vela 0.14.1 → 0.14.3

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "vela",
-	"version": "0.14.1",
+	"version": "0.14.3",
 	"type": "module",
 	"description": "A CLI for creating and updating SvelteKit projects",
 	"license": "MIT",
@@ -36,7 +36,7 @@
 	"dependencies": {
 		"@clack/prompts": "^1.7.0",
 		"@faker-js/faker": "^10.6.0",
-		"@velastack/patterns": "^0.3.1",
+		"@velastack/patterns": "^0.3.2",
 		"@velastack/pocketbase-codegen": "^0.1.0",
 		"annotate-json-schema": "^0.1.0",
 		"commander": "^13.1.0",

package/templates/server/apply.sh

@@ -157,9 +157,9 @@ PB_PORT=$(printf '%s' "$PORTS" | jq -r .pb)
 PRIMARY_DOMAIN=$(printf '%s' "$DOMAIN" | cut -d, -f1 | tr -d ' ')
 [ -n "$PRIMARY_DOMAIN" ] || PRIMARY_DOMAIN=$(printf '%s' "$MANAGED" | cut -d, -f1 | tr -d ' ')
 if [ -n "$PRIMARY_DOMAIN" ]; then
-	ORIGIN="https://$PRIMARY_DOMAIN"
+	PRIMARY_URL="https://$PRIMARY_DOMAIN"
 else
-	ORIGIN="http://127.0.0.1:$WEB_PORT"
+	PRIMARY_URL="http://127.0.0.1:$WEB_PORT"
 fi
 
 # Production secrets live in $ETC/env and are managed only by `vela env`.
@@ -172,7 +172,7 @@ runtime_tmp=$(mktemp "$ETC/.runtime.XXXXXX")
 	printf 'NODE_ENV=production\n'
 	printf 'HOST=127.0.0.1\n'
 	printf 'PORT=%s\n' "$WEB_PORT"
-	printf 'ORIGIN=%s\n' "$ORIGIN"
+	runtime_origin_lines "$DOMAIN" "$PRIMARY_URL"
 	# Only an instance with a PocketBase gets pointed at one: a URL to a port
 	# nothing listens on is not a setting, it is a trap. Kept for one more
 	# deploy when the backend is being removed, so that a failed deploy can put
@@ -209,7 +209,7 @@ fi
 
 install_deps() {
 	local lock="$RELEASE_DIR/package-lock.json"
-	local key
+	local key foreign="" name
 	local -a install_cmd
 	# `--no-engine-strict`: vela projects set engine-strict for development, but a
 	# production install takes only `dependencies` - a dev tool that wants a newer
@@ -219,7 +219,13 @@ install_deps() {
 		key=$(sha256sum "$lock" | cut -c1-16)
 		install_cmd=(npm ci "${flags[@]}")
 	elif [ -f "$RELEASE_DIR/package.json" ]; then
-		key=$(sha256sum "$RELEASE_DIR/package.json" | cut -c1-16)
+		# A project pinned by pnpm, yarn or bun: npm cannot replay the lockfile, so
+		# this resolves afresh, but the key still follows it - a dependency bump
+		# that only touched the lockfile must not reuse the old tree.
+		for name in pnpm-lock.yaml yarn.lock bun.lock bun.lockb; do
+			if [ -f "$RELEASE_DIR/$name" ]; then foreign="$RELEASE_DIR/$name"; break; fi
+		done
+		key=$(cat "$RELEASE_DIR/package.json" ${foreign:+"$foreign"} | sha256sum | cut -c1-16)
 		install_cmd=(npm install "${flags[@]}")
 	else
 		log "no package.json in release - skipping dependency install"
@@ -233,6 +239,20 @@ install_deps() {
 		mkdir -p "$deps"
 		cp "$RELEASE_DIR/package.json" "$deps/"
 		if [ -f "$lock" ]; then cp "$lock" "$deps/"; fi
+		# npm reads a yarn.lock beside package.json for resolution hints.
+		if [ "${foreign##*/}" = "yarn.lock" ]; then cp "$foreign" "$deps/"; fi
+		# `prepare` is a development hook (`svelte-kit sync`, husky) whose tools
+		# are devDependencies, which are not installed here: it can only print
+		# "svelte-kit: not found". Dependencies' own install scripts still run.
+		node -e '
+			const fs = require("fs");
+			const file = process.argv[1];
+			const pkg = JSON.parse(fs.readFileSync(file, "utf8"));
+			if (pkg.scripts && pkg.scripts.prepare) {
+				delete pkg.scripts.prepare;
+				fs.writeFileSync(file, JSON.stringify(pkg, null, 2) + "\n");
+			}
+		' "$deps/package.json" || die "could not read package.json"
 		if [ -f "$RELEASE_DIR/.npmrc" ]; then cp "$RELEASE_DIR/.npmrc" "$deps/"; fi
 		chown -R "$VELA_USER:$VELA_USER" "$deps"
 		# npm needs a writable HOME and cache; $VELA_ROOT itself stays root-owned
@@ -392,7 +412,7 @@ fi
 log "starting app on 127.0.0.1:$WEB_PORT"
 systemctl enable "$WEB_UNIT" >/dev/null 2>&1 || true
 systemctl restart "$WEB_UNIT"
-wait_for_http "http://127.0.0.1:$WEB_PORT$HEALTH_PATH" 60 0.5 \
+wait_for_http "http://127.0.0.1:$WEB_PORT$HEALTH_PATH" 60 0.5 "$PRIMARY_DOMAIN" \
 	|| die "app did not become healthy at $HEALTH_PATH - journalctl -u $WEB_UNIT"
 
