unoverse 0.1.92 → 0.1.94

package/bin/unoverse.mjs

@@ -60,7 +60,7 @@ const UNIVERSE = findUniverse();
 const OPERATOR_COMMANDS = new Set([
   "start", "stop", "check", "logs", "deploy", "destroy", "db-allow",
   // kept working, not advertised
-  "ground", "dev", "build", "publish", "init",
+  "ground", "dev", "build", "publish",
 ]);
 
 const [, , cmd, ...args] = process.argv;

package/operator/lib/deploy.sh

@@ -102,14 +102,11 @@ NODE
 # password afterwards. This opens a door in the network layer; it does not open the
 # database.
 cmd_db_allow() {
-  local cloud="" g
-  for g in digitalocean aws; do
-    [ -f "$ROOT/infra/$g/terraform.tfvars" ] && { cloud="$g"; break; }
-  done
-  if [ -z "$cloud" ]; then
-    fail "No ground here. There is no database to reach"
+  local cloud
+  SELF_CMD="unoverse db-allow" cloud=$(_pick_ground "${1:-}") || {
+    [ -z "${1:-}" ] && [ ! -d "$ROOT/infra" ] && fail "No ground here. There is no database to reach"
     return 1
-  fi
+  }
 
   local cluster
   cluster=$(grep -E '^existing_pg_cluster_name[[:space:]]*=' "$ROOT/infra/$cloud/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
@@ -188,6 +185,51 @@ NODE
 # `unoverse destroy` ran with no credential at all and every API call came back 401 —
 # the same class of bug as the Postgres question living in one branch of two. Anything
 # that talks to a ground calls this first.
+# WHICH GROUND THIS COMMAND MEANS.
+#   _pick_ground [name]   →  echoes the ground, or fails with a reason
+#
+# Every command used `for g in digitalocean aws; do ... break; done`: first match wins, and
+# digitalocean is first in the list. With both grounds configured there was no way to reach
+# the AWS one — and `unoverse destroy` would have torn down DigitalOcean while the operator
+# meant AWS, silently, because the word "aws" had nowhere to go.
+#
+# So a ground can be named. With one configured, naming it is optional and the answer is
+# obvious. With two, the name is REQUIRED rather than guessed: a wrong guess here destroys
+# the wrong cloud.
+_pick_ground() {
+  local want="${1:-}" g found=""
+  case "$want" in
+    do|digitalocean) want="digitalocean" ;;
+    aws|amazon)      want="aws" ;;
+    "")              want="" ;;
+    *) fail "Unknown ground '$want'. Use ${BOLD}digitalocean${NC} or ${BOLD}aws${NC}" >&2; return 1 ;;
+  esac
+
+  local configured=()
+  for g in digitalocean aws; do
+    [ -f "$ROOT/infra/$g/terraform.tfvars" ] && configured+=("$g")
+  done
+
+  if [ -n "$want" ]; then
+    for g in "${configured[@]}"; do
+      [ "$g" = "$want" ] && { printf '%s' "$want"; return 0; }
+    done
+    fail "No $want ground here. Run ${BOLD}unoverse deploy $want${NC} to create one" >&2
+    return 1
+  fi
+
+  case "${#configured[@]}" in
+    0) return 1 ;;                        # caller offers to create one
+    1) printf '%s' "${configured[0]}"; return 0 ;;
+    *)
+      # Two grounds and no name. Refuse rather than pick: this decides which cloud a
+      # destroy lands on.
+      fail "Two grounds are configured. Say which: ${BOLD}${SELF_CMD:-unoverse deploy} digitalocean${NC} or ${BOLD}${SELF_CMD:-unoverse deploy} aws${NC}" >&2
+      return 1
+      ;;
+  esac
+}
+
 _ground_credentials() {
   [ -n "${DIGITALOCEAN_TOKEN:-}" ] && return 0
   local _docfg
@@ -472,6 +514,13 @@ _ground_apply() {
 }
 
 cmd_deploy() {
+  # A LEADING GROUND NAME IS NOT A SUBCOMMAND. `unoverse deploy aws` names the cloud;
+  # `unoverse deploy init` names the step; `unoverse deploy aws init` does both. Take the
+  # ground off the front when it is there, and leave everything else exactly as it was.
+  local GROUND_ARG=""
+  case "${1:-}" in
+    do|digitalocean|aws|amazon) GROUND_ARG="$1"; shift ;;
+  esac
 
