unoverse 0.1.37 → 0.1.39

package/lib/create.mjs

@@ -33,38 +33,44 @@ async function ask(rl, q) {
  * credential gets refused, so detect it and pass it through untouched. */
 /** The raw dop_v1 token, whichever shape was pasted. docker login needs the raw form,
  * so the base64 user:token blob is decoded before anything downstream sees it. */
-function rawToken(input) {
-  // Whatever shape arrives, the dop_v1 token inside comes out:
-  //  - the raw token
-  //  - base64("token:token")            (API-token docker auth)
-  //  - base64(":token")                 (DO's READ-ONLY credential: EMPTY username —
-  //    the shape the downloaded Docker Credentials file actually carries, and the one
-  //    a required-username decoder silently passed through, so docker was handed the
-  //    whole blob as a username and answered "unauthorized")
-  //  - the whole credentials JSON pasted as-is
-  const token = input.trim().replace(/^["']|["']$/g, "");
-  const inline = /dop_v1_[0-9a-f]{64}/.exec(token);
-  if (inline) return inline[0];
-  if (/^[A-Za-z0-9+/]+=*$/.test(token)) {
-    const decoded = Buffer.from(token, "base64").toString("utf8");
-    const m = /^([\x20-\x7e]*):([\x20-\x7e]+)$/.exec(decoded);
-    if (m) return m[1] || m[2];
+/** The credential AS A PAIR. The downloaded Docker credentials file carries
+ * base64("email:token") — the username is the ACCOUNT EMAIL, and logging in with the
+ * token as username (right for API tokens) gets "unauthorized" for it. So nothing here
+ * reduces to a bare token any more: whatever shape is pasted, the exact user:password
+ * pair comes out and is used verbatim.
+ *   raw dop_v1            → token:token
+ *   base64("u:p")         → u:p          (email:token, or :token → token:token)
+ *   the whole JSON file   → its auth value, decoded the same way
+ */
+function parseCredential(input) {
+  const t = input.trim().replace(/^["']|["']$/g, "");
+  const pair = (d) => {
+    const m = /^([\x20-\x7e]*):([\x20-\x7e]+)$/.exec(d);
+    return m ? { user: m[1] || m[2], pass: m[2] } : null;
+  };
+  const auth = /"auth"\s*:\s*"([A-Za-z0-9+/=]+)"/.exec(t);
+  if (auth) {
+    const p = pair(Buffer.from(auth[1], "base64").toString("utf8"));
+    if (p) return p;
+  }
+  if (/^[A-Za-z0-9+/]+=*$/.test(t)) {
+    const p = pair(Buffer.from(t, "base64").toString("utf8"));
+    if (p) return p;
   }
-  return token;
+  const inline = /dop_v1_[0-9a-f]{64}/.exec(t);
+  if (inline) return { user: inline[0], pass: inline[0] };
+  return { user: t, pass: t };
 }
 
-function registryAuth(token) {
-  if (/^[A-Za-z0-9+/]+=*$/.test(token)) {
-    const decoded = Buffer.from(token, "base64").toString("utf8");
-    if (/^[\x20-\x7e]+:[\x20-\x7e]+$/.test(decoded)) return token;
-  }
-  return Buffer.from(`${token}:${token}`).toString("base64");
+
+function registryAuth(cred) {
+  return Buffer.from(`${cred.user}:${cred.pass}`).toString("base64");
 }
 
 /** The gate: prove the token opens the registry before handing over the kit.
  * Docker registries use the bearer-realm flow: /v2/ answers 401 and names the
  * auth realm; presenting the token there yields 200 (valid) or 401 (refused). */
-async function validateRegistryToken(token) {
+async function validateRegistryToken(cred) {
   try {
     const probe = await fetch(`https://${REGISTRY_HOST}/v2/`);
     const wa = probe.headers.get("www-authenticate") ?? "";
@@ -73,7 +79,7 @@ async function validateRegistryToken(token) {
     if (!realm) return probe.status === 200;
     const res = await fetch(
       `${realm}?service=${encodeURIComponent(service)}&scope=registry:catalog:*`,
-      { headers: { Authorization: `Basic ${registryAuth(token)}` } },
+      { headers: { Authorization: `Basic ${registryAuth(cred)}` } },
     );
     return res.ok;
   } catch {
@@ -124,9 +130,9 @@ function dockerUp() {
  * the same credential two minutes later — the tool approving a token with a weaker
  * check than the one that counts. When Docker is up, validation IS docker login (and
  * the credential lands in the keychain, so nothing downstream logs in again). */
-function dockerLogin(token) {
-  const r = spawnSync("docker", ["login", REGISTRY_HOST, "-u", token, "--password-stdin"], {
-    input: token,
+function dockerLogin(cred) {
+  const r = spawnSync("docker", ["login", REGISTRY_HOST, "-u", cred.user, "--password-stdin"], {
+    input: cred.pass,
     encoding: "utf8",
   });
   const err = (r.stderr || "").split("\n").filter((l) => l && !/^WARNING/i.test(l)).pop() || "";
@@ -282,8 +288,8 @@ export async function create(nameArg) {
       // A refused token re-asks RIGHT HERE. Being thrown out of the wizard to run
       // create again is its own bug.
       for (;;) {
-        token = rawToken(await ask(rl, "Registry access token: "));
-        if (!token) {
+        token = parseCredential(await ask(rl, "Registry access token: "));
+        if (!token.pass) {
           fail("no token. The universe kit is available to licensed operators");
           process.exit(1);
         }
@@ -332,7 +338,7 @@ export async function create(nameArg) {
       const r = spawnSync("bash", [operatorScript, "init"], {
         stdio: "inherit",
         cwd: name,
-        env: { ...process.env, UNOVERSE_DOCR_TOKEN: rawToken(token) },
+        env: { ...process.env, UNOVERSE_DOCR_TOKEN: token.pass, UNOVERSE_DOCR_USER: token.user },
       });
       if (r.status !== 0) {
         fail(`setup did not finish. Run 'unoverse start'${name === "." ? "" : ` in ./${name}`} to pick it back up`);

