@flisk-sh/flisk 1.4.2 → 1.4.5

package/cli/dist-bundle/cold-preflight-3BNDOLGS.js

@@ -0,0 +1,2 @@
+import{createRequire as __fliskRequire}from'node:module';const require=__fliskRequire(import.meta.url);
+import{A as d,B as e,C as f,D as g,E as h,F as i,G as j,H as k,x as a,y as b,z as c}from"./chunk-ULMQVD7J.js";import"./chunk-SFOFTVYM.js";import"./chunk-4J2FLFUA.js";import"./chunk-GPUJ55MI.js";import"./chunk-3J6XI3NX.js";import"./chunk-V36PT2HF.js";import"./chunk-TIYTGN5R.js";import"./chunk-CGTWXWBU.js";import"./chunk-PEZQEZVV.js";import"./chunk-U42XZWXB.js";import"./chunk-KJZUBHLO.js";export{c as MACHINE_CHECK_IDS,a as RUNTIME_CHECK_IDS,b as SCAFFOLD_CHECK_IDS,i as assertMachineReadyOrExit,j as detectRuntimePrerequisites,h as formatColdPreflight,k as formatRuntimeNextSteps,d as nodeTooOld,e as requireVerifiedDockerVersions,g as runColdPreflight,f as usesPrisma};