   # .env.production IS NOT A FILE IN THE UNIVERSE. It is `terraform output -raw
   # env_production`: derived, complete, and regenerated in full on every deploy. Writing it
@@ -492,10 +541,14 @@ cmd_deploy() {
   # ── ONE FLOW ────────────────────────────────────────────────────────────────
   # Which ground, is it configured, plan it, apply it, ship it. In that order, every
   # time, whether this is the first deploy or the fiftieth.
-  local cloud="" g rc
-  for g in digitalocean aws; do
-    [ -f "$ROOT/infra/$g/terraform.tfvars" ] && { cloud="$g"; break; }
-  done
+  # A named ground wins; one configured ground is implied; two without a name is refused
+  # (see _pick_ground). Nothing configured at all falls through to creating one below,
+  # which is the first-run path and the only case where an empty answer is not a mistake.
+  local cloud="" rc have=0
+  [ -f "$ROOT/infra/digitalocean/terraform.tfvars" ] || [ -f "$ROOT/infra/aws/terraform.tfvars" ] && have=1
+  if [ "$have" = "1" ]; then
+    cloud=$(SELF_CMD="unoverse deploy" _pick_ground "${GROUND_ARG:-}") || exit 1
+  fi
 
   if [ -z "$cloud" ]; then
     echo ""

package/operator/lib/destroy.sh

@@ -19,14 +19,17 @@
 # cloud resources this ground owns.
 
 cmd_destroy() {
-  local cloud="" g
-  for g in digitalocean aws; do
-    [ -f "$ROOT/infra/$g/terraform.tfvars" ] && { cloud="$g"; break; }
-  done
-  if [ -z "$cloud" ]; then
-    fail "No ground here. There is nothing deployed to take down"
+  # NAME THE GROUND. This took the first configured one, and digitalocean is first in the
+  # list — so an operator with both grounds who typed `unoverse destroy` meaning AWS would
+  # have torn down DigitalOcean instead, with the confirmation prompt happily naming the
+  # universe they thought they were destroying. _pick_ground refuses to guess when there is
+  # more than one.
+  local cloud
+  cloud=$(SELF_CMD="unoverse destroy" _pick_ground "${1:-}") || {
+    [ -f "$ROOT/infra/digitalocean/terraform.tfvars" ] || [ -f "$ROOT/infra/aws/terraform.tfvars" ] \
+      || fail "No ground here. There is nothing deployed to take down"
     return 1
-  fi
+  }
 
   local dir="$ROOT/infra/$cloud"
   if [ ! -d "$dir/.terraform" ]; then

package/operator/lib/doctor.sh

@@ -40,7 +40,7 @@ cmd_doctor() {
   if [ -f "$ROOT/.env" ]; then
     ok ".env file exists"
   else
-    fail ".env file missing. Run ${BOLD}unoverse init${NC}"
+    fail ".env file missing. Run ${BOLD}unoverse create${NC} in an empty folder"
     issues=$((issues + 1))
     print_summary $issues
     return
@@ -82,7 +82,7 @@ cmd_doctor() {
   if [ -f "$docker_config" ] && grep -q "$DOCR_REGISTRY" "$docker_config" 2>/dev/null; then
     ok "Logged in to DigitalOcean Container Registry"
   else
-    fail "Not logged in to DOCR. Run ${BOLD}unoverse init${NC}"
+    fail "Not logged in to the registry. Run ${BOLD}unoverse start${NC}, which logs in from your .env"
     issues=$((issues + 1))
   fi
 

package/operator/lib/help.sh

@@ -24,6 +24,7 @@ cmd_help() {
   echo -e "    ${GREEN}logs${NC}        What is it doing ${DIM}(unoverse logs <service> for one)${NC}"
   echo -e "    ${GREEN}deploy${NC}      Ship it to a server ${DIM}(first run asks which cloud)${NC}"
   echo -e "    ${GREEN}destroy${NC}     Take the deployment down ${DIM}(shows what goes, and what stays)${NC}"
+  echo -e "                ${DIM}With two grounds, name one: deploy aws  ·  destroy digitalocean${NC}"
   echo -e "    ${GREEN}db-allow${NC}    Let this machine reach the database ${DIM}(run it when you change network)${NC}"
   echo ""
   # Owner-only lane. Printed ONLY when publish.sh is present, so a starter kit never

package/operator/lib/start.sh

@@ -25,7 +25,7 @@ check_docker_file_sharing() {
     echo -e "  This will cause services to stay in ${BOLD}Created${NC} state and not start."
     echo ""
     echo -e "  ${BOLD}Fix (choose one):${NC}"
-    echo -e "    1. Move project to ${BOLD}~/dev/${NC} or ${BOLD}~/projects/${NC} and re-run ${BOLD}unoverse init${NC}"
+    echo -e "    1. Move project to ${BOLD}~/dev/${NC} or ${BOLD}~/projects/${NC} and re-run ${BOLD}unoverse start${NC}"
     echo -e "    2. Docker Desktop → Settings → Resources → File Sharing → add ${BOLD}$HOME/$location${NC}"
     echo ""
     return 1
@@ -79,7 +79,16 @@ cmd_start() {
   fi
 
