@selvajs/cli 4.8.0-beta.7 → 4.8.0-beta.9

package/src/commands/doctor.js

@@ -5,19 +5,33 @@
 // checks, each behind its own confirmation — and only those needing no root and
 // no runtime restart. See `applyFixes`.
 
-import { existsSync, readFileSync, readdirSync, accessSync, constants, statSync } from 'node:fs';
-import { spawnSync } from 'node:child_process';
-import { join, resolve, dirname, delimiter } from 'node:path';
+import {
+	existsSync,
+	readFileSync,
+	readdirSync,
+	accessSync,
+	constants,
+	statSync,
+	rmSync
+} from 'node:fs';
+import { join, resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { homedir } from 'node:os';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
-import { readEnvFile, RENAMED_ENV_VARS, REPLACED_ENV_VARS } from '../env.js';
+import { readEnvFile } from '../env.js';
 import { requireDeploymentDir, resolveDeploymentDir } from '../paths.js';
-import { detectDrift } from './migrate.js';
-
-const HEX_64 = /^[0-9a-f]{64}$/i;
-const PLACEHOLDER = 'replace-this-with-a-random-32-byte-hex-key';
+import { satisfiesNodeRange } from '../node-range.js';
+import { green, yellow, red, fixable } from '../checks/result.js';
+import { checkBootPersistence } from '../checks/boot.js';
+import {
+	checkDeprecatedEnv,
+	checkOrigin,
+	checkProviders,
+	checkSecret,
+	checkTenancy,
+	resolveProviders
+} from '../checks/config.js';
+import { detectDrift, NODE_MODULES_STASH } from './migrate.js';
 
 export async function runDoctor(argv = []) {
 	const fix = argv.includes('--fix');
@@ -32,28 +46,12 @@ export async function runDoctor(argv = []) {
 	checks.push(checkFile(join(dir, '.env'), '.env present'));
 	checks.push(checkFile(join(dir, 'ecosystem.config.cjs'), 'ecosystem.config.cjs present'));
 	checks.push(checkLayoutDrift(dir));
+	checks.push(checkMigrationLeftovers(dir));
 	checks.push(checkSecret(env.SELVA_HMAC_KEY, 'SELVA_HMAC_KEY is a 32-byte hex string'));
 	checks.push(checkSecret(env.SELVA_AT_REST_KEY, 'SELVA_AT_REST_KEY is a 32-byte hex string'));
 
-	// Header-auth: auth only; data/storage must be local or supabase.
-	const providers = {
-		auth: (env.SELVA_AUTH_PROVIDER ?? 'local').toLowerCase(),
-		data: (env.SELVA_DATA_PROVIDER ?? 'local').toLowerCase(),
-		storage: (env.SELVA_STORAGE_PROVIDER ?? 'local').toLowerCase()
-	};
-
-	const validForAuth = new Set(['local', 'supabase', 'header']);
-	const validForData = new Set(['local', 'supabase']);
-
-	if (!validForAuth.has(providers.auth)) {
-		checks.push(red(`SELVA_AUTH_PROVIDER="${providers.auth}" — expected local|supabase|header`));
-	}
-	if (!validForData.has(providers.data)) {
-		checks.push(red(`SELVA_DATA_PROVIDER="${providers.data}" — expected local|supabase`));
-	}
-	if (!validForData.has(providers.storage)) {
-		checks.push(red(`SELVA_STORAGE_PROVIDER="${providers.storage}" — expected local|supabase`));
-	}
+	const providers = resolveProviders(env);
+	checks.push(...checkProviders(providers));
 
 	const used = new Set(Object.values(providers));
 
@@ -70,42 +68,14 @@ export async function runDoctor(argv = []) {
 		checks.push(...checkHeaderAuth(dir, env, providers.data));
 	}
 
-	const tenancy = (env.SELVA_TENANCY ?? 'single').toLowerCase();
-	if (tenancy !== 'single' && tenancy !== 'multi') {
-		checks.push(red(`SELVA_TENANCY="${tenancy}" — expected single|multi`));
-	} else {
-		checks.push(green(`SELVA_TENANCY=${tenancy}`));
-	}
+	checks.push(checkTenancy(env));
 
