Function runCreate

src/commands/project.ts:131–214

(
  opts: CreateOptions,
  deps: ProjectDeps = {},
)

}

export async function runCreate(
  opts: CreateOptions,
  deps: ProjectDeps = {},
): Promise<CliCreateProjectResponse> {
  const out = makeOutput(opts.output, deps);
  const stderr = deps.stderr ?? ((line: string) => process.stderr.write(`${line}\n`));

  // P1-2: validate idempotency key before sending as an HTTP header.
  // Non-ASCII chars cause a ByteString TypeError at the transport layer
  // (exit 10 UNAVAILABLE) — fail fast with a clear exit 5 instead.
  assertIdempotencyKey(opts.idempotencyKey);

  // P1-3: client-side length checks matching server limits.
  if (opts.name !== undefined && opts.name.length > 200) {
    throw localValidationError('--name must be at most 200 characters');
  }
  if (opts.description !== undefined && opts.description.length > 2000) {
    throw localValidationError('--description must be at most 2000 characters');
  }

  // P2-7: guard --url against localhost/RFC1918/non-http(s) (same rules as
  // `test create --target-url`). Applies to both FE (required) and BE (optional).
  if (opts.targetUrl !== undefined) {
    assertNotLocal(opts.targetUrl);
  }

  if (opts.type === 'frontend' && !opts.targetUrl) {
    throw localValidationError('--url is required for --type frontend');
  }

  if (opts.dryRun) {
    const idempotencyKey = opts.idempotencyKey ?? `cli-proj-create-${randomUUID()}`;
    // P2-6: gate idempotency-key output behind --verbose/--debug/json (matches
    // test create convention). Suppress in plain text interactive mode to reduce
    // noise; still available for automation and retry flows.
    if (
      opts.idempotencyKey === undefined &&
      (opts.output === 'json' || opts.verbose || opts.debug)
    ) {
      stderr(`idempotency-key: ${idempotencyKey}`);
    }
    const sample: CliCreateProjectResponse = {
      id: 'p_dryrun_2026',
      type: opts.type,
      name: opts.name,
      targetUrl: opts.targetUrl ?? '',
      createdFrom: 'cli',
      createdAt: '2026-05-16T00:00:00.000Z',
      updatedAt: '2026-05-16T00:00:00.000Z',
    } as unknown as CliCreateProjectResponse;
    out.print(sample, data => renderProjectText(data as CliProject));
    return sample;
  }

  // Resolve password: flag > file > none
  let password = opts.password;
  if (password === undefined && opts.passwordFile !== undefined) {
    password = readFileSync(opts.passwordFile, 'utf8').trim();