create-op-node 0.4.0 → 0.5.0

package/README.md

@@ -16,6 +16,10 @@ That's it. The wizard walks you through:
 5. **pgsodium master key** — generates a fresh 64-hex root key, stores it in your **macOS login Keychain** as `org.opuspopuli.<region>/pgsodium-root-key`. No third-party password manager required.
 6. **Tunnel token retrieval** — after `terraform apply` lands, fetches the Tunnel token from Terraform Cloud outputs and stores it alongside the pgsodium key in your Keychain.
 
+> Doing **local dev / testing first** (no public exposure yet)?
+> See [Local-only mode](#local-only-mode-no-cloudflare) — `init --local-only`
+> skips the Cloudflare/TFC/PR phases entirely.
+
 Then on the Mac Studio itself:
 
 ```bash
@@ -26,16 +30,31 @@ Configures macOS power settings, installs Homebrew + the CLI tool list, sets up
 
 ### Local-only mode (no Cloudflare)
 
+For local dev / testing — frontend on your laptop, backend on the Studio
+over Tailscale, no public exposure. The flow mirrors production-init →
+production-bootstrap, just with the Cloudflare half cut out on both
+sides.
+
+**On the laptop:**
+
+```bash
+npx create-op-node init --region us-ca --local-only
+```
+
+This creates the region repo from the `OpusPopuli/opuspopuli-node`
+template (private, no public exposure), generates the pgsodium master
+key, and saves it to Keychain. No Cloudflare, no Terraform Cloud, no PR
+to merge.
+
+**On the Studio:**
+
 ```bash
 npx create-op-node bootstrap --region us-ca --local-only
 ```
 
-Brings the Studio up for local dev / testing — frontend on your laptop
-hits the Studio over Tailscale, no public exposure. Differences from
-the standard run:
+Differences from production bootstrap:
 
-- **No Tunnel token required.** `init` is unnecessary; if the pgsodium
-  key isn't in Keychain, bootstrap generates one inline and persists it.
+- **No Tunnel token required.** `init --local-only` skipped that phase.
 - **`cloudflared` stays down.** It's gated behind the `public` compose
   profile, which `--local-only` doesn't activate. Bootstrap also evicts
   any leftover cloudflared from a prior public run so it doesn't strand
@@ -47,8 +66,9 @@ the standard run:
   exported into the launchd session.
 - **Outro tells you to use Tailscale**, not `npx create-op-node verify`.
 
-When you're ready to go public, re-run `bootstrap` without `--local-only`
-and the same Studio promotes to the full production-shaped deploy.
+When you're ready to expose publicly, re-run **both** commands without
+`--local-only`. Same region repo, same pgsodium key — promotes
+cleanly to the production-shaped deploy.
 
 > **Template version**: this mode depends on the `opuspopuli-node`
 > template having `profiles: [public]` on its cloudflared service. If

package/dist/cli.js

@@ -536,10 +536,23 @@ var initCommand = new Command("init").description(
     "--use-existing-repo",
     "Continue using a previously-created node repo (don't fail on 'already exists')"
   ).default(false)
-).addOption(new Option("--skip-wait", "Don't poll for Terraform apply; exit after PR open").default(false)).addOption(new Option("-y, --yes", "Skip the final confirmation").default(false)).action(async (opts) => {
+).addOption(new Option("--skip-wait", "Don't poll for Terraform apply; exit after PR open").default(false)).addOption(
+  new Option(
+    "--local-only",
+    "Skip the Cloudflare/TFC/PR/tunnel phases. Creates the region repo from template + stores a pgsodium key \u2014 enough for `bootstrap --local-only` to work."
+  ).default(false)
+).addOption(new Option("-y, --yes", "Skip the final confirmation").default(false)).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node init ")));
   p3.note(
-    [
+    opts.localOnly ? [
+      "Local-only setup \u2014 creates the region repo from template + a pgsodium key.",
+      "No Cloudflare, no Terraform Cloud, no public exposure.",
+      "",
+      pc2.dim("Phase 1: laptop side (now) \u2014 GitHub repo from template + Keychain."),
+      pc2.dim("Phase 2: Studio side \u2014 `create-op-node bootstrap --local-only`."),
+      "",
+      pc2.dim("When you're ready to expose publicly, re-run `init` without --local-only.")
