unoverse 0.1.1 → 0.1.3

package/bin/unoverse.mjs

@@ -18,6 +18,7 @@ const HELP = `
 
   unoverse create [name]   What are you building? Studio project · universe · client app
   unoverse studio          Launch Unoverse Studio (authoring: components, nodes, skills)
+  unoverse urls            Your deployed universe's addresses — probed live, not recited
   unoverse help            This
 
   Operating a running universe? That lives in your universe folder:
@@ -29,6 +30,12 @@ switch (cmd) {
     await create(args[0]);
     break;
 
+  case "urls": {
+    const { urls } = await import("../lib/urls.mjs");
+    await urls();
+    break;
+  }
+
   case "studio": {
     // Studio is its own npm app; this is a launcher, not a wrapper.
     const r = spawnSync("npx", ["-y", "@unoverse-platform/studio@latest", ...args], {

package/lib/create.mjs

@@ -24,6 +24,18 @@ async function ask(rl, q) {
   return (await rl.question(`  ${q}`)).trim();
 }
 
+/** Operators hold the credential in two shapes: the raw dop_v1 API token, and the
+ * pre-encoded base64 `user:token` blob that docker config (and the starter's own
+ * `docr` setting) uses. Wrapping the second shape in base64 AGAIN is how a valid
+ * credential gets refused, so detect it and pass it through untouched. */
+function registryAuth(token) {
+  if (/^[A-Za-z0-9+/]+=*$/.test(token)) {
+    const decoded = Buffer.from(token, "base64").toString("utf8");
+    if (/^[\x20-\x7e]+:[\x20-\x7e]+$/.test(decoded)) return token;
+  }
+  return Buffer.from(`${token}:${token}`).toString("base64");
+}
+
 /** The gate: prove the token opens the registry before handing over the kit.
  * Docker registries use the bearer-realm flow: /v2/ answers 401 and names the
  * auth realm; presenting the token there yields 200 (valid) or 401 (refused). */
@@ -34,10 +46,9 @@ async function validateRegistryToken(token) {
     const realm = /realm="([^"]+)"/.exec(wa)?.[1];
     const service = /service="([^"]+)"/.exec(wa)?.[1] ?? REGISTRY_HOST;
     if (!realm) return probe.status === 200;
-    const auth = Buffer.from(`${token}:${token}`).toString("base64");
     const res = await fetch(
       `${realm}?service=${encodeURIComponent(service)}&scope=registry:catalog:*`,
-      { headers: { Authorization: `Basic ${auth}` } },
+      { headers: { Authorization: `Basic ${registryAuth(token)}` } },
     );
     return res.ok;
   } catch {

