unoverse 0.1.129 → 0.1.131

package/operator/docker-compose.yml

@@ -111,7 +111,17 @@ services:
       # SAME :4105 backend as api.<domain>, so default to the api host (one public entry,
       # one cert, no extra DNS). UNOVERSE_URL can still override for a dedicated MCP host.
       - VITE_UNOVERSE_SERVICE_URL=${UNOVERSE_URL:-${DOMAIN:+https://api.${DOMAIN:-}}}
-      - MEMORY_SERVICE_URL=http://memory:4114
+      # THE BROWSER'S MEMORY UPSTREAM, AND IT IS THE PUBLIC JWT LANE (:4104). Its own
+      # variable, because `MEMORY_SERVICE_URL` means the opposite thing to a server-to-
+      # server caller: the engine uses that name for the TOKENLESS platform lane (:4114),
+      # and the canvas entrypoint was reading the same name for its nginx upstream. The
+      # dashboard therefore proxied the browser at :4114, whose /api/* routes do not
+      # exist — every memory page call 404'd on every deployed universe.
+      #
+      # The 404 was the lucky part. The platform lane asserts identity instead of proving
+      # it, so a browser reaching it would read and write ANY user's memory with no token.
+      # A browser must only ever reach :4104, which authenticates every request.
+      - MEMORY_PUBLIC_URL=http://memory:4104
     depends_on:
       - unoverse
     logging: *default-logging

package/operator/lib/deploy.sh

@@ -103,7 +103,15 @@ NODE
 # database.
 cmd_db_allow() {
   local cloud
-  SELF_CMD="unoverse db-allow" cloud=$(_pick_ground "${1:-}") || {
+  # DIGITALOCEAN ONLY, and it is not an oversight. This joins a MANAGED DATABASE's
+  # trusted-source list through the DO API, and AWS has no equivalent to join: RDS
+  # reachability is a VPC security group, owned by Terraform and changed by `deploy`, not by
+  # a developer's laptop asking an API at runtime. Offering `db-allow aws` produced a
+  # ground-picker prompt for a cloud that would then have done nothing.
+  SELF_CMD="unoverse db-allow" \
+  GROUNDS_ONLY="digitalocean" \
+  GROUNDS_ONLY_WHY="On AWS the database is reached through its VPC security group, which the ground owns — change it in infra/aws and run ${BOLD}unoverse deploy aws${NC}." \
+  cloud=$(_pick_ground "${1:-}") || {
     [ -z "${1:-}" ] && [ ! -d "$ROOT/infra" ] && fail "No ground here. There is no database to reach"
     return 1
   }
@@ -117,8 +125,13 @@ cmd_db_allow() {
   # this could not help. A cluster host is `<name>-do-user-...`, so the name is right there
   # in DATABASE_URL.
   if [ -z "$cluster" ]; then
+    # `-n` + `p`: print ONLY when the substitution matched. The portable way to say "extract
+    # or nothing". This was `s|…|\1|; t; d`, which is GNU: BSD sed reads everything after `t`
+    # as a LABEL, so on macOS it died with `undefined label '; d'`, printed nothing, and the
+    # command then reported "this database has no trusted-source list" — a real cluster
+    # reported as an open one, on the platform's own machine.
     cluster=$(grep -E '^DATABASE_URL=' "$ROOT/.env" 2>/dev/null | head -1 \
-      | sed -E 's|.*@([a-z0-9-]+)-do-user-[^.]*\..*|\1|; t; d')
+      | sed -nE 's|.*@([a-z0-9-]+)-do-user-[^.]*\..*|\1|p')
   fi
 
   if [ -z "$cluster" ]; then
@@ -205,11 +218,23 @@ _pick_ground() {
     *) fail "Unknown ground '$want'. Use ${BOLD}digitalocean${NC} or ${BOLD}aws${NC}" >&2; return 1 ;;
   esac
 
+  # A command may not apply to every cloud. `GROUNDS_ONLY` names the ones it does, so a
+  # ground that cannot answer is never offered as a choice and never named in the
+  # "say which" prompt. Unset means all of them, which is every other caller.
   local configured=()
   for g in digitalocean aws; do
-    [ -f "$ROOT/infra/$g/terraform.tfvars" ] && configured+=("$g")
+    [ -f "$ROOT/infra/$g/terraform.tfvars" ] || continue
+    if [ -n "${GROUNDS_ONLY:-}" ] && [[ " ${GROUNDS_ONLY} " != *" $g "* ]]; then continue; fi
+    configured+=("$g")
   done
 
+  # Asked for a ground this command cannot serve: say so plainly rather than "no such
+  # ground here", which sends someone off to create one that would not have helped.
+  if [ -n "$want" ] && [ -n "${GROUNDS_ONLY:-}" ] && [[ " ${GROUNDS_ONLY} " != *" $want "* ]]; then
+    fail "${SELF_CMD:-This command} does not apply to $want. ${GROUNDS_ONLY_WHY:-}" >&2
+    return 1
+  fi
+
   if [ -n "$want" ]; then
     for g in "${configured[@]}"; do
       [ "$g" = "$want" ] && { printf '%s' "$want"; return 0; }
@@ -224,7 +249,9 @@ _pick_ground() {
     *)
       # Two grounds and no name. Refuse rather than pick: this decides which cloud a
       # destroy lands on.
-      fail "Two grounds are configured. Say which: ${BOLD}${SELF_CMD:-unoverse deploy} digitalocean${NC} or ${BOLD}${SELF_CMD:-unoverse deploy} aws${NC}" >&2
+      # Names the grounds THIS command can actually serve, not both clouds unconditionally:
+      # offering a choice that would be refused is worse than not offering it.
+      fail "Two grounds are configured. Say which: ${BOLD}${SELF_CMD:-unoverse deploy} ${configured[0]}${NC} or ${BOLD}${SELF_CMD:-unoverse deploy} ${configured[1]}${NC}" >&2
       return 1
       ;;
   esac

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.129",
+  "version": "0.1.131",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",