create-svc 0.1.7 → 0.1.9

package/templates/shared/scripts/cloudrun/deploy.ts

@@ -1,5 +1,5 @@
-import { bootstrap } from "./bootstrap";
 import { config } from "./config";
+import { bootstrap } from "./bootstrap";
 import { deleteBranch, ensureBranch, ensureDatabase, getConnectionUri, listBranches } from "./neon";
 import {
   addSecretVersion,
@@ -11,6 +11,8 @@ import {
   parseDeployArgs,
   requireCommand,
   resolveDeploymentTarget,
+  runMain,
+  runStep,
   serviceUrl,
   writeRenderedManifest,
 } from "./lib";
@@ -31,52 +33,65 @@ export async function deploy(args = Bun.argv.slice(2)) {
       throw new Error("Refusing to destroy the main environment");
     }
 
-    deleteService(target.serviceName);
-
-    const branches = await listBranches(config.neon.projectId);
-    const branch = branches.find((candidate) => candidate.name === target.branchName);
-    if (branch) {
-      await deleteBranch(config.neon.projectId, branch.id);
-    }
-    return;
+    await runStep(`Deleting Cloud Run service ${target.serviceName}`, () => deleteService(target.serviceName));
+    await runStep(`Deleting Neon branch ${target.branchName}`, async () => {
+      const branches = await listBranches(config.neon.projectId);
+      const branch = branches.find((candidate) => candidate.name === target.branchName);
+      if (branch) {
+        await deleteBranch(config.neon.projectId, branch.id);
+      }
+    });
+    return `Destroyed ${target.serviceName}`;
   }
 
-  ensureArtifactRepository();
+  await runStep("Ensuring Artifact Registry repository", () => ensureArtifactRepository());
 
   let branchId = config.neon.baseBranchId;
   if (options.environment !== "main") {
-    const branch = await ensureBranch(config.neon.projectId, target.branchName, config.neon.baseBranchId);
+    const branch = await runStep(`Ensuring Neon branch ${target.branchName}`, () =>
+      ensureBranch(config.neon.projectId, target.branchName, config.neon.baseBranchId)
+    );
     branchId = branch.id;
   }
 
-  await ensureDatabase(config.neon.projectId, branchId, config.neon.databaseName);
-  const connectionUri = await getConnectionUri(config.neon.projectId, branchId, config.neon.databaseName, config.neon.roleName);
-  addSecretVersion(target.databaseSecretName, connectionUri);
-  ensureSecretAccessor(target.databaseSecretName, `serviceAccount:${config.runtimeServiceAccount}`);
+  await runStep("Publishing environment database secret", async () => {
+    await ensureDatabase(config.neon.projectId, branchId, config.neon.databaseName);
+    const connectionUri = await getConnectionUri(config.neon.projectId, branchId, config.neon.databaseName, config.neon.roleName);
+    addSecretVersion(target.databaseSecretName, connectionUri);
+    ensureSecretAccessor(target.databaseSecretName, `serviceAccount:${config.runtimeServiceAccount}`);
+  });
 
   const image = imageUrl();
-  gcloud(["builds", "submit", "--project", config.project.id, "--region", config.region, "--tag", image]);
+  await runStep("Building container image", () =>
+    gcloud(["builds", "submit", "--project", config.project.id, "--region", config.region, "--tag", image])
+  );
+
+  const renderedManifestPath = await runStep("Rendering Cloud Run manifest", () => writeRenderedManifest(image, target));
+
+  await runStep(`Deploying Cloud Run service ${target.serviceName}`, () =>
+    gcloud(["run", "services", "replace", renderedManifestPath.pathname, "--project", config.project.id, "--region", config.region])
+  );
 
