unoverse 0.1.199 → 0.1.201

package/lib/skills.mjs

@@ -1,10 +1,12 @@
 // Install the Claude Code authoring skills for this developer, FROM THE DOCS SITE.
 //
-// The skills are pages of the documentation (packages/docs/skills/<skill>/...), published
-// with every other page and listed in the site's llms.txt (owner ruling 2026-09-05: the
-// docs site is the one public origin, and it already serves every page as raw markdown).
-// The installer reads llms.txt, takes every page under /skills/, and writes each one to
-// disk. There is no GitHub mirror and no tarball any more.
+// The skills are files under packages/docs/skills/<skill>/, served by the docs site at the
+// same path. They are NOT in the site's navigation (owner ruling 2026-09-05: a skill is
+// for the agent to read, not a page for a person to browse), so the installer does not
+// read llms.txt. It reads `skills/skills.json` for the list of skills, then each skill's
+// SKILL.md, and follows every `references/<name>.md` the front page names. A reference the
+// front page does not name never installs, and a test in packages/docs keeps the two in
+// step.
 //
 // PER DEVELOPER, NOT PER PROJECT (2026-08-21). These install to ~/.claude/skills, so
 // Claude Code picks them up in every folder the developer opens and nothing lands
@@ -20,18 +22,14 @@ import { tmpdir, homedir } from "node:os";
 const DOCS = "https://docs.unoverse.ai";
 
 /**
- * The skill files a site's llms.txt names: `{ skill, rel, url }` per page under /skills/,
- * `rel` being the path inside the skill folder. A skill's front page is SKILL.md on disk
- * whatever case the site serves it in, because Claude Code looks for exactly that name.
- * Pure, so it can be checked without a network.
+ * The reference files a skill's front page names, as `references/<name>.md`, in order of
+ * first mention and without repeats. Pure, so it can be checked without a network.
  */
-export function skillFilesFromLlms(text, origin = DOCS) {
+export function referencesNamedBy(skillMd) {
   const out = [];
-  const re = new RegExp(`\\((${origin.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}/skills/([^/\\s)]+)/([^\\s)]+\\.md))\\)`, "g");
-  for (const m of text.matchAll(re)) {
-    const [, url, skill, path] = m;
-    const rel = basename(path).toLowerCase() === "skill.md" ? join(dirname(path), "SKILL.md") : path;
-    out.push({ skill, rel, url });
+  for (const m of skillMd.matchAll(/references\/([a-z0-9-]+)\.md/g)) {
+    const rel = `references/${m[1]}.md`;
+    if (!out.includes(rel)) out.push(rel);
   }
   return out;
 }
@@ -90,30 +88,38 @@ const fresh = (url) => `${url}?t=${Date.now()}`;
 
 export async function installSkills() {
   const target = join(homedir(), ".claude", "skills");
-  let files;
+  let skills;
   try {
-    const res = await fetch(fresh(`${DOCS}/llms.txt`));
+    const res = await fetch(fresh(`${DOCS}/skills/skills.json`));
     if (!res.ok) throw new Error(`HTTP ${res.status}`);
-    files = skillFilesFromLlms(await res.text());
+    skills = (await res.json()).skills ?? [];
   } catch {
     console.log(`  Skills install skipped (${DOCS} unreachable). They install on the next update.`);
     return;
   }
-  const skills = [...new Set(files.map((f) => f.skill))];
   if (!skills.length) {
-    console.log(`  Skills install skipped: ${DOCS}/llms.txt lists no skills yet.`);
+    console.log(`  Skills install skipped: ${DOCS}/skills/skills.json lists no skills.`);
     return;
   }
   // Fetched whole into a scratch folder first, so a download that dies halfway leaves the
   // installed copy untouched rather than half-replaced.
   const tmp = mkdtempSync(join(tmpdir(), "unoverse-skills-"));
   try {
-    for (const f of files) {
-      const res = await fetch(fresh(f.url));
-      if (!res.ok) throw new Error(`${f.url}: HTTP ${res.status}`);
-      const p = join(tmp, f.skill, f.rel);
-      mkdirSync(dirname(p), { recursive: true });
-      writeFileSync(p, skillFileText(f.skill, f.rel, await res.text()));
+    for (const skill of skills) {
+      const front = await fetch(fresh(`${DOCS}/skills/${skill}/SKILL.md`));
+      if (!front.ok) throw new Error(`${skill}/SKILL.md: HTTP ${front.status}`);
+      const frontText = await front.text();
+      const files = [["SKILL.md", frontText]];
+      for (const rel of referencesNamedBy(frontText)) {
+        const res = await fetch(fresh(`${DOCS}/skills/${skill}/${rel}`));
+        if (!res.ok) throw new Error(`${skill}/${rel}: HTTP ${res.status}`);
+        files.push([rel, await res.text()]);
+      }
+      for (const [rel, text] of files) {
+        const p = join(tmp, skill, rel);
+        mkdirSync(dirname(p), { recursive: true });
+        writeFileSync(p, skillFileText(skill, rel, text));
+      }
     }
     mkdirSync(target, { recursive: true });
     // REPLACED WHOLE, ours only. Each skill folder the site carries is removed and

package/operator/.env.example

@@ -42,7 +42,7 @@ DOCR_TOKEN=
 # Page intelligence (promote-page extraction)
 HYPERBROWSER_API_KEY=
 
-# Marketplace catalogue to install from (docs/architecture/MARKETPLACE.md).
+# Marketplace catalogue to install from (docs/architecture/authoring/MARKETPLACE.md).
 # Empty = local items only. No default: a URL is never hardcoded.
 UNOVERSE_MARKETPLACE_URL=
 

package/operator/docker-compose.yml

@@ -372,7 +372,7 @@ services:
     restart: unless-stopped
 
   # unoverse-runtime REMOVED 2026-07-28: WIP, excluded from the platform
-  # (docs/architecture/INFRASTRUCTURE.md). Returns when the user declares it ready.
+  # (docs/architecture/deployment/INFRASTRUCTURE.md). Returns when the user declares it ready.
 
