create-op-node 0.10.8 → 0.10.10

package/dist/cli.js

@@ -577,22 +577,26 @@ var realDeps = {
 async function waitForApply(input, budgets = DEFAULT_BUDGETS, deps = realDeps) {
   let runId = input.runId;
   if (!runId) {
-    deps.onProgress?.("discovery");
-    const discoveryStart = deps.now();
-    while (deps.now() - discoveryStart < budgets.discoveryMs) {
-      await deps.sleep(budgets.pollMs);
-      const ws = await deps.findWorkspace({
-        token: input.token,
-        organization: input.organization,
-        tags: input.workspaceTags
-      });
-      if (ws?.currentRunId) {
-        runId = ws.currentRunId;
-        break;
-      }
-    }
+    runId = await discoverRunId(input, budgets, deps);
     if (!runId) return { kind: "no-run-started" };
   }
+  return waitForRunOutput(input, budgets, deps, runId);
+}
+async function discoverRunId(input, budgets, deps) {
+  deps.onProgress?.("discovery");
+  const discoveryStart = deps.now();
+  while (deps.now() - discoveryStart < budgets.discoveryMs) {
+    await deps.sleep(budgets.pollMs);
+    const ws = await deps.findWorkspace({
+      token: input.token,
+      organization: input.organization,
+      tags: input.workspaceTags
+    });
+    if (ws?.currentRunId) return ws.currentRunId;
+  }
+  return null;
+}
+async function waitForRunOutput(input, budgets, deps, runId) {
   deps.onProgress?.("run");
   const runStart = deps.now();
   while (deps.now() - runStart < budgets.runMs) {
@@ -1351,6 +1355,27 @@ async function writePgsodiumKeyFile(key, keyFile) {
 }
 var MODEL_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/;
 function renderLaunchAgentPlist(input) {
+  validatePlistInput(input);
+  const command = buildSetenvCommand(input);
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    `  <key>Label</key><string>${LAUNCH_AGENT_LABEL}</string>`,
+    "  <key>ProgramArguments</key>",
+    "  <array>",
+    "    <string>/bin/sh</string>",
+    "    <string>-c</string>",
+    `    <string>${command}</string>`,
+    "  </array>",
+    "  <key>RunAtLoad</key><true/>",
+    "</dict>",
+    "</plist>",
+    ""
+  ].join("\n");
+}
+function validatePlistInput(input) {
   if (input.tunnelToken !== void 0 && !TUNNEL_TOKEN_RE.test(input.tunnelToken)) {
     throw new Error("Tunnel token contains characters outside the expected base64-url set");
   }
@@ -1378,9 +1403,7 @@ function renderLaunchAgentPlist(input) {
   ];
   for (const [name, value] of supabaseFields) {
     if (value !== void 0 && !SAFE_LAUNCHCTL_VALUE_RE.test(value)) {
-      throw new Error(
-        `${String(name)} contains characters not allowed in a launchd setenv value`
-      );
+      throw new Error(`${String(name)} contains characters not allowed in a launchd setenv value`);
     }
   }
   if (input.supabaseUrl !== void 0 && !SAFE_URL_RE.test(input.supabaseUrl)) {
@@ -1388,7 +1411,9 @@ function renderLaunchAgentPlist(input) {
       `supabaseUrl ${JSON.stringify(input.supabaseUrl)} contains characters not allowed in a launchd setenv value`
     );
   }
-  const setenvLines = [
+}
+function buildSetenvCommand(input) {
+  return [
     `launchctl setenv PGSODIUM_ROOT_KEY "$(cat ${input.keyFilePath})"`,
     ...input.tunnelToken !== void 0 ? [`launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`] : [],
     ...input.llmModel !== void 0 ? [`launchctl setenv LLM_MODEL "${input.llmModel}"`] : [],
@@ -1399,25 +1424,7 @@ function renderLaunchAgentPlist(input) {
     ...input.supabaseServiceRoleKey !== void 0 ? [`launchctl setenv SUPABASE_SERVICE_ROLE_KEY "${input.supabaseServiceRoleKey}"`] : [],
     ...input.dashboardPassword !== void 0 ? [`launchctl setenv DASHBOARD_PASSWORD "${input.dashboardPassword}"`] : [],
     ...input.supabaseUrl !== void 0 ? [`launchctl setenv SUPABASE_URL "${input.supabaseUrl}"`] : []
-  ];
-  const command = setenvLines.join("; ");
-  return [
-    '<?xml version="1.0" encoding="UTF-8"?>',
-    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
-    '<plist version="1.0">',
-    "<dict>",
-    `  <key>Label</key><string>${LAUNCH_AGENT_LABEL}</string>`,
-    "  <key>ProgramArguments</key>",
-    "  <array>",
-    "    <string>/bin/sh</string>",
-    "    <string>-c</string>",
-    `    <string>${command}</string>`,
