unoverse 0.1.91 → 0.1.93

package/operator/infra/aws/outputs.tf

@@ -126,6 +126,9 @@ output "env_production" {
     OPENAI_API_KEY=${var.openai_api_key}
     HYPERBROWSER_API_KEY=${var.hyperbrowser_api_key}
 
+    # Marketplace catalogue (MARKETPLACE.md §5). Empty = local items only.
+    UNOVERSE_MARKETPLACE_URL=${var.marketplace_url}
+
     # Ingress. With a domain: DOMAIN drives every URL (compose derives
     # https://api.<domain>). Without one (POC): DOMAIN stays empty and the
     # explicit URLs below point at the ALB's DNS name over plain HTTP.

package/operator/infra/aws/terraform.tfvars.example

@@ -53,3 +53,7 @@ roles = [
 # that locks every credential users save in the platform. If it's lost, no backup
 # can bring them back. Never commit it; keep a safe copy with your database backups.
 # To change any value: edit this file and re-render. Never hand-edit the output.
+
+# Marketplace catalogue to install from (docs/architecture/MARKETPLACE.md).
+# Leave unset for local items only.
+# marketplace_url = "https://marketplace.example.com"

package/operator/infra/aws/variables.tf

@@ -91,3 +91,14 @@ variable "hyperbrowser_api_key" {
   default     = ""
   sensitive   = true
 }
+
+# The catalogue this universe installs from (MARKETPLACE.md §5). NO DEFAULT, deliberately:
+# a URL is never hardcoded and never a fallback, and absent config means no remote
+# catalogue — the universe serves what it has on disk and in its rows, which is the correct
+# state for development and for air-gapped estates. It reaches the marketplace at install
+# time and at no other time.
+variable "marketplace_url" {
+  description = "Base URL of the marketplace catalogue. Empty = local items only."
+  type        = string
+  default     = ""
+}

package/operator/infra/digitalocean/outputs.tf

@@ -118,6 +118,9 @@ output "env_production" {
     OPENAI_API_KEY=${var.openai_api_key}
     HYPERBROWSER_API_KEY=${var.hyperbrowser_api_key}
 
+    # Marketplace catalogue (MARKETPLACE.md §5). Empty = local items only.
+    UNOVERSE_MARKETPLACE_URL=${var.marketplace_url}
+
     # Ingress. With a domain: DOMAIN drives every URL (compose derives
     # https://api.<domain>). Without one (POC): DOMAIN stays empty and the
     # explicit URLs below point at the load balancer's IP over plain HTTP.

package/operator/infra/digitalocean/terraform.tfvars.example

@@ -50,3 +50,7 @@ openai_api_key       = "sk-..."       # memory server + OpenAI nodes
 # that locks every credential users save in the platform. If it's lost, no backup
 # can bring them back. Never commit it; keep a safe copy with your database backups.
 # To change any value: edit this file and re-render. Never hand-edit the output.
+
+# Marketplace catalogue to install from (docs/architecture/MARKETPLACE.md).
+# Leave unset for local items only.
+# marketplace_url = "https://marketplace.example.com"

package/operator/infra/digitalocean/variables.tf

@@ -125,3 +125,14 @@ variable "hyperbrowser_api_key" {
   default     = ""
   sensitive   = true
 }
+
+# The catalogue this universe installs from (MARKETPLACE.md §5). NO DEFAULT, deliberately:
+# a URL is never hardcoded and never a fallback, and absent config means no remote
+# catalogue — the universe serves what it has on disk and in its rows, which is the correct
+# state for development and for air-gapped estates. It reaches the marketplace at install
+# time and at no other time.
+variable "marketplace_url" {
+  description = "Base URL of the marketplace catalogue. Empty = local items only."
+  type        = string
+  default     = ""
+}

