create-substrat 0.9.3 → 0.9.4

package/index.js

@@ -36,11 +36,11 @@ const TEMPLATE = join(HERE, 'template');
 // The runtime packages release together off one version line (the changesets `fixed`
 // group), so one constant is right for all of them. Engines do NOT share a line —
 // each versions on its own, so one pin per engine, deliberately.
-const SUBSTRAT = '^0.105.0';
-const ENGINE_WORKORDER = '^0.11.4';
-const ENGINE_INVOICING = '^0.9.21';
+const SUBSTRAT = '^0.109.0';
+const ENGINE_WORKORDER = '^0.11.8';
+const ENGINE_INVOICING = '^0.9.25';
 const BOUNDARY_LINT = '^0.4.2';
-const DEV_ISSUER = '^0.1.20';
+const DEV_ISSUER = '^0.1.24';
 
 const DOCS = 'https://substrat.net';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-substrat",
-  "version": "0.9.3",
+  "version": "0.9.4",
   "description": "Scaffold a Substrat vertical — `npm create substrat <dir>`.",
   "license": "Apache-2.0",
   "repository": {

package/template/AGENTS.md

@@ -307,6 +307,15 @@ vertical done, boot the server and drive the real flow over HTTP as two personas
 should succeed and one who should be denied — and confirm the denial arrives as a denial
 (not a generic error).
 
+`.claude/launch.json` is what starts those servers for an agent with a browser pane, and it
+declares a **port** — never a path or a query. So the pane opens each server's bare origin,
+and no entry can deep-link a page underneath it: reaching one is a navigation you perform
+once the preview is up, not something configuration expresses. Do that without being asked.
+The page worth opening first on a vertical that serves the Scalar API reference is
+**`/api/docs`** — every operation, rendered from that vertical's own `/openapi.json`, on the
+vertical's own origin, so a try-it request carries the session cookie you already have and
+a 403 in the playground is the permission system working rather than a broken page.
+
 ## When it breaks — symptom → fix
 
 Six failures that have each cost someone a day. What makes them expensive is that none of

package/template/src/worker.ts

@@ -47,7 +47,7 @@ import {
   SCOPE_SWEEPER_NAME,
   type ScopeSweeperDo,
 } from '@substrat-run/adapter-cloudflare';
-import { readRoutedNode, RouterAssertionError, type ScopeStub } from '@substrat-run/kernel';
+import { readRoutedNode, RouterAssertionError, type ScopeStub, invocationLog } from '@substrat-run/kernel';
 import { mountPlatformSurface } from '@substrat-run/vertical-host';
 import { MODULES, OWNER_ROLE_KEY, ROLES } from './provision.js';
 import { SHOP_ENV } from './manifest.js';
@@ -239,6 +239,21 @@ async function unauthorizedReason(env: Env, node: Node): Promise<string> {
 
 const app = new Hono<{ Bindings: Env }>();
 
+// FIRST, before any route: Hono composes handlers in registration order and stops at the
+// one that answers, so a route registered above this line would never be logged. The line
+// it writes is what attributes this vertical's invocations to the tenant they served —
+// see `invocationLog`'s header for why the router cannot supply that from its side.
+app.use(
+  '*',
+  invocationLog<Env>({
+    // The same two answers this worker gives `readRoutedNode` in `nodeFor`: the line is
+    // written from a VERIFIED assertion, never from the header, or anyone who could reach
+    // this script directly could file their request under a tenant of their choosing.
+    routerSecret: (env) => env.ROUTER_SECRET,
+    allowUnsigned: (env) => env.ALLOW_DEV_NODE === 'true',
+  }),
+);
+
 // Who am I, and what instance am I on — resolves the caller without invoking
 // anything. Auth-shaped and host-specific, so it stays OUT of the shared table;
 // `server.ts` answers the same question from its own login.