@flisk-sh/flisk 0.0.0-stage → 1.3.189

package/cli/dist/commands/resource.js

@@ -0,0 +1,992 @@
+// Copyright (c) 2026 Flisk Landscape contributors
+// SPDX-License-Identifier: MIT
+import { existsSync, mkdirSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+import chalk from "chalk";
+import { Command } from "commander";
+import { DEFAULT_AGENT_RUNTIME, resolveAgentDurability, resolveAgentRuntime, } from "../agent-runtimes/registry.js";
+import { DEFAULT_BACKEND_FRAMEWORK, listBackendFrameworks, resolveBackendFramework, } from "../backend-frameworks/registry.js";
+import { getBackendIndexTemplate, getDrizzleBackendIndexTemplate, } from "../backend-languages/bun.js";
+import { resolveBackendLanguage } from "../backend-languages/registry.js";
+import { DEFAULT_FRONTEND_FRAMEWORK, listFrontendFrameworks, resolveFrontendFramework, } from "../frontend-frameworks/registry.js";
+import { hasDddLicense } from "../generator/extension-fetch.js";
+import { getDockerfileTemplate, getTestTemplate, getWorkerIndexTemplate, } from "../generator/resource-templates.js";
+import { RESOURCE_TYPE_VALUES } from "../types/index.js";
+import { addYesOption, assertValid, confirmOrCancel } from "../utils/command-helpers.js";
+import { AUTOGENERATED_DIR, BRING_YOUR_OWN_TYPE, PACKAGE_JSON, PORT_RANGES, SERVICE_JSON, } from "../utils/constants.js";
+import { clearDiscoveryCache } from "../utils/discovery-context.js";
+import { chooseResourcePath, isPathDiscovered, readDiscoveryPaths, } from "../utils/discovery-paths.js";
+import { errorFactories, requireProjectRoot, runCommand, TdkError } from "../utils/errors.js";
+import { writeFilesWithProgress } from "../utils/file-helpers.js";
+import { showCommandHeader } from "../utils/formatting.js";
+import { assignPort } from "../utils/port-assignment.js";
+import { promptSelect, promptText } from "../utils/prompt.js";
+import { getDefaultFeaturesForResourceType } from "../utils/resource-features.js";
+import { SERVICE_MANIFEST_SCHEMA_URL, SERVICE_MANIFEST_SCHEMA_VERSION, } from "../utils/service-manifest.js";
+import { discoverResources } from "../utils/services.js";
+import { createKebabCaseValidator, isPathSafe, validateResourceName, validateStackName, } from "../utils/validation.js";
+export { getDockerfileTemplate, getShutdownHandlerTemplate, getTestTemplate, getWorkerIndexTemplate, } from "../generator/resource-templates.js";
+export const BASE_TEMPLATE = {
+    port: 0, // Will be assigned
+    // `dependsOn` is the current name; `dependencies` is deprecated and `flisk doctor` warns about it, so a fresh scaffold must not write it.
+    dependsOn: [],
+    build: {
+        dockerfile: "Dockerfile",
+        context: ".",
+    },
+    dev: {
+        command: "bun run dev",
+        watch: ["src/**/*"],
+    },
+};
+export const TYPE_SPECIFIC = {
+    backend: {
+        healthCheckPath: "/health",
+    },
+    frontend: {
+        dev: {
+            command: "bun run dev",
+            watch: ["src/**/*", "public/**/*"],
+        },
+    },
+    worker: {
+        dev: {
+            command: "bun run worker",
+            watch: ["src/**/*"],
+        },
+    },
+    mcp: {
+        healthCheckPath: "/health",
+    },
+    // /ready is the readiness route (checkpoint store reachable); /health is liveness only, so an idle agent stays healthy.
+    agent: {
+        healthCheckPath: "/health",
+    },
+    [BRING_YOUR_OWN_TYPE]: {
+        healthCheckPath: "/health",
+    },
+};
+const BYO_RESTART_POLICIES = ["no", "on-failure", "unless-stopped", "always"];
+export function resolveByoPort(value, assignedPort, resources) {
+    return resolveResourcePort(BRING_YOUR_OWN_TYPE, value, assignedPort, resources);
+}
+// `--port` is an override for every port-assigned type, validated against that type's range.
+// Without it the next free port in the type's range is used.
+export function resolveResourcePort(resourceType, value, assignedPort, resources) {
+    if (!value)
+        return assignedPort;
+    const { min, max } = PORT_RANGES[resourceType];
+    const flag = resourceType === BRING_YOUR_OWN_TYPE ? "BYO --port" : "--port";
+    const subject = resourceType === BRING_YOUR_OWN_TYPE ? "BYO port" : "Port";
+    if (!/^\d+$/.test(value)) {
+        throw new TdkError(`${flag} must be an integer from ${min} through ${max}.`);
+    }
+    const port = Number(value);
+    if (!Number.isInteger(port) || port < min || port > max) {
+        throw new TdkError(`${flag} must be an integer from ${min} through ${max}.`);
+    }
+    if (resources.some((resource) => resource.config?.port === port)) {
+        throw new TdkError(`${subject} ${port} is already assigned to another resource.`);
+    }
+    return port;
+}
+export function createServiceJson(name, type, stack, port, extraFeatures = [], frameworkId, languageId, agent) {
+    const framework = resolveFrontendFramework(type, frameworkId);
+    // Only an explicit selection is persisted: a missing `language` has always meant Bun.
+    const language = languageId === undefined ? undefined : resolveBackendLanguage(type, languageId);
+    // Likewise a missing backend `framework` has always meant Hono.
