create-op-node 0.2.0 → 0.4.0

package/dist/cli.js

@@ -225,81 +225,75 @@ async function safeExeca(cmd, args, options) {
   }
 }
 
-// src/lib/onepassword.ts
-async function detectOp() {
-  const version = await safeExeca("op", ["--version"]);
-  if (version === null) {
-    return { installed: false, signedIn: false };
-  }
-  const installed = true;
-  const whoami = await safeExeca("op", ["whoami", "--format=json"]);
-  if (whoami === null || whoami.exitCode !== 0) {
-    return { installed, signedIn: false };
-  }
-  let email;
-  try {
-    const parsed = JSON.parse(whoami.stdout);
-    email = parsed.email;
-  } catch {
-  }
-  return {
-    installed,
-    signedIn: true,
-    ...email ? { email } : {}
-  };
+// src/lib/keychain.ts
+var SERVICE_PREFIX = "org.opuspopuli";
+function serviceFor(region) {
+  return `${SERVICE_PREFIX}.${region}`;
 }
-async function saveSecretToOp(input) {
-  const vaultArg = input.vault ? ["--vault", input.vault] : [];
-  const existing = await safeExeca("op", ["item", "get", input.title, ...vaultArg, "--format=json"]);
-  if (existing === null) {
+function labelFor(coords) {
+  const friendly = coords.account === "pgsodium-root-key" ? "pgsodium root key" : "Cloudflare Tunnel token";
+  return `Opus Populi (${coords.region}) \u2014 ${friendly}`;
+}
+async function detectKeychain() {
+  const res = await safeExeca("security", ["-h"]);
+  if (res === null) {
     return {
-      written: false,
-      alreadyExisted: false,
-      reason: "`op` CLI not installed"
+      available: false,
+      reason: "`security` CLI not on PATH (Keychain requires macOS)"
     };
   }
-  if (existing.exitCode === 0) {
-    if (!input.overwrite) {
-      return { written: false, alreadyExisted: true };
-    }
-    const edit = await safeExeca(
-      "op",
-      ["item", "edit", input.title, ...vaultArg, `notesPlain=${input.value}`]
-    );
-    if (edit === null || edit.exitCode !== 0) {
-      return {
-        written: false,
-        alreadyExisted: true,
-        reason: `op item edit failed: ${edit?.stderr || edit?.stdout || "`op` not installed"}`
-      };
-    }
-    return { written: true, alreadyExisted: true };
-  }
-  const create = await safeExeca("op", [
-    "item",
-    "create",
-    "--category",
-    "Secure Note",
-    "--title",
-    input.title,
-    ...vaultArg,
-    `notesPlain=${input.value}`
+  return { available: true };
+}
+async function saveSecret(coords, value) {
+  const service = serviceFor(coords.region);
+  const label = labelFor(coords);
+  const existing = await safeExeca("security", [
+    "find-generic-password",
+    "-s",
+    service,
+    "-a",
+    coords.account
   ]);
-  if (create === null || create.exitCode !== 0) {
+  const updated = existing !== null && existing.exitCode === 0;
+  const res = await safeExeca("security", [
+    "add-generic-password",
+    "-U",
+    // upsert
+    "-s",
+    service,
+    "-a",
+    coords.account,
+    "-l",
+    label,
+    "-D",
+    "Opus Populi secret",
+    "-w",
+    value
+    // argv-exposure caveat, see file header
+  ]);
+  if (res === null) {
+    return { written: false, updated: false, reason: "`security` CLI not on PATH" };
+  }
+  if (res.exitCode !== 0) {
     return {
       written: false,
-      alreadyExisted: false,
-      reason: `op item create failed: ${create?.stderr || create?.stdout || "`op` not installed"}`
+      updated,
+      reason: `security add-generic-password failed (${res.exitCode ?? "signal"}): ${res.stderr || res.stdout}`
     };
   }
-  return { written: true, alreadyExisted: false };
-}
-async function readSecretFromOp(input) {
-  const vaultArg = input.vault ? ["--vault", input.vault] : [];
