@percepta/create 3.0.1 → 3.1.2

package/templates/webapp/scripts/open-ryvn-deploy-pr.ts

@@ -0,0 +1,495 @@
+#!/usr/bin/env tsx
+/* eslint-disable n/no-process-env */
+
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { stdin as input, stdout as output } from "node:process";
+import { createInterface } from "node:readline/promises";
+import { fileURLToPath } from "node:url";
+
+const APP_NAME = "__APP_NAME__";
+const DATABASE_SCHEMA = "__APP_NAME_SNAKE__";
+const ENVIRONMENT = "percepta-test";
+const INFRA_REMOTE = "git@github.com:Percepta-Core/infra.git";
+
+type DeployPhase = "service" | "installation";
+
+interface Options {
+  infraPath?: string;
+  yes: boolean;
+  noClone: boolean;
+  phase: DeployPhase;
+}
+
+function parseArgs(argv: string[]): Options {
+  const options: Options = {
+    yes: false,
+    noClone: false,
+    phase: "service",
+  };
+
+  for (let index = 0; index < argv.length; index++) {
+    const arg = argv[index];
+    if (arg === "--yes" || arg === "-y") {
+      options.yes = true;
+    } else if (arg === "--no-clone") {
+      options.noClone = true;
+    } else if (arg === "--service") {
+      options.phase = "service";
+    } else if (arg === "--installation" || arg === "--install") {
+      options.phase = "installation";
+    } else if (arg === "--phase") {
+      const value = argv[index + 1];
+      if (!value) throw new Error("--phase requires service or installation");
+      if (value === "service") {
+        options.phase = "service";
+      } else if (value === "installation" || value === "install") {
+        options.phase = "installation";
+      } else {
+        throw new Error(
+          `Invalid --phase value "${value}". Use service or installation.`,
+        );
+      }
+      index++;
+    } else if (arg === "--infra") {
+      const value = argv[index + 1];
+      if (!value) throw new Error("--infra requires a path");
+      options.infraPath = path.resolve(value);
+      index++;
+    } else {
+      throw new Error(`Unknown argument: ${arg}`);
+    }
+  }
+
+  return options;
+}
+
+function run(
+  command: string,
+  args: string[],
+  cwd: string,
+  stdio: "inherit" | "pipe" = "inherit",
+): string {
+  const result = execFileSync(command, args, {
+    cwd,
+    encoding: "utf8",
+    stdio,
+  });
+
+  return typeof result === "string" ? result.trim() : "";
+}
+
+function assertCommand(command: string): void {
+  try {
+    run(command, ["--version"], process.cwd(), "pipe");
+  } catch {
+    throw new Error(
+      `Required command not found or not authenticated: ${command}`,
+    );
+  }
+}
+
+function findUp(startDir: string, fileName: string): string | null {
+  let dir = startDir;
+  while (true) {
+    if (existsSync(path.join(dir, fileName))) return dir;
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+function isGitRepo(dir: string): boolean {
+  if (!existsSync(dir)) return false;
+  try {
+    run("git", ["rev-parse", "--is-inside-work-tree"], dir, "pipe");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function confirm(message: string): Promise<boolean> {
+  const rl = createInterface({ input, output });
+  try {
+    const answer = (await rl.question(`${message} [Y/n] `))
+      .trim()
+      .toLowerCase();
+    return answer === "" || answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}
+
+async function resolveInfraRepo(
+  options: Options,
