unoverse 0.1.36 → 0.1.38

package/lib/create.mjs

@@ -33,27 +33,44 @@ async function ask(rl, q) {
  * credential gets refused, so detect it and pass it through untouched. */
 /** The raw dop_v1 token, whichever shape was pasted. docker login needs the raw form,
  * so the base64 user:token blob is decoded before anything downstream sees it. */
-function rawToken(token) {
-  if (/^[A-Za-z0-9+/]+=*$/.test(token) && !token.startsWith("dop_v1_")) {
-    const decoded = Buffer.from(token, "base64").toString("utf8");
-    const m = /^([\x20-\x7e]+):[\x20-\x7e]+$/.exec(decoded);
-    if (m) return m[1];
+/** The credential AS A PAIR. The downloaded Docker credentials file carries
+ * base64("email:token") — the username is the ACCOUNT EMAIL, and logging in with the
+ * token as username (right for API tokens) gets "unauthorized" for it. So nothing here
+ * reduces to a bare token any more: whatever shape is pasted, the exact user:password
+ * pair comes out and is used verbatim.
+ *   raw dop_v1            → token:token
+ *   base64("u:p")         → u:p          (email:token, or :token → token:token)
+ *   the whole JSON file   → its auth value, decoded the same way
+ */
+function parseCredential(input) {
+  const t = input.trim().replace(/^["']|["']$/g, "");
+  const pair = (d) => {
+    const m = /^([\x20-\x7e]*):([\x20-\x7e]+)$/.exec(d);
+    return m ? { user: m[1] || m[2], pass: m[2] } : null;
+  };
+  const auth = /"auth"\s*:\s*"([A-Za-z0-9+/=]+)"/.exec(t);
+  if (auth) {
+    const p = pair(Buffer.from(auth[1], "base64").toString("utf8"));
+    if (p) return p;
+  }
+  if (/^[A-Za-z0-9+/]+=*$/.test(t)) {
+    const p = pair(Buffer.from(t, "base64").toString("utf8"));
+    if (p) return p;
   }
-  return token;
+  const inline = /dop_v1_[0-9a-f]{64}/.exec(t);
+  if (inline) return { user: inline[0], pass: inline[0] };
+  return { user: t, pass: t };
 }
 
-function registryAuth(token) {
-  if (/^[A-Za-z0-9+/]+=*$/.test(token)) {
-    const decoded = Buffer.from(token, "base64").toString("utf8");
-    if (/^[\x20-\x7e]+:[\x20-\x7e]+$/.test(decoded)) return token;
-  }
-  return Buffer.from(`${token}:${token}`).toString("base64");
+
+function registryAuth(cred) {
+  return Buffer.from(`${cred.user}:${cred.pass}`).toString("base64");
 }
 
 /** The gate: prove the token opens the registry before handing over the kit.
  * Docker registries use the bearer-realm flow: /v2/ answers 401 and names the
  * auth realm; presenting the token there yields 200 (valid) or 401 (refused). */
-async function validateRegistryToken(token) {
+async function validateRegistryToken(cred) {
   try {
     const probe = await fetch(`https://${REGISTRY_HOST}/v2/`);
     const wa = probe.headers.get("www-authenticate") ?? "";
@@ -62,7 +79,7 @@ async function validateRegistryToken(token) {
     if (!realm) return probe.status === 200;
     const res = await fetch(
       `${realm}?service=${encodeURIComponent(service)}&scope=registry:catalog:*`,
-      { headers: { Authorization: `Basic ${registryAuth(token)}` } },
+      { headers: { Authorization: `Basic ${registryAuth(cred)}` } },
     );
     return res.ok;
   } catch {
@@ -113,9 +130,9 @@ function dockerUp() {
  * the same credential two minutes later — the tool approving a token with a weaker
  * check than the one that counts. When Docker is up, validation IS docker login (and
  * the credential lands in the keychain, so nothing downstream logs in again). */
-function dockerLogin(token) {
-  const r = spawnSync("docker", ["login", REGISTRY_HOST, "-u", token, "--password-stdin"], {
-    input: token,
+function dockerLogin(cred) {
+  const r = spawnSync("docker", ["login", REGISTRY_HOST, "-u", cred.user, "--password-stdin"], {
+    input: cred.pass,
     encoding: "utf8",
   });
   const err = (r.stderr || "").split("\n").filter((l) => l && !/^WARNING/i.test(l)).pop() || "";
@@ -271,8 +288,8 @@ export async function create(nameArg) {
       // A refused token re-asks RIGHT HERE. Being thrown out of the wizard to run
       // create again is its own bug.
       for (;;) {
-        token = rawToken(await ask(rl, "Registry access token: "));
-        if (!token) {
+        token = parseCredential(await ask(rl, "Registry access token: "));
+        if (!token.pass) {
           fail("no token. The universe kit is available to licensed operators");
           process.exit(1);
         }
@@ -283,7 +300,7 @@ export async function create(nameArg) {
           if (res.ok) { ok("token accepted"); break; }
           fail("the registry refused it:");
           console.log(`      ${dim(res.err)}`);
-          console.log(`  ${dim("Paste the registry token from your admin (dop_v1_…), or Ctrl-C to stop.")}\n`);
+          console.log(`  ${dim("Paste the credential exactly as your admin sent it (any shape works), or Ctrl-C to stop.")}\n`);
         } else {
           const valid = await validateRegistryToken(token);
           console.log("");
@@ -321,7 +338,7 @@ export async function create(nameArg) {
       const r = spawnSync("bash", [operatorScript, "init"], {
         stdio: "inherit",
         cwd: name,
-        env: { ...process.env, UNOVERSE_DOCR_TOKEN: rawToken(token) },
+        env: { ...process.env, UNOVERSE_DOCR_TOKEN: token.pass, UNOVERSE_DOCR_USER: token.user },
       });
       if (r.status !== 0) {
         fail(`setup did not finish. Run 'unoverse start'${name === "." ? "" : ` in ./${name}`} to pick it back up`);

