create-substrat 0.9.4 → 0.9.5

package/index.js

@@ -36,11 +36,11 @@ const TEMPLATE = join(HERE, 'template');
 // The runtime packages release together off one version line (the changesets `fixed`
 // group), so one constant is right for all of them. Engines do NOT share a line —
 // each versions on its own, so one pin per engine, deliberately.
-const SUBSTRAT = '^0.109.0';
-const ENGINE_WORKORDER = '^0.11.8';
-const ENGINE_INVOICING = '^0.9.25';
+const SUBSTRAT = '^0.110.0';
+const ENGINE_WORKORDER = '^0.11.9';
+const ENGINE_INVOICING = '^0.10.0';
 const BOUNDARY_LINT = '^0.4.2';
-const DEV_ISSUER = '^0.1.24';
+const DEV_ISSUER = '^0.1.25';
 
 const DOCS = 'https://substrat.net';
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-substrat",
-  "version": "0.9.4",
+  "version": "0.9.5",
   "description": "Scaffold a Substrat vertical — `npm create substrat <dir>`.",
   "license": "Apache-2.0",
   "repository": {

package/template/src/operations.ts

@@ -19,18 +19,34 @@ import { bikeShopEntities } from './entities.js';
  * The permission keys an operation here may name.
  *
  * Two of them are this vertical's own (they mirror `SHOP_PERM` in
- * `src/manifest.ts`); the other four are the WORKORDER ENGINE's. An engine key
- * is listed because a vertical operation may be gated by one — this is the
- * vocabulary a `permission` may draw on, not a second declaration of who owns
- * the key. The engine still declares them.
+ * `src/manifest.ts`); the rest belong to the ENGINES this vertical composes. An
+ * engine key is listed because a vertical operation may be gated by one — this
+ * is the vocabulary a `permission` may draw on, not a second declaration of who
+ * owns the key. The engine still declares them.
+ *
+ * One array, two readers, and that is what makes it checked (#1208).
+ * `defineOperations` takes it below as the union a mistyped `permission:` fails
+ * against; `definePermissions` in `src/provision.ts` takes the SAME array as
+ * `keys` and throws at module load if it and `MODULES` disagree in either
+ * direction. So every key a registered module declares is here, including the
+ * ones no shop operation checks today — `MODULES` registers both engines, so a
+ * scope declares them, and an operation gated on one had no way to say so while
+ * the list held only the subset the shop happened to check.
  */
 export const SHOP_PERMISSIONS = [
+  // The shop's own — `SHOP_PERM` in src/manifest.ts.
   'customer:manage',
   'bike:manage',
+  // @substrat-run/engine-workorder
   'workorder:create',
   'workorder:read',
+  'workorder:assign',
+  'workorder:report',
   'workorder:complete',
   'workorder:close',
+  // @substrat-run/engine-invoicing
+  'invoicing:read',
+  'invoicing:export',
 ] as const;
 
 /**

package/template/src/provision.ts

@@ -7,6 +7,7 @@ import { workorderModule, PERM as WO } from '@substrat-run/engine-workorder';
 import { invoicingModule, INVOICING_PERM as INV } from '@substrat-run/engine-invoicing';
 import { bikeShopModule } from './module.js';
 import { SHOP_PERM } from './manifest.js';
+import { SHOP_PERMISSIONS } from './operations.js';
 
 // The manifest's config surface rides the same import `substrat push` already makes for
 // `permissions` (#1206): this export is what the push uploads, so `src/manifest.ts` is the
@@ -73,9 +74,16 @@ export const ENTITY_GRANTS: { entityType: string; permissions: PermissionKey[] }
  * The single typed source for this vertical's permission surface — what the
  * permission checkpoint and `substrat push` read (via package.json
  * `substrat.permissions`).
+ *
+ * `keys` is `SHOP_PERMISSIONS` — the array `src/operations.ts` already hands
+ * `defineOperations` as the union a mistyped `permission:` fails against — which
+ * is what makes that restatement checked (#1208): `definePermissions` throws at
+ * module load if it and `MODULES` disagree in either direction. Keep handing
+ * both readers the SAME array; a second copy is the thing this removes.
  */
 export const permissions = definePermissions({
   modules: MODULES,
   roles: ROLES,
   entityGrants: ENTITY_GRANTS,
+  keys: SHOP_PERMISSIONS,
 });