unoverse 0.1.214 → 0.1.216

package/lib/workspace.mjs

@@ -40,8 +40,9 @@ export function designHome(root) {
  * a design home → this is an asset workspace, publish means item rows; a
  * docker-compose.yml first → this is a universe, publish stays the operator's.
  * Checked in that order at each level, so a universe folder that also holds a design
- * tree (the platform monorepo's apps/unoverse) is an asset workspace when you stand in
- * it, and a universe when you stand at its compose root.
+ * tree is an asset workspace when you stand in it, and a universe when you stand at its
+ * compose root. The platform monorepo holds no design tree (retired 2026-10-04), so
+ * anywhere inside it is the universe its compose root describes.
  */
 export function findWorkspace(from = process.cwd()) {
   for (let dir = resolve(from); ; ) {

package/operator/docker-compose.yml

@@ -6,10 +6,10 @@
 #   - unoverse (the platform runtime — engine in-process + node plane + native MCP),
 #     canvas, umap, memory. Code protected, pulled as images.
 #
-# LAYER 2: PLATFORM-DEV MOUNTS (monorepo only — sync-starter strips them)
-#   - apps/unoverse/design    — design (components, templates, styles)
-#   - apps/unoverse/prompts  — behavior (skills + blocks)
-#   In a STARTER/customer universe these folders do not exist: authoring is
+# LAYER 2: PLATFORM-DEV MOUNT (monorepo only; sync-starter strips it)
+#   - packages/marketplace/definitions  the marketplace tier (components, templates,
+#                                        styles, skills, blocks, nodes, objects, pipelines)
+#   In a STARTER/customer universe this folder does not exist: authoring is
 #   Studio's (publish over the API) and content is DB-driven (marketplace).
 #   Everything else under apps/unoverse (engine, server, web, tools) is image-only.
 #
@@ -296,7 +296,7 @@ services:
       - PLUGINS_DIR=/app/plugins
       # Dev-editable folders are mounted over the image below; NODE_PATH resolves
       # their hoisted deps from the local workspace node_modules. The plugins dir is
-      # also on NODE_PATH so locally-built component nodes (design/marketplace/nodes/*, which
+      # also on NODE_PATH so locally-built component nodes (packages/marketplace/definitions/nodes/*, which
       # live OUTSIDE /app/plugins) can resolve @unoverse-platform/plugin-base — the only
       # copy carrying a built dist. Without this the runtime hits MODULE_NOT_FOUND and
       # the nodes show "Package not installed".
@@ -307,10 +307,11 @@ services:
       # a `unoverse_base:/app/base` volume here between 2026-08-30 and 2026-09-03, holding a
       # base the entrypoint installed from npm at startup. Both are gone: base is compiled in
       # from the workspace, so the image and its runtime cannot disagree.
-      # ── Platform-dev mounts (monorepo only; sync-starter strips these two
-      # lines from the starter's copy — a customer universe serves what the DB
-      # says). Local edits are picked up on restart; design/prompts are data, no build.
-      - ./apps/unoverse/design:/app/apps/unoverse/design # every authored kind: components, templates, styles, skills, blocks, nodes
+      # ── Platform-dev mount (monorepo only; sync-starter strips this line from
+      # the starter's copy, so a customer universe serves what the DB says). Local
+      # edits are picked up on restart; definitions are data, no build. The design
+      # tree mount went with the design tree (2026-10-04).
+      - ./packages/marketplace/definitions:/app/packages/marketplace/definitions # the marketplace tier: every authored kind, read live, and also how base finds the content home (paths.ts findHome)
       - ./node_modules:/app/host_node_modules # Hoisted deps for locally-built nodes
     healthcheck:
       # Ready = internal runtime port up (nodes are loaded into memory BEFORE it binds).

