@flisk-sh/flisk 1.3.207 → 1.4.1

package/{engine → runtime/engine}/AGENTS.md

@@ -159,7 +159,7 @@ def get_resource_by_name(name):
 
 **Autogenerated Services List:**
 ```starlark
-# .tdk/.tdk-out/product_autogenerated_resource_manifests/services.autogenerated.star
+# .flisk/.flisk-out/product_autogenerated_resource_manifests/services.autogenerated.star
 APP_RESOURCES_AUTOGENERATED = [
     {
         'name': 'order-planner',
@@ -230,7 +230,7 @@ def generate_backend(path, prisma_path, write_fn, internal_deps, is_docker):
 def generate_app_dockerfile(path, resource_name, start_command):
     return '''
 # L1: Golden Image Base
-FROM tdk/golden-image-l1:latest AS base
+FROM flisk/golden-image-l1:latest AS base
 
 # L2: Dependency Installation
 FROM base AS deps
@@ -340,13 +340,13 @@ def generate_traefik_labels(resource_name, port, host, path_prefix):
 ```starlark
 # engine/topologies/tilt/resources/deps.star
 def discover_resource_libraries(ctx, resource_path):
-    """Discovers @tdk/* dependencies from package.json"""
+    """Discovers @flisk/* dependencies from package.json"""
     package_json = read_json(resource_path + "/package.json")
     deps = package_json.get("dependencies", {})
     
     return [
         name for name in deps.keys()
-        if name.startswith("@tdk/")
+        if name.startswith("@flisk/")
     ]
 
 def setup_libraries(ctx, should_enable, DDD_LIBS, PLATFORM_LIBS, PRODUCT_LIBS, generators):
@@ -385,7 +385,7 @@ def setup_libraries(ctx, should_enable, DDD_LIBS, PLATFORM_LIBS, PRODUCT_LIBS, g
 ```
 ❌ DON'T MODIFY:
 - **/autogenerated/*.autogenerated.*
-- .tdk/.tdk-out/product_autogenerated_*/*
+- .flisk/.flisk-out/product_autogenerated_*/*
 - **/services.autogenerated.star
 - **/domains.autogenerated.star
 ```
@@ -411,7 +411,7 @@ runtime dependency between them - see infra-loader.star's _load_* functions):
   golden-image (L1-L4, built first as a Docker layer-cache optimization,
                  not a runtime dependency of anything below)
   database-management (postgres) - Free, on by default
-  verdaccio (npm registry)       - Premium, requires TDK_LICENSE_KEY
+  verdaccio (npm registry)       - Premium, requires FLISK_LICENSE_KEY
   infisical, proxy, monitoring, debezium, elk - independent, opt-in
 
 Per-Service:

package/{engine → runtime/engine}/README.md

@@ -1,6 +1,6 @@
 # .tilt-engine/
 
-> **Contributing to the current engine:** follow the [engine and discovery recipe](../docs/contributing/02-feature-recipes.md#change-the-engine-or-service-discovery). This README contains older architecture notes; check paths against the current `engine/topologies/` source before relying on them.
+> **Contributing to the current engine:** follow the [engine and discovery recipe](../../docs/contributing/02-feature-recipes.md#change-the-engine-or-service-discovery). This README contains older architecture notes; check paths against the current `engine/topologies/` source before relying on them.
 
 **Tilt Platform Framework Code**
 
@@ -24,7 +24,7 @@ This directory contains the Flisk Landscape Tilt infrastructure framework - the
 
 When you see `.tilt-engine/` in paths, know that this is framework code (not generated output).
 
-Generated/output files go in `.tdk/.tdk-out/` (which is gitignored).
+Generated/output files go in `.flisk/.flisk-out/` (which is gitignored).
 
 ## Learn More
 

package/{engine → runtime/engine}/Tiltfile

@@ -1,12 +1,12 @@
 # =============================================================================
-# 🎯 TDK-ENGINE - Core Execution Engine
+# 🎯 Flisk-ENGINE - Core Execution Engine
 # =============================================================================
-# This is the Tiltfile entry point for the tdk-engine repo.
+# This is the Tiltfile entry point for the flisk-engine repo.
 # It exports core orchestration, resource builders, and topology management.
 #
 # Usage:
-#   v1alpha1.extension_repo(name='tdk-engine', url='https://github.com/flisk-sh/flisk')
-#   load('ext://tdk-engine', 'Utils', 'Manifest', 'Config', ...)
+#   v1alpha1.extension_repo(name='flisk-engine', url='https://github.com/flisk-sh/flisk')
+#   load('ext://flisk-engine', 'Utils', 'Manifest', 'Config', ...)
 # =============================================================================
 
