unoverse 0.1.216 → 0.1.217

package/bin/unoverse.mjs

@@ -96,9 +96,8 @@ const HELP = [
   "",
   `  ${bold("After that")}`,
   row("studio", "Design components, nodes and agent skills"),
-  row("lint", "Check your components, nodes and skills, the same way deploy does"),
-  row("deploy", "Ship it"),
-  `      ${dim("deploy studio         your components, nodes and skills → your universe")}`,
+  row("lint", "Check your components, nodes and skills, the same way your universe does"),
+  row("deploy", "Put a universe on a cloud"),
   `      ${dim("deploy aws            your universe → AWS")}`,
   `      ${dim("deploy digitalocean   your universe → DigitalOcean")}`,
   row("login", "Sign in to a universe (deploy asks by itself when needed)"),
@@ -244,10 +243,10 @@ switch (cmd) {
   }
 
   case "lint": {
-    // THE DEPLOY GATE, on its own. `deploy studio` runs exactly this before it sends, so a
-    // developer can ask the question without the answer costing them a deploy.
+    // THE CHECK, on its own: the same lint the org repo's pull-request check runs, and the one
+    // a universe runs before it applies a commit.
     const { lint } = await import("../lib/lint.mjs");
-    const { importBase } = await import("../lib/publish.mjs");
+    const { importBase } = await import("../lib/base.mjs");
     await lint(args, importBase);
     break;
   }
@@ -277,37 +276,29 @@ switch (cmd) {
   }
 
   case "deploy": {
-    // ONE VERB FOR THE REMOTE DEVELOPER, the target says what ships. `deploy studio`
-    // ships this design workspace's items to the signed-in universe (lint gates it);
-    // any other target is the operator's cloud deploy, unchanged. `publish` is the
-    // PLATFORM OWNER's word (the release) and stays out of this lane on purpose.
-    if (args[0] === "studio") {
-      const { findWorkspace } = await import("../lib/workspace.mjs");
-      const ws = findWorkspace();
-      if (ws?.kind !== "assets" && ws?.kind !== "org") {
-        console.log(`\n  deploy studio ships an org repo or design workspace, and there is none above ${process.cwd()}.\n  Start one with: unoverse create\n`);
-        process.exit(1);
-      }
-      const { publish } = await import("../lib/publish.mjs");
-      await publish(args.slice(1));
-      break;
+    // THE OPERATOR'S CLOUD DEPLOY: puts a universe on a cloud. A developer's own work never
+    // ships this way; it reaches a universe through the org's Git repo (RELEASE_LIFECYCLE.md §3).
+    // A word that is not a cloud is refused here, before the operator runs anything.
+    if (args[0] && !args[0].startsWith("-") && !["aws", "amazon", "digitalocean", "do"].includes(args[0])) {
+      console.log(`\n  'deploy ${args[0]}' is not a cloud. Use: unoverse deploy aws, or unoverse deploy digitalocean.\n  Your own work ships by a push to your org's Git repo.\n`);
+      process.exit(1);
     }
     if (UNIVERSE) operator(UNIVERSE, ["deploy", ...args]);
-    console.log(`\n  '${["deploy", args[0]].filter(Boolean).join(" ")}' operates a universe, and this folder is not one.\n  cd into your universe — or did you mean: unoverse deploy studio\n`);
+    console.log(`\n  '${["deploy", args[0]].filter(Boolean).join(" ")}' operates a universe, and this folder is not one.\n  cd into your universe. To ship your own work, push it to your org's Git repo.\n`);
     process.exit(1);
   }
 
   case "publish": {
-    // THE PLATFORM OWNER'S VERB. A remote developer never publishes: their word is
-    // `deploy studio`, and this says so instead of quietly doing it under the wrong
-    // name. In a universe checkout the operator's publish lane runs as before (on a
+    // THE PLATFORM OWNER'S VERB. A remote developer never publishes: their work ships by a
+    // push to their org's Git repo, and this says so instead of quietly doing it under the
+    // wrong name. In a universe checkout the operator's publish lane runs as before (on a
     // starter kit that lane refuses by itself and names the owner's script).
     const { findWorkspace } = await import("../lib/workspace.mjs");
     const ws = findWorkspace();
     if (ws?.kind === "universe") {
       operator({ root: ws.root, script: OPERATOR }, ["publish", ...args]);
     } else {
-      console.log(`\n  publish is the platform owner's release. To ship your work: unoverse deploy studio\n`);
+      console.log(`\n  publish is the platform owner's release. To ship your work, push it to your org's Git repo.\n`);
       process.exit(1);
     }
     break;

package/lib/base.mjs

@@ -0,0 +1,28 @@
+/**
+ * Base, as the CLI uses it: the lint the org repo's own pull-request check runs, and the same
+ * one a universe runs before it applies a commit.
+ *
+ * Base is consumed as BUILT dist, never source: in this monorepo straight from
+ * packages/base/dist (the in-repo copy wins, same rule as the vendored operator), and in the
+ * published package from the copy vendor-base.mjs froze at pack time.
+ */
+import { existsSync } from "node:fs";
+import { join, dirname, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const IN_REPO_BASE = resolve(here, "../../base/dist");
+const VENDORED_BASE = resolve(here, "../vendor/base");
+
+export async function importBase(subpath) {
+  const root = existsSync(IN_REPO_BASE) ? IN_REPO_BASE : VENDORED_BASE;
+  const file = join(root, subpath);
+  if (!existsSync(file)) {
+    throw new Error(
+      root === IN_REPO_BASE
+        ? `packages/base is not built (${subpath} missing). Run: npm run build -w packages/base`
+        : `This install is missing its vendored base (${subpath}). Reinstall: npm i -g unoverse@latest`,
+    );
+  }
+  return import(pathToFileURL(file).href);
+}

package/lib/lint.mjs

@@ -1,7 +1,7 @@
 /**
  * unoverse lint — check a workspace before you deploy it.
  *
- * THE SAME GATE `deploy studio` RUNS, and nothing else: one function in base
+ * THE SAME CHECK A UNIVERSE RUNS before it applies a commit, and nothing else: one function in base
  * (items/publish lintForPublish) lints the project's design/ and the workspace's nodes/,
  * and this file only prints what it found. A developer who runs this and sees a tick will
  * deploy without a surprise, because deploy asks the same function the same question.
@@ -16,7 +16,7 @@ import { findWorkspace, designHome } from "./workspace.mjs";
 const c = { dim: "\x1b[2m", red: "\x1b[31m", green: "\x1b[32m", yellow: "\x1b[33m", bold: "\x1b[1m", off: "\x1b[0m" };
 
 /**
- * Lint one project and print the findings. Returns the findings so `deploy studio` can
+ * Lint one project and print the findings. Returns the findings so a caller can
  * decide what to do with them; exits nobody.
  */
 export async function lintProject({ lintForPublish, designRoot, project }) {

package/operator/lib/deploy.sh

@@ -706,6 +706,11 @@ cmd_deploy() {
   local GROUND_ARG=""
   case "${1:-}" in
     do|digitalocean|aws|amazon) GROUND_ARG="$1"; shift ;;
+    ""|-*) ;;
+    # A WORD THAT IS NOT A CLOUD IS REFUSED, before anything runs. An unknown word used to be
+    # ignored and the full deploy went ahead: the retired command for shipping an org's work
+    # (UNO-85) walked an operator into "Where should this universe live?".
+    *) fail "'deploy $1' is not a cloud. Use: unoverse deploy aws, or unoverse deploy digitalocean. Your own work ships by a push to your org's Git repo."; return 1 ;;
   esac
 
   # .env.production IS NOT A FILE IN THE UNIVERSE. It is `terraform output -raw
@@ -893,7 +898,7 @@ EOF
     ""|deploy)
       # THE deploy: the server takes the latest platform images (pull + restart).
       # Content does NOT ride deploys — it arrives from the marketplace as database
-      # ROWS (`POST /marketplace/install`) or from `unoverse deploy studio`.
+      # ROWS (`POST /marketplace/install`) or from the org's Git repo, through the sync.
       #
       # "self-healing at boot" was the npm install lane (`plugins/startup.ts`),
       # deleted 2026-08-30 — nothing is fetched from a registry (MARKETPLACE.md §10 q3).

package/operator/lib/help.sh

@@ -16,8 +16,7 @@ cmd_help() {
   echo -e "  ${BOLD}Anywhere${NC}"
   echo -e "    ${GREEN}create${NC}      Start something new, here"
   echo -e "    ${GREEN}studio${NC}      Author components, nodes, agent skills"
-  echo -e "    ${GREEN}deploy${NC}      Ship it"
-  echo -e "                ${DIM}deploy studio         your components, nodes and skills → your universe${NC}"
+  echo -e "    ${GREEN}deploy${NC}      Put a universe on a cloud"
   echo -e "                ${DIM}deploy aws            your universe → AWS${NC}"
   echo -e "                ${DIM}deploy digitalocean   your universe → DigitalOcean${NC}"
   echo -e "    ${GREEN}login${NC}       Sign in to a universe ${DIM}(deploy asks by itself; this is for up front)${NC}"

