create-op-node 0.3.0 → 0.5.0

package/dist/cli.js

@@ -536,10 +536,23 @@ var initCommand = new Command("init").description(
     "--use-existing-repo",
     "Continue using a previously-created node repo (don't fail on 'already exists')"
   ).default(false)
-).addOption(new Option("--skip-wait", "Don't poll for Terraform apply; exit after PR open").default(false)).addOption(new Option("-y, --yes", "Skip the final confirmation").default(false)).action(async (opts) => {
+).addOption(new Option("--skip-wait", "Don't poll for Terraform apply; exit after PR open").default(false)).addOption(
+  new Option(
+    "--local-only",
+    "Skip the Cloudflare/TFC/PR/tunnel phases. Creates the region repo from template + stores a pgsodium key \u2014 enough for `bootstrap --local-only` to work."
+  ).default(false)
+).addOption(new Option("-y, --yes", "Skip the final confirmation").default(false)).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node init ")));
   p3.note(
-    [
+    opts.localOnly ? [
+      "Local-only setup \u2014 creates the region repo from template + a pgsodium key.",
+      "No Cloudflare, no Terraform Cloud, no public exposure.",
+      "",
+      pc2.dim("Phase 1: laptop side (now) \u2014 GitHub repo from template + Keychain."),
+      pc2.dim("Phase 2: Studio side \u2014 `create-op-node bootstrap --local-only`."),
+      "",
+      pc2.dim("When you're ready to expose publicly, re-run `init` without --local-only.")
+    ].join("\n") : [
       "This walks you from a sealed Mac Studio + a Cloudflare account to a",
       "live federation node serving traffic at api.<your-domain>.",
       "",
@@ -555,62 +568,25 @@ var initCommand = new Command("init").description(
       validate: (v) => /^[a-z0-9-]{2,32}$/.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
     })
   );
-  const domain = opts.domain ? opts.domain : unwrap(
-    await p3.text({
-      message: "Domain registered in Cloudflare?",
-      placeholder: "example.org",
-      validate: (v) => !v ? "Required" : v.includes(".") ? void 0 : "Missing a TLD?"
-    })
-  );
   const owner = opts.owner ?? "OpusPopuli";
   const newRepoName = `opuspopuli-node-${region}`;
   const newRepoFull = `${owner}/${newRepoName}`;
-  const cfToken = await collectSecret(
-    opts.cfToken,
-    "Cloudflare Account API token (input hidden)",
-    "cloudflare"
-  );
-  const cfAccount = await collectId(opts.cfAccount, "Cloudflare account ID");
-  const cfZone = await collectId(opts.cfZone, `Cloudflare zone ID for ${domain}`);
-  const cfSpin = p3.spinner();
-  cfSpin.start("Verifying Cloudflare token + 5 scopes\u2026");
-  const cfProbe = await probeCloudflareToken({
-    token: cfToken,
-    accountId: cfAccount,
-    zoneId: cfZone
-  });
-  if (!cfProbe.ok) {
-    cfSpin.stop(pc2.red("\u2717 Cloudflare token check failed."));
-    for (const issue of cfProbe.issues) console.error(`  - ${issue}`);
-    p3.cancel("Fix the token in the Cloudflare dashboard, then re-run.");
-    process.exit(1);
-  }
-  cfSpin.stop(pc2.green("\u2713 Cloudflare token valid, 5 scopes present."));
-  const tfToken = await collectSecret(
-    opts.tfToken,
-    "Terraform Cloud user/team API token",
-    "tfc"
-  );
-  const tfOrg = opts.tfOrg ? opts.tfOrg : unwrap(
-    await p3.text({
-      message: "Terraform Cloud organization name?",
-      placeholder: "op-region-ca"
-    })
-  );
-  const tfSpin = p3.spinner();
-  tfSpin.start("Verifying Terraform Cloud token + organization\u2026");
-  const tfProbe = await probeTfcToken({ token: tfToken, organization: tfOrg });
-  if (!tfProbe.ok) {
-    tfSpin.stop(pc2.red("\u2717 Terraform Cloud check failed."));
-    for (const issue of tfProbe.issues) console.error(`  - ${issue}`);
-    p3.cancel("Fix the token / org, then re-run.");
-    process.exit(1);
+  if (opts.localOnly) {
+    const ignored = listIgnoredLocalOnlyFlags(opts);
+    if (ignored.length > 0) {
+      p3.note(
+        pc2.yellow(
+          `\u26A0 The following ${ignored.length === 1 ? "flag is" : "flags are"} ignored with --local-only:
+  ${ignored.join(", ")}
+` + pc2.dim(
+            "These configure Cloudflare / TFC / PR-merge flow, which --local-only skips."
