create-op-node 0.15.0 → 0.15.2

package/README.md

@@ -72,7 +72,7 @@ The chosen models flow two places:
 1. **Ollama**: bootstrap pulls + warms them so the daemon has them
    resident before the stack comes up. The embedding model pulls first
    (small, fast feedback); the LLM pulls second (can be tens of GB).
-2. **The node `.env`**: bootstrap writes `LLM_MODEL`, `EMBEDDINGS_MODEL`,
+2. **The node `.env`**: bootstrap writes `LLM_MODEL`, `EMBEDDINGS_OLLAMA_MODEL`,
    and `EMBEDDINGS_PROVIDER` into a managed block of the region repo's
    `.env`, which docker compose auto-loads. This is the **single source of
    truth** — every service (and every future partial recreate) resolves
@@ -91,9 +91,10 @@ The chosen models flow two places:
 
 > **`--embeddings-provider` picks where embeddings run.** The default is
 > `xenova` (in-process), which bundles its own embedding model and ignores
-> `EMBEDDINGS_MODEL`. Pass `--embeddings-provider ollama` to use the host
-> daemon with `--embedding-model` — the value is written to `.env` as the
-> single source of truth. See `docs/provider-pattern.md`.
+> `EMBEDDINGS_OLLAMA_MODEL`. Pass `--embeddings-provider ollama` to use the host
+> daemon with `--embedding-model` — the value is written to `.env` (as
+> `EMBEDDINGS_OLLAMA_MODEL`, the key the backend reads) as the single source of
+> truth. See `docs/provider-pattern.md`.
 
 > **Template contract**: for `LLM_MODEL` to actually change the running
 > model, the region repo's `docker-compose-prod.yml` must use

package/dist/cli.js

@@ -1797,9 +1797,10 @@ if [ -n "$TUNNEL_TOKEN_VAL" ]; then
   export TUNNEL_TOKEN="$TUNNEL_TOKEN_VAL"
 fi
 
-# SUPABASE_URL is not a secret \u2014 read from env if the operator set one,
-# default to localhost for --local-only.
-export SUPABASE_URL="\${SUPABASE_URL:-http://localhost:8000}"
+# SUPABASE_URL is NOT exported here \u2014 it's non-secret config that lives in the
+# node .env managed block (create-op-node writes it), which docker compose
+# auto-loads. Exporting it would override that .env value with a stale default
+# and silently break browser-facing auth URLs. See opuspopuli-node#43.
 
