@selvajs/supabase-provider 0.16.1-beta.1 → 0.16.1-beta.3

package/README.md

@@ -34,7 +34,10 @@ Runs the Selva backend against **either** a managed Supabase project (production
 
 All env vars are documented in [`packages/selva/.env.example`](../../selva/.env.example) — copy that file to `.env` and edit it. The Supabase provider needs `SUPABASE_URL`, `SUPABASE_ANON_KEY`, and `SUPABASE_SERVICE_ROLE_KEY`; the optional bucket / private-URL / signup overrides are also listed there.
 
-`SELVA_HMAC_KEY` is not used for sessions by the Supabase provider — those are Supabase JWTs. It's still consulted as the fallback secret for share-link / invite token hashing if `SHARE_LINK_SECRET` / `INVITE_TOKEN_SECRET` are unset. `SELVA_AT_REST_KEY` is local-provider-only and is ignored. Both are harmless if left set.
+Both `SELVA_*` keys are still required under this provider, for narrower jobs than under the local provider:
+
+- `SELVA_HMAC_KEY` — **not** used for sessions here (those are Supabase JWTs), but still hashes share-link and invite tokens before they're stored.
+- `SELVA_AT_REST_KEY` — encrypts `compute_servers.api_key` before it reaches the database. `SupabaseDataProvider` refuses to construct without it.
 
 Rhino.Compute URL + API key are configured in `/admin/compute` and persisted in the `compute_config` table — unchanged by the provider choice.
 
@@ -116,7 +119,7 @@ npx supabase db diff
 npx supabase db push
 ```
 
-Alternatively you can copy each `.sql` file into Supabase Dashboard → **SQL Editor** and run them in order. The CLI path is strongly preferred — it's idempotent and version-controlled.
+Alternatively you can copy each `.sql` file into Supabase Dashboard → **SQL Editor** and run them in order. The CLI path is strongly preferred: it tracks which migrations already ran, so re-running it is safe, and the files stay under version control.
 
 ### Exposing the `selva` schema to PostgREST
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@selvajs/supabase-provider",
-  "version": "0.16.1-beta.1",
+  "version": "0.16.1-beta.3",
   "description": "Supabase (Auth + Postgres + Storage) implementations of @selvajs/platform interfaces",
   "license": "MIT",
   "author": "VektorNode",
@@ -32,26 +32,32 @@
   },
   "exports": {
     ".": {
+      "selva-source": "./src/index.ts",
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
     "./auth": {
+      "selva-source": "./src/auth/index.ts",
       "types": "./dist/auth/index.d.ts",
       "import": "./dist/auth/index.js"
     },
     "./data": {
+      "selva-source": "./src/data/index.ts",
       "types": "./dist/data/index.d.ts",
       "import": "./dist/data/index.js"
     },
     "./storage": {
+      "selva-source": "./src/storage/index.ts",
       "types": "./dist/storage/index.d.ts",
       "import": "./dist/storage/index.js"
     },
     "./permissions": {
+      "selva-source": "./src/permissions/index.ts",
       "types": "./dist/permissions/index.d.ts",
       "import": "./dist/permissions/index.js"
     },
     "./userProfile": {
+      "selva-source": "./src/userProfile/index.ts",
       "types": "./dist/userProfile/index.d.ts",
       "import": "./dist/userProfile/index.js"
     }
@@ -66,13 +72,14 @@
   "dependencies": {
     "@supabase/supabase-js": "^2.111.0",
     "sharp": "^0.35.3",
-    "@selvajs/platform": "^0.16.1-beta.0"
+    "@selvajs/platform": "^0.16.1-beta.2"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",
     "supabase": "^2.110.0",
     "typescript": "~6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.10",
+    "@selvajs/config": "0.0.3"
   },
   "scripts": {
     "build": "tsc",

package/supabase/migrations/20260425155514_selva_initial.sql

@@ -744,7 +744,7 @@ with check (
 -- Invite tokens are HMAC-hashed at the route layer (the selva app's
 -- `lib/server/invites/token.server.ts`) before reaching the store — the raw
 -- token is shown to the admin once and never persisted. A DB-only leak
--- therefore can't be replayed without the instance's INVITE_TOKEN_SECRET.
+-- therefore can't be replayed without the instance's SELVA_HMAC_KEY.
 -- Mirrors the share-link design (`share_links.token_hash`).
 create table if not exists selva.invites (
 	id uuid primary key,
@@ -965,7 +965,7 @@ with check (selva.is_instance_admin());
 -- 10. share_links (spec §7)
 --
 -- Per-definition tokens granting unauthenticated access to one
--- (definitionId, channel). token_hash is HMAC(SHARE_LINK_SECRET, raw); the
+-- (definitionId, channel). token_hash is HMAC(SELVA_HMAC_KEY, raw); the
 -- raw token is shown to the minter once at creation.
 -- ============================================================================