-  const renderedManifestPath = await writeRenderedManifest(image, target);
-  gcloud(["run", "services", "replace", renderedManifestPath.pathname, "--project", config.project.id, "--region", config.region]);
-  gcloud([
-    "run",
-    "services",
-    "add-iam-policy-binding",
-    target.serviceName,
-    "--project",
-    config.project.id,
-    "--region",
-    config.region,
-    "--member",
-    "allUsers",
-    "--role",
-    "roles/run.invoker",
-  ]);
+  await runStep("Granting public invoker access", () =>
+    gcloud([
+      "run",
+      "services",
+      "add-iam-policy-binding",
+      target.serviceName,
+      "--project",
+      config.project.id,
+      "--region",
+      config.region,
+      "--member",
+      "allUsers",
+      "--role",
+      "roles/run.invoker",
+    ])
+  );
 
-  console.log(serviceUrl(target.serviceName));
+  return serviceUrl(target.serviceName);
 }
 
 if (import.meta.main) {
-  await deploy();
+  await runMain("Deploy", () => deploy(Bun.argv.slice(2)));
 }

package/templates/shared/scripts/cloudrun/lib.ts

@@ -1,8 +1,8 @@
+import { intro, log, outro, spinner } from "@clack/prompts";
 import { config } from "./config";
 
 type CommandOptions = {
   allowFailure?: boolean;
-  capture?: boolean;
   input?: string;
 };
 
@@ -13,6 +13,11 @@ type DeployArgs = {
   name?: string;
 };
 
+type CleanupArgs = {
+  destroyProject: boolean;
+  destroyRepo: boolean;
+};
+
 type DeploymentTarget = {
   environment: "main" | "preview" | "personal";
   serviceName: string;
@@ -20,36 +25,60 @@ type DeploymentTarget = {
   databaseSecretName: string;
 };
 
+type CommandResult = {
+  success: boolean;
+  stdout: string;
+  stderr: string;
+  exitCode: number;
+};
+
 const decoder = new TextDecoder();
 
+export class CommandError extends Error {
+  command: string;
+  args: string[];
+  stdout: string;
+  stderr: string;
+  exitCode: number;
+
+  constructor(command: string, args: string[], result: CommandResult) {
+    super(`command failed: ${command} ${args.join(" ")}`);
+    this.name = "CommandError";
+    this.command = command;
+    this.args = args;
+    this.stdout = result.stdout;
+    this.stderr = result.stderr;
+    this.exitCode = result.exitCode;
+  }
+}
+
 export function requireCommand(name: string) {
   if (!Bun.which(name)) {
     throw new Error(`missing required command: ${name}`);
   }
 }
 
-export function run(command: string, args: string[], options: CommandOptions = {}) {
+export function run(command: string, args: string[], options: CommandOptions = {}): CommandResult {
   const result = Bun.spawnSync([command, ...args], {
     cwd: process.cwd(),
     env: process.env,
     stdin: options.input,
-    stdout: options.capture || options.allowFailure ? "pipe" : "inherit",
-    stderr: options.capture || options.allowFailure ? "pipe" : "inherit",
+    stdout: "pipe",
+    stderr: "pipe",
   });
 
-  const stdout = result.stdout ? decoder.decode(result.stdout).trim() : "";
-  const stderr = result.stderr ? decoder.decode(result.stderr).trim() : "";
-
-  if (!result.success && !options.allowFailure) {
-    throw new Error([`command failed: ${command} ${args.join(" ")}`, stdout, stderr].filter(Boolean).join("\n"));
-  }
-
-  return {
+  const commandResult: CommandResult = {
     success: result.success,
-    stdout,
-    stderr,
+    stdout: result.stdout ? decoder.decode(result.stdout).trim() : "",
+    stderr: result.stderr ? decoder.decode(result.stderr).trim() : "",
     exitCode: result.exitCode,
   };
+
+  if (!commandResult.success && !options.allowFailure) {
+    throw new CommandError(command, args, commandResult);
+  }
+
+  return commandResult;
 }
 
 export function gcloud(args: string[], options: CommandOptions = {}) {
@@ -64,6 +93,40 @@ export function gh(args: string[], options: CommandOptions = {}) {
   return run("gh", args, options);
 }
 
