@unoverse-platform/studio 0.1.115 → 0.1.117

package/vendor/base/src/auth/agentToken.ts

@@ -0,0 +1,142 @@
+/**
+ * AN AGENT'S TOKEN: an Agent working with nobody signed in runs as itself.
+ *
+ * Design: docs/auth-security/IDENTITY.md, Agents; docs/architecture/signal/AGENTS.md § 7. The
+ * Agent is its folder, `agent:<org>/<name>`; its token is signed by THIS CELL, not by the login
+ * provider, so it works the same whatever provider signs people in. Its permissions are its
+ * folder's `access`, capped at what its owner holds (`agentSwitch.ts`); `act` names the owner.
+ *
+ * No database here. The engine keeps the key (`engine/src/agentKeys/`) and hands it in; a
+ * test can drive every branch with a key it made itself. The one network read is
+ * `engineAgentKeys`, the public half, fetched from the engine when a token is checked.
+ */
+
+import { SignJWT, jwtVerify, decodeJwt, importJWK, generateKeyPair, exportJWK, createRemoteJWKSet, type JWK, type JWTPayload, type JWTVerifyGetKey } from "jose";
+
+/** `iss` on every Agent token. A cell-local name: each cell signs with its own key, so a
+ *  token from another cell carries the same name and still fails the signature. */
+export const AGENT_ISSUER = "unoverse:agent";
+
+/** Every Agent's user id starts with this, so a node can tell one from a person. */
+export const AGENT_ID_PREFIX = "agent:";
+
+export const AGENT_ALG = "ES256";
+
+/** The longest a run is expected to take. A token is signed per run. */
+export const AGENT_TOKEN_TTL_SECONDS = 3600;
+
+export interface AgentClaims {
+  /** The Agent, `<org>/<name>`: its folder. */
+  agent: string;
+  /** Its title, for the run history. */
+  name: string;
+  /** The person who switched it on, and is accountable for it. */
+  ownerId: string;
+  /** Its `access`, already capped at the owner's own. */
+  permissions: string[];
+}
+
+export function isAgentId(id: unknown): id is string {
+  return typeof id === "string" && id.startsWith(AGENT_ID_PREFIX);
+}
+
+/** A cell's signing key as plain JSON: what the engine stores and hands in. */
+export interface AgentKeyPair {
+  kid: string;
+  publicJwk: JWK;
+  privateJwk: JWK;
+}
+
+/** Make a new key pair. The engine calls this once per cell and stores the result. */
+export async function newAgentKeyPair(kid: string): Promise<AgentKeyPair> {
+  const { publicKey, privateKey } = await generateKeyPair(AGENT_ALG, { extractable: true });
+  const publicJwk = { ...(await exportJWK(publicKey)), kid, alg: AGENT_ALG, use: "sig" };
+  const privateJwk = { ...(await exportJWK(privateKey)), kid, alg: AGENT_ALG };
+  return { kid, publicJwk, privateJwk };
+}
+
+/** Sign one run's token. `audience` is the cell's `AUTH_AUDIENCE`, the same as a person's. */
+export async function signAgentToken(
+  claims: AgentClaims,
+  key: { kid: string; privateJwk: JWK },
+  audience: string | undefined,
+  now: Date = new Date(),
+): Promise<string> {
+  const iat = Math.floor(now.getTime() / 1000);
+  const jwt = new SignJWT({
+    name: claims.name,
+    permissions: claims.permissions,
+    act: { sub: claims.ownerId },
+  })
+    .setProtectedHeader({ alg: AGENT_ALG, kid: key.kid, typ: "at+jwt" })
+    .setIssuer(AGENT_ISSUER)
+    .setSubject(`${AGENT_ID_PREFIX}${claims.agent}`)
+    .setIssuedAt(iat)
+    .setExpirationTime(iat + AGENT_TOKEN_TTL_SECONDS);
+  if (audience) jwt.setAudience(audience);
+  return jwt.sign(await importJWK(key.privateJwk, AGENT_ALG));
+}
+
+/** Is this token one this platform signed for an Agent? Read, not verified: it only picks
+ *  which check to run. */
+export function isAgentToken(token: string): boolean {
+  try {
+    return decodeJwt(token).iss === AGENT_ISSUER;
+  } catch {
+    return false;
+  }
+}
+
+export interface VerifiedAgent {
+  id: string;
+  name?: string;
+  ownerId?: string;
+  permissions: string[];
+  raw: JWTPayload;
+}
+
+/**
+ * Check an Agent's token: signature against the cell's keys, issuer, expiry, audience.
+ * Null when any of them fails. FAIL CLOSED: a token without a `permissions` list, or whose
+ * subject is not an Agent id, is refused rather than read as "no permissions".
+ */
+export async function verifyAgentToken(
+  token: string,
+  keys: JWTVerifyGetKey,
+  audience: string | undefined,
+): Promise<VerifiedAgent | null> {
+  try {
+    const { payload } = await jwtVerify(token, keys, {
+      issuer: AGENT_ISSUER,
+      algorithms: [AGENT_ALG],
+      ...(audience ? { audience } : {}),
+    });
+    if (!isAgentId(payload.sub) || !Array.isArray(payload.permissions)) return null;
+    const act = payload.act as { sub?: unknown } | undefined;
+    return {
+      id: payload.sub,
+      name: typeof payload.name === "string" ? payload.name : undefined,
+      ownerId: typeof act?.sub === "string" ? act.sub : undefined,
+      permissions: (payload.permissions as unknown[]).filter((p): p is string => typeof p === "string"),
+      raw: payload,
+    };
+  } catch (error) {
+    const code = (error as { code?: string }).code;
+    console.warn(`[auth] Agent token refused: ${code ?? (error as Error).message}`);
+    return null;
+  }
+}
+
+/**
+ * The cell's public Agent keys, from the engine's internal listener. The same address the
+ * server and the memory service already use to reach the engine (`WORKFLOW_SERVICE_URL`).
+ * jose caches the set and refetches it when a token names a key it has not seen.
+ */
+let engineKeys: JWTVerifyGetKey | null = null;
+export function engineAgentKeys(): JWTVerifyGetKey {
+  if (!engineKeys) {
+    const engine = (process.env.WORKFLOW_SERVICE_URL || "http://localhost:4101").replace(/\/$/, "");
+    engineKeys = createRemoteJWKSet(new URL(`${engine}/agent-keys/jwks.json`));
+  }
+  return engineKeys;
+}

