@unoverse-platform/studio 0.1.96 → 0.1.98

package/vendor/base/src/lint/nodes/node.mjs

@@ -12,7 +12,7 @@
  */
 import { readdirSync, readFileSync, existsSync, statSync } from "node:fs";
 import { join, relative, resolve, dirname } from "node:path";
-import { report, rel, refCounts, derivedKinds, allCredentials, state } from "../context.mjs";
+import { report, rel, refCounts, derivedKinds, allCredentials, attachments, configFields, state } from "../context.mjs";
 import { SCHEMA_ID, SECTIONS, validateAgainst, Validator } from "./schema.mjs";
 import { readYaml, resolveRefs, sharedDirFor } from "./load.mjs";
 import { HANDLEBARS_HELPERS, promptBlocks } from "./blocks.mjs";
@@ -110,6 +110,11 @@ export function lintNode(dir, pkg) {
       (spec?.calls ?? []).map((c, i) => ({ at: `service.${m}.calls[${i}]${c?.name ? ` (${c.name})` : ""}`, call: c })),
     ),
   ].filter((c) => c.call && typeof c.call === "object");
+  // THE CALLS INSIDE A TURN are calls like any other: their hosts, credentials and transports
+  // are checked the same way, or a repeat would be a way round every rule below.
+  for (const { at, call } of [...calls])
+    for (const [j, ic] of (Array.isArray(call?.repeat?.calls) ? call.repeat.calls : []).entries())
+      if (ic && typeof ic === "object") calls.push({ at: `${at}.repeat.calls[${j}]${ic.name ? ` (${ic.name})` : ""}`, call: ic });
 
   /**
    * Every LIST of calls in the node, with whether its last one may stream.
@@ -124,6 +129,11 @@ export function lintNode(dir, pkg) {
       .filter(([, spec]) => spec?.calls)
       .map(([m, spec]) => ({ at: `service.${m}.calls`, list: spec.calls, lastMayStream: false })),
   ];
+  // A TURN is a list of calls too: named, unique, and every one settles, because the next call,
+  // `until` and the next turn all read it.
+  for (const { at, list } of [...chains])
+    for (const [i, s] of (Array.isArray(list) ? list : []).entries())
+      if (Array.isArray(s?.repeat?.calls)) chains.push({ at: `${at}[${i}].repeat.calls`, list: s.repeat.calls, lastMayStream: false });
 
   // A PURE SERVICE node legitimately has no outputs: it is never triggered by the
   // graph, it answers callers and hands them a value. Any other node with no outputs
@@ -137,7 +147,17 @@ export function lintNode(dir, pkg) {
   // Both halves matter: a node with inputs but no outputs is still an error, because something
   // reaches it and then the data stops dead.
   const isAnnotation = !outputs.size && !(iface.inputs ?? []).length && !api;
-  if (!outputs.size && !api?.service && !isAnnotation)
+  /**
+   * AN ATTACHMENT is the third legitimate case, and the only one that is DECLARED rather than
+   * inferred from an absence. It clips onto another node and overrides that node's config
+   * (DECLARATIVE_NODES.md §14). It never runs, so it has no inputs, no outputs and no api, and
+   * it has no place in the data graph at all: there is nothing to wire it to.
+   *
+   * Declared rather than inferred because an attachment and a half-finished node look identical
+   * from the outside, and the whole point of `kind` is that a node says what it is.
+   */
+  const isAttachment = node.kind === "Attachment" || !!iface.attaches;
+  if (!outputs.size && !api?.service && !isAnnotation && !isAttachment)
     report("error", F.iface ?? F.node, `declares no outputs. A node that emits nothing cannot be wired to anything`);
 
   // The service channel must match what the node advertises. A method with no
@@ -160,6 +180,10 @@ export function lintNode(dir, pkg) {
      * advertised or nothing can reach it.
      */
     const DISCOVERY_METHOD = "getSchema";
+    /**
+     * A MENU entry names a component and nothing else (owner ruling 2026-09-20): the panel
+     * RUNS this node and draws what its events emitted, so there is no method to check here.
+     */
     for (const method of Object.keys(api?.service ?? {}))
       if (method !== DISCOVERY_METHOD && !advertised.has(method))
         report("error", F.api, `api/service.yaml has "${method}" but no serviceConnector with isService: true lists it in methods. Nothing can discover it`);
@@ -182,6 +206,21 @@ export function lintNode(dir, pkg) {
         `offers service methods and declares no outputs, so it is a pure service node and needs "template: service". Without it the canvas draws connector dots that can never carry anything (https://docs.unoverse.ai/nodes/manifest-nodes)`,
       );
 