+  defaultInfraPath: string,
+): Promise<string> {
+  const infraPath =
+    options.infraPath ?? process.env.INFRA_REPO ?? defaultInfraPath;
+
+  if (isGitRepo(infraPath)) {
+    console.log(`Using infra repo: ${infraPath}`);
+    return infraPath;
+  }
+
+  if (existsSync(infraPath)) {
+    throw new Error(`${infraPath} exists but is not a git repository`);
+  }
+
+  if (options.noClone) {
+    throw new Error(
+      `Infra repo not found at ${infraPath}. Re-run with --infra <path>.`,
+    );
+  }
+
+  if (!options.yes) {
+    if (!process.stdin.isTTY) {
+      throw new Error(
+        `Infra repo not found at ${infraPath}. Re-run with --yes to clone or --infra <path>.`,
+      );
+    }
+
+    const shouldClone = await confirm(
+      `Infra repo not found. Clone Percepta-Core/infra to ${infraPath}?`,
+    );
+    if (!shouldClone) {
+      throw new Error(
+        "Skipped cloning infra repo. Re-run with --infra <path>.",
+      );
+    }
+  }
+
+  await mkdir(path.dirname(infraPath), { recursive: true });
+  console.log(`Cloning ${INFRA_REMOTE} to ${infraPath}...`);
+  run("git", ["clone", INFRA_REMOTE, infraPath], process.cwd());
+  console.log(`Cloned infra repo: ${infraPath}`);
+  return infraPath;
+}
+
+function assertCleanGitWorktree(repoPath: string): void {
+  const status = run("git", ["status", "--porcelain"], repoPath, "pipe");
+  if (status.length === 0) return;
+
+  throw new Error(
+    `Infra repo has local changes. Commit/stash them first or use --infra with a clean checkout.\n${status}`,
+  );
+}
+
+function getDeployBranchName(phase: DeployPhase): string {
+  return phase === "service"
+    ? `deploy/${APP_NAME}-${ENVIRONMENT}-service`
+    : `deploy/${APP_NAME}-${ENVIRONMENT}-installation`;
+}
+
+function switchDeployBranch(repoPath: string, phase: DeployPhase): string {
+  const branchName = getDeployBranchName(phase);
+  const currentBranch = run(
+    "git",
+    ["branch", "--show-current"],
+    repoPath,
+    "pipe",
+  );
+  if (currentBranch === branchName) return branchName;
+
+  run("git", ["fetch", "origin", "main"], repoPath);
+
+  let branchExists = false;
+  try {
+    run("git", ["rev-parse", "--verify", branchName], repoPath, "pipe");
+    branchExists = true;
+  } catch {
+    branchExists = false;
+  }
+
+  if (branchExists) {
+    run("git", ["switch", branchName], repoPath);
+  } else {
+    run("git", ["switch", "-c", branchName, "origin/main"], repoPath);
+  }
+
+  return branchName;
+}
+
+async function writeIfChanged(
+  filePath: string,
+  content: string,
+): Promise<boolean> {
+  if (existsSync(filePath)) {
+    const existing = await readFile(filePath, "utf8");
+    if (existing === content) return false;
+  }
+
+  await mkdir(path.dirname(filePath), { recursive: true });
+  await writeFile(filePath, content);
+  return true;
+}
+
+async function copyDeployYaml(
+  packageDir: string,
+  infraRepo: string,
+  phase: DeployPhase,
+): Promise<string[]> {
+  const serviceSource = path.join(
+    packageDir,
+    "deploy",
+    "ryvn",
+    `${APP_NAME}.service.yaml`,
+  );
+  const installationSource = path.join(
+    packageDir,
+    "deploy",
+    "ryvn",
+    "environments",
+    ENVIRONMENT,
+    "installations",
+    `${APP_NAME}.env.${ENVIRONMENT}.serviceinstallation.yaml`,
+  );
+
+  const serviceTarget = path.join(
+    infraRepo,
+    "ryvn",
+    `${APP_NAME}.service.yaml`,
+  );
+  const installationTarget = path.join(
