@selvajs/selva 2.0.0

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@selvajs/selva",
+  "version": "2.0.0",
+  "description": "Selva — self-contained Grasshopper-driven web app. Install + point at a selva.config.js to deploy.",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./build/index.js",
+  "files": [
+    "build",
+    "templates"
+  ],
+  "engines": {
+    "node": ">=20.6.0"
+  },
+  "dependencies": {
+    "@lucide/svelte": "^1.11.0",
+    "@selvajs/compute": "1.5.2",
+    "@supabase/supabase-js": "^2.104.1",
+    "@sveltejs/kit": "2.58.0",
+    "bits-ui": "^2.18.0",
+    "clsx": "^2.1.1",
+    "mode-watcher": "^1.1.0",
+    "sharp": "^0.34.5",
+    "tailwind-merge": "^3.5.0",
+    "tailwind-variants": "^3.2.2",
+    "three": "^0.184.0",
+    "zod": "^4.3.6"
+  },
+  "devDependencies": {
+    "@sveltejs/adapter-node": "^5.5.4",
+    "@types/three": "^0.184.0",
+    "esbuild": "^0.25.0",
+    "tw-animate-css": "^1.4.0",
+    "vitest": "^3.2.4",
+    "@selvajs/config": "0.0.0",
+    "@selvajs/header-auth-provider": "0.11.0",
+    "@selvajs/local-provider": "0.10.0",
+    "@selvajs/platform": "0.10.0",
+    "@selvajs/schemas": "2.0.0",
+    "@selvajs/ui": "2.0.0",
+    "@selvajs/supabase-provider": "0.10.0"
+  },
+  "scripts": {
+    "dev": "vite dev",
+    "build": "rm -rf build && vite build && node ./scripts/generate-templates.js",
+    "preview": "vite preview",
+    "start": "node build/index.js",
+    "clean": "rm -rf build templates",
+    "check": "svelte-kit sync && svelte-check --tsconfig ./tsconfig.json",
+    "type-check": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  }
+}

package/templates/.env.example

@@ -0,0 +1,339 @@
+# ============================================================================
+# COMPUTE-APP ENVIRONMENT VARIABLES
+# ============================================================================
+# These are PRIVATE server-side only variables. Never commit this file!
+# They are NOT embedded in the client bundle.
+#
+# COPY THIS FILE TO `.env` AND UPDATE THE VALUES FOR YOUR DEPLOYMENT
+# ============================================================================
+
+
+# ============================================================================
+# PROVIDER & TENANCY
+# ============================================================================
+# Selva is provider-pluggable. Each of auth / data / storage can be wired to
+# a different backend; the three vars below pick which implementation runs.
+# Vars labeled "[local]" further down are only read by the local provider;
+# "[supabase]" only by the Supabase provider.
+#
+# Wiring a custom provider (e.g. your own SSO, an internal data store) means
+# editing selva.config.ts. The defaults below cover the shipped stacks.
+#
+# SELVA_AUTH_PROVIDER       local | supabase | header    (default: local)
+# SELVA_DATA_PROVIDER       local | supabase             (default: local)
+# SELVA_STORAGE_PROVIDER    local | supabase             (default: local)
+#
+# Tenancy mode:
+#   single — one org per deployment. Setup creates it; every authenticated
+#            user acts inside that org. Right for white-label installs.
+#   multi  — orgs are first-class. Setup creates only a platform admin;
+#            users create their own orgs. Right for SaaS-style deployments.
+#
+# SELVA_TENANCY             single | multi      (default: single)
+
+
+# ============================================================================
+# WHITE-LABEL BRANDING
+# ============================================================================
+# Customer-visible product name, footer copyright, and landing-page copy.
+# All optional — anything left unset falls back to "Selva" / the default
+# tagline. Use these to rebrand the instance without forking the UI.
+#
+# SELVA_BRAND_NAME=Acme Compute
+#   Shown in the header next to the logo, in <title> tags, and in any copy
+#   that refers to "this {brand} instance" / "{brand} staff".
+#
+# SELVA_BRAND_COPYRIGHT_NAME=Acme Corp.
