unoverse 0.1.97 → 0.1.99

package/operator/infra/aws/main.tf

@@ -41,7 +41,11 @@ provider "aws" {
 # membership list, so it stays correct as the ground grows without anyone maintaining it.
 resource "aws_resourcegroups_group" "universe" {
   name        = var.name
-  description = "unoverse universe: ${var.name}"
+  # AWS Resource Groups allow ONLY [\sa-zA-Z0-9_.-] in a description — no colon, no
+  # parentheses. "unoverse universe: name" failed CreateGroup after four minutes of ALB
+  # provisioning, and terraform validate cannot see it: the rule lives in the AWS API, not
+  # in the schema.
+  description = "unoverse universe ${var.name}"
 
   resource_query {
     query = jsonencode({
@@ -149,7 +153,9 @@ resource "aws_security_group" "app" {
   vpc_id      = data.aws_vpc.default.id
 
   ingress {
-    description     = "Platform (api.<domain>) from the ALB only"
+    # Security group descriptions forbid angle brackets. "api.<domain>" reads naturally in
+    # prose and is rejected by the API.
+    description     = "Platform api host, from the ALB only"
     from_port       = 4105
     to_port         = 4105
     protocol        = "tcp"

package/operator/lib/deploy.sh

@@ -377,6 +377,25 @@ _ensure_ground_config() {
       info "${DIM}(Auth0 or any OIDC provider; the issuer looks like https://your-tenant.auth0.com)${NC}"
     fi
   fi
+  # AWS ONLY. Cognito needs a first administrator, and nothing else in the CLI collects an
+  # email — so this was left FILL_ME and the deploy gave up. It is one question.
+  if [ "$cloud" = "aws" ] && grep -q '^admin_email[[:space:]]*=[[:space:]]*"FILL_ME"' "$tfv" 2>/dev/null; then
+    local admin_email=""
+    echo ""
+    echo -e "  ${CYAN}${BOLD}Who is the first administrator?${NC}"
+    echo -e "  ${DIM}They get a Cognito account with every role, and an invitation by email.${NC}"
+    echo ""
+    while [ -z "$admin_email" ]; do
+      read -r -p "  Email: " admin_email
+      case "$admin_email" in
+        *@*.*) : ;;
+        *) [ -n "$admin_email" ] && warn "That does not look like an email address"; admin_email="" ;;
+      esac
+    done
+    _tf_put admin_email "$admin_email"
+    ok "First administrator: ${BOLD}$admin_email${NC}"
+  fi
+
   _tf_fill auth_issuer    AUTH_ISSUER    "AUTH_ISSUER"
   _tf_fill auth_client_id AUTH_CLIENT_ID "AUTH_CLIENT_ID"
 
@@ -384,9 +403,16 @@ _ensure_ground_config() {
   # it declared a complete file blank.
   if grep -qE '=[[:space:]]*"FILL_ME"' "$tfv" 2>/dev/null; then
     echo ""
-    warn "Some values are still blank in ${BOLD}infra/$cloud/terraform.tfvars${NC} — fill them, then:"
-    info "  cd infra/$cloud && terraform init && terraform apply"
-    info "  cd ../.. && unoverse deploy"
+    # NAME THE VALUES, AND NEVER HAND BACK TERRAFORM. This said "fill them, then cd
+    # infra/<cloud> && terraform init && terraform apply" — the homework this CLI exists to
+    # remove — and then named `unoverse deploy` without the ground, which on a universe with
+    # two grounds is a command that refuses. Say which values, say where, say the command
+    # that resumes.
+    warn "These still need a value in ${BOLD}infra/$cloud/terraform.tfvars${NC}:"
+    echo ""
+    grep -nE '=[[:space:]]*"FILL_ME"' "$tfv" | sed -E 's/^([0-9]+):([a-z_]+).*/      line \1   \2/' | while read -r l; do echo -e "  ${DIM}$l${NC}"; done
+    echo ""
+    info "Fill them in, then: ${BOLD}unoverse deploy $cloud${NC}"
     echo ""
     exit 1
   fi

package/operator/lib/ground.sh

@@ -291,8 +291,9 @@ openai_api_key = "FILL_ME"
 # hyperbrowser_api_key = ""             # optional — page intelligence
 
 oauth_callback_urls = [
-$( if [ -n "$zone_domain" ]; then echo "  \"https://$zone_domain\","; else echo "  \"https://FILL_ME\","; fi )
+$( if [ -n "$zone_domain" ]; then echo "  \"https://canvas.$zone_domain\","; fi )
   "http://localhost:5173", # local Studio/Canvas dev against this universe
+  # Add your Canvas URL here once a domain is set (https://canvas.<domain>).
 ]
 
 # RBAC roles (noun:verb). Each becomes a Cognito group; put a user in the group

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.97",
+  "version": "0.1.99",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",