create-svc 0.1.34 → 0.1.36

package/README.md

@@ -54,6 +54,10 @@ By default, that scaffolds the repo, installs dependencies, runs the generated
 repo's `service create`, deploys once, verifies production, starts local dev,
 and verifies local. Pass `--no-auto-deploy` for scaffold-only generation.
 
+Cloud Run services default to the shared existing GCP project `anmho-services`.
+Override with `--project-id <id>` or explicitly opt into per-service project
+creation with `--project-mode create_new`.
+
 `--profile microservice` is accepted as a compatibility no-op. App workspaces live outside this package in private app template repositories.
 
 By default, a standalone generated service is initialized as a git repository,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-svc",
-  "version": "0.1.34",
+  "version": "0.1.36",
   "description": "Local microservice bootstrap CLI for Cloud Run and Workers services with Neon-backed data.",
   "module": "index.ts",
   "type": "module",

package/src/cli.ts

@@ -3,7 +3,7 @@ import pc from "picocolors";
 import { readdirSync } from "node:fs";
 import { basename, dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { buildDeploymentVerificationCommands, buildLocalVerificationCommands, runPostScaffoldFlow } from "./post-scaffold";
+import { buildDeploymentVerificationCommands, buildLocalVerificationCommands, runPostScaffoldFlow, runPreGitBootstrapFlow } from "./post-scaffold";
 import {
   bootstrapGitHubRepository,
   buildGitBootstrapConfig,
@@ -15,6 +15,8 @@ import { listOpenBillingAccounts, listAccessibleProjects, type BillingAccount, t
 import {
   BILLING_ACCOUNT_DEFAULT,
   QUOTA_PROJECT_DEFAULT,
+  SERVICES_PROJECT_DEFAULT,
+  SERVICES_PROJECT_NAME_DEFAULT,
   deriveDefaults,
   frameworksForTargetRuntime,
   parseDeployTarget,
@@ -108,6 +110,11 @@ export async function run(argv: string[]) {
     await scaffoldProject(config);
     buildSpinner.stop("Project files generated");
 
+    const preGitResult = runPreGitBootstrapFlow(config, targetDir);
+    if (preGitResult.changed) {
+      log.step("Generated local SDK artifacts before initial GitHub push");
+    }
+
     const gitSpinner = spinner();
     gitSpinner.start("Preparing git repository");
     const gitResult = await bootstrapGitHubRepository(targetDir, config.git);
@@ -798,6 +805,15 @@ async function resolveGcpSelection(
   discovery: DiscoveryState,
   options: { allowBack?: boolean } = {}
 ): Promise<GcpSelection | typeof BACK> {
+  if (args.gcpProject && !args.gcpProjectMode) {
+    const existing = discovery.projects.find((project) => matchesProject(project, args.gcpProject ?? ""));
+    return {
+      mode: "use_existing" as const,
+      projectId: args.gcpProject,
+      projectName: existing?.name ?? args.gcpProject,
+    };
+  }
+
   if (args.gcpProjectMode && args.gcpProject) {
     const existing = discovery.projects.find((project) => matchesProject(project, args.gcpProject ?? ""));
     return {
@@ -819,22 +835,18 @@ async function resolveGcpSelection(
     const existing = discovery.projects.find((project) => project.projectId === args.gcpProject);
     return {
       mode: "use_existing" as const,
-      projectId: args.gcpProject ?? discovery.projects[0]?.projectId ?? defaults.projectId,
-      projectName: existing?.name ?? args.gcpProject ?? defaults.projectName,
+      projectId: args.gcpProject ?? SERVICES_PROJECT_DEFAULT,
+      projectName: existing?.name ?? args.gcpProject ?? SERVICES_PROJECT_NAME_DEFAULT,
     };
   }
 
   if (args.yes) {
-    return {
-      mode: "create_new" as const,
-      projectId: defaults.projectId,
-      projectName: defaults.projectName,
-    };
+    return sharedServicesProjectSelection(discovery);
   }
 
