unoverse 0.1.69 → 0.1.71

package/operator/infra/aws/outputs.tf

@@ -0,0 +1,139 @@
+# Everything .env.production needs — the rendered file is COMPLETE, nothing
+# is hand-edited afterwards:
+#   terraform output -raw env_production > ../../.env.production
+#   unoverse deploy && unoverse deploy db && unoverse deploy test
+
+output "deploy_host" {
+  description = ".env.production DEPLOY_HOST (SSH target). Public traffic goes to the ALB, never here."
+  value       = aws_eip.app.public_ip
+}
+
+output "alb_dns_name" {
+  description = "Point api.<domain> (and unoverse.<domain> when canvas_public) at this — CNAME/ALIAS. Created automatically when route53_zone_id is set."
+  value       = aws_lb.public.dns_name
+}
+
+output "acm_validation_records" {
+  description = "External DNS only (domain set, route53_zone_id empty): create these CNAMEs so the certificate can issue."
+  value = (local.has_domain && !local.dns_auto) ? [
+    for dvo in aws_acm_certificate.public[0].domain_validation_options : {
+      name = dvo.resource_record_name, type = dvo.resource_record_type, value = dvo.resource_record_value
+    }
+  ] : []
+}
+
+output "canvas_url" {
+  description = "Public Canvas URL (canvas_public = true only) — add it to the client origins."
+  value       = var.canvas_public ? (local.has_domain ? "https://unoverse.${var.domain}" : "http://${aws_lb.public.dns_name}:3001") : "canvas is admin-only (direct http://<instance-ip>:3001 from admin_cidr)"
+}
+
+output "api_url" {
+  description = "The API base URL as deployed — https://api.<domain> with a domain, http://<alb-dns> without one."
+  value       = local.has_domain ? "https://${local.api_host}" : "http://${aws_lb.public.dns_name}"
+}
+
+output "database_url" {
+  description = ".env.production DATABASE_URL (sslmode=require: RDS enforces TLS by default on PG16 — rds.force_ssl=1 — so the client must ask for it)"
+  value       = "postgresql://${aws_db_instance.postgres.username}:${random_password.db.result}@${aws_db_instance.postgres.address}:5432/${aws_db_instance.postgres.db_name}?sslmode=require"
+  sensitive   = true
+}
+
+output "redis_host" {
+  description = ".env.production REDIS_HOST (REDIS_PORT=6379, REDIS_TLS=true)"
+  value       = aws_elasticache_replication_group.redis.primary_endpoint_address
+}
+
+output "redis_password" {
+  description = ".env.production REDIS_PASSWORD"
+  value       = random_password.redis.result
+  sensitive   = true
+}
+
+output "auth_issuer" {
+  description = ".env.production AUTH_ISSUER (the Cognito user pool issuer)"
+  value       = "https://cognito-idp.${var.region}.amazonaws.com/${aws_cognito_user_pool.pool.id}"
+}
+
+output "auth_client_id" {
+  description = ".env.production AUTH_CLIENT_ID — and the AUTH_AUDIENCE candidate: Cognito access tokens carry client_id, not aud. SMOKE-TEST audience validation with a real token before declaring the universe up (AWS_DEPLOYMENT.md)."
+  value       = aws_cognito_user_pool_client.spa.id
+}
+
+output "roles" {
+  description = "Every RBAC role provisioned as a Cognito group (platform permissions + var.roles)"
+  value       = sort(keys(aws_cognito_user_group.roles))
+}
+
+output "cognito_hosted_ui" {
+  description = "Hosted login domain (Managed Login)"
+  value       = "https://${aws_cognito_user_pool_domain.domain.domain}.auth.${var.region}.amazoncognito.com"
+}
+
+output "bedrock_access_key_id" {
+  description = "Store as a platform awsCredential (accessKeyId) for the Bedrock/Nova nodes"
+  value       = aws_iam_access_key.bedrock.id
+}
+
+output "bedrock_secret_access_key" {
+  description = "Store as a platform awsCredential (secretAccessKey)"
+  value       = aws_iam_access_key.bedrock.secret
+  sensitive   = true
+}
+
+# ── The whole .env.production, rendered COMPLETE ──────────────────────────────
+output "env_production" {
+  sensitive   = true
+  description = "Rendered .env.production — complete, write to a file and deploy"
+  value       = <<-ENV
+    # UNIVERSE (AWS) — generated by infra/aws. COMPLETE:
+    # do not hand-edit; change terraform.tfvars and re-render instead.
