create-svc 0.1.10 → 0.1.11

package/templates/shared/scripts/cloudrun/lib.ts

@@ -4,6 +4,7 @@ import { config } from "./config";
 type CommandOptions = {
   allowFailure?: boolean;
   input?: string;
+  env?: Record<string, string | undefined>;
 };
 
 type DeployArgs = {
@@ -15,6 +16,7 @@ type DeployArgs = {
 
 type CleanupArgs = {
   destroyProject: boolean;
+  force: boolean;
 };
 
 export type DeploymentTarget = {
@@ -24,6 +26,13 @@ export type DeploymentTarget = {
   databaseSecretName: string;
 };
 
+type GcpResourceWithLabels = {
+  metadata?: {
+    labels?: Record<string, string>;
+  };
+  labels?: Record<string, string>;
+};
+
 type CommandResult = {
   success: boolean;
   stdout: string;
@@ -67,7 +76,7 @@ export function requireGcloudAuth() {
     throw new Error(
       [
         "gcloud is installed but no active Google Cloud account is available.",
-        "Run `gcloud auth login` on this machine before using bootstrap, deploy, or cleanup.",
+        "Run `gcloud auth login` on this machine before using service create, deploy, doctor, dns, or destroy.",
         "If you also rely on Application Default Credentials for other tooling, run `gcloud auth application-default login` as well.",
       ].join(" ")
     );
@@ -77,7 +86,7 @@ export function requireGcloudAuth() {
 export function run(command: string, args: string[], options: CommandOptions = {}): CommandResult {
   const result = Bun.spawnSync([command, ...args], {
     cwd: process.cwd(),
-    env: process.env,
+    env: { ...process.env, ...options.env },
     stdin: options.input === undefined ? undefined : encoder.encode(options.input),
     stdout: "pipe",
     stderr: "pipe",
@@ -119,7 +128,7 @@ export async function runStep<T>(label: string, task: () => Promise<T> | T) {
   }
 }
 
-export async function runMain(name: string, task: () => Promise<string | void>) {
+export async function runMain(name: string, task: () => Promise<string | void> | string | void) {
   intro(name);
 
   try {
@@ -152,6 +161,9 @@ export function ensureProject() {
 }
 
 export function attachBilling() {
+  if (config.project.mode === "use_existing") {
+    return "Using existing project billing";
+  }
   gcloud(["beta", "billing", "projects", "link", config.project.id, "--billing-account", config.project.billingAccount]);
 }
 
@@ -192,7 +204,17 @@ export function ensureSecret(secretName: string) {
     return;
   }
 
-  gcloud(["secrets", "create", secretName, "--project", config.project.id, "--replication-policy", "automatic"]);
+  gcloud([
+    "secrets",
+    "create",
+    secretName,
+    "--project",
+    config.project.id,
+    "--replication-policy",
+    "automatic",
+    "--labels",
+    ownershipLabelsArg(),
+  ]);
 }
 
 export function addSecretVersion(secretName: string, value: string) {
@@ -200,6 +222,10 @@ export function addSecretVersion(secretName: string, value: string) {
   gcloud(["secrets", "versions", "add", secretName, "--project", config.project.id, "--data-file=-"], { input: value });
 }
 
+export function accessSecretVersion(secretName: string) {
+  return gcloud(["secrets", "versions", "access", "latest", "--secret", secretName, "--project", config.project.id]).stdout;
+}
+
 export function ensureSecretAccessor(secretName: string, member: string) {
   gcloud(["secrets", "add-iam-policy-binding", secretName, "--project", config.project.id, "--member", member, "--role", "roles/secretmanager.secretAccessor"]);
 }
@@ -216,6 +242,11 @@ export function deleteSecret(secretName: string) {
   gcloud(["secrets", "delete", secretName, "--project", config.project.id, "--quiet"], { allowFailure: true });
 }
 
+export function describeSecret(secretName: string): GcpResourceWithLabels | undefined {
+  const result = gcloud(["secrets", "describe", secretName, "--project", config.project.id, "--format=json"], { allowFailure: true });
+  return parseOptionalJson(result.stdout, result.success);
+}
+
 export function ensureArtifactRepository() {
   if (
     gcloud(
@@ -240,24 +271,6 @@ export function ensureArtifactRepository() {
   ]);
 }
 