+          )
+        ),
+        "Notice"
+      );
+    }
   }
-  tfSpin.stop(
-    pc2.green(
-      `\u2713 TFC token valid${tfProbe.userName ? ` (as ${tfProbe.userName})` : ""}, org "${tfOrg}" reachable.`
-    )
-  );
+  const publicConfig = opts.localOnly ? null : await collectPublicConfig(opts);
   let ghToken = opts.ghToken;
   if (!ghToken) {
     const fromCli = await ghTokenFromCli();
@@ -636,12 +612,23 @@ var initCommand = new Command("init").description(
 ` + pc2.dim("Note: items don't sync to iCloud Keychain via the security CLI.\n") + pc2.dim("On the Studio, bootstrap will read locally and prompt you to paste if missing.") : `\u26A0 ${keychain.reason ?? "Keychain unavailable"}. Secrets will be printed for manual stash.`;
   p3.note(kcNote, "Secret store");
   p3.note(
-    [
+    opts.localOnly ? [
+      `Region label:        ${pc2.cyan(region)}`,
+      `New node repo:       ${pc2.cyan(newRepoFull)}`,
+      `Template:            ${pc2.dim(opts.template ?? "OpusPopuli/opuspopuli-node")}`,
+      `GH org write access: ${pc2.dim(`required for ${owner}`)}`,
+      ``,
+      `Will create the repo from template (private, no Cloudflare),`,
+      `and store a fresh pgsodium key in Keychain. That's it \u2014 no PR,`,
+      `no terraform, no tunnel token. Bootstrap on the Studio with`,
+      `\`bootstrap --local-only --region ${region}\` next.`
+    ].join("\n") : [
       `Region label:        ${pc2.cyan(region)}`,
-      `Domain:              ${pc2.cyan(domain)}`,
+      `Domain:              ${pc2.cyan(publicConfig?.domain ?? "")}`,
       `New node repo:       ${pc2.cyan(newRepoFull)}`,
       `Template:            ${pc2.dim(opts.template ?? "OpusPopuli/opuspopuli-node")}`,
-      `TFC organization:    ${pc2.cyan(tfOrg)}`,
+      `TFC organization:    ${pc2.cyan(publicConfig?.tfOrg ?? "")}`,
+      `GH org write access: ${pc2.dim(`required for ${owner}`)}`,
       ``,
       `Will create the repo, seed 5 secrets, write prod.tfvars on a branch,`,
       `open a PR, generate a fresh pgsodium key, and (after you merge) wait`,
@@ -697,90 +684,94 @@ var initCommand = new Command("init").description(
       defaultBranch: "main"
     };
   }
-  const secrets = [
-    { name: "CLOUDFLARE_API_TOKEN", value: cfToken },
-    { name: "CLOUDFLARE_ACCOUNT_ID", value: cfAccount },
-    { name: "CLOUDFLARE_ZONE_ID", value: cfZone },
-    { name: "TF_API_TOKEN", value: tfToken },
-    { name: "TF_CLOUD_ORGANIZATION", value: tfOrg }
-  ];
-  const secSpin = p3.spinner();
-  secSpin.start(`Seeding ${secrets.length} repo secrets\u2026`);
-  const seeded = [];
-  for (const s of secrets) {
-    const r = await setRepoSecret({ repo: newRepoFull, name: s.name, value: s.value });
-    if (!r.written) {
-      secSpin.stop(pc2.red(`\u2717 Failed to set ${s.name}: ${r.reason ?? "unknown"}`));
-      const remaining = secrets.slice(secrets.findIndex((x) => x.name === s.name)).map((x) => x.name);
-      p3.cancel(
-        [
-          seeded.length > 0 ? `Already seeded on ${newRepoFull}: ${seeded.join(", ")}.` : `Nothing seeded yet on ${newRepoFull}.`,
-          `Still pending: ${remaining.join(", ")}.`,
+  if (publicConfig) {
+    const secrets = [
+      { name: "CLOUDFLARE_API_TOKEN", value: publicConfig.cfToken },
+      { name: "CLOUDFLARE_ACCOUNT_ID", value: publicConfig.cfAccount },
+      { name: "CLOUDFLARE_ZONE_ID", value: publicConfig.cfZone },
+      { name: "TF_API_TOKEN", value: publicConfig.tfToken },
+      { name: "TF_CLOUD_ORGANIZATION", value: publicConfig.tfOrg }
+    ];
+    const secSpin = p3.spinner();
+    secSpin.start(`Seeding ${secrets.length} repo secrets\u2026`);
+    const seeded = [];
+    for (const s of secrets) {
