create-op-node 0.1.0 → 0.3.0

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { Command, Option } from 'commander';
 import pc2 from 'picocolors';
-import * as p2 from '@clack/prompts';
+import * as p3 from '@clack/prompts';
 import { execa } from 'execa';
 import { Octokit } from '@octokit/rest';
 import { randomBytes } from 'crypto';
 import { join, resolve, dirname } from 'path';
-import { mkdir, writeFile, access, chmod } from 'fs/promises';
+import { mkdir, writeFile, access, rm, chmod } from 'fs/promises';
 import { homedir } from 'os';
 import { readFileSync } from 'fs';
 import * as tls from 'tls';
@@ -225,85 +225,86 @@ async function safeExeca(cmd, args, options) {
   }
 }
 
-// src/lib/onepassword.ts
-async function detectOp() {
-  const version = await safeExeca("op", ["--version"]);
-  if (version === null) {
-    return { installed: false, signedIn: false };
-  }
-  const installed = true;
-  const whoami = await safeExeca("op", ["whoami", "--format=json"]);
-  if (whoami === null || whoami.exitCode !== 0) {
-    return { installed, signedIn: false };
-  }
-  let email;
-  try {
-    const parsed = JSON.parse(whoami.stdout);
-    email = parsed.email;
-  } catch {
-  }
-  return {
-    installed,
-    signedIn: true,
-    ...email ? { email } : {}
-  };
+// src/lib/keychain.ts
+var SERVICE_PREFIX = "org.opuspopuli";
+function serviceFor(region) {
+  return `${SERVICE_PREFIX}.${region}`;
+}
+function labelFor(coords) {
+  const friendly = coords.account === "pgsodium-root-key" ? "pgsodium root key" : "Cloudflare Tunnel token";
+  return `Opus Populi (${coords.region}) \u2014 ${friendly}`;
 }
-async function saveSecretToOp(input) {
-  const vaultArg = input.vault ? ["--vault", input.vault] : [];
-  const existing = await safeExeca("op", ["item", "get", input.title, ...vaultArg, "--format=json"]);
-  if (existing === null) {
+async function detectKeychain() {
+  const res = await safeExeca("security", ["-h"]);
+  if (res === null) {
     return {
-      written: false,
-      alreadyExisted: false,
-      reason: "`op` CLI not installed"
+      available: false,
+      reason: "`security` CLI not on PATH (Keychain requires macOS)"
     };
   }
-  if (existing.exitCode === 0) {
-    if (!input.overwrite) {
-      return { written: false, alreadyExisted: true };
-    }
-    const edit = await safeExeca(
-      "op",
-      ["item", "edit", input.title, ...vaultArg, `notesPlain=${input.value}`]
-    );
-    if (edit === null || edit.exitCode !== 0) {
-      return {
-        written: false,
-        alreadyExisted: true,
-        reason: `op item edit failed: ${edit?.stderr || edit?.stdout || "`op` not installed"}`
-      };
-    }
-    return { written: true, alreadyExisted: true };
-  }
-  const create = await safeExeca("op", [
-    "item",
-    "create",
-    "--category",
-    "Secure Note",
-    "--title",
-    input.title,
-    ...vaultArg,
-    `notesPlain=${input.value}`
+  return { available: true };
+}
+async function saveSecret(coords, value) {
+  const service = serviceFor(coords.region);
+  const label = labelFor(coords);
+  const existing = await safeExeca("security", [
+    "find-generic-password",
+    "-s",
+    service,
+    "-a",
+    coords.account
+  ]);
+  const updated = existing !== null && existing.exitCode === 0;
+  const res = await safeExeca("security", [
+    "add-generic-password",
+    "-U",
+    // upsert
+    "-s",
+    service,
+    "-a",
+    coords.account,
+    "-l",
+    label,
+    "-D",
+    "Opus Populi secret",
+    "-w",
+    value
+    // argv-exposure caveat, see file header
   ]);
-  if (create === null || create.exitCode !== 0) {
+  if (res === null) {
+    return { written: false, updated: false, reason: "`security` CLI not on PATH" };
+  }
+  if (res.exitCode !== 0) {
     return {
       written: false,
-      alreadyExisted: false,
-      reason: `op item create failed: ${create?.stderr || create?.stdout || "`op` not installed"}`
+      updated,
+      reason: `security add-generic-password failed (${res.exitCode ?? "signal"}): ${res.stderr || res.stdout}`
     };
   }
-  return { written: true, alreadyExisted: false };
-}
-async function readSecretFromOp(input) {
-  const vaultArg = input.vault ? ["--vault", input.vault] : [];
-  const res = await safeExeca(
-    "op",
-    ["item", "get", input.title, ...vaultArg, "--fields", "notesPlain", "--reveal"]
-  );
+  return { written: true, updated };
+}
+async function readSecret(coords) {
+  const service = serviceFor(coords.region);
+  const res = await safeExeca("security", [
+    "find-generic-password",
+    "-s",
+    service,
+    "-a",
+    coords.account,
+    "-w"
+    // print the password to stdout (final flag = read mode)
+  ]);
   if (res === null || res.exitCode !== 0) return null;
   const value = res.stdout.trim();
   return value.length > 0 ? value : null;
 }
+function unwrap(value) {
+  if (p3.isCancel(value)) {
+    p3.cancel("Cancelled.");
+    process.exit(0);
+  }
+  return value;
+}
 var _client = null;
 var _clientToken = null;
 function client(token) {
@@ -513,13 +514,6 @@ async function waitForApply(input, budgets = DEFAULT_BUDGETS, deps = realDeps) {
 }
 
 // src/commands/init.ts
-function unwrap(value) {
-  if (p2.isCancel(value)) {
-    p2.cancel("Cancelled.");
-    process.exit(0);
-  }
-  return value;
-}
 async function ghTokenFromCli() {
   const r = await safeExeca("gh", ["auth", "token"]);
   if (r === null || r.exitCode !== 0) return null;
@@ -532,10 +526,10 @@ var initCommand = new Command("init").description(
   new Option("--template <owner/repo>", "Template repo to clone from").default(
     "OpusPopuli/opuspopuli-node"
   )
-).addOption(new Option("--project <name>", "tfvars project prefix").default("opuspopuli")).addOption(new Option("--cf-token <token>", "Cloudflare Account API token").env("CF_TOKEN")).addOption(new Option("--cf-account <id>", "Cloudflare account ID").env("CF_ACCOUNT")).addOption(new Option("--cf-zone <id>", "Cloudflare zone ID for your domain").env("CF_ZONE")).addOption(new Option("--tf-token <token>", "Terraform Cloud user/team token").env("TF_API_TOKEN")).addOption(new Option("--tf-org <org>", "Terraform Cloud organization").env("TF_CLOUD_ORGANIZATION")).addOption(new Option("--gh-token <token>", "GitHub Personal Access Token (else gh CLI)").env("GH_TOKEN")).addOption(new Option("--vault <vault>", "1Password vault for secrets").default("Private")).addOption(
+).addOption(new Option("--project <name>", "tfvars project prefix").default("opuspopuli")).addOption(new Option("--cf-token <token>", "Cloudflare Account API token").env("CF_TOKEN")).addOption(new Option("--cf-account <id>", "Cloudflare account ID").env("CF_ACCOUNT")).addOption(new Option("--cf-zone <id>", "Cloudflare zone ID for your domain").env("CF_ZONE")).addOption(new Option("--tf-token <token>", "Terraform Cloud user/team token").env("TF_API_TOKEN")).addOption(new Option("--tf-org <org>", "Terraform Cloud organization").env("TF_CLOUD_ORGANIZATION")).addOption(new Option("--gh-token <token>", "GitHub Personal Access Token (else gh CLI)").env("GH_TOKEN")).addOption(
   new Option(
     "--overwrite",
-    "Overwrite existing 1Password items (pgsodium key, Tunnel token) on a re-run"
+    "Overwrite existing Keychain items (pgsodium key, Tunnel token) on a re-run"
   ).default(false)
 ).addOption(
   new Option(
@@ -543,8 +537,8 @@ var initCommand = new Command("init").description(
     "Continue using a previously-created node repo (don't fail on 'already exists')"
   ).default(false)
 ).addOption(new Option("--skip-wait", "Don't poll for Terraform apply; exit after PR open").default(false)).addOption(new Option("-y, --yes", "Skip the final confirmation").default(false)).action(async (opts) => {
-  p2.intro(pc2.bgCyan(pc2.black(" create-op-node init ")));
-  p2.note(
+  p3.intro(pc2.bgCyan(pc2.black(" create-op-node init ")));
+  p3.note(
     [
       "This walks you from a sealed Mac Studio + a Cloudflare account to a",
       "live federation node serving traffic at api.<your-domain>.",
@@ -555,14 +549,14 @@ var initCommand = new Command("init").description(
     "Welcome"
   );
   const region = opts.region ? opts.region : unwrap(
-    await p2.text({
-      message: "Short region label (used as a prefix in 1Password + R2)?",
+    await p3.text({
+      message: "Short region label (used as the Keychain service suffix + R2 prefix)?",
       placeholder: "us-ca",
       validate: (v) => /^[a-z0-9-]{2,32}$/.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
     })
   );
   const domain = opts.domain ? opts.domain : unwrap(
-    await p2.text({
+    await p3.text({
       message: "Domain registered in Cloudflare?",
       placeholder: "example.org",
       validate: (v) => !v ? "Required" : v.includes(".") ? void 0 : "Missing a TLD?"