 ${promptServiceUrlExport}# prompt-service credentials. Always exported \u2014 harmless when the operator
 # is NOT colocating prompt-service (the main compose doesn't read these
@@ -2223,16 +2224,18 @@ var MANAGED_END = "# <<< op-node managed <<<";
 var MANAGED_KEYS = [
   "LLM_MODEL",
   "EMBEDDINGS_PROVIDER",
-  "EMBEDDINGS_MODEL",
-  "NODE_ENV"
+  "EMBEDDINGS_OLLAMA_MODEL",
+  "NODE_ENV",
+  "SUPABASE_URL"
 ];
 var ENV_VALUE_RE = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/;
 function selectionToPairs(sel) {
   return [
     ["LLM_MODEL", sel.llmModel],
     ["EMBEDDINGS_PROVIDER", sel.embeddingsProvider],
-    ["EMBEDDINGS_MODEL", sel.embeddingModel],
-    ["NODE_ENV", sel.nodeEnv]
+    ["EMBEDDINGS_OLLAMA_MODEL", sel.embeddingModel],
+    ["NODE_ENV", sel.nodeEnv],
+    ["SUPABASE_URL", sel.supabaseUrl]
   ];
 }
 function parseEnvContent(content) {
@@ -2280,10 +2283,10 @@ function stripManagedKeyLines(region) {
 function renderBlock(values) {
   return [
     MANAGED_BEGIN,
-    "# Auto-generated by `create-op-node bootstrap`. Non-secret model config,",
-    "# read by docker compose via `.env` auto-load. Edit LLM_MODEL here to",
-    "# change the model for every service; re-running bootstrap preserves your",
-    "# edits unless you explicitly re-select a model. Secrets do NOT live here.",
+    "# Auto-generated by `create-op-node bootstrap`. Non-secret config (model",
+    "# selection + SUPABASE_URL), read by docker compose via `.env` auto-load.",
+    "# Edit a value here to change it for every service; re-running bootstrap",
+    "# preserves your edits unless you explicitly re-select. Secrets do NOT live here.",
     ...values.map(([k, v]) => `${k}=${v}`),
     MANAGED_END
   ];
@@ -2336,13 +2339,15 @@ async function readEnvModelConfig(repoDir) {
   const map = parseEnvContent(content);
   const cfg = {};
   const llm = map.get("LLM_MODEL");
-  const emb = map.get("EMBEDDINGS_MODEL");
+  const emb = map.get("EMBEDDINGS_OLLAMA_MODEL");
   const prov = map.get("EMBEDDINGS_PROVIDER");
   const node = map.get("NODE_ENV");
+  const supa = map.get("SUPABASE_URL");
   if (llm !== void 0) cfg.llmModel = llm;
   if (emb !== void 0) cfg.embeddingModel = emb;
   if (prov !== void 0) cfg.embeddingsProvider = prov;
   if (node !== void 0) cfg.nodeEnv = node;
+  if (supa !== void 0) cfg.supabaseUrl = supa;
   return cfg;
 }
 async function writeManagedEnv(repoDir, selection, opts = {}) {
@@ -2506,7 +2511,8 @@ var bootstrapCommand = new Command("bootstrap").description(
     llmModel,
     embeddingModel,
     embeddingsProvider,
-    localOnly: Boolean(opts.localOnly)
+    localOnly: Boolean(opts.localOnly),
+    supabaseUrl: secrets.supabaseUrl
   });
   await runStackPhase({ opts, repoPath, region, composeFile, secrets });
 });
@@ -2975,7 +2981,7 @@ async function runOllamaPhase(args) {
   }
 }
 async function runEnvFilePhase(args) {
-  const { repoPath, llmModel, embeddingModel, embeddingsProvider, localOnly } = args;
+  const { repoPath, llmModel, embeddingModel, embeddingsProvider, localOnly, supabaseUrl } = args;
   const envSpin = p3.spinner();
   envSpin.start("Writing model config to the node .env\u2026");
   const res = await writeManagedEnv(
@@ -2986,7 +2992,10 @@ async function runEnvFilePhase(args) {
       embeddingsProvider,
       // NODE_ENV=development only for local-dev nodes; production nodes leave
       // it unset (the compose default / container images decide).
-      ...localOnly ? { nodeEnv: "development" } : {}
+      ...localOnly ? { nodeEnv: "development" } : {},
+      // SUPABASE_URL lives in the managed block (not an op-compose export) so
+      // docker compose reads the node's real public URL from .env durably (#43).
+      supabaseUrl
     },
     { overwrite: true }
   );
@@ -3029,7 +3038,7 @@ function buildComposeEnv(args) {