   # ===========================================================================
   # OBSERVABILITY — log viewer (runs by default)

package/operator/infra/aws/main.tf

@@ -1,4 +1,4 @@
-# The Universe — AWS POC (docs/architecture/AWS_DEPLOYMENT.md)
+# The Universe — AWS POC (docs/architecture/deployment/AWS_DEPLOYMENT.md)
 #
 # One VM + managed Postgres/Redis + Cognito + a scoped Bedrock IAM user.
 # Deliberately flat and minimal: this is the POC tier. Terraform provisions,

package/operator/infra/digitalocean/main.tf

@@ -1,4 +1,4 @@
-# The Universe — DigitalOcean ground (docs/architecture/INFRASTRUCTURE.md)
+# The Universe — DigitalOcean ground (docs/architecture/deployment/INFRASTRUCTURE.md)
 #
 # Same five-input contract as infra/aws, DO implementation: Droplet + Managed
 # Postgres (fronted by its built-in PgBouncer, per the Postgres law) + Managed

package/operator/lib/db-verify.sh

@@ -36,7 +36,7 @@ cmd_db_verify() {
         "id", "name", "description", "nodes", "edges", "active",
         "execution_mode", "test_inputs", "umap_settings", "viewport",
         "mcp_schema", "memory_config", "content_taxonomy", "created_at", "updated_at",
-        "workflow_document", "layout_document"
+        "workflow_document", "layout_document", "org"
       ],
       workflow_executions: [
         "execution_id", "workflow_id", "status", "start_time", "end_time",
@@ -93,42 +93,42 @@ cmd_db_verify() {
         "needs", "source_url", "source_id", "umap_x", "umap_y", "umap_z",
         "umap_cluster_id", "color_hex", "needs_umap_update", "created_at",
         "updated_at", "workflow_id", "key_need", "metadata", "embedding_original",
-        "cluster_distance"
+        "cluster_distance", "org"
       ],
       dictionary_clusters: [
         "cluster_id", "workflow_id", "parent_id", "depth", "name", "description",
         "name_embedding", "medoid_id", "terms", "member_count", "umap_x", "umap_y",
         "umap_z", "radius", "created_at", "updated_at",
         "region_id", "carried_overlap", "derived_from", "name_locked", "locked_at",
-        "locked_by", "member_ids"
+        "locked_by", "member_ids", "org"
       ],
       user_region_events: [
         "id", "workflow_id", "user_id", "region_id", "region_name", "stage",
-        "source", "evidence", "occurred_at"
+        "source", "evidence", "occurred_at", "org"
       ],
       dictionary_regions: [
         "region_id", "workflow_id", "depth", "name", "description", "name_locked",
         "locked_at", "locked_by", "stage", "stage_set_by", "needs_review",
         "skills", "skills_set_by", "skills_set_at",
-        "derived_from", "first_seen", "last_seen", "closed_at"
+        "derived_from", "first_seen", "last_seen", "closed_at", "org"
       ],
       dictionary_content_chunks: [
         "chunk_id", "text", "source_url", "source_type", "metadata",
-        "workflow_id", "created_at", "updated_at", "embedding_original"
+        "workflow_id", "created_at", "updated_at", "embedding_original", "org"
       ],
       dictionary_chunk_need_matches: [
         "chunk_id", "need_id", "similarity_score", "rank", "match_type",
-        "created_at", "workflow_id"
+        "created_at", "workflow_id", "org"
       ],
       dictionary_ingestion_configs: [
         "id", "name", "description", "connector_type", "connector_config",
         "main_category", "workflow_id", "created_at", "updated_at",
-        "last_run_at", "run_count"
+        "last_run_at", "run_count", "org"
       ],
       dictionary_ingestion_jobs: [
         "job_id", "workflow_id", "status", "connector_type", "category",
         "config", "extraction_config", "started_at", "completed_at",
-        "progress", "error", "created_at"
+        "progress", "error", "created_at", "org"
       ],
       goals: [
         "goal_id", "user_id", "workflow_id", "status", "description",
@@ -141,13 +141,16 @@ cmd_db_verify() {
       goal_scratch: [
         "goal_id", "agent_id", "agent_name", "state", "updated_at"
       ],
+      orgs: [
+        "slug", "name", "settings", "website", "logo", "created_at", "updated_at"
+      ],
       knowledge_docs: [
         "id", "workflow_id", "title", "doc_type", "sections", "version",
         "links", "metadata", "created_at", "updated_at"
       ],
       content_sources: [
         "workflow_id", "connector", "source_key", "group_path", "label",
-        "status", "last_ingested", "metadata", "created_at", "updated_at"
+        "status", "last_ingested", "metadata", "created_at", "updated_at", "org"
       ],
       security_attack_corpus: [
         "id", "category", "label", "attack_prompt", "expected_result",

