create-op-node 0.10.5 → 0.10.6

package/dist/cli.js

@@ -1989,6 +1989,10 @@ async function locateOrCloneRepo(input) {
   return { kind: "cloned", path: target };
 }
 
+// src/lib/assert.ts
+function assertNever(_value) {
+}
+
 // src/commands/bootstrap.ts
 var PUBLIC_PROFILES = ["public"];
 var LOCAL_PROFILES = [];
@@ -2036,6 +2040,33 @@ var bootstrapCommand = new Command("bootstrap").description(
   ).default(false)
 ).addOption(new Option("-y, --yes", "Skip confirmation prompts").default(false)).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node bootstrap ")));
+  const nodeType = await selectNodeType(opts);
+  const region = await resolveRegion(opts);
+  const owner = opts.owner ?? "OpusPopuli";
+  const repoName = `opuspopuli-node-${region}`;
+  const composeFile = opts.composeFile ?? defaultComposeFiles(opts);
+  const llmModelChoice = opts.llmModel ?? await selectLlmModel(opts);
+  const [embeddingModel, llmModel] = resolveModels({
+    llmModel: llmModelChoice,
+    ...opts.embeddingModel !== void 0 ? { embeddingModel: opts.embeddingModel } : {}
+  });
+  await runSystemChecksPhase();
+  await runBrewPhase(opts);
+  await ensureGhAuth();
+  await promptTailscaleSignin();
+  const repoPath = await locateRegionRepoPhase(opts, owner, repoName);
+  await unlockKeychainPhase();
+  const secrets = await collectSecretsPhase({ region, nodeType, opts });
+  await runLaunchAgentPhase({ opts, secrets, llmModel, embeddingModel });
+  await installWrapperPhase({ repoPath, region, promptServiceUrl: secrets.promptServiceUrl });
+  await loginGhcrPhase();
+  await runOllamaPhase({ opts, embeddingModel, llmModel });
+  await runStackPhase({ opts, repoPath, region, composeFile, secrets, llmModel, embeddingModel });
+});
+function defaultComposeFiles(opts) {
+  return opts.localOnly ? ["docker-compose-prod.yml"] : ["docker-compose-prod.yml", "docker-compose-backup.yml"];
+}
+async function selectNodeType(opts) {
   const nodeType = opts.nodeType ? opts.nodeType : unwrap(
     await p3.select({
       message: "What kind of node are you provisioning?",
@@ -2062,22 +2093,18 @@ var bootstrapCommand = new Command("bootstrap").description(
     );
     process.exit(1);
   }
-  const region = opts.region ? opts.region : unwrap(
+  return nodeType;
+}
+async function resolveRegion(opts) {
+  return opts.region ? opts.region : unwrap(
     await p3.text({
       message: "Region label (the slug used during init \u2014 e.g. us-ca)?",
       placeholder: "us-ca",
       validate: (v) => /^[a-z0-9-]{2,32}$/.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
     })
   );
-  const owner = opts.owner ?? "OpusPopuli";
-  const repoName = `opuspopuli-node-${region}`;
-  const composeFileDefault = opts.localOnly ? ["docker-compose-prod.yml"] : ["docker-compose-prod.yml", "docker-compose-backup.yml"];
-  const composeFile = opts.composeFile ?? composeFileDefault;
-  const llmModelChoice = opts.llmModel ?? await selectLlmModel(opts);
-  const [embeddingModel, llmModel] = resolveModels({
-    llmModel: llmModelChoice,
-    ...opts.embeddingModel !== void 0 ? { embeddingModel: opts.embeddingModel } : {}
-  });
+}
+async function runSystemChecksPhase() {
   const sysSpin = p3.spinner();
   sysSpin.start("Inspecting macOS\u2026");
   const snap = await inspectSystem();
@@ -2122,54 +2149,55 @@ var bootstrapCommand = new Command("bootstrap").description(
       if (!r.ok) p3.note(`${pc2.red("\u2717")} ${r.reason}`, "pmset failed");
     }
   }
-  if (!opts.skipBrew) {
-    const brewInfo = await detectBrew();
-    if (!brewInfo.installed) {
-      p3.note(
-        [
-          `Homebrew is not installed. Open another shell and run:`,
-          "",
-          pc2.cyan(HOMEBREW_INSTALL_COMMAND),
-          "",
-          pc2.dim("Then come back and press Enter.")