+    const backendFramework = resolveBackendFramework(type, frameworkId, language);
+    const typeSpecific = TYPE_SPECIFIC[type];
+    const base = JSON.parse(JSON.stringify(BASE_TEMPLATE));
+    for (const [key, value] of Object.entries(typeSpecific)) {
+        if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+            base[key] = { ...base[key], ...value };
+        }
+        else {
+            base[key] = value;
+        }
+    }
+    if (language?.devCommand) {
+        base.dev = { command: language.devCommand, watch: language.watch ?? base.dev.watch };
+        // The engine generates the image (.autogenerated/Dockerfile.app.autogenerated); a build
+        // block would point at a Dockerfile that does not exist.
+        delete base.build;
+    }
+    return {
+        ...base,
+        $schema: SERVICE_MANIFEST_SCHEMA_URL,
+        schemaVersion: SERVICE_MANIFEST_SCHEMA_VERSION,
+        appName: name,
+        appType: type,
+        featuresEnabled: [
+            ...getDefaultFeaturesForResourceType(type).filter(
+            // Prisma wiring is Bun-only; the Python provider owns their data layer.
+            (feature) => !(language?.createFiles && feature === "prisma")),
+            ...extraFeatures,
+        ],
+        name,
+        type,
+        stack,
+        port,
+        ...(framework ? { framework: framework.id } : {}),
+        ...(backendFramework && type !== "mcp" && type !== "agent"
+            ? { framework: backendFramework.id }
+            : {}),
+        ...(language ? { language: language.id } : {}),
+        ...(type === "agent" && agent ? { agent } : {}),
+    };
+}
+export function createByoServiceJson(name, stack, port, options) {
+    return {
+        $schema: SERVICE_MANIFEST_SCHEMA_URL,
+        schemaVersion: SERVICE_MANIFEST_SCHEMA_VERSION,
+        appName: name,
+        appType: BRING_YOUR_OWN_TYPE,
+        stack,
+        port,
+        healthCheckPath: options.healthCheckPath,
+        ...(options.image ? { image: options.image } : { dockerfile: options.dockerfile }),
+        ...(options.exposeViaProxy === false ? { exposeViaProxy: false } : {}),
+        ...(options.restart ? { restart: options.restart } : {}),
+    };
+}
+/**
+ * The Vite configs a frontend's `dev`/`build` scripts point at are written by the engine
+ * (Tilt loads the Starlark generator in `flisk up`), not by `flisk resource`. Without them
+ * `vite` stops with an esbuild "Could not resolve" stack trace, so the pre-scripts say what
+ * is missing instead. Inside the engine's image build the file exists and the check passes.
+ */
+function requireGeneratedViteConfig(configPath) {
+    // The text sits inside single quotes in a shell command: no quotes, backticks or parentheses.
+    const message = `${configPath} does not exist yet. Flisk engine writes it when flisk up loads this resource ` +
+        "(needs Docker); flisk resource and flisk config regenerate do not create it. " +
+        "Run flisk up <stack> once, or point this script at your own Vite config to build on the host.";
+    return `bun -e 'if(!require("fs").existsSync(${JSON.stringify(configPath)})){console.error(${JSON.stringify(message)});process.exit(1)}'`;
+}
+export function createPackageJson(name, type, frameworkId, prismaEnabled = false, agentConfig, drizzleEnabled = false) {
+    const isFrontend = type === "frontend";
+    const framework = resolveFrontendFramework(type, frameworkId);
+    const backendFramework = resolveBackendFramework(type, frameworkId);
+    const isPostgresAgent = type === "agent" && agentConfig?.durability === "postgres";
+    return {
+        name: `@project/${name}`,
+        version: "0.0.1",
+        type: "module",
+        scripts: {
+            ...(isFrontend
+                ? {
+                    predev: requireGeneratedViteConfig(`${AUTOGENERATED_DIR}/vite.config.frontend.autogenerated.ts`),
+                    prebuild: requireGeneratedViteConfig(`${AUTOGENERATED_DIR}/vite.config.build.autogenerated.ts`),
+                }
+                : {}),
+            dev: isFrontend
+                ? `vite --config ${AUTOGENERATED_DIR}/vite.config.frontend.autogenerated.ts`
+                : "bun run --watch src/index.ts",
+            build: isFrontend
+                ? `tsc && vite build --config ${AUTOGENERATED_DIR}/vite.config.build.autogenerated.ts`
+                : "tsc",
+            // Backends and workers run `start` in their production image; doctor checks for it.
+            ...(isFrontend ? {} : { start: "bun run dist/index.js" }),
+            test: "vitest",
+            lint: "biome check .",
+            "lint:fix": "biome check . --write",
+        },
+        dependencies: {
+            ...(isFrontend ? {} : (backendFramework?.dependencies ?? { hono: "^4.0.0" })),
+            ...(framework?.dependencies ?? {}),
+            ...(prismaEnabled || isPostgresAgent
+                ? {
+                    ...(prismaEnabled
+                        ? {
+                            prisma: "^7.5.0",
+                            "@prisma/client": "^7.5.0",
+                            "@prisma/adapter-pg": "^7.5.0",
+                        }
+                        : {}),
+                    pg: "^8.13.0",
+                }
+                : {}),
+            ...(drizzleEnabled ? { "drizzle-orm": DRIZZLE_ORM_RANGE, pg: PG_RANGE } : {}),
+        },
+        devDependencies: {
+            "@types/bun": "^1.4.2",
+            // The generated Docker tsconfig sets "types": ["node"]; without this the
+            // image's `bun run build` fails with TS2688. ^20 matches the services that build.
+            "@types/node": "^20.0.0",
+            typescript: "^7.0.2",
+            vitest: "^5.0.0",
+            "@biomejs/biome": "^2.5.13",
+            // vitest 5 peers on vite ^6.4.0 || ^7 || ^8; vite 5 makes `vitest run` fail at startup with
+            // ERR_PACKAGE_PATH_NOT_EXPORTED ('./module-runner'), in every resource once it is hoisted.
