create-svc 0.1.53 → 0.1.54

package/README.md

@@ -115,6 +115,7 @@ bun run lint
 bun run test
 service create
 service deploy
+service observability-bootstrap
 service dev down
 service destroy
 ```
@@ -129,6 +130,7 @@ make lint
 make test
 service create
 service deploy
+service observability-bootstrap
 service dev down
 service destroy
 ```
@@ -136,6 +138,10 @@ service destroy
 Language-specific tasks such as local running, linting, formatting, testing, and building stay in package scripts or Make targets. Service lifecycle operations are exposed through the generated `service` CLI.
 `service destroy --force` also stops local dev and runs Docker Compose cleanup for generated Cloud Run services.
 
+`service observability-bootstrap` enables the Google Cloud Logging, Monitoring,
+and Trace APIs for the generated GCP project. It does not create dashboards,
+alerts, log-based metrics, or SLOs; those stay explicit follow-up work.
+
 After `service create` has provisioned auth, the generated repo can mint a
 client-credentials bearer token for smoke checks:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-svc",
-  "version": "0.1.53",
+  "version": "0.1.54",
   "description": "Local microservice bootstrap CLI for Cloud Run and Workers services with Neon-backed data.",
   "module": "index.ts",
   "type": "module",

package/src/scaffold.test.ts

@@ -133,12 +133,24 @@ test("scaffolds all runtime/framework variants with shared cloudrun config", asy
     expect(localEnv).toContain("VAULT_CLOUDFLARE_API_TOKEN_PATH=prod/providers/cloudflare");
     expect(localEnv).not.toContain("ATTACHMENT_PUBLIC_BASE_URL=");
 
-    const ciWorkflow = await Bun.file(join(generatedRoot, ".github", "workflows", "ci.yml")).text();
-    expect(ciWorkflow).toContain("bun run dashboards");
-    expect(ciWorkflow).toContain("GCX_ENABLED");
     expect(await Bun.file(join(generatedRoot, "grafana", "waitlist-dashboard.json")).exists()).toBeTrue();
     expect(await Bun.file(join(generatedRoot, "grafana", "alerts.yaml")).exists()).toBeTrue();
 
+    const previewWorkflow = await Bun.file(join(generatedRoot, ".github", "workflows", "preview.yml")).text();
+    expect(previewWorkflow).toContain("push:");
+    expect(previewWorkflow).toContain("branches-ignore:");
+    expect(previewWorkflow).toContain("- main");
+    expect(previewWorkflow).toContain("github.ref_name");
+    expect(previewWorkflow).toContain("service deploy --ci --environment preview --name");
+    expect(previewWorkflow).toContain("NEON_API_KEY");
+
+    const deployWorkflow = await Bun.file(join(generatedRoot, ".github", "workflows", "deploy.yml")).text();
+    expect(deployWorkflow).toContain("branches:");
+    expect(deployWorkflow).toContain("- main");
+    expect(deployWorkflow).toContain("service deploy --ci");
+    expect(deployWorkflow).toContain("bun run dashboards");
+    expect(deployWorkflow).toContain("GCX_ENABLED");
+
     if (variant.runtime === "go") {
       const goMod = await Bun.file(join(generatedRoot, "go.mod")).text();
       const goSumExists = await Bun.file(join(generatedRoot, "go.sum")).exists();
@@ -198,6 +210,7 @@ test("scaffolds all runtime/framework variants with shared cloudrun config", asy
       expect(packageJson).toContain('"create": "service create"');
       expect(packageJson).toContain('"deploy": "service deploy"');
       expect(packageJson).toContain('"dashboards": "service dashboards"');
+      expect(packageJson).toContain('"observability-bootstrap": "service observability-bootstrap"');
       expect(packageJson).toContain('"auth": "service auth"');
       expect(packageJson).toContain('"destroy": "service destroy"');
       expect(await Bun.file(join(generatedRoot, "scripts", "cloudrun", "cli.ts")).exists()).toBeFalse();
@@ -206,12 +219,15 @@ test("scaffolds all runtime/framework variants with shared cloudrun config", asy
       expect(serviceConfig).toContain('"service_id": "dns-api"');
       expect(serviceConfig).toContain('"project_id": "anmho-dns-api"');
       expect(serviceConfig).toContain('"database_name": "dns_api"');
+      expect(serviceConfig).toContain('"observability"');
+      expect(serviceConfig).toContain("logging.googleapis.com");
       const authScript = await Bun.file(join(generatedRoot, "src", "auth.ts")).text();
       expect(authScript).toContain('"Ed25519"');
 
