create-syncular-app 0.15.19 → 0.15.21

package/README.md

@@ -62,8 +62,8 @@ scaffolder logic. For each template it:
 
 1. scaffolds into a temp dir (`--local`),
 2. asserts the tree shape + placeholder substitution + package.json rewrite,
-3. runs `syncular generate --check` — proving the committed
-   `syncular.generated.ts` is byte-fresh,
+3. runs `syncular generate --check` — proving immutable migration history and
+   the committed `syncular.generated.ts` are byte-fresh,
 4. links a `node_modules` into the temp dir **offline** (see
    [`test/link-workspace.ts`](./test/link-workspace.ts): `@syncular/*` →
    the real package dirs, external deps → the workspace `.bun` hoist store),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-syncular-app",
-  "version": "0.15.19",
+  "version": "0.15.21",
   "description": "Scaffold a new Syncular app: `create-syncular-app`",
   "license": "Apache-2.0",
   "author": "Benjamin Kniffler",
@@ -49,6 +49,6 @@
     "!dist/**/*.test.d.ts"
   ],
   "devDependencies": {
-    "@syncular/typegen": "0.15.19"
+    "@syncular/typegen": "0.15.21"
   }
 }

package/template/minimal/README.md

@@ -20,6 +20,7 @@ bun run clients           # terminal 2 — prints "✓ converged"
 | File | What it is |
 |---|---|
 | `syncular.json` + `migrations/` | The schema manifest and SQL — typegen's input |
+| `syncular.migrations.lock.json` | Immutable checksums/layout evidence for deployed migrations (committed) |
 | `src/syncular.generated.ts` | Generated by `syncular generate` (committed; regenerate on schema change) |
 | `src/server.ts` | The whole sync backend in one Bun process |
 | `src/make-client.ts` | Constructs one `SyncClient` on bun:sqlite + fetch |
@@ -31,11 +32,15 @@ bun run clients           # terminal 2 — prints "✓ converged"
 1. **`src/server.ts` → `resolveScopes`** — the whole authorization story. It
    runs in your backend next to your auth. The starter returns `['*']` (see
    everything); a real one returns the scope values the authenticated actor may
-   see.
+   see. Multiple variables are independent, not correlated parent/child tuples:
+   test isolation with at least two parents and child IDs, and carry the parent
+   scope on every child table before using a child wildcard. See
+   [Scopes & authorization](https://syncular.dev/concepts-scopes/).
 2. **`src/server.ts` → `authenticate`** — plug in your real session/token
    check; return `{ actorId, partition }` or `null` for a 401.
-3. **`migrations/` + `syncular.json`** — add tables and scopes, then
-   `bun run generate` to refresh the typed schema.
+3. **`migrations/` + `syncular.json`** — append migrations and add tables or
+   scopes, then `bun run generate` to refresh the lock and typed schema. Never
+   edit a migration after deployment.
 
 ## Next
 

package/template/minimal/syncular.migrations.lock.json

@@ -0,0 +1,37 @@
+{
+  "formatVersion": 1,
+  "migrations": [
+    {
+      "name": "0001_initial",
+      "sha256": "355c1e3c68757f31a3fdd9b640982317df7f44566741e7686e51029e4c4fe4cc",
+      "tables": [
+        {
+          "name": "notes",
+          "primaryKey": "id",
+          "columns": [
+            {
+              "name": "id",
+              "type": "string",
+              "nullable": false
+            },
+            {
+              "name": "list_id",
+              "type": "string",
+              "nullable": false
+            },
+            {
+              "name": "body",
+              "type": "string",
+              "nullable": false
+            },
+            {
+              "name": "updated_at_ms",
+              "type": "integer",
+              "nullable": false
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

package/template/tauri/README.md

@@ -47,6 +47,7 @@ Prerequisites: [Rust](https://rustup.rs) and the
 | File | What it is |
 |---|---|
 | `syncular.json` + `migrations/` + `queries/` | Schema and named-query inputs |
+| `syncular.migrations.lock.json` | Immutable deployed-migration checksums/layout evidence (committed) |
 | `src/syncular.generated.ts` + `src/syncular.queries.ts` | Generated descriptors (committed) |
 | `src/server.ts` | Sync server + WebSocket + the web frontend, one Bun process |
 | `src/frontend/engine.ts` | **The seam**: picks worker core vs native core |
@@ -76,15 +77,19 @@ On desktop, the plugin owns the database path and the transport — see
 
 1. **`src/server.ts` → `resolveScopes`** — the whole authorization story. The
    starter returns `['*']`; a real one returns the scope values the
-   authenticated actor may see.
+   authenticated actor may see. Multiple variables are independent, not
+   correlated parent/child tuples: test isolation with at least two parents and
+   child IDs, and carry the parent scope on every child table before using a
+   child wildcard. See
+   [Scopes & authorization](https://syncular.dev/concepts-scopes/).
 2. **`src/server.ts` → `authenticate`** — plug in your real session/token
    check; return `{ actorId, partition }` or `null` for a 401.
 3. **`src-tauri/src/lib.rs` → `base_url`** — point the native core at your
    deployed sync endpoint (rotating auth goes through `client.setHeaders`).
 4. **`src/frontend/main.tsx`** — the UI. Everything under `<SyncProvider>` is
    shared code; grow it into your app.
-5. **`migrations/` + `syncular.json`** — add tables and scopes, then
-   `bun run generate`.
+5. **`migrations/` + `syncular.json`** — append migrations and add tables or
+   scopes, then `bun run generate`. Never edit a migration after deployment.
 
