },
 ];
 /** One line per port Flisk moved off the one it wanted. Ports the user set explicitly are never listed. */
 export function formatPortFallbackNotice(plan) {

package/cli/dist/utils/project-config-defaults.js

@@ -4,7 +4,7 @@ import { DATABASE_MANAGEMENT_FEATURE } from "./constants.js";
 /**
  * Defaults shared by project generation and CLI predicates.
  *
- * Source of truth for `always_enabled_infra` when `.tdk/project.json` omits
+ * Source of truth for `always_enabled_infra` when `.flisk/project.json` omits
  * the field. The generator bakes this into the Tiltfile
  * (`Tiltfile.hbs` → `ALWAYS_ENABLED_INFRA`); `should_enable` then returns
  * `RESOURCE_DEFAULTS.get(name, True)` for names in that list — so an omitted

package/cli/dist/utils/project-features.js

@@ -14,12 +14,12 @@ export const PROJECT_FEATURES = {
         dependsOn: [],
     },
     // Key/name must be the literal Tilt resource name (PlatformDockerConstants.VERDACCIO_RESOURCE_NAME
-    // in tdk-cli-extensions), since project.json's services list is copied verbatim into
+    // in flisk-cli-extensions), since project.json's services list is copied verbatim into
     // PRE_ALPHA_RESOURCES and matched against that name by should_enable(). "registry" would
     // silently fail to enable Verdaccio.
     verdaccio: {
         name: "verdaccio",
-        description: "Verdaccio npm registry for package management and local publishing (Premium - requires TDK_LICENSE_KEY)",
+        description: "Verdaccio npm registry for package management and local publishing (Premium - requires FLISK_LICENSE_KEY)",
         category: "premium",
         phase: "pre_alpha",
         enabled_by_default: false,

package/cli/dist/utils/resource-features.js

@@ -133,7 +133,7 @@ export const RESOURCE_FEATURES = {
         name: "ddd",
         description: "Domain-driven design folder structure (domain/application/infrastructure/presentation) " +
             "and matching @domain/@application/@infrastructure/@presentation/@test path aliases " +
-            "(Premium - requires TDK_LICENSE_KEY; see hasDddLicense() in extension-fetch.ts)",
+            "(Premium - requires FLISK_LICENSE_KEY; see hasDddLicense() in extension-fetch.ts)",
         applies_to: ["backend", "worker", "migrator"],
         enabled_by_default: false,
         category: "premium",
@@ -148,12 +148,12 @@ export const RESOURCE_FEATURES = {
             "is created or started, and a Traefik static route wakes it on the first request instead " +
             "(backends only for now), so it doesn't wait behind the rest of a large landscape's " +
             "bring-up. Requires `enable: true`. " +
-            "(Premium - requires TDK_LICENSE_KEY; free tier writes a disabled stub; see " +
+            "(Premium - requires FLISK_LICENSE_KEY; free tier writes a disabled stub; see " +
             "hasSablierLicense() in extension-fetch.ts KNOWN_RESOURCES/PREMIUM_PATH_MAP)",
         applies_to: ["backend", "frontend"],
         enabled_by_default: false,
         category: "premium",
-        generator_file: "engine/topologies/platform/docker/networking/sablier_container_cycle.star (stub; real generator in tdk-cli-extensions/premium/networking/), engine/topologies/platform/docker/networking/traefik.star, engine/topologies/platform/docker/compose/traefik_standalone.star (deferStart wake gateway + static route), engine/topologies/tilt/resources/orchestrator/apply_compose_resource_registration.star (deferred image prebuild + wake route wiring)",
+        generator_file: "engine/topologies/platform/docker/networking/sablier_container_cycle.star (stub; real generator in flisk-cli-extensions/premium/networking/), engine/topologies/platform/docker/networking/traefik.star, engine/topologies/platform/docker/compose/traefik_standalone.star (deferStart wake gateway + static route), engine/topologies/tilt/resources/orchestrator/apply_compose_resource_registration.star (deferred image prebuild + wake route wiring)",
         output_file: "(Traefik + Sablier Docker labels on the resource's own compose service; with deferStart, also a generated Traefik file-provider dynamic-config entry, wake gateway, and image prebuild resource)",
     },
 };