+export async function runStep<T>(label: string, task: () => Promise<T> | T) {
+  const indicator = spinner();
+  indicator.start(label);
+
+  try {
+    const result = await task();
+    indicator.stop(label);
+    return result;
+  } catch (error) {
+    indicator.stop(`${label} failed`);
+    throw new Error(`${label} failed\n${formatError(error)}`);
+  }
+}
+
+export async function runMain(name: string, task: () => Promise<string | void>) {
+  intro(name);
+
+  try {
+    const message = await task();
+    outro(message || "Done");
+  } catch (error) {
+    log.error(formatError(error));
+    process.exit(1);
+  }
+}
+
+export function formatError(error: unknown) {
+  if (error instanceof CommandError) {
+    return [error.message, error.stderr || error.stdout].filter(Boolean).join("\n");
+  }
+
+  return error instanceof Error ? error.message : String(error);
+}
+
 export function ensureProject() {
   if (gcloud(["projects", "describe", config.project.id], { allowFailure: true }).success) {
     return;
@@ -89,6 +152,10 @@ export function ensureServiceAccount(email: string) {
   gcloud(["iam", "service-accounts", "create", accountId, "--project", config.project.id, "--display-name", accountId]);
 }
 
+export function deleteServiceAccount(email: string) {
+  gcloud(["iam", "service-accounts", "delete", email, "--project", config.project.id, "--quiet"], { allowFailure: true });
+}
+
 export function ensureProjectRole(member: string, role: string) {
   gcloud(["projects", "add-iam-policy-binding", config.project.id, "--member", member, "--role", role]);
 }
@@ -125,6 +192,18 @@ export function ensureSecretAccessor(secretName: string, member: string) {
   gcloud(["secrets", "add-iam-policy-binding", secretName, "--project", config.project.id, "--member", member, "--role", "roles/secretmanager.secretAccessor"]);
 }
 
+export function listSecrets() {
+  return gcloud(["secrets", "list", "--project", config.project.id, "--format=value(name)"]).stdout
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .map((name) => name.split("/").pop() ?? name);
+}
+
+export function deleteSecret(secretName: string) {
+  gcloud(["secrets", "delete", secretName, "--project", config.project.id, "--quiet"], { allowFailure: true });
+}
+
 export function ensureArtifactRepository() {
   if (
     gcloud(
@@ -150,7 +229,7 @@ export function ensureArtifactRepository() {
 }
 
 export function projectNumber() {
-  return gcloud(["projects", "describe", config.project.id, "--format=value(projectNumber)"], { capture: true }).stdout;
+  return gcloud(["projects", "describe", config.project.id, "--format=value(projectNumber)"]).stdout;
 }
 
 export function workloadIdentityPoolResource() {
@@ -229,12 +308,40 @@ export function ensureWorkloadIdentityProvider() {
   ]);
 }
 
+export function deleteWorkloadIdentityProvider() {
+  gcloud(
+    [
+      "iam",
+      "workload-identity-pools",
+      "providers",
+      "delete",
+      config.workloadIdentityProviderId,
+      "--project",
+      config.project.id,
+      "--location",
+      "global",
+      "--workload-identity-pool",
+      config.workloadIdentityPoolId,
+      "--quiet",
+    ],
+    { allowFailure: true }
+  );
+}
+
 export function setGithubVariable(name: string, value: string) {
   gh(["variable", "set", name, "--repo", config.github.repo, "--body", value]);
 }
 
+export function deleteGithubVariable(name: string) {
+  gh(["variable", "delete", name, "--repo", config.github.repo], { allowFailure: true });
+}
+
+export function deleteGithubRepository() {
+  gh(["repo", "delete", config.github.repo, "--yes"]);
+}
+
 export function imageTag() {
-  const gitSha = run("git", ["rev-parse", "--short", "HEAD"], { allowFailure: true, capture: true }).stdout;
+  const gitSha = run("git", ["rev-parse", "--short", "HEAD"], { allowFailure: true }).stdout;
   return gitSha || `${Date.now()}`;
 }
 
@@ -298,6 +405,27 @@ export function parseDeployArgs(argv: string[]): DeployArgs {
   return parsed;
 }
 
