unoverse 0.1.156 → 0.1.158

package/bin/unoverse.mjs

@@ -96,8 +96,11 @@ const HELP = [
   "",
   `  ${bold("After that")}`,
   row("studio", "Design components, nodes and agent skills"),
-  row("publish", "Ship your work to your universe"),
-  row("login", "Sign in to a universe (publish asks by itself when needed)"),
+  row("deploy", "Ship it"),
+  `      ${dim("deploy studio         your components, nodes and skills → your universe")}`,
+  `      ${dim("deploy aws            your universe → AWS")}`,
+  `      ${dim("deploy digitalocean   your universe → DigitalOcean")}`,
+  row("login", "Sign in to a universe (deploy asks by itself when needed)"),
   row("update", "Update this CLI"),
   "",
 ].join("\n");
@@ -230,19 +233,38 @@ switch (cmd) {
     break;
   }
 
+  case "deploy": {
+    // ONE VERB FOR THE REMOTE DEVELOPER, the target says what ships. `deploy studio`
+    // ships this design workspace's items to the signed-in universe (lint gates it);
+    // any other target is the operator's cloud deploy, unchanged. `publish` is the
+    // PLATFORM OWNER's word (the release) and stays out of this lane on purpose.
+    if (args[0] === "studio") {
+      const { findWorkspace } = await import("../lib/workspace.mjs");
+      const ws = findWorkspace();
+      if (ws?.kind !== "assets") {
+        console.log(`\n  deploy studio ships a design workspace, and there is none above ${process.cwd()}.\n  Start one with: unoverse create\n`);
+        process.exit(1);
+      }
+      const { publish } = await import("../lib/publish.mjs");
+      await publish(args.slice(1));
+      break;
+    }
+    if (UNIVERSE) operator(UNIVERSE, ["deploy", ...args]);
+    console.log(`\n  '${["deploy", args[0]].filter(Boolean).join(" ")}' operates a universe, and this folder is not one.\n  cd into your universe — or did you mean: unoverse deploy studio\n`);
+    process.exit(1);
+  }
+
   case "publish": {
-    // ONE VERB, the folder decides (LOCAL_STUDIO.md §Publish is terminal-only).
-    // Nearest marker up from cwd: a design home → publish this workspace's items;
-    // a docker-compose.yml → publish is the operator's (the platform release lane).
+    // THE PLATFORM OWNER'S VERB. A remote developer never publishes: their word is
+    // `deploy studio`, and this says so instead of quietly doing it under the wrong
+    // name. In a universe checkout the operator's publish lane runs as before (on a
+    // starter kit that lane refuses by itself and names the owner's script).
     const { findWorkspace } = await import("../lib/workspace.mjs");
     const ws = findWorkspace();
-    if (ws?.kind === "assets") {
-      const { publish } = await import("../lib/publish.mjs");
-      await publish(args);
-    } else if (ws?.kind === "universe") {
+    if (ws?.kind === "universe") {
       operator({ root: ws.root, script: OPERATOR }, ["publish", ...args]);
     } else {
-      console.log(`\n  Nothing to publish here: no design/ workspace and no universe above ${process.cwd()}.\n  Start one with: unoverse create\n`);
+      console.log(`\n  publish is the platform owner's release. To ship your work: unoverse deploy studio\n`);
       process.exit(1);
     }
     break;

package/lib/publish.mjs

@@ -86,17 +86,17 @@ export async function publish(args) {
   let universe = opt("to") ?? config.universe;
   if (!universe) {
     if (!process.stdin.isTTY) die("no universe. Pass --to https://your-universe.example, or commit it in unoverse.yaml");
-    const typed = await ask(`\n  Where does this workspace publish to? ${c.dim}(e.g. universe.example.com)${c.off} `);
+    const typed = await ask(`\n  Where does this workspace deploy to? ${c.dim}(e.g. universe.example.com)${c.off} `);
     if (!typed) die("no universe given");
     universe = normaliseUrl(typed);
     await writeConfig(ws.root, { universe });
-    console.log(`  ${c.green}✓${c.off} saved to unoverse.yaml ${c.dim}(commit it: the whole team publishes there)${c.off}`);
+    console.log(`  ${c.green}✓${c.off} saved to unoverse.yaml ${c.dim}(commit it: the whole team deploys there)${c.off}`);
   } else {
     universe = normaliseUrl(universe);
   }
 
   // ── 1. lint. Nothing is sent if this fails ──────────────────────────────────
-  console.log(`\n  ${c.bold}publish ${project}${c.off} ${c.dim}→ ${universe}${c.off}\n`);
+  console.log(`\n  ${c.bold}deploy ${project}${c.off} ${c.dim}→ ${universe}${c.off}\n`);
   process.stdout.write(`  ${c.dim}checking…${c.off}`);
   const { problems, errors } = await lintForPublish(designRoot, project);
   process.stdout.write("\r                    \r");
@@ -148,7 +148,7 @@ export async function publish(args) {
 
