unoverse 0.1.124 → 0.1.126

package/operator/lib/destroy.sh

@@ -18,6 +18,84 @@
 # It never touches the developer's terraform.tfvars, their .env, or their code. Only the
 # cloud resources this ground owns.
 
+# ── Resources a previous run created and did not write down ───────────────────────────────
+#
+# `destroy` removes what STATE records. A deploy killed mid-apply leaves AWS holding
+# resources terraform never recorded, and they do not merely linger: a database or a load
+# balancer keeps a security group alive, so the part terraform CAN do fails on
+#
+#   DependencyViolation: resource sg-... has a dependent object
+#
+# after fifteen minutes of retrying, and the teardown reports only that it did not finish.
+# The operator is then left deleting a database, a Redis cluster and a load balancer by hand
+# before a "one command" teardown will complete. That happened on 2026-08-05.
+#
+# IT IMPORTS. IT NEVER DELETES.
+#
+# Adopting an orphan into state is a state write and touches no cloud API. The deletion is
+# still terraform's, from the plan the operator sees and confirms by name. That matters twice
+# over: terraform already knows the order to take this stack apart (load balancer before its
+# security group, database before the group holding its interface), and a second deletion
+# engine written in bash would not, and would drift from main.tf the day a resource was
+# added.
+#
+# NOTHING WE DID NOT CREATE, enforced four ways rather than trusted:
+#
+#   1. TAGGED AS OURS. `_cloud_orphans` lists only what carries `Universe=<name>`, and
+#      `default_tags` stamps that on resources THIS configuration creates. A borrowed
+#      database keeps its own tags and can never appear here (main.tf, "Borrowed resources
+#      are never owned").
+#   2. A KNOWN ADDRESS. The ARN must map to one of the handful of resources main.tf declares.
+#      Anything else is left alone, whatever it is tagged.
+#   3. NAMED AFTER THIS UNIVERSE. The ARN must contain the universe's own name, which is why
+#      `aws_instance.app` is deliberately absent below: an EC2 ARN carries only an opaque
+#      instance id, so it cannot be verified this way, and an unverifiable match is not one
+#      worth making. An untracked server is reported instead.
+#   4. NOT ALREADY TRACKED. An address present in state is skipped, so this can only ever add
+#      what is missing, never re-point something the operator already owns.
+#
+# Failure is not fatal anywhere in here: the worst case is the teardown behaving exactly as
+# it did before.
+_adopt_orphans() {
+  local dir="$1" uname_="$2" orphans arn addr id adopted=0 unclaimed=""
+
+  command -v aws >/dev/null 2>&1 || return 0
+  orphans=$(_cloud_orphans aws "$uname_" 2>/dev/null)
+  [ -n "$orphans" ] && [ "$orphans" != "unknown" ] || return 0
+
+  while IFS= read -r arn; do
+    [ -n "$arn" ] || continue
+    addr=""; id="$arn"
+    case "$arn" in
+      *:rds:*:db:"$uname_"-pg)                              addr="aws_db_instance.postgres";               id="$uname_-pg" ;;
+      *:elasticache:*:replicationgroup:"$uname_"-redis)     addr="aws_elasticache_replication_group.redis"; id="$uname_-redis" ;;
+      *:loadbalancer/app/"$uname_"-alb/*)                   addr="aws_lb.public" ;;
+      *:targetgroup/"$uname_"-app/*)                        addr="aws_lb_target_group.app" ;;
+      *:targetgroup/"$uname_"-canvas/*)                     addr="aws_lb_target_group.canvas[0]" ;;
+      *)                                                    unclaimed="$unclaimed  $arn"$'\n' ; continue ;;
+    esac
+    terraform -chdir="$dir" state list 2>/dev/null | grep -qxF "$addr" && continue
+    if terraform -chdir="$dir" import -input=false "$addr" "$id" >/dev/null 2>&1; then
+      adopted=$((adopted + 1))
+    else
+      unclaimed="$unclaimed  $arn"$'\n'
+    fi
+  done <<EOF
+$orphans
+EOF
+
+  [ "$adopted" -gt 0 ] && \
+    info "Adopted $adopted resource(s) an interrupted run left untracked. They are in the plan below"
+  # SAID OUT LOUD, never silently swept. Anything here is billing and this teardown will not
+  # remove it, which the operator has to know BEFORE they are told the universe is gone.
+  if [ -n "$unclaimed" ]; then
+    warn "these carry this universe's tag but are not resources this teardown can remove:"
+    printf '%s' "$unclaimed"
+    echo "      Check them yourself before assuming the bill has stopped."
+  fi
+  return 0
+}
+
 cmd_destroy() {
   # NAME THE GROUND. This took the first configured one, and digitalocean is first in the
   # list — so an operator with both grounds who typed `unoverse destroy` meaning AWS would
@@ -46,10 +124,20 @@ cmd_destroy() {
   echo -e "  ${RED}${BOLD}⬡ Taking down your $pretty universe${NC}"
   echo ""
 