-    "  </array>",
-    "  <key>RunAtLoad</key><true/>",
-    "</dict>",
-    "</plist>",
-    ""
-  ].join("\n");
+  ].join("; ");
 }
 async function writeLaunchAgentPlist(plistFile, content) {
   try {
@@ -1443,6 +1450,20 @@ async function loadLaunchAgent(plistFile) {
   }
   return { ok: true };
 }
+function plistInputFromSetup(input, keyFilePath) {
+  return {
+    keyFilePath,
+    ...input.tunnelToken !== void 0 ? { tunnelToken: input.tunnelToken } : {},
+    ...input.llmModel !== void 0 ? { llmModel: input.llmModel } : {},
+    ...input.embeddingModel !== void 0 ? { embeddingModel: input.embeddingModel } : {},
+    ...input.postgresPassword !== void 0 ? { postgresPassword: input.postgresPassword } : {},
+    ...input.jwtSecret !== void 0 ? { jwtSecret: input.jwtSecret } : {},
+    ...input.supabaseAnonKey !== void 0 ? { supabaseAnonKey: input.supabaseAnonKey } : {},
+    ...input.supabaseServiceRoleKey !== void 0 ? { supabaseServiceRoleKey: input.supabaseServiceRoleKey } : {},
+    ...input.dashboardPassword !== void 0 ? { dashboardPassword: input.dashboardPassword } : {},
+    ...input.supabaseUrl !== void 0 ? { supabaseUrl: input.supabaseUrl } : {}
+  };
+}
 async function setupLaunchAgent(input) {
   const paths = input.paths ?? defaultPaths();
   const keyResult = await writePgsodiumKeyFile(input.pgsodiumKey, paths.keyFile);
@@ -1451,18 +1472,7 @@ async function setupLaunchAgent(input) {
   }
   let plistContent;
   try {
-    plistContent = renderLaunchAgentPlist({
-      keyFilePath: paths.keyFile,
-      ...input.tunnelToken !== void 0 ? { tunnelToken: input.tunnelToken } : {},
-      ...input.llmModel !== void 0 ? { llmModel: input.llmModel } : {},
-      ...input.embeddingModel !== void 0 ? { embeddingModel: input.embeddingModel } : {},
-      ...input.postgresPassword !== void 0 ? { postgresPassword: input.postgresPassword } : {},
-      ...input.jwtSecret !== void 0 ? { jwtSecret: input.jwtSecret } : {},
-      ...input.supabaseAnonKey !== void 0 ? { supabaseAnonKey: input.supabaseAnonKey } : {},
-      ...input.supabaseServiceRoleKey !== void 0 ? { supabaseServiceRoleKey: input.supabaseServiceRoleKey } : {},
-      ...input.dashboardPassword !== void 0 ? { dashboardPassword: input.dashboardPassword } : {},
-      ...input.supabaseUrl !== void 0 ? { supabaseUrl: input.supabaseUrl } : {}
-    });
+    plistContent = renderLaunchAgentPlist(plistInputFromSetup(input, paths.keyFile));
   } catch (err) {
     return { ok: false, paths, step: "plist", reason: err.message };
   }
@@ -1812,6 +1822,15 @@ var realWaitDeps = {
   sleep: (ms) => new Promise((res) => setTimeout(res, ms)),
   now: () => Date.now()
 };
+function terminalOutcome(ps, requireHealthy) {
+  if (ps.length === 0) return null;
+  const verdict = assessHealth(ps, requireHealthy);
+  if (verdict.kind === "healthy") return { kind: "healthy", snapshots: ps };
+  if (verdict.kind === "unhealthy") {
+    return { kind: "unhealthy", snapshots: ps, problem: verdict.problem ?? "unhealthy" };
+  }
+  return null;
+}
 async function waitForHealthy(composeOpts, options = {}, deps = realWaitDeps) {
   const timeoutMs = options.timeoutMs ?? 5 * 60 * 1e3;
   const basePollMs = options.pollMs ?? 5 * 1e3;
@@ -1824,17 +1843,8 @@ async function waitForHealthy(composeOpts, options = {}, deps = realWaitDeps) {
     if (ps !== null) {
       last = ps;
       options.onPoll?.(ps);
-      if (ps.length > 0) {
-        const verdict = assessHealth(ps, options.requireHealthy);
-        if (verdict.kind === "healthy") return { kind: "healthy", snapshots: ps };
-        if (verdict.kind === "unhealthy") {
-          return {
-            kind: "unhealthy",
-            snapshots: ps,
-            problem: verdict.problem ?? "unhealthy"
-          };
-        }
-      }
+      const outcome = terminalOutcome(ps, options.requireHealthy);
+      if (outcome) return outcome;
     }
     const interval = pollCount < 3 ? basePollMs : basePollMs * 2;
     await deps.sleep(interval);
@@ -1842,6 +1852,12 @@ async function waitForHealthy(composeOpts, options = {}, deps = realWaitDeps) {
   return { kind: "timeout", snapshots: last };
 }
 function assessHealth(snapshots, requireHealthy) {
