create-op-node 0.14.0 → 0.15.1

package/README.md

@@ -72,7 +72,7 @@ The chosen models flow two places:
 1. **Ollama**: bootstrap pulls + warms them so the daemon has them
    resident before the stack comes up. The embedding model pulls first
    (small, fast feedback); the LLM pulls second (can be tens of GB).
-2. **The node `.env`**: bootstrap writes `LLM_MODEL`, `EMBEDDINGS_MODEL`,
+2. **The node `.env`**: bootstrap writes `LLM_MODEL`, `EMBEDDINGS_OLLAMA_MODEL`,
    and `EMBEDDINGS_PROVIDER` into a managed block of the region repo's
    `.env`, which docker compose auto-loads. This is the **single source of
    truth** — every service (and every future partial recreate) resolves
@@ -91,9 +91,10 @@ The chosen models flow two places:
 
 > **`--embeddings-provider` picks where embeddings run.** The default is
 > `xenova` (in-process), which bundles its own embedding model and ignores
-> `EMBEDDINGS_MODEL`. Pass `--embeddings-provider ollama` to use the host
-> daemon with `--embedding-model` — the value is written to `.env` as the
-> single source of truth. See `docs/provider-pattern.md`.
+> `EMBEDDINGS_OLLAMA_MODEL`. Pass `--embeddings-provider ollama` to use the host
+> daemon with `--embedding-model` — the value is written to `.env` (as
+> `EMBEDDINGS_OLLAMA_MODEL`, the key the backend reads) as the single source of
+> truth. See `docs/provider-pattern.md`.
 
 > **Template contract**: for `LLM_MODEL` to actually change the running
 > model, the region repo's `docker-compose-prod.yml` must use

