create-op-node 0.10.7 → 0.10.9

package/dist/cli.js

@@ -2890,87 +2890,89 @@ async function runReset(input, deps = DEFAULT_DEPS) {
     phases.push(ph);
     deps.onPhase?.(ph);
   };
+  push(await resetStopStackPhase(input, deps));
+  push(await resetLaunchAgentPhase(input, deps));
+  push(await resetDockerLogoutPhase(input, deps));
+  return { phases };
+}
+async function resetStopStackPhase(input, deps) {
   if (!input.stack) {
-    push({
+    return {
       name: RESET_PHASES.STOP_STACK,
       status: "skipped",
       detail: "--skip-stack or no repo path resolved"
-    });
-  } else if (input.dryRun) {
-    push({
+    };
+  }
+  if (input.dryRun) {
+    return {
       name: RESET_PHASES.STOP_STACK,
       status: "dry-run",
       detail: `would run: docker compose -f ${input.stack.composeFiles.join(" -f ")} down${input.stack.wipeVolumes ? " -v" : ""}${input.stack.removeOrphans ? " --remove-orphans" : ""}${input.stack.wipeImages ? " --rmi all" : ""}`
-    });
-  } else {
-    const result2 = await deps.composeDown({
-      files: input.stack.composeFiles,
-      cwd: input.stack.repoPath,
-      ...input.stack.envFile ? { envFile: input.stack.envFile } : {},
-      wipeVolumes: input.stack.wipeVolumes,
-      removeOrphans: input.stack.removeOrphans,
-      ...input.stack.wipeImages ? { removeImages: "all" } : {}
-    });
-    if (result2.ok) {
-      const bits = [
-        input.stack.wipeVolumes ? "volumes destroyed" : "containers stopped, volumes preserved",
-        input.stack.wipeImages ? "images removed (next bootstrap will re-pull)" : null
-      ].filter(Boolean);
-      push({
-        name: RESET_PHASES.STOP_STACK,
-        status: "ok",
-        detail: bits.join("; ")
-      });
-    } else {
-      push({ name: RESET_PHASES.STOP_STACK, status: "fail", detail: result2.reason ?? "unknown failure" });
-    }
+    };
   }
+  const result2 = await deps.composeDown({
+    files: input.stack.composeFiles,
+    cwd: input.stack.repoPath,
+    ...input.stack.envFile ? { envFile: input.stack.envFile } : {},
+    wipeVolumes: input.stack.wipeVolumes,
+    removeOrphans: input.stack.removeOrphans,
+    ...input.stack.wipeImages ? { removeImages: "all" } : {}
+  });
+  if (!result2.ok) {
+    return { name: RESET_PHASES.STOP_STACK, status: "fail", detail: result2.reason ?? "unknown failure" };
+  }
+  const bits = [
+    input.stack.wipeVolumes ? "volumes destroyed" : "containers stopped, volumes preserved",
+    input.stack.wipeImages ? "images removed (next bootstrap will re-pull)" : null
+  ].filter(Boolean);
+  return { name: RESET_PHASES.STOP_STACK, status: "ok", detail: bits.join("; ") };
+}
+async function resetLaunchAgentPhase(input, deps) {
   if (!input.launchAgent) {
-    push({ name: RESET_PHASES.LAUNCH_AGENT, status: "skipped", detail: "--skip-launch-agent or no plist found" });
-  } else if (input.dryRun) {
-    push({
+    return { name: RESET_PHASES.LAUNCH_AGENT, status: "skipped", detail: "--skip-launch-agent or no plist found" };
+  }
+  if (input.dryRun) {
+    return {
       name: RESET_PHASES.LAUNCH_AGENT,
       status: "dry-run",
       detail: `would unload ${input.launchAgent.paths.plistFile}, rm plist${input.launchAgent.keepKeyFile ? "" : " + key file"}`
-    });
-  } else {
-    const result2 = await deps.teardownLaunchAgent(
-      input.launchAgent.paths,
-      { keepKeyFile: input.launchAgent.keepKeyFile }
-    );
-    if (result2.ok) {
-      const removed = result2.steps.filter((s) => s.step !== "unload").map((s) => s.step).join(", ");
-      push({ name: RESET_PHASES.LAUNCH_AGENT, status: "ok", detail: `unloaded + ${removed}` });
-    } else {
-      const fail = result2.steps.find((s) => !s.ok);
-      push({
