create-substrat 0.8.0 → 0.8.2

package/index.js

@@ -36,11 +36,11 @@ const TEMPLATE = join(HERE, 'template');
 // The runtime packages release together off one version line (the changesets `fixed`
 // group), so one constant is right for all of them. Engines do NOT share a line —
 // each versions on its own, so one pin per engine, deliberately.
-const SUBSTRAT = '^0.89.0';
-const ENGINE_WORKORDER = '^0.9.0';
-const ENGINE_INVOICING = '^0.9.5';
+const SUBSTRAT = '^0.93.0';
+const ENGINE_WORKORDER = '^0.10.1';
+const ENGINE_INVOICING = '^0.9.9';
 const BOUNDARY_LINT = '^0.2.0';
-const DEV_ISSUER = '^0.1.3';
+const DEV_ISSUER = '^0.1.7';
 
 const DOCS = 'https://substrat.net';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-substrat",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Scaffold a Substrat vertical — `npm create substrat <dir>`.",
   "license": "Apache-2.0",
   "repository": {

package/template/.substrat/playbook.md

@@ -1,3 +1,4 @@
+<!-- Adapted by hand from the substrat skill (.claude/skills/substrat/SKILL.md in substrat-run/substrat) — NOT emitted from it. The two diverge on purpose; tools/playbook-sync.mts fails CI when the skill moves so a human ports what belongs here. Edit this file directly. -->
 # Playbook — build a vertical on Substrat
 
 The always-on rules live in [`AGENTS.md`](../AGENTS.md); read them first. This playbook is
@@ -71,7 +72,13 @@ Every vertical gets this whether or not it uses a single engine:
 - **Tenancy** — tenants and scopes, isolated at the database level. A scope is one
   SQLite/DO database. Cross-tenant access is not a bug you avoid; there is no API for it.
 - **Permissions** — roles, grants, entity-narrowed grants, and every decision carries a
-  proof path (why it was allowed).
+  proof path (why it was allowed). **Sharing is a kernel verb, not a table you design**:
+  an operation narrows a permission it already holds onto one entity, and withdraws it,
+  with `ctx.grant(principal, perm, entityRef)` / `ctx.revoke(principal, perm, entityRef)`
+  — entity-required, delegating (re-checks the caller's own decision), transactional with
+  the operation. Neither alternative is this: a `ctx.link` edge is permanent (not
+  revocable at all), and org membership is revocable but coarse-grained. Never mint an
+  org per domain row to get a revoke.
 - **Events + audit** — every mutation emits a kernel-stamped event. Origin fields (tenant,
   scope, actor, time) are stamped by the kernel; your code cannot mislabel one.
 - **Migrations** — journaled per module, applied lazily per scope.
@@ -392,7 +399,10 @@ await host.provisionScope(actor, { tenantId: tenant, scopeId: scope, jurisdictio
 
 Define roles **per tenant** from the engines' `PERM` + your keys, assign them, create seed
 entities via `stub.invoke` (**never raw SQL**), give portal principals entity-narrowed
-grants. Make it idempotent.
+grants. Make it idempotent. Seed-time grants are the platform actor's verb; sharing a
+**user** initiates at runtime is `ctx.grant` / `ctx.revoke` inside an operation (see the
+`AGENTS.md` section on sharing, and the [todo demo](https://github.com/substrat-run/substrat/tree/main/demos/todo)'s
+`src/module.ts` for the two calls in place).
 
 ### `test/scenario.test.ts`
 

package/template/AGENTS.md

@@ -142,6 +142,28 @@ consumers). Rules 1–5 are enforced mechanically by `boundary-lint`.
 adapter **rejects** a `ctx.link` for an undeclared edge, so a missing one fails loudly.
 This is also what lets a portal permission-walk reach the owner.
 
+## Sharing is `ctx.grant` / `ctx.revoke`, not a table
+
+When a person shares their own record with another person — and takes them off it again —
+the operation narrows a permission it already holds onto that one entity:
+
+```ts
+await ctx.grant(principal, PERM.listContribute, listRef(listId));   // share
+await ctx.revoke(principal, PERM.listContribute, listRef(listId));  // un-share
+```
+
+Entity-required (module code can never write a scope- or tenant-wide grant), delegating
+(the caller's own decision on that entity is re-checked, so an operation can never hand out
+more than it holds), and transactional with the operation. Every later `ctx.check` reads
+the grant, so nothing else has to remember who may touch what.
+
+Neither alternative is this, so you can tell a real absence from this one: a `ctx.link`
+edge is **not revocable at all** — it is permanent — and org membership is revocable but
+coarse-grained — a whole org, not one record. Never mint an org per domain row, or a
+membership table consulted by hand in every handler, to get a revoke. The two-line
+reference is the [todo demo](https://github.com/substrat-run/substrat/tree/main/demos/todo)
+(`src/module.ts`, `todo/share-list` and `todo/revoke-share`).
+
 ## The gates — run them, believe them
 
 ```sh

package/template/src/worker.ts

@@ -121,7 +121,11 @@ interface Env {
 function nodeFor(req: Request, env: Env): Node {
   let routed;
   try {
-    routed = readRoutedNode(req.headers, { expectedSecret: env.ROUTER_SECRET });
+    routed = readRoutedNode(req.headers, {
+      expectedSecret: env.ROUTER_SECRET,
+      // #966: an unsigned assertion is refused unless this is an un-routed dev instance.
+      allowUnsigned: env.ALLOW_DEV_NODE === 'true',
+    });
   } catch (e) {
     if (e instanceof RouterAssertionError) throw new HTTPException(400, { message: e.message });
     throw e;