+    infraRepo,
+    "ryvn",
+    "environments",
+    ENVIRONMENT,
+    "installations",
+    `${APP_NAME}.env.${ENVIRONMENT}.serviceinstallation.yaml`,
+  );
+
+  const changed: string[] = [];
+  if (
+    phase === "service" &&
+    (await writeIfChanged(serviceTarget, await readFile(serviceSource, "utf8")))
+  ) {
+    changed.push(path.relative(infraRepo, serviceTarget));
+  }
+  if (
+    phase === "installation" &&
+    (await writeIfChanged(
+      installationTarget,
+      await readFile(installationSource, "utf8"),
+    ))
+  ) {
+    changed.push(path.relative(infraRepo, installationTarget));
+  }
+
+  return changed;
+}
+
+async function ensureDatabaseSchema(infraRepo: string): Promise<string | null> {
+  const databasesPath = path.join(
+    infraRepo,
+    "terraform",
+    "percepta-internal",
+    "databases.tf",
+  );
+  const content = await readFile(databasesPath, "utf8");
+
+  if (
+    content.includes(`resource "postgresql_schema" "${DATABASE_SCHEMA}"`) ||
+    content.includes(`name     = "${DATABASE_SCHEMA}"`)
+  ) {
+    return null;
+  }
+
+  const block = `resource "postgresql_schema" "${DATABASE_SCHEMA}" {
+  provider = postgresql.percepta_internal
+  database = postgresql_database.demos.name
+  name     = "${DATABASE_SCHEMA}"
+}
+`;
+
+  await appendFile(
+    databasesPath,
+    `${content.endsWith("\n") ? "\n" : "\n\n"}${block}`,
+  );
+
+  return path.relative(infraRepo, databasesPath);
+}
+
+function hasStagedChanges(repoPath: string): boolean {
+  try {
+    run("git", ["diff", "--cached", "--quiet"], repoPath, "pipe");
+    return false;
+  } catch (error) {
+    const status =
+      typeof error === "object" && error !== null && "status" in error
+        ? (error as { status?: number }).status
+        : undefined;
+    if (status === 1) return true;
+    throw error;
+  }
+}
+
+function getPrUrl(repoPath: string, branchName: string): string | null {
+  try {
+    return run(
+      "gh",
+      ["pr", "view", branchName, "--json", "url", "--jq", ".url"],
+      repoPath,
+      "pipe",
+    );
+  } catch {
+    return null;
+  }
+}
+
+function getPrTitle(phase: DeployPhase): string {
+  return phase === "service"
+    ? `Add ${APP_NAME} ${ENVIRONMENT} service`
+    : `Install ${APP_NAME} in ${ENVIRONMENT}`;
+}
+
+function getPrBody(phase: DeployPhase): string {
+  if (phase === "service") {
+    return [
+      `Adds the Ryvn service for ${APP_NAME}.`,
+      "",
+      `Also creates the ${DATABASE_SCHEMA} schema in the shared demos database.`,
+      "",
+      "After merge:",
+      "1. Let GitOps import the service.",
+      "2. Approve/apply the percepta-internal Terraform task if one is created.",
+      "3. Push the app to main or run the release workflow so Ryvn has a first release.",
+      `4. Open the installation PR with pnpm deploy:percepta-test -- --phase installation --yes.`,
+    ].join("\n");
+  }
+
+  return [
+    `Adds the ${ENVIRONMENT} ServiceInstallation for ${APP_NAME}.`,
+    "",
+    "Pre-merge checklist:",
+    "1. The Ryvn Service exists from the service/schema PR.",
+    "2. At least one Ryvn release exists for this service.",
+    "",
+    "After merge, import deploy/ryvn/percepta-test.secrets.env in the Ryvn UI for the installation secrets.",
+  ].join("\n");
+}
+
+function printNextSteps(phase: DeployPhase): void {
+  if (phase === "service") {
+    console.log("");