 # Core
@@ -83,4 +83,4 @@ Watchers = _Watchers
 # True when a manifest's deferStart is actually active (licensed); decides whether a `<name>-image` prebuild resource exists.
 resource_defers_start = _resource_defers_start
 
-print("✅ TDK Engine loaded: orchestration, resources, and lifecycle")
+print("✅ Flisk Engine loaded: orchestration, resources, and lifecycle")

package/{engine → runtime/engine}/assets/docker/golden-layers.Dockerfile

@@ -7,7 +7,7 @@
 # 2. Or update service.json
 #
 # Generation Source: GoldenImage.generate_layered_dockerfile()
-# Service: tdk-project-l1-l4
+# Service: flisk-project-l1-l4
 # Type: GOLDEN LAYERED IMAGES | L1-L4 Pre-built Layers
 ###############################################################################
 
@@ -15,14 +15,14 @@
 # 🏗️ GOLDEN LAYERED IMAGES - Multi-Stage Base Images
 # =============================================================================
 # This Dockerfile builds 8 golden images:
-#   - tdk-project-l1:latest - OS base + Bun runtime
-#   - tdk-project-l2:latest - Dependencies installed
-#   - tdk-project-l3-backend:latest - Backend and migrator build tools (Prisma, no Infisical CLI)
-#   - tdk-project-l3-frontend:latest - Frontend build tools (no Prisma)
-#   - tdk-project-l4-backend:latest - Backend production runtime (Bun)
-#   - tdk-project-l4-backend-node:latest - Backend production runtime (Node.js)
-#   - tdk-project-l4-frontend:latest - Frontend production runtime (Nginx)
-#   - tdk-project-l4-migrator:latest - Migrator production runtime
+#   - flisk-project-l1:latest - OS base + Bun runtime
+#   - flisk-project-l2:latest - Dependencies installed
+#   - flisk-project-l3-backend:latest - Backend and migrator build tools (Prisma, no Infisical CLI)
+#   - flisk-project-l3-frontend:latest - Frontend build tools (no Prisma)
+#   - flisk-project-l4-backend:latest - Backend production runtime (Bun)
+#   - flisk-project-l4-backend-node:latest - Backend production runtime (Node.js)
+#   - flisk-project-l4-frontend:latest - Frontend production runtime (Nginx)
+#   - flisk-project-l4-migrator:latest - Migrator production runtime
 #
 # Migrators build on l3-backend: a separate l3-migrator stage installed the same Prisma
 # and produced identical layers under a second image name.
@@ -41,7 +41,7 @@
 # =============================================================================
 FROM oven/bun:1.3.11-alpine@sha256:7ed9f74c326d1c260abe247ac423ccbf5ac92af62bb442d515d1f92f21e8ea9b AS l1_golden
 
-LABEL layer="l1"       description="OS base with runtime environment"       maintainer="tdk-project"
+LABEL layer="l1"       description="OS base with runtime environment"       maintainer="flisk-project"
 
 # System dependencies for all services
 RUN apk add --no-cache     ca-certificates     tzdata     curl     file     bash     openssl
@@ -60,7 +60,7 @@ WORKDIR /app
 # =============================================================================
 FROM l1_golden AS l2_golden
 
-LABEL layer="l2"       description="Base with common dependencies installed"       maintainer="tdk-project"
+LABEL layer="l2"       description="Base with common dependencies installed"       maintainer="flisk-project"
 
 # Install minimal debugging tools (removed: vim, python3, make, g++ = -67MB)
 RUN apk add --no-cache     curl     netcat-openbsd     jq     bind-tools
@@ -77,7 +77,7 @@ RUN echo "Bun version: $(bun --version)"
 # =============================================================================
 FROM l2_golden AS l3_backend_golden
 
-LABEL layer="l3-backend"       description="Backend build tools with Prisma"       maintainer="tdk-project"
+LABEL layer="l3-backend"       description="Backend build tools with Prisma"       maintainer="flisk-project"
 
 # Install Prisma CLI globally (pinned for deterministic builds)
 RUN bun add -g prisma@7.5.0 @prisma/client@7.5.0
@@ -97,7 +97,7 @@ RUN echo "Prisma version: $(bunx prisma --version | head -1)"
 # =============================================================================
 FROM l2_golden AS l3_frontend_golden
 
-LABEL layer="l3-frontend"       description="Frontend build tools without Prisma"       maintainer="tdk-project"
+LABEL layer="l3-frontend"       description="Frontend build tools without Prisma"       maintainer="flisk-project"
 
 # Frontend doesn't need Prisma, just verify Bun
 RUN echo "Bun version: $(bun --version)"
@@ -108,7 +108,7 @@ RUN echo "Bun version: $(bun --version)"
 # =============================================================================
 FROM l1_golden AS l4_backend_bun
 
