unoverse 0.1.99 → 0.1.100

package/operator/lib/check.sh

@@ -1,4 +1,56 @@
 #!/usr/bin/env bash
+
+# Resources this universe is BILLED FOR that terraform does not know it owns.
+#   _cloud_orphans <ground> <universe-name>
+# Echoes nothing when everything is tracked, "unknown" when the provider could not be
+# reached (never a failure — an offline laptop is not an orphaned resource), or one line
+# per untracked resource.
+#
+# It works because every resource is labelled with the universe it belongs to: AWS through
+# default_tags (Universe=<name>), DigitalOcean through project membership. Without that
+# label there is no question to ask, which is why the Canvas load balancer landing in the
+# wrong DO project was worth fixing rather than tidying.
+_cloud_orphans() {
+  local g="$1" uname_="$2" dir="$ROOT/infra/$1"
+  [ -n "$uname_" ] || { echo unknown; return 0; }
+
+  local state
+  state=$(terraform -chdir="$dir" show -json 2>/dev/null) || { echo unknown; return 0; }
+  [ -n "$state" ] || { echo unknown; return 0; }
+
+  local live
+  if [ "$g" = "aws" ]; then
+    command -v aws >/dev/null 2>&1 || { echo unknown; return 0; }
+    live=$(aws resourcegroupstaggingapi get-resources \
+             --tag-filters "Key=Universe,Values=$uname_" \
+             --query 'ResourceTagMappingList[].ResourceARN' --output text 2>/dev/null | tr '\t' '\n')
+  else
+    [ -n "${DIGITALOCEAN_TOKEN:-}" ] || { echo unknown; return 0; }
+    local pid
+    pid=$(doctl projects list --format ID,Name --no-header 2>/dev/null | awk -v n="$uname_" '$2==n{print $1}')
+    [ -n "$pid" ] || { echo unknown; return 0; }
+    live=$(doctl projects resources list "$pid" --format URN --no-header 2>/dev/null)
+  fi
+  [ -n "$live" ] || { echo ""; return 0; }
+
+  printf '%s' "$state" | node -e '
+    let s=""; process.stdin.on("data",d=>s+=d).on("end",()=>{
+      const live=(process.argv[1]||"").split("\n").map(x=>x.trim()).filter(Boolean);
+      let ids=new Set();
+      try {
+        const st=JSON.parse(s);
+        const walk=(m)=>{ (m.resources||[]).forEach(r=>{ if(!r.values) return;
+          ["id","arn","urn"].forEach(k=>r.values[k]&&ids.add(String(r.values[k]))); });
+          (m.child_modules||[]).forEach(walk); };
+        if (st.values && st.values.root_module) walk(st.values.root_module);
+      } catch { process.exit(0); }          // unreadable state is not an orphan claim
+      const known=[...ids];
+      const orphans=live.filter(a=>!ids.has(a) && !known.some(i=>i && a.includes(i)));
+      orphans.forEach(o=>console.log(o));
+    });
+  ' "$live"
+}
+
 # unoverse check
 
 cmd_check() {
@@ -86,6 +138,36 @@ cmd_check() {
     fail "Canvas ${DIM}http://localhost:3001 → $canvas_code${NC}"
   fi
 
+  # 6. NOTHING BILLING THAT TERRAFORM HAS LOST SIGHT OF.
+  #
+  # Terraform records what it creates as it creates it, so an interrupted apply does not
+  # duplicate anything — the next run continues from state. Two cases break that, and both
+  # cost money silently: a crash between the API call and the state write, and a lost or
+  # deleted state file, which orphans everything at once and makes it invisible to destroy.
+  #
+  # This is answerable because every resource is labelled with the universe it belongs to:
+  # AWS through default_tags, DigitalOcean through project membership. Ask the provider
+  # what it thinks is ours, ask terraform what it knows it made, and compare. A number on
+  # the health check is the difference between trusting that and verifying it.
+  local _g
+  for _g in aws digitalocean; do
+    [ -f "$ROOT/infra/$_g/terraform.tfvars" ] || continue
+    [ -d "$ROOT/infra/$_g/.terraform" ] || continue
+    total=$((total + 1))
+    local uname_ orphans
+    uname_=$(grep -E '^name[[:space:]]*=' "$ROOT/infra/$_g/terraform.tfvars" 2>/dev/null | sed -E 's/.*"([^"]+)".*/\1/')
+    orphans=$(_cloud_orphans "$_g" "$uname_")
+    case "$orphans" in
+      "") ok "Cloud resources ${DIM}($_g — every resource is tracked)${NC}"; pass=$((pass + 1)) ;;
+      unknown) ok "Cloud resources ${DIM}($_g — could not reach the provider, skipped)${NC}"; pass=$((pass + 1)) ;;
+      *)
+        fail "Cloud resources ${DIM}($_g — billing but NOT tracked by terraform)${NC}"
+        echo "$orphans" | while read -r o; do [ -n "$o" ] && echo -e "      ${DIM}$o${NC}"; done
+        info "  These will not be removed by ${BOLD}unoverse destroy $_g${NC}. Delete them in the console"
+        ;;
+    esac
+  done
+
   # Summary
   echo ""
   if [ "$pass" -eq "$total" ]; then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.99",
+  "version": "0.1.100",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",