package/operator/lib/db-verify.sh

@@ -32,11 +32,15 @@ cmd_db_verify() {
 
     // ── Source of truth: every table + required columns (from Prisma schema) ──
     const schema = {
+      audit_events: [
+        "id", "at", "actor", "actor_kind", "method", "path", "route",
+        "requirement", "outcome", "status", "reason", "ip", "user_agent"
+      ],
       workflows: [
         "id", "name", "description", "nodes", "edges", "active",
         "execution_mode", "test_inputs", "umap_settings", "viewport",
         "mcp_schema", "memory_config", "content_taxonomy", "created_at", "updated_at",
-        "workflow_document", "layout_document", "org"
+        "workflow_document", "layout_document", "org", "deleted_at", "deleted_by", "created_by", "updated_by", "git_source"
       ],
       workflow_executions: [
         "execution_id", "workflow_id", "status", "start_time", "end_time",
@@ -50,7 +54,7 @@ cmd_db_verify() {
         "error", "created_at", "fingerprint"
       ],
       credentials: [
-        "id", "name", "type", "scope", "data", "created_at", "updated_at"
+        "id", "name", "type", "scope", "data", "created_at", "updated_at", "ref"
       ],
       token_usage: [
         "id", "workflow_id", "execution_id", "node_id", "node_type",

package/operator/lib/publish-assets.mjs

@@ -40,6 +40,12 @@ const die = (msg) => {
   process.exit(1);
 };
 
+// The platform repo's design/ was retired 2026-10-04: no org is authored here any more. An
+// absent folder is no org tier, said plainly, rather than a lint error about a missing folder.
+if (!existsSync(designRoot)) {
+  die(`no design/ folder at ${designRoot}. An org lives in its own repo and publishes from there; pass --design <folder> for a design tree kept elsewhere.`);
+}
+
 if (!project) {
   const projects = listProjects(designRoot);
   die(`which project?\n\n    unoverse publish <project> --to <universe>\n\n  Found: ${projects.join(", ") || "none"}`);

package/operator/lib/start.sh

@@ -286,8 +286,8 @@ build_component_nodes() {
 
   banner "Component Nodes (definition-backed)"
 
-  echo "  Building the marketplace package locally (bundle-defs + tsc → dist)..."
-  if (cd "$ROOT/packages/marketplace" && node scripts/bundle-defs.mjs && npx tsc 2>/dev/null); then
+  echo "  Building the marketplace package locally (tsc → dist)..."
+  if (cd "$ROOT/packages/marketplace" && npx tsc 2>/dev/null); then
     ok "Marketplace package built → packages/marketplace/dist"
   elif [ -d "$ROOT/packages/marketplace/dist" ]; then
     # Starters can't build it (no workspace plugin-base) — the dist SHIPS with the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.214",
+  "version": "0.1.216",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",

package/vendor/base/items/baseVersion.js

@@ -69,7 +69,7 @@ function packageVersion(designSystemDir) {
 }
 /**
  * Compute the version of the design system at `designSystemDir` (the resolved marketplace
- * directory: on-disk design/marketplace, or the installed bundle).
+ * directory: the tier on disk, or the installed bundle).
  *
  * Hashes components, atoms and styles together, because they only mean anything as a set:
  * a universe holding half of them renders against a contract with holes.

package/vendor/base/items/collect.js

@@ -284,7 +284,7 @@ function collectFrom(root, project, designSystem) {
     // 2026-09-08 it looked at a `nodes/` folder beside design/ while every org already
     // kept its nodes INSIDE its project, so the same nodes were left behind again. Org
     // nodes are org-scoped like skills; the marketplace tier's own nodes sit under
-    // design/marketplace/, which is never collected.
+    // the marketplace tier, which is never collected.
     const nodesHome = join(root, "nodes");
     if (existsSync(nodesHome)) {
         for (const pkg of collectNodePackages(nodesHome)) {