package/operator/operator.sh

@@ -198,28 +198,24 @@ case "${1:-}" in
     fi
     ;;
   publish)
-    # TWO MEANINGS, decided by which kit you are in.
-    #   monorepo  `publish` is the PLATFORM RELEASE (publish.sh, owner-only), so a
-    #             developer publish is `publish assets <project>`.
-    #   starter   sync-starter.sh strips publish.sh, so the name is free and `publish`
-    #             means the only publish a developer has.
+    # ONE MEANING: the PLATFORM RELEASE (publish.sh, owner-only). A developer never publishes
+    # into a universe: that door is closed (UNO-85), and their work ships by a push to their
+    # org's Git repo, which every connected universe pulls.
     if [ "${2:-}" = "assets" ]; then
-      shift 2; node --import tsx "$GRAVITY_LIB/publish-assets.mjs" "$@"
+      echo "" >&2
+      echo "  Publishing work into a universe is closed. Push it to your org's Git repo;" >&2
+      echo "  every universe connected to the repo pulls it (RELEASE_LIFECYCLE.md §3)." >&2
+      echo "" >&2
+      exit 1
     elif type cmd_publish >/dev/null 2>&1; then
       shift; cmd_publish "$@"
     elif _in_platform_monorepo; then
-      # THE INSTALLED CLI CANNOT RELEASE THE PLATFORM, and inside this repo the fallthrough
-      # below is never what anyone meant: it would start publishing design assets to a universe
-      # while the operator believes they are shipping the platform. It used to do exactly
-      # that, silently, which is the whole reason this branch exists. Refuse and say where
-      # to go. A starter kit never reaches here (no `unoverse-platform` package above it),
-      # so the developer publish keeps working untouched.
+      # THE INSTALLED CLI CANNOT RELEASE THE PLATFORM: refuse and say where to go.
       echo "" >&2
       echo "  The unoverse CLI does not release the platform." >&2
       echo "" >&2
-      echo "  You are inside the platform monorepo, where \`publish\` would publish rx" >&2
-      echo "  ASSETS to a universe — not ship the platform. The release lives in this" >&2
-      echo "  repo's own script, which the published CLI does not carry:" >&2
+      echo "  The release lives in this repo's own script, which the published CLI does" >&2
+      echo "  not carry:" >&2
       echo "" >&2
       echo "    scripts/operator.sh publish" >&2
       echo "" >&2
@@ -227,7 +223,11 @@ case "${1:-}" in
       echo "" >&2
       exit 1
     else
-      shift; node --import tsx "$GRAVITY_LIB/publish-assets.mjs" "$@"
+      echo "" >&2
+      echo "  Publishing work into a universe is closed. Push it to your org's Git repo;" >&2
+      echo "  every universe connected to the repo pulls it." >&2
+      echo "" >&2
+      exit 1
     fi
     ;;
   build)     cmd_build "${2:-}" ;;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.216",
+  "version": "0.1.217",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",

package/vendor/base/items/collect.js

@@ -279,7 +279,7 @@ function collectFrom(root, project, designSystem) {
     // package envelope their $refs and credential shapes resolve against. The name is the
     // node's `type`, bare: a saved workflow stores that identity and nothing else.
     //
-    // Until 2026-09-05 deploy never looked at nodes at all, so `deploy studio` shipped a
+    // Until 2026-09-05 the collect never looked at nodes at all, so shipping an org sent a
     // developer's components and skills and silently left every node behind. Until
     // 2026-09-08 it looked at a `nodes/` folder beside design/ while every org already
     // kept its nodes INSIDE its project, so the same nodes were left behind again. Org

package/vendor/base/lint/objects/_schema/objects/dataset.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://docs.unoverse.ai/schemas/objects/dataset.schema.json",
   "title": "A dataset's table",
-  "description": "The shape of the table an object owns (docs/unoverse/data/objects/dataset.md). The declaration IS the schema: it generates a migration a person reviews, and nobody edits a database schema by hand.",
+  "description": "The shape of the table an object owns (docs/unoverse/data/objects/dataset.md). The declaration IS the schema: the platform makes the table from it. Nobody writes SQL and nobody edits a database schema by hand.",
   "type": "object",
   "required": [
     "columns"

package/vendor/base/lint/objects/_schema/objects/object.schema.json

@@ -224,6 +224,20 @@
         ]
       }
     },
+    "matching": {
+      "type": "object",
+      "description": "How a name is matched to a row of this object (docs/unoverse/data/objects/entity-resolution.md, \"How an org declares it\"): ids decide, then any of its names as words, then a few candidates put to a judge. Every field is a prop of the object.",
+      "additionalProperties": false,
+      "required": ["names"],
+      "properties": {
+        "ids": { "type": "array", "items": { "type": "string" }, "minItems": 1, "description": "Fields whose equal value on both rows, compared as words, decides it is the same thing." },
+        "names": { "type": "array", "items": { "type": "string" }, "minItems": 1, "description": "The fields that hold its names; a mention matching any of them, as words, is this row." },
+        "remember": { "type": "string", "description": "One of names, a list: where a name confirmed by the judge or a person is added, so the next one matches at once." },
+        "evidence": { "type": "array", "items": { "type": "string" }, "description": "Fields shown to the judge beside each candidate, to tell like names apart." },
+        "ruleOut": { "type": "array", "items": { "type": "string" }, "description": "Fields that, filled on both and different as words, mean never the same thing." },
+        "judge": { "type": "string", "description": "The node that decides a name the rules leave open, choosing among the candidates or none (TypeSafeChoice). Absent, an open name goes to review." }
+      }
+    },
     "dataset": {
       "oneOf": [
         {