-LABEL layer="l4-backend-bun"       description="Backend production runtime (Bun)"       maintainer="tdk-project"
+LABEL layer="l4-backend-bun"       description="Backend production runtime (Bun)"       maintainer="flisk-project"
 
 ENV NODE_ENV=production
 
@@ -133,7 +133,7 @@ WORKDIR /app
 # =============================================================================
 FROM node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402 AS l4_backend_node
 
-LABEL layer="l4-backend-node"       description="Backend production runtime (Node.js - lightweight)"       maintainer="tdk-project"
+LABEL layer="l4-backend-node"       description="Backend production runtime (Node.js - lightweight)"       maintainer="flisk-project"
 
 ENV NODE_ENV=production
 
@@ -163,7 +163,7 @@ FROM l4_backend_bun AS l4_backend_golden
 # =============================================================================
 FROM nginx:1.27-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10 AS l4_frontend_golden
 
-LABEL layer="l4-frontend"       description="Frontend production runtime with Nginx"       maintainer="tdk-project"
+LABEL layer="l4-frontend"       description="Frontend production runtime with Nginx"       maintainer="flisk-project"
 
 ENV NODE_ENV=production
 
@@ -181,7 +181,7 @@ WORKDIR /usr/share/nginx/html
 # =============================================================================
 FROM l1_golden AS l4_migrator_golden
 
-LABEL layer="l4-migrator"       description="Migrator runtime with Prisma"       maintainer="tdk-project"
+LABEL layer="l4-migrator"       description="Migrator runtime with Prisma"       maintainer="flisk-project"
 
 ENV NODE_ENV=production
 

package/{engine → runtime/engine}/assets/docker/wake-gateway/Dockerfile

@@ -23,6 +23,13 @@ RUN apk add --no-cache docker-cli docker-cli-compose curl gcompat \
 WORKDIR /app
 COPY decide.ts server.ts ./
 
+# Run as the image's unprivileged `bun` user. Docker socket access comes from
+# the supplementary group in traefik_standalone.star (group_add), not from root.
+# HOME points at bun's home so `tilt trigger` finds the session token mounted
+# at $HOME/.tilt-dev.
+ENV HOME=/home/bun
+USER bun
+
 EXPOSE 9999
 HEALTHCHECK --interval=10s --timeout=3s --start-period=10s --retries=3 CMD curl --fail --silent http://127.0.0.1:${PORT:-9999}/health || exit 1
 CMD ["bun", "run", "server.ts"]

package/{engine → runtime/engine}/entrypoint.star

@@ -86,7 +86,7 @@ if _AUTO_DISCOVER_ENABLED:
     # Use unique name to avoid conflicts on reload
     local_resource(
         name="service-discovery-daemon-v2",
-        serve_cmd="cd {} && python3 discovery/resource_snapshot.py watch".format(os.getcwd()),
+        serve_cmd=["sh", "-c", 'cd "$1" && python3 discovery/resource_snapshot.py watch', "sh", os.getcwd()],
         deps=["services/product"],
         auto_init=True,
         labels=["infra", "discovery"],

package/{engine → runtime/engine}/paths.star

@@ -564,17 +564,17 @@ FEATURES = struct(
 # =============================================================================
 
 # Load project name for system identity
-# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+# Use FLISK_PROJECT_ROOT env var set by Tilt, fallback to current directory
 def _load_system_name_prefix():
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
-    project_json_path = '.tdk/project.json'
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
+    project_json_path = '.flisk/project.json'
     if project_root:
         project_json_path = project_root + '/' + project_json_path
     
     if os.path.exists(project_json_path):
         _project_json = read_json(project_json_path)
-        return _project_json.get('project', {}).get('name', 'tdk-project')
-    return 'tdk-project'
+        return _project_json.get('project', {}).get('name', 'flisk-project')
+    return 'flisk-project'
 
 _SYSTEM_NAME_PREFIX = _load_system_name_prefix()
 

package/{engine → runtime/engine}/schemas/project-schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://flisk.sh/project-schema.json",
   "title": "Flisk Project Configuration",
-  "description": "Editor assistance for .tdk/project.json. The Flisk CLI remains the runtime source of truth.",
+  "description": "Editor assistance for .flisk/project.json. The Flisk CLI remains the runtime source of truth.",
   "type": "object",
   "additionalProperties": true,
   "required": [
@@ -16,7 +16,7 @@
     "version": {
       "type": "string"
     },
-    "minTdkVersion": {
+    "minFliskVersion": {
       "type": "string",
       "pattern": "^\\d+\\.\\d+\\.\\d+$",
       "description": "Oldest flisk CLI this project works with, as MAJOR.MINOR.PATCH. flisk doctor fails on an older CLI."

