unoverse 0.1.102 → 0.1.103

package/operator/infra/aws/main.tf

@@ -11,6 +11,9 @@ terraform {
     aws     = { source = "hashicorp/aws", version = ">= 5.83, < 6.0" }
     random  = { source = "hashicorp/random", version = "~> 3.6" }
     archive = { source = "hashicorp/archive", version = "~> 2.4" }
+    # For the IAM propagation wait below. IAM is eventually consistent and Lambda is the
+    # one resource here that reliably outruns it.
+    time = { source = "hashicorp/time", version = "~> 0.11" }
   }
 }
 
@@ -369,7 +372,19 @@ resource "aws_iam_role_policy_attachment" "pretoken_logs" {
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
 }
 
+# IAM IS EVENTUALLY CONSISTENT, AND LAMBDA OUTRUNS IT. The role is created, Lambda is
+# created two seconds later, and AWS answers "The role defined for the function cannot be
+# assumed by Lambda" — the role is correct and simply not visible yet. Terraform's
+# dependency graph is satisfied because the role exists; AWS's own propagation is not.
+#
+# Ten seconds is the usual advice and it costs ten seconds on a first apply only.
+resource "time_sleep" "iam_propagation" {
+  depends_on      = [aws_iam_role.pretoken, aws_iam_role_policy_attachment.pretoken_logs]
+  create_duration = "10s"
+}
+
 resource "aws_lambda_function" "pretoken" {
+  depends_on       = [time_sleep.iam_propagation]
   function_name    = "${var.name}-pretoken"
   role             = aws_iam_role.pretoken.arn
   runtime          = "nodejs20.x"

package/operator/lib/deploy.sh

@@ -563,7 +563,7 @@ _ground_apply() {
   echo ""
   info "Building. Managed databases take a few minutes on the provider's side"
   echo ""
-  terraform -chdir="$dir" apply -input=false "$planfile" || { fail "The build did not finish. Re-run: unoverse deploy"; rm -rf "$tmp"; return 1; }
+  terraform -chdir="$dir" apply -input=false "$planfile" || { fail "The build did not finish. Nothing already built is lost — re-run: unoverse deploy $cloud"; rm -rf "$tmp"; return 1; }
   rm -rf "$tmp"
   return 0
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.102",
+  "version": "0.1.103",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",