create-op-node 0.9.1 → 0.10.1

package/dist/cli.js

@@ -237,7 +237,10 @@ var FRIENDLY = {
   "jwt-secret": "JWT signing secret",
   "supabase-anon-key": "Supabase anon key",
   "supabase-service-role-key": "Supabase service role key",
-  "dashboard-password": "Supabase Studio dashboard password"
+  "dashboard-password": "Supabase Studio dashboard password",
+  "prompts-db-password": "prompt-service Postgres password",
+  "prompt-service-api-key": "prompt-service HMAC API key",
+  "prompt-service-admin-api-key": "prompt-service admin API key"
 };
 function labelFor(coords) {
   return `Opus Populi (${coords.region}) \u2014 ${FRIENDLY[coords.account]}`;
@@ -286,7 +289,7 @@ async function saveSecret(coords, value) {
     return {
       written: false,
       updated,
-      reason: `security add-generic-password failed (${res.exitCode ?? "signal"}): ${res.stderr || res.stdout}`
+      reason: `security add-generic-password failed (${res.exitCode ?? "signal"}): ${res.stderr || res.stdout}${formatKeychainHint(res.exitCode)}`
     };
   }
   return { written: true, updated };
@@ -306,6 +309,47 @@ async function readSecret(coords) {
   const value = res.stdout.trim();
   return value.length > 0 ? value : null;
 }
+var ERR_SEC_INTERACTION_NOT_ALLOWED = 36;
+function formatKeychainHint(exitCode) {
+  if (exitCode === ERR_SEC_INTERACTION_NOT_ALLOWED) {
+    return `
+Hint: the login keychain is locked (SSH sessions don't auto-unlock it).
+Run \`security unlock-keychain ~/Library/Keychains/login.keychain-db\` and re-run bootstrap.`;
+  }
+  return "";
+}
+async function isKeychainLocked() {
+  const res = await safeExeca("security", [
+    "find-generic-password",
+    "-s",
+    `${SERVICE_PREFIX}.__op_node_lock_probe__`,
+    "-a",
+    "__nothing_here__"
+  ]);
+  if (res === null) return false;
+  return res.exitCode === ERR_SEC_INTERACTION_NOT_ALLOWED;
+}
+async function unlockKeychain(password3) {
+  const res = await safeExeca("security", [
+    "unlock-keychain",
+    "-p",
+    password3,
+    // Default keychain path — same as the operator's GUI login keychain
+    // on a stock macOS install. Lets us avoid a homedir lookup here.
+    `${process.env["HOME"] ?? ""}/Library/Keychains/login.keychain-db`
+  ]);
+  if (res === null) return { ok: false, reason: "`security` CLI not on PATH" };
+  if (res.exitCode !== 0) {
+    return {
+      ok: false,
+      reason: `security unlock-keychain failed (${res.exitCode ?? "signal"}): ${res.stderr || res.stdout}`
+    };
+  }
+  return { ok: true };
+}
+function isSshSession(env = process.env) {
+  return Boolean(env["SSH_CONNECTION"] ?? env["SSH_TTY"]);
+}
 function unwrap(value) {
   if (p3.isCancel(value)) {
     p3.cancel("Cancelled.");
@@ -448,6 +492,9 @@ function generatePostgresPassword() {
 function generateDashboardPassword() {
   return base64url(randomBytes(24));
 }
+function generateHmacApiKey() {
+  return base64url(randomBytes(32));
+}
 function generateJwtSecret() {
   return randomBytes(48).toString("base64");
 }
@@ -1405,12 +1452,26 @@ async function teardownLaunchAgent(paths, opts = {}) {
 
 // src/lib/op-compose-script.ts
 var REGION_RE = /^[a-z0-9-]{2,32}$/;
+var PROMPT_SERVICE_URL_RE = /^[A-Za-z0-9:/_.-]+$/;
 function renderOpComposeScript(input) {
   if (!REGION_RE.test(input.region)) {
     throw new Error(
       `region ${JSON.stringify(input.region)} contains characters not allowed in a launchd / Keychain service identifier`
     );
   }
+  if (input.promptServiceUrl !== void 0 && !PROMPT_SERVICE_URL_RE.test(input.promptServiceUrl)) {
+    throw new Error(
+      `promptServiceUrl ${JSON.stringify(input.promptServiceUrl)} contains characters not allowed in a wrapper export`
+    );
+  }
+  const promptServiceUrlExport = input.promptServiceUrl !== void 0 ? `# Backend services call prompt-service via this URL. Service-level env
+# from docker-compose-prompt-service.yml overlay (when layered) wins
+# over this default \u2014 so colocated deployments still hit
+# http://opuspopuli-prompts:3210 even though we may have a public URL
+# baked in here.
