unoverse 0.1.73 → 0.1.75

package/bin/unoverse.mjs

@@ -58,7 +58,7 @@ const UNIVERSE = findUniverse();
 // type it to update the CLI far more often than to refresh a local universe's images,
 // and that refresh now belongs to `start --pull`.
 const OPERATOR_COMMANDS = new Set([
-  "start", "stop", "check", "logs", "deploy",
+  "start", "stop", "check", "logs", "deploy", "destroy",
   // kept working, not advertised
   "ground", "dev", "build", "publish", "init",
 ]);

package/operator/infra/digitalocean/main.tf

@@ -270,12 +270,18 @@ resource "digitalocean_database_firewall" "pg" {
   }
 }
 
-# ── Redis: ALWAYS ours (Managed Redis, TLS, droplet-only). Never BYO — it is
-# the shared-state backbone and the active/active future; the stack owns it. ──
+# ── Valkey: ALWAYS ours (managed, TLS, droplet-only). Never BYO — it is the
+# shared-state backbone and the active/active future; the stack owns it.
+#
+# VALKEY, NOT REDIS. DigitalOcean retired the `redis` engine: /v2/databases/options now
+# lists valkey and no redis at all. Asking for a dead engine failed with "region 'lon1'
+# is not valid", because an unknown engine matches no region — an error that sent us
+# looking at the region for as long as it took to ask the API what engines exist.
+# Valkey speaks the Redis protocol, so every client here is unchanged. ──
 resource "digitalocean_database_cluster" "redis" {
   name       = "${var.name}-redis"
-  engine     = "redis"
-  version    = "7"
+  engine     = "valkey"
+  version    = "8"
   size       = local.s.redis
   region     = var.region
   node_count = 1
@@ -295,3 +301,25 @@ resource "random_password" "credential_key" {
   length  = 44
   special = false
 }
+
+# ── One project, so a universe looks like one thing ───────────────────────────
+#
+# Without this, a universe's parts scatter through the DigitalOcean default project among
+# everything else the account runs, and "what does this universe own" has no answer you
+# can see. The project is named after the universe, so the console shows the server, the
+# cache and the load balancer as one group.
+#
+# ONLY WHAT THIS STACK OWNS. An adopted Postgres belongs to whoever created it; moving it
+# into this project would quietly reorganise someone else's resource.
+resource "digitalocean_project" "universe" {
+  name        = var.name
+  description = "unoverse universe: ${var.name}"
+  purpose     = "Web Application"
+  environment = var.size == "small" ? "Development" : "Production"
+  resources = compact([
+    digitalocean_droplet.app.urn,
+    digitalocean_loadbalancer.public.urn,
+    digitalocean_database_cluster.redis.urn,
+    local.provision_pg ? digitalocean_database_cluster.pg[0].urn : "",
+  ])
+}

package/operator/lib/deploy.sh

@@ -114,6 +114,26 @@ _ensure_ground_config() {
   cur_size=$(grep -E '^size[[:space:]]*=' "$tfv" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
   [ -n "$cur_size" ] && info "Size: ${BOLD}${cur_size}${NC} ${DIM}(small · medium · large — change it in terraform.tfvars and deploy again whenever you outgrow it)${NC}"
 
+  # REGION MUST MATCH, or the platform cannot reach its own database. DigitalOcean's
+  # private networking is per-region: the connection string uses the cluster's PRIVATE
+  # host, which a droplet in another region cannot resolve. Everything provisions
+  # perfectly and then the platform fails to start, which is the worst way to find out.
+  local reuse_name ground_region db_region
+  reuse_name=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$tfv" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  ground_region=$(grep -E '^region[[:space:]]*=' "$tfv" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  if [ -n "$reuse_name" ] && [ -n "$ground_region" ] && command -v doctl >/dev/null 2>&1; then
+    db_region=$(doctl databases list --format Name,Region --no-header 2>/dev/null | awk -v n="$reuse_name" '$1==n{print $2}')
+    if [ -n "$db_region" ] && [ "$db_region" != "$ground_region" ]; then
+      echo ""
+      fail "Region mismatch: this universe is in ${BOLD}$ground_region${NC}, ${BOLD}$reuse_name${NC} is in ${BOLD}$db_region${NC}"
+      info "Private networking does not cross regions, so the platform could not reach it."
+      info "Either set ${BOLD}region = \"$db_region\"${NC} in infra/$cloud/terraform.tfvars,"
+      info "or comment out existing_pg_cluster_name to create a database in $ground_region."
+      echo ""
+      return 1
+    fi
+  fi
+
   # THE DATABASE DECISION, STATED EVERY RUN. It is asked once and then recorded in
   # terraform.tfvars, so later deploys correctly do not re-ask — but silence reads
   # exactly like never having been asked. Say what is in force, the same way Size does.

