create-op-node 0.9.0 → 0.10.0

package/dist/cli.js

@@ -6,7 +6,7 @@ import { execa } from 'execa';
 import { Octokit } from '@octokit/rest';
 import { randomBytes, createHmac } from 'crypto';
 import { join, resolve, dirname } from 'path';
-import { mkdir, writeFile, access, rm, chmod } from 'fs/promises';
+import { mkdir, writeFile, access, chmod, rename, rm } from 'fs/promises';
 import { homedir } from 'os';
 import { readFileSync } from 'fs';
 import * as tls from 'tls';
@@ -237,7 +237,10 @@ var FRIENDLY = {
   "jwt-secret": "JWT signing secret",
   "supabase-anon-key": "Supabase anon key",
   "supabase-service-role-key": "Supabase service role key",
-  "dashboard-password": "Supabase Studio dashboard password"
+  "dashboard-password": "Supabase Studio dashboard password",
+  "prompts-db-password": "prompt-service Postgres password",
+  "prompt-service-api-key": "prompt-service HMAC API key",
+  "prompt-service-admin-api-key": "prompt-service admin API key"
 };
 function labelFor(coords) {
   return `Opus Populi (${coords.region}) \u2014 ${FRIENDLY[coords.account]}`;
@@ -448,6 +451,9 @@ function generatePostgresPassword() {
 function generateDashboardPassword() {
   return base64url(randomBytes(24));
 }
+function generateHmacApiKey() {
+  return base64url(randomBytes(32));
+}
 function generateJwtSecret() {
   return randomBytes(48).toString("base64");
 }
@@ -1403,6 +1409,139 @@ async function teardownLaunchAgent(paths, opts = {}) {
   return { ok: steps.every((s) => s.ok), steps };
 }
 
+// src/lib/op-compose-script.ts
+var REGION_RE = /^[a-z0-9-]{2,32}$/;
+var PROMPT_SERVICE_URL_RE = /^[A-Za-z0-9:/_.-]+$/;
+function renderOpComposeScript(input) {
+  if (!REGION_RE.test(input.region)) {
+    throw new Error(
+      `region ${JSON.stringify(input.region)} contains characters not allowed in a launchd / Keychain service identifier`
+    );
+  }
+  if (input.promptServiceUrl !== void 0 && !PROMPT_SERVICE_URL_RE.test(input.promptServiceUrl)) {
+    throw new Error(
+      `promptServiceUrl ${JSON.stringify(input.promptServiceUrl)} contains characters not allowed in a wrapper export`
+    );
+  }
+  const promptServiceUrlExport = input.promptServiceUrl !== void 0 ? `# Backend services call prompt-service via this URL. Service-level env
+# from docker-compose-prompt-service.yml overlay (when layered) wins
+# over this default \u2014 so colocated deployments still hit
+# http://opuspopuli-prompts:3210 even though we may have a public URL
+# baked in here.
+export PROMPT_SERVICE_URL="\${PROMPT_SERVICE_URL:-${input.promptServiceUrl}}"
+
+` : "";
+  return `#!/bin/bash
+# op-compose \u2014 wrapper that reads region secrets from macOS Keychain just
+# before invoking \`docker compose\`. Auto-generated by
+# \`create-op-node bootstrap --region ${input.region}\`. Do not edit by
+# hand; re-run bootstrap to regenerate.
+#
+# Why: launchctl setenv only propagates to launchd-spawned processes, so
+# SSH shells and pre-existing Terminal.app instances never see the env
+# vars bootstrap exports. This wrapper hydrates the docker compose
+# subprocess directly, so every invocation works regardless of how the
+# operator's shell was started.