package/cli/dist-bundle/{demo-stage-OHNTP2UJ.js → demo-stage-G4W23BXW.js}

@@ -1,5 +1,5 @@
 import{createRequire as __fliskRequire}from'node:module';const require=__fliskRequire(import.meta.url);
-import{b as R}from"./chunk-5QBYM33Q.js";import{b as c}from"./chunk-YNCBBJ4V.js";import"./chunk-KJZUBHLO.js";var v=12,_=24,F={plain:e=>e,bold:c.bold,dim:c.gray,ok:c.green,warn:c.yellow,err:c.red},S={pending:"\u25CB",active:"\u25D0",done:"\u2714",failed:"\u2716"},j={pending:"dim",active:"warn",done:"ok",failed:"err"};function o(e){return R(String(e)).replace(/[\n\r\t]/g," ")}function g(e){if(!Number.isFinite(e)||e<0)return"0.0s";if(e<1e4)return`${(e/1e3).toFixed(1)}s`;if(e<6e4)return`${Math.round(e/1e3)}s`;let n=Math.floor(e/6e4),i=Math.round(e%6e4/1e3);return`${n}m ${i}s`}function $(e){return e.reduce((n,i)=>n+i.text.length,0)}function k(e,n){if(n<=0)return[];let i=[],l=0;for(let s of e){if(l>=n)break;let t=n-l;if(s.text.length<=t){i.push(s),l+=s.text.length;continue}i.push({...s,text:`${s.text.slice(0,Math.max(0,t-1))}\u2026`}),l=n}return i}function w(e,n){let i=k(e,n),l=n-$(i);return l<=0?i:[...i,{text:" ".repeat(l),style:"plain"}]}function M(e,n,i){let l=$(n),s=i-l-1;if(s<4)return w(k([...e,...n],i),i);let t=k(e,s),r=i-$(t)-l;return[...t,{text:" ".repeat(Math.max(1,r)),style:"plain"},...n]}function b(e){return[{text:` ${"\u2500".repeat(Math.max(0,e-2))}`,style:"dim"}]}function P(e,n){return M([{text:" ",style:"plain"},{text:S[e.status],style:j[e.status]},{text:"  ",style:"plain"},{text:o(e.label),style:e.status==="pending"?"dim":"plain"}],e.elapsedMs===void 0?[]:[{text:g(e.elapsedMs),style:"dim"}],n)}function Y(e){let n=Math.max(0,e.servicesTotal);if(n===0)return"no services found";let l=[`${Math.min(Math.max(0,e.servicesReady),n)} of ${n} services ready`];return e.servicesBuilding>0&&l.push(`${e.servicesBuilding} building`),l.join(" \xB7 ")}function E(e,n=80){let i=Number.isFinite(n)&&n>0?n:80,l=Math.max(_,Math.min(i-1,78)),s=[],t=a=>s.push(w(a,l)),r=()=>t([]);if(e.done){t(M([{text:" ",style:"plain"},{text:"\u2714",style:"ok"},{text:"  Your stack is running",style:"ok"}],[{text:g(e.elapsedMs),style:"dim"}],l)),t([{text:" ",style:"plain"},{text:o(e.subtitle),style:"dim"}]),r();for(let a of e.done.urls.slice(0,2))t([{text:"     ",style:"plain"},{text:o(a),style:"plain"}]);r(),t(b(l)),t([{text:" ",style:"plain"},{text:o(e.done.summary),style:"plain"}]),t([{text:" ",style:"plain"},{text:o(e.done.hint),style:"dim"}]),r(),t([{text:" ",style:"plain"},{text:`flisk ${o(e.done.version)}`,style:"dim"}])}else if(e.failure){let a=e.phases.find(p=>p.status==="failed");t(M([{text:" ",style:"plain"},{text:"\u2716",style:"err"},{text:"  ",style:"plain"},{text:o(a?.label??"The demo stopped"),style:"err"}],[{text:g(e.elapsedMs),style:"dim"}],l)),r(),t([{text:" ",style:"plain"},{text:o(e.failure.message),style:"plain"}]),e.failure.fix&&t([{text:" ",style:"plain"},{text:o(e.failure.fix),style:"dim"}]),r(),t(b(l)),e.detail&&t([{text:" ",style:"plain"},{text:o(e.detail),style:"dim"}]),e.failure.logPath&&t([{text:" ",style:"plain"},{text:`log: ${o(e.failure.logPath)}`,style:"dim"}])}else{t([{text:" ",style:"plain"},{text:o(e.title),style:"bold"}]),t([{text:" ",style:"plain"},{text:o(e.subtitle),style:"dim"}]),r();let a=e.phases.slice(0,4);for(let p of a)t(P(p,l));for(let p=a.length;p<4;p+=1)r();r(),t(b(l)),t([{text:" ",style:"plain"},{text:o(e.detail??""),style:"dim"}]),t(M([{text:" ",style:"plain"},{text:Y(e),style:"plain"}],[{text:g(e.elapsedMs),style:"dim"}],l))}for(;s.length<v;)s.push(w([],l));return s.slice(0,v)}function A(e){return e.map(n=>n.map(i=>i.text).join(""))}function D(e){return e.map(n=>F[n.style](n.text)).join("")}function H(e,n=process.stderr,i=Date.now){let l=n.isTTY===!0,s=i(),t={...e},r=!1,a="",p="",f,T=()=>{let u=!!(t.done||t.failure);return{...t,elapsedMs:u?t.elapsedMs:i()-s}},x=()=>{let u=T(),m=E(u,n.columns??80),y=A(m);if(!l){let h=y.join(`
+import{b as R}from"./chunk-LUUJ4JB7.js";import{b as c}from"./chunk-U42XZWXB.js";import"./chunk-KJZUBHLO.js";var v=12,_=24,F={plain:e=>e,bold:c.bold,dim:c.gray,ok:c.green,warn:c.yellow,err:c.red},S={pending:"\u25CB",active:"\u25D0",done:"\u2714",failed:"\u2716"},j={pending:"dim",active:"warn",done:"ok",failed:"err"};function o(e){return R(String(e)).replace(/[\n\r\t]/g," ")}function g(e){if(!Number.isFinite(e)||e<0)return"0.0s";if(e<1e4)return`${(e/1e3).toFixed(1)}s`;if(e<6e4)return`${Math.round(e/1e3)}s`;let n=Math.floor(e/6e4),i=Math.round(e%6e4/1e3);return`${n}m ${i}s`}function $(e){return e.reduce((n,i)=>n+i.text.length,0)}function k(e,n){if(n<=0)return[];let i=[],l=0;for(let s of e){if(l>=n)break;let t=n-l;if(s.text.length<=t){i.push(s),l+=s.text.length;continue}i.push({...s,text:`${s.text.slice(0,Math.max(0,t-1))}\u2026`}),l=n}return i}function w(e,n){let i=k(e,n),l=n-$(i);return l<=0?i:[...i,{text:" ".repeat(l),style:"plain"}]}function M(e,n,i){let l=$(n),s=i-l-1;if(s<4)return w(k([...e,...n],i),i);let t=k(e,s),r=i-$(t)-l;return[...t,{text:" ".repeat(Math.max(1,r)),style:"plain"},...n]}function b(e){return[{text:` ${"\u2500".repeat(Math.max(0,e-2))}`,style:"dim"}]}function P(e,n){return M([{text:" ",style:"plain"},{text:S[e.status],style:j[e.status]},{text:"  ",style:"plain"},{text:o(e.label),style:e.status==="pending"?"dim":"plain"}],e.elapsedMs===void 0?[]:[{text:g(e.elapsedMs),style:"dim"}],n)}function Y(e){let n=Math.max(0,e.servicesTotal);if(n===0)return"no services found";let l=[`${Math.min(Math.max(0,e.servicesReady),n)} of ${n} services ready`];return e.servicesBuilding>0&&l.push(`${e.servicesBuilding} building`),l.join(" \xB7 ")}function E(e,n=80){let i=Number.isFinite(n)&&n>0?n:80,l=Math.max(_,Math.min(i-1,78)),s=[],t=a=>s.push(w(a,l)),r=()=>t([]);if(e.done){t(M([{text:" ",style:"plain"},{text:"\u2714",style:"ok"},{text:"  Your stack is running",style:"ok"}],[{text:g(e.elapsedMs),style:"dim"}],l)),t([{text:" ",style:"plain"},{text:o(e.subtitle),style:"dim"}]),r();for(let a of e.done.urls.slice(0,2))t([{text:"     ",style:"plain"},{text:o(a),style:"plain"}]);r(),t(b(l)),t([{text:" ",style:"plain"},{text:o(e.done.summary),style:"plain"}]),t([{text:" ",style:"plain"},{text:o(e.done.hint),style:"dim"}]),r(),t([{text:" ",style:"plain"},{text:`flisk ${o(e.done.version)}`,style:"dim"}])}else if(e.failure){let a=e.phases.find(p=>p.status==="failed");t(M([{text:" ",style:"plain"},{text:"\u2716",style:"err"},{text:"  ",style:"plain"},{text:o(a?.label??"The demo stopped"),style:"err"}],[{text:g(e.elapsedMs),style:"dim"}],l)),r(),t([{text:" ",style:"plain"},{text:o(e.failure.message),style:"plain"}]),e.failure.fix&&t([{text:" ",style:"plain"},{text:o(e.failure.fix),style:"dim"}]),r(),t(b(l)),e.detail&&t([{text:" ",style:"plain"},{text:o(e.detail),style:"dim"}]),e.failure.logPath&&t([{text:" ",style:"plain"},{text:`log: ${o(e.failure.logPath)}`,style:"dim"}])}else{t([{text:" ",style:"plain"},{text:o(e.title),style:"bold"}]),t([{text:" ",style:"plain"},{text:o(e.subtitle),style:"dim"}]),r();let a=e.phases.slice(0,4);for(let p of a)t(P(p,l));for(let p=a.length;p<4;p+=1)r();r(),t(b(l)),t([{text:" ",style:"plain"},{text:o(e.detail??""),style:"dim"}]),t(M([{text:" ",style:"plain"},{text:Y(e),style:"plain"}],[{text:g(e.elapsedMs),style:"dim"}],l))}for(;s.length<v;)s.push(w([],l));return s.slice(0,v)}function A(e){return e.map(n=>n.map(i=>i.text).join(""))}function D(e){return e.map(n=>F[n.style](n.text)).join("")}function H(e,n=process.stderr,i=Date.now){let l=n.isTTY===!0,s=i(),t={...e},r=!1,a="",p="",f,T=()=>{let u=!!(t.done||t.failure);return{...t,elapsedMs:u?t.elapsedMs:i()-s}},x=()=>{let u=T(),m=E(u,n.columns??80),y=A(m);if(!l){let h=y.join(`
 `);if(h===p)return;p=h,n.write(`${y.filter(L=>L.trim()!=="").join(`
 `)}
 `);return}let d=y.join(`

package/cli/dist-bundle/{extension-fetch-VEFSCG4B.js → extension-fetch-KIPYDIRM.js}