   check_docker_file_sharing || exit 1
-  check_first_run
+  # NO SETUP WIZARD. `unoverse create` writes the .env; there is nothing for start to
+  # interview about, and an interactive wizard on the way to "start the platform" was a
+  # command inside a command. Say what is missing and name the one that fixes it.
+  if [ ! -f "$ROOT/.env" ]; then
+    echo ""
+    fail "No .env here. This folder is not a universe"
+    info "Run ${BOLD}unoverse create${NC} in an empty folder to make one"
+    echo ""
+    exit 1
+  fi
   banner "Starting Unoverse Platform"
   timer_start
 
@@ -126,7 +135,7 @@ cmd_start() {
     echo -e "  ${DIM}───────────────────────────────${NC}"
     echo ""
     echo -e "  ${YELLOW}Common fixes:${NC}"
-    echo -e "    • Not logged into registry?  ${GREEN}unoverse init${NC}"
+    echo -e "    • Not logged into registry?  check DOCR_TOKEN in ${GREEN}.env${NC}"
     echo -e "    • Missing .env?              ${GREEN}cp .env.example .env${NC} and fill in values"
     echo -e "    • Images not pulled?         ${GREEN}docker compose pull${NC}"
     echo ""
@@ -167,8 +176,8 @@ cmd_start() {
     build_component_nodes
     # Migrations, now that the unoverse service is up (they run from inside its
     # container). This is what makes start the resume point after any interrupted
-    # setup: pull, boot, migrate, no third command to know. Subshell for the same
-    # reason init uses one: cmd_db_setup exits rather than returns on failure.
+    # setup: pull, boot, migrate, no third command to know. Subshell because cmd_db_setup exits
+    # rather than returns on failure.
     if ! (cmd_db_setup) >/dev/null 2>&1; then
       warn "Migrations did not apply. Run ${BOLD}unoverse check${NC} to see why"
     fi
@@ -180,7 +189,7 @@ cmd_start() {
     echo ""
     echo -e "  ${YELLOW}No containers were created. Possible causes:${NC}"
     echo -e "    • Images not pulled yet?     ${GREEN}docker compose pull${NC}"
-    echo -e "    • Not logged into registry?  ${GREEN}unoverse init${NC}"
+    echo -e "    • Not logged into registry?  check DOCR_TOKEN in ${GREEN}.env${NC}"
     echo ""
   else
     printf "\r  ${YELLOW}!${NC} ${DIM}$running/$total services running${NC}\n"

package/operator/operator.sh

@@ -33,7 +33,6 @@ fi
 # ── Source all modules ──────────────────────────────────────────────
 source "$GRAVITY_LIB/find-root.sh"
 source "$GRAVITY_LIB/common.sh"
-source "$GRAVITY_LIB/init.sh"
 source "$GRAVITY_LIB/start.sh"
 source "$GRAVITY_LIB/stop.sh"
 source "$GRAVITY_LIB/logs.sh"
@@ -55,7 +54,6 @@ source "$GRAVITY_LIB/ground.sh"
 # (The old "studio mode" gate is gone — 2026-07-28. This CLI has ONE job:
 # operate a universe. Studio is a separate app; authoring happens there.)
 case "${1:-}" in
-  init)      cmd_init ;;   # not advertised: create configures, start resumes
   start)     shift; cmd_start "$@" ;;
   stop)      cmd_stop ;;
   logs)      cmd_logs "${2:-}" ;;
@@ -65,8 +63,8 @@ case "${1:-}" in
   check)     cmd_check && cmd_db_verify && cmd_doctor ;;
   dev)       cmd_dev ;;
   ground)    shift; cmd_ground "$@" ;;
-  destroy)   cmd_destroy ;;
-  db-allow)  cmd_db_allow ;;
+  destroy)   cmd_destroy "${2:-}" ;;
+  db-allow)  cmd_db_allow "${2:-}" ;;
   refresh-images)
     # internal: `unoverse update` runs this after updating the CLI. Pull newer images
     # if the registry has them, and recreate only what is already running — an update

