create-op-node 0.10.6 → 0.10.8

package/dist/cli.js

@@ -645,6 +645,37 @@ var initCommand = new Command("init").description(
   ).default(false)
 ).addOption(new Option("-y, --yes", "Skip the final confirmation").default(false)).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node init ")));
+  printWelcomeNote(opts);
+  const region = await resolveRegion(opts);
+  const owner = opts.owner ?? "OpusPopuli";
+  const newRepoName = `opuspopuli-node-${region}`;
+  const newRepoFull = `${owner}/${newRepoName}`;
+  warnIgnoredLocalOnlyFlags(opts);
+  const publicConfig = opts.localOnly ? null : await collectPublicConfig(opts);
+  const ghToken = await resolveGhToken(opts);
+  const keychain = await detectKeychain();
+  printSecretStoreNote(keychain);
+  await confirmPlan({ opts, region, owner, newRepoFull, publicConfig });
+  const created = await createRegionRepo({ opts, ghToken, owner, newRepoName, newRepoFull, region });
+  if (publicConfig) {
+    await seedRepoSecrets({ publicConfig, newRepoFull });
+  }
+  const pr = publicConfig ? await openInfraPr({ opts, ghToken, region, newRepoFull, publicConfig, created }) : null;
+  await persistPgsodiumKey({ keychain, opts, region });
+  if (!publicConfig) {
+    printLocalOnlyOutro({ region, newRepoFull });
+    return;
+  }
+  if (!pr) {
+    throw new Error("init: PR creation step did not run despite publicConfig present");
+  }
+  const proceed = await pauseForMerge({ pr, opts });
+  if (!proceed) return;
+  const tunnelToken = await fetchTunnelToken({ publicConfig });
+  await persistTunnelToken({ keychain, region, tunnelToken });
+  printDoneOutro(region);
+});
+function printWelcomeNote(opts) {
   p3.note(
     opts.localOnly ? [
       "Local-only setup \u2014 creates the region repo from template + a pgsodium key.",
@@ -663,32 +694,30 @@ var initCommand = new Command("init").description(
     ].join("\n"),
     "Welcome"
   );
-  const region = opts.region ? opts.region : unwrap(
+}
+async function resolveRegion(opts) {
+  return opts.region ? opts.region : unwrap(
     await p3.text({
       message: "Short region label (used as the Keychain service suffix + R2 prefix)?",
       placeholder: "us-ca",
       validate: (v) => /^[a-z0-9-]{2,32}$/.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
     })
   );
-  const owner = opts.owner ?? "OpusPopuli";
-  const newRepoName = `opuspopuli-node-${region}`;
-  const newRepoFull = `${owner}/${newRepoName}`;
-  if (opts.localOnly) {
-    const ignored = listIgnoredLocalOnlyFlags(opts);
-    if (ignored.length > 0) {
-      p3.note(
-        pc2.yellow(
-          `\u26A0 The following ${ignored.length === 1 ? "flag is" : "flags are"} ignored with --local-only:
+}
+function warnIgnoredLocalOnlyFlags(opts) {
+  if (!opts.localOnly) return;
+  const ignored = listIgnoredLocalOnlyFlags(opts);
+  if (ignored.length === 0) return;
+  p3.note(
+    pc2.yellow(
+      `\u26A0 The following ${ignored.length === 1 ? "flag is" : "flags are"} ignored with --local-only:
   ${ignored.join(", ")}
-` + pc2.dim(
-            "These configure Cloudflare / TFC / PR-merge flow, which --local-only skips."
-          )
-        ),
-        "Notice"
-      );
-    }
-  }
-  const publicConfig = opts.localOnly ? null : await collectPublicConfig(opts);
+` + pc2.dim("These configure Cloudflare / TFC / PR-merge flow, which --local-only skips.")
+    ),
+    "Notice"
+  );
+}
+async function resolveGhToken(opts) {
   let ghToken = opts.ghToken;
   if (!ghToken) {
     const fromCli = await ghTokenFromCli();
@@ -709,10 +738,15 @@ var initCommand = new Command("init").description(
       "github"
     );
   }
-  const keychain = await detectKeychain();
+  return ghToken;
+}
+function printSecretStoreNote(keychain) {
   const kcNote = keychain.available ? `\u2713 macOS Keychain available \u2014 pgsodium key + Tunnel token will be saved to your login keychain.
