create-svc 0.1.38 → 0.1.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-svc",
-  "version": "0.1.38",
+  "version": "0.1.40",
   "description": "Local microservice bootstrap CLI for Cloud Run and Workers services with Neon-backed data.",
   "module": "index.ts",
   "type": "module",

package/src/cli.ts

@@ -11,7 +11,13 @@ import {
   markGitHubRepositoryDeleteOnDestroy,
   type GitBootstrapResult,
 } from "./git-bootstrap";
-import { listOpenBillingAccounts, listAccessibleProjects, type BillingAccount, type GcpProject } from "./gcp";
+import {
+  assertExistingProjectReadyForAutoDeploy,
+  listOpenBillingAccounts,
+  listAccessibleProjects,
+  type BillingAccount,
+  type GcpProject,
+} from "./gcp";
 import {
   BILLING_ACCOUNT_DEFAULT,
   QUOTA_PROJECT_DEFAULT,
@@ -91,6 +97,7 @@ export async function run(argv: string[]) {
 
     const config = await resolveConfig(args);
     const targetDir = resolve(process.cwd(), config.directory);
+    await assertPreScaffoldReady(config);
 
     note(
       [
@@ -959,6 +966,14 @@ export function assertDiscoveryReady(discovery: DiscoveryState) {
   return discovery;
 }
 
+async function assertPreScaffoldReady(config: ScaffoldConfig) {
+  if (config.target !== "cloudrun" || !config.autoDeploy || config.gcpProjectMode !== "use_existing") {
+    return;
+  }
+
+  await assertExistingProjectReadyForAutoDeploy(config.gcpProject);
+}
+
 function chooseBillingAccount(input: string | undefined, accounts: BillingAccount[]) {
   if (input) {
     return input;

package/src/gcp.test.ts

@@ -1,5 +1,12 @@
 import { expect, test } from "bun:test";
-import { attachBillingAccount, createProject, listAccessibleProjects, listOpenBillingAccounts, type GcpApi } from "./gcp";
+import {
+  assertExistingProjectReadyForAutoDeploy,
+  attachBillingAccount,
+  createProject,
+  listAccessibleProjects,
+  listOpenBillingAccounts,
+  type GcpApi,
+} from "./gcp";
 
 test("listAccessibleProjects filters deleted projects and sorts by name", async () => {
   const api: GcpApi = {
@@ -105,3 +112,70 @@ test("createProject and attachBillingAccount call the expected endpoints", async
   expect(calls[0]).toBe("create:anmho-test:test");
   expect(calls[1]).toBe("billing:anmho-test:billingAccounts/123");
 });
+
+test("assertExistingProjectReadyForAutoDeploy passes when project exists with billing", async () => {
+  const api: GcpApi = {
+    async listProjects() {
+      return [];
+    },
+    async listBillingAccounts() {
+      return [];
+    },
+    async describeProject(projectId) {
+      return { projectId, name: "services" };
+    },
+    async describeBillingProject() {
+      return { billingEnabled: true, billingAccountName: "billingAccounts/123" };
+    },
+    async createProject() {},
+    async attachBillingAccount() {},
+  };
+
+  await expect(assertExistingProjectReadyForAutoDeploy("anmho-services", api)).resolves.toBeUndefined();
+});
+
+test("assertExistingProjectReadyForAutoDeploy rejects missing projects", async () => {
+  const api: GcpApi = {
+    async listProjects() {
+      return [];
+    },
+    async listBillingAccounts() {
+      return [];
+    },
+    async describeProject() {
+      throw new Error("not found");
+    },
+    async describeBillingProject() {
+      return { billingEnabled: true };
+    },
+    async createProject() {},
+    async attachBillingAccount() {},
+  };
+
+  await expect(assertExistingProjectReadyForAutoDeploy("anmho-services", api)).rejects.toThrow(
+    "GCP project anmho-services does not exist or is not accessible"
+  );
+});
+
+test("assertExistingProjectReadyForAutoDeploy rejects projects without billing", async () => {
+  const api: GcpApi = {
+    async listProjects() {
+      return [];
+    },
+    async listBillingAccounts() {
+      return [];
+    },
+    async describeProject(projectId) {
+      return { projectId, name: "services" };
+    },
+    async describeBillingProject() {
+      return { billingEnabled: false };
+    },
+    async createProject() {},
+    async attachBillingAccount() {},
+  };
+
+  await expect(assertExistingProjectReadyForAutoDeploy("anmho-services", api)).rejects.toThrow(
+    "GCP project anmho-services exists but billing is not enabled"
+  );
+});