package/vendor/base/src/auth/auth.ts

@@ -14,6 +14,7 @@
 import { jwtVerify, createRemoteJWKSet, JWTPayload } from "jose";
 import { isAuthEnabled, devIdentity } from "./authConfig.js";
 import { grantedTo } from "../security/permissions.js";
+import { isAgentToken, verifyAgentToken, engineAgentKeys } from "./agentToken.js";
 
 // Read env lazily (not at module load) so it's correct regardless of when .env loads.
 //
@@ -145,6 +146,12 @@ export async function validateJWT(token: string): Promise<AuthUser | null> {
 }
 
 async function verifyJWT(token: string): Promise<AuthUser | null> {
+  // AN AGENT'S TOKEN is signed by this cell, not the login provider (IDENTITY.md, Agents):
+  // checked against the cell's own keys, never the provider's. No email, no roles.
+  if (isAgentToken(token)) {
+    const agent = await verifyAgentToken(token, engineAgentKeys(), getAudience());
+    return agent ? { id: agent.id, roles: [], permissions: agent.permissions, raw: agent.raw } : null;
+  }
   const jwksSet = await getJWKS();
   const issuers = getIssuerCandidates();
   if (!jwksSet || issuers.length === 0) {

package/vendor/base/src/definitions/load/expand/inherit.ts

@@ -112,7 +112,7 @@ export function inheritProps(
   // could send, which is exactly the venue-renaming this flag exists to prevent.
   // `input` TRAVELS TOO (2026-09-15). An atom that marks a field `input: false` (the button's
   // `icon` and `link`) says nobody outside fills it; without the word here the host inherited
-  // the field as fillable and the tool asked the model for it (SAB transfer: four fields it
+  // the field as fillable and the tool asked the model for it (a bank's transfer form: four fields it
   // could not honestly write). Same failure as `override` above, one word later.
   const CONTRACT = ["type", "description", "maxLength", "minItems", "maxItems", "items", "hydrate", "optional", "override", "preview", "input"] as const;
   // AN ATOM INSIDE AN `Each` DESCRIBES THE ITEM, not the page. The scope is the chain of

package/vendor/base/src/definitions/load/expand/refs.ts

@@ -83,7 +83,7 @@ function applyStyleLiterals(style: unknown, lits: Record<string, unknown>): void
 
 export function applyLiterals(node: AnyNode, lits: Record<string, unknown>): void {
   // A NESTED REF FORWARDS THE LITERAL. A piece whose kind is itself a Ref to an atom
-  // (SAB's button: primary = the marketplace `button` atom with `props: {label: label}`)
+  // (a bank's button: primary = the marketplace `button` atom with `props: {label: label}`)
   // hands its host's literal on as that Ref's `with`, so the atom draws the words whether
   // the tree is expanded here or resolved by name on the client (referenced form).
   if (node.type === "Ref" && node.props && typeof node.props === "object") {

package/vendor/base/src/definitions/load/expand/walk.ts

@@ -61,7 +61,7 @@ export function expandNode(node: AnyNode, contextOrg?: string, inherit?: Record<
  * silently resolved to the marketplace `button` atom and the org's own button component
  * was never reached (2026-09-07). A bare name keeps the old order: atom first.
  *
- * AN EMBEDDED PIECE'S PRIVATE AXIS IS CHOSEN WHERE IT IS COMPOSED (2026-09-07, the SAB
+ * AN EMBEDDED PIECE'S PRIVATE AXIS IS CHOSEN WHERE IT IS COMPOSED (2026-09-07, the a bank
  * button: kinds primary/secondary/outline/link on a private `kind` axis). Its root is the
  * compiled surface shell around the switches on that axis. Inlined, the piece has no slice
  * of its own, so the host's `with` names the kind, and a host that names none gets the