     ...secrets.promptServiceApiKey !== void 0 ? { PROMPT_SERVICE_API_KEY: secrets.promptServiceApiKey } : {},
     ...secrets.promptServiceApiKeys !== void 0 ? { PROMPT_SERVICE_API_KEYS: secrets.promptServiceApiKeys } : {},
     ...secrets.promptServiceAdminApiKeys !== void 0 ? { PROMPT_SERVICE_ADMIN_API_KEYS: secrets.promptServiceAdminApiKeys } : {}
-    // Model config (LLM_MODEL / EMBEDDINGS_MODEL / NODE_ENV) is intentionally
+    // Model config (LLM_MODEL / EMBEDDINGS_OLLAMA_MODEL / NODE_ENV) is intentionally
     // NOT injected here — it lives in the node's `.env` (runEnvFilePhase),
     // which docker compose auto-loads. Injecting it into the subprocess env
     // would shadow `.env` (shell env > .env) and reintroduce the drift the
@@ -4010,6 +4019,7 @@ async function runVerify(input, deps = DEFAULT_DEPS2) {
   await verifyHealthPhase(input, deps, push);
   await verifyGraphqlPhase(input, deps, push);
   await verifyOllamaModelsPhase(input, deps, push);
+  verifySupabaseUrlPhase(input, push);
   await verifyCloudflarePhase(input, deps, push);
   await verifyCosignPhase(input, deps, push);
   return { phases };
@@ -4087,6 +4097,28 @@ async function verifyOllamaModelsPhase(input, deps, push) {
   }
   push({ name: "Ollama models", status: "ok", detail: `${required.join(", ")} present` });
 }
+function verifySupabaseUrlPhase(input, push) {
+  if (input.localOnly) {
+    return skipLocalOnly("SUPABASE_URL", "local-only node \u2014 localhost:8000 is expected", push);
+  }
+  if (input.supabaseUrl === void 0) {
+    push({
+      name: "SUPABASE_URL",
+      status: "skipped",
+      detail: "run on the node (or pass --repo-dir) so its .env is read"
+    });
+    return;
+  }
+  if (input.supabaseUrl === "http://localhost:8000") {
+    push({
+      name: "SUPABASE_URL",
+      status: "warn",
+      detail: "still http://localhost:8000 on a non-local node \u2014 browser-facing auth URLs will point at localhost; set SUPABASE_URL in the node .env to the public URL"
+    });
+    return;
+  }
+  push({ name: "SUPABASE_URL", status: "ok", detail: input.supabaseUrl });
+}
 async function verifyCloudflarePhase(input, deps, push) {
   if (input.localOnly) return skipLocalOnly("Cloudflare Tunnel", "local-only node \u2014 no tunnel", push);
   const cfFields = [
@@ -4200,7 +4232,8 @@ var verifyCommand = new Command("verify").description(
   const apiHost = localOnly ? "" : opts.apiHost ?? `api.${domain}`;
   const images = opts.image ?? [];
   const ollama = await resolveOllamaVerifyInput(opts);
-  const totalPhases = 5 + (images.length === 0 ? 1 : images.length);
+  const supabaseUrl = await resolveSupabaseUrlVerifyInput(opts);
+  const totalPhases = 6 + (images.length === 0 ? 1 : images.length);
   const report = await runVerifyWithSpinner({
     apiHost,
     certWarnDays,
@@ -4209,7 +4242,8 @@ var verifyCommand = new Command("verify").description(
     images,
     totalPhases,
     localOnly,
-    ...ollama ? { ollama } : {}
+    ...ollama ? { ollama } : {},
+    ...supabaseUrl !== void 0 ? { supabaseUrl } : {}
   });
   renderVerifySummary(report, { opts, totalPhases });
   reportVerifyOutcome(report);
@@ -4306,6 +4340,12 @@ async function resolveOllamaVerifyInput(opts) {
   }
   return mergeOllamaModelConfig(opts, envCfg);
 }
+async function resolveSupabaseUrlVerifyInput(opts) {
+  const explicit = opts.repoDir !== void 0;
+  const dir = opts.repoDir ?? process.cwd();
+  if (!explicit && !await looksLikeNodeRepo(dir)) return void 0;
+  return (await readEnvModelConfig(dir)).supabaseUrl;
+}
 async function runVerifyWithSpinner(args) {
   const { apiHost, certWarnDays, cfToken, opts, images, totalPhases, localOnly, ollama } = args;
   let phaseIndex = 0;
@@ -5445,7 +5485,7 @@ function withDefaultSubcommand(argv, known) {
 }
 
 // src/cli.ts
-var VERSION = "0.15.0";
+var VERSION = "0.15.2";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."