@hiyve/cli 1.0.14 → 1.0.17

package/README.md

@@ -107,6 +107,18 @@ Set `HIYVE_API_KEY` in your CI environment (GitHub Actions secrets, AWS SSM, etc
 - Check your internet connection
 - The registry may be temporarily unavailable
 
+### "401 Unauthorized" when running `npx @hiyve/cli login`
+
+If you've previously logged in and your token has expired, `npx` may fail because npm routes all `@hiyve/*` packages (including the CLI) through the private registry. To fix this, remove the stale registry line from your `~/.npmrc` and re-run login:
+
+```bash
+# Remove the stale @hiyve registry config
+npm config delete @hiyve:registry
+
+# Now login will work again
+npx @hiyve/cli login
+```
+
 ### Packages not installing
 
 After login, verify your configuration:
@@ -129,6 +141,6 @@ cat ~/.npmrc | grep hiyve
 
 ## Support
 
-- Documentation: https://docs.hiyve.io
+- Documentation: https://sdk.hiyve.dev
 - Issues: https://github.com/hiyve/hiyve-sdk/issues
 - Email: support@hiyve.io

package/bin/hiyve.js

@@ -18,7 +18,7 @@ program
   .name('hiyve')
   .description('Hiyve SDK CLI - Configure npm for private @hiyve packages')
   .version('1.0.0')
-  .option('--dev', 'Use dev registry (api.muziemedia.com)')
+  .option('--dev', 'Retained for compatibility — there is no separate dev registry; same host as production')
   .hook('preAction', () => {
     if (program.opts().dev) {
       setDevMode(true);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hiyve/cli",
-  "version": "1.0.14",
+  "version": "1.0.17",
   "description": "Hiyve SDK CLI - Configure npm for private @hiyve packages",
   "type": "module",
   "bin": {
@@ -12,7 +12,7 @@
     "src"
   ],
   "scripts": {
-    "test": "vitest run",
+    "test": "vitest run --pool=forks --poolOptions.forks.singleFork",
     "test:watch": "vitest",
     "deploy": "./deploy.sh"
   },
@@ -44,6 +44,6 @@
     "prompts": "^2.4.2"
   },
   "devDependencies": {
-    "vitest": "^2.1.9"
+    "vitest": "^3.2.6"
   }
 }

package/src/commands/init.js

@@ -217,7 +217,7 @@ export default defineConfig({
 }
 
 function generateEnvExample(template) {
-  let env = `# Hiyve API Key (from api.hiyve.dev)
+  let env = `# Hiyve API Key (from cloud.hiyve.io)
 HIYVE_API_KEY=pk_live_your_api_key_here
 
 # Room configuration
@@ -227,7 +227,7 @@ HIYVE_SIGNALING_URL=https://signal.hiyve.dev
   if (template.features.intelligence) {
     env += `
 # Cloud API (for AI features)
-HIYVE_CLOUD_URL=https://api.hiyve.dev
+HIYVE_CLOUD_URL=https://cloud.hiyve.io
 `;
   }
 
@@ -383,7 +383,7 @@ app.use(express.json());
 
 const API_KEY = process.env.HIYVE_API_KEY;
 const SIGNALING_URL = process.env.HIYVE_SIGNALING_URL || 'https://signal.hiyve.dev';
-${hasCloud ? `const CLOUD_URL = process.env.HIYVE_CLOUD_URL || 'https://api.hiyve.dev';\n` : ''}
+${hasCloud ? `const CLOUD_URL = process.env.HIYVE_CLOUD_URL || 'https://cloud.hiyve.io';\n` : ''}
 /**
  * Generate a room token for the client.
  * In production, add your own authentication before issuing tokens.

package/src/config.js

@@ -6,13 +6,36 @@
  *   - Registry URL: what goes into ~/.npmrc for npm to fetch tarballs. Always prod.
  */
 
-const PROD_API_URL = 'https://api.hiyve.dev/registry/';
-const DEV_API_URL = 'https://api.muziemedia.com/registry/';
+// The CLI's own API — key verification and the package catalogue, served by
+// hiyve-cloud at /registry/{verify,packages}.
+const PROD_API_URL = 'https://cloud.hiyve.io/registry/';
+// No separate development cloud exists — kept so --dev stays a valid flag,
+// but it reaches the SAME live host (2026-08-24).
+const DEV_API_URL = 'https://cloud.hiyve.io/registry/';
+
+/**
+ * Where npm actually fetches tarballs. DELIBERATELY NOT the API URL.
+ *
+ * This used to return getApiUrl(), on the assumption that "tarballs are
+ * served through the same API". They are not: the cloud's /registry proxy
+ * serves a stale catalogue whose `dist.tarball` URLs still name
+ * api.muziemedia.com — a host with no DNS record — so a packument fetch
+ * succeeded and the download that followed failed with ENOTFOUND. npm does
+ * not rewrite tarball hosts for a non-npmjs registry, so the URL in the
+ * metadata is the URL it uses.
+ *
+ * registry.muziemedia.com is the Verdaccio registry `changeset publish`
+ * actually publishes to. Verified 2026-08-24 with a customer pk_ key: it
+ * authenticates API keys natively (the proxy is not needed for auth),
+ * serves current versions, its tarball URLs point at itself, and the
+ * download returns a valid package.
+ */
+const REGISTRY_URL_VALUE = 'https://registry.muziemedia.com/';
 
 let _devMode = false;
 
