@unoverse-platform/studio 0.1.109 → 0.1.111

package/vendor/base/src/paths.ts

@@ -14,6 +14,12 @@ import * as path from "path";
 import { fileURLToPath } from "url";
 import { existsSync, renameSync } from "fs";
 
+/**
+ * Where the marketplace package keeps the tier, relative to the repo that holds it. Also the
+ * platform repo's marker (findHome), so it is declared before anything resolves.
+ */
+const MARKETPLACE_IN_REPO = path.join("packages", "marketplace", "definitions");
+
 /**
  * Find the content home when nobody said.
  *
@@ -27,11 +33,17 @@ function findHome(): string {
 
   let dir = path.dirname(fileURLToPath(import.meta.url));
   for (;;) {
-    // The in-repo home. Checked for `design` as well as the folder itself, so a stray
-    // directory of the same name elsewhere cannot claim it. (`nodes` was the marker until
-    // 2026-09-08, when nodes moved under design/marketplace with every other kind.)
+    // The in-repo home: `apps/unoverse` in a repo that also carries the marketplace tier
+    // (`packages/marketplace/definitions`), so a stray `apps/unoverse` elsewhere cannot
+    // claim it. The marker was `apps/unoverse/design` until 2026-10-04, when the design tree
+    // was retired (orgs live in their own repos, the tier in the marketplace package, the
+    // editor schemas on the docs site); `nodes` was the marker before 2026-09-08.
+    //
+    // NEITHER MARKER IS IN AN IMAGE. `.dockerignore` excludes the marketplace tier exactly
+    // as it excluded the design tree, so a deployed universe finds nothing here and falls
+    // back below, as it always has.
     const candidate = path.join(dir, "apps/unoverse");
-    if (existsSync(path.join(candidate, "design"))) return candidate;
+    if (existsSync(path.join(dir, MARKETPLACE_IN_REPO)) && existsSync(candidate)) return candidate;
     const parent = path.dirname(dir);
     if (parent === dir) break;
     dir = parent;
@@ -41,8 +53,9 @@ function findHome(): string {
   // produced the silent-wrong-path failures, so say so instead: every export below becomes
   // a path under cwd, and anything reading them will fail somewhere obvious.
   console.warn(
-    "[unoverse:base] UNOVERSE_HOME is not set and no apps/unoverse was found above this package. " +
-      "Falling back to the working directory; set UNOVERSE_HOME to the folder holding design/.",
+    "[unoverse:base] UNOVERSE_HOME is not set and no platform repo (apps/unoverse beside " +
+      "packages/marketplace/definitions) was found above this package. Falling back to the " +
+      "working directory; set UNOVERSE_HOME to the content home.",
   );
   return process.cwd();
 }
@@ -51,9 +64,13 @@ let HOME = findHome();
 
 /** Everything the runtime reads off disk, in one place. */
 export interface Paths {
-  /** Node packages: the marketplace tier's nodes, under design/marketplace/nodes. */
+  /** Node packages: the marketplace tier's nodes, `<marketplace>/nodes`. */
   nodes: string;
-  /** Design data: components, templates, styles. */
+  /**
+   * The design tree, `<home>/design`: one folder per org in a workspace that keeps orgs this
+   * way. ABSENT in the platform repo (retired 2026-10-04) and on a deployed universe, and every
+   * reader takes an absent tree as "no org tier here", never as an error.
+   */
   design: string;
   /** Authored agent skills (SKILL.md). */
   skills: string;
@@ -63,7 +80,13 @@ export interface Paths {
   plugins: string;
   /** LEGACY: the pre-migration node package folders. Usually absent. */
   packages: string;
-  /** LEGACY: the pre-migration marketplace folder. Usually absent. */
+  /**
+   * THE MARKETPLACE TIER on disk: components, atoms, templates, styles, objects, pipelines,
+   * skills, blocks and nodes. In the monorepo it is `packages/marketplace/definitions`, the
+   * folder the marketplace package publishes, authored where it ships. Absent anywhere else
+   * (a deployed universe, a developer's project), where the tier comes from installed rows
+   * or the installed package instead. Every reader of the tier starts here.
+   */
   marketplace: string;
   /**
    * AN ORG'S OWN REPO (UNO-88). When set, the home IS this one org: its folders at the root,
@@ -100,19 +123,40 @@ export function designDir(root: string): string {
   return design;
 }
 