package/vendor/base/lint/objects/_schema/pipelines/pipeline.schema.json

@@ -125,6 +125,10 @@
               "const": true,
               "description": "The item MAY be one; the model says."
             },
+            "per": {
+              "const": "section",
+              "description": "Written after the document is cut, one read per stored piece of each named section, instead of in the document's first read."
+            },
             "parts": {
               "type": "object",
               "additionalProperties": {

package/vendor/base/lint/objects/rules.mjs

@@ -106,6 +106,19 @@ export function envelopeFindings(name, envelope, file = `${name}.yaml`) {
       for (const k of Object.keys(l)) if (!["type", "between", "order", "when", "alike"].includes(k)) say(`object ${name}: link ${ln}: "${k}" is not a word here`);
     }
   }
+  // HOW A NAME IS MATCHED TO ITS ROWS (entity-resolution.md, "How an org declares it", 2026-10-05).
+  if (envelope.matching != null) {
+    const m = envelope.matching;
+    const fields = (v) => Array.isArray(v) && v.length > 0 && v.every((f) => typeof f === "string" && f);
+    if (!isRecord(m)) refuse(`object ${name}: matching is a record: ids, names, remember, evidence, ruleOut, judge`);
+    else {
+      if (!fields(m.names)) refuse(`object ${name}: matching: names lists the fields that hold this object's names`);
+      for (const k of ["ids", "evidence", "ruleOut"]) if (m[k] != null && !fields(m[k])) refuse(`object ${name}: matching: ${k} is a list of field names`);
+      if (m.remember != null && (typeof m.remember !== "string" || !(m.names ?? []).includes(m.remember))) refuse(`object ${name}: matching: remember names one of names, the list a confirmed name is added to`);
+      if (m.judge != null && (typeof m.judge !== "string" || !/^[A-Z][A-Za-z0-9]*$/.test(m.judge))) refuse(`object ${name}: matching: judge names a node by its type (TypeSafeChoice)`);
+      for (const k of Object.keys(m)) if (!["ids", "names", "remember", "evidence", "ruleOut", "judge"].includes(k)) say(`object ${name}: matching: "${k}" is not a word here`);
+    }
+  }
   return out;
 }
 
@@ -251,6 +264,11 @@ export function rowKeyFindings(name, envelope, props, file = `${name}.yaml`) {
     if (!Array.isArray(list)) continue;
     for (const f of list.flat()) if (typeof f === "string" && !known.has(f) && !known.has(camel(f))) out.push({ file, msg: `object ${name}: ${key} names "${f}", which is not a prop of this object or its base. A row key is a field (README 9a)` });
   }
+  const m = isRecord(envelope.matching) ? envelope.matching : null;
+  if (m) {
+    for (const k of ["ids", "names", "evidence", "ruleOut"]) for (const f of Array.isArray(m[k]) ? m[k] : []) if (typeof f === "string" && !known.has(f)) out.push({ file, msg: `object ${name}: matching: ${k} names "${f}", which is not a prop of this object or its base (entity-resolution.md)` });
+    if (typeof m.remember === "string" && props[m.remember] && props[m.remember].type !== "array") out.push({ file, msg: `object ${name}: matching: remember names "${m.remember}", which is not a list; a confirmed name is added to a list (entity-resolution.md)` });
+  }
   return out;
 }
 
@@ -285,7 +303,7 @@ export const PIPELINE_READ_KEYS = new Set(["each", "sourceUrl", "sourceId", "con
 const DROPPED_MAKE_KEYS = ["partsOf", "by", "under", "when", "from", "any", "index"];
 
