unoverse 0.1.75 → 0.1.77

package/operator/infra/aws/main.tf

@@ -14,8 +14,41 @@ terraform {
   }
 }
 
+# ── One universe, one group ───────────────────────────────────────────────────
+#
+# AWS has no projects. Its equivalent is TAGS, and `default_tags` is the only honest way
+# to apply them: it stamps every resource this configuration creates, so nothing is
+# forgotten the day someone adds a resource and does not think about tagging. The console
+# view comes from the Resource Group below, and the same tag drives cost allocation, which
+# a DigitalOcean project cannot do.
+#
+# It touches ONLY what this stack creates. An adopted database keeps its own tags, in
+# keeping with the rule that a universe never takes ownership of what it borrowed
+# (INFRASTRUCTURE.md, "Borrowed resources are never owned").
 provider "aws" {
   region = var.region
+
+  default_tags {
+    tags = {
+      Universe  = var.name
+      ManagedBy = "unoverse"
+      Size      = var.size
+    }
+  }
+}
+
+# The console's answer to "what does this universe own". A tag query rather than a
+# membership list, so it stays correct as the ground grows without anyone maintaining it.
+resource "aws_resourcegroups_group" "universe" {
+  name        = var.name
+  description = "unoverse universe: ${var.name}"
+
+  resource_query {
+    query = jsonencode({
+      ResourceTypeFilters = ["AWS::AllSupported"]
+      TagFilters          = [{ Key = "Universe", Values = [var.name] }]
+    })
+  }
 }
 
 # ── Network: default VPC + two security groups ─────────────────────────────────

package/operator/infra/digitalocean/main.tf

@@ -261,8 +261,18 @@ resource "digitalocean_database_connection_pool" "universe" {
   user       = digitalocean_database_user.universe[0].name
 }
 
+# ONLY A CLUSTER THIS STACK CREATED. `digitalocean_database_firewall` is AUTHORITATIVE:
+# it replaces the whole trusted-sources list rather than adding to it. Applied to an
+# ADOPTED cluster it therefore deleted every rule the account already had — the
+# operator's own IP, their other droplets, their App Platform apps — and locked them out
+# of a database this universe merely borrows. It happened, on 2026-08-01.
+#
+# So terraform owns the firewall only when it owns the cluster (`provision_pg`). For an
+# adopted cluster the CLI appends this droplet to the existing rules instead
+# (scripts/lib/deploy.sh), which is additive and leaves everything else alone. A universe
+# never takes ownership of a database it did not create.
 resource "digitalocean_database_firewall" "pg" {
-  count      = local.pg_managed ? 1 : 0
+  count      = local.provision_pg ? 1 : 0
   cluster_id = local.pg_cluster_id
   rule {
     type  = "droplet"

package/operator/lib/deploy.sh

@@ -14,6 +14,74 @@
 # Terraform is one static binary: install it from the official release rather than
 # sending anyone to brew, whose compile chain can demand Xcode Command Line Tools
 # updates for a tool that needs no compiling.
+# Give this universe's droplet access to an ADOPTED database, additively.
+#
+# Terraform cannot do this safely: `digitalocean_database_firewall` replaces the whole
+# trusted-sources list, so pointing it at a borrowed cluster deletes the operator's own
+# IP, their other droplets and their apps. Read the rules, add ours if missing, write
+# them back. Nothing else moves, and running it twice changes nothing.
+# Add or remove THIS universe's droplet in an adopted cluster's trusted sources.
+#   _adopted_db_access <cloud> grant|revoke [droplet_id]
+# Symmetric on purpose. The grant existed and nothing revoked it, so a teardown left a
+# stale rule behind — and worse, terraform's own destroy of an authoritative firewall
+# resource PUT an EMPTY list and locked the operator out of a database it had borrowed.
+# Both directions now touch exactly one rule and never the list.
+_adopted_db_access() {
+  local cloud="$1" dir="$ROOT/infra/$cloud" cluster droplet_id
+  local mode="$2"
+  cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  [ -n "$cluster" ] || return 0
+  [ -n "${DIGITALOCEAN_TOKEN:-}" ] || return 0
+  droplet_id="${3:-$(terraform -chdir="$dir" state show digitalocean_droplet.app 2>/dev/null | awk -F'"' '/^ *id *=/{print $2; exit}')}"
+  [ -n "$droplet_id" ] || return 0
+
+  node - "$cluster" "$droplet_id" "$mode" <<'NODE'
+const [cluster, droplet, mode] = process.argv.slice(2);
+const T = process.env.DIGITALOCEAN_TOKEN;
+const H = { Authorization: `Bearer ${T}`, "Content-Type": "application/json" };
+const api = (p, o = {}) => fetch(`https://api.digitalocean.com/v2${p}`, { headers: H, ...o });
+(async () => {
+  const list = await (await api("/databases")).json();
+  const db = (list.databases || []).find((d) => d.name === cluster);
+  if (!db) return;
+  const fw = await (await api(`/databases/${db.id}/firewall`)).json();
+  let rules = (fw.rules || []).map((r) => ({ type: r.type, value: r.value }));
+  const mine = (r) => r.type === "droplet" && String(r.value) === String(droplet);
+  const has = rules.some(mine);
+  if (mode === "revoke") {
+    if (!has) return;
+    rules = rules.filter((r) => !mine(r));   // ours only; every other rule survives
+  } else {
+    if (has) return;
+    rules.push({ type: "droplet", value: String(droplet) });
+  }
+  const res = await api(`/databases/${db.id}/firewall`, { method: "PUT", body: JSON.stringify({ rules }) });
+  const what = mode === "revoke" ? "no longer reaches" : "may reach";
+  console.log(res.ok
+    ? `  \x1b[32m✓\x1b[0m This universe ${what} ${cluster} \x1b[2m(one rule changed, ${rules.length} left in place)\x1b[0m`
+    : `  \x1b[33m!\x1b[0m Could not update ${cluster}'s trusted sources — adjust droplet ${droplet} by hand`);
+})().catch(() => {});
+NODE
+}
+
+# The cloud credential terraform needs, from where the CLI already put it.
+#
+# By design the DO token lives in doctl's config and never in a repo file (main.tf: an
+# empty var falls through to DIGITALOCEAN_TOKEN). This used to sit INSIDE cmd_deploy, so
+# `unoverse destroy` ran with no credential at all and every API call came back 401 —
+# the same class of bug as the Postgres question living in one branch of two. Anything
+# that talks to a ground calls this first.
+_ground_credentials() {
+  [ -n "${DIGITALOCEAN_TOKEN:-}" ] && return 0
+  local _docfg
+  for _docfg in "$HOME/Library/Application Support/doctl/config.yaml" "$HOME/.config/doctl/config.yaml"; do
+    [ -f "$_docfg" ] || continue
+    DIGITALOCEAN_TOKEN=$(awk '/access-token:/{print $2; exit}' "$_docfg")
+    if [ -n "$DIGITALOCEAN_TOKEN" ]; then export DIGITALOCEAN_TOKEN; return 0; fi
+  done
+  return 0
+}
+
 _ensure_terraform() {
   command -v terraform >/dev/null 2>&1 && return 0
   local REPLY tf_arch tf_os tf_v="1.9.8" tf_dir
@@ -209,18 +277,7 @@ cmd_deploy() {
 