 ACTIVATED=1
@@ -411,7 +431,7 @@ fi
 state_merge "$INSTANCE" "$(jq -c -n \
 	--arg app "$APP_ID" --arg name "$APP_NAME" --arg env "$ENV_TAG" \
 	--arg instance "$INSTANCE" --arg release "$RELEASE" --arg previous "$PREVIOUS" \
-	--arg domain "$DOMAIN" --arg managed "$MANAGED" --arg url "$ORIGIN" \
+	--arg domain "$DOMAIN" --arg managed "$MANAGED" --arg url "$PRIMARY_URL" \
 	--arg health "$HEALTH_PATH" --arg pb "$PB_VERSION" \
 	--arg sha "$GIT_SHA" --arg at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
 	--argjson web "$WEB_PORT" --argjson pbport "$PB_PORT" --argjson backend "$BACKEND" \
@@ -510,6 +530,6 @@ fi
 
 emit_result \
 	--arg instance "$INSTANCE" --arg release "$RELEASE" --arg domain "$DOMAIN" --arg managed "$MANAGED" \
-	--arg url "$ORIGIN" --argjson web "$WEB_PORT" --argjson pb "$PB_PORT" --argjson su "$SU_CREATED" \
+	--arg url "$PRIMARY_URL" --argjson web "$WEB_PORT" --argjson pb "$PB_PORT" --argjson su "$SU_CREATED" \
 	'{instance: $instance, release: $release, domain: $domain, managed: $managed, url: $url,
 	  webPort: $web, pbPort: $pb, superuserCreated: ($su == 1)}'

package/templates/server/lib.sh

@@ -171,11 +171,17 @@ unit_active() { systemctl is-active --quiet "$1"; }
 # a health path behind auth). A 404 is not that: it is what a wrong
 # --health-path or a route that never mounted looks like, and it used to pass.
 # No `-f`: curl has to report the status of an error response, not fail on it.
+#
+# A fourth argument is the public host to ask as, the way Caddy would. An app
+# serving several hosts has no pinned ORIGIN and tells its sites apart by
+# `Host`; asked as 127.0.0.1 it may rightly answer that it serves no such site.
 wait_for_http() {
-	local url=$1 attempts=${2:-60} delay=${3:-0.5} code
+	local url=$1 attempts=${2:-60} delay=${3:-0.5} host=${4:-} code
 	local i=0
+	local -a as=()
+	[ -z "$host" ] || as=(-H "Host: $host" -H 'X-Forwarded-Proto: https')
 	while [ "$i" -lt "$attempts" ]; do
-		code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 5 "$url" 2>/dev/null || echo 000)
+		code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 5 ${as[@]+"${as[@]}"} "$url" 2>/dev/null || echo 000)
 		case "$code" in
 			2*|3*|401|403) return 0 ;;
 		esac
@@ -185,6 +191,43 @@ wait_for_http() {
 	return 1
 }
 