 ` + pc2.dim("Note: items don't sync to iCloud Keychain via the security CLI.\n") + pc2.dim("On the Studio, bootstrap will read locally and prompt you to paste if missing.") : `\u26A0 ${keychain.reason ?? "Keychain unavailable"}. Secrets will be printed for manual stash.`;
   p3.note(kcNote, "Secret store");
+}
+async function confirmPlan(args) {
+  const { opts, region, owner, newRepoFull, publicConfig } = args;
   const orgWriteAccess = pc2.dim(`required for ${owner}`);
   p3.note(
     opts.localOnly ? [
@@ -739,20 +773,19 @@ var initCommand = new Command("init").description(
     ].join("\n"),
     "Plan"
   );
-  if (!opts.yes) {
-    const go = unwrap(
-      await p3.confirm({ message: "Proceed?", initialValue: true })
-    );
-    if (!go) {
-      p3.cancel("Cancelled.");
-      process.exit(0);
-    }
+  if (opts.yes) return;
+  const go = unwrap(await p3.confirm({ message: "Proceed?", initialValue: true }));
+  if (!go) {
+    p3.cancel("Cancelled.");
+    process.exit(0);
   }
+}
+async function createRegionRepo(args) {
+  const { opts, ghToken, owner, newRepoName, newRepoFull, region } = args;
   const repoSpin = p3.spinner();
   repoSpin.start(`Creating ${newRepoFull} from ${opts.template}\u2026`);
-  let created;
   try {
-    created = await createRepoFromTemplate({
+    const created = await createRepoFromTemplate({
       token: ghToken,
       template: opts.template ?? "OpusPopuli/opuspopuli-node",
       owner,
@@ -760,6 +793,7 @@ var initCommand = new Command("init").description(
       description: `Opus Populi node deployment for ${region}`
     });
     repoSpin.stop(pc2.green(`\u2713 Created ${created.fullName}`));
+    return { fullName: created.fullName, defaultBranch: created.defaultBranch };
   } catch (err) {
     const status = typeof err === "object" && err !== null && "status" in err ? err.status : 0;
     const message = err.message ?? "unknown error";
@@ -781,154 +815,155 @@ var initCommand = new Command("init").description(
       );
       process.exit(0);
     }
-    created = {
-      fullName: newRepoFull,
-      htmlUrl: `https://github.com/${newRepoFull}`,
-      defaultBranch: "main"
-    };
-  }
-  if (publicConfig) {
-    const secrets = [
-      { name: "CLOUDFLARE_API_TOKEN", value: publicConfig.cfToken },
-      { name: "CLOUDFLARE_ACCOUNT_ID", value: publicConfig.cfAccount },
-      { name: "CLOUDFLARE_ZONE_ID", value: publicConfig.cfZone },
-      { name: "TF_API_TOKEN", value: publicConfig.tfToken },
-      { name: "TF_CLOUD_ORGANIZATION", value: publicConfig.tfOrg }
-    ];
-    const secSpin = p3.spinner();
-    secSpin.start(`Seeding ${secrets.length} repo secrets\u2026`);
-    const seeded = [];
-    for (const s of secrets) {
-      const r = await setRepoSecret({ repo: newRepoFull, name: s.name, value: s.value });
-      if (!r.written) {
-        secSpin.stop(pc2.red(`\u2717 Failed to set ${s.name}: ${r.reason ?? "unknown"}`));
-        const remaining = secrets.slice(secrets.findIndex((x) => x.name === s.name)).map((x) => x.name);
-        p3.cancel(
-          [
-            seeded.length > 0 ? `Already seeded on ${newRepoFull}: ${seeded.join(", ")}.` : `Nothing seeded yet on ${newRepoFull}.`,
-            `Still pending: ${remaining.join(", ")}.`,
-            "",
-            `Make sure \`gh\` is installed and signed in (\`gh auth login\`).`,
-            `Re-run with --use-existing-repo to retry (GitHub will overwrite the already-set secrets idempotently).`
-          ].join("\n")
-        );
-        process.exit(1);
-      }
-      seeded.push(s.name);
-    }
-    secSpin.stop(pc2.green(`\u2713 Seeded ${secrets.length} secrets on ${newRepoFull}`));
+    return { fullName: newRepoFull, defaultBranch: "main" };
   }
-  let pr = null;
-  if (publicConfig) {
-    const branch = `init/region-${region}-${isoStampUtc(/* @__PURE__ */ new Date())}`;
-    const setupSpin = p3.spinner();
-    setupSpin.start(`Writing prod.tfvars on branch ${branch}\u2026`);
-    try {
-      await createBranch({
-        token: ghToken,
-        repo: newRepoFull,
-        branch,
-        fromBranch: created.defaultBranch
-      });
-      const tfvars = renderProdTfvars({
-        project: opts.project ?? "opuspopuli",
-        domain: publicConfig.domain
-      });
-      await commitFile({
-        token: ghToken,
-        repo: newRepoFull,
-        branch,
-        path: "infra/cloudflare/environments/prod.tfvars",