       const makefile = await Bun.file(join(generatedRoot, "Makefile")).text();
       expect(makefile).toContain("SERVICE := service");
       expect(makefile).toContain("dashboards:");
+      expect(makefile).toContain("observability-bootstrap:");
       expect(makefile).toContain("auth:");
       expect(makefile).toContain("bun run dev");
       const devScript = await Bun.file(join(generatedRoot, "scripts", "dev.ts")).text();
@@ -249,8 +265,6 @@ test("scaffolds all runtime/framework variants with shared cloudrun config", asy
       expect(readme).toContain("service auth resource-server");
     }
 
-    const deployWorkflow = await Bun.file(join(generatedRoot, ".github", "workflows", "deploy.yml")).text();
-    expect(deployWorkflow).toContain("bun run dashboards");
   }
 }, 30000);
 
@@ -275,14 +289,20 @@ test("scaffolds a backend package cleanly into a nested monorepo-style directory
   expect(readme).toContain("known-good CLIs");
   expect(readme).toContain("service create");
   expect(readme).toContain("service deploy");
+  expect(readme).toContain("Google observability bootstrap");
+  expect(readme).toContain("Google Cloud Logging, Monitoring, and Trace APIs");
   expect(readme).toContain("one-command production create");
   expect(readme).toContain("waitlist/launch service");
   expect(readme).toContain("Terraform is optional");
   expect(readme).toContain("waitlist/launch service");
   expect(readme).not.toContain("Neon main, preview, and personal branch provisioning");
-  const ciWorkflow = await Bun.file(join(generatedRoot, ".github", "workflows", "ci.yml")).text();
-  expect(ciWorkflow).toContain("bun run dashboards");
-  expect(readme).not.toContain("repository");
+  expect(readme).toContain("GitHub Actions deployment");
+  expect(readme).toContain(".github/workflows/preview.yml");
+  expect(readme).toContain(".github/workflows/deploy.yml");
+  expect(readme).toContain("pushes to non-main branches");
+  expect(readme).toContain("GCP_WIF_PROVIDER");
+  expect(readme).toContain("GCP_DEPLOYER_SERVICE_ACCOUNT");
+  expect(readme).toContain("NEON_API_KEY");
 
   const packageJson = await Bun.file(join(generatedRoot, "package.json")).text();
   expect(packageJson).toContain('"hono"');
@@ -290,6 +310,8 @@ test("scaffolds a backend package cleanly into a nested monorepo-style directory
   const entrypoint = await Bun.file(join(generatedRoot, "src", "index.ts")).text();
   expect(entrypoint).toContain("/v1/waitlist");
   expect(entrypoint).toContain("/v1/admin/waitlist");
+  expect(await Bun.file(join(generatedRoot, ".github", "workflows", "preview.yml")).exists()).toBeTrue();
+  expect(await Bun.file(join(generatedRoot, ".github", "workflows", "deploy.yml")).exists()).toBeTrue();
 }, 15000);
 
 test("scaffolds the workers target with wrangler lifecycle commands", async () => {

package/src/scaffold.ts

@@ -12,6 +12,11 @@ import {
 import { exampleForProfile, type Profile } from "./profiles";
 import type { GitBootstrapConfig } from "./git-bootstrap";
 
