@selvajs/cli 4.9.0 → 4.9.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/cli",
-  "version": "4.9.0",
+  "version": "4.9.1",
   "description": "Scaffold and operate a Selva white-label deployment. `npx @selvajs/cli <dir>` to bootstrap, `selva <cmd>` to manage.",
   "license": "MIT",
   "author": "VektorNode",

package/src/caddyfile.js

@@ -45,8 +45,11 @@ export function renderCaddyfile({ domain, acmeEmail, port = 3000 }) {
 	@api path /api/*
 	header @api Cache-Control "no-cache, no-store, must-revalidate"
 
+	# Must clear the app's own caps (COMPUTE_REQUEST_MAX_BYTES / BODY_SIZE_LIMIT,
+	# both 256 MB) — Caddy rejects first, so a lower value here silently caps
+	# every upload no matter what .env says.
 	request_body {
-		max_size 100mb
+		max_size 256mb
 	}
 
 	log {

package/src/checks/config.js

@@ -165,6 +165,73 @@ export function checkEnvDocumentation(commentLines, fix) {
 	);
 }
 
+/**
+ * Parse a `BODY_SIZE_LIMIT` the way adapter-node does, so this check agrees with
+ * the thing that actually rejects the request.
+ *
+ * The quirk is load-bearing: adapter-node reads only the LAST character as the
+ * suffix, so `60mb` parses as the digits `60m` and happens to mean 60 MB, while
+ * `60xy` silently becomes NaN. Returns bytes, or `null` when the value is one
+ * adapter-node can't use.
+ */
+export function parseBodySizeLimit(raw) {
+	if (raw == null || raw === '') return null;
+	const value = String(raw).trim();
+	if (value === '') return null;
+
+	// Mirrors adapter-node's parse_as_bytes (files/utils.js): only K/M/G count as
+	// units, and the rest goes through `Number`, which is strict — "256mb" leaves
+	// a trailing "m" and yields NaN, so adapter-node throws on boot.
+	const units = { K: 1024, M: 1024 * 1024, G: 1024 * 1024 * 1024 };
+	const multiplier = units[value.at(-1).toUpperCase()] ?? 1;
+	const bytes = Number(multiplier !== 1 ? value.slice(0, -1) : value) * multiplier;
+	if (!Number.isFinite(bytes) || bytes <= 0) return null;
+	return bytes;
+}
+
+// The app's own default for COMPUTE_REQUEST_MAX_BYTES (packages/server
+// compute/limits.ts). Duplicated rather than imported: the CLI installs the
+// runtime and cannot import from it.
+const COMPUTE_REQUEST_DEFAULT_BYTES = 256 * 1024 * 1024;
+
+/**
+ * BODY_SIZE_LIMIT has to clear the compute request cap, or adapter-node's global
+ * backstop rejects the upload first — with a non-JSON body the app never sees
+ * and cannot log. Unset is the dangerous case, not a neutral one: adapter-node
+ * falls back to 512 KB, so every upload 413s on a deployment that looks fine.
+ */
+export function checkBodySizeLimit(env) {
+	const raw = env.BODY_SIZE_LIMIT;
+	const requestCap = Number(env.COMPUTE_REQUEST_MAX_BYTES) || COMPUTE_REQUEST_DEFAULT_BYTES;
+	const asMb = (bytes) => `${Math.round(bytes / (1024 * 1024))} MB`;
+
+	if (raw == null || raw === '') {
+		return red(
+			`BODY_SIZE_LIMIT unset — adapter-node falls back to 512 KB, so uploads over ` +
+				`that fail with an opaque 413 no app log records. Set it to at least ` +
+				`${asMb(requestCap)} (the compute request cap).`
+		);
+	}
+
+	const bytes = parseBodySizeLimit(raw);
+	if (bytes === null) {
+		return red(
+			`BODY_SIZE_LIMIT="${raw}" — adapter-node cannot parse this and throws on boot. ` +
+				`Use a byte count or a single K/M/G suffix, e.g. "256M".`
+		);
+	}
+
+	if (bytes < requestCap) {
+		return yellow(
+			`BODY_SIZE_LIMIT=${raw} (${asMb(bytes)}) is below COMPUTE_REQUEST_MAX_BYTES ` +
+				`(${asMb(requestCap)}) — the global cap rejects first, making the compute cap ` +
+				`dead config. Raise it to at least ${asMb(requestCap)}.`
+		);
+	}
+
+	return green(`BODY_SIZE_LIMIT=${raw}`);
+}
+
 // A rename is auto-fixable (`selva migrate` rewrites the key). A replacement
 // encodes a value in the new name, so migrate leaves it alone rather than
 // guessing — it's reported here and nowhere else.

package/src/commands/doctor.js

@@ -27,6 +27,7 @@ import { green, yellow, red, fixable } from '../checks/result.js';
 import { checkBootPersistence } from '../checks/boot.js';
 import { checkRuntimeEnvironment } from '../checks/runtime.js';
 import {
+	checkBodySizeLimit,
 	checkDeprecatedEnv,
 	checkEnvDocumentation,
 	checkHeaderNames,
@@ -82,6 +83,7 @@ export async function runDoctor(argv = []) {
 	checks.push(...checkRuntimeEnvironment(dir));
 	checks.push(...checkBootPersistence(dir));
 	checks.push(checkOrigin(env));
+	checks.push(checkBodySizeLimit(env));
 	checks.push(...checkDeprecatedEnv(env));
 	checks.push(checkEnvDocs(dir));
 