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.92",
+  "version": "0.1.94",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",

package/operator/lib/init.sh

@@ -1,430 +0,0 @@
-#!/usr/bin/env bash
-# unoverse init, login, install-to-path, first-run check
-
-# install_to_path REMOVED 2026-07-31. The global command is the npm package `unoverse`
-# (`npm i -g unoverse`); symlinking a per-project bash script into /usr/local/bin was the
-# second CLI we set out to delete.
-
-# ── The image download, as an experience ─────────────────────────────────────
-#
-# The pull starts the moment the token is accepted, so the minute spent answering
-# questions is also the minute the images arrive. NOTHING writes to the terminal
-# asynchronously — a progress bar racing a readline prompt corrupts what the developer
-# is typing. The background half writes one line of STATE to a temp file; the wizard
-# prints a status line synchronously between question groups, where output composes
-# with input; the end of setup attaches with docker's own bars for whatever remains.
-PULL_STATE=""
-start_background_pull() {
-  PULL_STATE=$(mktemp)
-  (
-    imgs=$(docker compose -f "$ROOT/docker-compose.yml" config --images 2>/dev/null | sort -u)
-    total=$(printf '%s\n' "$imgs" | grep -c .)
-    n=0
-    for img in $imgs; do
-      short="${img##*/}"; short="${short%%:*}"
-      if docker image inspect "$img" >/dev/null 2>&1; then
-        n=$((n+1)); echo "$n $total ready $short" > "$PULL_STATE"; continue
-      fi
-      echo "$n $total pulling $short" > "$PULL_STATE"
-      docker pull "$img" >/dev/null 2>&1
-      n=$((n+1)); echo "$n $total pulled $short" > "$PULL_STATE"
-    done
-    echo "$total $total done -" > "$PULL_STATE"
-  ) &
-}
-
-# One dim line, printed only when the wizard is printing anyway. Never a redraw.
-pull_status_line() {
-  [ -n "$PULL_STATE" ] && [ -s "$PULL_STATE" ] || return 0
-  local n total verb what
-  read -r n total verb what < "$PULL_STATE" 2>/dev/null || return 0
-  if [ "$verb" = "done" ]; then
-    echo -e "  ${GREEN}⬇${NC} ${DIM}platform images: all $total downloaded${NC}"
-  elif [ "$verb" = "pulling" ]; then
-    echo -e "  ${CYAN}⬇${NC} ${DIM}platform images: $n of $total · pulling $what…${NC}"
-  else
-    echo -e "  ${CYAN}⬇${NC} ${DIM}platform images: $n of $total${NC}"
-  fi
-  echo ""
-}
-
-# First-run detection
-check_first_run() {
-  if [ ! -f "$ROOT/.env" ]; then
-    echo ""
-    echo -e "  ${YELLOW}${BOLD}Welcome to Unoverse!${NC}"
-    echo ""
-    echo -e "  Looks like this is your first time. Let's get you set up."
-    echo -e "  You'll need credentials from your Unoverse admin."
-    echo ""
-    read -r -p "  Ready to start setup? [Y/n] " REPLY
-    echo ""
-    if [[ ! "$REPLY" =~ ^[Nn]$ ]]; then
-      cmd_init
-    else
-      echo ""
-      info "Run ${BOLD}unoverse start${NC} when you're ready. It picks setup back up."
-      echo ""
-    fi
-    exit 0
-  fi
-}
-
-cmd_login() {
-  # Check if already logged in
-  local docker_config="$HOME/.docker/config.json"
-  if [ -f "$docker_config" ]; then
-    if grep -q "$DOCR_REGISTRY" "$docker_config" 2>/dev/null; then
-      ok "Already logged in to DOCR"
-      return
-    fi
-  fi
-
-  read -p "  DOCR Token: " TOKEN
-  if echo "$TOKEN" | docker login "$DOCR_REGISTRY" -u "$TOKEN" --password-stdin &>/dev/null; then
-    ok "Logged in to DOCR"
-  else
-    fail "Login failed"
-    exit 1
-  fi
-}
-
-cmd_init() {
-  echo ""
-  echo -e "  ${BOLD}${CYAN}⬡ Unoverse Setup${NC}"
-  echo -e "  ${DIM}─────────────────────────────────${NC}"
-  echo ""
-
-  # (The studio/platform mode interview was removed 2026-07-28 — Studio is a
-  # separate app, and this CLI only sets up the platform.)