 ## Next
 

package/template/tauri/src-tauri/Cargo.toml

@@ -21,7 +21,7 @@ tauri = { version = "2", features = [] }
 # The syncular plugin from crates.io. `native-transport` gives the core its
 # real HTTP + WebSocket transport (ureq + tungstenite) inside the host
 # process — the webview never talks to the sync server directly.
-tauri-plugin-syncular = { version = "0.15.19", features = ["native-transport"] }
+tauri-plugin-syncular = { version = "0.15.21", features = ["native-transport"] }
 
 [features]
 default = []

package/template/tauri/syncular.migrations.lock.json

@@ -0,0 +1,47 @@
+{
+  "formatVersion": 1,
+  "migrations": [
+    {
+      "name": "0001_initial",
+      "sha256": "87b23cd0f8e3677ca6fa7ca67eb7c8373a285607b6de10854cc43df1290bb0fa",
+      "tables": [
+        {
+          "name": "todos",
+          "primaryKey": "id",
+          "columns": [
+            {
+              "name": "id",
+              "type": "string",
+              "nullable": false
+            },
+            {
+              "name": "list_id",
+              "type": "string",
+              "nullable": false
+            },
+            {
+              "name": "title",
+              "type": "string",
+              "nullable": false
+            },
+            {
+              "name": "done",
+              "type": "boolean",
+              "nullable": false
+            },
+            {
+              "name": "position",
+              "type": "integer",
+              "nullable": false
+            },
+            {
+              "name": "updated_at_ms",
+              "type": "integer",
+              "nullable": false
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

package/template/web/README.md

@@ -30,6 +30,7 @@ covered by `tsc`).
 | File | What it is |
 |---|---|
 | `syncular.json` + `migrations/` | The schema manifest and SQL — typegen's input |
+| `syncular.migrations.lock.json` | Immutable deployed-migration checksums/layout evidence (committed) |
 | `src/syncular.generated.ts` | Generated by `syncular generate` (committed) |
 | `src/server.ts` | Sync server + WebSocket + static frontend, one Bun process |
 | `src/frontend/main.ts` | The single-pane UI, driving a worker core via RPC |
@@ -41,13 +42,17 @@ covered by `tsc`).
 
 1. **`src/server.ts` → `resolveScopes`** — the whole authorization story. It
    runs in your backend next to your auth. The starter returns `['*']`; a real
-   one returns the scope values the authenticated actor may see.
+   one returns the scope values the authenticated actor may see. Multiple
+   variables are independent, not correlated parent/child tuples: test
+   isolation with at least two parents and child IDs, and carry the parent scope
+   on every child table before using a child wildcard. See
+   [Scopes & authorization](https://syncular.dev/concepts-scopes/).
 2. **`src/server.ts` → `authenticate`** — plug in your real session/token
    check; return `{ actorId, partition }` or `null` for a 401.
 3. **`src/frontend/main.ts`** — the UI. It queries and mutates through the
    worker handle; grow it into your app.
-4. **`migrations/` + `syncular.json`** — add tables and scopes, then
-   `bun run generate`.
+4. **`migrations/` + `syncular.json`** — append migrations and add tables or
+   scopes, then `bun run generate`. Never edit a migration after deployment.
 
 ## How the frontend is served
 

package/template/web/syncular.migrations.lock.json

@@ -0,0 +1,47 @@
+{
+  "formatVersion": 1,
+  "migrations": [
+    {
+      "name": "0001_initial",
+      "sha256": "87b23cd0f8e3677ca6fa7ca67eb7c8373a285607b6de10854cc43df1290bb0fa",
+      "tables": [
+        {
+          "name": "todos",
+          "primaryKey": "id",
+          "columns": [
+            {
+              "name": "id",
+              "type": "string",
+              "nullable": false
+            },
+            {
+              "name": "list_id",
+              "type": "string",
+              "nullable": false
+            },
+            {
+              "name": "title",
+              "type": "string",
+              "nullable": false
+            },
+            {
+              "name": "done",
+              "type": "boolean",
+              "nullable": false
+            },
+            {
+              "name": "position",
+              "type": "integer",
+              "nullable": false
+            },
+            {
+              "name": "updated_at_ms",
+              "type": "integer",
+              "nullable": false
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}