-        name: RESET_PHASES.LAUNCH_AGENT,
-        status: "fail",
-        detail: `${fail?.step}: ${fail?.reason ?? "unknown"}`
-      });
-    }
+    };
+  }
+  const result2 = await deps.teardownLaunchAgent(
+    input.launchAgent.paths,
+    { keepKeyFile: input.launchAgent.keepKeyFile }
+  );
+  if (!result2.ok) {
+    const fail = result2.steps.find((s) => !s.ok);
+    return {
+      name: RESET_PHASES.LAUNCH_AGENT,
+      status: "fail",
+      detail: `${fail?.step}: ${fail?.reason ?? "unknown"}`
+    };
   }
+  const removed = result2.steps.filter((s) => s.step !== "unload").map((s) => s.step).join(", ");
+  return { name: RESET_PHASES.LAUNCH_AGENT, status: "ok", detail: `unloaded + ${removed}` };
+}
+async function resetDockerLogoutPhase(input, deps) {
   if (!input.dockerLogout) {
-    push({ name: RESET_PHASES.DOCKER_LOGOUT, status: "skipped", detail: "--skip-docker-logout" });
-  } else if (input.dryRun) {
-    push({
+    return { name: RESET_PHASES.DOCKER_LOGOUT, status: "skipped", detail: "--skip-docker-logout" };
+  }
+  if (input.dryRun) {
+    return {
       name: RESET_PHASES.DOCKER_LOGOUT,
       status: "dry-run",
       detail: `would run: docker logout ${input.dockerLogout.registry}`
-    });
-  } else {
-    const result2 = await deps.dockerLogout(input.dockerLogout.registry);
-    if (result2.ok) {
-      push({
-        name: RESET_PHASES.DOCKER_LOGOUT,
-        status: "ok",
-        detail: `credentials removed from ${input.dockerLogout.registry}`
-      });
-    } else {
-      push({ name: RESET_PHASES.DOCKER_LOGOUT, status: "warn", detail: result2.reason ?? "unknown" });
-    }
+    };
   }
-  return { phases };
+  const result2 = await deps.dockerLogout(input.dockerLogout.registry);
+  if (result2.ok) {
+    return {
+      name: RESET_PHASES.DOCKER_LOGOUT,
+      status: "ok",
+      detail: `credentials removed from ${input.dockerLogout.registry}`
+    };
+  }
+  return { name: RESET_PHASES.DOCKER_LOGOUT, status: "warn", detail: result2.reason ?? "unknown" };
 }
 async function fileExists2(path) {
   try {
@@ -3026,6 +3028,43 @@ var resetCommand = new Command("reset").description(
   const wipeImages = opts.wipeImages ?? false;
   const wipeData = (opts.wipeData ?? false) || wipeImages;
   const removeOrphans = opts.removeOrphans ?? true;
+  const region = await resolveResetRegion(opts);
+  const owner = opts.owner ?? "OpusPopuli";
+  const repoName = `opuspopuli-node-${region}`;
+  const launchAgentPaths = defaultPaths();
+  const plistExists = await fileExists2(launchAgentPaths.plistFile);
+  const keyFileExists = await fileExists2(launchAgentPaths.keyFile);
+  const { repoPath, stackSkipReason } = await locateResetRepo(opts, owner, repoName);
+  const runningContainers = repoPath ? await composePs({
+    files: resolveComposeFiles(repoPath, opts.composeFile),
+    cwd: repoPath,
+    ...opts.envFile ? { envFile: opts.envFile } : {}
+  }) : null;
+  renderSnapshotNote({
+    region,
+    repoPath,
+    stackSkipReason,
+    runningContainers,
+    plistExists,
+    keyFileExists,
+    launchAgentPaths,
+    opts,
+    wipeData,
+    wipeImages
+  });
+  await confirmReset({ opts, region, wipeData });
+  const input = buildResetInput({
+    opts,
+    repoPath,
+    plistExists,
+    launchAgentPaths,
+    wipeData,
+    wipeImages,
+    removeOrphans
+  });
+  await runResetWithSpinners({ opts, region, wipeData, input });
+});
+async function resolveResetRegion(opts) {
   const region = opts.region ? opts.region : unwrap(
     await p3.text({
       message: "Region label (the slug used during init \u2014 e.g. us-ca)?",
@@ -3037,51 +3076,52 @@ var resetCommand = new Command("reset").description(