+#   Footer copyright owner. Defaults to SELVA_BRAND_NAME when unset.
+#
+# SELVA_BRAND_TAGLINE=Acme's parametric design tools, on the web.
+#   Subtitle on the unauthenticated landing page.
+#
+# SELVA_BRAND_DESCRIPTION=Acme's interactive design platform.
+#   <meta name="description"> for SEO and social previews.
+#
+# Favicons + the apple-mobile-web-app-title in app.html are static assets
+# bundled into the build. To replace them, overwrite the files in
+# build/client/favicon/ after install. The webmanifest can be edited the
+# same way.
+
+
+# ============================================================================
+# PLATFORM FEATURE FLAGS (all default to off)
+# ============================================================================
+# Each flag is opt-in; absence or anything other than "true"/"1"/"yes" means
+# off. These are security-relevant — read the comments before flipping.
+#
+# SELVA_FLAG_ALLOW_ORG_CREATION=true
+#   Lets non-instance-admin users create their own org. Off by default in
+#   single-tenant deployments. Turn on for self-service multi-tenant setups.
+#
+# SELVA_FLAG_ALLOW_CROSS_ORG_PUBLIC=true
+#   Changes what `public` projects mean. Off (default): a `public` project is
+#   visible only to authenticated members of the publishing org. On: visible
+#   to any authenticated user on the instance. Self-hosted single-tenant
+#   instances can leave this off.
+#
+# SELVA_FLAG_ALLOW_ORG_COMPUTE_OVERRIDE=true
+#   Lets orgs configure their own Rhino.Compute server (BYO compute) instead
+#   of inheriting the instance default. Off by default.
+#
+# SELVA_FLAG_ENABLE_SHARING=true
+#   Per-definition share links — anonymous external access via tokenized
+#   URLs. Off by default. When off, share-link admin routes reject
+#   mint/list/revoke and the token-resolution path stops honouring tokens.
+
+
+# ============================================================================
+# [local] Local provider — filesystem + JSON + HMAC sessions
+# ============================================================================
+# Two keys, two jobs. They sound similar but are not interchangeable:
+#
+#   SELVA_HMAC_KEY     — SIGNS things. HMAC-SHA256 key used for session
+#                        cookies and (by fallback) share-link + invite
+#                        token hashes. Rotating it logs everyone out and
+#                        invalidates any tokens that were using it as a
+#                        fallback.
+#
+#   SELVA_AT_REST_KEY  — ENCRYPTS things. AES-256-GCM key used to encrypt
+#                        the Rhino.Compute API key at rest in
+#                        compute.config.json. Rotating it makes the
+#                        encrypted blob undecryptable — you'd have to
+#                        re-enter the API key at /admin/compute.
+#
+# Both must be 32 bytes, stable across restarts. Generate with:
+#   node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
+#
+# DATA_PATH       — directory where the local provider stores users.json,
+#                   orgs/projects/definitions JSON, and uploaded .gh files.
+#                   Resolved relative to packages/selva/. The default
+#                   points at .selva-data/ at the repo root so user data does
+#                   not live inside the package source tree (and is gitignored
+#                   there). For production deployments use an absolute path.
+#
+# All three are only read by the local provider. The first admin user is
+# created through the in-app setup page on first boot.
+#
+DATA_PATH="../../.selva-data"
+SELVA_HMAC_KEY=replace-this-with-a-random-32-byte-hex-key
+SELVA_AT_REST_KEY=replace-this-with-a-random-32-byte-hex-key
+
+
+# ============================================================================
+# [header] Header auth provider — trusts headers from an upstream proxy
+# ============================================================================
+# Auth-only provider. The deployment authenticates users in a reverse proxy
+# (Caddy forward_auth, oauth2-proxy, Authelia, …) and forwards a trusted UPN
+# header to Selva. Pair with `local` or `supabase` for data/storage.
+#
+# ⚠ TRUST BOUNDARY: this provider does NO cryptographic verification of the
+# headers. The deployment IS the security boundary. You MUST ensure all of:
+#   1. The app process is reachable ONLY through the proxy (bind 127.0.0.1
+#      / firewall the port). A direct curl from outside must NOT reach it.