 	checks.push(checkPackage(dir, '@selvajs/selva'));
 	checks.push(checkNodeEngine(dir));
 	checks.push(checkCliRuntimeAlignment(dir));
 	checks.push(...checkBootPersistence(dir));
-	if (env.ORIGIN) {
-		try {
-			new URL(env.ORIGIN);
-			checks.push(green(`ORIGIN=${env.ORIGIN}`));
-		} catch {
-			checks.push(red(`ORIGIN="${env.ORIGIN}" is not a valid URL`));
-		}
-	} else {
-		checks.push(yellow('ORIGIN unset — required behind a reverse proxy'));
-	}
-
-	for (const [oldName, newName] of Object.entries(RENAMED_ENV_VARS)) {
-		if (env[oldName] === undefined) continue;
-		checks.push(
-			env[newName] === undefined
-				? yellow(`${oldName} is deprecated — \`selva migrate\` renames it to ${newName}`)
-				: yellow(`${oldName} is deprecated and ignored — ${newName} is set and wins`)
-		);
-	}
-
-	// Not auto-fixable: the replacement encodes a value, so migrate won't guess.
-	for (const [oldName, replacement] of Object.entries(REPLACED_ENV_VARS)) {
-		if (env[oldName] === undefined) continue;
-		checks.push(yellow(`${oldName} is deprecated — replace it with ${replacement}`));
-	}
+	checks.push(checkOrigin(env));
+	checks.push(...checkDeprecatedEnv(env));
 
 	// ── Render ─────────────────────────────────────────────────────────
 	const resolved = await Promise.all(checks);
@@ -175,39 +145,10 @@ async function applyFixes(resolved, failures) {
 	return failures;
 }
 
-function green(text) {
-	return { severity: 'green', line: `${pc.green('✓')} ${text}` };
-}
-function yellow(text, fix) {
-	return { severity: 'yellow', line: `${pc.yellow('!')} ${text}`, fix };
-}
-function red(text, fix) {
-	return { severity: 'red', line: `${pc.red('✗')} ${text}`, fix };
-}
-
-/**
- * A repair `--fix` may run. `label` is what the operator is asked to approve;
- * `run()` performs it and returns a result line.
- *
- * Only attach one where the repair is unambiguous and reversible-ish. Anything
- * needing root, or that restarts the runtime running this process, stays a
- * printed instruction — a half-applied privileged fix is worse than none.
- */
-function fixable(label, run) {
-	return { label, run };
-}
-
 function checkFile(path, label) {
 	return existsSync(path) ? green(label) : red(`${label} (missing: ${path})`);
 }
 
-function checkSecret(value, label) {
-	if (!value) return red(`${label} — unset`);
-	if (value === PLACEHOLDER) return red(`${label} — still the placeholder`);
-	if (!HEX_64.test(value)) return red(`${label} — not 64 hex chars`);
-	return green(label);
-}
-
 function checkDataPath(dir, dataPath) {
 	const absolute = resolve(dir, dataPath);
 	try {
@@ -423,183 +364,26 @@ function checkNodeEngine(dir) {
 }
 