+            ...(isFrontend ? { vite: "^6.4.1" } : {}),
+            ...(drizzleEnabled ? { "drizzle-kit": DRIZZLE_KIT_RANGE, "@types/pg": "^8.11.0" } : {}),
+            ...(framework?.devDependencies ?? {}),
+            ...(backendFramework?.devDependencies ?? {}),
+        },
+    };
+}
+export const PRISMA_SCHEMA_TEMPLATE = `generator client {
+  provider = "prisma-client"
+  output   = "../generated/prisma"
+}
+
+datasource db {
+  provider = "postgresql"
+}
+`;
+export const PRISMA_CONFIG_TEMPLATE = `export default {
+  schema: "prisma/schema.prisma",
+  datasource: {
+    url: process.env.DATABASE_URL,
+  },
+};
+`;
+/** Version ranges for `--feature drizzle`; `drizzle-kit` must stay on the same minor as `drizzle-orm`. */
+export const DRIZZLE_ORM_RANGE = "^0.44.7";
+export const DRIZZLE_KIT_RANGE = "^0.31.8";
+const PG_RANGE = "^8.13.0";
+export const DRIZZLE_DB_TEMPLATE = `import { drizzle } from 'drizzle-orm/node-postgres';
+import { Pool } from 'pg';
+
+// DATABASE_URL is injected by Flisk. The pool connects on the first query, so a missing or
+// unreachable database fails /health/db instead of stopping the service at startup.
+export const pool = new Pool({ connectionString: process.env.DATABASE_URL });
+export const db = drizzle(pool);
+`;
+export const DRIZZLE_SCHEMA_TEMPLATE = `// Define tables here, for example with pgTable from 'drizzle-orm/pg-core'.
+export {};
+`;
+export const DRIZZLE_CONFIG_TEMPLATE = `import { defineConfig } from 'drizzle-kit';
+
+export default defineConfig({
+  dialect: 'postgresql',
+  schema: './src/schema.ts',
+  out: './drizzle',
+  dbCredentials: { url: process.env.DATABASE_URL ?? '' },
+});
+`;
+export function createResourceTsconfig(resourceType, frameworkId) {
+    const framework = resolveFrontendFramework(resourceType, frameworkId);
+    const backendFramework = resolveBackendFramework(resourceType, frameworkId);
+    return {
+        ...TSCONFIG_TEMPLATE,
+        compilerOptions: {
+            ...TSCONFIG_TEMPLATE.compilerOptions,
+            // TypeScript 7 does not auto-include @types/*: without this, `tsc` fails with TS2591 on
+            // `process`/`Buffer`. "node" matches the generated Docker tsconfig. Frontends target the
+            // DOM and keep the default.
+            ...(resourceType === "frontend" ? {} : { types: ["node"] }),
+            ...(framework?.compilerOptions ?? {}),
+            ...(backendFramework?.compilerOptions ?? {}),
+        },
+    };
+}
+export const TSCONFIG_TEMPLATE = {
+    compilerOptions: {
+        target: "ES2022",
+        module: "ESNext",
+        moduleResolution: "bundler",
+        strict: true,
+        esModuleInterop: true,
+        skipLibCheck: true,
+        forceConsistentCasingInFileNames: true,
+        outDir: "./dist",
+        rootDir: "./src",
+        declaration: true,
+        declarationMap: true,
+        sourceMap: true,
+    },
+    include: ["src/**/*"],
+    exclude: ["node_modules", "dist"],
+};
+export { getBackendIndexTemplate, getDrizzleBackendIndexTemplate };
+/** Resource types `flisk resource --type` accepts; `byo` is an alias of `bring-your-own`. */
+export function parseResourceType(type) {
+    const normalized = type === "byo" ? BRING_YOUR_OWN_TYPE : type;
+    const validTypes = [...RESOURCE_TYPE_VALUES];
+    if (!validTypes.includes(normalized)) {
+        throw new TdkError(`Unknown resource type "${type}". Supported types: ${validTypes.join(", ")}.`, [`Use one of: ${validTypes.join(", ")}`, "Omit --type to create a backend"]);
+    }
+    return normalized;
+}
+/**
+ * Parse an existing `service.json` manifest.
+ *
+ * Wraps JSON syntax errors in a `TdkError` that names the offending file, so a malformed manifest
+ * is reported as a CLI error instead of an unhandled `SyntaxError`. Only the JSON syntax is
+ * checked here: the manifest fields themselves are not validated, and a syntactically valid file
+ * is returned as-is, including unknown or missing fields.
+ *
+ * @param content - The raw contents of the `service.json` file.
+ * @param configPath - Path to the manifest, used in the error message.
+ * @returns The parsed manifest.
+ * @throws TdkError When the content is not valid JSON.
+ */
+export function parseExistingServiceJson(content, configPath) {
+    try {
+        return JSON.parse(content);
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw new TdkError(`Could not parse service.json at ${configPath}: ${reason}`);
+    }
+}
+/**
+ * Prints the framework inventory for the requested resource type.
+ *
+ * Without an explicit `--type` the listing stays the historical frontend one, byte for byte, so
+ * `flisk resource --frameworks` keeps working exactly as before: `--language` is a backend option and
+ * never applies to it. `--type frontend` and `--type backend` list that type's frameworks, and the
+ * backend listing carries the language (and runtime) each framework is scaffolded with.
+ */
+function printFrameworkInventory(options, isTypeExplicit) {
+    // No explicit `--type` means the historical frontend listing, so `--language` is not applied to it:
+    // it is a backend option, and the frontend listing has never carried one.
+    if (!isTypeExplicit) {
+        printFrontendFrameworks();
+        return;
+    }
+    const resourceType = parseResourceType(options.type ?? "backend");
+    if (resourceType !== "frontend" && resourceType !== "backend") {
+        throw new TdkError(`No frameworks are registered for --type ${resourceType}.`, [
+            "Use --type frontend or --type backend to list frameworks",
+            "Omit --type to list the frontend frameworks",
+        ]);
+    }
+    // `--language` belongs to backends only, so the resource command rejects it for every other type.