-export function ensureStorageBucket() {
-  if (gcloud(["storage", "buckets", "describe", `gs://${config.storage.attachmentBucket}`, "--project", config.project.id], { allowFailure: true }).success) {
-    return;
-  }
-
-  gcloud([
-    "storage",
-    "buckets",
-    "create",
-    `gs://${config.storage.attachmentBucket}`,
-    "--project",
-    config.project.id,
-    "--location",
-    config.region,
-    "--uniform-bucket-level-access",
-  ]);
-}
-
 export function projectNumber() {
   return gcloud(["projects", "describe", config.project.id, "--format=value(projectNumber)"]).stdout;
 }
@@ -330,6 +343,7 @@ export function parseDeployArgs(argv: string[]): DeployArgs {
 export function parseCleanupArgs(argv: string[]): CleanupArgs {
   const parsed: CleanupArgs = {
     destroyProject: false,
+    force: false,
   };
 
   for (const token of argv) {
@@ -337,6 +351,10 @@ export function parseCleanupArgs(argv: string[]): CleanupArgs {
       parsed.destroyProject = true;
       continue;
     }
+    if (token === "--force") {
+      parsed.force = true;
+      continue;
+    }
   }
 
   return parsed;
@@ -374,42 +392,63 @@ export function resolveDeploymentTarget(environment: DeployArgs["environment"],
   };
 }
 
-export function runtimeSecretNames(target: DeploymentTarget) {
-  return {
-    CLERK_SECRET_KEY: `${target.serviceName}-clerk-secret-key`,
-    CLERK_WEBHOOK_SECRET: `${target.serviceName}-clerk-webhook-secret`,
-    STRIPE_SECRET_KEY: `${target.serviceName}-stripe-secret-key`,
-    STRIPE_WEBHOOK_SECRET: `${target.serviceName}-stripe-webhook-secret`,
-    REVENUECAT_API_KEY: `${target.serviceName}-revenuecat-api-key`,
-    REVENUECAT_WEBHOOK_SECRET: `${target.serviceName}-revenuecat-webhook-secret`,
-    RESEND_API_KEY: `${target.serviceName}-resend-api-key`,
-    POSTHOG_API_KEY: `${target.serviceName}-posthog-api-key`,
-  } as const;
-}
-
 export async function renderManifest(image: string, target: DeploymentTarget) {
   const template = await Bun.file(new URL("../../service.yaml", import.meta.url)).text();
+  const temporal = resolveTemporalRuntimeConfig();
   const values = {
     SERVICE_NAME: target.serviceName,
+    SERVICE_ID: config.serviceName,
     RUNTIME_SERVICE_ACCOUNT: config.runtimeServiceAccount,
     IMAGE_URL: image,
     DATABASE_URL_SECRET: target.databaseSecretName,
-    ...runtimeSecretNames(target),
     SERVICE_RUNTIME: config.runtime,
     SERVICE_FRAMEWORK: config.framework,
-    ATTACHMENT_BUCKET: config.storage.attachmentBucket,
-    ATTACHMENT_PUBLIC_BASE_URL: config.storage.attachmentPublicBaseUrl,
+    TEMPORAL_ENABLED: String(temporal.enabled),
+    TEMPORAL_ADDRESS: temporal.address,
+    TEMPORAL_NAMESPACE: temporal.namespace,
+    TEMPORAL_TASK_QUEUE: temporal.taskQueue,
+    TEMPORAL_API_KEY_ENV: temporal.apiKeySecretName
+      ? [
+          "            - name: TEMPORAL_API_KEY",
+          "              valueFrom:",
+          "                secretKeyRef:",
+          `                  name: ${temporal.apiKeySecretName}`,
+          "                  key: latest",
+        ].join("\n")
+      : "",
+    AUTH_ISSUER: config.auth.issuer,
+    AUTH_AUDIENCE: config.auth.audience,
+    AUTH_JWKS_URL: config.auth.jwksUrl,
   };
 
   return template.replace(/\$\{([A-Z0-9_]+)\}/g, (_, key: string) => {
     const value = values[key as keyof typeof values];
-    if (!value) {
+    if (value === undefined) {
       throw new Error(`missing manifest value for ${key}`);
     }
     return value;
   });
 }
 
