create-svc 0.1.41 → 0.1.43

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-svc",
-  "version": "0.1.41",
+  "version": "0.1.43",
   "description": "Local microservice bootstrap CLI for Cloud Run and Workers services with Neon-backed data.",
   "module": "index.ts",
   "type": "module",

package/src/post-scaffold.test.ts

@@ -4,6 +4,7 @@ import {
   buildLocalVerificationCommands,
   buildPostScaffoldCommands,
   buildPreGitBootstrapCommands,
+  shouldRunLocalMigrate,
 } from "./post-scaffold";
 
 describe("buildPostScaffoldCommands", () => {
@@ -37,6 +38,13 @@ describe("buildPreGitBootstrapCommands", () => {
   });
 });
 
+describe("shouldRunLocalMigrate", () => {
+  test("skips local migrate before Workers dev", () => {
+    expect(shouldRunLocalMigrate({ target: "workers" })).toBe(false);
+    expect(shouldRunLocalMigrate({ target: "cloudrun" })).toBe(true);
+  });
+});
+
 describe("buildLocalVerificationCommands", () => {
   test("uses local curl checks for Bun Hono services", () => {
     expect(buildLocalVerificationCommands({ apiHostname: "api.launch.anmho.com", framework: "hono", runtime: "bun" })).toEqual([

package/src/post-scaffold.ts

@@ -58,7 +58,9 @@ export function runPreGitBootstrapFlow(config: Pick<ScaffoldConfig, "framework">
 }
 
 async function startLocalDevelopment(config: Pick<ScaffoldConfig, "target">, cwd: string) {
-  run("bun", ["run", "migrate"], { cwd });
+  if (shouldRunLocalMigrate(config)) {
+    run("bun", ["run", "migrate"], { cwd });
+  }
   await mkdir(join(cwd, ".service"), { recursive: true });
   const child = Bun.spawn(["sh", "-c", "exec bun run dev > .service/local-dev.log 2>&1 < /dev/null"], {
     cwd,
@@ -72,6 +74,10 @@ async function startLocalDevelopment(config: Pick<ScaffoldConfig, "target">, cwd
   await Bun.write(join(cwd, ".service", "local-dev.pid"), `${child.pid}\n`);
 }
 
+export function shouldRunLocalMigrate(config: Pick<ScaffoldConfig, "target">) {
+  return config.target !== "workers";
+}
+
 function runWithRetries(command: PostScaffoldCommand, options: CommandOptions, attempts: number, delayMs: number) {
   let lastError: unknown;
   for (let attempt = 1; attempt <= attempts; attempt += 1) {

package/src/service-runtime/workers/cli.ts

@@ -7,6 +7,7 @@ import { manualGitHubDeleteCommand } from "../../git-bootstrap";
 import { ensureAuthClient, ensureAuthResourceServer, runAuthCommand, runAuthDoctor } from "../authctl";
 import { stopLocalDev } from "../local-dev";
 import { serviceConfig } from "../runtime";
+import { isLocalDatabaseUrl, isMissingDatabaseError, resolveCommandPath } from "./lib";
 
 const config = {
   serviceName: serviceConfig.service_id,
@@ -35,8 +36,8 @@ export async function main(argv = Bun.argv.slice(2)) {
     return runMain("Create", async () => {
       ensureAuthResourceServer();
       ensureAuthClient();
-      const databaseUrl = await resolveDatabaseUrl();
-      await applySchema(databaseUrl);
+      const databaseUrl = await resolveDatabaseUrl({ preferRemote: true });
+      await applySchemaWithRetries(databaseUrl);
       await ensureHyperdrive(databaseUrl);
       run("wrangler", ["deploy"]);
       return `Created https://${config.hostname}`;
@@ -196,10 +197,11 @@ async function confirmGitHubRepositoryDeletion(force: boolean) {
 }
 
 function run(command: string, args: string[], options: { allowFailure?: boolean; capture?: boolean } = {}) {
-  if (!Bun.which(command)) {
+  const resolvedCommand = resolveCommandPath(command);
+  if (!resolvedCommand) {
     throw new Error(`missing required command: ${command}`);
   }
-  const result = Bun.spawnSync([command, ...args], {
+  const result = Bun.spawnSync([resolvedCommand, ...args], {
     cwd: process.cwd(),
     env: process.env,
     stdin: "inherit",
@@ -254,15 +256,20 @@ async function deleteHyperdrive() {
   run("wrangler", ["hyperdrive", "delete", id, "--force"], { allowFailure: true });
 }
 
-async function resolveDatabaseUrl() {
+async function resolveDatabaseUrl(options: { preferRemote?: boolean } = {}) {
   const direct = Bun.env.DATABASE_URL?.trim();
+  const apiKey = resolveNeonApiKey();
   if (direct) {
-    return direct;
+    if (!options.preferRemote || !isLocalDatabaseUrl(direct)) {
+      return direct;
+    }
+    if (!apiKey) {
+      throw new Error("NEON_API_KEY or readable Vault Neon provider path is required for Workers production create; ignoring local DATABASE_URL");
+    }
   }
 
-  const apiKey = Bun.env.NEON_API_KEY?.trim();
   if (!apiKey) {
-    throw new Error("DATABASE_URL or NEON_API_KEY is required to provision the Hyperdrive binding");
+    throw new Error("NEON_API_KEY, readable Vault Neon provider path, or non-local DATABASE_URL is required to provision the Hyperdrive binding");
   }
 
   const { neon, projectId, branchId } = await resolveNeonTarget(apiKey);
@@ -295,6 +302,32 @@ async function resolveDatabaseUrl() {
   return uri;
 }
 