+    ].join("\n") : [
       "This walks you from a sealed Mac Studio + a Cloudflare account to a",
       "live federation node serving traffic at api.<your-domain>.",
       "",
@@ -555,62 +568,25 @@ var initCommand = new Command("init").description(
       validate: (v) => /^[a-z0-9-]{2,32}$/.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
     })
   );
-  const domain = opts.domain ? opts.domain : unwrap(
-    await p3.text({
-      message: "Domain registered in Cloudflare?",
-      placeholder: "example.org",
-      validate: (v) => !v ? "Required" : v.includes(".") ? void 0 : "Missing a TLD?"
-    })
-  );
   const owner = opts.owner ?? "OpusPopuli";
   const newRepoName = `opuspopuli-node-${region}`;
   const newRepoFull = `${owner}/${newRepoName}`;
-  const cfToken = await collectSecret(
-    opts.cfToken,
-    "Cloudflare Account API token (input hidden)",
-    "cloudflare"
-  );
-  const cfAccount = await collectId(opts.cfAccount, "Cloudflare account ID");
-  const cfZone = await collectId(opts.cfZone, `Cloudflare zone ID for ${domain}`);
-  const cfSpin = p3.spinner();
-  cfSpin.start("Verifying Cloudflare token + 5 scopes\u2026");
-  const cfProbe = await probeCloudflareToken({
-    token: cfToken,
-    accountId: cfAccount,
-    zoneId: cfZone
-  });
-  if (!cfProbe.ok) {
-    cfSpin.stop(pc2.red("\u2717 Cloudflare token check failed."));
-    for (const issue of cfProbe.issues) console.error(`  - ${issue}`);
-    p3.cancel("Fix the token in the Cloudflare dashboard, then re-run.");
-    process.exit(1);
-  }
-  cfSpin.stop(pc2.green("\u2713 Cloudflare token valid, 5 scopes present."));
-  const tfToken = await collectSecret(
-    opts.tfToken,
-    "Terraform Cloud user/team API token",
-    "tfc"
-  );
-  const tfOrg = opts.tfOrg ? opts.tfOrg : unwrap(
-    await p3.text({
-      message: "Terraform Cloud organization name?",
-      placeholder: "op-region-ca"
-    })
-  );
-  const tfSpin = p3.spinner();
-  tfSpin.start("Verifying Terraform Cloud token + organization\u2026");
-  const tfProbe = await probeTfcToken({ token: tfToken, organization: tfOrg });
-  if (!tfProbe.ok) {
-    tfSpin.stop(pc2.red("\u2717 Terraform Cloud check failed."));
-    for (const issue of tfProbe.issues) console.error(`  - ${issue}`);
-    p3.cancel("Fix the token / org, then re-run.");
-    process.exit(1);
+  if (opts.localOnly) {
+    const ignored = listIgnoredLocalOnlyFlags(opts);
+    if (ignored.length > 0) {
+      p3.note(
+        pc2.yellow(
+          `\u26A0 The following ${ignored.length === 1 ? "flag is" : "flags are"} ignored with --local-only:
+  ${ignored.join(", ")}
+` + pc2.dim(
+            "These configure Cloudflare / TFC / PR-merge flow, which --local-only skips."