package/src/gcp.ts

@@ -10,9 +10,16 @@ export type BillingAccount = {
   open: boolean;
 };
 
+export type BillingProject = {
+  billingEnabled?: boolean;
+  billingAccountName?: string;
+};
+
 export type GcpApi = {
   listProjects(): Promise<GcpProject[]>;
   listBillingAccounts(): Promise<BillingAccount[]>;
+  describeProject?(projectId: string): Promise<GcpProject>;
+  describeBillingProject?(projectId: string): Promise<BillingProject>;
   createProject(projectId: string, name: string): Promise<void>;
   attachBillingAccount(projectId: string, billingAccountName: string): Promise<void>;
 };
@@ -33,6 +40,20 @@ export function createGcpApi(): GcpApi {
       );
     },
 
+    async describeProject(projectId: string) {
+      return parseJson<GcpProject>(
+        runGcloud(["projects", "describe", projectId, "--format=json(projectId,name,lifecycleState)"]).stdout,
+        "GCP project"
+      );
+    },
+
+    async describeBillingProject(projectId: string) {
+      return parseJson<BillingProject>(
+        runGcloud(["beta", "billing", "projects", "describe", projectId, "--format=json(billingEnabled,billingAccountName)"]).stdout,
+        "GCP project billing"
+      );
+    },
+
     async createProject(projectId: string, name: string) {
       runGcloud(["projects", "create", projectId, "--name", name]);
     },
@@ -64,6 +85,46 @@ export async function attachBillingAccount(projectId: string, billingAccountName
   await api.attachBillingAccount(projectId, billingAccountName);
 }
 
+export async function assertExistingProjectReadyForAutoDeploy(projectId: string, api = createGcpApi()) {
+  try {
+    await api.describeProject?.(projectId);
+  } catch (error) {
+    throw new Error(
+      [
+        `GCP project ${projectId} does not exist or is not accessible.`,
+        "Create and enable billing on that project before one-shot create, pass --project-id <billed-project>, or pass --no-auto-deploy.",
+        formatErrorDetail(error),
+      ]
+        .filter(Boolean)
+        .join("\n")
+    );
+  }
+
+  let billing: BillingProject;
+  try {
+    billing = (await api.describeBillingProject?.(projectId)) ?? {};
+  } catch (error) {
+    throw new Error(
+      [
+        `Unable to verify billing for GCP project ${projectId}.`,
+        "Fix billing access before one-shot create, pass --project-id <billed-project>, or pass --no-auto-deploy.",
+        formatErrorDetail(error),
+      ]
+        .filter(Boolean)
+        .join("\n")
+    );
+  }
+
+  if (!billing.billingEnabled) {
+    throw new Error(
+      [
+        `GCP project ${projectId} exists but billing is not enabled.`,
+        "Link billing before one-shot create, pass --project-id <billed-project>, or pass --no-auto-deploy.",
+      ].join("\n")
+    );
+  }
+}
+
 function runGcloud(args: string[]) {
   const result = Bun.spawnSync(["gcloud", ...args], {
     stdout: "pipe",
@@ -87,6 +148,11 @@ function accountSortName(account: BillingAccount) {
   return account.displayName || account.name;
 }
 