+#   2. The proxy authenticates against the IdP on every request.
+#   3. The proxy STRIPS any inbound SELVA-* headers before adding its own.
+# See packages/providers/header-auth/README.md for a working Caddyfile and a
+# curl-based self-test to run after every deployment change.
+#
+# HEADER_AUTH_DATA_DIR
+#   Directory holding header-allowlist.json (the pre-provisioned UPN list).
+#   Falls back to DATA_PATH when unset — convenient when pairing with the
+#   local data provider.
+#
+# HEADER_AUTH_UPN_HEADER         (default: SELVA-UserPrincipalName)
+# HEADER_AUTH_EMAIL_HEADER       (default: SELVA-Email)
+# HEADER_AUTH_DISPLAY_NAME_HEADER (default: SELVA-DisplayName)
+#   Header names the proxy sets. Override to match a different proxy
+#   (e.g. oauth2-proxy uses X-Auth-Request-User).
+#
+# Note: there is no Selva-side logout — identity rides on every request via
+# the proxy headers, so there's no session to destroy. Sign-out is the
+# proxy/IdP's job; Selva does not render a logout button under header-auth.
+#
+# HEADER_AUTH_DATA_DIR=/var/lib/selva
+# HEADER_AUTH_UPN_HEADER=SELVA-UserPrincipalName
+# HEADER_AUTH_EMAIL_HEADER=SELVA-Email
+# HEADER_AUTH_DISPLAY_NAME_HEADER=SELVA-DisplayName
+
+
+# ============================================================================
+# TOKEN HMAC SECRETS (both providers)
+# ============================================================================
+# HMAC keys used to hash share-link and invite tokens at rest. The raw token
+# is generated per record (32 random bytes) and shown to the minter once;
+# the DB stores HMAC(secret, token). A DB-only leak therefore can't be
+# replayed without the secret.
+#
+# If unset, both fall back to SELVA_HMAC_KEY. Fine for single-tenant;
+# multi-tenant or production should set them explicitly so they can be
+# rotated independently — rotating one shouldn't invalidate the other.
+#
+# Generate each with:
+#   openssl rand -base64 32
+#
+# Rotation invalidates EVERY existing token of that kind instantly (hashes
+# won't match). Set once at install; rotate only on suspected secret
+# compromise. Rotating SHARE_LINK_SECRET breaks live share links;
+# rotating INVITE_TOKEN_SECRET breaks pending invite links.
+#
+# SHARE_LINK_SECRET=replace-this-with-a-random-32-plus-character-secret
+# INVITE_TOKEN_SECRET=replace-this-with-a-random-32-plus-character-secret
+
+
+# ============================================================================
+# [supabase] Supabase provider
+# ============================================================================
+# Local stack (`cd packages/providers/supabase && npx supabase start`):
+#   SUPABASE_URL=http://127.0.0.1:54321
+#   then read `npx supabase status` for the Publishable + Secret keys.
+#
+# Hosted project (supabase.com):
+#   SUPABASE_URL=https://<project-ref>.supabase.co
+#   Dashboard → Project Settings → API
+#
+# SUPABASE_URL=
+# SUPABASE_ANON_KEY=              # "Publishable" on CLI v2.95+ (sb_publishable_…)
+# SUPABASE_SERVICE_ROLE_KEY=      # "Secret" on CLI v2.95+ (sb_secret_…) — server-only
+
+# Optional bucket overrides (defaults are selva-public + selva-private).
+# SUPABASE_PUBLIC_BUCKET=selva-public
+# SUPABASE_PRIVATE_BUCKET=selva-private
+
+# URL prefix the app serves private files at. Default: /api/files
+# SUPABASE_PRIVATE_URL_PREFIX=/api/files
+
+# Allow self-service signup via /signup? Default: false (invite-only)
+# SUPABASE_ENABLE_SELF_SIGNUP=true
+
+# OAuth providers to surface on the login page. Comma-separated; each must be
+# enabled in the Supabase dashboard first (Authentication → Providers).