package/operator/lib/setup.sh

@@ -343,7 +343,7 @@ OPENAI_API_KEY=${OPENAI_API_KEY}
 # back it up with the database. Kept on re-runs.
 CREDENTIAL_ENCRYPTION_KEY=${CREDENTIAL_ENCRYPTION_KEY}
 HYPERBROWSER_API_KEY=${HYPERBROWSER_API_KEY}
-# Marketplace catalogue to install from (docs/architecture/MARKETPLACE.md).
+# Marketplace catalogue to install from (docs/architecture/authoring/MARKETPLACE.md).
 # Empty = local items only. No default: a URL is never hardcoded.
 UNOVERSE_MARKETPLACE_URL=
 DOMAIN=

package/operator/operator.sh

@@ -223,7 +223,7 @@ case "${1:-}" in
       echo "" >&2
       echo "    scripts/operator.sh publish" >&2
       echo "" >&2
-      echo "  See docs/architecture/DEVELOPER_GUIDE.md § Releasing." >&2
+      echo "  See docs/architecture/platform/DEVELOPER_GUIDE.md § Releasing." >&2
       echo "" >&2
       exit 1
     else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.199",
+  "version": "0.1.201",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",

package/vendor/base/items/collect.js

@@ -97,7 +97,8 @@ export function collectProject(designRoot, project) {
     // A prompt block is NEVER qualified this way — see the blocks/ walk below for why.
     // Apps keep their bare ids: those are org-qualified by convention
     // (`<org>-chat`). docs/unoverse/UNOVERSE_COMPONENT_ORGS.md.
-    const QUALIFIED_KINDS = new Set(["component", "skill", "template"]);
+    // `identity` (2026-09-05): the org's four documents, `<org>/brand` like a component.
+    const QUALIFIED_KINDS = new Set(["component", "skill", "template", "identity"]);
     const add = (kind, name, definition) => items.push({
         kind,
         name: QUALIFIED_KINDS.has(kind) ? `${project}/${name}` : name,
@@ -121,7 +122,10 @@ export function collectProject(designRoot, project) {
     // 029): apps publish as kind `app` and the Template Model kind owns the bare
     // word. Forgetting a design dir here ships deploys that silently drop every
     // artifact of that kind.
-    for (const [dir, kind] of [["components", "component"], ["apps", "app"], ["templates", "template"], ["atoms", "atom"]]) {
+    // IDENTITY (owner ruling 2026-09-05): design/<org>/identity/<doc>/ publishes as kind
+    // `identity`, the same walk as a component folder, so it reaches the registry, the
+    // spatial catalogue and the map through the one publish path everything else takes.
+    for (const [dir, kind] of [["components", "component"], ["apps", "app"], ["templates", "template"], ["atoms", "atom"], ["identity", "identity"]]) {
         const home = join(root, dir);
         if (!existsSync(home))
             continue;

package/vendor/base/items/publish.js

@@ -10,7 +10,7 @@
  * new, changed, unchanged, or refused because the name belongs to someone else. Publishing
  * blind is how a project half-lands and nobody can tell by looking.
  *
- * See docs/architecture/DECLARATIVE_NODES.md §9.
+ * See docs/architecture/authoring/DECLARATIVE_NODES.md §9.
  */
 import { existsSync } from "node:fs";
 import { join } from "node:path";

package/vendor/base/lint/design/vocabulary.mjs

@@ -57,7 +57,7 @@ export const PROP_KEYS = [
  */
 export const INTERFACE_FIELDS = new Set([
   "universal_id", "title", "description", "object_type", "key_need", "source_url", "source_id",
-  "tagline", "shortDescription", "introParagraph", "callToAction", "actionPrompt", "primaryImage", "images", "action",
+  "tagline", "shortDescription", "introParagraph", "callToAction", "primaryImage", "images", "action",
   "bodyCopy", "features", "mainCategory", "section", "needs",
 ]);
 

package/vendor/base/lint/nodes/_schema/_defs.schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://unoverse/nodes/_defs.schema.json",
+  "$id": "https://docs.unoverse.ai/schemas/nodes/_defs.schema.json",
   "title": "Shared node definitions",
-  "description": "Fragments $ref'd by the sibling node schemas. Not authored directly. See docs/architecture/DECLARATIVE_NODES.md.",
+  "description": "Fragments $ref'd by the sibling node schemas. Not authored directly. See docs/architecture/authoring/DECLARATIVE_NODES.md.",
   "definitions": {
     "nodeType": {
       "type": "string",

package/vendor/base/lint/nodes/_schema/api.schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://unoverse/nodes/api.schema.json",
+  "$id": "https://docs.unoverse.ai/schemas/nodes/api.schema.json",
   "title": "Unoverse node API call",
-  "description": "api.yaml — the upstream call this node makes, and how its response maps onto the node's outputs. This is the file that replaces an executor. NAMED api, not service: `service` already means serviceConnectors / isService / MCP providers / /service-call in this platform. See docs/architecture/DECLARATIVE_NODES.md §8.\n\nEVERY enum below is the EXECUTOR'S CAPABILITY LIST. A manifest may only name a capability that is already implemented in code. Adding a value here without implementing it produces a node that lints clean and fails at run time, and allowing a manifest to name arbitrary code would end the safety property this whole format exists for (§2).\n\nA node is reached two ways, and they never cross. The GRAPH RUNS it: `run` is the ordered list of calls it makes, and `events` says what lands on its output connectors. Or a SERVICE CALLS it ad-hoc, exposed as MCP: `service` holds those methods, each with its own list of calls, each handing one value straight back to the caller rather than touching a connector. A pure service node has only `service`.\n\nCalls are ALWAYS a `run` list, even when there is one of them. There is no `request` key.",
+  "description": "api.yaml — the upstream call this node makes, and how its response maps onto the node's outputs. This is the file that replaces an executor. NAMED api, not service: `service` already means serviceConnectors / isService / MCP providers / /service-call in this platform. See docs/architecture/authoring/DECLARATIVE_NODES.md §8.\n\nEVERY enum below is the EXECUTOR'S CAPABILITY LIST. A manifest may only name a capability that is already implemented in code. Adding a value here without implementing it produces a node that lints clean and fails at run time, and allowing a manifest to name arbitrary code would end the safety property this whole format exists for (§2).\n\nA node is reached two ways, and they never cross. The GRAPH RUNS it: `run` is the ordered list of calls it makes, and `events` says what lands on its output connectors. Or a SERVICE CALLS it ad-hoc, exposed as MCP: `service` holds those methods, each with its own list of calls, each handing one value straight back to the caller rather than touching a connector. A pure service node has only `service`.\n\nCalls are ALWAYS a `run` list, even when there is one of them. There is no `request` key.",
   "type": "object",
   "required": [],
   "definitions": {