+function formatErrorDetail(error: unknown) {
+  const message = error instanceof Error ? error.message : String(error);
+  return message ? `Details: ${message}` : undefined;
+}
+
 function parseJson<T>(value: string, label: string): T {
   try {
     return JSON.parse(value) as T;

package/src/scaffold.test.ts

@@ -70,6 +70,8 @@ test("scaffolds all runtime/framework variants with shared cloudrun config", asy
     expect(serviceConfig).toContain('"api_key_secret_name": "dns-api-temporal-api-key"');
     expect(serviceConfig).toContain('"project_mode": "create_new"');
     expect(serviceConfig).toContain('"quota_project_id": "anmho-infra-prod"');
+    expect(serviceConfig).toContain('"artifact_repository": "cloud-run"');
+    expect(serviceConfig).not.toContain("cloudbuild.googleapis.com");
     expect(serviceConfig).toContain('"jwks_url": "https://auth.anmho.com/api/auth/jwks"');
     expect(serviceConfig).toContain('"git": {');
     expect(serviceConfig).toContain('"repository": "dns-api"');

package/src/service-runtime/cloudrun/cleanup.ts

@@ -75,8 +75,9 @@ export async function cleanup(args = Bun.argv.slice(2)) {
   }
 
   await requireDestroyConfirmation(options.force);
+  const deleteGitHubRepository = await confirmGitHubRepositoryDeletion(plan.githubRepository, options.force);
 
-  await deletePlannedResources(plan);
+  await deletePlannedResources(plan, { deleteGitHubRepository });
 
   if (options.destroyProject) {
     await runStep(`Deleting GCP project ${config.project.id}`, () => deleteProject());
@@ -87,7 +88,7 @@ export async function cleanup(args = Bun.argv.slice(2)) {
   return `Destroy finished for ${config.serviceName}`;
 }
 
-async function deletePlannedResources(plan: DestroyPlan) {
+async function deletePlannedResources(plan: DestroyPlan, options: { deleteGitHubRepository: boolean }) {
   const tasks: ParallelTask[] = [
     {
       label: "Stopping local dev resources",
@@ -135,7 +136,7 @@ async function deletePlannedResources(plan: DestroyPlan) {
     },
   ];
 
-  if (plan.githubRepository) {
+  if (plan.githubRepository && options.deleteGitHubRepository) {
     tasks.push({
       label: `Deleting GitHub repository ${plan.githubRepository}`,
       task: () => deleteGitHubRepository(plan.githubRepository!),
@@ -246,7 +247,10 @@ function planGitHubRepository(plan: DestroyPlan) {
   }
 
   plan.githubRepository = repository;
-  plan.resources.push({ label: `GitHub repository ${repository}`, detail: "private generated repo" });
+  plan.skipped.push({
+    label: `GitHub repository ${repository}`,
+    detail: "owned by this service CLI run; deletion is optional and defaults to no",
+  });
 }
 
 function deleteGitHubRepository(repository: string) {
@@ -400,6 +404,41 @@ async function requireDestroyConfirmation(force: boolean) {
   }
 }
 
+async function confirmGitHubRepositoryDeletion(repository: string | undefined, force: boolean) {
+  if (!repository) {
+    return false;
+  }
+
+  if (force) {
+    log.step(`Keeping GitHub repository ${repository}; delete manually with: ${manualGitHubDeleteCommand(repository)}`);
+    return false;
+  }
+
+  if (!process.stdin.isTTY) {
+    return false;
+  }
+
+  const deleteAnswer = await confirm({
+    message: `Delete GitHub repository ${repository}?`,
+    initialValue: false,
+  });
+  if (isCancel(deleteAnswer) || !deleteAnswer) {
+    log.step(`Keeping GitHub repository ${repository}; delete manually with: ${manualGitHubDeleteCommand(repository)}`);
+    return false;
+  }
+
+  const confirmAnswer = await confirm({
+    message: `Confirm deleting GitHub repository ${repository}? This cannot be undone.`,
+    initialValue: false,
+  });
+  if (isCancel(confirmAnswer) || !confirmAnswer) {
+    log.step(`Keeping GitHub repository ${repository}; delete manually with: ${manualGitHubDeleteCommand(repository)}`);
+    return false;
+  }
+
+  return true;
+}
+
 if (import.meta.main) {
   await runMain("Destroy", () => cleanup(Bun.argv.slice(2)));
 }

