unoverse 0.1.72 → 0.1.74

package/bin/unoverse.mjs

@@ -58,7 +58,7 @@ const UNIVERSE = findUniverse();
 // type it to update the CLI far more often than to refresh a local universe's images,
 // and that refresh now belongs to `start --pull`.
 const OPERATOR_COMMANDS = new Set([
-  "start", "stop", "check", "logs", "deploy",
+  "start", "stop", "check", "logs", "deploy", "destroy",
   // kept working, not advertised
   "ground", "dev", "build", "publish", "init",
 ]);

package/operator/infra/digitalocean/main.tf

@@ -270,12 +270,18 @@ resource "digitalocean_database_firewall" "pg" {
   }
 }
 
-# ── Redis: ALWAYS ours (Managed Redis, TLS, droplet-only). Never BYO — it is
-# the shared-state backbone and the active/active future; the stack owns it. ──
+# ── Valkey: ALWAYS ours (managed, TLS, droplet-only). Never BYO — it is the
+# shared-state backbone and the active/active future; the stack owns it.
+#
+# VALKEY, NOT REDIS. DigitalOcean retired the `redis` engine: /v2/databases/options now
+# lists valkey and no redis at all. Asking for a dead engine failed with "region 'lon1'
+# is not valid", because an unknown engine matches no region — an error that sent us
+# looking at the region for as long as it took to ask the API what engines exist.
+# Valkey speaks the Redis protocol, so every client here is unchanged. ──
 resource "digitalocean_database_cluster" "redis" {
   name       = "${var.name}-redis"
-  engine     = "redis"
-  version    = "7"
+  engine     = "valkey"
+  version    = "8"
   size       = local.s.redis
   region     = var.region
   node_count = 1
@@ -295,3 +301,25 @@ resource "random_password" "credential_key" {
   length  = 44
   special = false
 }
+
+# ── One project, so a universe looks like one thing ───────────────────────────
+#
+# Without this, a universe's parts scatter through the DigitalOcean default project among
+# everything else the account runs, and "what does this universe own" has no answer you
+# can see. The project is named after the universe, so the console shows the server, the
+# cache and the load balancer as one group.
+#
+# ONLY WHAT THIS STACK OWNS. An adopted Postgres belongs to whoever created it; moving it
+# into this project would quietly reorganise someone else's resource.
+resource "digitalocean_project" "universe" {
+  name        = var.name
+  description = "unoverse universe: ${var.name}"
+  purpose     = "Web Application"
+  environment = var.size == "small" ? "Development" : "Production"
+  resources = compact([
+    digitalocean_droplet.app.urn,
+    digitalocean_loadbalancer.public.urn,
+    digitalocean_database_cluster.redis.urn,
+    local.provision_pg ? digitalocean_database_cluster.pg[0].urn : "",
+  ])
+}

package/operator/lib/deploy.sh

@@ -162,12 +162,15 @@ _ground_apply() {
 
   # `read -p` does NOT interpret escapes, so ${DIM} printed as literal \033[2m. Colour
   # the hint with echo -e first, then take a plain prompt.
+  # EXPLICIT YES, and it says so. Everywhere else in this CLI Enter means "go"; here it
+  # means "stop", because this is the one prompt that starts a monthly bill. Keeping the
+  # safety is right — leaving it as a bare [y/N] among Enter-means-go prompts is not.
   local REPLY
-  echo -e "  ${DIM}(d shows the full technical plan)${NC}"
-  read -r -p "  Go ahead? [y/N] " REPLY
+  echo -e "  ${DIM}d shows the full technical plan${NC}"
+  read -r -p "  Type y to build this, or Enter to stop: " REPLY
   if [[ "$REPLY" =~ ^[Dd]$ ]]; then
     terraform -chdir="$dir" show "$planfile"
-    read -r -p "  Go ahead? [y/N] " REPLY
+    read -r -p "  Type y to build this, or Enter to stop: " REPLY
   fi
   if [[ ! "$REPLY" =~ ^[Yy]$ ]]; then
     info "Nothing was created. Run ${BOLD}unoverse deploy${NC} when you are ready"