package/dist/cli.js

@@ -2223,7 +2223,7 @@ var MANAGED_END = "# <<< op-node managed <<<";
 var MANAGED_KEYS = [
   "LLM_MODEL",
   "EMBEDDINGS_PROVIDER",
-  "EMBEDDINGS_MODEL",
+  "EMBEDDINGS_OLLAMA_MODEL",
   "NODE_ENV"
 ];
 var ENV_VALUE_RE = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/;
@@ -2231,7 +2231,7 @@ function selectionToPairs(sel) {
   return [
     ["LLM_MODEL", sel.llmModel],
     ["EMBEDDINGS_PROVIDER", sel.embeddingsProvider],
-    ["EMBEDDINGS_MODEL", sel.embeddingModel],
+    ["EMBEDDINGS_OLLAMA_MODEL", sel.embeddingModel],
     ["NODE_ENV", sel.nodeEnv]
   ];
 }
@@ -2336,7 +2336,7 @@ async function readEnvModelConfig(repoDir) {
   const map = parseEnvContent(content);
   const cfg = {};
   const llm = map.get("LLM_MODEL");
-  const emb = map.get("EMBEDDINGS_MODEL");
+  const emb = map.get("EMBEDDINGS_OLLAMA_MODEL");
   const prov = map.get("EMBEDDINGS_PROVIDER");
   const node = map.get("NODE_ENV");
   if (llm !== void 0) cfg.llmModel = llm;
@@ -3029,7 +3029,7 @@ function buildComposeEnv(args) {
     ...secrets.promptServiceApiKey !== void 0 ? { PROMPT_SERVICE_API_KEY: secrets.promptServiceApiKey } : {},
     ...secrets.promptServiceApiKeys !== void 0 ? { PROMPT_SERVICE_API_KEYS: secrets.promptServiceApiKeys } : {},
     ...secrets.promptServiceAdminApiKeys !== void 0 ? { PROMPT_SERVICE_ADMIN_API_KEYS: secrets.promptServiceAdminApiKeys } : {}
-    // Model config (LLM_MODEL / EMBEDDINGS_MODEL / NODE_ENV) is intentionally
+    // Model config (LLM_MODEL / EMBEDDINGS_OLLAMA_MODEL / NODE_ENV) is intentionally
     // NOT injected here — it lives in the node's `.env` (runEnvFilePhase),
     // which docker compose auto-loads. Injecting it into the subprocess env
     // would shadow `.env` (shell env > .env) and reintroduce the drift the
@@ -4014,7 +4014,12 @@ async function runVerify(input, deps = DEFAULT_DEPS2) {
   await verifyCosignPhase(input, deps, push);
   return { phases };
 }
+function skipLocalOnly(name, detail, push) {
+  push({ name, status: "skipped", detail });
+}
+var LOCAL_ONLY_NO_ENDPOINT = "local-only node \u2014 no public endpoint to probe";
 async function verifyTlsPhase(input, deps, push) {
+  if (input.localOnly) return skipLocalOnly("TLS handshake", LOCAL_ONLY_NO_ENDPOINT, push);
   const tls2 = await deps.tls({ host: input.apiHost });
   if (!tls2.ok) {
     push({ name: "TLS handshake", status: "fail", detail: tls2.reason });
@@ -4032,6 +4037,7 @@ async function verifyTlsPhase(input, deps, push) {
   push({ name: "TLS handshake", status: "ok", detail: line });
 }
 async function verifyHealthPhase(input, deps, push) {
+  if (input.localOnly) return skipLocalOnly("GET /health", LOCAL_ONLY_NO_ENDPOINT, push);
   const health = await deps.http({ url: `https://${input.apiHost}/health` });
   if (health.ok) {
     push({ name: "GET /health", status: "ok", detail: `HTTP ${health.status}` });
@@ -4040,6 +4046,7 @@ async function verifyHealthPhase(input, deps, push) {
   }
 }
 async function verifyGraphqlPhase(input, deps, push) {
+  if (input.localOnly) return skipLocalOnly("GraphQL { __typename }", LOCAL_ONLY_NO_ENDPOINT, push);
   const gql = await deps.graphql({ url: `https://${input.apiHost}/api` });
   if (gql.ok) {
     push({ name: "GraphQL { __typename }", status: "ok", detail: `typename=${gql.typename}` });
@@ -4081,6 +4088,7 @@ async function verifyOllamaModelsPhase(input, deps, push) {
   push({ name: "Ollama models", status: "ok", detail: `${required.join(", ")} present` });
 }
 async function verifyCloudflarePhase(input, deps, push) {
+  if (input.localOnly) return skipLocalOnly("Cloudflare Tunnel", "local-only node \u2014 no tunnel", push);
   const cfFields = [
     ["--cf-token", input.cf?.token],
     ["--cf-account-id", input.cf?.accountId],
@@ -4150,6 +4158,9 @@ function readTokenFile(path) {
   if (!raw) throw new Error(`--cf-token-file ${path} was empty`);
   return raw;
 }
+function collectImage(value, previous) {
+  return [...previous ?? [], value];
+}
 var verifyCommand = new Command("verify").description(
   "Off-LAN health probe of a live node \u2014 TLS, Apollo Federation reachability, GraphQL smoke. Run from anywhere with internet access."
 ).addOption(
@@ -4159,9 +4170,7 @@ var verifyCommand = new Command("verify").description(
 ).addOption(new Option("--cf-account-id <id>", "Cloudflare account ID (required with --cf-token)")).addOption(
   new Option("--tunnel-id <id>", "Cloudflare Tunnel ID to query (required with --cf-token)")
 ).addOption(
-  new Option("--image <ref>", "Repeatable. Image to cosign-verify (e.g. ghcr.io/opuspopuli/api:tag)").default(
-    []
-  )
+  new Option("--image <ref>", "Repeatable. Image to cosign-verify (e.g. ghcr.io/opuspopuli/api:tag)").default([]).argParser(collectImage)
 ).addOption(
   new Option("--cert-warn-days <n>", "Warn if cert expires within N days").default("14")
 ).addOption(
@@ -4175,14 +4184,20 @@ var verifyCommand = new Command("verify").description(
   new Option("--embeddings-provider <provider>", "Embeddings provider the node runs; the embedding model is only asserted for `ollama`.").choices(["xenova", "ollama"])
 ).addOption(
   new Option("--repo-dir <path>", "Node repo dir whose .env supplies the model config when --llm-model is omitted (default: cwd).")
+).addOption(
+  new Option(
+    "--local-only",
+    "Node has no public domain/tunnel \u2014 skip the TLS/health/GraphQL/tunnel probes (no domain prompt) and run only the node-local checks (Ollama model presence, cosign)."
+  ).default(false)
 ).addOption(
   new Option("--show-skipped", "Include skipped phases in the summary").default(false)
 ).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node verify ")));
-  const domain = await resolveDomain(opts);
+  const localOnly = opts.localOnly ?? false;
+  const domain = localOnly ? void 0 : await resolveDomain(opts);
   const certWarnDays = resolveCertWarnDays(opts);
   const cfToken = resolveCfToken(opts);
-  const apiHost = opts.apiHost ?? `api.${domain}`;
+  const apiHost = localOnly ? "" : opts.apiHost ?? `api.${domain}`;
   const images = opts.image ?? [];
   const ollama = await resolveOllamaVerifyInput(opts);
   const totalPhases = 5 + (images.length === 0 ? 1 : images.length);
@@ -4193,6 +4208,7 @@ var verifyCommand = new Command("verify").description(
     opts,
     images,
     totalPhases,
+    localOnly,
     ...ollama ? { ollama } : {}
   });
   renderVerifySummary(report, { opts, totalPhases });
@@ -4291,7 +4307,7 @@ async function resolveOllamaVerifyInput(opts) {
   return mergeOllamaModelConfig(opts, envCfg);
 }
 async function runVerifyWithSpinner(args) {
-  const { apiHost, certWarnDays, cfToken, opts, images, totalPhases, ollama } = args;
+  const { apiHost, certWarnDays, cfToken, opts, images, totalPhases, localOnly, ollama } = args;
   let phaseIndex = 0;
   let activeSpin = null;
   const renderPhase = (ph) => {
@@ -4313,6 +4329,7 @@ async function runVerifyWithSpinner(args) {
         ...opts.tunnelId ? { tunnelId: opts.tunnelId } : {}
       },
       images,
+      localOnly,
       ...ollama ? { ollama } : {}
     },
     deps
@@ -5428,7 +5445,7 @@ function withDefaultSubcommand(argv, known) {
 }
 
 // src/cli.ts
-var VERSION = "0.14.0";
+var VERSION = "0.15.1";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."