package/src/service-runtime/cloudrun/deploy-args.ts

@@ -0,0 +1,90 @@
+export type DeployArgs = {
+  build: "local" | "cloudbuild";
+  ci: boolean;
+  destroy: boolean;
+  environment: "main" | "preview" | "personal";
+  name?: string;
+};
+
+export function parseDeployArgs(argv: string[]): DeployArgs {
+  const parsed: DeployArgs = {
+    build: parseBuildStrategy(process.env.SERVICE_BUILD_STRATEGY || process.env.SERVICE_BUILD),
+    ci: false,
+    destroy: false,
+    environment: "main",
+  };
+
+  for (let i = 0; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token) {
+      continue;
+    }
+
+    const next = argv[i + 1];
+    const readValue = () => {
+      if (!next || next.startsWith("-")) {
+        throw new Error(`Missing value for ${token}`);
+      }
+      i += 1;
+      return next;
+    };
+
+    if (token === "--ci") {
+      parsed.ci = true;
+      continue;
+    }
+
+    if (token === "--destroy") {
+      parsed.destroy = true;
+      continue;
+    }
+
+    if (token === "--build") {
+      parsed.build = parseBuildStrategy(readValue());
+      continue;
+    }
+
+    if (token.startsWith("--build=")) {
+      parsed.build = parseBuildStrategy(token.slice("--build=".length));
+      continue;
+    }
+
+    if (token === "--cloud-build") {
+      parsed.build = "cloudbuild";
+      continue;
+    }
+
+    if (token === "--environment") {
+      parsed.environment = readValue() as DeployArgs["environment"];
+      continue;
+    }
+
+    if (token.startsWith("--environment=")) {
+      parsed.environment = token.slice("--environment=".length) as DeployArgs["environment"];
+      continue;
+    }
+
+    if (token === "--name") {
+      parsed.name = readValue();
+      continue;
+    }
+
+    if (token.startsWith("--name=")) {
+      parsed.name = token.slice("--name=".length);
+      continue;
+    }
+  }
+
+  return parsed;
+}
+
+function parseBuildStrategy(value: string | undefined): DeployArgs["build"] {
+  if (!value || value === "local") {
+    return "local";
+  }
+  if (value === "cloudbuild" || value === "cloud-build") {
+    return "cloudbuild";
+  }
+  throw new Error(`Unknown build strategy: ${value}`);
+}
+

package/src/service-runtime/cloudrun/deploy.ts

@@ -4,6 +4,7 @@ import { deleteBranch, ensureBranch, ensureDatabase, getConnectionUri, listBranc
 import {
   addSecretVersion,
   deleteService,
+  dockerStreaming,
   ensureArtifactRepository,
   ensureProductionDomainMapping,
   ensureSecretAccessor,
@@ -74,9 +75,18 @@ export async function deploy(args = Bun.argv.slice(2), deployOptions: DeployOpti
     });
   }
   const image = imageUrl();
-  await runStep("Building container image in Cloud Build", () =>
-    gcloudStreaming(["builds", "submit", "--project", config.project.id, "--region", config.region, "--tag", image])
-  );
+  if (options.build === "cloudbuild") {
+    await runStep("Building container image in Cloud Build", () =>
+      gcloudStreaming(["builds", "submit", "--project", config.project.id, "--region", config.region, "--tag", image])
+    );
+  } else {
+    requireCommand("docker");
+    await runStep("Authenticating Docker to Artifact Registry", () =>
+      gcloud(["auth", "configure-docker", `${config.region}-docker.pkg.dev`, "--quiet"])
+    );
+    await runStep("Building container image locally", () => dockerStreaming(["build", "-t", image, "."]));
+    await runStep("Pushing container image to Artifact Registry", () => dockerStreaming(["push", image]));
+  }
 
   const renderedManifestPath = await runStep("Rendering Cloud Run manifest", () => writeRenderedManifest(image, target));
 