   const mode = await select({
     message: "GCP project",
-    initialValue: "create_new",
+    initialValue: "use_shared",
     options: [
       ...(options.allowBack
         ? [
@@ -845,16 +857,20 @@ async function resolveGcpSelection(
             },
           ]
         : []),
+      {
+        value: "use_shared",
+        label: `Use shared services project: ${sharedServicesProjectSelection(discovery).projectName} (${SERVICES_PROJECT_DEFAULT})`,
+        hint: "Default",
+      },
       {
         value: "create_new",
         label: `Create new project: ${defaults.projectName} (${defaults.projectId})`,
-        hint: "Default",
+        hint: "May hit billing quota limits",
       },
       {
         value: "use_existing",
-        label: "Use existing project...",
-        hint: discovery.projects.length > 0 ? `${discovery.projects.length} available` : "Unavailable",
-        disabled: discovery.projects.length === 0,
+        label: "Use another existing project...",
+        hint: discovery.projects.length > 0 ? `${discovery.projects.length} available` : "Pass --project-id to use an undiscovered project",
       },
     ],
   });
@@ -868,6 +884,10 @@ async function resolveGcpSelection(
     return BACK;
   }
 
+  if (mode === "use_shared") {
+    return sharedServicesProjectSelection(discovery);
+  }
+
   if (mode === "create_new") {
     return {
       mode: "create_new" as const,
@@ -877,7 +897,7 @@ async function resolveGcpSelection(
   }
 
   if (discovery.projects.length === 0) {
-    throw new Error("No existing GCP projects were discovered");
+    return sharedServicesProjectSelection(discovery);
   }
 
   const selected = await promptForExistingProject(discovery.projects, options);
@@ -904,6 +924,15 @@ async function resolveGcpSelection(
   };
 }
 
+function sharedServicesProjectSelection(discovery: DiscoveryState): GcpSelection {
+  const project = discovery.projects.find((candidate) => candidate.projectId === SERVICES_PROJECT_DEFAULT);
+  return {
+    mode: "use_existing" as const,
+    projectId: SERVICES_PROJECT_DEFAULT,
+    projectName: project?.name ?? SERVICES_PROJECT_NAME_DEFAULT,
+  };
+}
+
 async function discoverCloudInputs(): Promise<DiscoveryState> {
   const result: DiscoveryState = {
     projects: [],

package/src/git-bootstrap.test.ts

@@ -2,7 +2,7 @@ import { expect, test } from "bun:test";
 import { mkdir, mkdtemp, realpath, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
-import { buildGitBootstrapConfig, findExistingGitWorktree, markGitHubRepositoryDeleteOnDestroy } from "./git-bootstrap";
+import { buildGitBootstrapConfig, findExistingGitWorktree, manualGitHubDeleteCommand, markGitHubRepositoryDeleteOnDestroy } from "./git-bootstrap";
 
 test("buildGitBootstrapConfig defaults to anmho private repo creation", () => {
   expect(buildGitBootstrapConfig("launch-api", undefined)).toEqual({
@@ -20,6 +20,10 @@ test("buildGitBootstrapConfig honors --no-git", () => {
   });
 });
 
+test("manualGitHubDeleteCommand formats the advisory cleanup command", () => {
+  expect(manualGitHubDeleteCommand("anmho/launch-api")).toBe("gh repo delete anmho/launch-api --yes");
+});
+
 test("findExistingGitWorktree detects parent repositories", async () => {
   const root = await mkdtemp(join(tmpdir(), "create-svc-git-"));
   run(["git", "init", "-b", "main"], root);

package/src/git-bootstrap.ts

@@ -21,6 +21,10 @@ export function buildGitBootstrapConfig(serviceName: string, noGit: boolean | un
   };
 }
 