package/vendor/base/src/definitions/load/load.ts

@@ -184,7 +184,12 @@ export function loadDefinition(
             if (m.preview && typeof m.preview === "object") def.preview = m.preview as Record<string, string[]>;
             // THE WORKFLOW THAT WORKS IT (UNOVERSE_HOST_PAGE.md rule 4): the manifest names it,
             // and the page reads it here to start a call on it.
-            if (m.binding && typeof m.binding === "object") def.binding = m.binding as { workflow?: string; trigger?: string; pipeline?: string };
+            if (m.binding && typeof m.binding === "object") def.binding = m.binding as { workflow?: string; trigger?: string; pipeline?: string; autoTrigger?: boolean };
+            // THE TASK IT CARRIES (docs/design/lifecycle-hooks.md): which moments have a hook, so a
+            // page that draws it knows to ask for its task. Only the moments ride; the calls stay
+            // on the server, in the template's folder.
+            if (Array.isArray(m.lifecycle))
+              (def as unknown as Record<string, unknown>).lifecycle = (m.lifecycle as Array<Record<string, unknown>>).map((e) => ({ phase: e?.phase }));
             // SPATIAL-CAPABLE, exactly as a component is (§9c, ruled 2026-08-30): a
             // template is found by what a guest says, through the same projection, the
             // same registry switch and the same embedded text. The difference is only

package/vendor/base/src/definitions/registry/agentFolders.ts

@@ -0,0 +1,113 @@
+/**
+ * AGENTS AS FOLDERS, READ (docs/architecture/signal/AGENTS.md § 3, § 3a).
+ *
+ * One shape for every Agent: `agents/<name>/agent.yaml` and its soul (`SOUL.md`). This reads them
+ * for whoever shows or runs an Agent (Studio's Agents lane, Signal, Spatial). A flat file directly
+ * in `agents/` is the older Agent file (agents.ts), read there until it is converted.
+ *
+ * Read as written: the lint (`lintObjects`) is what refuses a broken one; here a folder that cannot
+ * be read is left out with a warning, never taking the org's other Agents with it
+ * (UNOVERSE_ORGANISATION.md § 11).
+ */
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse } from "yaml";
+import { listOrgs, projectDir } from "./homes.js";
+import { isolated } from "../isolated.js";
+
+/** One Agent trigger, as the file writes it: what wakes it, and the node behind it. */
+export interface AgentTrigger {
+  name: string;
+  node?: string;
+  wakes?: string;
+  config?: Record<string, unknown>;
+}
+
+/** An Agent folder: its file as written, its soul's words, where it is. */
+export interface AgentFolder {
+  /** `<org>/<name>`. */
+  ref: string;
+  org: string;
+  name: string;
+  title?: string;
+  role?: string;
+  description?: string;
+  whenToUse?: string;
+  category?: string;
+  version?: string;
+  avatar?: string;
+  skills: string[];
+  model?: { use?: string; reasoning?: string; fallback?: string; turns?: number };
+  budget?: { perDay?: string; perRun?: string };
+  tasks: string[];
+  access: string[];
+  triggers: AgentTrigger[];
+  checkIn?: string;
+  memory?: { agent?: string };
+  askWhenUnsure?: string;
+  /** The soul's own words (character only), empty when the file is missing. */
+  soul: string;
+  /** The folder, relative to the org repo. */
+  path: string;
+}
+
+const str = (v: unknown): string | undefined => (typeof v === "string" && v.trim() ? v.trim() : undefined);
+const strs = (v: unknown): string[] => (Array.isArray(v) ? v.filter((x): x is string => typeof x === "string" && !!x.trim()) : []);
+const rec = (v: unknown): Record<string, unknown> | undefined => (v && typeof v === "object" && !Array.isArray(v) ? (v as Record<string, unknown>) : undefined);
+
+/** One Agent folder of an org, or null when it is not one. */
+export function readAgentFolder(root: string, org: string, name: string): AgentFolder | null {
+  const dir = join(root, "agents", name);
+  const file = join(dir, "agent.yaml");
+  if (!existsSync(file)) return null;
+  const doc = (parse(readFileSync(file, "utf8")) as Record<string, unknown>) ?? {};
+  if (doc.type !== "agent") return null;
+  const soulName = str(doc.soul) ?? "SOUL.md";
+  const soulFile = join(dir, soulName);
+  const model = rec(doc.model);
+  const budget = rec(doc.budget);
+  const memory = rec(doc.memory);
+  return {
+    ref: `${org}/${name}`,
+    org,
+    name,
+    title: str(doc.title),
+    role: str(doc.role),
+    description: str(doc.description),
+    whenToUse: str(doc.whenToUse),
+    category: str(doc.category),
+    version: str(doc.version),
+    avatar: str(doc.avatar),
+    skills: strs(doc.skills),
+    ...(model ? { model: { use: str(model.use), reasoning: str(model.reasoning), fallback: str(model.fallback), ...(typeof model.turns === "number" && model.turns > 0 ? { turns: Math.floor(model.turns) } : {}) } } : {}),
+    ...(budget ? { budget: { perDay: str(budget.perDay), perRun: str(budget.perRun) } } : {}),
+    tasks: strs(doc.tasks),
+    access: strs(doc.access),
+    triggers: (Array.isArray(doc.triggers) ? doc.triggers : [])
+      .map(rec)
+      .filter((c): c is Record<string, unknown> => !!c && !!str(c.name))
+      .map((c) => ({ name: str(c.name)!, node: str(c.node), wakes: str(c.wakes), ...(rec(c.config) ? { config: rec(c.config) } : {}) })),
+    checkIn: str(doc.checkIn),
+    ...(memory ? { memory: { agent: str(memory.agent) } } : {}),
+    askWhenUnsure: str(doc.askWhenUnsure),
+    soul: existsSync(soulFile) ? readFileSync(soulFile, "utf8") : "",
+    path: `agents/${name}`,
+  };
+}
+
+/** Every Agent folder of one org, by name. */
+export function listAgentFoldersIn(root: string, org: string): AgentFolder[] {
+  const dir = join(root, "agents");
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir, { withFileTypes: true })
+    .filter((e) => e.isDirectory() && !e.name.startsWith(".") && !e.name.startsWith("_"))
+    .map((e) => isolated(`agent ${org}/${e.name}`, () => readAgentFolder(root, org, e.name)) ?? null)
+    .filter((a): a is AgentFolder => a !== null)
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/** Every Agent folder across the workspace, or one org's. */
+export function listAgentFolders(org?: string): AgentFolder[] {
+  const orgs = org && org !== "all" ? [org] : listOrgs();
+  return orgs.flatMap((o) => listAgentFoldersIn(projectDir(o), o));
+}