package/src/service-runtime/cloudrun/lib.test.ts

@@ -0,0 +1,29 @@
+import { afterEach, expect, test } from "bun:test";
+import { parseDeployArgs } from "./deploy-args";
+
+const originalBuild = process.env.SERVICE_BUILD;
+const originalBuildStrategy = process.env.SERVICE_BUILD_STRATEGY;
+
+afterEach(() => {
+  process.env.SERVICE_BUILD = originalBuild;
+  process.env.SERVICE_BUILD_STRATEGY = originalBuildStrategy;
+});
+
+test("parseDeployArgs defaults to local image builds", () => {
+  delete process.env.SERVICE_BUILD;
+  delete process.env.SERVICE_BUILD_STRATEGY;
+
+  expect(parseDeployArgs([]).build).toBe("local");
+});
+
+test("parseDeployArgs accepts explicit Cloud Build fallback", () => {
+  expect(parseDeployArgs(["--build", "cloudbuild"]).build).toBe("cloudbuild");
+  expect(parseDeployArgs(["--build=cloud-build"]).build).toBe("cloudbuild");
+  expect(parseDeployArgs(["--cloud-build"]).build).toBe("cloudbuild");
+});
+
+test("parseDeployArgs accepts build strategy from env", () => {
+  process.env.SERVICE_BUILD_STRATEGY = "cloudbuild";
+
+  expect(parseDeployArgs([]).build).toBe("cloudbuild");
+});

package/src/service-runtime/cloudrun/lib.ts

@@ -2,6 +2,7 @@ import { intro, log, outro, spinner } from "@clack/prompts";
 import { join } from "node:path";
 import { config } from "./config";
 import { serviceRoot } from "../runtime";
+import { parseDeployArgs, type DeployArgs } from "./deploy-args";
 
 type CommandOptions = {
   allowFailure?: boolean;
@@ -9,13 +10,6 @@ type CommandOptions = {
   env?: Record<string, string | undefined>;
 };
 
-type DeployArgs = {
-  ci: boolean;
-  destroy: boolean;
-  environment: "main" | "preview" | "personal";
-  name?: string;
-};
-
 type CleanupArgs = {
   destroyProject: boolean;
   force: boolean;
@@ -125,6 +119,10 @@ export async function gcloudStreaming(args: string[], options: CommandOptions =
   return runStreaming("gcloud", normalized, options);
 }
 
+export async function dockerStreaming(args: string[], options: CommandOptions = {}) {
+  return runStreaming("docker", args, options);
+}
+
 export async function runStreaming(command: string, args: string[], options: CommandOptions = {}): Promise<CommandResult> {
   const child = Bun.spawn([command, ...args], {
     cwd: process.cwd(),
@@ -454,61 +452,7 @@ export function imageUrl(tag = imageTag()) {
   return `${artifactImageBase()}:${tag}`;
 }
 
-export function parseDeployArgs(argv: string[]): DeployArgs {
-  const parsed: DeployArgs = {
-    ci: false,
-    destroy: false,
-    environment: "main",
-  };
-
-  for (let i = 0; i < argv.length; i += 1) {
-    const token = argv[i];
-    if (!token) {
-      continue;
-    }
-
-    const next = argv[i + 1];
-    const readValue = () => {
-      if (!next || next.startsWith("-")) {
-        throw new Error(`Missing value for ${token}`);
-      }
-      i += 1;
-      return next;
-    };
-
-    if (token === "--ci") {
-      parsed.ci = true;
-      continue;
-    }
-
-    if (token === "--destroy") {
-      parsed.destroy = true;
-      continue;
-    }
-
-    if (token === "--environment") {
-      parsed.environment = readValue() as DeployArgs["environment"];
-      continue;
-    }
-
-    if (token.startsWith("--environment=")) {
-      parsed.environment = token.slice("--environment=".length) as DeployArgs["environment"];
-      continue;
-    }
-
-    if (token === "--name") {
-      parsed.name = readValue();
-      continue;
-    }
-
-    if (token.startsWith("--name=")) {
-      parsed.name = token.slice("--name=".length);
-      continue;
-    }
-  }
-
-  return parsed;
-}
+export { parseDeployArgs };
 