-  const res = await safeExeca(
-    "op",
-    ["item", "get", input.title, ...vaultArg, "--fields", "notesPlain", "--reveal"]
-  );
+  return { written: true, updated };
+}
+async function readSecret(coords) {
+  const service = serviceFor(coords.region);
+  const res = await safeExeca("security", [
+    "find-generic-password",
+    "-s",
+    service,
+    "-a",
+    coords.account,
+    "-w"
+    // print the password to stdout (final flag = read mode)
+  ]);
   if (res === null || res.exitCode !== 0) return null;
   const value = res.stdout.trim();
   return value.length > 0 ? value : null;
@@ -532,10 +526,10 @@ var initCommand = new Command("init").description(
   new Option("--template <owner/repo>", "Template repo to clone from").default(
     "OpusPopuli/opuspopuli-node"
   )
-).addOption(new Option("--project <name>", "tfvars project prefix").default("opuspopuli")).addOption(new Option("--cf-token <token>", "Cloudflare Account API token").env("CF_TOKEN")).addOption(new Option("--cf-account <id>", "Cloudflare account ID").env("CF_ACCOUNT")).addOption(new Option("--cf-zone <id>", "Cloudflare zone ID for your domain").env("CF_ZONE")).addOption(new Option("--tf-token <token>", "Terraform Cloud user/team token").env("TF_API_TOKEN")).addOption(new Option("--tf-org <org>", "Terraform Cloud organization").env("TF_CLOUD_ORGANIZATION")).addOption(new Option("--gh-token <token>", "GitHub Personal Access Token (else gh CLI)").env("GH_TOKEN")).addOption(new Option("--vault <vault>", "1Password vault for secrets").default("Private")).addOption(
+).addOption(new Option("--project <name>", "tfvars project prefix").default("opuspopuli")).addOption(new Option("--cf-token <token>", "Cloudflare Account API token").env("CF_TOKEN")).addOption(new Option("--cf-account <id>", "Cloudflare account ID").env("CF_ACCOUNT")).addOption(new Option("--cf-zone <id>", "Cloudflare zone ID for your domain").env("CF_ZONE")).addOption(new Option("--tf-token <token>", "Terraform Cloud user/team token").env("TF_API_TOKEN")).addOption(new Option("--tf-org <org>", "Terraform Cloud organization").env("TF_CLOUD_ORGANIZATION")).addOption(new Option("--gh-token <token>", "GitHub Personal Access Token (else gh CLI)").env("GH_TOKEN")).addOption(
   new Option(
     "--overwrite",
-    "Overwrite existing 1Password items (pgsodium key, Tunnel token) on a re-run"
+    "Overwrite existing Keychain items (pgsodium key, Tunnel token) on a re-run"
   ).default(false)
 ).addOption(
   new Option(
@@ -556,7 +550,7 @@ var initCommand = new Command("init").description(
   );
   const region = opts.region ? opts.region : unwrap(
     await p3.text({
-      message: "Short region label (used as a prefix in 1Password + R2)?",
+      message: "Short region label (used as the Keychain service suffix + R2 prefix)?",
       placeholder: "us-ca",
       validate: (v) => /^[a-z0-9-]{2,32}$/.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
     })
@@ -637,9 +631,10 @@ var initCommand = new Command("init").description(
       "github"
     );
   }
-  const op = await detectOp();
-  const opNote = op.installed ? op.signedIn ? `\u2713 1Password CLI signed in${op.email ? ` (${op.email})` : ""} \u2014 pgsodium key + Tunnel token will be saved automatically.` : `\u26A0 1Password CLI installed but not signed in. Run \`op signin\` in another shell, or you'll be prompted to paste secrets.` : `\u26A0 1Password CLI not installed. Secrets will be printed for you to paste into 1Password by hand.`;
-  p3.note(opNote, "1Password");
+  const keychain = await detectKeychain();
+  const kcNote = keychain.available ? `\u2713 macOS Keychain available \u2014 pgsodium key + Tunnel token will be saved to your login keychain.
