vela 0.15.9 → 0.15.11

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "vela",
-	"version": "0.15.9",
+	"version": "0.15.11",
 	"type": "module",
 	"description": "A CLI for creating and updating SvelteKit projects",
 	"license": "MIT",
@@ -50,7 +50,7 @@
 		"package-manager-detector": "^1.8.0",
 		"picocolors": "^1.1.1",
 		"pocketbase": "^0.28.0",
-		"pocketbase-server": "^0.40.6-beta.3",
+		"pocketbase-server": "^0.40.6-beta.4",
 		"stripe": "^22.6.2",
 		"sv": "~1.1.1",
 		"svelte": "^5.56.10",

package/templates/server/apply.sh

@@ -253,17 +253,25 @@ fi
 # pin the same dependencies: redeploys of unchanged dependencies skip the
 # install entirely, and a rollback still finds the tree its own lockfile
 # described.
+#
+# The key also carries the Node ABI and npm's major. Native modules
+# (better-sqlite3, argon2) are compiled for one ABI, so a tree installed before
+# `vela provision` moved Node to a new major would fail to load after it; and
+# npm majors disagree on what a lockfile has to contain. Either change installs
+# afresh.
 
 install_deps() {
 	local lock="$RELEASE_DIR/package-lock.json"
-	local key foreign="" name
+	local key foreign="" name runtime
 	local -a install_cmd
+	runtime="abi$(node -p process.versions.modules 2>/dev/null)-npm$(npm -v 2>/dev/null | cut -d. -f1)"
+	[[ $runtime =~ ^abi[0-9]+-npm[0-9]+$ ]] || die "could not read the Node and npm versions ($runtime)"
 	# `--no-engine-strict`: vela projects set engine-strict for development, but a
 	# production install takes only `dependencies` - a dev tool that wants a newer
 	# Node than the server runs is not a reason to refuse the deploy.
 	local -a flags=(--omit=dev --no-audit --no-fund --no-engine-strict --loglevel=error)
 	if [ -f "$lock" ]; then
-		key=$(sha256sum "$lock" | cut -c1-16)
+		key=$({ printf '%s\n' "$runtime"; cat "$lock"; } | sha256sum | cut -c1-16)
 		install_cmd=(npm ci "${flags[@]}")
 	elif [ -f "$RELEASE_DIR/package.json" ]; then
 		# A project pinned by pnpm, yarn or bun: npm cannot replay the lockfile, so
@@ -272,7 +280,8 @@ install_deps() {
 		for name in pnpm-lock.yaml yarn.lock bun.lock bun.lockb; do
 			if [ -f "$RELEASE_DIR/$name" ]; then foreign="$RELEASE_DIR/$name"; break; fi
 		done
-		key=$(cat "$RELEASE_DIR/package.json" ${foreign:+"$foreign"} | sha256sum | cut -c1-16)
+		key=$({ printf '%s\n' "$runtime"; cat "$RELEASE_DIR/package.json" ${foreign:+"$foreign"}; } \
+			| sha256sum | cut -c1-16)
 		install_cmd=(npm install "${flags[@]}")
 	else
 		log "no package.json in release - skipping dependency install"
@@ -280,7 +289,11 @@ install_deps() {
 	fi
 
 	local deps="$APP/deps/$key"
-	if [ ! -d "$deps/node_modules" ]; then
+	# Written only once npm has finished: an install that died part-way leaves a
+	# node_modules behind, and the next deploy with the same key must not take
+	# it for a complete tree.
+	local done_marker="$deps/.vela-installed"
+	if [ ! -f "$done_marker" ]; then
 		log "installing dependencies ($key)"
 		rm -rf "$deps"
 		mkdir -p "$deps"
@@ -311,6 +324,7 @@ install_deps() {
 		( cd "$deps" && runuser -u "$VELA_USER" -- env \
 			HOME="$deps" npm_config_cache="$VELA_ROOT/cache/npm" \
 			"${install_cmd[@]}" >&2 8>&- ) || die "dependency install failed"
+		: > "$done_marker"
 	else
 		log "dependencies already installed ($key)"
 	fi

package/templates/server/provision.sh

@@ -12,8 +12,8 @@ SCRIPT_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 . "$SCRIPT_DIR/lib.sh"
 