     p3.cancel(`--region ${JSON.stringify(region)} is not a valid region slug.`);
     process.exit(2);
   }
-  const owner = opts.owner ?? "OpusPopuli";
-  const repoName = `opuspopuli-node-${region}`;
-  const launchAgentPaths = defaultPaths();
-  const plistExists = await fileExists2(launchAgentPaths.plistFile);
-  const keyFileExists = await fileExists2(launchAgentPaths.keyFile);
-  let repoPath;
-  let stackSkipReason;
-  if (!opts.skipStack) {
-    const located = await locateOrCloneRepo({
-      owner,
-      name: repoName,
-      cwd: process.cwd(),
-      allowClone: false,
-      ...opts.repoDir ? { explicit: opts.repoDir } : {}
-    });
-    switch (located.kind) {
-      case "found":
-        repoPath = located.path;
-        break;
-      case "explicit-not-a-node-repo":
-        p3.cancel(
-          `--repo-dir ${JSON.stringify(located.path)} doesn't look like a node repo (missing one of: ${NODE_REPO_MARKERS.join(", ")}). Verify the path or drop --repo-dir to let reset search the cwd.`
-        );
-        process.exit(2);
-        break;
-      case "clone-disallowed":
-        stackSkipReason = `no checkout found at ${process.cwd()}; pass --repo-dir to target one`;
-        break;
-      case "cloned":
-      case "gh-not-installed":
-      case "clone-failed":
-        stackSkipReason = `unexpected outcome ${located.kind} from locateOrCloneRepo with allowClone=false`;
-        break;
-    }
-  } else {
-    stackSkipReason = "--skip-stack";
-  }
-  let runningContainers = null;
-  if (repoPath) {
-    runningContainers = await composePs({
-      files: resolveComposeFiles(repoPath, opts.composeFile),
-      cwd: repoPath,
-      ...opts.envFile ? { envFile: opts.envFile } : {}
-    });
+  return region;
+}
+async function locateResetRepo(opts, owner, repoName) {
+  if (opts.skipStack) {
+    return { stackSkipReason: "--skip-stack" };
   }
+  const located = await locateOrCloneRepo({
+    owner,
+    name: repoName,
+    cwd: process.cwd(),
+    allowClone: false,
+    ...opts.repoDir ? { explicit: opts.repoDir } : {}
+  });
+  switch (located.kind) {
+    case "found":
+      return { repoPath: located.path };
+    case "explicit-not-a-node-repo":
+      p3.cancel(
+        `--repo-dir ${JSON.stringify(located.path)} doesn't look like a node repo (missing one of: ${NODE_REPO_MARKERS.join(", ")}). Verify the path or drop --repo-dir to let reset search the cwd.`
+      );
+      return process.exit(2);
+    case "clone-disallowed":
+      return { stackSkipReason: `no checkout found at ${process.cwd()}; pass --repo-dir to target one` };
+    case "cloned":
+    case "gh-not-installed":
+    case "clone-failed":
+      return {
+        stackSkipReason: `unexpected outcome ${located.kind} from locateOrCloneRepo with allowClone=false`
+      };
+    default:
+      return assertNever();
+  }
+}
+function renderSnapshotNote(args) {
+  const {
+    region,
+    repoPath,
+    stackSkipReason,
+    runningContainers,
+    plistExists,
+    keyFileExists,
+    launchAgentPaths,
+    opts,
+    wipeData,
+    wipeImages
+  } = args;
   let runningContainersLabel;
   if (runningContainers === null) {
     runningContainersLabel = pc2.dim("unknown");
@@ -3104,6 +3144,9 @@ var resetCommand = new Command("reset").description(
     ].join("\n"),
     "Snapshot"
   );
+}
+async function confirmReset(args) {
+  const { opts, region, wipeData } = args;
   if (wipeData && !opts.dryRun) {
     unwrap(
       await p3.text({
@@ -3111,7 +3154,9 @@ var resetCommand = new Command("reset").description(
         validate: (v) => v === region ? void 0 : `must match the region label exactly`
       })
     );
-  } else if (!opts.dryRun && !opts.yes) {
+    return;
+  }
+  if (!opts.dryRun && !opts.yes) {