+  const hard = firstHardFailure(snapshots);
+  if (hard) return hard;
+  const required = requireHealthy ?? [];
+  return required.length > 0 ? assessRequired(snapshots, required) : assessAllRunning(snapshots);
+}
+function firstHardFailure(snapshots) {
   for (const s of snapshots) {
     if (s.health === "unhealthy") {
       return { kind: "unhealthy", problem: `${s.name} reports unhealthy` };
@@ -1850,21 +1866,23 @@ function assessHealth(snapshots, requireHealthy) {
       return { kind: "unhealthy", problem: `${s.name} exited with code ${s.exitCode}` };
     }
   }
-  const required = requireHealthy ?? [];
-  if (required.length > 0) {
-    const byName = new Map(snapshots.map((s) => [s.name, s]));
-    for (const name of required) {
-      const s = byName.get(name);
-      if (!s) return { kind: "pending" };
-      if (s.state === "exited" && s.exitCode === 0) continue;
-      if (s.state !== "running") return { kind: "pending" };
-      if (s.health === "starting") return { kind: "pending" };
-      if (s.health === "unhealthy") {
-        return { kind: "unhealthy", problem: `${s.name} reports unhealthy` };
-      }
+  return null;
+}
+function assessRequired(snapshots, required) {
+  const byName = new Map(snapshots.map((s) => [s.name, s]));
+  for (const name of required) {
+    const s = byName.get(name);
+    if (!s) return { kind: "pending" };
+    if (s.state === "exited" && s.exitCode === 0) continue;
+    if (s.state !== "running") return { kind: "pending" };
+    if (s.health === "starting") return { kind: "pending" };
+    if (s.health === "unhealthy") {
+      return { kind: "unhealthy", problem: `${s.name} reports unhealthy` };
     }
-    return { kind: "healthy" };
   }
+  return { kind: "healthy" };
+}
+function assessAllRunning(snapshots) {
   for (const s of snapshots) {
     if (s.state === "exited" && s.exitCode === 0) continue;
     if (s.state !== "running") return { kind: "pending" };
@@ -3428,36 +3446,47 @@ async function runVerify(input, deps = DEFAULT_DEPS2) {
     phases.push(ph);
     deps.onPhase?.(ph);
   };
+  await verifyTlsPhase(input, deps, push);
+  await verifyHealthPhase(input, deps, push);
+  await verifyGraphqlPhase(input, deps, push);
+  await verifyCloudflarePhase(input, deps, push);
+  await verifyCosignPhase(input, deps, push);
+  return { phases };
+}
+async function verifyTlsPhase(input, deps, push) {
   const tls2 = await deps.tls({ host: input.apiHost });
   if (!tls2.ok) {
     push({ name: "TLS handshake", status: "fail", detail: tls2.reason });
-  } else {
-    const line = `subject=${tls2.subject}, issuer=${tls2.issuer}, ${formatExpiry(tls2.daysToExpiry)}`;
-    const warn = tls2.daysToExpiry < input.certWarnDays;
-    if (warn) {
-      push({
-        name: "TLS handshake",
-        status: "warn",
-        detail: tls2.daysToExpiry < 0 ? line : `${line} (< warn threshold ${input.certWarnDays}d)`
-      });
-    } else {
-      push({ name: "TLS handshake", status: "ok", detail: line });
-    }
+    return;
+  }
+  const line = `subject=${tls2.subject}, issuer=${tls2.issuer}, ${formatExpiry(tls2.daysToExpiry)}`;
+  if (tls2.daysToExpiry < input.certWarnDays) {
+    push({
+      name: "TLS handshake",
+      status: "warn",
+      detail: tls2.daysToExpiry < 0 ? line : `${line} (< warn threshold ${input.certWarnDays}d)`
+    });
+    return;
   }
-  const healthUrl = `https://${input.apiHost}/health`;
-  const health = await deps.http({ url: healthUrl });
+  push({ name: "TLS handshake", status: "ok", detail: line });
+}
+async function verifyHealthPhase(input, deps, push) {
+  const health = await deps.http({ url: `https://${input.apiHost}/health` });
   if (health.ok) {
     push({ name: "GET /health", status: "ok", detail: `HTTP ${health.status}` });
   } else {
     push({ name: "GET /health", status: "fail", detail: health.reason });
   }
-  const gqlUrl = `https://${input.apiHost}/api`;
-  const gql = await deps.graphql({ url: gqlUrl });
+}
+async function verifyGraphqlPhase(input, deps, push) {
+  const gql = await deps.graphql({ url: `https://${input.apiHost}/api` });
   if (gql.ok) {
     push({ name: "GraphQL { __typename }", status: "ok", detail: `typename=${gql.typename}` });
   } else {