+
+    # Deploy target (SSH; public traffic goes through the ALB)
+    DEPLOY_HOST=${aws_eip.app.public_ip}
+    DEPLOY_USER=ubuntu
+
+    # Container registry
+    DOCR_TOKEN=${var.docr_token}
+
+    # Database (RDS enforces TLS on PG16 — sslmode stays). AWS runs DIRECT (no
+    # pooler until `large` per the Postgres law): both URLs are the same server.
+    DATABASE_URL=postgresql://${aws_db_instance.postgres.username}:${random_password.db.result}@${aws_db_instance.postgres.address}:5432/${aws_db_instance.postgres.db_name}?sslmode=require
+    DATABASE_URL_DIRECT=postgresql://${aws_db_instance.postgres.username}:${random_password.db.result}@${aws_db_instance.postgres.address}:5432/${aws_db_instance.postgres.db_name}?sslmode=require
+
+    # Connection budget (INFRASTRUCTURE.md, size = ${var.size})
+    DB_POOL_ENGINE=${local.s.pool_engine}
+    DB_POOL_ENGINE_LEGACY=${local.s.pool_legacy}
+    DB_POOL_MEMORY=${local.s.pool_memory}
+
+    # Credential encryption at rest — per-deployment, generated by Terraform.
+    # Back this up with the database (a DB backup is unreadable without it).
+    CREDENTIAL_ENCRYPTION_KEY=${random_password.credential_key.result}
+
+    # Redis (ElastiCache, TLS + auth token)
+    REDIS_HOST=${aws_elasticache_replication_group.redis.primary_endpoint_address}
+    REDIS_PORT=6379
+    REDIS_PASSWORD=${random_password.redis.result}
+    REDIS_TLS=true
+    REDIS_NAMESPACE=universe
+
+    # OIDC (Cognito). AUTH_AUDIENCE = the app client id — Cognito access tokens
+    # carry client_id, not aud; SMOKE-TEST with a real token (AWS_DEPLOYMENT.md).
+    AUTH_ISSUER=https://cognito-idp.${var.region}.amazonaws.com/${aws_cognito_user_pool.pool.id}
+    AUTH_CLIENT_ID=${aws_cognito_user_pool_client.spa.id}
+    AUTH_AUDIENCE=${aws_cognito_user_pool_client.spa.id}
+
+    # Service keys
+    OPENAI_API_KEY=${var.openai_api_key}
+    HYPERBROWSER_API_KEY=${var.hyperbrowser_api_key}
+
+    # Ingress. With a domain: DOMAIN drives every URL (compose derives
+    # https://api.<domain>). Without one (POC): DOMAIN stays empty and the
+    # explicit URLs below point at the ALB's DNS name over plain HTTP.
+    # To upgrade later: set domain in terraform.tfvars, terraform apply,
+    # re-render this file, unoverse deploy. Nothing is destroyed.
+    DOMAIN=${var.domain}
+    ${local.has_domain ? "" : "API_URL=http://${aws_lb.public.dns_name}"}
+    ${local.has_domain ? "" : "VITE_SERVER_WS_URL=ws://${aws_lb.public.dns_name}"}
+    ${local.has_domain ? "" : "UNOVERSE_URL=http://${aws_lb.public.dns_name}"}
+  ENV
+}

package/operator/infra/aws/pretoken/index.mjs

@@ -0,0 +1,37 @@
+/**
+ * Cognito Pre Token Generation (V2_0) — the platform's token contract.