+      const r = await setRepoSecret({ repo: newRepoFull, name: s.name, value: s.value });
+      if (!r.written) {
+        secSpin.stop(pc2.red(`\u2717 Failed to set ${s.name}: ${r.reason ?? "unknown"}`));
+        const remaining = secrets.slice(secrets.findIndex((x) => x.name === s.name)).map((x) => x.name);
+        p3.cancel(
+          [
+            seeded.length > 0 ? `Already seeded on ${newRepoFull}: ${seeded.join(", ")}.` : `Nothing seeded yet on ${newRepoFull}.`,
+            `Still pending: ${remaining.join(", ")}.`,
+            "",
+            `Make sure \`gh\` is installed and signed in (\`gh auth login\`).`,
+            `Re-run with --use-existing-repo to retry (GitHub will overwrite the already-set secrets idempotently).`
+          ].join("\n")
+        );
+        process.exit(1);
+      }
+      seeded.push(s.name);
+    }
+    secSpin.stop(pc2.green(`\u2713 Seeded ${secrets.length} secrets on ${newRepoFull}`));
+  }
+  let pr = null;
+  if (publicConfig) {
+    const branch = `init/region-${region}-${isoStampUtc(/* @__PURE__ */ new Date())}`;
+    const setupSpin = p3.spinner();
+    setupSpin.start(`Writing prod.tfvars on branch ${branch}\u2026`);
+    try {
+      await createBranch({
+        token: ghToken,
+        repo: newRepoFull,
+        branch,
+        fromBranch: created.defaultBranch
+      });
+      const tfvars = renderProdTfvars({
+        project: opts.project ?? "opuspopuli",
+        domain: publicConfig.domain
+      });
+      await commitFile({
+        token: ghToken,
+        repo: newRepoFull,
+        branch,
+        path: "infra/cloudflare/environments/prod.tfvars",
+        content: tfvars,
+        message: `init: prod.tfvars for ${region}`
+      });
+    } catch (err) {
+      setupSpin.stop(pc2.red(`\u2717 Couldn't write tfvars: ${err.message}`));
+      p3.cancel("The repo exists but the branch / commit failed. Open it on GitHub and inspect.");
+      process.exit(1);
+    }
+    setupSpin.stop(pc2.green("\u2713 Wrote prod.tfvars"));
+    const prSpin = p3.spinner();
+    prSpin.start("Opening pull request\u2026");
+    try {
+      pr = await openPullRequest({
+        token: ghToken,
+        repo: newRepoFull,
+        head: branch,
+        base: created.defaultBranch,
+        title: `init: bring up region ${region}`,
+        body: [
+          `Initial region deployment for **${region}** (${publicConfig.domain}).`,
+          "",
+          "Adds `infra/cloudflare/environments/prod.tfvars`. Merging this PR triggers",
+          "`cloudflare-infra.yml` which runs `terraform apply` against the",
+          `\`${publicConfig.tfOrg}\` Terraform Cloud organization, provisioning the Cloudflare`,
+          "Tunnel, DNS records, R2 buckets, and Pages project.",
           "",
-          `Make sure \`gh\` is installed and signed in (\`gh auth login\`).`,
-          `Re-run with --use-existing-repo to retry (GitHub will overwrite the already-set secrets idempotently).`
+          `Generated by \`create-op-node init\`.`
         ].join("\n")
-      );
+      });
+    } catch (err) {
+      prSpin.stop(pc2.red(`\u2717 Couldn't open PR: ${err.message}`));
+      p3.cancel("Branch + tfvars are committed; open the PR by hand on GitHub.");
       process.exit(1);
     }
-    seeded.push(s.name);
-  }
-  secSpin.stop(pc2.green(`\u2713 Seeded ${secrets.length} secrets on ${newRepoFull}`));
-  const branch = `init/region-${region}-${isoStampUtc(/* @__PURE__ */ new Date())}`;
-  const setupSpin = p3.spinner();
-  setupSpin.start(`Writing prod.tfvars on branch ${branch}\u2026`);
-  try {
-    await createBranch({
-      token: ghToken,
-      repo: newRepoFull,
-      branch,
-      fromBranch: created.defaultBranch