package/operator/lib/deploy.sh

@@ -102,14 +102,11 @@ NODE
 # password afterwards. This opens a door in the network layer; it does not open the
 # database.
 cmd_db_allow() {
-  local cloud="" g
-  for g in digitalocean aws; do
-    [ -f "$ROOT/infra/$g/terraform.tfvars" ] && { cloud="$g"; break; }
-  done
-  if [ -z "$cloud" ]; then
-    fail "No ground here. There is no database to reach"
+  local cloud
+  SELF_CMD="unoverse db-allow" cloud=$(_pick_ground "${1:-}") || {
+    [ -z "${1:-}" ] && [ ! -d "$ROOT/infra" ] && fail "No ground here. There is no database to reach"
     return 1
-  fi
+  }
 
   local cluster
   cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$ROOT/infra/$cloud/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
@@ -188,6 +185,51 @@ NODE
 # `unoverse destroy` ran with no credential at all and every API call came back 401 —
 # the same class of bug as the Postgres question living in one branch of two. Anything
 # that talks to a ground calls this first.
+# WHICH GROUND THIS COMMAND MEANS.
+#   _pick_ground [name]   →  echoes the ground, or fails with a reason
+#
+# Every command used `for g in digitalocean aws; do ... break; done`: first match wins, and
+# digitalocean is first in the list. With both grounds configured there was no way to reach
+# the AWS one — and `unoverse destroy` would have torn down DigitalOcean while the operator
+# meant AWS, silently, because the word "aws" had nowhere to go.
+#
+# So a ground can be named. With one configured, naming it is optional and the answer is
+# obvious. With two, the name is REQUIRED rather than guessed: a wrong guess here destroys
+# the wrong cloud.
+_pick_ground() {
+  local want="${1:-}" g found=""
+  case "$want" in
+    do|digitalocean) want="digitalocean" ;;
+    aws|amazon)      want="aws" ;;
+    "")              want="" ;;
+    *) fail "Unknown ground '$want'. Use ${BOLD}digitalocean${NC} or ${BOLD}aws${NC}" >&2; return 1 ;;
+  esac
+
+  local configured=()
+  for g in digitalocean aws; do
+    [ -f "$ROOT/infra/$g/terraform.tfvars" ] && configured+=("$g")
+  done
+
+  if [ -n "$want" ]; then
+    for g in "${configured[@]}"; do
+      [ "$g" = "$want" ] && { printf '%s' "$want"; return 0; }
+    done
+    fail "No $want ground here. Run ${BOLD}unoverse deploy $want${NC} to create one" >&2
+    return 1
+  fi
+
+  case "${#configured[@]}" in
+    0) return 1 ;;                        # caller offers to create one
+    1) printf '%s' "${configured[0]}"; return 0 ;;
+    *)
+      # Two grounds and no name. Refuse rather than pick: this decides which cloud a
+      # destroy lands on.
+      fail "Two grounds are configured. Say which: ${BOLD}${SELF_CMD:-unoverse deploy} digitalocean${NC} or ${BOLD}${SELF_CMD:-unoverse deploy} aws${NC}" >&2
+      return 1
+      ;;
+  esac
+}
+
 _ground_credentials() {
   [ -n "${DIGITALOCEAN_TOKEN:-}" ] && return 0
   local _docfg
@@ -472,6 +514,13 @@ _ground_apply() {
 }
 
 cmd_deploy() {
+  # A LEADING GROUND NAME IS NOT A SUBCOMMAND. `unoverse deploy aws` names the cloud;
+  # `unoverse deploy init` names the step; `unoverse deploy aws init` does both. Take the
+  # ground off the front when it is there, and leave everything else exactly as it was.
+  local GROUND_ARG=""
+  case "${1:-}" in
+    do|digitalocean|aws|amazon) GROUND_ARG="$1"; shift ;;
+  esac
 