+#
+# Usage:
+#   ./bin/op-compose -f docker-compose-prod.yml up -d
+#   ./bin/op-compose -f docker-compose-prod.yml pull
+#   ./bin/op-compose -f docker-compose-prod.yml down
+
+set -euo pipefail
+
+SVC="org.opuspopuli.${input.region}"
+
+require_secret() {
+  local account="$1"
+  local value
+  if ! value=$(security find-generic-password -s "$SVC" -a "$account" -w 2>/dev/null); then
+    echo "op-compose: missing Keychain entry '$account' under service '$SVC'." >&2
+    echo "Run: create-op-node bootstrap --region ${input.region}" >&2
+    exit 1
+  fi
+  printf '%s' "$value"
+}
+
+optional_secret() {
+  local account="$1"
+  security find-generic-password -s "$SVC" -a "$account" -w 2>/dev/null || true
+}
+
+# Bootstrap-critical: Postgres + Supabase admin credentials.
+export PGSODIUM_ROOT_KEY="$(require_secret pgsodium-root-key)"
+export POSTGRES_PASSWORD="$(require_secret postgres-password)"
+export JWT_SECRET="$(require_secret jwt-secret)"
+export SUPABASE_ANON_KEY="$(require_secret supabase-anon-key)"
+export SUPABASE_SERVICE_ROLE_KEY="$(require_secret supabase-service-role-key)"
+export DASHBOARD_PASSWORD="$(require_secret dashboard-password)"
+
+# AUTH_JWT_SECRET historically equals JWT_SECRET in dev/UAT \u2014 supply that
+# default if the operator hasn't set one independently.
+export AUTH_JWT_SECRET="\${AUTH_JWT_SECRET:-$JWT_SECRET}"
+
+# Optional: Cloudflare Tunnel token (only present in non-local-only mode).
+TUNNEL_TOKEN_VAL="$(optional_secret tunnel-token)"
+if [ -n "$TUNNEL_TOKEN_VAL" ]; then
+  export TUNNEL_TOKEN="$TUNNEL_TOKEN_VAL"
+fi
+
+# SUPABASE_URL is not a secret \u2014 read from env if the operator set one,
+# default to localhost for --local-only.
+export SUPABASE_URL="\${SUPABASE_URL:-http://localhost:8000}"
+
+${promptServiceUrlExport}# prompt-service credentials. Always exported \u2014 harmless when the operator
+# is NOT colocating prompt-service (the main compose doesn't read these
+# vars; the overlay does). The PROMPT_SERVICE_API_KEYS list is built from
+# the operator's region + the single HMAC key in Keychain, matching the
+# prompt-service env format \`<region>:<key>,<region>:<key>,\u2026\`.
+PROMPTS_DB_PASSWORD_VAL="$(optional_secret prompts-db-password)"
+PROMPT_SERVICE_API_KEY_VAL="$(optional_secret prompt-service-api-key)"
+PROMPT_SERVICE_ADMIN_API_KEY_VAL="$(optional_secret prompt-service-admin-api-key)"
+if [ -n "$PROMPTS_DB_PASSWORD_VAL" ]; then
+  export PROMPTS_DB_PASSWORD="$PROMPTS_DB_PASSWORD_VAL"
+fi
+if [ -n "$PROMPT_SERVICE_API_KEY_VAL" ]; then
+  export PROMPT_SERVICE_API_KEY="$PROMPT_SERVICE_API_KEY_VAL"
+  # API_KEYS env on prompt-service is \`<region>:<key>,\u2026\` \u2014 render the
+  # single-region pair here so prompt-service accepts the same key the
+  # backend sends. The prompts team adds additional regions on the
+  # central deployment for Phase 2.