+    const language = resolveBackendLanguage(resourceType, options.language);
+    if (resourceType === "frontend") {
+        printFrontendFrameworks();
+        return;
+    }
+    for (const f of listBackendFrameworks(options.language)) {
+        // The compatibility cell names the language it is judged against, so it is never a bare
+        // "compatible" that could be read against a different language.
+        const compatibility = f.compatible
+            ? `compatible with ${language?.id}`
+            : `incompatible with --language ${language?.id}`;
+        console.log(`${f.id}\t${f.label}\t${f.languages.join(", ")}\t${compatibility}\t${f.command}`);
+    }
+}
+/** The historical frontend listing: id, display name, kind, verification, command. */
+function printFrontendFrameworks() {
+    for (const f of listFrontendFrameworks()) {
+        console.log(`${f.id}\t${f.label}\t${f.kind}\t${f.verified ? "verified" : "unverified"}\t${f.command}`);
+    }
+}
+export const resourceCommand = addYesOption(new Command("resource"))
+    .description("Create a new resource (service) from scratch, or register an existing one")
+    .argument("[name]", "Resource name (kebab-case)")
+    .option("-t, --type <type>", "Resource type: backend, frontend, worker, mcp, agent, bring-your-own, sdk", "backend")
+    .option("--framework <id>", "Framework: frontend react (default), vue, svelte, preact, lit, solid, qwik, vanilla, tanstack-router; backend hono (default), express, elysia, fastify, nestjs, koa, h3 (list them with --frameworks)")
+    .option("--frameworks", "List registered frameworks for the resource type and exit (--type frontend, --type backend)")
+    .option("--language <id>", "Backend language: bun (default), python, go, rust, node")
+    .option("-s, --stack <stack>", "Stack to assign resource to", "default")
+    .option("-p, --path <path>", "Custom path for resource directory")
+    .option("--resource-path <path>", "Alias for --path (for backward compatibility)")
+    .option("--register-existing", "Register an existing resource without creating templates")
+    .option("--ddd", "Scaffold DDD (domain-driven design) folders + path aliases (Premium - requires TDK_LICENSE_KEY)")
+    .option("--dockerfile <path>", "Path to Dockerfile relative to resource dir (for bring-your-own)")
+    .option("--health-path <path>", "HTTP health check path (for bring-your-own)", "/health")
+    .option("--no-proxy", "Disable the Traefik route (bring-your-own only)")
+    .option("--restart <policy>", "Compose restart policy: no, on-failure, unless-stopped, always (bring-your-own only; use no for one-shot jobs)")
+    .option("--image <name>", "Docker image name instead of building from Dockerfile (for bring-your-own)")
+    .option("--port <port>", "Port for the resource, within its type's range (default: next free port in that range)")
+    .option("--feature <feature...>", "Enable a resource feature (for example: prisma, drizzle)")
+    .option("--runtime <id>", "Agent runtime (for agent only): custom (default)")
+    .option("--durability <kind>", "Where agent sessions are checkpointed (for agent only): files (default, named volume) or postgres")
+    .action(async (name, options, command) => {
+    if (options.frameworks) {
+        await runCommand(async () => {
+            // The frontend listing is the historical default; `--type` selects the listing when it is given.
+            printFrameworkInventory(options, command.getOptionValueSource("type") === "cli");
+        });
+        return;
+    }
+    await runCommand(async () => {
+        const projectRoot = requireProjectRoot();
+        // Support --resource-path as alias for --path
+        const resourcePath = options.resourcePath || options.path;
+        showCommandHeader("Resource Creation");
+        const allResources = discoverResources();
+        let resourceName = name;
+        if (!resourceName && options.yes) {
+            throw new TdkError("A resource name is required when using --yes.", [
+                "Pass the name explicitly, for example: flisk resource api --yes.",
+            ]);
+        }
+        if (!resourceName) {
+            const inputName = await promptText({
+                message: "Resource name (kebab-case):",
+                validate: (input) => {
+                    const validation = createKebabCaseValidator("resource")(input);
+                    return validation === true || validation;
+                },
+            });
+            resourceName = inputName;
+        }
+        else {
+            assertValid(validateResourceName(resourceName));
+        }
+        const resourceType = parseResourceType(options.type);
+        if (resourceType !== "agent" &&
+            (options.runtime !== undefined || options.durability !== undefined)) {
+            throw new TdkError("--runtime and --durability can only be used with --type agent.", [
+                "Drop --runtime and --durability, or pass --type agent",
+            ]);
+        }
+        // Validate the agent options before anything is written, so a bad flag leaves no half-scaffolded directory.
+        let agentConfig;
+        if (resourceType === "agent") {
+            resolveAgentRuntime(options.runtime);
+            agentConfig = {
+                runtime: options.runtime ?? DEFAULT_AGENT_RUNTIME,
+                durability: resolveAgentDurability(options.durability),
+            };
+        }
+        let frameworkOption = options.framework;
+        if (resourceType === "frontend" &&
+            frameworkOption === undefined &&
+            !options.yes &&
+            process.stdin.isTTY) {
+            frameworkOption = await promptSelect({
+                message: "Frontend framework:",
+                choices: listFrontendFrameworks()
+                    .map((f) => ({ title: f.label, value: f.id }))
+                    .sort((a, b) => a.value === DEFAULT_FRONTEND_FRAMEWORK
+                    ? -1
+                    : b.value === DEFAULT_FRONTEND_FRAMEWORK
+                        ? 1
+                        : 0),
+            });
+        }
+        const frontendFramework = resolveFrontendFramework(resourceType, frameworkOption, resourceName);
+        const backendLanguage = resolveBackendLanguage(resourceType, options.language);
+        // A backend on a language that owns its runtime (python, go, rust, node) has no framework to
+        // pick: `resolveBackendFramework` rejects that combination, so the prompt only offers the
+        // frameworks the resolver accepts.