package/vendor/base/src/definitions/registry/catalog.ts

@@ -290,7 +290,7 @@ export function loadAppManifest(ref: string): AppManifest | null {
   // the template loader); the app loader never did, so `app.previewComponents?.[0]`
   // was undefined and the app tool's whole render block — gated on that ref — was
   // skipped. The call returned cleanly, nothing reached /stream, and the model told
-  // the person to use a surface that had never appeared (SAB sab-voice, 2026-09-07).
+  // the person to use a surface that had never appeared (a bank's voice app, 2026-09-07).
   // `kind` rides along for the same reason it does on a template: the render path
   // resolves the definition in the tier `kind` names, and an app is not a component.
   return normalizeMode({

package/vendor/base/src/definitions/registry/objects.ts

@@ -94,6 +94,8 @@ export interface ObjectLink {
   match?: Record<string, string>;
   /** Fields (of `between`, or the row's side of `match`) whose values may name one thing several ways: one question per set of names says which are the same. */
   alike?: string[];
+  /** Fields of the row this line carries, added never replaced: a provider's `serves` carries its role (relationships-and-labels.md). */
+  carries?: string[];
 }
 
 /**
@@ -112,10 +114,26 @@ export interface ObjectMatching {
   evidence?: string[];
   /** Filled on both and different, as words: never the same thing. */
   ruleOut?: string[];
-  /** The node that decides a name the rules leave open (TypeSafeChoice). Absent, an open name goes to review. */
-  judge?: string;
+  /** The node that decides a name the rules leave open: a node's name (TypeSafeChoice), or a decision node with its
+   *  config ({ node: OpenAIDecision, config: { model } }), asked as the review is. Absent, an open name goes to review. */
+  judge?: string | { node: string; config?: Record<string, unknown> };
+  /**
+   * THE LINKER, BEFORE THE JUDGE (pipelines README, "Three sweeps"; owner 2026-10-10: "Splink to dedupe
+   * our entities"): a node that scores the name against each candidate's names. Sure the same, it links;
+   * sure different, the name is none of them; between, the judge decides.
+   */
+  link?: { node: string; config: Record<string, unknown> };
+  /**
+   * THE LAST LOOK (owner 2026-10-11: "use the LLM to investigate and solve these"): the node that
+   * looks again at every name a run left open, with what the documents say where it is used
+   * (OpenAIDecision). Sure, it decides as a person would, with Undo; not sure, it stays open.
+   * Absent, the judge looks.
+   */
+  review?: { node: string; config?: Record<string, unknown> };
   /** The lines (by name, e.g. a document's `about`) whose name, sure to be no record held, makes the record. A mention on any other line never does. */
   createFrom?: string[];
+  /** The object's `extract.never` words, set by the registry: left out when two names of one parent are compared ("A Shares" and "Class A"). */
+  never?: string[];
 }
 