+function resolveNeonApiKey() {
+  const direct = Bun.env.NEON_API_KEY?.trim();
+  if (direct) {
+    return direct;
+  }
+
+  const vault = resolveCommandPath("vault");
+  if (!vault) {
+    return "";
+  }
+
+  const mount = Bun.env.VAULT_SECRET_MOUNT?.trim() || "secret";
+  const path = Bun.env.VAULT_NEON_API_KEY_PATH?.trim() || "prod/providers/neon";
+  const field = Bun.env.VAULT_NEON_API_KEY_FIELD?.trim() || "api_key";
+  const result = Bun.spawnSync([vault, "kv", "get", `-mount=${mount}`, `-field=${field}`, path], {
+    cwd: process.cwd(),
+    env: process.env,
+    stdout: "pipe",
+    stderr: "pipe",
+  });
+  if (!result.success || !result.stdout) {
+    return "";
+  }
+  return new TextDecoder().decode(result.stdout).trim();
+}
+
 async function resolveNeonTarget(apiKey: string) {
   const neon = createApiClient({ apiKey });
   const projectsPayload = await neon.listProjects({ limit: 100 });
@@ -388,6 +421,23 @@ create index if not exists waitlist_triggers_status_created_idx
   }
 }
 
+async function applySchemaWithRetries(databaseUrl: string) {
+  let lastError: unknown;
+  for (let attempt = 1; attempt <= 10; attempt += 1) {
+    try {
+      await applySchema(databaseUrl);
+      return;
+    } catch (error) {
+      lastError = error;
+      if (!isMissingDatabaseError(error) || attempt === 10) {
+        break;
+      }
+      await Bun.sleep(2_000);
+    }
+  }
+  throw lastError;
+}
+
 async function runDoctor() {
   const results: Array<{ name: string; status: DoctorStatus; detail: string }> = [];
 
@@ -462,7 +512,7 @@ async function record(
 }
 
 function checkCommand(name: string) {
-  const path = Bun.which(name);
+  const path = resolveCommandPath(name);
   if (!path) {
     throw new Error(`${name} is not installed`);
   }

package/src/service-runtime/workers/lib.test.ts

@@ -0,0 +1,32 @@
+import { expect, test } from "bun:test";
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { mkdtempSync } from "node:fs";
+import { isLocalDatabaseUrl, isMissingDatabaseError, resolveCommandPath } from "./lib";
+
+test("resolveCommandPath prefers repo-local bins", async () => {
+  const root = mkdtempSync(join(tmpdir(), "create-svc-workers-bin-"));
+  try {
+    const binDir = join(root, "node_modules", ".bin");
+    await mkdir(binDir, { recursive: true });
+    const wrangler = join(binDir, "wrangler");
+    await writeFile(wrangler, "#!/bin/sh\n");
+
+    expect(resolveCommandPath("wrangler", root)).toBe(wrangler);
+  } finally {
+    await rm(root, { recursive: true, force: true });
+  }
+});
+
+test("isLocalDatabaseUrl detects localhost database URLs", () => {
+  expect(isLocalDatabaseUrl("postgres://postgres:postgres@127.0.0.1:5432/app")).toBe(true);
+  expect(isLocalDatabaseUrl("postgres://postgres:postgres@localhost:5432/app")).toBe(true);
+  expect(isLocalDatabaseUrl("postgres://user:pass@ep-example.us-east-2.aws.neon.tech/app")).toBe(false);
+  expect(isLocalDatabaseUrl("not a url")).toBe(false);
+});
+
+test("isMissingDatabaseError detects Neon database propagation failures", () => {
+  expect(isMissingDatabaseError(new Error('database "codex_workers" does not exist'))).toBe(true);
+  expect(isMissingDatabaseError(new Error("password authentication failed"))).toBe(false);
+});

package/src/service-runtime/workers/lib.ts

@@ -0,0 +1,24 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+
+export function resolveCommandPath(command: string, cwd = process.cwd()) {
+  const local = join(cwd, "node_modules", ".bin", command);
+  if (existsSync(local)) {
+    return local;
+  }
+  return Bun.which(command);
+}
+
+export function isLocalDatabaseUrl(value: string) {
+  try {
+    const parsed = new URL(value);
+    return ["localhost", "127.0.0.1", "::1"].includes(parsed.hostname);
+  } catch {
+    return false;
+  }
+}
+
+export function isMissingDatabaseError(error: unknown) {
+  const message = error instanceof Error ? error.message : String(error);
+  return /database ".+" does not exist/.test(message);
+}

package/templates/targets/workers/README.md

@@ -70,6 +70,9 @@ If the Hyperdrive binding id is empty, `service create` uses `DATABASE_URL`, or
 `NEON_API_KEY` to create/resolve the generated Neon database and connection URI,
 applies the waitlist schema, then runs `wrangler hyperdrive create` and writes
 the returned id back into `wrangler.toml` before deploy.
+For production create, a generated local `DATABASE_URL` pointing at localhost is
+ignored when `NEON_API_KEY` or the generated Vault Neon provider path is
+available.
 
 You can also apply the schema manually: