create-substrat 0.9.8 → 0.10.0

package/index.js

@@ -36,11 +36,11 @@ const TEMPLATE = join(HERE, 'template');
 // The runtime packages release together off one version line (the changesets `fixed`
 // group), so one constant is right for all of them. Engines do NOT share a line —
 // each versions on its own, so one pin per engine, deliberately.
-const SUBSTRAT = '^0.114.0';
-const ENGINE_WORKORDER = '^0.11.13';
-const ENGINE_INVOICING = '^0.10.4';
-const BOUNDARY_LINT = '^0.4.2';
-const DEV_ISSUER = '^0.1.29';
+const SUBSTRAT = '^0.124.0';
+const ENGINE_WORKORDER = '^0.12.8';
+const ENGINE_INVOICING = '^0.11.8';
+const BOUNDARY_LINT = '^0.5.0';
+const DEV_ISSUER = '^0.2.6';
 
 const DOCS = 'https://substrat.net';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-substrat",
-  "version": "0.9.8",
+  "version": "0.10.0",
   "description": "Scaffold a Substrat vertical — `npm create substrat <dir>`.",
   "license": "Apache-2.0",
   "repository": {

package/project-files.js

@@ -46,6 +46,9 @@ export const VITEST_CONFIG = `import { defineConfig } from 'vitest/config';
 export default defineConfig({
   test: {
     include: ['test/**/*.test.ts'],
+    // The 50-byte LIKE/GLOB pattern limit a Durable Object enforces (#1770) — on by
+    // default, so a scaffolded project's own suite sees what production sees.
+    setupFiles: ['./test/setup.ts'],
   },
 });
 `;

package/template/AGENTS.md

@@ -53,6 +53,8 @@ src/worker.ts          the deployable Cloudflare worker             ← harness
 src/config-do.ts       per-instance config store (Cloudflare only)  ← harness
 test/scenario.test.ts  the scenario — including the denials
 test/entities.test.ts  the registry, held to the tables it migrates
+test/setup.ts          the 50-byte LIKE/GLOB pattern limit, on by default (vitest setupFiles)
+test/sql-limits.test.ts  proves the setupFiles wiring itself — goes red if setup.ts stops running
 ```
 
 **A new route is an `http` declaration on its operation, never a handler in an

package/template/src/worker.ts

@@ -48,7 +48,7 @@ import {
   type ScopeSweeperDo,
 } from '@substrat-run/adapter-cloudflare';
 import {
-  PLATFORM_REQUEST_HEADER,
+  kickFlags,
   readRoutedNode,
   RouterAssertionError,
   type ScopeStub,
@@ -220,12 +220,13 @@ async function stub(c: Context<{ Bindings: Env }>): Promise<ScopeStub> {
   const principal = await authenticatedPrincipal(c.req.raw, c.env);
   if (!principal) throw new HTTPException(401, { message: await unauthorizedReason(c.env, node) });
   return hostFor(c.env).getScope(principal, node.tenantId, node.scopeId, {
-    // An operation that called `ctx.requestPlatform` flags its response, and the router
-    // drains this scope within seconds instead of at the next sweep. Leave it wired even
-    // if nothing requests anything yet: the host calls this only when a committed invoke
-    // enqueued at least one intent, so it costs nothing until then, and without it every
-    // platform intent waits up to a quarter of an hour.
-    onPlatformRequests: () => c.header(PLATFORM_REQUEST_HEADER, '1'),
+    // An operation that called `ctx.requestPlatform`, or committed an event of a type this
+    // vertical EXPORTS (whether or not another app imports it yet), flags its response. The
+    // router then has the platform act on this scope within seconds instead of at the next
+    // sweep. Leave it wired even if nothing uses either yet: the host raises a flag only when a
+    // committed invoke did one of the two, so it costs nothing until then, and without it each
+    // waits up to a quarter of an hour.
+    ...kickFlags((name, value) => c.header(name, value)),
   });
 }
 

package/template/test/setup.ts

@@ -0,0 +1,15 @@
+// The node suite sees the LIKE/GLOB pattern limit a Durable Object enforces (50 bytes), so a
+// pattern that passes here passes deployed too — see apps/docs/concepts/scope-host.md, "SQL
+// limits on ctx.sql". The import's side effect patches better-sqlite3's Database.prototype.
+import { LIKE_PATTERN_LIMIT } from '@substrat-run/adapter-sqlite/testing';
+
+declare global {
+  var __substratLikeLimitSetup: number | undefined;
+}
+
+// A marker test/sql-limits.test.ts asserts before trusting a pattern to throw — so a suite
+// that stops running this file (vitest.config.ts's setupFiles edited or removed, or this file
+// emptied) fails on "setup did not run" instead of silently accepting a pattern a Durable
+// Object would refuse. Derived from the import itself (not a bare `true`), so the assertion
+// also catches an import that resolves to something other than the real helper.
+globalThis.__substratLikeLimitSetup = LIKE_PATTERN_LIMIT;

package/template/test/sql-limits.test.ts

@@ -0,0 +1,34 @@
+import Database from 'better-sqlite3';
+import { describe, expect, it } from 'vitest';
+
+// Proves the WIRING, not just the helper: test/setup.ts (vitest.config.ts's setupFiles) is what
+// makes a pattern over 50 bytes throw here, the same way it throws on a Durable Object. If
+// setupFiles is ever removed, or setup.ts stops importing the helper, this suite must fail
+// loudly rather than quietly accept a pattern deployed production would refuse.
+describe('the 50-byte LIKE/GLOB pattern limit is on by default', () => {
+  it('test/setup.ts ran — the marker it derived from the real helper is present', () => {
+    expect(globalThis.__substratLikeLimitSetup).toBe(50);
+  });
+
+  it('a 51-byte pattern is refused, the same message a Durable Object gives', () => {
+    const db = new Database(':memory:');
+    const pattern = `%${'a'.repeat(49)}%`; // 51 bytes
+    try {
+      expect(() => db.prepare('SELECT ? LIKE ?').pluck().get('x', pattern)).toThrow(
+        /LIKE or GLOB pattern too complex/,
+      );
+    } finally {
+      db.close();
+    }
+  });
+
+  it('the passing twin: a 50-byte pattern still runs', () => {
+    const db = new Database(':memory:');
+    const pattern = `%${'a'.repeat(48)}%`; // 50 bytes
+    try {
+      expect(db.prepare('SELECT ? LIKE ?').pluck().get(`x${'a'.repeat(48)}x`, pattern)).toBe(1);
+    } finally {
+      db.close();
+    }
+  });
+});