   # .env.production IS NOT A FILE IN THE UNIVERSE. It is `terraform output -raw
   # env_production`: derived, complete, and regenerated in full on every deploy. Writing it
@@ -492,10 +541,14 @@ cmd_deploy() {
   # ── ONE FLOW ────────────────────────────────────────────────────────────────
   # Which ground, is it configured, plan it, apply it, ship it. In that order, every
   # time, whether this is the first deploy or the fiftieth.
-  local cloud="" g rc
-  for g in digitalocean aws; do
-    [ -f "$ROOT/infra/$g/terraform.tfvars" ] && { cloud="$g"; break; }
-  done
+  # A named ground wins; one configured ground is implied; two without a name is refused
+  # (see _pick_ground). Nothing configured at all falls through to creating one below,
+  # which is the first-run path and the only case where an empty answer is not a mistake.
+  local cloud="" rc have=0
+  [ -f "$ROOT/infra/digitalocean/terraform.tfvars" ] || [ -f "$ROOT/infra/aws/terraform.tfvars" ] && have=1
+  if [ "$have" = "1" ]; then
+    cloud=$(SELF_CMD="unoverse deploy" _pick_ground "${GROUND_ARG:-}") || exit 1
+  fi
 
   if [ -z "$cloud" ]; then
     echo ""

package/operator/lib/destroy.sh

@@ -19,14 +19,17 @@
 # cloud resources this ground owns.
 
 cmd_destroy() {
-  local cloud="" g
-  for g in digitalocean aws; do
-    [ -f "$ROOT/infra/$g/terraform.tfvars" ] && { cloud="$g"; break; }
-  done
-  if [ -z "$cloud" ]; then
-    fail "No ground here. There is nothing deployed to take down"
+  # NAME THE GROUND. This took the first configured one, and digitalocean is first in the
+  # list — so an operator with both grounds who typed `unoverse destroy` meaning AWS would
+  # have torn down DigitalOcean instead, with the confirmation prompt happily naming the
+  # universe they thought they were destroying. _pick_ground refuses to guess when there is
+  # more than one.
+  local cloud
+  cloud=$(SELF_CMD="unoverse destroy" _pick_ground "${1:-}") || {
+    [ -f "$ROOT/infra/digitalocean/terraform.tfvars" ] || [ -f "$ROOT/infra/aws/terraform.tfvars" ] \
+      || fail "No ground here. There is nothing deployed to take down"
     return 1
-  fi
+  }
 
   local dir="$ROOT/infra/$cloud"
   if [ ! -d "$dir/.terraform" ]; then

package/operator/lib/help.sh

@@ -24,6 +24,7 @@ cmd_help() {
   echo -e "    ${GREEN}logs${NC}        What is it doing ${DIM}(unoverse logs <service> for one)${NC}"
   echo -e "    ${GREEN}deploy${NC}      Ship it to a server ${DIM}(first run asks which cloud)${NC}"
   echo -e "    ${GREEN}destroy${NC}     Take the deployment down ${DIM}(shows what goes, and what stays)${NC}"
+  echo -e "                ${DIM}With two grounds, name one: deploy aws  ·  destroy digitalocean${NC}"
   echo -e "    ${GREEN}db-allow${NC}    Let this machine reach the database ${DIM}(run it when you change network)${NC}"
   echo ""
   # Owner-only lane. Printed ONLY when publish.sh is present, so a starter kit never

package/operator/operator.sh

@@ -65,8 +65,8 @@ case "${1:-}" in
   check)     cmd_check && cmd_db_verify && cmd_doctor ;;
   dev)       cmd_dev ;;
   ground)    shift; cmd_ground "$@" ;;
-  destroy)   cmd_destroy ;;
-  db-allow)  cmd_db_allow ;;
+  destroy)   cmd_destroy "${2:-}" ;;
+  db-allow)  cmd_db_allow "${2:-}" ;;
   refresh-images)
     # internal: `unoverse update` runs this after updating the CLI. Pull newer images
     # if the registry has them, and recreate only what is already running — an update

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.91",
+  "version": "0.1.93",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",