package/operator/lib/destroy.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# unoverse destroy — take the whole deployment down, in one command.
+#
+# The counterpart to `deploy`, and the same shape: read the ground, show in plain English
+# what will go, take ONE answer, then do exactly what was shown. It exists because the
+# alternative is remembering `terraform destroy` in the right folder with the right
+# environment, and because half a teardown is worse than none — a load balancer nobody
+# knows about bills forever.
+#
+# THREE THINGS MAKE THIS SAFE.
+#   1. It shows what exists before it asks anything.
+#   2. It names what it will NOT remove: an adopted Postgres is somebody else's cluster,
+#      read by this stack and never owned, so it survives. Saying so prevents both a
+#      nasty surprise and a false sense that the bill is now zero.
+#   3. Confirmation is the universe's NAME, typed. y/N is muscle memory; a name is a
+#      decision, and this deletes data that no backup here can restore.
+#
+# It never touches the developer's terraform.tfvars, their .env, or their code. Only the
+# cloud resources this ground owns.
+
+cmd_destroy() {
+  local cloud="" g
+  for g in digitalocean aws; do
+    [ -f "$ROOT/infra/$g/terraform.tfvars" ] && { cloud="$g"; break; }
+  done
+  if [ -z "$cloud" ]; then
+    fail "No ground here. There is nothing deployed to take down"
+    return 1
+  fi
+
+  local dir="$ROOT/infra/$cloud"
+  if [ ! -d "$dir/.terraform" ]; then
+    fail "That ground was never applied. Nothing exists to destroy"
+    return 1
+  fi
+
+  _ensure_terraform || return 1
+
+  local pretty
+  [ "$cloud" = "aws" ] && pretty="AWS" || pretty="DigitalOcean"
+  echo ""
+  echo -e "  ${RED}${BOLD}⬡ Taking down your $pretty universe${NC}"
+  echo ""
+
+  local tmp planfile rc
+  tmp=$(mktemp -d); planfile="$tmp/plan"
+  info "Working out what exists..."
+  terraform -chdir="$dir" plan -destroy -input=false -detailed-exitcode -out="$planfile" >"$tmp/log" 2>&1
+  rc=$?
+  case "$rc" in
+    0) ok "Nothing is deployed. There is nothing to take down"; rm -rf "$tmp"; return 0 ;;
+    2) : ;;
+    *) fail "Terraform could not read the deployment:"; tail -20 "$tmp/log" | sed 's/^/      /'; rm -rf "$tmp"; return 1 ;;
+  esac
+
+  if ! terraform -chdir="$dir" show -json "$planfile" 2>/dev/null | node "$GRAVITY_LIB/tfsummary.mjs"; then
+    terraform -chdir="$dir" show "$planfile"
+  fi
+
+  # What SURVIVES matters as much as what goes: an adopted cluster is read, never owned.
+  local kept
+  kept=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  if [ -n "$kept" ]; then
+    info "Staying: ${BOLD}$kept${NC} ${DIM}(you reused it, so this stack never owned it. Its bill continues)${NC}"
+  fi
+  if grep -qE '^byo_postgres_url[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null; then
+    info "Staying: ${BOLD}your own database${NC} ${DIM}(byo_postgres_url — this stack never owned it)${NC}"
+  fi
+
+  local name
+  name=$(grep -E '^name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  name="${name:-universe}"
+
+  echo ""
+  echo -e "  ${RED}This deletes the server and its data. It cannot be undone.${NC}"
+  echo ""
+  local typed
+  read -r -p "  Type the universe name to confirm ($name): " typed
+  if [ "$typed" != "$name" ]; then
+    info "Name did not match. Nothing was destroyed"
+    rm -rf "$tmp"
+    return 1
+  fi
+
+  echo ""
+  info "Taking it down..."
+  echo ""
+  terraform -chdir="$dir" apply -input=false "$planfile" || { fail "Teardown did not finish. Re-run: unoverse destroy"; rm -rf "$tmp"; return 1; }
+  rm -rf "$tmp"
+
+  # .env.production described a server that no longer exists. Leaving it makes the next
+  # deploy think there is something to ship to.
+  rm -f "$ROOT/.env.production"
+
+  echo ""
+  ok "Your $pretty universe is gone"
+  info "Your ground, code and settings are untouched. ${BOLD}unoverse deploy${NC} builds it again"
+  echo ""
+}