package/{engine → runtime/engine}/schemas/service-schema.json

@@ -138,12 +138,12 @@
       "type": "string"
     },
     "basePath": {
-      "description": "Base path for frontend routing on tdk.localhost. Default is /{stack}s when omitted.",
+      "description": "Base path for frontend routing on flisk.localhost. Default is /{stack}s when omitted.",
       "pattern": "^/[a-z0-9/-]*$",
       "type": "string"
     },
     "databaseName": {
-      "description": "Override auto-generated DB name.\nDefault: TDK_{stack}",
+      "description": "Override auto-generated DB name.\nDefault: FLISK_{stack}",
       "pattern": "^Flisk_[a-z_]+$",
       "type": "string"
     },
@@ -185,7 +185,7 @@
       "type": "string"
     },
     "stack": {
-      "description": "Technology stack this resource belongs to.\nUsed for:\n• Database naming: TDK_{stack}\n• Traefik routing: /api/{stack}\n• NATS queue: {stack}_backend_svc",
+      "description": "Technology stack this resource belongs to.\nUsed for:\n• Database naming: FLISK_{stack}\n• Traefik routing: /api/{stack}\n• NATS queue: {stack}_backend_svc",
       "type": "string"
     },
     "params": {
@@ -196,7 +196,7 @@
       "type": "object"
     },
     "secrets": {
-      "description": "Names of secrets the resource needs. By default each is read from the project .env (gitignored) and injected into the container; with TDK_SECRET_PROVIDER=infisical they are left to Infisical. NO secret values in params/envVars or anywhere in service.json.",
+      "description": "Names of secrets the resource needs. By default each is read from the project .env (gitignored) and injected into the container; with FLISK_SECRET_PROVIDER=infisical they are left to Infisical. NO secret values in params/envVars or anywhere in service.json.",
       "properties": {
         "required": {
           "description": "Required secret names. The resource does not start if any is missing from the project .env.",
@@ -348,7 +348,7 @@
       "type": "integer"
     },
     "sablier": {
-      "description": "On-demand scaling: stop this container when idle, wake it on the next request.\nNot recommended for databases or other stateful resources with in-flight writes.\n(Premium - requires TDK_LICENSE_KEY; see hasSablierLicense() in extension-fetch.ts)",
+      "description": "On-demand scaling: stop this container when idle, wake it on the next request.\nNot recommended for databases or other stateful resources with in-flight writes.\n(Premium - requires FLISK_LICENSE_KEY; see hasSablierLicense() in extension-fetch.ts)",
       "properties": {
         "enable": {
           "default": false,

package/{engine → runtime/engine}/scripts/debug-container.sh

@@ -15,9 +15,9 @@ YELLOW='\033[1;33m'
 BLUE='\033[0;34m'
 NC='\033[0m' # No Color
 
-# Container name filter: project name from .tdk/project.json (override with TDK_PROJECT_NAME)
-PROJECT_FILTER="${TDK_PROJECT_NAME:-$(sed -n 's/.*"name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' .tdk/project.json 2>/dev/null | head -1)}"
-PROJECT_FILTER="${PROJECT_FILTER:-tdk-project}"
+# Container name filter: project name from .flisk/project.json (override with FLISK_PROJECT_NAME)
+PROJECT_FILTER="${FLISK_PROJECT_NAME:-$(sed -n 's/.*"name"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' .flisk/project.json 2>/dev/null | head -1)}"
+PROJECT_FILTER="${PROJECT_FILTER:-flisk-project}"
 PROJECT_FILTER="${PROJECT_FILTER//-/[-_]}"
 
 # Help text

package/{engine → runtime/engine}/spec.master

@@ -62,7 +62,7 @@
 
 # PROJECT_ROOT is automatically set by Tiltfile based on where you run `tilt up`.
 # You don't need to set it. Example:
-#   - If you run in /home/dev/tdk-project, PROJECT_ROOT = "/home/dev/tdk-project"
+#   - If you run in /home/dev/flisk-project, PROJECT_ROOT = "/home/dev/flisk-project"
 #   - All other paths are built from this root.
 #
 # This file is manually maintained to match the directory structure.
@@ -341,7 +341,7 @@ SPEC = struct(
     SHARED_DIR = PROJECT_ROOT + "/shared",
     
     # Topology paths - ALL EXPLICIT
-    # NOTE: These paths are relative to TDK CLI installation root (engine/ directory)
+    # NOTE: These paths are relative to Flisk CLI installation root (engine/ directory)
     TOPOLOGIES = struct(
         BASE = PROJECT_ROOT + "/engine/topologies",
         PLATFORM = PROJECT_ROOT + "/engine/topologies/platform",
@@ -563,7 +563,7 @@ FEATURES = struct(
 
 CONSTANTS = struct(
     # System identity - EXPLICIT
-    SYSTEM_NAME = "tdk-project-tilt-platform",
+    SYSTEM_NAME = "flisk-project-tilt-platform",
     SYSTEM_VERSION = "2.0.0",
     
     # Runtimes - EXPLICIT supported options

package/{engine → runtime/engine}/topologies/README.md

@@ -13,11 +13,11 @@ This folder holds the Starlark modules that turn `service.json` manifests into D
 
 Paths below are relative to the repository root. The order is the order things run.
 