package/vendor/base/lint/nodes/_schema/audio.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://unoverse/nodes/audio.schema.json",
+  "$id": "https://docs.unoverse.ai/schemas/nodes/audio.schema.json",
   "title": "Unoverse node audio lane",
   "description": "api/audio.yaml — how a duplex voice node is wired to the platform's audio lane. Only meaningful beside a `transport: ws` call.\n\nWHY THIS FILE EXISTS, and it is not a design preference. There are TWO sockets in a voice call. The VENDOR socket lives in api/run.yaml and is the node's conversation with OpenAI, xAI or Nova. The AUDIO LANE is the platform's own socket to the browser, and it exists for exactly ONE reason: MCP cannot carry binary audio.\n\nSo the rule that keeps this file small: EVERYTHING THAT IS NOT AUDIO BELONGS IN `events`. Transcripts, tool results, speech state, usage — all of it reaches the client over MCP streaming already, by landing on an output connector like any other node's output. Nothing needs a side channel to get there. If something non-audio is being put in this file, the reason is almost always that it was easier to reach the lane than to declare an output, and that is the wrong trade: an output is visible on the canvas, wirable, and testable, and a side channel is none of those.\n\nWHAT THE EXECUTOR CONTRIBUTES. Everything here names computation rather than describing data, which is why it is a handful of keys rather than a body template. Resampling is an interpolation over samples. Coalescing is a timer and a byte budget. Barge-in is discarding a buffer rather than flushing it. None of those can be written as an expression, and all of them are identical for every vendor, which is exactly the test for belonging to the executor (DECLARATIVE_NODES.md §2).",
   "type": "object",

package/vendor/base/lint/nodes/_schema/config.schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://unoverse/nodes/config.schema.json",
+  "$id": "https://docs.unoverse.ai/schemas/nodes/config.schema.json",
   "title": "Unoverse node config",
-  "description": "config.yaml \u2014 the node's settings form. `configSchema` is itself a JSON Schema: this file describes the SHAPE OF THAT SCHEMA, not the shape of a config. Canvas renders the form from it and the executor resolves {{ config.* }} against the saved values.\n\nThis is the file with the most churn: every new option lands here and nowhere else. Full reference for the options: docs-starter/nodes/config-schema.md.",
+  "description": "config.yaml — the node's settings form. `configSchema` is itself a JSON Schema: this file describes the SHAPE OF THAT SCHEMA, not the shape of a config. Canvas renders the form from it and the executor resolves {{ config.* }} against the saved values.\n\nThis is the file with the most churn: every new option lands here and nowhere else. Full reference for the options: docs-starter/nodes/config-schema.md.",
   "type": "object",
   "required": [
     "configSchema"
@@ -116,7 +116,7 @@
           "enum": [
             "modelTier"
           ],
-          "description": "An executor RESOLVER applied to this field's saved value just before the request is built. IMPLEMENTED resolvers only.\n\n`modelTier` is the migration of shared/models.ts resolveModel(): a saved workflow stores a concrete model id, and if that id is later retired the resolver falls back to the current best model in the same tier, warning the operator. Without it, replacing a model generation breaks every saved workflow that named an old id.\n\nThis is the \u00a72 line in miniature: the model LIST is description and lives in shared/models.yaml, while the fallback is computation and lives in the executor.",
+          "description": "An executor RESOLVER applied to this field's saved value just before the request is built. IMPLEMENTED resolvers only.\n\n`modelTier` is the migration of shared/models.ts resolveModel(): a saved workflow stores a concrete model id, and if that id is later retired the resolver falls back to the current best model in the same tier, warning the operator. Without it, replacing a model generation breaks every saved workflow that named an old id.\n\nThis is the §2 line in miniature: the model LIST is description and lives in shared/models.yaml, while the fallback is computation and lives in the executor.",
           "$comment": "Adding a value here without implementing it produces a node that lints clean and fails at run time."
         },
         "ui:field": {
@@ -137,7 +137,7 @@
             "checkboxes",
             "domainSelector"
           ],
-          "description": "IMPLEMENTED widgets only, verified against the renderer in apps/canvas/src/components/workflow/ConfigurationForm/FieldRenderer.jsx:\n\n  toggle          a boolean switch\n  select          an enum picker\n  textarea        a multi-line box (FieldRenderer.jsx:248). Pair with ui:options.rows\n  slider          a number, dragged rather than typed (:162)\n  checkboxes      an array of enum values, all visible at once (:208)\n  domainSelector  an array of hostnames (:195)\n\nNOT `color`. The retired Note node declared `ui:widget: color` and the renderer has never implemented it, so it fell through to a plain text input \u2014 a setting that looked bespoke and was not. Adding a value here without a branch in FieldRenderer reproduces exactly that: it lints clean and silently renders as something else."
+          "description": "IMPLEMENTED widgets only, verified against the renderer in apps/canvas/src/components/workflow/ConfigurationForm/FieldRenderer.jsx:\n\n  toggle          a boolean switch\n  select          an enum picker\n  textarea        a multi-line box (FieldRenderer.jsx:248). Pair with ui:options.rows\n  slider          a number, dragged rather than typed (:162)\n  checkboxes      an array of enum values, all visible at once (:208)\n  domainSelector  an array of hostnames (:195)\n\nNOT `color`. The retired Note node declared `ui:widget: color` and the renderer has never implemented it, so it fell through to a plain text input — a setting that looked bespoke and was not. Adding a value here without a branch in FieldRenderer reproduces exactly that: it lints clean and silently renders as something else."
         },
         "ui:dependencies": {
           "type": "object",
@@ -171,4 +171,4 @@
       }
     }
   }
-}
+}