+        const backendFrameworkChoices = resourceType === "backend"
+            ? listBackendFrameworks(options.language).filter((framework) => framework.compatible)
+            : [];
+        if (resourceType === "backend" &&
+            frameworkOption === undefined &&
+            !options.yes &&
+            process.stdin.isTTY &&
+            backendFrameworkChoices.length > 0) {
+            frameworkOption = await promptSelect({
+                message: "Backend framework:",
+                choices: backendFrameworkChoices
+                    .map((f) => ({ title: f.label, value: f.id }))
+                    .sort((a, b) => a.value === DEFAULT_BACKEND_FRAMEWORK
+                    ? -1
+                    : b.value === DEFAULT_BACKEND_FRAMEWORK
+                        ? 1
+                        : 0),
+            });
+        }
+        const backendFramework = resolveBackendFramework(resourceType, frameworkOption, backendLanguage);
+        // The id passed on to the file generators. An mcp resource has one fixed scaffold and no `framework` setting, so it passes none
+        // (its provider is selected by the resource type itself).
+        const scaffoldFrameworkId = resourceType === "mcp" || resourceType === "agent"
+            ? undefined
+            : (frontendFramework?.id ?? backendFramework?.id);
+        let dddEnabled = false;
+        if (options.ddd) {
+            if (resourceType !== "backend" && resourceType !== "worker") {
+                console.log(chalk.yellow(`\n⚠️  --ddd only applies to backend/worker resources, ignoring for type "${resourceType}"`));
+            }
+            else {
+                const granted = await hasDddLicense(projectRoot);
+                if (!granted) {
+                    throw new Error("DDD scaffolding is a Premium feature and requires a license key that grants it. " +
+                        "Set export TDK_LICENSE_KEY=<key> (request a Premium license at https://tdk-landscape.github.io/tdk-website/#waitlist) and try again.");
+                }
+                dddEnabled = true;
+            }
+        }
+        assertValid(validateStackName(options.stack));
+        let stackName = options.stack;
+        if (stackName === "default") {
+            const existingResources = allResources;
+            const stackSet = new Set();
+            for (const r of existingResources) {
+                if (r.stack)
+                    stackSet.add(r.stack);
+            }
+            const existingStacks = Array.from(stackSet);
+            if (existingStacks.length > 0) {
+                if (options.yes) {
+                    if (existingStacks.length > 1) {
+                        throw new TdkError("Multiple stacks exist; specify --stack when using --yes.", [
+                            `Available stacks: ${existingStacks.join(", ")}`,
+                        ]);
+                    }
+                    stackName = existingStacks[0] ?? "main";
+                }
+                else {
+                    const selectedStack = await promptSelect({
+                        message: "Assign to stack:",
+                        choices: [
+                            ...existingStacks.map((s) => ({ title: s, value: s })),
+                            { title: "Create new stack", value: "__new__" },
+                        ],
+                    });
+                    if (selectedStack === "__new__") {
+                        const newStack = await promptText({
+                            message: "New stack name:",
+                            validate: (input) => {
+                                const validation = createKebabCaseValidator("stack")(input);
+                                return validation === true || validation;
+                            },
+                        });
+                        stackName = newStack;
+                    }
+                    else {
+                        stackName = selectedStack;
+                    }
+                }
+            }
+            else if (options.yes) {
+                stackName = "main";
+            }
+            else {
+                const newStack = await promptText({
+                    message: "Stack name (first resource):",
+                    initial: "main",
+                    validate: (input) => {
+                        const validation = createKebabCaseValidator("stack")(input);
+                        return validation === true || validation;
+                    },
+                });
+                stackName = newStack;
+            }
+        }
+        let finalResourcePath = resourcePath;
+        let pathAdjustedFrom;
+        if (!finalResourcePath) {
+            const defaultPaths = {
+                backend: `services/${stackName}/${resourceName}`,
+                frontend: `apps/${resourceName}`,
+                worker: `workers/${resourceName}`,
+                mcp: `services/${stackName}/${resourceName}`,
+                agent: `services/${stackName}/${resourceName}`,
+                [BRING_YOUR_OWN_TYPE]: `services/${stackName}/${resourceName}`,
+                sdk: `packages/${resourceName}`,
+            };
+            finalResourcePath = defaultPaths[resourceType];
+            // An SDK is registered where it already lives, so its folder is never moved.
+            if (resourceType !== "sdk") {
+                const chosen = chooseResourcePath(projectRoot, finalResourcePath, stackName, resourceName);
+                finalResourcePath = chosen.path;
+                pathAdjustedFrom = chosen.adjustedFrom;
+            }
+        }
+        const fullPath = resolve(projectRoot, finalResourcePath);
+        // Prevent path traversal attacks
+        const relativePathResult = relative(projectRoot, fullPath);
+        if (relativePathResult.startsWith("..") || isAbsolute(relativePathResult)) {
+            errorFactories.invalidPath(fullPath).exit();
+        }
+        if (!isPathSafe(finalResourcePath)) {
+            errorFactories.invalidPath(finalResourcePath).exit();
+        }
+        // Check if resource already exists
+        const isExistingResource = existsSync(fullPath);
+        const hasServiceJson = existsSync(resolve(fullPath, SERVICE_JSON));
+        if (options.port !== undefined && resourceType === "sdk") {
+            throw new TdkError("--port does not apply to --type sdk.", [
+                "Drop --port, or use a service type",
+            ]);
+        }
+        if (resourceType === "sdk" && !hasServiceJson) {
+            throw new TdkError(`No service.json in ${finalResourcePath}`, [
+                'Add one with "appType": "sdk", then run this again to register it',
+            ]);
+        }
+        const shouldRegisterExisting = options.registerExisting ||
+            resourceType === "sdk" ||
+            (isExistingResource && hasServiceJson);
+        if (isExistingResource && !shouldRegisterExisting && resourceType !== BRING_YOUR_OWN_TYPE) {
+            errorFactories.directoryExists(fullPath).exit();
+        }
+        const nextPort = resourceType === "sdk"
+            ? 0
+            : assignPort(resourceType, allResources);
+        if (options.restart !== undefined) {
+            if (resourceType !== BRING_YOUR_OWN_TYPE) {
+                throw new TdkError("--restart can only be used with --type bring-your-own.", [
+                    "Add --type bring-your-own, or drop --restart",
+                ]);
+            }
+            if (!BYO_RESTART_POLICIES.includes(options.restart)) {
+                throw new TdkError(`Unknown --restart policy "${options.restart}".`, [
+                    `Use one of: ${BYO_RESTART_POLICIES.join(", ")}`,
+                ]);
+            }
+        }
+        // Checked before anything is written: the Drizzle files are Bun/TypeScript files for a backend.