-1. **Generate the project Tiltfile.** `flisk up` (or `flisk config regenerate`) renders `.tdk/.tdk-out/Tiltfile` from [`cli/templates/Tiltfile.hbs`](../../cli/templates/Tiltfile.hbs). It loads the engine through the root [`Tiltfile`](../../Tiltfile), which re-exports `Manifest`, `Orchestrator`, `Infra` and the rest.
-2. **Discover and validate manifests.** The generated Tiltfile calls `Manifest.load_all(...)`. Discovery, normalization and the field checks live in [`discovery/loading.star`](../../discovery/loading.star), [`discovery/json_manifest_scanner.star`](../../discovery/json_manifest_scanner.star), [`discovery/manifest/normalize.star`](../../discovery/manifest/normalize.star) and [`discovery/manifest/validation.star`](../../discovery/manifest/validation.star). Parsing helpers and constants are in [`tilt/manifest/parser.star`](tilt/manifest/parser.star) and [`tilt/manifest/constants.star`](tilt/manifest/constants.star). The `dependsOn` check you see from `flisk config verify` is in [`cli/src/commands/config.ts`](../../cli/src/commands/config.ts).
+1. **Generate the project Tiltfile.** `flisk up` (or `flisk config regenerate`) renders `.flisk/.flisk-out/Tiltfile` from [`cli/templates/Tiltfile.hbs`](../../../cli/templates/Tiltfile.hbs). It loads the engine through the root [`Tiltfile`](../../Tiltfile), which re-exports `Manifest`, `Orchestrator`, `Infra` and the rest.
+2. **Discover and validate manifests.** The generated Tiltfile calls `Manifest.load_all(...)`. Discovery, normalization and the field checks live in [`discovery/loading.star`](../../discovery/loading.star), [`discovery/json_manifest_scanner.star`](../../discovery/json_manifest_scanner.star), [`discovery/manifest/normalize.star`](../../discovery/manifest/normalize.star) and [`discovery/manifest/validation.star`](../../discovery/manifest/validation.star). Parsing helpers and constants are in [`tilt/manifest/parser.star`](tilt/manifest/parser.star) and [`tilt/manifest/constants.star`](tilt/manifest/constants.star). The `dependsOn` check you see from `flisk config verify` is in [`cli/src/commands/config.ts`](../../../cli/src/commands/config.ts).
 3. **Orchestrate each resource.** The Tiltfile calls `Orchestrator.apply_service(...)`, which reaches [`tilt/resources/orchestrator/apply.star`](tilt/resources/orchestrator/apply.star). For each enabled stack it validates the resource, loads its manifest, registers the Compose resource and, for migrators, registers the migration job. The helpers are the `apply_*.star` files next to it. [`apply_compose_resource_registration.star`](tilt/resources/orchestrator/apply_compose_resource_registration.star) turns `dependsOn` into Tilt `resource_deps`.
 4. **Generate the platform files.** The Docker modules under [`platform/docker/`](platform/docker/) write the files each resource needs: Compose entries in [`compose/compose.star`](platform/docker/compose/compose.star), Dockerfiles in [`dockerfile/dockerfile.star`](platform/docker/dockerfile/dockerfile.star) and the image layers in [`layers/`](platform/docker/layers/). Config generators such as `tsconfig` and Vite are in [`tilt/generators/`](tilt/generators/). Shared infrastructure (Traefik, Postgres) is loaded by [`tilt/resources/infra-loader.star`](tilt/resources/infra-loader.star).
-5. **Read the generated project files.** The output lands in each resource's `.autogenerated/` folder, for example `docker-compose.app.autogenerated.yml` and `Dockerfile.app.autogenerated`. Do not edit these by hand; see [generated files](../../docs/generated-files.md).
+5. **Read the generated project files.** The output lands in each resource's `.autogenerated/` folder, for example `docker-compose.app.autogenerated.yml` and `Dockerfile.app.autogenerated`. Do not edit these by hand; see [generated files](../../../docs/generated-files.md).
 