+export function manualGitHubDeleteCommand(repository: string) {
+  return `gh repo delete ${repository} --yes`;
+}
+
 export async function bootstrapGitHubRepository(targetDir: string, config: GitBootstrapConfig): Promise<GitBootstrapResult> {
   if (!config.enabled) {
     return { status: "disabled" };

package/src/naming.test.ts

@@ -1,5 +1,12 @@
 import { expect, test } from "bun:test";
-import { buildGcpProjectOptions, compactDatabaseName, compactIdentifier, deriveDefaults, deriveLocalPostgresPort } from "./naming";
+import {
+  SERVICES_PROJECT_DEFAULT,
+  buildGcpProjectOptions,
+  compactDatabaseName,
+  compactIdentifier,
+  deriveDefaults,
+  deriveLocalPostgresPort,
+} from "./naming";
 
 test("deriveDefaults uses the service name for project, repo, and database naming", () => {
   expect(deriveDefaults("edge-api")).toEqual({
@@ -25,16 +32,17 @@ test("compactDatabaseName switches to underscores", () => {
   expect(compactDatabaseName("preview-worker")).toBe("preview_worker");
 });
 
-test("buildGcpProjectOptions puts create-new first", () => {
+test("buildGcpProjectOptions puts the shared services project first", () => {
   const options = buildGcpProjectOptions("preview-worker", "anmho-preview-worker", "preview-worker", [
     { projectId: "anmho-existing", name: "existing" },
   ]);
 
   expect(options[0]).toEqual({
-    label: "Create new project: preview-worker (anmho-preview-worker)",
-    mode: "create_new",
-    projectId: "anmho-preview-worker",
-    projectName: "preview-worker",
+    label: `Use shared services project: services (${SERVICES_PROJECT_DEFAULT})`,
+    mode: "use_existing",
+    projectId: "anmho-services",
+    projectName: "services",
   });
   expect(options[1]?.mode).toBe("use_existing");
+  expect(options[2]?.mode).toBe("create_new");
 });

package/src/naming.ts

@@ -1,5 +1,7 @@
 export const BILLING_ACCOUNT_DEFAULT = "billingAccounts/01BD2E-3A6949-8F4C84";
 export const QUOTA_PROJECT_DEFAULT = "anmho-infra-prod";
+export const SERVICES_PROJECT_DEFAULT = "anmho-services";
+export const SERVICES_PROJECT_NAME_DEFAULT = "services";
 
 export const DEPLOY_TARGETS = ["cloudrun", "workers"] as const;
 
@@ -108,19 +110,27 @@ export function buildGcpProjectOptions(
   projectName: string,
   projects: Array<{ projectId: string; name: string }>
 ) {
+  const servicesProject = projects.find((project) => project.projectId === SERVICES_PROJECT_DEFAULT);
+  const remainingProjects = projects.filter((project) => project.projectId !== SERVICES_PROJECT_DEFAULT);
   return [
     {
-      label: buildCreateProjectLabel(serviceName, projectId),
-      mode: "create_new" as const,
-      projectId,
-      projectName,
+      label: `Use shared services project: ${servicesProject?.name ?? SERVICES_PROJECT_NAME_DEFAULT} (${SERVICES_PROJECT_DEFAULT})`,
+      mode: "use_existing" as const,
+      projectId: SERVICES_PROJECT_DEFAULT,
+      projectName: servicesProject?.name ?? SERVICES_PROJECT_NAME_DEFAULT,
     },
-    ...projects.map((project) => ({
+    ...remainingProjects.map((project) => ({
       label: `Use existing project: ${project.name} (${project.projectId})`,
       mode: "use_existing" as const,
       projectId: project.projectId,
       projectName: project.name,
     })),
+    {
+      label: buildCreateProjectLabel(serviceName, projectId),
+      mode: "create_new" as const,
+      projectId,
+      projectName,
+    },
   ];
 }
 

package/src/post-scaffold.test.ts

@@ -1,5 +1,10 @@
 import { describe, expect, test } from "bun:test";
-import { buildDeploymentVerificationCommands, buildLocalVerificationCommands, buildPostScaffoldCommands } from "./post-scaffold";
+import {
+  buildDeploymentVerificationCommands,
+  buildLocalVerificationCommands,
+  buildPostScaffoldCommands,
+  buildPreGitBootstrapCommands,
+} from "./post-scaffold";
 
 describe("buildPostScaffoldCommands", () => {
   test("runs create for HTTP services", () => {
@@ -8,9 +13,8 @@ describe("buildPostScaffoldCommands", () => {
     ]);
   });
 