-        ].join("\n"),
-        "Manual step"
-      );
-      unwrap(await p3.confirm({ message: "Homebrew installed?", initialValue: true }));
-    }
-    const brewSpin = p3.spinner();
-    brewSpin.start("Installing Studio packages\u2026 (~5\u201315 min first run)");
-    const report = await installPackages(STUDIO_PACKAGES, (pkg, status) => {
-      brewSpin.message(`${status}: ${pkg.name}`);
-    });
-    brewSpin.stop(
-      report.failed.length === 0 ? pc2.green(
-        `\u2713 ${report.installed.length} installed, ${report.alreadyPresent.length} already present`
-      ) : pc2.yellow(
-        `\u26A0 ${report.installed.length} installed, ${report.alreadyPresent.length} present, ${report.failed.length} failed`
-      )
+}
+async function runBrewPhase(opts) {
+  if (opts.skipBrew) return;
+  const brewInfo = await detectBrew();
+  if (!brewInfo.installed) {
+    p3.note(
+      [
+        `Homebrew is not installed. Open another shell and run:`,
+        "",
+        pc2.cyan(HOMEBREW_INSTALL_COMMAND),
+        "",
+        pc2.dim("Then come back and press Enter.")
+      ].join("\n"),
+      "Manual step"
     );
-    if (report.failed.length > 0) {
-      p3.note(
-        [
-          report.failed.map((f) => `${pc2.red("\u2022")} ${f.pkg.name}: ${f.reason}`).join("\n"),
-          "",
-          pc2.dim("A partial install usually fails downstream (Docker / Ollama / compose)."),
-          pc2.dim("Install the failed packages manually and re-run with --skip-brew.")
-        ].join("\n"),
-        "Brew failures"
-      );
-      const cont = unwrap(
-        await p3.confirm({
-          message: "Continue anyway? (Default no \u2014 recommended to fix and re-run.)",
-          initialValue: false
-        })
-      );
-      if (!cont) process.exit(1);
-    }
+    unwrap(await p3.confirm({ message: "Homebrew installed?", initialValue: true }));
   }
-  await ensureGhAuth();
-  await promptTailscaleSignin();
+  const brewSpin = p3.spinner();
+  brewSpin.start("Installing Studio packages\u2026 (~5\u201315 min first run)");
+  const report = await installPackages(STUDIO_PACKAGES, (pkg, status) => {
+    brewSpin.message(`${status}: ${pkg.name}`);
+  });
+  brewSpin.stop(
+    report.failed.length === 0 ? pc2.green(
+      `\u2713 ${report.installed.length} installed, ${report.alreadyPresent.length} already present`
+    ) : pc2.yellow(
+      `\u26A0 ${report.installed.length} installed, ${report.alreadyPresent.length} present, ${report.failed.length} failed`
+    )
+  );
+  if (report.failed.length > 0) {
+    p3.note(
+      [
+        report.failed.map((f) => `${pc2.red("\u2022")} ${f.pkg.name}: ${f.reason}`).join("\n"),
+        "",
+        pc2.dim("A partial install usually fails downstream (Docker / Ollama / compose)."),
+        pc2.dim("Install the failed packages manually and re-run with --skip-brew.")
+      ].join("\n"),
+      "Brew failures"
+    );
+    const cont = unwrap(
+      await p3.confirm({
+        message: "Continue anyway? (Default no \u2014 recommended to fix and re-run.)",
+        initialValue: false
+      })
+    );
+    if (!cont) process.exit(1);
+  }
+}
+async function locateRegionRepoPhase(opts, owner, repoName) {
   const repoSpin = p3.spinner();
   repoSpin.start("Locating your region node repo\u2026");
   const located = await locateOrCloneRepo({
@@ -2187,6 +2215,9 @@ var bootstrapCommand = new Command("bootstrap").description(
   repoSpin.stop(
     located.kind === "cloned" ? pc2.green(`\u2713 Cloned ${owner}/${repoName} to ${repoPath}`) : pc2.green(`\u2713 Found region repo at ${repoPath}`)
   );
+  return repoPath;
+}
+async function unlockKeychainPhase() {
   const keychain = await detectKeychain();
   if (!keychain.available) {
     p3.cancel(
@@ -2219,6 +2250,9 @@ var bootstrapCommand = new Command("bootstrap").description(
     }
     p3.note(`${pc2.green("\u2713")} Keychain unlocked for this session.`, "Keychain");
   }
+}
+async function collectCoreSecrets(args) {
+  const { region, opts } = args;
   const pgsodiumKey = await loadSecret({
     region,
     account: "pgsodium-root-key",
@@ -2272,6 +2306,18 @@ var bootstrapCommand = new Command("bootstrap").description(
     validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
     generate: generateDashboardPassword
   });
+  return {
+    pgsodiumKey,
+    tunnelToken,
+    postgresPassword,
+    jwtSecret,
+    supabaseAnonKey,
+    supabaseServiceRoleKey,
+    dashboardPassword
+  };
+}
+async function collectPromptServiceSecrets(args) {