 If you change a field in `service.json`, start at step 2. If a container is built or wired wrongly, start at step 3 or 4.
 

package/{engine → runtime/engine}/topologies/platform/docker/build/golden_image_build.star

@@ -5,7 +5,7 @@
 load('./golden_image_constants.star', 'GOLDEN_DOCKERFILE', 'GOLDEN_IMAGE_PREFIX', 'GOLDEN_LAYERS', 'LEGACY_GOLDEN_IMAGES')
 
 # Label that records which golden Dockerfile an image was built from.
-GOLDEN_HASH_LABEL = 'tdk.golden.hash'
+GOLDEN_HASH_LABEL = 'flisk.golden.hash'
 
 # Shell template for the golden build. Placeholders (@@...@@) are replaced in
 # build_golden_layers(); plain `$VAR` references are expanded by the shell.
@@ -17,7 +17,7 @@ ROOT="$(cd "$ROOT_REL" && pwd)"
 HASH="$(cat "$DF" | (sha256sum 2>/dev/null || shasum -a 256) | cut -c1-64)"
 IMAGES="@@IMAGES@@"
 
-if [ -z "$TDK_GOLDEN_REBUILD" ]; then
+if [ -z "$FLISK_GOLDEN_REBUILD" ]; then
   fresh=1
   for img in $IMAGES; do
     [ "$(docker image inspect -f '{{index .Config.Labels "@@HASH_LABEL@@"}}' "$img" 2>/dev/null)" = "$HASH" ] || fresh=0
@@ -74,14 +74,14 @@ def build_golden_layers(project_root='.'):
 
     project_root: path back to the project root from wherever
     local_resource cmds actually run (the Tiltfile's own directory,
-    .tdk/.tdk-out/ - not the project root), e.g. '../../'. GOLDEN_DOCKERFILE
+    .flisk/.flisk-out/ - not the project root), e.g. '../../'. GOLDEN_DOCKERFILE
     is itself project-root-relative, so it must be prefixed with this to
     resolve correctly - passing project_root='.' (the default) only works
     when the Tiltfile happens to live at the project root.
 
     The build is skipped when every golden image already exists with a
-    `tdk.golden.hash` label matching the current Dockerfile. Set
-    TDK_GOLDEN_REBUILD=1 to force a rebuild. Otherwise all targets are built
+    `flisk.golden.hash` label matching the current Dockerfile. Set
+    FLISK_GOLDEN_REBUILD=1 to force a rebuild. Otherwise all targets are built
     with one `docker buildx bake`, falling back to serial `docker build` when
     buildx is not installed.
     """

package/{engine → runtime/engine}/topologies/platform/docker/build/golden_image_constants.star

@@ -3,23 +3,23 @@
 # =============================================================================
 
 # Load project configuration to get the project name as prefix
-# Falls back to 'tdk-project' if project.json is not found
-# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+# Falls back to 'flisk-project' if project.json is not found
+# Use FLISK_PROJECT_ROOT env var set by Tilt, fallback to current directory
 def _load_golden_prefix():
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
-    project_json_path = '.tdk/project.json'
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
+    project_json_path = '.flisk/project.json'
     if project_root:
         project_json_path = project_root + '/' + project_json_path
     
     if os.path.exists(project_json_path):
         _project_json = read_json(project_json_path)
-        return _project_json.get('project', {}).get('name', 'tdk-project')
-    return 'tdk-project'
+        return _project_json.get('project', {}).get('name', 'flisk-project')
+    return 'flisk-project'
 
 _GOLDEN_IMAGE_PREFIX = _load_golden_prefix()
 
 GOLDEN_IMAGE_PREFIX = _GOLDEN_IMAGE_PREFIX
-GOLDEN_DOCKERFILE = '.tdk/.tdk-out/golden-layers.Dockerfile'
+GOLDEN_DOCKERFILE = '.flisk/.flisk-out/golden-layers.Dockerfile'
 
 GOLDEN_LAYERS = {
     'l1': {

package/{engine → runtime/engine}/topologies/platform/docker/build/golden_image_dockerfile.star

@@ -7,17 +7,17 @@ load('../config/healthcheck.star', 'DOCKER_HEALTHCHECK', 'dockerfile_healthcheck
 
 
 # Load project name for dynamic naming
-# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+# Use FLISK_PROJECT_ROOT env var set by Tilt, fallback to current directory
 def _load_golden_prefix():
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
-    project_json_path = '.tdk/project.json'
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
+    project_json_path = '.flisk/project.json'
     if project_root:
         project_json_path = project_root + '/' + project_json_path
     
     if os.path.exists(project_json_path):
         _project_json = read_json(project_json_path)
-        return _project_json.get('project', {}).get('name', 'tdk-project')
-    return 'tdk-project'
+        return _project_json.get('project', {}).get('name', 'flisk-project')
+    return 'flisk-project'
 
 _GOLDEN_PREFIX = _load_golden_prefix()
 