-  test("builds SDK artifacts before create for ConnectRPC services", () => {
+  test("runs create for ConnectRPC services after pre-git SDK preparation", () => {
     expect(buildPostScaffoldCommands({ framework: "connectrpc" })).toEqual([
-      { command: "service", args: ["sdk", "build"] },
       { command: "service", args: ["create"] },
     ]);
   });
@@ -22,6 +26,17 @@ describe("buildPostScaffoldCommands", () => {
   });
 });
 
+describe("buildPreGitBootstrapCommands", () => {
+  test("builds SDK artifacts before the initial GitHub push for ConnectRPC services", () => {
+    expect(buildPreGitBootstrapCommands({ framework: "connectrpc" })).toEqual([{ command: "service", args: ["sdk", "build"] }]);
+  });
+
+  test("does not build SDK artifacts for HTTP or Workers services", () => {
+    expect(buildPreGitBootstrapCommands({ framework: "hono" })).toEqual([]);
+    expect(buildPreGitBootstrapCommands({ target: "workers", framework: "connectrpc" })).toEqual([]);
+  });
+});
+
 describe("buildLocalVerificationCommands", () => {
   test("uses local curl checks for Bun Hono services", () => {
     expect(buildLocalVerificationCommands({ apiHostname: "api.launch.anmho.com", framework: "hono", runtime: "bun" })).toEqual([

package/src/post-scaffold.ts

@@ -44,6 +44,19 @@ export async function runPostScaffoldFlow(config: ScaffoldConfig, cwd: string) {
   return { message: "Backend package generated" };
 }
 
+export function runPreGitBootstrapFlow(config: Pick<ScaffoldConfig, "framework"> & Partial<Pick<ScaffoldConfig, "target">>, cwd: string) {
+  const commands = buildPreGitBootstrapCommands(config);
+  if (commands.length === 0) {
+    return { changed: false };
+  }
+
+  installProjectDependencies(cwd);
+  for (const command of commands) {
+    run(command.command, command.args, { cwd });
+  }
+  return { changed: true };
+}
+
 async function startLocalDevelopment(config: Pick<ScaffoldConfig, "target">, cwd: string) {
   run("bun", ["run", "migrate"], { cwd });
   await mkdir(join(cwd, ".service"), { recursive: true });
@@ -222,10 +235,16 @@ function localVerificationHost(config: Partial<Pick<ScaffoldConfig, "target" | "
 export function buildPostScaffoldCommands(
   config: Pick<ScaffoldConfig, "framework"> & Partial<Pick<ScaffoldConfig, "target">>
 ): PostScaffoldCommand[] {
-  return [
-    ...(config.target !== "workers" && config.framework === "connectrpc" ? [{ command: "service", args: ["sdk", "build"] }] : []),
-    { command: "service", args: ["create"] },
-  ];
+  return [{ command: "service", args: ["create"] }];
+}
+
+export function buildPreGitBootstrapCommands(
+  config: Pick<ScaffoldConfig, "framework"> & Partial<Pick<ScaffoldConfig, "target">>
+): PostScaffoldCommand[] {
+  if (config.target === "workers" || config.framework !== "connectrpc") {
+    return [];
+  }
+  return [{ command: "service", args: ["sdk", "build"] }];
 }
 