-  local tmp planfile rc
+  local tmp planfile rc name
   tmp=$(mktemp -d); planfile="$tmp/plan"
 
-  # APPLY THE CONFIGURATION FIRST, because destroy does not.
+  # The universe's name, read once. It is the tag every resource carries, so it is what
+  # decides which untracked resources are this universe's (_adopt_orphans) as well as the
+  # word the operator types to confirm.
+  name=$(grep -E '^name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  name="${name:-universe}"
+
+  # BEFORE THE PLAN, so what an interrupted run left behind is in the list the operator
+  # confirms, rather than something they discover by hand an hour later.
+  [ "$cloud" = "aws" ] && _adopt_orphans "$dir" "$name"
+
+  # APPLY THE CONFIGURATION TO THE DATABASE FIRST, because destroy does not.
   #
   # `terraform destroy` deletes a resource as the last apply left it, so an attribute that
   # matters only AT DELETE — RDS's `skip_final_snapshot` — comes from STATE, not from
@@ -57,10 +145,23 @@ cmd_destroy() {
   # already applied. Applying the config to the database writes those settings into state
   # and calls no API; the resource is deleted seconds later, so nothing else here matters.
   #
-  # It is the standard terraform answer (apply, then destroy) rather than a special case,
-  # and it is best-effort: if it fails, the destroy below reports the real problem.
-  [ "$cloud" = "aws" ] && terraform -chdir="$dir" apply -input=false -auto-approve \
-    -target=aws_db_instance.postgres >"$tmp/sync.log" 2>&1
+  # ONLY IF IT IS ALREADY IN STATE. Without that test this is not an update, it is a CREATE:
+  # `apply -target` on a resource the configuration declares and the state does not have
+  # builds it. So a teardown of a universe whose database had already gone — deleted by
+  # hand, or removed from state — silently provisioned a NEW one, with -auto-approve, on the
+  # way to being told to destroy everything. In state means the only possible change is to
+  # the resource's own attributes.
+  #
+  # ANNOUNCED, because it runs before the first progress line and terraform can sit on an
+  # RDS refresh for a while. Sending it to a log with nothing on screen made `unoverse
+  # destroy` look frozen at the banner.
+  if [ "$cloud" = "aws" ] \
+    && terraform -chdir="$dir" state list 2>/dev/null | grep -qx "aws_db_instance.postgres"; then
+    info "Checking the database's delete settings..."
+    terraform -chdir="$dir" apply -input=false -auto-approve \
+      -target=aws_db_instance.postgres >"$tmp/sync.log" 2>&1 \
+      || warn "could not update them; the teardown may stop on the database"
+  fi
 
   info "Working out what exists..."
   terraform -chdir="$dir" plan -destroy -input=false -detailed-exitcode -out="$planfile" >"$tmp/log" 2>&1
@@ -85,10 +186,6 @@ cmd_destroy() {
     info "Staying: ${BOLD}your own database${NC} ${DIM}(byo_postgres_url — this stack never owned it)${NC}"
   fi
 
-  local name
-  name=$(grep -E '^name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
-  name="${name:-universe}"
-
   echo ""
   # Say what is actually lost. With a reused cluster the DATABASE survives, and claiming
   # otherwise makes the warning untrue in the commonest case — which teaches people to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.124",
+  "version": "0.1.126",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",