+# The public host an instance's health check should ask as: the host of the
+# `url` its last deploy recorded, or nothing for an instance no domain points
+# at (whose url is its own loopback address).
+#
+# usage: state_primary_host <instance>
+state_primary_host() {
+	local url
+	url=$(state_get "$1" url 2>/dev/null) || return 0
+	case "$url" in
+		https://*) url=${url#https://}; printf '%s' "${url%%/*}" ;;
+	esac
+}
+
+# The lines of runtime.env that tell adapter-node what origin a request has.
+#
+# One served host: pin it with ORIGIN, so nothing a client sends can change
+# what the app believes its own address is. Several hosts served directly
+# (velastack.dev and velabase.dev from one app) cannot share an ORIGIN - the
+# second host would render as the first and have its form posts refused as
+# cross-site - so the origin comes from the request instead: `Host`, which
+# Caddy passes through and only ever for the names in this instance's site
+# block, and the scheme from the X-Forwarded-Proto Caddy sets itself.
+#
+# Managed velastack.app names do not count: beside a direct host they redirect
+# at the edge rather than being served.
+#
+# usage: runtime_origin_lines <direct_hosts_csv> <primary_url>
+runtime_origin_lines() {
+	local direct=$1 primary_url=$2 count
+	count=$(printf '%s' "$direct" | tr ',' '\n' | sed 's/^ *//; s/ *$//' | grep -c -v '^$' || true)
+	if [ "$count" -gt 1 ]; then
+		printf 'PROTOCOL_HEADER=x-forwarded-proto\n'
+	else
+		printf 'ORIGIN=%s\n' "$primary_url"
+	fi
+}
+
 # How many migrations the current release has that the target release does not.
 # PocketBase reverts by count, so this is what `migrate down` needs.
 migrations_ahead() {

package/templates/server/restore.sh

@@ -220,7 +220,7 @@ assert_superuser_auth "$PB_PORT" "$SU_EMAIL" "$SU_PASSWORD" \
 
 log "starting app on 127.0.0.1:$WEB_PORT"
 systemctl start "$WEB_UNIT"
-wait_for_http "http://127.0.0.1:$WEB_PORT$HEALTH_PATH" 60 0.5 \
+wait_for_http "http://127.0.0.1:$WEB_PORT$HEALTH_PATH" 60 0.5 "$(state_primary_host "$INSTANCE")" \
 	|| die "app did not become healthy at $HEALTH_PATH - journalctl -u $WEB_UNIT"
 
 RESTORED=1

package/templates/server/rollback.sh

@@ -74,7 +74,7 @@ if [ "$BACKEND" = "true" ]; then
 		|| die "PocketBase did not become healthy after rollback"
 fi
 systemctl restart "$WEB_UNIT"
-wait_for_http "http://127.0.0.1:$WEB_PORT$HEALTH_PATH" 60 0.5 \
+wait_for_http "http://127.0.0.1:$WEB_PORT$HEALTH_PATH" 60 0.5 "$(state_primary_host "$INSTANCE")" \
 	|| die "app did not become healthy after rollback"
 
 state_merge "$INSTANCE" "$(jq -c -n --arg t "$TARGET" --arg c "$CURRENT" \

package/templates/static/vite.config.ts

@@ -3,6 +3,14 @@ import tailwindcss from '@tailwindcss/vite';
 import { sveltekit } from '@sveltejs/kit/vite';
 import adapter from '@sveltejs/adapter-static';
 
+/**
+ * The footer links to these before they exist; `vela legal privacy` and
+ * `vela legal terms` generate them. Prerendering crawls every link and fails
+ * the build on a 404, so a project would not build until both were written.
+ * Once generated they prerender like any other page.
+ */
+const PENDING_LEGAL_ROUTES = ['/privacy', '/terms'];
+
 export default defineConfig({
 	plugins: [
 		tailwindcss(),
@@ -14,7 +22,14 @@ export default defineConfig({
 			adapter: adapter({
 				fallback: '200.html'
 			}),
-			...(process.env.VELA_ORIGIN ? { prerender: { origin: process.env.VELA_ORIGIN } } : {})
+			prerender: {
+				// Every other broken link still fails the build.
+				handleHttpError: ({ path, status, message }) => {
+					if (status === 404 && PENDING_LEGAL_ROUTES.includes(path)) return;
+					throw new Error(message);
+				},
+				...(process.env.VELA_ORIGIN ? { origin: process.env.VELA_ORIGIN } : {})
+			}
 		})
 	]
 });