@@ -578,7 +572,7 @@ var initCommand = new Command("init").description(
   );
   const cfAccount = await collectId(opts.cfAccount, "Cloudflare account ID");
   const cfZone = await collectId(opts.cfZone, `Cloudflare zone ID for ${domain}`);
-  const cfSpin = p2.spinner();
+  const cfSpin = p3.spinner();
   cfSpin.start("Verifying Cloudflare token + 5 scopes\u2026");
   const cfProbe = await probeCloudflareToken({
     token: cfToken,
@@ -588,7 +582,7 @@ var initCommand = new Command("init").description(
   if (!cfProbe.ok) {
     cfSpin.stop(pc2.red("\u2717 Cloudflare token check failed."));
     for (const issue of cfProbe.issues) console.error(`  - ${issue}`);
-    p2.cancel("Fix the token in the Cloudflare dashboard, then re-run.");
+    p3.cancel("Fix the token in the Cloudflare dashboard, then re-run.");
     process.exit(1);
   }
   cfSpin.stop(pc2.green("\u2713 Cloudflare token valid, 5 scopes present."));
@@ -598,18 +592,18 @@ var initCommand = new Command("init").description(
     "tfc"
   );
   const tfOrg = opts.tfOrg ? opts.tfOrg : unwrap(
-    await p2.text({
+    await p3.text({
       message: "Terraform Cloud organization name?",
       placeholder: "op-region-ca"
     })
   );
-  const tfSpin = p2.spinner();
+  const tfSpin = p3.spinner();
   tfSpin.start("Verifying Terraform Cloud token + organization\u2026");
   const tfProbe = await probeTfcToken({ token: tfToken, organization: tfOrg });
   if (!tfProbe.ok) {
     tfSpin.stop(pc2.red("\u2717 Terraform Cloud check failed."));
     for (const issue of tfProbe.issues) console.error(`  - ${issue}`);
-    p2.cancel("Fix the token / org, then re-run.");
+    p3.cancel("Fix the token / org, then re-run.");
     process.exit(1);
   }
   tfSpin.stop(
@@ -622,7 +616,7 @@ var initCommand = new Command("init").description(
     const fromCli = await ghTokenFromCli();
     if (fromCli) {
       const useCli = unwrap(
-        await p2.confirm({
+        await p3.confirm({
           message: "Found a signed-in `gh` CLI \u2014 use its token?",
           initialValue: true
         })
@@ -637,10 +631,11 @@ var initCommand = new Command("init").description(
       "github"
     );
   }
-  const op = await detectOp();
-  const opNote = op.installed ? op.signedIn ? `\u2713 1Password CLI signed in${op.email ? ` (${op.email})` : ""} \u2014 pgsodium key + Tunnel token will be saved automatically.` : `\u26A0 1Password CLI installed but not signed in. Run \`op signin\` in another shell, or you'll be prompted to paste secrets.` : `\u26A0 1Password CLI not installed. Secrets will be printed for you to paste into 1Password by hand.`;
-  p2.note(opNote, "1Password");
-  p2.note(
+  const keychain = await detectKeychain();
+  const kcNote = keychain.available ? `\u2713 macOS Keychain available \u2014 pgsodium key + Tunnel token will be saved to your login keychain.
+` + pc2.dim("Note: items don't sync to iCloud Keychain via the security CLI.\n") + pc2.dim("On the Studio, bootstrap will read locally and prompt you to paste if missing.") : `\u26A0 ${keychain.reason ?? "Keychain unavailable"}. Secrets will be printed for manual stash.`;
+  p3.note(kcNote, "Secret store");
+  p3.note(
     [
       `Region label:        ${pc2.cyan(region)}`,
       `Domain:              ${pc2.cyan(domain)}`,
@@ -656,14 +651,14 @@ var initCommand = new Command("init").description(
   );
   if (!opts.yes) {
     const go = unwrap(
-      await p2.confirm({ message: "Proceed?", initialValue: true })
+      await p3.confirm({ message: "Proceed?", initialValue: true })
     );
     if (!go) {
-      p2.cancel("Cancelled.");
+      p3.cancel("Cancelled.");
       process.exit(0);
     }
   }
-  const repoSpin = p2.spinner();
+  const repoSpin = p3.spinner();
   repoSpin.start(`Creating ${newRepoFull} from ${opts.template}\u2026`);
   let created;
   try {
@@ -680,18 +675,18 @@ var initCommand = new Command("init").description(
     const message = err.message ?? "unknown error";
     if (status !== 422) {
       repoSpin.stop(pc2.red(`\u2717 Couldn't create repo: ${message}`));
-      p2.cancel("Fix the issue and re-run.");
+      p3.cancel("Fix the issue and re-run.");
       process.exit(1);
     }
     repoSpin.stop(pc2.yellow(`\u26A0 ${newRepoFull} already exists.`));
     const reuse = opts.useExistingRepo || unwrap(
-      await p2.confirm({
+      await p3.confirm({
         message: `Continue with the existing ${newRepoFull}? (Re-seeds secrets + re-commits prod.tfvars on a fresh branch.)`,
         initialValue: true
       })
     );
     if (!reuse) {
-      p2.cancel(
+      p3.cancel(
         `Delete ${newRepoFull} on GitHub and re-run, or pass --use-existing-repo to skip this prompt.`
       );
       process.exit(0);
@@ -709,7 +704,7 @@ var initCommand = new Command("init").description(
     { name: "TF_API_TOKEN", value: tfToken },
     { name: "TF_CLOUD_ORGANIZATION", value: tfOrg }
   ];
-  const secSpin = p2.spinner();
+  const secSpin = p3.spinner();
   secSpin.start(`Seeding ${secrets.length} repo secrets\u2026`);
   const seeded = [];
   for (const s of secrets) {
@@ -717,7 +712,7 @@ var initCommand = new Command("init").description(
     if (!r.written) {
       secSpin.stop(pc2.red(`\u2717 Failed to set ${s.name}: ${r.reason ?? "unknown"}`));
       const remaining = secrets.slice(secrets.findIndex((x) => x.name === s.name)).map((x) => x.name);
-      p2.cancel(
+      p3.cancel(
         [
           seeded.length > 0 ? `Already seeded on ${newRepoFull}: ${seeded.join(", ")}.` : `Nothing seeded yet on ${newRepoFull}.`,
           `Still pending: ${remaining.join(", ")}.`,
@@ -732,7 +727,7 @@ var initCommand = new Command("init").description(
   }
   secSpin.stop(pc2.green(`\u2713 Seeded ${secrets.length} secrets on ${newRepoFull}`));
   const branch = `init/region-${region}-${isoStampUtc(/* @__PURE__ */ new Date())}`;
-  const setupSpin = p2.spinner();
+  const setupSpin = p3.spinner();
   setupSpin.start(`Writing prod.tfvars on branch ${branch}\u2026`);
   try {
     await createBranch({
@@ -755,11 +750,11 @@ var initCommand = new Command("init").description(
     });
   } catch (err) {
     setupSpin.stop(pc2.red(`\u2717 Couldn't write tfvars: ${err.message}`));
-    p2.cancel("The repo exists but the branch / commit failed. Open it on GitHub and inspect.");
+    p3.cancel("The repo exists but the branch / commit failed. Open it on GitHub and inspect.");
     process.exit(1);
   }
   setupSpin.stop(pc2.green("\u2713 Wrote prod.tfvars"));
-  const prSpin = p2.spinner();
+  const prSpin = p3.spinner();
   prSpin.start("Opening pull request\u2026");
   let pr;
   try {
@@ -782,54 +777,44 @@ var initCommand = new Command("init").description(
     });
   } catch (err) {
     prSpin.stop(pc2.red(`\u2717 Couldn't open PR: ${err.message}`));
-    p2.cancel("Branch + tfvars are committed; open the PR by hand on GitHub.");
+    p3.cancel("Branch + tfvars are committed; open the PR by hand on GitHub.");
     process.exit(1);
   }
   prSpin.stop(pc2.green(`\u2713 Opened PR #${pr.number}`));
-  const keyTitle = `opuspopuli-${region}-pgsodium-root-key`;
-  const vaultArg = opts.vault ? { vault: opts.vault } : {};
-  if (op.installed && op.signedIn) {
-    const existing = opts.overwrite ? null : await readSecretFromOp({ title: keyTitle, ...vaultArg });
+  const pgsodiumCoords = { region, account: "pgsodium-root-key" };
+  const keyLabel = `org.opuspopuli.${region}/pgsodium-root-key`;
+  if (keychain.available) {
+    const existing = opts.overwrite ? null : await readSecret(pgsodiumCoords);
     if (existing && /^[a-f0-9]{64}$/.test(existing)) {
-      p2.note(
-        `${pc2.green("\u2713")} Re-using existing pgsodium master key from 1Password (${pc2.cyan(keyTitle)}). Pass --overwrite to rotate.`,
+      p3.note(
+        `${pc2.green("\u2713")} Re-using existing pgsodium master key from Keychain (${pc2.cyan(keyLabel)}). Pass --overwrite to rotate.`,
         "Secret"
       );
     } else {
       const fresh = generatePgsodiumRootKey();
-      const r = await saveSecretToOp({
-        title: keyTitle,
-        value: fresh,
-        overwrite: opts.overwrite ?? false,
-        ...vaultArg
-      });
+      const r = await saveSecret(pgsodiumCoords, fresh);
       if (r.written) {
-        p2.note(
-          `${pc2.green("\u2713")} pgsodium master key${r.alreadyExisted ? " rotated" : " saved"} to 1Password as ${pc2.cyan(keyTitle)}.`,