package/vendor/base/lint/design/file.mjs

@@ -175,7 +175,7 @@ function checkAppTree(json, root, file) {
             if (ref.includes("/"))
               report("error", file, `state "${where}" preview names "${ref}" with an org prefix. Studio seeds a preview by the component's bare name ("${ref.split("/").pop()}"); a prefixed name resolves to nothing and the state's tab shows nothing (docs.unoverse.ai/design/apps)`);
             else if (comps && !comps.has(ref.toLowerCase()))
-              report("error", file, `state "${where}" preview names "${ref}", which is no component or template this org can see (design/marketplace/, this org's components/ and templates/). Studio would seed nothing and the state's tab would show nothing (docs.unoverse.ai/design/apps)`);
+              report("error", file, `state "${where}" preview names "${ref}", which is no component or template this org can see (the marketplace's, this org's components/ and templates/). Studio would seed nothing and the state's tab would show nothing (docs.unoverse.ai/design/apps)`);
           }
         } else if (entry.preview !== undefined && (typeof entry.preview !== "object" || entry.preview === null))
           report("error", file, `state "${where}" preview must be a list of component names, or an object of app-state mock data (docs.unoverse.ai/design/apps)`);
@@ -578,7 +578,7 @@ function lintFile(file) {
             // 2026-09-11); the lookup is the name before the hash.
             for (const c of list)
               if (comps && !comps.has(String(c).split("#")[0].toLowerCase()))
-                report("error", file, `preview."${state}" names unknown component "${c}". No match in design/marketplace/components/ or this org's components/ (org-privacy: another org's components are out of reach; lookup is case-insensitive)`);
+                report("error", file, `preview."${state}" names unknown component "${c}". No match in the marketplace's components/ or this org's components/ (org-privacy: another org's components are out of reach; lookup is case-insensitive)`);
           }
         }
       }

package/vendor/base/lint/design/index.mjs

@@ -42,10 +42,13 @@ export function lintDefinitions(designRoot, options = {}) {
     const hit = overlay[resolve(f)];
     return hit === undefined ? readFileSync(f, "utf8") : hit;
   };
-  const candidates = designRoot ? [resolve(designRoot)] : [resolve("apps/unoverse/design"), resolve("design")];
+  // With no root given: the platform repo's marketplace tier (linted as the root itself, as
+  // CI and the release do), else a developer's design/.
+  const candidates = designRoot ? [resolve(designRoot)] : [resolve("packages/marketplace/definitions"), resolve("design")];
 
-  /** The monorepo's shapes: the design system at `design/marketplace/`, or the legacy one
-   *  with `components/` and `atoms/` loose at the root. */
+  /** A design root holding the design system at `<root>/marketplace/`, or the design system
+   *  itself as the root, with `components/` and `atoms/` loose in it (how the platform repo
+   *  lints its tier, `packages/marketplace/definitions`). */
   const holdsDesignSystem = (p) =>
     existsSync(join(p, "marketplace")) || existsSync(join(p, "components")) || existsSync(join(p, "atoms"));
 
@@ -53,7 +56,7 @@ export function lintDefinitions(designRoot, options = {}) {
    * A DEVELOPER'S design/ HOLDS ONLY ORG FOLDERS, and looking for the monorepo's shapes there
    * finds nothing. `design/<org>/{components,styles,apps}` is what Studio scaffolds and
    * the only layout a developer ever has, because the design system is INSTALLED rather
-   * than authored (sync-starter.sh keeps `design/marketplace` out of a project on purpose).
+   * than authored (sync-starter.sh keeps the marketplace tier out of a project on purpose).
    *
    * So a project could not be linted, and since publishing lints first, it could not be
    * published either: "no design/ folder here", naming the folder it was standing in.
@@ -85,7 +88,24 @@ export function lintDefinitions(designRoot, options = {}) {
    */
   const ORG_REPO = options.org?.dir ? resolve(options.org.dir) : null;
   const ORG_NAME = options.org?.name ?? null;
-  const DESIGN_ROOT = ORG_REPO ? dirname(ORG_REPO) : candidates.find((p) => holdsDesignSystem(p) || holdsOrgs(p));
+  /**
+   * THE MARKETPLACE TIER BY NAME, when it is not `<root>/marketplace`. The platform repo
+   * authors it at packages/marketplace/definitions (base paths.ts `marketplace`), outside any
+   * design root, and a caller that knows that says so. The tier then reads exactly as
+   * `<root>/marketplace` would: the design system, and a home named `marketplace`.
+   */
+  const MARKETPLACE = !ORG_REPO && options.marketplace ? resolve(options.marketplace) : null;
+  const DESIGN_ROOT = ORG_REPO
+    ? dirname(ORG_REPO)
+    : candidates.find((p) => holdsDesignSystem(p) || holdsOrgs(p)) ??
+      (MARKETPLACE && (existsSync(candidates[0]) || existsSync(MARKETPLACE)) ? candidates[0] : undefined);
+  /**
+   * NO ORG TIER HERE. The platform repo authors no orgs (its design/ was retired 2026-10-04),
+   * so a caller naming the marketplace tier may hand a design root that does not exist. That
+   * means "lint the tier alone", never "nothing to lint": an error here would fail every save
+   * in the platform repo's Studio on a folder nobody is meant to have.
+   */
+  const NO_ORG_TIER = !ORG_REPO && !existsSync(DESIGN_ROOT ?? "");
   if (!DESIGN_ROOT)
     return {
       problems: [{ level: "error", file: candidates[0], msg: `no design/ folder here (looked in: ${candidates.join(", ")})` }],
@@ -93,14 +113,15 @@ export function lintDefinitions(designRoot, options = {}) {
     };
 
