@selvajs/cli 4.8.1 → 4.8.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/cli",
-  "version": "4.8.1",
+  "version": "4.8.2",
   "description": "Scaffold and operate a Selva white-label deployment. `npx @selvajs/cli <dir>` to bootstrap, `selva <cmd>` to manage.",
   "license": "MIT",
   "author": "VektorNode",

package/src/commands/create.js

@@ -17,6 +17,7 @@ import {
 } from '../paths.js';
 import {
 	buildDeploymentPackageJson,
+	needsSupabaseProvider,
 	npmDistTagVersion,
 	resolveSelvaPins
 } from '../deployment-package.js';
@@ -65,12 +66,17 @@ export async function runCreate(argv) {
 	// `"latest"` re-resolves on every later `npm install`, so the deployment
 	// would follow the tag instead of the version it was scaffolded against —
 	// and `selva doctor` reports a floating pin as drift.
-	const { pins } = resolveSelvaPins({}, npmDistTagVersion);
+	const supabase = needsSupabaseProvider(values);
+	const { pins } = resolveSelvaPins(
+		{},
+		npmDistTagVersion,
+		supabase ? ['@selvajs/supabase-provider'] : []
+	);
 
 	// package.json first: npm install needs it, and the runtime templates below
 	// only exist once @selvajs/selva is installed into node_modules.
 	const pkgJson = JSON.stringify(
-		buildDeploymentPackageJson({ name: deployName, dependencies: pins }),
+		buildDeploymentPackageJson({ name: deployName, dependencies: pins, supabase }),
 		null,
 		2
 	);

package/src/commands/doctor.js

@@ -229,8 +229,9 @@ async function checkSupabaseMigrations(dir, env) {
 		// Provider package not installed in this deployment.
 	}
 	if (!expected) {
-		return yellow(
-			'@selvajs/supabase-provider migrations not found — skipping migration-head check'
+		return red(
+			'@selvajs/supabase-provider is not installed, so the migration SQL is missing. ' +
+				'Run `selva migrate` to add it, then `npm install`.'
 		);
 	}
 

package/src/commands/migrate.js

@@ -15,6 +15,7 @@ import {
 	DEPENDENCIES,
 	isFloatingPin,
 	LEGACY_DEPENDENCIES,
+	needsSupabaseProvider,
 	npmDistTagVersion,
 	OVERRIDES,
 	resolveSelvaPins,
@@ -122,7 +123,12 @@ export async function runMigrate(
 	}
 
 	const before = JSON.parse(readFileSync(pkgPath, 'utf8'));
-	const { pkg: target, notes: pinNotes } = buildTargetPackageJson(before, resolveVersion);
+	const deploymentEnv = readDeploymentEnv(join(dir, '.env'));
+	const { pkg: target, notes: pinNotes } = buildTargetPackageJson(
+		before,
+		resolveVersion,
+		deploymentEnv
+	);
 	const pkgDiff = diffPackageJson(before, target);
 
 	const configPath = join(dir, 'selva.config.js');
@@ -339,13 +345,32 @@ function restartAfterRollback(dir, pm2 = runPm2) {
 	}
 }
 
-function buildTargetPackageJson(current, resolveVersion = npmDistTagVersion) {
-	const { pins, notes } = resolveSelvaPins(current.dependencies, resolveVersion);
+// Only the provider keys matter here, so this reads `KEY=value` lines rather
+// than pulling in a dotenv parser: no quoting, expansion, or multi-line values
+// to honour.
+function readDeploymentEnv(envPath) {
+	if (!existsSync(envPath)) return {};
+	const env = {};
+	for (const line of readFileSync(envPath, 'utf8').split(/\r?\n/)) {
+		const match = /^\s*([A-Z0-9_]+)\s*=\s*(.*)$/.exec(line);
+		if (match) env[match[1]] = match[2].trim().replace(/^["']|["']$/g, '');
+	}
+	return env;
+}
+
+function buildTargetPackageJson(current, resolveVersion = npmDistTagVersion, env = {}) {
+	const supabase = needsSupabaseProvider(env);
+	const { pins, notes } = resolveSelvaPins(
+		current.dependencies,
+		resolveVersion,
+		supabase ? ['@selvajs/supabase-provider'] : []
+	);
 	const pkg = buildDeploymentPackageJson({
 		name: current.name ?? 'selva-deployment',
 		version: current.version ?? '0.1.0',
 		engines: current.engines,
-		dependencies: pins
+		dependencies: pins,
+		supabase
 	});
 	return { pkg, notes };
 }

package/src/deployment-package.js

@@ -64,7 +64,35 @@ const DEPENDENCIES = {
 	pm2: PM2_VERSION
 };
 