-    });
-    const tfvars = renderProdTfvars({
-      project: opts.project ?? "opuspopuli",
-      domain
-    });
-    await commitFile({
-      token: ghToken,
-      repo: newRepoFull,
-      branch,
-      path: "infra/cloudflare/environments/prod.tfvars",
-      content: tfvars,
-      message: `init: prod.tfvars for ${region}`
-    });
-  } catch (err) {
-    setupSpin.stop(pc2.red(`\u2717 Couldn't write tfvars: ${err.message}`));
-    p3.cancel("The repo exists but the branch / commit failed. Open it on GitHub and inspect.");
-    process.exit(1);
-  }
-  setupSpin.stop(pc2.green("\u2713 Wrote prod.tfvars"));
-  const prSpin = p3.spinner();
-  prSpin.start("Opening pull request\u2026");
-  let pr;
-  try {
-    pr = await openPullRequest({
-      token: ghToken,
-      repo: newRepoFull,
-      head: branch,
-      base: created.defaultBranch,
-      title: `init: bring up region ${region}`,
-      body: [
-        `Initial region deployment for **${region}** (${domain}).`,
-        "",
-        "Adds `infra/cloudflare/environments/prod.tfvars`. Merging this PR triggers",
-        "`cloudflare-infra.yml` which runs `terraform apply` against the",
-        `\`${tfOrg}\` Terraform Cloud organization, provisioning the Cloudflare`,
-        "Tunnel, DNS records, R2 buckets, and Pages project.",
-        "",
-        `Generated by \`create-op-node init\`.`
-      ].join("\n")
-    });
-  } catch (err) {
-    prSpin.stop(pc2.red(`\u2717 Couldn't open PR: ${err.message}`));
-    p3.cancel("Branch + tfvars are committed; open the PR by hand on GitHub.");
-    process.exit(1);
+    prSpin.stop(pc2.green(`\u2713 Opened PR #${pr.number}`));
   }
-  prSpin.stop(pc2.green(`\u2713 Opened PR #${pr.number}`));
   const pgsodiumCoords = { region, account: "pgsodium-root-key" };
   const keyLabel = `org.opuspopuli.${region}/pgsodium-root-key`;
   if (keychain.available) {
@@ -806,6 +797,28 @@ var initCommand = new Command("init").description(
     const fresh = generatePgsodiumRootKey();
     await printKeyForManualSave(fresh, keyLabel);
   }
+  if (!publicConfig) {
+    p3.outro(
+      pc2.cyan(
+        [
+          `Region ${region} provisioned for local-only mode.`,
+          `Repo: https://github.com/${newRepoFull}`,
+          ``,
+          `Next: on the Studio (fresh or otherwise \u2014 bootstrap installs`,
+          `brew packages it needs), run:`,
+          `  npx create-op-node bootstrap --region ${region} --local-only`,
+          ``,
+          `When you're ready to expose publicly, re-run BOTH \`init\` and`,
+          `\`bootstrap\` without --local-only. Same region repo + pgsodium key`,
+          `promote cleanly to the production-shaped deploy.`
+        ].join("\n")
+      )
+    );
+    return;
+  }
+  if (!pr) {
+    throw new Error("init: PR creation step did not run despite publicConfig present");
+  }
   if (opts.skipWait) {
     p3.outro(
       pc2.cyan(
@@ -833,19 +846,19 @@ var initCommand = new Command("init").description(
     return;
   }
   const ws = await findWorkspace({
-    token: tfToken,
-    organization: tfOrg,
+    token: publicConfig.tfToken,
+    organization: publicConfig.tfOrg,
     tags: ["opuspopuli", "cloudflare"]
   });
   if (!ws) {
     p3.cancel(
-      `Couldn't find a TFC workspace tagged opuspopuli + cloudflare in ${tfOrg}. Check the workflow's run log; the workspace is created on first apply.`
+      `Couldn't find a TFC workspace tagged opuspopuli + cloudflare in ${publicConfig.tfOrg}. Check the workflow's run log; the workspace is created on first apply.`
     );
     process.exit(1);
   }
   const tunnelToken = await waitForApplyAndFetchTunnelToken({
-    token: tfToken,