-          "Secret"
-        );
-      } else if (r.alreadyExisted) {
-        p2.note(
-          `${pc2.yellow("!")} 1Password has an item titled ${pc2.cyan(keyTitle)} but its value is NOT a 64-hex pgsodium key. Inspect it in 1Password; re-run with --overwrite to replace.`,
+        p3.note(
+          `${pc2.green("\u2713")} pgsodium master key${r.updated ? " rotated" : " saved"} to Keychain as ${pc2.cyan(keyLabel)}.`,
           "Secret"
         );
       } else {
-        await printKeyForManualSave(fresh, keyTitle, r.reason);
+        await printKeyForManualSave(fresh, keyLabel, r.reason);
       }
     }
   } else {
     const fresh = generatePgsodiumRootKey();
-    await printKeyForManualSave(fresh, keyTitle);
+    await printKeyForManualSave(fresh, keyLabel);
   }
   if (opts.skipWait) {
-    p2.outro(
+    p3.outro(
       pc2.cyan(
         `Review + merge ${pr.htmlUrl} when ready. Re-run with no --skip-wait or run \`npx create-op-node verify\` afterwards.`
       )
     );
     return;
   }
-  p2.note(
+  p3.note(
     [
       `Open the PR: ${pc2.cyan(pr.htmlUrl)}`,
       "",
@@ -839,10 +824,10 @@ var initCommand = new Command("init").description(
     "Next step: review + merge"
   );
   const merged = unwrap(
-    await p2.confirm({ message: "PR merged?", initialValue: false })
+    await p3.confirm({ message: "PR merged?", initialValue: false })
   );
   if (!merged) {
-    p2.outro(
+    p3.outro(
       pc2.cyan(`No worries \u2014 re-run \`create-op-node init --skip-wait\` later to skip this step, or finish manually.`)
     );
     return;
@@ -853,7 +838,7 @@ var initCommand = new Command("init").description(
     tags: ["opuspopuli", "cloudflare"]
   });
   if (!ws) {
-    p2.cancel(
+    p3.cancel(
       `Couldn't find a TFC workspace tagged opuspopuli + cloudflare in ${tfOrg}. Check the workflow's run log; the workspace is created on first apply.`
     );
     process.exit(1);
@@ -865,31 +850,27 @@ var initCommand = new Command("init").description(
     runId: ws.currentRunId
   });
   if (!tunnelToken) {
-    p2.cancel(
+    p3.cancel(
       `Terraform apply didn't produce a tunnel_token output. Check the run on TFC; if it succeeded, the output may be named differently \u2014 patch and re-run, or fetch via 'terraform output -raw tunnel_token'.`
     );
     process.exit(1);
   }
-  const tunnelTitle = `opuspopuli-${region}-tunnel-token`;
-  if (op.installed && op.signedIn) {
-    const r = await saveSecretToOp({
-      title: tunnelTitle,
-      value: tunnelToken,
-      ...opts.vault ? { vault: opts.vault } : {},
-      overwrite: true
-    });
+  const tunnelCoords = { region, account: "tunnel-token" };
+  const tunnelLabel = `org.opuspopuli.${region}/tunnel-token`;
+  if (keychain.available) {
+    const r = await saveSecret(tunnelCoords, tunnelToken);
     if (r.written) {
-      p2.note(
-        `${pc2.green("\u2713")} Tunnel token saved to 1Password as ${pc2.cyan(tunnelTitle)}.`,
+      p3.note(
+        `${pc2.green("\u2713")} Tunnel token saved to Keychain as ${pc2.cyan(tunnelLabel)}.`,
         "Secret"
       );
     } else {
-      await printKeyForManualSave(tunnelToken, tunnelTitle, r.reason);
+      await printKeyForManualSave(tunnelToken, tunnelLabel, r.reason);
     }
   } else {
-    await printKeyForManualSave(tunnelToken, tunnelTitle);
+    await printKeyForManualSave(tunnelToken, tunnelLabel);
   }
-  p2.outro(
+  p3.outro(
     pc2.cyan(
       `Region ${region} is provisioned. Next: \`npx create-op-node bootstrap\` on the Mac Studio.`
     )
@@ -905,7 +886,7 @@ async function collectSecret(preset, message, kind = "generic") {
   if (preset) return preset;
   const min = MIN_TOKEN_LENGTH[kind];
   const v = unwrap(
-    await p2.password({
+    await p3.password({
       message,
       validate: (v2) => v2 && v2.length >= min ? void 0 : `That looks too short \u2014 expected at least ${min} characters for a ${kind} token`
     })
@@ -915,7 +896,7 @@ async function collectSecret(preset, message, kind = "generic") {
 async function collectId(preset, message) {
   if (preset) return preset;
   const v = unwrap(
-    await p2.text({
+    await p3.text({
       message,
       placeholder: "0000000000000000000000000000000",
       validate: (v2) => /^[a-f0-9]{32}$/.test(v2 ?? "") ? void 0 : "Expected 32 hex characters"
@@ -923,21 +904,22 @@ async function collectId(preset, message) {
   );
   return v;
 }
-async function printKeyForManualSave(value, title, reason) {
-  p2.note(
+async function printKeyForManualSave(value, label, reason) {
+  p3.note(
     [
       reason ? `${pc2.red("\u2717")} ${reason}` : "",
-      `Save this value to 1Password as ${pc2.cyan(title)}:`,
+      `Save this value to your secret store as ${pc2.cyan(label)}:`,
       "",
       pc2.yellow(value),
       "",
-      pc2.dim("It will not be shown again.")
+      pc2.dim("It will not be shown again."),
+      pc2.dim("On the Studio, bootstrap will prompt you to paste it back.")
     ].filter((line) => line.length > 0).join("\n"),
     "Manual save"
   );
   unwrap(
-    await p2.confirm({
-      message: "Value stashed in 1Password?",
+    await p3.confirm({
+      message: "Value stashed?",
       initialValue: true
     })
   );
@@ -947,7 +929,7 @@ function isoStampUtc(d) {
   return `${d.getUTCFullYear()}${pad(d.getUTCMonth() + 1)}${pad(d.getUTCDate())}-${pad(d.getUTCHours())}${pad(d.getUTCMinutes())}${pad(d.getUTCSeconds())}Z`;
 }
 async function waitForApplyAndFetchTunnelToken(input) {
-  const spin = p2.spinner();
+  const spin = p3.spinner();
   spin.start("Waiting for terraform apply to finish (polling every 10s)\u2026");
   const outcome = await waitForApply({
     token: input.token,
@@ -1204,6 +1186,30 @@ async function setupLaunchAgent(input) {
   }
   return { ok: true, paths };
 }
+async function teardownLaunchAgent(paths, opts = {}) {
+  const steps = [];
+  const unload = await safeExeca("launchctl", ["unload", paths.plistFile]);
+  steps.push({
+    step: "unload",
+    ok: true,
+    ...unload === null ? { reason: "`launchctl` not on PATH" } : {}
+  });
+  try {
+    await rm(paths.plistFile, { force: true });
+    steps.push({ step: "rm-plist", ok: true });
+  } catch (err) {
+    steps.push({ step: "rm-plist", ok: false, reason: err.message });
+  }
+  if (!opts.keepKeyFile) {
+    try {
+      await rm(paths.keyFile, { force: true });
+      steps.push({ step: "rm-key-file", ok: true });
+    } catch (err) {
+      steps.push({ step: "rm-key-file", ok: false, reason: err.message });
+    }
+  }
+  return { ok: steps.every((s) => s.ok), steps };
+}
 
 // src/lib/docker.ts
 var GHCR_REGISTRY = "ghcr.io";
@@ -1258,6 +1264,17 @@ async function composeUp(opts) {
   const res = await safeExeca("docker", composeArgs(opts, ["up", "-d", "--remove-orphans"]));
   return result(res, "compose up");
 }
+async function composeDown(opts) {
+  const flags = ["down"];
+  if (opts.wipeVolumes) flags.push("-v");
+  if (opts.removeOrphans) flags.push("--remove-orphans");
+  const res = await safeExeca("docker", composeArgs(opts, flags));
+  return result(res, opts.wipeVolumes ? "compose down -v" : "compose down");
+}
+async function dockerLogout(registry = GHCR_REGISTRY) {
+  const res = await safeExeca("docker", ["logout", registry]);
+  return result(res, `docker logout ${registry}`);
+}
 function result(res, label) {
   if (res === null) return { ok: false, reason: "`docker` not installed" };
   if (res.exitCode !== 0) {
@@ -1412,10 +1429,10 @@ async function warmModel(name, url = OLLAMA_URL) {
       body: JSON.stringify({ model: name, prompt: "hi", stream: false })
     });
     if (!res.ok) {
-      const text5 = await res.text().catch(() => "");
+      const text6 = await res.text().catch(() => "");
       return {
         ok: false,
-        reason: `warm ${name} returned HTTP ${res.status}: ${text5 || "(no body)"}`
+        reason: `warm ${name} returned HTTP ${res.status}: ${text6 || "(no body)"}`
       };
     }
     await res.text();
@@ -1526,16 +1543,9 @@ async function locateOrCloneRepo(input) {
 }
 
 // src/commands/bootstrap.ts
-function unwrap2(value) {
-  if (p2.isCancel(value)) {
-    p2.cancel("Cancelled.");
-    process.exit(0);
-  }
-  return value;
-}
 var bootstrapCommand = new Command("bootstrap").description(
   "Configure the Mac Studio and bring the stack up. Run this on the Studio itself, after `init` has finished on your laptop."