-/** The `@selvajs/*` packages whose pin belongs to the operator, not the scaffold. */
+/**
+ * Installed on top of `DEPENDENCIES` when a Supabase provider is selected.
+ *
+ * The provider's *code* is bundled into `@selvajs/selva`, so the app runs
+ * without this. Its migration SQL is not: `@selvajs/selva` publishes only
+ * `build` + `templates`, while the SQL and the `selva-supabase` bin ship in
+ * this package's own tarball. Without it, a deployment has no way to reach the
+ * schema it needs — `npx selva-supabase sync-migrations` resolves nothing and
+ * `doctor`'s migration-head check finds no directory to compare against.
+ */
+export const SUPABASE_DEPENDENCIES = {
+	'@selvajs/supabase-provider': 'latest'
+};
+
+/** True when any provider slot is set to supabase. */
+export function needsSupabaseProvider(env) {
+	return ['SELVA_AUTH_PROVIDER', 'SELVA_DATA_PROVIDER', 'SELVA_STORAGE_PROVIDER'].some(
+		(key) => env?.[key] === 'supabase'
+	);
+}
+
+/**
+ * The `@selvajs/*` packages whose pin belongs to the operator, not the scaffold.
+ *
+ * `@selvajs/supabase-provider` is deliberately absent: it's conditional, and
+ * `resolveSelvaPins` runs before anything knows which providers a deployment
+ * uses. Its pin is resolved alongside these only when it's actually installed
+ * (see `resolveSelvaPins`' `extra` argument).
+ */
 export const SELVA_PACKAGES = ['@selvajs/cli', '@selvajs/selva'];
 
 /**
@@ -117,7 +145,6 @@ export const LEGACY_DEPENDENCIES = {
 	'@selvajs/create': 'the old CLI package',
 	'@selvajs/platform': 'now bundled into @selvajs/selva',
 	'@selvajs/local-provider': 'now bundled into @selvajs/selva',
-	'@selvajs/supabase-provider': 'now bundled into @selvajs/selva',
 	'@selvajs/header-auth-provider': 'now bundled into @selvajs/selva'
 };
 
@@ -139,14 +166,29 @@ export const LEGACY_DEPENDENCIES = {
  * an operator choice too. `migrate` passes the resolved `@selvajs/*` pins in
  * here; a fresh scaffold passes none and inherits the defaults.
  */
-export function buildDeploymentPackageJson({ name, version = '0.1.0', engines, dependencies }) {
+export function buildDeploymentPackageJson({
+	name,
+	version = '0.1.0',
+	engines,
+	dependencies,
+	supabase = false
+}) {
+	const base = supabase ? { ...DEPENDENCIES, ...SUPABASE_DEPENDENCIES } : { ...DEPENDENCIES };
+	// A caller-supplied pin wins, but only for a package the deployment actually
+	// carries: an operator's stale supabase pin must not reinstate the dependency
+	// on a deployment that has since moved off supabase.
+	const resolved = { ...base };
+	for (const [pkgName, pin] of Object.entries(dependencies ?? {})) {
+		if (pkgName in base) resolved[pkgName] = pin;
+	}
+
 	const pkg = {
 		name: sanitizePackageName(name),
 		version,
 		private: true,
 		type: 'module',
 		scripts: { ...SCRIPTS },
-		dependencies: { ...DEPENDENCIES, ...dependencies },
+		dependencies: resolved,
 		overrides: { ...OVERRIDES }
 	};
 	if (engines && typeof engines === 'object') pkg.engines = { ...engines };
@@ -186,11 +228,11 @@ export function npmDistTagVersion(name, tag) {
  * so migrate can report it rather than inventing a version or aborting a
  * migration whose other half (layout, overrides, env renames) is still valid.
  */
-export function resolveSelvaPins(currentDeps, resolveVersion) {
+export function resolveSelvaPins(currentDeps, resolveVersion, extra = []) {
 	const pins = {};
 	const notes = [];
 
-	for (const name of SELVA_PACKAGES) {
+	for (const name of [...SELVA_PACKAGES, ...extra]) {
 		const current = currentDeps?.[name];
 
 		if (isPrereleasePin(current)) {
@@ -214,7 +256,7 @@ export function resolveSelvaPins(currentDeps, resolveVersion) {
 		// Nothing resolvable and nothing worth keeping — fall back to the tag so
 		// the install still succeeds. Rare: offline *and* a floating pin.
 		if (isFloatingPin(current)) {
-			pins[name] = DEPENDENCIES[name];
+			pins[name] = DEPENDENCIES[name] ?? SUPABASE_DEPENDENCIES[name];
 			if (!notes.some((n) => n.name === name)) {
 				notes.push({ name, kind: 'unresolved', pin: current, reason: 'no version returned' });
 			}

package/src/prompts.js

@@ -5,6 +5,52 @@ import pc from 'picocolors';
 
 const TRUTHY = new Set(['true', '1', 'yes']);
 