package/operator/lib/help.sh

@@ -23,6 +23,7 @@ cmd_help() {
   echo -e "    ${GREEN}check${NC}       Is it healthy ${DIM}(services, schema, environment)${NC}"
   echo -e "    ${GREEN}logs${NC}        What is it doing ${DIM}(unoverse logs <service> for one)${NC}"
   echo -e "    ${GREEN}deploy${NC}      Ship it to a server ${DIM}(first run asks which cloud)${NC}"
+  echo -e "    ${GREEN}destroy${NC}     Take the deployment down ${DIM}(shows what goes, and what stays)${NC}"
   echo ""
   # Owner-only lane. Printed ONLY when publish.sh is present, so a starter kit never
   # advertises a command it does not have (sync-starter.sh deletes that file).

package/operator/lib/tfsummary.mjs

@@ -52,10 +52,17 @@ function describe(r) {
   switch (r.type) {
     case "digitalocean_droplet":
       return { what: "Server", detail: `${spec(a.size)} · ${a.region ?? ""}`, price: PRICE[a.size] };
-    case "digitalocean_database_cluster":
-      return a.engine === "redis"
-        ? { what: "Redis cache", detail: `${spec(a.size)} · v${a.version ?? ""}`, price: PRICE[a.size] }
-        : { what: "PostgreSQL database", detail: `${spec(a.size)} · v${a.version ?? ""}`, price: PRICE[a.size] };
+    case "digitalocean_database_cluster": {
+      // MATCH THE ENGINE, don't assume two. DigitalOcean renamed redis to valkey, and a
+      // lone `=== "redis"` test quietly relabelled the cache as "PostgreSQL database" —
+      // the summary claiming one thing while the plan built another.
+      const cache = a.engine === "valkey" || a.engine === "redis";
+      return {
+        what: cache ? "Cache" : "PostgreSQL database",
+        detail: `${spec(a.size)} · ${a.engine ?? ""} v${a.version ?? ""}`,
+        price: PRICE[a.size],
+      };
+    }
     case "digitalocean_loadbalancer":
       return { what: "Load balancer", detail: "the public way in", price: PRICE.lb };
     case "digitalocean_firewall":

package/operator/operator.sh

@@ -44,6 +44,7 @@ source "$GRAVITY_LIB/help.sh"
 source "$GRAVITY_LIB/db-setup.sh"
 source "$GRAVITY_LIB/db-verify.sh"
 source "$GRAVITY_LIB/deploy.sh"
+source "$GRAVITY_LIB/destroy.sh"
 source "$GRAVITY_LIB/ground.sh"
 # Authoring tools (lint, new, node test/hash, studio) moved to _legacy/scripts-lib
 # 2026-07-28 — authoring lives in Studio now. The CLI is the OPERATOR tool.
@@ -64,6 +65,7 @@ case "${1:-}" in
   check)     cmd_check && cmd_db_verify && cmd_doctor ;;
   dev)       cmd_dev ;;
   ground)    shift; cmd_ground "$@" ;;
+  destroy)   cmd_destroy ;;
   refresh-images)
     # internal: `unoverse update` runs this after updating the CLI. Pull newer images
     # if the registry has them, and recreate only what is already running — an update

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.72",
+  "version": "0.1.74",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",