package/vendor/base/lint/nodes/_schema/credential.schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://unoverse/nodes/credential.schema.json",
+  "$id": "https://docs.unoverse.ai/schemas/nodes/credential.schema.json",
   "title": "Unoverse credential type",
-  "description": "credentials/<name>.yaml \u2014 the SHAPE of a credential, never its value. Declared once per package and referenced by name from each node.yaml.\n\nSecrets stay where they already live: encrypted in Postgres via credentialManager on a deployed universe, and in the developer's own .env locally (LOCAL_STUDIO.md). Only the schema is data in a manifest, which is why a manifest is safe to commit and to deploy.",
+  "description": "credentials/<name>.yaml — the SHAPE of a credential, never its value. Declared once per package and referenced by name from each node.yaml.\n\nSecrets stay where they already live: encrypted in Postgres via credentialManager on a deployed universe, and in the developer's own .env locally (LOCAL_STUDIO.md). Only the schema is data in a manifest, which is why a manifest is safe to commit and to deploy.",
   "type": "object",
   "required": [
     "name",
@@ -44,7 +44,7 @@
           "name": {
             "type": "string",
             "pattern": "^[a-z][A-Za-z0-9_]*$",
-            "description": "The FIELD name, as a manifest reads it: credentials.<credentialName>.<fieldName>.\n\ncamelCase by convention. snake_case is ALLOWED, for exactly the reason a PORT name may be snake_case (_defs.schema.json): a migrated node must keep the names its code version used. A credential is read field by field out of stored, encrypted values \u2014 Cloudinary's are cloud_name, api_key and api_secret \u2014 so tidying them to camelCase would leave every existing workflow authenticating with undefined, and it would fail as a vendor 401 rather than as anything naming the rename. Fidelity beats house style here.\n\nPrefer camelCase for a NEW credential, where nothing is stored yet."
+            "description": "The FIELD name, as a manifest reads it: credentials.<credentialName>.<fieldName>.\n\ncamelCase by convention. snake_case is ALLOWED, for exactly the reason a PORT name may be snake_case (_defs.schema.json): a migrated node must keep the names its code version used. A credential is read field by field out of stored, encrypted values — Cloudinary's are cloud_name, api_key and api_secret — so tidying them to camelCase would leave every existing workflow authenticating with undefined, and it would fail as a vendor 401 rather than as anything naming the rename. Fidelity beats house style here.\n\nPrefer camelCase for a NEW credential, where nothing is stored yet."
           },
           "displayName": {
             "type": "string"

package/vendor/base/lint/nodes/_schema/events.schema.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://docs.unoverse.ai/schemas/nodes/events.schema.json",
+  "title": "api/events.yaml: one row per output connector",
+  "$ref": "api.schema.json#/properties/events"
+}

package/vendor/base/lint/nodes/_schema/interface.schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://unoverse/nodes/interface.schema.json",
+  "$id": "https://docs.unoverse.ai/schemas/nodes/interface.schema.json",
   "title": "Unoverse node interface",
-  "description": "interface.yaml — the node's WIRING SURFACE, and nothing else. Everything another node, an agent, or a developer needs in order to connect to this one: what goes in, what comes out, what services it offers or consumes, and what credentials it needs.\n\nIt has its own file because this is the question asked most often about a node, and it should never require reading past a node's branding to answer. See docs/architecture/DECLARATIVE_NODES.md §5.",
+  "description": "interface.yaml — the node's WIRING SURFACE, and nothing else. Everything another node, an agent, or a developer needs in order to connect to this one: what goes in, what comes out, what services it offers or consumes, and what credentials it needs.\n\nIt has its own file because this is the question asked most often about a node, and it should never require reading past a node's branding to answer. See docs/architecture/authoring/DECLARATIVE_NODES.md §5.",
   "type": "object",
   "properties": {
     "$schema": {

package/vendor/base/lint/nodes/_schema/narrate.schema.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://docs.unoverse.ai/schemas/nodes/narrate.schema.json",
+  "title": "api/narrate.yaml: a second model narrating progress",
+  "$ref": "api.schema.json#/properties/narrate"
+}

