@uluops/setup 0.9.8 → 0.9.9

package/dist/cli.js

@@ -33,6 +33,7 @@ async function main() {
         .option("--verify", "Check existing installation health")
         .option("--uninstall", "Remove all UluOps artifacts")
         .option("--dry-run", "Show what would happen", false)
+        .option("--username <name>", "Set your registry username (slug, required to publish) without prompting")
         .option("-y, --yes", "Skip confirmations", false);
     program.parse();
     const opts = program.opts();
@@ -123,6 +124,7 @@ async function main() {
     }
     await runSetup({
         apiKey: opts.apiKey,
+        username: opts.username,
         signup: opts.signup ?? false,
         scope,
         localDefs: opts.localDefs,

package/dist/commands/setup.d.ts

@@ -19,5 +19,7 @@ interface RunSetupOpts {
      * CLI prompt is also suppressed downstream (no hook → no CLI gate).
      */
     noMetrics?: boolean;
+    /** Explicit registry username (slug). Set + confirmed non-interactively when provided. */
+    username?: string;
 }
 export declare function runSetup(opts: RunSetupOpts): Promise<void>;

package/dist/commands/setup.js

@@ -9,6 +9,7 @@ import { acquireInstallLock, } from "../lib/install-lock.js";
 import { initContext, checkConflicts, configureMcpStep, installAgentsDefs, installCommandsDefs, installSkillsDefs, configureMetricsStep, configureCliStep, configureAgentMetricsCliStep, runHealthCheck, configureShell, } from "./helpers.js";
 import { ConflictRejectedError } from "./errors.js";
 import { classifyExit, } from "./per-harness.js";
+import { maybeSetUsername } from "../steps/username.js";
 export async function runSetup(opts) {
     if (opts.harnesses.length === 0) {
         info(chalk.dim("Nothing to install — re-run with at least one harness selected.\n"));
@@ -34,6 +35,17 @@ export async function runSetup(opts) {
     // === Once-per-run: BEFORE the per-harness loop ===
     const { env, apiKey } = await initContext(opts);
     console.log();
+    // Optional, never-forced: offer to set a registry username (the one-time
+    // prerequisite for creating/publishing definitions). Skipped silently in
+    // non-interactive runs unless --username is supplied.
+    await maybeSetUsername({
+        apiKey,
+        username: opts.username,
+        interactive: !opts.yes && Boolean(process.stdin.isTTY),
+        dryRun: opts.dryRun,
+        emit: (msg) => info(msg),
+    });
+    console.log();
     // Acquire the install lock before touching any shared state. Skipped on
     // dry-run (read-only). The lock excludes a second concurrent uluops-setup
     // from racing the manifest / MCP config / shell-profile / settings.json

package/dist/lib/mcp-packages.d.ts

@@ -21,11 +21,11 @@
  * the latest version was reachable.
  */
 export declare const OPS_MCP_PACKAGE = "@uluops/ops-mcp";
-export declare const OPS_MCP_VERSION = "0.4.7";
-export declare const OPS_MCP_SPEC: "@uluops/ops-mcp@0.4.7";
+export declare const OPS_MCP_VERSION = "0.5.0";
+export declare const OPS_MCP_SPEC: "@uluops/ops-mcp@0.5.0";
 export declare const REGISTRY_MCP_PACKAGE = "@uluops/registry-mcp";
-export declare const REGISTRY_MCP_VERSION = "0.2.13";
-export declare const REGISTRY_MCP_SPEC: "@uluops/registry-mcp@0.2.13";
+export declare const REGISTRY_MCP_VERSION = "0.2.14";
+export declare const REGISTRY_MCP_SPEC: "@uluops/registry-mcp@0.2.14";
 /**
  * Bare package names for the npm availability probe. The probe checks
  * existence on the registry, not version-specific resolvability, so it