+          )
+        ),
+        "Notice"
+      );
+    }
   }
-  tfSpin.stop(
-    pc2.green(
-      `\u2713 TFC token valid${tfProbe.userName ? ` (as ${tfProbe.userName})` : ""}, org "${tfOrg}" reachable.`
-    )
-  );
+  const publicConfig = opts.localOnly ? null : await collectPublicConfig(opts);
   let ghToken = opts.ghToken;
   if (!ghToken) {
     const fromCli = await ghTokenFromCli();
@@ -636,12 +612,23 @@ var initCommand = new Command("init").description(
 ` + pc2.dim("Note: items don't sync to iCloud Keychain via the security CLI.\n") + pc2.dim("On the Studio, bootstrap will read locally and prompt you to paste if missing.") : `\u26A0 ${keychain.reason ?? "Keychain unavailable"}. Secrets will be printed for manual stash.`;
   p3.note(kcNote, "Secret store");
   p3.note(
-    [
+    opts.localOnly ? [
+      `Region label:        ${pc2.cyan(region)}`,
+      `New node repo:       ${pc2.cyan(newRepoFull)}`,
+      `Template:            ${pc2.dim(opts.template ?? "OpusPopuli/opuspopuli-node")}`,
+      `GH org write access: ${pc2.dim(`required for ${owner}`)}`,
+      ``,
+      `Will create the repo from template (private, no Cloudflare),`,
+      `and store a fresh pgsodium key in Keychain. That's it \u2014 no PR,`,
+      `no terraform, no tunnel token. Bootstrap on the Studio with`,
+      `\`bootstrap --local-only --region ${region}\` next.`
+    ].join("\n") : [
       `Region label:        ${pc2.cyan(region)}`,
-      `Domain:              ${pc2.cyan(domain)}`,
+      `Domain:              ${pc2.cyan(publicConfig?.domain ?? "")}`,
       `New node repo:       ${pc2.cyan(newRepoFull)}`,
       `Template:            ${pc2.dim(opts.template ?? "OpusPopuli/opuspopuli-node")}`,
-      `TFC organization:    ${pc2.cyan(tfOrg)}`,
+      `TFC organization:    ${pc2.cyan(publicConfig?.tfOrg ?? "")}`,
+      `GH org write access: ${pc2.dim(`required for ${owner}`)}`,
       ``,
       `Will create the repo, seed 5 secrets, write prod.tfvars on a branch,`,
       `open a PR, generate a fresh pgsodium key, and (after you merge) wait`,
@@ -697,90 +684,94 @@ var initCommand = new Command("init").description(
       defaultBranch: "main"
     };
   }
-  const secrets = [
-    { name: "CLOUDFLARE_API_TOKEN", value: cfToken },
-    { name: "CLOUDFLARE_ACCOUNT_ID", value: cfAccount },
-    { name: "CLOUDFLARE_ZONE_ID", value: cfZone },
-    { name: "TF_API_TOKEN", value: tfToken },
-    { name: "TF_CLOUD_ORGANIZATION", value: tfOrg }
-  ];
-  const secSpin = p3.spinner();
-  secSpin.start(`Seeding ${secrets.length} repo secrets\u2026`);
-  const seeded = [];
-  for (const s of secrets) {
-    const r = await setRepoSecret({ repo: newRepoFull, name: s.name, value: s.value });
-    if (!r.written) {
-      secSpin.stop(pc2.red(`\u2717 Failed to set ${s.name}: ${r.reason ?? "unknown"}`));
-      const remaining = secrets.slice(secrets.findIndex((x) => x.name === s.name)).map((x) => x.name);
-      p3.cancel(
-        [
-          seeded.length > 0 ? `Already seeded on ${newRepoFull}: ${seeded.join(", ")}.` : `Nothing seeded yet on ${newRepoFull}.`,
-          `Still pending: ${remaining.join(", ")}.`,
+  if (publicConfig) {
+    const secrets = [
+      { name: "CLOUDFLARE_API_TOKEN", value: publicConfig.cfToken },
+      { name: "CLOUDFLARE_ACCOUNT_ID", value: publicConfig.cfAccount },
+      { name: "CLOUDFLARE_ZONE_ID", value: publicConfig.cfZone },
+      { name: "TF_API_TOKEN", value: publicConfig.tfToken },
+      { name: "TF_CLOUD_ORGANIZATION", value: publicConfig.tfOrg }
+    ];