 // ── tree layout ──
-// New layout: design/marketplace/{atoms,components,styles} + one top-level folder per
+// New layout: <root>/marketplace/{atoms,components,styles} (or the tier named by
+// options.marketplace) + one top-level folder per
 // org (design/<org>/). Legacy layout: components/ + atoms/ at the root, orgs under design/orgs/.
 // The DESIGN SYSTEM is the primary lint target; org folders get the SAME generic
 // checks — nothing here may key on a specific org's name.
-// WHERE THE DESIGN SYSTEM ACTUALLY IS. `design/marketplace/` exists in this monorepo and is
-  // deliberately absent from a developer's project (sync-starter.sh): the platform installs
-  // @unoverse-platform/marketplace, whose `definitions/` bundle carries components, atoms
-  // AND styles (bundle-defs.mjs). All three matter — the space-scale check reads
+// WHERE THE DESIGN SYSTEM ACTUALLY IS. `<root>/marketplace/` when a root carries one; it
+  // is deliberately absent from a developer's project (sync-starter.sh): the platform installs
+  // @unoverse-platform/marketplace, whose `definitions/` folder carries components, atoms
+  // AND styles (authored there, packages/marketplace/definitions in the platform repo). All three matter — the space-scale check reads
   // styles/base/spacing, so a fallback finding only components would build a PARTIAL scale
   // and reject valid steps, reporting false errors on correct work. Mirrors definitions.ts.
   const DS = (() => {
@@ -110,6 +131,7 @@ export function lintDefinitions(designRoot, options = {}) {
       const bundled = join(ORG_REPO, "plugins", "node_modules", "@unoverse-platform", "marketplace", "definitions");
       return existsSync(bundled) ? bundled : join(ORG_REPO, ".unoverse", "no-design-system");
     }
+    if (MARKETPLACE) return MARKETPLACE;
     const onDisk = join(DESIGN_ROOT, "marketplace");
     if (existsSync(onDisk)) return onDisk;
     for (const c of [
@@ -123,10 +145,15 @@ const HAS_DS = DS !== DESIGN_ROOT && existsSync(DS);
 /** The org a home folder belongs to: the declared name in an org repo, else the folder's name. */
 const orgName = (dir) => (ORG_REPO && dir === ORG_REPO ? ORG_NAME : basename(dir));
 /** Every home that can hold node packages, credentials or places: the design system and the orgs. */
-const tierHomes = () => (ORG_REPO ? [DS, ...orgDirs] : readdirSync(DESIGN_ROOT).map((t) => join(DESIGN_ROOT, t)));
+const tierHomes = () =>
+  ORG_REPO ? [DS, ...orgDirs] : [...(MARKETPLACE ? [DS] : []), ...(NO_ORG_TIER ? [] : readdirSync(DESIGN_ROOT).map((t) => join(DESIGN_ROOT, t)))];
+/** A file's path below the design root, the named marketplace tier reading as `marketplace/…`. */
+const underRoot = (f) =>
+  MARKETPLACE && (f === DS || f.startsWith(DS + sep)) ? ["marketplace", ...relative(DS, f).split(sep)] : relative(DESIGN_ROOT, f).split(sep);
 const legacyOrgsDir = join(DESIGN_ROOT, "orgs");
 const orgDirs = (() => {
   if (ORG_REPO) return [ORG_REPO];
+  if (NO_ORG_TIER) return [];
   if (existsSync(legacyOrgsDir))
     return readdirSync(legacyOrgsDir)
       .filter((e) => !e.startsWith("."))
@@ -199,11 +226,11 @@ const isPropsExtract = (f) => {
 const isManifest = (f) => /^manifest\.(json|yaml)$/.test(basename(f));
 // WHICH HOME A FILE IS IN — asked of the path BELOW the design root, never the absolute
 // one. Testing the absolute path for an `apps` segment was true of every file in this
-// monorepo, because the design tree itself lives at `apps/unoverse/design`: every
+// monorepo, because the design tree itself lived at `apps/unoverse/design`: every
 // component manifest in the repo was linted as an APP manifest (two bogus warnings each,
 // while the real component-manifest rules never ran once). A rule that cannot tell the
 // homes apart is worse than no rule — it trains people to ignore its output.
-const homeSegments = (f) => relative(DESIGN_ROOT, f).split(sep);
+const homeSegments = (f) => underRoot(f);
 const isAppPath = (f) => homeSegments(f).includes("apps");
 // THE TEMPLATE KIND (UNOVERSE_TEMPLATE_MODEL.md §9b). Its folders answer to different
 // rules than an app's or a component's, so the rules that would misfire have to be able
@@ -931,7 +958,7 @@ function appSizesForFile(file) {
   return appSizesCache.get(home);
 }
 