package/operator/lib/db-setup.sh

@@ -34,11 +34,16 @@ cmd_db_setup() {
     echo ""
     echo "  Running migrations (local dev)..."
 
+    # --no-check-order: databases from before the 2026-07-28 squash have
+    # 002-018 recorded in pgmigrations with no matching files (they live inside
+    # 001_baseline now), which trips the order check on ANY new migration.
+    # Ordering still holds by filename; applied names are never re-run.
     NODE_TLS_REJECT_UNAUTHORIZED=0 DATABASE_URL="$db_url" \
       npx node-pg-migrate up \
         --migrations-dir "$ROOT/apps/unoverse/engine/migrations" \
         --migration-file-language sql \
         --no-lock \
+        --no-check-order \
         2>&1 | sed 's/^/  /' || {
       fail "Migrations failed"
       exit 1
@@ -73,6 +78,7 @@ cmd_db_setup() {
         --migrations-dir /app/apps/unoverse/engine/migrations \
         --migration-file-language sql \
         --no-lock \
+        --no-check-order \
         2>&1 | sed 's/^/  /' || {
       fail "Migrations failed"
       exit 1

package/operator/lib/init.sh

@@ -140,10 +140,12 @@ cmd_init() {
   # twice minutes apart. Typed here only when init is run on its own.
   if [ -n "${UNOVERSE_DOCR_TOKEN:-}" ]; then
     DOCR_TOKEN="$UNOVERSE_DOCR_TOKEN"
+    DOCR_USER="${UNOVERSE_DOCR_USER:-$UNOVERSE_DOCR_TOKEN}"
     ok "Registry token carried over from create"
   else
     local cur_token
     cur_token=$(_env_cur DOCR_TOKEN)
+    DOCR_USER=$(_env_cur DOCR_USER)
     while true; do
       if [ -n "$cur_token" ]; then
         read -p "  DOCR Token [keep current]: " DOCR_TOKEN || { fail "no input (end of stream). Run unoverse init interactively"; exit 1; }
@@ -151,14 +153,19 @@ cmd_init() {
       else
         read -p "  DOCR Token (from your Unoverse admin): " DOCR_TOKEN || { fail "no input (end of stream). Run unoverse init interactively"; exit 1; }
       fi
-      # Accept the credential in any shape: raw dop_v1, or the base64 blob from DO's
-      # downloaded Docker credentials (which does NOT start with dop_v1 — it wraps the
-      # token behind an empty username). Extract rather than lecture about the format.
+      # Accept the credential in any shape, AS A PAIR. The downloaded Docker
+      # credentials wrap base64("email:token") — the username is the email, and
+      # logging in token-as-username gets "unauthorized" for exactly that shape.
+      DOCR_USER=""
       if [[ "$DOCR_TOKEN" != dop_v1_* ]]; then
         local decoded
-        decoded=$(printf '%s' "$DOCR_TOKEN" | base64 -d 2>/dev/null | tr -d '\0')
-        case "$decoded" in *dop_v1_*) DOCR_TOKEN="dop_v1_${decoded##*dop_v1_}";; esac
+        decoded=$(printf '%s' "$DOCR_TOKEN" | sed -E 's/.*"auth"[^"]*"([A-Za-z0-9+\/=]+)".*/\1/' | base64 -d 2>/dev/null | tr -d '\0')
+        [ -n "$decoded" ] || decoded=$(printf '%s' "$DOCR_TOKEN" | base64 -d 2>/dev/null | tr -d '\0')
+        case "$decoded" in
+          *:dop_v1_*) DOCR_USER="${decoded%%:*}"; DOCR_TOKEN="dop_v1_${decoded##*dop_v1_}";;
+        esac
       fi
+      DOCR_USER="${DOCR_USER:-$DOCR_TOKEN}"
       if [[ "$DOCR_TOKEN" == dop_v1_* ]]; then
         break
       fi
@@ -169,7 +176,7 @@ cmd_init() {
   # THE DOWNLOAD STARTS NOW (see the block at the top of this file).
   if [ "$DOCKER_OK" = "1" ]; then
     local login_err
-    if login_err=$(echo "$DOCR_TOKEN" | docker login "$DOCR_REGISTRY" -u "$DOCR_TOKEN" --password-stdin 2>&1 >/dev/null); then
+    if login_err=$(echo "$DOCR_TOKEN" | docker login "$DOCR_REGISTRY" -u "${DOCR_USER:-$DOCR_TOKEN}" --password-stdin 2>&1 >/dev/null); then
       start_background_pull
       echo ""
       echo -e "  ${CYAN}⬇${NC} ${DIM}Platform images are downloading in the background while you configure${NC}"
@@ -343,10 +350,23 @@ cmd_init() {
     read -p "  SEARCHAPI_KEY (web-search nodes, blank to skip): " SEARCHAPI_KEY
   fi
 
