create-svc 0.1.19 → 0.1.21

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-svc",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "description": "Local microservice bootstrap CLI for Cloud Run and Workers services with Neon-backed data.",
   "module": "index.ts",
   "type": "module",

package/src/post-scaffold.test.ts

@@ -28,8 +28,8 @@ describe("buildPostScaffoldCommands", () => {
 describe("buildDeploymentVerificationCommands", () => {
   test("uses curl health checks for HTTP services", () => {
     expect(buildDeploymentVerificationCommands({ apiHostname: "api.launch.anmho.com", framework: "hono", runtime: "bun" })).toEqual([
-      { command: "curl", args: ["--fail", "--show-error", "--silent", "https://api.launch.anmho.com/healthz"] },
-      { command: "curl", args: ["--fail", "--show-error", "--silent", "https://api.launch.anmho.com/readyz"] },
+      { command: "sh", args: ["-c", 'curl --fail --show-error --silent "https://api.launch.anmho.com/healthz"'] },
+      { command: "sh", args: ["-c", 'curl --fail --show-error --silent "https://api.launch.anmho.com/readyz"'] },
       {
         command: "sh",
         args: [
@@ -40,12 +40,31 @@ describe("buildDeploymentVerificationCommands", () => {
     ]);
   });
 
+  test("uses the immediate Cloud Run service URL when project details are available", () => {
+    expect(
+      buildDeploymentVerificationCommands({
+        apiHostname: "api.launch.anmho.com",
+        framework: "hono",
+        runtime: "bun",
+        serviceName: "launch-api",
+        gcpProject: "anmho-infra-prod",
+        region: "us-west1",
+      })
+    ).toContainEqual({
+      command: "sh",
+      args: [
+        "-c",
+        'curl --fail --show-error --silent "$(gcloud run services describe launch-api --project anmho-infra-prod --region us-west1 --format=value(status.url))/healthz"',
+      ],
+    });
+  });
+
   test("uses auth token and grpcurl for Go ConnectRPC services", () => {
     expect(buildDeploymentVerificationCommands({ apiHostname: "api.launch.anmho.com", framework: "connectrpc", runtime: "go" })).toContainEqual({
       command: "sh",
       args: [
         "-c",
-        'TOKEN="$(bun ./scripts/cloudrun/cli.ts auth token)" && grpcurl -H "Authorization: Bearer $TOKEN" -d \'{"limit":1}\' -proto protos/waitlist/v1/waitlist.proto api.launch.anmho.com:443 waitlist.v1.WaitlistService/ListWaitlistEntries',
+        'TOKEN="$(bun ./scripts/cloudrun/cli.ts auth token)" && grpcurl -H "Authorization: Bearer $TOKEN" -d \'{"limit":1}\' -proto protos/waitlist/v1/waitlist.proto "api.launch.anmho.com:443" waitlist.v1.WaitlistService/ListWaitlistEntries',
       ],
     });
   });

package/src/post-scaffold.ts

@@ -55,23 +55,26 @@ function runWithRetries(command: PostScaffoldCommand, options: CommandOptions, a
 }
 
 export function buildDeploymentVerificationCommands(
-  config: Pick<ScaffoldConfig, "apiHostname" | "framework" | "runtime"> & Partial<Pick<ScaffoldConfig, "target">>
+  config: Pick<ScaffoldConfig, "apiHostname" | "framework" | "runtime"> &
+    Partial<Pick<ScaffoldConfig, "target" | "serviceName" | "gcpProject" | "region">>
 ): PostScaffoldCommand[] {
-  const origin = `https://${config.apiHostname}`;
+  const origin = verificationOrigin(config);
   const tokenCommand = `TOKEN="$(bun ${serviceCliPath(config)} auth token)"`;
   return [
-    { command: "curl", args: ["--fail", "--show-error", "--silent", `${origin}/healthz`] },
-    { command: "curl", args: ["--fail", "--show-error", "--silent", `${origin}/readyz`] },
+    shellVerificationCommand(`curl --fail --show-error --silent "${origin}/healthz"`),
+    shellVerificationCommand(`curl --fail --show-error --silent "${origin}/readyz"`),
     protectedVerificationCommand(config, origin, tokenCommand),
   ];
 }
 
 function protectedVerificationCommand(
-  config: Pick<ScaffoldConfig, "apiHostname" | "framework" | "runtime">,
+  config: Pick<ScaffoldConfig, "apiHostname" | "framework" | "runtime"> &
+    Partial<Pick<ScaffoldConfig, "target" | "serviceName" | "gcpProject" | "region">>,
   origin: string,
   tokenCommand: string
 ): PostScaffoldCommand {
   if (config.framework === "connectrpc" && config.runtime === "go") {
+    const host = verificationHost(config);
     return {
       command: "sh",
       args: [
@@ -82,7 +85,7 @@ function protectedVerificationCommand(
           '-H "Authorization: Bearer $TOKEN"',
           "-d '{\"limit\":1}'",
           "-proto protos/waitlist/v1/waitlist.proto",
-          `${config.apiHostname}:443`,
+          `"${host}:443"`,
           "waitlist.v1.WaitlistService/ListWaitlistEntries",
         ].join(" "),
       ],
@@ -120,6 +123,28 @@ function protectedVerificationCommand(
   };
 }
 
