create-op-node 0.12.2 → 0.12.4

package/dist/cli.js

@@ -1335,8 +1335,6 @@ async function waitForApplyAndFetchTunnelToken(input) {
       return null;
   }
 }
-
-// src/lib/homebrew.ts
 var STUDIO_PACKAGES = [
   { name: "git", kind: "formula" },
   { name: "gh", kind: "formula" },
@@ -1347,8 +1345,11 @@ var STUDIO_PACKAGES = [
   { name: "ollama", kind: "formula" },
   // Required for the fail-closed image-signature gate in `bootstrap` (#34).
   { name: "cosign", kind: "formula" },
-  { name: "docker", kind: "cask" },
-  { name: "tailscale", kind: "cask" }
+  // Homebrew renamed the `docker` cask to `docker-desktop`. The appPath skip
+  // means a directly-installed Docker Desktop (the common case) is treated as
+  // present rather than tripping `brew install` on the existing app. (#89)
+  { name: "docker-desktop", kind: "cask", appPath: "/Applications/Docker.app" },
+  { name: "tailscale", kind: "cask", appPath: "/Applications/Tailscale.app" }
 ];
 async function detectBrew() {
   const res = await safeExeca("brew", ["--version"]);
@@ -1359,7 +1360,18 @@ async function detectBrew() {
   return { installed: true, ...version ? { version } : {} };
 }
 var HOMEBREW_INSTALL_COMMAND = '/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"';
+async function pathExists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function isPackageInstalled(pkg) {
+  if (pkg.appPath && await pathExists(pkg.appPath)) {
+    return true;
+  }
   const flag = pkg.kind === "cask" ? "--cask" : "--formula";
   const res = await safeExeca("brew", ["list", flag, pkg.name]);
   return res !== null && res.exitCode === 0;
@@ -1481,6 +1493,7 @@ async function writePgsodiumKeyFile(key, keyFile) {
   try {
     const dir = dirname(keyFile);
     await mkdir(dir, { recursive: true, mode: 448 });
+    await rm(keyFile, { force: true });
     await writeFile(keyFile, key, { mode: 256 });
     await chmod(dir, 448);
     await chmod(keyFile, 256);
@@ -2061,7 +2074,7 @@ function assessAllRunning(snapshots) {
 