-    organization: tfOrg,
+    token: publicConfig.tfToken,
+    organization: publicConfig.tfOrg,
     workspaceId: ws.id,
     runId: ws.currentRunId
   });
@@ -882,6 +895,73 @@ var MIN_TOKEN_LENGTH = {
   github: 40,
   generic: 20
 };
+function listIgnoredLocalOnlyFlags(opts) {
+  const ignored = [];
+  if (opts.domain) ignored.push("--domain");
+  if (opts.cfToken) ignored.push("--cf-token");
+  if (opts.cfAccount) ignored.push("--cf-account");
+  if (opts.cfZone) ignored.push("--cf-zone");
+  if (opts.tfToken) ignored.push("--tf-token");
+  if (opts.tfOrg) ignored.push("--tf-org");
+  if (opts.skipWait) ignored.push("--skip-wait");
+  return ignored;
+}
+async function collectPublicConfig(opts) {
+  const domain = opts.domain ? opts.domain : unwrap(
+    await p3.text({
+      message: "Domain registered in Cloudflare?",
+      placeholder: "example.org",
+      validate: (v) => !v ? "Required" : v.includes(".") ? void 0 : "Missing a TLD?"
+    })
+  );
+  const cfToken = await collectSecret(
+    opts.cfToken,
+    "Cloudflare Account API token (input hidden)",
+    "cloudflare"
+  );
+  const cfAccount = await collectId(opts.cfAccount, "Cloudflare account ID");
+  const cfZone = await collectId(opts.cfZone, `Cloudflare zone ID for ${domain}`);
+  const cfSpin = p3.spinner();
+  cfSpin.start("Verifying Cloudflare token + 5 scopes\u2026");
+  const cfProbe = await probeCloudflareToken({
+    token: cfToken,
+    accountId: cfAccount,
+    zoneId: cfZone
+  });
+  if (!cfProbe.ok) {
+    cfSpin.stop(pc2.red("\u2717 Cloudflare token check failed."));
+    for (const issue of cfProbe.issues) console.error(`  - ${issue}`);
+    p3.cancel("Fix the token in the Cloudflare dashboard, then re-run.");
+    process.exit(1);
+  }
+  cfSpin.stop(pc2.green("\u2713 Cloudflare token valid, 5 scopes present."));
+  const tfToken = await collectSecret(
+    opts.tfToken,
+    "Terraform Cloud user/team API token",
+    "tfc"
+  );
+  const tfOrg = opts.tfOrg ? opts.tfOrg : unwrap(
+    await p3.text({
+      message: "Terraform Cloud organization name?",
+      placeholder: "op-region-ca"
+    })
+  );
+  const tfSpin = p3.spinner();
+  tfSpin.start("Verifying Terraform Cloud token + organization\u2026");
+  const tfProbe = await probeTfcToken({ token: tfToken, organization: tfOrg });
+  if (!tfProbe.ok) {
+    tfSpin.stop(pc2.red("\u2717 Terraform Cloud check failed."));
+    for (const issue of tfProbe.issues) console.error(`  - ${issue}`);
+    p3.cancel("Fix the token / org, then re-run.");
+    process.exit(1);
+  }
+  tfSpin.stop(
+    pc2.green(
+      `\u2713 TFC token valid${tfProbe.userName ? ` (as ${tfProbe.userName})` : ""}, org "${tfOrg}" reachable.`
+    )
+  );
+  return { domain, cfToken, cfAccount, cfZone, tfToken, tfOrg };
+}
 async function collectSecret(preset, message, kind = "generic") {
   if (preset) return preset;
   const min = MIN_TOKEN_LENGTH[kind];
@@ -1110,7 +1190,7 @@ async function writePgsodiumKeyFile(key, keyFile) {
   }
 }
 function renderLaunchAgentPlist(input) {
-  if (!TUNNEL_TOKEN_RE.test(input.tunnelToken)) {
+  if (input.tunnelToken !== void 0 && !TUNNEL_TOKEN_RE.test(input.tunnelToken)) {
     throw new Error("Tunnel token contains characters outside the expected base64-url set");
   }
   if (!SAFE_PATH_RE.test(input.keyFilePath)) {
@@ -1118,7 +1198,11 @@ function renderLaunchAgentPlist(input) {
       `keyFilePath ${JSON.stringify(input.keyFilePath)} contains characters not allowed in a launchd path interpolation`
     );
   }
-  const command = `launchctl setenv PGSODIUM_ROOT_KEY "$(cat ${input.keyFilePath})"; launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`;
+  const setenvLines = [
