@unoverse-platform/studio 0.1.110 → 0.1.111

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unoverse-platform/studio",
-  "version": "0.1.110",
+  "version": "0.1.111",
   "type": "module",
   "description": "Unoverse Studio: the local authoring app. Reads your own rx/ folder, no backend.",
   "scripts": {

package/vendor/base/src/definitions/registry/datasetSql.ts

@@ -2,13 +2,9 @@
  * A DATASET'S TABLE, AS SQL (docs/unoverse/data/objects/dataset.md, PROPOSED 2026-09-18).
  *
  * The declaration in an object's folder is the schema, so nobody writes SQL and nobody edits a
- * schema by hand. This turns that declaration into a migration: a file a person reads, approves
- * and can reverse. Nothing here runs anything.
- *
- * WHERE IT GOES. Beside the declaration, as `dataset.sql`, and never into the migrations folder:
- * a dataset's table is made at publish by the platform's one door, and a file kept where the
- * migration runner finds it would be a step someone has to run. This is what ran, written down,
- * so a schema change can be read and compared and is never invisible.
+ * schema by hand. This turns that declaration into the statements the platform's one door runs
+ * (services/dataset/ensure.ts). Nothing here runs anything, and nothing here is ever written to
+ * a file: an org holds no SQL.
  *
  * THE POLICIES ARE PART OF THE TABLE, not a later step. They are written in the same statement
  * block, so a table cannot exist without them. A table created today and secured on Thursday is
@@ -100,11 +96,10 @@ export function datasetMigration(object: string, d: DatasetDefinition, org?: str
   const indexed = d.columns.filter((c) => c.indexed);
   const lines: string[] = [];
 
-  lines.push(`-- THE ${object.toUpperCase()} DATASET (docs/unoverse/data/objects/dataset.md).`);
-  lines.push(`-- Generated from ${org ? `design/${org}` : "design"}/objects/${object}/dataset.yaml. Do not edit by hand:`);
-  lines.push(`-- edit the declaration and generate it again, so the folder and the database never disagree.`);
-  if (d.description) lines.push(`--\n-- ${d.description.replace(/\s+/g, " ")}`);
-  lines.push("");
+  // NO CALLER TEXT IN A COMMENT (2026-10-04): the org's and the object's names once went into a
+  // header here, and a line break in either ended the comment and ran what followed as SQL. What
+  // this returns is run, so it holds only names the generator squeezed or the lint checked.
+  if (d.description) lines.push(`-- ${d.description.replace(/\s+/g, " ")}`);
   lines.push(`CREATE TABLE IF NOT EXISTS ${t} (`);
   lines.push(`  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),`);
   lines.push(`  -- WHOSE IT IS, and what it belongs to. Not the author's to name, and not optional:`);

package/vendor/base/src/security/rules.ts

@@ -18,6 +18,12 @@ export interface Rule {
   requires: Requirement;
   /** Why. Required for `public` and `own-gate`, because both need a reason to be read. */
   note?: string;
+  /**
+   * `false` keeps an author's route out of the audit trail because it changes nothing a person
+   * manages: running a node test, laying a canvas out without saving. The trail is how people
+   * manage the platform (who made, changed or deleted what), never what runs on it (UNO-103).
+   */
+  audit?: false;
 }
 
 export const ALL = "*" as const;