@unoverse-platform/studio 0.1.98 → 0.1.100

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unoverse-platform/studio",
-  "version": "0.1.98",
+  "version": "0.1.100",
   "type": "module",
   "description": "Unoverse Studio: the local authoring app. Reads your own rx/ folder, no backend.",
   "scripts": {

package/vendor/base/src/auth/auth.ts

@@ -41,11 +41,33 @@ const getIssuerCandidates = (): string[] => {
 };
 const getAudience = (): string | undefined => process.env.AUTH_AUDIENCE;
 
-let jwks: ReturnType<typeof createRemoteJWKSet> | null = null;
-function getJWKS() {
+// WHERE THE SIGNING KEYS ARE IS THE PROVIDER'S TO SAY, in its discovery document.
+//
+// This read `${issuer}/.well-known/jwks.json`, which is where Auth0 and Cognito happen to keep
+// them. Microsoft Entra keeps them under /discovery/v2.0/keys, Keycloak under
+// /protocol/openid-connect/certs, WorkOS AuthKit under /oauth2/jwks, so a bank's Entra or a
+// WorkOS login was refused on every request with a key that could not be found. OIDC
+// discovery names the place (`jwks_uri`). With no discovery document the old location is
+// used, and not remembered, so a transient failure is retried on the next request.
+type KeySet = ReturnType<typeof createRemoteJWKSet>;
+let jwks: Promise<KeySet> | null = null;
+async function loadJWKS(base: string): Promise<{ set: KeySet; discovered: boolean }> {
+  try {
+    const res = await fetch(`${base}/.well-known/openid-configuration`, { signal: AbortSignal.timeout(5000) });
+    const doc: any = res.ok ? await res.json() : null;
+    if (typeof doc?.jwks_uri === "string") return { set: createRemoteJWKSet(new URL(doc.jwks_uri)), discovered: true };
+  } catch {
+    // fall through to the conventional location
+  }
+  return { set: createRemoteJWKSet(new URL(`${base}/.well-known/jwks.json`)), discovered: false };
+}
+function getJWKS(): Promise<KeySet> | null {
   const base = getIssuerBase();
   if (!jwks && base) {
-    jwks = createRemoteJWKSet(new URL(`${base}/.well-known/jwks.json`));
+    jwks = loadJWKS(base).then(({ set, discovered }) => {
+      if (!discovered) jwks = null;
+      return set;
+    });
   }
   return jwks;
 }
@@ -69,6 +91,14 @@ function parseArrayClaim(payload: JWTPayload, claimName: string): string[] {
   return [];
 }
 
+/** Roles as a list. Most providers send a `roles` list (Auth0 namespaced, Entra app roles);
+ *  WorkOS sends one `role`, the role of the organization membership signed in with. */
+export function parseRoles(payload: JWTPayload): string[] {
+  const roles = parseArrayClaim(payload, "roles");
+  const one = payload.role;
+  return typeof one === "string" && one && !roles.includes(one) ? [...roles, one] : roles;
+}
+
 /** Parse a string claim, handling Auth0-style namespaced claims (e.g. https://…/email).
  *  Auth0 emits custom claims (email on the access token) ONLY namespaced, so a plain
  *  `payload.email` read returns undefined and silently no-ops every email-keyed feature
@@ -114,7 +144,7 @@ export async function validateJWT(token: string): Promise<AuthUser | null> {
 }
 
 async function verifyJWT(token: string): Promise<AuthUser | null> {
-  const jwksSet = getJWKS();
+  const jwksSet = await getJWKS();
   const issuers = getIssuerCandidates();
   if (!jwksSet || issuers.length === 0) {
     console.warn("[auth] OIDC not configured (AUTH_ISSUER missing)");
@@ -136,8 +166,11 @@ async function verifyJWT(token: string): Promise<AuthUser | null> {
     const { payload } = await jwtVerify(token, jwksSet, { issuer: issuers });
     const expected = getAudience();
     if (expected) {
-      const claimed = payload.aud ?? (payload as Record<string, unknown>).client_id;
-      const values = Array.isArray(claimed) ? claimed.map(String) : claimed ? [String(claimed)] : [];
+      // Both places are read, not the first one present: WorkOS sends its environment in `aud`
+      // and the signed-in app in `client_id`, and a cell names its own app.
+      const aud = payload.aud;
+      const clientId = (payload as Record<string, unknown>).client_id;
+      const values = [...(Array.isArray(aud) ? aud : aud ? [aud] : []), ...(clientId ? [clientId] : [])].map(String);
       if (!values.includes(expected)) {
         console.error(
           `[auth] JWT validation failed: audience mismatch (expected ${expected}, token had ${values.join(", ") || "none"})`,
@@ -148,7 +181,7 @@ async function verifyJWT(token: string): Promise<AuthUser | null> {
     return {
       id: payload.sub || "unknown",
       email: parseStringClaim(payload, "email"),
-      roles: parseArrayClaim(payload, "roles"),
+      roles: parseRoles(payload),
       permissions: parseArrayClaim(payload, "permissions"),
       raw: payload,
     };