+  export PROMPT_SERVICE_API_KEYS="${input.region}:$PROMPT_SERVICE_API_KEY_VAL"
+fi
+if [ -n "$PROMPT_SERVICE_ADMIN_API_KEY_VAL" ]; then
+  export PROMPT_SERVICE_ADMIN_API_KEYS="$PROMPT_SERVICE_ADMIN_API_KEY_VAL"
+fi
+
+exec docker compose "$@"
+`;
+}
+
+// src/lib/op-compose-install.ts
+async function installOpComposeWrapper(input) {
+  let content;
+  try {
+    content = renderOpComposeScript({
+      region: input.region,
+      ...input.promptServiceUrl !== void 0 ? { promptServiceUrl: input.promptServiceUrl } : {}
+    });
+  } catch (err) {
+    return { ok: false, reason: err.message };
+  }
+  const binDir = join(input.repoDir, "bin");
+  const target = join(binDir, "op-compose");
+  const tmp = `${target}.tmp.${process.pid}`;
+  try {
+    await mkdir(binDir, { recursive: true });
+    await writeFile(tmp, content, { mode: 493 });
+    await chmod(tmp, 493);
+    await rename(tmp, target);
+    return { ok: true, path: target };
+  } catch (err) {
+    return { ok: false, reason: `writing ${target} failed: ${err.message}` };
+  }
+}
+
 // src/lib/docker.ts
 var GHCR_REGISTRY = "ghcr.io";
 async function loginToGhcr() {
@@ -1449,16 +1588,19 @@ function composeArgs(opts, sub) {
   const profiles = (opts.profiles ?? []).flatMap((pr) => ["--profile", pr]);
   return ["compose", ...files, ...env, ...profiles, ...sub];
 }
+function execOpts(opts) {
+  return opts.env ? { cwd: opts.cwd, env: opts.env } : { cwd: opts.cwd };
+}
 async function composePull(opts) {
-  const res = await safeExeca("docker", composeArgs(opts, ["pull"]));
+  const res = await safeExeca("docker", composeArgs(opts, ["pull"]), execOpts(opts));
   return result(res, "compose pull");
 }
 async function composeUp(opts) {
-  const res = await safeExeca("docker", composeArgs(opts, ["up", "-d", "--remove-orphans"]));
+  const res = await safeExeca("docker", composeArgs(opts, ["up", "-d", "--remove-orphans"]), execOpts(opts));
   return result(res, "compose up");
 }
 async function composeRemoveService(opts, service) {
-  const res = await safeExeca("docker", composeArgs(opts, ["rm", "-sfv", service]));
+  const res = await safeExeca("docker", composeArgs(opts, ["rm", "-sfv", service]), execOpts(opts));
   return result(res, `compose rm ${service}`);
 }
 async function composeDown(opts) {
@@ -1471,7 +1613,7 @@ async function composeDown(opts) {
     opts.wipeVolumes ? "-v" : "",
     opts.removeImages ? `--rmi ${opts.removeImages}` : ""
   ].filter(Boolean).join(" ");
-  const res = await safeExeca("docker", composeArgs(opts, flags));
+  const res = await safeExeca("docker", composeArgs(opts, flags), execOpts(opts));
   return result(res, label);
 }
 async function dockerLogout(registry = GHCR_REGISTRY) {
@@ -1517,7 +1659,7 @@ function normalize(raw) {
   return { name, state, health, exitCode };
 }
 async function composePs(opts) {
-  const res = await safeExeca("docker", composeArgs(opts, ["ps", "--format", "json"]));
+  const res = await safeExeca("docker", composeArgs(opts, ["ps", "--format", "json"]), execOpts(opts));
   if (res === null || res.exitCode !== 0) return null;
   return parseComposePs(res.stdout);
 }
@@ -1776,6 +1918,16 @@ var bootstrapCommand = new Command("bootstrap").description(
     "--supabase-url <url>",
     "Public-facing Supabase URL (what browsers + microservices use). Default: `http://localhost:8000` in --local-only mode, otherwise `https://supabase.<domain>` (which the operator can override)."
   )
+).addOption(
+  new Option(
+    "--node-type <type>",
+    "Deployment topology. `region` (default) = region node connecting to remote prompt-service. `region-with-prompts` = region node + colocated prompt-service overlay (team/dev use). `prompts-only` = future stub for the central prompts deployment."
+  ).choices(["region", "region-with-prompts", "prompts-only"])
+).addOption(
+  new Option(
+    "--prompt-service-url <url>",
+    "Remote prompt-service URL. Only meaningful for --node-type=region (default: https://prompts.opuspopuli.org). Ignored for --node-type=region-with-prompts (the overlay pins it to http://opuspopuli-prompts:3210)."
