unoverse 0.1.160 → 0.1.162

package/bin/unoverse.mjs

@@ -116,10 +116,27 @@ switch (cmd) {
     // Those two steps run via `_postupdate` in the NEWLY installed binary, not this
     // process: this file is being replaced mid-command, and copying the skill from the
     // old install would pin it one release behind forever.
-    const r = spawnSync("npm", ["install", "-g", "unoverse@latest"], { stdio: "inherit" });
+    // THE REGISTRY IS THE TRUTH, asked directly. `npm install unoverse@latest` resolves
+    // `latest` from npm's CACHED metadata, and that cache lags real releases by minutes:
+    // three updates in a row can install the same stale version while the registry has
+    // long moved on (observed live 2026-08-21, 0.1.160 served repeatedly with 0.1.161
+    // published). So update asks the registry itself which version is latest and installs
+    // THAT version by exact number with --prefer-online, which is immune to every layer
+    // of metadata cache. The registry being unreachable falls back to npm's own idea of
+    // latest, which is never worse than before.
+    let want = "";
+    try {
+      const doc = await (await fetch("https://registry.npmjs.org/unoverse", { headers: { accept: "application/vnd.npm.install-v1+json" } })).json();
+      want = doc?.["dist-tags"]?.latest ?? "";
+    } catch { /* registry unreachable: npm's latest is the best available answer */ }
+    const spec = want ? `unoverse@${want}` : "unoverse@latest";
+    const r = spawnSync("npm", ["install", "-g", spec, "--prefer-online"], { stdio: "inherit" });
     if (r.status === 0) {
       const v = spawnSync("unoverse", ["-v"], { encoding: "utf8" }).stdout?.trim();
       console.log(`\n  ✓ unoverse is now ${v || "up to date"}`);
+      if (want && v && v !== want) {
+        console.log(`  ⚠ the registry's latest is ${want}; npm delivered ${v}. Re-run in a minute, or: npm install -g unoverse@${want}`);
+      }
       spawnSync("unoverse", ["_postupdate"], { stdio: "inherit" });
     } else {
       // DO NOT GUESS THE CAUSE. This used to say "(permissions?)" whatever happened, so a

package/lib/login.mjs

@@ -174,7 +174,7 @@ export async function login(universeInput, { log = console.log } = {}) {
   if (!config.authEnabled) {
     throw new Error(
       `${origin} has authentication switched off, so there is no account to sign in with.\n` +
-        `  To publish there, set UNOVERSE_TOKEN to a publish key minted on the universe itself.`,
+        `  To deploy there, set UNOVERSE_TOKEN to a deploy key minted on the universe itself.`,
     );
   }
   if (!config.issuer) throw new Error(`${origin} has no identity provider configured.`);
@@ -257,13 +257,13 @@ export async function tokenFor(origin, { interactive = true, log = console.log }
   } else if (!config.authEnabled) {
     throw new Error(
       `${origin} has authentication switched off.\n` +
-        `  To publish there, set UNOVERSE_TOKEN to a publish key minted on the universe itself.`,
+        `  To deploy there, set UNOVERSE_TOKEN to a deploy key minted on the universe itself.`,
     );
   }
 
   if (!interactive || !process.stdin.isTTY) {
     throw new Error(
-      `No credential for ${origin}. In CI, set UNOVERSE_TOKEN to a publish key.\n` +
+      `No credential for ${origin}. In CI, set UNOVERSE_TOKEN to a deploy key.\n` +
         `  At a terminal, run: unoverse login ${origin}`,
     );
   }

package/lib/publish.mjs

@@ -74,7 +74,7 @@ export async function publish(args) {
   let project = positional;
   if (!project) {
     if (projects.length > 1) {
-      die(`several projects here. Say which:\n\n    unoverse publish <project>\n\n  Found: ${projects.join(", ")}`);
+      die(`several projects here. Say which:\n\n    unoverse deploy studio <project>\n\n  Found: ${projects.join(", ")}`);
     }
     project = projects[0];
   } else if (!projects.includes(project)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.160",
+  "version": "0.1.162",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",