create-svc 0.1.71 → 0.1.73

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-svc",
-  "version": "0.1.71",
+  "version": "0.1.73",
   "description": "Local microservice bootstrap CLI for Cloud Run and Workers services with Neon-backed data.",
   "module": "index.ts",
   "type": "module",

package/src/service-runtime/cloudrun/cli.ts

@@ -17,6 +17,7 @@ import {
   formatError,
   gcloud,
   ensureProductionDomainMapping,
+  readVaultField,
   requireCommand,
   requireGcloudAuth,
   resolveDeploymentTarget,
@@ -347,8 +348,9 @@ async function runSdk(args: string[]) {
   const [subcommand] = args;
   if (subcommand === "publish") {
     requireCommand("buf");
-    run("buf", ["push"]);
-    const published = resolvePublishedSdk();
+    const authEnv = resolveBufAuthEnv();
+    run("buf", ["push", "--create", "--create-visibility", "private"], { env: authEnv });
+    const published = resolvePublishedSdk(authEnv);
     await writeSdkMode("remote", published);
     return `Schema pushed to Buf Schema Registry and recorded for consumers: ${published.commit}`;
   }
@@ -371,7 +373,8 @@ async function runSdk(args: string[]) {
 
   if (subcommand === "use-remote") {
     requireCommand("buf");
-    const published = resolvePublishedSdk();
+    const authEnv = resolveBufAuthEnv();
+    const published = resolvePublishedSdk(authEnv);
     await writeSdkMode("remote", published);
     return `Remote Buf SDK recorded for consumers: ${bufModule()}@${published.commit}`;
   }
@@ -392,9 +395,9 @@ type PublishedSdk = {
   createTime?: string;
 };
 
-function resolvePublishedSdk(): PublishedSdk {
+function resolvePublishedSdk(authEnv: Record<string, string> = {}): PublishedSdk {
   const module = bufModule();
-  const result = run("buf", ["registry", "module", "commit", "list", module, "--format", "json", "--page-size", "1"]);
+  const result = run("buf", ["registry", "module", "commit", "list", module, "--format", "json", "--page-size", "1"], { env: authEnv });
   const parsed = JSON.parse(result.stdout) as {
     commits?: Array<Record<string, unknown>>;
     commit?: Record<string, unknown>;
@@ -447,7 +450,17 @@ async function writeSdkMode(mode: "local" | "remote", published?: PublishedSdk)
 }
 
 function bufModule() {
-  return `buf.build/anmho/${config.serviceName}`;
+  return config.buf.module || `buf.build/anmho/${config.serviceName}`;
+}
+
+function resolveBufAuthEnv(): Record<string, string> {
+  const token =
+    process.env.BUF_TOKEN?.trim() ||
+    readVaultField(config.buf.vaultMount, config.buf.vaultPath, ["BUF_TOKEN", "buf.api_token", "buf_token", "api_token", "token"]);
+  if (!token) {
+    return {};
+  }
+  return { BUF_TOKEN: token };
 }
 
 async function resolveLocalSdkPath() {

package/src/service-runtime/cloudrun/config.ts

@@ -46,6 +46,11 @@ export const config = {
     vaultMount: vault.mount || "secret",
     vaultPath: vault.temporal_path || "prod/providers/temporal",
   },
+  buf: {
+    module: serviceConfig.buf?.module || `buf.build/anmho/${serviceConfig.service_id}`,
+    vaultMount: vault.mount || "secret",
+    vaultPath: vault.buf_path || "prod/providers/buf",
+  },
   neon: {
     projectId: neon.project_id,
     baseBranchId: neon.base_branch_id,

package/src/service-runtime/cloudrun/lib.ts

@@ -589,7 +589,7 @@ function renderTemporalMtlsEnv(temporal: ReturnType<typeof resolveTemporalRuntim
     .join("\n");
 }
 
-function readVaultField(mount: string, path: string, fields: string[]) {
+export function readVaultField(mount: string, path: string, fields: string[]) {
   const vault = Bun.which("vault");
   if (!vault || !path) {
     return "";

package/src/service-runtime/cloudrun/sdk.test.ts

@@ -37,6 +37,7 @@ test("service sdk publish pushes the named Buf module and selects remote SDK mod
   const generatedRoot = join(root, "sdk-proof");
   const fakeBin = join(root, "bin");
   const bufLog = join(root, "buf.log");
+  const tokenLog = join(root, "buf-token.log");
 
   await scaffoldProject(baseConfig(generatedRoot));
   await mkdir(join(generatedRoot, "node_modules"));
@@ -46,10 +47,16 @@ test("service sdk publish pushes the named Buf module and selects remote SDK mod
     [
       "#!/bin/sh",
       `echo "$@" >> "${bufLog}"`,
+      `printf '%s' "$BUF_TOKEN" > "${tokenLog}"`,
       'if [ "$1 $2 $3 $4" = "registry module commit list" ]; then',
       '  printf \'{"commits":[{"name":"buf.build/anmho/sdk-proof:commit-123","digest":"b5:abc123","create_time":"2026-05-25T12:00:00Z"}]}\'',
+      "  exit 0",
       "fi",
-      "exit 0",
+      'if [ "$1 $2 $3 $4" = "push --create --create-visibility private" ]; then',
+      "  exit 0",
+      "fi",
+      "echo unexpected buf command: $@ >&2",
+      "exit 1",
       "",
     ].join("\n")
   );
@@ -57,16 +64,22 @@ test("service sdk publish pushes the named Buf module and selects remote SDK mod
 
   const result = Bun.spawnSync(["bun", join(import.meta.dir, "..", "..", "..", "index.ts"), "sdk", "publish"], {
     cwd: generatedRoot,
-    env: { ...process.env, PATH: `${fakeBin}:${process.env.PATH ?? ""}` },
+    env: { ...process.env, BUF_TOKEN: "test-token", PATH: `${fakeBin}:${process.env.PATH ?? ""}` },
     stdout: "pipe",
     stderr: "pipe",
   });
 
   expect(result.success, [result.stdout.toString(), result.stderr.toString()].join("\n")).toBeTrue();
   expect(result.stdout.toString()).toContain("recorded for consumers");
+  expect(result.stdout.toString()).not.toContain("test-token");
+  expect(result.stderr.toString()).not.toContain("test-token");
   expect((await readFile(bufLog, "utf8")).trim()).toBe(
-    ["push", "registry module commit list buf.build/anmho/sdk-proof --format json --page-size 1"].join("\n")
+    [
+      "push --create --create-visibility private",
+      "registry module commit list buf.build/anmho/sdk-proof --format json --page-size 1",
+    ].join("\n")
   );
+  expect((await readFile(tokenLog, "utf8")).trim()).toBe("test-token");
   const sdkState = JSON.parse(await Bun.file(join(generatedRoot, ".service", "sdk.json")).text());
   expect(sdkState).toMatchObject({
     mode: "remote",

package/templates/shared/service.jsonc

@@ -70,7 +70,8 @@
       "cloudflare_path": "prod/providers/cloudflare",
       "grafana_path": "prod/providers/grafana",
       "clerk_m2m_path": "prod/providers/clerk-m2m",
-      "temporal_path": "prod/providers/temporal"
+      "temporal_path": "prod/providers/temporal",
+      "buf_path": "prod/providers/buf"
     }
   },