+export PROMPT_SERVICE_URL="\${PROMPT_SERVICE_URL:-${input.promptServiceUrl}}"
+
+` : "";
   return `#!/bin/bash
 # op-compose \u2014 wrapper that reads region secrets from macOS Keychain just
 # before invoking \`docker compose\`. Auto-generated by
@@ -1470,6 +1531,29 @@ fi
 # default to localhost for --local-only.
 export SUPABASE_URL="\${SUPABASE_URL:-http://localhost:8000}"
 
+${promptServiceUrlExport}# prompt-service credentials. Always exported \u2014 harmless when the operator
+# is NOT colocating prompt-service (the main compose doesn't read these
+# vars; the overlay does). The PROMPT_SERVICE_API_KEYS list is built from
+# the operator's region + the single HMAC key in Keychain, matching the
+# prompt-service env format \`<region>:<key>,<region>:<key>,\u2026\`.
+PROMPTS_DB_PASSWORD_VAL="$(optional_secret prompts-db-password)"
+PROMPT_SERVICE_API_KEY_VAL="$(optional_secret prompt-service-api-key)"
+PROMPT_SERVICE_ADMIN_API_KEY_VAL="$(optional_secret prompt-service-admin-api-key)"
+if [ -n "$PROMPTS_DB_PASSWORD_VAL" ]; then
+  export PROMPTS_DB_PASSWORD="$PROMPTS_DB_PASSWORD_VAL"
+fi
+if [ -n "$PROMPT_SERVICE_API_KEY_VAL" ]; then
+  export PROMPT_SERVICE_API_KEY="$PROMPT_SERVICE_API_KEY_VAL"
+  # API_KEYS env on prompt-service is \`<region>:<key>,\u2026\` \u2014 render the
+  # single-region pair here so prompt-service accepts the same key the
+  # backend sends. The prompts team adds additional regions on the
+  # central deployment for Phase 2.
+  export PROMPT_SERVICE_API_KEYS="${input.region}:$PROMPT_SERVICE_API_KEY_VAL"
+fi
+if [ -n "$PROMPT_SERVICE_ADMIN_API_KEY_VAL" ]; then
+  export PROMPT_SERVICE_ADMIN_API_KEYS="$PROMPT_SERVICE_ADMIN_API_KEY_VAL"
+fi
+
 exec docker compose "$@"
 `;
 }
@@ -1478,7 +1562,10 @@ exec docker compose "$@"
 async function installOpComposeWrapper(input) {
   let content;
   try {
-    content = renderOpComposeScript({ region: input.region });
+    content = renderOpComposeScript({
+      region: input.region,
+      ...input.promptServiceUrl !== void 0 ? { promptServiceUrl: input.promptServiceUrl } : {}
+    });
   } catch (err) {
     return { ok: false, reason: err.message };
   }
@@ -1872,6 +1959,16 @@ var bootstrapCommand = new Command("bootstrap").description(
     "--supabase-url <url>",
     "Public-facing Supabase URL (what browsers + microservices use). Default: `http://localhost:8000` in --local-only mode, otherwise `https://supabase.<domain>` (which the operator can override)."
   )
+).addOption(
+  new Option(
+    "--node-type <type>",
+    "Deployment topology. `region` (default) = region node connecting to remote prompt-service. `region-with-prompts` = region node + colocated prompt-service overlay (team/dev use). `prompts-only` = future stub for the central prompts deployment."
+  ).choices(["region", "region-with-prompts", "prompts-only"])
+).addOption(
+  new Option(
+    "--prompt-service-url <url>",
+    "Remote prompt-service URL. Only meaningful for --node-type=region (default: https://prompts.opuspopuli.org). Ignored for --node-type=region-with-prompts (the overlay pins it to http://opuspopuli-prompts:3210)."
+  )
 ).addOption(new Option("--skip-stack", "Stop before `docker compose pull && up`").default(false)).addOption(
   new Option(
     "--local-only",
@@ -1879,6 +1976,32 @@ var bootstrapCommand = new Command("bootstrap").description(
   ).default(false)
 ).addOption(new Option("-y, --yes", "Skip confirmation prompts").default(false)).action(async (opts) => {
   p3.intro(pc2.bgCyan(pc2.black(" create-op-node bootstrap ")));
+  const nodeType = opts.nodeType ? opts.nodeType : unwrap(
+    await p3.select({
+      message: "What kind of node are you provisioning?",
+      options: [
+        {
+          value: "region",
+          label: "Region node (civic data for one region, remote prompt-service)"
+        },
+        {
+          value: "region-with-prompts",
+          label: "Region + colocated prompt-service (team / dev)"
+        },
+        {
+          value: "prompts-only",
+          label: "Prompt-service node (central prompts deployment \u2014 future)"
+        }
+      ],
+      initialValue: "region"
+    })
+  );
+  if (nodeType === "prompts-only") {
+    p3.cancel(
+      "prompts-only node deployment is not yet implemented. This flag exists so the CLI surface is stable for when the prompts team deploys the central prompts.opuspopuli.org instance \u2014 but the deployment stack (compose file, healthchecks, observability) is filled in later, when there is an actual central prompt-service to deploy."