+export function parseCleanupArgs(argv: string[]): CleanupArgs {
+  const parsed: CleanupArgs = {
+    destroyProject: false,
+    destroyRepo: false,
+  };
+
+  for (const token of argv) {
+    if (token === "--project") {
+      parsed.destroyProject = true;
+      continue;
+    }
+
+    if (token === "--repo") {
+      parsed.destroyRepo = true;
+      continue;
+    }
+  }
+
+  return parsed;
+}
+
 export function resolveDeploymentTarget(environment: DeployArgs["environment"], rawName?: string): DeploymentTarget {
   if (environment === "main") {
     return {
@@ -359,17 +487,27 @@ export async function writeRenderedManifest(image: string, target: DeploymentTar
 
 export function serviceUrl(serviceName: string) {
   return gcloud(
-    ["run", "services", "describe", serviceName, "--project", config.project.id, "--region", config.region, "--format=value(status.url)"],
-    { capture: true }
+    ["run", "services", "describe", serviceName, "--project", config.project.id, "--region", config.region, "--format=value(status.url)"]
   ).stdout;
 }
 
+export function listCloudRunServices() {
+  return gcloud(["run", "services", "list", "--project", config.project.id, "--region", config.region, "--format=value(metadata.name)"]).stdout
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean);
+}
+
 export function deleteService(serviceName: string) {
   gcloud(["run", "services", "delete", serviceName, "--project", config.project.id, "--region", config.region, "--quiet"], {
     allowFailure: true,
   });
 }
 
+export function deleteProject() {
+  gcloud(["projects", "delete", config.project.id, "--quiet"]);
+}
+
 function slugify(value: string) {
   return value
     .trim()
@@ -377,4 +515,3 @@ function slugify(value: string) {
     .replace(/[^a-z0-9]+/g, "-")
     .replace(/^-+|-+$/g, "");
 }
-

package/templates/shared/scripts/cloudrun/neon.ts

@@ -1,4 +1,6 @@
 import { createApiClient } from "@neondatabase/api-client";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import { config } from "./config";
 
 type NeonBranch = {
@@ -13,13 +15,13 @@ async function resolveNeonApiKey() {
   }
 
   const addr = process.env.VAULT_ADDR?.trim() ?? "";
-  const token = process.env.VAULT_TOKEN?.trim() ?? "";
+  const token = await resolveVaultToken();
   const mount = process.env.VAULT_SECRET_MOUNT?.trim() ?? "secret";
   const path = process.env.VAULT_NEON_API_KEY_PATH?.trim() ?? "provider/neon-api-key";
   const field = process.env.VAULT_NEON_API_KEY_FIELD?.trim() ?? "value";
 
   if (!addr || !token) {
-    throw new Error("NEON_API_KEY is required for Neon provisioning, or set VAULT_ADDR and VAULT_TOKEN");
+    throw new Error("NEON_API_KEY is required for Neon provisioning, or set VAULT_ADDR with VAULT_TOKEN, VAULT_TOKEN_FILE, or ~/.vault-token");
   }
 
   const normalizedAddr = addr.replace(/\/+$/g, "");
@@ -49,6 +51,21 @@ async function resolveNeonApiKey() {
   return apiKey;
 }
 
+async function resolveVaultToken() {
+  const direct = process.env.VAULT_TOKEN?.trim();
+  if (direct) {
+    return direct;
+  }
+
+  const tokenFile = process.env.VAULT_TOKEN_FILE?.trim() || join(homedir(), ".vault-token");
+
+  try {
+    return (await Bun.file(tokenFile).text()).trim();
+  } catch {
+    return "";
+  }
+}
+
 async function neonClient() {
   const apiKey = await resolveNeonApiKey();
   return createApiClient({ apiKey });
@@ -85,6 +102,18 @@ export async function ensureDatabase(projectId: string, branchId: string, databa
   });
 }
 
