create-op-node 0.9.0 → 0.9.1

package/dist/cli.js

@@ -6,7 +6,7 @@ import { execa } from 'execa';
 import { Octokit } from '@octokit/rest';
 import { randomBytes, createHmac } from 'crypto';
 import { join, resolve, dirname } from 'path';
-import { mkdir, writeFile, access, rm, chmod } from 'fs/promises';
+import { mkdir, writeFile, access, chmod, rename, rm } from 'fs/promises';
 import { homedir } from 'os';
 import { readFileSync } from 'fs';
 import * as tls from 'tls';
@@ -1403,6 +1403,99 @@ async function teardownLaunchAgent(paths, opts = {}) {
   return { ok: steps.every((s) => s.ok), steps };
 }
 
+// src/lib/op-compose-script.ts
+var REGION_RE = /^[a-z0-9-]{2,32}$/;
+function renderOpComposeScript(input) {
+  if (!REGION_RE.test(input.region)) {
+    throw new Error(
+      `region ${JSON.stringify(input.region)} contains characters not allowed in a launchd / Keychain service identifier`
+    );
+  }
+  return `#!/bin/bash
+# op-compose \u2014 wrapper that reads region secrets from macOS Keychain just
+# before invoking \`docker compose\`. Auto-generated by
+# \`create-op-node bootstrap --region ${input.region}\`. Do not edit by
+# hand; re-run bootstrap to regenerate.
+#
+# Why: launchctl setenv only propagates to launchd-spawned processes, so
+# SSH shells and pre-existing Terminal.app instances never see the env
+# vars bootstrap exports. This wrapper hydrates the docker compose
+# subprocess directly, so every invocation works regardless of how the
+# operator's shell was started.
+#
+# Usage:
+#   ./bin/op-compose -f docker-compose-prod.yml up -d
+#   ./bin/op-compose -f docker-compose-prod.yml pull
+#   ./bin/op-compose -f docker-compose-prod.yml down
+
+set -euo pipefail
+
+SVC="org.opuspopuli.${input.region}"
+
+require_secret() {
+  local account="$1"
+  local value
+  if ! value=$(security find-generic-password -s "$SVC" -a "$account" -w 2>/dev/null); then
+    echo "op-compose: missing Keychain entry '$account' under service '$SVC'." >&2
+    echo "Run: create-op-node bootstrap --region ${input.region}" >&2
+    exit 1
+  fi
+  printf '%s' "$value"
+}
+
+optional_secret() {
+  local account="$1"
+  security find-generic-password -s "$SVC" -a "$account" -w 2>/dev/null || true
+}
+
+# Bootstrap-critical: Postgres + Supabase admin credentials.
+export PGSODIUM_ROOT_KEY="$(require_secret pgsodium-root-key)"
+export POSTGRES_PASSWORD="$(require_secret postgres-password)"
+export JWT_SECRET="$(require_secret jwt-secret)"
+export SUPABASE_ANON_KEY="$(require_secret supabase-anon-key)"
+export SUPABASE_SERVICE_ROLE_KEY="$(require_secret supabase-service-role-key)"
+export DASHBOARD_PASSWORD="$(require_secret dashboard-password)"
+
+# AUTH_JWT_SECRET historically equals JWT_SECRET in dev/UAT \u2014 supply that
+# default if the operator hasn't set one independently.
+export AUTH_JWT_SECRET="\${AUTH_JWT_SECRET:-$JWT_SECRET}"
+
+# Optional: Cloudflare Tunnel token (only present in non-local-only mode).
+TUNNEL_TOKEN_VAL="$(optional_secret tunnel-token)"
+if [ -n "$TUNNEL_TOKEN_VAL" ]; then
+  export TUNNEL_TOKEN="$TUNNEL_TOKEN_VAL"
+fi
+
+# SUPABASE_URL is not a secret \u2014 read from env if the operator set one,
+# default to localhost for --local-only.