 function installProjectDependencies(cwd: string) {

package/src/service-runtime/cloudrun/cleanup.ts

@@ -1,10 +1,13 @@
 import { confirm, isCancel, log } from "@clack/prompts";
 import { deleteAuthResourceServer } from "../authctl";
+import { manualGitHubDeleteCommand } from "../../git-bootstrap";
 import { buildLocalDevCleanupPlan, stopLocalDev } from "../local-dev";
+import { runParallelTasks, type ParallelTask } from "../parallel-tasks";
 import { config } from "./config";
 import { deleteBranch, deleteDatabase, listBranches, resolveNeonConfig } from "./neon";
 import {
   assertOwnedResource,
+  deleteArtifactImage,
   deleteProject,
   deleteProductionDomainMapping,
   deleteSecret,
@@ -15,6 +18,7 @@ import {
   describeSecret,
   formatError,
   listCloudRunServices,
+  listArtifactImages,
   listSecrets,
   parseCleanupArgs,
   requireCommand,
@@ -50,6 +54,7 @@ type DestroyPlan = {
   hasProductionDomainMapping: boolean;
   serviceNames: string[];
   secretNames: string[];
+  artifactImages: string[];
   neon?: {
     projectId: string;
     baseBranchId: string;
@@ -71,58 +76,105 @@ export async function cleanup(args = Bun.argv.slice(2)) {
 
   await requireDestroyConfirmation(options.force);
 
-  await runStep("Stopping local dev resources", () => stopLocalDev({ dockerCompose: true, removeVolumes: true }));
+  await deletePlannedResources(plan);
 
-  if (plan.githubRepository) {
-    await runStep(`Deleting GitHub repository ${plan.githubRepository}`, () => deleteGitHubRepository(plan.githubRepository!));
+  if (options.destroyProject) {
+    await runStep(`Deleting GCP project ${config.project.id}`, () => deleteProject());
+    return `Deleted project ${config.project.id}`;
   }
 
-  await runStep(`Deleting auth resource server ${config.serviceName}`, () => deleteAuthResourceServer());
-
-  if (plan.hasProductionDomainMapping) {
-    await runStep(`Deleting production domain mapping ${config.domain.hostname}`, () => deleteProductionDomainMapping());
-  }
+  log.step(`Production API hostname released: ${config.domain.hostname}`);
+  return `Destroy finished for ${config.serviceName}`;
+}
 
-  const serviceNames = plan.serviceNames;
-  await runStep("Deleting Cloud Run services", () => {
-    for (const serviceName of serviceNames) {
-      assertOwnedResource(`Cloud Run service ${serviceName}`, describeCloudRunService(serviceName));
-      deleteService(serviceName);
-    }
-  });
+async function deletePlannedResources(plan: DestroyPlan) {
+  const tasks: ParallelTask[] = [
+    {
+      label: "Stopping local dev resources",
+      task: () => stopLocalDev({ dockerCompose: true, removeVolumes: true }),
+    },
+    {
+      label: `Deleting auth resource server ${config.serviceName}`,
+      task: () => deleteAuthResourceServer(),
+    },
+    {
+      label: "Deleting Cloud Run services",
+      task: () => {
+        for (const serviceName of plan.serviceNames) {
+          assertOwnedResource(`Cloud Run service ${serviceName}`, describeCloudRunService(serviceName));
+          deleteService(serviceName);
+        }
+      },
+    },
+    {
+      label: "Deleting Artifact Registry images",
+      task: () => {
+        for (const image of plan.artifactImages) {
+          deleteArtifactImage(image);
+        }
+      },
+    },
+    {
+      label: "Deleting service secrets",
+      task: () => {
+        for (const secretName of plan.secretNames) {
+          assertOwnedResource(`Secret ${secretName}`, describeSecret(secretName));
+          deleteSecret(secretName);
+        }
+      },
+    },
+    {
+      label: "Deleting Grafana resources",
+      task: () => deleteGrafanaResources(),
+    },
+    {
+      label: "Deleting service-specific identity resources",
+      task: () => {
+        deleteServiceAccount(config.runtimeServiceAccount);
+      },
+    },
+  ];
 