package/operator/lib/db-verify.sh

@@ -35,7 +35,7 @@ cmd_db_verify() {
       workflows: [
         "id", "name", "description", "nodes", "edges", "active",
         "execution_mode", "test_inputs", "umap_settings", "viewport",
-        "mcp_schema", "memory_config", "created_at", "updated_at"
+        "mcp_schema", "memory_config", "content_taxonomy", "created_at", "updated_at"
       ],
       workflow_executions: [
         "execution_id", "workflow_id", "status", "start_time", "end_time",

package/operator/lib/init.sh

@@ -140,10 +140,12 @@ cmd_init() {
   # twice minutes apart. Typed here only when init is run on its own.
   if [ -n "${UNOVERSE_DOCR_TOKEN:-}" ]; then
     DOCR_TOKEN="$UNOVERSE_DOCR_TOKEN"
+    DOCR_USER="${UNOVERSE_DOCR_USER:-$UNOVERSE_DOCR_TOKEN}"
     ok "Registry token carried over from create"
   else
     local cur_token
     cur_token=$(_env_cur DOCR_TOKEN)
+    DOCR_USER=$(_env_cur DOCR_USER)
     while true; do
       if [ -n "$cur_token" ]; then
         read -p "  DOCR Token [keep current]: " DOCR_TOKEN || { fail "no input (end of stream). Run unoverse init interactively"; exit 1; }
@@ -151,17 +153,30 @@ cmd_init() {
       else
         read -p "  DOCR Token (from your Unoverse admin): " DOCR_TOKEN || { fail "no input (end of stream). Run unoverse init interactively"; exit 1; }
       fi
+      # Accept the credential in any shape, AS A PAIR. The downloaded Docker
+      # credentials wrap base64("email:token") — the username is the email, and
+      # logging in token-as-username gets "unauthorized" for exactly that shape.
+      DOCR_USER=""
+      if [[ "$DOCR_TOKEN" != dop_v1_* ]]; then
+        local decoded
+        decoded=$(printf '%s' "$DOCR_TOKEN" | sed -E 's/.*"auth"[^"]*"([A-Za-z0-9+\/=]+)".*/\1/' | base64 -d 2>/dev/null | tr -d '\0')
+        [ -n "$decoded" ] || decoded=$(printf '%s' "$DOCR_TOKEN" | base64 -d 2>/dev/null | tr -d '\0')
+        case "$decoded" in
+          *:dop_v1_*) DOCR_USER="${decoded%%:*}"; DOCR_TOKEN="dop_v1_${decoded##*dop_v1_}";;
+        esac
+      fi
+      DOCR_USER="${DOCR_USER:-$DOCR_TOKEN}"
       if [[ "$DOCR_TOKEN" == dop_v1_* ]]; then
         break
       fi
-      fail "Token should start with dop_v1_"
+      fail "That does not look like a registry credential. Paste it exactly as it was sent"
     done
   fi
 
   # THE DOWNLOAD STARTS NOW (see the block at the top of this file).
   if [ "$DOCKER_OK" = "1" ]; then
     local login_err
-    if login_err=$(echo "$DOCR_TOKEN" | docker login "$DOCR_REGISTRY" -u "$DOCR_TOKEN" --password-stdin 2>&1 >/dev/null); then
+    if login_err=$(echo "$DOCR_TOKEN" | docker login "$DOCR_REGISTRY" -u "${DOCR_USER:-$DOCR_TOKEN}" --password-stdin 2>&1 >/dev/null); then
       start_background_pull
       echo ""
       echo -e "  ${CYAN}⬇${NC} ${DIM}Platform images are downloading in the background while you configure${NC}"
@@ -339,6 +354,7 @@ cmd_init() {
   cat > "$ROOT/.env" << ENVEOF
 # Generated by unoverse init
 DOCR_TOKEN=${DOCR_TOKEN}
+DOCR_USER=${DOCR_USER:-${DOCR_TOKEN}}
 DATABASE_URL=${DATABASE_URL}
 REDIS_HOST=${REDIS_HOST}
 REDIS_PORT=${REDIS_PORT}

package/operator/lib/start.sh

@@ -55,8 +55,10 @@ cmd_start() {
   # Login to registry if DOCR_TOKEN is set
   local docr_token
   docr_token=$(grep "^DOCR_TOKEN=" "$ROOT/.env" 2>/dev/null | cut -d'=' -f2-)
+  local docr_user
+  docr_user=$(grep "^DOCR_USER=" "$ROOT/.env" 2>/dev/null | cut -d'=' -f2-)
   if [ -n "$docr_token" ]; then
-    echo "$docr_token" | docker login registry.digitalocean.com -u "$docr_token" --password-stdin >/dev/null 2>&1 || true
+    echo "$docr_token" | docker login registry.digitalocean.com -u "${docr_user:-$docr_token}" --password-stdin >/dev/null 2>&1 || true
   fi
 
   # `start --pull` refreshes the images first. This is where refreshing a LOCAL universe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.36",
+  "version": "0.1.38",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",