package/dist/lib/mcp-packages.js

@@ -21,10 +21,10 @@
  * the latest version was reachable.
  */
 export const OPS_MCP_PACKAGE = "@uluops/ops-mcp";
-export const OPS_MCP_VERSION = "0.4.7";
+export const OPS_MCP_VERSION = "0.5.0";
 export const OPS_MCP_SPEC = `${OPS_MCP_PACKAGE}@${OPS_MCP_VERSION}`;
 export const REGISTRY_MCP_PACKAGE = "@uluops/registry-mcp";
-export const REGISTRY_MCP_VERSION = "0.2.13";
+export const REGISTRY_MCP_VERSION = "0.2.14";
 export const REGISTRY_MCP_SPEC = `${REGISTRY_MCP_PACKAGE}@${REGISTRY_MCP_VERSION}`;
 /**
  * Bare package names for the npm availability probe. The probe checks

package/dist/steps/username.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Optional username step.
+ *
+ * Setting a username is the one-time prerequisite the registry enforces before
+ * a user can create or publish definitions. We offer it during setup so
+ * publishers clear the gate up front — but never force it: consumers who only
+ * run definitions never need a username, so the step is skippable and is
+ * silently skipped in non-interactive runs unless --username is supplied.
+ *
+ * Uses native fetch against the platform API with the api key the run already
+ * resolved — no SDK dependency. Mirrors the PATCH /auth/profile fold-in, where
+ * setting a username also confirms it.
+ */
+/**
+ * Pure slug check for the interactive prompt. Returns true when valid, or a
+ * message string otherwise (inquirer validate contract). Server validation
+ * remains authoritative.
+ * @internal Exported for testing only.
+ */
+export declare function validateUsername(name: string): string | true;
+/**
+ * PATCH /auth/profile with the username. Setting it confirms it (one-time).
+ * Returns the confirmed username on success. Throws a friendly Error otherwise.
+ * @internal Exported for testing only.
+ */
+export declare function setUsername(apiKey: string, username: string): Promise<string>;
+export interface MaybeSetUsernameOpts {
+    /** Resolved api key for the run; without it there is nothing to authenticate with. */
+    apiKey: string | null;
+    /** Explicit username from --username (non-interactive path). */
+    username?: string;
+    /** True when prompting is allowed (a TTY run without --yes). */
+    interactive: boolean;
+    /** Dry run — describe, don't write. */
+    dryRun: boolean;
+    /** Emit a line of user-facing output. */
+    emit: (msg: string) => void;
+}
+/**
+ * Offer to set a username. Resolution order:
+ *  - no api key            → skip (nothing to auth with)
+ *  - --username supplied   → set it (works non-interactively)
+ *  - interactive, no flag  → prompt once; empty input skips
+ *  - non-interactive       → skip silently
+ *
+ * Never throws: a failure to set the username is surfaced as a warning and
+ * does not abort setup (it is an optional, publisher-only prerequisite).
+ */
+export declare function maybeSetUsername(opts: MaybeSetUsernameOpts): Promise<void>;