 /**
- * Enable dev mode (CLI API calls go to api.muziemedia.com)
+ * Enable dev mode (there is no separate dev cloud — same host as prod)
  */
 export function setDevMode(enabled) {
   _devMode = enabled;
@@ -28,10 +51,10 @@ export function getApiUrl() {
 
 /**
  * Get the registry URL for ~/.npmrc (where npm fetches tarballs).
- * Matches the API URL — tarballs are served through the same API.
+ * Independent of the API URL, and of --dev: there is one registry.
  */
 export function getRegistryUrl() {
-  return getApiUrl();
+  return REGISTRY_URL_VALUE;
 }
 
 /**
@@ -42,7 +65,8 @@ export function isDevMode() {
 }
 
 // Backwards-compatible named export
-export const REGISTRY_URL = PROD_API_URL;
+// The npm registry, NOT the CLI API (they are different hosts — see above).
+export const REGISTRY_URL = REGISTRY_URL_VALUE;
 
 export default {
   REGISTRY_URL,

package/src/config.test.js

@@ -3,30 +3,38 @@ import config, { REGISTRY_URL, getApiUrl, getRegistryUrl, setDevMode } from './c
 
 describe('config', () => {
   it('exports REGISTRY_URL as a named export', () => {
-    expect(REGISTRY_URL).toBe('https://api.hiyve.dev/registry/');
+    expect(REGISTRY_URL).toBe('https://registry.muziemedia.com/');
   });
 
   it('default export contains REGISTRY_URL', () => {
     expect(config).toHaveProperty('REGISTRY_URL');
-    expect(config.REGISTRY_URL).toBe('https://api.hiyve.dev/registry/');
+    expect(config.REGISTRY_URL).toBe('https://registry.muziemedia.com/');
   });
 
   it('getApiUrl returns prod URL by default', () => {
     setDevMode(false);
-    expect(getApiUrl()).toBe('https://api.hiyve.dev/registry/');
+    expect(getApiUrl()).toBe('https://cloud.hiyve.io/registry/');
   });
 
   it('getApiUrl returns dev URL when dev mode is enabled', () => {
     setDevMode(true);
-    expect(getApiUrl()).toBe('https://api.muziemedia.com/registry/');
+    expect(getApiUrl()).toBe('https://cloud.hiyve.io/registry/');
     setDevMode(false);
   });
 
-  it('getRegistryUrl switches with dev mode', () => {
+  it('getRegistryUrl is the npm registry, NOT the API host', () => {
+    // These are different services: the API serves /verify and /packages
+    // from hiyve-cloud; npm fetches tarballs from Verdaccio. Conflating them
+    // shipped a registry whose tarball URLs pointed at a dead host.
+    expect(getRegistryUrl()).toBe('https://registry.muziemedia.com/');
+    expect(getRegistryUrl()).not.toBe(getApiUrl());
+  });
+
+  it('getRegistryUrl does NOT switch with dev mode — there is one registry', () => {
     setDevMode(false);
-    expect(getRegistryUrl()).toBe('https://api.hiyve.dev/registry/');
+    const prod = getRegistryUrl();
     setDevMode(true);
-    expect(getRegistryUrl()).toBe('https://api.muziemedia.com/registry/');
+    expect(getRegistryUrl()).toBe(prod);
     setDevMode(false);
   });
 });

package/src/utils/npmrc.js

@@ -11,7 +11,16 @@ import path from 'path';
 const NPMRC_PATH = path.join(os.homedir(), '.npmrc');
 
 // Known Hiyve registry hosts (current and historical)
-const HIYVE_HOSTS = ['//console.hiyve.dev/', '//api.hiyve.dev/', '//api.muziemedia.com/'];
+const HIYVE_HOSTS = [
+  '//registry.muziemedia.com/',
+  '//cloud.hiyve.io/',
+  // Historical hosts stay listed FOREVER: this array's job is to strip
+  // stale entries from a developer's .npmrc, so dropping a retired host
+  // leaves its dead token line behind.
+  '//console.hiyve.dev/',
+  '//api.hiyve.dev/',
+  '//api.muziemedia.com/',
+];
 
 /**
  * Check if a line in .npmrc is a Hiyve-related config line.
@@ -34,7 +43,7 @@ function filterOutHiyveLines(content) {
 
 /**
  * Configure ~/.npmrc for Hiyve registry
- * @param {string} registryUrl - The registry URL (e.g., https://api.hiyve.dev/registry/)
+ * @param {string} registryUrl - The registry URL (e.g., https://registry.muziemedia.com/)
  * @param {string} apiKey - The API key for authentication
  */
 export async function configureNpmrc(registryUrl, apiKey) {

package/src/utils/output.js

@@ -14,12 +14,12 @@ const FETCH_TIMEOUT_MS = 15_000;
  */
 export function printDevHint(command) {
   if (isDevMode()) {
-    console.log(chalk.gray('  You are using --dev mode (development registry).'));
-    console.log(chalk.gray('  If you meant to use production, run without --dev:'));
+    // No longer suggests the opposite mode: both use the same host since
+    // 2026-08-24, so "try without --dev" sent people hunting a difference
+    // that cannot exist.
+    console.log(chalk.gray('  --dev no longer selects a different registry — same host as the'));
+    console.log(chalk.gray('  default, so re-running without it will not change this result.'));
     console.log(chalk.cyan(`    npx @hiyve/cli ${command}`));
-  } else {
-    console.log(chalk.gray('  If you meant to use the development registry, use --dev:'));
-    console.log(chalk.cyan(`    npx @hiyve/cli --dev ${command}`));
   }
 }