@selvajs/cli 4.20.0-beta.22 → 4.20.0-beta.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/cli",
-  "version": "4.20.0-beta.22",
+  "version": "4.20.0-beta.24",
   "description": "Scaffold and operate a Selva white-label deployment. `npx @selvajs/cli <dir>` to bootstrap, `selva <cmd>` to manage.",
   "license": "MIT",
   "author": "VektorNode",

package/src/checks/migrations.js

@@ -0,0 +1,156 @@
+// Supabase schema head: what the installed runtime expects, what the installed
+// provider can migrate to, and what the database is at. These are three
+// separate numbers. The runtime bundles the provider's code but not its SQL,
+// so `selva update` can move the runtime past a provider install that stays
+// pinned. Comparing the database against the provider then reports a match
+// while the app degrades /api/health to 503.
+
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { green, yellow, red } from './result.js';
+
+const HEAD_RE = /^\d{14}$/;
+
+/** Head the installed @selvajs/selva was built against, or null for a runtime that predates runtime-meta.json. */
+export function readRuntimeMigrationHead(dir) {
+	try {
+		const meta = JSON.parse(
+			readFileSync(
+				join(dir, 'node_modules', '@selvajs', 'selva', 'build', 'runtime-meta.json'),
+				'utf8'
+			)
+		);
+		return HEAD_RE.test(meta?.supabaseMigrationHead) ? meta.supabaseMigrationHead : null;
+	} catch {
+		return null;
+	}
+}
+
+/** Newest migration the installed @selvajs/supabase-provider ships, or null when it isn't installed. */
+export function readProviderMigrationHead(dir) {
+	const migrationsDir = join(
+		dir,
+		'node_modules',
+		'@selvajs',
+		'supabase-provider',
+		'supabase',
+		'migrations'
+	);
+	if (!existsSync(migrationsDir)) return null;
+	return (
+		readdirSync(migrationsDir)
+			.filter((f) => /^\d{14}_.+\.sql$/.test(f))
+			.map((f) => f.slice(0, 14))
+			.sort()
+			.pop() ?? null
+	);
+}
+
+/** The npm dist-tag matching the installed runtime: a pre-release runtime needs the provider's beta migrations. */
+export function providerTagFor(runtimeVersion) {
+	return runtimeVersion?.includes('-') ? 'beta' : 'latest';
+}
+
+/**
+ * `{ head }` on success, `{ missing: true }` when selva.migration_head() doesn't
+ * exist yet, `{ error }` when the database couldn't be asked.
+ */
+export async function fetchDatabaseMigrationHead(env) {
+	try {
+		const controller = new AbortController();
+		const timer = setTimeout(() => controller.abort(), 4000);
+		const res = await fetch(env.SUPABASE_URL + '/rest/v1/rpc/migration_head', {
+			method: 'POST',
+			headers: {
+				apikey: env.SUPABASE_SERVICE_ROLE_KEY,
+				Authorization: `Bearer ${env.SUPABASE_SERVICE_ROLE_KEY}`,
+				'Content-Type': 'application/json',
+				// The function lives in the selva schema the app is pinned to.
+				'Content-Profile': 'selva'
+			},
+			body: '{}',
+			signal: controller.signal
+		});
+		clearTimeout(timer);
+		if (res.status === 404) return { missing: true };
+		if (!res.ok) return { error: `migration_head RPC responded ${res.status}` };