+  const { region, nodeType, opts } = args;
   if (nodeType === "region-with-prompts") {
     await loadSecret({
       region,
@@ -2315,6 +2361,9 @@ var bootstrapCommand = new Command("bootstrap").description(
     );
     process.exit(1);
   }
+  return promptServiceUrl;
+}
+async function resolveSupabaseUrl(opts) {
   let supabaseUrl;
   if (opts.supabaseUrl) {
     supabaseUrl = opts.supabaseUrl;
@@ -2338,32 +2387,44 @@ var bootstrapCommand = new Command("bootstrap").description(
     );
     process.exit(1);
   }
-  if (!opts.skipLaunchAgent) {
-    const laSpin = p3.spinner();
-    laSpin.start("Writing pgsodium key file + LaunchAgent plist\u2026");
-    const la = await setupLaunchAgent({
-      pgsodiumKey,
-      ...tunnelToken !== void 0 ? { tunnelToken } : {},
-      llmModel,
-      embeddingModel,
-      postgresPassword,
-      jwtSecret,
-      supabaseAnonKey,
-      supabaseServiceRoleKey,
-      dashboardPassword,
-      supabaseUrl
-    });
-    if (!la.ok) {
-      laSpin.stop(pc2.red(`\u2717 LaunchAgent step ${la.step} failed.`));
-      p3.cancel(la.reason ?? "LaunchAgent setup failed.");
-      process.exit(1);
-    }
-    laSpin.stop(
-      pc2.green(
-        `\u2713 LaunchAgent loaded (${la.paths.plistFile})${opts.localOnly ? " \u2014 local-only mode, no TUNNEL_TOKEN set" : ""}.`
-      )
-    );
+  return supabaseUrl;
+}
+async function collectSecretsPhase(args) {
+  const core = await collectCoreSecrets({ region: args.region, opts: args.opts });
+  const promptServiceUrl = await collectPromptServiceSecrets(args);
+  const supabaseUrl = await resolveSupabaseUrl(args.opts);
+  return { ...core, promptServiceUrl, supabaseUrl };
+}
+async function runLaunchAgentPhase(args) {
+  const { opts, secrets, llmModel, embeddingModel } = args;
+  if (opts.skipLaunchAgent) return;
+  const laSpin = p3.spinner();
+  laSpin.start("Writing pgsodium key file + LaunchAgent plist\u2026");
+  const la = await setupLaunchAgent({
+    pgsodiumKey: secrets.pgsodiumKey,
+    ...secrets.tunnelToken !== void 0 ? { tunnelToken: secrets.tunnelToken } : {},
+    llmModel,
+    embeddingModel,
+    postgresPassword: secrets.postgresPassword,
+    jwtSecret: secrets.jwtSecret,
+    supabaseAnonKey: secrets.supabaseAnonKey,
+    supabaseServiceRoleKey: secrets.supabaseServiceRoleKey,
+    dashboardPassword: secrets.dashboardPassword,
+    supabaseUrl: secrets.supabaseUrl
+  });
+  if (!la.ok) {
+    laSpin.stop(pc2.red(`\u2717 LaunchAgent step ${la.step} failed.`));
+    p3.cancel(la.reason ?? "LaunchAgent setup failed.");
+    process.exit(1);
   }
+  laSpin.stop(
+    pc2.green(
+      `\u2713 LaunchAgent loaded (${la.paths.plistFile})${opts.localOnly ? " \u2014 local-only mode, no TUNNEL_TOKEN set" : ""}.`
+    )
+  );
+}
+async function installWrapperPhase(args) {
+  const { repoPath, region, promptServiceUrl } = args;
   const wrapperSpin = p3.spinner();
   wrapperSpin.start("Installing bin/op-compose wrapper\u2026");
   const wrapper = await installOpComposeWrapper({ repoDir: repoPath, region, promptServiceUrl });
@@ -2373,6 +2434,8 @@ var bootstrapCommand = new Command("bootstrap").description(
     process.exit(1);
   }
   wrapperSpin.stop(pc2.green(`\u2713 Installed ${wrapper.path} (mode 0755).`));
+}
+async function loginGhcrPhase() {
   const ghcrSpin = p3.spinner();
   ghcrSpin.start("Authenticating Docker to ghcr.io\u2026");
   const ghcr = await loginToGhcr();
@@ -2382,45 +2445,66 @@ var bootstrapCommand = new Command("bootstrap").description(
     process.exit(1);
   }
   ghcrSpin.stop(pc2.green("\u2713 Logged in to ghcr.io."));
-  if (!opts.skipOllama) {
-    const olSpin = p3.spinner();
-    olSpin.start(`Pulling + warming Ollama models\u2026 (${estimatedPullTime(llmModel)})`);
-    let olHealth = await checkOllamaHealth();
-    if (!olHealth.reachable) {
-      olSpin.message("Ollama not reachable \u2014 running `brew services start ollama`\u2026");
-      const start = await startOllamaService();
-      if (!start.ok) {
-        olSpin.stop(pc2.red("\u2717 Couldn't start Ollama service."));
-        p3.cancel(
-          `${start.reason ?? "unknown"} \u2014 start it manually with \`brew services start ollama\` and re-run with --skip-brew --skip-launch-agent.`
-        );
-        process.exit(1);
-      }
-      await new Promise((res) => setTimeout(res, 3e3));
-      olHealth = await checkOllamaHealth();
-      if (!olHealth.reachable) {
-        olSpin.stop(
-          pc2.yellow("\u26A0 Ollama service started but daemon not yet answering on :11434.")