 /**
@@ -130,6 +148,18 @@ export interface DatasetColumn {
    *  its words here and the database refuses the rest: a misspelling cannot become a second
    *  thing that never sums with the first. Absent on a column carrying a document's own words. */
   enum?: string[];
+  /** FOR A COLUMN WITH `enum`: the words a table's title or headings print for each value (net return:
+   *  [performance, returns]), so a table found by its shape is known by what it holds (tables.md 3b). */
+  wordings?: Record<string, string[]>;
+  /** FOR A COLUMN WITH `enum`: the words a key-figures row's own label prints for each value (net asset
+   *  value: [total net assets, fund size]), so "Total Net Assets | USD 126m" is one figure (tables.md 3b). */
+  rowWordings?: Record<string, string[]>;
+  /** FOR A COLUMN WITH `enum`: the words a table's COLUMN prints for each value (exposure: [market value, % of net
+   *  assets]), so a number kept from any table is known by the column it sits under (tables.md 3f, 2026-10-16). */
+  columnWordings?: Record<string, string[]>;
+  /** FOR A COLUMN WITH `enum`: the values of another column each of its values gathers (dimension fair value level:
+   *  [Level 1, Level 2, Level 3]), so a number whose row or column names one is known to be sliced that way (tables.md 3i). */
+  values?: Record<string, string[]>;
   /** string | number | integer | date | datetime | boolean. Nothing else: a type this does not
    *  name is one the generated table cannot promise anything about. */
   type: string;
@@ -152,6 +182,35 @@ export interface DatasetDefinition {
   subject?: string;
   asOf?: string;
   description?: string;
+  /** WHOSE A ROW IS, AS RECORDS (tables.md 3i step 4, 2026-10-17: the code names no industry): the object a row's subject is,
+   *  its parts, how one sits inside another, and the `level` values each is filed under. Absent: rows name no record. */
+  whose?: DatasetWhose;
+}
+
+export interface DatasetWhose {
+  /** The object a row's subject is (a fund), the column its name goes in, the `level` value for its own figures. */
+  object: string; column: string; level: string;
+  /** The subject's field of other names, the field naming what it is compared with (its index), and the `level` value for that. */
+  names?: string; compare?: string; compareLevel?: string;
+  /** How a subject sits inside another: the link from it to its parent, and the field naming the parent. */
+  within?: { link: string; field?: string };
+  /** Its parts (a fund's share classes): their object, their column, their `level` value, their name field, and the field naming their subject. */
+  part?: { object: string; column: string; level: string; name: string; of: string; measures?: string[]; perUnit?: Record<string, string> };
+  /** The subject's own measures: a figure of one is the subject's, over a part only its section named. */
+  measures?: string[];
+  /** The measures that are a record's standing terms (a fee rate): a figure of one is a field, never a row. */
+  terms?: string[];
+  /** The measures that are a subject's figure against its comparison (an excess return): a row of one that names no
+   *  subject is the subject the table's own rows name, when they name exactly one. */
+  relative?: string[];
+  /** The words a name of the subject's kind carries (fund, portfolio): an allocation's row naming one, with words of its
+   *  own, is a holding (tables.md 3c rule 3). Absent, the word fund. */
+  vehicles?: string[];
+  /** Who stands behind the subject (a fund's manager): its object, as a layout's section names it in `about`, and the
+   *  `level` value for its figures (the firm's assets under management), reached from a row's subject by a join. */
+  owner?: { object: string; level: string };
+  /** The `level` value for a document about no subject (a market note). */
+  none?: string;
 }
 