+        const requestedFeatures = Array.isArray(options.feature) ? options.feature : [];
+        if (requestedFeatures.includes("drizzle") &&
+            (resourceType !== "backend" || backendLanguage?.createFiles)) {
+            throw new TdkError("--feature drizzle is only supported for Bun backends.", [
+                "Use --type backend without --language, or drop --feature drizzle",
+            ]);
+        }
+        const assignedPort = resourceType === "sdk"
+            ? 0
+            : resolveResourcePort(resourceType, options.port, nextPort, allResources);
+        console.log(chalk.gray("\nResource details:"));
+        console.log(chalk.gray(`  Name:  ${resourceName}`));
+        console.log(chalk.gray(`  Type:  ${resourceType}`));
+        console.log(chalk.gray(`  Stack: ${stackName}`));
+        console.log(chalk.gray(`  Port: ${assignedPort || "N/A (SDK)"}`));
+        console.log(chalk.gray(`  Path:  ${finalResourcePath}`));
+        if (shouldRegisterExisting && hasServiceJson) {
+            console.log(chalk.yellow("\n⚠️  Existing resource detected - will update service.json only"));
+        }
+        const confirmed = options.yes ||
+            (await confirmOrCancel(shouldRegisterExisting && hasServiceJson
+                ? "\nRegister existing resource?"
+                : "\nCreate resource?"));
+        if (!confirmed)
+            return;
+        // Handle existing resource registration
+        if (shouldRegisterExisting && hasServiceJson) {
+            // Read existing service.json
+            const { readFileSync } = await import("node:fs");
+            const existingServiceJsonPath = resolve(fullPath, SERVICE_JSON);
+            const existingContent = readFileSync(existingServiceJsonPath, "utf-8");
+            const existingServiceJson = parseExistingServiceJson(existingContent, existingServiceJsonPath);
+            // Update with new values while preserving existing fields
+            const updatedServiceJson = {
+                ...existingServiceJson,
+                $schema: existingServiceJson.$schema ?? SERVICE_MANIFEST_SCHEMA_URL,
+                schemaVersion: existingServiceJson.schemaVersion ?? SERVICE_MANIFEST_SCHEMA_VERSION,
+                appName: resourceName,
+                appType: resourceType === "sdk" ? "sdk" : existingServiceJson.appType || resourceType,
+                stack: stackName,
+                ...(assignedPort > 0 && { port: assignedPort }),
+            };
+            // Write updated service.json
+            const { writeFileSync } = await import("node:fs");
+            writeFileSync(existingServiceJsonPath, JSON.stringify(updatedServiceJson, null, 2));
+            clearDiscoveryCache();
+            console.log(chalk.green("\n✅ Existing resource registered successfully!"));
+            console.log(chalk.gray(`\nLocation: ${fullPath}`));
+            console.log(chalk.gray(`\nNext steps:`));
+            console.log(chalk.gray(`  flisk up ${stackName}`));
+            return;
+        }
+        // Handle bring-your-own type
+        if (resourceType === BRING_YOUR_OWN_TYPE) {
+            console.log(chalk.blue("\n📁 Creating bring-your-own resource..."));
+            // Parse port option
+            const port = assignedPort;
+            const dockerfile = options.dockerfile || "./Dockerfile";
+            const dockerfilePath = resolve(fullPath, dockerfile);
+            const dockerfileRelativePath = relative(fullPath, dockerfilePath);
+            if (isAbsolute(dockerfileRelativePath) ||
+                dockerfileRelativePath === ".." ||
+                dockerfileRelativePath.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) {
+                errorFactories.invalidPath(dockerfile).exit();
+            }
+            mkdirSync(fullPath, { recursive: true });
+            // Create service.json
+            const byoServiceJson = createByoServiceJson(resourceName, stackName, port, {
+                healthCheckPath: options.healthPath || "/health",
+                dockerfile,
+                ...(options.image ? { image: options.image } : {}),
+                ...(options.proxy === false ? { exposeViaProxy: false } : {}),
+                ...(options.restart ? { restart: options.restart } : {}),
+            });
+            const { writeFileSync } = await import("node:fs");
+            writeFileSync(resolve(fullPath, SERVICE_JSON), JSON.stringify(byoServiceJson, null, 2));
+            // Create Dockerfile stub if no image provided and dockerfile doesn't exist
+            if (!options.image && !existsSync(dockerfilePath)) {
+                mkdirSync(resolve(dockerfilePath, ".."), { recursive: true });
+                const healthConfigPath = resolve(dockerfilePath, "..", "health.conf");
+                const healthConfigRelativePath = relative(fullPath, healthConfigPath).replace(/\\/g, "/");
+                const dockerfileContent = `FROM nginx:1.27-alpine
+RUN apk add --no-cache curl
+COPY ${healthConfigRelativePath} /etc/nginx/conf.d/default.conf
+EXPOSE ${port}
+`;
+                writeFileSync(dockerfilePath, dockerfileContent);
+                const healthConfContent = `server {
+  listen ${port};
+  location /health {
+    default_type text/plain;
+    return 200 'ok';
+  }
+  location / {
+    default_type text/plain;
+    return 200 'byo';
+  }
+}
+`;
+                writeFileSync(healthConfigPath, healthConfContent);
+            }
+            // Create AGENTS.md
+            const agentsMdContent = `# AGENTS.md
+
+DO NOT DELETE service.json
+
+This file contains the resource configuration for Flisk.