-        content: tfvars,
-        message: `init: prod.tfvars for ${region}`
-      });
-    } catch (err) {
-      setupSpin.stop(pc2.red(`\u2717 Couldn't write tfvars: ${err.message}`));
-      p3.cancel("The repo exists but the branch / commit failed. Open it on GitHub and inspect.");
-      process.exit(1);
-    }
-    setupSpin.stop(pc2.green("\u2713 Wrote prod.tfvars"));
-    const prSpin = p3.spinner();
-    prSpin.start("Opening pull request\u2026");
-    try {
-      pr = await openPullRequest({
-        token: ghToken,
-        repo: newRepoFull,
-        head: branch,
-        base: created.defaultBranch,
-        title: `init: bring up region ${region}`,
-        body: [
-          `Initial region deployment for **${region}** (${publicConfig.domain}).`,
-          "",
-          "Adds `infra/cloudflare/environments/prod.tfvars`. Merging this PR triggers",
-          "`cloudflare-infra.yml` which runs `terraform apply` against the",
-          `\`${publicConfig.tfOrg}\` Terraform Cloud organization, provisioning the Cloudflare`,
-          "Tunnel, DNS records, R2 buckets, and Pages project.",
+}
+async function seedRepoSecrets(args) {
+  const { publicConfig, newRepoFull } = args;
+  const secrets = [
+    { name: "CLOUDFLARE_API_TOKEN", value: publicConfig.cfToken },
+    { name: "CLOUDFLARE_ACCOUNT_ID", value: publicConfig.cfAccount },
+    { name: "CLOUDFLARE_ZONE_ID", value: publicConfig.cfZone },
+    { name: "TF_API_TOKEN", value: publicConfig.tfToken },
+    { name: "TF_CLOUD_ORGANIZATION", value: publicConfig.tfOrg }
+  ];
+  const secSpin = p3.spinner();
+  secSpin.start(`Seeding ${secrets.length} repo secrets\u2026`);
+  const seeded = [];
+  for (const s of secrets) {
+    const r = await setRepoSecret({ repo: newRepoFull, name: s.name, value: s.value });
+    if (!r.written) {
+      secSpin.stop(pc2.red(`\u2717 Failed to set ${s.name}: ${r.reason ?? "unknown"}`));
+      const remaining = secrets.slice(secrets.findIndex((x) => x.name === s.name)).map((x) => x.name);
+      p3.cancel(
+        [
+          seeded.length > 0 ? `Already seeded on ${newRepoFull}: ${seeded.join(", ")}.` : `Nothing seeded yet on ${newRepoFull}.`,
+          `Still pending: ${remaining.join(", ")}.`,
           "",
-          `Generated by \`create-op-node init\`.`
+          `Make sure \`gh\` is installed and signed in (\`gh auth login\`).`,
+          `Re-run with --use-existing-repo to retry (GitHub will overwrite the already-set secrets idempotently).`
         ].join("\n")
-      });
-    } catch (err) {
-      prSpin.stop(pc2.red(`\u2717 Couldn't open PR: ${err.message}`));
-      p3.cancel("Branch + tfvars are committed; open the PR by hand on GitHub.");
+      );
       process.exit(1);
     }
+    seeded.push(s.name);
+  }
+  secSpin.stop(pc2.green(`\u2713 Seeded ${secrets.length} secrets on ${newRepoFull}`));
+}
+async function openInfraPr(args) {
+  const { opts, ghToken, region, newRepoFull, publicConfig, created } = args;
+  const branch = `init/region-${region}-${isoStampUtc(/* @__PURE__ */ new Date())}`;
+  const setupSpin = p3.spinner();
+  setupSpin.start(`Writing prod.tfvars on branch ${branch}\u2026`);
+  try {
+    await createBranch({
+      token: ghToken,
+      repo: newRepoFull,
+      branch,
+      fromBranch: created.defaultBranch
+    });
+    const tfvars = renderProdTfvars({
+      project: opts.project ?? "opuspopuli",
+      domain: publicConfig.domain
+    });
+    await commitFile({
+      token: ghToken,
+      repo: newRepoFull,
+      branch,
+      path: "infra/cloudflare/environments/prod.tfvars",
+      content: tfvars,
+      message: `init: prod.tfvars for ${region}`
+    });
+  } catch (err) {
+    setupSpin.stop(pc2.red(`\u2717 Couldn't write tfvars: ${err.message}`));
+    p3.cancel("The repo exists but the branch / commit failed. Open it on GitHub and inspect.");
+    process.exit(1);
+  }
+  setupSpin.stop(pc2.green("\u2713 Wrote prod.tfvars"));
+  const prSpin = p3.spinner();
+  prSpin.start("Opening pull request\u2026");
+  try {
+    const pr = await openPullRequest({
+      token: ghToken,
+      repo: newRepoFull,
+      head: branch,
+      base: created.defaultBranch,
+      title: `init: bring up region ${region}`,
+      body: [
+        `Initial region deployment for **${region}** (${publicConfig.domain}).`,
+        "",
+        "Adds `infra/cloudflare/environments/prod.tfvars`. Merging this PR triggers",
