@unoverse-platform/studio 0.1.57 → 0.1.59

package/local/plugin.ts

@@ -222,7 +222,7 @@ export function localStudioHost(): Plugin {
         // 200. That has now cost three separate bugs (the /api allowlist, the dev proxy for
         // /.well-known and /publish), each of which looked like a missing route rather than
         // a filtered one.
-        if (!/^\/(dev|local|mcp|skills|prompt-blocks|registry|nodes|keys|execute|publish)\b/.test(path)) return next();
+        if (!/^\/(dev|local|mcp|skills|prompt-blocks|registry|nodes|keys|execute)\b/.test(path)) return next();
 
         /** Read a JSON request body. */
         const body = async (): Promise<Record<string, unknown>> => {
@@ -248,71 +248,10 @@ export function localStudioHost(): Plugin {
                 envFiles: [resolve(projectRoot, "..", ".env"), resolve(projectRoot, ".env")],
               });
 
-            /**
-             * PUBLISH, in two calls: plan then send.
-             *
-             * It runs HERE rather than in the browser because publishing reads the
-             * developer's disk: their definitions, and the design system they built on.
-             * A browser cannot, and a server that could would be a server this tool
-             * deliberately does not have.
-             *
-             * The token is passed per request and never stored. Studio holds it in the
-             * OIDC session for the tab (UniverseSession) and hands it over for the one
-             * call; local Studio writes no secret to disk (local/keys.ts), and connecting
-             * to a universe must not be the thing that breaks that.
-             *
-             * Same functions the CLI uses (`unoverse publish assets`), so the two cannot
-             * disagree about what a publish is.
-             */
-            case path === "/publish/plan" || path === "/publish/send": {
-              const b = await body();
-              const project = String(b.project ?? "");
-              const universe = String(b.universe ?? "");
-              const token = String(b.token ?? "");
-              if (!project || !universe || !token)
-                return json(res, { error: "project, universe and token are required" }, 400);
-
-              // Loaded through Vite's SSR runner, like the catalog and node loaders above: a bare
-              // dynamic import of a .js path does not resolve to the .ts source. The type below
-              // mirrors the module's real exports — tsc can't follow an ssrLoadModule path.
-              type PublishItem = { kind: string; name: string; why?: string; mode?: string };
-              type PublishModule = {
-                lintForPublish(designRoot: string, project: string): Promise<{ problems: unknown[]; errors: unknown[] }>;
-                collectProject(designRoot: string, project: string): unknown;
-                planPublish(collected: unknown, universe: string, token: string): Promise<Record<string, PublishItem[]>>;
-                sendPublish(plan: unknown, universe: string, token: string): Promise<{ sent: PublishItem[]; failed?: PublishItem[] }>;
-              };
-              const items = (await ssr(`${baseSrc}/items/publish.ts`)) as PublishModule;
-              const designRoot = designHome(projectRoot);
-
-              // LINT FIRST, ALWAYS. Nothing leaves the machine until the rules pass: a
-              // developer should learn about a raw hex value here, not from an HTTP error.
-              const { problems, errors } = await items.lintForPublish(designRoot, project);
-              if (errors.length) return json(res, { blocked: true, problems, errors });
-
-              const collected = items.collectProject(designRoot, project);
-              const plan = await items.planPublish(collected, universe, token);
-
-              // The screen renders kinds and names. The plan carries every file's full
-              // contents, so sending it whole would push the entire project through the
-              // browser for a list, and again on send.
-              type Lean = { kind: string; name: string; why?: string; mode?: string };
-              const lean = (list: Lean[] = []) =>
-                list.map(({ kind, name, why, mode }) => ({ kind, name, why, mode }));
-              const leanPlan = Object.fromEntries(
-                Object.entries(plan as Record<string, Lean[]>).map(([k, v]) => [k, lean(v)]),
-              );
-
-              if (path === "/publish/plan") return json(res, { problems, plan: leanPlan });
-
-              const result = await items.sendPublish(plan, universe, token);
-              return json(res, {
-                problems,
-                plan: leanPlan,
-                sent: lean(result.sent),
-                failed: lean(result.failed),
-              });
-            }
+            // NO PUBLISH ROUTES. Studio had /publish/plan and /publish/send; they moved
+            // to the terminal whole (LOCAL_STUDIO.md §Publish is terminal-only): the CLI
+            // runs the same base items/publish functions directly, and no token ever
+            // nears the browser because the browser no longer takes part.
 
             case path === "/dev/orgs":
               return json(res, { orgs: c.themeOrgs() });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unoverse-platform/studio",
-  "version": "0.1.57",
+  "version": "0.1.59",
   "type": "module",
   "description": "Unoverse Studio: the local authoring app. Reads your own rx/ folder, no backend.",
   "scripts": {

package/screens/DesignSystemView.tsx

@@ -167,7 +167,10 @@ export function DesignSystemView({
                   {isOverride("text", name) && <OverrideMark />}
                 </div>
                 <div className="min-w-0 flex-1">
-                  <div style={style as React.CSSProperties}>The quick brown fox</div>
+                  {/* A typography token carries family/size/weight/line-height only — never a
+                      colour — so the specimen would otherwise inherit Studio's ambient text
+                      colour and wash out. Paint it in the THEME's ink, like the family name below. */}
+                  <div style={{ ...(style as React.CSSProperties), color: ink }}>The quick brown fox</div>
                   <div className="mt-0.5 text-[10px]" style={{ color: sub }}>
                     {fams.length ? (
                       <>

package/screens/NativeAppHost.tsx

@@ -33,7 +33,7 @@ export function NativeAppHost({
    *  (appEngine) and this relays it, so the host's badge can tell the truth.
    *  `refused` carries the server's terminal refusal text (register_session refused
    *  the session — public-entry gate, requires.role, stale token); undefined otherwise. */
-  onStatus?: (s: { ready: boolean; connected: boolean; refused?: string }) => void;
+  onStatus?: (s: { ready: boolean; connected: boolean; refused?: string; failure?: { nodeIds: string[]; errors: Record<string, string> } }) => void;
 }) {
   const [html, setHtml] = useState<string | null>(null);
   const [error, setError] = useState<string | null>(null);
@@ -47,7 +47,7 @@ export function NativeAppHost({
       if (e.source !== frame.current?.contentWindow) return;
       if (e.data?.type === "unoverse:size" && e.data.width) setAppWidth(String(e.data.width));
       if (e.data?.type === "unoverse:status")
-        onStatus?.({ ready: !!e.data.ready, connected: !!e.data.connected, refused: typeof e.data.refused === "string" ? e.data.refused : undefined });
+        onStatus?.({ ready: !!e.data.ready, connected: !!e.data.connected, refused: typeof e.data.refused === "string" ? e.data.refused : undefined, failure: e.data.failure ?? undefined });
     };
     window.addEventListener("message", onSize);
     return () => window.removeEventListener("message", onSize);

