@selvajs/cli 4.6.21-beta.1 → 4.7.0-beta.3

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2025 Selva FelixBrunold VektorNode
+Copyright (c) 2025 Selva VektorNode AG
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/package.json

@@ -1,11 +1,16 @@
 {
   "name": "@selvajs/cli",
-  "version": "4.6.21-beta.1",
+  "version": "4.7.0-beta.3",
   "description": "Scaffold and operate a Selva white-label deployment. `npx @selvajs/cli <dir>` to bootstrap, `selva <cmd>` to manage.",
   "license": "MIT",
   "publishConfig": {
     "access": "public"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/VektorNode/selva.git",
+    "directory": "packages/cli"
+  },
   "type": "module",
   "bin": {
     "cli": "./bin/cli.js",
@@ -16,7 +21,7 @@
     "src"
   ],
   "engines": {
-    "node": ">=20.6.0"
+    "node": ">=22.0.0"
   },
   "dependencies": {
     "@clack/prompts": "^0.11.0",

package/src/cli.js

@@ -35,9 +35,6 @@ export async function runSelva(argv) {
 	}
 
 	if (command === '--version' || command === '-v') {
-		// We don't pin a version here — selva is installed transitively, so
-		// the deployment's package.json doesn't list us directly. Read our
-		// own package.json instead.
 		const { readFileSync } = await import('node:fs');
 		const { fileURLToPath } = await import('node:url');
 		const { dirname, join } = await import('node:path');

package/src/commands/pm2.js

@@ -58,7 +58,7 @@ function runPm2(dir, args, { inherit = true } = {}) {
 	const result = spawnSync(bin, args, {
 		cwd: dir,
 		stdio: inherit ? 'inherit' : 'pipe',
-		shell: process.platform === 'win32' // allow .cmd shim resolution
+		shell: process.platform === 'win32'
 	});
 	if (result.error) {
 		throw new Error(
@@ -125,10 +125,8 @@ export async function runUpdate() {
 		return;
 	}
 
-	// Resync daemon before state changes (avoid half-state stop/start).
 	ensurePm2InSync(dir);
 
-	// Stop before npm rewrites (SvelteKit lazy-loads chunks; see migrate command).
 	const stopStatus = runPm2(dir, ['stop', APP_NAME], { inherit: false });
 	if (stopStatus !== 0) {
 		p.log.warn('pm2 stop did not succeed — selva-compute may not be running. Continuing.');
@@ -137,7 +135,6 @@ export async function runUpdate() {
 	const s = p.spinner();
 	s.start(`npm update ${packages.join(' ')}`);
 	try {
-		// --prefer-online bypasses npm's packument cache (see docs/Hotfix-CLI-Runtime.md).
 		execSync(`npm update --save --prefer-online ${packages.join(' ')}`, {
 			cwd: dir,
 			stdio: 'pipe'
@@ -145,7 +142,6 @@ export async function runUpdate() {
 		s.stop('npm update finished');
 	} catch (err) {
 		s.stop('npm update failed');
-		// Best-effort: bring old process back up.
 		runPm2(dir, ['start', APP_NAME, '--update-env'], { inherit: false });
 		throw err;
 	}
@@ -153,7 +149,6 @@ export async function runUpdate() {
 	const after = readRuntimeVersion(dir);
 	p.log.info(`New @selvajs/selva:     ${after ?? 'unknown'}`);
 
-	// Surface no-op updates (cache may be stale; propagation delay is real).
 	if (before && after && before === after) {
 		p.log.warn(
 			[
@@ -168,7 +163,6 @@ export async function runUpdate() {
 		);
 	}
 
-	// Start the new build under PM2.
 	const status = runPm2(dir, ['start', APP_NAME, '--update-env'], { inherit: false });
 	if (status === 0) {
 		p.outro(pc.green('Started ' + APP_NAME));

package/src/prompts.js

@@ -10,8 +10,6 @@ function envBool(v) {
 	return TRUTHY.has(String(v).toLowerCase());
 }
 
-// Non-interactive sibling of collectConfig: read from env, validate strictly,
-// fail loud for security-relevant fields (no safe defaults).
 export function collectConfigFromEnv(env = process.env) {
 	const tenancy = pick(env.SELVA_TENANCY, ['single', 'multi'], 'single', 'SELVA_TENANCY');
 	const auth = pick(
@@ -61,8 +59,6 @@ export function collectConfigFromEnv(env = process.env) {
 	}
 
 	if (auth === 'header') {
-		// Same loopback default as the prompt — header-auth without network
-		// isolation is the documented worst-case footgun.
 		values.HOST = env.HOST || '127.0.0.1';
 		if (data !== 'local') {
 			values.HEADER_AUTH_DATA_DIR = requireEnv(env, 'HEADER_AUTH_DATA_DIR');
@@ -102,7 +98,6 @@ export function collectConfigFromEnv(env = process.env) {
 	}
 	values.ORIGIN = origin;
 
-	// Pass-through: SELVA_FLAG_* vars written verbatim; unset = empty string.
 	const flagNames = [
 		'ALLOW_ORG_CREATION',
 		'ALLOW_CROSS_ORG_PUBLIC',
@@ -140,9 +135,6 @@ export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
 	p.intro(pc.bgCyan(pc.black(isInit ? ' selva init ' : ' Selva — new deployment ')));
 
 	// Brand prompts (SELVA_BRAND_NAME / COPYRIGHT_NAME / TAGLINE / DESCRIPTION)
-	// are skipped for now — the runtime falls back to "Selva" defaults when
-	// these env vars are absent. To re-enable, add a brand prompt block here
-	// and write the values into `values` below.
 
 	const tenancy = await p.select({
 		message: 'Tenancy mode',
@@ -300,7 +292,6 @@ export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
 			cancelOn(dataDir);
 			providerValues.HEADER_AUTH_DATA_DIR = String(dataDir);
 		} else if (defaults.HEADER_AUTH_DATA_DIR) {
-			// Preserve an explicit override if the operator set one previously.
 			providerValues.HEADER_AUTH_DATA_DIR = defaults.HEADER_AUTH_DATA_DIR;
 		}
 
@@ -397,10 +388,6 @@ export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
 		initialValue: defaults.BOOTSTRAP_INSTANCE_ADMIN_EMAIL ?? '',
 		validate: (v) => {
 			if (!v) {
-				// Blank is allowed in single-tenant non-header. Header-auth and
-				// multi-tenant both need the email — without it there is no
-				// supported path to first-admin (header-auth) or the first
-				// random signup gets staff perms (multi-tenant).
 				return adminRequired ? 'Required for this configuration.' : undefined;
 			}
 			if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(v)) return 'Not a valid email.';
@@ -435,7 +422,6 @@ export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
 		cancelOn(value);
 		origin = String(value);
 
-		// Plain HTTP kills Secure cookies in production (login appears to succeed, then anon).
 		if (origin.startsWith('http://')) {
 			p.note(
 				'Sessions use Secure cookies in production; browsers will silently\n' +
@@ -528,7 +514,6 @@ function stringValue(v) {
 	return String(v);
 }
 
-// Header-auth security: deployment IS the boundary (runtime enforcement impossible).
 function headerAuthSecurityWarning() {
 	return [
 		'Header-auth trusts identity headers from the upstream proxy. Anyone who',