 // src/lib/cosign.ts
 var COSIGN_OIDC_ISSUER = "https://token.actions.githubusercontent.com";
-var DEFAULT_IDENTITY_REGEXP = "^https://github\\.com/OpusPopuli/opuspopuli/\\.github/workflows/release\\.yml@refs/heads/.*$";
+var DEFAULT_IDENTITY_REGEXP = "^https://github\\.com/OpusPopuli/(?:opuspopuli|prompt-service)/\\.github/workflows/release\\.yml@refs/heads/.*$";
 async function cosignVerifyImage(input) {
   const idRegex = input.certificateIdentityRegexp ?? DEFAULT_IDENTITY_REGEXP;
   const issuer = input.certificateOidcIssuer ?? COSIGN_OIDC_ISSUER;
@@ -2615,15 +2628,18 @@ async function collectCoreSecrets(args) {
 }
 async function collectPromptServiceSecrets(args) {
   const { region, nodeType, opts } = args;
+  let promptsDbPassword;
+  let promptServiceApiKey;
+  let promptServiceAdminApiKeys;
   if (nodeType === "region-with-prompts") {
-    await loadSecret({
+    promptsDbPassword = await loadSecret({
       region,
       account: "prompts-db-password",
       label: "prompt-service Postgres password",
       validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
       generate: generatePostgresPassword
     });
-    await loadSecret({
+    promptServiceApiKey = await loadSecret({
       region,
       account: "prompt-service-api-key",
       label: "prompt-service HMAC API key",
@@ -2632,7 +2648,7 @@ async function collectPromptServiceSecrets(args) {
       validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
       generate: generateHmacApiKey
     });
-    await loadSecret({
+    promptServiceAdminApiKeys = await loadSecret({
       region,
       account: "prompt-service-admin-api-key",
       label: "prompt-service admin API key",
@@ -2640,7 +2656,7 @@ async function collectPromptServiceSecrets(args) {
       generate: generateHmacApiKey
     });
   } else {
-    await loadSecret({
+    promptServiceApiKey = await loadSecret({
       region,
       account: "prompt-service-api-key",
       label: "prompt-service HMAC API key (issued by the prompts team)",
@@ -2658,7 +2674,15 @@ async function collectPromptServiceSecrets(args) {
     );
     process.exit(1);
   }
-  return promptServiceUrl;
+  return {
+    url: promptServiceUrl,
+    ...promptsDbPassword !== void 0 ? { promptsDbPassword } : {},
+    // PROMPT_SERVICE_API_KEY is the raw key; PROMPT_SERVICE_API_KEYS is the
+    // `<region>:<key>` list prompt-service validates against — same derivation
+    // the op-compose wrapper does.
+    ...promptServiceApiKey !== void 0 ? { promptServiceApiKey, promptServiceApiKeys: `${region}:${promptServiceApiKey}` } : {},
+    ...promptServiceAdminApiKeys !== void 0 ? { promptServiceAdminApiKeys } : {}
+  };
 }
 async function resolveSupabaseUrl(opts) {
   let supabaseUrl;
@@ -2688,9 +2712,9 @@ async function resolveSupabaseUrl(opts) {
 }
 async function collectSecretsPhase(args) {
   const core = await collectCoreSecrets({ region: args.region, opts: args.opts });
-  const promptServiceUrl = await collectPromptServiceSecrets(args);
+  const { url: promptServiceUrl, ...promptSecrets } = await collectPromptServiceSecrets(args);
   const supabaseUrl = await resolveSupabaseUrl(args.opts);
-  return { ...core, promptServiceUrl, supabaseUrl };
+  return { ...core, ...promptSecrets, promptServiceUrl, supabaseUrl };
 }
 async function runLaunchAgentPhase(args) {
   const { opts, secrets, llmModel, embeddingModel } = args;
@@ -2806,6 +2830,16 @@ function buildComposeEnv(args) {
     SUPABASE_URL: secrets.supabaseUrl,
     AUTH_JWT_SECRET: process.env["AUTH_JWT_SECRET"] ?? secrets.jwtSecret,
     ...secrets.tunnelToken !== void 0 ? { TUNNEL_TOKEN: secrets.tunnelToken } : {},
+    // prompt-service wiring — mirrors the op-compose wrapper so bootstrap's OWN
+    // compose calls can process the region-with-prompts overlay instead of
+    // aborting on `${PROMPTS_DB_PASSWORD:?}`. PROMPT_SERVICE_URL is always set
+    // (in-network for colocated, remote otherwise); the rest are present only
+    // when the node runs or calls a prompt-service. (#90)
+    PROMPT_SERVICE_URL: secrets.promptServiceUrl,
+    ...secrets.promptsDbPassword !== void 0 ? { PROMPTS_DB_PASSWORD: secrets.promptsDbPassword } : {},
+    ...secrets.promptServiceApiKey !== void 0 ? { PROMPT_SERVICE_API_KEY: secrets.promptServiceApiKey } : {},
+    ...secrets.promptServiceApiKeys !== void 0 ? { PROMPT_SERVICE_API_KEYS: secrets.promptServiceApiKeys } : {},
+    ...secrets.promptServiceAdminApiKeys !== void 0 ? { PROMPT_SERVICE_ADMIN_API_KEYS: secrets.promptServiceAdminApiKeys } : {},
     ...llmModel ? { LLM_MODEL: llmModel } : {},
     ...embeddingModel ? { EMBEDDINGS_MODEL: embeddingModel } : {}
   };
@@ -5121,7 +5155,7 @@ function withDefaultSubcommand(argv, known) {
 }
 
 // src/cli.ts
-var VERSION = "0.12.2";
+var VERSION = "0.12.4";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."