-// The universal component names (design/marketplace/components/*, case-insensitive) — for
+// The universal component names (the tier's components/*, case-insensitive) — for
 // validating an app manifest's `preview` map. null = the file is not under a design tree.
 const componentNamesCache = new Map();
 // Components an ORG's template may reference: the marketplace tier + that org's OWN
@@ -941,9 +968,10 @@ function componentNamesForFile(file) {
   // `${sep}orgs${sep}` and returned null for anything else, so on the flat layout — which
   // is every project now (`design/<org>/…`, "flat wins") — it answered "no list" and
   // every rule that asks it, preview names included, silently stopped checking.
-  const segs = relative(DESIGN_ROOT, file).split(sep);
+  const segs = underRoot(file);
   if (segs.length < 2 || segs[0] === "..") return null;
   const projectSegs = segs[0] === "orgs" ? segs.slice(0, 2) : segs.slice(0, 1);
+  const projectHome = MARKETPLACE && projectSegs[0] === "marketplace" ? DS : join(DESIGN_ROOT, ...projectSegs);
   const org = projectSegs.join("/");
   const cached = componentNamesCache.get(org);
   if (cached !== undefined) return cached;
@@ -958,11 +986,11 @@ function componentNamesForFile(file) {
   }
   const dirs = [
     join(DS, "components"),
-    join(DESIGN_ROOT, ...projectSegs, "components"),
+    join(projectHome, "components"),
     // TEMPLATES ARE PEERS (§9c): a state that holds one seeds it by name like any
     // component, so the name set a preview is checked against includes them.
     join(DS, "templates"),
-    join(DESIGN_ROOT, ...projectSegs, "templates"),
+    join(projectHome, "templates"),
   ];
   let names = null;
   for (const dir of dirs) {

package/vendor/base/lint/design/vocabulary.mjs

@@ -1,7 +1,7 @@
 /**
  * The CLOSED SETS. This file is the linter's ground truth.
  *
- * Mirrors apps/unoverse/design/_schema/unoverse.schema.json and the server guards, and UNOVERSE_CONFORMANCE
+ * Mirrors packages/docs/schemas/design/unoverse.schema.json and the server guards, and UNOVERSE_CONFORMANCE
  * §5 makes keeping them equal a maintenance rule: "One source for each closed set... Keep
  * them equal or they disagree silently."
  *
@@ -10,7 +10,7 @@
  * without extending the schema and the SDK in the same change.
  */
 