+        "`cloudflare-infra.yml` which runs `terraform apply` against the",
+        `\`${publicConfig.tfOrg}\` Terraform Cloud organization, provisioning the Cloudflare`,
+        "Tunnel, DNS records, R2 buckets, and Pages project.",
+        "",
+        `Generated by \`create-op-node init\`.`
+      ].join("\n")
+    });
     prSpin.stop(pc2.green(`\u2713 Opened PR #${pr.number}`));
+    return pr;
+  } catch (err) {
+    prSpin.stop(pc2.red(`\u2717 Couldn't open PR: ${err.message}`));
+    p3.cancel("Branch + tfvars are committed; open the PR by hand on GitHub.");
+    process.exit(1);
   }
+}
+async function persistPgsodiumKey(args) {
+  const { keychain, opts, region } = args;
   const pgsodiumCoords = { region, account: "pgsodium-root-key" };
   const keyLabel = `org.opuspopuli.${region}/pgsodium-root-key`;
-  if (keychain.available) {
-    const existing = opts.overwrite ? null : await readSecret(pgsodiumCoords);
-    if (existing && /^[a-f0-9]{64}$/.test(existing)) {
-      p3.note(
-        `${pc2.green("\u2713")} Re-using existing pgsodium master key from Keychain (${pc2.cyan(keyLabel)}). Pass --overwrite to rotate.`,
-        "Secret"
-      );
-    } else {
-      const fresh = generatePgsodiumRootKey();
-      const r = await saveSecret(pgsodiumCoords, fresh);
-      if (r.written) {
-        p3.note(
-          `${pc2.green("\u2713")} pgsodium master key${r.updated ? " rotated" : " saved"} to Keychain as ${pc2.cyan(keyLabel)}.`,
-          "Secret"
-        );
-      } else {
-        await printKeyForManualSave(fresh, keyLabel, r.reason);
-      }
-    }
-  } else {
-    const fresh = generatePgsodiumRootKey();
-    await printKeyForManualSave(fresh, keyLabel);
+  if (!keychain.available) {
+    const fresh2 = generatePgsodiumRootKey();
+    await printKeyForManualSave(fresh2, keyLabel);
+    return;
   }
-  if (!publicConfig) {
-    p3.outro(
-      pc2.cyan(
-        [
-          `Region ${region} provisioned for local-only mode.`,
-          `Repo: https://github.com/${newRepoFull}`,
-          ``,
-          `Next: on the Studio (fresh or otherwise \u2014 bootstrap installs`,
-          `brew packages it needs), run:`,
-          `  npx create-op-node bootstrap --region ${region} --local-only`,
-          ``,
-          `When you're ready to expose publicly, re-run BOTH \`init\` and`,
-          `\`bootstrap\` without --local-only. Same region repo + pgsodium key`,
-          `promote cleanly to the production-shaped deploy.`
-        ].join("\n")
-      )
+  const existing = opts.overwrite ? null : await readSecret(pgsodiumCoords);
+  if (existing && /^[a-f0-9]{64}$/.test(existing)) {
+    p3.note(
+      `${pc2.green("\u2713")} Re-using existing pgsodium master key from Keychain (${pc2.cyan(keyLabel)}). Pass --overwrite to rotate.`,
+      "Secret"
     );
     return;
   }
-  if (!pr) {
-    throw new Error("init: PR creation step did not run despite publicConfig present");
+  const fresh = generatePgsodiumRootKey();
+  const r = await saveSecret(pgsodiumCoords, fresh);
+  if (r.written) {
+    p3.note(
+      `${pc2.green("\u2713")} pgsodium master key${r.updated ? " rotated" : " saved"} to Keychain as ${pc2.cyan(keyLabel)}.`,
+      "Secret"
+    );
+  } else {
+    await printKeyForManualSave(fresh, keyLabel, r.reason);
   }
+}
+function printLocalOnlyOutro(args) {
+  const { region, newRepoFull } = args;
+  p3.outro(
+    pc2.cyan(
+      [
+        `Region ${region} provisioned for local-only mode.`,
+        `Repo: https://github.com/${newRepoFull}`,
+        ``,
+        `Next: on the Studio (fresh or otherwise \u2014 bootstrap installs`,
+        `brew packages it needs), run:`,
+        `  npx create-op-node bootstrap --region ${region} --local-only`,
+        ``,
+        `When you're ready to expose publicly, re-run BOTH \`init\` and`,
+        `\`bootstrap\` without --local-only. Same region repo + pgsodium key`,
+        `promote cleanly to the production-shaped deploy.`
+      ].join("\n")
+    )
+  );
+}
+async function pauseForMerge(args) {
+  const { pr, opts } = args;
   if (opts.skipWait) {
     p3.outro(
       pc2.cyan(
         `Review + merge ${pr.htmlUrl} when ready. Re-run with no --skip-wait or run \`npx create-op-node verify\` afterwards.`
       )
     );
-    return;
+    return false;
   }
   p3.note(
     [
@@ -939,15 +974,17 @@ var initCommand = new Command("init").description(