package/vendor/base/lint/nodes/_schema/node.schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://unoverse/nodes/node.schema.json",
+  "$id": "https://docs.unoverse.ai/schemas/nodes/node.schema.json",
   "title": "Unoverse node",
-  "description": "node.yaml — what this node IS: its identity, its kind, and how it is discovered. The only required file in a node folder.\n\nThe wiring surface lives next door in interface.yaml, so \"what can I connect to this?\" is answered without reading past the node's branding. config/api/test/interface may each be inlined here instead of living in their own file, but never both (that is a lint error, not a merge). See docs/architecture/DECLARATIVE_NODES.md §5.",
+  "description": "node.yaml — what this node IS: its identity, its kind, and how it is discovered. The only required file in a node folder.\n\nThe wiring surface lives next door in interface.yaml, so \"what can I connect to this?\" is answered without reading past the node's branding. config/api/test/interface may each be inlined here instead of living in their own file, but never both (that is a lint error, not a merge). See docs/architecture/authoring/DECLARATIVE_NODES.md §5.",
   "type": "object",
   "required": [
     "type",
@@ -89,23 +89,31 @@
         "cacheable": {
           "description": "Output may be MEMOIZED: the engine may serve a prior run's output when the fingerprint (type + version + RESOLVED config + credential ref + scope) matches.\n\nSet ONLY for idempotent side-effect-free READS (search, scrape, fetch-by-id, pure transform). NEVER for effectful nodes (send, write, post, charge) where reuse silently skips the side effect, and NEVER for non-deterministic ones (LLM completions, time or random dependent) where re-running is the correct behaviour. Memoization is off engine-wide by default; this flag only makes the node eligible.\n\nOBJECT FORM, for nodes whose config carries a VOLATILE field (a presigned/expiring URL) over content whose identity arrives on an input (an etag). `ignore` drops the named top-level resolved-config fields from the fingerprint; `key` names input leaf fields (dot-suffix match, e.g. \"etag\" or \"file.etag\") the engine collects from the resolved inputs as the content's identity. If a key field collects NOTHING on a run, that run is not cached — no identity, no reuse. Declaring the object form IS the opt-in.",
           "oneOf": [
-            { "type": "boolean" },
+            {
+              "type": "boolean"
+            },
             {
               "type": "object",
               "properties": {
                 "ignore": {
                   "type": "array",
-                  "items": { "type": "string" },
+                  "items": {
+                    "type": "string"
+                  },
                   "description": "Top-level resolved-config fields excluded from the fingerprint because they are volatile, not identity (a presigned URL that changes every run). Every OTHER config field still busts the cache."
                 },
                 "key": {
                   "type": "array",
-                  "items": { "type": "string" },
+                  "items": {
+                    "type": "string"
+                  },
                   "minItems": 1,
                   "description": "Input leaf fields that identify the content, matched by dot-suffix against every leaf path in the resolved inputs (wiring-independent: \"etag\" matches inputs.file.<anyNode>.file.etag). All matches, sorted by path, enter the fingerprint. A key that matches nothing disables caching for that run."
                 }
               },
-              "required": ["key"],
+              "required": [
+                "key"
+              ],
               "additionalProperties": false
             }
           ]
@@ -135,7 +143,7 @@
     },
     "auth": {
       "type": "object",
-      "description": "WHO MAY RUN THIS NODE — inbound, about the caller (docs/architecture/DECLARATIVE_NODES.md §9.13). Not to be confused with a call's `credential` in api/run.yaml, which is outbound: how the node proves itself to a vendor. Both were spelled `auth` until 2026-07-28.\n\nCOMPULSORY, which is the point. It was optional (`requires: { role }`) until 2026-07-28, and every node in the tree said nothing — so a node that had been considered and left open looked exactly like a node nobody had thought about. Silence is not an answer to this question.",
+      "description": "WHO MAY RUN THIS NODE — inbound, about the caller (docs/architecture/authoring/DECLARATIVE_NODES.md §9.13). Not to be confused with a call's `credential` in api/run.yaml, which is outbound: how the node proves itself to a vendor. Both were spelled `auth` until 2026-07-28.\n\nCOMPULSORY, which is the point. It was optional (`requires: { role }`) until 2026-07-28, and every node in the tree said nothing — so a node that had been considered and left open looked exactly like a node nobody had thought about. Silence is not an answer to this question.",
       "additionalProperties": false,
       "properties": {
         "required": {

