create-substrat 0.8.1 → 0.8.2

package/index.js

@@ -36,11 +36,11 @@ const TEMPLATE = join(HERE, 'template');
 // The runtime packages release together off one version line (the changesets `fixed`
 // group), so one constant is right for all of them. Engines do NOT share a line —
 // each versions on its own, so one pin per engine, deliberately.
-const SUBSTRAT = '^0.91.1';
-const ENGINE_WORKORDER = '^0.9.2';
-const ENGINE_INVOICING = '^0.9.7';
+const SUBSTRAT = '^0.93.0';
+const ENGINE_WORKORDER = '^0.10.1';
+const ENGINE_INVOICING = '^0.9.9';
 const BOUNDARY_LINT = '^0.2.0';
-const DEV_ISSUER = '^0.1.5';
+const DEV_ISSUER = '^0.1.7';
 
 const DOCS = 'https://substrat.net';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-substrat",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Scaffold a Substrat vertical — `npm create substrat <dir>`.",
   "license": "Apache-2.0",
   "repository": {

package/template/.substrat/playbook.md

@@ -1,3 +1,4 @@
+<!-- Adapted by hand from the substrat skill (.claude/skills/substrat/SKILL.md in substrat-run/substrat) — NOT emitted from it. The two diverge on purpose; tools/playbook-sync.mts fails CI when the skill moves so a human ports what belongs here. Edit this file directly. -->
 # Playbook — build a vertical on Substrat
 
 The always-on rules live in [`AGENTS.md`](../AGENTS.md); read them first. This playbook is

package/template/src/worker.ts

@@ -121,7 +121,11 @@ interface Env {
 function nodeFor(req: Request, env: Env): Node {
   let routed;
   try {
-    routed = readRoutedNode(req.headers, { expectedSecret: env.ROUTER_SECRET });
+    routed = readRoutedNode(req.headers, {
+      expectedSecret: env.ROUTER_SECRET,
+      // #966: an unsigned assertion is refused unless this is an un-routed dev instance.
+      allowUnsigned: env.ALLOW_DEV_NODE === 'true',
+    });
   } catch (e) {
     if (e instanceof RouterAssertionError) throw new HTTPException(400, { message: e.message });
     throw e;