     push({ name: "GraphQL { __typename }", status: "fail", detail: gql.reason });
   }
+}
+async function verifyCloudflarePhase(input, deps, push) {
   const cfFields = [
     ["--cf-token", input.cf?.token],
     ["--cf-account-id", input.cf?.accountId],
@@ -3470,54 +3499,57 @@ async function runVerify(input, deps = DEFAULT_DEPS2) {
       status: "skipped",
       detail: "pass --cf-token + --cf-account-id + --tunnel-id to enable"
     });
-  } else if (cfSet.length < cfFields.length) {
+    return;
+  }
+  if (cfSet.length < cfFields.length) {
     const missing = cfFields.filter(([, v]) => v === void 0 || v === "").map(([name]) => name).join(", ");
     push({
       name: "Cloudflare Tunnel",
       status: "warn",
       detail: `partial CF config \u2014 missing ${missing}; check skipped`
     });
+    return;
+  }
+  const tun = await deps.tunnel({
+    token: input.cf.token,
+    accountId: input.cf.accountId,
+    tunnelId: input.cf.tunnelId
+  });
+  if (!tun.ok) {
+    push({ name: "Cloudflare Tunnel", status: "fail", detail: tun.reason });
+  } else if (tun.connections === 0) {
+    push({
+      name: "Cloudflare Tunnel",
+      status: "warn",
+      detail: `status=${tun.status}, 0 connections \u2014 cloudflared on the Studio appears offline`
+    });
   } else {
-    const tun = await deps.tunnel({
-      token: input.cf.token,
-      accountId: input.cf.accountId,
-      tunnelId: input.cf.tunnelId
+    push({
+      name: "Cloudflare Tunnel",
+      status: "ok",
+      detail: `${tun.connections} connections, status=${tun.status}`
     });
-    if (!tun.ok) {
-      push({ name: "Cloudflare Tunnel", status: "fail", detail: tun.reason });
-    } else if (tun.connections === 0) {
-      push({
-        name: "Cloudflare Tunnel",
-        status: "warn",
-        detail: `status=${tun.status}, 0 connections \u2014 cloudflared on the Studio appears offline`
-      });
-    } else {
-      push({
-        name: "Cloudflare Tunnel",
-        status: "ok",
-        detail: `${tun.connections} connections, status=${tun.status}`
-      });
-    }
   }
+}
+async function verifyCosignPhase(input, deps, push) {
   if (input.images.length === 0) {
     push({
       name: "cosign verify",
       status: "skipped",
       detail: "pass --image <ref> (repeatable) to enable"
     });
-  } else {
-    for (const image of input.images) {
-      const cos = await deps.cosign({ image });
-      if (cos.ok) {
-        push({ name: `cosign verify ${image}`, status: "ok", detail: "signature valid" });
-      } else if (cos.skipped) {
-        push({ name: `cosign verify ${image}`, status: "skipped", detail: cos.reason });
-      } else {
-        push({ name: `cosign verify ${image}`, status: "fail", detail: cos.reason });
-      }
+    return;
+  }
+  for (const image of input.images) {
+    const cos = await deps.cosign({ image });
+    if (cos.ok) {
+      push({ name: `cosign verify ${image}`, status: "ok", detail: "signature valid" });
+    } else if (cos.skipped) {
+      push({ name: `cosign verify ${image}`, status: "skipped", detail: cos.reason });
+    } else {
+      push({ name: `cosign verify ${image}`, status: "fail", detail: cos.reason });
     }
   }
-  return { phases };
 }
 function readTokenFile(path) {
   const raw = readFileSync(path, "utf8").trim();
@@ -3542,6 +3574,53 @@ var verifyCommand = new Command("verify").description(
   new Option("--show-skipped", "Include skipped phases in the summary").default(false)
 ).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node verify ")));
+  const domain = await resolveDomain(opts);
+  const certWarnDays = resolveCertWarnDays(opts);
+  const cfToken = resolveCfToken(opts);
+  const apiHost = opts.apiHost ?? `api.${domain}`;
+  const images = opts.image ?? [];
+  const totalPhases = 4 + (images.length === 0 ? 1 : images.length);
+  const report = await runVerifyWithSpinner({
+    apiHost,
+    certWarnDays,
+    cfToken,
+    opts,
+    images,
+    totalPhases
+  });
+  renderVerifySummary(report, { opts, totalPhases });
+  reportVerifyOutcome(report);
+});
+function phaseIcon2(ph) {
+  switch (ph.status) {
+    case "ok":
+      return pc2.green("\u2713");
+    case "warn":
+      return pc2.yellow("\u26A0");
+    case "skipped":