 export function parseCleanupArgs(argv: string[]): CleanupArgs {
   const parsed: CleanupArgs = {

package/src/service-runtime/workers/cli.ts

@@ -97,7 +97,9 @@ export async function main(argv = Bun.argv.slice(2)) {
       await requireDestroyConfirmation(rest.includes("--force"));
       const wranglerArgs = rest.filter((arg) => arg !== "--force");
       await stopLocalDev({ dockerCompose: false });
-      deleteGitHubRepositoryIfOwned();
+      if (await confirmGitHubRepositoryDeletion(rest.includes("--force"))) {
+        deleteGitHubRepositoryIfOwned();
+      }
       await deleteHyperdrive();
       run("wrangler", ["delete", "--name", config.serviceName, "--force", ...wranglerArgs]);
       await deleteNeonDatabase();
@@ -152,6 +154,47 @@ function deleteGitHubRepositoryIfOwned() {
   run("gh", ["repo", "delete", repository, "--yes"]);
 }
 
+async function confirmGitHubRepositoryDeletion(force: boolean) {
+  const repository = `${config.git.owner}/${config.git.repository}`;
+  if (!config.git.deleteOnDestroy) {
+    log.step(
+      `Skipping GitHub repository ${repository}: ${
+        config.git.enabled ? `not created by this service CLI run; manual cleanup: ${manualGitHubDeleteCommand(repository)}` : "git disabled"
+      }`
+    );
+    return false;
+  }
+
+  if (force) {
+    log.step(`Keeping GitHub repository ${repository}; delete manually with: ${manualGitHubDeleteCommand(repository)}`);
+    return false;
+  }
+
+  if (!process.stdin.isTTY) {
+    return false;
+  }
+
+  const deleteAnswer = await confirm({
+    message: `Delete GitHub repository ${repository}?`,
+    initialValue: false,
+  });
+  if (isCancel(deleteAnswer) || !deleteAnswer) {
+    log.step(`Keeping GitHub repository ${repository}; delete manually with: ${manualGitHubDeleteCommand(repository)}`);
+    return false;
+  }
+
+  const confirmAnswer = await confirm({
+    message: `Confirm deleting GitHub repository ${repository}? This cannot be undone.`,
+    initialValue: false,
+  });
+  if (isCancel(confirmAnswer) || !confirmAnswer) {
+    log.step(`Keeping GitHub repository ${repository}; delete manually with: ${manualGitHubDeleteCommand(repository)}`);
+    return false;
+  }
+
+  return true;
+}
+
 function run(command: string, args: string[], options: { allowFailure?: boolean; capture?: boolean } = {}) {
   if (!Bun.which(command)) {
     throw new Error(`missing required command: ${command}`);

package/templates/shared/README.md

@@ -66,10 +66,14 @@ Create, deploy, and destroy use:
 
 - known-good CLIs first, especially `gcloud`
 - `gcloud`
+- Docker for local image builds and Artifact Registry pushes
 - `NEON_API_KEY`, or a working Vault login via `VAULT_ADDR` plus `VAULT_TOKEN`, `VAULT_TOKEN_FILE`, or `~/.vault-token`
 - the repo-aware `service` CLI from this package
 
 Local provisioning intentionally prefers known-good CLIs over SDKs for Google Cloud operations.
+Cloud Run deploys build and push the container image locally by default. Use
+`service deploy --build cloudbuild` only when you explicitly want Google Cloud
+Build to build the image remotely.
 
 Authenticate `gcloud` on the machine before running provisioning commands:
 

package/templates/shared/service.jsonc

@@ -97,7 +97,6 @@
     "service_account": "{{RUNTIME_SERVICE_ACCOUNT}}",
     "required_apis": [
       "run.googleapis.com",
-      "cloudbuild.googleapis.com",
       "artifactregistry.googleapis.com",
       "iam.googleapis.com",
       "iamcredentials.googleapis.com",