+    /**
+     * A REPLY NEVER READS CONFIG (owner ruling 2026-09-20). A method's `returns` and its
+     * `renderComponents` go to a MODEL or a screen, and a box's settings are the author's:
+     * the runtime no longer puts `config` in that scope, so an expression reading it fails
+     * at run time with "config is not defined". Said here instead, at write time, with the
+     * reason. The CALLS still read config to build their requests; that is server-side.
+     */
+    for (const [method, spec] of Object.entries(api?.service ?? {})) {
+      for (const key of ["returns", "renderComponents"]) {
+        const text = typeof spec?.[key] === "string" ? spec[key] : spec?.[key] ? JSON.stringify(spec[key]) : "";
+        if (/\bconfig\./.test(text))
+          report("error", F.api, `api/service.yaml "${method}.${key}" reads config. A reply goes to a model and a box's settings are the author's, never the model's: compute what the caller may know in a call, or answer from params and the reply (https://docs.unoverse.ai/nodes/mcp-services)`);
+      }
+    }
+
     // The mirror of it: advertising the discovery method as a tool.
     if (advertised.has(DISCOVERY_METHOD))
       report("error", F.iface ?? F.node, `a serviceConnector lists "${DISCOVERY_METHOD}" in methods. It is tool DISCOVERY, called by convention, and listing it advertises it to the model as a tool (https://docs.unoverse.ai/nodes/mcp-services)`);
@@ -192,6 +231,52 @@ export function lintNode(dir, pkg) {
 
   // ── tier 3: semantics ──
 
+  /**
+   * ATTACHMENTS (DECLARATIVE_NODES.md §14). An attachment is configuration that arrives from
+   * outside a node and LOCKS what it owns: it clips onto the edge of a node whose configSchema
+   * has every field it sets, overrides those fields, and contributes a tab to that node's panel.
+   *
+   * The two halves must agree. `kind: Attachment` with no `attaches` is a node that clips onto
+   * nothing; `attaches` without the kind is an attachment the canvas will draw as an ordinary
+   * wireable box, which is the exact failure the guardrail ruling named ("a guardrail you must
+   * remember to wire is a suggestion").
+   */
+  if (node.kind === "Attachment" && !iface.attaches)
+    report("error", F.iface ?? F.node, `kind is "Attachment" but interface.yaml declares no "attaches". An attachment that sets nothing clips onto nothing (https://docs.unoverse.ai/nodes/manifest-nodes)`);
+  if (iface.attaches && node.kind !== "Attachment")
+    report("error", F.node, `declares "attaches" but kind is "${node.kind}". An attachment must SAY so, or the canvas draws it as an ordinary wireable box (https://docs.unoverse.ai/nodes/manifest-nodes)`);
+
+  if (isAttachment) {
+    // IT NEVER RUNS. Everything below is a way of running, and an attachment that declared one
+    // would be a node pretending to be data.
+    for (const [what, present, file] of [
+      ["inputs", (iface.inputs ?? []).length, F.iface],
+      ["outputs", outputs.size, F.iface],
+      ["serviceConnectors", (iface.serviceConnectors ?? []).length, F.iface],
+      ["api/run.yaml", api?.run?.length, F.api],
+      ["api/service.yaml", api?.service && Object.keys(api.service).length, F.api],
+      ["menu", (node.menu ?? []).length, F.node],
+    ])
+      if (present)
+        report("error", file ?? F.node, `is an Attachment but declares ${what}. An attachment never runs and has no place in the data graph: it sets config on the node it clips onto (https://docs.unoverse.ai/nodes/manifest-nodes)`);
+
+    /**
+     * ONE OWNER PER VALUE, applied to the attachment itself. A field it SETS on a host and also
+     * declares in its OWN configSchema is two surfaces editing one name, and the reader cannot
+     * tell which one is the lock. Anything variable belongs in its own config; anything it owns
+     * on the host is a literal.
+     */
+    const sets = Object.keys(iface.attaches?.sets ?? {});
+    const own = new Set(Object.keys(config?.configSchema?.properties ?? {}));
+    for (const f of sets.filter((f) => own.has(f)))
+      report("error", F.config ?? F.node, `sets "${f}" on its host AND declares it in its own configSchema. One owner per value: set it on the host, or own it here, never both (https://docs.unoverse.ai/nodes/manifest-nodes)`);
+
+    if (sets.length) attachments.set(label, { file: F.iface ?? F.node, sets, type: node.type });
+  } else if (config?.configSchema?.properties) {
+    // The other half of the cross-node check below: what a host has to offer an attachment.
+    configFields.set(label, new Set(Object.keys(config.configSchema.properties)));
+  }
+
   // kind is DECLARED but VERIFIED. Getting it wrong used to surface only at runtime.
   // A tool exchange is a multi-turn LOOP, so it makes the node a CallbackNode just as
   // surely as a streaming transport does, and it must name a connector that grants tools.
@@ -232,7 +317,7 @@ export function lintNode(dir, pkg) {
     // way anything leaves the node, so without it the node is a call into the void.
     if (!(api.events ?? []).length)
       report("error", F.api, `has run calls but no api/events.yaml. The events table is compulsory, it is the only way anything leaves a node (https://docs.unoverse.ai/nodes/manifest-nodes)`);
-  } else if (existsSync(join(dir, "src")) === false && !parts.api && !isAnnotation) {
+  } else if (existsSync(join(dir, "src")) === false && !parts.api && !isAnnotation && !isAttachment) {
     // An ANNOTATION node is exempt, because "does nothing" is the whole specification. `Note`
     // has no inputs, no outputs and no api: it is a markdown sticky on the canvas. Warning about
     // it would train a reader to ignore this message, which is the only thing that makes it
@@ -390,6 +475,22 @@ export function lintNode(dir, pkg) {
       if (s?.poll?.body && s.poll.method !== "POST")
         report("error", F.api, `${at}[${i}] (${s.name}) sets poll.body, which is only sent when poll.method is POST. As a GET it would be discarded`);
 