-).addOption(new Option("--region <slug>", "Region label set during init (e.g. us-ca)")).addOption(new Option("--owner <owner>", "GitHub owner for the node repo").default("OpusPopuli")).addOption(new Option("--vault <vault>", "1Password vault to read secrets from").default("Private")).addOption(new Option("--repo-dir <path>", "Explicit path to a checked-out node repo (overrides cwd + clone)")).addOption(
+).addOption(new Option("--region <slug>", "Region label set during init (e.g. us-ca)")).addOption(new Option("--owner <owner>", "GitHub owner for the node repo").default("OpusPopuli")).addOption(new Option("--repo-dir <path>", "Explicit path to a checked-out node repo (overrides cwd + clone)")).addOption(
   new Option(
     "--compose-file <path>",
     "Repeatable. Compose file relative to repo root. Default: docker-compose-prod.yml + docker-compose-backup.yml"
@@ -1546,9 +1556,9 @@ var bootstrapCommand = new Command("bootstrap").description(
     "Skip the LaunchAgent setup (assumes one is already in place)"
   ).default(false)
 ).addOption(new Option("--skip-ollama", "Skip the Ollama model pull + warm").default(false)).addOption(new Option("--skip-stack", "Stop before `docker compose pull && up`").default(false)).addOption(new Option("-y, --yes", "Skip confirmation prompts").default(false)).action(async (opts) => {
-  p2.intro(pc2.bgCyan(pc2.black(" create-op-node bootstrap ")));
-  const region = opts.region ? opts.region : unwrap2(
-    await p2.text({
+  p3.intro(pc2.bgCyan(pc2.black(" create-op-node bootstrap ")));
+  const region = opts.region ? opts.region : unwrap(
+    await p3.text({
       message: "Region label (the slug used during init \u2014 e.g. us-ca)?",
       placeholder: "us-ca",
       validate: (v) => /^[a-z0-9-]{2,32}$/.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
@@ -1556,17 +1566,17 @@ var bootstrapCommand = new Command("bootstrap").description(
   );
   const owner = opts.owner ?? "OpusPopuli";
   const repoName = `opuspopuli-node-${region}`;
-  const sysSpin = p2.spinner();
+  const sysSpin = p3.spinner();
   sysSpin.start("Inspecting macOS\u2026");
   const snap = await inspectSystem();
   sysSpin.stop(pc2.green("\u2713 macOS inspected."));
   if (!snap.isAppleSilicon) {
-    p2.cancel(
+    p3.cancel(
       `Bootstrap requires an Apple Silicon Mac (the runbook targets M-series). Detected: ${snap.osVersion ?? "unknown"} (uname -m != arm64).`
     );
     process.exit(1);
   }
-  p2.note(
+  p3.note(
     [
       `Hostname:                 ${pc2.cyan(snap.hostname)}`,
       `macOS:                    ${pc2.cyan(snap.osVersion ?? "(sw_vers failed)")}`,
@@ -1577,33 +1587,33 @@ var bootstrapCommand = new Command("bootstrap").description(
     "System snapshot"
   );
   if (!snap.autoRestartOnPowerFailure) {
-    const fix = unwrap2(
-      await p2.confirm({
+    const fix = unwrap(
+      await p3.confirm({
         message: "Auto-restart-on-power-failure is OFF. Enable now (requires sudo)?",
         initialValue: true
       })
     );
     if (fix) {
       const r = await enableAutoRestartOnPowerFailure();
-      if (!r.ok) p2.note(`${pc2.red("\u2717")} ${r.reason}`, "pmset failed");
+      if (!r.ok) p3.note(`${pc2.red("\u2717")} ${r.reason}`, "pmset failed");
     }
   }
   if (!snap.diskSleepDisabled) {
-    const fix = unwrap2(
-      await p2.confirm({
+    const fix = unwrap(
+      await p3.confirm({
         message: "Disk sleep is enabled. Disable now (requires sudo)?",
         initialValue: true
       })
     );
     if (fix) {
       const r = await disableDiskSleep();
-      if (!r.ok) p2.note(`${pc2.red("\u2717")} ${r.reason}`, "pmset failed");
+      if (!r.ok) p3.note(`${pc2.red("\u2717")} ${r.reason}`, "pmset failed");
     }
   }
   if (!opts.skipBrew) {
     const brewInfo = await detectBrew();
     if (!brewInfo.installed) {
-      p2.note(
+      p3.note(
         [
           `Homebrew is not installed. Open another shell and run:`,
           "",
@@ -1613,9 +1623,9 @@ var bootstrapCommand = new Command("bootstrap").description(
         ].join("\n"),
         "Manual step"
       );
-      unwrap2(await p2.confirm({ message: "Homebrew installed?", initialValue: true }));
+      unwrap(await p3.confirm({ message: "Homebrew installed?", initialValue: true }));
     }
-    const brewSpin = p2.spinner();
+    const brewSpin = p3.spinner();
     brewSpin.start("Installing Studio packages\u2026");
     const report = await installPackages(STUDIO_PACKAGES, (pkg, status) => {
       brewSpin.message(`${status}: ${pkg.name}`);
@@ -1628,7 +1638,7 @@ var bootstrapCommand = new Command("bootstrap").description(
       )
     );
     if (report.failed.length > 0) {
-      p2.note(
+      p3.note(
         [
           report.failed.map((f) => `${pc2.red("\u2022")} ${f.pkg.name}: ${f.reason}`).join("\n"),
           "",
@@ -1637,8 +1647,8 @@ var bootstrapCommand = new Command("bootstrap").description(
         ].join("\n"),
         "Brew failures"
       );
-      const cont = unwrap2(
-        await p2.confirm({
+      const cont = unwrap(
+        await p3.confirm({
           message: "Continue anyway? (Default no \u2014 recommended to fix and re-run.)",
           initialValue: false
         })
@@ -1648,7 +1658,7 @@ var bootstrapCommand = new Command("bootstrap").description(
   }
   await ensureGhAuth();
   await promptTailscaleSignin();
-  const repoSpin = p2.spinner();
+  const repoSpin = p3.spinner();
   repoSpin.start("Locating your region node repo\u2026");
   const located = await locateOrCloneRepo({
     owner,
@@ -1665,59 +1675,49 @@ var bootstrapCommand = new Command("bootstrap").description(
   repoSpin.stop(
     located.kind === "cloned" ? pc2.green(`\u2713 Cloned ${owner}/${repoName} to ${repoPath}`) : pc2.green(`\u2713 Found region repo at ${repoPath}`)
   );
-  const op = await detectOp();
-  if (!op.installed || !op.signedIn) {
-    p2.cancel(
-      "1Password CLI not installed or not signed in. Run `op signin` and re-run bootstrap. (Or paste pgsodium key + Tunnel token by hand \u2014 manual path not in v0.1.)"
-    );
-    process.exit(1);
-  }
-  const keyTitle = `opuspopuli-${region}-pgsodium-root-key`;
-  const tunnelTitle = `opuspopuli-${region}-tunnel-token`;
-  const vaultArg = opts.vault ? { vault: opts.vault } : {};
-  const opSpin = p2.spinner();
-  opSpin.start("Reading pgsodium key + Tunnel token from 1Password\u2026");
-  const pgsodiumKey = await readSecretFromOp({ title: keyTitle, ...vaultArg });
-  const tunnelToken = await readSecretFromOp({ title: tunnelTitle, ...vaultArg });
-  if (!pgsodiumKey || !tunnelToken) {
-    opSpin.stop(pc2.red("\u2717 Required 1Password items missing."));
-    const missing = [
-      pgsodiumKey ? null : keyTitle,
-      tunnelToken ? null : tunnelTitle
-    ].filter(Boolean);
-    p2.cancel(
-      `Missing in 1Password (vault: ${opts.vault ?? "Private"}): ${missing.join(", ")}. Run \`create-op-node init\` first, or pass --vault if your items live elsewhere.`
+  const keychain = await detectKeychain();
+  if (!keychain.available) {
+    p3.cancel(
+      `${keychain.reason ?? "Keychain unavailable"}. Bootstrap requires the macOS Keychain.`
     );
     process.exit(1);
   }
-  if (!PGSODIUM_KEY_RE.test(pgsodiumKey)) {
-    opSpin.stop(pc2.red("\u2717 pgsodium item exists but isn't a 64-hex key."));
-    p2.cancel("Inspect the item in 1Password; it should be 64 lowercase hex characters.");
-    process.exit(1);
-  }
-  opSpin.stop(pc2.green("\u2713 Secrets read from 1Password."));
+  const pgsodiumKey = await loadOrPromptSecret({
+    region,
+    account: "pgsodium-root-key",
+    label: "pgsodium master key",
+    placeholder: "64 lowercase hex characters",
+    validate: (v) => PGSODIUM_KEY_RE.test(v) ? void 0 : "must be exactly 64 lowercase hex characters"
+  });
+  const tunnelToken = await loadOrPromptSecret({
+    region,
+    account: "tunnel-token",
+    label: "Cloudflare Tunnel token",
+    placeholder: "JWT-style base64url string from `terraform output tunnel_token`",
+    validate: (v) => TUNNEL_TOKEN_RE.test(v) ? void 0 : "tunnel token must be a base64-url JWT"
+  });
   if (!opts.skipLaunchAgent) {
-    const laSpin = p2.spinner();
+    const laSpin = p3.spinner();
     laSpin.start("Writing pgsodium key file + LaunchAgent plist\u2026");
     const la = await setupLaunchAgent({ pgsodiumKey, tunnelToken });
     if (!la.ok) {
       laSpin.stop(pc2.red(`\u2717 LaunchAgent step ${la.step} failed.`));
-      p2.cancel(la.reason ?? "LaunchAgent setup failed.");
+      p3.cancel(la.reason ?? "LaunchAgent setup failed.");
       process.exit(1);
     }
     laSpin.stop(pc2.green(`\u2713 LaunchAgent loaded (${la.paths.plistFile}).`));
   }
-  const ghcrSpin = p2.spinner();
+  const ghcrSpin = p3.spinner();
   ghcrSpin.start("Authenticating Docker to ghcr.io\u2026");
   const ghcr = await loginToGhcr();
   if (!ghcr.ok) {
     ghcrSpin.stop(pc2.red("\u2717 ghcr.io login failed."));
-    p2.cancel(ghcr.reason ?? "ghcr.io login failed.");
+    p3.cancel(ghcr.reason ?? "ghcr.io login failed.");
     process.exit(1);
   }
   ghcrSpin.stop(pc2.green("\u2713 Logged in to ghcr.io."));
   if (!opts.skipOllama) {
-    const olSpin = p2.spinner();
+    const olSpin = p3.spinner();
     olSpin.start("Pulling + warming Ollama models\u2026");
     let olHealth = await checkOllamaHealth();
     if (!olHealth.reachable) {
@@ -1725,7 +1725,7 @@ var bootstrapCommand = new Command("bootstrap").description(
       const start = await startOllamaService();
       if (!start.ok) {
         olSpin.stop(pc2.red("\u2717 Couldn't start Ollama service."));
-        p2.cancel(
+        p3.cancel(
           `${start.reason ?? "unknown"} \u2014 start it manually with \`brew services start ollama\` and re-run with --skip-brew --skip-launch-agent.`
         );
         process.exit(1);
@@ -1736,7 +1736,7 @@ var bootstrapCommand = new Command("bootstrap").description(
         olSpin.stop(
           pc2.yellow("\u26A0 Ollama service started but daemon not yet answering on :11434.")
