unoverse 0.1.177 → 0.1.178

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.177",
+  "version": "0.1.178",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",

package/vendor/base/lint/design/index.mjs

@@ -705,18 +705,20 @@ for (const orgDir of [DS, ...orgDirs]) {
       if (hookYaml && !Array.isArray(readDef(mf).allowedHosts))
         report("error", mf, `${custom} makes requests, so this manifest must declare "allowedHosts". Deny by default: no list, no network`);
 
-      // A NAME with no definition behind it is a key nobody can ever enter: nothing offers
-      // a form for it, the hook runs credential-less, the vendor refuses, and the card
-      // renders its preview defaults with no error anywhere. Caught here instead. Skipped
-      // when no definition was found at all, since that means the nodes tree is absent
-      // rather than the name being wrong.
+      // A credential is a NAME (owner ruling 2026-08-26): it references a value that
+      // exists in the universe or does not, and shipping NEVER blocks on it — the gap is
+      // a WARNING here and a loud runtime warning when the hook runs without it
+      // (resolveCredentials says so on every keyless run). A missing DEFINITION only
+      // means no package offers a pre-built entry form; the value can still be provided.
+      // This was an org-blocking error until it stopped a yasisland deploy over a form
+      // nobody needed that day.
       if (credentialDefs.size)
         for (const cname of Array.isArray(readDef(mf).credentials) ? readDef(mf).credentials : [])
           if (!credentialDefs.has(String(cname)))
             report(
-              "error",
+              "warn",
               mf,
-              `credential "${cname}" has no definition in any installed node package, so nothing can offer a form to enter it. Install the package that defines it, or name one that exists: ${[...credentialDefs].sort().join(", ")}`,
+              `credential "${cname}" has no definition in any installed node package, so no pre-built form exists to enter it — the hook will run without it until a value is provided. Installed definitions: ${[...credentialDefs].sort().join(", ")}`,
             );
 
     }