+ *
+ * LOAD-BEARING. The platform reads sub/email/roles (and permissions) off the
+ * ACCESS token and never calls back to the IdP (docs/AUTH_TOKEN_FLOW.md). Without
+ * this Lambda, email-keyed features silently no-op and no role-gated surface
+ * (workflow:author builder, marketplace:publish publish, requires.role nodes)
+ * can ever pass. The Cognito equivalent of the Auth0 Post-Login Action.
+ *
+ * Roles = the user's Cognito groups, verbatim. Groups are named in the platform's
+ * noun:verb grammar (workflow:author, marketplace:publish, finance:approve, ...),
+ * so group membership IS the RBAC surface. They are emitted on BOTH `roles` and
+ * `permissions`: the platform's builder/publish gates read permissions, node
+ * requires.role matches either.
+ */
+export const handler = async (event) => {
+  const groups = event.request.groupConfiguration?.groupsToOverride ?? [];
+  const email = event.request.userAttributes?.email;
+
+  const claims = {
+    roles: groups,
+    permissions: groups,
+    ...(email ? { email } : {}),
+  };
+
+  event.response = {
+    claimsAndScopeOverrideDetails: {
+      accessTokenGeneration: {
+        claimsToAddOrOverride: claims,
+      },
+      idTokenGeneration: {
+        claimsToAddOrOverride: claims,
+      },
+    },
+  };
+  return event;
+};

package/operator/infra/aws/prices.tf

@@ -0,0 +1,53 @@
+# What this ground costs to run, priced where its sizes are chosen.
+#
+# ONE HOME FOR THE NUMBERS, the same arrangement as the DigitalOcean ground: the ground
+# owns its sizes, so the ground prices them. `unoverse deploy` reads this map out of the
+# plan JSON instead of carrying a second table, which is how the CLI came to quote
+# t3-series rates for a ground that had moved to t4g and silently price its database at
+# nothing at all.
+#
+# NOT A COST ORACLE. On-demand rates in a mid-priced region, so a developer sees an order
+# of magnitude instead of a surprise. Rates move and vary by region; the bill is AWS's.
+
+locals {
+  # Monthly USD, keyed by the instance type it prices. A type absent here is simply not
+  # priced (the summary shows the resource with no figure) rather than guessed at.
+  prices = {
+    # EC2
+    "t3.xlarge"   = 120 # small: the POC box
+    "m6i.2xlarge" = 280 # medium
+    "r6i.2xlarge" = 365 # large
+    # RDS Postgres
+    "db.t4g.small"  = 25
+    "db.t4g.medium" = 50
+    "db.m6g.large"  = 125
+    # ElastiCache Redis
+    "cache.t4g.micro"  = 12
+    "cache.t4g.small"  = 25
+    "cache.t4g.medium" = 50
+    # Fixed-price resources, keyed by what they are rather than a size
+    "alb" = 18
+    # Not a size: EBS, the public IPv4 charge, Route 53 and egress at POC traffic. Small
+    # and unavoidable, so the estimate carries it rather than reading low by a sixth.
+    "baseline" = 15
+  }
+
+  # The steady-state bill for THIS universe, as configured.
+  monthly_estimate = sum([
+    lookup(local.prices, local.s.instance, 0),
+    lookup(local.prices, local.s.pg, 0),
+    lookup(local.prices, local.s.redis, 0),
+    local.prices["alb"],
+    local.prices["baseline"],
+  ])
+}
+
+output "prices" {
+  description = "Monthly USD by instance type. The CLI's plan summary reads this, so the deploy screen and the docs cannot drift apart."
+  value       = local.prices
+}
+
+output "monthly_estimate" {
+  description = "Roughly what this universe costs a month at on-demand prices, for the size configured."
+  value       = local.monthly_estimate
+}

package/operator/infra/aws/terraform.tfvars.example

@@ -0,0 +1,55 @@
+# Copy to terraform.tfvars and fill in — or let `./unoverse ground aws` write it
+# for you, prefilled from the AWS CLI (region, key pair, Route53 zone, your IP).
