create-op-node 0.8.0 → 0.9.0

package/README.md

@@ -557,6 +557,42 @@ Releases are automated via [release-please](https://github.com/googleapis/releas
 
 No manual version bumps, no manual tagging. To trigger a release with no functional changes (re-publishing after a CI fix, etc.), push a commit with `chore: trigger release` — release-please will skip it but still update the PR.
 
+#### One-time PAT setup
+
+GitHub deliberately doesn't fire workflows on branches or tags pushed by
+`GITHUB_TOKEN`. Without a PAT, two things bite every release:
+
+- The release PR opens but its CI run never starts (sits in
+  *Expected — Waiting for status to be reported*). You can't merge.
+- After you eventually merge, `publish.yml`'s tag-push trigger doesn't
+  fire either, so npm never gets the new version.
+
+Both go away when release-please uses a PAT instead. One-time setup:
+
+1. **Create a fine-grained PAT** at
+   [github.com/settings/personal-access-tokens/new](https://github.com/settings/personal-access-tokens/new):
+   - *Resource owner*: **OpusPopuli** (not your personal account —
+     fine-grained PATs are scoped at creation and can't be moved)
+   - *Expiration*: your call (90 days for safety; you'll be reminded
+     when it's near expiry)
+   - *Repository access*: **Only select repositories** →
+     `create-op-node`
+   - *Repository permissions*:
+     - **Contents**: Read and write
+     - **Pull requests**: Read and write
+     - **Workflows**: Read and write *(release-please updates the
+       version line in `release-please.yml`'s manifest output;
+       without this permission the action fails to write)*
+2. **Add it as a repo secret**: repo → Settings → Secrets and
+   variables → Actions → New repository secret →
+   `RELEASE_PLEASE_TOKEN`, paste the PAT value.
+3. **Done.** Next release-please run uses the PAT, CI runs normally on
+   the release PR, and `publish.yml` fires automatically on the tag.
+
+The workflow falls back to `GITHUB_TOKEN` when the secret isn't
+present, so it doesn't break in repos that haven't done the PAT setup
+yet — it just goes back to needing the manual workarounds.
+
 ## License
 
 [AGPL-3.0-or-later](./LICENSE). The Opus Populi platform code is AGPL-3.0 + dual commercial; this CLI inherits the AGPL-3.0 terms.