+  # Silent facts, not questions. The encryption key is GENERATED (a human never types
+  # one), kept on re-runs (a new key orphans every stored credential), and the pool
+  # sizes are present-but-empty purely so compose stops warning about them.
+  CREDENTIAL_ENCRYPTION_KEY=$(_env_cur CREDENTIAL_ENCRYPTION_KEY)
+  if [ -z "$CREDENTIAL_ENCRYPTION_KEY" ]; then
+    CREDENTIAL_ENCRYPTION_KEY=$(openssl rand -hex 32 2>/dev/null || head -c32 /dev/urandom | xxd -p -c64)
+    ok "Credential encryption key generated"
+  fi
+  DB_POOL_ENGINE=$(_env_cur DB_POOL_ENGINE)
+  DB_POOL_ENGINE_LEGACY=$(_env_cur DB_POOL_ENGINE_LEGACY)
+  DB_POOL_MEMORY=$(_env_cur DB_POOL_MEMORY)
+
   # Write .env
   cat > "$ROOT/.env" << ENVEOF
 # Generated by unoverse init
 DOCR_TOKEN=${DOCR_TOKEN}
+DOCR_USER=${DOCR_USER:-${DOCR_TOKEN}}
 DATABASE_URL=${DATABASE_URL}
 REDIS_HOST=${REDIS_HOST}
 REDIS_PORT=${REDIS_PORT}
@@ -359,6 +379,13 @@ AUTH_CLIENT_ID=${AUTH_CLIENT_ID}
 AUTH_AUDIENCE=${AUTH_AUDIENCE}
 API_URL=${API_URL}
 OPENAI_API_KEY=${OPENAI_API_KEY}
+# Generated at setup: encrypts credentials stored by nodes. Losing it orphans them —
+# back it up with the database. Kept on re-runs.
+CREDENTIAL_ENCRYPTION_KEY=${CREDENTIAL_ENCRYPTION_KEY}
+# Present-but-empty so compose does not warn; the platform applies its own defaults.
+DB_POOL_ENGINE=${DB_POOL_ENGINE}
+DB_POOL_ENGINE_LEGACY=${DB_POOL_ENGINE_LEGACY}
+DB_POOL_MEMORY=${DB_POOL_MEMORY}
 HYPERBROWSER_API_KEY=${HYPERBROWSER_API_KEY}
 SEARCHAPI_KEY=${SEARCHAPI_KEY}
 DOMAIN=

package/operator/lib/start.sh

@@ -55,8 +55,10 @@ cmd_start() {
   # Login to registry if DOCR_TOKEN is set
   local docr_token
   docr_token=$(grep "^DOCR_TOKEN=" "$ROOT/.env" 2>/dev/null | cut -d'=' -f2-)
+  local docr_user
+  docr_user=$(grep "^DOCR_USER=" "$ROOT/.env" 2>/dev/null | cut -d'=' -f2-)
   if [ -n "$docr_token" ]; then
-    echo "$docr_token" | docker login registry.digitalocean.com -u "$docr_token" --password-stdin >/dev/null 2>&1 || true
+    echo "$docr_token" | docker login registry.digitalocean.com -u "${docr_user:-$docr_token}" --password-stdin >/dev/null 2>&1 || true
   fi
 
   # `start --pull` refreshes the images first. This is where refreshing a LOCAL universe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.37",
+  "version": "0.1.39",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",