+# terraform.tfvars is gitignored.
+
+region       = "us-east-1"
+name         = "universe-poc"
+admin_cidr   = "203.0.113.7/32"        # YOUR IP — the only SSH source
+ssh_key_name = "your-ec2-keypair-name" # must already exist in the region
+admin_email  = "you@example.com"       # initial admin (Cognito user, all roles; invite emailed)
+size         = "small"                 # small (POC) | medium | large
+# Domain is OPTIONAL — the same law on every ground. Leave it empty and the
+# universe comes up on the ALB's DNS name over plain HTTP (terraform output
+# api_url shows the address). Fill it in later and `terraform apply` again:
+# the SAME deployment upgrades in place to TLS at api.<domain>.
+domain       = ""                      # empty = HTTP on the ALB DNS name; "yourdomain.com" = TLS at api.yourdomain.com
+
+# OPTIONAL (with a domain): the domain's Route53 hosted zone id — set it and Terraform creates the
+# DNS records AND auto-validates the certificate. Empty = you add the printed
+# CNAMEs/aliases yourself (outputs: acm_validation_records, alb_dns_name).
+# route53_zone_id = "Z0123456789ABC"
+# (Domain hosted elsewhere — GoDaddy etc.? That's fine on AWS: leave this unset
+#  and paste the printed CNAMEs into your DNS panel. No Route53 required.)
+
+# POC ONLY: public Canvas at https://unoverse.<domain> — a host rule on the ONE
+# ALB (no second LB; ALBs host-route, unlike DO). Add the URL to oauth origins.
+canvas_public = true
+
+# Service secrets — with these set, the rendered .env.production is COMPLETE.
+docr_token           = "dop_v1_..."   # registry token (pulls platform images)
+openai_api_key       = "sk-..."       # memory server + OpenAI nodes
+# hyperbrowser_api_key = ""           # optional — page intelligence
+
+oauth_callback_urls = [
+  "https://yourdomain.com",
+  "http://localhost:5173", # local Studio/Canvas dev against this universe
+]
+
+# RBAC roles (noun:verb — the grammar node manifests' requires.role matches).
+# Each becomes a Cognito group; put a user in the group and the role rides their
+# token. THE FULL SET, mirroring the Auth0 tenant's Gravity API permissions
+# (2026-07-28). The first two are enforced by code gates and are always created
+# even if removed from this list; the last two are declared intent (no code gate
+# yet — enforcement arrives with the surfaces they name).
+roles = [
+  "workflow:author",    # build and test workflows (builder gate — ENFORCED)
+  "marketplace:publish", # publish assets to this universe (publish gate — ENFORCED)
+  "workflow:promote",   # promote a draft to active / go-live (declared only)
+  "admin:access",       # admin to Unoverse Canvas (declared only)
+]
+
+# The rendered output (terraform output -raw env_production > ../../.env.production)
+# IS your universe's secrets, including the MASTER KEY (CREDENTIAL_ENCRYPTION_KEY)
+# that locks every credential users save in the platform. If it's lost, no backup
+# can bring them back. Never commit it; keep a safe copy with your database backups.
+# To change any value: edit this file and re-render. Never hand-edit the output.

package/operator/infra/aws/variables.tf

@@ -0,0 +1,92 @@
+variable "region" {
+  description = "AWS region. Must have Bedrock model access enabled for the models you use."
+  type        = string
+  default     = "us-east-1"
+}
+
+variable "name" {
+  description = "Prefix for every resource (also the Cognito domain prefix, so keep it dns-safe)."
+  type        = string
+  default     = "universe-poc"
+}
+
+variable "admin_cidr" {
+  description = "The ONLY CIDR allowed to SSH (deploys + ./unoverse key). Your IP as x.x.x.x/32."
+  type        = string
+}
+
+variable "ssh_key_name" {
+  description = "Name of an existing EC2 key pair for SSH access."
