unoverse 0.1.101 → 0.1.103

package/operator/infra/aws/main.tf

@@ -11,6 +11,9 @@ terraform {
     aws     = { source = "hashicorp/aws", version = ">= 5.83, < 6.0" }
     random  = { source = "hashicorp/random", version = "~> 3.6" }
     archive = { source = "hashicorp/archive", version = "~> 2.4" }
+    # For the IAM propagation wait below. IAM is eventually consistent and Lambda is the
+    # one resource here that reliably outruns it.
+    time = { source = "hashicorp/time", version = "~> 0.11" }
   }
 }
 
@@ -369,7 +372,19 @@ resource "aws_iam_role_policy_attachment" "pretoken_logs" {
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
 }
 
+# IAM IS EVENTUALLY CONSISTENT, AND LAMBDA OUTRUNS IT. The role is created, Lambda is
+# created two seconds later, and AWS answers "The role defined for the function cannot be
+# assumed by Lambda" — the role is correct and simply not visible yet. Terraform's
+# dependency graph is satisfied because the role exists; AWS's own propagation is not.
+#
+# Ten seconds is the usual advice and it costs ten seconds on a first apply only.
+resource "time_sleep" "iam_propagation" {
+  depends_on      = [aws_iam_role.pretoken, aws_iam_role_policy_attachment.pretoken_logs]
+  create_duration = "10s"
+}
+
 resource "aws_lambda_function" "pretoken" {
+  depends_on       = [time_sleep.iam_propagation]
   function_name    = "${var.name}-pretoken"
   role             = aws_iam_role.pretoken.arn
   runtime          = "nodejs20.x"

package/operator/lib/deploy.sh

@@ -366,6 +366,35 @@ _ensure_ground_config() {
     esac
   fi
 
+  # CAN THIS MACHINE ACTUALLY REACH WHAT IT IS ABOUT TO BUILD?
+  #
+  # An EC2 key pair the operator does not hold applies perfectly and then fails at the ship
+  # step: eleven minutes of RDS and ElastiCache provisioning, then "Permission denied
+  # (publickey)". Generating the ground correctly is not enough — tfvars is the developer's
+  # file and `unoverse update` never rewrites it, so a ground made before this check keeps
+  # its unusable key forever and fails the same way every time.
+  #
+  # Checked here, before the plan, because the cost of being wrong is money and eleven
+  # minutes, and the fix is one line in a file this command already edits.
+  if [ "$cloud" = "aws" ]; then
+    local named_key pub_key
+    named_key=$(grep -E '^ssh_key_name[[:space:]]*=' "$tfv" 2>/dev/null | sed -E 's/.*"([^"]*)".*/\1/')
+    if [ -n "$named_key" ] && ! grep -qE '^operator_public_key[[:space:]]*=[[:space:]]*"ssh-' "$tfv" 2>/dev/null; then
+      for pub_key in "$HOME/.ssh/id_ed25519.pub" "$HOME/.ssh/id_rsa.pub" ""; do
+        [ -n "$pub_key" ] && [ -f "$pub_key" ] && break
+      done
+      if [ -n "$pub_key" ]; then
+        node -e 'const fs=require("fs");const[f,v]=process.argv.slice(1);let s=fs.readFileSync(f,"utf8");
+          s=s.replace(/^ssh_key_name\s*=.*$/m,"ssh_key_name = \"\"  # empty = terraform uploads operator_public_key below\noperator_public_key = "+JSON.stringify(v)+"   # your key: the deploy ssh-es from this machine");
+          fs.writeFileSync(f,s)' "$tfv" "$(cat "$pub_key")"
+        ok "SSH key: your own ${DIM}($(basename "$pub_key") — replacing '"'"'$named_key'"'"', whose private half is not on this machine)${NC}"
+      else
+        warn "No ssh key on this machine. The deploy will build, then fail to reach the server"
+        info "Make one with ${BOLD}ssh-keygen -t ed25519${NC} and run this again"
+      fi
+    fi
+  fi
+
   _tf_fill docr_token     DOCR_TOKEN     "Registry access token (from your Unoverse admin)"
   _tf_fill openai_api_key OPENAI_API_KEY "OPENAI_API_KEY (powers the platform's AI)"
   if grep -q '^auth_issuer[[:space:]]*=[[:space:]]*"FILL_ME"' "$tfv" 2>/dev/null; then
@@ -534,7 +563,7 @@ _ground_apply() {
   echo ""
   info "Building. Managed databases take a few minutes on the provider's side"
   echo ""
-  terraform -chdir="$dir" apply -input=false "$planfile" || { fail "The build did not finish. Re-run: unoverse deploy"; rm -rf "$tmp"; return 1; }
+  terraform -chdir="$dir" apply -input=false "$planfile" || { fail "The build did not finish. Nothing already built is lost — re-run: unoverse deploy $cloud"; rm -rf "$tmp"; return 1; }
   rm -rf "$tmp"
   return 0
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.101",
+  "version": "0.1.103",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",