-  timer_start
-
-  # DOCKER IS NEEDED TO START, NOT TO CONFIGURE. This used to exit here, which threw
-  # away a scaffold and a validated token because Docker Desktop happened to be closed.
-  # Writing .env needs nothing running, so record the state and carry on; the steps that
-  # genuinely need a daemon skip themselves, and `start` is where it becomes an error.
-  DOCKER_OK=0
-  if ! command -v docker &>/dev/null; then
-    warn "Docker is not installed. Configuration will finish; install it before ${BOLD}unoverse start${NC}"
-    info "Install: https://docs.docker.com/get-docker/"
-  elif ! docker info &>/dev/null; then
-    warn "Docker is not running. Configuration will finish; start Docker Desktop before ${BOLD}unoverse start${NC}"
-  else
-    DOCKER_OK=1
-    ok "Docker is installed and running"
-  fi
-
-  # Apple Silicon check
-  if [ "$(uname -m)" = "arm64" ]; then
-    ok "Apple Silicon detected: multi-arch images will run natively"
-    echo ""
-  fi
-
-  # RE-RUNNING EDITS. There is no "overwrite? [y/N]" gate any more: every existing value
-  # becomes its question's default, so Enter keeps a setting and typing replaces it.
-  # Walking through changes only what you change — which makes this the way to change
-  # one env var, not a destructive restart.
-  _env_cur() { grep "^$1=" "$ROOT/.env" 2>/dev/null | head -1 | cut -d= -f2-; }
-
-  echo ""
-  echo -e "  ${BOLD}Configure your environment:${NC}"
-  if [ -f "$ROOT/.env" ]; then
-    echo -e "  ${DIM}(Existing .env found. Enter keeps each current value)${NC}"
-  else
-    echo -e "  ${DIM}(Press Enter to use defaults)${NC}"
-  fi
-  echo ""
-
-  # DOCR Token. `unoverse create` has already asked for this and VALIDATED it against
-  # the registry, so it hands it over rather than making you type the same credential
-  # twice minutes apart. Typed here only when init is run on its own.
-  if [ -n "${UNOVERSE_DOCR_TOKEN:-}" ]; then
-    DOCR_TOKEN="$UNOVERSE_DOCR_TOKEN"
-    DOCR_USER="${UNOVERSE_DOCR_USER:-$UNOVERSE_DOCR_TOKEN}"
-    ok "Registry token carried over from create"
-  else
-    local cur_token
-    cur_token=$(_env_cur DOCR_TOKEN)
-    DOCR_USER=$(_env_cur DOCR_USER)
-    while true; do
-      if [ -n "$cur_token" ]; then
-        read -p "  DOCR Token [keep current]: " DOCR_TOKEN || { fail "no input (end of stream). Run unoverse init interactively"; exit 1; }
-        DOCR_TOKEN="${DOCR_TOKEN:-$cur_token}"
-      else
-        read -p "  DOCR Token (from your Unoverse admin): " DOCR_TOKEN || { fail "no input (end of stream). Run unoverse init interactively"; exit 1; }
-      fi
-      # Accept the credential in any shape, AS A PAIR. The downloaded Docker
-      # credentials wrap base64("email:token") — the username is the email, and
-      # logging in token-as-username gets "unauthorized" for exactly that shape.
-      DOCR_USER=""
-      if [[ "$DOCR_TOKEN" != dop_v1_* ]]; then
-        local decoded
-        decoded=$(printf '%s' "$DOCR_TOKEN" | sed -E 's/.*"auth"[^"]*"([A-Za-z0-9+\/=]+)".*/\1/' | base64 -d 2>/dev/null | tr -d '\0')
-        [ -n "$decoded" ] || decoded=$(printf '%s' "$DOCR_TOKEN" | base64 -d 2>/dev/null | tr -d '\0')
-        case "$decoded" in
-          *:dop_v1_*) DOCR_USER="${decoded%%:*}"; DOCR_TOKEN="dop_v1_${decoded##*dop_v1_}";;
-        esac
-      fi
-      DOCR_USER="${DOCR_USER:-$DOCR_TOKEN}"
-      if [[ "$DOCR_TOKEN" == dop_v1_* ]]; then
-        break
-      fi
-      fail "That does not look like a registry credential. Paste it exactly as it was sent"
-    done
-  fi
-
-  # THE DOWNLOAD STARTS NOW (see the block at the top of this file).
-  if [ "$DOCKER_OK" = "1" ]; then
-    local login_err
-    if login_err=$(echo "$DOCR_TOKEN" | docker login "$DOCR_REGISTRY" -u "${DOCR_USER:-$DOCR_TOKEN}" --password-stdin 2>&1 >/dev/null); then