+    `launchctl setenv PGSODIUM_ROOT_KEY "$(cat ${input.keyFilePath})"`,
+    ...input.tunnelToken !== void 0 ? [`launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`] : []
+  ];
+  const command = setenvLines.join("; ");
   return [
     '<?xml version="1.0" encoding="UTF-8"?>',
     '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
@@ -1171,7 +1255,7 @@ async function setupLaunchAgent(input) {
   try {
     plistContent = renderLaunchAgentPlist({
       keyFilePath: paths.keyFile,
-      tunnelToken: input.tunnelToken
+      ...input.tunnelToken !== void 0 ? { tunnelToken: input.tunnelToken } : {}
     });
   } catch (err) {
     return { ok: false, paths, step: "plist", reason: err.message };
@@ -1254,7 +1338,8 @@ async function loginToGhcr() {
 function composeArgs(opts, sub) {
   const files = opts.files.flatMap((f) => ["-f", f]);
   const env = opts.envFile ? ["--env-file", opts.envFile] : [];
-  return ["compose", ...files, ...env, ...sub];
+  const profiles = (opts.profiles ?? []).flatMap((pr) => ["--profile", pr]);
+  return ["compose", ...files, ...env, ...profiles, ...sub];
 }
 async function composePull(opts) {
   const res = await safeExeca("docker", composeArgs(opts, ["pull"]));
@@ -1264,6 +1349,10 @@ async function composeUp(opts) {
   const res = await safeExeca("docker", composeArgs(opts, ["up", "-d", "--remove-orphans"]));
   return result(res, "compose up");
 }
+async function composeRemoveService(opts, service) {
+  const res = await safeExeca("docker", composeArgs(opts, ["rm", "-sfv", service]));
+  return result(res, `compose rm ${service}`);
+}
 async function composeDown(opts) {
   const flags = ["down"];
   if (opts.wipeVolumes) flags.push("-v");
@@ -1543,19 +1632,26 @@ async function locateOrCloneRepo(input) {
 }
 
 // src/commands/bootstrap.ts
+var PUBLIC_PROFILES = ["public"];
+var LOCAL_PROFILES = [];
 var bootstrapCommand = new Command("bootstrap").description(
   "Configure the Mac Studio and bring the stack up. Run this on the Studio itself, after `init` has finished on your laptop."
 ).addOption(new Option("--region <slug>", "Region label set during init (e.g. us-ca)")).addOption(new Option("--owner <owner>", "GitHub owner for the node repo").default("OpusPopuli")).addOption(new Option("--repo-dir <path>", "Explicit path to a checked-out node repo (overrides cwd + clone)")).addOption(
   new Option(
     "--compose-file <path>",
-    "Repeatable. Compose file relative to repo root. Default: docker-compose-prod.yml + docker-compose-backup.yml"
-  ).default(["docker-compose-prod.yml", "docker-compose-backup.yml"])
+    "Repeatable. Compose file relative to repo root. Default: prod + backup (production), prod only (--local-only)."
+  )
 ).addOption(new Option("--env-file <path>", "Compose --env-file. Default: .env.production")).addOption(new Option("--skip-brew", "Skip the Homebrew package install pass").default(false)).addOption(
   new Option(
     "--skip-launch-agent",
     "Skip the LaunchAgent setup (assumes one is already in place)"
   ).default(false)
-).addOption(new Option("--skip-ollama", "Skip the Ollama model pull + warm").default(false)).addOption(new Option("--skip-stack", "Stop before `docker compose pull && up`").default(false)).addOption(new Option("-y, --yes", "Skip confirmation prompts").default(false)).action(async (opts) => {
+).addOption(new Option("--skip-ollama", "Skip the Ollama model pull + warm").default(false)).addOption(new Option("--skip-stack", "Stop before `docker compose pull && up`").default(false)).addOption(
+  new Option(
+    "--local-only",
+    "Run for local dev / testing: no Tunnel token required, cloudflared stays down. Auto-generates the pgsodium key if not in Keychain (init unnecessary)."