+` + pc2.dim("Note: items don't sync to iCloud Keychain via the security CLI.\n") + pc2.dim("On the Studio, bootstrap will read locally and prompt you to paste if missing.") : `\u26A0 ${keychain.reason ?? "Keychain unavailable"}. Secrets will be printed for manual stash.`;
+  p3.note(kcNote, "Secret store");
   p3.note(
     [
       `Region label:        ${pc2.cyan(region)}`,
@@ -786,40 +781,30 @@ var initCommand = new Command("init").description(
     process.exit(1);
   }
   prSpin.stop(pc2.green(`\u2713 Opened PR #${pr.number}`));
-  const keyTitle = `opuspopuli-${region}-pgsodium-root-key`;
-  const vaultArg = opts.vault ? { vault: opts.vault } : {};
-  if (op.installed && op.signedIn) {
-    const existing = opts.overwrite ? null : await readSecretFromOp({ title: keyTitle, ...vaultArg });
+  const pgsodiumCoords = { region, account: "pgsodium-root-key" };
+  const keyLabel = `org.opuspopuli.${region}/pgsodium-root-key`;
+  if (keychain.available) {
+    const existing = opts.overwrite ? null : await readSecret(pgsodiumCoords);
     if (existing && /^[a-f0-9]{64}$/.test(existing)) {
       p3.note(
-        `${pc2.green("\u2713")} Re-using existing pgsodium master key from 1Password (${pc2.cyan(keyTitle)}). Pass --overwrite to rotate.`,
+        `${pc2.green("\u2713")} Re-using existing pgsodium master key from Keychain (${pc2.cyan(keyLabel)}). Pass --overwrite to rotate.`,
         "Secret"
       );
     } else {
       const fresh = generatePgsodiumRootKey();
-      const r = await saveSecretToOp({
-        title: keyTitle,
-        value: fresh,
-        overwrite: opts.overwrite ?? false,
-        ...vaultArg
-      });
+      const r = await saveSecret(pgsodiumCoords, fresh);
       if (r.written) {
         p3.note(
-          `${pc2.green("\u2713")} pgsodium master key${r.alreadyExisted ? " rotated" : " saved"} to 1Password as ${pc2.cyan(keyTitle)}.`,
-          "Secret"
-        );
-      } else if (r.alreadyExisted) {
-        p3.note(
-          `${pc2.yellow("!")} 1Password has an item titled ${pc2.cyan(keyTitle)} but its value is NOT a 64-hex pgsodium key. Inspect it in 1Password; re-run with --overwrite to replace.`,
+          `${pc2.green("\u2713")} pgsodium master key${r.updated ? " rotated" : " saved"} to Keychain as ${pc2.cyan(keyLabel)}.`,
           "Secret"
         );
       } else {
-        await printKeyForManualSave(fresh, keyTitle, r.reason);
+        await printKeyForManualSave(fresh, keyLabel, r.reason);
       }
     }
   } else {
     const fresh = generatePgsodiumRootKey();
-    await printKeyForManualSave(fresh, keyTitle);
+    await printKeyForManualSave(fresh, keyLabel);
   }
   if (opts.skipWait) {
     p3.outro(
@@ -870,24 +855,20 @@ var initCommand = new Command("init").description(
     );
     process.exit(1);
   }
-  const tunnelTitle = `opuspopuli-${region}-tunnel-token`;
-  if (op.installed && op.signedIn) {
-    const r = await saveSecretToOp({
-      title: tunnelTitle,
-      value: tunnelToken,
-      ...opts.vault ? { vault: opts.vault } : {},
-      overwrite: true
-    });
+  const tunnelCoords = { region, account: "tunnel-token" };
+  const tunnelLabel = `org.opuspopuli.${region}/tunnel-token`;
+  if (keychain.available) {
+    const r = await saveSecret(tunnelCoords, tunnelToken);
     if (r.written) {
       p3.note(
-        `${pc2.green("\u2713")} Tunnel token saved to 1Password as ${pc2.cyan(tunnelTitle)}.`,
+        `${pc2.green("\u2713")} Tunnel token saved to Keychain as ${pc2.cyan(tunnelLabel)}.`,
         "Secret"
       );
     } else {
-      await printKeyForManualSave(tunnelToken, tunnelTitle, r.reason);
+      await printKeyForManualSave(tunnelToken, tunnelLabel, r.reason);
     }
   } else {
-    await printKeyForManualSave(tunnelToken, tunnelTitle);
+    await printKeyForManualSave(tunnelToken, tunnelLabel);
   }
   p3.outro(
     pc2.cyan(
@@ -923,21 +904,22 @@ async function collectId(preset, message) {
   );
   return v;
 }
-async function printKeyForManualSave(value, title, reason) {
+async function printKeyForManualSave(value, label, reason) {
   p3.note(
     [
       reason ? `${pc2.red("\u2717")} ${reason}` : "",
-      `Save this value to 1Password as ${pc2.cyan(title)}:`,
+      `Save this value to your secret store as ${pc2.cyan(label)}:`,
       "",
       pc2.yellow(value),
       "",
-      pc2.dim("It will not be shown again.")