package/screens/TemplatesView.tsx

@@ -217,7 +217,7 @@ export function TemplatesView({
   // connection and posts `unoverse:status` up; the in-page `conn` below is never
   // opened in native mode, so a badge reading it said "Offline" while the app
   // streamed (observed live). Native status wins whenever the iframe has reported.
-  const [nativeStatus, setNativeStatus] = useState<{ ready: boolean; connected: boolean; refused?: string } | null>(null);
+  const [nativeStatus, setNativeStatus] = useState<{ ready: boolean; connected: boolean; refused?: string; failure?: { nodeIds: string[]; errors: Record<string, string> } } | null>(null);
   useEffect(() => setNativeStatus(null), [selected, live]);
   // LIVE output inspector — the last submitted app output, projected through the
   // component's declared `outputs` (the same object the held tool call returns to
@@ -831,6 +831,15 @@ export function TemplatesView({
                         {nativeStatus.refused}
                       </div>
                     )}
+                    {nativeStatus?.failure && (
+                      /* The last run's WORKFLOW_ERROR, verbatim per node — developer surface
+                         only; a production app never renders this. */
+                      <div className="mb-2 rounded border px-2 py-1.5 text-[11px] leading-snug" style={{ borderColor: "#ef4444", color: "#ef4444" }}>
+                        {Object.entries(nativeStatus.failure.errors).map(([nodeId, err]) => (
+                          <div key={nodeId}><span className="font-medium">{nodeId}</span>: {err}</div>
+                        ))}
+                      </div>
+                    )}
                     {/* Read-only: the app decides. Server is environment; Workflow + Trigger
                         come from the selected app's manifest binding (no manual entry). */}
                     {(

package/src/App.tsx

@@ -18,11 +18,8 @@ import {
   PromptBlocksView,
 } from "@unoverse/studio";
 import { client, usePersistentState } from "./host";
-import { UniverseSession } from "./UniverseSession";
-import { ConnectUniverse } from "./ConnectUniverse";
-import { PublishDialog } from "./PublishDialog";
+import { OfflineSession } from "./OfflineSession";
 import { NewProject } from "./NewProject";
-import { loadUniverses, type Universe } from "./universes";
 // Local-only screens. Nodes are AUTHORED and TESTED here and nowhere else: Canvas keeps
 // the node library (using nodes), the marketplace acquires them (a universe's job).
 import { NodesView } from "./NodesView";
@@ -40,37 +37,23 @@ const NAV: { key: View; label: string; group: string }[] = [
 ];
 
 /**
- * The shell, wrapped in the session for the selected universe.
+ * The shell, inside the permanently signed-out session.
  *
- * The provider must sit ABOVE every screen, because a screen deep in the tree
- * (TemplatesView) already calls `useAuth()`. With no universe selected nothing is
- * mounted and Studio behaves exactly as it did offline.
+ * The provider must sit ABOVE every screen, because a shared screen deep in the tree
+ * (TemplatesView) calls `useAuth()` unconditionally. Local Studio has no login and no
+ * publish button — identity lives in the CLI at publish time (`unoverse publish`;
+ * LOCAL_STUDIO.md §Publish is terminal-only) — so the session it provides is the
+ * signed-out one, always.
  */
 export function App() {
-  // Which universe is selected, remembered across refreshes. The list itself lives in
-  // localStorage (universes.ts); this is only the pointer into it.
-  const [activeUrl, setActiveUrl] = usePersistentState<string | null>("studio:universe", null);
-  const active = loadUniverses().find((u) => u.url === activeUrl) ?? null;
-
   return (
-    <UniverseSession universe={active}>
-      <Shell
-        active={active}
-        onSelectUniverse={(u: Universe | null) => setActiveUrl(u?.url ?? null)}
-      />
-    </UniverseSession>
+    <OfflineSession>
+      <Shell />
+    </OfflineSession>
   );
 }
 
-function Shell({
-  active,
-  onSelectUniverse,
-}: {
-  active: Universe | null;
-  onSelectUniverse: (u: Universe | null) => void;
-}) {
-  const [connectOpen, setConnectOpen] = useState(false);
-  const [publishOpen, setPublishOpen] = useState(false);
+function Shell() {
   const [newProjectOpen, setNewProjectOpen] = useState(false);
   const [view, setView] = usePersistentState<View>("studio:view", "components");
   const [org, setOrg] = usePersistentState<string>("studio:org", "all");
@@ -168,43 +151,12 @@ function Shell({
           >
             {variant}
           </button>
-          {/* The ONLY place Studio asks for anything. Unconnected reads as an invitation,
-              not an error: working offline is a supported state, not a missing step. */}
-          <button
-            onClick={() => setConnectOpen(true)}
-            className="rounded border border-gray-700 px-2 py-1 text-gray-300 hover:text-gray-100"
-            title="Where your work publishes to"
-          >
-            {active ? active.label : "Not connected"}
-          </button>
-          {/* PUBLISHES THE SELECTED PROJECT. Disabled rather than hidden when there is
-              nowhere to send or nothing selected: a missing button reads as a missing
-              feature, a disabled one with a reason reads as a next step. */}
-          <button
-            onClick={() => setPublishOpen(true)}
-            disabled={!active || org === "all"}
-            title={
-              !active
-                ? "Connect a universe first"
-                : org === "all"
-                  ? "Pick one project to publish"
-                  : `Publish ${org} to ${active.label}`
-            }
-            className={
-              active && org !== "all"
-                ? "rounded bg-emerald-500 px-3 py-1 font-medium text-emerald-950 hover:bg-emerald-400"
-                : "rounded border border-gray-700 px-2 py-1 text-gray-500 disabled:cursor-not-allowed"
-            }
-          >
-            Publish
-          </button>
+          {/* NO PUBLISH BUTTON, DELIBERATELY (LOCAL_STUDIO.md §Publish is terminal-only).
+              Studio renders; shipping is `unoverse publish` in the terminal the developer
+              already has open, which signs in by itself when it needs to. */}
         </div>
       </header>
 
-      {publishOpen && active && org !== "all" && (
-        <PublishDialog project={org} universe={active} onClose={() => setPublishOpen(false)} />
-      )}
-
       {/* Created, then SELECTED. Making a project and leaving the developer looking at the
           old one would be a step they have to discover. */}
       {newProjectOpen && (
@@ -218,14 +170,6 @@ function Shell({
         />
       )}
 
-      {connectOpen && (
-        <ConnectUniverse
-          active={active}
-          onSelect={onSelectUniverse}
-          onClose={() => setConnectOpen(false)}
-        />
-      )}
-
       {/* The shared screens size themselves with `flex-1`, so the host must be a flex
           column. As a grid cell they would collapse to their content height. */}
       <main className="flex min-h-0 flex-col overflow-hidden">