+		return { head: String((await res.json()) ?? '') };
+	} catch (err) {
+		return { error: err.message ?? String(err) };
+	}
+}
+
+function migrateSteps(tag, providerBehind) {
+	return [
+		...(providerBehind ? [`npm install --prefer-online @selvajs/supabase-provider@${tag}`] : []),
+		'npx selva-supabase',
+		'npx supabase db push'
+	].join(' && ');
+}
+
+/**
+ * Pure verdict, so the three-way comparison is testable without disk or network.
+ * `runtime` is null for an old runtime; the provider head is then the best guess.
+ * String comparison is safe: every head is a fixed-width timestamp.
+ */
+export function judgeMigrationHeads({ runtime, provider, database, tag }) {
+	const expected = runtime ?? provider;
+	if (!expected) {
+		return red(
+			'@selvajs/supabase-provider is not installed, so the migration SQL is missing. ' +
+				'Run `selva migrate` to add it, then `npm install`.'
+		);
+	}
+	const providerBehind = !provider || provider < expected;
+	const steps = migrateSteps(tag, providerBehind);
+	const providerNote =
+		runtime && providerBehind
+			? ` The installed @selvajs/supabase-provider only reaches ${provider ?? '(none)'}, so syncing it copies nothing new.`
+			: '';
+
+	if (database.error) return yellow(`Migration-head check skipped (${database.error})`);
+	if (database.missing) {
+		return red(
+			`Database is missing selva.migration_head(): migrations are pending (expected head ${expected}).${providerNote} Run: ${steps}`
+		);
+	}
+	if (!database.head) {
+		return red(
+			`Database reports no applied migrations (expected head ${expected}).${providerNote} Run: ${steps}`
+		);
+	}
+	if (database.head < expected) {
+		const against = runtime ? "the app's expected" : 'the installed provider';
+		return red(
+			`Database migration head ${database.head} is behind ${against} ${expected}. ` +
+				`/api/health returns 503 and writes that need the newer schema fail.${providerNote} Run: ${steps}`
+		);
+	}
+	if (runtime && providerBehind) {
+		// The database is fine today; the next upgrade's sync would silently copy nothing.
+		return yellow(
+			`Database migration head ${database.head} matches the app, but @selvajs/supabase-provider ` +
+				`is at ${provider ?? '(none)'}. Run: npm install --prefer-online @selvajs/supabase-provider@${tag}`
+		);
+	}
+	return green(
+		`Database migration head ${database.head} matches the ${runtime ? 'app' : 'installed provider'}`
+	);
+}
+
+export async function checkSupabaseMigrations(dir, env, runtimeVersion) {
+	if (!env.SUPABASE_URL || !env.SUPABASE_SERVICE_ROLE_KEY) {
+		return yellow('Migration-head check skipped: Supabase env incomplete');
+	}
+	const runtime = readRuntimeMigrationHead(dir);
+	const provider = readProviderMigrationHead(dir);
+	if (!runtime && !provider) {
+		return judgeMigrationHeads({ runtime, provider, database: {}, tag: 'latest' });
+	}
+	return judgeMigrationHeads({
+		runtime,
+		provider,
+		database: await fetchDatabaseMigrationHead(env),
+		tag: providerTagFor(runtimeVersion)
+	});
+}

