unoverse 0.1.35 → 0.1.36

package/lib/create.mjs

@@ -104,6 +104,24 @@ function resolveTarget(nameArg) {
 /** Human name for the target, for messages that should not say "./.". */
 const label = (dir) => (dir === "." ? "this folder" : `./${dir}`);
 
+function dockerUp() {
+  return spawnSync("docker", ["info"], { stdio: "ignore" }).status === 0;
+}
+
+/** The ONLY honest validation is the operation itself. create used to probe the auth
+ * realm with its own HTTP call and say "token accepted", then docker login failed on
+ * the same credential two minutes later — the tool approving a token with a weaker
+ * check than the one that counts. When Docker is up, validation IS docker login (and
+ * the credential lands in the keychain, so nothing downstream logs in again). */
+function dockerLogin(token) {
+  const r = spawnSync("docker", ["login", REGISTRY_HOST, "-u", token, "--password-stdin"], {
+    input: token,
+    encoding: "utf8",
+  });
+  const err = (r.stderr || "").split("\n").filter((l) => l && !/^WARNING/i.test(l)).pop() || "";
+  return { ok: r.status === 0, err };
+}
+
 function download(dir, stripComponents = 1, filter = "") {
   mkdirSync(dir, { recursive: true });
   const r = spawnSync(
@@ -248,20 +266,32 @@ export async function create(nameArg) {
 
       console.log(`\n  ${cyan("A universe needs a registry access token.")}`);
       console.log(`  ${dim("It authorizes the platform's images. Your Unoverse admin issues it.")}\n`);
-      const token = await ask(rl, "Registry access token: ");
-      if (!token) {
-        fail("no token. The universe kit is available to licensed operators");
-        process.exit(1);
-      }
-      process.stdout.write("  validating against the registry...");
-      const valid = await validateRegistryToken(token);
-      console.log("");
-      if (!valid) {
-        fail("that token was refused by the registry");
-        console.log(`  ${dim("Check it with your Unoverse admin, then try again.")}`);
-        process.exit(1);
+      const useDocker = dockerUp();
+      let token;
+      // A refused token re-asks RIGHT HERE. Being thrown out of the wizard to run
+      // create again is its own bug.
+      for (;;) {
+        token = rawToken(await ask(rl, "Registry access token: "));
+        if (!token) {
+          fail("no token. The universe kit is available to licensed operators");
+          process.exit(1);
+        }
+        process.stdout.write("  validating against the registry...");
+        if (useDocker) {
+          const res = dockerLogin(token);
+          console.log("");
+          if (res.ok) { ok("token accepted"); break; }
+          fail("the registry refused it:");
+          console.log(`      ${dim(res.err)}`);
+          console.log(`  ${dim("Paste the registry token from your admin (dop_v1_…), or Ctrl-C to stop.")}\n`);
+        } else {
+          const valid = await validateRegistryToken(token);
+          console.log("");
+          if (valid) { ok("token accepted"); break; }
+          fail("that token was refused by the registry");
+          console.log(`  ${dim("Check it with your Unoverse admin, or Ctrl-C to stop.")}\n`);
+        }
       }
-      ok("token accepted");
 
       download(name);
       ok(`universe scaffolded in ${label(name)}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",