 /** What an object may say: under `each`, how many and what it holds; made once per pack, how many and from which rows. */
-const ITEM_OBJECT_KEYS = new Set(["cardinality", "any", "parts", "where"]);
+const ITEM_OBJECT_KEYS = new Set(["cardinality", "any", "parts", "where", "per"]);
 const FIELD = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
 /**
@@ -361,7 +379,8 @@ export function pipelineFindings(name, file, fileName = "pipeline.yaml") {
         }
         if (made.includes(o)) refuse(`pipeline ${name}: ${at}.${o} is made above already; one entry makes an object`);
         const allowed = ITEM_OBJECT_KEYS;
-        for (const k of Object.keys(spec)) if (!allowed.has(k)) refuse(`pipeline ${name}: ${at}.${o}: "${k}" is not a word here; an object says cardinality, any, parts and where (${see})`);
+        for (const k of Object.keys(spec)) if (!allowed.has(k)) refuse(`pipeline ${name}: ${at}.${o}: "${k}" is not a word here; an object says cardinality, any, parts, where and per (${see})`);
+        if ("per" in spec && spec.per !== "section") refuse(`pipeline ${name}: ${at}.${o}: per says section, the only unit an object is written per (${see})`);
         // HOW MANY IS SAID by every object the model writes (owner, 2026-09-13).
         if (spec.cardinality !== "one" && spec.cardinality !== "many") say(`pipeline ${name}: ${at}.${o} says cardinality: one or many, how many of it one row makes (${see})`);
         if ("any" in spec && spec.any !== true) refuse(`pipeline ${name}: ${at}.${o}: any: true is its only value, the item MAY be one`);