+function shellVerificationCommand(script: string): PostScaffoldCommand {
+  return { command: "sh", args: ["-c", script] };
+}
+
+function verificationOrigin(
+  config: Partial<Pick<ScaffoldConfig, "target" | "serviceName" | "gcpProject" | "region">> & Pick<ScaffoldConfig, "apiHostname">
+) {
+  if (config.target !== "workers" && config.serviceName && config.gcpProject && config.region) {
+    return `$(gcloud run services describe ${config.serviceName} --project ${config.gcpProject} --region ${config.region} --format=value(status.url))`;
+  }
+  return `https://${config.apiHostname}`;
+}
+
+function verificationHost(
+  config: Partial<Pick<ScaffoldConfig, "target" | "serviceName" | "gcpProject" | "region">> & Pick<ScaffoldConfig, "apiHostname">
+) {
+  if (config.target !== "workers" && config.serviceName && config.gcpProject && config.region) {
+    return `$(gcloud run services describe ${config.serviceName} --project ${config.gcpProject} --region ${config.region} --format=value(status.url) | sed 's#^https://##')`;
+  }
+  return config.apiHostname;
+}
+
 export function buildPostScaffoldCommands(
   config: Pick<ScaffoldConfig, "framework"> & Partial<Pick<ScaffoldConfig, "target">>
 ): PostScaffoldCommand[] {

package/src/scaffold.test.ts

@@ -90,6 +90,7 @@ test("scaffolds all runtime/framework variants with shared cloudrun config", asy
     expect(deployScript).toContain("serviceDomain");
     expect(deployScript).toContain("ensureProductionDomainMapping");
     expect(deployScript).toContain("ensureCloudflareDnsRecord");
+    expect(deployScript).toContain("gcloudWithRetry");
     expect(deployScript).toContain("CLOUDFLARE_API_TOKEN");
     expect(deployScript).toContain('"domain-mappings",');
     expect(deployScript).toContain('"--region",');

package/templates/shared/scripts/cloudrun/deploy.ts

@@ -8,6 +8,7 @@ import {
   ensureProductionDomainMapping,
   ensureSecretAccessor,
   gcloud,
+  gcloudWithRetry,
   imageUrl,
   parseDeployArgs,
   requireCommand,
@@ -74,7 +75,7 @@ export async function deploy(args = Bun.argv.slice(2)) {
   );
 
   await runStep("Granting public invoker access", () =>
-    gcloud([
+    gcloudWithRetry([
       "run",
       "services",
       "add-iam-policy-binding",

package/templates/shared/scripts/cloudrun/lib.ts

@@ -115,6 +115,22 @@ export function gcloud(args: string[], options: CommandOptions = {}) {
   return run("gcloud", normalized, options);
 }
 
+export function gcloudWithRetry(args: string[], options: CommandOptions = {}) {
+  let lastError: unknown;
+  for (let attempt = 1; attempt <= 12; attempt += 1) {
+    try {
+      return gcloud(args, options);
+    } catch (error) {
+      lastError = error;
+      if (attempt === 12 || !isRetryableGcloudError(error)) {
+        break;
+      }
+      Bun.sleepSync(5_000);
+    }
+  }
+  throw lastError;
+}
+
 export async function runStep<T>(label: string, task: () => Promise<T> | T) {
   const indicator = spinner();
   indicator.start(label);
@@ -176,6 +192,7 @@ export function ensureServiceAccount(email: string) {
 
   const accountId = email.split("@")[0] ?? email;
   gcloud(["iam", "service-accounts", "create", accountId, "--project", config.project.id, "--display-name", accountId]);
+  waitForServiceAccount(email);
 }
 
 export function deleteServiceAccount(email: string) {
@@ -183,11 +200,11 @@ export function deleteServiceAccount(email: string) {
 }
 
 export function ensureProjectRole(member: string, role: string) {
-  gcloud(["projects", "add-iam-policy-binding", config.project.id, "--member", member, "--role", role]);
+  gcloudWithRetry(["projects", "add-iam-policy-binding", config.project.id, "--member", member, "--role", role]);
 }
 
 export function ensureServiceAccountRole(serviceAccount: string, member: string, role: string) {
-  gcloud([
+  gcloudWithRetry([
     "iam",
     "service-accounts",
     "add-iam-policy-binding",
@@ -229,7 +246,17 @@ export function accessSecretVersion(secretName: string) {
 }
 
 export function ensureSecretAccessor(secretName: string, member: string) {
-  gcloud(["secrets", "add-iam-policy-binding", secretName, "--project", config.project.id, "--member", member, "--role", "roles/secretmanager.secretAccessor"]);
+  gcloudWithRetry([
+    "secrets",
+    "add-iam-policy-binding",
+    secretName,
+    "--project",
+    config.project.id,
+    "--member",
+    member,
+    "--role",
+    "roles/secretmanager.secretAccessor",
+  ]);
 }
 
 export function listSecrets() {
@@ -737,6 +764,31 @@ function fetchJsonSync(url: string, init: { method: string; headers: Record<stri
   return JSON.parse(decoder.decode(result.stdout).trim()) as { status: number; body: string };
 }
 
+function waitForServiceAccount(email: string) {
+  for (let attempt = 1; attempt <= 12; attempt += 1) {
+    if (gcloud(["iam", "service-accounts", "describe", email, "--project", config.project.id], { allowFailure: true }).success) {
+      return;
+    }
+    Bun.sleepSync(5_000);
+  }
+  throw new Error(`service account ${email} was created but is not yet readable`);
+}
+
+function isRetryableGcloudError(error: unknown) {
+  if (!(error instanceof CommandError)) {
+    return false;
+  }
+  const output = `${error.stdout}\n${error.stderr}`.toLowerCase();
+  return (
+    output.includes("does not exist") ||
+    output.includes("not found") ||
+    output.includes("permission denied") ||
+    output.includes("failed_precondition") ||
+    output.includes("try again") ||
+    output.includes("retry")
+  );
+}
+
 export function describeCloudRunService(serviceName: string): GcpResourceWithLabels | undefined {
   const result = gcloud(
     ["run", "services", "describe", serviceName, "--project", config.project.id, "--region", config.region, "--format=json"],