@selvajs/cli 4.20.0-beta.25 → 4.20.0-beta.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/cli",
-  "version": "4.20.0-beta.25",
+  "version": "4.20.0-beta.26",
   "description": "Scaffold and operate a Selva white-label deployment. `npx @selvajs/cli <dir>` to bootstrap, `selva <cmd>` to manage.",
   "license": "MIT",
   "author": "VektorNode",

package/src/caddyfile.js

@@ -45,7 +45,7 @@ export function renderCaddyfile({ domain, acmeEmail, port = 3000 }) {
 	@api path /api/*
 	header @api Cache-Control "no-cache, no-store, must-revalidate"
 
-	# Must clear the app's own caps (COMPUTE_REQUEST_MAX_BYTES / BODY_SIZE_LIMIT,
+	# Must clear the app's own caps (the solve request cap and BODY_SIZE_LIMIT,
 	# both 256 MiB) — Caddy rejects first, so a lower value here silently caps
 	# every upload no matter what .env says. Write MiB: Caddy's "mb" is 10^6 bytes.
 	request_body {

package/src/checks/config.js

@@ -10,7 +10,7 @@
 // it. `__tests__/doctor-config-parity.test.js` asserts both against one fixture
 // table, so a rule changed here and not there fails CI.
 
-import { RENAMED_ENV_VARS, REPLACED_ENV_VARS } from '../env.js';
+import { RENAMED_ENV_VARS, RETIRED_ENV_VARS } from '../env.js';
 import { keyRotationStatus } from '../generated/config.js';
 import { green, red, yellow } from './result.js';
 
@@ -221,10 +221,10 @@ export function parseBodySizeLimit(raw) {
 	return bytes;
 }
 
-// The app's own default for COMPUTE_REQUEST_MAX_BYTES (packages/server
+// The app's solve request cap (COMPUTE_REQUEST_MAX_BYTES in packages/server
 // compute/limits.ts). Duplicated rather than imported: the CLI installs the
 // runtime and cannot import from it.
-const COMPUTE_REQUEST_DEFAULT_BYTES = 256 * 1024 * 1024;
+const COMPUTE_REQUEST_MAX_BYTES = 256 * 1024 * 1024;
 
 /**
  * BODY_SIZE_LIMIT has to clear the compute request cap, or adapter-node's global
@@ -234,7 +234,7 @@ const COMPUTE_REQUEST_DEFAULT_BYTES = 256 * 1024 * 1024;
  */
 export function checkBodySizeLimit(env) {
 	const raw = env.BODY_SIZE_LIMIT;
-	const requestCap = Number(env.COMPUTE_REQUEST_MAX_BYTES) || COMPUTE_REQUEST_DEFAULT_BYTES;
+	const requestCap = COMPUTE_REQUEST_MAX_BYTES;
 	const asMb = (bytes) => `${Math.round(bytes / (1024 * 1024))} MB`;
 
 	if (raw == null || raw === '') {
@@ -255,9 +255,9 @@ export function checkBodySizeLimit(env) {
 
 	if (bytes < requestCap) {
 		return yellow(
-			`BODY_SIZE_LIMIT=${raw} (${asMb(bytes)}) is below COMPUTE_REQUEST_MAX_BYTES ` +
-				`(${asMb(requestCap)}) — the global cap rejects first, making the compute cap ` +
-				`dead config. Raise it to at least ${asMb(requestCap)}.`
+			`BODY_SIZE_LIMIT=${raw} (${asMb(bytes)}) is below the ` +
+				`${asMb(requestCap)} a solve may send — larger solves fail with 413 before Selva ` +
+				`sees them. Raise it to at least ${asMb(requestCap)}.`
 		);
 	}
 
@@ -331,9 +331,7 @@ export function checkClientAddress(env) {
 	return green(`ADDRESS_HEADER=${header}${depth ? ` (XFF_DEPTH=${depth})` : ''}`);
 }
 
-// A rename is auto-fixable (`selva migrate` rewrites the key). A replacement
-// encodes a value in the new name, so migrate leaves it alone rather than
-// guessing — it's reported here and nowhere else.
+// Both are auto-fixable: `selva migrate` renames old names and removes retired keys.
 export function checkDeprecatedEnv(env) {
 	const checks = [];
 