+      // A REPEAT entry makes no request of its own; its turn's calls do. It needs a turn, a way
+      // to stop and a bound, or it would make nothing, or never end until the platform's cap.
+      if (s?.repeat) {
+        if (!Array.isArray(s.repeat.calls) || !s.repeat.calls.length)
+          report("error", F.api, `${at}[${i}] (${s.name}) repeats with no calls, so a turn would do nothing (https://docs.unoverse.ai/nodes/calls-that-loop)`);
+        if (!s.repeat.until)
+          report("error", F.api, `${at}[${i}] (${s.name}) repeats with no "until", so only the turn bound would end it`);
+        if (s.repeat.maxTurns === undefined)
+          report("error", F.api, `${at}[${i}] (${s.name}) repeats with no "maxTurns"; the author's bound is compulsory, the platform's cap of 20 is only a backstop`);
+        if (Array.isArray(s.repeat.calls) && s.repeat.calls.some((c) => c?.repeat))
+          report("error", F.api, `${at}[${i}] (${s.name}) has a repeat inside its turn. Nested repeats multiply their bounds; a walk that needs a walk inside it is two nodes`);
+        for (const k of ["method", "url", "transport", "credential", "body", "retry", "headers", "query"])
+          if (k in s) report("error", F.api, `${at}[${i}] (${s.name}) sets "${k}" beside "repeat". A repeat makes no request of its own; its turn's calls do`);
+        continue;
+      }
+
       // A LOOP entry keeps an index rather than reaching a host, so the request keys are as
       // meaningless on it as they are on a state call.
       if (s?.loop) {
@@ -431,8 +532,17 @@ export function lintNode(dir, pkg) {
 
     // A step naming one that does not exist reads as empty, and the request goes out
     // with a hole in it rather than failing.
-    for (const [i, s] of list.entries())
-      for (const [, ref] of JSON.stringify(s ?? {}).matchAll(/\bcalls\.([A-Za-z0-9_]+)/g)) {
+    // A REPEAT is read in two parts. Its turn's calls are a chain of their own (checked there),
+    // and its `until` reads THAT turn's calls, never this list's; only what is left of it is
+    // read against this list.
+    for (const [i, s] of list.entries()) {
+      if (s?.repeat) {
+        const turn = Array.isArray(s.repeat.calls) ? s.repeat.calls.map((c) => c?.name) : [];
+        for (const [, ref] of String(s.repeat.until ?? "").matchAll(/\bcalls\.([A-Za-z0-9_]+)/g))
+          if (!turn.includes(ref)) report("error", F.api, `${at}[${i}] (${s.name}).repeat.until reads calls.${ref}, which is not a call in its turn`);
+      }
+      const own = s?.repeat ? { ...s, repeat: undefined } : s;
+      for (const [, ref] of JSON.stringify(own ?? {}).matchAll(/\bcalls\.([A-Za-z0-9_]+)/g)) {
         const earlier = names.slice(0, i);
         if (!earlier.includes(ref))
           report(
@@ -443,6 +553,7 @@ export function lintNode(dir, pkg) {
               : `${at}[${i}] (${s.name}) reads calls.${ref}, which is not a call in this list`,
           );
       }
+    }
   }
 
   // The narrator's call is not part of a list: nothing reads its reply back and it can
@@ -467,7 +578,7 @@ export function lintNode(dir, pkg) {
         report("error", F.api, `service.${name} declares "${old}". A method's calls are ALWAYS a list named "calls", even when there is one (https://docs.unoverse.ai/nodes/manifest-nodes)`);
 