 export interface ObjectFunction {
@@ -206,6 +265,8 @@ export interface ObjectDefinition {
   links?: Record<string, ObjectLink>;
   /** How a name is matched to its rows (entity-resolution.md); absent, a line to it compares one field with one field. */
   matching?: ObjectMatching;
+  /** How a page reader picks it out of a page (pipelines README, "Or read by a node"): instructions and worked examples. */
+  extract?: { instructions?: string; examples?: { text: string; answer: Record<string, unknown>[] }[]; never?: string[]; notAlso?: string[]; notAlsoWhen?: Record<string, Record<string, string[]>>; notWhen?: string[] };
   /** THE TABLE THIS OBJECT OWNS (docs/unoverse/data/objects/dataset.md, PROPOSED 2026-09-18),
    *  from its folder's table.yaml: an object that holds many small facts read together rather
    *  than one row read alone. Absent on every ordinary object, which stays a row. */
@@ -275,12 +336,54 @@ export function readDataset(name: string, file: Record<string, any>, dir: string
     // about the column.
     if (allowed && type !== "string") findings.push(`column "${col}": only a string column may say which values it allows`);
     if (allowed && new Set(allowed).size !== allowed.length) findings.push(`column "${col}": its allowed values repeat`);
-    columns.push({ name: col, type, ...(allowed ? { enum: allowed } : {}), ...(c?.required === true ? { required: true } : {}), ...(c?.indexed === true ? { indexed: true } : {}), ...(c?.description ? { description: String(c.description) } : {}) });
+    // ITS WORDS (tables.md 3b): what a table prints for each allowed value; a key outside the list is no word of it.
+    const wordings = c?.wordings && typeof c.wordings === "object" ? Object.fromEntries(Object.entries(c.wordings as Record<string, unknown>).map(([k, v]) => [k, Array.isArray(v) ? v.map(String) : []])) : undefined;
+    if (wordings && !allowed) findings.push(`column "${col}": wordings name the words for allowed values, so the column says enum`);
+    for (const k of Object.keys(wordings ?? {})) if (allowed && !allowed.includes(k)) findings.push(`column "${col}": wordings for "${k}", which is not one of its allowed values`);
+    // AND A ROW'S OWN WORDS (key figures, tables.md 3b): kept like `wordings`, or the reader never sees them
+    // (measured 2026-10-14: dropped here, no key figure was read).
+    const rowWordings = c?.rowWordings && typeof c.rowWordings === "object" ? Object.fromEntries(Object.entries(c.rowWordings as Record<string, unknown>).map(([k, v]) => [k, Array.isArray(v) ? v.map(String) : []])) : undefined;
+    if (rowWordings && !allowed) findings.push(`column "${col}": rowWordings name the words for allowed values, so the column says enum`);
+    for (const k of Object.keys(rowWordings ?? {})) if (allowed && !allowed.includes(k)) findings.push(`column "${col}": rowWordings for "${k}", which is not one of its allowed values`);
+    // AND A COLUMN'S OWN WORDS (every number kept, tables.md 3f): kept like `wordings`.
+    const columnWordings = c?.columnWordings && typeof c.columnWordings === "object" ? Object.fromEntries(Object.entries(c.columnWordings as Record<string, unknown>).map(([k, v]) => [k, Array.isArray(v) ? v.map(String) : []])) : undefined;
+    if (columnWordings && !allowed) findings.push(`column "${col}": columnWordings name the words for allowed values, so the column says enum`);
+    for (const k of Object.keys(columnWordings ?? {})) if (allowed && !allowed.includes(k)) findings.push(`column "${col}": columnWordings for "${k}", which is not one of its allowed values`);
+    // AND THE VALUES EACH OF ITS VALUES GATHERS (a slicing's own values, tables.md 3i): kept like `wordings`.
+    const values = c?.values && typeof c.values === "object" ? Object.fromEntries(Object.entries(c.values as Record<string, unknown>).map(([k, v]) => [k, Array.isArray(v) ? v.map(String) : []])) : undefined;
+    if (values && !allowed) findings.push(`column "${col}": values name what allowed values gather, so the column says enum`);
+    for (const k of Object.keys(values ?? {})) if (allowed && !allowed.includes(k)) findings.push(`column "${col}": values for "${k}", which is not one of its allowed values`);
+    columns.push({ name: col, type, ...(allowed ? { enum: allowed } : {}), ...(wordings ? { wordings } : {}), ...(rowWordings ? { rowWordings } : {}), ...(columnWordings ? { columnWordings } : {}), ...(values ? { values } : {}), ...(c?.required === true ? { required: true } : {}), ...(c?.indexed === true ? { indexed: true } : {}), ...(c?.description ? { description: String(c.description) } : {}) });
   }
   const uniqueBy = Array.isArray(file.uniqueBy) ? file.uniqueBy.map((u: unknown) => String(u)) : undefined;
   for (const u of uniqueBy ?? []) if (!seen.has(u) && !RESERVED.has(u)) findings.push(`uniqueBy names "${u}", which is not a column`);
   if (findings.length) throw new Error(`object ${name}: ${findings.join("; ")} (${dir})`);
-  return { columns, ...(uniqueBy ? { uniqueBy } : {}), ...(file.description ? { description: String(file.description) } : {}) };
+  // WHOSE A ROW IS, AS RECORDS: kept as declared, its columns checked.
+  const w = file.whose && typeof file.whose === "object" ? (file.whose as Record<string, any>) : null;
+  const whose: DatasetWhose | undefined = w && w.object && w.column && w.level ? {
+    object: String(w.object), column: String(w.column), level: String(w.level),
+    ...(w.names ? { names: String(w.names) } : {}), ...(w.compare ? { compare: String(w.compare) } : {}), ...(w.compareLevel ? { compareLevel: String(w.compareLevel) } : {}),
+    ...(w.within?.link ? { within: { link: String(w.within.link), ...(w.within.field ? { field: String(w.within.field) } : {}) } } : {}),
+    // A PART'S OWN MEASURES (2026-10-24): a figure of one of them is always a part's ("net asset value per share" is a
+    // share class's; a fund has no price per share of its own), whatever section it is printed in.
+    ...(w.part?.object ? { part: { object: String(w.part.object), column: String(w.part.column), level: String(w.part.level), name: String(w.part.name), of: String(w.part.of), ...(Array.isArray(w.part.measures) ? { measures: w.part.measures.map(String) } : {}), ...(w.part.perUnit && typeof w.part.perUnit === "object" ? { perUnit: Object.fromEntries(Object.entries(w.part.perUnit).map(([k, v]) => [k, String(v)])) } : {}) } } : {}),
+    ...(w.none ? { none: String(w.none) } : {}),
+    ...(Array.isArray(w.measures) ? { measures: w.measures.map(String) } : {}),
+    // THE MEASURES THAT ARE TERMS (2026-10-25): a figure of one is a field of its record, never a row ("static goes into
+    // the entities, changes over time goes into the metrics").
+    ...(Array.isArray(w.terms) ? { terms: w.terms.map(String) } : {}),
+    // THE MEASURES THAT ARE A FIGURE AGAINST A COMPARISON (2026-10-25): "Excess" printed under a class's and its index's
+    // rows is that class's return above the index, as the measure's own definition says.
+    ...(Array.isArray(w.relative) ? { relative: w.relative.map(String) } : {}),
+    // WHAT A HOLDING OF THE SUBJECT'S KIND IS CALLED IN ITS NAME (tables.md 3c rule 3, 2026-10-26): a fund, a segregated portfolio.
+    ...(Array.isArray(w.vehicles) ? { vehicles: w.vehicles.map(String) } : {}),
+    // WHO STANDS BEHIND THE SUBJECT (2026-10-25): a section about a fund's manager prints the firm's figures, not the fund's.
+    ...(w.owner?.object && w.owner?.level ? { owner: { object: String(w.owner.object), level: String(w.owner.level) } } : {}),
+  } : undefined;
+  if (w && !whose) findings.push("whose names its object, its column and its level");
+  for (const col of [whose?.column, whose?.part?.column].filter(Boolean) as string[]) if (!seen.has(col)) findings.push(`whose names column "${col}", which is not a column`);
+  if (findings.length) throw new Error(`object ${name}: ${findings.join("; ")} (${dir})`);
+  return { columns, ...(uniqueBy ? { uniqueBy } : {}), ...(file.description ? { description: String(file.description) } : {}), ...(whose ? { whose } : {}) };
 }
 