     const cont = unwrap(
       await p3.confirm({
         message: "Proceed with reset? (volumes will be preserved)",
@@ -3123,6 +3168,9 @@ var resetCommand = new Command("reset").description(
       process.exit(0);
     }
   }
+}
+function buildResetInput(args) {
+  const { opts, repoPath, plistExists, launchAgentPaths, wipeData, wipeImages, removeOrphans } = args;
   const stack = repoPath ? {
     repoPath,
     composeFiles: resolveComposeFiles(repoPath, opts.composeFile),
@@ -3136,11 +3184,20 @@ var resetCommand = new Command("reset").description(
     keepKeyFile: opts.keepKeyFile ?? false
   } : void 0;
   const dockerLogoutInput = !opts.skipDockerLogout ? { registry: opts.registry ?? GHCR_REGISTRY } : void 0;
+  return {
+    ...stack ? { stack } : {},
+    ...launchAgent ? { launchAgent } : {},
+    ...dockerLogoutInput ? { dockerLogout: dockerLogoutInput } : {},
+    dryRun: opts.dryRun ?? false
+  };
+}
+async function runResetWithSpinners(args) {
+  const { opts, region, wipeData, input } = args;
   const phaseSpins = /* @__PURE__ */ new Map();
   const actingPhases = [];
-  if (stack && !opts.dryRun) actingPhases.push(RESET_PHASES.STOP_STACK);
-  if (launchAgent && !opts.dryRun) actingPhases.push(RESET_PHASES.LAUNCH_AGENT);
-  if (dockerLogoutInput && !opts.dryRun) actingPhases.push(RESET_PHASES.DOCKER_LOGOUT);
+  if (input.stack && !input.dryRun) actingPhases.push(RESET_PHASES.STOP_STACK);
+  if (input.launchAgent && !input.dryRun) actingPhases.push(RESET_PHASES.LAUNCH_AGENT);
+  if (input.dockerLogout && !input.dryRun) actingPhases.push(RESET_PHASES.DOCKER_LOGOUT);
   for (const name of actingPhases) {
     const s = p3.spinner();
     s.start(`${name}\u2026`);
@@ -3156,30 +3213,27 @@ var resetCommand = new Command("reset").description(
       p3.log.info(line);
     }
   };
-  const report = await runReset(
-    {
-      ...stack ? { stack } : {},
-      ...launchAgent ? { launchAgent } : {},
-      ...dockerLogoutInput ? { dockerLogout: dockerLogoutInput } : {},
-      dryRun: opts.dryRun ?? false
-    },
-    { ...DEFAULT_DEPS, onPhase: renderPhase }
-  );
+  const report = await runReset(input, { ...DEFAULT_DEPS, onPhase: renderPhase });
   for (const [, spin] of phaseSpins) spin.stop(pc2.dim("\u2014 skipped"));
+  reportResetOutcome({ report, opts, wipeData, region });
+}
+function reportResetOutcome(args) {
+  const { report, opts, wipeData, region } = args;
   const failed = report.phases.filter((ph) => ph.status === "fail").length;
   if (failed > 0) {
     p3.outro(pc2.red(`${failed} step${failed === 1 ? "" : "s"} failed.`));
     process.exit(1);
-  } else if (opts.dryRun) {
+  }
+  if (opts.dryRun) {
     p3.outro(pc2.cyan("Dry run complete. Re-run without --dry-run to apply."));
-  } else {
-    p3.outro(
-      pc2.green(
-        wipeData ? `Reset complete \u2014 volumes wiped. Re-run \`create-op-node bootstrap --region ${region}\` to start fresh.` : `Reset complete \u2014 volumes preserved. Re-run \`create-op-node bootstrap --region ${region}\` to bring the stack back up.`
-      )
-    );
+    return;
   }
-});
+  p3.outro(
+    pc2.green(
+      wipeData ? `Reset complete \u2014 volumes wiped. Re-run \`create-op-node bootstrap --region ${region}\` to start fresh.` : `Reset complete \u2014 volumes preserved. Re-run \`create-op-node bootstrap --region ${region}\` to bring the stack back up.`
+    )
+  );
+}
 
 // src/lib/cosign.ts
 var COSIGN_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
@@ -3374,36 +3428,47 @@ async function runVerify(input, deps = DEFAULT_DEPS2) {
     phases.push(ph);
     deps.onPhase?.(ph);
   };
+  await verifyTlsPhase(input, deps, push);
+  await verifyHealthPhase(input, deps, push);