+      return pc2.dim("\xB7");
+    case "fail":
+      return pc2.red("\u2717");
+  }
+}
+function phaseColor(status) {
+  switch (status) {
+    case "ok":
+      return pc2.green;
+    case "warn":
+      return pc2.yellow;
+    case "skipped":
+      return pc2.dim;
+    case "fail":
+      return pc2.red;
+  }
+}
+function formatPhaseLine(prefix, ph) {
+  const icon = phaseIcon2(ph);
+  const colorize = phaseColor(ph.status);
+  return colorize(`${icon} ${prefix}: ${ph.detail}`);
+}
+async function resolveDomain(opts) {
   const domain = opts.domain ? opts.domain : unwrap(
     await p3.text({
       message: "Public domain of the node?",
@@ -3553,28 +3632,33 @@ var verifyCommand = new Command("verify").description(
     p3.cancel(`--domain ${JSON.stringify(domain)} doesn't look like a domain.`);
     process.exit(2);
   }
+  return domain;
+}
+function resolveCertWarnDays(opts) {
   const rawDays = opts.certWarnDays ?? "14";
   const certWarnDays = Number.parseInt(rawDays, 10);
   if (!Number.isFinite(certWarnDays) || certWarnDays < 0 || !/^\d+$/.test(rawDays)) {
     p3.cancel(`--cert-warn-days must be a non-negative integer (got ${JSON.stringify(rawDays)}).`);
     process.exit(2);
   }
+  return certWarnDays;
+}
+function resolveCfToken(opts) {
   if (opts.cfToken && opts.cfTokenFile) {
     p3.cancel("Pass either --cf-token or --cf-token-file, not both.");
     process.exit(2);
   }
-  let cfToken = opts.cfToken;
-  if (!cfToken && opts.cfTokenFile) {
-    try {
-      cfToken = readTokenFile(opts.cfTokenFile);
-    } catch (err) {
-      p3.cancel(err.message);
-      process.exit(2);
-    }
+  if (opts.cfToken) return opts.cfToken;
+  if (!opts.cfTokenFile) return void 0;
+  try {
+    return readTokenFile(opts.cfTokenFile);
+  } catch (err) {
+    p3.cancel(err.message);
+    process.exit(2);
   }
-  const apiHost = opts.apiHost ?? `api.${domain}`;
-  const images = opts.image ?? [];
-  const totalPhases = 4 + (images.length === 0 ? 1 : images.length);
+}
+async function runVerifyWithSpinner(args) {
+  const { apiHost, certWarnDays, cfToken, opts, images, totalPhases } = args;
   let phaseIndex = 0;
   let activeSpin = null;
   const renderPhase = (ph) => {
@@ -3583,10 +3667,7 @@ var verifyCommand = new Command("verify").description(
     activeSpin?.stop(formatPhaseLine(prefix, ph));
     activeSpin = null;
   };
-  const deps = {
-    ...DEFAULT_DEPS2,
-    onPhase: renderPhase
-  };
+  const deps = { ...DEFAULT_DEPS2, onPhase: renderPhase };
   activeSpin = p3.spinner();
   activeSpin.start("Running checks\u2026");
   const report = await runVerify(
@@ -3603,6 +3684,10 @@ var verifyCommand = new Command("verify").description(
     deps
   );
   activeSpin?.stop("Done.");
+  return report;
+}
+function renderVerifySummary(report, args) {
+  const { opts, totalPhases } = args;
   const visible = opts.showSkipped ?? false ? report.phases : report.phases.filter((ph) => ph.status !== "skipped");
   const lines = visible.map((ph) => {
     const idx = report.phases.indexOf(ph) + 1;
@@ -3613,47 +3698,19 @@ var verifyCommand = new Command("verify").description(
     lines.push(pc2.dim(`\xB7 ${skippedCount} phase${skippedCount === 1 ? "" : "s"} skipped (run with --show-skipped to see them)`));
   }
   p3.note(lines.join("\n"), "Summary");
+}
+function reportVerifyOutcome(report) {
   const summary = summarize(report);
-  if (summary.ok) {
-    if (summary.warned === 0) {
-      p3.outro(pc2.green("All checks passed."));
-    } else {
-      p3.outro(pc2.yellow(`Passed with ${summary.warned} warning${summary.warned === 1 ? "" : "s"}.`));
-    }
-  } else {
+  if (!summary.ok) {
     p3.outro(pc2.red(`${summary.failed} check${summary.failed === 1 ? "" : "s"} failed.`));
     process.exit(1);
   }
-});
-function phaseIcon2(ph) {
-  switch (ph.status) {
-    case "ok":
-      return pc2.green("\u2713");
-    case "warn":
-      return pc2.yellow("\u26A0");
-    case "skipped":
-      return pc2.dim("\xB7");
-    case "fail":
-      return pc2.red("\u2717");
-  }
-}
-function phaseColor(status) {
-  switch (status) {
-    case "ok":
-      return pc2.green;
-    case "warn":
-      return pc2.yellow;
-    case "skipped":
-      return pc2.dim;
-    case "fail":
