create-substrat 0.8.6 → 0.9.0

package/index.js

@@ -36,11 +36,11 @@ const TEMPLATE = join(HERE, 'template');
 // The runtime packages release together off one version line (the changesets `fixed`
 // group), so one constant is right for all of them. Engines do NOT share a line —
 // each versions on its own, so one pin per engine, deliberately.
-const SUBSTRAT = '^0.98.0';
-const ENGINE_WORKORDER = '^0.10.6';
-const ENGINE_INVOICING = '^0.9.14';
-const BOUNDARY_LINT = '^0.4.0';
-const DEV_ISSUER = '^0.1.13';
+const SUBSTRAT = '^0.99.0';
+const ENGINE_WORKORDER = '^0.10.7';
+const ENGINE_INVOICING = '^0.9.15';
+const BOUNDARY_LINT = '^0.4.2';
+const DEV_ISSUER = '^0.1.14';
 
 const DOCS = 'https://substrat.net';
 
@@ -101,21 +101,10 @@ function packageJson(name) {
             { binding: 'CONFIG', class: 'ConfigDO' },
           ],
         },
-        // The declared per-instance settings — MIRRORED from src/manifest.ts
-        // (`SHOP_ENV`), because `substrat push` reads JSON, not TS. The dashboard
-        // renders its Settings form from this; keep the two in sync.
-        envSpec: [
-          {
-            key: 'SHOP_NAME',
-            label: 'Workshop name',
-            description: 'The workshop name shown to customers. Set per install.',
-            placeholder: 'Söder Cykel & Service',
-            default: 'Substrat Bike Shop',
-            required: false,
-            secret: false,
-            group: 'General',
-          },
-        ],
+        // No envSpec copy here (#1206): the declared per-instance settings live in
+        // src/manifest.ts (`SHOP_ENV`), re-exported as `envSpec` from the permissions
+        // entry — `substrat push` reads them off that same import. The dashboard
+        // renders its Settings form from what the push uploads.
         devServers: DEV_SERVERS,
       },
       scripts: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-substrat",
-  "version": "0.8.6",
+  "version": "0.9.0",
   "description": "Scaffold a Substrat vertical — `npm create substrat <dir>`.",
   "license": "Apache-2.0",
   "repository": {

package/template/AGENTS.md

@@ -87,9 +87,9 @@ dashboard reports `delivered: false`, and the app never sees it. That includes t
 back through `resolveScopedEnvSpec` (`instanceConfig`). Read settings that way and
 never off `env` directly: an `envSpec` default rides as a worker binding shared by
 every install of one serving script, so `env.FOO` is the same string for every
-tenant no matter what any of them saved. Declare a setting in **both**
-`src/manifest.ts` (`SHOP_ENV`) and package.json `substrat.envSpec` — `substrat
-push` reads the JSON, not the TypeScript.
+tenant no matter what any of them saved. Declare a setting once, in
+`src/manifest.ts` (`SHOP_ENV`) — `src/provision.ts` re-exports it as `envSpec`,
+which is what `substrat push` uploads; package.json carries no copy.
 
 ## The rules (non-negotiable)
 

package/template/src/manifest.ts

@@ -29,8 +29,8 @@ export const SHOP_PERM = {
  * value one tenant saved for one install — a spec `default` rides as a worker binding
  * shared by every install of the serving script.
  *
- * MIRRORED in package.json `substrat.envSpec` (what `substrat push` carries — it reads
- * JSON, not TS); keep the two in sync.
+ * The single declaration (#1206): `src/provision.ts` re-exports this as `envSpec`, which
+ * is what `substrat push` uploads — package.json carries no copy.
  */
 export const SHOP_ENV: EnvVarSpec[] = [
   {

package/template/src/provision.ts

@@ -8,6 +8,11 @@ import { invoicingModule, INVOICING_PERM as INV } from '@substrat-run/engine-inv
 import { bikeShopModule } from './module.js';
 import { SHOP_PERM } from './manifest.js';
 
+// The manifest's config surface rides the same import `substrat push` already makes for
+// `permissions` (#1206): this export is what the push uploads, so `src/manifest.ts` is the
+// single envSpec declaration and package.json carries no copy.
+export { SHOP_ENV as envSpec } from './manifest.js';
+
 // ============================================================================
 // The vertical's PROVISIONING surface — everything a deployment needs to know
 // about modules, roles and grant shapes, with NO node imports. Split from