     ].join("\n"),
     "Next step: review + merge"
   );
-  const merged = unwrap(
-    await p3.confirm({ message: "PR merged?", initialValue: false })
-  );
+  const merged = unwrap(await p3.confirm({ message: "PR merged?", initialValue: false }));
   if (!merged) {
     p3.outro(
       pc2.cyan(`No worries \u2014 re-run \`create-op-node init --skip-wait\` later to skip this step, or finish manually.`)
     );
-    return;
+    return false;
   }
+  return true;
+}
+async function fetchTunnelToken(args) {
+  const { publicConfig } = args;
   const ws = await findWorkspace({
     token: publicConfig.tfToken,
     organization: publicConfig.tfOrg,
@@ -971,27 +1008,33 @@ var initCommand = new Command("init").description(
     );
     process.exit(1);
   }
+  return tunnelToken;
+}
+async function persistTunnelToken(args) {
+  const { keychain, region, tunnelToken } = args;
   const tunnelCoords = { region, account: "tunnel-token" };
   const tunnelLabel = `org.opuspopuli.${region}/tunnel-token`;
-  if (keychain.available) {
-    const r = await saveSecret(tunnelCoords, tunnelToken);
-    if (r.written) {
-      p3.note(
-        `${pc2.green("\u2713")} Tunnel token saved to Keychain as ${pc2.cyan(tunnelLabel)}.`,
-        "Secret"
-      );
-    } else {
-      await printKeyForManualSave(tunnelToken, tunnelLabel, r.reason);
-    }
-  } else {
+  if (!keychain.available) {
     await printKeyForManualSave(tunnelToken, tunnelLabel);
+    return;
+  }
+  const r = await saveSecret(tunnelCoords, tunnelToken);
+  if (r.written) {
+    p3.note(
+      `${pc2.green("\u2713")} Tunnel token saved to Keychain as ${pc2.cyan(tunnelLabel)}.`,
+      "Secret"
+    );
+  } else {
+    await printKeyForManualSave(tunnelToken, tunnelLabel, r.reason);
   }
+}
+function printDoneOutro(region) {
   p3.outro(
     pc2.cyan(
       `Region ${region} is provisioned. Next: \`npx create-op-node bootstrap\` on the Mac Studio.`
     )
   );
-});
+}
 var MIN_TOKEN_LENGTH = {
   cloudflare: 40,
   tfc: 40,
@@ -2041,7 +2084,7 @@ var bootstrapCommand = new Command("bootstrap").description(
 ).addOption(new Option("-y, --yes", "Skip confirmation prompts").default(false)).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node bootstrap ")));
   const nodeType = await selectNodeType(opts);
-  const region = await resolveRegion(opts);
+  const region = await resolveRegion2(opts);
   const owner = opts.owner ?? "OpusPopuli";
   const repoName = `opuspopuli-node-${region}`;
   const composeFile = opts.composeFile ?? defaultComposeFiles(opts);
@@ -2095,7 +2138,7 @@ async function selectNodeType(opts) {
   }
   return nodeType;
 }
-async function resolveRegion(opts) {
+async function resolveRegion2(opts) {
   return opts.region ? opts.region : unwrap(
     await p3.text({
       message: "Region label (the slug used during init \u2014 e.g. us-ca)?",
@@ -2847,87 +2890,89 @@ async function runReset(input, deps = DEFAULT_DEPS) {
     phases.push(ph);
     deps.onPhase?.(ph);
   };
+  push(await resetStopStackPhase(input, deps));
+  push(await resetLaunchAgentPhase(input, deps));
+  push(await resetDockerLogoutPhase(input, deps));
+  return { phases };
+}
+async function resetStopStackPhase(input, deps) {
   if (!input.stack) {
-    push({
+    return {
       name: RESET_PHASES.STOP_STACK,
       status: "skipped",
       detail: "--skip-stack or no repo path resolved"
-    });
-  } else if (input.dryRun) {
-    push({
+    };
+  }
+  if (input.dryRun) {
+    return {
       name: RESET_PHASES.STOP_STACK,
       status: "dry-run",
       detail: `would run: docker compose -f ${input.stack.composeFiles.join(" -f ")} down${input.stack.wipeVolumes ? " -v" : ""}${input.stack.removeOrphans ? " --remove-orphans" : ""}${input.stack.wipeImages ? " --rmi all" : ""}`
-    });
-  } else {
-    const result2 = await deps.composeDown({
-      files: input.stack.composeFiles,
-      cwd: input.stack.repoPath,
-      ...input.stack.envFile ? { envFile: input.stack.envFile } : {},
-      wipeVolumes: input.stack.wipeVolumes,
-      removeOrphans: input.stack.removeOrphans,
-      ...input.stack.wipeImages ? { removeImages: "all" } : {}
-    });
-    if (result2.ok) {
-      const bits = [
-        input.stack.wipeVolumes ? "volumes destroyed" : "containers stopped, volumes preserved",
-        input.stack.wipeImages ? "images removed (next bootstrap will re-pull)" : null