+export function resolveTemporalRuntimeConfig() {
+  const enabledOverride = process.env.TEMPORAL_ENABLED?.trim();
+  const address = process.env.TEMPORAL_ADDRESS?.trim() || config.temporal.address;
+  const namespace = process.env.TEMPORAL_NAMESPACE?.trim() || config.temporal.namespace;
+  const taskQueue = process.env.TEMPORAL_TASK_QUEUE?.trim() || config.temporal.taskQueue;
+  const apiKeySecretName = process.env.TEMPORAL_API_KEY_SECRET?.trim() || (process.env.TEMPORAL_API_KEY?.trim() ? config.temporal.apiKeySecretName : "");
+  const enabled = enabledOverride
+    ? ["1", "true", "yes", "on"].includes(enabledOverride.toLowerCase())
+    : Boolean(process.env.TEMPORAL_ADDRESS?.trim() || process.env.TEMPORAL_API_KEY?.trim() || process.env.TEMPORAL_API_KEY_SECRET?.trim());
+
+  return {
+    enabled,
+    address,
+    namespace,
+    taskQueue,
+    apiKeySecretName,
+  };
+}
+
 export async function writeRenderedManifest(image: string, target: DeploymentTarget) {
   const rendered = await renderManifest(image, target);
   const path = new URL("../../.cloudrun.rendered.yaml", import.meta.url);
@@ -441,8 +480,13 @@ export function serviceOrigin(target: DeploymentTarget) {
 }
 
 export function ensureProductionDomainMapping(serviceName: string) {
-  if (gcloud(["beta", "run", "domain-mappings", "describe", "--domain", config.domain.hostname, "--project", config.project.id], { allowFailure: true }).success) {
-    return;
+  const existing = describeProductionDomainMapping();
+  if (existing) {
+    const mappedService = existing.spec?.routeName ?? existing.status?.resourceRecords?.[0]?.rrdata;
+    if (!mappedService || mappedService === serviceName) {
+      return;
+    }
+    throw new Error(`${config.domain.hostname} is already mapped to ${mappedService}; refusing to take it over`);
   }
 
   gcloud([
@@ -461,6 +505,60 @@ export function ensureProductionDomainMapping(serviceName: string) {
   ]);
 }
 
+export function describeProductionDomainMapping():
+  | { spec?: { routeName?: string }; status?: { resourceRecords?: Array<{ rrdata?: string }> } }
+  | undefined {
+  const result = gcloud(
+    [
+      "beta",
+      "run",
+      "domain-mappings",
+      "describe",
+      "--domain",
+      config.domain.hostname,
+      "--project",
+      config.project.id,
+      "--region",
+      config.region,
+      "--format=json",
+    ],
+    { allowFailure: true }
+  );
+  if (!result.success || !result.stdout) {
+    return undefined;
+  }
+
+  try {
+    return JSON.parse(result.stdout);
+  } catch {
+    throw new Error(`Unable to parse Cloud Run domain mapping for ${config.domain.hostname}`);
+  }
+}
+
+export function assertProductionDomainAvailable(serviceName: string) {
+  const existing = describeProductionDomainMapping();
+  if (!existing) {
+    return;
+  }
+
+  const mappedService = existing.spec?.routeName;
+  if (mappedService && mappedService !== serviceName) {
+    throw new Error(`${config.domain.hostname} is already mapped to ${mappedService}; choose a different service_id before provisioning resources`);
+  }
+
+  throw new Error(`${config.domain.hostname} already has a domain mapping; use service deploy to redeploy or service dns to repair it`);
+}
+
+export function assertServiceNameAvailable(serviceName: string) {
+  const result = gcloud(
+    ["run", "services", "describe", serviceName, "--project", config.project.id, "--region", config.region, "--format=value(metadata.name)"],
+    { allowFailure: true }
+  );
+  if (result.success) {
+    throw new Error(`${serviceName} already exists in Cloud Run; use service deploy to redeploy or service destroy to remove owned resources`);
+  }
+}
+
 export function deleteProductionDomainMapping() {
   gcloud(["beta", "run", "domain-mappings", "delete", "--domain", config.domain.hostname, "--project", config.project.id, "--quiet"], {
     allowFailure: true,
@@ -474,6 +572,14 @@ export function listCloudRunServices() {
     .filter(Boolean);
 }
 