-      return pc2.red;
+  if (summary.warned === 0) {
+    p3.outro(pc2.green("All checks passed."));
+  } else {
+    p3.outro(pc2.yellow(`Passed with ${summary.warned} warning${summary.warned === 1 ? "" : "s"}.`));
   }
 }
-function formatPhaseLine(prefix, ph) {
-  const icon = phaseIcon2(ph);
-  const colorize = phaseColor(ph.status);
-  return colorize(`${icon} ${prefix}: ${ph.detail}`);
-}
 
 // src/lib/region-schema.json
 var region_schema_default = {
@@ -4387,6 +4444,14 @@ function regionFilePath(input) {
 }
 var schemaValidator = new Validator(region_schema_default, "7");
 function validateRegionConfig(file) {
+  return [
+    ...validateVersionAndIds(file),
+    ...validateFipsCode(file),
+    ...validateDataSourceUniqueness(file),
+    ...validateAgainstSchema(file)
+  ];
+}
+function validateVersionAndIds(file) {
   const issues = [];
   const { config } = file;
   if (!/^\d+\.\d+\.\d+$/.test(file.version)) {
@@ -4403,34 +4468,39 @@ function validateRegionConfig(file) {
       `county regionId "${config.regionId}" should be prefixed with its parent "${config.parentRegionId}-"`
     );
   }
+  return issues;
+}
+function validateFipsCode(file) {
+  const { config } = file;
+  if (config.fipsCode === void 0) return [];
   const isCounty = config.parentRegionId !== void 0;
-  if (config.fipsCode !== void 0) {
-    const expected = isCounty ? 5 : 2;
-    if (!/^\d+$/.test(config.fipsCode) || config.fipsCode.length !== expected) {
-      issues.push(
-        `fipsCode "${config.fipsCode}" must be ${expected} digits for a ${isCounty ? "county" : "state"}`
-      );
-    }
+  const expected = isCounty ? 5 : 2;
+  if (!/^\d+$/.test(config.fipsCode) || config.fipsCode.length !== expected) {
+    return [
+      `fipsCode "${config.fipsCode}" must be ${expected} digits for a ${isCounty ? "county" : "state"}`
+    ];
   }
-  if (Array.isArray(config.dataSources)) {
-    const seen = /* @__PURE__ */ new Set();
-    for (const src of config.dataSources) {
-      const key = `${src.dataType} ${src.url}`;
-      if (seen.has(key)) {
-        issues.push(`duplicate data source: ${src.dataType} ${src.url}`);
-      }
-      seen.add(key);
-    }
-  }
-  const result2 = schemaValidator.validate(file);
-  if (!result2.valid) {
-    for (const err of result2.errors) {
-      const path = err.instanceLocation || "<root>";
-      issues.push(`schema: ${path} ${err.error}`);
+  return [];
+}
+function validateDataSourceUniqueness(file) {
+  const { config } = file;
+  if (!Array.isArray(config.dataSources)) return [];
+  const issues = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const src of config.dataSources) {
+    const key = `${src.dataType} ${src.url}`;
+    if (seen.has(key)) {
+      issues.push(`duplicate data source: ${src.dataType} ${src.url}`);
     }
+    seen.add(key);
   }
   return issues;
 }
+function validateAgainstSchema(file) {
+  const result2 = schemaValidator.validate(file);
+  if (result2.valid) return [];
+  return result2.errors.map((err) => `schema: ${err.instanceLocation || "<root>"} ${err.error}`);
+}
 
 // src/commands/region.ts
 var regionCommand = new Command("region").description(
@@ -4446,6 +4516,18 @@ var regionCommand = new Command("region").description(
   )
 ).addOption(new Option("-f, --force", "Overwrite an existing config file").default(false)).action(async (opts) => {
   p3.intro(pc2.bgMagenta(pc2.black(" create-op-node region ")));
+  printRegionWelcome();
+  const targetDir = await resolveTargetDir(opts);
+  const level = await resolveLevel(opts);
+  const identity = await collectIdentity(opts, level);
+  const codes = await collectCodes(opts, level);
+  const dataSources = await collectDataSources();
+  const input = buildRegionInput({ level, identity, codes, dataSources });
+  const file = buildAndValidateConfig(input);
+  await writeRegionConfig({ opts, targetDir, level, identity, file });
+});
+var requireNonEmpty = (v) => v && v.trim().length > 0 ? void 0 : "Required";
+function printRegionWelcome() {
   p3.note(
     [
       "Scaffolds a declarative region config JSON for opuspopuli-regions \u2014",
@@ -4457,6 +4539,8 @@ var regionCommand = new Command("region").description(
     ].join("\n"),
     "Welcome"
   );