-      ].filter(Boolean);
-      push({
-        name: RESET_PHASES.STOP_STACK,
-        status: "ok",
-        detail: bits.join("; ")
-      });
-    } else {
-      push({ name: RESET_PHASES.STOP_STACK, status: "fail", detail: result2.reason ?? "unknown failure" });
-    }
+    };
   }
+  const result2 = await deps.composeDown({
+    files: input.stack.composeFiles,
+    cwd: input.stack.repoPath,
+    ...input.stack.envFile ? { envFile: input.stack.envFile } : {},
+    wipeVolumes: input.stack.wipeVolumes,
+    removeOrphans: input.stack.removeOrphans,
+    ...input.stack.wipeImages ? { removeImages: "all" } : {}
+  });
+  if (!result2.ok) {
+    return { name: RESET_PHASES.STOP_STACK, status: "fail", detail: result2.reason ?? "unknown failure" };
+  }
+  const bits = [
+    input.stack.wipeVolumes ? "volumes destroyed" : "containers stopped, volumes preserved",
+    input.stack.wipeImages ? "images removed (next bootstrap will re-pull)" : null
+  ].filter(Boolean);
+  return { name: RESET_PHASES.STOP_STACK, status: "ok", detail: bits.join("; ") };
+}
+async function resetLaunchAgentPhase(input, deps) {
   if (!input.launchAgent) {
-    push({ name: RESET_PHASES.LAUNCH_AGENT, status: "skipped", detail: "--skip-launch-agent or no plist found" });
-  } else if (input.dryRun) {
-    push({
+    return { name: RESET_PHASES.LAUNCH_AGENT, status: "skipped", detail: "--skip-launch-agent or no plist found" };
+  }
+  if (input.dryRun) {
+    return {
       name: RESET_PHASES.LAUNCH_AGENT,
       status: "dry-run",
       detail: `would unload ${input.launchAgent.paths.plistFile}, rm plist${input.launchAgent.keepKeyFile ? "" : " + key file"}`
-    });
-  } else {
-    const result2 = await deps.teardownLaunchAgent(
-      input.launchAgent.paths,
-      { keepKeyFile: input.launchAgent.keepKeyFile }
-    );
-    if (result2.ok) {
-      const removed = result2.steps.filter((s) => s.step !== "unload").map((s) => s.step).join(", ");
-      push({ name: RESET_PHASES.LAUNCH_AGENT, status: "ok", detail: `unloaded + ${removed}` });
-    } else {
-      const fail = result2.steps.find((s) => !s.ok);
-      push({
-        name: RESET_PHASES.LAUNCH_AGENT,
-        status: "fail",
-        detail: `${fail?.step}: ${fail?.reason ?? "unknown"}`
-      });
-    }
+    };
   }
+  const result2 = await deps.teardownLaunchAgent(
+    input.launchAgent.paths,
+    { keepKeyFile: input.launchAgent.keepKeyFile }
+  );
+  if (!result2.ok) {
+    const fail = result2.steps.find((s) => !s.ok);
+    return {
+      name: RESET_PHASES.LAUNCH_AGENT,
+      status: "fail",
+      detail: `${fail?.step}: ${fail?.reason ?? "unknown"}`
+    };
+  }
+  const removed = result2.steps.filter((s) => s.step !== "unload").map((s) => s.step).join(", ");
+  return { name: RESET_PHASES.LAUNCH_AGENT, status: "ok", detail: `unloaded + ${removed}` };
+}
+async function resetDockerLogoutPhase(input, deps) {
   if (!input.dockerLogout) {
-    push({ name: RESET_PHASES.DOCKER_LOGOUT, status: "skipped", detail: "--skip-docker-logout" });
-  } else if (input.dryRun) {
-    push({
+    return { name: RESET_PHASES.DOCKER_LOGOUT, status: "skipped", detail: "--skip-docker-logout" };
+  }
+  if (input.dryRun) {
+    return {
       name: RESET_PHASES.DOCKER_LOGOUT,
       status: "dry-run",
       detail: `would run: docker logout ${input.dockerLogout.registry}`
-    });
-  } else {
-    const result2 = await deps.dockerLogout(input.dockerLogout.registry);
-    if (result2.ok) {
-      push({
-        name: RESET_PHASES.DOCKER_LOGOUT,
-        status: "ok",
-        detail: `credentials removed from ${input.dockerLogout.registry}`
-      });
-    } else {
-      push({ name: RESET_PHASES.DOCKER_LOGOUT, status: "warn", detail: result2.reason ?? "unknown" });
-    }
+    };
   }
-  return { phases };
+  const result2 = await deps.dockerLogout(input.dockerLogout.registry);
+  if (result2.ok) {
+    return {
+      name: RESET_PHASES.DOCKER_LOGOUT,
+      status: "ok",
+      detail: `credentials removed from ${input.dockerLogout.registry}`
+    };
+  }
+  return { name: RESET_PHASES.DOCKER_LOGOUT, status: "warn", detail: result2.reason ?? "unknown" };
 }
 async function fileExists2(path) {
   try {
@@ -2983,6 +3028,43 @@ var resetCommand = new Command("reset").description(
   const wipeImages = opts.wipeImages ?? false;
   const wipeData = (opts.wipeData ?? false) || wipeImages;
