create-substrat 0.9.3 → 0.9.5

package/index.js

@@ -36,11 +36,11 @@ const TEMPLATE = join(HERE, 'template');
 // The runtime packages release together off one version line (the changesets `fixed`
 // group), so one constant is right for all of them. Engines do NOT share a line —
 // each versions on its own, so one pin per engine, deliberately.
-const SUBSTRAT = '^0.105.0';
-const ENGINE_WORKORDER = '^0.11.4';
-const ENGINE_INVOICING = '^0.9.21';
+const SUBSTRAT = '^0.110.0';
+const ENGINE_WORKORDER = '^0.11.9';
+const ENGINE_INVOICING = '^0.10.0';
 const BOUNDARY_LINT = '^0.4.2';
-const DEV_ISSUER = '^0.1.20';
+const DEV_ISSUER = '^0.1.25';
 
 const DOCS = 'https://substrat.net';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-substrat",
-  "version": "0.9.3",
+  "version": "0.9.5",
   "description": "Scaffold a Substrat vertical — `npm create substrat <dir>`.",
   "license": "Apache-2.0",
   "repository": {

package/template/AGENTS.md

@@ -307,6 +307,15 @@ vertical done, boot the server and drive the real flow over HTTP as two personas
 should succeed and one who should be denied — and confirm the denial arrives as a denial
 (not a generic error).
 
+`.claude/launch.json` is what starts those servers for an agent with a browser pane, and it
+declares a **port** — never a path or a query. So the pane opens each server's bare origin,
+and no entry can deep-link a page underneath it: reaching one is a navigation you perform
+once the preview is up, not something configuration expresses. Do that without being asked.
+The page worth opening first on a vertical that serves the Scalar API reference is
+**`/api/docs`** — every operation, rendered from that vertical's own `/openapi.json`, on the
+vertical's own origin, so a try-it request carries the session cookie you already have and
+a 403 in the playground is the permission system working rather than a broken page.
+
 ## When it breaks — symptom → fix
 
 Six failures that have each cost someone a day. What makes them expensive is that none of

package/template/src/operations.ts

@@ -19,18 +19,34 @@ import { bikeShopEntities } from './entities.js';
  * The permission keys an operation here may name.
  *
  * Two of them are this vertical's own (they mirror `SHOP_PERM` in
- * `src/manifest.ts`); the other four are the WORKORDER ENGINE's. An engine key
- * is listed because a vertical operation may be gated by one — this is the
- * vocabulary a `permission` may draw on, not a second declaration of who owns
- * the key. The engine still declares them.
+ * `src/manifest.ts`); the rest belong to the ENGINES this vertical composes. An
+ * engine key is listed because a vertical operation may be gated by one — this
+ * is the vocabulary a `permission` may draw on, not a second declaration of who
+ * owns the key. The engine still declares them.
+ *
+ * One array, two readers, and that is what makes it checked (#1208).
+ * `defineOperations` takes it below as the union a mistyped `permission:` fails
+ * against; `definePermissions` in `src/provision.ts` takes the SAME array as
+ * `keys` and throws at module load if it and `MODULES` disagree in either
+ * direction. So every key a registered module declares is here, including the
+ * ones no shop operation checks today — `MODULES` registers both engines, so a
+ * scope declares them, and an operation gated on one had no way to say so while
+ * the list held only the subset the shop happened to check.
  */
 export const SHOP_PERMISSIONS = [
+  // The shop's own — `SHOP_PERM` in src/manifest.ts.
   'customer:manage',
   'bike:manage',
+  // @substrat-run/engine-workorder
   'workorder:create',
   'workorder:read',
+  'workorder:assign',
+  'workorder:report',
   'workorder:complete',
   'workorder:close',
+  // @substrat-run/engine-invoicing
+  'invoicing:read',
+  'invoicing:export',
 ] as const;
 
 /**

package/template/src/provision.ts

@@ -7,6 +7,7 @@ import { workorderModule, PERM as WO } from '@substrat-run/engine-workorder';
 import { invoicingModule, INVOICING_PERM as INV } from '@substrat-run/engine-invoicing';
 import { bikeShopModule } from './module.js';
 import { SHOP_PERM } from './manifest.js';
+import { SHOP_PERMISSIONS } from './operations.js';
 
 // The manifest's config surface rides the same import `substrat push` already makes for
 // `permissions` (#1206): this export is what the push uploads, so `src/manifest.ts` is the
@@ -73,9 +74,16 @@ export const ENTITY_GRANTS: { entityType: string; permissions: PermissionKey[] }
  * The single typed source for this vertical's permission surface — what the
  * permission checkpoint and `substrat push` read (via package.json
  * `substrat.permissions`).
+ *
+ * `keys` is `SHOP_PERMISSIONS` — the array `src/operations.ts` already hands
+ * `defineOperations` as the union a mistyped `permission:` fails against — which
+ * is what makes that restatement checked (#1208): `definePermissions` throws at
+ * module load if it and `MODULES` disagree in either direction. Keep handing
+ * both readers the SAME array; a second copy is the thing this removes.
  */
 export const permissions = definePermissions({
   modules: MODULES,
   roles: ROLES,
   entityGrants: ENTITY_GRANTS,
+  keys: SHOP_PERMISSIONS,
 });

package/template/src/worker.ts

@@ -47,7 +47,7 @@ import {
   SCOPE_SWEEPER_NAME,
   type ScopeSweeperDo,
 } from '@substrat-run/adapter-cloudflare';
-import { readRoutedNode, RouterAssertionError, type ScopeStub } from '@substrat-run/kernel';
+import { readRoutedNode, RouterAssertionError, type ScopeStub, invocationLog } from '@substrat-run/kernel';
 import { mountPlatformSurface } from '@substrat-run/vertical-host';
 import { MODULES, OWNER_ROLE_KEY, ROLES } from './provision.js';
 import { SHOP_ENV } from './manifest.js';
@@ -239,6 +239,21 @@ async function unauthorizedReason(env: Env, node: Node): Promise<string> {
 
 const app = new Hono<{ Bindings: Env }>();
 
+// FIRST, before any route: Hono composes handlers in registration order and stops at the
+// one that answers, so a route registered above this line would never be logged. The line
+// it writes is what attributes this vertical's invocations to the tenant they served —
+// see `invocationLog`'s header for why the router cannot supply that from its side.
+app.use(
+  '*',
+  invocationLog<Env>({
+    // The same two answers this worker gives `readRoutedNode` in `nodeFor`: the line is
+    // written from a VERIFIED assertion, never from the header, or anyone who could reach
+    // this script directly could file their request under a tenant of their choosing.
+    routerSecret: (env) => env.ROUTER_SECRET,
+    allowUnsigned: (env) => env.ALLOW_DEV_NODE === 'true',
+  }),
+);
+
 // Who am I, and what instance am I on — resolves the caller without invoking
 // anything. Auth-shaped and host-specific, so it stays OUT of the shared table;
 // `server.ts` answers the same question from its own login.