package/operator/lib/destroy.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+# unoverse destroy — take the whole deployment down, in one command.
+#
+# The counterpart to `deploy`, and the same shape: read the ground, show in plain English
+# what will go, take ONE answer, then do exactly what was shown. It exists because the
+# alternative is remembering `terraform destroy` in the right folder with the right
+# environment, and because half a teardown is worse than none — a load balancer nobody
+# knows about bills forever.
+#
+# THREE THINGS MAKE THIS SAFE.
+#   1. It shows what exists before it asks anything.
+#   2. It names what it will NOT remove: an adopted Postgres is somebody else's cluster,
+#      read by this stack and never owned, so it survives. Saying so prevents both a
+#      nasty surprise and a false sense that the bill is now zero.
+#   3. Confirmation is the universe's NAME, typed. y/N is muscle memory; a name is a
+#      decision, and this deletes data that no backup here can restore.
+#
+# It never touches the developer's terraform.tfvars, their .env, or their code. Only the
+# cloud resources this ground owns.
+
+cmd_destroy() {
+  local cloud="" g
+  for g in digitalocean aws; do
+    [ -f "$ROOT/infra/$g/terraform.tfvars" ] && { cloud="$g"; break; }
+  done
+  if [ -z "$cloud" ]; then
+    fail "No ground here. There is nothing deployed to take down"
+    return 1
+  fi
+
+  local dir="$ROOT/infra/$cloud"
+  if [ ! -d "$dir/.terraform" ]; then
+    fail "That ground was never applied. Nothing exists to destroy"
+    return 1
+  fi
+
+  _ensure_terraform || return 1
+
+  local pretty
+  [ "$cloud" = "aws" ] && pretty="AWS" || pretty="DigitalOcean"
+  echo ""
+  echo -e "  ${RED}${BOLD}⬡ Taking down your $pretty universe${NC}"
+  echo ""
+
+  local tmp planfile rc
+  tmp=$(mktemp -d); planfile="$tmp/plan"
+  info "Working out what exists..."
+  terraform -chdir="$dir" plan -destroy -input=false -detailed-exitcode -out="$planfile" >"$tmp/log" 2>&1
+  rc=$?
+  case "$rc" in
+    0) ok "Nothing is deployed. There is nothing to take down"; rm -rf "$tmp"; return 0 ;;
+    2) : ;;
+    *) fail "Terraform could not read the deployment:"; tail -20 "$tmp/log" | sed 's/^/      /'; rm -rf "$tmp"; return 1 ;;
+  esac
+
+  if ! terraform -chdir="$dir" show -json "$planfile" 2>/dev/null | node "$GRAVITY_LIB/tfsummary.mjs"; then
+    terraform -chdir="$dir" show "$planfile"
+  fi
+
+  # What SURVIVES matters as much as what goes: an adopted cluster is read, never owned.
+  local kept
+  kept=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  if [ -n "$kept" ]; then
+    info "Staying: ${BOLD}$kept${NC} ${DIM}(you reused it, so this stack never owned it. Its bill continues)${NC}"
+  fi
+  if grep -qE '^byo_postgres_url[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null; then
+    info "Staying: ${BOLD}your own database${NC} ${DIM}(byo_postgres_url — this stack never owned it)${NC}"
+  fi
+
+  local name
+  name=$(grep -E '^name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  name="${name:-universe}"
+
+  echo ""
+  echo -e "  ${RED}This deletes the server and its data. It cannot be undone.${NC}"
+  echo ""
+  local typed
+  read -r -p "  Type the universe name to confirm ($name): " typed
+  if [ "$typed" != "$name" ]; then
+    info "Name did not match. Nothing was destroyed"
+    rm -rf "$tmp"
+    return 1
+  fi
+
+  echo ""
+  info "Taking it down..."
+  echo ""
+  terraform -chdir="$dir" apply -input=false "$planfile" || { fail "Teardown did not finish. Re-run: unoverse destroy"; rm -rf "$tmp"; return 1; }
+  rm -rf "$tmp"
+
+  # .env.production described a server that no longer exists. Leaving it makes the next
+  # deploy think there is something to ship to.
+  rm -f "$ROOT/.env.production"
+
+  echo ""
+  ok "Your $pretty universe is gone"
+  info "Your ground, code and settings are untouched. ${BOLD}unoverse deploy${NC} builds it again"
+  echo ""
+}