   // Credentials must resolve to a declared type, or the run fails at execute time.
-  for (const c of iface.credentials ?? []) {
+  for (const c of [...(iface.credentials ?? []), ...(iface.attaches?.credentials ?? [])]) {
     const name = c.name;
     if (!pkg.credentials.has(name))
       report("error", F.iface ?? F.node, `needs credential "${name}" but no credentials/${name}.yaml exists in this package. A package DECLARES the credentials it needs (https://docs.unoverse.ai/nodes/credentials)`);
@@ -561,7 +672,7 @@ export function lintNode(dir, pkg) {
       for (const [, b] of body.matchAll(/\b(?:prompt|blocks)\.([A-Za-z0-9_]+)/g))
         if (!promptBlocks().has(b) && !seen.has(b)) {
           seen.add(b);
-          report("error", F.api, `references prompt block "{{prompt.${b}}}", which does not exist in prompts/blocks/. It resolves to empty and the instruction silently disappears`);
+          report("error", F.api, `references prompt block "{{prompt.${b}}}", which does not exist in design/marketplace/blocks/. It resolves to empty and the instruction silently disappears`);
         }
     }
   }
@@ -758,7 +869,46 @@ export function lintNode(dir, pkg) {
       // Nothing errors, and every downstream field reads empty.
       if (call.poll && pkg.requires.poll !== true)
         report("error", rel(pkg.file), `node ${node.type} waits on a job at ${at} but package.yaml requires.poll is not true`);
+      // A REPEATED call on an executor without it makes no request at all and settles on
+      // nothing: the node answers empty and nothing errors.
+      if (call.repeat && pkg.requires.repeat !== true)
+        report("error", rel(pkg.file), `node ${node.type} goes round in turns at ${at} but package.yaml requires.repeat is not true`);
     }
 
   return node;
 }
+
+/**
+ * THE LAST PASS: can each attachment ever clip onto anything?
+ *
+ * An attachment names no host. Compatibility IS the fields (DECLARATIVE_NODES.md §14): a node
+ * accepts it when that node's configSchema declares every field the attachment sets. That is
+ * what keeps the mechanism general — no `accepts:` list on the host to drift, no enum of kinds
+ * to widen for each new case — but it means the answer is not in the attachment's own folder.
+ * Its host may be in a package read later in the run, or in no package at all.
+ *
+ * So it is checked once, after every package, and it catches the mistake this design makes
+ * easy: a typo in a field name is not an error anywhere. The attachment lints clean, publishes,
+ * and then simply refuses to stick to anything, with nothing to read that says why.
+ *
+ * Reported as a WARNING, not an error. A universe may legitimately hold an attachment whose
+ * host lives in another universe, or one published ahead of the node it is for.
+ */
+export function lintAttachments() {
+  for (const [label, { file, sets, type }] of attachments) {
+    const hosts = [...configFields].filter(([, fields]) => sets.every((f) => fields.has(f)));
+    if (hosts.length) continue;
+
+    // Which field is the reason? The one the fewest nodes have is almost always the typo, and
+    // naming it is the difference between a usable warning and "it does not work".
+    const rarest = sets
+      .map((f) => ({ f, n: [...configFields.values()].filter((fields) => fields.has(f)).length }))
+      .sort((a, b) => a.n - b.n)[0];
+    const why = rarest?.n === 0 ? `no node declares "${rarest.f}"` : `no single node declares all of ${sets.map((f) => `"${f}"`).join(", ")}`;
+    report(
+      "warn",
+      file ?? label,
+      `attachment ${type ?? label} can clip onto nothing: ${why}. An attachment fits a node whose configSchema has every field it sets (https://docs.unoverse.ai/nodes/manifest-nodes)`,
+    );
+  }
+}

package/vendor/base/src/lint/objects/index.d.mts

@@ -0,0 +1,32 @@
+/**
+ * Types for the objects and pipelines linter, which is plain JavaScript.
+ *
+ * Same arrangement as ../design/index.d.mts and ../nodes/index.d.mts: the linter stays
+ * .mjs so the CLIs run it under bare node, and TypeScript consumers (the publish gate,
+ * Studio) get a shape rather than `any`.
+ */
+
+export interface Finding {
+  level: "error" | "warn" | "hint";
+  file: string;
+  line?: number;
+  msg: string;
+}
+
+export interface ObjectsResult {
+  problems: Finding[];
+  objectCount: number;
+  pipelineCount: number;
+  designRoot: string;
+}
+
+export interface LintObjectsOptions {
+  /** Absolute path -> text that stands in for what is on disk (Studio's unsaved editor). */
+  overlay?: Record<string, string>;
+}
+
+/** Lint every object and pipeline folder under `designRoot`, every tier. Prints nothing, throws nothing for a lint failure. */
+export function lintObjects(designRoot: string, options?: LintObjectsOptions): ObjectsResult;
+
+/** True when anything would fail a build. */
+export function hasErrors(result: ObjectsResult): boolean;