 function readFolder(dir: string, name: string, org: string | undefined, seen: string[]): ObjectDefinition {
@@ -367,7 +470,8 @@ function readFolder(dir: string, name: string, org: string | undefined, seen: st
     ...(typeof envelope.element === "string" && envelope.element ? { element: envelope.element } : parent?.element ? { element: parent.element } : {}),
     ...(envelope.meta ? { meta: envelope.meta } : parent?.meta ? { meta: parent.meta } : {}),
     ...(links && Object.keys(links).length ? { links } : {}),
-    ...(envelope.matching ? { matching: envelope.matching as ObjectMatching } : parent?.matching ? { matching: parent.matching } : {}),
+    ...(envelope.matching ? { matching: { ...(envelope.matching as ObjectMatching), ...((envelope.extract as ObjectDefinition["extract"])?.never?.length ? { never: (envelope.extract as ObjectDefinition["extract"])!.never } : {}) } } : parent?.matching ? { matching: parent.matching } : {}),
+    ...(envelope.extract ? { extract: envelope.extract as ObjectDefinition["extract"] } : {}),
     ...(dataset ? { dataset } : {}),
     props,
     ownProps,

package/vendor/base/src/definitions/registry/pipelines.ts

@@ -68,11 +68,28 @@ export interface MakeEntry {
   /** How many of this object one source makes (owner, 2026-09-13): one, or many. The read asks by it; a part's entry says none. */
   cardinality?: "one" | "many";
   /**
-   * WRITTEN FROM EVERY SECTION (owner, 2026-10-05): `per: section` writes this object after the
-   * document is cut, one read per stored piece of each named section, instead of in the
-   * document's first read, which sees only its first two pages and its headings.
+   * WRITTEN FROM EVERY PAGE (owner, 2026-10-05; page-store.md, 2026-10-07: no sections): `per: page`
+   * writes this object once the document's pages are kept, one read per page, instead of in the
+   * document's first read, which sees only its first two pages.
    */
-  per?: "section";
+  per?: "page";
+  /**
+   * READ BY A NODE, FROM THE PAGES THAT NAME IT (pipelines README, "Or read by a node", owner
+   * 2026-10-09): with `per: page`, the node handed the best chunks with a template made from the
+   * object's input props, in place of a model reading every page. Its config is resolved over the
+   * run's `config` when the rows are collected.
+   */
+  read?: { node: string; config: Record<string, unknown>; chunks?: number | "all"; cacheable?: true };
+  /**
+   * READ FROM THE DOCUMENT'S TABLES TOO (pipelines/tables.md, 2026-10-12): a table's labels are
+   * matched to the object's props by their `wordings`, and a matched cell's value is copied as
+   * printed. `whose` is the node that says which of the document's rows a table is about, when
+   * the document is linked to more than one. `labels` is the node that proposes a field for a label
+   * no rule matched (column matching step 4), once per org, for a person to approve in Review.
+   */
+  /** `allocations` names the object's line an allocation table draws, one per fund it holds, carrying the weight (tables.md 3c). */
+  /** `boards` names the object's lines a board list may draw, each to whose board it is, carrying the role (tables.md 3d). */
+  tables?: { whose?: { node: string; config: Record<string, unknown> }; subject?: boolean; labels?: { node: string; config: Record<string, unknown> }; allocations?: string; boards?: string[] };
   sourceUrl?: string;
   sourceId?: string;
   /** The item's content, each value a reference over `item`, `index`, `config`, `collect`. */
@@ -154,7 +171,9 @@ function readFolder(dir: string, name: string, org: string | undefined): Pipelin
         ...(spec.any === true ? { any: list } : { each: list }),
         ...(spec.cardinality === "one" || spec.cardinality === "many" ? { cardinality: spec.cardinality as "one" | "many" } : {}),
         ...(whenOf(spec) ? { when: whenOf(spec) } : {}),
-        ...(spec.per === "section" ? { per: "section" as const } : {}),
+        ...(spec.per === "page" ? { per: "page" as const } : {}),
+        ...(isRecord(spec.read) && typeof spec.read.node === "string" ? { read: { node: spec.read.node, config: isRecord(spec.read.config) ? spec.read.config : {}, ...(spec.read.chunks === "all" || typeof spec.read.chunks === "number" ? { chunks: spec.read.chunks as number | "all" } : {}), ...(spec.read.cacheable === true ? { cacheable: true as const } : {}) } } : {}),
+        ...(isRecord(spec.tables) ? { tables: { ...(isRecord(spec.tables.whose) && typeof spec.tables.whose.node === "string" ? { whose: { node: spec.tables.whose.node, config: isRecord(spec.tables.whose.config) ? spec.tables.whose.config : {} } } : {}), ...(spec.tables.subject === true ? { subject: true } : {}), ...(isRecord(spec.tables.labels) && typeof spec.tables.labels.node === "string" ? { labels: { node: spec.tables.labels.node, config: isRecord(spec.tables.labels.config) ? spec.tables.labels.config : {} } } : {}), ...(typeof spec.tables.allocations === "string" && spec.tables.allocations ? { allocations: spec.tables.allocations } : {}), ...(Array.isArray(spec.tables.boards) && spec.tables.boards.length && spec.tables.boards.every((b: unknown) => typeof b === "string" && b) ? { boards: spec.tables.boards as string[] } : {}) } } : {}),
         sourceUrl: typeof raw.sourceUrl === "string" ? raw.sourceUrl : "{{ item.address }}",
         sourceId: typeof raw.sourceId === "string" ? raw.sourceId : "{{ item.universalId }}",
         content: isRecord(raw.content) ? raw.content : {},

