create-substrat 0.8.0 → 0.8.1

package/index.js

@@ -36,11 +36,11 @@ const TEMPLATE = join(HERE, 'template');
 // The runtime packages release together off one version line (the changesets `fixed`
 // group), so one constant is right for all of them. Engines do NOT share a line —
 // each versions on its own, so one pin per engine, deliberately.
-const SUBSTRAT = '^0.89.0';
-const ENGINE_WORKORDER = '^0.9.0';
-const ENGINE_INVOICING = '^0.9.5';
+const SUBSTRAT = '^0.91.1';
+const ENGINE_WORKORDER = '^0.9.2';
+const ENGINE_INVOICING = '^0.9.7';
 const BOUNDARY_LINT = '^0.2.0';
-const DEV_ISSUER = '^0.1.3';
+const DEV_ISSUER = '^0.1.5';
 
 const DOCS = 'https://substrat.net';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-substrat",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Scaffold a Substrat vertical — `npm create substrat <dir>`.",
   "license": "Apache-2.0",
   "repository": {

package/template/.substrat/playbook.md

@@ -71,7 +71,13 @@ Every vertical gets this whether or not it uses a single engine:
 - **Tenancy** — tenants and scopes, isolated at the database level. A scope is one
   SQLite/DO database. Cross-tenant access is not a bug you avoid; there is no API for it.
 - **Permissions** — roles, grants, entity-narrowed grants, and every decision carries a
-  proof path (why it was allowed).
+  proof path (why it was allowed). **Sharing is a kernel verb, not a table you design**:
+  an operation narrows a permission it already holds onto one entity, and withdraws it,
+  with `ctx.grant(principal, perm, entityRef)` / `ctx.revoke(principal, perm, entityRef)`
+  — entity-required, delegating (re-checks the caller's own decision), transactional with
+  the operation. Neither alternative is this: a `ctx.link` edge is permanent (not
+  revocable at all), and org membership is revocable but coarse-grained. Never mint an
+  org per domain row to get a revoke.
 - **Events + audit** — every mutation emits a kernel-stamped event. Origin fields (tenant,
   scope, actor, time) are stamped by the kernel; your code cannot mislabel one.
 - **Migrations** — journaled per module, applied lazily per scope.
@@ -392,7 +398,10 @@ await host.provisionScope(actor, { tenantId: tenant, scopeId: scope, jurisdictio
 
 Define roles **per tenant** from the engines' `PERM` + your keys, assign them, create seed
 entities via `stub.invoke` (**never raw SQL**), give portal principals entity-narrowed
-grants. Make it idempotent.
+grants. Make it idempotent. Seed-time grants are the platform actor's verb; sharing a
+**user** initiates at runtime is `ctx.grant` / `ctx.revoke` inside an operation (see the
+`AGENTS.md` section on sharing, and the [todo demo](https://github.com/substrat-run/substrat/tree/main/demos/todo)'s
+`src/module.ts` for the two calls in place).
 
 ### `test/scenario.test.ts`
 

package/template/AGENTS.md

@@ -142,6 +142,28 @@ consumers). Rules 1–5 are enforced mechanically by `boundary-lint`.
 adapter **rejects** a `ctx.link` for an undeclared edge, so a missing one fails loudly.
 This is also what lets a portal permission-walk reach the owner.
 
+## Sharing is `ctx.grant` / `ctx.revoke`, not a table
+
+When a person shares their own record with another person — and takes them off it again —
+the operation narrows a permission it already holds onto that one entity:
+
+```ts
+await ctx.grant(principal, PERM.listContribute, listRef(listId));   // share
+await ctx.revoke(principal, PERM.listContribute, listRef(listId));  // un-share
+```
+
+Entity-required (module code can never write a scope- or tenant-wide grant), delegating
+(the caller's own decision on that entity is re-checked, so an operation can never hand out
+more than it holds), and transactional with the operation. Every later `ctx.check` reads
+the grant, so nothing else has to remember who may touch what.
+
+Neither alternative is this, so you can tell a real absence from this one: a `ctx.link`
+edge is **not revocable at all** — it is permanent — and org membership is revocable but
+coarse-grained — a whole org, not one record. Never mint an org per domain row, or a
+membership table consulted by hand in every handler, to get a revoke. The two-line
+reference is the [todo demo](https://github.com/substrat-run/substrat/tree/main/demos/todo)
+(`src/module.ts`, `todo/share-list` and `todo/revoke-share`).
+
 ## The gates — run them, believe them
 
 ```sh