create-substrat 0.9.1 → 0.9.2

package/index.js

@@ -36,11 +36,11 @@ const TEMPLATE = join(HERE, 'template');
 // The runtime packages release together off one version line (the changesets `fixed`
 // group), so one constant is right for all of them. Engines do NOT share a line —
 // each versions on its own, so one pin per engine, deliberately.
-const SUBSTRAT = '^0.100.0';
-const ENGINE_WORKORDER = '^0.10.8';
-const ENGINE_INVOICING = '^0.9.16';
+const SUBSTRAT = '^0.102.0';
+const ENGINE_WORKORDER = '^0.11.1';
+const ENGINE_INVOICING = '^0.9.18';
 const BOUNDARY_LINT = '^0.4.2';
-const DEV_ISSUER = '^0.1.15';
+const DEV_ISSUER = '^0.1.17';
 
 const DOCS = 'https://substrat.net';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-substrat",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "description": "Scaffold a Substrat vertical — `npm create substrat <dir>`.",
   "license": "Apache-2.0",
   "repository": {

package/template/.claude/launch.json

@@ -18,7 +18,7 @@
         "run",
         "server"
       ],
-      "port": 8873,
+      "port": 8891,
       "autoPort": false
     }
   ]

package/template/.substrat/playbook.md

@@ -472,7 +472,7 @@ Build confidence in this order, and **show the user the output of each**:
 pnpm install
 pnpm test                        # the scenario, including the denials
 npx @substrat-run/boundary-lint  # the layer rules
-pnpm dev                         # API on :8871 (PORT=… WEB_PORT=… to move it)
+pnpm dev                         # API on :8891 (PORT=… WEB_PORT=… to move it)
 ```
 
 Then **actually exercise it** — don't just report that the server started. A green scenario
@@ -519,7 +519,7 @@ Two more that each fail silently:
   `notFoundHandling: "single-page-application"`, a missing `/api/*` entry answers every API
   call with `index.html` — the app then reports parse errors instead of denials.
 - **The app calls its own origin** (`fetch('/api' + path)`), never a baked base URL. The Vite
-  `proxy` block is a dev-only convenience; `VITE_API_URL` or `localhost:8871` works on the
+  `proxy` block is a dev-only convenience; `VITE_API_URL` or `localhost:8891` works on the
   author's machine and reaches nothing from a phone.
 
 `substrat push` refuses an `app/` that nothing would serve, so this cannot reach a hostname

package/template/src/server.ts

@@ -57,6 +57,11 @@ const staffActor = platformActorId.parse(ulid());
 // Both ports are bound in THIS file so they move together: `substrat.devServers` names
 // it for the API and for the issuer alike, and `ISSUER_PORT=… PORT=… pnpm dev` shifts the
 // pair without either end losing track of the other.
+//
+// The issuer default is 8879 because that is `@substrat-run/dev-issuer`'s OWN default —
+// the `issuer` script passes no `--port`, so this number and the one the issuer actually
+// binds have to be the same or the login round-trip points at nothing. Change one and you
+// must change the other; `ISSUER_PORT=…` moves both at once, which is the supported way.
 const ISSUER_PORT = Number(process.env.ISSUER_PORT ?? 8879);
 const login = devLogin({
   directory: host.admin,
@@ -87,7 +92,11 @@ async function stub(c: Context): Promise<ScopeStub> {
 // Everything else — including `/api/invoke` and the shared error envelope.
 mountApi(app, stub);
 
-const PORT = Number(process.env.PORT ?? 8873);
+// 8891, not 8873. The `887x`/`527x` block is reserved for this monorepo's own demos
+// (CLAUDE.md, "Commands"), and 8873 is the shop demo's API — so a scaffolded project used
+// to refuse to boot beside the demo it was read from. A scaffold has no claim on that
+// block; `PORT=…` moves this one.
+const PORT = Number(process.env.PORT ?? 8891);
 serve({ fetch: app.fetch, port: PORT });
 console.log(`Bike-shop API on http://localhost:${PORT} — data in ${dataDir}`);
 console.log(`Sign in at http://localhost:${PORT}/api/auth/login — issuer: ${login.issuer}`);