 PB_VERSION=""
-# The Node line a server with none (or one older than 22) gets. One already on
-# 22 or later is upgraded within its own line instead; see install_node.
+# The Node line a server is brought up to: the one releases are built with. A
+# server already on a later major keeps it; see install_node.
 NODE_MAJOR=24
 CLI_VERSION="unknown"
 LAYOUT_VERSION=1
@@ -98,21 +98,31 @@ ensure_packages ca-certificates curl gnupg rsync unzip tar sqlite3 jq git
 # prebuild is unavailable, so the toolchain has to be here.
 ensure_packages build-essential python3
 
-# SvelteKit 3 and adapter-node 6 need Node 22.17, so that - not the major
-# alone - is what decides whether anything is installed. A server already on 22
-# or later but short of it (22.16 and earlier) is upgraded within its own line:
-# the apps it hosts were built and tested against that major, and the floor is
-# the only reason to move. Anything older, or no Node at all, gets NODE_MAJOR.
+# The server runs the Node major that releases are built with (NODE_MAJOR, the
+# action's default too), not merely one new enough to start them: npm ships with
+# Node, and the server's `npm ci` has to accept the lockfile the build's npm
+# wrote. npm 10 (Node 22) rejects some that npm 11 (Node 24) writes, as
+# "Missing: ... from lock file". SvelteKit 3 and adapter-node 6 also need 22.17,
+# which an explicit `--node-major 22` still has to reach within its line. A
+# server already on a later major than NODE_MAJOR is left alone.
+#
+# Moving a major leaves the hosted apps on dependencies compiled for the old
+# one. Their running processes keep working, but each needs a redeploy (which
+# installs afresh for the new ABI, see apply.sh) before it next restarts.
 install_node() {
 	local current=0 line=$NODE_MAJOR
-	if node_at_least 22 17; then
+	if command -v node >/dev/null 2>&1; then
+		current=$(node -p 'process.versions.node.split(".")[0]' 2>/dev/null || echo 0)
+	fi
+	if [ "$current" -ge "$line" ] 2>/dev/null && node_at_least 22 17; then
 		log "node $(node -v) already installed"
 		return 0
 	fi
-	if command -v node >/dev/null 2>&1; then
-		current=$(node -p 'process.versions.node.split(".")[0]' 2>/dev/null || echo 0)
-		if [ "$current" -ge 22 ] 2>/dev/null; then line=$current; fi
-		log "upgrading Node.js $(node -v) to the latest $line.x - vela apps need 22.17 or later"
+	if [ "$current" -gt 0 ] 2>/dev/null; then
+		log "upgrading Node.js $(node -v) to the latest $line.x - builds use $line"
+		if [ "$current" -lt "$line" ]; then
+			log "redeploy every app on this server now: their dependencies were installed for Node $current"
+		fi
 	else
 		log "installing Node.js $line"
 	fi
@@ -126,8 +136,9 @@ install_node() {
 	# A held package or another repository pinned above nodesource can leave the
 	# old version in place with apt reporting success. Caught here, it names the
 	# problem; caught by the next deploy, it would only name the symptom.
-	node_at_least 22 17 \
-		|| die "Node.js is $(node -v 2>/dev/null || echo 'missing') after installing $line.x - vela apps need 22.17 or later"
+	current=$(node -p 'process.versions.node.split(".")[0]' 2>/dev/null || echo 0)
+	{ [ "$current" -ge "$line" ] 2>/dev/null && node_at_least 22 17; } \
+		|| die "Node.js is $(node -v 2>/dev/null || echo 'missing') after installing $line.x - check for a held nodejs package or another repository pinned above nodesource"
 }
 install_node