package/dist/steps/username.js

@@ -0,0 +1,121 @@
+/**
+ * Optional username step.
+ *
+ * Setting a username is the one-time prerequisite the registry enforces before
+ * a user can create or publish definitions. We offer it during setup so
+ * publishers clear the gate up front — but never force it: consumers who only
+ * run definitions never need a username, so the step is skippable and is
+ * silently skipped in non-interactive runs unless --username is supplied.
+ *
+ * Uses native fetch against the platform API with the api key the run already
+ * resolved — no SDK dependency. Mirrors the PATCH /auth/profile fold-in, where
+ * setting a username also confirms it.
+ */
+const API_BASE = "https://api.uluops.ai/api/v1";
+// Canonical username / personal-org slug pattern, shared in spirit with
+// ops-api + ops-sdk: 1-40 chars, lowercase alphanumeric with internal hyphens
+// or underscores, must start and end alphanumeric (e.g. "ulu-labs").
+const USERNAME_REGEX = /^[a-z0-9](?:[a-z0-9_-]{0,38}[a-z0-9])?$/;
+/**
+ * Pure slug check for the interactive prompt. Returns true when valid, or a
+ * message string otherwise (inquirer validate contract). Server validation
+ * remains authoritative.
+ * @internal Exported for testing only.
+ */
+export function validateUsername(name) {
+    if (!name.trim())
+        return "Username is required";
+    if (!USERNAME_REGEX.test(name)) {
+        return "1-40 chars, lowercase letters/digits with internal hyphens or underscores (e.g. ulu-labs)";
+    }
+    return true;
+}
+/**
+ * PATCH /auth/profile with the username. Setting it confirms it (one-time).
+ * Returns the confirmed username on success. Throws a friendly Error otherwise.
+ * @internal Exported for testing only.
+ */
+export async function setUsername(apiKey, username) {
+    let res;
+    try {
+        res = await fetch(`${API_BASE}/auth/profile`, {
+            method: "PATCH",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${apiKey}`,
+            },
+            body: JSON.stringify({ username }),
+            signal: AbortSignal.timeout(15000),
+        });
+    }
+    catch (err) {
+        if (err instanceof TypeError) {
+            throw new Error("Can't reach api.uluops.ai — check your connection.");
+        }
+        throw err;
+    }
+    if (res.ok) {
+        const body = await res.json();
+        if (typeof body !== "object" || body === null) {
+            throw new Error("Unexpected API response shape");
+        }
+        const confirmed = body.data?.user?.username;
+        return typeof confirmed === "string" ? confirmed : username;
+    }
+    const errorBody = (await res.json().catch(() => null));
+    const message = errorBody?.error?.message ?? errorBody?.message ?? `HTTP ${res.status}`;
+    if (res.status === 409) {
+        throw new Error(`Username unavailable: ${message}`);
+    }
+    if (res.status === 400) {
+        throw new Error(`Username rejected: ${message}`);
+    }
+    throw new Error(`Couldn't set username (${res.status}): ${message}`);
+}
+/**
+ * Offer to set a username. Resolution order:
+ *  - no api key            → skip (nothing to auth with)
+ *  - --username supplied   → set it (works non-interactively)
+ *  - interactive, no flag  → prompt once; empty input skips
+ *  - non-interactive       → skip silently
+ *
+ * Never throws: a failure to set the username is surfaced as a warning and
+ * does not abort setup (it is an optional, publisher-only prerequisite).
+ */
+export async function maybeSetUsername(opts) {
+    const { apiKey, interactive, dryRun, emit } = opts;
+    if (!apiKey)
+        return;
+    let username = opts.username?.trim();
+    if (!username) {
+        if (!interactive)
+            return; // non-interactive with no flag → skip silently
+        const { input } = await import("@inquirer/prompts");
+        const answer = await input({
+            message: "Registry username (optional — required to publish; press Enter to skip)",
+            validate: (v) => (v.trim() === "" ? true : validateUsername(v)),
+        });
+        username = answer.trim();
+        if (!username)
+            return; // user skipped
+    }
+    else {
+        const valid = validateUsername(username);
+        if (valid !== true) {
+            emit(`  ⚠ Skipping username — ${valid}`);
+            return;
+        }
+    }
+    if (dryRun) {
+        emit(`  Would set registry username to "${username}".`);
+        return;
+    }
+    try {
+        const confirmed = await setUsername(apiKey, username);
+        emit(`  Registry username set to "${confirmed}".`);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        emit(`  ⚠ ${message} You can set it later with "ulu auth update-profile --username <name>".`);
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uluops/setup",
-  "version": "0.9.8",
+  "version": "0.9.9",
   "description": "Zero-friction installer for UluOps agentic harnesses",
   "license": "MIT",
   "repository": {