create-svc 0.1.72 → 0.1.73

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-svc",
-  "version": "0.1.72",
+  "version": "0.1.73",
   "description": "Local microservice bootstrap CLI for Cloud Run and Workers services with Neon-backed data.",
   "module": "index.ts",
   "type": "module",

package/src/service-runtime/cloudrun/cli.ts

@@ -348,9 +348,9 @@ async function runSdk(args: string[]) {
   const [subcommand] = args;
   if (subcommand === "publish") {
     requireCommand("buf");
-    ensureBufAuth();
-    run("buf", ["push"]);
-    const published = resolvePublishedSdk();
+    const authEnv = resolveBufAuthEnv();
+    run("buf", ["push", "--create", "--create-visibility", "private"], { env: authEnv });
+    const published = resolvePublishedSdk(authEnv);
     await writeSdkMode("remote", published);
     return `Schema pushed to Buf Schema Registry and recorded for consumers: ${published.commit}`;
   }
@@ -373,8 +373,8 @@ async function runSdk(args: string[]) {
 
   if (subcommand === "use-remote") {
     requireCommand("buf");
-    ensureBufAuth();
-    const published = resolvePublishedSdk();
+    const authEnv = resolveBufAuthEnv();
+    const published = resolvePublishedSdk(authEnv);
     await writeSdkMode("remote", published);
     return `Remote Buf SDK recorded for consumers: ${bufModule()}@${published.commit}`;
   }
@@ -395,9 +395,9 @@ type PublishedSdk = {
   createTime?: string;
 };
 
-function resolvePublishedSdk(): PublishedSdk {
+function resolvePublishedSdk(authEnv: Record<string, string> = {}): PublishedSdk {
   const module = bufModule();
-  const result = run("buf", ["registry", "module", "commit", "list", module, "--format", "json", "--page-size", "1"]);
+  const result = run("buf", ["registry", "module", "commit", "list", module, "--format", "json", "--page-size", "1"], { env: authEnv });
   const parsed = JSON.parse(result.stdout) as {
     commits?: Array<Record<string, unknown>>;
     commit?: Record<string, unknown>;
@@ -453,14 +453,14 @@ function bufModule() {
   return config.buf.module || `buf.build/anmho/${config.serviceName}`;
 }
 
-function ensureBufAuth() {
+function resolveBufAuthEnv(): Record<string, string> {
   const token =
     process.env.BUF_TOKEN?.trim() ||
     readVaultField(config.buf.vaultMount, config.buf.vaultPath, ["BUF_TOKEN", "buf.api_token", "buf_token", "api_token", "token"]);
   if (!token) {
-    return;
+    return {};
   }
-  run("buf", ["registry", "login", "buf.build", "--token-stdin"], { input: `${token}\n` });
+  return { BUF_TOKEN: token };
 }
 
 async function resolveLocalSdkPath() {

package/src/service-runtime/cloudrun/sdk.test.ts

@@ -47,15 +47,12 @@ test("service sdk publish pushes the named Buf module and selects remote SDK mod
     [
       "#!/bin/sh",
       `echo "$@" >> "${bufLog}"`,
-      'if [ "$1 $2 $3 $4" = "registry login buf.build --token-stdin" ]; then',
-      `  cat > "${tokenLog}"`,
-      "  exit 0",
-      "fi",
+      `printf '%s' "$BUF_TOKEN" > "${tokenLog}"`,
       'if [ "$1 $2 $3 $4" = "registry module commit list" ]; then',
       '  printf \'{"commits":[{"name":"buf.build/anmho/sdk-proof:commit-123","digest":"b5:abc123","create_time":"2026-05-25T12:00:00Z"}]}\'',
       "  exit 0",
       "fi",
-      'if [ "$1" = "push" ]; then',
+      'if [ "$1 $2 $3 $4" = "push --create --create-visibility private" ]; then',
       "  exit 0",
       "fi",
       "echo unexpected buf command: $@ >&2",
@@ -77,7 +74,10 @@ test("service sdk publish pushes the named Buf module and selects remote SDK mod
   expect(result.stdout.toString()).not.toContain("test-token");
   expect(result.stderr.toString()).not.toContain("test-token");
   expect((await readFile(bufLog, "utf8")).trim()).toBe(
-    ["registry login buf.build --token-stdin", "push", "registry module commit list buf.build/anmho/sdk-proof --format json --page-size 1"].join("\n")
+    [
+      "push --create --create-visibility private",
+      "registry module commit list buf.build/anmho/sdk-proof --format json --page-size 1",
+    ].join("\n")
   );
   expect((await readFile(tokenLog, "utf8")).trim()).toBe("test-token");
   const sdkState = JSON.parse(await Bun.file(join(generatedRoot, ".service", "sdk.json")).text());