package/vendor/base/src/lint/objects/index.mjs

@@ -0,0 +1,324 @@
+/**
+ * The objects and pipelines linter, as a LIBRARY. Rules in, findings out.
+ *
+ * A THIRD SIBLING of ../design/ and ../nodes/ (docs/unoverse/data/objects/README.md 9a,
+ * 2026-09-10). An object and a pipeline are folders in the node grammar, so they are linted
+ * the way nodes are: tier 2, every file against a schema (packages/docs/schemas/objects and
+ * /pipelines); tier 3, the rules a schema cannot say (rules.mjs, the SAME functions the
+ * loaders refuse a file with). Not the design linter's way: there is no primitive tree here.
+ *
+ * Callers: `unoverse lint` and `POST /publish` through items/publish lintForPublish; Studio's
+ * save and draft lint; CI. Prints nothing, exits nothing, throws nothing for a lint failure.
+ *
+ * `options.overlay` maps an absolute path to text that STANDS IN for what is on disk, so
+ * Studio's editor lints what the developer has typed before it is saved, through these
+ * rules and no others.
+ */
+import { readdirSync, readFileSync, existsSync, statSync } from "node:fs";
+import { join, resolve, dirname, relative, basename } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
+import { problems, reset, report, state } from "../context.mjs";
+import { validateAgainst, Validator } from "../nodes/schema.mjs";
+import {
+  envelopeFindings, propsFindings, fromFindings, serviceFindings, makeFindings, rowKeyFindings, objectTestFindings,
+  pipelineFindings, pipelineFolderFindings,
+} from "./rules.mjs";
+
+const require_ = createRequire(import.meta.url);
+let YAML;
+try {
+  YAML = require_("yaml");
+} catch {
+  throw new Error("the objects linter needs yaml (npm install -D yaml)");
+}
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+
+export const SCHEMA_ID = {
+  object: "https://docs.unoverse.ai/schemas/objects/object.schema.json",
+  props: "https://docs.unoverse.ai/schemas/objects/props.schema.json",
+  service: "https://docs.unoverse.ai/schemas/objects/service.schema.json",
+  make: "https://docs.unoverse.ai/schemas/objects/make.schema.json",
+  objectTest: "https://docs.unoverse.ai/schemas/objects/test.schema.json",
+  dataset: "https://docs.unoverse.ai/schemas/objects/dataset.schema.json",
+  pipeline: "https://docs.unoverse.ai/schemas/pipelines/pipeline.schema.json",
+  config: "https://docs.unoverse.ai/schemas/pipelines/config.schema.json",
+  interface: "https://docs.unoverse.ai/schemas/pipelines/interface.schema.json",
+  pipelineTest: "https://docs.unoverse.ai/schemas/pipelines/test.schema.json",
+};
+
+/**
+ * Where the schemas are, for this run. Their home is packages/docs/schemas/{objects,
+ * pipelines,nodes}, served by the docs site; in dist they sit beside this file
+ * (copy-lint.mjs puts them there, the CLI vendors that folder). The node schemas ride too:
+ * a pipeline's config, interface and test files ARE a node's, and the object schemas
+ * reach into _defs for an expression.
+ */
+function schemaDirs() {
+  const out = [];
+  for (const kind of ["objects", "pipelines", "nodes"]) {
+    for (const c of [join(HERE, "_schema", kind), resolve(HERE, `../../../../docs/schemas/${kind}`), join(HERE, "../nodes/_schema")]) {
+      if (existsSync(c)) {
+        out.push(c);
+        break;
+      }
+    }
+  }
+  return out;
+}
+
+function loadAllSchemas() {
+  for (const dir of schemaDirs())
+    for (const f of readdirSync(dir).filter((f) => f.endsWith(".json")))
+      try {
+        const s = JSON.parse(readFileSync(join(dir, f), "utf8"));
+        if (s.$id && !state.schemas[s.$id]) state.schemas[s.$id] = s;
+      } catch (e) {
+        report("error", join(dir, f), `is not valid JSON: ${e.message}`);
+      }
+}
+
+const isDir = (p) => existsSync(p) && statSync(p).isDirectory();
+const isRecord = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+
+/**
+ * Lint every object and pipeline folder under `designRoot`: the marketplace tier and every
+ * org's. Returns `{ problems, objectCount, pipelineCount, designRoot }`.
+ */
+export function lintObjects(designRoot, options = {}) {
+  const ROOT = resolve(designRoot);
+  reset(ROOT, "");
+  const overlay = {};
+  for (const [k, v] of Object.entries(options.overlay ?? {})) overlay[resolve(k)] = v;
+  const readText = (f) => (overlay[resolve(f)] === undefined ? readFileSync(f, "utf8") : overlay[resolve(f)]);
+  const rel = (f) => relative(process.cwd(), f).startsWith("..") ? f : relative(process.cwd(), f);
+
+  const readYaml = (file) => {