   local env_prod="$ROOT/.env.production"
 
-  # HAND TERRAFORM ITS TOKEN. By design the DO token lives in doctl's config and never
-  # in a repo file (main.tf: empty var falls through to DIGITALOCEAN_TOKEN). deploy
-  # authenticated doctl, so deploy passes the token on — process env only, no file.
-  # Without this, apply planned 6 resources and then 401'd on an empty credential.
-  if [ -z "${DIGITALOCEAN_TOKEN:-}" ]; then
-    local _docfg
-    for _docfg in "$HOME/Library/Application Support/doctl/config.yaml" "$HOME/.config/doctl/config.yaml"; do
-      [ -f "$_docfg" ] || continue
-      DIGITALOCEAN_TOKEN=$(awk '/access-token:/{print $2; exit}' "$_docfg")
-      if [ -n "$DIGITALOCEAN_TOKEN" ]; then export DIGITALOCEAN_TOKEN; break; fi
-    done
-  fi
+  _ground_credentials
 
   # ── ONE FLOW ────────────────────────────────────────────────────────────────
   # Which ground, is it configured, plan it, apply it, ship it. In that order, every
@@ -269,6 +326,8 @@ cmd_deploy() {
     exit 1
   fi
 
+  _adopted_db_access "$cloud" grant
+
 
   # Read deploy target from .env.production
   local deploy_host deploy_user

package/operator/lib/destroy.sh

@@ -34,6 +34,7 @@ cmd_destroy() {
     return 1
   fi
 
+  _ground_credentials
   _ensure_terraform || return 1
 
   local pretty
@@ -72,7 +73,15 @@ cmd_destroy() {
   name="${name:-universe}"
 
   echo ""
-  echo -e "  ${RED}This deletes the server and its data. It cannot be undone.${NC}"
+  # Say what is actually lost. With a reused cluster the DATABASE survives, and claiming
+  # otherwise makes the warning untrue in the commonest case — which teaches people to
+  # skim warnings.
+  if [ -n "$kept" ]; then
+    echo -e "  ${RED}This deletes the server and everything on its disk. It cannot be undone.${NC}"
+    echo -e "  ${DIM}Your database and its contents survive in $kept.${NC}"
+  else
+    echo -e "  ${RED}This deletes the server, the database and all their data. It cannot be undone.${NC}"
+  fi
   echo ""
   local typed
   read -r -p "  Type the universe name to confirm ($name): " typed
@@ -82,6 +91,14 @@ cmd_destroy() {
     return 1
   fi
 
+  # Take our rule out of the borrowed cluster BEFORE the state goes, while the droplet id
+  # is still readable. One rule, ours, never the list.
+  if [ -n "$kept" ]; then
+    local dropped
+    dropped=$(terraform -chdir="$dir" state show digitalocean_droplet.app 2>/dev/null | awk -F'"' '/^ *id *=/{print $2; exit}')
+    [ -n "$dropped" ] && _adopted_db_access "$cloud" revoke "$dropped"
+  fi
+
   echo ""
   info "Taking it down..."
   echo ""

package/operator/lib/tfsummary.mjs

@@ -48,7 +48,10 @@ function spec(size) {
  * and listing them separately turns one decision into eleven.
  */
 function describe(r) {
-  const a = r.change?.after ?? {};
+  // BEFORE, when there is no after. A destroy plan has `after: null` — every resource
+  // is being removed — so reading only `after` printed "Server · " with no size or
+  // region: the summary of a teardown, describing nothing.
+  const a = r.change?.after ?? r.change?.before ?? {};
   switch (r.type) {
     case "digitalocean_droplet":
       return { what: "Server", detail: `${spec(a.size)} · ${a.region ?? ""}`, price: PRICE[a.size] };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.75",
+  "version": "0.1.77",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",