unoverse 0.1.125 → 0.1.127

package/operator/infra/aws/main.tf

@@ -271,6 +271,28 @@ resource "aws_instance" "app" {
     volume_type = "gp3"
   }
 
+  # IMDSv2 REQUIRED, and this is not optional in a governed account.
+  #
+  # AWS's own recommended guardrail denies ec2:RunInstances unless the launch enforces
+  # IMDSv2, and organisations apply it as a Service Control Policy. Without this block the
+  # AWS default is `optional`, the condition is not met, and the deny fires:
+  #
+  #   UnauthorizedOperation ... ec2:RunInstances ... with an explicit deny in a service
+  #   control policy
+  #
+  # That error names no condition, so it reads as "EC2 is banned here" and sends you to your
+  # cloud team for a policy change you do not need. The condition is visible only by
+  # decoding the failure message (`aws sts decode-authorization-message`), which showed
+  # `ec2:MetadataHttpTokens = required`. Proved by dry run 2026-08-06: identical launch
+  # refused without this block, accepted with it.
+  #
+  # It is the right default everywhere regardless. IMDSv1 lets any process that can forge a
+  # simple GET read the instance's credentials; IMDSv2 requires a signed token first.
+  metadata_options {
+    http_endpoint = "enabled"
+    http_tokens   = "required"
+  }
+
   tags = { Name = "${var.name}-app" }
 }
 
@@ -589,10 +611,25 @@ resource "aws_iam_user_policy" "bedrock" {
     Version = "2012-10-17"
     Statement = [{
       Effect = "Allow"
+      # WIDE ON RUNTIME, silent on spending.
+      #
+      # Three named Invoke actions dated fast. `Converse` is the current unified API and the
+      # Bedrock nodes already call it; `ApplyGuardrail` is a separate action the guardrail
+      # node needs; knowledge bases add `Retrieve`. Each arrival meant editing this list,
+      # re-applying, and in a managed account asking an administrator again.
+      #
+      # NOT `bedrock:*`. That includes CreateProvisionedModelThroughput, which commits money.
+      # Everything below is invoke-and-read: it cannot buy capacity, and it cannot create or
+      # delete a model or a guardrail.
+      #
+      # Model access is still granted per model in the Bedrock console. No policy grants it.
       Action = [
-        "bedrock:InvokeModel",
-        "bedrock:InvokeModelWithResponseStream",
-        "bedrock:InvokeModelWithBidirectionalStream",
+        "bedrock:InvokeModel*",
+        "bedrock:Converse*",
+        "bedrock:ApplyGuardrail",
+        "bedrock:Retrieve*",
+        "bedrock:List*",
+        "bedrock:Get*",
       ]
       Resource = "*"
     }]

package/operator/lib/destroy.sh

@@ -18,6 +18,84 @@
 # It never touches the developer's terraform.tfvars, their .env, or their code. Only the
 # cloud resources this ground owns.
 