+  type        = string
+}
+
+variable "oauth_callback_urls" {
+  description = "OIDC redirect URLs for the SPA client (Canvas/Studio origins, e.g. https://yourdomain.com and http://localhost:5173 for dev)."
+  type        = list(string)
+}
+
+variable "admin_email" {
+  description = "The initial ADMIN user's email. Created in the Cognito pool and placed in every role group (Cognito emails an invite with a temporary password). This is the platform admin — a Cognito user, not an IAM one."
+  type        = string
+}
+
+variable "roles" {
+  description = "This deployment's RBAC roles, always noun:verb (matched by node manifests' requires.role). Each becomes a Cognito group; membership rides the token's roles/permissions claims. The two platform permissions (workflow:author, marketplace:publish) are always created and need not be listed."
+  type        = list(string)
+  default     = []
+  validation {
+    condition     = alltrue([for r in var.roles : can(regex("^[a-z][a-z0-9_-]*:[a-z][a-z0-9_-]*$", r))])
+    error_message = "Every role must be noun:verb (lowercase), e.g. finance:approve — the same grammar the node linter enforces."
+  }
+}
+
+# ── Added 2026-07-29: parity with infra/digitalocean ──────────────────────────
+
+variable "size" {
+  description = "Deployment size (INFRASTRUCTURE.md size table): small = POC box."
+  type        = string
+  default     = "small"
+  validation {
+    condition     = contains(["small", "medium", "large"], var.size)
+    error_message = "size must be small, medium or large."
+  }
+}
+
+variable "domain" {
+  description = "OPTIONAL — the same law on every ground. Empty (the default) = no certificate and no hostnames: the ALB serves plain HTTP on its DNS name (terraform output api_url) — the zero-friction first apply. Set it later and re-apply to upgrade IN PLACE to TLS at api.<domain> (and unoverse.<domain> when canvas_public). Nothing is destroyed by the upgrade."
+  type        = string
+  default     = ""
+}
+
+variable "route53_zone_id" {
+  description = "OPTIONAL: the domain's Route53 hosted zone id. Set = Terraform creates the DNS records AND auto-validates the ACM cert. Empty = you create the validation CNAME + A records yourself (printed as outputs)."
+  type        = string
+  default     = ""
+}
+
+variable "canvas_public" {
+  description = "POC ONLY: Canvas publicly at https://unoverse.<domain> — a HOST RULE on the one ALB (ALBs host-route; no second LB needed, unlike DO). false = Canvas stays admin-only direct :3001 (the standing posture). Add https://unoverse.<domain> to the client origins."
+  type        = bool
+  default     = false
+}
+
+# Service secrets — taken here so the rendered .env.production is COMPLETE;
+# the operator fills terraform.tfvars once and never hand-edits the env file.
+variable "docr_token" {
+  description = "Container registry token — pulls the platform images."
+  type        = string
+  sensitive   = true
+}
+
+variable "openai_api_key" {
+  description = "OpenAI API key — memory server + OpenAI nodes."
+  type        = string
+  sensitive   = true
+}
+
+variable "hyperbrowser_api_key" {
+  description = "Optional — page-intelligence features. Empty = feature off."
+  type        = string
+  default     = ""
+  sensitive   = true
+}

package/operator/infra/digitalocean/main.tf

@@ -0,0 +1,297 @@
+# The Universe — DigitalOcean ground (docs/architecture/INFRASTRUCTURE.md)
+#
+# Same five-input contract as infra/aws, DO implementation: Droplet + Managed
+# Postgres (fronted by its built-in PgBouncer, per the Postgres law) + Managed
+# Redis + DO Load Balancer with a managed Let's Encrypt cert (native ingress —
+# Caddy is retired) + cloud firewall (the ground owns the firewall; Docker
+# cannot bypass what never reaches the box). Terraform provisions and renders
+# .env.production; `unoverse deploy` does the rest.
