create-op-node 0.15.1 → 0.15.2

package/dist/cli.js

@@ -1797,9 +1797,10 @@ if [ -n "$TUNNEL_TOKEN_VAL" ]; then
   export TUNNEL_TOKEN="$TUNNEL_TOKEN_VAL"
 fi
 
-# SUPABASE_URL is not a secret \u2014 read from env if the operator set one,
-# default to localhost for --local-only.
-export SUPABASE_URL="\${SUPABASE_URL:-http://localhost:8000}"
+# SUPABASE_URL is NOT exported here \u2014 it's non-secret config that lives in the
+# node .env managed block (create-op-node writes it), which docker compose
+# auto-loads. Exporting it would override that .env value with a stale default
+# and silently break browser-facing auth URLs. See opuspopuli-node#43.
 
 ${promptServiceUrlExport}# prompt-service credentials. Always exported \u2014 harmless when the operator
 # is NOT colocating prompt-service (the main compose doesn't read these
@@ -2224,7 +2225,8 @@ var MANAGED_KEYS = [
   "LLM_MODEL",
   "EMBEDDINGS_PROVIDER",
   "EMBEDDINGS_OLLAMA_MODEL",
-  "NODE_ENV"
+  "NODE_ENV",
+  "SUPABASE_URL"
 ];
 var ENV_VALUE_RE = /^[A-Za-z0-9][A-Za-z0-9._:/-]*$/;
 function selectionToPairs(sel) {
@@ -2232,7 +2234,8 @@ function selectionToPairs(sel) {
     ["LLM_MODEL", sel.llmModel],
     ["EMBEDDINGS_PROVIDER", sel.embeddingsProvider],
     ["EMBEDDINGS_OLLAMA_MODEL", sel.embeddingModel],
-    ["NODE_ENV", sel.nodeEnv]
+    ["NODE_ENV", sel.nodeEnv],
+    ["SUPABASE_URL", sel.supabaseUrl]
   ];
 }
 function parseEnvContent(content) {
@@ -2280,10 +2283,10 @@ function stripManagedKeyLines(region) {
 function renderBlock(values) {
   return [
     MANAGED_BEGIN,
-    "# Auto-generated by `create-op-node bootstrap`. Non-secret model config,",
-    "# read by docker compose via `.env` auto-load. Edit LLM_MODEL here to",
-    "# change the model for every service; re-running bootstrap preserves your",
-    "# edits unless you explicitly re-select a model. Secrets do NOT live here.",
+    "# Auto-generated by `create-op-node bootstrap`. Non-secret config (model",
+    "# selection + SUPABASE_URL), read by docker compose via `.env` auto-load.",
+    "# Edit a value here to change it for every service; re-running bootstrap",
+    "# preserves your edits unless you explicitly re-select. Secrets do NOT live here.",
     ...values.map(([k, v]) => `${k}=${v}`),
     MANAGED_END
   ];
@@ -2339,10 +2342,12 @@ async function readEnvModelConfig(repoDir) {
   const emb = map.get("EMBEDDINGS_OLLAMA_MODEL");
   const prov = map.get("EMBEDDINGS_PROVIDER");
   const node = map.get("NODE_ENV");
+  const supa = map.get("SUPABASE_URL");
   if (llm !== void 0) cfg.llmModel = llm;
   if (emb !== void 0) cfg.embeddingModel = emb;
   if (prov !== void 0) cfg.embeddingsProvider = prov;
   if (node !== void 0) cfg.nodeEnv = node;
+  if (supa !== void 0) cfg.supabaseUrl = supa;
   return cfg;
 }
 async function writeManagedEnv(repoDir, selection, opts = {}) {
@@ -2506,7 +2511,8 @@ var bootstrapCommand = new Command("bootstrap").description(
     llmModel,
     embeddingModel,
     embeddingsProvider,
-    localOnly: Boolean(opts.localOnly)
+    localOnly: Boolean(opts.localOnly),
+    supabaseUrl: secrets.supabaseUrl
   });
   await runStackPhase({ opts, repoPath, region, composeFile, secrets });
 });
@@ -2975,7 +2981,7 @@ async function runOllamaPhase(args) {
   }
 }
 async function runEnvFilePhase(args) {
-  const { repoPath, llmModel, embeddingModel, embeddingsProvider, localOnly } = args;
+  const { repoPath, llmModel, embeddingModel, embeddingsProvider, localOnly, supabaseUrl } = args;
   const envSpin = p3.spinner();
   envSpin.start("Writing model config to the node .env\u2026");
   const res = await writeManagedEnv(
@@ -2986,7 +2992,10 @@ async function runEnvFilePhase(args) {