package/lib/publish.mjs

@@ -1,218 +0,0 @@
-/**
- * unoverse deploy studio: ship an asset workspace's items to its universe.
- *
- * The terminal face of @unoverse-platform/base items/publish. The order is the safety:
- * LINT, then COMPARE (a dry-run per item against the universe), then a plan and a
- * question, then send. Nothing leaves the machine until the rules pass.
- * (LOCAL_STUDIO.md §Publish is terminal-only; the engine lives in base, this file only
- * resolves context, formats and asks.)
- *
- * Base is consumed as BUILT dist, never source: in this monorepo straight from
- * packages/base/dist (the in-repo copy wins, same rule as the vendored operator), and in
- * the published package from the copy vendor-base.mjs froze at pack time.
- */
-import { existsSync } from "node:fs";
-import { join, dirname, resolve } from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-import { createInterface } from "node:readline/promises";
-import { findWorkspace, designHome, readConfig, writeConfig } from "./workspace.mjs";
-import { normaliseUrl, tokenFor } from "./login.mjs";
-
-const here = dirname(fileURLToPath(import.meta.url));
-const IN_REPO_BASE = resolve(here, "../../base/dist");
-const VENDORED_BASE = resolve(here, "../vendor/base");
-
-export async function importBase(subpath) {
-  const root = existsSync(IN_REPO_BASE) ? IN_REPO_BASE : VENDORED_BASE;
-  const file = join(root, subpath);
-  if (!existsSync(file)) {
-    throw new Error(
-      root === IN_REPO_BASE
-        ? `packages/base is not built (${subpath} missing). Run: npm run build -w packages/base`
-        : `This install is missing its vendored base (${subpath}). Reinstall: npm i -g unoverse@latest`,
-    );
-  }
-  return import(pathToFileURL(file).href);
-}
-
-const c = { dim: "\x1b[2m", red: "\x1b[31m", green: "\x1b[32m", yellow: "\x1b[33m", bold: "\x1b[1m", off: "\x1b[0m" };
-const die = (msg) => {
-  console.error(`\n  ${c.red}✗${c.off} ${msg}\n`);
-  process.exit(1);
-};
-
-const ask = async (question) => {
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  const answer = await rl.question(question);
-  rl.close();
-  return answer.trim();
-};
-
-/**
- * `unoverse deploy studio [project] [--to <universe> | --env <name>] [--dry-run] [--yes]`
- * Run from anywhere inside an asset workspace. bin/unoverse.mjs routes here only when
- * the nearest marker up from cwd is a design home.
- */
-export async function publish(args) {
-  const flag = (name) => args.includes(`--${name}`);
-  const opt = (name) => {
-    const i = args.indexOf(`--${name}`);
-    return i >= 0 ? args[i + 1] : undefined;
-  };
-  // An option's value is never the project: `--env uat` must not read "uat" as one.
-  const optionValues = new Set(["to", "env"].map(opt).filter(Boolean));
-  const positional = args.find((a) => !a.startsWith("--") && !optionValues.has(a));
-
-  const ws = findWorkspace();
-  if (ws?.kind !== "assets" && ws?.kind !== "org") die("no org repo or design/ folder here or above. Run this inside your workspace.");
-
-  const { collectProject, listProjects, collectOrg } = await importBase("items/collect.js");
-  const { lintForPublish, planPublish, sendPublish, lintOrg } = await importBase("items/publish.js");
-
-  // ── which project ───────────────────────────────────────────────────────────
-  // An org repo (UNO-88) IS one org, declared in its unoverse.yaml; the monorepo shape
-  // (design/<project>/) may hold several and asks which.
-  let project = positional;
-  let designRoot;
-  let collect;
-  let lintFor = lintForPublish;
-  if (ws.kind === "org") {
-    if (project && project !== ws.org) die(`this repo is the org "${ws.org}", not "${project}"`);
-    project = ws.org;
-    designRoot = ws.root;
-    collect = () => collectOrg({ org: ws.org, dir: ws.root });
-    lintFor = () => lintOrg({ org: ws.org, dir: ws.root });
-  } else {
-    designRoot = designHome(ws.root);
-    const projects = listProjects(designRoot);
-    if (!projects.length) die(`nothing to publish: ${designRoot} holds no projects`);
-    if (!project) {
-      if (projects.length > 1) {
-        die(`several projects here. Say which:\n\n    unoverse deploy studio <project>\n\n  Found: ${projects.join(", ")}`);
-      }
-      project = projects[0];
-    } else if (!projects.includes(project)) {
-      die(`no project "${project}" in ${designRoot}. Found: ${projects.join(", ") || "none"}`);
-    }
-    collect = () => collectProject(designRoot, project);
-  }
-
-  // ── which universe: --to overrides, --env names one from unoverse.yaml's
-  //    `environments:`, `universe:` is the default, the login answers, and only a
-  //    machine that knows nothing asks ─────────────────────────────────────────
-  const config = await readConfig(ws.root);
-  const envName = opt("env");
-  let envUniverse;
-  if (envName && !opt("to")) {
-    envUniverse = config.environments?.[envName];
-    if (!envUniverse) {
-      const known = Object.keys(config.environments ?? {});
-      die(`no environment "${envName}" in unoverse.yaml. ${known.length ? `Found: ${known.join(", ")}` : "Add one:\n\n    environments:\n      " + envName + ": https://your-universe.example"}`);
-    }