+
+terraform {
+  required_version = ">= 1.5"
+  required_providers {
+    digitalocean = { source = "digitalocean/digitalocean", version = "~> 2.40" }
+    random       = { source = "hashicorp/random", version = "~> 3.6" }
+  }
+}
+
+provider "digitalocean" {
+  # Empty token falls through to the DIGITALOCEAN_TOKEN env var.
+  token = var.do_token != "" ? var.do_token : null
+}
+
+# ── Size table (INFRASTRUCTURE.md § Sizes — the numbers live in the contract) ──
+locals {
+  sizes = {
+    small = {
+      droplet = "s-4vcpu-16gb-amd" # 4 vCPU / 16 GB — the POC box
+      pg      = "db-s-1vcpu-1gb"   # ~22 backend connections (~19 usable) — hence the pool
+      redis   = "db-s-1vcpu-1gb"
+      # Connection budget: engine 8 / legacy 4 / memory 4 (+2 ops, +1 reserve = 19)
+      pool_engine = 8
+      pool_legacy = 4
+      pool_memory = 4
+      pgbouncer   = 17 # backend connections the managed pool holds (leaves 5 direct: migrations + ops)
+    }
+    medium = {
+      droplet     = "g-8vcpu-32gb"
+      pg          = "db-s-2vcpu-4gb"
+      redis       = "db-s-1vcpu-2gb"
+      pool_engine = 20
+      pool_legacy = 8
+      pool_memory = 10
+      pgbouncer   = 40
+    }
+    large = {
+      droplet     = "m-8vcpu-64gb" # memory-optimized: the engine is ONE event loop — RAM, not cores
+      pg          = "db-s-4vcpu-8gb"
+      redis       = "db-s-2vcpu-4gb"
+      pool_engine = 40
+      pool_legacy = 12
+      pool_memory = 20
+      pgbouncer   = 80
+    }
+  }
+  s = local.sizes[var.size]
+
+  # Postgres modes (variables.tf): external URL > existing DO cluster > provision.
+  pg_external  = var.byo_postgres_url != ""
+  pg_adopt     = !local.pg_external && var.existing_pg_cluster_name != ""
+  provision_pg = !local.pg_external && !local.pg_adopt
+  pg_managed   = local.pg_adopt || local.provision_pg # any DO-managed mode
+
+  # Domainless-first (DECIDED 2026-07-31): no domain = no cert, the LB speaks
+  # plain HTTP on its IP. Setting domain later and re-applying upgrades the SAME
+  # LB in place — cert issued, HTTPS rules swap in, HTTP redirect on.
+  has_domain = var.domain != ""
+  api_host   = "api.${var.domain}"
+}
+
+# The adopted cluster's facts (id/host/port) when reusing an existing one.
+data "digitalocean_database_cluster" "existing_pg" {
+  count = local.pg_adopt ? 1 : 0
+  name  = var.existing_pg_cluster_name
+}
+
+locals {
+  # The cluster every universe resource (db/user/pool/firewall) attaches to.
+  pg_cluster_id   = local.pg_adopt ? data.digitalocean_database_cluster.existing_pg[0].id : (local.provision_pg ? digitalocean_database_cluster.pg[0].id : "")
+  pg_cluster_host = local.pg_adopt ? data.digitalocean_database_cluster.existing_pg[0].private_host : (local.provision_pg ? digitalocean_database_cluster.pg[0].private_host : "")
+  pg_cluster_port = local.pg_adopt ? data.digitalocean_database_cluster.existing_pg[0].port : (local.provision_pg ? digitalocean_database_cluster.pg[0].port : 25060)
+}
+
+data "digitalocean_ssh_key" "operator" {
+  name = var.ssh_key_name
+}
+
+# ── The box ───────────────────────────────────────────────────────────────────
+resource "digitalocean_droplet" "app" {
+  name     = "${var.name}-app"
+  region   = var.region
+  size     = local.s.droplet
+  image    = "ubuntu-22-04-x64"
+  ssh_keys = [data.digitalocean_ssh_key.operator.id]
+}
+
+# ── Firewall: the ground owns it (harden.yml's ufw could be bypassed by
+# Docker's iptables rules; a cloud firewall cannot) ────────────────────────────
+resource "digitalocean_firewall" "app" {
+  name        = "${var.name}-app"
+  droplet_ids = [digitalocean_droplet.app.id]
+
+  inbound_rule {
+    protocol         = "tcp"
+    port_range       = "22"
+    source_addresses = [var.admin_cidr]
+  }
+  # Dozzle log viewer — POC size ships it ON, admin-only (INFRASTRUCTURE.md size table).
