unoverse 0.1.173 → 0.1.175

package/operator/lib/db-verify.sh

@@ -108,6 +108,7 @@ cmd_db_verify() {
       dictionary_regions: [
         "region_id", "workflow_id", "depth", "name", "description", "name_locked",
         "locked_at", "locked_by", "stage", "stage_set_by", "needs_review",
+        "skills", "skills_set_by", "skills_set_at",
         "derived_from", "first_seen", "last_seen", "closed_at"
       ],
       dictionary_content_chunks: [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.173",
+  "version": "0.1.175",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",

package/vendor/base/items/collect.js

@@ -18,7 +18,7 @@
  * performs correctly, and a half-published project is worse than either extreme.
  */
 import { readdirSync, readFileSync, existsSync, statSync } from "node:fs";
-import { join, relative } from "node:path";
+import { join, relative, basename } from "node:path";
 import { fingerprintOf } from "./fingerprint.js";
 import { designSystemVersion } from "./baseVersion.js";
 /** Folders under rx/ that are never a developer's own project. */
@@ -87,15 +87,18 @@ export function collectProject(designRoot, project) {
     // could disagree with itself mid-run if a file changed.
     const base_version = designSystemVersion(designSystemDir(designRoot));
     const items = [];
-    // A COMPONENT row's name is the qualified ref (`<org>/<name>`): the items table's
-    // identity is (kind, name) with no org in the key, and component names are unique
-    // only WITHIN an org — two orgs may ship `course-card`, so the org must be in the
-    // name for the rows to coexist (the same trick a style row already uses: its name
-    // IS the org). Templates keep their bare ids: those are org-qualified by
-    // convention (`<org>-chat-layout`). docs/unoverse/UNOVERSE_COMPONENT_ORGS.md.
+    // A COMPONENT (and, since 2026-08-24, a SKILL) row's name is the qualified ref
+    // (`<org>/<name>`): the items table's identity is (kind, name) with no org in the
+    // key, and both names are unique only WITHIN an org — two orgs may ship
+    // `course-card` or `hr-education-coach`, so the org must be in the name for the
+    // rows to coexist (the same trick a style row already uses: its name IS the org).
+    // A prompt block is NEVER qualified this way — see the blocks/ walk below for why.
+    // Templates keep their bare ids: those are org-qualified by convention
+    // (`<org>-chat-layout`). docs/unoverse/UNOVERSE_COMPONENT_ORGS.md.
+    const QUALIFIED_KINDS = new Set(["component", "skill"]);
     const add = (kind, name, definition) => items.push({
         kind,
-        name: kind === "component" ? `${project}/${name}` : name,
+        name: QUALIFIED_KINDS.has(kind) ? `${project}/${name}` : name,
         definition,
         fingerprint: fingerprintOf(definition),
         org: project,
@@ -135,6 +138,53 @@ export function collectProject(designRoot, project) {
     const styles = filesUnder(join(root, "styles"));
     if (Object.keys(styles).length)
         add("style", project, { files: styles });
+    // skills/ — ORG-QUALIFIED, same trick as a component: `${project}/${name}` is the
+    // identity, so two orgs may each ship "hr-education-coach" without one silently
+    // taking the other's row (items/loaders.ts loadParsedSkill resolves the qualified
+    // form back to this same folder). One item per skill folder, same shape as a
+    // component: SKILL.md plus any references/ it carries.
+    const skillsHome = join(root, "skills");
+    if (existsSync(skillsHome)) {
+        for (const e of readdirSync(skillsHome, { withFileTypes: true })) {
+            if (!e.isDirectory() || e.name.startsWith("."))
+                continue;
+            if (!existsSync(join(skillsHome, e.name, "SKILL.md")))
+                continue; // not a skill folder
+            const files = filesUnder(join(skillsHome, e.name));
+            if (Object.keys(files).length)
+                add("skill", e.name, { files });
+        }
+    }
+    // blocks/ — NAME STAYS BARE, unlike a skill. A block is referenced inline in authored
+    // component text as `{{prompt.name}}` (packages'/engine's template resolver), a single
+    // FLAT name across the whole platform with no room for an org segment. Org-qualifying
+    // it would break every existing `{{prompt.X}}` reference, so only where the block
+    // lives moves; what it is called does not. Two orgs shipping the same block name still
+    // collide at the row (last publish wins) — an accepted limit, not solved here.
+    const blocksHome = join(root, "blocks");
+    if (existsSync(blocksHome)) {
+        const walk = (d) => {
+            for (const e of readdirSync(d, { withFileTypes: true })) {
+                if (e.name.startsWith("."))
+                    continue;
+                const p = join(d, e.name);
+                if (e.isDirectory())
+                    walk(p);
+                else if (e.name.endsWith(".md")) {
+                    const definition = { files: { [relative(blocksHome, p)]: readFileSync(p, "utf8") } };
+                    items.push({
+                        kind: "prompt-block",
+                        name: basename(e.name, ".md"),
+                        definition,
+                        fingerprint: fingerprintOf(definition),
+                        org: project,
+                        base_version,
+                    });
+                }
+            }
+        };
+        walk(blocksHome);
+    }
     return items;
 }
 //# sourceMappingURL=collect.js.map