 /**
- * Narrow `engines.node` range check — `>=X`, `^`, `~`, `||`, and bare/x-ranges.
- * Returns null when unparseable so a misread never reports a false failure.
- *
- * Mirrors `satisfiesRange` in @selvajs/server/ops. Duplicated because the CLI is
- * dependency-free by design (it scaffolds the deployment that installs the
- * runtime, so it cannot import from it).
+ * `selva migrate` parks the old node_modules aside so a failed install can be
+ * rolled back, and removes it on either outcome. One surviving here means the
+ * migration was killed mid-flight — worth saying, because it is a full copy of
+ * the dependency tree and the deployment may be running on the wrong one.
  */
-export function satisfiesNodeRange(version, range) {
-	const core = /^v?(\d+)\.(\d+)\.(\d+)/.exec(String(version).trim());
-	if (!core) return null;
-	const v = [Number(core[1]), Number(core[2]), Number(core[3])];
-
-	let anyParsed = false;
-	for (const alt of String(range).split('||')) {
-		const clauses = alt.trim().split(/\s+/).filter(Boolean);
-		if (!clauses.length) continue;
-
-		let all = true;
-		let parsed = true;
-		for (const clause of clauses) {
-			const m = /^(>=|<=|>|<|\^|~|=)?\s*v?(\d+)(?:\.(\d+|x|\*))?(?:\.(\d+|x|\*))?/.exec(clause);
-			if (!m) {
-				parsed = false;
-				break;
-			}
-			const op = m[1] ?? '=';
-			const num = (s) => (s == null || s === 'x' || s === '*' ? 0 : Number(s));
-			const t = [Number(m[2]), num(m[3]), num(m[4])];
-			let cmp = 0;
-			for (let i = 0; i < 3; i++) {
-				if (v[i] > t[i]) {
-					cmp = 1;
-					break;
-				}
-				if (v[i] < t[i]) {
-					cmp = -1;
-					break;
-				}
-			}
-			let ok;
-			if (op === '>=') ok = cmp >= 0;
-			else if (op === '>') ok = cmp > 0;
-			else if (op === '<=') ok = cmp <= 0;
-			else if (op === '<') ok = cmp < 0;
-			else if (op === '^') ok = cmp >= 0 && v[0] === t[0];
-			else if (op === '~') ok = cmp >= 0 && v[0] === t[0] && v[1] === t[1];
-			else
-				ok =
-					v[0] === t[0] &&
-					(m[3] == null || m[3] === 'x' || m[3] === '*' || v[1] === t[1]) &&
-					(m[4] == null || m[4] === 'x' || m[4] === '*' || v[2] === t[2]);
-			if (!ok) {
-				all = false;
-				break;
+function checkMigrationLeftovers(dir) {
+	const stash = join(dir, NODE_MODULES_STASH);
+	if (!existsSync(stash)) return green('no interrupted migration left behind');
+	return yellow(
+		`${NODE_MODULES_STASH} exists — a \`selva migrate\` was interrupted. If the app ` +
+			`is healthy, delete it: rm -rf ${stash}`,
+		fixable(`delete the leftover ${NODE_MODULES_STASH}`, () => {
+			try {
+				rmSync(stash, { recursive: true, force: true });
+				return green(`removed ${NODE_MODULES_STASH}`);
+			} catch (err) {
+				return red(`could not remove ${stash}: ${err instanceof Error ? err.message : err}`);
 			}
-		}
-		if (!parsed) continue;
-		anyParsed = true;
-		if (all) return true;
-	}
-	return anyParsed ? false : null;
-}
-
-function checkBootPersistence(dir) {
-	// pm2's boot integration is Linux/systemd-specific. On macOS it's launchd
-	// (different unit path) and on Windows pm2 boot persistence isn't a thing —
-	// stay silent rather than emit misleading checks.
-	if (process.platform !== 'linux') return [];
-
-	const out = [];
-
-	// dump.pm2 (what pm2 startup resurrects).
-	const pm2Home = process.env.PM2_HOME ?? join(homedir(), '.pm2');
-	const dumpPath = join(pm2Home, 'dump.pm2');
-	if (existsSync(dumpPath)) {
-		out.push(green('pm2 process list saved (dump.pm2 present)'));
-	} else {
-		out.push(
-			yellow(
-				'pm2 process list not saved — run `npx pm2 save` so a reboot can ' +
-					'resurrect the app (nothing to restore without it)',
-				fixable('run `pm2 save` to persist the current process list', () => {
-					const bin = join(dir, 'node_modules', '.bin', 'pm2');
-					if (!existsSync(bin)) return red('pm2 not installed in this deployment');
-					const r = spawnSync(bin, ['save'], { cwd: dir, encoding: 'utf8' });
-					return (r.status ?? 1) === 0
-						? green('pm2 process list saved')
-						: red(`pm2 save failed: ${(r.stderr || r.stdout || '').trim()}`);
-				})
-			)
-		);
-	}
-
-	// systemd unit: present and pointing at deployment-local pm2.
-	const user = process.env.USER ?? process.env.LOGNAME;
-	const unitPath = user ? `/etc/systemd/system/pm2-${user}.service` : null;
-
-	if (unitPath && existsSync(unitPath)) {
-		const localPm2 = join(dir, 'node_modules', 'pm2', 'bin', 'pm2');
-		let unit = '';
-		try {
-			unit = readFileSync(unitPath, 'utf8');
-		} catch {
-			out.push(yellow(`pm2 systemd unit present but unreadable (${unitPath})`));
-			return out;
-		}
-		const execStart = /^ExecStart=(.+)$/m.exec(unit)?.[1] ?? '';
-		if (execStart.includes(localPm2)) {
-			out.push(green('pm2 systemd boot unit installed (uses deployment-local pm2)'));
-		} else {
-			out.push(
-				red(
-					`pm2 systemd boot unit points at a different pm2 than this deployment's.\n     ` +
-						`ExecStart: ${execStart || '(not found)'}\n     ` +
-						`expected:  ${localPm2} resurrect\n     ` +
-						`Reboots will resurrect via the wrong pm2 (version skew). Re-run startup ` +
-						`with the local binary:\n     ` +
-						`sudo env PATH=$PATH:${join(dir, 'node_modules', '.bin')} ${localPm2} ` +
-						`startup systemd -u $USER --hp $HOME`
-				)
-			);
-		}
-	} else {
-		out.push(
-			yellow(
-				'pm2 systemd boot unit not installed — the app will NOT restart after a ' +
-					'reboot. Run `npx pm2 startup systemd -u $USER --hp $HOME` and paste the ' +
-					'printed command (point it at this deployment’s pm2).'
-			)
-		);
-	}
-
-	// Warn if global pm2 is on PATH (root cause of version skew).
-	const globalPm2 = findGlobalPm2(dir);
-	if (globalPm2) {
-		// Only offer the removal when we could actually perform it. A global
-		// install under /usr is root-owned; attempting it would half-fail and
-		// leave the operator worse informed than a printed instruction.
-		let writable = false;
-		try {
-			accessSync(dirname(globalPm2), constants.W_OK);
-			writable = true;
-		} catch {
-			writable = false;
-		}
-
-		out.push(
-			yellow(
-				`a pm2 outside this deployment is on PATH (${globalPm2}) — it can fork a ` +
-					`mismatched daemon and trigger skew. Prefer \`npm run\` wrappers / \`npx pm2\` ` +
-					`from this directory; consider \`npm uninstall -g pm2\`.` +
-					(writable ? '' : `\n     (${dirname(globalPm2)} is not writable — needs sudo)`),
-				writable
-					? fixable(`uninstall the global pm2 at ${globalPm2}`, () => {
-							const r = spawnSync('npm', ['uninstall', '-g', 'pm2'], { encoding: 'utf8' });
-							return (r.status ?? 1) === 0
-								? green('global pm2 uninstalled')
-								: red(`npm uninstall -g pm2 failed: ${(r.stderr || r.stdout || '').trim()}`);
-						})
-					: undefined
-			)
-		);
-	}
-
-	return out;
-}
-
-// Scan PATH for stray pm2 binary (read-only).
-function findGlobalPm2(dir) {
-	const localBin = resolve(dir, 'node_modules', '.bin');
-	const dirs = (process.env.PATH ?? '').split(delimiter).filter(Boolean);
-	for (const d of dirs) {
-		if (resolve(d) === localBin) continue;
-		const candidate = join(d, 'pm2');
-		if (existsSync(candidate)) return candidate;
-	}
-	return null;
+		})
+	);
 }
 