+  await verifyGraphqlPhase(input, deps, push);
+  await verifyCloudflarePhase(input, deps, push);
+  await verifyCosignPhase(input, deps, push);
+  return { phases };
+}
+async function verifyTlsPhase(input, deps, push) {
   const tls2 = await deps.tls({ host: input.apiHost });
   if (!tls2.ok) {
     push({ name: "TLS handshake", status: "fail", detail: tls2.reason });
-  } else {
-    const line = `subject=${tls2.subject}, issuer=${tls2.issuer}, ${formatExpiry(tls2.daysToExpiry)}`;
-    const warn = tls2.daysToExpiry < input.certWarnDays;
-    if (warn) {
-      push({
-        name: "TLS handshake",
-        status: "warn",
-        detail: tls2.daysToExpiry < 0 ? line : `${line} (< warn threshold ${input.certWarnDays}d)`
-      });
-    } else {
-      push({ name: "TLS handshake", status: "ok", detail: line });
-    }
+    return;
+  }
+  const line = `subject=${tls2.subject}, issuer=${tls2.issuer}, ${formatExpiry(tls2.daysToExpiry)}`;
+  if (tls2.daysToExpiry < input.certWarnDays) {
+    push({
+      name: "TLS handshake",
+      status: "warn",
+      detail: tls2.daysToExpiry < 0 ? line : `${line} (< warn threshold ${input.certWarnDays}d)`
+    });
+    return;
   }
-  const healthUrl = `https://${input.apiHost}/health`;
-  const health = await deps.http({ url: healthUrl });
+  push({ name: "TLS handshake", status: "ok", detail: line });
+}
+async function verifyHealthPhase(input, deps, push) {
+  const health = await deps.http({ url: `https://${input.apiHost}/health` });
   if (health.ok) {
     push({ name: "GET /health", status: "ok", detail: `HTTP ${health.status}` });
   } else {
     push({ name: "GET /health", status: "fail", detail: health.reason });
   }
-  const gqlUrl = `https://${input.apiHost}/api`;
-  const gql = await deps.graphql({ url: gqlUrl });
+}
+async function verifyGraphqlPhase(input, deps, push) {
+  const gql = await deps.graphql({ url: `https://${input.apiHost}/api` });
   if (gql.ok) {
     push({ name: "GraphQL { __typename }", status: "ok", detail: `typename=${gql.typename}` });
   } else {
     push({ name: "GraphQL { __typename }", status: "fail", detail: gql.reason });
   }
+}
+async function verifyCloudflarePhase(input, deps, push) {
   const cfFields = [
     ["--cf-token", input.cf?.token],
     ["--cf-account-id", input.cf?.accountId],
@@ -3416,54 +3481,57 @@ async function runVerify(input, deps = DEFAULT_DEPS2) {
       status: "skipped",
       detail: "pass --cf-token + --cf-account-id + --tunnel-id to enable"
     });
-  } else if (cfSet.length < cfFields.length) {
+    return;
+  }
+  if (cfSet.length < cfFields.length) {
     const missing = cfFields.filter(([, v]) => v === void 0 || v === "").map(([name]) => name).join(", ");
     push({
       name: "Cloudflare Tunnel",
       status: "warn",
       detail: `partial CF config \u2014 missing ${missing}; check skipped`
     });
+    return;
+  }
+  const tun = await deps.tunnel({
+    token: input.cf.token,
+    accountId: input.cf.accountId,
+    tunnelId: input.cf.tunnelId
+  });
+  if (!tun.ok) {
+    push({ name: "Cloudflare Tunnel", status: "fail", detail: tun.reason });
+  } else if (tun.connections === 0) {
+    push({
+      name: "Cloudflare Tunnel",
+      status: "warn",
+      detail: `status=${tun.status}, 0 connections \u2014 cloudflared on the Studio appears offline`
+    });
   } else {
-    const tun = await deps.tunnel({
-      token: input.cf.token,
-      accountId: input.cf.accountId,
-      tunnelId: input.cf.tunnelId
+    push({
+      name: "Cloudflare Tunnel",
+      status: "ok",
+      detail: `${tun.connections} connections, status=${tun.status}`
     });
-    if (!tun.ok) {
-      push({ name: "Cloudflare Tunnel", status: "fail", detail: tun.reason });