@@ -166,9 +166,9 @@ ENV BUN_OPTIONS=--smol
 USER bun
 
 # Backend-specific healthcheck: probes the service over HTTP. The image is shared by every backend,
-# so the port and path come from the container env (PORT is set by compose, TDK_HEALTH_PATH is optional).
+# so the port and path come from the container env (PORT is set by compose, FLISK_HEALTH_PATH is optional).
 HEALTHCHECK {hc_flags} \
-  CMD bun -e "fetch('http://127.0.0.1:'+process.env.PORT+(process.env.TDK_HEALTH_PATH||'/health')).then(r=>process.exit(r.ok?0:1),()=>process.exit(1))" || exit 1
+  CMD bun -e "fetch('http://127.0.0.1:'+process.env.PORT+(process.env.FLISK_HEALTH_PATH||'/health')).then(r=>process.exit(r.ok?0:1),()=>process.exit(1))" || exit 1
 
 WORKDIR /app
 
@@ -197,7 +197,7 @@ USER app
 
 # Backend-specific healthcheck: probes the service over HTTP (port and path from container env, see the Bun stage)
 HEALTHCHECK {hc_flags} \
-  CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+(process.env.TDK_HEALTH_PATH||'/health')).then(r=>process.exit(r.ok?0:1),()=>process.exit(1))" || exit 1
+  CMD node -e "fetch('http://127.0.0.1:'+process.env.PORT+(process.env.FLISK_HEALTH_PATH||'/health')).then(r=>process.exit(r.ok?0:1),()=>process.exit(1))" || exit 1
 
 WORKDIR /app
 

package/{engine → runtime/engine}/topologies/platform/docker/compose/compose.star

@@ -31,17 +31,17 @@ load("../constants.star", "PlatformDockerConstants")
 load("../config/healthcheck.star", "DOCKER_HEALTHCHECK", "compose_healthcheck_timing")
 
 # Load project name for dynamic host naming
-# Use TDK_PROJECT_ROOT env var set by Tilt, fallback to current directory
+# Use FLISK_PROJECT_ROOT env var set by Tilt, fallback to current directory
 def _load_project_name():
-    project_root = os.environ.get('TDK_PROJECT_ROOT', '')
-    project_json_path = '.tdk/project.json'
+    project_root = os.environ.get('FLISK_PROJECT_ROOT', '')
+    project_json_path = '.flisk/project.json'
     if project_root:
         project_json_path = project_root + '/' + project_json_path
     
     if os.path.exists(project_json_path):
         _project_json = read_json(project_json_path)
-        return _project_json.get('project', {}).get('name', 'tdk-project')
-    return 'tdk-project'
+        return _project_json.get('project', {}).get('name', 'flisk-project')
+    return 'flisk-project'
 
 _PROJECT_NAME = _load_project_name()
 
@@ -201,7 +201,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
     auth_config = AuthConfig.from_manifest(manifest)
     
     auth_env = AuthConfig.generate_docker_compose_auth_env(auth_config)
-    # secrets.required / secrets.optional, read from the project .env by Compose (empty with TDK_SECRET_PROVIDER=infisical)
+    # secrets.required / secrets.optional, read from the project .env by Compose (empty with FLISK_SECRET_PROVIDER=infisical)
     secrets_env = get_secret_environment_lines(manifest, res_name)
     
     byo_image = reject_unsafe_value(manifest.get('image'), 'image') if manifest else None
@@ -272,7 +272,7 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
     # No HTTP server means no HTTP probe. Disable explicitly: the image HEALTHCHECK would otherwise probe a port nothing listens on.
     no_http_healthcheck_section = NO_HTTP_HEALTHCHECK if (is_worker or health_path == None) else ""
     # Backends with a health path get it in the env, so the shared golden image's HEALTHCHECK can probe it.
-    health_env = "      - TDK_HEALTH_PATH={}\n".format(health_path) if health_path else ""
+    health_env = "      - FLISK_HEALTH_PATH={}\n".format(health_path) if health_path else ""
     # An agent with files durability keeps its session checkpoints in a named volume. The volume is declared at the top of the
     # generated file (generate_app_compose_from_entries reads the marker line below), so flisk down keeps it.
     agent_env = ""
@@ -282,8 +282,8 @@ def _generate_single_backend_entry(resource_path, resource_name, res, manifest,
         agent_env = "      - AGENT_DURABILITY={}\n".format(agent_durability)
         if agent_durability == 'files':
             agent_volume = res_name + '-agent-state'
-            agent_env += "      - AGENT_STATE_DIR=/var/lib/tdk-agent\n"
-            agent_volume_section = "    # tdk-agent-volume: {vol}\n    volumes:\n      - {vol}:/var/lib/tdk-agent\n".format(vol=agent_volume)
+            agent_env += "      - AGENT_STATE_DIR=/var/lib/flisk-agent\n"
+            agent_volume_section = "    # flisk-agent-volume: {vol}\n    volumes:\n      - {vol}:/var/lib/flisk-agent\n".format(vol=agent_volume)
 
     if is_worker or is_proxy_disabled_byo:
         traefik_labels = '      - "traefik.enable=false"'
@@ -526,12 +526,12 @@ services:
 """.format(port_anchors=port_anchors)
 