+}
+async function resolveTargetDir(opts) {
   const targetDir = opts.outDir ?? process.cwd();
   const looksRight = await looksLikeRegionsRepo(targetDir);
   if (!looksRight) {
@@ -4471,7 +4555,10 @@ var regionCommand = new Command("region").description(
       process.exit(0);
     }
   }
-  const level = opts.level === "state" || opts.level === "county" ? opts.level : unwrap(
+  return targetDir;
+}
+async function resolveLevel(opts) {
+  return opts.level === "state" || opts.level === "county" ? opts.level : unwrap(
     await p3.select({
       message: "What level is this region?",
       options: [
@@ -4480,27 +4567,31 @@ var regionCommand = new Command("region").description(
       ]
     })
   );
+}
+async function resolveParentSlug(opts, level) {
+  if (level !== "county") return void 0;
+  const parentSlug = opts.parent ?? unwrap(
+    await p3.text({
+      message: "Parent state slug?",
+      placeholder: "california",
+      validate: (v) => isValidSlug(v ?? "") ? void 0 : "kebab-case (lowercase letters, digits, hyphens)"
+    })
+  );
+  if (!isValidSlug(parentSlug)) {
+    p3.cancel(`Parent slug "${parentSlug}" must be kebab-case.`);
+    process.exit(1);
+  }
+  return parentSlug;
+}
+async function collectIdentity(opts, level) {
   const rawName = opts.name ?? unwrap(
     await p3.text({
       message: level === "county" ? "County name?" : "State name?",
       placeholder: level === "county" ? "Alameda" : "California",
-      validate: (v) => v && v.trim().length > 0 ? void 0 : "Required"
+      validate: requireNonEmpty
     })
   );
-  let parentSlug;
-  if (level === "county") {
-    parentSlug = opts.parent ?? unwrap(
-      await p3.text({
-        message: "Parent state slug?",
-        placeholder: "california",
-        validate: (v) => isValidSlug(v ?? "") ? void 0 : "kebab-case (lowercase letters, digits, hyphens)"
-      })
-    );
-    if (!isValidSlug(parentSlug)) {
-      p3.cancel(`Parent slug "${parentSlug}" must be kebab-case.`);
-      process.exit(1);
-    }
-  }
+  const parentSlug = await resolveParentSlug(opts, level);
   const ownSlug = slugify(rawName);
   const regionId = level === "county" ? `${parentSlug}-${ownSlug}` : ownSlug;
   if (!isValidSlug(regionId)) {
@@ -4518,9 +4609,12 @@ var regionCommand = new Command("region").description(
     await p3.text({
       message: "One-line description of the data coverage?",
       placeholder: level === "county" ? `Civic data for ${rawName} County` : `Civic data for the state of ${rawName}`,
-      validate: (v) => v && v.trim().length > 0 ? void 0 : "Required"
+      validate: requireNonEmpty
     })
   );
+  return { rawName, parentSlug, ownSlug, regionId, regionName, description };
+}
+async function collectCodes(opts, level) {
   const stateCode = (opts.stateCode ?? unwrap(
     await p3.text({
       message: "Two-letter state code?",
@@ -4555,65 +4649,77 @@ var regionCommand = new Command("region").description(
       validate: (v) => isValidTimezone(v || "America/Los_Angeles") ? void 0 : "Not a recognized IANA zone (e.g. America/New_York)"
     })
   );
+  return { stateCode, fipsCode, timezone };
+}
+async function collectOneDataSource(index) {
+  const url = unwrap(
+    await p3.text({
+      message: `Data source #${index} \u2014 URL?`,
+      placeholder: "https://example.gov/meetings",
+      validate: (v) => /^https?:\/\//.test(v ?? "") ? void 0 : "Must start with http(s)://"
+    })
+  );
+  const dataType = unwrap(
+    await p3.select({
+      message: "Data type?",
+      options: DATA_TYPES.map((t) => ({ value: t, label: t }))
+    })
+  );
+  const sourceType = unwrap(
+    await p3.select({
+      message: "Source type?",
+      initialValue: "html_scrape",
+      options: SOURCE_TYPES.map((t) => ({ value: t, label: t }))
+    })
+  );
+  const contentGoal = unwrap(
+    await p3.text({
+      message: "Content goal (what should the scraper extract)?",
+      placeholder: "Fetch upcoming board meeting agendas and minutes",
+      validate: requireNonEmpty
+    })
+  );
+  const category = unwrap(
+    await p3.text({
+      message: "Category label (optional)?",
+      placeholder: "Board of Supervisors"
+    })
+  );
+  const src = { url, dataType, sourceType, contentGoal };