@@ -1,2 +1,2 @@
 import{createRequire as __fliskRequire}from'node:module';const require=__fliskRequire(import.meta.url);
-import{b as a,c as b,d as c,e as d}from"./chunk-K6SOCO6V.js";import"./chunk-KJZUBHLO.js";export{a as applyPremiumOverlay,c as hasDddLicense,d as hasSablierLicense,b as hasVerdaccioLicense};
+import{b as a,c as b,d as c,e as d}from"./chunk-GPUJ55MI.js";import"./chunk-KJZUBHLO.js";export{a as applyPremiumOverlay,c as hasDddLicense,d as hasSablierLicense,b as hasVerdaccioLicense};

package/cli/dist-bundle/{open-XROJ6YEY.js → open-HQFT6WDC.js}

@@ -1,2 +1,2 @@
 import{createRequire as __fliskRequire}from'node:module';const require=__fliskRequire(import.meta.url);
-import{d as a,e as b,f as c,g as d,h as e,i as f}from"./chunk-DU2BN46C.js";import"./chunk-MINZ25AC.js";import"./chunk-YHYRGWUH.js";import"./chunk-3XODDLRJ.js";import"./chunk-53L2JN7G.js";import"./chunk-5F7YP5IR.js";import"./chunk-YNCBBJ4V.js";import"./chunk-KJZUBHLO.js";export{d as findReadyFrontend,b as isFrontendReady,a as listFrontendTargets,f as openCommand,e as openFirstFrontend,c as pickReadyFrontend};
+import{d as a,e as b,f as c,g as d,h as e,i as f}from"./chunk-Z5QEE4SW.js";import"./chunk-MINZ25AC.js";import"./chunk-V36PT2HF.js";import"./chunk-TIYTGN5R.js";import"./chunk-CGTWXWBU.js";import"./chunk-PEZQEZVV.js";import"./chunk-U42XZWXB.js";import"./chunk-KJZUBHLO.js";export{d as findReadyFrontend,b as isFrontendReady,a as listFrontendTargets,f as openCommand,e as openFirstFrontend,c as pickReadyFrontend};

package/cli/dist-bundle/project-JZO2CPZZ.js

@@ -0,0 +1,2 @@
+import{createRequire as __fliskRequire}from'node:module';const require=__fliskRequire(import.meta.url);
+import{g as a,h as b,i as c,j as d}from"./chunk-BMHPPX2Q.js";import"./chunk-BP2M4OJ4.js";import"./chunk-SFOFTVYM.js";import"./chunk-GPUJ55MI.js";import"./chunk-CGTWXWBU.js";import"./chunk-PEZQEZVV.js";import"./chunk-U42XZWXB.js";import"./chunk-KJZUBHLO.js";export{c as cloneProjectTemplate,a as enableDiscoveredStacks,d as projectCommand,b as templateTargetDir};

package/cli/dist-bundle/{project-templates-EYSQG2EO.js → project-templates-IMJ3OX5I.js}

@@ -1,2 +1,2 @@
 import{createRequire as __fliskRequire}from'node:module';const require=__fliskRequire(import.meta.url);
-import{a,b}from"./chunk-YL56J2WX.js";import"./chunk-KJZUBHLO.js";export{a as PROJECT_TEMPLATES,b as bareTemplateArg};
+import{a,b}from"./chunk-BP2M4OJ4.js";import"./chunk-KJZUBHLO.js";export{a as PROJECT_TEMPLATES,b as bareTemplateArg};

package/cli/dist-bundle/{services-BIMF6MVU.js → services-GLFKZBBZ.js}

@@ -1,2 +1,2 @@
 import{createRequire as __fliskRequire}from'node:module';const require=__fliskRequire(import.meta.url);
-import{ca as a,da as b,ea as c,fa as d,ga as e,ha as f,ia as g,ja as h,ka as i,la as j,ma as k,na as l,oa as m,pa as n,qa as o}from"./chunk-5F7YP5IR.js";import"./chunk-YNCBBJ4V.js";import"./chunk-KJZUBHLO.js";export{m as clearMetadataCache,f as discoverResources,e as discoverResourcesFromRoot,g as discoverResourcesStrict,c as discoverResourcesWithProblems,a as discoverServiceManifestPaths,h as discoverStackNames,j as discoverStacks,i as getAllStacks,n as getResourceMetadata,k as getResourcesForStack,o as getStackMetadata,b as resetPrintedServiceWarnings,l as stackExists,d as warnAboutSkippedFiles};
+import{da as a,ea as b,fa as c,ga as d,ha as e,ia as f,ja as g,ka as h,la as i,ma as j,na as k,oa as l,pa as m,qa as n,ra as o}from"./chunk-PEZQEZVV.js";import"./chunk-U42XZWXB.js";import"./chunk-KJZUBHLO.js";export{m as clearMetadataCache,f as discoverResources,e as discoverResourcesFromRoot,g as discoverResourcesStrict,c as discoverResourcesWithProblems,a as discoverServiceManifestPaths,h as discoverStackNames,j as discoverStacks,i as getAllStacks,n as getResourceMetadata,k as getResourcesForStack,o as getStackMetadata,b as resetPrintedServiceWarnings,l as stackExists,d as warnAboutSkippedFiles};

package/cli/dist-bundle/{tilt-port-owner-ZY5M2JC4.js → tilt-port-owner-PJN4MPYE.js}