+  inbound_rule {
+    protocol         = "tcp"
+    port_range       = "8080"
+    source_addresses = [var.admin_cidr]
+  }
+  # The public surface arrives ONLY through the load balancer.
+  inbound_rule {
+    protocol                  = "tcp"
+    port_range                = "4105"
+    source_load_balancer_uids = [digitalocean_loadbalancer.public.id]
+  }
+  # Canvas (operator UI): the DO LB has NO host-based routing (Caddy did), so the
+  # public LB carries ONLY the api host → :4105. Canvas is an OPERATOR tool —
+  # admin-only direct access, same trust ring as SSH and Dozzle. It still calls
+  # the platform at https://api.<domain> like any client.
+  # POC (canvas_public = true): :3001 ALSO accepts the public LB, which serves
+  # Canvas at https://api.<domain>:3001. Direct-IP access stays admin-only either way.
+  inbound_rule {
+    protocol                  = "tcp"
+    port_range                = "3001"
+    source_addresses          = [var.admin_cidr]
+    source_load_balancer_uids = var.canvas_public ? [digitalocean_loadbalancer.public.id] : []
+  }
+
+  outbound_rule {
+    protocol              = "tcp"
+    port_range            = "1-65535"
+    destination_addresses = ["0.0.0.0/0", "::/0"]
+  }
+  outbound_rule {
+    protocol              = "udp"
+    port_range            = "1-65535"
+    destination_addresses = ["0.0.0.0/0", "::/0"]
+  }
+}
+
+# ── Native ingress: DO LB + managed Let's Encrypt cert (Caddy retired) ────────
+# NOTE (INFRASTRUCTURE.md § Ingress): DO caps http idle timeout at 600s — set to
+# the cap; long-quiet SSE/WS sessions must survive a reconnect (smoke-test item).
+resource "digitalocean_certificate" "api" {
+  count   = local.has_domain ? 1 : 0
+  name    = "${var.name}-api"
+  type    = "lets_encrypt"
+  # canvas.<domain> rides the SAME certificate as a SAN (and the same LB): the
+  # clean hostname costs nothing — only the PORT cannot be dropped, because DO
+  # LBs cannot host-route (DECIDED 2026-07-29: one LB, port in the URL).
+  domains = var.canvas_public ? [local.api_host, "canvas.${var.domain}"] : [local.api_host]
+}
+
+resource "digitalocean_loadbalancer" "public" {
+  name                     = "${var.name}-lb"
+  region                   = var.region
+  droplet_ids              = [digitalocean_droplet.app.id]
+  redirect_http_to_https   = local.has_domain # domainless serves HTTP itself, nothing to redirect to
+  http_idle_timeout_seconds = 600 # DO's maximum
+
+  # With a domain: HTTPS 443 with the managed cert. Without: plain HTTP 80 on
+  # the LB IP. Same port meanings for the developer either way (API on the root).
+  dynamic "forwarding_rule" {
+    for_each = local.has_domain ? [1] : []
+    content {
+      entry_port       = 443
+      entry_protocol   = "https"
+      target_port      = 4105
+      target_protocol  = "http"
+      certificate_name = one(digitalocean_certificate.api[*].name)
+    }
+  }
+  dynamic "forwarding_rule" {
+    for_each = local.has_domain ? [] : [1]
+    content {
+      entry_port      = 80
+      entry_protocol  = "http"
+      target_port     = 4105
+      target_protocol = "http"
+    }
+  }
+
+  # POC (canvas_public = true, DECIDED 2026-07-29): Canvas rides the SAME LB on a
+  # second port — https://canvas.<domain>:3001 (a SAN on the api certificate, an A record to this same LB). ONE load balancer total: DO LBs can't
+  # host-route, and a clean second hostname would cost a second LB; the POC takes
+  # the port in the URL instead. Domainless: same second port, plain HTTP.