+export async function deleteDatabase(projectId: string, branchId: string, databaseName: string) {
+  try {
+    await (await neonClient()).deleteProjectBranchDatabase(projectId, branchId, databaseName);
+  } catch (error) {
+    const status = (error as { response?: { status?: number } })?.response?.status;
+    if (status === 404) {
+      return;
+    }
+    throw error;
+  }
+}
+
 export async function ensureBranch(projectId: string, branchName: string, parentId: string) {
   const existing = (await listBranches(projectId)).find((branch) => branch.name === branchName);
   if (existing) {

package/templates/variants/bun-connectrpc/Makefile

@@ -0,0 +1,24 @@
+.PHONY: dev gen lint test bootstrap deploy cleanup
+
+CLOUDRUN := npx --no-install svc-cloudrun
+
+dev:
+	bun run ./src/index.ts
+
+gen:
+	bun run ./scripts/codegen.ts
+
+lint:
+	bunx tsc --noEmit
+
+test:
+	bun test
+
+bootstrap:
+	$(CLOUDRUN) bootstrap
+
+deploy:
+	$(CLOUDRUN) deploy $(ARGS)
+
+cleanup:
+	$(CLOUDRUN) cleanup $(ARGS)

package/templates/variants/bun-connectrpc/package.json

@@ -2,15 +2,11 @@
   "name": "{{SERVICE_NAME}}",
   "private": true,
   "type": "module",
-  "scripts": {
-    "dev": "bun run ./src/index.ts",
-    "gen": "bun run ./scripts/codegen.ts",
-    "lint": "bunx tsc --noEmit",
-    "test": "bun test",
-    "bootstrap": "bun run ./scripts/cloudrun/bootstrap.ts",
-    "deploy": "bun run ./scripts/cloudrun/deploy.ts"
+  "bin": {
+    "svc-cloudrun": "./scripts/cloudrun/cli.ts"
   },
   "dependencies": {
+    "@clack/prompts": "^1.2.0",
     "@neondatabase/api-client": "^2.7.1"
   },
   "devDependencies": {

package/templates/variants/bun-hono/Makefile

@@ -0,0 +1,24 @@
+.PHONY: dev gen lint test bootstrap deploy cleanup
+
+CLOUDRUN := npx --no-install svc-cloudrun
+
+dev:
+	bun run ./src/index.ts
+
+gen:
+	bun run ./scripts/codegen.ts
+
+lint:
+	bunx tsc --noEmit
+
+test:
+	bun test
+
+bootstrap:
+	$(CLOUDRUN) bootstrap
+
+deploy:
+	$(CLOUDRUN) deploy $(ARGS)
+
+cleanup:
+	$(CLOUDRUN) cleanup $(ARGS)

package/templates/variants/bun-hono/package.json

@@ -2,15 +2,11 @@
   "name": "{{SERVICE_NAME}}",
   "private": true,
   "type": "module",
-  "scripts": {
-    "dev": "bun run ./src/index.ts",
-    "gen": "bun run ./scripts/codegen.ts",
-    "lint": "bunx tsc --noEmit",
-    "test": "bun test",
-    "bootstrap": "bun run ./scripts/cloudrun/bootstrap.ts",
-    "deploy": "bun run ./scripts/cloudrun/deploy.ts"
+  "bin": {
+    "svc-cloudrun": "./scripts/cloudrun/cli.ts"
   },
   "dependencies": {
+    "@clack/prompts": "^1.2.0",
     "@neondatabase/api-client": "^2.7.1",
     "hono": "^4.10.1"
   },

package/templates/variants/go-chi/Makefile

@@ -0,0 +1,25 @@
+.PHONY: dev gen lint test bootstrap deploy cleanup
+
+CLOUDRUN := npx --no-install svc-cloudrun
+
+dev:
+	go run ./cmd/server
+
+gen:
+	buf generate
+
+lint:
+	go vet ./...
+	buf lint
+
+test:
+	bun test ./test
+
+bootstrap:
+	$(CLOUDRUN) bootstrap
+
+deploy:
+	$(CLOUDRUN) deploy $(ARGS)
+
+cleanup:
+	$(CLOUDRUN) cleanup $(ARGS)

