Skip to content
SocialMediaClone
Sign inCreate account

This page ships 0 kb of JavaScript

A social network, built to break a framework

Every Ultimate primitive, once, in one real app: relational visibility decided by a policy, a live feed, offline reads, uploads and an admin that shares the same authz object as the API.

Read the public feedSign in

Seeded demo data. Every account, post and photo here is fabricated.

canSeePost(null, post)

What a signed-out reader may see

  • audience: publicvisible
  • audience: friendshidden
  • audience: privatehidden

Not a WHERE clause. One policy object answers the HTTP route, the live query, the MCP tool and the admin button — and it is re-decided per row, per subscriber.

primitives, and the list is closed
8
JavaScript on every public page
0 kb
policy object per decision, on all four surfaces
1
packages published in lockstep
31

What this deployment is evidence for

  • One authz object, four surfaces

    Who may see a post is friendship and blocks, not a tenant column — and the HTTP route, the live query, the MCP tool and the admin button all ask the same policy.

  • Live queries, not polling

    A read declared live: true becomes a subscription, with the row gate re-decided per subscriber.

  • Offline is a route declaration

    Each route says precache, runtime or network-only, and the service worker is generated from the route table.

  • Admin is view-only by permission

    It holds admin:read and never admin:write. One decision renders the button and answers the call.

None of that is configuration. It is a declaration.

A route says how it renders, whether it hydrates, what it does offline and what it may cost. The service worker, the budget check and the prerender list are all generated from those five lines — so a page cannot quietly start shipping JavaScript.

  • The directory is the URL. There is no route table to keep in step.
  • A budget is a build failure, not a note in a README.
  • Who may read a post is one policy object, asked by HTTP, live queries, the MCP tools and the admin alike.
apps/web/site/feed/page.tsx
// the directory is the URL
export const config = defineRoute({
  render: 'ssr',
  hydrate: 'never',
  offline: 'runtime',
  budget: { js: '0kb' },
});

Everything here is real, and none of it is true

The data is fabricated and the app is not. Read the feed and every row you see was decided by a policy, not by a WHERE clause.

Read the public feedCreate an account