+      pc2.dim("It will not be shown again."),
+      pc2.dim("On the Studio, bootstrap will prompt you to paste it back.")
     ].filter((line) => line.length > 0).join("\n"),
     "Manual save"
   );
   unwrap(
     await p3.confirm({
-      message: "Value stashed in 1Password?",
+      message: "Value stashed?",
       initialValue: true
     })
   );
@@ -1128,7 +1110,7 @@ async function writePgsodiumKeyFile(key, keyFile) {
   }
 }
 function renderLaunchAgentPlist(input) {
-  if (!TUNNEL_TOKEN_RE.test(input.tunnelToken)) {
+  if (input.tunnelToken !== void 0 && !TUNNEL_TOKEN_RE.test(input.tunnelToken)) {
     throw new Error("Tunnel token contains characters outside the expected base64-url set");
   }
   if (!SAFE_PATH_RE.test(input.keyFilePath)) {
@@ -1136,7 +1118,11 @@ function renderLaunchAgentPlist(input) {
       `keyFilePath ${JSON.stringify(input.keyFilePath)} contains characters not allowed in a launchd path interpolation`
     );
   }
-  const command = `launchctl setenv PGSODIUM_ROOT_KEY "$(cat ${input.keyFilePath})"; launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`;
+  const setenvLines = [
+    `launchctl setenv PGSODIUM_ROOT_KEY "$(cat ${input.keyFilePath})"`,
+    ...input.tunnelToken !== void 0 ? [`launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`] : []
+  ];
+  const command = setenvLines.join("; ");
   return [
     '<?xml version="1.0" encoding="UTF-8"?>',
     '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
@@ -1189,7 +1175,7 @@ async function setupLaunchAgent(input) {
   try {
     plistContent = renderLaunchAgentPlist({
       keyFilePath: paths.keyFile,
-      tunnelToken: input.tunnelToken
+      ...input.tunnelToken !== void 0 ? { tunnelToken: input.tunnelToken } : {}
     });
   } catch (err) {
     return { ok: false, paths, step: "plist", reason: err.message };
@@ -1272,7 +1258,8 @@ async function loginToGhcr() {
 function composeArgs(opts, sub) {
   const files = opts.files.flatMap((f) => ["-f", f]);
   const env = opts.envFile ? ["--env-file", opts.envFile] : [];
-  return ["compose", ...files, ...env, ...sub];
+  const profiles = (opts.profiles ?? []).flatMap((pr) => ["--profile", pr]);
+  return ["compose", ...files, ...env, ...profiles, ...sub];
 }
 async function composePull(opts) {
   const res = await safeExeca("docker", composeArgs(opts, ["pull"]));
@@ -1282,6 +1269,10 @@ async function composeUp(opts) {
   const res = await safeExeca("docker", composeArgs(opts, ["up", "-d", "--remove-orphans"]));
   return result(res, "compose up");
 }
+async function composeRemoveService(opts, service) {
+  const res = await safeExeca("docker", composeArgs(opts, ["rm", "-sfv", service]));
+  return result(res, `compose rm ${service}`);
+}
 async function composeDown(opts) {
   const flags = ["down"];
   if (opts.wipeVolumes) flags.push("-v");
@@ -1561,19 +1552,26 @@ async function locateOrCloneRepo(input) {
 }
 
 // src/commands/bootstrap.ts
+var PUBLIC_PROFILES = ["public"];
+var LOCAL_PROFILES = [];
 var bootstrapCommand = new Command("bootstrap").description(
   "Configure the Mac Studio and bring the stack up. Run this on the Studio itself, after `init` has finished on your laptop."