@@ -174,7 +176,7 @@ function checkDataPath(dir, dataPath) {
 	}
 }
 
-async function checkSupabase(env) {
+export async function checkSupabase(env) {
 	if (!env.SUPABASE_URL) return red('SUPABASE_URL unset');
 	if (!env.SUPABASE_ANON_KEY) return red('SUPABASE_ANON_KEY unset');
 	if (!env.SUPABASE_SERVICE_ROLE_KEY) return red('SUPABASE_SERVICE_ROLE_KEY unset');
@@ -189,11 +191,21 @@ async function checkSupabase(env) {
 	try {
 		const controller = new AbortController();
 		const timer = setTimeout(() => controller.abort(), 4000);
+		// GoTrue rejects an unauthenticated request to its own health endpoint, so
+		// without the key a perfectly healthy project answers 401 and this reads as
+		// a broken deployment. Sending the anon key makes 200 mean what it says.
 		const res = await fetch(env.SUPABASE_URL + '/auth/v1/health', {
+			headers: { apikey: env.SUPABASE_ANON_KEY },
 			signal: controller.signal
 		});
 		clearTimeout(timer);
 		if (res.ok) return green(`SUPABASE_URL reachable (${res.status})`);
+		if (res.status === 401) {
+			return red(
+				`SUPABASE_URL rejected SUPABASE_ANON_KEY (401) — the key does not belong ` +
+					`to this project, or it has been rotated.`
+			);
+		}
 		return yellow(`SUPABASE_URL responded ${res.status} — check project status`);
 	} catch (err) {
 		return yellow(`SUPABASE_URL unreachable (${err.message ?? err}) — skipping`);

package/src/env.js

@@ -180,6 +180,31 @@ export function readEnvFile(path) {
 	return parseEnv(readFileSync(path, 'utf8'));
 }
 
+/**
+ * Template vars whose shipped value is a real default a deployment should run
+ * with, rather than a placeholder or a prompt answer.
+ *
+ * Deliberately an allowlist, not "every live line in the template". The template
+ * also ships `SELVA_HMAC_KEY=replace-this-…` (seeding it would give every
+ * deployment a publicly known key) and a monorepo-relative `DATA_PATH` that is
+ * wrong anywhere but this repo.
+ *
+ * `BODY_SIZE_LIMIT` has to be here: unset, adapter-node falls back to 512 KB and
+ * every upload 413s with an opaque non-JSON body, which reads as a broken
+ * install rather than a missing setting.
+ */
+const SEEDED_TEMPLATE_DEFAULTS = ['BODY_SIZE_LIMIT'];
+
+/** The subset of the template's live `KEY=value` lines that are safe to seed. */
+function seededTemplateDefaults(template) {
+	const parsed = parseEnv(template);
+	const out = {};
+	for (const key of SEEDED_TEMPLATE_DEFAULTS) {
+		if (parsed[key] !== undefined) out[key] = parsed[key];
+	}
+	return out;
+}
+
 /**
  * Render a values-only `.env` — the scaffold's default shape.
  *
@@ -192,6 +217,7 @@ export function readEnvFile(path) {
 export function renderEnvValues(template, values, { header = ENV_HEADER } = {}) {
 	const ordered = [];
 	const seen = new Set();
+	const defaults = seededTemplateDefaults(template);
 
 	// The template names a var three ways — live (`KEY=v`), commented-out
 	// (`# KEY=v`), and as a bare mention in prose (`# KEY   single | multi`).
@@ -202,7 +228,17 @@ export function renderEnvValues(template, values, { header = ENV_HEADER } = {})
 		const key = stripped.split(/[\s=]/)[0]?.trim();
 		if (!key || !/^[A-Z][A-Z0-9_]{2,}$/.test(key)) continue;
 		if (seen.has(key)) continue;
-		if (!Object.prototype.hasOwnProperty.call(values, key)) continue;
+		// A live `KEY=value` in the template is a shipped default, not just an
+		// ordering hint: the prompts cover a fraction of the vars, so without this
+		// a scaffolded deployment silently runs on the code's fallback instead.
+		// BODY_SIZE_LIMIT is the case that bites — adapter-node's fallback is
+		// 512 KB, so every upload 413s until an operator sets it by hand.
+		if (
+			!Object.prototype.hasOwnProperty.call(values, key) &&
+			!Object.prototype.hasOwnProperty.call(defaults, key)
+		) {
+			continue;
+		}
 		seen.add(key);
 		ordered.push(key);
 	}
@@ -213,7 +249,9 @@ export function renderEnvValues(template, values, { header = ENV_HEADER } = {})
 
 	const lines = [];
 	for (const key of ordered) {
-		const value = values[key];
+		// Operator values win over the template's defaults, including when the
+		// operator has deliberately blanked one out.
+		const value = Object.prototype.hasOwnProperty.call(values, key) ? values[key] : defaults[key];
 		if (value === undefined || value === null || value === '') continue;
 		lines.push(`${key}=${quoteIfNeeded(value)}`);
 	}