Spotcraft 0.2.0

Databases for hosted apps, and a backend kit that gives server-rendered apps guest accounts:
one Postgres on the apps server with a database per app, the spotcraft dev command to run
the same setup locally, and the dashboard to see and delete an app's users.

Before deploying, add the POSTGRES_AGENT_PASSWORD secret (see Upgrading).

Added

• Postgres on the apps server (postgres service, Postgres 18), the base for databases for
  hosted apps. Reachable only inside Docker; the superuser only over the local socket.
• App databases: database: true (the dashboard's Database checkbox) gives an app its own
  Postgres role and database as DATABASE_URL. Removing an app keeps its database unless you
  also choose to delete it (?purge=true). When the agent starts, it brings every app database
  up to date.
• Backend kit (@spotcraft/kit on npm): guest accounts for server-rendered apps on Better
  Auth. Server-only: an httpOnly session cookie, no auth routes, and it fails to bundle for the
  browser. currentGuest reads without creating, so apps create guests only when a visitor
  saves something, not for every page view or crawler. New guests are limited per client
  address, and the kit checks the auth schema version.
• spotcraft dev (spotcraft on npm): the apps server's Postgres and app database setup on
  your machine (start, stop, status, env --write, reset, migrate).
• App users: for apps with a database, the dashboard lists their users (guests and
  registered, created, last seen) and deletes one with everything the app kept for them. The
  agent's API has GET /apps/:name/users and DELETE /apps/:name/users/:id.
• Dashboard: a Database checkbox when adding or editing an app, the database in the app's
  settings, and "Also delete its database" when removing it.
• npm packages published by CI on release tags, with provenance. Their APIs join the public
  API (ADR 0019).
• Guide: Guest accounts with the backend kit,
  for a SvelteKit app locally and on Spotcraft.

Changed

• The Deploy workflow needs a new secret, POSTGRES_AGENT_PASSWORD, on the production
  environment. The apps server needs about 1 GB more memory.

Security

• Each app's role can open only its own database, and can't change the auth schema, which
  Spotcraft owns and migrates. The built-in databases are closed to everyone but the agent's
  role, which can create databases and roles but is not a superuser.
• An app's database password is generated by the agent and kept with mode 600. The agent's API
  never returns it.
• Two zlib CVEs in the distroless base image (CVE-2026-85091, CVE-2026-76844) are accepted
  until 2026-12-08: nothing in the images loads that zlib, and no fixed base image exists yet.

Upgrading from 0.1:

1. Add POSTGRES_AGENT_PASSWORD (openssl rand -hex 32) to the production environment.
   Without it, the deploy stops with "POSTGRES_AGENT_PASSWORD is empty".
2. Run the Deploy workflow with 0.2.0. Hosted apps keep running; they only get a database
   once you tick Database.

Images: vindotski/spotcraft-agent:0.2.0, vindotski/spotcraft-dashboard:0.2.0, vindotski/spotcraft-site:0.2.0 (amd64 and arm64).

npm: @spotcraft/kit@0.2.0, spotcraft@0.2.0.

Full changelog: v0.1.0...v0.2.0