+`;
+            const agentsPath = resolve(fullPath, "AGENTS.md");
+            if (!existsSync(agentsPath))
+                writeFileSync(agentsPath, agentsMdContent);
+            clearDiscoveryCache();
+            console.log(chalk.green("\n✅ Bring-your-own resource created successfully!"));
+            console.log(chalk.gray(`\nLocation: ${fullPath}`));
+            console.log(chalk.gray(`\nNext steps:`));
+            console.log(chalk.gray(`  flisk up ${stackName}`));
+            return;
+        }
+        // Create directory structure for new resources
+        console.log(chalk.blue("\n📁 Creating directory structure..."));
+        mkdirSync(fullPath, { recursive: true });
+        // A provider that owns its runtime files only gets the folders it writes into (Go keeps its files at the root).
+        const ownedTopLevel = new Set((backendLanguage?.createFiles?.(resourceName) ?? []).map((file) => file.filename.split("/")[0]));
+        for (const folder of ["src", "tests"]) {
+            if (!backendLanguage?.createFiles || ownedTopLevel.has(folder)) {
+                mkdirSync(resolve(fullPath, folder), { recursive: true });
+            }
+        }
+        if (resourceType === "frontend") {
+            mkdirSync(resolve(fullPath, "public"), { recursive: true });
+        }
+        if (dddEnabled) {
+            for (const layer of ["domain", "application", "infrastructure", "presentation"]) {
+                mkdirSync(resolve(fullPath, "src", layer), { recursive: true });
+            }
+        }
+        // Prepare file generation tasks
+        const prismaEnabled = requestedFeatures.includes("prisma");
+        const drizzleEnabled = requestedFeatures.includes("drizzle");
+        const serviceJson = createServiceJson(resourceName, resourceType, stackName, assignedPort, [...(dddEnabled ? ["ddd"] : []), ...requestedFeatures], scaffoldFrameworkId, options.language === undefined ? undefined : backendLanguage?.id, agentConfig);
+        const packageJson = createPackageJson(resourceName, resourceType, scaffoldFrameworkId, prismaEnabled, agentConfig, drizzleEnabled);
+        if (prismaEnabled && resourceType === "backend") {
+            serviceJson.dependsOn = [`${resourceName}-migrator`];
+        }
+        const tasks = [
+            {
+                type: "json",
+                filename: SERVICE_JSON,
+                content: serviceJson,
+                description: "Generating service.json",
+                emoji: "📝",
+            },
+            {
+                type: "json",
+                filename: PACKAGE_JSON,
+                content: packageJson,
+                description: "Generating package.json",
+                emoji: "📦",
+            },
+            {
+                type: "json",
+                filename: "tsconfig.json",
+                content: createResourceTsconfig(resourceType, scaffoldFrameworkId),
+                description: "Generating tsconfig.json",
+                emoji: "⚙️",
+            },
+            {
+                type: "text",
+                filename: "Dockerfile",
+                content: getDockerfileTemplate(serviceJson.port, typeof serviceJson.healthCheckPath === "string"
+                    ? serviceJson.healthCheckPath
+                    : undefined),
+                description: "Generating Dockerfile",
+                emoji: "🐳",
+            },
+        ];
+        // Add source files based on resource type
+        if (resourceType === "backend" || resourceType === "mcp" || resourceType === "agent") {
+            // The /health/db route is only written into the Bun + Hono template (the default framework).
+            const drizzleRouteTemplate = drizzleEnabled &&
+                resourceType === "backend" &&
+                (backendFramework?.id ?? "hono") === "hono"
+                ? getDrizzleBackendIndexTemplate
+                : undefined;
+            const indexContent = resourceType === "agent"
+                ? (backendFramework?.createIndex ?? getBackendIndexTemplate)(resourceName, agentConfig?.durability)
+                : drizzleRouteTemplate
+                    ? drizzleRouteTemplate(resourceName)
+                    : (backendFramework?.createIndex ?? getBackendIndexTemplate)(resourceName);
+            tasks.push({
+                type: "text",
+                filename: "src/index.ts",
+                content: indexContent,
+                description: resourceType === "mcp"
+                    ? "Generating MCP server source"
+                    : resourceType === "agent"
+                        ? "Generating agent source"
+                        : "Generating backend source",
+                emoji: "💻",
+            });
+        }
+        else if (resourceType === "frontend") {
+            tasks.push(...(frontendFramework?.createFiles(resourceName).map((file) => ({
+                ...file,
+                type: "text",
+            })) ?? []));
+            // The shared frontend Docker builder unconditionally runs `COPY <resource>/public`
+            // (the Vite static-assets folder), and an empty folder can't be committed, so
+            // without a placeholder the image build fails for every framework.