package/src/commands/doctor.js

@@ -31,6 +31,7 @@ import { satisfiesNodeRange } from '../node-range.js';
 import { green, yellow, red, fixable } from '../checks/result.js';
 import { checkBootPersistence } from '../checks/boot.js';
 import { checkRuntimeEnvironment } from '../checks/runtime.js';
+import { checkSupabaseMigrations } from '../checks/migrations.js';
 import {
 	checkBodySizeLimit,
 	checkClientAddress,
@@ -77,7 +78,13 @@ export async function runDoctor(argv = []) {
 
 	if (used.has('supabase')) {
 		checks.push(checkSupabase(env));
-		checks.push(checkSupabaseMigrations(dir, env));
+		checks.push(
+			checkSupabaseMigrations(
+				dir,
+				env,
+				readPackageVersion(join(dir, 'node_modules', '@selvajs', 'selva', 'package.json'))
+			)
+		);
 	}
 
 	if (providers.auth === 'header') {
@@ -222,83 +229,6 @@ export async function checkSupabase(env) {
 	}
 }
 
-// Compares the newest migration shipped by @selvajs/supabase-provider against
-// what the database reports via selva.migration_head(). Red on skew — the app
-// degrades /api/health to 503 at boot in the same state, so catching it here
-// saves a confusing deploy.
-async function checkSupabaseMigrations(dir, env) {
-	if (!env.SUPABASE_URL || !env.SUPABASE_SERVICE_ROLE_KEY) {
-		return yellow('Migration-head check skipped — Supabase env incomplete');
-	}
-
-	const migrationsDir = join(
-		dir,
-		'node_modules',
-		'@selvajs',
-		'supabase-provider',
-		'supabase',
-		'migrations'
-	);
-	let expected = null;
-	try {
-		expected =
-			readdirSync(migrationsDir)
-				.filter((f) => /^\d{14}_.+\.sql$/.test(f))
-				.map((f) => f.slice(0, 14))
-				.sort()
-				.pop() ?? null;
-	} catch {
-		// Provider package not installed in this deployment.
-	}
-	if (!expected) {
-		return red(
-			'@selvajs/supabase-provider is not installed, so the migration SQL is missing. ' +
-				'Run `selva migrate` to add it, then `npm install`.'
-		);
-	}
-
-	try {
-		const controller = new AbortController();
-		const timer = setTimeout(() => controller.abort(), 4000);
-		const res = await fetch(env.SUPABASE_URL + '/rest/v1/rpc/migration_head', {
-			method: 'POST',
-			headers: {
-				apikey: env.SUPABASE_SERVICE_ROLE_KEY,
-				Authorization: `Bearer ${env.SUPABASE_SERVICE_ROLE_KEY}`,
-				'Content-Type': 'application/json',
-				// The function lives in the selva schema the app is pinned to.
-				'Content-Profile': 'selva'
-			},
-			body: '{}',
-			signal: controller.signal
-		});
-		clearTimeout(timer);
-		if (res.status === 404) {
-			return red(
-				`Database is missing selva.migration_head() — migrations are pending (expected head ${expected}). Run: npx selva-supabase && npx supabase db push`
-			);
-		}
-		if (!res.ok) {
-			return yellow(`migration_head RPC responded ${res.status} — cannot verify schema head`);
-		}
-		const actual = String((await res.json()) ?? '');
-		if (!actual) {
-			return red(
-				`Database reports no applied migrations (expected head ${expected}). Run: npx selva-supabase && npx supabase db push`
-			);
-		}
-		// String comparison — relies on both heads being fixed-width, zero-padded timestamps.
-		if (actual < expected) {
-			return red(
-				`Database migration head ${actual} is behind the installed provider (${expected}). Run: npx selva-supabase && npx supabase db push`
-			);
-		}
-		return green(`Database migration head ${actual} matches the installed provider`);
-	} catch (err) {
-		return yellow(`Migration-head check skipped (${err.message ?? err})`);
-	}
-}
-
 function checkPackage(dir, name) {
 	const path = join(dir, 'node_modules', ...name.split('/'), 'package.json');
 	if (!existsSync(path)) return red(`${name} not installed (run npm install)`);

package/src/commands/pm2.js

@@ -8,6 +8,9 @@ import { spawnSync, execSync } from 'node:child_process';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import { requireDeploymentDir, resolveDeploymentDir } from '../paths.js';
+import { readEnvFile } from '../env.js';
+import { needsSupabaseProvider } from '../deployment-package.js';
+import { checkSupabaseMigrations, providerTagFor } from '../checks/migrations.js';
 
 export const APP_NAME = 'selva-compute';
 
@@ -147,10 +150,10 @@ export async function runUpdate() {
 	const before = readRuntimeVersion(dir);
 	p.log.info(`Current @selvajs/selva: ${before ?? 'unknown'}`);
 
-	// Providers are bundled into @selvajs/selva — the only @selvajs/* packages
-	// an operator install carries are the runtime and the CLI. The admin-center
-	// "Run update" button runs the same list — keep them in sync if you edit.
+	// The admin-center "Run update" button runs the same list: keep them in sync.
 	const packages = ['@selvajs/cli', '@selvajs/selva'];
+	const env = readEnvFile(join(dir, '.env'));
+	const supabase = needsSupabaseProvider(env);
 
 	const confirmed = await p.confirm({
 		message: 'Refresh all @selvajs/* packages and restart the app?',
@@ -185,6 +188,21 @@ export async function runUpdate() {
 	const after = readRuntimeVersion(dir);
 	p.log.info(`New @selvajs/selva:     ${after ?? 'unknown'}`);
 