package/vendor/base/lint/nodes/_schema/package.schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://unoverse/nodes/package.schema.json",
+  "$id": "https://docs.unoverse.ai/schemas/nodes/package.schema.json",
   "title": "Unoverse node package",
-  "description": "package.yaml \u2014 the envelope for a folder of nodes. Replaces the `gravity` block in package.json for packages that no longer ship code. See docs/architecture/DECLARATIVE_NODES.md \u00a75.",
+  "description": "package.yaml — the envelope for a folder of nodes. Replaces the `gravity` block in package.json for packages that no longer ship code. See docs/architecture/authoring/DECLARATIVE_NODES.md §5.",
   "type": "object",
   "required": [
     "name",
@@ -61,7 +61,7 @@
         "type": "string",
         "pattern": "^(\\*$|(\\*\\*\\.|\\*\\.)?[a-z0-9-]+(\\.[a-z0-9-]+)+$)"
       },
-      "description": "The ONLY hosts this package's nodes may call. The executor refuses any other, and lint refuses a request URL outside it.\n\nThis is the control that makes a manifest safe to accept from someone else. A manifest cannot execute, but it CAN say \"POST this credential to evil.example\", and that is exfiltration without a line of code. Bounding allowedHosts means a package's secrets can only ever reach hosts it declared in writing, and the declaration is one short reviewable list at install time.\n\nSECURITY.md draws the line as: a NODE is trusted code bounded by provenance; a TEMPLATE EXPRESSION is untrusted data bounded by having no credentials in scope. A manifest node is neither \u2014 it arrives as data but holds a credential and a URL. AllowedHosts is its boundary.\n\n`*.` matches ONE subdomain level, e.g. \"*.slack.com\" reaches api.slack.com but not a.b.slack.com.\n\n`**.` matches ANY depth, and is written with two stars because it is a deliberately weaker claim the author should have to make on purpose. AWS forced it: `dynamodb.us-east-1.amazonaws.com` is two labels deep and an S3 bucket is three, since the region AND the bucket are part of the host. Listing every region defeats itself the day AWS adds one, and a bucket name comes from config so it cannot be listed at all. Still bounded: \"**.amazonaws.com\" reaches any AWS host and nothing else.\n\n`*` alone means ANY HOST, and it applies ONLY to calls that send no credential. Some nodes legitimately fetch a url a person supplies (an image for a model to look at, a document to read) and that url cannot be declared in advance. It is safe exactly there: this boundary exists to stop exfiltration, and a call with no `auth` block has no credential to leak. Non-https is still refused, so cloud metadata and plaintext internal services stay out of reach, and the moment a call carries a credential the wildcard stops matching and the declared list applies.",
+      "description": "The ONLY hosts this package's nodes may call. The executor refuses any other, and lint refuses a request URL outside it.\n\nThis is the control that makes a manifest safe to accept from someone else. A manifest cannot execute, but it CAN say \"POST this credential to evil.example\", and that is exfiltration without a line of code. Bounding allowedHosts means a package's secrets can only ever reach hosts it declared in writing, and the declaration is one short reviewable list at install time.\n\nSECURITY.md draws the line as: a NODE is trusted code bounded by provenance; a TEMPLATE EXPRESSION is untrusted data bounded by having no credentials in scope. A manifest node is neither — it arrives as data but holds a credential and a URL. AllowedHosts is its boundary.\n\n`*.` matches ONE subdomain level, e.g. \"*.slack.com\" reaches api.slack.com but not a.b.slack.com.\n\n`**.` matches ANY depth, and is written with two stars because it is a deliberately weaker claim the author should have to make on purpose. AWS forced it: `dynamodb.us-east-1.amazonaws.com` is two labels deep and an S3 bucket is three, since the region AND the bucket are part of the host. Listing every region defeats itself the day AWS adds one, and a bucket name comes from config so it cannot be listed at all. Still bounded: \"**.amazonaws.com\" reaches any AWS host and nothing else.\n\n`*` alone means ANY HOST, and it applies ONLY to calls that send no credential. Some nodes legitimately fetch a url a person supplies (an image for a model to look at, a document to read) and that url cannot be declared in advance. It is safe exactly there: this boundary exists to stop exfiltration, and a call with no `auth` block has no credential to leak. Non-https is still refused, so cloud metadata and plaintext internal services stay out of reach, and the moment a call carries a credential the wildcard stops matching and the declared list applies.",
       "examples": [
         [
           "api.openai.com"
@@ -133,7 +133,7 @@
         },
         "poll": {
           "type": "boolean",
-          "description": "True when a node waits on an asynchronous JOB: start it, then ask until it is done. On an executor without it the node settles on the START reply, which is a receipt carrying a job id, and emits that as its answer \u2014 every downstream field reads empty and nothing errors."
+          "description": "True when a node waits on an asynchronous JOB: start it, then ask until it is done. On an executor without it the node settles on the START reply, which is a receipt carrying a job id, and emits that as its answer — every downstream field reads empty and nothing errors."
         },
         "encoding": {
           "type": "array",
@@ -145,7 +145,7 @@
               "ndjson"
             ]
           },
-          "description": "Body encodings this package's nodes use. Declared like auth and transport, and for the same reason: on an executor without one, the body is sent as plain JSON instead. That is not an error anywhere \u2014 the vendor simply rejects a shape it did not expect, or worse accepts it and ignores the file, so an upload silently transcribes nothing."
+          "description": "Body encodings this package's nodes use. Declared like auth and transport, and for the same reason: on an executor without one, the body is sent as plain JSON instead. That is not an error anywhere — the vendor simply rejects a shape it did not expect, or worse accepts it and ignores the file, so an upload silently transcribes nothing."
         },
         "renderComponents": {
           "type": "boolean",

package/vendor/base/lint/nodes/_schema/run.schema.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://docs.unoverse.ai/schemas/nodes/run.schema.json",
+  "title": "api/run.yaml: the calls a node makes, always a list",
+  "$ref": "api.schema.json#/properties/run"
+}

package/vendor/base/lint/nodes/_schema/service.schema.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://docs.unoverse.ai/schemas/nodes/service.schema.json",
+  "title": "api/service.yaml: methods offered over a service edge",
+  "$ref": "api.schema.json#/properties/service"
+}