       embeddingsProvider,
       // NODE_ENV=development only for local-dev nodes; production nodes leave
       // it unset (the compose default / container images decide).
-      ...localOnly ? { nodeEnv: "development" } : {}
+      ...localOnly ? { nodeEnv: "development" } : {},
+      // SUPABASE_URL lives in the managed block (not an op-compose export) so
+      // docker compose reads the node's real public URL from .env durably (#43).
+      supabaseUrl
     },
     { overwrite: true }
   );
@@ -4010,6 +4019,7 @@ async function runVerify(input, deps = DEFAULT_DEPS2) {
   await verifyHealthPhase(input, deps, push);
   await verifyGraphqlPhase(input, deps, push);
   await verifyOllamaModelsPhase(input, deps, push);
+  verifySupabaseUrlPhase(input, push);
   await verifyCloudflarePhase(input, deps, push);
   await verifyCosignPhase(input, deps, push);
   return { phases };
@@ -4087,6 +4097,28 @@ async function verifyOllamaModelsPhase(input, deps, push) {
   }
   push({ name: "Ollama models", status: "ok", detail: `${required.join(", ")} present` });
 }
+function verifySupabaseUrlPhase(input, push) {
+  if (input.localOnly) {
+    return skipLocalOnly("SUPABASE_URL", "local-only node \u2014 localhost:8000 is expected", push);
+  }
+  if (input.supabaseUrl === void 0) {
+    push({
+      name: "SUPABASE_URL",
+      status: "skipped",
+      detail: "run on the node (or pass --repo-dir) so its .env is read"
+    });
+    return;
+  }
+  if (input.supabaseUrl === "http://localhost:8000") {
+    push({
+      name: "SUPABASE_URL",
+      status: "warn",
+      detail: "still http://localhost:8000 on a non-local node \u2014 browser-facing auth URLs will point at localhost; set SUPABASE_URL in the node .env to the public URL"
+    });
+    return;
+  }
+  push({ name: "SUPABASE_URL", status: "ok", detail: input.supabaseUrl });
+}
 async function verifyCloudflarePhase(input, deps, push) {
   if (input.localOnly) return skipLocalOnly("Cloudflare Tunnel", "local-only node \u2014 no tunnel", push);
   const cfFields = [
@@ -4200,7 +4232,8 @@ var verifyCommand = new Command("verify").description(
   const apiHost = localOnly ? "" : opts.apiHost ?? `api.${domain}`;
   const images = opts.image ?? [];
   const ollama = await resolveOllamaVerifyInput(opts);
-  const totalPhases = 5 + (images.length === 0 ? 1 : images.length);
+  const supabaseUrl = await resolveSupabaseUrlVerifyInput(opts);
+  const totalPhases = 6 + (images.length === 0 ? 1 : images.length);
   const report = await runVerifyWithSpinner({
     apiHost,
     certWarnDays,
@@ -4209,7 +4242,8 @@ var verifyCommand = new Command("verify").description(
     images,
     totalPhases,
     localOnly,
-    ...ollama ? { ollama } : {}
+    ...ollama ? { ollama } : {},
+    ...supabaseUrl !== void 0 ? { supabaseUrl } : {}
   });
   renderVerifySummary(report, { opts, totalPhases });
   reportVerifyOutcome(report);
@@ -4306,6 +4340,12 @@ async function resolveOllamaVerifyInput(opts) {
   }
   return mergeOllamaModelConfig(opts, envCfg);
 }
+async function resolveSupabaseUrlVerifyInput(opts) {
+  const explicit = opts.repoDir !== void 0;
+  const dir = opts.repoDir ?? process.cwd();
+  if (!explicit && !await looksLikeNodeRepo(dir)) return void 0;
+  return (await readEnvModelConfig(dir)).supabaseUrl;
+}
 async function runVerifyWithSpinner(args) {
   const { apiHost, certWarnDays, cfToken, opts, images, totalPhases, localOnly, ollama } = args;
   let phaseIndex = 0;
@@ -5445,7 +5485,7 @@ function withDefaultSubcommand(argv, known) {
 }
 
 // src/cli.ts
-var VERSION = "0.15.1";
+var VERSION = "0.15.2";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."