+export SUPABASE_URL="\${SUPABASE_URL:-http://localhost:8000}"
+
+exec docker compose "$@"
+`;
+}
+
+// src/lib/op-compose-install.ts
+async function installOpComposeWrapper(input) {
+  let content;
+  try {
+    content = renderOpComposeScript({ region: input.region });
+  } catch (err) {
+    return { ok: false, reason: err.message };
+  }
+  const binDir = join(input.repoDir, "bin");
+  const target = join(binDir, "op-compose");
+  const tmp = `${target}.tmp.${process.pid}`;
+  try {
+    await mkdir(binDir, { recursive: true });
+    await writeFile(tmp, content, { mode: 493 });
+    await chmod(tmp, 493);
+    await rename(tmp, target);
+    return { ok: true, path: target };
+  } catch (err) {
+    return { ok: false, reason: `writing ${target} failed: ${err.message}` };
+  }
+}
+
 // src/lib/docker.ts
 var GHCR_REGISTRY = "ghcr.io";
 async function loginToGhcr() {
@@ -1449,16 +1542,19 @@ function composeArgs(opts, sub) {
   const profiles = (opts.profiles ?? []).flatMap((pr) => ["--profile", pr]);
   return ["compose", ...files, ...env, ...profiles, ...sub];
 }
+function execOpts(opts) {
+  return opts.env ? { cwd: opts.cwd, env: opts.env } : { cwd: opts.cwd };
+}
 async function composePull(opts) {
-  const res = await safeExeca("docker", composeArgs(opts, ["pull"]));
+  const res = await safeExeca("docker", composeArgs(opts, ["pull"]), execOpts(opts));
   return result(res, "compose pull");
 }
 async function composeUp(opts) {
-  const res = await safeExeca("docker", composeArgs(opts, ["up", "-d", "--remove-orphans"]));
+  const res = await safeExeca("docker", composeArgs(opts, ["up", "-d", "--remove-orphans"]), execOpts(opts));
   return result(res, "compose up");
 }
 async function composeRemoveService(opts, service) {
-  const res = await safeExeca("docker", composeArgs(opts, ["rm", "-sfv", service]));
+  const res = await safeExeca("docker", composeArgs(opts, ["rm", "-sfv", service]), execOpts(opts));
   return result(res, `compose rm ${service}`);
 }
 async function composeDown(opts) {
@@ -1471,7 +1567,7 @@ async function composeDown(opts) {
     opts.wipeVolumes ? "-v" : "",
     opts.removeImages ? `--rmi ${opts.removeImages}` : ""
   ].filter(Boolean).join(" ");
-  const res = await safeExeca("docker", composeArgs(opts, flags));
+  const res = await safeExeca("docker", composeArgs(opts, flags), execOpts(opts));
   return result(res, label);
 }
 async function dockerLogout(registry = GHCR_REGISTRY) {
@@ -1517,7 +1613,7 @@ function normalize(raw) {
   return { name, state, health, exitCode };
 }
 async function composePs(opts) {
-  const res = await safeExeca("docker", composeArgs(opts, ["ps", "--format", "json"]));
+  const res = await safeExeca("docker", composeArgs(opts, ["ps", "--format", "json"]), execOpts(opts));
   if (res === null || res.exitCode !== 0) return null;
   return parseComposePs(res.stdout);
 }
@@ -2014,6 +2110,15 @@ var bootstrapCommand = new Command("bootstrap").description(
       )
     );
   }
+  const wrapperSpin = p3.spinner();
+  wrapperSpin.start("Installing bin/op-compose wrapper\u2026");
+  const wrapper = await installOpComposeWrapper({ repoDir: repoPath, region });
+  if (!wrapper.ok) {
+    wrapperSpin.stop(pc2.red("\u2717 op-compose wrapper install failed."));