-    } else if (tun.connections === 0) {
-      push({
-        name: "Cloudflare Tunnel",
-        status: "warn",
-        detail: `status=${tun.status}, 0 connections \u2014 cloudflared on the Studio appears offline`
-      });
-    } else {
-      push({
-        name: "Cloudflare Tunnel",
-        status: "ok",
-        detail: `${tun.connections} connections, status=${tun.status}`
-      });
-    }
   }
+}
+async function verifyCosignPhase(input, deps, push) {
   if (input.images.length === 0) {
     push({
       name: "cosign verify",
       status: "skipped",
       detail: "pass --image <ref> (repeatable) to enable"
     });
-  } else {
-    for (const image of input.images) {
-      const cos = await deps.cosign({ image });
-      if (cos.ok) {
-        push({ name: `cosign verify ${image}`, status: "ok", detail: "signature valid" });
-      } else if (cos.skipped) {
-        push({ name: `cosign verify ${image}`, status: "skipped", detail: cos.reason });
-      } else {
-        push({ name: `cosign verify ${image}`, status: "fail", detail: cos.reason });
-      }
+    return;
+  }
+  for (const image of input.images) {
+    const cos = await deps.cosign({ image });
+    if (cos.ok) {
+      push({ name: `cosign verify ${image}`, status: "ok", detail: "signature valid" });
+    } else if (cos.skipped) {
+      push({ name: `cosign verify ${image}`, status: "skipped", detail: cos.reason });
+    } else {
+      push({ name: `cosign verify ${image}`, status: "fail", detail: cos.reason });
     }
   }
-  return { phases };
 }
 function readTokenFile(path) {
   const raw = readFileSync(path, "utf8").trim();
@@ -3488,6 +3556,53 @@ var verifyCommand = new Command("verify").description(
   new Option("--show-skipped", "Include skipped phases in the summary").default(false)
 ).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node verify ")));
+  const domain = await resolveDomain(opts);
+  const certWarnDays = resolveCertWarnDays(opts);
+  const cfToken = resolveCfToken(opts);
+  const apiHost = opts.apiHost ?? `api.${domain}`;
+  const images = opts.image ?? [];
+  const totalPhases = 4 + (images.length === 0 ? 1 : images.length);
+  const report = await runVerifyWithSpinner({
+    apiHost,
+    certWarnDays,
+    cfToken,
+    opts,
+    images,
+    totalPhases
+  });
+  renderVerifySummary(report, { opts, totalPhases });
+  reportVerifyOutcome(report);
+});
+function phaseIcon2(ph) {
+  switch (ph.status) {
+    case "ok":
+      return pc2.green("\u2713");
+    case "warn":
+      return pc2.yellow("\u26A0");
+    case "skipped":
+      return pc2.dim("\xB7");
+    case "fail":
+      return pc2.red("\u2717");
+  }
+}
+function phaseColor(status) {
+  switch (status) {
+    case "ok":
+      return pc2.green;
+    case "warn":
+      return pc2.yellow;
+    case "skipped":
+      return pc2.dim;
+    case "fail":
+      return pc2.red;
+  }
+}
+function formatPhaseLine(prefix, ph) {
+  const icon = phaseIcon2(ph);
+  const colorize = phaseColor(ph.status);
+  return colorize(`${icon} ${prefix}: ${ph.detail}`);
+}
+async function resolveDomain(opts) {
   const domain = opts.domain ? opts.domain : unwrap(
     await p3.text({
       message: "Public domain of the node?",
@@ -3499,28 +3614,33 @@ var verifyCommand = new Command("verify").description(
     p3.cancel(`--domain ${JSON.stringify(domain)} doesn't look like a domain.`);
     process.exit(2);
   }
+  return domain;
+}
+function resolveCertWarnDays(opts) {
   const rawDays = opts.certWarnDays ?? "14";
   const certWarnDays = Number.parseInt(rawDays, 10);
   if (!Number.isFinite(certWarnDays) || certWarnDays < 0 || !/^\d+$/.test(rawDays)) {