   const removeOrphans = opts.removeOrphans ?? true;
+  const region = await resolveResetRegion(opts);
+  const owner = opts.owner ?? "OpusPopuli";
+  const repoName = `opuspopuli-node-${region}`;
+  const launchAgentPaths = defaultPaths();
+  const plistExists = await fileExists2(launchAgentPaths.plistFile);
+  const keyFileExists = await fileExists2(launchAgentPaths.keyFile);
+  const { repoPath, stackSkipReason } = await locateResetRepo(opts, owner, repoName);
+  const runningContainers = repoPath ? await composePs({
+    files: resolveComposeFiles(repoPath, opts.composeFile),
+    cwd: repoPath,
+    ...opts.envFile ? { envFile: opts.envFile } : {}
+  }) : null;
+  renderSnapshotNote({
+    region,
+    repoPath,
+    stackSkipReason,
+    runningContainers,
+    plistExists,
+    keyFileExists,
+    launchAgentPaths,
+    opts,
+    wipeData,
+    wipeImages
+  });
+  await confirmReset({ opts, region, wipeData });
+  const input = buildResetInput({
+    opts,
+    repoPath,
+    plistExists,
+    launchAgentPaths,
+    wipeData,
+    wipeImages,
+    removeOrphans
+  });
+  await runResetWithSpinners({ opts, region, wipeData, input });
+});
+async function resolveResetRegion(opts) {
   const region = opts.region ? opts.region : unwrap(
     await p3.text({
       message: "Region label (the slug used during init \u2014 e.g. us-ca)?",
@@ -2994,51 +3076,52 @@ var resetCommand = new Command("reset").description(
     p3.cancel(`--region ${JSON.stringify(region)} is not a valid region slug.`);
     process.exit(2);
   }
-  const owner = opts.owner ?? "OpusPopuli";
-  const repoName = `opuspopuli-node-${region}`;
-  const launchAgentPaths = defaultPaths();
-  const plistExists = await fileExists2(launchAgentPaths.plistFile);
-  const keyFileExists = await fileExists2(launchAgentPaths.keyFile);
-  let repoPath;
-  let stackSkipReason;
-  if (!opts.skipStack) {
-    const located = await locateOrCloneRepo({
-      owner,
-      name: repoName,
-      cwd: process.cwd(),
-      allowClone: false,
-      ...opts.repoDir ? { explicit: opts.repoDir } : {}
-    });
-    switch (located.kind) {
-      case "found":
-        repoPath = located.path;
-        break;
-      case "explicit-not-a-node-repo":
-        p3.cancel(
-          `--repo-dir ${JSON.stringify(located.path)} doesn't look like a node repo (missing one of: ${NODE_REPO_MARKERS.join(", ")}). Verify the path or drop --repo-dir to let reset search the cwd.`
-        );
-        process.exit(2);
-        break;
-      case "clone-disallowed":
-        stackSkipReason = `no checkout found at ${process.cwd()}; pass --repo-dir to target one`;
-        break;
-      case "cloned":
-      case "gh-not-installed":
-      case "clone-failed":
-        stackSkipReason = `unexpected outcome ${located.kind} from locateOrCloneRepo with allowClone=false`;
-        break;
-    }
-  } else {
-    stackSkipReason = "--skip-stack";
-  }
-  let runningContainers = null;
-  if (repoPath) {
-    runningContainers = await composePs({
-      files: resolveComposeFiles(repoPath, opts.composeFile),
-      cwd: repoPath,
-      ...opts.envFile ? { envFile: opts.envFile } : {}
-    });
+  return region;
+}
+async function locateResetRepo(opts, owner, repoName) {
+  if (opts.skipStack) {
+    return { stackSkipReason: "--skip-stack" };
+  }
+  const located = await locateOrCloneRepo({
+    owner,
+    name: repoName,
+    cwd: process.cwd(),
+    allowClone: false,
+    ...opts.repoDir ? { explicit: opts.repoDir } : {}
+  });
+  switch (located.kind) {
+    case "found":
+      return { repoPath: located.path };
+    case "explicit-not-a-node-repo":
+      p3.cancel(
+        `--repo-dir ${JSON.stringify(located.path)} doesn't look like a node repo (missing one of: ${NODE_REPO_MARKERS.join(", ")}). Verify the path or drop --repo-dir to let reset search the cwd.`
+      );
+      return process.exit(2);
+    case "clone-disallowed":
+      return { stackSkipReason: `no checkout found at ${process.cwd()}; pass --repo-dir to target one` };
+    case "cloned":
+    case "gh-not-installed":
+    case "clone-failed":
+      return {
+        stackSkipReason: `unexpected outcome ${located.kind} from locateOrCloneRepo with allowClone=false`
+      };
+    default:
+      return assertNever();
   }
+}
+function renderSnapshotNote(args) {
+  const {
+    region,
+    repoPath,
+    stackSkipReason,
+    runningContainers,
+    plistExists,
