unoverse 0.1.78 → 0.1.80

package/bin/unoverse.mjs

@@ -114,7 +114,12 @@ switch (cmd) {
       console.log(`\n  ✓ unoverse is now ${v || "up to date"}`);
       spawnSync("unoverse", ["_postupdate"], { stdio: "inherit" });
     } else {
-      console.log(`\n  ✗ global install failed (permissions?). Try:\n\n    sudo npm install -g unoverse@latest\n    npx unoverse@latest    # or skip the global install entirely\n`);
+      // DO NOT GUESS THE CAUSE. This used to say "(permissions?)" whatever happened, so a
+      // registry that had not finished propagating a release — npm resolves `latest` to a
+      // version whose tarball is not servable yet, ETARGET — was reported as a permissions
+      // problem, sending people to sudo for something sudo cannot fix. npm's own error is
+      // already on screen above; name the two real causes and let it speak for itself.
+      console.log(`\n  ✗ Update failed. npm's reason is above.\n\n    "No matching version" — a release is still propagating. Wait a minute and re-run.\n    "EACCES" / permission denied — sudo npm install -g unoverse@latest\n\n  Or skip the global install entirely: npx unoverse@latest\n`);
     }
     process.exit(r.status ?? 0);
   }

package/operator/ansible/playbooks/deploy-images.yml

@@ -30,9 +30,16 @@
     # server's existing compose, so a new env var (e.g. MEMORY_SERVICE_URL) silently never
     # reached prod even though the image had the code. `.env` (per-server values) is left
     # untouched — only the canonical compose is refreshed from the repo.
+    #
+    # THE COMPOSE LIVES IN THE UNIVERSE, NOT NEXT TO THIS PLAYBOOK. `playbook_dir/../..`
+    # is the monorepo, where ansible/ and docker-compose.yml are siblings. Installed from
+    # npm they are not: the playbook sits in node_modules/unoverse/operator/ansible, and
+    # that path resolved to node_modules/unoverse/docker-compose.yml, which does not exist
+    # — so every deploy from an installed CLI died here on "Could not find or access". The
+    # deploy passes universe_root; the default keeps the monorepo working.
     - name: "[1/4] Sync docker-compose.yml (config travels with the deploy)"
       copy:
-        src: "{{ playbook_dir }}/../../docker-compose.yml"
+        src: "{{ universe_root | default(playbook_dir + '/../..') }}/docker-compose.yml"
         dest: "{{ gravity_dir }}/docker-compose.yml"
 
     - name: "[2/4] Pull latest platform images"

package/operator/ansible/playbooks/install.yml

@@ -121,7 +121,7 @@
 
     - name: "[7/12] Copy docker-compose.yml"
       copy:
-        src: "{{ playbook_dir }}/../../docker-compose.yml"
+        src: "{{ universe_root | default(playbook_dir + '/../..') }}/docker-compose.yml"
         dest: "{{ gravity_dir }}/docker-compose.yml"
         owner: "{{ ansible_user }}"
         mode: "0644"

package/operator/infra/digitalocean/main.tf

@@ -246,6 +246,21 @@ resource "digitalocean_database_user" "universe" {
   count      = local.pg_managed ? 1 : 0
   cluster_id = local.pg_cluster_id
   name       = "universe"
+
+  # NEVER UPDATE THIS USER IN PLACE. Provider 2.96 grew a `settings` block (Kafka and
+  # OpenSearch ACLs) and an update path that fires whenever it sees any diff on the
+  # resource — including one the provider invented itself on refresh. For a Postgres user,
+  # which has no settings, that path PUTs an empty body and DigitalOcean rejects it:
+  #
+  #   400 request is missing the following required fields: user_settings
+  #
+  # It killed a deploy mid-apply, after the firewall had already changed, on a resource
+  # declaring nothing but a name. We create this user once and never modify it — name and
+  # cluster_id both force replacement anyway — so there is no update we want, and the
+  # safest number of update paths to leave available is zero.
+  lifecycle {
+    ignore_changes = all
+  }
 }
 
 # Transaction-mode pool: ~hundreds of client connections over `pgbouncer` backend

package/operator/lib/deploy.sh

@@ -426,6 +426,7 @@ EOF
       ansible-playbook \
         -i "$tmp_inventory" \
         "$ansible_dir/playbooks/deploy-images.yml" \
+        -e "universe_root=$ROOT" \
         -e "env_file=$env_prod"
       ;;
     init|full)
@@ -438,18 +439,21 @@ EOF
       ansible-playbook \
         -i "$tmp_inventory" \
         "$ansible_dir/playbooks/install.yml" \
+        -e "universe_root=$ROOT" \
         -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "install failed — fix and re-run: unoverse deploy init"; exit 1; }
       echo ""
       info "[2/3] Database setup..."
       ansible-playbook \
         -i "$tmp_inventory" \
         "$ansible_dir/playbooks/db-setup.yml" \
+        -e "universe_root=$ROOT" \
         -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "db setup failed — fix and re-run: unoverse deploy db"; exit 1; }
       echo ""
       info "[3/3] Verifying..."
       ansible-playbook \
         -i "$tmp_inventory" \
         "$ansible_dir/playbooks/test-connectivity.yml" \
+        -e "universe_root=$ROOT" \
         -e "env_file=$env_prod" || { rm -f "$tmp_inventory"; fail "verification failed — inspect and re-run: unoverse deploy test"; exit 1; }
       echo ""
       ok "Your universe is up. From now on, deploys are just: unoverse deploy"
@@ -461,6 +465,7 @@ EOF
       ansible-playbook \
         -i "$tmp_inventory" \
         "$ansible_dir/playbooks/db-setup.yml" \
+        -e "universe_root=$ROOT" \
         -e "env_file=$env_prod"
       ;;
     test|check)
@@ -469,6 +474,7 @@ EOF
       ansible-playbook \
         -i "$tmp_inventory" \
         "$ansible_dir/playbooks/test-connectivity.yml" \
+        -e "universe_root=$ROOT" \
         -e "env_file=$env_prod"
       ;;
     harden)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.78",
+  "version": "0.1.80",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",