unoverse 0.1.140 → 0.1.142

package/lib/create/download.mjs

@@ -7,11 +7,16 @@ import { spawnSync } from "node:child_process";
 export const STARTER_TARBALL =
   "https://codeload.github.com/unoverse-platform/starter/tar.gz/refs/heads/main";
 
-export function download(dir, stripComponents = 1, filter = "") {
+// The CLIENT STARTER has its own public repo. It used to be a folder inside the starter,
+// which meant handing someone the whole operator kit to give them one web page.
+export const CLIENT_TARBALL =
+  "https://codeload.github.com/unoverse-platform/client/tar.gz/refs/heads/main";
+
+export function download(dir, stripComponents = 1, filter = "", tarball = STARTER_TARBALL) {
   mkdirSync(dir, { recursive: true });
   const r = spawnSync(
     "sh",
-    ["-c", `curl -fsSL '${STARTER_TARBALL}' | tar -xz --strip-components=${stripComponents} -C '${dir}' ${filter}`],
+    ["-c", `curl -fsSL '${tarball}' | tar -xz --strip-components=${stripComponents} -C '${dir}' ${filter}`],
     { stdio: ["ignore", "inherit", "inherit"] },
   );
   if (r.status !== 0) throw new Error("download failed");

package/lib/create/index.mjs

@@ -15,7 +15,7 @@ import { spawnSync } from "node:child_process";
 import { cyan, dim, ok, fail, ask, select } from "../ui.mjs";
 import { parseCredential, validateRegistryToken, dockerUp, dockerLogin } from "./credential.mjs";
 import { resolveTarget, label } from "./target.mjs";
-import { download } from "./download.mjs";
+import { download, CLIENT_TARBALL } from "./download.mjs";
 
 export async function create(nameArg) {
   console.log(`\n  ${cyan("⬡ What are you building?")}\n`);
@@ -137,10 +137,21 @@ export async function create(nameArg) {
 
     if (choice === "3") {
       const name = resolveTarget(nameArg);
-      // The reference client ships inside the starter — take just that folder.
-      download(name, 3, "'*/packages/client'");
-      ok(`client app scaffolded in ${label(name)}`);
-      console.log(`\n  Next:${name === "." ? "" : `\n    cd ${name}`}\n    npm install && npm run dev\n\n  ${cyan("Build with Claude:")} open this folder in Claude Code and describe what you want, in plain words.\n`);
+      // Its own public repo, so the whole tree IS the project: one strip level, no filter.
+      download(name, 1, "", CLIENT_TARBALL);
+      ok(`client scaffolded in ${label(name)}`);
+      console.log(`
+  Next:${name === "." ? "" : `
+    cd ${name}`}
+    npm install
+    cp .env.example .env      ${dim("# your universe, and which app to load")}
+    npm run dev
+
+  The README documents every option: the script tag's attributes, how to hand it
+  your login, and how to open it from your own buttons.
+
+  ${cyan("Docs:")} https://docs.unoverse.ai
+`);
       return;
     }
 