package/dist/cli.js

@@ -4,7 +4,7 @@ import pc2 from 'picocolors';
 import * as p3 from '@clack/prompts';
 import { execa } from 'execa';
 import { Octokit } from '@octokit/rest';
-import { randomBytes } from 'crypto';
+import { randomBytes, createHmac } from 'crypto';
 import { join, resolve, dirname } from 'path';
 import { mkdir, writeFile, access, rm, chmod } from 'fs/promises';
 import { homedir } from 'os';
@@ -230,9 +230,17 @@ var SERVICE_PREFIX = "org.opuspopuli";
 function serviceFor(region) {
   return `${SERVICE_PREFIX}.${region}`;
 }
+var FRIENDLY = {
+  "pgsodium-root-key": "pgsodium root key",
+  "tunnel-token": "Cloudflare Tunnel token",
+  "postgres-password": "Postgres password",
+  "jwt-secret": "JWT signing secret",
+  "supabase-anon-key": "Supabase anon key",
+  "supabase-service-role-key": "Supabase service role key",
+  "dashboard-password": "Supabase Studio dashboard password"
+};
 function labelFor(coords) {
-  const friendly = coords.account === "pgsodium-root-key" ? "pgsodium root key" : "Cloudflare Tunnel token";
-  return `Opus Populi (${coords.region}) \u2014 ${friendly}`;
+  return `Opus Populi (${coords.region}) \u2014 ${FRIENDLY[coords.account]}`;
 }
 async function detectKeychain() {
   const res = await safeExeca("security", ["-h"]);
@@ -430,6 +438,50 @@ async function openPullRequest(input) {
 function generatePgsodiumRootKey() {
   return randomBytes(32).toString("hex");
 }
+function base64url(input) {
+  const buf = typeof input === "string" ? Buffer.from(input) : input;
+  return buf.toString("base64").replace(/=+$/, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function generatePostgresPassword() {
+  return base64url(randomBytes(32));
+}
+function generateDashboardPassword() {
+  return base64url(randomBytes(24));
+}
+function generateJwtSecret() {
+  return randomBytes(48).toString("base64");
+}
+function verifySupabaseJwt(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) return false;
+  const [h, p7, sig] = parts;
+  const expected = base64url(createHmac("sha256", secret).update(`${h}.${p7}`).digest());
+  if (sig.length !== expected.length) return false;
+  let mismatch = 0;
+  for (let i = 0; i < sig.length; i++) {
+    mismatch |= sig.charCodeAt(i) ^ expected.charCodeAt(i);
+  }
+  return mismatch === 0;
+}
+function signSupabaseJwt(input) {
+  const iat = input.issuedAtSeconds ?? 17e8;
+  const ttl = input.ttlSeconds ?? 10 * 365 * 24 * 60 * 60;
+  const issuer = input.issuer ?? "supabase";
+  const header = { alg: "HS256", typ: "JWT" };
+  const payload = {
+    role: input.role,
+    iss: issuer,
+    iat,
+    exp: iat + ttl
+  };
+  const encodedHeader = base64url(JSON.stringify(header));
+  const encodedPayload = base64url(JSON.stringify(payload));
+  const signingInput = `${encodedHeader}.${encodedPayload}`;
+  const signature = base64url(
+    createHmac("sha256", input.secret).update(signingInput).digest()
+  );
+  return `${signingInput}.${signature}`;
+}
 function renderProdTfvars(input) {
   const project = input.project ?? "opuspopuli";
   const api = input.apiSubdomain ?? "api";
@@ -1042,6 +1094,9 @@ async function waitForApplyAndFetchTunnelToken(input) {
 var PGSODIUM_KEY_RE = /^[a-f0-9]{64}$/;
 var TUNNEL_TOKEN_RE = /^[A-Za-z0-9_\-.=]+$/;
 var SAFE_PATH_RE = /^[A-Za-z0-9_\-./ ]+$/;
+var SAFE_LAUNCHCTL_VALUE_RE = /^[A-Za-z0-9+/=._-]+$/;
+var URL_SAFE_PASSWORD_RE = /^[A-Za-z0-9_-]+$/;
+var SAFE_URL_RE = /^[A-Za-z0-9:/_.\-]+$/;
 var VERIFY_NETWORK_TIMEOUT_MS = 1e4;
 var BODY_PREVIEW_MAX = 200;
 