-  const secretNames = plan.secretNames;
-  await runStep("Deleting service secrets", () => {
-    for (const secretName of secretNames) {
-      assertOwnedResource(`Secret ${secretName}`, describeSecret(secretName));
-      deleteSecret(secretName);
-    }
-  });
+  if (plan.githubRepository) {
+    tasks.push({
+      label: `Deleting GitHub repository ${plan.githubRepository}`,
+      task: () => deleteGitHubRepository(plan.githubRepository!),
+    });
+  }
 
-  const neonPlan = plan.neon;
-  if (neonPlan) {
-    await runStep("Deleting Neon preview and personal branches", async () => {
-      for (const branch of neonPlan.branches) {
-        await deleteBranch(neonPlan.projectId, branch.id);
-      }
+  if (plan.hasProductionDomainMapping) {
+    tasks.push({
+      label: `Deleting production domain mapping ${config.domain.hostname}`,
+      task: () => deleteProductionDomainMapping(),
     });
+  }
 
-    await runStep("Deleting Neon service database", () => deleteDatabase(neonPlan.projectId, neonPlan.baseBranchId, neonPlan.databaseName));
+  if (plan.neon) {
+    const neonPlan = plan.neon;
+    tasks.push(
+      {
+        label: "Deleting Neon preview and personal branches",
+        task: async () => {
+          await Promise.all(neonPlan.branches.map((branch) => deleteBranch(neonPlan.projectId, branch.id)));
+        },
+      },
+      {
+        label: "Deleting Neon service database",
+        task: () => deleteDatabase(neonPlan.projectId, neonPlan.baseBranchId, neonPlan.databaseName),
+      }
+    );
   }
 
-  await runStep("Deleting Grafana resources", async () => deleteGrafanaResources());
+  await runDestroyTasks(tasks);
+}
 
-  await runStep("Deleting service-specific identity resources", () => {
-    deleteServiceAccount(config.runtimeServiceAccount);
+async function runDestroyTasks(tasks: Array<{ label: string; task: () => Promise<unknown> | unknown }>) {
+  log.step(`Deleting ${tasks.length} resource groups in parallel`);
+  await runParallelTasks(tasks, {
+    formatError,
+    onSuccess: (label) => log.step(`${label}: done`),
+    onFailure: (label, error) => log.error(`${label} failed\n${formatError(error)}`),
   });
-
-  if (options.destroyProject) {
-    await runStep(`Deleting GCP project ${config.project.id}`, () => deleteProject());
-    return `Deleted project ${config.project.id}`;
-  }
-
-  log.step(`Production API hostname released: ${config.domain.hostname}`);
-  return `Destroy finished for ${config.serviceName}`;
 }
 
 async function buildDestroyPlan(destroyProject: boolean): Promise<DestroyPlan> {
@@ -137,12 +189,14 @@ async function buildDestroyPlan(destroyProject: boolean): Promise<DestroyPlan> {
     hasProductionDomainMapping: false,
     serviceNames: [],
     secretNames: [],
+    artifactImages: [],
   };
 
   planGitHubRepository(plan);
   await planLocalDev(plan);
   planProductionDomainMapping(plan);
   planCloudRunServices(plan);
+  planArtifactImages(plan);
   planSecrets(plan);
   await planNeon(plan);
   await planGrafana(plan);
@@ -169,7 +223,7 @@ function planGitHubRepository(plan: DestroyPlan) {
   if (!config.git.deleteOnDestroy) {
     plan.skipped.push({
       label: `GitHub repository ${repository}`,
-      detail: config.git.enabled ? "not created by this service CLI run" : "git disabled",
+      detail: config.git.enabled ? `not created by this service CLI run; manual cleanup: ${manualGitHubDeleteCommand(repository)}` : "git disabled",
     });
     return;
   }
@@ -236,6 +290,21 @@ function planCloudRunServices(plan: DestroyPlan) {
   }
 }
 