package/operator/lib/help.sh

@@ -23,6 +23,7 @@ cmd_help() {
   echo -e "    ${GREEN}check${NC}       Is it healthy ${DIM}(services, schema, environment)${NC}"
   echo -e "    ${GREEN}logs${NC}        What is it doing ${DIM}(unoverse logs <service> for one)${NC}"
   echo -e "    ${GREEN}deploy${NC}      Ship it to a server ${DIM}(first run asks which cloud)${NC}"
+  echo -e "    ${GREEN}destroy${NC}     Take the deployment down ${DIM}(shows what goes, and what stays)${NC}"
   echo ""
   # Owner-only lane. Printed ONLY when publish.sh is present, so a starter kit never
   # advertises a command it does not have (sync-starter.sh deletes that file).

package/operator/lib/tfsummary.mjs

@@ -52,10 +52,17 @@ function describe(r) {
   switch (r.type) {
     case "digitalocean_droplet":
       return { what: "Server", detail: `${spec(a.size)} · ${a.region ?? ""}`, price: PRICE[a.size] };
-    case "digitalocean_database_cluster":
-      return a.engine === "redis"
-        ? { what: "Redis cache", detail: `${spec(a.size)} · v${a.version ?? ""}`, price: PRICE[a.size] }
-        : { what: "PostgreSQL database", detail: `${spec(a.size)} · v${a.version ?? ""}`, price: PRICE[a.size] };
+    case "digitalocean_database_cluster": {
+      // MATCH THE ENGINE, don't assume two. DigitalOcean renamed redis to valkey, and a
+      // lone `=== "redis"` test quietly relabelled the cache as "PostgreSQL database" —
+      // the summary claiming one thing while the plan built another.
+      const cache = a.engine === "valkey" || a.engine === "redis";
+      return {
+        what: cache ? "Cache" : "PostgreSQL database",
+        detail: `${spec(a.size)} · ${a.engine ?? ""} v${a.version ?? ""}`,
+        price: PRICE[a.size],
+      };
+    }
     case "digitalocean_loadbalancer":
       return { what: "Load balancer", detail: "the public way in", price: PRICE.lb };
     case "digitalocean_firewall":

package/operator/operator.sh

@@ -44,6 +44,7 @@ source "$GRAVITY_LIB/help.sh"
 source "$GRAVITY_LIB/db-setup.sh"
 source "$GRAVITY_LIB/db-verify.sh"
 source "$GRAVITY_LIB/deploy.sh"
+source "$GRAVITY_LIB/destroy.sh"
 source "$GRAVITY_LIB/ground.sh"
 # Authoring tools (lint, new, node test/hash, studio) moved to _legacy/scripts-lib
 # 2026-07-28 — authoring lives in Studio now. The CLI is the OPERATOR tool.
@@ -64,6 +65,7 @@ case "${1:-}" in
   check)     cmd_check && cmd_db_verify && cmd_doctor ;;
   dev)       cmd_dev ;;
   ground)    shift; cmd_ground "$@" ;;
+  destroy)   cmd_destroy ;;
   refresh-images)
     # internal: `unoverse update` runs this after updating the CLI. Pull newer images
     # if the registry has them, and recreate only what is already running — an update

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.73",
+  "version": "0.1.75",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",