-// ── ground truth (mirrors design/_schema/unoverse.schema.json + server guards) ──
+// ── ground truth (mirrors packages/docs/schemas/design/unoverse.schema.json + server guards) ──
 export const PRIMITIVES = new Set([
   "Box", "Stack", "Row", "Column", "Each", "Switch", "ComponentSlot", "Timeline",
   "Text", "Image", "Button", "Input", "Select", "Markdown", "Skeleton", "Icon", "Ref", "Orb", "Template", "Place",

package/vendor/base/lint/nodes/_schema/_defs.schema.json

@@ -96,7 +96,7 @@
     },
     "template": {
       "type": "string",
-      "description": "A Handlebars template resolved against the node's input context before the request is sent.\n\nFive roots:\n  signal.<sourceId>.<outputHandle>.<field>   upstream node output, e.g. {{signal.inputtrigger1.output.message}}\n  config.<field>                              this node's own settings\n  credentials.<name>.<field>                  this node's resolved credential\n  services.<connector>                        RUNTIME service wiring, e.g. {{#unless services.mcpService.tools}}\n  prompt.<blockName>                          a PROMPT BLOCK from the library (alias: blocks.<name>)\n\nThe services root exists because some request shaping depends on what is WIRED rather than configured, a fact only the executor knows at run time.\n\nThe prompt root is why a manifest must NEVER hardcode instruction text. Blocks live in design/marketplace/blocks/**/*.md, are authored and toggled in Studio, and are camelCased from the filename (markdown-guidelines.md becomes {{prompt.markdownGuidelines}}). A copy of a block's words baked into a node is a fork that silently stops tracking the block. Text belongs in the library; the node references it. This is the prompt-side twin of the SDK owning no styles.\n\nEvery root works in ANY template field, including a user's own systemPrompt: that is what lets an author compose blocks and upstream values into a prompt without the node knowing anything about it.\n\nThere is NO {{input.*}} root: a wrong path resolves to EMPTY silently. Array elements and object keys are dot segments, never brackets: records.0.Name, not records[0].Name."
+      "description": "A Handlebars template resolved against the node's input context before the request is sent.\n\nFive roots:\n  signal.<sourceId>.<outputHandle>.<field>   upstream node output, e.g. {{signal.inputtrigger1.output.message}}\n  config.<field>                              this node's own settings\n  credentials.<name>.<field>                  this node's resolved credential\n  services.<connector>                        RUNTIME service wiring, e.g. {{#unless services.mcpService.tools}}\n  prompt.<blockName>                          a PROMPT BLOCK from the library (alias: blocks.<name>)\n\nThe services root exists because some request shaping depends on what is WIRED rather than configured, a fact only the executor knows at run time.\n\nThe prompt root is why a manifest must NEVER hardcode instruction text. Blocks live in packages/marketplace/definitions/blocks/**/*.md, are authored and toggled in Studio, and are camelCased from the filename (markdown-guidelines.md becomes {{prompt.markdownGuidelines}}). A copy of a block's words baked into a node is a fork that silently stops tracking the block. Text belongs in the library; the node references it. This is the prompt-side twin of the SDK owning no styles.\n\nEvery root works in ANY template field, including a user's own systemPrompt: that is what lets an author compose blocks and upstream values into a prompt without the node knowing anything about it.\n\nThere is NO {{input.*}} root: a wrong path resolves to EMPTY silently. Array elements and object keys are dot segments, never brackets: records.0.Name, not records[0].Name."
     }
   }
 }

package/vendor/base/lint/nodes/blocks.mjs

@@ -23,7 +23,7 @@ export const HANDLEBARS_HELPERS = new Set([
 ]);
 
 /**
- * The prompt-block library: design/marketplace/blocks/**\/*.md, keyed the way the resolver keys them
+ * The prompt-block library: the marketplace tier's blocks/**\/*.md, keyed the way the resolver keys them
  * (engine/src/template/promptBlocks.ts) — the filename camelCased, so markdown-guidelines.md is
  * referenced as {{prompt.markdownGuidelines}}.
  *
@@ -42,8 +42,8 @@ const CACHE = new Map();
 
 export function promptBlocks() {
   // The block library is the marketplace tier's. Beside the nodes when they ARE that
-  // tier (design/marketplace/{nodes,blocks}); one tier over for an org's own nodes
-  // (design/<org>/nodes → design/marketplace/blocks).
+  // tier (packages/marketplace/definitions/{nodes,blocks}); one tier over for an org's own
+  // nodes (design/<org>/nodes → design/marketplace/blocks, a design root carrying the tier).
   const home = [resolve(state.nodesHome, "../blocks"), resolve(state.nodesHome, "../../marketplace/blocks")]
     .find((d) => existsSync(d)) ?? resolve(state.nodesHome, "../../marketplace/blocks");
   const cached = CACHE.get(home);