-  }
-  let universe = opt("to") ?? envUniverse ?? config.universe;
-  if (!universe) {
-    // THE LOGIN ALREADY NAMED THE UNIVERSE. `unoverse login` takes an address and
-    // keeps a session for it, so a machine signed in to exactly one universe has
-    // already answered this question — asking it again reads as the CLI forgetting
-    // what it was just told (observed live 2026-08-21). One session: use it, say so,
-    // and remember it in unoverse.yaml like a typed answer. Several sessions: the
-    // choice is real, so the question remains.
-    const { sessionOrigins } = await import("./session.mjs");
-    const origins = sessionOrigins();
-    if (origins.length === 1) {
-      universe = origins[0];
-      await writeConfig(ws.root, { universe });
-      console.log(`
-  ${c.dim}→ ${universe} (your signed-in universe; saved to unoverse.yaml)${c.off}`);
-    }
-  }
-  if (!universe) {
-    if (!process.stdin.isTTY) die("no universe. Pass --to https://your-universe.example, or commit it in unoverse.yaml");
-    const typed = await ask(`\n  Where does this workspace deploy to? ${c.dim}(e.g. universe.example.com)${c.off} `);
-    if (!typed) die("no universe given");
-    universe = normaliseUrl(typed);
-    await writeConfig(ws.root, { universe });
-    console.log(`  ${c.green}✓${c.off} saved to unoverse.yaml ${c.dim}(commit it: the whole team deploys there)${c.off}`);
-  } else {
-    universe = normaliseUrl(universe);
-  }
-
-  // ── 1. lint. Nothing is sent if this fails ──────────────────────────────────
-  console.log(`\n  ${c.bold}deploy ${project}${c.off} ${c.dim}→ ${universe}${c.off}\n`);
-  const { lintProject } = await import("./lint.mjs");
-  const { errors } = await lintProject({ lintForPublish: lintFor, designRoot, project });
-  if (errors.length) {
-    console.error(`  ${c.red}Nothing was sent.${c.off}\n`);
-    process.exit(1);
-  }
-
-  // ── 2. the credential, only now that there is something worth sending ───────
-  const items = collect();
-  if (!items.length) die(`nothing to publish in ${project}`);
-  let token;
-  try {
-    token = await tokenFor(universe, { interactive: !flag("yes") });
-  } catch (e) {
-    die(e.message);
-  }
-
-  // ── 3. the plan: what would this publish actually do ────────────────────────
-  let plan;
-  try {
-    plan = await planPublish(items, universe, token, project);
-  } catch (e) {
-    die(e.message);
-  }
-
-  console.log("");
-  const label = (i) => `${i.kind}/${i.name}`;
-  // No "(lands PENDING review)" on a node (removed 2026-09-05): the review flow in
-  // DECLARATIVE_NODES.md §9.5 is not built, and the route registers a node row at once.
-  for (const i of plan.create) console.log(`  ${c.green}+${c.off} ${label(i)} ${c.dim}(new)${c.off}`);
-  for (const i of plan.update) console.log(`  ${c.yellow}~${c.off} ${label(i)} ${c.dim}(changed)${c.off}`);
-  if (plan.unchanged.length) console.log(`  ${c.dim}= ${plan.unchanged.length} unchanged${c.off}`);
-  for (const r of plan.refused) console.log(`  ${c.red}✗ ${label(r)}${c.off} ${c.dim}${r.why}${c.off}`);
-  // Deploy is a SYNC: what left the workspace leaves the universe, said before it happens.
-  for (const r of plan.remove ?? []) console.log(`  ${c.red}-${c.off} ${label(r)} ${c.dim}(no longer in this workspace — will be removed)${c.off}`);
-
-  if (plan.syncUnavailable) {
-    console.log(`  ${c.yellow}⚠${c.off} this universe cannot answer the sync check yet ${c.dim}(its server predates it)${c.off}`);
-    console.log(`    ${c.dim}items you deleted from the workspace were NOT reconciled. Update the universe`);
-    console.log(`    ${c.dim}(unoverse update on its box), then deploy again to remove them.${c.off}`);
-  }
-
-  const toSend = plan.create.length + plan.update.length + (plan.remove?.length ?? 0);
-  if (!toSend) {
-    if (plan.syncUnavailable) {
-      console.log(`\n  ${c.green}✓${c.off} nothing new to send ${c.dim}(deletions unchecked, see above)${c.off}\n`);
-    } else {
-      console.log(`\n  ${c.green}✓${c.off} nothing to do, ${project} is up to date\n`);
-    }
-    process.exit(plan.refused.length ? 1 : 0);
-  }
-  if (flag("dry-run")) {
-    console.log(`\n  ${c.dim}dry run: ${toSend} item(s) would be sent${c.off}\n`);
-    process.exit(0);
-  }
-
-  // ── 4. confirm, unless told not to ──────────────────────────────────────────
-  if (!flag("yes")) {
-    const answer = await ask(`\n  ${toSend} item(s) → ${universe}. Deploy? [y/N] `);
-    if (!/^y(es)?$/i.test(answer)) {
-      console.log(`  ${c.dim}cancelled${c.off}\n`);
-      process.exit(0);
-    }
-  }
-
-  // ── 5. send ─────────────────────────────────────────────────────────────────
-  const { sent, failed } = await sendPublish(plan, universe, token);
-  console.log("");
-  for (const s of sent) console.log(`  ${c.green}✓${c.off} ${s.mode ?? "sent"} ${c.dim}${s.kind}/${s.name}${c.off}`);
-  for (const f of failed) console.log(`  ${c.red}✗${c.off} ${f.kind}/${f.name}  ${f.why}`);
-  console.log(
-    `\n  ${failed.length ? c.red + "✗" : c.green + "✓"}${c.off} ${sent.length} deployed` +
-      (failed.length ? `, ${failed.length} failed` : "") + "\n",
-  );
-  process.exit(failed.length ? 1 : 0);
-}