package/src/OfflineSession.tsx

@@ -0,0 +1,50 @@
+/**
+ * The permanently signed-out session local Studio hands the shared screens.
+ *
+ * Local Studio has NO auth chrome and NO publish path (LOCAL_STUDIO.md §Publish is
+ * terminal-only, 2026-08-21): authoring is offline, and identity exists only in the CLI
+ * at publish time (`unoverse login`). But the shared screens are also Canvas's, where a
+ * real session exists, so they call `useAuth()` unconditionally — and react-oidc-context
+ * warns loudly whenever the context VALUE is falsy. So the host supplies a real value
+ * meaning SIGNED OUT, permanently.
+ *
+ * The sign-in actions throw rather than no-op: reaching one from local Studio means a
+ * shared screen forgot which host it is in (the `hasAuth` capability flag is the check
+ * it should have made), and silence would hide that.
+ */
+import type { ReactNode } from "react";
+import { AuthContext, type AuthContextProps } from "react-oidc-context";
+
+function offline(name: string) {
+  return async () => {
+    throw new Error(`${name} is not available in local Studio. Publishing signs in from the terminal: unoverse publish.`);
+  };
+}
+
+/**
+ * Cast because `AuthContextProps` also carries the oidc-client-ts settings and event
+ * surface, none of which exists without a provider and none of which the screens touch.
+ */
+const OFFLINE_SESSION = {
+  isAuthenticated: false,
+  isLoading: false,
+  user: undefined,
+  error: undefined,
+  activeNavigator: undefined,
+  signinRedirect: offline("signinRedirect"),
+  signinPopup: offline("signinPopup"),
+  signinSilent: offline("signinSilent"),
+  signoutRedirect: offline("signoutRedirect"),
+  signoutPopup: offline("signoutPopup"),
+  signoutSilent: offline("signoutSilent"),
+  removeUser: offline("removeUser"),
+  clearStaleState: offline("clearStaleState"),
+  querySessionStatus: offline("querySessionStatus"),
+  revokeTokens: offline("revokeTokens"),
+  startSilentRenew: () => {},
+  stopSilentRenew: () => {},
+} as unknown as AuthContextProps;
+
+export function OfflineSession({ children }: { children: ReactNode }) {
+  return <AuthContext.Provider value={OFFLINE_SESSION}>{children}</AuthContext.Provider>;
+}

package/src/host.ts

@@ -22,21 +22,19 @@ export const UNOVERSE_BASE = "";
 export const hasAuth = false;
 
 /**
- * The universe Studio is signed into (the header connection), or null when offline.
- * THE LIVE PREVIEW'S SERVER. One source of truth: the same selection App.tsx keeps
- * (`studio:universe` is its usePersistentState pointer into the saved universe list),
- * so it is impossible to be signed into one universe and silently previewing against
- * another. The shared screens fall back to the local dev platform only when no
- * universe is connected.
+ * THE LIVE PREVIEW'S SERVER: always null here, meaning the local dev platform.
+ *
+ * This used to read the universe picked in the header (`studio:universe`), written by
+ * the connect button. That chrome is gone (LOCAL_STUDIO.md §Publish is terminal-only) —
+ * and reading the stale localStorage value after removing the UI left Live mode aimed
+ * at a universe nobody could change or clear, failing with that universe's errors
+ * (seen live: "Unknown Unoverse template" from a universe the app was never published
+ * to). So local Studio's Live preview targets the local dev platform, full stop.
+ * Pointing Live at the workspace's own universe (unoverse.yaml) is future work and
+ * will come from the workspace, not from a browser store.
  */
 export function liveUniverseUrl(): string | null {
-  try {
-    const raw = localStorage.getItem("studio:universe");
-    const url = raw === null ? null : (JSON.parse(raw) as string | null);
-    return url || null;
-  } catch {
-    return null;
-  }
+  return null;
 }
 
 /**

package/vendor/sdk/appEngine.tsx

@@ -188,11 +188,24 @@ export function AppEngine(cfg: AppConfig) {
   // connection, so a host badge watching its own (never-opened) in-page connection
   // reads "offline" forever while this session streams (observed live). Report the
   // truth the same way size is reported; hosts that don't listen lose nothing.
+  //
+  // `failure` is the last run's WORKFLOW_ERROR detail (which node, what error) —
+  // DEVELOPER information. A production embed host doesn't listen and its users see
+  // nothing; Studio's preview listens and shows it, so a dead run stops being a
+  // silence only the server logs could explain.
+  const [failure, setFailure] = useState(store.getLastFailure());
+  useEffect(() => store.subscribe(() => setFailure(store.getLastFailure())), [store]);
   useEffect(() => {
     // `refused` carries the server's terminal refusal text (register_session isError) —
     // the one state a "Connecting…" badge must not sit on forever.
-    postToEmbedHost({ type: "unoverse:status", ready: !!conn.isReady, connected: !!conn.isConnected, refused: conn.refusal ?? undefined });
-  }, [conn.isReady, conn.isConnected, conn.refusal]);
+    postToEmbedHost({
+      type: "unoverse:status",
+      ready: !!conn.isReady,
+      connected: !!conn.isConnected,
+      refused: conn.refusal ?? undefined,
+      failure: failure ?? undefined,
+    });
+  }, [conn.isReady, conn.isConnected, conn.refusal, failure]);
 
   // VOICE (§2e-1): a `service: "voice"` app runs the native voice service — which now lives
   // in the shared renderer (StreamedUnoverseTemplate), identical to Studio. The host only

package/vendor/sdk/lib/core/connection.ts

@@ -114,8 +114,19 @@ export function applyServerMessage(store: ComponentStore, msg: ServerMessage, se
       // born WITH its first component, so the streaming-and-empty window never exists.
       if (m.state === "WORKFLOW_STARTED" || m.state === "THINKING" || m.state === "RESPONDING" || m.state === "WAITING") {
         if (m.chatId) store.startResponse(m.chatId);
+        // A new run supersedes the previous run's failure detail.
+        if (m.state === "WORKFLOW_STARTED") store.setLastFailure(null);
       } else if (m.state === "WORKFLOW_COMPLETED" || m.state === "COMPLETE") {
         store.completeResponse(m.chatId);
+      } else if (m.state === "ERROR" || m.state === "WORKFLOW_ERROR") {
+        // SETTLE the turn exactly as completion does — a failed run must not leave the
+        // thinking state open forever (the eternal dots). What DIFFERS is invisible to
+        // a production user: the failure detail is stored for a developer host to
+        // read (Studio's preview); the SDK renders none of it.
+        store.completeResponse(m.chatId);
+        const failure = (m.metadata as { failure?: { nodeIds: string[]; errors: Record<string, string> } } | undefined)
+          ?.failure;
+        if (failure) store.setLastFailure(failure);
       }
       // Lifecycle machine — the global turn status (projected for visibleWhen).
       if (m.state === "WORKFLOW_STARTED" || m.state === "THINKING") store.setLifecycle("thinking");

package/vendor/sdk/lib/core/store.ts

@@ -274,6 +274,23 @@ export class ComponentStore {
     this.bump();
   }
 
+  // --- lastFailure: DEVELOPER detail from WORKFLOW_ERROR, stored and never rendered ---
+  //
+  // The SDK is a dumb renderer: a production app's experience does not change on a
+  // failed run (the turn settles exactly as on success). The failure detail is HELD
+  // here so a developer HOST that chooses to look (Studio's app preview) can show
+  // which node died and why. No SDK surface reads it.
+  private failure: { nodeIds: string[]; errors: Record<string, string> } | null = null;
+
+  /** The last run's failure detail, or null. Cleared when a new run starts. */
+  getLastFailure(): { nodeIds: string[]; errors: Record<string, string> } | null {
+    return this.failure;
+  }
+  setLastFailure(f: { nodeIds: string[]; errors: Record<string, string> } | null): void {
+    this.failure = f;
+    this.bump();
+  }
+
   /** Apply a streamed event (COMPONENT_INIT or COMPONENT_DATA). */
   apply(event: UnoverseEvent): void {
     const key = `${event.chatId}:${event.nodeId}`;