+    console.log("Next:");
+    console.log("1. Merge the service/schema PR.");
+    console.log("2. Wait for GitOps to import the service.");
+    console.log(
+      "3. Approve/apply the percepta-internal Terraform task if one is created.",
+    );
+    console.log("4. Push the app to main or run the release workflow.");
+    console.log(
+      "5. Run: pnpm deploy:percepta-test -- --phase installation --yes",
+    );
+    return;
+  }
+
+  console.log("");
+  console.log("Next:");
+  console.log("1. Merge the installation PR.");
+  console.log("2. Let GitOps import the ServiceInstallation.");
+  console.log(
+    "3. Import deploy/ryvn/percepta-test.secrets.env in the Ryvn UI.",
+  );
+  console.log(
+    "4. Verify health with: ryvn get installation __APP_NAME__ -e percepta-test",
+  );
+}
+
+async function confirmInstallationPrerequisites(
+  options: Options,
+): Promise<void> {
+  if (options.phase !== "installation" || options.yes) return;
+
+  const message =
+    "Before opening the installation PR, confirm the service exists, " +
+    "and a first Ryvn release exists. Continue?";
+
+  if (!process.stdin.isTTY) {
+    throw new Error(`${message} Re-run with --yes to confirm.`);
+  }
+
+  if (!(await confirm(message))) {
+    throw new Error("Skipped installation PR.");
+  }
+}
+
+async function main(): Promise<void> {
+  const options = parseArgs(process.argv.slice(2));
+  assertCommand("git");
+  assertCommand("gh");
+  await confirmInstallationPrerequisites(options);
+
+  const packageDir = path.resolve(
+    path.dirname(fileURLToPath(import.meta.url)),
+    "..",
+  );
+  const monorepoRoot = findUp(packageDir, "pnpm-workspace.yaml") ?? packageDir;
+  const defaultInfraPath = path.resolve(monorepoRoot, "..", "infra");
+  const infraRepo = await resolveInfraRepo(options, defaultInfraPath);
+
+  assertCleanGitWorktree(infraRepo);
+  const branchName = switchDeployBranch(infraRepo, options.phase);
+
+  const changedPaths = await copyDeployYaml(
+    packageDir,
+    infraRepo,
+    options.phase,
+  );
+  if (options.phase === "service") {
+    const schemaPath = await ensureDatabaseSchema(infraRepo);
+    if (schemaPath) changedPaths.push(schemaPath);
+  }
+
+  if (changedPaths.length === 0) {
+    console.log(
+      options.phase === "service"
+        ? "Infra repo already has the generated Ryvn service and database schema."
+        : "Infra repo already has the generated Ryvn installation.",
+    );
+    printNextSteps(options.phase);
+    return;
+  }
+
+  run("git", ["add", ...changedPaths], infraRepo);
+  if (!hasStagedChanges(infraRepo)) {
+    console.log("No infra changes to commit.");
+    return;
+  }
+
+  run("git", ["commit", "-m", getPrTitle(options.phase)], infraRepo);
+  run("git", ["push", "-u", "origin", branchName], infraRepo);
+
+  const existingPr = getPrUrl(infraRepo, branchName);
+  if (existingPr) {
+    console.log(`Infra PR: ${existingPr}`);
+    printNextSteps(options.phase);
+    return;
+  }
+
+  const prUrl = run(
+    "gh",
+    [
+      "pr",
+      "create",
+      "--title",
+      getPrTitle(options.phase),
+      "--body",
+      getPrBody(options.phase),
+    ],
+    infraRepo,
+    "pipe",
+  );
+
+  console.log(`Infra PR: ${prUrl}`);
+  printNextSteps(options.phase);
+}
+
+void main().catch((error) => {
+  console.error(error instanceof Error ? error.message : error);
+  process.exit(1);
+});