@@ -1,2 +1,2 @@
 import{createRequire as __fliskRequire}from'node:module';const require=__fliskRequire(import.meta.url);
-import{a,b,c}from"./chunk-I7TGIK5N.js";import"./chunk-IGN5UC3P.js";import"./chunk-3XODDLRJ.js";import"./chunk-53L2JN7G.js";import"./chunk-5F7YP5IR.js";import"./chunk-YNCBBJ4V.js";import"./chunk-KJZUBHLO.js";export{c as classifyTiltPorts,a as findTiltPortOwner,b as isForeignTilt};
+import{a,b,c}from"./chunk-VMVTECCK.js";import"./chunk-4J2FLFUA.js";import"./chunk-TIYTGN5R.js";import"./chunk-CGTWXWBU.js";import"./chunk-PEZQEZVV.js";import"./chunk-U42XZWXB.js";import"./chunk-KJZUBHLO.js";export{c as classifyTiltPorts,a as findTiltPortOwner,b as isForeignTilt};

package/cli/package.json

@@ -1,7 +1,7 @@
 {
   "name": "flisk-cli-internal",
   "private": true,
-  "version": "1.4.2",
+  "version": "1.4.5",
   "description": "Flisk CLI — start services on your machine.",
   "keywords": [
     "flisk",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flisk-sh/flisk",
-  "version": "1.4.2",
+  "version": "1.4.5",
   "description": "Flisk CLI — start services on your machine.",
   "homepage": "https://flisk.sh",
   "repository": {

package/runtime/engine/topologies/platform/docker/compose/compose.star

@@ -77,6 +77,19 @@ def _compute_env_file_rel_path(resource_path, full_resource_path, env_filename):
 # 🚦 FRONTEND / BACKEND ENTRIES
 # =============================================================================
 
+# The memory anchors a frontend service merges. Next.js gets its own (next dev needs far more than the 64M an nginx SPA fits in,
+# and the OOM kill exits 0, so the container looks like a clean exit). The engine finds frontend entries by these strings.
+_FRONTEND_MEMORY_ANCHORS = ["<<: *frontend-memory-limit", "<<: *next-memory-limit"]
+
+
+def _has_frontend_memory_anchor(entry):
+    """True when a compose entry merges one of the frontend memory anchors."""
+    for anchor in _FRONTEND_MEMORY_ANCHORS:
+        if anchor in entry:
+            return True
+    return False
+
+
 def generate_frontend_compose(resource_path, resource_name, res, manifest=None):
     """Generate frontend docker-compose entry with Traefik routing."""
     res_name = res['name']
@@ -91,6 +104,10 @@ def generate_frontend_compose(resource_path, resource_name, res, manifest=None):
     # healthcheck probe a port nothing listens on, which left the container marked
     # unhealthy -- and Traefik's Docker provider skips unhealthy containers, so the
     # router was never registered and every request 404'd.
+    # Next.js is served by its own Node server (no nginx), on the manifest port, under its basePath.
+    is_next = bool(manifest) and manifest.get('framework') == 'next'
+    if is_next:
+        use_nginx = False
     port = NGINX_CONTAINER_PORT if use_nginx else reject_unsafe_value(manifest.get('port', BASE_PORT_FRONTEND), 'port')
     
     # Base path for routing on {project}.localhost. Shared with the Vite config and
@@ -129,11 +146,19 @@ def generate_frontend_compose(resource_path, resource_name, res, manifest=None):
         manifest=manifest,
     )
     
+    memory_anchor = "<<: *next-memory-limit" if is_next else "<<: *frontend-memory-limit"
+    # An nginx frontend answers at /. Next.js answers at its basePath (with a trailing slash, see next.config.mjs), and the image
+    # has curl, not wget.
+    if is_next:
+        health_test = '["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:{}{}/"]'.format(port, base_path)
+    else:
+        health_test = '["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:{}"]'.format(port)
+
     return """  {res_name}:
     image: {image_name}
     init: true
 {build_config}
-    <<: *frontend-memory-limit
+    {memory_anchor}
     env_file:
       - {env_file_rel_path}
     environment:
@@ -144,9 +169,11 @@ def generate_frontend_compose(resource_path, resource_name, res, manifest=None):
         - {network_traefik_public}
         - {network_backend}
     healthcheck:
-      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:{port}"]
+      test: {health_test}
 {healthcheck_timing}""".format(
+        health_test=health_test,
         res_name=res_name, 
+        memory_anchor=memory_anchor,
         image_name=image_name,
         build_config=build_config,
         env_file_rel_path=env_file_rel_path,
@@ -439,7 +466,7 @@ def _generate_port_anchors(resource_entries):
                             sdk_port = int(port_str)
                             break
         # Check if this is a frontend (has frontend-memory-limit but not SDK)
-        elif "<<: *frontend-memory-limit" in entry and not ("-sdk:" in entry or entry.strip().startswith("identity-sdk:")):
+        elif _has_frontend_memory_anchor(entry) and not ("-sdk:" in entry or entry.strip().startswith("identity-sdk:")):
             has_frontend = True
             # Extract frontend port from entry
             if "loadbalancer.server.port=" in entry:
@@ -452,7 +479,7 @@ def _generate_port_anchors(resource_entries):
                             break
         # Check if this is a backend (has a port, not frontend, not SDK)
         # Backend entries have "healthcheck:" section with backend port
-        elif "healthcheck:" in entry and "<<: *frontend-memory-limit" not in entry and not ("-sdk:" in entry or entry.strip().startswith("identity-sdk:")):
+        elif "healthcheck:" in entry and not _has_frontend_memory_anchor(entry) and not ("-sdk:" in entry or entry.strip().startswith("identity-sdk:")):
             has_backend = True
             # Extract backend port from entry
             if "loadbalancer.server.port=" in entry:
@@ -522,6 +549,15 @@ x-frontend-memory-limit: &frontend-memory-limit
       reservations:
         memory: 32M
 
+x-next-memory-limit: &next-memory-limit
+  deploy:
+    resources:
+      limits:
+        memory: 1G
+        cpus: '1.0'
+      reservations:
+        memory: 256M
+
 services:
 """.format(port_anchors=port_anchors)
 

package/runtime/engine/topologies/platform/docker/dockerfile/language_dockerfile.star

@@ -136,6 +136,7 @@ EXPOSE {port}
 CMD ["node", "src/index.js"]
 """
 
+
 # The watcher the Go development target runs. It compiles a change into a staging binary while the running app keeps serving, and stops
 # and swaps the app only when that build succeeds. Air was tried first and stops the app as soon as it sees a change (engine.go `start`
 # calls stopBin before buildRun), so the service stayed down for the whole compile; a Traefik health check landing in that gap kept the
@@ -247,6 +248,11 @@ def generate_language_dockerfile(res_path, language, port = BASE_PORT_BACKEND, d
     )
 