+function planArtifactImages(plan: DestroyPlan) {
+  try {
+    plan.artifactImages = listArtifactImages();
+    if (plan.artifactImages.length === 0) {
+      plan.skipped.push({ label: `Artifact Registry images for ${config.serviceName}`, detail: "none matched" });
+      return;
+    }
+    for (const image of plan.artifactImages) {
+      plan.resources.push({ label: `Artifact Registry image ${image}`, detail: `${config.project.id}/${config.region}` });
+    }
+  } catch (error) {
+    plan.blockers.push(`Artifact Registry images for ${config.serviceName}: ${formatError(error)}`);
+  }
+}
+
 function planSecrets(plan: DestroyPlan) {
   try {
     plan.secretNames = listSecrets().filter(matchesSecretResource);

package/src/service-runtime/cloudrun/lib.ts

@@ -415,6 +415,32 @@ export function ensureArtifactRepository() {
   ]);
 }
 
+export function artifactImageBase() {
+  return `${config.region}-docker.pkg.dev/${config.project.id}/${config.artifactRepository}/${config.serviceName}`;
+}
+
+export function listArtifactImages() {
+  const result = gcloud(
+    ["artifacts", "docker", "images", "list", artifactImageBase(), "--include-tags", "--project", config.project.id, "--format=json"],
+    { allowFailure: true }
+  );
+  if (!result.success || !result.stdout) {
+    return [];
+  }
+
+  try {
+    return (JSON.parse(result.stdout) as Array<{ package?: string; version?: string }>)
+      .map((image) => (image.package && image.version ? `${image.package}@${image.version}` : ""))
+      .filter(Boolean);
+  } catch {
+    throw new Error(`Unable to parse Artifact Registry images for ${artifactImageBase()}`);
+  }
+}
+
+export function deleteArtifactImage(image: string) {
+  gcloud(["artifacts", "docker", "images", "delete", image, "--delete-tags", "--project", config.project.id, "--quiet"], { allowFailure: true });
+}
+
 export function projectNumber() {
   return gcloud(["projects", "describe", config.project.id, "--format=value(projectNumber)"]).stdout;
 }
@@ -425,7 +451,7 @@ export function imageTag() {
 }
 
 export function imageUrl(tag = imageTag()) {
-  return `${config.region}-docker.pkg.dev/${config.project.id}/${config.artifactRepository}/${config.serviceName}:${tag}`;
+  return `${artifactImageBase()}:${tag}`;
 }
 
 export function parseDeployArgs(argv: string[]): DeployArgs {
@@ -708,9 +734,24 @@ export function assertServiceNameAvailable(serviceName: string) {
 
 export function deleteProductionDomainMapping() {
   deleteCloudflareDnsRecord();
-  gcloud(["beta", "run", "domain-mappings", "delete", "--domain", config.domain.hostname, "--project", config.project.id, "--quiet"], {
-    allowFailure: true,
-  });
+  gcloud(
+    [
+      "beta",
+      "run",
+      "domain-mappings",
+      "delete",
+      "--domain",
+      config.domain.hostname,
+      "--project",
+      config.project.id,
+      "--region",
+      config.region,
+      "--quiet",
+    ],
+    {
+      allowFailure: true,
+    }
+  );
 }
 