package/src/ConnectUniverse.tsx

@@ -1,232 +0,0 @@
-/**
- * Connect to a universe: the "when you are ready" step.
- *
- * Everything before this point is offline. A developer builds components, templates and
- * nodes against their own folders with no account and no network. This screen is where
- * they choose somewhere to publish, and it is deliberately the only place Studio asks
- * for anything.
- *
- * The flow is: type an address, Studio asks that universe who authenticates it, then
- * signs in against whatever the answer was. Studio names no provider.
- *
- * See docs/architecture/LOCAL_STUDIO.md.
- */
-import { useState } from "react";
-import { useAuth } from "react-oidc-context";
-import {
-  normaliseUrl,
-  defaultLabel,
-  discover,
-  loginReady,
-  canPublish,
-  loadUniverses,
-  saveUniverse,
-  removeUniverse,
-  type Universe,
-} from "./universes";
-
-/** Decode a JWT payload without verifying it. Display only: the universe verifies. */
-function claimsOf(accessToken: string | undefined): Record<string, unknown> | null {
-  if (!accessToken) return null;
-  try {
-    return JSON.parse(atob(accessToken.split(".")[1] ?? ""));
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Sign out of the connected universe.
- *
- * `removeUser` clears the local session only: it does not sign you out of the identity
- * provider, so signing in again may return the same account without prompting. That is the
- * provider's decision, not ours, and a full federated logout needs a logout URL configured
- * per universe. Local is the honest scope for a tool.
- */
-function SignOut({ auth }: { auth: ReturnType<typeof useAuth> }) {
-  return (
-    <button
-      onClick={() => auth?.removeUser()}
-      className="text-xs text-gray-500 underline-offset-2 hover:text-gray-300 hover:underline"
-    >
-      Sign out
-    </button>
-  );
-}
-
-export function ConnectUniverse({
-  active,
-  onSelect,
-  onClose,
-}: {
-  active: Universe | null;
-  onSelect: (universe: Universe | null) => void;
-  onClose: () => void;
-}) {
-  const [universes, setUniverses] = useState<Universe[]>(() => loadUniverses());
-  const [address, setAddress] = useState("");
-  const [busy, setBusy] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-
-  // Undefined when no provider is mounted, which is the normal offline case.
-  const auth = useAuth();
-  const claims = claimsOf(auth?.user?.access_token);
-  const signedIn = Boolean(auth?.isAuthenticated);
-
-  async function connect() {
-    setError(null);
-    setBusy(true);
-    try {
-      const url = normaliseUrl(address);
-      const config = await discover(url);
-      const universe: Universe = {
-        url,
-        label: defaultLabel(url),
-        config,
-        connectedAt: new Date().toISOString(),
-      };
-      setUniverses(saveUniverse(universe));
-      setAddress("");
-      onSelect(universe);
-    } catch (e: any) {
-      // These messages are written to be actionable (universes.ts), so show them as-is.
-      setError(e?.message ?? String(e));
-    } finally {
-      setBusy(false);
-    }
-  }
-
-  function forget(url: string) {
-    setUniverses(removeUniverse(url));
-    if (active?.url === url) onSelect(null);
-  }
-
-  const readiness = active ? loginReady(active.config) : null;
-  const allowed = active && claims ? canPublish(claims, active.config) : false;
-  /** The signed-in address. Namespace-aware: Auth0 emits `email` ONLY namespaced on an
-   *  access token, so a plain `claims.email` is undefined and the id leaks into the UI. */
-  const email = (() => {
-    const direct = (claims as any)?.email;
-    if (typeof direct === "string") return direct;
-    const key = Object.keys(claims ?? {}).find((k) => k.endsWith("/email") || k.endsWith("/claims/email"));
-    const value = key ? (claims as any)[key] : undefined;
-    return typeof value === "string" ? value : null;
-  })();
-
-  /** What the token says, for the message below. Trimmed, as the checks are. */
-  const permissionList: string[] = (() => {
-    const direct = (claims as any)?.permissions;
-    const nsKey = Object.keys(claims ?? {}).find((k) => k.endsWith("/permissions"));
-    const list = Array.isArray(direct) ? direct : ((claims as any)?.[nsKey ?? ""] ?? []);
-    return Array.isArray(list) ? list.map((p) => String(p).trim()) : [];
-  })();
-
-  return (
-    <div className="fixed inset-0 z-50 flex items-start justify-center bg-black/60 p-8" onClick={onClose}>
-      <div
-        className="w-full max-w-lg rounded-xl border border-gray-800 bg-[#151b22] p-6 text-gray-200 shadow-2xl"
-        onClick={(e) => e.stopPropagation()}
-      >
-        <h2 className="text-base font-semibold text-gray-100">Publish to a universe</h2>
-        <p className="mt-1 text-xs text-gray-400">
-          Studio works offline. Connect a universe when you are ready to publish.
-        </p>
-
-        {/* Add one */}
-        <div className="mt-5 flex gap-2">
-          <input
-            value={address}
-            onChange={(e) => setAddress(e.target.value)}
-            onKeyDown={(e) => e.key === "Enter" && !busy && connect()}
-            placeholder="your-universe.com"
-            className="flex-1 rounded border border-gray-700 bg-[#1b2129] px-3 py-2 text-sm text-gray-200 placeholder:text-gray-600 focus:border-gray-500 focus:outline-none"
-          />
-          <button
-            onClick={connect}
-            disabled={busy || !address.trim()}
-            className="rounded bg-gray-100 px-4 py-2 text-sm font-medium text-gray-900 hover:bg-white disabled:opacity-30"
-          >
-            {busy ? "Checking..." : "Connect"}
-          </button>
-        </div>
-        {error && <p className="mt-2 text-xs text-red-400">{error}</p>}
-
-        {/* The ones this developer has connected to. There is no central directory of
-            universes and there cannot be: each is independent with its own provider. */}
-        {universes.length > 0 && (
-          <ul className="mt-5 space-y-2">
-            {universes.map((u) => (
-              <li
-                key={u.url}
-                className={`flex items-center justify-between rounded-md border px-3 py-2 text-sm ${
-                  active?.url === u.url
-                    ? "border-gray-500 bg-white/5"
-                    : "border-gray-800 hover:border-gray-700"
-                }`}
-              >
-                <button className="text-left" onClick={() => onSelect(u)}>
-                  <span className="font-medium">{u.label}</span>
-                  <span className="ml-2 text-gray-500">{u.url}</span>
-                </button>
-                <button className="text-xs text-gray-500 hover:text-red-400" onClick={() => forget(u.url)}>
-                  Forget
-                </button>
-              </li>
-            ))}
-          </ul>
-        )}
-
-        {/* Sign-in state for the selected universe. Every branch says what to do next. */}
-        {active && (
-          <div className="mt-5 border-t border-gray-800 pt-4 text-sm">
-            {readiness && !readiness.ok ? (
-              // A universe with auth off, or one misconfigured. Publishing is not
-              // possible, and saying so beats a redirect to a provider that is not there.
-              <p className="text-xs text-amber-400">{readiness.reason}</p>
-            ) : !signedIn ? (
-              <button
-                onClick={() => auth?.signinRedirect()}
-                className="rounded bg-gray-100 px-4 py-2 text-sm font-medium text-gray-900 hover:bg-white"
-              >
-                Sign in to {active.label}
-              </button>
-            ) : allowed ? (
-              <div className="flex items-center justify-between gap-3">
-                {/* The fact, not the identifier. A raw `auth0|692be24b…` is noise: it is not
-                    how anyone thinks of themselves, and it appeared only because `email` is a
-                    NAMESPACED claim that a plain read misses (AUTH_TOKEN_FLOW.md names this
-                    exact footgun). Read properly it is an address; absent, the sentence is
-                    better without it. */}
-                <p className="text-sm font-medium text-emerald-400">
-                  Ready to publish{email ? <span className="font-normal text-gray-400"> as {email}</span> : null}
-                </p>
-                <SignOut auth={auth} />
-              </div>
-            ) : (
-              // Signed in but without the permission. Said HERE, not at the first push,
-              // so nobody builds for an hour and then finds out.
-              <div>
-                <p className="text-xs text-amber-400">
-                  Signed in, but your account does not have{" "}
-                  <code>{active.config.publishPermission}</code> on this universe. Ask whoever
-                  administers it to grant it.
-                </p>
-                {/* WHAT THE TOKEN ACTUALLY CARRIES. Kept, in a reduced form, because "you do not
-                    have this permission" is unhelpful when the identity provider visibly
-                    says you do. Printing the claim turns a guess into a fact: it is how a
-                    leading space in an Auth0 permission (" marketplace:publish") was found,
-                    after the screens, the token and the label had all agreed it was correct. */}
-                <p className="mt-2 text-xs text-gray-500">
-                  Your token carries: <code>{permissionList.join(", ") || "no permissions claim"}</code>
-                </p>
-                <div className="mt-2">
-                  <SignOut auth={auth} />
-                </div>
-              </div>
-            )}
-          </div>
-        )}
-      </div>
-    </div>
-  );
-}