package/vendor/base/lint/nodes/node.mjs

@@ -672,7 +672,7 @@ export function lintNode(dir, pkg) {
       for (const [, b] of body.matchAll(/\b(?:prompt|blocks)\.([A-Za-z0-9_]+)/g))
         if (!promptBlocks().has(b) && !seen.has(b)) {
           seen.add(b);
-          report("error", F.api, `references prompt block "{{prompt.${b}}}", which does not exist in design/marketplace/blocks/. It resolves to empty and the instruction silently disappears`);
+          report("error", F.api, `references prompt block "{{prompt.${b}}}", which does not exist in the marketplace's blocks/. It resolves to empty and the instruction silently disappears`);
         }
     }
   }

package/vendor/base/lint/objects/index.mjs

@@ -106,7 +106,13 @@ export function lintObjects(designRoot, options = {}) {
     }
   };
 
-  if (!isDir(ROOT)) {
+  // The marketplace tier: `<root>/marketplace`, unless the caller names it (options.marketplace:
+  // the platform repo authors it outside any design root, base paths.ts `marketplace`).
+  const marketplace = options.marketplace ? resolve(options.marketplace) : join(ROOT, "marketplace");
+  // NO ORG TIER HERE: a named marketplace tier with no design root beside it (the platform
+  // repo, whose design/ was retired 2026-10-04) lints the tier alone. Only a root with neither
+  // is "nothing to lint".
+  if (!isDir(ROOT) && !(options.marketplace && isDir(marketplace))) {
     report("error", ROOT, "no design/ folder here");
     return { problems: [...problems], objectCount: 0, pipelineCount: 0, designRoot: ROOT };
   }
@@ -119,13 +125,12 @@ export function lintObjects(designRoot, options = {}) {
   // ── the tiers: the marketplace, then every org folder ──
   // An org's own repo is ONE tier with a DECLARED name (`options.org`, UNO-88): its folder may
   // be called anything, and the org name is also the dataset table's (`dataset_<org>_<name>`).
-  const marketplace = join(ROOT, "marketplace");
   const tiers = [];
   if (options.org?.dir) {
     tiers.push({ org: options.org.name, dir: resolve(options.org.dir) });
   } else {
     if (isDir(marketplace)) tiers.push({ org: undefined, dir: marketplace });
-    for (const e of readdirSync(ROOT)) {
+    for (const e of isDir(ROOT) ? readdirSync(ROOT) : []) {
       if (e.startsWith(".") || e === "marketplace" || e === "_schema") continue;
       const d = join(ROOT, e);
       if (isDir(d)) tiers.push({ org: e, dir: d });
@@ -265,22 +270,38 @@ export function lintObjects(designRoot, options = {}) {
 