+  )
 ).addOption(new Option("--skip-stack", "Stop before `docker compose pull && up`").default(false)).addOption(
   new Option(
     "--local-only",
@@ -1783,6 +1935,32 @@ var bootstrapCommand = new Command("bootstrap").description(
   ).default(false)
 ).addOption(new Option("-y, --yes", "Skip confirmation prompts").default(false)).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node bootstrap ")));
+  const nodeType = opts.nodeType ? opts.nodeType : unwrap(
+    await p3.select({
+      message: "What kind of node are you provisioning?",
+      options: [
+        {
+          value: "region",
+          label: "Region node (civic data for one region, remote prompt-service)"
+        },
+        {
+          value: "region-with-prompts",
+          label: "Region + colocated prompt-service (team / dev)"
+        },
+        {
+          value: "prompts-only",
+          label: "Prompt-service node (central prompts deployment \u2014 future)"
+        }
+      ],
+      initialValue: "region"
+    })
+  );
+  if (nodeType === "prompts-only") {
+    p3.cancel(
+      "prompts-only node deployment is not yet implemented. This flag exists so the CLI surface is stable for when the prompts team deploys the central prompts.opuspopuli.org instance \u2014 but the deployment stack (compose file, healthchecks, observability) is filled in later, when there is an actual central prompt-service to deploy."
+    );
+    process.exit(1);
+  }
   const region = opts.region ? opts.region : unwrap(
     await p3.text({
       message: "Region label (the slug used during init \u2014 e.g. us-ca)?",
@@ -1968,6 +2146,46 @@ var bootstrapCommand = new Command("bootstrap").description(
     validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
     generate: generateDashboardPassword
   });
+  if (nodeType === "region-with-prompts") {
+    await loadSecret({
+      region,
+      account: "prompts-db-password",
+      label: "prompt-service Postgres password",
+      validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
+      generate: generatePostgresPassword
+    });
+    await loadSecret({
+      region,
+      account: "prompt-service-api-key",
+      label: "prompt-service HMAC API key",
+      // Same URL-safe alphabet as other HMAC keys; embedded in the
+      // `<region>:<key>` API_KEYS list and in Authorization headers.
+      validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
+      generate: generateHmacApiKey
+    });
+    await loadSecret({
+      region,
+      account: "prompt-service-admin-api-key",
+      label: "prompt-service admin API key",
+      validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
+      generate: generateHmacApiKey
+    });
+  } else {
+    await loadSecret({
+      region,
+      account: "prompt-service-api-key",
+      label: "prompt-service HMAC API key (issued by the prompts team)",
+      placeholder: "paste the region-specific HMAC key",
+      validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)"
+    });
+  }
+  const promptServiceUrl = nodeType === "region-with-prompts" ? "http://opuspopuli-prompts:3210" : opts.promptServiceUrl ?? "https://prompts.opuspopuli.org";
+  if (!SAFE_URL_RE.test(promptServiceUrl)) {
+    p3.cancel(
+      `--prompt-service-url ${JSON.stringify(promptServiceUrl)} contains characters outside the allowed URL set`
+    );
+    process.exit(1);
+  }
   let supabaseUrl;
   if (opts.supabaseUrl) {
     supabaseUrl = opts.supabaseUrl;
@@ -2014,6 +2232,15 @@ var bootstrapCommand = new Command("bootstrap").description(
       )
     );