package/src/PublishDialog.tsx

@@ -1,309 +0,0 @@
-/**
- * Publish a project to the connected universe.
- *
- * PLAN, THEN SEND. Publishing writes rows that every workflow in a universe can use, so
- * "what am I about to do" is answered before anything moves. Blind publishing is how a
- * project half-lands and nobody can tell by looking.
- *
- * The plan runs the moment this opens, unasked: it reads disk and dry-runs against the
- * universe, writing nothing. Only the second press sends. An empty dialog with a button
- * marked "check" made the developer ask for the answer they opened the dialog to get.
- *
- * The work happens in Studio's local host (`local/plugin.ts`), not here: it reads the
- * developer's disk, which a browser cannot. This screen collects a decision and shows a
- * result. It calls the same functions as `unoverse publish assets`, so the two cannot
- * disagree about what a publish is.
- *
- * See docs/architecture/DECLARATIVE_NODES.md §9.
- */
-import { useEffect, useRef, useState } from "react";
-import { useAuth } from "react-oidc-context";
-import { canPublish, type Universe } from "./universes";
-
-interface Item {
-  kind: string;
-  name: string;
-  why?: string;
-  mode?: string;
-}
-interface Plan {
-  create: Item[];
-  update: Item[];
-  unchanged: Item[];
-  refused: Item[];
-}
-interface Problem {
-  level: string;
-  file: string;
-  line?: number;
-  msg: string;
-}
-
-/** Decode a JWT payload without verifying it. Display only: the universe verifies. */
-function claimsOf(token: string | undefined): Record<string, unknown> | null {
-  if (!token) return null;
-  try {
-    return JSON.parse(atob(token.split(".")[1] ?? ""));
-  } catch {
-    return null;
-  }
-}
-
-export function PublishDialog({
-  project,
-  universe,
-  onClose,
-}: {
-  project: string;
-  universe: Universe;
-  onClose: () => void;
-}) {
-  const auth = useAuth();
-  const token = auth?.user?.access_token;
-
-  const [plan, setPlan] = useState<Plan | null>(null);
-  const [problems, setProblems] = useState<Problem[]>([]);
-  const [blocked, setBlocked] = useState<Problem[] | null>(null);
-  const [sent, setSent] = useState<{ sent: Item[]; failed: Item[] } | null>(null);
-  const [busy, setBusy] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-
-  const allowed = canPublish(claimsOf(token), universe.config);
-
-  async function call(step: "plan" | "send") {
-    setError(null);
-    setBusy(true);
-    try {
-      const res = await fetch(`/publish/${step}`, {
-        method: "POST",
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ project, universe: universe.url, token }),
-      });
-      const body = await res.json();
-      if (body.error) throw new Error(body.error);
-      // Errors STOP the publish. Reported as findings rather than a failure, because the
-      // developer's next action is to fix a file, not to retry.
-      if (body.blocked) {
-        setBlocked(body.errors);
-        return;
-      }
-      setProblems(body.problems ?? []);
-      setPlan(body.plan);
-      if (step === "send") setSent({ sent: body.sent ?? [], failed: body.failed ?? [] });
-    } catch (e: any) {
-      setError(e?.message ?? String(e));
-    } finally {
-      setBusy(false);
-    }
-  }
-
-  /**
-   * PLAN ON OPEN. The dialog's whole job is to answer "what am I about to publish", so it
-   * answers it without being asked. Planning reads disk and dry-runs against the universe;
-   * it writes nothing, which is what makes running it unprompted safe.
-   *
-   * The guard is a ref rather than the usual empty dep array: `call` closes over state that
-   * changes, and a second plan on a re-render would be a wasted round trip and a flicker.
-   */
-  const planned = useRef(false);
-  useEffect(() => {
-    if (planned.current || !allowed || !token) return;
-    planned.current = true;
-    call("plan");
-  }, [allowed, token]);
-
-  const toSend = (plan?.create.length ?? 0) + (plan?.update.length ?? 0);
-  const warnings = problems.filter((p) => p.level === "warn").length;
-
-  /**
-   * ONE ROW PER ITEM. A comma-joined list per status cannot be scanned: the question a
-   * developer opens this with is "which of MY things is about to move", and that is a
-   * property of the item, not of a group heading. So every item gets a line carrying its
-   * own status, and the statuses sort so the ones that will move sit at the top.
-   *
-   * The kind is singular here, because a row is one thing. `bpp` is a style set and
-   * `bpp-chat-layout` is an app; without that word they read as five apps, which is how a
-   * developer concludes their components were never collected when they were.
-   */
-  const KIND_LABEL: Record<string, string> = {
-    component: "component",
-    atom: "atom",
-    style: "styles",
-    template: "app",
-    node: "node",
-    skill: "skill",
-    "prompt-block": "prompt block",
-    recipe: "recipe",
-  };
-
-  /**
-   * Contrast is the whole job here. Dark text on a dark panel made a five row list
-   * unreadable, so the name carries full weight, the status carries colour, and only the
-   * kind is allowed to recede.
-   */
-  const STATUS = {
-    create: { label: "new", pill: "bg-emerald-400/15 text-emerald-300 ring-emerald-400/30", order: 0 },
-    update: { label: "changed", pill: "bg-amber-400/15 text-amber-300 ring-amber-400/30", order: 1 },
-    refused: { label: "refused", pill: "bg-red-400/15 text-red-300 ring-red-400/30", order: 2 },
-    unchanged: { label: "unchanged", pill: "bg-gray-500/10 text-gray-400 ring-gray-500/30", order: 3 },
-  } as const;
-  type Status = keyof typeof STATUS;
-
-  /** Every item, flattened, carrying its status. Sorted by what will move, then by name. */
-  const rows: Array<Item & { status: Status }> = plan
-    ? (Object.keys(STATUS) as Status[])
-        .flatMap((status) => plan[status].map((i) => ({ ...i, status })))
-        .sort(
-          (a, b) =>
-            STATUS[a.status].order - STATUS[b.status].order ||
-            a.kind.localeCompare(b.kind) ||
-            a.name.localeCompare(b.name),
-        )
-    : [];
-
-  return (
-    <div className="fixed inset-0 z-50 flex items-start justify-center bg-black/60 p-8" onClick={onClose}>
-      <div
-        className="w-full max-w-xl rounded-xl border border-gray-800 bg-[#151b22] p-6 text-gray-200 shadow-2xl"
-        onClick={(e) => e.stopPropagation()}
-      >
-        <h2 className="text-base font-semibold text-gray-100">