-        );
-        p3.cancel(
-          "Give it another few seconds, then re-run with --skip-brew --skip-launch-agent."
-        );
-        process.exit(1);
-      }
+}
+async function runOllamaPhase(args) {
+  const { opts, embeddingModel, llmModel } = args;
+  if (opts.skipOllama) return;
+  const olSpin = p3.spinner();
+  olSpin.start(`Pulling + warming Ollama models\u2026 (${estimatedPullTime(llmModel)})`);
+  let olHealth = await checkOllamaHealth();
+  if (!olHealth.reachable) {
+    olSpin.message("Ollama not reachable \u2014 running `brew services start ollama`\u2026");
+    const start = await startOllamaService();
+    if (!start.ok) {
+      olSpin.stop(pc2.red("\u2717 Couldn't start Ollama service."));
+      p3.cancel(
+        `${start.reason ?? "unknown"} \u2014 start it manually with \`brew services start ollama\` and re-run with --skip-brew --skip-launch-agent.`
+      );
+      process.exit(1);
     }
-    const modelReport = await setupModels([embeddingModel, llmModel], (model, status) => {
-      olSpin.message(`${status}: ${model}`);
-    });
-    olSpin.stop(
-      modelReport.failed.length === 0 ? pc2.green(
-        `\u2713 ${modelReport.pulled.length} pulled, ${modelReport.alreadyPresent.length} present, ${modelReport.warmed.length} warmed`
-      ) : pc2.yellow(`\u26A0 ${modelReport.failed.length} model pull(s) failed`)
-    );
-    const probe = await probeHostDockerInternal();
-    if (!probe.ok) {
-      p3.note(`${pc2.yellow("\u26A0")} ${probe.reason}`, "Docker host networking");
+    await new Promise((res) => setTimeout(res, 3e3));
+    olHealth = await checkOllamaHealth();
+    if (!olHealth.reachable) {
+      olSpin.stop(
+        pc2.yellow("\u26A0 Ollama service started but daemon not yet answering on :11434.")
+      );
+      p3.cancel(
+        "Give it another few seconds, then re-run with --skip-brew --skip-launch-agent."