+const GENERATED_GITHUB_ACTION_WORKFLOWS = new Set([
+  ".github/workflows/preview.yml",
+  ".github/workflows/deploy.yml",
+]);
+
 export type ScaffoldConfig = {
   directory: string;
   serviceName: string;
@@ -153,12 +158,23 @@ async function collectTemplateFiles(root: string, relative = ""): Promise<string
       files.push(...(await collectTemplateFiles(root, nextRelative)));
       continue;
     }
+    if (shouldSkipTemplateFile(nextRelative)) {
+      continue;
+    }
     files.push(nextRelative);
   }
 
   return files.sort();
 }
 
+function shouldSkipTemplateFile(relativePath: string) {
+  if (!relativePath.startsWith(".github/")) {
+    return false;
+  }
+
+  return !GENERATED_GITHUB_ACTION_WORKFLOWS.has(relativePath);
+}
+
 function buildReplacements(config: ScaffoldConfig) {
   const example = exampleForProfile(config.profile);
   const serviceAccountBase = compactIdentifier(config.serviceName, 21);
@@ -219,6 +235,13 @@ function buildReplacements(config: ScaffoldConfig) {
     COMMAND_DEV_DOWN: "service dev down",
     COMMAND_BOOTSTRAP: "service create",
     COMMAND_DEPLOY: "service deploy",
+    COMMAND_OBSERVABILITY_BOOTSTRAP:
+      config.runtime === "bun" ? "bun run observability-bootstrap" : "make observability-bootstrap",
+    WORKFLOW_DEPLOY_MAIN_COMMAND: "npm install -g create-svc@latest && service deploy --ci",
+    WORKFLOW_DEPLOY_PREVIEW_COMMAND:
+      "npm install -g create-svc@latest && service deploy --ci --environment preview --name ${{ github.ref_name }}",
+    WORKFLOW_DEPLOY_MAIN_DOC_COMMAND: "service deploy --ci",
+    WORKFLOW_DEPLOY_PREVIEW_DOC_COMMAND: "service deploy --ci --environment preview --name <branch-name>",
     COMMAND_AUTH_RESOURCE: "service auth resource-server",
     COMMAND_AUTH_CLIENT: "service auth client create",
     COMMAND_AUTH_TOKEN: "service auth token",

package/src/service-runtime/cloudrun/cli.ts

@@ -6,6 +6,7 @@ import { stopLocalDev } from "../local-dev";
 import { bootstrap, prepareGcpProject } from "./bootstrap";
 import { cleanup } from "./cleanup";
 import { deploy } from "./deploy";
+import { observabilityBootstrap } from "./observability";
 import { config } from "./config";
 import {
   accessSecretVersion,
@@ -69,6 +70,14 @@ export async function main(argv = Bun.argv.slice(2)) {
     return;
   }
 
+  if (command === "observability-bootstrap") {
+    await runMain("Google observability bootstrap", async () => {
+      await observabilityBootstrap();
+      return `Google observability bootstrap finished for ${config.serviceName}`;
+    });
+    return;
+  }
+
   if (command === "dev") {
     if (rest[0] !== "down") {
       throw new Error(`Unknown dev command: ${rest[0] || ""}\n\n${formatHelp()}`);
@@ -125,6 +134,7 @@ function formatHelp() {
     "  sdk         Build or publish generated SDK artifacts",
     "  dns         Repair or inspect DNS mappings",
     "  dev down    Stop local dev and Docker Compose containers",
+    "  observability-bootstrap  Enable Google observability APIs",
     "  dashboards  Publish Grafana resources",
     "  destroy     Remove service-managed cloud resources",
   ].join("\n");

package/src/service-runtime/cloudrun/config.ts

@@ -55,6 +55,9 @@ export const config = {
     repository: serviceConfig.git?.repository || serviceConfig.service_id,
     deleteOnDestroy: Boolean(serviceConfig.git?.delete_on_destroy),
   },
+  observability: {
+    requiredApis: serviceConfig.observability?.required_apis ?? ["logging.googleapis.com", "monitoring.googleapis.com", "cloudtrace.googleapis.com"],
+  },
   requiredApis: cloudrun.required_apis,
 } as const;
 

package/src/service-runtime/cloudrun/observability.ts

@@ -0,0 +1,18 @@
+import { config } from "./config";
+import { gcloud, requireCommand, requireGcloudAuth, runMain, runStep } from "./lib";
+
+export async function observabilityBootstrap() {
+  requireCommand("gcloud");
+  requireGcloudAuth();
+
+  await runStep("Enabling Google observability APIs", () =>
+    gcloud(["services", "enable", ...config.observability.requiredApis, "--project", config.project.id])
+  );
+}
+
+if (import.meta.main) {
+  await runMain("Google observability bootstrap", async () => {
+    await observabilityBootstrap();
+    return `Google observability bootstrap finished for ${config.serviceName}`;
+  });
+}