-).addOption(new Option("--region <slug>", "Region label set during init (e.g. us-ca)")).addOption(new Option("--owner <owner>", "GitHub owner for the node repo").default("OpusPopuli")).addOption(new Option("--vault <vault>", "1Password vault to read secrets from").default("Private")).addOption(new Option("--repo-dir <path>", "Explicit path to a checked-out node repo (overrides cwd + clone)")).addOption(
+).addOption(new Option("--region <slug>", "Region label set during init (e.g. us-ca)")).addOption(new Option("--owner <owner>", "GitHub owner for the node repo").default("OpusPopuli")).addOption(new Option("--repo-dir <path>", "Explicit path to a checked-out node repo (overrides cwd + clone)")).addOption(
   new Option(
     "--compose-file <path>",
-    "Repeatable. Compose file relative to repo root. Default: docker-compose-prod.yml + docker-compose-backup.yml"
-  ).default(["docker-compose-prod.yml", "docker-compose-backup.yml"])
+    "Repeatable. Compose file relative to repo root. Default: prod + backup (production), prod only (--local-only)."
+  )
 ).addOption(new Option("--env-file <path>", "Compose --env-file. Default: .env.production")).addOption(new Option("--skip-brew", "Skip the Homebrew package install pass").default(false)).addOption(
   new Option(
     "--skip-launch-agent",
     "Skip the LaunchAgent setup (assumes one is already in place)"
   ).default(false)
-).addOption(new Option("--skip-ollama", "Skip the Ollama model pull + warm").default(false)).addOption(new Option("--skip-stack", "Stop before `docker compose pull && up`").default(false)).addOption(new Option("-y, --yes", "Skip confirmation prompts").default(false)).action(async (opts) => {
+).addOption(new Option("--skip-ollama", "Skip the Ollama model pull + warm").default(false)).addOption(new Option("--skip-stack", "Stop before `docker compose pull && up`").default(false)).addOption(
+  new Option(
+    "--local-only",
+    "Run for local dev / testing: no Tunnel token required, cloudflared stays down. Auto-generates the pgsodium key if not in Keychain (init unnecessary)."
+  ).default(false)
+).addOption(new Option("-y, --yes", "Skip confirmation prompts").default(false)).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node bootstrap ")));
   const region = opts.region ? opts.region : unwrap(
     await p3.text({
@@ -1584,6 +1582,8 @@ var bootstrapCommand = new Command("bootstrap").description(
   );
   const owner = opts.owner ?? "OpusPopuli";
   const repoName = `opuspopuli-node-${region}`;
+  const composeFileDefault = opts.localOnly ? ["docker-compose-prod.yml"] : ["docker-compose-prod.yml", "docker-compose-backup.yml"];
+  const composeFile = opts.composeFile ?? composeFileDefault;
   const sysSpin = p3.spinner();
   sysSpin.start("Inspecting macOS\u2026");
   const snap = await inspectSystem();
@@ -1693,47 +1693,44 @@ var bootstrapCommand = new Command("bootstrap").description(
   repoSpin.stop(
     located.kind === "cloned" ? pc2.green(`\u2713 Cloned ${owner}/${repoName} to ${repoPath}`) : pc2.green(`\u2713 Found region repo at ${repoPath}`)
   );
-  const op = await detectOp();
-  if (!op.installed || !op.signedIn) {
-    p3.cancel(
-      "1Password CLI not installed or not signed in. Run `op signin` and re-run bootstrap. (Or paste pgsodium key + Tunnel token by hand \u2014 manual path not in v0.1.)"