+    if (!existsSync(file) && overlay[resolve(file)] === undefined) return null;
+    try {
+      const doc = YAML.parse(readText(file));
+      if (doc && typeof doc === "object") delete doc.$schema;
+      return doc ?? {};
+    } catch (e) {
+      report("error", rel(file), `is not valid YAML: ${e.message.split("\n")[0]}`);
+      return null;
+    }
+  };
+
+  if (!isDir(ROOT)) {
+    report("error", ROOT, "no design/ folder here");
+    return { problems: [...problems], objectCount: 0, pipelineCount: 0, designRoot: ROOT };
+  }
+  if (!Validator) {
+    report("error", ROOT, "the objects linter needs @cfworker/json-schema");
+    return { problems: [...problems], objectCount: 0, pipelineCount: 0, designRoot: ROOT };
+  }
+  loadAllSchemas();
+
+  // ── the tiers: the marketplace, then every org folder ──
+  const marketplace = join(ROOT, "marketplace");
+  const tiers = [];
+  if (isDir(marketplace)) tiers.push({ org: undefined, dir: marketplace });
+  for (const e of readdirSync(ROOT)) {
+    if (e.startsWith(".") || e === "marketplace" || e === "_schema") continue;
+    const d = join(ROOT, e);
+    if (isDir(d)) tiers.push({ org: e, dir: d });
+  }
+
+  /**
+   * WHAT A TIER CAN SEE. A node named by a call or a collect step must be one the org
+   * has: the marketplace's, or its own under design/<org>/nodes/. A developer's workspace
+   * carries no marketplace on disk (it is installed, never baked), so when the marketplace
+   * tier is absent the existence rules step back to a hint rather than reporting every
+   * shipped node as unknown: a rule that cannot see must not read that as clean, nor as
+   * wrong.
+   */
+  const nodeTypesIn = (tierDir) => {
+    const out = new Set();
+    const home = join(tierDir, "nodes");
+    if (!isDir(home)) return out;
+    for (const pkg of readdirSync(home)) {
+      const nodes = join(home, pkg, "nodes");
+      if (!isDir(nodes)) continue;
+      for (const n of readdirSync(nodes)) {
+        const nodeYaml = join(nodes, n, "node.yaml");
+        if (!existsSync(nodeYaml)) continue;
+        const m = /^type:\s*([A-Za-z0-9_]+)/m.exec(readFileSync(nodeYaml, "utf8"));
+        out.add(m ? m[1] : n);
+      }
+    }
+    return out;
+  };
+  const foldersIn = (tierDir, kind) => {
+    const home = join(tierDir, kind);
+    if (!isDir(home)) return [];
+    return readdirSync(home).filter((e) => !e.startsWith(".") && !e.startsWith("_") && isDir(join(home, e)));
+  };
+  const marketplaceSeen = tiers.some((t) => t.org === undefined);
+  const marketplaceNodes = marketplaceSeen ? nodeTypesIn(marketplace) : null;
+  const marketplaceObjects = new Set(marketplaceSeen ? foldersIn(marketplace, "objects") : []);
+  const marketplacePipelines = new Set(marketplaceSeen ? foldersIn(marketplace, "pipelines") : []);
+  const visible = (tier, kind) => {
+    const own = new Set(foldersIn(tier.dir, kind));
+    if (!marketplaceSeen) return null;
+    for (const n of kind === "objects" ? marketplaceObjects : marketplacePipelines) own.add(n);
+    return own;
+  };
+  const visibleNodes = (tier) => {
+    if (!marketplaceSeen) return null;
+    const s = new Set(marketplaceNodes);
+    if (tier.org) for (const n of nodeTypesIn(tier.dir)) s.add(n);
+    return s;
+  };
+
+  // ── objects ──
+  // An object's folder, read raw: envelope, own props, service, test. The lint composes
+  // `extends` itself (across tiers, the org's first) so the row keys can be checked against
+  // every field the object carries, the base's included.
+  const objectFolder = (dir, name) => {
+    const envFile = [`${name}.yaml`, `${name}.json`].map((f) => join(dir, f)).find((f) => existsSync(f) || overlay[resolve(f)] !== undefined);
+    if (!envFile) return null;
+    const envelope = readYaml(envFile);
+    let props = isRecord(envelope) ? envelope.props : undefined;
+    let propsFile = envFile;
+    if (isRecord(props) && typeof props.$include === "string") {
+      propsFile = join(dir, `${props.$include}.yaml`);
+      props = readYaml(propsFile);
+      if (props === null && !existsSync(propsFile)) report("error", rel(envFile), `object ${name}: props $include "${envelope.props.$include}" resolves to no file in the folder`);
+    }
+    const servicePath = join(dir, "api", "service.yaml");
+    const service = existsSync(servicePath) || overlay[resolve(servicePath)] !== undefined ? readYaml(servicePath) : undefined;
+    // THE PRIVATE MAKE FUNCTION (objects README 4b, 2026-09-14): api/make.yaml, one function, `make`.
+    const makePath = join(dir, "api", "make.yaml");