+            tasks.push({
+                type: "text",
+                filename: "public/.gitkeep",
+                content: "",
+                description: "Generating public/ assets folder",
+                emoji: "📁",
+            });
+        }
+        else if (resourceType === "worker") {
+            tasks.push({
+                type: "text",
+                filename: "src/index.ts",
+                content: getWorkerIndexTemplate(resourceName),
+                description: "Generating worker source",
+                emoji: "💻",
+            });
+        }
+        // Add test file
+        tasks.push({
+            type: "text",
+            filename: `tests/${resourceName}.test.ts`,
+            content: getTestTemplate(resourceName),
+            description: "Generating test file",
+            emoji: "🧪",
+        });
+        if (drizzleEnabled) {
+            tasks.push({
+                type: "text",
+                filename: "src/db.ts",
+                content: DRIZZLE_DB_TEMPLATE,
+                description: "Generating Drizzle client",
+                emoji: "🗄️",
+            }, {
+                type: "text",
+                filename: "src/schema.ts",
+                content: DRIZZLE_SCHEMA_TEMPLATE,
+                description: "Generating Drizzle schema",
+                emoji: "🧬",
+            }, {
+                type: "text",
+                filename: "drizzle.config.ts",
+                content: DRIZZLE_CONFIG_TEMPLATE,
+                description: "Generating Drizzle config",
+                emoji: "⚙️",
+            });
+        }
+        // A language provider that owns its runtime files replaces the shared Bun/TypeScript
+        // scaffold (package.json, tsconfig, source, test, and the Dockerfile, which the engine generates); service.json stays shared.
+        const languageFiles = backendLanguage?.createFiles?.(resourceName);
+        if (languageFiles) {
+            const owned = new Set(languageFiles.map((file) => file.filename));
+            const sharedTasks = tasks.filter((task) => task.filename === SERVICE_JSON ||
+                !(owned.has(task.filename) ||
+                    task.filename === "Dockerfile" ||
+                    task.filename === "src/index.ts" ||
+                    task.filename === PACKAGE_JSON ||
+                    task.filename === "tsconfig.json" ||
+                    task.filename.endsWith(".test.ts")));
+            tasks.length = 0;
+            tasks.push(...sharedTasks, ...languageFiles.map((file) => ({ ...file, type: "text" })));
+        }
+        // Execute all file writes with progress
+        console.log(chalk.blue("💻 Generating source files..."));
+        writeFilesWithProgress(fullPath, tasks);
+        if (prismaEnabled && resourceType === "backend") {
+            mkdirSync(resolve(fullPath, "prisma"), { recursive: true });
+            const migratorName = `${resourceName}-migrator`;
+            const migratorPath = resolve(projectRoot, `services/${stackName}/${migratorName}`);
+            mkdirSync(resolve(migratorPath, "prisma"), { recursive: true });
+            const migratorConfig = {
+                ...JSON.parse(JSON.stringify(BASE_TEMPLATE)),
+                $schema: SERVICE_MANIFEST_SCHEMA_URL,
+                schemaVersion: SERVICE_MANIFEST_SCHEMA_VERSION,
+                appName: migratorName,
+                appType: "migrator",
+                name: migratorName,
+                type: "migrator",
+                stack: stackName,
+                featuresEnabled: ["prisma"],
+            };
+            migratorConfig.dependsOn = ["postgres"];
+            // A migrator serves no route, so it declares no port. The base template's placeholder 0 would fail the service port check in flisk up.
+            delete migratorConfig.port;
+            const migratorPackage = createPackageJson(migratorName, "migrator", undefined, true);
+            migratorPackage.scripts = {
+                ...migratorPackage.scripts,
+                start: "prisma migrate deploy",
+            };
+            writeFilesWithProgress(migratorPath, [
+                {
+                    type: "json",
+                    filename: SERVICE_JSON,
+                    content: migratorConfig,
+                    description: "Generating Prisma migrator manifest",
+                    emoji: "🗃️",
+                },
+                {
+                    type: "json",
+                    filename: PACKAGE_JSON,
+                    content: migratorPackage,
+                    description: "Generating Prisma migrator package",
+                    emoji: "📦",
+                },
+                {
+                    type: "text",
+                    filename: "prisma/schema.prisma",
+                    content: PRISMA_SCHEMA_TEMPLATE,
+                    description: "Generating Prisma schema",
+                    emoji: "🧬",
+                },
+                {
+                    type: "text",
+                    filename: "prisma.config.ts",
+                    content: PRISMA_CONFIG_TEMPLATE,
+                    description: "Generating Prisma config",
+                    emoji: "⚙️",
+                },
+            ]);
+            writeFilesWithProgress(fullPath, [
+                {
+                    type: "text",
+                    filename: "prisma/schema.prisma",
+                    content: PRISMA_SCHEMA_TEMPLATE,
+                    description: "Generating Prisma schema",
+                    emoji: "🧬",
+                },
+                {
+                    type: "text",
+                    filename: "prisma.config.ts",
+                    content: PRISMA_CONFIG_TEMPLATE,
+                    description: "Generating Prisma config",
+                    emoji: "⚙️",
+                },
+            ]);
+        }
+        clearDiscoveryCache();
+        console.log(chalk.green("\n✅ Resource created successfully!"));
+        console.log(chalk.gray(`\nLocation: ${fullPath}`));
+        const discoveryPaths = readDiscoveryPaths(projectRoot);
+        if (pathAdjustedFrom) {
+            console.log(chalk.yellow(`\n📁 Placed in ${finalResourcePath} instead of the usual ${pathAdjustedFrom}: ` +
+                `discovery.paths in .tdk/project.json is ${JSON.stringify(discoveryPaths)}, ` +
+                `so ${pathAdjustedFrom} would never be started by \`flisk up\`.`));
+            console.log(chalk.gray("   Use --path to choose another folder."));
+        }
+        else if (!isPathDiscovered(projectRoot, finalResourcePath, discoveryPaths)) {
+            console.log(chalk.yellow(`\n⚠️  ${finalResourcePath} is outside discovery.paths ${JSON.stringify(discoveryPaths)}, ` +
+                "so `flisk up` will not start this resource."));
+            console.log(chalk.gray("   Add a matching pattern to discovery.paths in .tdk/project.json and run `flisk config regenerate`."));
+        }
+        console.log(chalk.gray(`\nNext steps:`));
+        console.log(chalk.gray(`  cd ${finalResourcePath}`));
+        console.log(chalk.gray(`  ${backendLanguage?.installHint ?? "bun install"}`));
+        console.log(chalk.gray(`  flisk up ${stackName}`));
+    });
+});