-      start_background_pull
-      echo ""
-      echo -e "  ${CYAN}⬇${NC} ${DIM}Platform images are downloading in the background while you configure${NC}"
-      echo ""
-    else
-      # The REASON, not just the fact: a swallowed docker error left "login failed"
-      # undiagnosable when create had just validated the same credential.
-      warn "Registry login failed. Images will not pull until it is fixed"
-      echo "$login_err" | grep -vi "warning" | head -3 | sed 's/^/      /'
-    fi
-  fi
-
-  # A DEFAULT, because "from your admin" is meaningless when you are the admin. The
-  # platform ships no database (docker-compose has no postgres), so this points at one
-  # you run. Enter takes the conventional local one.
-  DB_DEFAULT=$(_env_cur DATABASE_URL)
-  DB_DEFAULT="${DB_DEFAULT:-postgres://postgres:postgres@localhost:5432/unoverse}"
-  while true; do
-    read -p "  DATABASE_URL [${DB_DEFAULT}]: " DATABASE_URL || { fail "no input (end of stream). Run unoverse init interactively"; exit 1; }
-    DATABASE_URL="${DATABASE_URL:-$DB_DEFAULT}"
-    if [ -n "$DATABASE_URL" ] && [[ "$DATABASE_URL" != *"user:password"* ]]; then
-      break
-    fi
-    fail "DATABASE_URL is required. Get it from your Unoverse admin"
-  done
-
-  # Auto-add SSL params if missing
-  if [[ "$DATABASE_URL" != *"sslmode="* ]] && [[ "$DATABASE_URL" != *"ssl="* ]]; then
-    local sep="?"
-    [[ "$DATABASE_URL" == *"?"* ]] && sep="&"
-    if [[ "$DATABASE_URL" == *"localhost"* ]] || \
-       [[ "$DATABASE_URL" == *"127.0.0.1"* ]] || \
-       [[ "$DATABASE_URL" == *"host.docker.internal"* ]]; then
-      DATABASE_URL="${DATABASE_URL}${sep}sslmode=disable"
-      ok "Local database detected. Added sslmode=disable"
-    else
-      DATABASE_URL="${DATABASE_URL}${sep}sslmode=require"
-      ok "Managed database detected. Added sslmode=require"
-    fi
-  fi
-
-  pull_status_line
-  # Redis, current values as defaults
-  local rd
-  rd=$(_env_cur REDIS_HOST); rd="${rd:-host.docker.internal}"
-  read -p "  REDIS_HOST [$rd]: " REDIS_HOST
-  REDIS_HOST="${REDIS_HOST:-$rd}"
-
-  rd=$(_env_cur REDIS_PORT); rd="${rd:-6379}"
-  read -p "  REDIS_PORT [$rd]: " REDIS_PORT
-  REDIS_PORT="${REDIS_PORT:-$rd}"
-
-  rd=$(_env_cur REDIS_PASSWORD)
-  if [ -n "$rd" ]; then
-    read -p "  REDIS_PASSWORD [keep current]: " REDIS_PASSWORD
-    REDIS_PASSWORD="${REDIS_PASSWORD:-$rd}"
-  else
-    read -p "  REDIS_PASSWORD (blank for none): " REDIS_PASSWORD
-  fi
-
-  rd=$(_env_cur REDIS_TLS); rd="${rd:-false}"
-  read -p "  REDIS_TLS [$rd]: " REDIS_TLS
-  REDIS_TLS="${REDIS_TLS:-$rd}"
-
-  # Auth (required — from admin)
-  # ASK BEFORE DEMANDING. A developer trying the platform locally has no identity
-  # provider yet, and AUTH_ISSUER was required, so init could not be completed at all.
-  #
-  # This is a LOCAL switch only. INFRASTRUCTURE.md is explicit that auth is always on for
-  # a deployed universe ("there is no auth-off deployment"), and the platform enforces it
-  # rather than trusting this wizard: authConfig.ts refuses to start with auth off when
-  # NODE_ENV=production. So answering "no" here cannot produce an unprotected deployment.
-  pull_status_line
-  local cur_auth idp_prompt
-  cur_auth=$(_env_cur AUTH_ENABLED)
-  idp_prompt="[y/N]"
-  [ "$cur_auth" = "true" ] && idp_prompt="[Y/n]"
-  read -r -p "  Do you have an identity provider (Auth0/OIDC) to connect? $idp_prompt " HAS_IDP
-  echo ""
-  if [ -z "$HAS_IDP" ] && [ "$cur_auth" = "true" ]; then HAS_IDP=y; fi
-
-  if [[ "$HAS_IDP" =~ ^[Yy]$ ]]; then
-    AUTH_ENABLED=true
-    local cur_iss cur_cid cur_aud
-    cur_iss=$(_env_cur AUTH_ISSUER)
-    cur_cid=$(_env_cur AUTH_CLIENT_ID)