package/templates/variants/go-chi/package.json

@@ -2,15 +2,11 @@
   "name": "{{SERVICE_NAME}}",
   "private": true,
   "type": "module",
+  "bin": {
+    "svc-cloudrun": "./scripts/cloudrun/cli.ts"
+  },
   "dependencies": {
+    "@clack/prompts": "^1.2.0",
     "@neondatabase/api-client": "^2.7.1"
-  },
-  "scripts": {
-    "dev": "go run ./cmd/server",
-    "gen": "buf generate",
-    "lint": "go vet ./... && buf lint",
-    "test": "bun test ./test",
-    "bootstrap": "bun run ./scripts/cloudrun/bootstrap.ts",
-    "deploy": "bun run ./scripts/cloudrun/deploy.ts"
   }
 }

package/templates/variants/go-chi/test/go.test.ts

@@ -1,11 +1,6 @@
 import { expect, test } from "bun:test";
 
-const decoder = new TextDecoder();
-
-test(
-  "go test ./...",
-  { timeout: 60_000 },
-  () => {
+test("go test ./...", { timeout: 60_000 }, () => {
   const result = Bun.spawnSync(["go", "test", "./..."], {
     cwd: process.cwd(),
     stdout: "pipe",
@@ -13,7 +8,6 @@ test(
     env: process.env,
   });
 
-  const output = [decoder.decode(result.stdout), decoder.decode(result.stderr)].join("").trim();
+  const output = `${new TextDecoder().decode(result.stdout)}${new TextDecoder().decode(result.stderr)}`.trim();
   expect(result.exitCode, output || "go test ./... failed").toBe(0);
-  }
-);
+});

package/templates/variants/go-connectrpc/Makefile

@@ -0,0 +1,25 @@
+.PHONY: dev gen lint test bootstrap deploy cleanup
+
+CLOUDRUN := npx --no-install svc-cloudrun
+
+dev:
+	go run ./cmd/server
+
+gen:
+	buf generate
+
+lint:
+	go vet ./...
+	buf lint
+
+test:
+	bun test ./test
+
+bootstrap:
+	$(CLOUDRUN) bootstrap
+
+deploy:
+	$(CLOUDRUN) deploy $(ARGS)
+
+cleanup:
+	$(CLOUDRUN) cleanup $(ARGS)

package/templates/variants/go-connectrpc/package.json

@@ -2,15 +2,11 @@
   "name": "{{SERVICE_NAME}}",
   "private": true,
   "type": "module",
+  "bin": {
+    "svc-cloudrun": "./scripts/cloudrun/cli.ts"
+  },
   "dependencies": {
+    "@clack/prompts": "^1.2.0",
     "@neondatabase/api-client": "^2.7.1"
-  },
-  "scripts": {
-    "dev": "go run ./cmd/server",
-    "gen": "buf generate",
-    "lint": "go vet ./... && buf lint",
-    "test": "bun test ./test",
-    "bootstrap": "bun run ./scripts/cloudrun/bootstrap.ts",
-    "deploy": "bun run ./scripts/cloudrun/deploy.ts"
   }
 }

package/templates/variants/go-connectrpc/test/go.test.ts

@@ -1,11 +1,6 @@
 import { expect, test } from "bun:test";
 
-const decoder = new TextDecoder();
-
-test(
-  "go test ./...",
-  { timeout: 60_000 },
-  () => {
+test("go test ./...", { timeout: 60_000 }, () => {
   const result = Bun.spawnSync(["go", "test", "./..."], {
     cwd: process.cwd(),
     stdout: "pipe",
@@ -13,7 +8,6 @@ test(
     env: process.env,
   });
 
-  const output = [decoder.decode(result.stdout), decoder.decode(result.stderr)].join("").trim();
+  const output = `${new TextDecoder().decode(result.stdout)}${new TextDecoder().decode(result.stderr)}`.trim();
   expect(result.exitCode, output || "go test ./... failed").toBe(0);
-  }
-);
+});