+  ).default(false)
+).addOption(new Option("-y, --yes", "Skip confirmation prompts").default(false)).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node bootstrap ")));
   const region = opts.region ? opts.region : unwrap(
     await p3.text({
@@ -1566,6 +1662,8 @@ var bootstrapCommand = new Command("bootstrap").description(
   );
   const owner = opts.owner ?? "OpusPopuli";
   const repoName = `opuspopuli-node-${region}`;
+  const composeFileDefault = opts.localOnly ? ["docker-compose-prod.yml"] : ["docker-compose-prod.yml", "docker-compose-backup.yml"];
+  const composeFile = opts.composeFile ?? composeFileDefault;
   const sysSpin = p3.spinner();
   sysSpin.start("Inspecting macOS\u2026");
   const snap = await inspectSystem();
@@ -1682,14 +1780,14 @@ var bootstrapCommand = new Command("bootstrap").description(
     );
     process.exit(1);
   }
-  const pgsodiumKey = await loadOrPromptSecret({
+  const pgsodiumKey = await loadSecret({
     region,
     account: "pgsodium-root-key",
     label: "pgsodium master key",
-    placeholder: "64 lowercase hex characters",
-    validate: (v) => PGSODIUM_KEY_RE.test(v) ? void 0 : "must be exactly 64 lowercase hex characters"
+    validate: (v) => PGSODIUM_KEY_RE.test(v) ? void 0 : "must be exactly 64 lowercase hex characters",
+    ...opts.localOnly ? { generate: generatePgsodiumRootKey } : {}
   });
-  const tunnelToken = await loadOrPromptSecret({
+  const tunnelToken = opts.localOnly ? void 0 : await loadSecret({
     region,
     account: "tunnel-token",
     label: "Cloudflare Tunnel token",
@@ -1699,13 +1797,20 @@ var bootstrapCommand = new Command("bootstrap").description(
   if (!opts.skipLaunchAgent) {
     const laSpin = p3.spinner();
     laSpin.start("Writing pgsodium key file + LaunchAgent plist\u2026");
-    const la = await setupLaunchAgent({ pgsodiumKey, tunnelToken });
+    const la = await setupLaunchAgent({
+      pgsodiumKey,
+      ...tunnelToken !== void 0 ? { tunnelToken } : {}
+    });
     if (!la.ok) {
       laSpin.stop(pc2.red(`\u2717 LaunchAgent step ${la.step} failed.`));
       p3.cancel(la.reason ?? "LaunchAgent setup failed.");
       process.exit(1);
     }
-    laSpin.stop(pc2.green(`\u2713 LaunchAgent loaded (${la.paths.plistFile}).`));
+    laSpin.stop(
+      pc2.green(
+        `\u2713 LaunchAgent loaded (${la.paths.plistFile})${opts.localOnly ? " \u2014 local-only mode, no TUNNEL_TOKEN set" : ""}.`
+      )
+    );
   }
   const ghcrSpin = p3.spinner();
   ghcrSpin.start("Authenticating Docker to ghcr.io\u2026");
@@ -1756,19 +1861,32 @@ var bootstrapCommand = new Command("bootstrap").description(
     }
   }
   if (opts.skipStack) {
+    const profileFlag = opts.localOnly ? "" : "--profile public ";
     p3.outro(
       pc2.cyan(
-        `Stack-up skipped. Run \`docker compose -f ${(opts.composeFile ?? ["docker-compose-prod.yml"]).join(" -f ")} pull && up -d\` from ${repoPath} when ready.`
+        `Stack-up skipped. Run \`docker compose -f ${composeFile.join(" -f ")} ${profileFlag}pull && docker compose -f ${composeFile.join(" -f ")} ${profileFlag}up -d\` from ${repoPath} when ready.`
       )
     );
     return;
   }
-  const composeFiles = resolveComposeFiles(repoPath, opts.composeFile);
+  const composeFiles = resolveComposeFiles(repoPath, composeFile);
   const composeOpts = {
     files: composeFiles,
     cwd: repoPath,
-    ...opts.envFile ? { envFile: opts.envFile } : {}
+    ...opts.envFile ? { envFile: opts.envFile } : {},
+    profiles: opts.localOnly ? LOCAL_PROFILES : PUBLIC_PROFILES
   };
+  if (opts.localOnly) {
+    const evict = p3.spinner();
+    evict.start("Evicting any cloudflared from a prior public bootstrap\u2026");
+    const rm2 = await composeRemoveService(
+      { ...composeOpts, profiles: PUBLIC_PROFILES },