@@ -346,9 +344,9 @@ export function checkDeprecatedEnv(env) {
 		);
 	}
 
-	for (const [oldName, replacement] of Object.entries(REPLACED_ENV_VARS)) {
-		if (env[oldName] === undefined) continue;
-		checks.push(yellow(`${oldName} is deprecated — replace it with ${replacement}`));
+	for (const [key, now] of Object.entries(RETIRED_ENV_VARS)) {
+		if (env[key] === undefined) continue;
+		checks.push(yellow(`${key} is no longer read (${now}) — \`selva migrate\` removes it`));
 	}
 
 	return checks;

package/src/env-migration.js

@@ -1,6 +1,6 @@
 // Plan the .env rewrite `selva migrate` applies: old names renamed, values a
-// looser reader used to accept rewritten to what they meant, no-op lines
-// removed, shipped template prose stripped. Unknown keys are kept.
+// looser reader used to accept rewritten to what they meant, no-op and retired
+// lines removed, shipped template prose stripped. Unknown keys are kept.
 //
 // `mismatches` is the proof: every declared key resolved from the old file
 // (with the old readers' semantics) and from the new one. Anything but empty
@@ -10,6 +10,7 @@ import {
 	countEnvCommentLines,
 	parseEnv,
 	RENAMED_ENV_VARS as RENAMES,
+	RETIRED_ENV_VARS as RETIRED,
 	renameEnvKeys,
 	setEnvValues,
 	stripEnvComments
@@ -34,8 +35,7 @@ function computeDebugMode(env) {
 /** Keys whose effective value depends on another key. */
 const EFFECTIVE = {
 	HEADER_AUTH_DATA_DIR: (env) => env.HEADER_AUTH_DATA_DIR || env.DATA_PATH,
-	SELVA_FLAG_COMPUTE_DEBUG: computeDebugMode,
-	SELVA_FLAG_COMPUTE_DEBUG_VERBOSE: () => undefined
+	SELVA_FLAG_COMPUTE_DEBUG: computeDebugMode
 };
 
 function canonical(value) {
@@ -114,6 +114,13 @@ export function planEnvMigration(input) {
 		changes.push({ key: 'HEADER_AUTH_DATA_DIR', action: 'removed', reason: 'same as DATA_PATH' });
 	}
 
+	// The app ignores these whatever their value, so removing the line changes nothing it does.
+	for (const [key, now] of Object.entries(RETIRED)) {
+		if (env[key] === undefined || key in updates) continue;
+		updates[key] = undefined;
+		changes.push({ key, action: 'removed', reason: `no longer read: ${now}` });
+	}
+
 	if (Object.keys(updates).length > 0) text = setEnvValues(text, updates);
 
 	// Read back with Node's parser, the one the app boots with, so a writer bug
@@ -127,7 +134,7 @@ export function planEnvMigration(input) {
 		if (JSON.stringify(was) !== JSON.stringify(is)) mismatches.push({ key: spec.key, was, is });
 	}
 	for (const key of Object.keys(before)) {
-		if (!SPECS.has(key) && !(key in RENAMES) && after[key] !== before[key]) {
+		if (!SPECS.has(key) && !(key in RENAMES) && !(key in RETIRED) && after[key] !== before[key]) {
 			mismatches.push({ key, was: before[key], is: after[key] });
 		}
 	}

package/src/env.js

@@ -4,7 +4,7 @@
 
 import { readFileSync, writeFileSync, existsSync, chmodSync } from 'node:fs';
 import { parseEnv as nodeParseEnv } from 'node:util';
-import { ALL_SETTINGS } from './generated/config.js';
+import { ALL_SETTINGS, RETIRED_KEYS } from './generated/config.js';
 
 // Old env name → its replacement, for keys renamed without changing meaning.
 // From the manifest's `aliases`, the same list the server reads old names by.
@@ -12,11 +12,8 @@ export const RENAMED_ENV_VARS = Object.fromEntries(
 	ALL_SETTINGS.flatMap((s) => (s.aliases ?? []).map((alias) => [alias, s.key]))
 );
 
-// Deprecated vars whose replacement changes the VALUE too, so a simple key
-// rename can't migrate them — `selva migrate` leaves these alone rather than guessing.
-export const REPLACED_ENV_VARS = {
-	SELVA_FLAG_COMPUTE_DEBUG_VERBOSE: 'SELVA_FLAG_COMPUTE_DEBUG=verbose'
-};
+// Keys the app no longer reads → what took their place. `selva migrate` removes them.
+export const RETIRED_ENV_VARS = RETIRED_KEYS;
 