 export function listCloudRunServices() {

package/src/service-runtime/parallel-tasks.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, test } from "bun:test";
+import { runParallelTasks } from "./parallel-tasks";
+
+describe("runParallelTasks", () => {
+  test("runs tasks concurrently and reports success as each task finishes", async () => {
+    const completed: string[] = [];
+    const startedAt = Date.now();
+
+    await runParallelTasks(
+      [
+        { label: "slow", task: () => Bun.sleep(60) },
+        { label: "fast", task: () => Bun.sleep(10) },
+      ],
+      { onSuccess: (label) => completed.push(label) }
+    );
+
+    expect(Date.now() - startedAt).toBeLessThan(100);
+    expect(completed).toEqual(["fast", "slow"]);
+  });
+
+  test("collects multiple failures before throwing", async () => {
+    const failures: string[] = [];
+
+    await expect(
+      runParallelTasks(
+        [
+          { label: "one", task: () => Promise.reject(new Error("first")) },
+          { label: "two", task: () => Promise.reject(new Error("second")) },
+        ],
+        { onFailure: (label) => failures.push(label) }
+      )
+    ).rejects.toThrow("Destroy failed for one or more resource groups:");
+
+    expect(failures.sort()).toEqual(["one", "two"]);
+  });
+});

package/src/service-runtime/parallel-tasks.ts

@@ -0,0 +1,35 @@
+export type ParallelTask = {
+  label: string;
+  task: () => Promise<unknown> | unknown;
+};
+
+type ParallelTaskOptions = {
+  onSuccess?: (label: string) => void;
+  onFailure?: (label: string, error: unknown) => void;
+  formatError?: (error: unknown) => string;
+};
+
+export async function runParallelTasks(tasks: ParallelTask[], options: ParallelTaskOptions = {}) {
+  const failures: string[] = [];
+  const format = options.formatError ?? defaultFormatError;
+
+  await Promise.all(
+    tasks.map(async ({ label, task }) => {
+      try {
+        await task();
+        options.onSuccess?.(label);
+      } catch (error) {
+        failures.push(`${label}: ${format(error)}`);
+        options.onFailure?.(label, error);
+      }
+    })
+  );
+
+  if (failures.length > 0) {
+    throw new Error(["Destroy failed for one or more resource groups:", ...failures.map((failure) => `- ${failure}`)].join("\n"));
+  }
+}
+
+function defaultFormatError(error: unknown) {
+  return error instanceof Error ? error.message : String(error);
+}

package/src/service-runtime/workers/cli.ts

@@ -3,6 +3,7 @@
 import { confirm, intro, isCancel, log, outro } from "@clack/prompts";
 import { createApiClient } from "@neondatabase/api-client";
 import { Client } from "pg";
+import { manualGitHubDeleteCommand } from "../../git-bootstrap";
 import { ensureAuthClient, ensureAuthResourceServer, runAuthCommand, runAuthDoctor } from "../authctl";
 import { stopLocalDev } from "../local-dev";
 import { serviceConfig } from "../runtime";
@@ -135,7 +136,11 @@ function formatHelp() {
 function deleteGitHubRepositoryIfOwned() {
   const repository = `${config.git.owner}/${config.git.repository}`;
   if (!config.git.deleteOnDestroy) {
-    log.step(`Skipping GitHub repository ${repository}: ${config.git.enabled ? "not created by this service CLI run" : "git disabled"}`);
+    log.step(
+      `Skipping GitHub repository ${repository}: ${
+        config.git.enabled ? `not created by this service CLI run; manual cleanup: ${manualGitHubDeleteCommand(repository)}` : "git disabled"
+      }`
+    );
     return;
   }
   run("gh", ["auth", "status"], { capture: true });

package/templates/shared/README.md

@@ -8,7 +8,7 @@ This `{{PROFILE}}` profile targets `{{RUNTIME}} + {{FRAMEWORK}}` on Cloud Run wi
 - a lightweight `{{EXAMPLE_LABEL}}` example surface
 - local Docker Compose Postgres for first-run development
 - the `service` CLI for create, deploy, doctor, dashboards, and destroy
-- GCP project create with billing and quota-project-aware `gcloud` calls
+- shared GCP project deployment with quota-project-aware `gcloud` calls
 - Neon-backed remote database provisioning during create and deploy
 - Better Auth client-credentials resource-server registration through `authctl`
 - stage-aware waitlist data and trigger ingestion