   // ── 4. confirm, unless told not to ──────────────────────────────────────────
   if (!flag("yes")) {
-    const answer = await ask(`\n  ${toSend} item(s) → ${universe}. Publish? [y/N] `);
+    const answer = await ask(`\n  ${toSend} item(s) → ${universe}. Deploy? [y/N] `);
     if (!/^y(es)?$/i.test(answer)) {
       console.log(`  ${c.dim}cancelled${c.off}\n`);
       process.exit(0);
@@ -161,7 +161,7 @@ export async function publish(args) {
   for (const s of sent) console.log(`  ${c.green}✓${c.off} ${s.mode ?? "sent"} ${c.dim}${s.kind}/${s.name}${c.off}`);
   for (const f of failed) console.log(`  ${c.red}✗${c.off} ${f.kind}/${f.name}  ${f.why}`);
   console.log(
-    `\n  ${failed.length ? c.red + "✗" : c.green + "✓"}${c.off} ${sent.length} published` +
+    `\n  ${failed.length ? c.red + "✗" : c.green + "✓"}${c.off} ${sent.length} deployed` +
       (failed.length ? `, ${failed.length} failed` : "") + "\n",
   );
   process.exit(failed.length ? 1 : 0);

package/operator/infra/aws/main.tf

@@ -605,7 +605,13 @@ resource "aws_cognito_user_pool_client" "spa" {
   # canvas_entry is the same expression the invitation email and the canvas_url output use,
   # so the address a person is sent to is by construction an address they may return to.
   # Anything else in the variable (localhost for dev, a second front end) is kept.
-  callback_urls                        = distinct(concat([local.canvas_entry, local.studio_entry], var.oauth_callback_urls))
+  #
+  # THE CLI'S LOOPBACK IS ALWAYS ALLOWED, same rule as the app's own address: every
+  # universe is published to by `unoverse login` + `unoverse publish`, and its fixed
+  # callback is a platform constant, not an operator decision. Baked here so no tfvars
+  # ever needs it and an updated ground picks it up on the next deploy.
+  # (Callback only, not logout: the CLI never runs a logout redirect.)
+  callback_urls                        = distinct(concat([local.canvas_entry, local.studio_entry, "http://127.0.0.1:4109/callback"], var.oauth_callback_urls))
   logout_urls                          = distinct(concat([local.canvas_entry, local.studio_entry], var.oauth_callback_urls))
   supported_identity_providers         = ["COGNITO"]
 }

package/operator/infra/digitalocean/terraform.tfvars.example

@@ -29,6 +29,9 @@ canvas_public = true
 auth_issuer    = "https://your-tenant.auth0.com"
 auth_client_id = "your-spa-client-id"
 auth_audience  = "gravity-api"
+# In that client's Allowed Callback URLs, include http://127.0.0.1:4109/callback —
+# it is how `unoverse login` signs developers in from the terminal. (On AWS this is
+# automatic: the ground owns Cognito and always allows it.)
 
 # Service secrets — with these set, the rendered .env.production is COMPLETE.
 docr_token           = "dop_v1_..."   # registry token (pulls platform images)

package/operator/lib/ground.sh

@@ -313,8 +313,8 @@ openai_api_key = "FILL_ME"
 oauth_callback_urls = [
 $( if [ -n "$zone_domain" ]; then echo "  \"https://canvas.$zone_domain\","; fi )
   "http://localhost:5173", # local Studio/Canvas dev against this universe
-  "http://127.0.0.1:4109/callback", # unoverse login (the CLI's loopback; IdPs match exactly)
   # Add your Canvas URL here once a domain is set (https://canvas.<domain>).
+  # (No need to list the CLI's login callback — main.tf always allows it.)
 ]
 
 # RBAC roles (noun:verb). Each becomes a Cognito group; put a user in the group

package/operator/lib/help.sh

@@ -3,8 +3,10 @@
 #
 # Printed by the npm CLI when you are standing in a universe folder. It lists what you
 # can do to a universe, and nothing else. Commands that still exist but are not for
-# day-to-day operating (ground, dev, build, publish) are deliberately absent: a list you
-# can read in one glance is worth more than a complete one.
+# day-to-day operating (ground, dev, build) are deliberately absent: a list you can read
+# in one glance is worth more than a complete one. `publish` is listed under Anywhere:
+# it is one verb whose lane the folder decides (a design workspace publishes assets, the
+# platform monorepo root releases the platform — LOCAL_STUDIO.md §Publish is terminal-only).
 
 cmd_help() {
 
@@ -14,6 +16,8 @@ cmd_help() {
   echo -e "  ${BOLD}Anywhere${NC}"
   echo -e "    ${GREEN}create${NC}      Start something new, here"
   echo -e "    ${GREEN}studio${NC}      Author components, nodes, agent skills"
+  echo -e "    ${GREEN}publish${NC}     Ship your work ${DIM}(run it in your design workspace; signs you in if needed)${NC}"
+  echo -e "    ${GREEN}login${NC}       Sign in to a universe ${DIM}(publish asks by itself; this is for up front)${NC}"
   echo -e "    ${GREEN}where${NC}       Links to your universe ${DIM}(Canvas, API), checked live${NC}"
   echo -e "    ${GREEN}update${NC}      Update this CLI"
   echo ""

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.156",
+  "version": "0.1.158",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",