-          Publish <span className="text-gray-400">{project}</span> to {universe.label}
-        </h2>
-
-        {/* Said HERE, before any work, not at the first push. */}
-        {!allowed && (
-          <p className="mt-3 text-xs text-amber-400">
-            Your account does not have <code>{universe.config.publishPermission}</code> on this
-            universe. Ask whoever administers it to grant it.
-          </p>
-        )}
-
-        {error && <p className="mt-3 text-xs text-red-400">{error}</p>}
-
-        {busy && !plan && !blocked && (
-          <p className="mt-4 text-sm text-gray-500">Reading {project}…</p>
-        )}
-
-        {/* Lint errors: nothing was sent, and the file and line are what fixes it. */}
-        {blocked && (
-          <div className="mt-4">
-            <p className="text-xs text-red-400">
-              {blocked.length} error{blocked.length === 1 ? "" : "s"} in {project}. Nothing was sent.
-            </p>
-            <ul className="mt-2 max-h-48 space-y-1 overflow-y-auto text-xs">
-              {blocked.slice(0, 12).map((p, i) => (
-                <li key={i} className="text-gray-400">
-                  <span className="text-gray-500">
-                    {p.file}
-                    {p.line ? `:${p.line}` : ""}
-                  </span>{" "}
-                  {p.msg}
-                </li>
-              ))}
-            </ul>
-          </div>
-        )}
-
-        {plan && !blocked && (
-          <div className="mt-4">
-            {/* The count sentence answers "how much", the list answers "which". Both, always. */}
-            <p className="text-xs font-medium uppercase tracking-wide text-gray-400">
-              {[
-                plan.create.length && `${plan.create.length} new`,
-                plan.update.length && `${plan.update.length} changed`,
-                plan.unchanged.length && `${plan.unchanged.length} unchanged`,
-                plan.refused.length && `${plan.refused.length} refused`,
-              ]
-                .filter(Boolean)
-                .join(", ") || "nothing to publish"}
-            </p>
-
-            <div className="mt-3 max-h-72 divide-y divide-white/5 overflow-y-auto rounded-lg border border-white/10 bg-black/20">
-              {rows.map((r) => (
-                <div key={`${r.kind}/${r.name}`} className="flex items-baseline gap-3 px-3 py-2 hover:bg-white/5">
-                  <span
-                    className={`w-[74px] shrink-0 rounded px-1.5 py-0.5 text-center text-[11px] font-semibold uppercase tracking-wide ring-1 ${STATUS[r.status].pill}`}
-                  >
-                    {STATUS[r.status].label}
-                  </span>
-                  <span
-                    className={`flex-1 truncate text-sm font-medium ${
-                      r.status === "unchanged" ? "text-gray-400" : "text-white"
-                    }`}
-                  >
-                    {r.name}
-                  </span>
-                  {/* The kind sits last and quiet: it labels the name rather than competing with it. */}
-                  <span className="shrink-0 text-xs text-gray-500">{KIND_LABEL[r.kind] ?? r.kind}</span>
-                  {/* The reason belongs ON the refused row: it is the only row it explains. */}
-                  {r.why && <span className="shrink-0 text-xs text-red-300">{r.why}</span>}
-                </div>
-              ))}
-            </div>
-            {/*
-              Said once, in the place where its absence gets noticed. The Components tab
-              lists the design system alongside this project's own, so a plan holding two
-              components where the tab showed eighteen reads as a collection bug.
-            */}
-            <p className="pt-3 text-xs leading-relaxed text-gray-500">
-              Only {project} publishes. Design system components, atoms and styles belong to
-              the universe already.
-            </p>
-            {/*
-              A COUNT ALONE IS USELESS. "2 warnings" tells a developer something is wrong
-              and gives them no way to find it, which is worse than silence: it is a nag
-              with no address. The file, line and message are what fixes it, so they are
-              here, one click away rather than one grep away.
-            */}
-            {warnings > 0 && (
-              <details className="pt-1">
-                <summary className="cursor-pointer text-xs text-amber-300/80 hover:text-amber-300">
-                  {warnings} warning{warnings === 1 ? "" : "s"}, not blocking
-                </summary>
-                <ul className="mt-2 max-h-40 space-y-2 overflow-y-auto text-xs">
-                  {problems
-                    .filter((p) => p.level === "warn")
-                    .map((p, i) => (
-                      <li key={i} className="leading-relaxed">
-                        <span className="text-gray-500">
-                          {p.file?.replace(/^.*\/design\//, "")}
-                          {p.line ? `:${p.line}` : ""}
-                        </span>
-                        <br />
-                        <span className="text-gray-400">{p.msg}</span>
-                      </li>
-                    ))}
-                </ul>
-              </details>
-            )}
-          </div>
-        )}
-
-        {sent && (
-          <p className={`mt-4 text-sm ${sent.failed.length ? "text-red-400" : "text-emerald-400"}`}>
-            {sent.sent.length} published{sent.failed.length ? `, ${sent.failed.length} failed` : ""}
-          </p>
-        )}
-
-        <div className="mt-6 flex items-center gap-2">
-          {plan && !sent && toSend > 0 && (
-            <button
-              onClick={() => call("send")}
-              disabled={busy}
-              className="rounded bg-emerald-500 px-4 py-2 text-sm font-semibold text-emerald-950 hover:bg-emerald-400 disabled:opacity-30"
-            >
-              {busy ? "Publishing…" : `Publish ${toSend} item${toSend === 1 ? "" : "s"}`}
-            </button>
-          )}
-          {plan && !sent && toSend === 0 && (
-            <p className="text-sm text-emerald-400">{project} is already up to date</p>
-          )}
-          <button onClick={onClose} className="rounded px-3 py-2 text-sm text-gray-400 hover:text-gray-200">
-            {sent ? "Done" : "Cancel"}
-          </button>
-        </div>
-      </div>
-    </div>
-  );
-}