+    const secSpin = p3.spinner();
+    secSpin.start(`Seeding ${secrets.length} repo secrets\u2026`);
+    const seeded = [];
+    for (const s of secrets) {
+      const r = await setRepoSecret({ repo: newRepoFull, name: s.name, value: s.value });
+      if (!r.written) {
+        secSpin.stop(pc2.red(`\u2717 Failed to set ${s.name}: ${r.reason ?? "unknown"}`));
+        const remaining = secrets.slice(secrets.findIndex((x) => x.name === s.name)).map((x) => x.name);
+        p3.cancel(
+          [
+            seeded.length > 0 ? `Already seeded on ${newRepoFull}: ${seeded.join(", ")}.` : `Nothing seeded yet on ${newRepoFull}.`,
+            `Still pending: ${remaining.join(", ")}.`,
+            "",
+            `Make sure \`gh\` is installed and signed in (\`gh auth login\`).`,
+            `Re-run with --use-existing-repo to retry (GitHub will overwrite the already-set secrets idempotently).`
+          ].join("\n")
+        );
+        process.exit(1);
+      }
+      seeded.push(s.name);
+    }
+    secSpin.stop(pc2.green(`\u2713 Seeded ${secrets.length} secrets on ${newRepoFull}`));
+  }
+  let pr = null;
+  if (publicConfig) {
+    const branch = `init/region-${region}-${isoStampUtc(/* @__PURE__ */ new Date())}`;
+    const setupSpin = p3.spinner();
+    setupSpin.start(`Writing prod.tfvars on branch ${branch}\u2026`);
+    try {
+      await createBranch({
+        token: ghToken,
+        repo: newRepoFull,
+        branch,
+        fromBranch: created.defaultBranch
+      });
+      const tfvars = renderProdTfvars({
+        project: opts.project ?? "opuspopuli",
+        domain: publicConfig.domain
+      });
+      await commitFile({
+        token: ghToken,
+        repo: newRepoFull,
+        branch,
+        path: "infra/cloudflare/environments/prod.tfvars",
+        content: tfvars,
+        message: `init: prod.tfvars for ${region}`
+      });
+    } catch (err) {
+      setupSpin.stop(pc2.red(`\u2717 Couldn't write tfvars: ${err.message}`));
+      p3.cancel("The repo exists but the branch / commit failed. Open it on GitHub and inspect.");
+      process.exit(1);
+    }
+    setupSpin.stop(pc2.green("\u2713 Wrote prod.tfvars"));
+    const prSpin = p3.spinner();
+    prSpin.start("Opening pull request\u2026");
+    try {
+      pr = await openPullRequest({
+        token: ghToken,
+        repo: newRepoFull,
+        head: branch,
+        base: created.defaultBranch,
+        title: `init: bring up region ${region}`,
+        body: [
+          `Initial region deployment for **${region}** (${publicConfig.domain}).`,
+          "",
+          "Adds `infra/cloudflare/environments/prod.tfvars`. Merging this PR triggers",
+          "`cloudflare-infra.yml` which runs `terraform apply` against the",
+          `\`${publicConfig.tfOrg}\` Terraform Cloud organization, provisioning the Cloudflare`,
+          "Tunnel, DNS records, R2 buckets, and Pages project.",
           "",
-          `Make sure \`gh\` is installed and signed in (\`gh auth login\`).`,
-          `Re-run with --use-existing-repo to retry (GitHub will overwrite the already-set secrets idempotently).`
+          `Generated by \`create-op-node init\`.`
         ].join("\n")
-      );
+      });
+    } catch (err) {
+      prSpin.stop(pc2.red(`\u2717 Couldn't open PR: ${err.message}`));
+      p3.cancel("Branch + tfvars are committed; open the PR by hand on GitHub.");
       process.exit(1);
     }
-    seeded.push(s.name);
+    prSpin.stop(pc2.green(`\u2713 Opened PR #${pr.number}`));
   }
