unoverse 0.1.156 → 0.1.157

package/operator/infra/aws/main.tf

@@ -605,7 +605,13 @@ resource "aws_cognito_user_pool_client" "spa" {
   # canvas_entry is the same expression the invitation email and the canvas_url output use,
   # so the address a person is sent to is by construction an address they may return to.
   # Anything else in the variable (localhost for dev, a second front end) is kept.
-  callback_urls                        = distinct(concat([local.canvas_entry, local.studio_entry], var.oauth_callback_urls))
+  #
+  # THE CLI'S LOOPBACK IS ALWAYS ALLOWED, same rule as the app's own address: every
+  # universe is published to by `unoverse login` + `unoverse publish`, and its fixed
+  # callback is a platform constant, not an operator decision. Baked here so no tfvars
+  # ever needs it and an updated ground picks it up on the next deploy.
+  # (Callback only, not logout: the CLI never runs a logout redirect.)
+  callback_urls                        = distinct(concat([local.canvas_entry, local.studio_entry, "http://127.0.0.1:4109/callback"], var.oauth_callback_urls))
   logout_urls                          = distinct(concat([local.canvas_entry, local.studio_entry], var.oauth_callback_urls))
   supported_identity_providers         = ["COGNITO"]
 }

package/operator/infra/digitalocean/terraform.tfvars.example

@@ -29,6 +29,9 @@ canvas_public = true
 auth_issuer    = "https://your-tenant.auth0.com"
 auth_client_id = "your-spa-client-id"
 auth_audience  = "gravity-api"
+# In that client's Allowed Callback URLs, include http://127.0.0.1:4109/callback —
+# it is how `unoverse login` signs developers in from the terminal. (On AWS this is
+# automatic: the ground owns Cognito and always allows it.)
 
 # Service secrets — with these set, the rendered .env.production is COMPLETE.
 docr_token           = "dop_v1_..."   # registry token (pulls platform images)

package/operator/lib/ground.sh

@@ -313,8 +313,8 @@ openai_api_key = "FILL_ME"
 oauth_callback_urls = [
 $( if [ -n "$zone_domain" ]; then echo "  \"https://canvas.$zone_domain\","; fi )
   "http://localhost:5173", # local Studio/Canvas dev against this universe
-  "http://127.0.0.1:4109/callback", # unoverse login (the CLI's loopback; IdPs match exactly)
   # Add your Canvas URL here once a domain is set (https://canvas.<domain>).
+  # (No need to list the CLI's login callback — main.tf always allows it.)
 ]
 
 # RBAC roles (noun:verb). Each becomes a Cognito group; put a user in the group

package/operator/lib/help.sh

@@ -3,8 +3,10 @@
 #
 # Printed by the npm CLI when you are standing in a universe folder. It lists what you
 # can do to a universe, and nothing else. Commands that still exist but are not for
-# day-to-day operating (ground, dev, build, publish) are deliberately absent: a list you
-# can read in one glance is worth more than a complete one.
+# day-to-day operating (ground, dev, build) are deliberately absent: a list you can read
+# in one glance is worth more than a complete one. `publish` is listed under Anywhere:
+# it is one verb whose lane the folder decides (a design workspace publishes assets, the
+# platform monorepo root releases the platform — LOCAL_STUDIO.md §Publish is terminal-only).
 
 cmd_help() {
 
@@ -14,6 +16,8 @@ cmd_help() {
   echo -e "  ${BOLD}Anywhere${NC}"
   echo -e "    ${GREEN}create${NC}      Start something new, here"
   echo -e "    ${GREEN}studio${NC}      Author components, nodes, agent skills"
+  echo -e "    ${GREEN}publish${NC}     Ship your work ${DIM}(run it in your design workspace; signs you in if needed)${NC}"
+  echo -e "    ${GREEN}login${NC}       Sign in to a universe ${DIM}(publish asks by itself; this is for up front)${NC}"
   echo -e "    ${GREEN}where${NC}       Links to your universe ${DIM}(Canvas, API), checked live${NC}"
   echo -e "    ${GREEN}update${NC}      Update this CLI"
   echo ""

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.156",
+  "version": "0.1.157",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",