+    p3.cancel(wrapper.reason ?? "op-compose wrapper install failed.");
+    process.exit(1);
+  }
+  wrapperSpin.stop(pc2.green(`\u2713 Installed ${wrapper.path} (mode 0755).`));
   const ghcrSpin = p3.spinner();
   ghcrSpin.start("Authenticating Docker to ghcr.io\u2026");
   const ghcr = await loginToGhcr();
@@ -2066,17 +2171,31 @@ var bootstrapCommand = new Command("bootstrap").description(
     const profileFlag = opts.localOnly ? "" : "--profile public ";
     p3.outro(
       pc2.cyan(
-        `Stack-up skipped. Run \`docker compose -f ${composeFile.join(" -f ")} ${profileFlag}pull && docker compose -f ${composeFile.join(" -f ")} ${profileFlag}up -d\` from ${repoPath} when ready.`
+        `Stack-up skipped. Run \`./bin/op-compose -f ${composeFile.join(" -f ")} ${profileFlag}pull && ./bin/op-compose -f ${composeFile.join(" -f ")} ${profileFlag}up -d\` from ${repoPath} when ready. (op-compose hydrates Keychain secrets per-invocation; use it instead of raw \`docker compose\`.)`
       )
     );
     return;
   }
   const composeFiles = resolveComposeFiles(repoPath, composeFile);
+  const composeEnv = {
+    PGSODIUM_ROOT_KEY: pgsodiumKey,
+    POSTGRES_PASSWORD: postgresPassword,
+    JWT_SECRET: jwtSecret,
+    SUPABASE_ANON_KEY: supabaseAnonKey,
+    SUPABASE_SERVICE_ROLE_KEY: supabaseServiceRoleKey,
+    DASHBOARD_PASSWORD: dashboardPassword,
+    SUPABASE_URL: supabaseUrl,
+    AUTH_JWT_SECRET: process.env["AUTH_JWT_SECRET"] ?? jwtSecret,
+    ...tunnelToken !== void 0 ? { TUNNEL_TOKEN: tunnelToken } : {},
+    ...llmModel ? { LLM_MODEL: llmModel } : {},
+    ...embeddingModel ? { EMBEDDINGS_MODEL: embeddingModel } : {}
+  };
   const composeOpts = {
     files: composeFiles,
     cwd: repoPath,
     ...opts.envFile ? { envFile: opts.envFile } : {},
-    profiles: opts.localOnly ? LOCAL_PROFILES : PUBLIC_PROFILES
+    profiles: opts.localOnly ? LOCAL_PROFILES : PUBLIC_PROFILES,
+    env: composeEnv
   };
   if (opts.localOnly) {
     const evict = p3.spinner();
@@ -2372,7 +2491,7 @@ async function loadSecret(input) {
   }
   return pasted;
 }
-var REGION_RE = /^[a-z0-9-]{2,32}$/;
+var REGION_RE2 = /^[a-z0-9-]{2,32}$/;
 var RESET_PHASES = {
   STOP_STACK: "Stop stack",
   LAUNCH_AGENT: "LaunchAgent",
@@ -2529,10 +2648,10 @@ var resetCommand = new Command("reset").description(
     await p3.text({
       message: "Region label (the slug used during init \u2014 e.g. us-ca)?",
       placeholder: "us-ca",
-      validate: (v) => REGION_RE.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
+      validate: (v) => REGION_RE2.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
     })
   );
-  if (!REGION_RE.test(region)) {
+  if (!REGION_RE2.test(region)) {
     p3.cancel(`--region ${JSON.stringify(region)} is not a valid region slug.`);
     process.exit(2);
   }
@@ -2577,6 +2696,7 @@ var resetCommand = new Command("reset").description(
   if (repoPath) {
     runningContainers = await composePs({
       files: resolveComposeFiles(repoPath, opts.composeFile),
+      cwd: repoPath,
       ...opts.envFile ? { envFile: opts.envFile } : {}
     });
   }
@@ -4092,7 +4212,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.9.0";
+var VERSION = "0.9.1";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."