+// Mirrors FLAG_KEYS in @selvajs/server's create-selva-providers.ts. Every key
+// here is written to .env; `promptable: false` only hides it from the wizard.
+const FLAG_OPTIONS = [
+	{
+		value: 'ALLOW_ORG_CREATION',
+		label: 'Allow non-admin users to create their own orgs',
+		hint: 'multi-tenant self-service',
+		multiOnly: true,
+		// No route consults this flag yet — self-service org creation has not
+		// shipped. Offering it would promise behaviour nothing implements.
+		promptable: false
+	},
+	{
+		value: 'ALLOW_CROSS_ORG_PUBLIC',
+		label: 'Public projects visible across all orgs',
+		hint: 'instance-wide discovery',
+		multiOnly: true
+	},
+	{
+		value: 'ALLOW_ORG_COMPUTE_OVERRIDE',
+		label: 'Orgs can configure their own Rhino.Compute server',
+		hint: 'BYO compute',
+		multiOnly: true
+	},
+	{
+		value: 'ENABLE_PLATFORM_PROJECTS',
+		label: 'Platform projects (admin-owned, granted to orgs/users)',
+		hint: 'cross-org sharing without membership'
+	},
+	{
+		value: 'ENABLE_SHARING',
+		label: 'Per-definition share links (anonymous external access)',
+		hint: 'tokenized URLs'
+	}
+];
+
+const FLAG_NAMES = FLAG_OPTIONS.map((o) => o.value);
+
+/**
+ * Flags worth offering for a given tenancy. Cross-org flags are hidden under
+ * `single`, where one org makes both settings describe the same set.
+ */
+export function promptableFlags(tenancy) {
+	return FLAG_OPTIONS.filter((o) => o.promptable !== false && (tenancy === 'multi' || !o.multiOnly));
+}
+
 function envBool(v) {
 	if (v === undefined) return false;
 	return TRUTHY.has(String(v).toLowerCase());
@@ -95,14 +141,10 @@ export function collectConfigFromEnv(env = process.env) {
 	}
 	values.ORIGIN = origin;
 
-	const flagNames = [
-		'ALLOW_ORG_CREATION',
-		'ALLOW_CROSS_ORG_PUBLIC',
-		'ALLOW_ORG_COMPUTE_OVERRIDE',
-		'ENABLE_PLATFORM_PROJECTS',
-		'ENABLE_SHARING'
-	];
-	for (const f of flagNames) {
+	// An explicitly-set flag is preserved verbatim even when tenancy makes it
+	// inert: rewriting it to '' would hide the operator's misconfiguration
+	// rather than fix it, and the server already reads every key as opt-in.
+	for (const f of FLAG_NAMES) {
 		const key = `SELVA_FLAG_${f}`;
 		values[key] = envBool(env[key]) ? 'true' : '';
 	}
@@ -425,33 +467,7 @@ export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
 		}
 	}
 
-	const flagOptions = [
-		{
-			value: 'ALLOW_ORG_CREATION',
-			label: 'Allow non-admin users to create their own orgs',
-			hint: 'multi-tenant self-service'
-		},
-		{
-			value: 'ALLOW_CROSS_ORG_PUBLIC',
-			label: 'Public projects visible across all orgs',
-			hint: 'instance-wide discovery'
-		},
-		{
-			value: 'ALLOW_ORG_COMPUTE_OVERRIDE',
-			label: 'Orgs can configure their own Rhino.Compute server',
-			hint: 'BYO compute'
-		},
-		{
-			value: 'ENABLE_PLATFORM_PROJECTS',
-			label: 'Platform projects (admin-owned, granted to orgs/users)',
-			hint: 'cross-org sharing without membership'
-		},
-		{
-			value: 'ENABLE_SHARING',
-			label: 'Per-definition share links (anonymous external access)',
-			hint: 'tokenized URLs'
-		}
-	];
+	const flagOptions = promptableFlags(tenancy);
 
 	const flagDefaults = flagOptions
 		.map((o) => o.value)
@@ -475,9 +491,18 @@ export async function collectConfig({ defaults = {}, mode = 'create' } = {}) {
 		...providerValues
 	};
 
-	for (const opt of flagOptions) {
-		const enabled = Array.isArray(flags) && flags.includes(opt.value);
-		values[`SELVA_FLAG_${opt.value}`] = enabled ? 'true' : '';
+	// Every key is written, including the ones the prompt hid — a missing key
+	// reads as "unset" downstream, which is indistinguishable from "removed".
+	// A hidden flag keeps whatever the existing .env had; only offered flags
+	// are decided by the multiselect, so `init` can't silently clear one.
+	const offered = new Set(flagOptions.map((o) => o.value));
+	for (const name of FLAG_NAMES) {
+		const key = `SELVA_FLAG_${name}`;
+		if (!offered.has(name)) {
+			values[key] = envBool(defaults[key]) ? 'true' : '';
+			continue;
+		}
+		values[key] = Array.isArray(flags) && flags.includes(name) ? 'true' : '';
 	}
 
 	return values;