-    cur_aud=$(_env_cur AUTH_AUDIENCE)
-
-    while true; do
-      if [ -n "$cur_iss" ]; then
-        read -p "  AUTH_ISSUER [$cur_iss]: " AUTH_ISSUER || { fail "no input (end of stream). Run unoverse init interactively"; exit 1; }
-        AUTH_ISSUER="${AUTH_ISSUER:-$cur_iss}"
-      else
-        read -p "  AUTH_ISSUER (e.g. https://your-tenant.auth0.com): " AUTH_ISSUER || { fail "no input (end of stream). Run unoverse init interactively"; exit 1; }
-      fi
-      if [ -n "$AUTH_ISSUER" ] && [[ "$AUTH_ISSUER" == https://* ]]; then
-        break
-      fi
-      fail "AUTH_ISSUER must be an https:// URL from your identity provider"
-    done
-
-    while true; do
-      if [ -n "$cur_cid" ]; then
-        read -p "  AUTH_CLIENT_ID [$cur_cid]: " AUTH_CLIENT_ID || { fail "no input (end of stream). Run unoverse init interactively"; exit 1; }
-        AUTH_CLIENT_ID="${AUTH_CLIENT_ID:-$cur_cid}"
-      else
-        read -p "  AUTH_CLIENT_ID: " AUTH_CLIENT_ID || { fail "no input (end of stream). Run unoverse init interactively"; exit 1; }
-      fi
-      if [ -n "$AUTH_CLIENT_ID" ] && [[ "$AUTH_CLIENT_ID" != *"your-"* ]]; then
-        break
-      fi
-      fail "AUTH_CLIENT_ID is required"
-    done
-
-    cur_aud="${cur_aud:-gravity-api}"
-    read -p "  AUTH_AUDIENCE [$cur_aud]: " AUTH_AUDIENCE
-    AUTH_AUDIENCE="${AUTH_AUDIENCE:-$cur_aud}"
-  else
-    AUTH_ENABLED=false
-    AUTH_ISSUER=""
-    AUTH_CLIENT_ID=""
-    AUTH_AUDIENCE="gravity-api"
-    warn "Auth is OFF for local development"
-    info "Deploying needs it: ${BOLD}unoverse deploy${NC} runs with auth on, and the server refuses to start without it in production"
-  fi
-
-  # NOT ASKED. 4105 is the port docker-compose publishes, so locally this is a fact the
-  # CLI already knows, and confirming it is not a question. A DEPLOYED universe gets its
-  # own API_URL rendered into .env.production by Terraform, which never comes through here.
-  API_URL="http://localhost:4105"
-
-  # DERIVED FROM THE FOLDER, not hardcoded. Every key the memory server writes is
-  # prefixed with this, so two universes sharing one Redis and the same namespace mix
-  # their streams and caches. It used to be written as a literal `gravity` for every
-  # local universe, while Terraform rendered `universe` for deployed ones: same Redis,
-  # same prefix, silently interleaved.
-  REDIS_NAMESPACE=$(basename "$ROOT" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9-' '-' | sed 's/-*$//')
-  REDIS_NAMESPACE="${REDIS_NAMESPACE:-universe}"
-  ok "Redis namespace: ${BOLD}${REDIS_NAMESPACE}${NC}"
-
-  # OpenAI (for Memory Server)
-  pull_status_line
-  local cur_oai
-  cur_oai=$(_env_cur OPENAI_API_KEY)
-  # NOT just the memory server: compose hands this to the unoverse service itself —
-  # agents, embeddings and memory all run on it. A universe boots without it, but its AI
-  # does not, so skipping gets a warning rather than silence.
-  if [ -n "$cur_oai" ]; then
-    read -p "  OPENAI_API_KEY [keep current]: " OPENAI_API_KEY
-    OPENAI_API_KEY="${OPENAI_API_KEY:-$cur_oai}"
-  else
-    read -p "  OPENAI_API_KEY (powers the platform's AI): " OPENAI_API_KEY
-    [ -z "$OPENAI_API_KEY" ] && warn "No OpenAI key: the universe starts, but agents, embeddings and memory will not work until one is in .env"
-  fi
-
-  # Node vendor keys, OPTIONAL: only the matching nodes need them, nothing platform-level
-  # does. Asked so compose stops warning about them and so they land in .env with names.
-  local cur_hb
-  cur_hb=$(_env_cur HYPERBROWSER_API_KEY)
-  if [ -n "$cur_hb" ]; then
-    read -p "  HYPERBROWSER_API_KEY [keep current]: " HYPERBROWSER_API_KEY
-    HYPERBROWSER_API_KEY="${HYPERBROWSER_API_KEY:-$cur_hb}"
-  else