 // Header written above the settings in a stripped .env. The pointer matters:
 // without it the operator has no way back to what a var means, and the reflex

package/src/generated/config.js

@@ -682,68 +682,15 @@ var ENGINE_SETTINGS = composeManifest([
 		description: 'Override the TLS mode inferred from the port.',
 		legacy: { bool: 'exact-true' }
 	}),
-	tunableInt('COMPUTE_SOLVE_DEADLINE_MS', 1e5, 'Solve time limit', 'Longest one solve may run.', {
-		unit: 'ms',
-		aliases: ['MAX_SOLVE_DURATION_MS'],
-		impact: 'Past the reverse proxy read timeout, solves fail there with a 502 instead.'
-	}),
-	tunableInt(
-		'COMPUTE_RATE_LIMIT_WINDOW_MS',
-		1e5,
-		'Solve rate limit window',
-		'Compute rate-limit window.',
-		{ unit: 'ms' }
-	),
 	tunableInt(
 		'COMPUTE_RATE_LIMIT_MAX',
 		120,
 		'Solves per window',
-		'Solves per user or share link per window.'
+		'Solves per user or share link per 100-second window.'
 	),
 	tunableInt('MAX_DEFINITION_FILE_SIZE_BYTES', 50 * MB, 'Max .gh upload', 'Largest .gh upload.', {
 		unit: 'bytes'
 	}),
-	tunableInt(
-		'MAX_IMAGE_FILE_SIZE_BYTES',
-		10 * MB,
-		'Max image upload',
-		'Largest cover image upload.',
-		{ unit: 'bytes' }
-	),
-	tunableInt(
-		'COMPUTE_REQUEST_MAX_BYTES',
-		256 * MB,
-		'Max solve request',
-		'Largest solve request body.',
-		{
-			unit: 'bytes',
-			impact: 'Must stay at or below BODY_SIZE_LIMIT, or that limit rejects first.'
-		}
-	),
-	tunableInt(
-		'COMPUTE_RESPONSE_MAX_BYTES',
-		300 * MB,
-		'Max solve response',
-		'Largest solve response body.',
-		{ unit: 'bytes' }
-	),
-	tunableInt(
-		'REMOTE_DEFINITION_FETCH_TIMEOUT_MS',
-		3e4,
-		'Remote .gh fetch timeout',
-		'Deadline for fetching a remote .gh.',
-		{ unit: 'ms' }
-	),
-	tunableInt(
-		'REMOTE_DEFINITION_CACHE_TTL_MS',
-		3e5,
-		'Remote .gh cache time',
-		'How long remote .gh bytes stay cached.',
-		{
-			unit: 'ms',
-			aliases: ['DEFINITION_CACHE_TTL_MS']
-		}
-	),
 	tunableInt(
 		'COMPUTE_MAX_QUEUE_DEPTH',
 		0,
@@ -789,17 +736,6 @@ var ENGINE_SETTINGS = composeManifest([
 			aliases: ['COMPUTE_RESPONSE_CACHE_MB']
 		}
 	),
-	defineSetting({
-		key: 'COMPUTE_REUSE_DEFINITION_CACHE',
-		label: 'Reuse compute server definition cache',
-		type: 'bool',
-		default: true,
-		onInvalid: 'default',
-		class: 'tunable',
-		description: 'Reuse the compute server’s cached definition instead of re-uploading it.',
-		impact:
-			'Leave on only with a compute server that reports a stale pointer (the VektorNode fork).'
-	}),
 	defineSetting({
 		key: 'COMPUTE_SERVER_CACHESOLVE',
 		label: 'Compute server solve cache',
@@ -809,18 +745,11 @@ var ENGINE_SETTINGS = composeManifest([
 		class: 'tunable',
 		description: 'Ask Rhino.Compute to cache solve results server-side.'
 	}),
-	tunableInt(
-		'API_TOKEN_RATE_LIMIT_WINDOW_MS',
-		DEFAULT_API_RATE_LIMIT.windowMs,
-		'API rate limit window',
-		'API token rate-limit window.',
-		{ unit: 'ms' }
-	),
 	tunableInt(
 		'API_TOKEN_RATE_LIMIT_MAX',
 		DEFAULT_API_RATE_LIMIT.maxPerWindow,
-		'API requests per window',
-		'Requests per API token per window. 0 is off.',
+		'API requests per minute',
+		'Requests per API token per minute. 0 is off.',
 		{
 			min: 0,
 			zero: 'Off'
@@ -946,29 +875,6 @@ var SUPABASE_SETTINGS = composeManifest([
 		class: 'setting',
 		description: 'OAuth buttons on the login page (google, github, azure, gitlab).'
 	}),
-	defineSetting({
-		key: 'SUPABASE_TOKEN_VERIFICATION',
-		label: 'Session check mode',
-		type: 'enum',
-		values: ['hybrid', 'strict'],
-		default: 'hybrid',