 
+def is_next_frontend(manifest):
+    """True for a frontend whose `framework` is `next`: it runs on Node, not as a Vite build behind nginx."""
+    return bool(manifest) and manifest.get("appType") == "frontend" and manifest.get("framework") == "next"
+
+
 def is_provider_owned_language(manifest):
     """True when the manifest selects a provider-owned language (a missing language means Bun)."""
     if not manifest:

package/runtime/engine/topologies/platform/docker/dockerfile/next_dockerfile.star

@@ -0,0 +1,83 @@
+# Copyright (c) 2026 Flisk Landscape contributors
+# SPDX-License-Identifier: MIT
+# Dockerfile for a Next.js frontend (`framework: next`). Node image, not the Bun + nginx SPA image; see
+# language_dockerfile.star for the other provider-owned runtimes.
+
+load('../build/golden_image_constants.star', 'get_layer_reference')
+
+BASE_PORT_FRONTEND = 3000
+
+# Same RUN line as the backend templates in language_dockerfile.star (Starlark does not export underscored names).
+_NEXT_CURL = """RUN apt-get update && apt-get install -y --no-install-recommends curl \\
+  && rm -rf /var/lib/apt/lists/*
+"""
+
+# Next.js frontend (`framework: next`): a Node image, not the Bun + nginx SPA image. `development` runs `next dev` (what Tilt builds, with
+# the sources live-updated into it); `production` is the standalone server `next build` writes. The engine's env file becomes `.env`,
+# which Next loads in both modes, so next.config.mjs sees FLISK_BASE_PATH and the browser bundle gets NEXT_PUBLIC_API_URL.
+# The Node runtime comes from the approved golden layer `l4-backend-node` when the golden image is enabled (the same
+# `use_golden` switch the Bun generators use); otherwise it is the upstream node image.
+# The `production` stage is the last one, so a plain `docker build` of the file also produces it.
+_BASE_ARG = "ARG BASE_IMAGE="
+
+_NEXT = """# Generated by Flisk for a Next.js frontend. Do not edit; change service.json instead.
+# The default is the upstream node image, pinned by digest like the backend Node template; the golden path replaces it.
+ARG BASE_IMAGE=node:22-slim@sha256:c3de60bf2f9dd0ac6370e6117950ff62d6e339527e7472301c9c78a017978392
+FROM ${{BASE_IMAGE}} AS base
+ENV NEXT_TELEMETRY_DISABLED=1
+# The golden runtime runs as a non-root user; install and build as root, then drop to {run_user} for the running stages.
+USER root
+WORKDIR /app/{res_path}
+
+{curl}
+COPY {res_path}/package.json {res_path}/package-lock.jso[n] ./
+RUN if [ -f package-lock.json ]; then npm ci --no-audit --no-fund; else npm install --no-audit --no-fund; fi
+
+COPY {res_path}/.autogenerated/.env.frontend.autogenerated ./.env
+COPY {res_path}/next.config.mjs ./next.config.mjs
+COPY {res_path}/tsconfig.json ./tsconfig.json
+COPY {res_path}/public ./public
+COPY {res_path}/src ./src
+
+FROM base AS development
+# WORKDIR is created by root, and next dev writes .next (and next-env.d.ts) inside it as {run_user}:
+# without this the dev server dies with EACCES: mkdir '.next'. Give the run user the app folder.
+ENV PORT={port} HOSTNAME=0.0.0.0
+RUN chown -R {run_user}:{run_user} /app/{res_path}
+USER {run_user}
+EXPOSE {port}
+CMD ["npx", "next", "dev", "--hostname", "0.0.0.0", "--port", "{port}"]
+
+FROM base AS build
+RUN npx next build
+
+FROM ${{BASE_IMAGE}} AS production
+ENV NODE_ENV=production NEXT_TELEMETRY_DISABLED=1 PORT={port} HOSTNAME=0.0.0.0
+WORKDIR /app/{res_path}
+{curl}
+COPY --from=build --chown={run_user}:{run_user} /app/{res_path}/.next/standalone ./
+COPY --from=build --chown={run_user}:{run_user} /app/{res_path}/.next/static ./.next/static
+COPY --from=build --chown={run_user}:{run_user} /app/{res_path}/public ./public
+USER {run_user}
+EXPOSE {port}
+CMD ["node", "server.js"]
+"""
+
+def generate_next_dockerfile(res_path, port = BASE_PORT_FRONTEND, use_golden = True):
+    """Dockerfile text for a Next.js frontend: `development` (next dev), `build`, and `production` (standalone server).
+
+    With `use_golden` the base is the approved golden `l4-backend-node` layer (alpine, curl already present, non-root `app`);
+    without it, the upstream node image (debian slim, which needs curl installed, non-root `node`).
+    """
+    if use_golden:
+        run_user = 'app'
+        curl = ''
+    else:
+        run_user = 'node'
+        curl = _NEXT_CURL
+    text = _NEXT.format(res_path = res_path, port = port, run_user = run_user, curl = curl)
+    if use_golden:
+        head, _, rest = text.partition(_BASE_ARG)
+        _, _, tail = rest.partition("\n")
+        text = head + _BASE_ARG + get_layer_reference('l4-backend-node') + "\n" + tail
+    return text

package/runtime/engine/topologies/platform/docker/index.star

@@ -6,11 +6,13 @@ load(
     "generate_app_dockerfile",
     "generate_migrator_dockerfile",
 )
+load("./dockerfile/next_dockerfile.star", "generate_next_dockerfile")
 load(
     "./dockerfile/language_dockerfile.star",
     "generate_language_dockerfile",
     "is_provider_owned_language",
     "go_live_reload_enabled",
+    "is_next_frontend",
     "LANGUAGE_REQUIRED_FILES",
 )
 load("./config/dockerignore.star", "generate_dockerignore")
@@ -30,6 +32,8 @@ Docker = struct(
     backend_language = generate_language_dockerfile,
     is_provider_owned_language = is_provider_owned_language,
     go_live_reload = go_live_reload_enabled,
+    next_frontend = generate_next_dockerfile,
+    is_next_frontend = is_next_frontend,
     language_required_files = LANGUAGE_REQUIRED_FILES,
     generate_dockerignore = generate_dockerignore,
     frontend_compose = generate_frontend_compose,

package/runtime/engine/topologies/platform/docker/layers/prisma/filesystem_setup.star