package/vendor/base/src/definitions/registry/taskStarts.ts

@@ -0,0 +1,76 @@
+/**
+ * A TASK START IS A TASK (docs/mcp/MCP_TASKS.md § 2): a titled, described Task Start has an MCP
+ * tool on our own door, so any Agent a line is drawn to on its canvas can call it, and is
+ * answered with an MCP task. One rule, read by the engine's Task Start (what it offers a wired
+ * Agent) and the server (the tool it registers), so the two always name the same tool.
+ */
+import { AGENT_CARD, listAgents, type AgentFile } from "./agents.js";
+import { listApps } from "./catalog.js";
+
+/** A Task Start as a workflow saves it. */
+export interface TaskStartNode {
+  id: string;
+  type?: string;
+  data?: { config?: Record<string, unknown> };
+}
+
+const kebab = (s: string) =>
+  s
+    .trim()
+    .replace(/([a-z0-9])([A-Z])/g, "$1-$2")
+    .replace(/[^a-zA-Z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .toLowerCase();
+
+const text = (v: unknown) => (typeof v === "string" ? v.trim() : "");
+
+/**
+ * A TASK START'S NAME (docs/mcp/MCP_TASKS.md § 2a, step U2): its own `name` field, set once, so its
+ * URI (`unoverse://tasks/<org>/<name>`) never moves when someone renames the title. A Task Start
+ * saved before the field existed is named from its title, as it always was, and that name is
+ * written into the field on its next save (`withFixedTaskName`), so from then on it stays put.
+ */
+export function taskStartName(node: TaskStartNode): string {
+  const cfg = node.data?.config ?? {};
+  return text(cfg.name) || kebab(text(cfg.title));
+}
+
+/** The node with its name written in, when it has a title and no name yet. Saving calls this. */
+export function withFixedTaskName<T extends TaskStartNode>(node: T): T {
+  if (node.type !== "InputTrigger") return node;
+  const cfg = node.data?.config ?? {};
+  if (text(cfg.name) || !text(cfg.title)) return node;
+  return { ...node, data: { ...node.data, config: { ...cfg, name: kebab(text(cfg.title)) } } };
+}
+
+/**
+ * The Task a Task Start is, or undefined when it is not one yet (no title, or nothing saying what
+ * it does, or its workflow belongs to no org's app). An Agent file that already names this start
+ * IS its Task, so the start reuses that file's tool rather than minting a second one.
+ */
+export function taskOfStart(workflowId: string, node: TaskStartNode): AgentFile | undefined {
+  if (node.type !== undefined && node.type !== "InputTrigger") return undefined;
+  const known = listAgents().find((a) => a.workflow === workflowId && a.trigger === node.id);
+  if (known) return known;
+  const cfg = node.data?.config ?? {};
+  const title = text(cfg.title);
+  const description = text(cfg.description);
+  const whenToUse = text(cfg.whenToUse);
+  const id = taskStartName(node);
+  if (!id || (!description && !whenToUse)) return undefined;
+  const org = listApps().find((a) => a.binding?.workflow === workflowId)?.org;
+  if (!org) return undefined;
+  return {
+    name: `${org}/${id}`,
+    org,
+    id,
+    title,
+    ...(description ? { description } : {}),
+    ...(whenToUse ? { whenToUse } : {}),
+    app: AGENT_CARD,
+    workflow: workflowId,
+    trigger: node.id,
+    ...(text(cfg.resultFrom) ? { output: text(cfg.resultFrom) } : {}),
+    path: "",
+  };
+}