   }
+  const wrapperSpin = p3.spinner();
+  wrapperSpin.start("Installing bin/op-compose wrapper\u2026");
+  const wrapper = await installOpComposeWrapper({ repoDir: repoPath, region, promptServiceUrl });
+  if (!wrapper.ok) {
+    wrapperSpin.stop(pc2.red("\u2717 op-compose wrapper install failed."));
+    p3.cancel(wrapper.reason ?? "op-compose wrapper install failed.");
+    process.exit(1);
+  }
+  wrapperSpin.stop(pc2.green(`\u2713 Installed ${wrapper.path} (mode 0755).`));
   const ghcrSpin = p3.spinner();
   ghcrSpin.start("Authenticating Docker to ghcr.io\u2026");
   const ghcr = await loginToGhcr();
@@ -2066,17 +2293,31 @@ var bootstrapCommand = new Command("bootstrap").description(
     const profileFlag = opts.localOnly ? "" : "--profile public ";
     p3.outro(
       pc2.cyan(
-        `Stack-up skipped. Run \`docker compose -f ${composeFile.join(" -f ")} ${profileFlag}pull && docker compose -f ${composeFile.join(" -f ")} ${profileFlag}up -d\` from ${repoPath} when ready.`
+        `Stack-up skipped. Run \`./bin/op-compose -f ${composeFile.join(" -f ")} ${profileFlag}pull && ./bin/op-compose -f ${composeFile.join(" -f ")} ${profileFlag}up -d\` from ${repoPath} when ready. (op-compose hydrates Keychain secrets per-invocation; use it instead of raw \`docker compose\`.)`
       )
     );
     return;
   }
   const composeFiles = resolveComposeFiles(repoPath, composeFile);
+  const composeEnv = {
+    PGSODIUM_ROOT_KEY: pgsodiumKey,
+    POSTGRES_PASSWORD: postgresPassword,
+    JWT_SECRET: jwtSecret,
+    SUPABASE_ANON_KEY: supabaseAnonKey,
+    SUPABASE_SERVICE_ROLE_KEY: supabaseServiceRoleKey,
+    DASHBOARD_PASSWORD: dashboardPassword,
+    SUPABASE_URL: supabaseUrl,
+    AUTH_JWT_SECRET: process.env["AUTH_JWT_SECRET"] ?? jwtSecret,
+    ...tunnelToken !== void 0 ? { TUNNEL_TOKEN: tunnelToken } : {},
+    ...llmModel ? { LLM_MODEL: llmModel } : {},
+    ...embeddingModel ? { EMBEDDINGS_MODEL: embeddingModel } : {}
+  };
   const composeOpts = {
     files: composeFiles,
     cwd: repoPath,
     ...opts.envFile ? { envFile: opts.envFile } : {},
-    profiles: opts.localOnly ? LOCAL_PROFILES : PUBLIC_PROFILES
+    profiles: opts.localOnly ? LOCAL_PROFILES : PUBLIC_PROFILES,
+    env: composeEnv
   };
   if (opts.localOnly) {
     const evict = p3.spinner();
@@ -2372,7 +2613,7 @@ async function loadSecret(input) {
   }
   return pasted;
 }
-var REGION_RE = /^[a-z0-9-]{2,32}$/;
+var REGION_RE2 = /^[a-z0-9-]{2,32}$/;
 var RESET_PHASES = {
   STOP_STACK: "Stop stack",
   LAUNCH_AGENT: "LaunchAgent",
@@ -2529,10 +2770,10 @@ var resetCommand = new Command("reset").description(
     await p3.text({
       message: "Region label (the slug used during init \u2014 e.g. us-ca)?",
       placeholder: "us-ca",
-      validate: (v) => REGION_RE.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
+      validate: (v) => REGION_RE2.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
     })
   );
-  if (!REGION_RE.test(region)) {
+  if (!REGION_RE2.test(region)) {
     p3.cancel(`--region ${JSON.stringify(region)} is not a valid region slug.`);
     process.exit(2);
   }
@@ -2577,6 +2818,7 @@ var resetCommand = new Command("reset").description(
   if (repoPath) {
     runningContainers = await composePs({
       files: resolveComposeFiles(repoPath, opts.composeFile),
+      cwd: repoPath,
       ...opts.envFile ? { envFile: opts.envFile } : {}
     });
   }
@@ -4092,7 +4334,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.9.0";
+var VERSION = "0.10.0";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."