unoverse 0.1.98 → 0.1.100

package/operator/infra/aws/main.tf

@@ -41,7 +41,11 @@ provider "aws" {
 # membership list, so it stays correct as the ground grows without anyone maintaining it.
 resource "aws_resourcegroups_group" "universe" {
   name        = var.name
-  description = "unoverse universe: ${var.name}"
+  # AWS Resource Groups allow ONLY [\sa-zA-Z0-9_.-] in a description — no colon, no
+  # parentheses. "unoverse universe: name" failed CreateGroup after four minutes of ALB
+  # provisioning, and terraform validate cannot see it: the rule lives in the AWS API, not
+  # in the schema.
+  description = "unoverse universe ${var.name}"
 
   resource_query {
     query = jsonencode({
@@ -149,7 +153,9 @@ resource "aws_security_group" "app" {
   vpc_id      = data.aws_vpc.default.id
 
   ingress {
-    description     = "Platform (api.<domain>) from the ALB only"
+    # Security group descriptions forbid angle brackets. "api.<domain>" reads naturally in
+    # prose and is rejected by the API.
+    description     = "Platform api host, from the ALB only"
     from_port       = 4105
     to_port         = 4105
     protocol        = "tcp"

package/operator/lib/check.sh

@@ -1,4 +1,56 @@
 #!/usr/bin/env bash
+
+# Resources this universe is BILLED FOR that terraform does not know it owns.
+#   _cloud_orphans <ground> <universe-name>
+# Echoes nothing when everything is tracked, "unknown" when the provider could not be
+# reached (never a failure — an offline laptop is not an orphaned resource), or one line
+# per untracked resource.
+#
+# It works because every resource is labelled with the universe it belongs to: AWS through
+# default_tags (Universe=<name>), DigitalOcean through project membership. Without that
+# label there is no question to ask, which is why the Canvas load balancer landing in the
+# wrong DO project was worth fixing rather than tidying.
+_cloud_orphans() {
+  local g="$1" uname_="$2" dir="$ROOT/infra/$1"
+  [ -n "$uname_" ] || { echo unknown; return 0; }
+
+  local state
+  state=$(terraform -chdir="$dir" show -json 2>/dev/null) || { echo unknown; return 0; }
+  [ -n "$state" ] || { echo unknown; return 0; }
+
+  local live
+  if [ "$g" = "aws" ]; then
+    command -v aws >/dev/null 2>&1 || { echo unknown; return 0; }
+    live=$(aws resourcegroupstaggingapi get-resources \
+             --tag-filters "Key=Universe,Values=$uname_" \
+             --query 'ResourceTagMappingList[].ResourceARN' --output text 2>/dev/null | tr '\t' '\n')
+  else
+    [ -n "${DIGITALOCEAN_TOKEN:-}" ] || { echo unknown; return 0; }
+    local pid
+    pid=$(doctl projects list --format ID,Name --no-header 2>/dev/null | awk -v n="$uname_" '$2==n{print $1}')
+    [ -n "$pid" ] || { echo unknown; return 0; }
+    live=$(doctl projects resources list "$pid" --format URN --no-header 2>/dev/null)
+  fi
+  [ -n "$live" ] || { echo ""; return 0; }
+
+  printf '%s' "$state" | node -e '
+    let s=""; process.stdin.on("data",d=>s+=d).on("end",()=>{
+      const live=(process.argv[1]||"").split("\n").map(x=>x.trim()).filter(Boolean);
+      let ids=new Set();
+      try {
+        const st=JSON.parse(s);
+        const walk=(m)=>{ (m.resources||[]).forEach(r=>{ if(!r.values) return;
+          ["id","arn","urn"].forEach(k=>r.values[k]&&ids.add(String(r.values[k]))); });
+          (m.child_modules||[]).forEach(walk); };
+        if (st.values && st.values.root_module) walk(st.values.root_module);
+      } catch { process.exit(0); }          // unreadable state is not an orphan claim
+      const known=[...ids];
+      const orphans=live.filter(a=>!ids.has(a) && !known.some(i=>i && a.includes(i)));
+      orphans.forEach(o=>console.log(o));
+    });
+  ' "$live"
+}
+
 # unoverse check
 
 cmd_check() {
@@ -86,6 +138,36 @@ cmd_check() {
     fail "Canvas ${DIM}http://localhost:3001 → $canvas_code${NC}"
   fi
 
+  # 6. NOTHING BILLING THAT TERRAFORM HAS LOST SIGHT OF.
+  #
+  # Terraform records what it creates as it creates it, so an interrupted apply does not
+  # duplicate anything — the next run continues from state. Two cases break that, and both
+  # cost money silently: a crash between the API call and the state write, and a lost or
+  # deleted state file, which orphans everything at once and makes it invisible to destroy.
+  #
+  # This is answerable because every resource is labelled with the universe it belongs to:
+  # AWS through default_tags, DigitalOcean through project membership. Ask the provider
+  # what it thinks is ours, ask terraform what it knows it made, and compare. A number on
+  # the health check is the difference between trusting that and verifying it.
+  local _g
+  for _g in aws digitalocean; do
+    [ -f "$ROOT/infra/$_g/terraform.tfvars" ] || continue
+    [ -d "$ROOT/infra/$_g/.terraform" ] || continue
+    total=$((total + 1))
+    local uname_ orphans
+    uname_=$(grep -E '^name[[:space:]]*=' "$ROOT/infra/$_g/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+    orphans=$(_cloud_orphans "$_g" "$uname_")
+    case "$orphans" in
+      "") ok "Cloud resources ${DIM}($_g — every resource is tracked)${NC}"; pass=$((pass + 1)) ;;
+      unknown) ok "Cloud resources ${DIM}($_g — could not reach the provider, skipped)${NC}"; pass=$((pass + 1)) ;;
+      *)
+        fail "Cloud resources ${DIM}($_g — billing but NOT tracked by terraform)${NC}"
+        echo "$orphans" | while read -r o; do [ -n "$o" ] && echo -e "      ${DIM}$o${NC}"; done
+        info "  These will not be removed by ${BOLD}unoverse destroy $_g${NC}. Delete them in the console"
+        ;;
+    esac
+  done
+
   # Summary
   echo ""
   if [ "$pass" -eq "$total" ]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.98",
+  "version": "0.1.100",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",