package/templates/shared/.github/workflows/deploy.yml

@@ -25,7 +25,7 @@ jobs:
           service_account: ${{ vars.GCP_DEPLOYER_SERVICE_ACCOUNT }}
       - uses: google-github-actions/setup-gcloud@v2
       - run: bun install
-      - run: bun run deploy -- --ci
+      - run: {{WORKFLOW_DEPLOY_MAIN_COMMAND}}
         env:
           NEON_API_KEY: ${{ secrets.NEON_API_KEY }}
       - if: ${{ vars.GCX_ENABLED == 'true' }}

package/templates/shared/.github/workflows/preview.yml

@@ -1,8 +1,9 @@
 name: Preview
 
 on:
-  pull_request:
-    types: [opened, synchronize, reopened]
+  push:
+    branches-ignore:
+      - main
 
 permissions:
   contents: read
@@ -24,6 +25,6 @@ jobs:
           service_account: ${{ vars.GCP_DEPLOYER_SERVICE_ACCOUNT }}
       - uses: google-github-actions/setup-gcloud@v2
       - run: bun install
-      - run: bun run deploy -- --ci --environment preview --name ${{ github.event.pull_request.number }}
+      - run: {{WORKFLOW_DEPLOY_PREVIEW_COMMAND}}
         env:
           NEON_API_KEY: ${{ secrets.NEON_API_KEY }}

package/templates/shared/README.md

@@ -9,6 +9,7 @@ This `{{PROFILE}}` profile targets `{{RUNTIME}} + {{FRAMEWORK}}` on Cloud Run wi
 - local Docker Compose Postgres for first-run development
 - the `service` CLI for create, deploy, doctor, dashboards, and destroy
 - shared GCP project deployment with quota-project-aware `gcloud` calls
+- Google Cloud Observability API bootstrap through `service observability-bootstrap`
 - Neon-backed remote database provisioning during create and deploy
 - Better Auth client-credentials resource-server registration through `authctl`
 - stage-aware waitlist data and trigger ingestion
@@ -77,6 +78,20 @@ Build to build the image remotely.
 Local Docker builds target `linux/amd64` so images built on Apple Silicon run on
 Cloud Run.
 