         );
-        p2.cancel(
+        p3.cancel(
           "Give it another few seconds, then re-run with --skip-brew --skip-launch-agent."
         );
         process.exit(1);
@@ -1752,11 +1752,11 @@ var bootstrapCommand = new Command("bootstrap").description(
     );
     const probe = await probeHostDockerInternal();
     if (!probe.ok) {
-      p2.note(`${pc2.yellow("\u26A0")} ${probe.reason}`, "Docker host networking");
+      p3.note(`${pc2.yellow("\u26A0")} ${probe.reason}`, "Docker host networking");
     }
   }
   if (opts.skipStack) {
-    p2.outro(
+    p3.outro(
       pc2.cyan(
         `Stack-up skipped. Run \`docker compose -f ${(opts.composeFile ?? ["docker-compose-prod.yml"]).join(" -f ")} pull && up -d\` from ${repoPath} when ready.`
       )
@@ -1769,25 +1769,25 @@ var bootstrapCommand = new Command("bootstrap").description(
     cwd: repoPath,
     ...opts.envFile ? { envFile: opts.envFile } : {}
   };
-  const pullSpin = p2.spinner();
+  const pullSpin = p3.spinner();
   pullSpin.start("Pulling images from ghcr.io\u2026");
   const pull = await composePull(composeOpts);
   if (!pull.ok) {
     pullSpin.stop(pc2.red("\u2717 compose pull failed."));
-    p2.cancel(pull.reason ?? "compose pull failed.");
+    p3.cancel(pull.reason ?? "compose pull failed.");
     process.exit(1);
   }
   pullSpin.stop(pc2.green("\u2713 Images pulled."));
-  const upSpin = p2.spinner();
+  const upSpin = p3.spinner();
   upSpin.start("Starting the stack\u2026");
   const up = await composeUp(composeOpts);
   if (!up.ok) {
     upSpin.stop(pc2.red("\u2717 compose up failed."));
-    p2.cancel(up.reason ?? "compose up failed.");
+    p3.cancel(up.reason ?? "compose up failed.");
     process.exit(1);
   }
   upSpin.stop(pc2.green("\u2713 Containers started \u2014 waiting for healthy\u2026"));
-  const healthSpin = p2.spinner();
+  const healthSpin = p3.spinner();
   healthSpin.start("Polling for healthy containers (5s, up to 5 minutes)\u2026");
   const outcome = await waitForHealthy(composeOpts, {
     onPoll: (snaps) => {
@@ -1799,7 +1799,7 @@ var bootstrapCommand = new Command("bootstrap").description(
   switch (outcome.kind) {
     case "healthy":
       healthSpin.stop(pc2.green(`\u2713 All ${outcome.snapshots.length} containers healthy.`));
-      p2.outro(
+      p3.outro(
         pc2.cyan(
           `Region ${region} is up. Next: verify off-LAN with \`npx create-op-node verify --domain <your-domain>\`.`
         )
@@ -1807,22 +1807,22 @@ var bootstrapCommand = new Command("bootstrap").description(
       return;
     case "unhealthy":
       healthSpin.stop(pc2.red(`\u2717 ${outcome.problem}`));
-      p2.note(
+      p3.note(
         outcome.snapshots.map((s) => `  ${kvHealth(s.health)} ${s.name} (${s.state})`).join("\n"),
         "Container state"
       );
-      p2.cancel(
+      p3.cancel(
         `Inspect with \`docker compose -f ${composeFiles.join(" -f ")} logs\`. Fix and re-run.`
       );
       process.exit(1);
     // eslint-disable-next-line no-fallthrough
     case "timeout":
       healthSpin.stop(pc2.yellow("\u26A0 Timed out waiting for all containers to report healthy."));
-      p2.note(
+      p3.note(
         outcome.snapshots.map((s) => `  ${kvHealth(s.health)} ${s.name} (${s.state})`).join("\n"),
         "Container state at timeout"
       );
-      p2.cancel(
+      p3.cancel(
         `Re-run \`create-op-node bootstrap --skip-brew --skip-launch-agent --skip-ollama\` to skip the already-done phases and poll again once containers settle.`
       );
       process.exit(1);
@@ -1862,20 +1862,20 @@ function repoPathFromLocate(out) {
 function handleLocateError(out, owner, name) {
   switch (out.kind) {
     case "explicit-not-a-node-repo":
-      p2.cancel(
+      p3.cancel(
         `${out.path} doesn't look like a node repo (missing one of docker-compose-prod.yml / supabase/init/pgsodium_getkey_env.sh). Point --repo-dir at the right place.`
       );
       return;
     case "gh-not-installed":
-      p2.cancel("`gh` not installed \u2014 install via `brew install gh` and re-run.");
+      p3.cancel("`gh` not installed \u2014 install via `brew install gh` and re-run.");
       return;
     case "clone-failed":
-      p2.cancel(
+      p3.cancel(
         `Couldn't clone ${owner}/${name}: ${out.reason}. Check repo exists + you have access.`
       );
       return;
     case "clone-disallowed":
-      p2.cancel(
+      p3.cancel(
         "No checked-out node repo found and --no-clone (or similar) was set. Provide --repo-dir."
       );
       return;
@@ -1890,12 +1890,12 @@ function handleLocateError(out, owner, name) {
 async function ensureGhAuth() {
   const status = await safeExeca("gh", ["auth", "status"]);
   if (status === null) {
-    p2.cancel("`gh` not on PATH. Install via `brew install gh` and re-run.");
+    p3.cancel("`gh` not on PATH. Install via `brew install gh` and re-run.");
     process.exit(1);
   }
   if (status.exitCode === 0) return;
   const detail = (status.stderr || status.stdout).trim();
-  p2.note(
+  p3.note(
     [
       "`gh` is not signed in (or signed in to a different account / missing scope).",
       detail ? "" : void 0,
@@ -1909,12 +1909,12 @@ async function ensureGhAuth() {
     ].filter((l) => typeof l === "string").join("\n"),
     "Manual step"
   );
-  unwrap2(await p2.confirm({ message: "gh signed in?", initialValue: true }));
+  unwrap(await p3.confirm({ message: "gh signed in?", initialValue: true }));
 }
 async function promptTailscaleSignin() {
   const status = await safeExeca("tailscale", ["status"]);
   if (status !== null && status.exitCode === 0) return;
-  p2.note(
+  p3.note(
     [
       "Tailscale needs to be signed in (or you can skip \u2014 Tailscale is",
       "optional; it provides out-of-band SSH from your laptop. The rest",
@@ -1928,8 +1928,319 @@ async function promptTailscaleSignin() {
     ].join("\n"),
     "Manual step"
   );
-  unwrap2(await p2.confirm({ message: "Tailscale signed in (or skipped)?", initialValue: true }));
+  unwrap(await p3.confirm({ message: "Tailscale signed in (or skipped)?", initialValue: true }));
+}
+async function loadOrPromptSecret(input) {
+  const coords = { region: input.region, account: input.account };
+  const spin = p3.spinner();
+  spin.start(`Reading ${input.label} from Keychain\u2026`);
+  const existing = await readSecret(coords);
+  if (existing && input.validate(existing) === void 0) {
+    spin.stop(pc2.green(`\u2713 ${input.label} read from Keychain.`));
+    return existing;
+  }
+  spin.stop(
+    existing ? pc2.yellow(`\u26A0 ${input.label} in Keychain failed validation \u2014 will re-prompt.`) : pc2.dim(`\xB7 ${input.label} not in Keychain \u2014 will prompt.`)
+  );
+  const pasted = unwrap(
+    await p3.password({
+      message: `Paste the ${input.label} for region ${input.region}:`,
+      validate: (v) => input.validate(v ?? "")
+    })
+  );
+  const save = await saveSecret(coords, pasted);
+  if (!save.written) {
+    p3.note(`${pc2.yellow("\u26A0")} Couldn't persist to Keychain: ${save.reason ?? "unknown"}. Continuing anyway.`, "Keychain");
+  } else {
+    p3.note(`${pc2.green("\u2713")} Stored ${input.label} in Keychain for re-runs.`, "Keychain");
+  }
+  return pasted;
+}
+var REGION_RE = /^[a-z0-9-]{2,32}$/;
+var RESET_PHASES = {
+  STOP_STACK: "Stop stack",
+  LAUNCH_AGENT: "LaunchAgent",
+  DOCKER_LOGOUT: "docker logout"
+};
+var DEFAULT_DEPS = {
+  composeDown,
+  teardownLaunchAgent,
+  dockerLogout
+};
+async function runReset(input, deps = DEFAULT_DEPS) {
+  const phases = [];
+  const push = (ph) => {
+    phases.push(ph);
+    deps.onPhase?.(ph);
+  };
+  if (!input.stack) {
+    push({
+      name: RESET_PHASES.STOP_STACK,
+      status: "skipped",
+      detail: "--skip-stack or no repo path resolved"
+    });
+  } else if (input.dryRun) {
+    push({
+      name: RESET_PHASES.STOP_STACK,
+      status: "dry-run",
+      detail: `would run: docker compose -f ${input.stack.composeFiles.join(" -f ")} down${input.stack.wipeVolumes ? " -v" : ""}${input.stack.removeOrphans ? " --remove-orphans" : ""}`
+    });
+  } else {
+    const result2 = await deps.composeDown({
+      files: input.stack.composeFiles,
+      cwd: input.stack.repoPath,
+      ...input.stack.envFile ? { envFile: input.stack.envFile } : {},
+      wipeVolumes: input.stack.wipeVolumes,
+      removeOrphans: input.stack.removeOrphans
+    });
+    if (result2.ok) {
+      push({
+        name: RESET_PHASES.STOP_STACK,
+        status: "ok",
+        detail: input.stack.wipeVolumes ? "volumes destroyed" : "containers stopped, volumes preserved"
+      });
+    } else {
+      push({ name: RESET_PHASES.STOP_STACK, status: "fail", detail: result2.reason ?? "unknown failure" });
+    }
+  }
+  if (!input.launchAgent) {
+    push({ name: RESET_PHASES.LAUNCH_AGENT, status: "skipped", detail: "--skip-launch-agent or no plist found" });
+  } else if (input.dryRun) {
+    push({
+      name: RESET_PHASES.LAUNCH_AGENT,
+      status: "dry-run",
+      detail: `would unload ${input.launchAgent.paths.plistFile}, rm plist${input.launchAgent.keepKeyFile ? "" : " + key file"}`
+    });
+  } else {
+    const result2 = await deps.teardownLaunchAgent(
+      input.launchAgent.paths,
+      { keepKeyFile: input.launchAgent.keepKeyFile }
+    );
+    if (result2.ok) {
+      const removed = result2.steps.filter((s) => s.step !== "unload").map((s) => s.step).join(", ");
+      push({ name: RESET_PHASES.LAUNCH_AGENT, status: "ok", detail: `unloaded + ${removed}` });
+    } else {
+      const fail = result2.steps.find((s) => !s.ok);
+      push({
+        name: RESET_PHASES.LAUNCH_AGENT,
+        status: "fail",
+        detail: `${fail?.step}: ${fail?.reason ?? "unknown"}`
+      });
+    }
+  }
+  if (!input.dockerLogout) {
+    push({ name: RESET_PHASES.DOCKER_LOGOUT, status: "skipped", detail: "--skip-docker-logout" });
+  } else if (input.dryRun) {
+    push({
+      name: RESET_PHASES.DOCKER_LOGOUT,
+      status: "dry-run",
+      detail: `would run: docker logout ${input.dockerLogout.registry}`
+    });
+  } else {
+    const result2 = await deps.dockerLogout(input.dockerLogout.registry);
+    if (result2.ok) {
+      push({
+        name: RESET_PHASES.DOCKER_LOGOUT,
+        status: "ok",
+        detail: `credentials removed from ${input.dockerLogout.registry}`
+      });
+    } else {
+      push({ name: RESET_PHASES.DOCKER_LOGOUT, status: "warn", detail: result2.reason ?? "unknown" });
+    }
+  }
+  return { phases };
+}
+async function fileExists2(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function phaseIcon(ph) {
+  switch (ph.status) {
+    case "ok":
+      return pc2.green("\u2713");
+    case "warn":
+      return pc2.yellow("\u26A0");
+    case "skipped":
+      return pc2.dim("\xB7");
+    case "dry-run":
+      return pc2.cyan("?");
+    case "fail":
+      return pc2.red("\u2717");
+  }
 }
+var resetCommand = new Command("reset").description(
+  "Reverse the Mac Studio side of bootstrap: stop containers, unload the LaunchAgent, remove the pgsodium key file. Preserves docker volumes by default \u2014 pass --wipe-data for a full data nuke (requires retyping the region label)."