package/cli/dist/utils/runtime-layout.js

@@ -0,0 +1,58 @@
+// Copyright (c) 2026 Flisk Landscape contributors
+// SPDX-License-Identifier: MIT
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+// Directories that make up the Flisk Tilt extension, next to the root Tiltfile.
+export const EXTENSION_DIRS = ["engine", "discovery", "specs", "ext"];
+// Optional wrapper folder for a future layout that nests the extension directories.
+const NESTED_RUNTIME_DIR = "runtime";
+// Resolve one extension directory, preferring the nested layout and falling back to the
+// current flat one, so callers keep working whichever layout a checkout or bundle uses.
+export function resolveExtensionDir(sourceRoot, name) {
+    const nested = join(sourceRoot, NESTED_RUNTIME_DIR, name);
+    return existsSync(nested) ? nested : join(sourceRoot, name);
+}
+// The extension entry point sits at runtime/Tiltfile in a source checkout and at the bundle
+// root in a packaged or vendored layout.
+export function resolveTiltfile(sourceRoot) {
+    const nested = join(sourceRoot, NESTED_RUNTIME_DIR, "Tiltfile");
+    return existsSync(nested) ? nested : join(sourceRoot, "Tiltfile");
+}
+// Checks that the Tiltfile and every extension directory come from one layout. The resolvers above pick each
+// entry on its own, so a stale or half-migrated tree would otherwise combine nested and flat entries.
+export function inspectExtensionLayout(sourceRoot) {
+    const entries = ["Tiltfile", ...EXTENSION_DIRS];
+    const nested = entries.filter((name) => existsSync(join(sourceRoot, NESTED_RUNTIME_DIR, name)));
+    const flat = entries.filter((name) => existsSync(join(sourceRoot, name)));
+    if (nested.length === 0 && flat.length === 0) {
+        return { ok: false, kind: "incomplete", missing: [...entries], mixed: [] };
+    }
+    if (nested.length === entries.length)
+        return { ok: true, kind: "nested", missing: [], mixed: [] };
+    if (nested.length === 0) {
+        const missing = entries.filter((name) => !flat.includes(name));
+        return missing.length === 0
+            ? { ok: true, kind: "flat", missing, mixed: [] }
+            : { ok: false, kind: "incomplete", missing, mixed: [] };
+    }
+    // Some entries are nested: the tree is meant to be nested, so a flat-only entry is a leftover.
+    const missing = entries.filter((name) => !nested.includes(name));
+    const mixed = missing.filter((name) => flat.includes(name));
+    return { ok: false, kind: mixed.length > 0 ? "mixed" : "incomplete", missing, mixed };
+}
+// One line naming what is wrong, for warnings and `flisk runtime --check-assets`.
+export function describeLayoutProblems(sourceRoot, report = inspectExtensionLayout(sourceRoot)) {
+    if (report.ok)
+        return `${sourceRoot}: ${report.kind} layout`;
+    const parts = [];
+    if (report.kind === "mixed") {
+        parts.push(`mixes the nested ${NESTED_RUNTIME_DIR}/ layout with flat entries (${report.mixed.join(", ")} only at the root)`);
+    }
+    const absent = report.missing.filter((name) => !report.mixed.includes(name));
+    if (absent.length > 0)
+        parts.push(`is missing ${absent.join(", ")}`);
+    return `${sourceRoot} ${parts.join(" and ")}`;
+}
+export function hasExtensionLayout(sourceRoot) {
+    return inspectExtensionLayout(sourceRoot).ok;
+}