create-substrat 0.11.0 → 0.11.2

package/index.js

@@ -17,7 +17,7 @@ import { basename, dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 import { DEV_SERVERS } from './dev-servers.js';
-import { TSCONFIG, VITEST_CONFIG } from './project-files.js';
+import { TEST_RUNNER, TSCONFIG, VITEST_CONFIG } from './project-files.js';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
 const TEMPLATE = join(HERE, 'template');
@@ -36,12 +36,12 @@ const TEMPLATE = join(HERE, 'template');
 // The runtime packages release together off one version line (the changesets `fixed`
 // group), so one constant is right for all of them. Engines do NOT share a line —
 // each versions on its own, so one pin per engine, deliberately.
-const SUBSTRAT = '^0.140.0';
-const ENGINE_WORKORDER = '^0.12.24';
-const ENGINE_INVOICING = '^0.11.24';
-const BOUNDARY_LINT = '^0.6.1';
-const DEV_ISSUER = '^0.2.22';
-const ATTACHMENT_EXTRACTORS = '^0.2.1';
+const SUBSTRAT = '^0.142.0';
+const ENGINE_WORKORDER = '^0.12.26';
+const ENGINE_INVOICING = '^0.11.26';
+const BOUNDARY_LINT = '^0.6.2';
+const DEV_ISSUER = '^0.2.24';
+const ATTACHMENT_EXTRACTORS = '^0.2.3';
 
 const DOCS = 'https://substrat.net';
 
@@ -114,8 +114,8 @@ function packageJson(name) {
         issuer: 'substrat-dev-issuer --personas src/personas.ts',
         server: 'tsx src/server.ts',
         test: 'vitest run',
-        // The live test dashboard in the Browser pane: the `tests` entry of
-        // .claude/launch.json. `--watch` is explicit, since vitest runs once and exits without a TTY.
+        // The live test dashboard: the `tests` entry of .claude/launch.json, opened at the
+        // tokenised URL vitest prints. `--watch` is explicit, since vitest runs once and exits without a TTY.
         'test:ui': 'vitest --watch --ui --open=false -c vitest.ui.config.ts',
         typecheck: 'tsc --noEmit && tsc -p tsconfig.worker.json --noEmit',
         'lint:boundaries': 'substrat-boundary-lint',
@@ -144,8 +144,7 @@ function packageJson(name) {
         concurrently: '^9.0.0',
         tsx: '^4.19.0',
         typescript: '^5.6.0',
-        vitest: '^3.0.0',
-        '@vitest/ui': '^3.0.0',
+        ...TEST_RUNNER,
       },
       // Do NOT add `zod` here — import `z` from `@substrat-run/contracts` (AGENTS.md, rule 10).
       // better-sqlite3 >=13 ships prebuilt binaries for every supported platform and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-substrat",
-  "version": "0.11.0",
+  "version": "0.11.2",
   "description": "Scaffold a Substrat vertical — `npm create substrat <dir>`.",
   "license": "Apache-2.0",
   "repository": {

package/project-files.js

@@ -52,3 +52,11 @@ export default defineConfig({
   },
 });
 `;
+
+/**
+ * The test runner a scaffold installs. Here rather than inline in `index.js`'s `packageJson()`
+ * so `tools/template-sync.mjs` can hold it to the vitest the workspace runs the template on
+ * (#2129): `packages/template-check` tests the template on the catalog's vitest, and a scaffold
+ * on a different major is a project nothing on a PR has ever run.
+ */
+export const TEST_RUNNER = { vitest: '^5.0.0', '@vitest/ui': '^5.0.0' };

package/template/AGENTS.md

@@ -336,6 +336,11 @@ The page worth opening first on a vertical that serves the Scalar API reference
 vertical's own origin, so a try-it request carries the session cookie you already have and
 a 403 in the playground is the permission system working rather than a broken page.
 
+The `tests` entry is the one whose bare origin shows nothing: the vitest dashboard serves
+only the URL it prints when it starts (`UI started at …/__vitest__/?token=…`) and answers a
+403 without the token, which guards an API that can write files and run code. Take that URL
+from the server's output; never work around the token.
+
 ## When it breaks — symptom → fix
 
 Six failures that have each cost someone a day. What makes them expensive is that none of

package/template/vitest.ui.config.ts

@@ -1,32 +1,20 @@
 /**
  * The config behind `pnpm test:ui` — your own `vitest.config.ts`, plus the live test
- * dashboard served on a port Claude Desktop's Browser pane can open (`.claude/launch.json`,
- * the `tests` entry).
+ * dashboard on a fixed port (`.claude/launch.json`, the `tests` entry).
  *
- * The UI lives at `/__vitest__/` and the bare origin is a 404, but a launch entry carries
- * a port and never a path, so `/` is redirected to the UI here. `VITEST_UI_PORT` moves
- * the port; it binds 127.0.0.1 only, since the dashboard can re-run your tests. The port
- * is strict: a busy one fails the start rather than moving the dashboard somewhere the
- * launch entry does not point.
+ * Open it at the URL vitest prints when it starts (`UI started at
+ * http://127.0.0.1:5290/__vitest__/?token=…`). The dashboard refuses any request without that
+ * token, because its API can re-run your tests, write files and run code; the token is what
+ * keeps another page in your browser from driving it. So nothing here redirects the bare
+ * origin to it. `VITEST_UI_PORT` moves the port; it binds 127.0.0.1 only. The port is strict:
+ * a busy one fails the start rather than moving the dashboard somewhere the launch entry does
+ * not point.
  */
-import { mergeConfig, type Plugin } from 'vitest/config';
+import { mergeConfig } from 'vitest/config';
 
 import base from './vitest.config.ts';
 
-const redirectRootToUi: Plugin = {
-  name: 'substrat:vitest-ui-root',
-  configureServer(server) {
-    server.middlewares.use((req, res, next) => {
-      if (req.url !== '/') return next();
-      res.statusCode = 302;
-      res.setHeader('Location', '/__vitest__/');
-      res.end();
-    });
-  },
-};
-
 export default mergeConfig(base, {
-  plugins: [redirectRootToUi],
   test: {
     api: {
       host: '127.0.0.1',