+).addOption(new Option("--region <slug>", "Region label (used for --wipe-data confirmation + finding the repo)")).addOption(new Option("--owner <owner>", "GitHub owner for the node repo").default("OpusPopuli")).addOption(new Option("--repo-dir <path>", "Explicit path to a checked-out node repo")).addOption(
+  new Option(
+    "--compose-file <path>",
+    "Repeatable. Compose file relative to repo root. Default: docker-compose-prod.yml"
+  ).default(["docker-compose-prod.yml"])
+).addOption(new Option("--env-file <path>", "Compose --env-file. Default: .env.production")).addOption(
+  new Option(
+    "--wipe-data",
+    "DESTROYS docker volumes (adds -v to `compose down`). Requires retyping the region label as confirmation. Default off \u2014 volumes preserved."
+  ).default(false)
+).addOption(
+  new Option(
+    "--no-remove-orphans",
+    "Do NOT pass --remove-orphans to compose down. Preserves containers from compose files no longer included."
+  )
+).addOption(new Option("--skip-stack", "Don't touch docker compose").default(false)).addOption(new Option("--skip-launch-agent", "Don't touch the LaunchAgent").default(false)).addOption(
+  new Option(
+    "--keep-key-file",
+    "Preserve the pgsodium key file (only matters when LaunchAgent teardown runs). Useful as belt-and-suspenders backup before a wipe-data run."
+  ).default(false)
+).addOption(new Option("--skip-docker-logout", "Don't run `docker logout`").default(false)).addOption(new Option("--registry <registry>", "Registry to log out of").default(GHCR_REGISTRY)).addOption(new Option("--dry-run", "Show what would happen without acting").default(false)).addOption(new Option("-y, --yes", "Skip non-destructive confirmations (wipe still confirms)").default(false)).action(async (opts) => {
+  p3.intro(pc2.bgCyan(pc2.black(" create-op-node reset ")));
+  const wipeData = opts.wipeData ?? false;
+  const removeOrphans = opts.removeOrphans ?? true;
+  const region = opts.region ? opts.region : unwrap(
+    await p3.text({
+      message: "Region label (the slug used during init \u2014 e.g. us-ca)?",
+      placeholder: "us-ca",
+      validate: (v) => REGION_RE.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
+    })
+  );
+  if (!REGION_RE.test(region)) {
+    p3.cancel(`--region ${JSON.stringify(region)} is not a valid region slug.`);
+    process.exit(2);
+  }
+  const owner = opts.owner ?? "OpusPopuli";
+  const repoName = `opuspopuli-node-${region}`;
+  const launchAgentPaths = defaultPaths();
+  const plistExists = await fileExists2(launchAgentPaths.plistFile);
+  const keyFileExists = await fileExists2(launchAgentPaths.keyFile);
+  let repoPath;
+  let stackSkipReason;
+  if (!opts.skipStack) {
+    const located = await locateOrCloneRepo({
+      owner,
+      name: repoName,
+      cwd: process.cwd(),
+      allowClone: false,
+      ...opts.repoDir ? { explicit: opts.repoDir } : {}
+    });
+    switch (located.kind) {
+      case "found":
+        repoPath = located.path;
+        break;
+      case "explicit-not-a-node-repo":
+        p3.cancel(
+          `--repo-dir ${JSON.stringify(located.path)} doesn't look like a node repo (missing one of: ${NODE_REPO_MARKERS.join(", ")}). Verify the path or drop --repo-dir to let reset search the cwd.`
+        );
+        process.exit(2);
+        break;
+      case "clone-disallowed":
+        stackSkipReason = `no checkout found at ${process.cwd()}; pass --repo-dir to target one`;
+        break;
+      case "cloned":
+      case "gh-not-installed":
+      case "clone-failed":
+        stackSkipReason = `unexpected outcome ${located.kind} from locateOrCloneRepo with allowClone=false`;
+        break;
+    }
+  } else {
+    stackSkipReason = "--skip-stack";
+  }
+  let runningContainers = null;
+  if (repoPath) {
+    runningContainers = await composePs({
+      files: resolveComposeFiles(repoPath, opts.composeFile),
+      ...opts.envFile ? { envFile: opts.envFile } : {}
+    });
+  }
+  p3.note(
+    [
+      `Region:                ${pc2.cyan(region)}`,
+      `Repo path:             ${repoPath ? pc2.cyan(repoPath) : pc2.dim(`not used (${stackSkipReason ?? "no repo path resolved"})`)}`,
+      `Running containers:    ${runningContainers === null ? pc2.dim("unknown") : runningContainers.length === 0 ? pc2.dim("none") : pc2.cyan(`${runningContainers.length} listed by compose ps`)}`,
+      `LaunchAgent plist:     ${plistExists ? pc2.cyan(launchAgentPaths.plistFile) : pc2.dim("not present")}`,
+      `pgsodium key file:     ${keyFileExists ? pc2.cyan(launchAgentPaths.keyFile) : pc2.dim("not present")}`,
+      `Registry to log out:   ${pc2.cyan(opts.registry ?? GHCR_REGISTRY)}`,
+      `Volume policy:         ${wipeData ? pc2.red("WIPE") : pc2.green("preserve (default)")}`,
+      `Dry run:               ${opts.dryRun ? pc2.yellow("yes") : pc2.dim("no")}`
+    ].join("\n"),
+    "Snapshot"
+  );
+  if (wipeData && !opts.dryRun) {
+    unwrap(
+      await p3.text({
+        message: pc2.red(`Type the region label to confirm WIPING all volumes (the slug you'd use with --region):`),
+        validate: (v) => v === region ? void 0 : `must match the region label exactly`
+      })
+    );
+  } else if (!opts.dryRun && !opts.yes) {
+    const cont = unwrap(
+      await p3.confirm({
+        message: "Proceed with reset? (volumes will be preserved)",
+        initialValue: true
+      })
+    );
+    if (!cont) {
+      p3.cancel("Cancelled.");
+      process.exit(0);
+    }
+  }
+  const stack = repoPath ? {
+    repoPath,
+    composeFiles: resolveComposeFiles(repoPath, opts.composeFile),
+    wipeVolumes: wipeData,
+    removeOrphans,
+    ...opts.envFile ? { envFile: opts.envFile } : {}
+  } : void 0;
+  const launchAgent = plistExists && !opts.skipLaunchAgent ? {
+    paths: launchAgentPaths,
+    keepKeyFile: opts.keepKeyFile ?? false
+  } : void 0;
+  const dockerLogoutInput = !opts.skipDockerLogout ? { registry: opts.registry ?? GHCR_REGISTRY } : void 0;
+  const phaseSpins = /* @__PURE__ */ new Map();
+  const actingPhases = [];
+  if (stack && !opts.dryRun) actingPhases.push(RESET_PHASES.STOP_STACK);
+  if (launchAgent && !opts.dryRun) actingPhases.push(RESET_PHASES.LAUNCH_AGENT);
+  if (dockerLogoutInput && !opts.dryRun) actingPhases.push(RESET_PHASES.DOCKER_LOGOUT);
+  for (const name of actingPhases) {
+    const s = p3.spinner();
+    s.start(`${name}\u2026`);
+    phaseSpins.set(name, s);
+  }
+  const renderPhase = (ph) => {
+    const spin = phaseSpins.get(ph.name);
+    const line = `${phaseIcon(ph)} ${ph.name}: ${pc2.dim(ph.detail)}`;
+    if (spin) {
+      spin.stop(line);
+      phaseSpins.delete(ph.name);
+    } else {
+      p3.log.info(line);
+    }
+  };
+  const report = await runReset(
+    {
+      ...stack ? { stack } : {},
+      ...launchAgent ? { launchAgent } : {},
+      ...dockerLogoutInput ? { dockerLogout: dockerLogoutInput } : {},
+      dryRun: opts.dryRun ?? false
+    },
+    { ...DEFAULT_DEPS, onPhase: renderPhase }
+  );
+  for (const [, spin] of phaseSpins) spin.stop(pc2.dim("\u2014 skipped"));
+  const failed = report.phases.filter((ph) => ph.status === "fail").length;
+  if (failed > 0) {
+    p3.outro(pc2.red(`${failed} step${failed === 1 ? "" : "s"} failed.`));
+    process.exit(1);
+  } else if (opts.dryRun) {