-		onInvalid: 'fail',
-		class: 'tunable',
-		description:
-			'hybrid verifies JWTs locally and rechecks periodically; strict asks Supabase every request.',
-		legacy: { enumFallback: 'hybrid' }
-	}),
-	defineSetting({
-		key: 'SUPABASE_REVALIDATE_MS',
-		label: 'Session recheck interval',
-		type: 'int',
-		min: 1,
-		default: 6e4,
-		unit: 'ms',
-		onInvalid: 'default',
-		class: 'tunable',
-		description: 'Hybrid recheck window: the longest a revoked session keeps working.'
-	}),
 	defineSetting({
 		key: 'SUPABASE_PUBLIC_BUCKET',
 		label: 'Public files bucket',
@@ -986,15 +892,6 @@ var SUPABASE_SETTINGS = composeManifest([
 		onInvalid: 'fail',
 		class: 'tunable',
 		description: 'Storage bucket for private files.'
-	}),
-	defineSetting({
-		key: 'SUPABASE_PRIVATE_URL_PREFIX',
-		label: 'Private file URL prefix',
-		type: 'string',
-		default: '/api/files',
-		onInvalid: 'fail',
-		class: 'tunable',
-		description: 'URL prefix the app serves private files at.'
 	})
 ]);
 // src/lib/server/config/settings.ts
@@ -1147,14 +1044,6 @@ var APP_SETTINGS = composeManifest([
 			'off, on (cache and timing lines per solve) or verbose (adds Compute’s raw error bodies).',
 		impact: 'verbose can write what was solved to the log, which erasure cannot reach.'
 	}),
-	defineSetting({
-		key: 'SELVA_FLAG_COMPUTE_DEBUG_VERBOSE',
-		label: 'Compute debug logging (old name)',
-		type: 'bool',
-		onInvalid: 'default',
-		class: 'setting',
-		description: 'Replaced by SELVA_FLAG_COMPUTE_DEBUG=verbose.'
-	}),
 	defineSetting({
 		key: 'SENTRY_DSN',
 		label: 'Sentry error reporting',
@@ -1199,6 +1088,27 @@ var WATCHED_PREFIXES = [
 ];
 /** Read by tooling, not by the app: not unknown, not reported. */
 var EXTERNAL_KEYS = ['SELVA_REQUIRE_SUPABASE'];
+/**
+ * Keys no release reads any more, with what took their place. Boot and doctor
+ * name them instead of calling them typos; `selva migrate` removes them.
+ */
+var RETIRED_KEYS = {
+	SELVA_FLAG_COMPUTE_DEBUG_VERBOSE: 'use SELVA_FLAG_COMPUTE_DEBUG=verbose',
+	COMPUTE_RATE_LIMIT_WINDOW_MS: 'fixed at 100 s',
+	API_TOKEN_RATE_LIMIT_WINDOW_MS: 'fixed at 60 s',
+	MAX_IMAGE_FILE_SIZE_BYTES: 'fixed at 10 MB',
+	COMPUTE_REQUEST_MAX_BYTES: 'fixed at 256 MB',
+	COMPUTE_RESPONSE_MAX_BYTES: 'fixed at 300 MB',
+	REMOTE_DEFINITION_FETCH_TIMEOUT_MS: 'fixed at 30 s',
+	REMOTE_DEFINITION_CACHE_TTL_MS: 'fixed at 5 min',
+	DEFINITION_CACHE_TTL_MS: 'fixed at 5 min',
+	SUPABASE_TOKEN_VERIFICATION: 'always hybrid',
+	SUPABASE_REVALIDATE_MS: 'fixed at 60 s',
+	SUPABASE_PRIVATE_URL_PREFIX: 'fixed at /api/files',
+	COMPUTE_SOLVE_DEADLINE_MS: 'set --timeout (RHINO_COMPUTE_TIMEOUT) on the compute server',
+	MAX_SOLVE_DURATION_MS: 'set --timeout (RHINO_COMPUTE_TIMEOUT) on the compute server',
+	COMPUTE_REUSE_DEFINITION_CACHE: 'on whenever the compute server reports /limits'
+};
 /**
  * The manifest for this deployment: engine and app keys, plus the slices of
  * the providers it selects. A provider's required keys only apply when it is
@@ -1235,7 +1145,7 @@ function deploymentReport(env) {
 	);
 	return buildConfigReport(manifest, env, {
 		prefixes: WATCHED_PREFIXES,
-		external: [...EXTERNAL_KEYS, ...inactive]
+		external: [...EXTERNAL_KEYS, ...Object.keys(RETIRED_KEYS), ...inactive]
 	});
 }
 var NOT_FROM_ENV_FILE = /* @__PURE__ */ new Set(['NODE_ENV']);
@@ -1262,6 +1172,7 @@ function keyRotationStatus(env, now = Date.now()) {
 export {
 	ALL_SETTINGS,
 	PREVIOUS_KEY_DAYS,
+	RETIRED_KEYS,
 	buildConfigReport,
 	deploymentManifest,
 	deploymentReport,