@@ -19,6 +19,7 @@ load(
 load(
     './constants.star',
     'APP_BUN_STORE_DIR',
+    'APP_DIR',
     'APP_GENERATED_CLIENT_DIR',
     'APP_NODE_MODULES_BIN_DIR',
     'APP_NODE_MODULES_DIR',
@@ -46,10 +47,16 @@ def prisma_dir_and_permissions():
     Create directories that Prisma writes to at runtime and ensure the `bun` user owns
     them.  Handles both the standard `node_modules/.prisma/client` path and custom
     output paths like `../src/generated` or `../generated-client`.
+
+    `/app` itself is owned by `bun` too: `migrate.sh` runs `prisma generate` as `bun`,
+    and a generator output such as `../generated/prisma` (the `flisk resource
+    --feature prisma` scaffold) makes Prisma create a new directory directly under
+    `/app`, which fails with EACCES while root owns it.
     """
     return (
         "# Ensure Prisma can write generated files including custom output paths\n"
         + "RUN mkdir -p " + APP_NODE_MODULES_DIR + " " + APP_SRC_DIR + " " + APP_GENERATED_CLIENT_DIR
+        + " && chown " + BUN_USER + ":" + BUN_USER + " " + APP_DIR
         + " && chown -R " + BUN_USER + ":" + BUN_USER
         + " " + APP_PRISMA_DIR + " " + APP_NODE_MODULES_DIR + " " + APP_SRC_DIR + " " + APP_GENERATED_CLIENT_DIR
         + " " + PRISMA_CONFIG_ABS_PATH + " || true\n"

package/runtime/engine/topologies/platform/docker/networking/traefik.star

@@ -38,6 +38,31 @@ load("./sablier_container_cycle.star",
     "sablier_container_labels",
 )
 load("../compose/unsafe_value.star", "reject_unsafe_value")
+load("../constants.star", "PROJECT_NAME_HYPHEN")
+
+
+def _project_slug():
+    """The project name with every character except letters and digits written as `_` plus its six-digit hex code.
+
+    The result has no `-` in it, so the first `-` in a scoped name always separates the project from the resource. That
+    keeps the mapping one-to-one: `team` + `app-api` and `team-app` + `api` get different names, and so do `a-b` and `a_b`.
+    """
+    return "".join([ch if ch.isalnum() else "_" + _hex6(ord(ch)) for ch in PROJECT_NAME_HYPHEN.elems()])
+
+
+def _hex6(code):
+    """`code` in hex, zero-padded to six digits so every escape has the same width."""
+    return ("000000" + "%x" % code)[-6:]
+
+
+def traefik_scoped_name(name):
+    """Router, middleware and service name for `name`, prefixed with this Flisk project.
+
+    One Traefik instance serves every Flisk project on the machine, and it keys routers, middlewares and services by name
+    alone. Two projects that name a resource the same (`api`, say) would define the same router twice, and Traefik drops both.
+    The project prefix keeps them apart.
+    """
+    return _project_slug() + "-" + name
 
 
 def get_frontend_traefik_labels(res_name, domain, base_path, port, traefik_host=None, manifest=None):
@@ -55,8 +80,9 @@ def get_frontend_traefik_labels(res_name, domain, base_path, port, traefik_host=
         TRAEFIK_FRONTEND_ENABLE_HTTP,
         TRAEFIK_FRONTEND_ENABLE_HTTPS,
     )
-    middleware_name = res_name + TRAEFIK_MIDDLEWARE_SUFFIX
-    
+    router_name = traefik_scoped_name(res_name)
+    middleware_name = router_name + TRAEFIK_MIDDLEWARE_SUFFIX
+
     # Check if maintenance feature is enabled
     features = manifest.get('featuresEnabled', []) if manifest else []
     maintenance_middleware = ""
@@ -66,20 +92,31 @@ def get_frontend_traefik_labels(res_name, domain, base_path, port, traefik_host=
     # On-demand scaling: attach the Sablier middleware when opted in via the manifest
     sablier_middleware, sablier_enabled = sablier_middleware_suffix(manifest, res_name)
 