+    p3.outro(pc2.cyan("Dry run complete. Re-run without --dry-run to apply."));
+  } else {
+    p3.outro(
+      pc2.green(
+        wipeData ? `Reset complete \u2014 volumes wiped. Re-run \`create-op-node bootstrap --region ${region}\` to start fresh.` : `Reset complete \u2014 volumes preserved. Re-run \`create-op-node bootstrap --region ${region}\` to bring the stack back up.`
+      )
+    );
+  }
+});
 
 // src/lib/cosign.ts
 var COSIGN_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
@@ -1965,8 +2276,8 @@ async function cosignVerifyImage(input) {
 // src/lib/http.ts
 var GRAPHQL_ACCEPT = "application/graphql-response+json, application/json";
 async function readBodyCapped(res) {
-  const text5 = await res.text();
-  return text5.slice(0, BODY_PREVIEW_MAX);
+  const text6 = await res.text();
+  return text6.slice(0, BODY_PREVIEW_MAX);
 }
 async function httpProbe(input) {
   const expected = input.expectedStatus ?? 200;
@@ -2004,22 +2315,22 @@ async function graphqlProbe(input) {
       body: JSON.stringify({ query: "{ __typename }" }),
       signal: ctrl.signal
     });
-    const text5 = await readBodyCapped(res);
+    const text6 = await readBodyCapped(res);
     if (res.status !== 200) {
       return {
         ok: false,
         status: res.status,
-        reason: `expected HTTP 200, got ${res.status}: ${text5}`
+        reason: `expected HTTP 200, got ${res.status}: ${text6}`
       };
     }
     let envelope;
     try {
-      envelope = JSON.parse(text5);
+      envelope = JSON.parse(text6);
     } catch {
       return {
         ok: false,
         status: res.status,
-        reason: `response was not JSON: ${text5}`
+        reason: `response was not JSON: ${text6}`
       };
     }
     const data = envelope.data;
@@ -2028,7 +2339,7 @@ async function graphqlProbe(input) {
       return {
         ok: false,
         status: res.status,
-        reason: `response missing { data: { __typename: string } }: ${text5}`
+        reason: `response missing { data: { __typename: string } }: ${text6}`
       };
     }
     return { ok: true, typename };
@@ -2096,13 +2407,6 @@ function tlsHandshake(input) {
 }
 
 // src/commands/verify.ts
-function unwrap3(value) {
-  if (p2.isCancel(value)) {
-    p2.cancel("Cancelled.");
-    process.exit(0);
-  }
-  return value;
-}
 var DOMAIN_RE = /^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}$/i;
 function summarize(report) {
   let failed = 0;
@@ -2118,14 +2422,14 @@ function formatExpiry(days) {
   if (days === 0) return "expires today";
   return `${days}d to expiry`;
 }
-var DEFAULT_DEPS = {
+var DEFAULT_DEPS2 = {
   tls: tlsHandshake,
   http: httpProbe,
   graphql: graphqlProbe,
   tunnel: tunnelStatus,
   cosign: cosignVerifyImage
 };
-async function runVerify(input, deps = DEFAULT_DEPS) {
+async function runVerify(input, deps = DEFAULT_DEPS2) {
   const phases = [];
   const push = (ph) => {
     phases.push(ph);
@@ -2244,26 +2548,26 @@ var verifyCommand = new Command("verify").description(
 ).addOption(
   new Option("--show-skipped", "Include skipped phases in the summary").default(false)
 ).action(async (opts) => {
-  p2.intro(pc2.bgCyan(pc2.black(" create-op-node verify ")));
-  const domain = opts.domain ? opts.domain : unwrap3(
-    await p2.text({
+  p3.intro(pc2.bgCyan(pc2.black(" create-op-node verify ")));
+  const domain = opts.domain ? opts.domain : unwrap(
+    await p3.text({
       message: "Public domain of the node?",
       placeholder: "yournode.example.org",
       validate: (v) => DOMAIN_RE.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens, dots; must contain a dot and a TLD"
     })
   );
   if (!DOMAIN_RE.test(domain)) {
-    p2.cancel(`--domain ${JSON.stringify(domain)} doesn't look like a domain.`);
+    p3.cancel(`--domain ${JSON.stringify(domain)} doesn't look like a domain.`);
     process.exit(2);
   }
   const rawDays = opts.certWarnDays ?? "14";
   const certWarnDays = Number.parseInt(rawDays, 10);
   if (!Number.isFinite(certWarnDays) || certWarnDays < 0 || !/^\d+$/.test(rawDays)) {
-    p2.cancel(`--cert-warn-days must be a non-negative integer (got ${JSON.stringify(rawDays)}).`);
+    p3.cancel(`--cert-warn-days must be a non-negative integer (got ${JSON.stringify(rawDays)}).`);
     process.exit(2);
   }
   if (opts.cfToken && opts.cfTokenFile) {
-    p2.cancel("Pass either --cf-token or --cf-token-file, not both.");
+    p3.cancel("Pass either --cf-token or --cf-token-file, not both.");
     process.exit(2);
   }
   let cfToken = opts.cfToken;
@@ -2271,7 +2575,7 @@ var verifyCommand = new Command("verify").description(
     try {
       cfToken = readTokenFile(opts.cfTokenFile);
     } catch (err) {
-      p2.cancel(err.message);
+      p3.cancel(err.message);
       process.exit(2);
     }
   }
@@ -2287,10 +2591,10 @@ var verifyCommand = new Command("verify").description(
     activeSpin = null;
   };
   const deps = {
-    ...DEFAULT_DEPS,
+    ...DEFAULT_DEPS2,
     onPhase: renderPhase
   };
-  activeSpin = p2.spinner();
+  activeSpin = p3.spinner();
   activeSpin.start("Running checks\u2026");
   const report = await runVerify(
     {
@@ -2309,24 +2613,24 @@ var verifyCommand = new Command("verify").description(
   const visible = opts.showSkipped ?? false ? report.phases : report.phases.filter((ph) => ph.status !== "skipped");
   const lines = visible.map((ph, i) => {
     const idx = report.phases.indexOf(ph) + 1;
-    return `${phaseIcon(ph)} [${idx}/${totalPhases}] ${ph.name}: ${pc2.dim(ph.detail)}`;
+    return `${phaseIcon2(ph)} [${idx}/${totalPhases}] ${ph.name}: ${pc2.dim(ph.detail)}`;
   });
   const skippedCount = report.phases.length - visible.length;
   if (skippedCount > 0 && !opts.showSkipped) {
     lines.push(pc2.dim(`\xB7 ${skippedCount} phase${skippedCount === 1 ? "" : "s"} skipped (run with --show-skipped to see them)`));
   }
-  p2.note(lines.join("\n"), "Summary");
+  p3.note(lines.join("\n"), "Summary");
   const summary = summarize(report);
   if (summary.ok) {
-    p2.outro(
+    p3.outro(
       summary.warned === 0 ? pc2.green("All checks passed.") : pc2.yellow(`Passed with ${summary.warned} warning${summary.warned === 1 ? "" : "s"}.`)
     );
   } else {
-    p2.outro(pc2.red(`${summary.failed} check${summary.failed === 1 ? "" : "s"} failed.`));
+    p3.outro(pc2.red(`${summary.failed} check${summary.failed === 1 ? "" : "s"} failed.`));
     process.exit(1);
   }
 });
-function phaseIcon(ph) {
+function phaseIcon2(ph) {
   switch (ph.status) {
     case "ok":
       return pc2.green("\u2713");
@@ -2339,7 +2643,7 @@ function phaseIcon(ph) {
   }
 }
 function formatPhaseLine(prefix, ph) {
-  const icon = phaseIcon(ph);
+  const icon = phaseIcon2(ph);
   const colorize = ph.status === "ok" ? pc2.green : ph.status === "warn" ? pc2.yellow : ph.status === "skipped" ? pc2.dim : pc2.red;
   return colorize(`${icon} ${prefix}: ${ph.detail}`);
 }
@@ -3122,13 +3426,6 @@ function validateRegionConfig(file) {
 }
 
 // src/commands/region.ts
-function unwrap4(value) {
-  if (p2.isCancel(value)) {
-    p2.cancel("Cancelled.");
-    process.exit(0);
-  }
-  return value;
-}
 var regionCommand = new Command("region").description(
   "Scaffold a schema-valid region config for the OpusPopuli/opuspopuli-regions repo. Run this from inside your checkout of that repo."