package/templates/webapp/scripts/seed.ts

@@ -18,7 +18,7 @@ const DEFAULT_USER = {
 
 async function main(): Promise<void> {
   loadEnvConfig(process.cwd());
-  // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-explicit-any
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unsafe-member-access
   (globalThis as any).AsyncLocalStorage = AsyncLocalStorage;
 
   const { auth } = await import("../src/lib/auth");

package/templates/webapp/scripts/setup-database.ts

@@ -1,6 +1,9 @@
 import { loadEnvConfig } from "@next/env";
 import { Pool } from "pg";
 import { getEnvConfig } from "../src/config/getEnvConfig";
+import { getPgSslConfig } from "../src/drizzle/ssl";
+
+const SHARED_DATABASES = new Set(["demos", "internal_apps"]);
 
 async function main(): Promise<void> {
   loadEnvConfig(process.cwd());
@@ -11,6 +14,7 @@ async function main(): Promise<void> {
     DATABASE_USERNAME: user,
     DATABASE_PASSWORD: password,
     DATABASE_NAME: database,
+    DATABASE_SCHEMA: databaseSchema,
     DATABASE_USE_SSL: useSSL,
   } = getEnvConfig();
 
@@ -18,6 +22,17 @@ async function main(): Promise<void> {
   console.log(`📍 Host: ${host}:${port}`);
   console.log(`👤 User: ${user}`);
 
+  if (SHARED_DATABASES.has(database)) {
+    console.log(
+      `✅ ${database} is a shared database; skipping CREATE DATABASE. ` +
+        "The database is managed by infra.",
+    );
+    if (databaseSchema) {
+      console.log(`📦 Using schema: ${databaseSchema}`);
+    }
+    return;
+  }
+
   // First, connect to the default 'postgres' database to create our target database
   const adminClient = new Pool({
     host,
@@ -25,7 +40,7 @@ async function main(): Promise<void> {
     user,
     password,
     database: "postgres", // Connect to default postgres database
-    ssl: useSSL,
+    ssl: getPgSslConfig(useSSL),
   });
 
   try {

package/templates/webapp/scripts/start.sh

@@ -17,8 +17,9 @@ echo "Running database migrations..."
 if pnpm db:setup-and-migrate; then
     echo "✅ Database migrations completed successfully"
 else
-    echo "❌ Database migration failed. App will start anyway."
+    echo "❌ Database migration failed. App will not start."
     echo "Check your database configuration and connectivity."
+    exit 1
 fi
 
 # Setup readonly database user for EDW (only if READONLY_SECRET_NAME is set)
@@ -49,4 +50,4 @@ fi
 
 # Start the Next.js application
 echo "Starting Next.js server on port ${PORT:-3000}..."
-exec pnpm start
+exec pnpm start

package/templates/webapp/src/app/(app)/layout.tsx

@@ -1,11 +1,7 @@
 import React from "react";
 import Header from "../../components/Header";
 
-export default function AppLayout({
-  children,
-}: {
-  children: React.ReactNode;
-}) {
+export default function AppLayout({ children }: { children: React.ReactNode }) {
   return (
     <>
       <Header />

package/templates/webapp/src/app/(auth)/auth/signin/CredentialsSignInForm.tsx

@@ -2,14 +2,15 @@
 
 import { zodResolver } from "@hookform/resolvers/zod";
 import { Button, Input } from "@percepta/design";
+import Link from "next/link";
 import { useRouter, useSearchParams } from "next/navigation";
 import React, { useCallback } from "react";
 import { Controller, useForm } from "react-hook-form";
 import { toast } from "sonner";
 import z from "zod";
 import { FormItem } from "../../../../components/form/FormItem";
-import { authClient } from "../../../../lib/auth-client";
 import { IS_DEV } from "../../../../config/isDev";
+import { authClient } from "../../../../lib/auth-client";
 
 const CREDENTIALS_SCHEMA = z.object({
   email: z.string().min(1, "Email is required"),
@@ -66,6 +67,15 @@ export function CredentialsSignInForm() {
     <div className="space-y-8">
       <div className="text-center">
         <h1 className="text-2xl font-bold text-foreground">Sign In</h1>
+        <p className="mt-2 text-sm text-muted-foreground">
+          Need an account?{" "}
+          <Link
+            className="font-medium text-primary underline-offset-4 hover:underline"
+            href={`/auth/signup?callbackUrl=${encodeURIComponent(callbackUrl)}`}
+          >
+            Create one
+          </Link>
+        </p>
       </div>
       <form className="space-y-6" onSubmit={handleSubmit(submit)}>
         <div className="space-y-4">