+  if (category && category.trim().length > 0) src.category = category.trim();
+  return src;
+}
+async function collectDataSources() {
   const dataSources = [];
   do {
-    const url = unwrap(
-      await p3.text({
-        message: `Data source #${dataSources.length + 1} \u2014 URL?`,
-        placeholder: "https://example.gov/meetings",
-        validate: (v) => /^https?:\/\//.test(v ?? "") ? void 0 : "Must start with http(s)://"
-      })
-    );
-    const dataType = unwrap(
-      await p3.select({
-        message: "Data type?",
-        options: DATA_TYPES.map((t) => ({ value: t, label: t }))
-      })
-    );
-    const sourceType = unwrap(
-      await p3.select({
-        message: "Source type?",
-        initialValue: "html_scrape",
-        options: SOURCE_TYPES.map((t) => ({ value: t, label: t }))
-      })
-    );
-    const contentGoal = unwrap(
-      await p3.text({
-        message: "Content goal (what should the scraper extract)?",
-        placeholder: "Fetch upcoming board meeting agendas and minutes",
-        validate: (v) => v && v.trim().length > 0 ? void 0 : "Required"
-      })
-    );
-    const category = unwrap(
-      await p3.text({
-        message: "Category label (optional)?",
-        placeholder: "Board of Supervisors"
-      })
-    );
-    const src = { url, dataType, sourceType, contentGoal };
-    if (category && category.trim().length > 0) src.category = category.trim();
-    dataSources.push(src);
+    dataSources.push(await collectOneDataSource(dataSources.length + 1));
     const again = unwrap(
       await p3.confirm({ message: "Add another data source?", initialValue: false })
     );
     if (!again) break;
   } while (true);
-  const input = {
-    regionId,
-    displayName: regionName,
-    regionName,
-    description,
+  return dataSources;
+}
+function buildRegionInput(args) {
+  const { level, identity, codes, dataSources } = args;
+  return {
+    level,
+    regionId: identity.regionId,
+    displayName: identity.regionName,
+    regionName: identity.regionName,
+    description: identity.description,
     // New region configs start at 0.1.0 — the documented convention in the
-    // regions repo's CLAUDE.md. Bump to a higher version manually as the
-    // config matures.
+    // regions repo's CLAUDE.md. Bump manually as the config matures.
     version: "0.1.0",
-    timezone,
-    stateCode,
-    fipsCode,
+    timezone: codes.timezone,
+    stateCode: codes.stateCode,
+    fipsCode: codes.fipsCode,
     dataSources,
-    ...parentSlug ? { parentRegionId: parentSlug } : {},
-    ...level === "county" ? { countySlug: ownSlug } : {}
+    ...identity.parentSlug ? { parentRegionId: identity.parentSlug } : {},
+    ...level === "county" ? { countySlug: identity.ownSlug } : {}
   };
+}
+function buildAndValidateConfig(input) {
   const file = buildRegionConfig(input);
   const issues = validateRegionConfig(file);
   if (issues.length > 0) {
@@ -4621,11 +4727,15 @@ var regionCommand = new Command("region").description(
     p3.cancel("The generated config would not pass the regions repo CI. Re-run and adjust.");
     process.exit(1);
   }
+  return file;
+}
+async function writeRegionConfig(args) {
+  const { opts, targetDir, level, identity, file } = args;
   const relPath = regionFilePath({
     level,
-    regionId,
-    ...parentSlug ? { parentRegionId: parentSlug } : {},
-    ...level === "county" ? { countySlug: ownSlug } : {}
+    regionId: identity.regionId,
+    ...identity.parentSlug ? { parentRegionId: identity.parentSlug } : {},
+    ...level === "county" ? { countySlug: identity.ownSlug } : {}
   });
   const absPath = resolve(targetDir, relPath);
   const json = `${JSON.stringify(file, null, 2)}
@@ -4655,8 +4765,8 @@ var regionCommand = new Command("region").description(
     ].join("\n"),
     "Done"
   );
-  p3.outro(pc2.magenta(`Region scaffolded: ${regionId}`));
-});
+  p3.outro(pc2.magenta(`Region scaffolded: ${identity.regionId}`));
+}
 async function fileExists3(path) {
   try {
     await access(path);
@@ -4674,7 +4784,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.10.8";
+var VERSION = "0.10.10";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."