package/vendor/base/items/publish.js

@@ -59,6 +59,16 @@ project = "", fetchImpl = fetch) {
      * the project (a fresh clone missing its files, the wrong folder entirely) does not
      * get to empty the universe. Removals are proposed only when the workspace holds at
      * least one item — deleting the last one is done by name, deliberately.
+     *
+     * AND A SECOND GUARD, ON KINDS. Absence only means "deleted" for a kind this
+     * collector actually LOOKED for. A CLI that predates a kind collects none of it, sees
+     * rows it cannot account for, and proposes deleting every one — which is exactly what
+     * happened live on 2026-08-24: an older global `unoverse` removed all three freshly
+     * published skill and prompt-block rows, because its collector had never heard of
+     * them. Version skew between a machine's CLI and its universe is normal and must not
+     * be destructive, so a kind that contributed NOTHING to this collection is left
+     * entirely alone. Deleting the last item OF A KIND is therefore done by name, the
+     * same deliberate act as emptying a project.
      */
     if (project && items.length > 0) {
         try {
@@ -70,7 +80,10 @@ project = "", fetchImpl = fetch) {
             if (res.ok) {
                 const doc = (await res.json().catch(() => null));
                 const have = new Set(items.map((i) => `${i.kind}/${i.name}`));
+                const collectedKinds = new Set(items.map((i) => i.kind));
                 for (const r of doc?.items ?? []) {
+                    if (!collectedKinds.has(r.kind))
+                        continue; // this collector never looked for it
                     if (!have.has(`${r.kind}/${r.name}`))
                         plan.remove.push(r);
                 }

package/vendor/base/lint/design/file.mjs

@@ -34,7 +34,7 @@ function checkStateOrder(order, rootFolder, file, includeLayouts = false) {
   const onDisk = new Set([...stateNames, ...(includeLayouts ? dirNames("layouts") : [])]);
   for (const name of order)
     if (typeof name === "string" && !onDisk.has(name))
-      report("error", file, `stateOrder lists "${name}" but no states/${name}${includeLayouts ? ` or layouts/${name}` : ""} definition exists (docs/design/${includeLayouts ? "05" : "03"})`);
+      report("error", file, `stateOrder lists "${name}" but no states/${name}${includeLayouts ? ` or layouts/${name}` : ""} definition exists (docs.unoverse.ai/design/${includeLayouts ? "apps" : "components"})`);
   // Only STATES must appear in stateOrder to lock the picker order; the default layout is
   // legitimately omitted, so never warn on layouts.
   for (const name of stateNames)
@@ -488,6 +488,14 @@ function lintFile(file) {
           if (typeof arrival !== "string")
             report("error", file, `a faced component must declare its base state — a v2 state.view tree \`initial\`, or (legacy) manifest.defaultState / state.defaultState (docs.unoverse.ai/design/components)`);
         }
+        // A tree DECLARES its order, so an authored stateOrder beside one is a second source
+        // of truth that can silently disagree with it. Five docs call this form legacy and
+        // nothing enforced it, so a component kept running on one and never heard a word.
+        // The old check only fired when a states/ FOLDER existed, which a fragment-based
+        // component does not have (docs/doc-control §Guards: enforce rules as tests).
+        if (viewTree && json.stateOrder !== undefined)
+          report("error", file, `authored "stateOrder" beside a "state.view" tree. The tree declares the order: nest these as substates and delete the list (docs.unoverse.ai/design/state)`);
+
         if (stateFiles.length) {
           const order = Array.isArray(json.stateOrder) ? [...json.stateOrder].sort() : null;
           if (!order || !order.length)