+export function describeCloudRunService(serviceName: string): GcpResourceWithLabels | undefined {
+  const result = gcloud(
+    ["run", "services", "describe", serviceName, "--project", config.project.id, "--region", config.region, "--format=json"],
+    { allowFailure: true }
+  );
+  return parseOptionalJson(result.stdout, result.success);
+}
+
 export function deleteService(serviceName: string) {
   gcloud(["run", "services", "delete", serviceName, "--project", config.project.id, "--region", config.region, "--quiet"], {
     allowFailure: true,
@@ -491,3 +597,30 @@ function slugify(value: string) {
     .replace(/[^a-z0-9]+/g, "-")
     .replace(/^-+|-+$/g, "");
 }
+
+export function assertOwnedResource(name: string, resource: GcpResourceWithLabels | undefined) {
+  if (!resource) {
+    throw new Error(`${name} does not exist`);
+  }
+
+  const labels = resource.metadata?.labels ?? resource.labels ?? {};
+  if (labels.managed_by !== "create-service" || labels.service_id !== config.serviceName) {
+    throw new Error(`${name} is missing ownership labels for service_id=${config.serviceName}`);
+  }
+}
+
+function ownershipLabelsArg() {
+  return `managed_by=create-service,service_id=${config.serviceName}`;
+}
+
+function parseOptionalJson<T>(stdout: string, success: boolean): T | undefined {
+  if (!success || !stdout) {
+    return undefined;
+  }
+
+  try {
+    return JSON.parse(stdout) as T;
+  } catch {
+    throw new Error("Unable to parse gcloud JSON response");
+  }
+}

package/templates/shared/scripts/cloudrun/neon.ts

@@ -13,6 +13,11 @@ type NeonBranch = {
   name: string;
 };
 
+type NeonDatabase = {
+  name: string;
+  ownerName: string;
+};
+
 type ResolvedNeonConfig = {
   projectId: string;
   baseBranchId: string;
@@ -110,6 +115,18 @@ export async function listBranches(projectId: string) {
     .sort((left: NeonBranch, right: NeonBranch) => left.name.localeCompare(right.name));
 }
 
+export async function listDatabases(projectId: string, branchId: string) {
+  const payload = await (await neonClient()).listProjectBranchDatabases(projectId, branchId);
+  const databases = ((payload.data as { databases?: Array<{ name?: string; owner_name?: string }> } | undefined)?.databases ?? []);
+  return databases
+    .map((database: { name?: string; owner_name?: string }) => ({
+      name: database.name ?? "",
+      ownerName: database.owner_name ?? "",
+    }))
+    .filter((database: NeonDatabase): database is NeonDatabase => Boolean(database.name))
+    .sort((left: NeonDatabase, right: NeonDatabase) => left.name.localeCompare(right.name));
+}
+
 export async function resolveNeonConfig(): Promise<ResolvedNeonConfig> {
   const configuredProjectId = config.neon.projectId.trim();
   const configuredBaseBranchId = config.neon.baseBranchId.trim();
@@ -172,6 +189,7 @@ export async function ensureDatabase(projectId: string, branchId: string, databa
 }
 
 export async function deleteDatabase(projectId: string, branchId: string, databaseName: string) {
+  await assertDatabaseOwned(projectId, branchId, databaseName);
   try {
     await (await neonClient()).deleteProjectBranchDatabase(projectId, branchId, databaseName);
   } catch (error) {
@@ -213,6 +231,11 @@ export async function ensureBranch(projectId: string, branchName: string, parent
 }
 
 export async function deleteBranch(projectId: string, branchId: string) {
+  const branch = (await listBranches(projectId)).find((candidate) => candidate.id === branchId);
+  if (!branch) {
+    return;
+  }
+  assertDisposableBranchName(branch.name);
   try {
     await (await neonClient()).deleteProjectBranch(projectId, branchId);
   } catch (error) {
@@ -224,6 +247,28 @@ export async function deleteBranch(projectId: string, branchId: string) {
   }
 }
 