package/src/UniverseSession.tsx

@@ -1,121 +0,0 @@
-/**
- * The signed-in session for ONE universe.
- *
- * Local Studio is offline and unauthenticated by default, and that must not change:
- * building a component needs no account, no network and no provider. Authentication
- * appears only when a developer connects to a universe in order to publish.
- *
- * So the provider is mounted CONDITIONALLY. With no universe selected, or one that has
- * auth switched off, children render exactly as they did before this file existed.
- *
- * THE CONFIG COMES FROM THE UNIVERSE, NOT FROM HERE. Canvas reads its issuer and client
- * id from `window.__GRAVITY_CONFIG__` injected into its own page; Studio runs on the
- * developer's machine and cannot, so it asks (`universes.ts` → discover). That is what
- * keeps the tooling provider-agnostic: nothing in Studio names Auth0.
- *
- * See docs/architecture/LOCAL_STUDIO.md.
- */
-import type { ReactNode } from "react";
-import { AuthProvider, AuthContext, type AuthContextProps } from "react-oidc-context";
-import { WebStorageStateStore } from "oidc-client-ts";
-import { loginReady, type Universe } from "./universes";
-
-/**
- * The OIDC settings for one universe. Mirrors Canvas's `oidcConfig`
- * (`apps/canvas/src/App.jsx`) so a token minted for Studio looks the same to the
- * platform as one minted for Canvas, with one difference: every value is read from the
- * universe rather than from this app's build.
- */
-function oidcConfigFor(universe: Universe) {
-  const { issuer, clientId, audience } = universe.config;
-  return {
-    authority: issuer as string,
-    client_id: clientId as string,
-    // Studio's own origin. The universe's identity provider must list this as an allowed
-    // callback, which is the one setup step a customer does on their side.
-    redirect_uri: window.location.origin,
-    scope: "openid profile email",
-    // Auth0 and friends only mint an API access token when an audience is asked for.
-    // Without it the login succeeds and the token is useless against the universe.
-    ...(audience ? { extraQueryParams: { audience } } : {}),
-    // sessionStorage, not localStorage: the token dies with the tab. Studio's standing
-    // rule is that it never persists a secret (local/keys.ts), and a token is a secret.
-    userStore: new WebStorageStateStore({ store: window.sessionStorage }),
-    // Same reason Canvas disables it: a stored user carries the redirect_uri it was
-    // minted with, and a silent renew against a different universe reuses the wrong one.
-    automaticSilentRenew: false,
-    onSigninCallback: () => {
-      window.history.replaceState({}, document.title, window.location.pathname);
-    },
-  };
-}
-
-/**
- * A signed-out session, for when Studio is not connected to a universe.
- *
- * Cast because `AuthContextProps` also carries the oidc-client-ts settings and event
- * surface, none of which exists without a provider and none of which the screens touch.
- * The honest alternative is a fake settings object, which would be a bigger lie than this.
- */
-const OFFLINE_SESSION = {
-  isAuthenticated: false,
-  isLoading: false,
-  user: undefined,
-  error: undefined,
-  activeNavigator: undefined,
-  signinRedirect: offline("signinRedirect"),
-  signinPopup: offline("signinPopup"),
-  signinSilent: offline("signinSilent"),
-  signoutRedirect: offline("signoutRedirect"),
-  signoutPopup: offline("signoutPopup"),
-  signoutSilent: offline("signoutSilent"),
-  removeUser: offline("removeUser"),
-  clearStaleState: offline("clearStaleState"),
-  querySessionStatus: offline("querySessionStatus"),
-  revokeTokens: offline("revokeTokens"),
-  startSilentRenew: () => {},
-  stopSilentRenew: () => {},
-} as unknown as AuthContextProps;
-
-/** Reject loudly: calling this means a caller forgot Studio has no universe connected. */
-function offline(name: string) {
-  return async () => {
-    throw new Error(`${name} needs a universe. Connect one first (Studio is offline).`);
-  };
-}
-
-export function UniverseSession({
-  universe,
-  children,
-}: {
-  universe: Universe | null;
-  children: ReactNode;
-}) {
-  // No universe, or one that cannot be logged into: the offline case, and the normal one.
-  //
-  // The shared screens call `useAuth()` unconditionally and cope with having no session.
-  // But react-oidc-context warns whenever the context VALUE is falsy:
-  //
-  //     const context = React.useContext(AuthContext);
-  //     if (!context) console.warn("AuthProvider context is undefined, ...");
-  //
-  // so mounting the provider with `undefined` warns exactly as loudly as mounting nothing
-  // (both were tried). With TemplatesView re-rendering it is a stream of warnings about a
-  // state that is fully supported.
-  //
-  // So hand it a real value meaning SIGNED OUT. Everything the screens read is present and
-  // false; the sign-in actions throw rather than no-op, because reaching one from here
-  // would mean a code path forgot there is no universe, and silence would hide that.
-  if (!universe || !loginReady(universe.config).ok) {
-    return <AuthContext.Provider value={OFFLINE_SESSION}>{children}</AuthContext.Provider>;
-  }
-
-  // `key` forces a fresh provider when the universe changes. Without it the library keeps
-  // the previous authority and client id, and a developer switching universes would stay
-  // signed in to the old one while appearing to be on the new.
-  return (
-    <AuthProvider key={universe.url} {...oidcConfigFor(universe)}>
-      {children}
-    </AuthProvider>
-  );
-}