+## Google observability bootstrap
+
+Run this after the first production create when you want the project ready for
+Google Cloud Observability follow-up work:
+
+```bash
+{{COMMAND_OBSERVABILITY_BOOTSTRAP}}
+```
+
+The command authenticates through `gcloud`, targets the generated GCP project,
+and enables the Google Cloud Logging, Monitoring, and Trace APIs. It does not
+create dashboards, alerts, log-based metrics, or SLOs; those remain explicit
+follow-up work.
+
 Authenticate `gcloud` on the machine before running provisioning commands:
 
 ```bash
@@ -211,6 +226,28 @@ secrets only when you add a provider adapter. A generic adapter can honor:
 
 - `WEBHOOK_<PROVIDER>_SECRET`
 
+## GitHub Actions deployment
+
+The scaffold emits a minimal deployment workflow slice for Cloud Run:
+
+- [.github/workflows/preview.yml](.github/workflows/preview.yml) deploys a preview environment on pushes to non-main branches. It runs `{{WORKFLOW_DEPLOY_PREVIEW_DOC_COMMAND}}`.
+- [.github/workflows/deploy.yml](.github/workflows/deploy.yml) deploys the main production environment on pushes to `main`. It runs `{{WORKFLOW_DEPLOY_MAIN_DOC_COMMAND}}`.
+
+These workflows intentionally assume only GitHub OIDC, Google Cloud Workload Identity Federation, the generated `service` CLI, and Neon.
+They do not use a long-lived Google service account key.
+
+Before enabling the workflows, set these GitHub repository variables:
+
+- `GCP_WIF_PROVIDER`: full Workload Identity Provider resource name that trusts this repository
+- `GCP_DEPLOYER_SERVICE_ACCOUNT`: deployer service account email
+
+Set this GitHub repository secret:
+
+- `NEON_API_KEY`: Neon admin API key used to create preview branches and resolve the main database
+
+The deployer service account needs enough access in the generated GCP project to run `service deploy`, including Cloud Run, Artifact Registry, Secret Manager, IAM service account usage, and storage operations for this service.
+Run `{{COMMAND_BOOTSTRAP}}` once before relying on the production workflow for a fresh project.
+
 ## One-command production create
 
 The one-command production create path is designed for a fresh standalone service.

package/templates/shared/service.jsonc

@@ -85,6 +85,14 @@
     "module": "buf.build/anmho/{{SERVICE_ID}}"
   },
 
+  "observability": {
+    "required_apis": [
+      "logging.googleapis.com",
+      "monitoring.googleapis.com",
+      "cloudtrace.googleapis.com"
+    ]
+  },
+
   "cloudrun": {
     "project_id": "{{PROJECT_ID}}",
     "project_name": "{{PROJECT_NAME}}",

package/templates/variants/bun-connectrpc/Makefile

@@ -1,4 +1,4 @@
-.PHONY: dev migrate gen lint test create deploy dashboards auth destroy
+.PHONY: dev migrate gen lint test create deploy dashboards observability-bootstrap auth destroy
 
 SERVICE := service
 
@@ -26,6 +26,9 @@ deploy:
 dashboards:
 	$(SERVICE) dashboards
 
+observability-bootstrap:
+	$(SERVICE) observability-bootstrap
+
 auth:
 	$(SERVICE) auth $(ARGS)
 

package/templates/variants/bun-connectrpc/migrations/0000_init.sql

@@ -18,3 +18,13 @@ create table if not exists waitlist_triggers (
   created_at timestamptz not null default now(),
   processed_at timestamptz
 );
+
+create table if not exists webhook_events (
+  id text primary key,
+  provider text not null,
+  external_event_id text not null,
+  payload_json text not null,
+  headers_json text not null,
+  received_at timestamptz not null default now(),
+  unique (provider, external_event_id)
+);

package/templates/variants/bun-connectrpc/package.json

@@ -12,6 +12,7 @@
     "create": "service create",
     "deploy": "service deploy",
     "dashboards": "service dashboards",
+    "observability-bootstrap": "service observability-bootstrap",
     "auth": "service auth",
     "destroy": "service destroy"
   },

package/templates/variants/bun-connectrpc/src/db/repository.ts

@@ -1,7 +1,7 @@
-import { desc, eq } from "drizzle-orm";
+import { and, desc, eq } from "drizzle-orm";
 import type { createDb } from "./client";
-import { waitlistEntries, waitlistTriggers } from "./schema";
-import type { WaitlistEntry, WaitlistTrigger } from "../waitlist/types";
+import { waitlistEntries, waitlistTriggers, webhookEvents } from "./schema";
+import type { WaitlistEntry, WaitlistTrigger, WebhookEvent } from "../waitlist/types";
 
 type Database = ReturnType<typeof createDb>;
 type WaitlistEntryRow = typeof waitlistEntries.$inferSelect;