-    labels = """        - "{traefik_enable_label}"
-        - 'traefik.http.routers.{res_name}.rule={frontend_route_rule}'
-        - "traefik.http.routers.{res_name}.entrypoints={frontend_entrypoints}"
-        - "traefik.http.routers.{res_name}.priority={router_priority}"
-        - "traefik.http.routers.{res_name}.middlewares={middleware_name}{maintenance_middleware}{sablier_middleware}"
+    # Next.js serves under its own basePath, so the prefix must reach it: the route keeps /<name> and adds no stripprefix middleware.
+    strips_prefix = not manifest or manifest.get('framework') != 'next'
+    if strips_prefix:
+        middlewares = middleware_name + maintenance_middleware + sablier_middleware
+        middleware_labels = """        - "traefik.http.routers.{router_name}.middlewares={middlewares}"
         - "traefik.http.middlewares.{middleware_name}.stripprefix.prefixes={base_path}"
-        - "traefik.http.services.{res_name}.loadbalancer.server.port={port}"
+""".format(router_name=router_name, middlewares=middlewares, middleware_name=middleware_name, base_path=base_path)
+    else:
+        middlewares = (maintenance_middleware + sablier_middleware).lstrip(",")
+        middleware_labels = ""
+        if middlewares:
+            middleware_labels = """        - "traefik.http.routers.{router_name}.middlewares={middlewares}"
+""".format(router_name=router_name, middlewares=middlewares)
+
+    labels = """        - "{traefik_enable_label}"
+        - 'traefik.http.routers.{router_name}.rule={frontend_route_rule}'
+        - "traefik.http.routers.{router_name}.entrypoints={frontend_entrypoints}"
+        - "traefik.http.routers.{router_name}.priority={router_priority}"
+{middleware_labels}        - "traefik.http.services.{router_name}.loadbalancer.server.port={port}"
         - "traefik.docker.network={traefik_network}\"""".format(
-        res_name=res_name,
+        router_name=router_name,
         traefik_enable_label=TRAEFIK_ENABLE_LABEL,
         frontend_route_rule=frontend_route_rule,
         frontend_entrypoints=frontend_entrypoints,
-        middleware_name=middleware_name,
-        base_path=base_path,
+        middleware_labels=middleware_labels,
         port=port,
         router_priority=router_priority,
         traefik_network=TRAEFIK_DOCKER_NETWORK,
@@ -135,8 +172,10 @@ def get_backend_traefik_labels(
         TRAEFIK_BACKEND_ENABLE_HTTP,
         TRAEFIK_BACKEND_ENABLE_HTTPS,
     )
-    middleware_name = resource_entry_name + TRAEFIK_MIDDLEWARE_SUFFIX
-    
+    router_name = traefik_scoped_name(resource_entry_name)
+    service_name = traefik_scoped_name(traefik_resource_name)
+    middleware_name = router_name + TRAEFIK_MIDDLEWARE_SUFFIX
+
     # Check if maintenance feature is enabled
     features = manifest.get('featuresEnabled', []) if manifest else []
     maintenance_middleware = ""
@@ -149,13 +188,13 @@ def get_backend_traefik_labels(
     # Build middleware config only if traefik_path is not empty
     if traefik_path:
         middleware_config_lines = [
-            '      - "traefik.http.routers.' + resource_entry_name + '.middlewares=' + middleware_name + maintenance_middleware + sablier_middleware + '"',
+            '      - "traefik.http.routers.' + router_name + '.middlewares=' + middleware_name + maintenance_middleware + sablier_middleware + '"',
             '      - "traefik.http.middlewares.' + middleware_name + '.stripprefix.prefixes=' + traefik_path + '"',
         ]
         middleware_config = "\n".join(middleware_config_lines)
     elif sablier_middleware:
         # No strip-prefix path, but still front the router with the Sablier middleware
-        middleware_config = '      - "traefik.http.routers.' + resource_entry_name + '.middlewares=' + sablier_middleware.lstrip(",") + '"'
+        middleware_config = '      - "traefik.http.routers.' + router_name + '.middlewares=' + sablier_middleware.lstrip(",") + '"'
     else:
         # No middleware if path is empty - router has no middlewares
         middleware_config = ""
@@ -171,15 +210,15 @@ def get_backend_traefik_labels(
     if stack_shared and not backend_route_rule:
         backend_router_labels = ""
     else:
-        backend_router_labels = """      - "traefik.http.routers.{resource_entry_name}.rule={backend_route_rule}"
-      - "traefik.http.routers.{resource_entry_name}.entrypoints={backend_entrypoints}"
-      - "traefik.http.routers.{resource_entry_name}.service={traefik_resource_name}"
+        backend_router_labels = """      - "traefik.http.routers.{router_name}.rule={backend_route_rule}"
+      - "traefik.http.routers.{router_name}.entrypoints={backend_entrypoints}"
+      - "traefik.http.routers.{router_name}.service={service_name}"
 {middleware_config}
 """.format(
-            resource_entry_name=resource_entry_name,
+            router_name=router_name,
             backend_route_rule=backend_route_rule,
             backend_entrypoints=backend_entrypoints,
-            traefik_resource_name=traefik_resource_name,
+            service_name=service_name,
             middleware_config=middleware_config,
         )
 
@@ -187,25 +226,25 @@ def get_backend_traefik_labels(
     # probing a path the service never serves.
     traefik_healthcheck_labels = ""
     if health_path:
-        traefik_healthcheck_labels = """      - "traefik.http.services.{traefik_resource_name}.loadbalancer.healthcheck.path={health_path}"
-      - "traefik.http.services.{traefik_resource_name}.loadbalancer.healthcheck.interval={health_interval}"
-      - "traefik.http.services.{traefik_resource_name}.loadbalancer.healthcheck.timeout={health_timeout}"
-      - "traefik.http.services.{traefik_resource_name}.loadbalancer.healthcheck.followredirects=false"
+        traefik_healthcheck_labels = """      - "traefik.http.services.{service_name}.loadbalancer.healthcheck.path={health_path}"
+      - "traefik.http.services.{service_name}.loadbalancer.healthcheck.interval={health_interval}"
+      - "traefik.http.services.{service_name}.loadbalancer.healthcheck.timeout={health_timeout}"
+      - "traefik.http.services.{service_name}.loadbalancer.healthcheck.followredirects=false"
 """.format(
-            traefik_resource_name=traefik_resource_name,
+            service_name=service_name,
             health_path=health_path,
             health_interval=TRAEFIK_HEALTHCHECK_INTERVAL,
             health_timeout=TRAEFIK_HEALTHCHECK_TIMEOUT,
         )
 
     labels = """      - "{traefik_enable_label}"
-{backend_router_labels}      - "traefik.http.services.{traefik_resource_name}.loadbalancer.server.port={internal_port}"
+{backend_router_labels}      - "traefik.http.services.{service_name}.loadbalancer.server.port={internal_port}"
 {traefik_healthcheck_labels}      - "traefik.docker.network={traefik_network}"
 """.format(
-        resource_entry_name=resource_entry_name,
+        router_name=router_name,
         traefik_enable_label=TRAEFIK_ENABLE_LABEL,
         backend_router_labels=backend_router_labels,
-        traefik_resource_name=traefik_resource_name,
+        service_name=service_name,
         internal_port=internal_port,
         traefik_healthcheck_labels=traefik_healthcheck_labels,
         traefik_network=TRAEFIK_DOCKER_NETWORK,
@@ -233,15 +272,15 @@ def get_backend_traefik_labels(
         management_path = get_api_path(stack, manifest) if stack else ""
 