+    );
+    process.exit(1);
+  }
   const region = opts.region ? opts.region : unwrap(
     await p3.text({
       message: "Region label (the slug used during init \u2014 e.g. us-ca)?",
@@ -2011,6 +2134,31 @@ var bootstrapCommand = new Command("bootstrap").description(
     );
     process.exit(1);
   }
+  if (isSshSession() && await isKeychainLocked()) {
+    p3.note(
+      [
+        "SSH session detected with a locked login keychain.",
+        "macOS keychain operations require an unlocked keychain \u2014 your",
+        "login password will be used once to unlock it for this session.",
+        "The keychain remains unlocked until the session ends or it",
+        "idle-locks. To skip and unlock manually, press Ctrl+C and run",
+        "`security unlock-keychain` yourself."
+      ].join("\n"),
+      "Keychain unlock required"
+    );
+    const pw = unwrap(
+      await p3.password({
+        message: "macOS login password (for `security unlock-keychain`):",
+        validate: (v) => v && v.length > 0 ? void 0 : "password required"
+      })
+    );
+    const unlock = await unlockKeychain(pw);
+    if (!unlock.ok) {
+      p3.cancel(unlock.reason ?? "security unlock-keychain failed.");
+      process.exit(1);
+    }
+    p3.note(`${pc2.green("\u2713")} Keychain unlocked for this session.`, "Keychain");
+  }
   const pgsodiumKey = await loadSecret({
     region,
     account: "pgsodium-root-key",
@@ -2064,6 +2212,46 @@ var bootstrapCommand = new Command("bootstrap").description(
     validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
     generate: generateDashboardPassword
   });
+  if (nodeType === "region-with-prompts") {
+    await loadSecret({
+      region,
+      account: "prompts-db-password",
+      label: "prompt-service Postgres password",
+      validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
+      generate: generatePostgresPassword
+    });
+    await loadSecret({
+      region,
+      account: "prompt-service-api-key",
+      label: "prompt-service HMAC API key",
+      // Same URL-safe alphabet as other HMAC keys; embedded in the
+      // `<region>:<key>` API_KEYS list and in Authorization headers.
+      validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
+      generate: generateHmacApiKey
+    });
+    await loadSecret({
+      region,
+      account: "prompt-service-admin-api-key",
+      label: "prompt-service admin API key",
+      validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)",
+      generate: generateHmacApiKey
+    });
+  } else {
+    await loadSecret({
+      region,
+      account: "prompt-service-api-key",
+      label: "prompt-service HMAC API key (issued by the prompts team)",
+      placeholder: "paste the region-specific HMAC key",
+      validate: (v) => URL_SAFE_PASSWORD_RE.test(v) ? void 0 : "must be base64url chars only (no + / =)"
+    });
+  }
+  const promptServiceUrl = nodeType === "region-with-prompts" ? "http://opuspopuli-prompts:3210" : opts.promptServiceUrl ?? "https://prompts.opuspopuli.org";
+  if (!SAFE_URL_RE.test(promptServiceUrl)) {
+    p3.cancel(
+      `--prompt-service-url ${JSON.stringify(promptServiceUrl)} contains characters outside the allowed URL set`
+    );
+    process.exit(1);
+  }
   let supabaseUrl;
   if (opts.supabaseUrl) {
     supabaseUrl = opts.supabaseUrl;
@@ -2112,7 +2300,7 @@ var bootstrapCommand = new Command("bootstrap").description(
   }
   const wrapperSpin = p3.spinner();
   wrapperSpin.start("Installing bin/op-compose wrapper\u2026");
-  const wrapper = await installOpComposeWrapper({ repoDir: repoPath, region });
+  const wrapper = await installOpComposeWrapper({ repoDir: repoPath, region, promptServiceUrl });
   if (!wrapper.ok) {
     wrapperSpin.stop(pc2.red("\u2717 op-compose wrapper install failed."));
     p3.cancel(wrapper.reason ?? "op-compose wrapper install failed.");
@@ -4212,7 +4400,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.9.1";
+var VERSION = "0.10.1";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."