unoverse 0.1.102 → 0.1.104

package/operator/infra/aws/main.tf

@@ -11,6 +11,9 @@ terraform {
     aws     = { source = "hashicorp/aws", version = ">= 5.83, < 6.0" }
     random  = { source = "hashicorp/random", version = "~> 3.6" }
     archive = { source = "hashicorp/archive", version = "~> 2.4" }
+    # For the IAM propagation wait below. IAM is eventually consistent and Lambda is the
+    # one resource here that reliably outruns it.
+    time = { source = "hashicorp/time", version = "~> 0.11" }
   }
 }
 
@@ -369,7 +372,19 @@ resource "aws_iam_role_policy_attachment" "pretoken_logs" {
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
 }
 
+# IAM IS EVENTUALLY CONSISTENT, AND LAMBDA OUTRUNS IT. The role is created, Lambda is
+# created two seconds later, and AWS answers "The role defined for the function cannot be
+# assumed by Lambda" — the role is correct and simply not visible yet. Terraform's
+# dependency graph is satisfied because the role exists; AWS's own propagation is not.
+#
+# Ten seconds is the usual advice and it costs ten seconds on a first apply only.
+resource "time_sleep" "iam_propagation" {
+  depends_on      = [aws_iam_role.pretoken, aws_iam_role_policy_attachment.pretoken_logs]
+  create_duration = "10s"
+}
+
 resource "aws_lambda_function" "pretoken" {
+  depends_on       = [time_sleep.iam_propagation]
   function_name    = "${var.name}-pretoken"
   role             = aws_iam_role.pretoken.arn
   runtime          = "nodejs20.x"

package/operator/lib/deploy.sh

@@ -563,7 +563,7 @@ _ground_apply() {
   echo ""
   info "Building. Managed databases take a few minutes on the provider's side"
   echo ""
-  terraform -chdir="$dir" apply -input=false "$planfile" || { fail "The build did not finish. Re-run: unoverse deploy"; rm -rf "$tmp"; return 1; }
+  terraform -chdir="$dir" apply -input=false "$planfile" || { fail "The build did not finish. Nothing already built is lost — re-run: unoverse deploy $cloud"; rm -rf "$tmp"; return 1; }
   rm -rf "$tmp"
   return 0
 }

package/operator/lib/tfsummary.mjs

@@ -141,26 +141,43 @@ process.stdin.on("end", () => {
 
   const groups = { create: [], update: [], delete: [], replace: [] };
   const supporting = { create: 0, update: 0, delete: 0, replace: 0 };
+  // LOSING SOMETHING IS NEVER ANONYMOUS. Counting the plumbing is right when things are
+  // being built — nobody needs eleven IAM attachments enumerated. It is wrong the moment
+  // anything is destroyed or replaced: "plus 1 supporting resource" was a security group
+  // about to be deleted, and the operator hit Ctrl-C when Terraform printed "Destroying"
+  // for something the summary had not named. Anything being taken away is listed.
+  const named = { delete: [], replace: [] };
 
   for (const r of plan.resource_changes ?? []) {
     const act = action(r.change ?? {});
     if (!act) continue;
     const d = describe(r);
     if (d) groups[act].push(d);
-    else supporting[act]++;
+    else if (act === "delete" || act === "replace") {
+      // Turn the terraform type into something readable: aws_security_group → security group
+      const label = r.type.replace(/^(aws|digitalocean|random|time|archive)_/, "").replace(/_/g, " ");
+      const v = r.change?.before ?? r.change?.after ?? {};
+      named[act].push({ what: label.charAt(0).toUpperCase() + label.slice(1), detail: v.name ?? v.id ?? "" });
+    } else supporting[act]++;
   }
 
-  const total = Object.values(groups).flat().length + Object.values(supporting).reduce((a, b) => a + b, 0);
+  const total = Object.values(groups).flat().length
+    + Object.values(supporting).reduce((a, b) => a + b, 0)
+    + named.delete.length + named.replace.length;
   const out = [];
   if (total === 0) {
     console.log(`\n  ${green("●")} Your infrastructure already matches. Nothing to change.\n`);
     return;
   }
 
-  const width = Math.max(...Object.values(groups).flat().map((d) => d.what.length), 0) + 2;
+  const width = Math.max(
+    ...Object.values(groups).flat().map((d) => d.what.length),
+    ...named.delete.map((d) => d.what.length),
+    ...named.replace.map((d) => d.what.length),
+    0) + 2;
 
   for (const act of ["create", "update", "replace", "delete"]) {
-    const list = groups[act];
+    const list = [...groups[act], ...(named[act] ?? [])];
     const extra = supporting[act];
     if (!list.length && !extra) continue;
     const colour = act === "delete" || act === "replace" ? red : act === "update" ? yellow : green;
@@ -194,6 +211,6 @@ process.stdin.on("end", () => {
   // something is not. `process.exitCode` rather than `process.exit`, which can cut off
   // the output above while it is still draining down a pipe.
   const destructive =
-    groups.delete.length + groups.replace.length + supporting.delete + supporting.replace;
+    groups.delete.length + groups.replace.length + named.delete.length + named.replace.length;
   if (destructive) process.exitCode = 3;
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.102",
+  "version": "0.1.104",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",