+# Supported labels: google, github, azure, gitlab.
+# When set, the login page renders "Continue with X" buttons; the setup page
+# treats the first OAuth sign-in as the bootstrap admin (granted every
+# platform permission). Leave unset for password-only deployments.
+# SUPABASE_OAUTH_PROVIDERS=google,github
+
+
+# ============================================================================
+# INSTANCE-ADMIN BOOTSTRAP (both providers)
+# ============================================================================
+# Constrains the "first OAuth sign-in becomes instance_admin" path
+# (Permissions.md §2 invariant) to a specific email. Without this set,
+# whoever signs in first while no admin exists wins the race — fine for
+# fresh self-hosted installs, risky in production.
+#
+# Setting this also doubles as the break-glass recovery path
+# (Permissions.md §12) when admin is lost to manual DB edits, a backup
+# restore, or migration drift: configure the env var, the named user
+# signs in, admin is restored. The check only runs while *no* admin
+# exists, so this is safe to leave permanently set.
+#
+# BOOTSTRAP_INSTANCE_ADMIN_EMAIL=admin@your-domain.com
+
+
+# ============================================================================
+# Rhino.Compute Server
+# ============================================================================
+# Server URL and optional API key are configured in the admin dashboard
+# (/admin/compute) and stored in the data provider — no env var needed.
+
+
+# ============================================================================
+# OPTIONAL: Server Configuration
+# ============================================================================
+# Port the application server listens on (default: 3000)
+# PORT=3000
+
+# Host/IP address the server binds to (default: 0.0.0.0)
+# Use 0.0.0.0 to accept external connections
+# Use 127.0.0.1 or localhost for local-only connections
+# HOST=0.0.0.0
+
+# Node.js environment mode (default: development)
+# Set to 'production' for deployments to hide error stack traces
+# NOTE: Do NOT set this in .env during build/preview with Vite as it causes errors
+# NODE_ENV=production
+
+
+# ============================================================================
+# OPTIONAL: Request Body Size Limit (Important for NODE deployment)
+# ============================================================================
+# Global cap enforced by adapter-node for every route. Sized to the largest
+# legitimate payload — a big .gh upload plus an image:
+#
+#   BODY_SIZE_LIMIT=150M
+#
+# Smaller per-route caps live next to the route handlers (e.g.
+# `COMPUTE_REQUEST_MAX_BYTES` in /api/compute) and are enforced via
+# `Content-Length` before the body is read. Don't set this to "Infinity" in
+# production — every JSON endpoint inherits the global cap, and an
+# unbounded body is a DoS vector on every route that doesn't have its own.
+#
+# Supports a single-letter suffix (K / M / G, case-insensitive) or a raw
+# byte count. NOTE: adapter-node only checks the *last* character — "60mb"
+# is parsed as the digits "60m" (= 60 MB by accident) and "Infinity" throws
+# on boot. Use "150M" or the raw byte count "157286400" to be unambiguous.
+#
+# NOTE: If you change this value and are using PM2, restart with --update-env:
+#   pm2 restart selva-compute --update-env
+#
+BODY_SIZE_LIMIT=150M
+
+
+# ============================================================================
+# OPTIONAL: Compute limits (single source of truth: lib/server/computeLimits.ts)
+# ============================================================================
+# All knobs below are read by `computeLimits.ts` on boot. Defaults are sized
+# for typical interactive use; tune only when real traffic warrants it.
+#
+# Maximum solve duration. Single source of truth for "how long can one solve
+# take". Server enforces it on /api/compute; the same value is forwarded to
+# the page so the browser's AbortController matches. NOTE: this only bounds
+# the parts of the stack we control. If you raise it past your reverse
+# proxy's read_timeout or your hosting platform's function cap, requests
+# will 502 at those layers regardless of this value — bump those configs
+# in lockstep when targeting long-running definitions.
+# MAX_SOLVE_DURATION_MS=60000
+#
+# Per-key rate limit on /api/compute (fixed window, in-process Map). Keyed by
+# user OR share-link, so anonymous link consumers don't share a bucket with
+# the link's owner. Default 120 / 60_000ms = 2 solves/sec sustained — well
+# above what a slider scrub produces with the client-side throttle.