+    const make = existsSync(makePath) || overlay[resolve(makePath)] !== undefined ? readYaml(makePath) : undefined;
+    const testPath = join(dir, "test.yaml");
+    const test = existsSync(testPath) || overlay[resolve(testPath)] !== undefined ? readYaml(testPath) : undefined;
+    // THE TABLE IT OWNS (objects README 4f, dataset.md): dataset.yaml, never table.yaml, which
+    // would be the envelope of an object NAMED table.
+    const datasetPath = join(dir, "dataset.yaml");
+    const dataset = datasetPath !== envFile && (existsSync(datasetPath) || overlay[resolve(datasetPath)] !== undefined) ? readYaml(datasetPath) : undefined;
+    return { dir, name, envFile, envelope, props, propsFile, service, servicePath, make, makePath, test, testPath, dataset, datasetPath };
+  };
+  const objectIndex = new Map(); // `${org ?? ""}/${name}` -> folder
+  const datasetTables = new Map(); // the table a dataset would own -> the object that owns it
+  for (const tier of tiers) for (const name of foldersIn(tier.dir, "objects")) {
+    const f = objectFolder(join(tier.dir, "objects", name), name);
+    if (f) objectIndex.set(`${tier.org ?? ""}/${name}`, { ...f, org: tier.org });
+  }
+  const findObject = (name, org) => objectIndex.get(`${org ?? ""}/${name}`) ?? objectIndex.get(`/${name}`) ?? null;
+  /** The composed props of an object, or null on a cycle or a missing base (reported by the caller). */
+  const composedProps = (folder, chain = []) => {
+    const own = isRecord(folder.props) ? folder.props : {};
+    const base = isRecord(folder.envelope) ? folder.envelope.extends : undefined;
+    if (typeof base !== "string") return { ...own };
+    if (chain.includes(folder.name) || chain.includes(base)) return null;
+    const parent = findObject(base, folder.org);
+    if (!parent) return null;
+    const pp = composedProps(parent, [...chain, folder.name]);
+    return pp ? { ...pp, ...own } : null;
+  };
+
+  /** An object's own functions by name: api/service.yaml's, and `make` from api/make.yaml. */
+  const ownFunctions = (folder) => ({ ...(isRecord(folder.service) ? folder.service : {}), ...(folder.make != null ? { make: folder.make } : {}) });
+  /** The functions an object can call: its own over every base's (objects README 5, "Inheritance is whole"). */
+  const composedService = (folder, chain = []) => {
+    const own = ownFunctions(folder);
+    const base = isRecord(folder.envelope) ? folder.envelope.extends : undefined;
+    if (typeof base !== "string" || chain.includes(folder.name) || chain.includes(base)) return { ...own };
+    const parent = findObject(base, folder.org);
+    return parent ? { ...composedService(parent, [...chain, folder.name]), ...own } : { ...own };
+  };
+
+  let objectCount = 0;
+  for (const [, f] of objectIndex) {
+    objectCount++;
+    const tier = { org: f.org, dir: f.org ? join(ROOT, f.org) : marketplace };
+    const at = (file) => rel(join(f.dir, file));
+    if (f.envelope === null) continue;
+    validateAgainst(SCHEMA_ID.object, f.envelope, rel(f.envFile), `object ${f.name}: the envelope`);
+    if (f.props != null && f.propsFile !== f.envFile) validateAgainst(SCHEMA_ID.props, f.props, rel(f.propsFile), `object ${f.name}: the props`);
+    if (f.service != null) validateAgainst(SCHEMA_ID.service, f.service, rel(f.servicePath), `object ${f.name}: the functions`);
+    if (f.make != null) validateAgainst(SCHEMA_ID.make, f.make, rel(f.makePath), `object ${f.name}: the make function`);
+    if (f.test != null) validateAgainst(SCHEMA_ID.objectTest, f.test, rel(f.testPath), `object ${f.name}: the test`);
+    if (f.dataset != null) validateAgainst(SCHEMA_ID.dataset, f.dataset, rel(f.datasetPath), `object ${f.name}: the table it owns`);
+    // TWO OBJECTS MAY NOT ARRIVE AT ONE TABLE. A dataset's table is named from its object and its
+    // org, squeezed to letters, digits and underscores, so "my-thing" and "my_thing" would be one
+    // table and the second object would quietly write into the first's rows.
+    if (f.dataset != null) {
+      const table = `dataset_${[f.org, f.name].filter(Boolean).map((p) => String(p).replace(/[^a-z0-9]+/gi, "_").toLowerCase()).join("_")}`;
+      const taken = datasetTables.get(table);
+      if (taken && taken !== `${f.org ?? ""}/${f.name}`) report("error", rel(f.datasetPath), `object ${f.name}: its table would be "${table}", which "${taken}" already owns. Two objects cannot share a table: rename one.`);
+      else datasetTables.set(table, `${f.org ?? ""}/${f.name}`);
+    }
+
+    const say = (list) => {