package/lib/urls.mjs

@@ -0,0 +1,115 @@
+/**
+ * `unoverse urls` — the deployed stack's addresses, PROBED, not recited.
+ *
+ * Run it in a universe folder (or anywhere above one). It reads the deployment's
+ * own facts — .env.production first, the ground's terraform outputs as enrichment —
+ * builds every URL a person or client would use, then actually requests each one
+ * and reports what answered. A URL you cannot click is a hope, not an address.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve, dirname } from "node:path";
+import { spawnSync } from "node:child_process";
+
+const COLOR = !process.env.NO_COLOR;
+const paint = (code) => (s) => (COLOR ? `\x1b[${code}m${s}\x1b[0m` : s);
+const bold = paint("1");
+const dim = paint("2");
+const cyan = paint("36");
+const green = paint("32");
+const red = paint("31");
+
+/** Walk up from cwd to the folder holding .env.production (a universe checkout). */
+function findUniverseRoot() {
+  for (let dir = process.cwd(); ; ) {
+    if (existsSync(join(dir, ".env.production"))) return dir;
+    const parent = resolve(dir, "..");
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+function parseEnv(file) {
+  const env = {};
+  for (const line of readFileSync(file, "utf8").split("\n")) {
+    const m = /^([A-Z0-9_]+)=(.*)$/.exec(line.trim());
+    if (m) env[m[1]] = m[2];
+  }
+  return env;
+}
+
+/** The ground's terraform outputs, when a state is present. Best-effort. */
+function terraformOutputs(root) {
+  for (const ground of ["infra/digitalocean", "infra/aws"]) {
+    const dir = join(root, ground);
+    if (!existsSync(join(dir, "terraform.tfstate")) && !existsSync(join(dir, ".terraform"))) continue;
+    const r = spawnSync("terraform", ["output", "-json"], { cwd: dir, encoding: "utf8" });
+    if (r.status === 0) {
+      try {
+        const out = JSON.parse(r.stdout);
+        return Object.fromEntries(Object.entries(out).map(([k, v]) => [k, v.value]));
+      } catch { /* fall through */ }
+    }
+  }
+  return {};
+}
+
+async function probe(url) {
+  try {
+    const res = await fetch(url, { redirect: "manual", signal: AbortSignal.timeout(5000) });
+    return { up: true, status: res.status };
+  } catch {
+    return { up: false };
+  }
+}
+
+export async function urls() {
+  const root = findUniverseRoot();
+  if (!root) {
+    console.log(`\n  ${red("✗")} no .env.production found here or above — run this inside a universe folder`);
+    console.log(`  ${dim("(a universe is deployed from its checkout: terraform apply renders .env.production)")}\n`);
+    process.exit(1);
+  }
+
+  const env = parseEnv(join(root, ".env.production"));
+  const tf = terraformOutputs(root);
+  const domain = env.DOMAIN || "";
+
+  // The same law as the ground: DOMAIN drives HTTPS URLs; without it, the
+  // explicit API_URL (rendered by terraform) carries the LB address.
+  const apiBase = domain ? `https://api.${domain}` : env.API_URL || tf.api_url || "";
+  const candidates = [];
+  if (apiBase) {
+    candidates.push({ label: "API", url: apiBase, note: "MCP at /mcp" });
+    candidates.push({ label: "Health", url: `${apiBase}/health` });
+  }
+  const canvas = tf.canvas_url && tf.canvas_url.startsWith("http") ? tf.canvas_url : null;
+  if (canvas) candidates.push({ label: "Canvas", url: canvas, note: "add to IdP origins" });
+  if (env.DEPLOY_HOST) candidates.push({ label: "Dozzle", url: `http://${env.DEPLOY_HOST}:8080`, note: "logs, admin IP only" });
+  if (tf.cognito_hosted_ui) candidates.push({ label: "Login", url: tf.cognito_hosted_ui });
+
+  if (!candidates.length) {
+    console.log(`\n  ${red("✗")} .env.production has neither DOMAIN nor API_URL — re-render it from the ground:`);
+    console.log(`  ${dim("cd infra/<ground> && terraform output -raw env_production > ../../.env.production")}\n`);
+    process.exit(1);
+  }
+
+  const results = await Promise.all(candidates.map(async (c) => ({ ...c, ...(await probe(c.url)) })));
+
+  const labelWidth = Math.max(...results.map((r) => r.label.length));
+  const urlWidth = Math.max(...results.map((r) => r.url.length));
+  const upCount = results.filter((r) => r.up).length;
+  const rule = dim("─".repeat(Math.min(70, urlWidth + labelWidth + 12)));
+  const mark = (r) => (r.up ? green("●") : red("✗"));
+
+  console.log("");
+  console.log(`  ${rule}`);
+  console.log(`  ${upCount === results.length ? green("●") : red("●")} ${bold("universe")}   ${dim(`${upCount} of ${results.length} answering${domain ? "" : "  ·  domainless (plain HTTP) — set domain in terraform.tfvars to upgrade"}`)}`);
+  console.log("");
+  for (const r of results) {
+    const status = r.up ? dim(`${r.status}`) : red("no answer");
+    console.log(`  ${mark(r)} ${dim(r.label.padEnd(labelWidth))}   ${cyan(r.url.padEnd(urlWidth))}   ${status}${r.note ? `  ${dim(r.note)}` : ""}`);
+  }
+  console.log(`  ${rule}`);
+  console.log("");
+  if (upCount < results.length) process.exit(1);
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "unoverse",
-  "version": "0.1.1",
-  "description": "The Unoverse front door \u2014 create a Studio project, a universe, or a client app, and launch Studio.",
+  "version": "0.1.3",
+  "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",
   "bin": {
@@ -20,4 +20,4 @@
     "type": "git",
     "url": "git+https://github.com/unoverse-platform/unoverse.git"
   }
-}
+}