@@ -1216,11 +1271,36 @@ function renderLaunchAgentPlist(input) {
       `keyFilePath ${JSON.stringify(input.keyFilePath)} contains characters not allowed in a launchd path interpolation`
     );
   }
+  const supabaseFields = [
+    ["postgresPassword", input.postgresPassword],
+    ["jwtSecret", input.jwtSecret],
+    ["supabaseAnonKey", input.supabaseAnonKey],
+    ["supabaseServiceRoleKey", input.supabaseServiceRoleKey],
+    ["dashboardPassword", input.dashboardPassword]
+  ];
+  for (const [name, value] of supabaseFields) {
+    if (value !== void 0 && !SAFE_LAUNCHCTL_VALUE_RE.test(value)) {
+      throw new Error(
+        `${String(name)} contains characters not allowed in a launchd setenv value`
+      );
+    }
+  }
+  if (input.supabaseUrl !== void 0 && !SAFE_URL_RE.test(input.supabaseUrl)) {
+    throw new Error(
+      `supabaseUrl ${JSON.stringify(input.supabaseUrl)} contains characters not allowed in a launchd setenv value`
+    );
+  }
   const setenvLines = [
     `launchctl setenv PGSODIUM_ROOT_KEY "$(cat ${input.keyFilePath})"`,
     ...input.tunnelToken !== void 0 ? [`launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`] : [],
     ...input.llmModel !== void 0 ? [`launchctl setenv LLM_MODEL "${input.llmModel}"`] : [],
-    ...input.embeddingModel !== void 0 ? [`launchctl setenv EMBEDDINGS_MODEL "${input.embeddingModel}"`] : []
+    ...input.embeddingModel !== void 0 ? [`launchctl setenv EMBEDDINGS_MODEL "${input.embeddingModel}"`] : [],
+    ...input.postgresPassword !== void 0 ? [`launchctl setenv POSTGRES_PASSWORD "${input.postgresPassword}"`] : [],
+    ...input.jwtSecret !== void 0 ? [`launchctl setenv JWT_SECRET "${input.jwtSecret}"`] : [],
+    ...input.supabaseAnonKey !== void 0 ? [`launchctl setenv SUPABASE_ANON_KEY "${input.supabaseAnonKey}"`] : [],
+    ...input.supabaseServiceRoleKey !== void 0 ? [`launchctl setenv SUPABASE_SERVICE_ROLE_KEY "${input.supabaseServiceRoleKey}"`] : [],
+    ...input.dashboardPassword !== void 0 ? [`launchctl setenv DASHBOARD_PASSWORD "${input.dashboardPassword}"`] : [],
+    ...input.supabaseUrl !== void 0 ? [`launchctl setenv SUPABASE_URL "${input.supabaseUrl}"`] : []
   ];
   const command = setenvLines.join("; ");
   return [
@@ -1277,7 +1357,13 @@ async function setupLaunchAgent(input) {
       keyFilePath: paths.keyFile,
       ...input.tunnelToken !== void 0 ? { tunnelToken: input.tunnelToken } : {},
       ...input.llmModel !== void 0 ? { llmModel: input.llmModel } : {},
-      ...input.embeddingModel !== void 0 ? { embeddingModel: input.embeddingModel } : {}
+      ...input.embeddingModel !== void 0 ? { embeddingModel: input.embeddingModel } : {},
+      ...input.postgresPassword !== void 0 ? { postgresPassword: input.postgresPassword } : {},
+      ...input.jwtSecret !== void 0 ? { jwtSecret: input.jwtSecret } : {},
+      ...input.supabaseAnonKey !== void 0 ? { supabaseAnonKey: input.supabaseAnonKey } : {},
+      ...input.supabaseServiceRoleKey !== void 0 ? { supabaseServiceRoleKey: input.supabaseServiceRoleKey } : {},
+      ...input.dashboardPassword !== void 0 ? { dashboardPassword: input.dashboardPassword } : {},
+      ...input.supabaseUrl !== void 0 ? { supabaseUrl: input.supabaseUrl } : {}
     });
   } catch (err) {
     return { ok: false, paths, step: "plist", reason: err.message };
@@ -1685,6 +1771,11 @@ var bootstrapCommand = new Command("bootstrap").description(
     "--embedding-model <model>",
     `Ollama embedding model. Default: ${DEFAULT_EMBEDDING_MODEL}. Only takes effect when the knowledge service runs with EMBEDDINGS_PROVIDER=ollama (otherwise embeddings are computed in-process via xenova).`
   )
+).addOption(
+  new Option(
+    "--supabase-url <url>",
+    "Public-facing Supabase URL (what browsers + microservices use). Default: `http://localhost:8000` in --local-only mode, otherwise `https://supabase.<domain>` (which the operator can override)."