-  secSpin.stop(pc2.green(`\u2713 Seeded ${secrets.length} secrets on ${newRepoFull}`));
-  const branch = `init/region-${region}-${isoStampUtc(/* @__PURE__ */ new Date())}`;
-  const setupSpin = p3.spinner();
-  setupSpin.start(`Writing prod.tfvars on branch ${branch}\u2026`);
-  try {
-    await createBranch({
-      token: ghToken,
-      repo: newRepoFull,
-      branch,
-      fromBranch: created.defaultBranch
-    });
-    const tfvars = renderProdTfvars({
-      project: opts.project ?? "opuspopuli",
-      domain
-    });
-    await commitFile({
-      token: ghToken,
-      repo: newRepoFull,
-      branch,
-      path: "infra/cloudflare/environments/prod.tfvars",
-      content: tfvars,
-      message: `init: prod.tfvars for ${region}`
-    });
-  } catch (err) {
-    setupSpin.stop(pc2.red(`\u2717 Couldn't write tfvars: ${err.message}`));
-    p3.cancel("The repo exists but the branch / commit failed. Open it on GitHub and inspect.");
-    process.exit(1);
-  }
-  setupSpin.stop(pc2.green("\u2713 Wrote prod.tfvars"));
-  const prSpin = p3.spinner();
-  prSpin.start("Opening pull request\u2026");
-  let pr;
-  try {
-    pr = await openPullRequest({
-      token: ghToken,
-      repo: newRepoFull,
-      head: branch,
-      base: created.defaultBranch,
-      title: `init: bring up region ${region}`,
-      body: [
-        `Initial region deployment for **${region}** (${domain}).`,
-        "",
-        "Adds `infra/cloudflare/environments/prod.tfvars`. Merging this PR triggers",
-        "`cloudflare-infra.yml` which runs `terraform apply` against the",
-        `\`${tfOrg}\` Terraform Cloud organization, provisioning the Cloudflare`,
-        "Tunnel, DNS records, R2 buckets, and Pages project.",
-        "",
-        `Generated by \`create-op-node init\`.`
-      ].join("\n")
-    });
-  } catch (err) {
-    prSpin.stop(pc2.red(`\u2717 Couldn't open PR: ${err.message}`));
-    p3.cancel("Branch + tfvars are committed; open the PR by hand on GitHub.");
-    process.exit(1);
-  }
-  prSpin.stop(pc2.green(`\u2713 Opened PR #${pr.number}`));
   const pgsodiumCoords = { region, account: "pgsodium-root-key" };
   const keyLabel = `org.opuspopuli.${region}/pgsodium-root-key`;
   if (keychain.available) {
@@ -806,6 +797,28 @@ var initCommand = new Command("init").description(
     const fresh = generatePgsodiumRootKey();
     await printKeyForManualSave(fresh, keyLabel);
   }
+  if (!publicConfig) {
+    p3.outro(
+      pc2.cyan(
+        [
+          `Region ${region} provisioned for local-only mode.`,
+          `Repo: https://github.com/${newRepoFull}`,
+          ``,
+          `Next: on the Studio (fresh or otherwise \u2014 bootstrap installs`,
+          `brew packages it needs), run:`,
+          `  npx create-op-node bootstrap --region ${region} --local-only`,
+          ``,
+          `When you're ready to expose publicly, re-run BOTH \`init\` and`,
+          `\`bootstrap\` without --local-only. Same region repo + pgsodium key`,
+          `promote cleanly to the production-shaped deploy.`
+        ].join("\n")
+      )
+    );
+    return;
+  }
+  if (!pr) {
+    throw new Error("init: PR creation step did not run despite publicConfig present");
+  }
   if (opts.skipWait) {
     p3.outro(
       pc2.cyan(
@@ -833,19 +846,19 @@ var initCommand = new Command("init").description(
     return;
   }
   const ws = await findWorkspace({
-    token: tfToken,
-    organization: tfOrg,
+    token: publicConfig.tfToken,
+    organization: publicConfig.tfOrg,
     tags: ["opuspopuli", "cloudflare"]
