unoverse 0.1.121 → 0.1.123

package/operator/docker-compose.yml

@@ -184,7 +184,15 @@ services:
       # configures.
       - AUTH_ENABLED=${AUTH_ENABLED:-}
       - AUTH_ISSUER=${AUTH_ISSUER:-}
+      # AND SO DOES THE CLIENT ID. It is documented everywhere as a browser value
+      # (VITE_AUTH_CLIENT_ID) because for a long time only the browser needed it. The
+      # server needs it now: `/.well-known/unoverse-universe` is how Studio learns where
+      # to send someone to sign in, and it answers from AUTH_CLIENT_ID. Unforwarded, that
+      # endpoint returned `clientId: null` and Studio correctly refused to connect,
+      # against a universe whose .env had the value all along. Public by definition — an
+      # OAuth client id is not a secret.
       - AUTH_AUDIENCE=${AUTH_AUDIENCE:-}
+      - AUTH_CLIENT_ID=${AUTH_CLIENT_ID:-}
       # WHERE THE MARKETPLACE IS. The catalogue this universe can install from, served as
       # static files (catalogue.json plus each item's own definition). No default: a baked
       # URL ties the image to one deployment and hides a missing setting. Empty means no
@@ -306,7 +314,15 @@ services:
       # configures.
       - AUTH_ENABLED=${AUTH_ENABLED:-}
       - AUTH_ISSUER=${AUTH_ISSUER:-}
+      # AND SO DOES THE CLIENT ID. It is documented everywhere as a browser value
+      # (VITE_AUTH_CLIENT_ID) because for a long time only the browser needed it. The
+      # server needs it now: `/.well-known/unoverse-universe` is how Studio learns where
+      # to send someone to sign in, and it answers from AUTH_CLIENT_ID. Unforwarded, that
+      # endpoint returned `clientId: null` and Studio correctly refused to connect,
+      # against a universe whose .env had the value all along. Public by definition — an
+      # OAuth client id is not a secret.
       - AUTH_AUDIENCE=${AUTH_AUDIENCE:-}
+      - AUTH_CLIENT_ID=${AUTH_CLIENT_ID:-}
       - OPENAI_API_KEY=${OPENAI_API_KEY:-}
       - WORKFLOW_SERVICE_URL=http://unoverse:4101
     labels:

package/operator/infra/aws/main.tf

@@ -318,8 +318,28 @@ resource "aws_db_instance" "postgres" {
 
   backup_retention_period   = 7
   backup_window             = "03:00-04:00"
-  skip_final_snapshot       = false
-  final_snapshot_identifier = "${var.name}-pg-final"
+  # NO FINAL SNAPSHOT, which is what `unoverse destroy` already promises: "this deletes data
+  # that no backup here can restore" (destroy.sh). The code said otherwise, and the two
+  # disagreed silently.
+  #
+  # A FIXED snapshot name cannot survive a SECOND teardown. `<name>-pg-final` derives only
+  # from the universe name, so teardown one creates it, it persists for ever, and teardown
+  # two is rejected by AWS before the delete even starts:
+  #
+  #   Cannot create the snapshot because a snapshot with the identifier
+  #   unoversedevtest-pg-final already exists
+  #
+  # The instance then sits at `available`, never `deleting`, and everything behind it
+  # strands: the data SG holds its network interface, the app SG is referenced by data's
+  # rules, the alb SG by app's. One rejected call, five resources left billing, and a
+  # teardown that reports it did not finish without saying why. Found 2026-08-05, blocked by
+  # a snapshot a teardown three days earlier had left behind.
+  #
+  # Making the name unique would need a new resource (a random suffix), and `terraform
+  # destroy` cannot create one on its way past. A one-command teardown means no snapshot.
+  # Automated backups (7 days, above) live and die with the instance: take a MANUAL snapshot
+  # before destroying if you want to keep anything.
+  skip_final_snapshot = true
   # POC: no deletion_protection so teardown stays one command. Turn it on at graduation.
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.121",
+  "version": "0.1.123",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",