+async function assertDatabaseOwned(projectId: string, branchId: string, databaseName: string) {
+  if (databaseName !== config.neon.databaseName) {
+    throw new Error(`Refusing to delete Neon database ${databaseName}; expected ${config.neon.databaseName}`);
+  }
+
+  const database = (await listDatabases(projectId, branchId)).find((candidate) => candidate.name === databaseName);
+  if (!database) {
+    return;
+  }
+
+  if (database.ownerName && database.ownerName !== config.neon.roleName) {
+    throw new Error(`Refusing to delete Neon database ${databaseName}; owner is ${database.ownerName}, expected ${config.neon.roleName}`);
+  }
+}
+
+function assertDisposableBranchName(branchName: string) {
+  if (branchName.startsWith(`${config.neon.previewBranchPrefix}-`) || branchName.startsWith(`${config.neon.personalBranchPrefix}-`)) {
+    return;
+  }
+  throw new Error(`Refusing to delete Neon branch ${branchName}; it is not owned by ${config.serviceName}`);
+}
+
 export async function getConnectionUri(projectId: string, branchId: string, databaseName: string, roleName: string) {
   const payload = await (await neonClient()).getConnectionUri({
     projectId,

package/templates/shared/scripts/dev.ts

@@ -0,0 +1,22 @@
+import { readLocalEnv } from "./local-env";
+import { ensureLocalPostgres } from "./local-docker";
+
+const command = Bun.argv.slice(2);
+
+if (command.length === 0) {
+  throw new Error("Usage: bun run ./scripts/dev.ts <command...>");
+}
+
+await ensureLocalPostgres();
+
+const child = Bun.spawn(command, {
+  stdin: "inherit",
+  stdout: "inherit",
+  stderr: "inherit",
+  env: {
+    ...Bun.env,
+    ...(await readLocalEnv()),
+  },
+});
+
+process.exit(await child.exited);

package/templates/shared/scripts/ensure-local-db.ts

@@ -0,0 +1,3 @@
+import { ensureLocalPostgres } from "./local-docker";
+
+await ensureLocalPostgres();

package/templates/shared/scripts/local-docker.ts

@@ -0,0 +1,63 @@
+export async function ensureLocalPostgres() {
+  await ensureDockerRunning();
+  await run(["docker", "compose", "up", "-d"], { label: "start local postgres" });
+}
+
+async function ensureDockerRunning() {
+  if (await dockerInfo()) {
+    return;
+  }
+
+  await openDocker();
+  const deadline = Date.now() + 120_000;
+
+  while (Date.now() < deadline) {
+    if (await dockerInfo()) {
+      return;
+    }
+    await Bun.sleep(2_000);
+  }
+
+  throw new Error("Docker did not become ready within 120 seconds. Open Docker Desktop and retry.");
+}
+
+async function dockerInfo() {
+  const result = await Bun.spawn(["docker", "info"], {
+    stdout: "ignore",
+    stderr: "ignore",
+  }).exited;
+  return result === 0;
+}
+
+async function openDocker() {
+  if (process.platform === "darwin") {
+    await run(["open", "-a", "Docker"], { label: "open Docker Desktop" });
+    return;
+  }
+
+  if (process.platform === "win32") {
+    await run(["powershell.exe", "-NoProfile", "-Command", "Start-Process 'Docker Desktop'"], {
+      label: "open Docker Desktop",
+      optional: true,
+    });
+    return;
+  }
+
+  await run(["systemctl", "--user", "start", "docker-desktop"], {
+    label: "open Docker Desktop",
+    optional: true,
+  });
+}
+
+async function run(command: string[], options: { label: string; optional?: boolean }) {
+  const result = await Bun.spawn(command, {
+    stdin: "ignore",
+    stdout: "inherit",
+    stderr: "inherit",
+    env: Bun.env,
+  }).exited;
+
+  if (result !== 0 && !options.optional) {
+    throw new Error(`${options.label} failed with exit code ${result}`);
+  }
+}