         labels += """
-      - "traefik.http.routers.{resource_entry_name}-project.rule={project_rule}"
-      - "traefik.http.routers.{resource_entry_name}-project.entrypoints={project_entrypoints}"
-      - "traefik.http.routers.{resource_entry_name}-project.service={traefik_resource_name}"
-      - "traefik.http.routers.{resource_entry_name}-project.middlewares={middleware_name}-project{maintenance_middleware}{sablier_middleware}"
+      - "traefik.http.routers.{router_name}-project.rule={project_rule}"
+      - "traefik.http.routers.{router_name}-project.entrypoints={project_entrypoints}"
+      - "traefik.http.routers.{router_name}-project.service={service_name}"
+      - "traefik.http.routers.{router_name}-project.middlewares={middleware_name}-project{maintenance_middleware}{sablier_middleware}"
       - "traefik.http.middlewares.{middleware_name}-project.stripprefix.prefixes={api_path}"
-      - "traefik.http.routers.{resource_entry_name}-project.priority={router_priority}"
+      - "traefik.http.routers.{router_name}-project.priority={router_priority}"
 """.format(
-            resource_entry_name=resource_entry_name,
-            traefik_resource_name=traefik_resource_name,
+            router_name=router_name,
+            service_name=service_name,
             project_rule=project_rule,
             project_entrypoints=project_entrypoints,
             middleware_name=middleware_name,
@@ -253,15 +292,15 @@ def get_backend_traefik_labels(
 
         if management_path and management_path != api_path and not stack_shared:
             labels += """
-      - "traefik.http.routers.{resource_entry_name}-management.rule=Host(`{api_host}`) && PathPrefix(`{management_path}`)"
-      - "traefik.http.routers.{resource_entry_name}-management.entrypoints={project_entrypoints}"
-      - "traefik.http.routers.{resource_entry_name}-management.service={traefik_resource_name}"
-      - "traefik.http.routers.{resource_entry_name}-management.middlewares={middleware_name}-management{sablier_middleware}"
+      - "traefik.http.routers.{router_name}-management.rule=Host(`{api_host}`) && PathPrefix(`{management_path}`)"
+      - "traefik.http.routers.{router_name}-management.entrypoints={project_entrypoints}"
+      - "traefik.http.routers.{router_name}-management.service={service_name}"
+      - "traefik.http.routers.{router_name}-management.middlewares={middleware_name}-management{sablier_middleware}"
       - "traefik.http.middlewares.{middleware_name}-management.stripprefix.prefixes={management_path}"
-      - "traefik.http.routers.{resource_entry_name}-management.priority={mgmt_priority}"
+      - "traefik.http.routers.{router_name}-management.priority={mgmt_priority}"
 """.format(
-                resource_entry_name=resource_entry_name,
-                traefik_resource_name=traefik_resource_name,
+                router_name=router_name,
+                service_name=service_name,
                 api_host=TRAEFIK_PROJECT_API_HOST,
                 management_path=management_path,
                 project_entrypoints=project_entrypoints,
@@ -273,11 +312,11 @@ def get_backend_traefik_labels(
         if old_path_pattern:
             labels += """
       # Redirect middleware for URL restructuring: old path -> new path
-      - "traefik.http.middlewares.{resource_entry_name}-redirect.redirectregex.regex=^`{old_path_pattern}/(.*)`"
-      - "traefik.http.middlewares.{resource_entry_name}-redirect.redirectregex.replacement=`{api_path}/$$1`"
-      - "traefik.http.middlewares.{resource_entry_name}-redirect.redirectregex.permanent=true"
+      - "traefik.http.middlewares.{router_name}-redirect.redirectregex.regex=^`{old_path_pattern}/(.*)`"
+      - "traefik.http.middlewares.{router_name}-redirect.redirectregex.replacement=`{api_path}/$$1`"
+      - "traefik.http.middlewares.{router_name}-redirect.redirectregex.permanent=true"
 """.format(
-                resource_entry_name=resource_entry_name,
+                router_name=router_name,
                 old_path_pattern=old_path_pattern,
                 api_path=api_path,
             )

package/runtime/engine/topologies/tilt/common/utils_output.star

@@ -85,6 +85,7 @@ def get_template_header(file_type, generator_name, resource_name='', extra_info=
 {c} TO MODIFY THIS CONFIGURATION:
 {c} 1. Edit the source generator in: .tilt/topologies/
 {c} 2. Or update service.json
+{c} Regenerate with: flisk config regenerate
 {c}
 {c} Generation Source: {generator}{resource_line}{extra_line}
 {border}

package/runtime/engine/topologies/tilt/generators/validators.star

@@ -571,7 +571,7 @@ def generate_resource_health_check(resource_name, resource_path, manifest, check
     }.get(manifest.get("language", "bun"), ["package.json", "prisma/schema.prisma"])
     required_files = {
         "backend": backend_files,
-        "frontend": ["package.json", "index.html", frontend_entry],
+        "frontend": ["package.json", "next.config.mjs", "src/app/page.tsx"] if manifest.get("framework") == "next" else ["package.json", "index.html", frontend_entry],
         "library": ["package.json"],
     }.get(app_type, ["package.json"])
     

package/runtime/engine/topologies/tilt/generators/vite/frontend.star

@@ -111,9 +111,9 @@ def generate_frontend(manifest, backend_manifest=None, write_fn=None):
     stack = manifest.get('stack', 'app')
     port = manifest.get('port', BASE_PORT_FRONTEND)
     hmr_port = port + 1000  # HMR port is always port + 1000
-    base_path = get_frontend_base_path(manifest)
-    vite_base_path = _normalize_vite_base_path(base_path)
     app_name = manifest.get('appName', 'unknown')
+    base_path = get_frontend_base_path(manifest, app_name)
+    vite_base_path = _normalize_vite_base_path(base_path)
 
     backend_port = BASE_PORT_BACKEND
     if backend_manifest:

package/runtime/engine/topologies/tilt/generators/vite/generators.star

@@ -31,6 +31,9 @@ def generate_for_manifest(manifest, backend_manifest=None, write_fn=None):
         return None
     
     if app_type == 'frontend':
+        # Next.js owns its build config (next.config.mjs); there is no Vite config to generate.
+        if manifest.get('framework') == 'next':
+            return None
         return generate_frontend(manifest, backend_manifest, write_fn)
     elif app_type == 'backend':
         return generate_backend(manifest, write_fn)

package/runtime/engine/topologies/tilt/manifest/constants.star

@@ -196,6 +196,9 @@ DEFAULT_SYNCS = {
     'bring-your-own': [],
 }
 
+# Next.js owns its entry files (no index.html) and rebuilds from package.json or next.config.*, which are not synced.
+NEXT_FRONTEND_SYNCS = ['src', 'public']
+
 RUNTIME_CONFIGS = {
     'bun': {
         'image_base': 'oven/bun:1.3.11-alpine',