+      "cloudflared"
+    );
+    evict.stop(
+      rm2.ok ? pc2.green("\u2713 cloudflared not present (or removed).") : pc2.yellow(`\u26A0 cloudflared eviction reported: ${rm2.reason ?? "unknown"} \u2014 continuing.`)
+    );
+  }
   const pullSpin = p3.spinner();
   pullSpin.start("Pulling images from ghcr.io\u2026");
   const pull = await composePull(composeOpts);
@@ -1799,11 +1917,23 @@ var bootstrapCommand = new Command("bootstrap").description(
   switch (outcome.kind) {
     case "healthy":
       healthSpin.stop(pc2.green(`\u2713 All ${outcome.snapshots.length} containers healthy.`));
-      p3.outro(
-        pc2.cyan(
-          `Region ${region} is up. Next: verify off-LAN with \`npx create-op-node verify --domain <your-domain>\`.`
-        )
-      );
+      if (opts.localOnly) {
+        p3.outro(
+          pc2.cyan(
+            [
+              `Region ${region} is up locally (no public Cloudflare Tunnel \u2014 cloudflared stays down).`,
+              `Access from your laptop over Tailscale at this Studio's tailnet IP.`,
+              `When you're ready to expose publicly, re-run \`bootstrap\` without --local-only.`
+            ].join("\n")
+          )
+        );
+      } else {
+        p3.outro(
+          pc2.cyan(
+            `Region ${region} is up. Next: verify off-LAN with \`npx create-op-node verify --domain <your-domain>\`.`
+          )
+        );
+      }
       return;
     case "unhealthy":
       healthSpin.stop(pc2.red(`\u2717 ${outcome.problem}`));
@@ -1930,7 +2060,7 @@ async function promptTailscaleSignin() {
   );
   unwrap(await p3.confirm({ message: "Tailscale signed in (or skipped)?", initialValue: true }));
 }
-async function loadOrPromptSecret(input) {
+async function loadSecret(input) {
   const coords = { region: input.region, account: input.account };
   const spin = p3.spinner();
   spin.start(`Reading ${input.label} from Keychain\u2026`);
@@ -1940,8 +2070,20 @@ async function loadOrPromptSecret(input) {
     return existing;
   }
   spin.stop(
-    existing ? pc2.yellow(`\u26A0 ${input.label} in Keychain failed validation \u2014 will re-prompt.`) : pc2.dim(`\xB7 ${input.label} not in Keychain \u2014 will prompt.`)
+    existing ? pc2.yellow(`\u26A0 ${input.label} in Keychain failed format validation \u2014 will replace.`) : pc2.dim(`\xB7 ${input.label} not in Keychain.`)
   );
+  if (input.generate) {
+    const fresh = input.generate();
+    const save2 = await saveSecret(coords, fresh);
+    if (!save2.written) {
+      p3.cancel(
+        `Generated a fresh ${input.label} but couldn't persist it to Keychain: ${save2.reason ?? "unknown"}. Continuing would risk silent key rotation on the next re-run. Resolve the Keychain access (re-grant via Keychain Access.app or check the security CLI) and re-run.`
+      );
+      process.exit(1);
+    }
+    p3.note(`${pc2.green("\u2713")} Generated fresh ${input.label} and stored in Keychain.`, "Keychain");
+    return fresh;
+  }
   const pasted = unwrap(
     await p3.password({
       message: `Paste the ${input.label} for region ${input.region}:`,
@@ -1950,7 +2092,10 @@ async function loadOrPromptSecret(input) {
   );
   const save = await saveSecret(coords, pasted);
   if (!save.written) {
-    p3.note(`${pc2.yellow("\u26A0")} Couldn't persist to Keychain: ${save.reason ?? "unknown"}. Continuing anyway.`, "Keychain");
+    p3.note(
+      `${pc2.yellow("\u26A0")} Couldn't persist to Keychain: ${save.reason ?? "unknown"}. You'll need to paste it again next run.`,
+      "Keychain"
+    );
   } else {
     p3.note(`${pc2.green("\u2713")} Stored ${input.label} in Keychain for re-runs.`, "Keychain");
   }
@@ -3663,7 +3808,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.3.0";
+var VERSION = "0.5.0";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."