unoverse 0.1.35 → 0.1.37

package/lib/create.mjs

@@ -33,11 +33,22 @@ async function ask(rl, q) {
  * credential gets refused, so detect it and pass it through untouched. */
 /** The raw dop_v1 token, whichever shape was pasted. docker login needs the raw form,
  * so the base64 user:token blob is decoded before anything downstream sees it. */
-function rawToken(token) {
-  if (/^[A-Za-z0-9+/]+=*$/.test(token) && !token.startsWith("dop_v1_")) {
+function rawToken(input) {
+  // Whatever shape arrives, the dop_v1 token inside comes out:
+  //  - the raw token
+  //  - base64("token:token")            (API-token docker auth)
+  //  - base64(":token")                 (DO's READ-ONLY credential: EMPTY username —
+  //    the shape the downloaded Docker Credentials file actually carries, and the one
+  //    a required-username decoder silently passed through, so docker was handed the
+  //    whole blob as a username and answered "unauthorized")
+  //  - the whole credentials JSON pasted as-is
+  const token = input.trim().replace(/^["']|["']$/g, "");
+  const inline = /dop_v1_[0-9a-f]{64}/.exec(token);
+  if (inline) return inline[0];
+  if (/^[A-Za-z0-9+/]+=*$/.test(token)) {
     const decoded = Buffer.from(token, "base64").toString("utf8");
-    const m = /^([\x20-\x7e]+):[\x20-\x7e]+$/.exec(decoded);
-    if (m) return m[1];
+    const m = /^([\x20-\x7e]*):([\x20-\x7e]+)$/.exec(decoded);
+    if (m) return m[1] || m[2];
   }
   return token;
 }
@@ -104,6 +115,24 @@ function resolveTarget(nameArg) {
 /** Human name for the target, for messages that should not say "./.". */
 const label = (dir) => (dir === "." ? "this folder" : `./${dir}`);
 
+function dockerUp() {
+  return spawnSync("docker", ["info"], { stdio: "ignore" }).status === 0;
+}
+
+/** The ONLY honest validation is the operation itself. create used to probe the auth
+ * realm with its own HTTP call and say "token accepted", then docker login failed on
+ * the same credential two minutes later — the tool approving a token with a weaker
+ * check than the one that counts. When Docker is up, validation IS docker login (and
+ * the credential lands in the keychain, so nothing downstream logs in again). */
+function dockerLogin(token) {
+  const r = spawnSync("docker", ["login", REGISTRY_HOST, "-u", token, "--password-stdin"], {
+    input: token,
+    encoding: "utf8",
+  });
+  const err = (r.stderr || "").split("\n").filter((l) => l && !/^WARNING/i.test(l)).pop() || "";
+  return { ok: r.status === 0, err };
+}
+
 function download(dir, stripComponents = 1, filter = "") {
   mkdirSync(dir, { recursive: true });
   const r = spawnSync(
@@ -248,20 +277,32 @@ export async function create(nameArg) {
 
       console.log(`\n  ${cyan("A universe needs a registry access token.")}`);
       console.log(`  ${dim("It authorizes the platform's images. Your Unoverse admin issues it.")}\n`);
-      const token = await ask(rl, "Registry access token: ");
-      if (!token) {
-        fail("no token. The universe kit is available to licensed operators");
-        process.exit(1);
-      }
-      process.stdout.write("  validating against the registry...");
-      const valid = await validateRegistryToken(token);
-      console.log("");
-      if (!valid) {
-        fail("that token was refused by the registry");
-        console.log(`  ${dim("Check it with your Unoverse admin, then try again.")}`);
-        process.exit(1);
+      const useDocker = dockerUp();
+      let token;
+      // A refused token re-asks RIGHT HERE. Being thrown out of the wizard to run
+      // create again is its own bug.
+      for (;;) {
+        token = rawToken(await ask(rl, "Registry access token: "));
+        if (!token) {
+          fail("no token. The universe kit is available to licensed operators");
+          process.exit(1);
+        }
+        process.stdout.write("  validating against the registry...");
+        if (useDocker) {
+          const res = dockerLogin(token);
+          console.log("");
+          if (res.ok) { ok("token accepted"); break; }
+          fail("the registry refused it:");
+          console.log(`      ${dim(res.err)}`);
+          console.log(`  ${dim("Paste the credential exactly as your admin sent it (any shape works), or Ctrl-C to stop.")}\n`);
+        } else {
+          const valid = await validateRegistryToken(token);
+          console.log("");
+          if (valid) { ok("token accepted"); break; }
+          fail("that token was refused by the registry");
+          console.log(`  ${dim("Check it with your Unoverse admin, or Ctrl-C to stop.")}\n`);
+        }
       }
-      ok("token accepted");
 
       download(name);
       ok(`universe scaffolded in ${label(name)}`);

package/operator/lib/db-verify.sh

@@ -35,7 +35,7 @@ cmd_db_verify() {
       workflows: [
         "id", "name", "description", "nodes", "edges", "active",
         "execution_mode", "test_inputs", "umap_settings", "viewport",
-        "mcp_schema", "memory_config", "created_at", "updated_at"
+        "mcp_schema", "memory_config", "content_taxonomy", "created_at", "updated_at"
       ],
       workflow_executions: [
         "execution_id", "workflow_id", "status", "start_time", "end_time",

package/operator/lib/init.sh

@@ -151,10 +151,18 @@ cmd_init() {
       else
         read -p "  DOCR Token (from your Unoverse admin): " DOCR_TOKEN || { fail "no input (end of stream). Run unoverse init interactively"; exit 1; }
       fi
+      # Accept the credential in any shape: raw dop_v1, or the base64 blob from DO's
+      # downloaded Docker credentials (which does NOT start with dop_v1 — it wraps the
+      # token behind an empty username). Extract rather than lecture about the format.
+      if [[ "$DOCR_TOKEN" != dop_v1_* ]]; then
+        local decoded
+        decoded=$(printf '%s' "$DOCR_TOKEN" | base64 -d 2>/dev/null | tr -d '\0')
+        case "$decoded" in *dop_v1_*) DOCR_TOKEN="dop_v1_${decoded##*dop_v1_}";; esac
+      fi
       if [[ "$DOCR_TOKEN" == dop_v1_* ]]; then
         break
       fi
-      fail "Token should start with dop_v1_"
+      fail "That does not look like a registry credential. Paste it exactly as it was sent"
     done
   fi
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.35",
+  "version": "0.1.37",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",