+    keyFileExists,
+    launchAgentPaths,
+    opts,
+    wipeData,
+    wipeImages
+  } = args;
   let runningContainersLabel;
   if (runningContainers === null) {
     runningContainersLabel = pc2.dim("unknown");
@@ -3061,6 +3144,9 @@ var resetCommand = new Command("reset").description(
     ].join("\n"),
     "Snapshot"
   );
+}
+async function confirmReset(args) {
+  const { opts, region, wipeData } = args;
   if (wipeData && !opts.dryRun) {
     unwrap(
       await p3.text({
@@ -3068,7 +3154,9 @@ var resetCommand = new Command("reset").description(
         validate: (v) => v === region ? void 0 : `must match the region label exactly`
       })
     );
-  } else if (!opts.dryRun && !opts.yes) {
+    return;
+  }
+  if (!opts.dryRun && !opts.yes) {
     const cont = unwrap(
       await p3.confirm({
         message: "Proceed with reset? (volumes will be preserved)",
@@ -3080,6 +3168,9 @@ var resetCommand = new Command("reset").description(
       process.exit(0);
     }
   }
+}
+function buildResetInput(args) {
+  const { opts, repoPath, plistExists, launchAgentPaths, wipeData, wipeImages, removeOrphans } = args;
   const stack = repoPath ? {
     repoPath,
     composeFiles: resolveComposeFiles(repoPath, opts.composeFile),
@@ -3093,11 +3184,20 @@ var resetCommand = new Command("reset").description(
     keepKeyFile: opts.keepKeyFile ?? false
   } : void 0;
   const dockerLogoutInput = !opts.skipDockerLogout ? { registry: opts.registry ?? GHCR_REGISTRY } : void 0;
+  return {
+    ...stack ? { stack } : {},
+    ...launchAgent ? { launchAgent } : {},
+    ...dockerLogoutInput ? { dockerLogout: dockerLogoutInput } : {},
+    dryRun: opts.dryRun ?? false
+  };
+}
+async function runResetWithSpinners(args) {
+  const { opts, region, wipeData, input } = args;
   const phaseSpins = /* @__PURE__ */ new Map();
   const actingPhases = [];
-  if (stack && !opts.dryRun) actingPhases.push(RESET_PHASES.STOP_STACK);
-  if (launchAgent && !opts.dryRun) actingPhases.push(RESET_PHASES.LAUNCH_AGENT);
-  if (dockerLogoutInput && !opts.dryRun) actingPhases.push(RESET_PHASES.DOCKER_LOGOUT);
+  if (input.stack && !input.dryRun) actingPhases.push(RESET_PHASES.STOP_STACK);
+  if (input.launchAgent && !input.dryRun) actingPhases.push(RESET_PHASES.LAUNCH_AGENT);
+  if (input.dockerLogout && !input.dryRun) actingPhases.push(RESET_PHASES.DOCKER_LOGOUT);
   for (const name of actingPhases) {
     const s = p3.spinner();
     s.start(`${name}\u2026`);
@@ -3113,30 +3213,27 @@ var resetCommand = new Command("reset").description(
       p3.log.info(line);
     }
   };
-  const report = await runReset(
-    {
-      ...stack ? { stack } : {},
-      ...launchAgent ? { launchAgent } : {},
-      ...dockerLogoutInput ? { dockerLogout: dockerLogoutInput } : {},
-      dryRun: opts.dryRun ?? false
-    },
-    { ...DEFAULT_DEPS, onPhase: renderPhase }
-  );
+  const report = await runReset(input, { ...DEFAULT_DEPS, onPhase: renderPhase });
   for (const [, spin] of phaseSpins) spin.stop(pc2.dim("\u2014 skipped"));
+  reportResetOutcome({ report, opts, wipeData, region });
+}
+function reportResetOutcome(args) {
+  const { report, opts, wipeData, region } = args;
   const failed = report.phases.filter((ph) => ph.status === "fail").length;
   if (failed > 0) {
     p3.outro(pc2.red(`${failed} step${failed === 1 ? "" : "s"} failed.`));
     process.exit(1);
-  } else if (opts.dryRun) {
+  }
+  if (opts.dryRun) {
     p3.outro(pc2.cyan("Dry run complete. Re-run without --dry-run to apply."));
-  } else {
-    p3.outro(
-      pc2.green(
-        wipeData ? `Reset complete \u2014 volumes wiped. Re-run \`create-op-node bootstrap --region ${region}\` to start fresh.` : `Reset complete \u2014 volumes preserved. Re-run \`create-op-node bootstrap --region ${region}\` to bring the stack back up.`
-      )
-    );
+    return;
   }
-});
+  p3.outro(
+    pc2.green(
+      wipeData ? `Reset complete \u2014 volumes wiped. Re-run \`create-op-node bootstrap --region ${region}\` to start fresh.` : `Reset complete \u2014 volumes preserved. Re-run \`create-op-node bootstrap --region ${region}\` to bring the stack back up.`
+    )
+  );
+}
 
 // src/lib/cosign.ts
 var COSIGN_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
@@ -4577,7 +4674,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.10.6";
+var VERSION = "0.10.8";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."