 function checkLayoutDrift(dir) {

package/src/commands/init.js

@@ -7,14 +7,13 @@
 //     `selva keys rotate`'s job, not init's.
 //   • Doesn't touch package.json or run npm install.
 
-import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import { collectConfig } from '../prompts.js';
 import { readEnvFile, writeEnvFile } from '../env.js';
 import { generateKey } from '../secrets.js';
-import { requireDeploymentDir, resolveDeploymentDir } from '../paths.js';
+import { readEnvTemplate, requireDeploymentDir, resolveDeploymentDir } from '../paths.js';
 
 export async function runInit() {
 	const dir = resolveDeploymentDir();
@@ -48,24 +47,7 @@ export async function runInit() {
 		p.log.warn('SELVA_AT_REST_KEY was missing — generated a fresh one.');
 	}
 
-	// Use whatever .env.example shipped with the installed runtime as the
-	// canonical template. Falls back to the current .env if the runtime
-	// templates aren't present (shouldn't happen post-install).
-	const templatePath = join(
-		dir,
-		'node_modules',
-		'@selvajs',
-		'selva',
-		'templates',
-		'.env.example'
-	);
-	const template = existsSync(templatePath)
-		? readFileSync(templatePath, 'utf8')
-		: existsSync(envPath)
-			? readFileSync(envPath, 'utf8')
-			: '';
-
-	writeEnvFile(envPath, template, values);
+	writeEnvFile(envPath, readEnvTemplate(dir), values);
 
 	p.outro(
 		[

package/src/commands/keys.js

@@ -1,12 +1,11 @@
 // Rotate SELVA_HMAC_KEY or SELVA_AT_REST_KEY; requires explicit confirm (blast radius in TARGETS).
 
-import { readFileSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
 import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import { readEnvFile, writeEnvFile } from '../env.js';
 import { generateKey } from '../secrets.js';
-import { requireDeploymentDir, resolveDeploymentDir } from '../paths.js';
+import { readEnvTemplate, requireDeploymentDir, resolveDeploymentDir } from '../paths.js';
 
 const TARGETS = {
 	hmac: {
@@ -14,8 +13,7 @@ const TARGETS = {
 		warning: [
 			'This will:',
 			pc.red('  • log every signed-in user out (existing session cookies stop verifying)'),
-			pc.red('  • invalidate share-link and invite tokens that fell back to this key'),
-			pc.dim('    (only relevant when SHARE_LINK_SECRET / INVITE_TOKEN_SECRET are unset)')
+			pc.red('  • invalidate every share link and pending invite')
 		].join('\n')
 	},
 	'at-rest': {
@@ -58,19 +56,7 @@ export async function runKeysRotate(argv) {
 	const fresh = generateKey();
 	current[envVar] = fresh;
 
-	const templatePath = join(
-		dir,
-		'node_modules',
-		'@selvajs',
-		'selva',
-		'templates',
-		'.env.example'
-	);
-	const template = existsSync(templatePath)
-		? readFileSync(templatePath, 'utf8')
-		: readFileSync(envPath, 'utf8');
-
-	writeEnvFile(envPath, template, current);
+	writeEnvFile(envPath, readEnvTemplate(dir), current);
 
 	p.outro(
 		[