+      for (const x of list) report(x.level ?? "error", at(x.file), x.msg);
+    };
+    say(envelopeFindings(f.name, f.envelope, basename(f.envFile)));
+
+    // extends: resolves, no cycle, across the tiers the org can see.
+    let parentProps = null;
+    const base = isRecord(f.envelope) ? f.envelope.extends : undefined;
+    if (typeof base === "string") {
+      const parent = findObject(base, f.org);
+      if (!parent) report("error", rel(f.envFile), `object ${f.name}: extends "${base}", which no tier holds`);
+      else {
+        parentProps = composedProps(parent, [f.name]);
+        if (parentProps === null) report("error", rel(f.envFile), `object ${f.name}: extends cycle through ${base}`);
+      }
+    }
+    say(propsFindings(f.name, f.props, parentProps, base, basename(f.propsFile)));
+    if (isRecord(f.props)) for (const [k, p] of Object.entries(f.props)) if (isRecord(p) && p.from != null) say(fromFindings(f.name, k, p.from, composedService(f), basename(f.propsFile)));
+    say(serviceFindings(f.name, f.service, visibleNodes(tier)));
+    say(makeFindings(f.name, f.make, f.service, visibleNodes(tier)));
+    if (!marketplaceSeen && isRecord(f.service)) report("hint", rel(f.servicePath), `object ${f.name}: the marketplace is not on disk here, so the nodes its calls name were not checked`);
+    const all = composedProps(f) ?? (isRecord(f.props) ? f.props : {});
+    say(rowKeyFindings(f.name, f.envelope, all, basename(f.envFile)));
+    say(objectTestFindings(f.name, f.test, ownFunctions(f)));
+    // An org may never take a marketplace name: a bare object_type must stay unambiguous.
+    if (f.org && marketplaceObjects.has(f.name)) report("error", rel(f.envFile), `object ${f.name}: an org's object may not take a marketplace object's name; the row's object_type would be ambiguous. Rename it, or extend ${f.name} under a name of its own`);
+  }
+
+  // ── pipelines ──
+  let pipelineCount = 0;
+  for (const tier of tiers) for (const name of foldersIn(tier.dir, "pipelines")) {
+    pipelineCount++;
+    const dir = join(tier.dir, "pipelines", name);
+    const at = (file) => rel(join(dir, file));
+    const filePath = join(dir, "pipeline.yaml");
+    const file = readYaml(filePath);
+    if (file === null) {
+      if (!existsSync(filePath)) report("error", at("pipeline.yaml"), `pipeline ${name}: the folder has no pipeline.yaml`);
+      continue;
+    }
+    const configPath = join(dir, "config.yaml");
+    const config = existsSync(configPath) || overlay[resolve(configPath)] !== undefined ? readYaml(configPath) : undefined;
+    const ifacePath = join(dir, "interface.yaml");
+    const iface = existsSync(ifacePath) || overlay[resolve(ifacePath)] !== undefined ? readYaml(ifacePath) : undefined;
+    const testPath = join(dir, "test.yaml");
+    const test = existsSync(testPath) || overlay[resolve(testPath)] !== undefined ? readYaml(testPath) : undefined;
+
+    validateAgainst(SCHEMA_ID.pipeline, file, at("pipeline.yaml"), `pipeline ${name}`);
+    if (config != null) validateAgainst(SCHEMA_ID.config, config, at("config.yaml"), `pipeline ${name}: the Import form`);
+    if (iface != null) validateAgainst(SCHEMA_ID.interface, iface, at("interface.yaml"), `pipeline ${name}: the interface`);
+    if (test != null) validateAgainst(SCHEMA_ID.pipelineTest, test, at("test.yaml"), `pipeline ${name}: the test`);
+
+    const say = (list) => {
+      for (const x of list) report(x.level ?? "error", at(x.file), x.msg);
+    };
+    say(pipelineFindings(name, file));
+    say(pipelineFolderFindings(name, { file, config: config ?? null, test }, { nodeTypes: visibleNodes(tier), objectNames: visible(tier, "objects") }));
+    if (!marketplaceSeen) report("hint", at("pipeline.yaml"), `pipeline ${name}: the marketplace is not on disk here, so the nodes its steps name and the objects it makes were not checked`);
+    if (tier.org && marketplacePipelines.has(name)) report("error", at("pipeline.yaml"), `pipeline ${name}: an org's pipeline may not take a marketplace pipeline's name; the connector's name would be ambiguous`);
+  }
+
+  const rank = { error: 0, warn: 1, hint: 2 };
+  const sorted = [...problems].sort((a, b) => rank[a.level] - rank[b.level] || a.file.localeCompare(b.file));
+  return { problems: sorted, objectCount, pipelineCount, designRoot: ROOT };
+}
+
+/** True when anything would fail a build. Warnings and hints inform, errors stop. */
+export function hasErrors(result) {
+  return result.problems.some((p) => p.level === "error");
+}