package/vendor/base/lint/nodes/_schema/test.schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://unoverse/nodes/test.schema.json",
+  "$id": "https://docs.unoverse.ai/schemas/nodes/test.schema.json",
   "title": "Unoverse node test data",
-  "description": "test.yaml \u2014 the fixture behind Studio's \"Load sample, Run\" button and behind `unoverse node test`. Every node must have one: a node nobody can run is a node nobody can trust, and lint enforces it.\n\nTemplate fields are supplied ALREADY RESOLVED, because the bench has no upstream node to resolve them from. See docs/architecture/DECLARATIVE_NODES.md \u00a76.",
+  "description": "test.yaml — the fixture behind Studio's \"Load sample, Run\" button and behind `unoverse node test`. Every node must have one: a node nobody can run is a node nobody can trust, and lint enforces it.\n\nTemplate fields are supplied ALREADY RESOLVED, because the bench has no upstream node to resolve them from. See docs/architecture/authoring/DECLARATIVE_NODES.md §6.",
   "type": "object",
   "required": [
     "testData"
@@ -42,11 +42,11 @@
           "additionalProperties": false
         },
         "state": {
-      "type": "object",
-      "description": "PLATFORM STORAGE this fixture starts with, keyed by LOGICAL key. The bench has no Redis, so it runs the real state and loop code against an in-memory client seeded from here; a value is either an object (stored whole) or an array (stored as a list, for drain).\n\nIt exists because some nodes only make sense with a warm store. `LoopEnd` closes a pass of a loop that `LoopStart` opened, so with nothing seeded its very first act is the \"loop state not found\" error it is supposed to raise for a mistyped id \u2014 the bench would report a real bug as the node's normal behaviour. Same for any node whose first call is a cache read.\n\nThe run's ids are FIXED on the bench (see test-node.mjs) so a key naming them is predictable.",
-      "additionalProperties": true
-    },
-    "expect": {
+          "type": "object",
+          "description": "PLATFORM STORAGE this fixture starts with, keyed by LOGICAL key. The bench has no Redis, so it runs the real state and loop code against an in-memory client seeded from here; a value is either an object (stored whole) or an array (stored as a list, for drain).\n\nIt exists because some nodes only make sense with a warm store. `LoopEnd` closes a pass of a loop that `LoopStart` opened, so with nothing seeded its very first act is the \"loop state not found\" error it is supposed to raise for a mistyped id — the bench would report a real bug as the node's normal behaviour. Same for any node whose first call is a cache read.\n\nThe run's ids are FIXED on the bench (see test-node.mjs) so a key naming them is predictable.",
+          "additionalProperties": true
+        },
+        "expect": {
           "type": "object",
           "description": "Assertions over the result. On the workflow channel the scope is `output` (the emitted connectors); on the service channel it is `output` too, bound to the value the method RETURNED. Absent means the run only has to succeed.",
           "additionalProperties": {
@@ -58,7 +58,7 @@
           "required": [
             "method"
           ],
-          "description": "For a node with `provides`: which SERVICE method to exercise and with what arguments. A pure service node has no inputs to feed and no outputs to watch, so `inputs` cannot stand in \u2014 the only way to run it is to call it the way a consumer would.",
+          "description": "For a node with `provides`: which SERVICE method to exercise and with what arguments. A pure service node has no inputs to feed and no outputs to watch, so `inputs` cannot stand in — the only way to run it is to call it the way a consumer would.",
           "properties": {
             "method": {
               "type": "string",

package/vendor/base/lint/nodes/_schema/toolExchange.schema.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://docs.unoverse.ai/schemas/nodes/toolExchange.schema.json",
+  "title": "api/toolExchange.yaml: how this API expresses a tool call",
+  "$ref": "api.schema.json#/properties/toolExchange"
+}

package/vendor/base/lint/nodes/index.mjs

@@ -13,7 +13,7 @@
  * without it is the gap LOCAL_STUDIO.md:246 names: "a malformed definition is one restart
  * from a broken server", and a published row does not even need the restart.
  *
- * FOUR TIERS (docs/architecture/DECLARATIVE_NODES.md §6). This is tiers 2 and 3.
+ * FOUR TIERS (docs/architecture/authoring/DECLARATIVE_NODES.md §6). This is tiers 2 and 3.
  *   1  editor    $schema pointers + .vscode yaml.schemas, no tool
  *   2  structural   every part validated against the node schemas (packages/docs/schemas/nodes)
  *   3  semantic     the cross-file rules a schema cannot express

package/vendor/base/lint/nodes/schema.mjs

@@ -25,13 +25,13 @@ try {
 }
 
 export const SCHEMA_ID = {
-  node: "https://unoverse/nodes/node.schema.json",
-  interface: "https://unoverse/nodes/interface.schema.json",
-  config: "https://unoverse/nodes/config.schema.json",
-  api: "https://unoverse/nodes/api.schema.json",
-  test: "https://unoverse/nodes/test.schema.json",
-  package: "https://unoverse/nodes/package.schema.json",
-  credential: "https://unoverse/nodes/credential.schema.json",
+  node: "https://docs.unoverse.ai/schemas/nodes/node.schema.json",
+  interface: "https://docs.unoverse.ai/schemas/nodes/interface.schema.json",
+  config: "https://docs.unoverse.ai/schemas/nodes/config.schema.json",
+  api: "https://docs.unoverse.ai/schemas/nodes/api.schema.json",
+  test: "https://docs.unoverse.ai/schemas/nodes/test.schema.json",
+  package: "https://docs.unoverse.ai/schemas/nodes/package.schema.json",
+  credential: "https://docs.unoverse.ai/schemas/nodes/credential.schema.json",
 };
 
 /** The four sections that may live in their own file OR inline in node.yaml. */

package/vendor/base/manifests/source.js

@@ -9,7 +9,7 @@
  * Everything past this file works on the composed definition and never learns where
  * it came from.
  *
- * See docs/architecture/DECLARATIVE_NODES.md.
+ * See docs/architecture/authoring/DECLARATIVE_NODES.md.
  */
 import * as fs from "fs";
 import * as path from "path";