package/src/universes.ts

@@ -1,210 +0,0 @@
-/**
- * The universes this developer can publish to.
- *
- * A UNIVERSE NAMES ITS OWN IDENTITY PROVIDER. Studio hardcodes no issuer and no vendor:
- * it asks a universe at `/.well-known/unoverse-universe` and follows the answer, so
- * Auth0, Okta, Entra and Keycloak all work with no change here. That is the whole reason
- * login lives in Studio (a browser, where OIDC is a redirect) rather than in the CLI.
- *
- * THERE IS NO CENTRAL DIRECTORY, and there cannot be. Every universe is independent with
- * its own database and its own IdP (docs/AUTH_TOKEN_FLOW.md: "OIDC-provider-agnostic").
- * Nothing sits above them to enumerate. So "the universes I can deploy to" means the ones
- * this developer has connected to, held here on their machine. That is the honest answer,
- * not a placeholder for a registry.
- *
- * NO TOKEN IS EVER WRITTEN HERE. Only the URL, a label, and the public config. The access
- * token stays wherever the OIDC library keeps it for the session. Local Studio already
- * holds this line for credentials (`local/keys.ts`: "Studio therefore never WRITES a
- * secret") and connecting to a universe must not be the thing that breaks it.
- *
- * See docs/architecture/LOCAL_STUDIO.md.
- */
-
-/** What a universe publishes about itself. Mirrors `getPublicAuthConfig()` on the server. */
-export interface UniverseConfig {
-  /** False means the universe is not gated at all: do not send anyone to log in. */
-  authEnabled: boolean;
-  issuer: string | null;
-  clientId: string | null;
-  audience: string | null;
-  /** The permission a token needs before this universe accepts a publish. */
-  publishPermission: string;
-}
-
-export interface Universe {
-  /** Origin, normalised. The identity of the entry: one row per universe. */
-  url: string;
-  /** What the developer calls it. Defaults to the host. */
-  label: string;
-  config: UniverseConfig;
-  /** When it was last reachable, ISO. Purely informational. */
-  connectedAt?: string;
-}
-
-const STORAGE_KEY = "studio:universes";
-
-/** The path a universe serves its public config on. */
-export const DISCOVERY_PATH = "/.well-known/unoverse-universe";
-
-/**
- * Turn whatever a developer typed into an origin.
- *
- * People type `localhost:4105`, `example.com/`, and `https://example.com/canvas`. All
- * three mean one universe, and storing them as three entries would let the same universe
- * hold three different logins. So this is the identity function for the list.
- *
- * Bare hosts default to https, EXCEPT localhost and 127.0.0.1, which are overwhelmingly
- * a developer's own machine over http and would otherwise fail confusingly.
- */
-export function normaliseUrl(input: string): string {
-  const trimmed = (input ?? "").trim();
-  if (!trimmed) throw new Error("Enter a universe address");
-
-  const isLocal = /^(https?:\/\/)?(localhost|127\.0\.0\.1)(:|\/|$)/i.test(trimmed);
-  const withScheme = /^https?:\/\//i.test(trimmed) ? trimmed : `${isLocal ? "http" : "https"}://${trimmed}`;
-
-  let parsed: URL;
-  try {
-    parsed = new URL(withScheme);
-  } catch {
-    throw new Error(`"${input}" is not a valid address`);
-  }
-  return parsed.origin;
-}
-
-/** A readable default name: the host, without the port for a real domain. */
-export function defaultLabel(url: string): string {
-  try {
-    return new URL(url).host;
-  } catch {
-    return url;
-  }
-}
-
-/**
- * Ask a universe how to log in.
- *
- * Failure here is the common case, not the exception: wrong address, universe down, a
- * plain website that is not a universe at all. Each gets a message a developer can act
- * on, because "Failed to fetch" tells them nothing about which of the three it was.
- */
-export async function discover(
-  url: string,
-  fetchImpl: typeof fetch = fetch,
-): Promise<UniverseConfig> {
-  let response: Response;
-  try {
-    response = await fetchImpl(`${url}${DISCOVERY_PATH}`, { headers: { accept: "application/json" } });
-  } catch {
-    throw new Error(`Could not reach ${url}. Check the address, and that the universe is running.`);
-  }
-
-  if (response.status === 404) {
-    throw new Error(`Something answered at ${url}, but it is not a universe.`);
-  }
-  if (!response.ok) {
-    throw new Error(`${url} answered with an error (${response.status}).`);
-  }
-
-  let body: unknown;
-  try {
-    body = await response.json();
-  } catch {
-    throw new Error(`${url} answered, but not like a universe. If it is one, it may need restarting.`);
-  }
-
-  const cfg = body as Partial<UniverseConfig>;
-  // authEnabled is the field that decides whether we send someone to log in, so its
-  // absence is a broken response rather than a default worth guessing at.
-  if (typeof cfg?.authEnabled !== "boolean") {
-    throw new Error(`${url} answered, but not like a universe. If it is one, it may need restarting.`);
-  }
-
-  return {
-    authEnabled: cfg.authEnabled,
-    issuer: cfg.issuer ?? null,
-    clientId: cfg.clientId ?? null,
-    audience: cfg.audience ?? null,
-    publishPermission: cfg.publishPermission ?? "marketplace:publish",
-  };
-}
-
-/**
- * Can this universe actually be logged into?
- *
- * A universe can say `authEnabled: true` and still be missing an issuer or a client id,
- * which is a misconfigured universe rather than a Studio problem. Saying so beats
- * redirecting the browser to `undefined`.
- */
-export function loginReady(config: UniverseConfig): { ok: true } | { ok: false; reason: string } {
-  if (!config.authEnabled) return { ok: false, reason: "This universe has authentication switched off." };
-  if (!config.issuer) return { ok: false, reason: "This universe has no identity provider configured." };
-  if (!config.clientId) return { ok: false, reason: "This universe has no client id configured for sign-in." };
-  return { ok: true };
-}
-
-/**
- * Does this token allow publishing here?
- *
- * Checked so Studio can say "signed in, but not allowed to publish" up front, instead of
- * letting someone build for an hour and fail on the push. Namespace-aware for the same
- * reason the server is: an IdP may emit `permissions` under a namespaced claim, and a
- * plain read silently returns nothing (docs/AUTH_TOKEN_FLOW.md).
- */
-export function canPublish(claims: Record<string, unknown> | null | undefined, config: UniverseConfig): boolean {
-  if (!claims) return false;
-  const direct = claims.permissions;
-  const namespacedKey = Object.keys(claims).find(
-    (k) => k.endsWith("/permissions") || k.endsWith("/claims/permissions"),
-  );
-  const list = Array.isArray(direct) ? direct : namespacedKey && Array.isArray(claims[namespacedKey]) ? (claims[namespacedKey] as unknown[]) : [];
-
-  // TRIMMED, because a permission is typed into an identity provider by a person and a
-  // stray space is invisible everywhere it is displayed. One arrived as " marketplace:publish"
-  // and cost a long debugging session: the Auth0 screen showed it assigned, the token
-  // carried it, the label printed it, and the comparison correctly said no. Nothing about
-  // surrounding whitespace is ever meaningful in a permission name.
-  const wanted = String(config.publishPermission).trim();
-  return list.some((p) => String(p).trim() === wanted);
-}
-
-// ── The stored list ───────────────────────────────────────────────────────
-
-type Store = Pick<Storage, "getItem" | "setItem">;
-
-function store(): Store | null {
-  try {
-    return typeof localStorage === "undefined" ? null : localStorage;
-  } catch {
-    return null; // storage blocked (private mode, embedded contexts)
-  }
-}
-
-/** Every universe this developer has connected to. Never throws: a corrupt entry is
- *  dropped rather than taking the whole list, and the app down with it. */
-export function loadUniverses(storage: Store | null = store()): Universe[] {
-  const raw = storage?.getItem(STORAGE_KEY);
-  if (!raw) return [];
-  try {
-    const parsed = JSON.parse(raw);
-    if (!Array.isArray(parsed)) return [];
-    return parsed.filter((u): u is Universe => typeof u?.url === "string" && typeof u?.config?.authEnabled === "boolean");
-  } catch {
-    return [];
-  }
-}
-
-/** Add or update one, keyed on url so reconnecting refreshes rather than duplicates. */
-export function saveUniverse(universe: Universe, storage: Store | null = store()): Universe[] {
-  const next = [...loadUniverses(storage).filter((u) => u.url !== universe.url), universe].sort((a, b) =>
-    a.label.localeCompare(b.label),
-  );
-  storage?.setItem(STORAGE_KEY, JSON.stringify(next));
-  return next;
-}
-
-export function removeUniverse(url: string, storage: Store | null = store()): Universe[] {
-  const next = loadUniverses(storage).filter((u) => u.url !== url);
-  storage?.setItem(STORAGE_KEY, JSON.stringify(next));
-  return next;
-}