-    );
-    process.exit(1);
-  }
-  const keyTitle = `opuspopuli-${region}-pgsodium-root-key`;
-  const tunnelTitle = `opuspopuli-${region}-tunnel-token`;
-  const vaultArg = opts.vault ? { vault: opts.vault } : {};
-  const opSpin = p3.spinner();
-  opSpin.start("Reading pgsodium key + Tunnel token from 1Password\u2026");
-  const pgsodiumKey = await readSecretFromOp({ title: keyTitle, ...vaultArg });
-  const tunnelToken = await readSecretFromOp({ title: tunnelTitle, ...vaultArg });
-  if (!pgsodiumKey || !tunnelToken) {
-    opSpin.stop(pc2.red("\u2717 Required 1Password items missing."));
-    const missing = [
-      pgsodiumKey ? null : keyTitle,
-      tunnelToken ? null : tunnelTitle
-    ].filter(Boolean);
+  const keychain = await detectKeychain();
+  if (!keychain.available) {
     p3.cancel(
-      `Missing in 1Password (vault: ${opts.vault ?? "Private"}): ${missing.join(", ")}. Run \`create-op-node init\` first, or pass --vault if your items live elsewhere.`
+      `${keychain.reason ?? "Keychain unavailable"}. Bootstrap requires the macOS Keychain.`
     );
     process.exit(1);
   }
-  if (!PGSODIUM_KEY_RE.test(pgsodiumKey)) {
-    opSpin.stop(pc2.red("\u2717 pgsodium item exists but isn't a 64-hex key."));
-    p3.cancel("Inspect the item in 1Password; it should be 64 lowercase hex characters.");
-    process.exit(1);
-  }
-  opSpin.stop(pc2.green("\u2713 Secrets read from 1Password."));
+  const pgsodiumKey = await loadSecret({
+    region,
+    account: "pgsodium-root-key",
+    label: "pgsodium master key",
+    validate: (v) => PGSODIUM_KEY_RE.test(v) ? void 0 : "must be exactly 64 lowercase hex characters",
+    ...opts.localOnly ? { generate: generatePgsodiumRootKey } : {}
+  });
+  const tunnelToken = opts.localOnly ? void 0 : await loadSecret({
+    region,
+    account: "tunnel-token",
+    label: "Cloudflare Tunnel token",
+    placeholder: "JWT-style base64url string from `terraform output tunnel_token`",
+    validate: (v) => TUNNEL_TOKEN_RE.test(v) ? void 0 : "tunnel token must be a base64-url JWT"
+  });
   if (!opts.skipLaunchAgent) {
     const laSpin = p3.spinner();
     laSpin.start("Writing pgsodium key file + LaunchAgent plist\u2026");
-    const la = await setupLaunchAgent({ pgsodiumKey, tunnelToken });
+    const la = await setupLaunchAgent({
+      pgsodiumKey,
+      ...tunnelToken !== void 0 ? { tunnelToken } : {}
+    });
     if (!la.ok) {
       laSpin.stop(pc2.red(`\u2717 LaunchAgent step ${la.step} failed.`));
       p3.cancel(la.reason ?? "LaunchAgent setup failed.");
       process.exit(1);
     }
-    laSpin.stop(pc2.green(`\u2713 LaunchAgent loaded (${la.paths.plistFile}).`));
+    laSpin.stop(
+      pc2.green(
+        `\u2713 LaunchAgent loaded (${la.paths.plistFile})${opts.localOnly ? " \u2014 local-only mode, no TUNNEL_TOKEN set" : ""}.`
+      )
+    );
   }
   const ghcrSpin = p3.spinner();
   ghcrSpin.start("Authenticating Docker to ghcr.io\u2026");
@@ -1784,19 +1781,32 @@ var bootstrapCommand = new Command("bootstrap").description(
     }
   }
   if (opts.skipStack) {
+    const profileFlag = opts.localOnly ? "" : "--profile public ";
     p3.outro(
       pc2.cyan(
-        `Stack-up skipped. Run \`docker compose -f ${(opts.composeFile ?? ["docker-compose-prod.yml"]).join(" -f ")} pull && up -d\` from ${repoPath} when ready.`
+        `Stack-up skipped. Run \`docker compose -f ${composeFile.join(" -f ")} ${profileFlag}pull && docker compose -f ${composeFile.join(" -f ")} ${profileFlag}up -d\` from ${repoPath} when ready.`
       )
     );
     return;
   }
-  const composeFiles = resolveComposeFiles(repoPath, opts.composeFile);
+  const composeFiles = resolveComposeFiles(repoPath, composeFile);
   const composeOpts = {
     files: composeFiles,
     cwd: repoPath,
-    ...opts.envFile ? { envFile: opts.envFile } : {}
+    ...opts.envFile ? { envFile: opts.envFile } : {},
+    profiles: opts.localOnly ? LOCAL_PROFILES : PUBLIC_PROFILES