package/operator/lib/publish-assets.mjs

@@ -1,123 +0,0 @@
-#!/usr/bin/env node
-/**
- * unoverse publish <project> — push a project's assets into a universe.
- *
- * The terminal face of `packages/base/src/items/publish.ts`. Studio will call the same
- * functions from a button; this file only formats and asks.
- *
- * The order is the safety: LINT, then COMPARE, then confirm, then send. Nothing leaves the
- * machine until the rules pass, because a developer should learn about a raw hex value from
- * their own terminal, not from an HTTP error. The universe validates again on receipt, as
- * it must not trust a client, but by then it is a second opinion rather than the only one.
- *
- * Usage:
- *   publish-assets.mjs <project> --to <universe> --token <jwt>   [--dry-run] [--yes]
- */
-import { resolve, dirname, join } from "node:path";
-import { existsSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { createInterface } from "node:readline/promises";
-
-const here = dirname(fileURLToPath(import.meta.url));
-const base = join(here, "../../packages/base/src/items");
-const { collectProject, listProjects } = await import(join(base, "collect.ts"));
-const { lintForPublish, planPublish, sendPublish } = await import(join(base, "publish.ts"));
-
-const arg = (name) => {
-  const i = process.argv.indexOf(`--${name}`);
-  return i >= 0 ? process.argv[i + 1] : undefined;
-};
-const flag = (name) => process.argv.includes(`--${name}`);
-
-const project = process.argv[2] && !process.argv[2].startsWith("--") ? process.argv[2] : undefined;
-const universe = arg("to");
-const token = arg("token") ?? process.env.UNOVERSE_TOKEN;
-const designRoot = resolve(arg("design") ?? "apps/unoverse/design");
-
-const c = { dim: "\x1b[2m", red: "\x1b[31m", green: "\x1b[32m", yellow: "\x1b[33m", bold: "\x1b[1m", off: "\x1b[0m" };
-const die = (msg) => {
-  console.error(`\n  ${c.red}✗${c.off} ${msg}\n`);
-  process.exit(1);
-};
-
-// The platform repo's design/ was retired 2026-10-04: no org is authored here any more. An
-// absent folder is no org tier, said plainly, rather than a lint error about a missing folder.
-if (!existsSync(designRoot)) {
-  die(`no design/ folder at ${designRoot}. An org lives in its own repo and publishes from there; pass --design <folder> for a design tree kept elsewhere.`);
-}
-
-if (!project) {
-  const projects = listProjects(designRoot);
-  die(`which project?\n\n    unoverse publish <project> --to <universe>\n\n  Found: ${projects.join(", ") || "none"}`);
-}
-if (!universe) die("no universe. Pass --to https://your-universe.com");
-if (!token) die("no credential. Pass --token, or set UNOVERSE_TOKEN");
-
-// ── 1. lint. Nothing is sent if this fails ────────────────────────────────────
-console.log(`\n  ${c.bold}publish ${project}${c.off} ${c.dim}→ ${universe}${c.off}\n`);
-process.stdout.write(`  ${c.dim}checking…${c.off}`);
-const { problems, errors } = await lintForPublish(designRoot, project);
-process.stdout.write("\r                    \r");
-
-if (errors.length) {
-  console.error(`  ${c.red}✗ ${errors.length} error(s) in ${project}. Nothing was sent.${c.off}\n`);
-  for (const p of errors.slice(0, 10)) console.error(`    ${p.file}${p.line ? ":" + p.line : ""}  ${p.msg}`);
-  if (errors.length > 10) console.error(`    ${c.dim}…and ${errors.length - 10} more${c.off}`);
-  console.error("");
-  process.exit(1);
-}
-const warnings = problems.filter((p) => p.level === "warn").length;
-console.log(`  ${c.green}✓${c.off} checks passed${warnings ? ` ${c.dim}(${warnings} warning(s))${c.off}` : ""}`);
-
-// ── 2. compare against what the universe already holds ────────────────────────
-const items = collectProject(designRoot, project);
-if (!items.length) die(`nothing to publish in ${project}`);
-
-let plan;
-try {
-  plan = await planPublish(items, universe, token);
-} catch (e) {
-  die(e.message);
-}
-
-const line = (label, list, colour) =>
-  list.length && console.log(`  ${colour}${String(list.length).padStart(3)}${c.off} ${label.padEnd(10)} ${c.dim}${list.map((i) => i.name).join(", ")}${c.off}`);
-
-console.log("");
-line("new", plan.create, c.green);
-line("updated", plan.update, c.yellow);
-line("unchanged", plan.unchanged, c.dim);
-line("refused", plan.refused, c.red);
-for (const r of plan.refused) console.log(`      ${c.red}${r.name}${c.off} ${c.dim}${r.why}${c.off}`);
-
-const toSend = plan.create.length + plan.update.length;
-if (!toSend) {
-  console.log(`\n  ${c.green}✓${c.off} nothing to do, ${project} is up to date\n`);
-  process.exit(0);
-}
-if (flag("dry-run")) {
-  console.log(`\n  ${c.dim}dry run: ${toSend} item(s) would be sent${c.off}\n`);
-  process.exit(0);
-}
-
-// ── 3. confirm, unless told not to ────────────────────────────────────────────
-if (!flag("yes")) {
-  const rl = createInterface({ input: process.stdin, output: process.stdout });
-  const answer = await rl.question(`\n  Publish ${toSend} item(s) to ${universe}? [y/N] `);
-  rl.close();
-  if (!/^y(es)?$/i.test(answer.trim())) {
-    console.log(`  ${c.dim}cancelled${c.off}\n`);
-    process.exit(0);
-  }
-}
-
-// ── 4. send ───────────────────────────────────────────────────────────────────
-const { sent, failed } = await sendPublish(plan, universe, token);
-console.log("");
-for (const s of sent) console.log(`  ${c.green}✓${c.off} ${s.mode ?? "sent"} ${c.dim}${s.kind}/${s.name}${c.off}`);
-for (const f of failed) console.log(`  ${c.red}✗${c.off} ${f.kind}/${f.name}  ${f.why}`);
-console.log(
-  `\n  ${failed.length ? c.red + "✗" : c.green + "✓"}${c.off} ${sent.length} published` +
-    (failed.length ? `, ${failed.length} failed` : "") + "\n",
-);
-process.exit(failed.length ? 1 : 0);