     p3.cancel(`--cert-warn-days must be a non-negative integer (got ${JSON.stringify(rawDays)}).`);
     process.exit(2);
   }
+  return certWarnDays;
+}
+function resolveCfToken(opts) {
   if (opts.cfToken && opts.cfTokenFile) {
     p3.cancel("Pass either --cf-token or --cf-token-file, not both.");
     process.exit(2);
   }
-  let cfToken = opts.cfToken;
-  if (!cfToken && opts.cfTokenFile) {
-    try {
-      cfToken = readTokenFile(opts.cfTokenFile);
-    } catch (err) {
-      p3.cancel(err.message);
-      process.exit(2);
-    }
+  if (opts.cfToken) return opts.cfToken;
+  if (!opts.cfTokenFile) return void 0;
+  try {
+    return readTokenFile(opts.cfTokenFile);
+  } catch (err) {
+    p3.cancel(err.message);
+    process.exit(2);
   }
-  const apiHost = opts.apiHost ?? `api.${domain}`;
-  const images = opts.image ?? [];
-  const totalPhases = 4 + (images.length === 0 ? 1 : images.length);
+}
+async function runVerifyWithSpinner(args) {
+  const { apiHost, certWarnDays, cfToken, opts, images, totalPhases } = args;
   let phaseIndex = 0;
   let activeSpin = null;
   const renderPhase = (ph) => {
@@ -3529,10 +3649,7 @@ var verifyCommand = new Command("verify").description(
     activeSpin?.stop(formatPhaseLine(prefix, ph));
     activeSpin = null;
   };
-  const deps = {
-    ...DEFAULT_DEPS2,
-    onPhase: renderPhase
-  };
+  const deps = { ...DEFAULT_DEPS2, onPhase: renderPhase };
   activeSpin = p3.spinner();
   activeSpin.start("Running checks\u2026");
   const report = await runVerify(
@@ -3549,6 +3666,10 @@ var verifyCommand = new Command("verify").description(
     deps
   );
   activeSpin?.stop("Done.");
+  return report;
+}
+function renderVerifySummary(report, args) {
+  const { opts, totalPhases } = args;
   const visible = opts.showSkipped ?? false ? report.phases : report.phases.filter((ph) => ph.status !== "skipped");
   const lines = visible.map((ph) => {
     const idx = report.phases.indexOf(ph) + 1;
@@ -3559,47 +3680,19 @@ var verifyCommand = new Command("verify").description(
     lines.push(pc2.dim(`\xB7 ${skippedCount} phase${skippedCount === 1 ? "" : "s"} skipped (run with --show-skipped to see them)`));
   }
   p3.note(lines.join("\n"), "Summary");
+}
+function reportVerifyOutcome(report) {
   const summary = summarize(report);
-  if (summary.ok) {
-    if (summary.warned === 0) {
-      p3.outro(pc2.green("All checks passed."));
-    } else {
-      p3.outro(pc2.yellow(`Passed with ${summary.warned} warning${summary.warned === 1 ? "" : "s"}.`));
-    }
-  } else {
+  if (!summary.ok) {
     p3.outro(pc2.red(`${summary.failed} check${summary.failed === 1 ? "" : "s"} failed.`));
     process.exit(1);
   }
-});
-function phaseIcon2(ph) {
-  switch (ph.status) {
-    case "ok":
-      return pc2.green("\u2713");
-    case "warn":
-      return pc2.yellow("\u26A0");
-    case "skipped":
-      return pc2.dim("\xB7");
-    case "fail":
-      return pc2.red("\u2717");
-  }
-}
-function phaseColor(status) {
-  switch (status) {
-    case "ok":
-      return pc2.green;
-    case "warn":
-      return pc2.yellow;
-    case "skipped":
-      return pc2.dim;
-    case "fail":
-      return pc2.red;
+  if (summary.warned === 0) {
+    p3.outro(pc2.green("All checks passed."));
+  } else {
+    p3.outro(pc2.yellow(`Passed with ${summary.warned} warning${summary.warned === 1 ? "" : "s"}.`));
   }
 }
-function formatPhaseLine(prefix, ph) {
-  const icon = phaseIcon2(ph);
-  const colorize = phaseColor(ph.status);
-  return colorize(`${icon} ${prefix}: ${ph.detail}`);
-}
 
 // src/lib/region-schema.json
 var region_schema_default = {
@@ -4620,7 +4713,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.10.7";
+var VERSION = "0.10.9";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."