unoverse 0.1.127 → 0.1.129

package/operator/infra/aws/main.tf

@@ -600,13 +600,27 @@ resource "aws_cognito_user_pool_domain" "domain" {
 # NOTE: the secret lands in Terraform state — acceptable at POC, noted in the doc.
 # Model ACCESS is enabled in the console per model/region, outside Terraform.
 
+# OPTIONAL, because it is the only thing here that needs IAM write and nothing reads it.
+#
+# The platform never uses these keys. They exist as OUTPUTS, for a developer to paste into
+# the Credentials UI, exactly as they would an OpenAI key. So a universe that does not use
+# the Bedrock nodes was minting a permanent access key for nobody, and paying for it in the
+# one place that matters: `iam:CreateUser` is excluded from AWS's PowerUserAccess policy, so
+# in any managed account this single resource turns a working deploy into a request to
+# somebody's cloud team.
+#
+# DEFAULT TRUE, deliberately. Flipping it to false would DESTROY the user and key in every
+# universe that already has one, and silently break Bedrock for anyone who had pasted those
+# keys into a credential. Set it false where IAM write is not delegated.
 resource "aws_iam_user" "bedrock" {
-  name = "${var.name}-bedrock-invoke"
+  count = var.bedrock_credentials ? 1 : 0
+  name  = "${var.name}-bedrock-invoke"
 }
 
 resource "aws_iam_user_policy" "bedrock" {
-  name = "bedrock-invoke-only"
-  user = aws_iam_user.bedrock.name
+  count = var.bedrock_credentials ? 1 : 0
+  name  = "bedrock-invoke-only"
+  user  = aws_iam_user.bedrock[0].name
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [{
@@ -637,7 +651,8 @@ resource "aws_iam_user_policy" "bedrock" {
 }
 
 resource "aws_iam_access_key" "bedrock" {
-  user = aws_iam_user.bedrock.name
+  count = var.bedrock_credentials ? 1 : 0
+  user  = aws_iam_user.bedrock[0].name
 }
 
 # ── Native ingress (2026-07-29): ONE ALB, host-routed — the thing DO's LB can't

package/operator/infra/aws/outputs.tf

@@ -71,12 +71,12 @@ output "cognito_hosted_ui" {
 
 output "bedrock_access_key_id" {
   description = "Store as a platform awsCredential (accessKeyId) for the Bedrock/Nova nodes"
-  value       = aws_iam_access_key.bedrock.id
+  value       = one(aws_iam_access_key.bedrock[*].id)
 }
 
 output "bedrock_secret_access_key" {
   description = "Store as a platform awsCredential (secretAccessKey)"
-  value       = aws_iam_access_key.bedrock.secret
+  value       = one(aws_iam_access_key.bedrock[*].secret)
   sensitive   = true
 }
 

package/operator/infra/aws/variables.tf

@@ -117,3 +117,16 @@ variable "operator_public_key" {
   type        = string
   default     = ""
 }
+
+# Whether to create the Bedrock IAM user and access key (main.tf, "Bedrock").
+#
+# TRUE preserves what every existing universe already has. FALSE skips the only resource
+# here that needs IAM write, which is what makes a deploy possible in an account where
+# `iam:CreateUser` is not delegated. Nothing in the platform reads the keys: they are
+# outputs, for pasting into a credential, so switching this off costs a manual step and
+# nothing else.
+variable "bedrock_credentials" {
+  type        = bool
+  default     = true
+  description = "Create an IAM user and access key for the Bedrock nodes. Set false where IAM write is not delegated."
+}

package/operator/lib/db-verify.sh

@@ -88,7 +88,7 @@ cmd_db_verify() {
       ],
       dictionary_need_states: [
         "universal_id", "content_hash", "title", "description", "object_type",
-        "needs", "source_url", "umap_x", "umap_y", "umap_z",
+        "needs", "source_url", "source_id", "umap_x", "umap_y", "umap_z",
         "umap_cluster_id", "color_hex", "needs_umap_update", "created_at",
         "updated_at", "workflow_id", "key_need", "metadata", "embedding_original"
       ],

package/operator/operator.sh

@@ -30,6 +30,22 @@ else
   exit 1
 fi
 
+# True when the CURRENT DIRECTORY sits inside the platform monorepo. Deliberately keyed to
+# $PWD and not to this script's location: the case it exists for is the INSTALLED CLI being
+# run from inside this repo, where the script lives in node_modules and only the cwd says
+# where the user actually is. The root package name is the marker, and no starter kit
+# carries it.
+_in_platform_monorepo() {
+  local d="$PWD"
+  while [ "$d" != "/" ] && [ -n "$d" ]; do
+    if [ -f "$d/package.json" ] && grep -q '"name"[[:space:]]*:[[:space:]]*"unoverse-platform"' "$d/package.json" 2>/dev/null; then
+      return 0
+    fi
+    d="$(dirname "$d")"
+  done
+  return 1
+}
+
 # ── Source all modules ──────────────────────────────────────────────
 source "$GRAVITY_LIB/find-root.sh"
 source "$GRAVITY_LIB/common.sh"
@@ -154,6 +170,25 @@ case "${1:-}" in
       shift 2; node --import tsx "$GRAVITY_LIB/publish-assets.mjs" "$@"
     elif type cmd_publish >/dev/null 2>&1; then
       shift; cmd_publish "$@"
+    elif _in_platform_monorepo; then
+      # THE INSTALLED CLI CANNOT RELEASE THE PLATFORM, and inside this repo the fallthrough
+      # below is never what anyone meant: it would start publishing rx assets to a universe
+      # while the operator believes they are shipping the platform. It used to do exactly
+      # that, silently, which is the whole reason this branch exists. Refuse and say where
+      # to go. A starter kit never reaches here (no `unoverse-platform` package above it),
+      # so the developer publish keeps working untouched.
+      echo "" >&2
+      echo "  The unoverse CLI does not release the platform." >&2
+      echo "" >&2
+      echo "  You are inside the platform monorepo, where \`publish\` would publish rx" >&2
+      echo "  ASSETS to a universe — not ship the platform. The release lives in this" >&2
+      echo "  repo's own script, which the published CLI does not carry:" >&2
+      echo "" >&2
+      echo "    scripts/operator.sh publish" >&2
+      echo "" >&2
+      echo "  See docs/architecture/DEVELOPER_GUIDE.md § Releasing." >&2
+      echo "" >&2
+      exit 1
     else
       shift; node --import tsx "$GRAVITY_LIB/publish-assets.mjs" "$@"
     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.127",
+  "version": "0.1.129",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",