 ).addOption(
@@ -3141,8 +3438,8 @@ var regionCommand = new Command("region").description(
     "current directory"
   )
 ).addOption(new Option("-f, --force", "Overwrite an existing config file").default(false)).action(async (opts) => {
-  p2.intro(pc2.bgMagenta(pc2.black(" create-op-node region ")));
-  p2.note(
+  p3.intro(pc2.bgMagenta(pc2.black(" create-op-node region ")));
+  p3.note(
     [
       "Scaffolds a declarative region config JSON for opuspopuli-regions \u2014",
       "the file that defines WHAT civic data a region collects.",
@@ -3156,19 +3453,19 @@ var regionCommand = new Command("region").description(
   const targetDir = opts.outDir ?? process.cwd();
   const looksRight = await looksLikeRegionsRepo(targetDir);
   if (!looksRight) {
-    const proceed = unwrap4(
-      await p2.confirm({
+    const proceed = unwrap(
+      await p3.confirm({
         message: `${targetDir} doesn't look like an opuspopuli-regions checkout (no schema/region-plugin.schema.json). Continue anyway?`,
         initialValue: false
       })
     );
     if (!proceed) {
-      p2.cancel("Cancelled \u2014 run again from your opuspopuli-regions checkout, or pass --out-dir.");
+      p3.cancel("Cancelled \u2014 run again from your opuspopuli-regions checkout, or pass --out-dir.");
       process.exit(0);
     }
   }
-  const level = opts.level === "state" || opts.level === "county" ? opts.level : unwrap4(
-    await p2.select({
+  const level = opts.level === "state" || opts.level === "county" ? opts.level : unwrap(
+    await p3.select({
       message: "What level is this region?",
       options: [
         { value: "state", label: "State", hint: "e.g. California" },
@@ -3176,8 +3473,8 @@ var regionCommand = new Command("region").description(
       ]
     })
   );
-  const rawName = opts.name ?? unwrap4(
-    await p2.text({
+  const rawName = opts.name ?? unwrap(
+    await p3.text({
       message: level === "county" ? "County name?" : "State name?",
       placeholder: level === "county" ? "Alameda" : "California",
       validate: (v) => v && v.trim().length > 0 ? void 0 : "Required"
@@ -3185,62 +3482,62 @@ var regionCommand = new Command("region").description(
   );
   let parentSlug;
   if (level === "county") {
-    parentSlug = opts.parent ?? unwrap4(
-      await p2.text({
+    parentSlug = opts.parent ?? unwrap(
+      await p3.text({
         message: "Parent state slug?",
         placeholder: "california",
         validate: (v) => isValidSlug(v ?? "") ? void 0 : "kebab-case (lowercase letters, digits, hyphens)"
       })
     );
     if (!isValidSlug(parentSlug)) {
-      p2.cancel(`Parent slug "${parentSlug}" must be kebab-case.`);
+      p3.cancel(`Parent slug "${parentSlug}" must be kebab-case.`);
       process.exit(1);
     }
   }
   const ownSlug = slugify(rawName);
   const regionId = level === "county" ? `${parentSlug}-${ownSlug}` : ownSlug;
   if (!isValidSlug(regionId)) {
-    p2.cancel(`Derived regionId "${regionId}" is not valid kebab-case. Try a simpler name.`);
+    p3.cancel(`Derived regionId "${regionId}" is not valid kebab-case. Try a simpler name.`);
     process.exit(1);
   }
-  const displayName = unwrap4(
-    await p2.text({
+  const displayName = unwrap(
+    await p3.text({
       message: "Display name?",
       defaultValue: rawName
     })
   );
   const regionName = displayName || rawName;
-  const description = unwrap4(
-    await p2.text({
+  const description = unwrap(
+    await p3.text({
       message: "One-line description of the data coverage?",
       placeholder: level === "county" ? `Civic data for ${rawName} County` : `Civic data for the state of ${rawName}`,
       validate: (v) => v && v.trim().length > 0 ? void 0 : "Required"
     })
   );
-  const stateCode = (opts.stateCode ?? unwrap4(
-    await p2.text({
+  const stateCode = (opts.stateCode ?? unwrap(
+    await p3.text({
       message: "Two-letter state code?",
       placeholder: "CA",
       validate: (v) => isValidStateCode((v ?? "").toUpperCase()) ? void 0 : "Two letters, e.g. CA"
     })
   )).toUpperCase();
   if (!isValidStateCode(stateCode)) {
-    p2.cancel(`State code "${stateCode}" must be two letters.`);
+    p3.cancel(`State code "${stateCode}" must be two letters.`);
     process.exit(1);
   }
-  const fipsCode = opts.fips ?? unwrap4(
-    await p2.text({
+  const fipsCode = opts.fips ?? unwrap(
+    await p3.text({
       message: level === "county" ? "County FIPS (5 digits)?" : "State FIPS (2 digits)?",
       placeholder: level === "county" ? "06001" : "06",
       validate: (v) => isValidFips(v ?? "", level) ? void 0 : `Expected ${level === "county" ? "5" : "2"} digits`
     })
   );
   if (!isValidFips(fipsCode, level)) {
-    p2.cancel(`FIPS "${fipsCode}" is the wrong length for a ${level}.`);
+    p3.cancel(`FIPS "${fipsCode}" is the wrong length for a ${level}.`);
     process.exit(1);
   }
-  const timezone = opts.timezone ?? unwrap4(
-    await p2.text({
+  const timezone = opts.timezone ?? unwrap(
+    await p3.text({
       message: "IANA timezone?",
       defaultValue: "America/Los_Angeles",
       placeholder: "America/Los_Angeles",
@@ -3249,35 +3546,35 @@ var regionCommand = new Command("region").description(
   );
   const dataSources = [];
   do {
-    const url = unwrap4(
-      await p2.text({
+    const url = unwrap(
+      await p3.text({
         message: `Data source #${dataSources.length + 1} \u2014 URL?`,
         placeholder: "https://example.gov/meetings",
         validate: (v) => /^https?:\/\//.test(v ?? "") ? void 0 : "Must start with http(s)://"
       })
     );
-    const dataType = unwrap4(
-      await p2.select({
+    const dataType = unwrap(
+      await p3.select({
         message: "Data type?",
         options: DATA_TYPES.map((t) => ({ value: t, label: t }))
       })
     );
-    const sourceType = unwrap4(
-      await p2.select({
+    const sourceType = unwrap(
+      await p3.select({
         message: "Source type?",
         initialValue: "html_scrape",
         options: SOURCE_TYPES.map((t) => ({ value: t, label: t }))
       })
     );
-    const contentGoal = unwrap4(
-      await p2.text({
+    const contentGoal = unwrap(
+      await p3.text({
         message: "Content goal (what should the scraper extract)?",
         placeholder: "Fetch upcoming board meeting agendas and minutes",
         validate: (v) => v && v.trim().length > 0 ? void 0 : "Required"
       })
     );
-    const category = unwrap4(
-      await p2.text({
+    const category = unwrap(
+      await p3.text({
         message: "Category label (optional)?",
         placeholder: "Board of Supervisors"
       })
@@ -3285,8 +3582,8 @@ var regionCommand = new Command("region").description(
     const src = { url, dataType, sourceType, contentGoal };
     if (category && category.trim().length > 0) src.category = category.trim();
     dataSources.push(src);
-    const again = unwrap4(
-      await p2.confirm({ message: "Add another data source?", initialValue: false })
+    const again = unwrap(
+      await p3.confirm({ message: "Add another data source?", initialValue: false })
     );
     if (!again) break;
   } while (true);
@@ -3309,8 +3606,8 @@ var regionCommand = new Command("region").description(
   const file = buildRegionConfig(input);
   const issues = validateRegionConfig(file);
   if (issues.length > 0) {
-    p2.note(issues.map((i) => `${pc2.red("\u2022")} ${i}`).join("\n"), "Validation failed");
-    p2.cancel("The generated config would not pass the regions repo CI. Re-run and adjust.");
+    p3.note(issues.map((i) => `${pc2.red("\u2022")} ${i}`).join("\n"), "Validation failed");
+    p3.cancel("The generated config would not pass the regions repo CI. Re-run and adjust.");
     process.exit(1);
   }
   const relPath = regionFilePath({
@@ -3322,21 +3619,21 @@ var regionCommand = new Command("region").description(
   const absPath = resolve(targetDir, relPath);
   const json = `${JSON.stringify(file, null, 2)}
 `;
-  p2.note(json, `${relPath} (preview)`);
-  if (!opts.force && await fileExists2(absPath)) {
-    p2.cancel(`${relPath} already exists. Re-run with --force to overwrite.`);
+  p3.note(json, `${relPath} (preview)`);
+  if (!opts.force && await fileExists3(absPath)) {
+    p3.cancel(`${relPath} already exists. Re-run with --force to overwrite.`);
     process.exit(1);
   }
-  const write = unwrap4(
-    await p2.confirm({ message: `Write ${relPath}?`, initialValue: true })
+  const write = unwrap(
+    await p3.confirm({ message: `Write ${relPath}?`, initialValue: true })
   );
   if (!write) {
-    p2.cancel("Nothing written.");
+    p3.cancel("Nothing written.");
     process.exit(0);
   }
   await mkdir(dirname(absPath), { recursive: true });
   await writeFile(absPath, json, "utf8");
-  p2.note(
+  p3.note(
     [
       `${pc2.green("\u2713")} Wrote ${pc2.cyan(relPath)}`,
       "",
@@ -3347,9 +3644,9 @@ var regionCommand = new Command("region").description(
     ].join("\n"),
     "Done"
   );
-  p2.outro(pc2.magenta(`Region scaffolded: ${regionId}`));
+  p3.outro(pc2.magenta(`Region scaffolded: ${regionId}`));
 });
-async function fileExists2(path) {
+async function fileExists3(path) {
   try {
     await access(path);
     return true;
@@ -3359,20 +3656,21 @@ async function fileExists2(path) {
 }
 async function looksLikeRegionsRepo(dir) {
   const [hasSchema, hasRegions] = await Promise.all([
-    fileExists2(join(dir, "schema", "region-plugin.schema.json")),
-    fileExists2(join(dir, "regions"))
+    fileExists3(join(dir, "schema", "region-plugin.schema.json")),
+    fileExists3(join(dir, "regions"))
   ]);
   return hasSchema && hasRegions;
 }
 
 // src/cli.ts
-var VERSION = "0.1.0";
+var VERSION = "0.3.0";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."
 ).version(VERSION, "-v, --version", "show version");
 program.addCommand(initCommand);
 program.addCommand(bootstrapCommand);
+program.addCommand(resetCommand);
 program.addCommand(verifyCommand);
 program.addCommand(regionCommand);
 if (process.argv.length === 2) {