     # Named volumes used by services (agent session state) must be declared at the top level. Services mark them with a
-    # "# tdk-agent-volume: <name>" line, so the declaration follows the services without a separate registry.
+    # "# flisk-agent-volume: <name>" line, so the declaration follows the services without a separate registry.
     volume_names = []
     for entry in resource_entries:
         for line in entry.split("\n"):
-            if line.strip().startswith("# tdk-agent-volume: "):
-                name = line.strip()[len("# tdk-agent-volume: "):]
+            if line.strip().startswith("# flisk-agent-volume: "):
+                name = line.strip()[len("# flisk-agent-volume: "):]
                 # Replicas of one agent repeat the marker; Compose rejects a duplicate key under volumes:.
                 if name not in volume_names:
                     volume_names.append(name)

package/{engine → runtime/engine}/topologies/platform/docker/compose/traefik_standalone.star

@@ -80,12 +80,13 @@ volumes:
             name=name,
             gateway_container=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_CONTAINER,
             gateway_port=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_PORT,
-            vendored_gateway_dir="tdk-cli-ext/engine/assets/docker/wake-gateway",
+            vendored_gateway_dir="flisk-cli-ext/engine/assets/docker/wake-gateway",
             tilt_dev_dir=os.environ.get("HOME", "") + "/.tilt-dev",
             project_root_mount=_project_root_mount(),
+            docker_socket_gid=_docker_socket_gid(),
         ) if sablier_enabled else "",
         dynamic_dir_name=PlatformDockerConstants.TRAEFIK_DYNAMIC_DIR_REL.split("/")[-1],
-        vendored_gateway_dir="tdk-cli-ext/engine/assets/docker/wake-gateway",
+        vendored_gateway_dir="flisk-cli-ext/engine/assets/docker/wake-gateway",
         gateway_container=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_CONTAINER,
         gateway_port=PlatformDockerConstants.TRAEFIK_WAKE_GATEWAY_PORT,
         tilt_dev_dir=os.environ.get("HOME", "") + "/.tilt-dev",
@@ -95,6 +96,16 @@ volumes:
     )
 
 
+def _docker_socket_gid():
+    """Group ID the wake gateway joins to reach /var/run/docker.sock.
+
+    Docker Desktop exposes the socket as root:root (gid 0). On Linux hosts it
+    is usually root:docker, whose gid varies, so set FLISK_DOCKER_SOCKET_GID to
+    the socket's gid there (`stat -c %g /var/run/docker.sock`).
+    """
+    return os.environ.get("FLISK_DOCKER_SOCKET_GID", "0")
+
+
 def _project_root_mount():
     """Read-only mount of the project at its own absolute host path.
 
@@ -102,7 +113,7 @@ def _project_root_mount():
     itself (bypassing Tilt's build queue), using the compose files Tilt uses.
     Compose resolves relative paths in them (env_file etc.) client-side, so
     they must exist at the same absolute paths inside the gateway container.
-    Empty when TDK_PROJECT_ROOT is unset (the generated Tiltfile sets it).
+    Empty when FLISK_PROJECT_ROOT is unset (the generated Tiltfile sets it).
     """
     root = project_root_abspath()
     if not root:
@@ -111,8 +122,8 @@ def _project_root_mount():
 
 
 def project_root_abspath():
-    """Absolute, normalized project root (TDK_PROJECT_ROOT), or "" when unset."""
-    return normalize_abs_path(os.environ.get("TDK_PROJECT_ROOT", ""))
+    """Absolute, normalized project root (FLISK_PROJECT_ROOT), or "" when unset."""
+    return normalize_abs_path(os.environ.get("FLISK_PROJECT_ROOT", ""))
 
 
 _SABLIER_DEPENDS_ON = """    depends_on:
@@ -162,9 +173,13 @@ _SABLIER_SERVICES = """  sablier:
       - TILT_PORT=10350
       - SABLIER_URL=http://sablier:10000
       - PORT={gateway_port}
+    # Non-root (see the Dockerfile): the Docker socket is root-owned, so the
+    # gateway joins the socket's group instead of running as root.
+    group_add:
+      - "{docker_socket_gid}"
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - {tilt_dev_dir}:/root/.tilt-dev:ro{project_root_mount}
+      - {tilt_dev_dir}:/home/bun/.tilt-dev:ro{project_root_mount}
     networks:
       - traefik-public