+  dynamic "forwarding_rule" {
+    for_each = var.canvas_public ? [1] : []
+    content {
+      entry_port       = 3001
+      entry_protocol   = local.has_domain ? "https" : "http"
+      target_port      = 3001
+      target_protocol  = "http"
+      certificate_name = one(digitalocean_certificate.api[*].name)
+    }
+  }
+
+
+  healthcheck {
+    port     = 4105
+    protocol = "http"
+    path     = "/health"
+  }
+}
+
+resource "digitalocean_record" "canvas" {
+  count  = local.has_domain && var.canvas_public && var.manage_dns ? 1 : 0
+  domain = var.domain
+  type   = "A"
+  name   = "canvas"
+  value  = digitalocean_loadbalancer.public.ip
+  ttl    = 300
+}
+
+# Optional DNS (manage_dns = true and the domain hosted on DO).
+resource "digitalocean_record" "api" {
+  count  = local.has_domain && var.manage_dns ? 1 : 0
+  domain = var.domain
+  type   = "A"
+  name   = "api"
+  value  = digitalocean_loadbalancer.public.ip
+  ttl    = 300
+}
+
+# ── Postgres: Managed PG fronted by its built-in PgBouncer (the law) ──────────
+resource "digitalocean_database_cluster" "pg" {
+  count      = local.provision_pg ? 1 : 0
+  name       = "${var.name}-pg"
+  engine     = "pg"
+  version    = "16"
+  size       = local.s.pg
+  region     = var.region
+  node_count = 1
+}
+
+resource "digitalocean_database_db" "universe" {
+  count      = local.pg_managed ? 1 : 0
+  cluster_id = local.pg_cluster_id
+  name       = "universe"
+}
+
+resource "digitalocean_database_user" "universe" {
+  count      = local.pg_managed ? 1 : 0
+  cluster_id = local.pg_cluster_id
+  name       = "universe"
+}
+
+# Transaction-mode pool: ~hundreds of client connections over `pgbouncer` backend
+# slots. Services use the POOLED url; migrations use the DIRECT url
+# (DATABASE_URL_DIRECT — db-setup prefers it; DDL doesn't ride transaction mode).
+resource "digitalocean_database_connection_pool" "universe" {
+  count      = local.pg_managed ? 1 : 0
+  cluster_id = local.pg_cluster_id
+  name       = "universe-pool"
+  mode       = "transaction"
+  size       = local.s.pgbouncer
+  db_name    = digitalocean_database_db.universe[0].name
+  user       = digitalocean_database_user.universe[0].name
+}
+
+resource "digitalocean_database_firewall" "pg" {
+  count      = local.pg_managed ? 1 : 0
+  cluster_id = local.pg_cluster_id
+  rule {
+    type  = "droplet"
+    value = digitalocean_droplet.app.id
+  }
+}
+
+# ── Redis: ALWAYS ours (Managed Redis, TLS, droplet-only). Never BYO — it is
+# the shared-state backbone and the active/active future; the stack owns it. ──
+resource "digitalocean_database_cluster" "redis" {
+  name       = "${var.name}-redis"
+  engine     = "redis"
+  version    = "7"
+  size       = local.s.redis
+  region     = var.region
+  node_count = 1
+}
+
+resource "digitalocean_database_firewall" "redis" {
+  cluster_id = digitalocean_database_cluster.redis.id
+  rule {
+    type  = "droplet"
+    value = digitalocean_droplet.app.id
+  }
+}
+
+# ── Per-deployment credential-encryption key (SECURITY.md § Credential
+# encryption at rest): no deployment ever runs on the committed default. ──────
+resource "random_password" "credential_key" {
+  length  = 44
+  special = false
+}