+# ── Resources a previous run created and did not write down ───────────────────────────────
+#
+# `destroy` removes what STATE records. A deploy killed mid-apply leaves AWS holding
+# resources terraform never recorded, and they do not merely linger: a database or a load
+# balancer keeps a security group alive, so the part terraform CAN do fails on
+#
+#   DependencyViolation: resource sg-... has a dependent object
+#
+# after fifteen minutes of retrying, and the teardown reports only that it did not finish.
+# The operator is then left deleting a database, a Redis cluster and a load balancer by hand
+# before a "one command" teardown will complete. That happened on 2026-08-05.
+#
+# IT IMPORTS. IT NEVER DELETES.
+#
+# Adopting an orphan into state is a state write and touches no cloud API. The deletion is
+# still terraform's, from the plan the operator sees and confirms by name. That matters twice
+# over: terraform already knows the order to take this stack apart (load balancer before its
+# security group, database before the group holding its interface), and a second deletion
+# engine written in bash would not, and would drift from main.tf the day a resource was
+# added.
+#
+# NOTHING WE DID NOT CREATE, enforced four ways rather than trusted:
+#
+#   1. TAGGED AS OURS. `_cloud_orphans` lists only what carries `Universe=<name>`, and
+#      `default_tags` stamps that on resources THIS configuration creates. A borrowed
+#      database keeps its own tags and can never appear here (main.tf, "Borrowed resources
+#      are never owned").
+#   2. A KNOWN ADDRESS. The ARN must map to one of the handful of resources main.tf declares.
+#      Anything else is left alone, whatever it is tagged.
+#   3. NAMED AFTER THIS UNIVERSE. The ARN must contain the universe's own name, which is why
+#      `aws_instance.app` is deliberately absent below: an EC2 ARN carries only an opaque
+#      instance id, so it cannot be verified this way, and an unverifiable match is not one
+#      worth making. An untracked server is reported instead.
+#   4. NOT ALREADY TRACKED. An address present in state is skipped, so this can only ever add
+#      what is missing, never re-point something the operator already owns.
+#
+# Failure is not fatal anywhere in here: the worst case is the teardown behaving exactly as
+# it did before.
+_adopt_orphans() {
+  local dir="$1" uname_="$2" orphans arn addr id adopted=0 unclaimed=""
+
+  command -v aws >/dev/null 2>&1 || return 0
+  orphans=$(_cloud_orphans aws "$uname_" 2>/dev/null)
+  [ -n "$orphans" ] && [ "$orphans" != "unknown" ] || return 0
+
+  while IFS= read -r arn; do
+    [ -n "$arn" ] || continue
+    addr=""; id="$arn"
+    case "$arn" in
+      *:rds:*:db:"$uname_"-pg)                              addr="aws_db_instance.postgres";               id="$uname_-pg" ;;
+      *:elasticache:*:replicationgroup:"$uname_"-redis)     addr="aws_elasticache_replication_group.redis"; id="$uname_-redis" ;;
+      *:loadbalancer/app/"$uname_"-alb/*)                   addr="aws_lb.public" ;;
+      *:targetgroup/"$uname_"-app/*)                        addr="aws_lb_target_group.app" ;;
+      *:targetgroup/"$uname_"-canvas/*)                     addr="aws_lb_target_group.canvas[0]" ;;
+      *)                                                    unclaimed="$unclaimed  $arn"$'\n' ; continue ;;
+    esac
+    terraform -chdir="$dir" state list 2>/dev/null | grep -qxF "$addr" && continue
+    if terraform -chdir="$dir" import -input=false "$addr" "$id" >/dev/null 2>&1; then
+      adopted=$((adopted + 1))
+    else
+      unclaimed="$unclaimed  $arn"$'\n'
+    fi
+  done <<EOF
+$orphans
+EOF
+
+  [ "$adopted" -gt 0 ] && \
+    info "Adopted $adopted resource(s) an interrupted run left untracked. They are in the plan below"
+  # SAID OUT LOUD, never silently swept. Anything here is billing and this teardown will not
+  # remove it, which the operator has to know BEFORE they are told the universe is gone.
+  if [ -n "$unclaimed" ]; then
+    warn "these carry this universe's tag but are not resources this teardown can remove:"
+    printf '%s' "$unclaimed"
+    echo "      Check them yourself before assuming the bill has stopped."
+  fi
+  return 0
+}
+
 cmd_destroy() {
   # NAME THE GROUND. This took the first configured one, and digitalocean is first in the
   # list — so an operator with both grounds who typed `unoverse destroy` meaning AWS would
@@ -46,9 +124,19 @@ cmd_destroy() {
   echo -e "  ${RED}${BOLD}⬡ Taking down your $pretty universe${NC}"
   echo ""
 
-  local tmp planfile rc
+  local tmp planfile rc name
   tmp=$(mktemp -d); planfile="$tmp/plan"
 
+  # The universe's name, read once. It is the tag every resource carries, so it is what
+  # decides which untracked resources are this universe's (_adopt_orphans) as well as the
+  # word the operator types to confirm.
+  name=$(grep -E '^name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+  name="${name:-universe}"
+
+  # BEFORE THE PLAN, so what an interrupted run left behind is in the list the operator
+  # confirms, rather than something they discover by hand an hour later.
+  [ "$cloud" = "aws" ] && _adopt_orphans "$dir" "$name"
+
   # APPLY THE CONFIGURATION TO THE DATABASE FIRST, because destroy does not.
   #
   # `terraform destroy` deletes a resource as the last apply left it, so an attribute that
@@ -98,10 +186,6 @@ cmd_destroy() {
     info "Staying: ${BOLD}your own database${NC} ${DIM}(byo_postgres_url — this stack never owned it)${NC}"
   fi
 
-  local name
-  name=$(grep -E '^name[[:space:]]*=' "$dir/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
-  name="${name:-universe}"
-
   echo ""
   # Say what is actually lost. With a reused cluster the DATABASE survives, and claiming
   # otherwise makes the warning untrue in the commonest case — which teaches people to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.125",
+  "version": "0.1.127",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",