+	if (supabase) {
+		// Provider code is bundled into @selvajs/selva, but the migration SQL ships
+		// here. Left behind, `selva-supabase` copies nothing new. Installed by tag,
+		// not `npm update`d: its pin can sit on another channel than the runtime's.
+		const spec = `@selvajs/supabase-provider@${providerTagFor(after)}`;
+		s.start(`npm install ${spec}`);
+		try {
+			execSync(`npm install --save --prefer-online ${spec}`, { cwd: dir, stdio: 'pipe' });
+			s.stop(`${spec} installed`);
+		} catch (err) {
+			s.stop(`npm install ${spec} failed`);
+			p.log.warn(String(err.stderr ?? err.message ?? err).trim());
+		}
+	}
+
 	if (before && after && before === after) {
 		p.log.warn(
 			[
@@ -199,12 +217,68 @@ export async function runUpdate() {
 		);
 	}
 
+	// Migrations are not applied here: they aren't reversible, and the old build
+	// is already gone. The app serves on an old schema (degraded), so start it and
+	// say what is left to do.
+	const schema = supabase ? await checkSupabaseMigrations(dir, env, after) : null;
+
 	const status = runPm2(dir, ['start', APP_NAME, '--update-env'], { inherit: false });
-	if (status === 0) {
-		p.outro(pc.green('Started ' + APP_NAME));
-	} else {
+	if (status !== 0) {
 		p.outro(pc.yellow(`Start failed — investigate with \`pm2 logs ${APP_NAME}\`.`));
+		process.exitCode = 1;
+		return;
+	}
+
+	const health = await waitForHealth(env);
+	if (schema && schema.severity !== 'green') p.log.message(schema.line);
+	if (health.ok) {
+		p.outro(pc.green(`Started ${APP_NAME}`));
+		return;
+	}
+	p.outro(
+		pc.red(
+			health.status
+				? `Started ${APP_NAME}, but /api/health returned ${health.status}: ${health.reason}`
+				: `Started ${APP_NAME}, but /api/health did not answer within 30s. Check \`pm2 logs ${APP_NAME}\`.`
+		)
+	);
+	process.exitCode = 1;
+}
+
+// The app was stopped before the update, so the first answer is the new process.
+async function waitForHealth(env, timeoutMs = 30_000) {
+	const host = !env.HOST || env.HOST === '0.0.0.0' || env.HOST === '::' ? '127.0.0.1' : env.HOST;
+	const url = `http://${host.includes(':') ? `[${host}]` : host}:${env.PORT || 3000}/api/health`;
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		try {
+			const res = await fetch(url, { signal: AbortSignal.timeout(3000) });
+			if (res.ok) return { ok: true };
+			return {
+				ok: false,
+				status: res.status,
+				reason: degradedReason(await res.json().catch(() => null))
+			};
+		} catch {
+			await new Promise((r) => setTimeout(r, 1000));
+		}
+	}
+	return { ok: false };
+}
+
+/** Names the cause a 503 from /api/health reports in `boot`. */
+export function degradedReason(body) {
+	const boot = body?.boot;
+	if (boot?.schemaVersion?.ok === false) {
+		return (
+			boot.schemaVersion.message ??
+			`database migration head ${boot.schemaVersion.actual} is behind ${boot.schemaVersion.expected}`
+		);
+	}
+	if (boot?.atRestSecrets?.ok === false) {
+		return 'stored compute API keys cannot be decrypted under the current SELVA_AT_REST_KEY';
 	}
+	return 'see `pm2 logs selva-compute`';
 }
 
 function readRuntimeVersion(dir) {