@@ -21,6 +21,14 @@ type CreateTriggerRecord = {
   payloadJson: string;
 };
 
+type CreateWebhookEventRecord = {
+  id: string;
+  provider: string;
+  externalEventId: string;
+  payload: unknown;
+  headers: Record<string, string>;
+};
+
 export class WaitlistRepository {
   constructor(private readonly db: Database) {}
 
@@ -91,6 +99,36 @@ export class WaitlistRepository {
       .returning();
     return toWaitlistTrigger(row);
   }
+
+  async recordWebhookEvent(input: CreateWebhookEventRecord): Promise<{ event: WebhookEvent; duplicate: boolean }> {
+    const [inserted] = await this.db
+      .insert(webhookEvents)
+      .values({
+        id: input.id,
+        provider: input.provider,
+        externalEventId: input.externalEventId,
+        payloadJson: JSON.stringify(input.payload ?? {}),
+        headersJson: JSON.stringify(input.headers),
+        receivedAt: new Date(),
+      })
+      .onConflictDoNothing({
+        target: [webhookEvents.provider, webhookEvents.externalEventId],
+      })
+      .returning();
+    if (inserted) {
+      return { event: toWebhookEvent(inserted), duplicate: false };
+    }
+
+    const [row] = await this.db
+      .select()
+      .from(webhookEvents)
+      .where(and(eq(webhookEvents.provider, input.provider), eq(webhookEvents.externalEventId, input.externalEventId)))
+      .limit(1);
+    if (!row) {
+      throw new Error("webhook event was not inserted and could not be read");
+    }
+    return { event: toWebhookEvent(row), duplicate: true };
+  }
 }
 
 function clampLimit(value: number | null | undefined) {
@@ -124,3 +162,14 @@ function toWaitlistTrigger(row: typeof waitlistTriggers.$inferSelect): WaitlistT
     processedAt: row.processedAt?.toISOString() ?? null,
   };
 }
+
+function toWebhookEvent(row: typeof webhookEvents.$inferSelect): WebhookEvent {
+  return {
+    id: row.id,
+    provider: row.provider,
+    externalEventId: row.externalEventId,
+    payload: JSON.parse(row.payloadJson),
+    headers: JSON.parse(row.headersJson),
+    receivedAt: row.receivedAt.toISOString(),
+  };
+}

package/templates/variants/bun-connectrpc/src/db/schema.ts

@@ -24,3 +24,16 @@ export const waitlistTriggers = pgTable("waitlist_triggers", {
   createdAt: timestamp("created_at", { withTimezone: true, mode: "date" }).notNull().defaultNow(),
   processedAt: timestamp("processed_at", { withTimezone: true, mode: "date" }),
 });
+
+export const webhookEvents = pgTable(
+  "webhook_events",
+  {
+    id: text("id").primaryKey(),
+    provider: text("provider").notNull(),
+    externalEventId: text("external_event_id").notNull(),
+    payloadJson: text("payload_json").notNull(),
+    headersJson: text("headers_json").notNull(),
+    receivedAt: timestamp("received_at", { withTimezone: true, mode: "date" }).notNull().defaultNow(),
+  },
+  (table) => [uniqueIndex("webhook_events_provider_external_event_id_key").on(table.provider, table.externalEventId)]
+);

package/templates/variants/bun-connectrpc/src/index.ts

@@ -96,11 +96,21 @@ export function createHandler(service: WaitlistService) {
         try {
           const provider = path.split("/").filter(Boolean)[1] ?? "generic";
           const rawBody = await readRawBody(request);
-          const trigger = await service.recordTrigger({
-            type: `webhook.${provider}`,
-            payloadJson: JSON.stringify({ headers: request.headers, rawBody }),
+          const headers = headersPayload(request.headers);
+          const payload = parseWebhookPayload(rawBody);
+          const result = await service.recordWebhookEvent({
+            provider,
+            externalEventId: webhookEventId(payload, request.headers),
+            payload,
+            headers,
           });
-          respondJson(response, 202, { trigger });
+          if (!result.duplicate) {
+            await service.recordTrigger({
+              type: `webhook.${provider}`,
+              payloadJson: JSON.stringify({ headers, rawBody }),
+            });
+          }
+          respondJson(response, result.duplicate ? 200 : 202, result);
         } catch (error) {
           respondAppError(response, error);
         }
@@ -192,6 +202,39 @@ function readRawBody(request: Parameters<FallbackHandler>[0]) {
   });
 }
 
+function parseWebhookPayload(rawBody: string) {
+  try {
+    return rawBody ? JSON.parse(rawBody) : {};
+  } catch {
+    return { rawBody };
+  }
+}
+
