feat(workspaces): complete milestone 1 with robust deployment primitives

packages/workspace-manager/Dockerfile

@@ -1,20 +1,20 @@
-/**
- * @license
- * Copyright 2026 Google LLC
- * SPDX-License-Identifier: Apache-2.0
- */
+# Copyright 2026 Google LLC
+# SPDX-License-Identifier: Apache-2.0
 
 # Standard Hub Dockerfile
 FROM node:20-slim
 
 WORKDIR /app
 
-COPY package.json package-lock.json ./
-RUN npm ci
+# In a monorepo, we typically don't have a local package-lock.json
+# so we use npm install instead of npm ci for individual package builds.
+COPY package.json ./
+RUN npm install
 
 COPY . .
 RUN npm run build
 
 EXPOSE 8080
 
-CMD ["npm", "start"]
+# Use node directly for better signal handling (SIGTERM)
+CMD ["node", "dist/index.js"]

packages/workspace-manager/src/index.ts

@@ -10,7 +10,7 @@ import { workspaceRouter } from './routes/workspaceRoutes.js';
 export const app = express();
 app.use(express.json());
 
-const PORT = process.env.PORT || 8080;
+const PORT = process.env['PORT'] || 8080;
 
 app.get('/health', (_req, res) => {
   res.send({ status: 'ok' });
@@ -20,7 +20,7 @@ app.get('/health', (_req, res) => {
 app.use('/workspaces', workspaceRouter);
 
 // Only listen if not in test mode
-if (process.env.NODE_ENV !== 'test') {
+if (process.env['NODE_ENV'] !== 'test') {
   app.listen(PORT, () => {
     // eslint-disable-next-line no-console
     console.log(`Workspace Hub listening on port ${PORT}`);

packages/workspace-manager/terraform/modules/workspace-hub/main.tf

@@ -18,10 +18,10 @@ resource "google_project_iam_member" "firestore_user" {
   member  = "serviceAccount:${google_service_account.hub_sa.email}"
 }
 
-resource "google_project_iam_member" "sa_user" {
-  project = var.project_id
-  role    = "roles/iam.serviceAccountUser"
-  member  = "serviceAccount:${google_service_account.hub_sa.email}"
+resource "google_service_account_iam_member" "sa_user" {
+  service_account_id = "projects/${var.project_id}/serviceAccounts/${var.compute_default_sa}"
+  role               = "roles/iam.serviceAccountUser"
+  member             = "serviceAccount:${google_service_account.hub_sa.email}"
 }
 
 resource "google_cloud_run_v2_service" "hub" {

packages/workspace-manager/terraform/modules/workspace-hub/variables.tf

@@ -16,3 +16,8 @@ variable "hub_image_uri" {
   description = "The Docker image URI for the Workspace Hub"
   type        = string
 }
+
+variable "compute_default_sa" {
+  description = "The Compute Engine default service account email"
+  type        = string
+}

packages/workspace-manager/tsconfig.json

@@ -1,9 +1,24 @@
 {
-  "extends": "../../tsconfig.json",
   "compilerOptions": {
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noImplicitAny": true,
+    "noImplicitOverride": true,
+    "noImplicitReturns": true,
+    "noImplicitThis": true,
+    "noUnusedLocals": true,
+    "noUnusedParameters": true,
+    "noFallthroughCasesInSwitch": true,
+    "noPropertyAccessFromIndexSignature": true,
+    "verbatimModuleSyntax": true,
+    "lib": ["ES2023"],
+    "module": "NodeNext",
+    "moduleResolution": "nodenext",
+    "target": "es2022",
+    "types": ["node", "vitest/globals"],
     "outDir": "./dist",
-    "rootDir": "./src",
-    "composite": false
+    "rootDir": "./src"
   },
   "include": ["src/**/*"],
   "exclude": ["node_modules", "**/*.test.ts"]