+/**
+ * Find the marketplace tier for a home: `packages/marketplace/definitions` in the repo that
+ * holds the home, which is the home itself or the nearest folder above it carrying one.
+ *
+ * ANCHORED ON THE FOLDER, like findHome, never on a depth. A home with no such folder above
+ * it (a deployed universe, a developer's project, a test's scratch home) gets the path it
+ * would have inside the home itself, which does not exist, so the tier there resolves from
+ * installed rows or the installed package exactly as it did when the tier lived elsewhere.
+ */
+function findMarketplace(home: string): string {
+  for (let dir = home; ; ) {
+    const candidate = path.join(dir, MARKETPLACE_IN_REPO);
+    if (existsSync(candidate)) return candidate;
+    const parent = path.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return path.join(home, MARKETPLACE_IN_REPO);
+}
+
 function derive(home: string): Paths {
+  const marketplace = findMarketplace(home);
   return {
     design: designDir(home),
-    // THE MARKETPLACE TIER, and it lives under design/ with every other kind.
+    // THE MARKETPLACE TIER, ONE ROOT FOR EVERY KIND (`marketplace` below).
     //
-    // Skills and blocks were authored in a `prompts/` folder beside design/, left from
-    // before components, templates, atoms and styles took their marketplace home under
-    // `design/marketplace/`. Two roots for one tier is what let a surface read half of
-    // it and look right. There is one authoring root now: `design/`. Nodes were the
-    // last kind outside it, at `nodes/` beside design/, until 2026-09-08.
-    nodes: path.join(designDir(home), "marketplace/nodes"),
-    skills: path.join(designDir(home), "marketplace/skills"),
-    promptBlocks: path.join(designDir(home), "marketplace/blocks"),
+    // Skills and blocks were authored in a `prompts/` folder beside design/, and nodes in
+    // `nodes/` beside it until 2026-09-08. Two roots for one tier is what let a surface
+    // read half of it and look right. The tier was then authored under
+    // `design/marketplace/` and copied into the marketplace package on every release; it
+    // is authored in the package now, so there is one copy and it is the one that ships.
+    nodes: path.join(marketplace, "nodes"),
+    skills: path.join(marketplace, "skills"),
+    promptBlocks: path.join(marketplace, "blocks"),
     plugins: path.join(home, "plugins"),
     // DELIBERATELY under the home, not at the repo root.
     //
@@ -121,7 +165,7 @@ function derive(home: string): Paths {
     // the @unoverse-platform scope with an entry point, so it found THIS package and
     // returned ["@unoverse-platform/base"] — the runtime being offered as a node.
     packages: path.join(home, "packages"),
-    marketplace: path.join(home, "packages-marketplace"),
+    marketplace,
   };
 }
 
@@ -156,6 +200,8 @@ export const NODES_HOME = paths.nodes;
 export const DESIGN_HOME = paths.design;
 export const SKILLS_HOME = paths.skills;
 export const PROMPT_BLOCKS_HOME = paths.promptBlocks;
+/** The marketplace tier on disk (`Paths.marketplace`). */
+export const MARKETPLACE_HOME = paths.marketplace;
 /**
  * Where INSTALLED items are written so the loaders can read them (items/hydrate.ts).
  *
@@ -190,4 +236,3 @@ export function databaseOnly(): boolean {
 }
 export const PLUGINS_DIR = paths.plugins;
 export const PACKAGES_PATH = paths.packages;
-export const MARKETPLACE_PATH = paths.marketplace;

package/vendor/base/src/plugins/discovery.ts

@@ -39,7 +39,7 @@ function scanPluginDir(dir: string, scopes: string[]): string[] {
   return plugins;
 }
 
-/** The marketplace tier's node packages (apps/unoverse/design/marketplace/nodes). */
+/** The marketplace tier's node packages (packages/marketplace/definitions/nodes). */
 export function discoverNodesHome(): string[] {
   return scanPluginDir(NODES_HOME, ["@unoverse-platform/"]);
 }

package/vendor/base/src/plugins/loader.ts

@@ -7,7 +7,7 @@ import * as path from "path";
 import { execSync } from "child_process";
 import { pathToFileURL } from "url";
 import { getNodeRegistry, getPluginNodeMap, deleteNode } from "../registry.js";
-import { PACKAGES_PATH, MARKETPLACE_PATH, PLUGINS_DIR, NODES_HOME } from "../paths.js";
+import { PACKAGES_PATH, PLUGINS_DIR, NODES_HOME } from "../paths.js";
 
 /**
  * Resolve a package directory's entry file from its package.json.
@@ -87,18 +87,16 @@ export async function loadPlugin(pluginName: string, api: any): Promise<string[]
 
   try {
     const shortName = pluginName.replace(/@[^/]+\//, "");
-    // Resolution order: the in-Unoverse node home wins, then legacy /packages,
-    // then /packages-marketplace, then the bare npm specifier.
+    // Resolution order: the in-Unoverse node home wins, then legacy /packages, then the
+    // bare npm specifier. (A `packages-marketplace` folder was searched third until the
+    // marketplace tier took that setting's name; no checkout or image had one.)
     const homePath = path.join(NODES_HOME, shortName);
     const pkgPath = path.join(PACKAGES_PATH, shortName);
-    const mktPath = path.join(MARKETPLACE_PATH, shortName);
     const resolvedPath = fs.existsSync(homePath)
       ? homePath
       : fs.existsSync(pkgPath)
         ? pkgPath
-        : fs.existsSync(mktPath)
-          ? mktPath
-          : pluginName;
+        : pluginName;
 
     const pkg = await importPluginModule(resolvedPath);
     const plugin = pkg.default || pkg;

package/vendor/base/src/security/rules.ts

@@ -18,6 +18,12 @@ export interface Rule {
   requires: Requirement;
   /** Why. Required for `public` and `own-gate`, because both need a reason to be read. */
   note?: string;
+  /**
+   * `false` keeps an author's route out of the audit trail because it changes nothing a person
+   * manages: running a node test, laying a canvas out without saving. The trail is how people
+   * manage the platform (who made, changed or deleted what), never what runs on it (UNO-103).
+   */
+  audit?: false;
 }
 
 export const ALL = "*" as const;