package/templates/shared/scripts/local-env.ts

@@ -0,0 +1,27 @@
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+
+export async function readLocalEnv() {
+  if (!existsSync(".env.local")) {
+    return {};
+  }
+
+  const values: Record<string, string> = {};
+  const text = await readFile(".env.local", "utf8");
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      continue;
+    }
+
+    const separator = trimmed.indexOf("=");
+    if (separator === -1) {
+      continue;
+    }
+
+    const key = trimmed.slice(0, separator).trim();
+    const rawValue = trimmed.slice(separator + 1).trim();
+    values[key] = rawValue.replace(/^['"]|['"]$/g, "");
+  }
+  return values;
+}

package/templates/shared/scripts/seed.ts

@@ -0,0 +1,73 @@
+#!/usr/bin/env bun
+
+import { SQL } from "bun";
+
+const databaseUrl = Bun.env.DATABASE_URL?.trim();
+if (!databaseUrl) {
+  throw new Error("DATABASE_URL is required");
+}
+
+const stage = normalizeStage(Bun.env.SERVICE_STAGE || Bun.env.APP_ENV || Bun.env.NODE_ENV || "local");
+if (stage === "prod" && Bun.env.SEED_PROD !== "true") {
+  console.log("Skipping production seed data. Set SEED_PROD=true to apply production seeds.");
+  process.exit(0);
+}
+
+const sql = new SQL(databaseUrl);
+
+try {
+  const entries = seedEntries(stage);
+  for (const entry of entries) {
+    await sql`
+      insert into waitlist_entries (id, email, name, company, source, status)
+      values (${entry.id}, ${entry.email}, ${entry.name}, ${entry.company}, ${entry.source}, ${entry.status})
+      on conflict (email) do update set
+        name = excluded.name,
+        company = excluded.company,
+        source = excluded.source,
+        updated_at = now()
+    `;
+
+    await sql`
+      insert into waitlist_triggers (id, type, entry_id, status, payload_json)
+      values (${`${entry.id}-trigger`}, ${"seed"}, ${entry.id}, ${"queued"}, ${JSON.stringify({ stage, email: entry.email })})
+      on conflict (id) do nothing
+    `;
+  }
+
+  console.log(`Seeded ${entries.length} waitlist entr${entries.length === 1 ? "y" : "ies"} for ${stage}.`);
+} finally {
+  await sql.close();
+}
+
+function normalizeStage(value: string) {
+  const normalized = value.trim().toLowerCase();
+  if (normalized === "production" || normalized === "main") {
+    return "prod";
+  }
+  if (normalized === "development") {
+    return "local";
+  }
+  return normalized || "local";
+}
+
+function seedEntries(stage: string) {
+  return [
+    {
+      id: `seed-${stage}-founder`,
+      email: `founder+${stage}@example.com`,
+      name: "Founder Example",
+      company: "Example Co",
+      source: `seed:${stage}`,
+      status: "joined",
+    },
+    {
+      id: `seed-${stage}-operator`,
+      email: `operator+${stage}@example.com`,
+      name: "Operator Example",
+      company: "Example Co",
+      source: `seed:${stage}`,
+      status: "joined",
+    },
+  ];
+}

package/templates/shared/scripts/wait-for-db.ts

@@ -0,0 +1,32 @@
+import { SQL } from "bun";
+import { readLocalEnv } from "./local-env";
+
+const env = {
+  ...Bun.env,
+  ...(await readLocalEnv()),
+};
+const databaseUrl = env.DATABASE_URL?.trim();
+
+if (!databaseUrl) {
+  throw new Error("DATABASE_URL is required");
+}
+
+const client = new SQL(databaseUrl);
+const deadline = Date.now() + 45_000;
+let lastError: unknown;
+
+while (Date.now() < deadline) {
+  try {
+    await client.unsafe("select 1");
+    process.exit(0);
+  } catch (error) {
+    lastError = error;
+    await Bun.sleep(1_000);
+  }
+}
+
+throw new Error(`Timed out waiting for Postgres: ${formatError(lastError)}`);
+
+function formatError(error: unknown) {
+  return error instanceof Error ? error.message : String(error ?? "unknown error");
+}