package/operator/.env.example

@@ -0,0 +1,69 @@
+# =============================================================================
+# THE UNIVERSE — LOCAL DEV
+# =============================================================================
+# cp .env.example .env — set DATABASE_URL, OPENAI_API_KEY, and your OIDC
+# values (or AUTH_ENABLED=false to skip login locally). That's it.
+# (Production is Terraform's job — see infra/*/terraform.tfvars.example.)
+
+# ── Local development ────────────────────────────────────────────────────────
+# THESE TWO GO TOGETHER. Auth is always on by default, and turning it off is
+# refused when the environment claims to be production — so setting only
+# AUTH_ENABLED=false leaves the platform correctly refusing to start, with the
+# two settings contradicting each other and no way out. A deployed universe sets
+# neither: unset means production with auth on, and Terraform never renders them.
+NODE_ENV=development
+AUTH_ENABLED=false
+
+# Postgres. A managed URL works as-is; a Postgres running on YOUR MAC needs
+# host.docker.internal for the same reason as Redis below — the platform runs in containers,
+# and localhost inside one means that container.
+DATABASE_URL=postgres://user:password@host.docker.internal:5432/unoverse
+
+# Local Redis. `unoverse start` launches one for you if none is running.
+#
+# host.docker.internal, NOT 127.0.0.1: the platform runs in containers, and inside a
+# container 127.0.0.1 means THAT CONTAINER. Redis runs on your Mac with a published port, so
+# this is the address that reaches it. The sample said 127.0.0.1 and every fresh universe
+# hit the same wall — unoverse died on boot with MaxRetriesPerRequestError while memory,
+# which tolerates a dead Redis, stayed up and made it look like something subtler.
+REDIS_HOST=host.docker.internal
+REDIS_PORT=6379
+REDIS_PASSWORD=
+REDIS_TLS=false
+REDIS_NAMESPACE=gravity
+
+# Memory server + OpenAI nodes
+OPENAI_API_KEY=sk-your-key-here
+
+# REQUIRED: pulls the platform images. Without it the platform cannot start.
+# (Only platform-source developers building images locally can leave it empty.)
+DOCR_TOKEN=
+
+# Page intelligence (promote-page extraction)
+HYPERBROWSER_API_KEY=
+
+# Marketplace catalogue to install from (docs/architecture/MARKETPLACE.md).
+# Empty = local items only. No default: a URL is never hardcoded.
+UNOVERSE_MARKETPLACE_URL=
+
+# REQUIRED. The master key encrypting every credential saved in the database. There is
+# no default and no fallback: the server refuses to start without it. A default would be
+# a key published in the source, which is what this used to be, and encryption at rest
+# under a key everyone has is evidence of nothing.
+#
+# Generate:  openssl rand -base64 32          (at least 32 characters)
+# BACK IT UP with your database. Lose it and every stored credential is unreadable, and
+# no backup can bring them back. `unoverse create` generates one for you.
+#
+# CHANGING IT ORPHANS EXISTING CREDENTIALS. Pointing a fresh .env at a database that
+# already holds credentials fails with OpenSSL "bad decrypt" on every one of them: copy
+# the original key across rather than generating a new one.
+CREDENTIAL_ENCRYPTION_KEY=
+
+# Auth is ON by default (missing flag = enabled), same as production.
+AUTH_ISSUER=https://your-tenant.auth0.com
+AUTH_CLIENT_ID=your-client-id
+AUTH_AUDIENCE=gravity-api
+
+# Quick no-login mode (local only — production refuses to start with it):
+# AUTH_ENABLED=false

package/operator/lib/db-verify.sh

@@ -96,7 +96,18 @@ cmd_db_verify() {
       dictionary_clusters: [
         "cluster_id", "workflow_id", "parent_id", "depth", "name", "description",
         "name_embedding", "medoid_id", "terms", "member_count", "umap_x", "umap_y",
-        "umap_z", "radius", "created_at", "updated_at"
+        "umap_z", "radius", "created_at", "updated_at",
+        "region_id", "carried_overlap", "derived_from", "name_locked", "locked_at",
+        "locked_by", "member_ids"
+      ],
+      user_region_events: [
+        "id", "workflow_id", "user_id", "region_id", "region_name", "stage",
+        "source", "evidence", "occurred_at"
+      ],
+      dictionary_regions: [
+        "region_id", "workflow_id", "depth", "name", "description", "name_locked",
+        "locked_at", "locked_by", "stage", "stage_set_by", "needs_review",
+        "derived_from", "first_seen", "last_seen", "closed_at"
       ],
       dictionary_content_chunks: [
         "chunk_id", "text", "source_url", "source_type", "metadata",

package/operator/operator.sh

@@ -116,6 +116,21 @@ case "${1:-}" in
         fi
       fi
 
+      # .env.example UPDATES LIKE THE COMPOSE FILE, and for the same reason: it is the
+      # reference a developer reads when they add a setting by hand, and it was written once
+      # at creation and never again. It went stale the moment CREDENTIAL_ENCRYPTION_KEY
+      # became required — an old copy still describes it as optional with a built-in default,
+      # which is now the shape that refuses to boot.
+      #
+      # THE EXAMPLE ONLY. Their .env is never touched by anything here.
+      _vexample="$GRAVITY_LIB/../.env.example"
+      if [ -f "$_vexample" ] && [ -f "$ROOT/.env.example" ]; then
+        if ! cmp -s "$_vexample" "$ROOT/.env.example"; then
+          cp "$_vexample" "$ROOT/.env.example"
+          ok "Refreshed .env.example ${DIM}(your .env is untouched)${NC}"
+        fi
+      fi
+
       _vinfra="$GRAVITY_LIB/../infra"
       if [ -d "$_vinfra" ]; then
         for _g in digitalocean aws; do

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.140",
+  "version": "0.1.142",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",