+      );
+      process.exit(1);
     }
   }
+  const modelReport = await setupModels([embeddingModel, llmModel], (model, status) => {
+    olSpin.message(`${status}: ${model}`);
+  });
+  olSpin.stop(
+    modelReport.failed.length === 0 ? pc2.green(
+      `\u2713 ${modelReport.pulled.length} pulled, ${modelReport.alreadyPresent.length} present, ${modelReport.warmed.length} warmed`
+    ) : pc2.yellow(`\u26A0 ${modelReport.failed.length} model pull(s) failed`)
+  );
+  const probe = await probeHostDockerInternal();
+  if (!probe.ok) {
+    p3.note(`${pc2.yellow("\u26A0")} ${probe.reason}`, "Docker host networking");
+  }
+}
+function buildComposeEnv(args) {
+  const { secrets, llmModel, embeddingModel } = args;
+  return {
+    PGSODIUM_ROOT_KEY: secrets.pgsodiumKey,
+    POSTGRES_PASSWORD: secrets.postgresPassword,
+    JWT_SECRET: secrets.jwtSecret,
+    SUPABASE_ANON_KEY: secrets.supabaseAnonKey,
+    SUPABASE_SERVICE_ROLE_KEY: secrets.supabaseServiceRoleKey,
+    DASHBOARD_PASSWORD: secrets.dashboardPassword,
+    SUPABASE_URL: secrets.supabaseUrl,
+    AUTH_JWT_SECRET: process.env["AUTH_JWT_SECRET"] ?? secrets.jwtSecret,
+    ...secrets.tunnelToken !== void 0 ? { TUNNEL_TOKEN: secrets.tunnelToken } : {},
+    ...llmModel ? { LLM_MODEL: llmModel } : {},
+    ...embeddingModel ? { EMBEDDINGS_MODEL: embeddingModel } : {}
+  };
+}
+async function runStackPhase(args) {
+  const { opts, repoPath, region, composeFile, secrets, llmModel, embeddingModel } = args;
   if (opts.skipStack) {
     const profileFlag = opts.localOnly ? "" : "--profile public ";
     p3.outro(
@@ -2431,19 +2515,7 @@ var bootstrapCommand = new Command("bootstrap").description(
     return;
   }
   const composeFiles = resolveComposeFiles(repoPath, composeFile);
-  const composeEnv = {
-    PGSODIUM_ROOT_KEY: pgsodiumKey,
-    POSTGRES_PASSWORD: postgresPassword,
-    JWT_SECRET: jwtSecret,
-    SUPABASE_ANON_KEY: supabaseAnonKey,
-    SUPABASE_SERVICE_ROLE_KEY: supabaseServiceRoleKey,
-    DASHBOARD_PASSWORD: dashboardPassword,
-    SUPABASE_URL: supabaseUrl,
-    AUTH_JWT_SECRET: process.env["AUTH_JWT_SECRET"] ?? jwtSecret,
-    ...tunnelToken !== void 0 ? { TUNNEL_TOKEN: tunnelToken } : {},
-    ...llmModel ? { LLM_MODEL: llmModel } : {},
-    ...embeddingModel ? { EMBEDDINGS_MODEL: embeddingModel } : {}
-  };
+  const composeEnv = buildComposeEnv({ secrets, llmModel, embeddingModel });
   const composeOpts = {
     files: composeFiles,
     cwd: repoPath,
@@ -2489,9 +2561,25 @@ var bootstrapCommand = new Command("bootstrap").description(
       healthSpin.message(`${healthy}/${running} healthy`);
     }
   });
+  healthSpin.stop(healthOutcomeHeadline(outcome));
+  finishHealthOutcome(outcome, { region, opts, composeFiles });
+}
+function healthOutcomeHeadline(outcome) {
+  switch (outcome.kind) {
+    case "healthy":
+      return pc2.green(`\u2713 All ${outcome.snapshots.length} containers healthy.`);
+    case "unhealthy":
+      return pc2.red(`\u2717 ${outcome.problem}`);
+    case "timeout":
+      return pc2.yellow("\u26A0 Timed out waiting for all containers to report healthy.");
+    default:
+      return assertNever();
+  }
+}
+function finishHealthOutcome(outcome, args) {
+  const { region, opts, composeFiles } = args;
   switch (outcome.kind) {
     case "healthy":
-      healthSpin.stop(pc2.green(`\u2713 All ${outcome.snapshots.length} containers healthy.`));
       if (opts.localOnly) {
         p3.outro(
           pc2.cyan(
@@ -2511,7 +2599,6 @@ var bootstrapCommand = new Command("bootstrap").description(
       }
       return;
     case "unhealthy":
-      healthSpin.stop(pc2.red(`\u2717 ${outcome.problem}`));
       p3.note(
         outcome.snapshots.map((s) => `  ${kvHealth(s.health)} ${s.name} (${s.state})`).join("\n"),
         "Container state"
@@ -2522,7 +2609,6 @@ var bootstrapCommand = new Command("bootstrap").description(
       process.exit(1);
     // eslint-disable-next-line no-fallthrough
     case "timeout":
-      healthSpin.stop(pc2.yellow("\u26A0 Timed out waiting for all containers to report healthy."));
       p3.note(
         outcome.snapshots.map((s) => `  ${kvHealth(s.health)} ${s.name} (${s.state})`).join("\n"),
         "Container state at timeout"
@@ -2532,11 +2618,10 @@ var bootstrapCommand = new Command("bootstrap").description(
       );
       process.exit(1);
     // eslint-disable-next-line no-fallthrough
-    default: {
+    default:
       return;
-    }
   }
-});
+}
 function resolveComposeFiles(repoPath, composeFile) {
   const inputs = composeFile ?? ["docker-compose-prod.yml"];
   return inputs.map((f) => f.startsWith("/") ? f : join(repoPath, f));
@@ -4492,7 +4577,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.10.5";
+var VERSION = "0.10.6";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."