package/vendor/base/src/definitions/isolated.ts

@@ -0,0 +1,37 @@
+/**
+ * AN ORG IS A WALL (docs/unoverse/UNOVERSE_ORGANISATION.md §11, part 1).
+ *
+ * Anything built from many orgs' definitions (an MCP session's tools, the spatial
+ * registry, the Studio lists) builds each item through here. One that throws is left
+ * out and named, `org/item: reason`, and every other org is still served. Observed live
+ * 2026-09-23: one org's stale template threw inside MCP session construction and every
+ * signed-in session, for every org, answered -32603.
+ *
+ * The one door, so no builder writes its own try and no builder forgets one.
+ */
+
+/** Name what was left out and why. The label is `org/item` (or `kind org/item`). */
+export function reportLeftOut(label: string, err: unknown): void {
+  const reason = err instanceof Error ? err.message : String(err);
+  console.warn(`[unoverse] left out ${label}: ${reason}`);
+}
+
+/** Build one item on its own. Undefined when it failed; the failure is reported. */
+export function isolated<T>(label: string, build: () => T): T | undefined {
+  try {
+    return build();
+  } catch (err) {
+    reportLeftOut(label, err);
+    return undefined;
+  }
+}
+
+/** The same, for a build that awaits. */
+export async function isolatedAsync<T>(label: string, build: () => Promise<T>): Promise<T | undefined> {
+  try {
+    return await build();
+  } catch (err) {
+    reportLeftOut(label, err);
+    return undefined;
+  }
+}

package/vendor/base/src/definitions/registry/agents.ts

@@ -19,6 +19,7 @@ import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { parse } from "yaml";
 import { listOrgs, projectDir } from "./homes.js";
+import { isolated } from "../isolated.js";
 
 export const AGENT_CARD = "unoverse://components/agent-card";
 
@@ -88,7 +89,12 @@ export function listAgentsIn(root: string, org: string): AgentFile[] {
   if (!existsSync(dir)) return [];
   return readdirSync(dir, { withFileTypes: true })
     .filter((e) => e.isFile() && isDef(e.name))
-    .map((e) => readAgent(root, org, e.name.replace(/\.ya?ml$/, "")))
+    // One malformed Agent file leaves out that Agent, never the org's others or any other
+    // org's: this list is read inside MCP session construction (UNOVERSE_ORGANISATION.md §11).
+    .map((e) => {
+      const id = e.name.replace(/\.ya?ml$/, "");
+      return isolated(`agent ${org}/${id}`, () => readAgent(root, org, id)) ?? null;
+    })
     .filter((a): a is AgentFile => a !== null)
     .sort((a, b) => a.name.localeCompare(b.name));
 }

package/vendor/base/src/definitions/registry/catalog.ts

@@ -13,6 +13,7 @@ import type { UnoverseDefinition } from "../model.js";
 import { normalizeDeclaredKind, defaultLayoutOf } from "../model.js";
 import { loadDefinition } from "../load/load.js";
 import { expandNode } from "../load/expand/index.js";
+import { isolated } from "../isolated.js";
 
 /** List definitions of a kind. Atoms come from the ONE shared home. Components come
  *  from the marketplace PLUS the org packs — every org's when `org` is omitted
@@ -404,12 +405,8 @@ function walkApps(org: string | undefined, orgsToWalk: string[]): AppManifest[]
   // dropped the whole universe, 2026-08-20). One broken app degrades to a skipped
   // entry with a warning, never a dead platform.
   const push = (load: () => AppManifest | null, label: string) => {
-    try {
-      const m = load();
-      if (m) out.push(m);
-    } catch (err) {
-      console.warn(`[unoverse] skipping app '${label}' — failed to load: ${(err as Error)?.message ?? err}`);
-    }
+    const m = isolated(`app ${label}`, load);
+    if (m) out.push(m);
   };
   // APP homes, not template homes: the 2026-08-28 rename split templateDirs (the new
   // Template Model kind) from appDirs (the org apps/ folders) — this walk kept calling
@@ -657,13 +654,16 @@ export function listAppsForWorkbench(org?: string): (UnoverseDefinition & {
   app?: AppManifest;
 })[] {
   return listDefinitions("app", org)
-    .map((def) => {
+    .flatMap((def) => {
       const ref = `${def.org}/${def.name}`; // folder id = lowercased template name, org-scoped
-      const app = loadAppManifest(ref);
-      const states = listStates("app", ref);
-      return app
-        ? { ...def, states, binding: app.binding, appName: app.name, autoTrigger: app.autoTrigger, previewComponents: app.previewComponents, fluidHeight: app.fluidHeight, app }
-        : { ...def, states };
+      const entry = isolated(`app ${ref}`, () => {
+        const app = loadAppManifest(ref);
+        const states = listStates("app", ref);
+        return app
+          ? { ...def, states, binding: app.binding, appName: app.name, autoTrigger: app.autoTrigger, previewComponents: app.previewComponents, fluidHeight: app.fluidHeight, app }
+          : { ...def, states };
+      });
+      return entry ? [entry] : [];
     })
     // Templates view shows only apps that ARE surfaces (manifest defaultState
     // "template", or a plain layout with no manifest). Component apps (focus /