create-substrat 0.9.9 → 0.10.1

package/index.js

@@ -36,11 +36,11 @@ const TEMPLATE = join(HERE, 'template');
 // The runtime packages release together off one version line (the changesets `fixed`
 // group), so one constant is right for all of them. Engines do NOT share a line —
 // each versions on its own, so one pin per engine, deliberately.
-const SUBSTRAT = '^0.121.0';
-const ENGINE_WORKORDER = '^0.12.5';
-const ENGINE_INVOICING = '^0.11.5';
-const BOUNDARY_LINT = '^0.5.0';
-const DEV_ISSUER = '^0.2.3';
+const SUBSTRAT = '^0.126.0';
+const ENGINE_WORKORDER = '^0.12.10';
+const ENGINE_INVOICING = '^0.11.10';
+const BOUNDARY_LINT = '^0.6.0';
+const DEV_ISSUER = '^0.2.8';
 
 const DOCS = 'https://substrat.net';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-substrat",
-  "version": "0.9.9",
+  "version": "0.10.1",
   "description": "Scaffold a Substrat vertical — `npm create substrat <dir>`.",
   "license": "Apache-2.0",
   "repository": {

package/project-files.js

@@ -46,6 +46,9 @@ export const VITEST_CONFIG = `import { defineConfig } from 'vitest/config';
 export default defineConfig({
   test: {
     include: ['test/**/*.test.ts'],
+    // The 50-byte LIKE/GLOB pattern limit a Durable Object enforces (#1770) — on by
+    // default, so a scaffolded project's own suite sees what production sees.
+    setupFiles: ['./test/setup.ts'],
   },
 });
 `;

package/template/.substrat/playbook.md

@@ -76,9 +76,9 @@ Every vertical gets this whether or not it uses a single engine:
   an operation narrows a permission it already holds onto one entity, and withdraws it,
   with `ctx.grant(principal, perm, entityRef)` / `ctx.revoke(principal, perm, entityRef)`
   — entity-required, delegating (re-checks the caller's own decision), transactional with
-  the operation. Neither alternative is this: a `ctx.link` edge is permanent (not
-  revocable at all), and org membership is revocable but coarse-grained. Never mint an
-  org per domain row to get a revoke.
+  the operation. Neither alternative is this: a `ctx.link` edge can be moved
+  (`ctx.relink`) but never removed, so it is not a revoke, and org membership is
+  revocable but coarse-grained. Never mint an org per domain row to get a revoke.
 - **Events + audit** — every mutation emits a kernel-stamped event. Origin fields (tenant,
   scope, actor, time) are stamped by the kernel; your code cannot mislabel one.
 - **Migrations** — journaled per module, applied lazily per scope.

package/template/AGENTS.md

@@ -53,6 +53,8 @@ src/worker.ts          the deployable Cloudflare worker             ← harness
 src/config-do.ts       per-instance config store (Cloudflare only)  ← harness
 test/scenario.test.ts  the scenario — including the denials
 test/entities.test.ts  the registry, held to the tables it migrates
+test/setup.ts          the 50-byte LIKE/GLOB pattern limit, on by default (vitest setupFiles)
+test/sql-limits.test.ts  proves the setupFiles wiring itself — goes red if setup.ts stops running
 ```
 
 **A new route is an `http` declaration on its operation, never a handler in an
@@ -300,8 +302,9 @@ more than it holds), and transactional with the operation. Every later `ctx.chec
 the grant, so nothing else has to remember who may touch what.
 
 Neither alternative is this, so you can tell a real absence from this one: a `ctx.link`
-edge is **not revocable at all** — it is permanent — and org membership is revocable but
-coarse-grained — a whole org, not one record. Never mint an org per domain row, or a
+edge **can be moved but never removed** (`ctx.relink` replaces one parent with another), so
+it is not a revoke, and org membership is revocable but coarse-grained — a whole org, not
+one record. Never mint an org per domain row, or a
 membership table consulted by hand in every handler, to get a revoke. The two-line
 reference is the [todo demo](https://github.com/substrat-run/substrat/tree/main/demos/todo)
 (`src/module.ts`, `todo/share-list` and `todo/revoke-share`).

package/template/test/setup.ts

@@ -0,0 +1,15 @@
+// The node suite sees the LIKE/GLOB pattern limit a Durable Object enforces (50 bytes), so a
+// pattern that passes here passes deployed too — see apps/docs/concepts/scope-host.md, "SQL
+// limits on ctx.sql". The import's side effect patches better-sqlite3's Database.prototype.
+import { LIKE_PATTERN_LIMIT } from '@substrat-run/adapter-sqlite/testing';
+
+declare global {
+  var __substratLikeLimitSetup: number | undefined;
+}
+
+// A marker test/sql-limits.test.ts asserts before trusting a pattern to throw — so a suite
+// that stops running this file (vitest.config.ts's setupFiles edited or removed, or this file
+// emptied) fails on "setup did not run" instead of silently accepting a pattern a Durable
+// Object would refuse. Derived from the import itself (not a bare `true`), so the assertion
+// also catches an import that resolves to something other than the real helper.
+globalThis.__substratLikeLimitSetup = LIKE_PATTERN_LIMIT;

package/template/test/sql-limits.test.ts

@@ -0,0 +1,34 @@
+import Database from 'better-sqlite3';
+import { describe, expect, it } from 'vitest';
+
+// Proves the WIRING, not just the helper: test/setup.ts (vitest.config.ts's setupFiles) is what
+// makes a pattern over 50 bytes throw here, the same way it throws on a Durable Object. If
+// setupFiles is ever removed, or setup.ts stops importing the helper, this suite must fail
+// loudly rather than quietly accept a pattern deployed production would refuse.
+describe('the 50-byte LIKE/GLOB pattern limit is on by default', () => {
+  it('test/setup.ts ran — the marker it derived from the real helper is present', () => {
+    expect(globalThis.__substratLikeLimitSetup).toBe(50);
+  });
+
+  it('a 51-byte pattern is refused, the same message a Durable Object gives', () => {
+    const db = new Database(':memory:');
+    const pattern = `%${'a'.repeat(49)}%`; // 51 bytes
+    try {
+      expect(() => db.prepare('SELECT ? LIKE ?').pluck().get('x', pattern)).toThrow(
+        /LIKE or GLOB pattern too complex/,
+      );
+    } finally {
+      db.close();
+    }
+  });
+
+  it('the passing twin: a 50-byte pattern still runs', () => {
+    const db = new Database(':memory:');
+    const pattern = `%${'a'.repeat(48)}%`; // 50 bytes
+    try {
+      expect(db.prepare('SELECT ? LIKE ?').pluck().get(`x${'a'.repeat(48)}x`, pattern)).toBe(1);
+    } finally {
+      db.close();
+    }
+  });
+});