+  )
 ).addOption(new Option("--skip-stack", "Stop before `docker compose pull && up`").default(false)).addOption(
   new Option(
     "--local-only",
@@ -1838,6 +1929,65 @@ var bootstrapCommand = new Command("bootstrap").description(
     placeholder: "JWT-style base64url string from `terraform output tunnel_token`",
     validate: (v) => TUNNEL_TOKEN_RE.test(v) ? void 0 : "tunnel token must be a base64-url JWT"
   });
+  const postgresPassword = await loadSecret({
+    region,
+    account: "postgres-password",
+    label: "Postgres password",
+    // URL-safe alphabet required — value lands in postgres:// URIs where
+    // `+`/`/`/`=` cause parser ambiguity in gotrue/postgrest/storage.
+    validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
+    generate: generatePostgresPassword
+  });
+  const jwtSecret = await loadSecret({
+    region,
+    account: "jwt-secret",
+    label: "JWT signing secret",
+    validate: (v) => SAFE_LAUNCHCTL_VALUE_RE.test(v) && v.length >= 32 ? void 0 : "must be \u226532 base64 characters",
+    generate: generateJwtSecret
+  });
+  const supabaseAnonKey = await loadSecret({
+    region,
+    account: "supabase-anon-key",
+    label: "Supabase anon key",
+    validate: (v) => SAFE_LAUNCHCTL_VALUE_RE.test(v) && verifySupabaseJwt(v, jwtSecret) ? void 0 : "must be a base64url JWT signed by the current JWT_SECRET",
+    generate: () => signSupabaseJwt({ role: "anon", secret: jwtSecret })
+  });
+  const supabaseServiceRoleKey = await loadSecret({
+    region,
+    account: "supabase-service-role-key",
+    label: "Supabase service role key",
+    validate: (v) => SAFE_LAUNCHCTL_VALUE_RE.test(v) && verifySupabaseJwt(v, jwtSecret) ? void 0 : "must be a base64url JWT signed by the current JWT_SECRET",
+    generate: () => signSupabaseJwt({ role: "service_role", secret: jwtSecret })
+  });
+  const dashboardPassword = await loadSecret({
+    region,
+    account: "dashboard-password",
+    label: "Supabase Studio dashboard password",
+    // URL-safe alphabet required — value lands in basic-auth headers via
+    // kong's declarative config. Avoid `+`/`/`/`=` for the same reasons.
+    validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
+    generate: generateDashboardPassword
+  });
+  let supabaseUrl;
+  if (opts.supabaseUrl) {
+    supabaseUrl = opts.supabaseUrl;
+  } else if (opts.localOnly) {
+    supabaseUrl = "http://localhost:8000";
+  } else {
+    supabaseUrl = unwrap(
+      await p3.text({
+        message: "Public-facing Supabase URL (what browsers + microservices use to reach kong)?",
+        placeholder: "https://supabase.civicfeed.tx",
+        validate: (v) => !v ? "required" : SAFE_URL_RE.test(v) ? void 0 : "contains characters outside the allowed URL set"
+      })
+    );
+  }
+  if (!SAFE_URL_RE.test(supabaseUrl)) {
+    p3.cancel(
+      `--supabase-url ${JSON.stringify(supabaseUrl)} contains characters outside the allowed URL set`
+    );
+    process.exit(1);
+  }
   if (!opts.skipLaunchAgent) {
     const laSpin = p3.spinner();
     laSpin.start("Writing pgsodium key file + LaunchAgent plist\u2026");
@@ -1845,7 +1995,13 @@ var bootstrapCommand = new Command("bootstrap").description(
       pgsodiumKey,
       ...tunnelToken !== void 0 ? { tunnelToken } : {},
       llmModel,
-      embeddingModel
+      embeddingModel,
+      postgresPassword,
+      jwtSecret,
+      supabaseAnonKey,
+      supabaseServiceRoleKey,
+      dashboardPassword,
+      supabaseUrl
     });
     if (!la.ok) {
       laSpin.stop(pc2.red(`\u2717 LaunchAgent step ${la.step} failed.`));
@@ -3936,7 +4092,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.8.0";
+var VERSION = "0.9.0";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."