+function webhookEventId(payload: unknown, headers: Parameters<FallbackHandler>[0]["headers"]) {
+  if (payload && typeof payload === "object" && "id" in payload && typeof payload.id === "string") {
+    return payload.id;
+  }
+  const header = headers["x-webhook-event-id"];
+  if (Array.isArray(header)) {
+    return header[0] ?? crypto.randomUUID();
+  }
+  return header ?? crypto.randomUUID();
+}
+
+function headersPayload(headers: Parameters<FallbackHandler>[0]["headers"]) {
+  const out: Record<string, string> = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (Array.isArray(value)) {
+      out[key] = value.join(", ");
+      continue;
+    }
+    if (typeof value === "string") {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+
 if (import.meta.main) {
   const temporalWorker = await startTemporalWorker();
   if (temporalWorker) {

package/templates/variants/bun-connectrpc/src/waitlist/service.ts

@@ -3,8 +3,10 @@ import { WaitlistRepository } from "../db/repository";
 import type {
   JoinWaitlistInput,
   ListWaitlistEntriesInput,
+  RecordWebhookEventInput,
   RecordTriggerInput,
   UpdateWaitlistEntryInput,
+  WebhookEvent,
   WaitlistEntry,
   WaitlistEntryStatus,
 } from "./types";
@@ -27,6 +29,7 @@ export type WaitlistService = {
   updateWaitlistEntry(input: UpdateWaitlistEntryInput): Promise<WaitlistEntry>;
   exportWaitlistEntries(input?: ListWaitlistEntriesInput): Promise<string>;
   recordTrigger(input: RecordTriggerInput): Promise<unknown>;
+  recordWebhookEvent(input: RecordWebhookEventInput): Promise<{ event: WebhookEvent; duplicate: boolean }>;
 };
 
 export class DefaultWaitlistService implements WaitlistService {
@@ -113,6 +116,25 @@ export class DefaultWaitlistService implements WaitlistService {
       payloadJson: normalizePayloadJson(input.payloadJson),
     });
   }
+
+  async recordWebhookEvent(input: RecordWebhookEventInput) {
+    const provider = input.provider.trim();
+    const externalEventId = input.externalEventId.trim();
+    if (!provider) {
+      throw new AppError(400, "invalid_webhook_provider", "webhook provider is required");
+    }
+    if (!externalEventId) {
+      throw new AppError(400, "invalid_webhook_event_id", "webhook event id is required");
+    }
+
+    return this.repository.recordWebhookEvent({
+      id: crypto.randomUUID(),
+      provider,
+      externalEventId,
+      payload: input.payload ?? {},
+      headers: input.headers,
+    });
+  }
 }
 
 export function createDefaultWaitlistService() {

package/templates/variants/bun-connectrpc/src/waitlist/types.ts

@@ -19,6 +19,15 @@ export type WaitlistTrigger = {
   processedAt: string | null;
 };
 
+export type WebhookEvent = {
+  id: string;
+  provider: string;
+  externalEventId: string;
+  payload: unknown;
+  headers: Record<string, string>;
+  receivedAt: string;
+};
+
 export type JoinWaitlistInput = {
   email: string;
   name?: string | null;
@@ -43,3 +52,10 @@ export type RecordTriggerInput = {
   entryId?: string | null;
   payloadJson?: string | null;
 };
+
+export type RecordWebhookEventInput = {
+  provider: string;
+  externalEventId: string;
+  payload: unknown;
+  headers: Record<string, string>;
+};

package/templates/variants/bun-hono/Makefile

@@ -1,4 +1,4 @@
-.PHONY: dev migrate gen lint test create deploy dashboards auth destroy
+.PHONY: dev migrate gen lint test create deploy dashboards observability-bootstrap auth destroy
 
 SERVICE := service
 
@@ -26,6 +26,9 @@ deploy:
 dashboards:
 	$(SERVICE) dashboards
 
+observability-bootstrap:
+	$(SERVICE) observability-bootstrap
+
 auth:
 	$(SERVICE) auth $(ARGS)
 

package/templates/variants/bun-hono/migrations/0000_init.sql

@@ -18,3 +18,13 @@ create table if not exists waitlist_triggers (
   created_at timestamptz not null default now(),
   processed_at timestamptz
 );
+
+create table if not exists webhook_events (
+  id text primary key,
+  provider text not null,
+  external_event_id text not null,
+  payload_json text not null,
+  headers_json text not null,
+  received_at timestamptz not null default now(),
+  unique (provider, external_event_id)
+);

package/templates/variants/bun-hono/package.json

@@ -12,6 +12,7 @@
     "create": "service create",
     "deploy": "service deploy",
     "dashboards": "service dashboards",
+    "observability-bootstrap": "service observability-bootstrap",
     "auth": "service auth",
     "destroy": "service destroy"
   },