-    read -p "  HYPERBROWSER_API_KEY (browser nodes, blank to skip): " HYPERBROWSER_API_KEY
-  fi
-
-
-  # A silent fact, not a question: the encryption key is GENERATED (a human never types
-  # one) and kept verbatim on re-runs — a new key orphans every stored credential.
-  CREDENTIAL_ENCRYPTION_KEY=$(_env_cur CREDENTIAL_ENCRYPTION_KEY)
-  if [ -z "$CREDENTIAL_ENCRYPTION_KEY" ]; then
-    CREDENTIAL_ENCRYPTION_KEY=$(openssl rand -hex 32 2>/dev/null || head -c32 /dev/urandom | xxd -p -c64)
-    ok "Credential encryption key generated"
-  fi
-  # Write .env
-  cat > "$ROOT/.env" << ENVEOF
-# Generated by unoverse init
-DOCR_TOKEN=${DOCR_TOKEN}
-DOCR_USER=${DOCR_USER:-${DOCR_TOKEN}}
-DATABASE_URL=${DATABASE_URL}
-REDIS_HOST=${REDIS_HOST}
-REDIS_PORT=${REDIS_PORT}
-REDIS_PASSWORD=${REDIS_PASSWORD}
-REDIS_TLS=${REDIS_TLS}
-REDIS_NAMESPACE=${REDIS_NAMESPACE}
-AUTH_ENABLED=${AUTH_ENABLED}
-AUTH_ISSUER=${AUTH_ISSUER}
-AUTH_CLIENT_ID=${AUTH_CLIENT_ID}
-AUTH_AUDIENCE=${AUTH_AUDIENCE}
-API_URL=${API_URL}
-OPENAI_API_KEY=${OPENAI_API_KEY}
-# Generated at setup: encrypts credentials stored by nodes. Losing it orphans them —
-# back it up with the database. Kept on re-runs.
-CREDENTIAL_ENCRYPTION_KEY=${CREDENTIAL_ENCRYPTION_KEY}
-HYPERBROWSER_API_KEY=${HYPERBROWSER_API_KEY}
-DOMAIN=
-ENVEOF
-
-  ok ".env created"
-
-  # Attach to the background pull started when the token was accepted: layers already
-  # down show as complete, the rest stream docker's progress bars. Without a daemon the
-  # token is in .env, and `unoverse start` pulls on its first run.
-  if [ "$DOCKER_OK" = "1" ]; then
-    pull_missing_images
-    [ -n "$PULL_STATE" ] && rm -f "$PULL_STATE"
-  else
-    echo ""
-    info "Skipped the image download. ${BOLD}unoverse start${NC} does it once Docker is up"
-  fi
-
-  # Install to PATH
-  
-  # Done
-  echo ""
-  echo -e "  ${GREEN}${BOLD}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-  echo -e "  ${GREEN}${BOLD}  ✓ Setup Complete!${NC} ${DIM}($(timer_elapsed))${NC}"
-  echo -e "  ${GREEN}${BOLD}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-  # MIGRATIONS RUN HERE, so `db-setup` is not a command anyone has to know about. Deploy
-  # already ran them on the server (playbooks/db-setup.yml); this is the local half.
-  # A database that is not reachable yet is not a failed setup — .env is written and
-  # correct, so say so and move on rather than unwinding everything.
-  echo ""
-  # SUBSHELL, deliberately: cmd_db_setup exits on "services not up yet", and an exit in a
-  # sourced function would take all of init with it — setup then reported failure for a
-  # situation that just means "migrations run on start". Which they now do (start.sh).
-  if grep -q '^DATABASE_URL=' "$ROOT/.env" 2>/dev/null; then
-    # Quietly: db-setup narrates its own advice ("start services first, then re-run"),
-    # which contradicts and duplicates the one line that is true here.
-    if (cmd_db_setup) >/dev/null 2>&1; then
-      ok "Database schema is up to date"
-    else
-      info "Migrations wait for the platform: ${BOLD}unoverse start${NC} applies them once services are up"
-    fi
-  fi
-
-  echo ""
-  echo -e "  ${BOLD}Next steps:${NC}"
-  echo ""
-  if [ "$DOCKER_OK" = "1" ]; then
-    echo -e "    ${GREEN}unoverse start${NC}     Start the platform"
-  else
-    echo -e "    ${DIM}1.${NC} Start Docker Desktop"
-    echo -e "    ${DIM}2.${NC} ${GREEN}unoverse start${NC}"
-  fi
-  echo -e "    ${GREEN}unoverse where${NC}     Links to your Canvas and API"
-  echo ""
-  info "Run ${BOLD}unoverse check${NC} anytime to see if it is healthy"
-  info "Change a setting any time: edit ${BOLD}.env${NC} directly, or re-run ${BOLD}unoverse create${NC} (Enter keeps each current value)"
-  echo ""
-}