   });
   if (!ws) {
     p3.cancel(
-      `Couldn't find a TFC workspace tagged opuspopuli + cloudflare in ${tfOrg}. Check the workflow's run log; the workspace is created on first apply.`
+      `Couldn't find a TFC workspace tagged opuspopuli + cloudflare in ${publicConfig.tfOrg}. Check the workflow's run log; the workspace is created on first apply.`
     );
     process.exit(1);
   }
   const tunnelToken = await waitForApplyAndFetchTunnelToken({
-    token: tfToken,
-    organization: tfOrg,
+    token: publicConfig.tfToken,
+    organization: publicConfig.tfOrg,
     workspaceId: ws.id,
     runId: ws.currentRunId
   });
@@ -882,6 +895,73 @@ var MIN_TOKEN_LENGTH = {
   github: 40,
   generic: 20
 };
+function listIgnoredLocalOnlyFlags(opts) {
+  const ignored = [];
+  if (opts.domain) ignored.push("--domain");
+  if (opts.cfToken) ignored.push("--cf-token");
+  if (opts.cfAccount) ignored.push("--cf-account");
+  if (opts.cfZone) ignored.push("--cf-zone");
+  if (opts.tfToken) ignored.push("--tf-token");
+  if (opts.tfOrg) ignored.push("--tf-org");
+  if (opts.skipWait) ignored.push("--skip-wait");
+  return ignored;
+}
+async function collectPublicConfig(opts) {
+  const domain = opts.domain ? opts.domain : unwrap(
+    await p3.text({
+      message: "Domain registered in Cloudflare?",
+      placeholder: "example.org",
+      validate: (v) => !v ? "Required" : v.includes(".") ? void 0 : "Missing a TLD?"
+    })
+  );
+  const cfToken = await collectSecret(
+    opts.cfToken,
+    "Cloudflare Account API token (input hidden)",
+    "cloudflare"
+  );
+  const cfAccount = await collectId(opts.cfAccount, "Cloudflare account ID");
+  const cfZone = await collectId(opts.cfZone, `Cloudflare zone ID for ${domain}`);
+  const cfSpin = p3.spinner();
+  cfSpin.start("Verifying Cloudflare token + 5 scopes\u2026");
+  const cfProbe = await probeCloudflareToken({
+    token: cfToken,
+    accountId: cfAccount,
+    zoneId: cfZone
+  });
+  if (!cfProbe.ok) {
+    cfSpin.stop(pc2.red("\u2717 Cloudflare token check failed."));
+    for (const issue of cfProbe.issues) console.error(`  - ${issue}`);
+    p3.cancel("Fix the token in the Cloudflare dashboard, then re-run.");
+    process.exit(1);
+  }
+  cfSpin.stop(pc2.green("\u2713 Cloudflare token valid, 5 scopes present."));
+  const tfToken = await collectSecret(
+    opts.tfToken,
+    "Terraform Cloud user/team API token",
+    "tfc"
+  );
+  const tfOrg = opts.tfOrg ? opts.tfOrg : unwrap(
+    await p3.text({
+      message: "Terraform Cloud organization name?",
+      placeholder: "op-region-ca"
+    })
+  );
+  const tfSpin = p3.spinner();
+  tfSpin.start("Verifying Terraform Cloud token + organization\u2026");
+  const tfProbe = await probeTfcToken({ token: tfToken, organization: tfOrg });
+  if (!tfProbe.ok) {
+    tfSpin.stop(pc2.red("\u2717 Terraform Cloud check failed."));
+    for (const issue of tfProbe.issues) console.error(`  - ${issue}`);
+    p3.cancel("Fix the token / org, then re-run.");
+    process.exit(1);
+  }
+  tfSpin.stop(
+    pc2.green(
+      `\u2713 TFC token valid${tfProbe.userName ? ` (as ${tfProbe.userName})` : ""}, org "${tfOrg}" reachable.`
+    )
+  );
+  return { domain, cfToken, cfAccount, cfZone, tfToken, tfOrg };
+}
 async function collectSecret(preset, message, kind = "generic") {
   if (preset) return preset;
   const min = MIN_TOKEN_LENGTH[kind];
@@ -3728,7 +3808,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.4.0";
+var VERSION = "0.5.0";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."