     // extends: resolves, no cycle, across the tiers the org can see.
     let parentProps = null;
+    // A BASE THAT CANNOT BE SEEN is not a missing base. An org repo carries no marketplace on
+    // disk (UNO-88), so `extends: need` names an object installed in every universe and present
+    // in none of the repo's folders. The same rule as the nodes above: step back to a hint, read
+    // a description-only prop as the re-brief of an inherited field (the only thing it can be),
+    // and leave the row keys, which need the base's fields, to the universe that has them.
+    let baseUnseen = false;
     const base = isRecord(f.envelope) ? f.envelope.extends : undefined;
     if (typeof base === "string") {
       const parent = findObject(base, f.org);
-      if (!parent) report("error", rel(f.envFile), `object ${f.name}: extends "${base}", which no tier holds`);
+      if (!parent && options.org?.dir && !marketplaceSeen) {
+        baseUnseen = true;
+        report("hint", rel(f.envFile), `object ${f.name}: extends "${base}", which is not on disk here (the marketplace is installed, not in the repo), so what it inherits was not checked`);
+        parentProps = Object.fromEntries(
+          Object.entries(isRecord(f.props) ? f.props : {}).filter(([, p]) => isRecord(p) && Object.keys(p).every((k) => k === "description")),
+        );
+      } else if (!parent) report("error", rel(f.envFile), `object ${f.name}: extends "${base}", which no tier holds`);
       else {
         parentProps = composedProps(parent, [f.name]);
         if (parentProps === null) report("error", rel(f.envFile), `object ${f.name}: extends cycle through ${base}`);
       }
     }
     say(propsFindings(f.name, f.props, parentProps, base, basename(f.propsFile)));
-    if (isRecord(f.props)) for (const [k, p] of Object.entries(f.props)) if (isRecord(p) && p.from != null) say(fromFindings(f.name, k, p.from, composedService(f), basename(f.propsFile)));
+    // With the base unseen, a function the object does not declare itself may be the base's
+    // (README: a prop may be written from an inherited function), so only its own are checked.
+    const fns = composedService(f);
+    const ownFn = (from) => typeof from === "string" && from.split(".")[0] in fns;
+    if (isRecord(f.props)) for (const [k, p] of Object.entries(f.props)) if (isRecord(p) && p.from != null && (!baseUnseen || ownFn(p.from))) say(fromFindings(f.name, k, p.from, fns, basename(f.propsFile)));
     say(serviceFindings(f.name, f.service, visibleNodes(tier)));
     say(makeFindings(f.name, f.make, f.service, visibleNodes(tier)));
     if (!marketplaceSeen && isRecord(f.service)) report("hint", rel(f.servicePath), `object ${f.name}: the marketplace is not on disk here, so the nodes its calls name were not checked`);
     const all = composedProps(f) ?? (isRecord(f.props) ? f.props : {});
-    say(rowKeyFindings(f.name, f.envelope, all, basename(f.envFile)));
+    if (!baseUnseen) say(rowKeyFindings(f.name, f.envelope, all, basename(f.envFile)));
     say(objectTestFindings(f.name, f.test, ownFunctions(f)));
     // An org may never take a marketplace name: a bare object_type must stay unambiguous.
     if (f.org && marketplaceObjects.has(f.name)) report("error", rel(f.envFile), `object ${f.name}: an org's object may not take a marketplace object's name; the row's object_type would be ambiguous. Rename it, or extend ${f.name} under a name of its own`);

package/vendor/base/lint/prompts/index.mjs

@@ -135,21 +135,26 @@ export function lintPrompts(designRoot, options = {}) {
   const present = (f) => existsSync(f) || overlay[resolve(f)] !== undefined;
   const rel = (f) => (relative(process.cwd(), f).startsWith("..") ? f : relative(process.cwd(), f));
 
-  if (!isDir(ROOT)) {
+  // The marketplace tier: `<root>/marketplace`, unless the caller names it (options.marketplace:
+  // the platform repo authors it outside any design root, base paths.ts `marketplace`).
+  const marketplace = options.marketplace ? resolve(options.marketplace) : join(ROOT, "marketplace");
+  // NO ORG TIER HERE: a named marketplace tier with no design root beside it (the platform
+  // repo, whose design/ was retired 2026-10-04) lints the tier alone. Only a root with neither
+  // is "nothing to lint".
+  if (!isDir(ROOT) && !(options.marketplace && isDir(marketplace))) {
     report("error", ROOT, "no design/ folder here");
     return { problems: [...problems], skillCount: 0, blockCount: 0, designRoot: ROOT };
   }
 
   // ── the tiers: the marketplace, every flat org folder, and the legacy orgs/ container ──
   const tiers = [];
-  const marketplace = join(ROOT, "marketplace");
   const orgDirs = (base) => readdirSync(base).filter((e) => !e.startsWith(".") && !e.startsWith("_") && e !== "marketplace" && e !== "orgs" && isDir(join(base, e)));
   if (options.org?.dir) {
     // An org's own repo: one tier, its name declared, never read off the folder (UNO-88).
     tiers.push({ org: options.org.name, dir: resolve(options.org.dir) });
   } else {
     if (isDir(marketplace)) tiers.push({ org: undefined, dir: marketplace });
-    for (const e of orgDirs(ROOT)) tiers.push({ org: e, dir: join(ROOT, e) });
+    if (isDir(ROOT)) for (const e of orgDirs(ROOT)) tiers.push({ org: e, dir: join(ROOT, e) });
     if (isDir(join(ROOT, "orgs"))) for (const e of orgDirs(join(ROOT, "orgs"))) tiers.push({ org: e, dir: join(ROOT, "orgs", e) });
   }