   };
+  if (opts.localOnly) {
+    const evict = p3.spinner();
+    evict.start("Evicting any cloudflared from a prior public bootstrap\u2026");
+    const rm2 = await composeRemoveService(
+      { ...composeOpts, profiles: PUBLIC_PROFILES },
+      "cloudflared"
+    );
+    evict.stop(
+      rm2.ok ? pc2.green("\u2713 cloudflared not present (or removed).") : pc2.yellow(`\u26A0 cloudflared eviction reported: ${rm2.reason ?? "unknown"} \u2014 continuing.`)
+    );
+  }
   const pullSpin = p3.spinner();
   pullSpin.start("Pulling images from ghcr.io\u2026");
   const pull = await composePull(composeOpts);
@@ -1827,11 +1837,23 @@ var bootstrapCommand = new Command("bootstrap").description(
   switch (outcome.kind) {
     case "healthy":
       healthSpin.stop(pc2.green(`\u2713 All ${outcome.snapshots.length} containers healthy.`));
-      p3.outro(
-        pc2.cyan(
-          `Region ${region} is up. Next: verify off-LAN with \`npx create-op-node verify --domain <your-domain>\`.`
-        )
-      );
+      if (opts.localOnly) {
+        p3.outro(
+          pc2.cyan(
+            [
+              `Region ${region} is up locally (no public Cloudflare Tunnel \u2014 cloudflared stays down).`,
+              `Access from your laptop over Tailscale at this Studio's tailnet IP.`,
+              `When you're ready to expose publicly, re-run \`bootstrap\` without --local-only.`
+            ].join("\n")
+          )
+        );
+      } else {
+        p3.outro(
+          pc2.cyan(
+            `Region ${region} is up. Next: verify off-LAN with \`npx create-op-node verify --domain <your-domain>\`.`
+          )
+        );
+      }
       return;
     case "unhealthy":
       healthSpin.stop(pc2.red(`\u2717 ${outcome.problem}`));
@@ -1958,6 +1980,47 @@ async function promptTailscaleSignin() {
   );
   unwrap(await p3.confirm({ message: "Tailscale signed in (or skipped)?", initialValue: true }));
 }
+async function loadSecret(input) {
+  const coords = { region: input.region, account: input.account };
+  const spin = p3.spinner();
+  spin.start(`Reading ${input.label} from Keychain\u2026`);
+  const existing = await readSecret(coords);
+  if (existing && input.validate(existing) === void 0) {
+    spin.stop(pc2.green(`\u2713 ${input.label} read from Keychain.`));
+    return existing;
+  }
+  spin.stop(
+    existing ? pc2.yellow(`\u26A0 ${input.label} in Keychain failed format validation \u2014 will replace.`) : pc2.dim(`\xB7 ${input.label} not in Keychain.`)
+  );
+  if (input.generate) {
+    const fresh = input.generate();
+    const save2 = await saveSecret(coords, fresh);
+    if (!save2.written) {
+      p3.cancel(
+        `Generated a fresh ${input.label} but couldn't persist it to Keychain: ${save2.reason ?? "unknown"}. Continuing would risk silent key rotation on the next re-run. Resolve the Keychain access (re-grant via Keychain Access.app or check the security CLI) and re-run.`
+      );
+      process.exit(1);
+    }
+    p3.note(`${pc2.green("\u2713")} Generated fresh ${input.label} and stored in Keychain.`, "Keychain");
+    return fresh;
+  }
+  const pasted = unwrap(
+    await p3.password({
+      message: `Paste the ${input.label} for region ${input.region}:`,
+      validate: (v) => input.validate(v ?? "")
+    })
+  );
+  const save = await saveSecret(coords, pasted);
+  if (!save.written) {
+    p3.note(
+      `${pc2.yellow("\u26A0")} Couldn't persist to Keychain: ${save.reason ?? "unknown"}. You'll need to paste it again next run.`,
+      "Keychain"
+    );
+  } else {
+    p3.note(`${pc2.green("\u2713")} Stored ${input.label} in Keychain for re-runs.`, "Keychain");
+  }
+  return pasted;
+}
 var REGION_RE = /^[a-z0-9-]{2,32}$/;
 var RESET_PHASES = {
   STOP_STACK: "Stop stack",
@@ -3665,7 +3728,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.2.0";
+var VERSION = "0.4.0";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."