+# COMPUTE_RATE_LIMIT_WINDOW_MS=60000
+# COMPUTE_RATE_LIMIT_MAX=120
+#
+# Upload caps (.gh and cover image). REMOTE_DEFINITION_MAX_BYTES tracks
+# MAX_GH_FILE_SIZE_BYTES so a remote URL can't smuggle past the upload cap.
+# MAX_GH_FILE_SIZE_BYTES=52428800       # 50 MB
+# MAX_IMAGE_FILE_SIZE_BYTES=10485760    # 10 MB
+#
+# /api/compute JSON body cap (inputs + values, NOT the .gh).
+# COMPUTE_REQUEST_MAX_BYTES=5242880     # 5 MB
+#
+# Remote-definition fetch deadline + cache TTL.
+# REMOTE_DEFINITION_FETCH_TIMEOUT_MS=30000
+# DEFINITION_CACHE_TTL_MS=300000        # 5 minutes
+
+
+# ============================================================================
+# REQUIRED when behind a reverse proxy (Caddy, nginx, etc.)
+# ============================================================================
+# SvelteKit's CSRF protection compares the request Origin header against this
+# value. Without it, form submissions through a proxy fail with
+# "Cross-site POST form submissions are forbidden".
+#
+# Set this to the public-facing URL of the app (no trailing slash):
+#   ORIGIN=https://your-domain.com
+#   ORIGIN=http://your-server-ip
+#
+# ORIGIN=https://your-domain.com
+
+
+# ============================================================================
+# OPTIONAL: Installation Directory for Updates
+# ============================================================================
+# Directory where the application is installed and where update.sh is located.
+# Used by the admin dashboard when triggering updates.
+# Defaults to current working directory if not set.
+#
+# INSTALL_DIR=/var/www/selva-compute

package/templates/ecosystem.config.cjs

@@ -0,0 +1,52 @@
+// PM2 process file — runtime template shipped with @selvajs/selva.
+//
+// Drop this into a deployment directory alongside selva.config.js and .env,
+// then `pm2 start ecosystem.config.cjs`.
+//
+// Runtime config is loaded from .env via Node's --env-file flag (Node >= 20.6).
+// PM2's own env_file option is silently ignored by `pm2 start` (only works
+// under pm2-runtime) — using --env-file via node_args avoids that footgun.
+//
+// SELVA_CONFIG_PATH points the runtime at the operator's compiled config.
+// Rhino.Compute server URL + API key are configured in /admin/compute.
+module.exports = {
+	apps: [
+		{
+			name: 'selva-compute',
+			script: './node_modules/@selvajs/selva/build/index.js',
+			cwd: '.',
+			node_args: '--env-file=.env',
+
+			// fork + 1 instance is required for the local provider — its JSON stores
+			// read-modify-write without file locking. Switch to instances: 'max',
+			// exec_mode: 'cluster' on Supabase or any provider with real concurrency
+			// control.
+			instances: 1,
+			exec_mode: 'fork',
+
+			autorestart: true,
+			watch: false,
+			max_memory_restart: '1G',
+
+			// kill_timeout: graceful-drain budget on restart. PM2 sends SIGINT to
+			// the SvelteKit server, which stops accepting new connections and
+			// waits for in-flight requests to finish. After this many ms, PM2
+			// escalates to SIGKILL. 10s is enough for most solves; bump if your
+			// definitions can run longer and you want them to complete during
+			// an update. The admin-update health probe runs AFTER this window,
+			// so raising kill_timeout extends update time but doesn't break it.
+			kill_timeout: 10000,
+			listen_timeout: 10000,
+			min_uptime: '30s',
+			max_restarts: 10,
+
+			log_date_format: 'YYYY-MM-DD HH:mm:ss Z',
+			merge_logs: true,
+
+			env: {
+				NODE_ENV: 'production',
+				SELVA_CONFIG_PATH: './selva.config.js'
+			}
+		}
+	]
+};