@everystack/cli 0.1.0

package/src/handler/publish-web.ts

@@ -0,0 +1,311 @@
+import crypto from 'crypto';
+import { eq, and } from 'drizzle-orm';
+import type { UpdatesHandlerOptions } from './types';
+import { opsItems, runs, buildArtifacts } from '../schema';
+import { sha256 } from './signing';
+import { checkAuth, jsonError, mirrorToDb, ensureChannelInStorage } from './helpers';
+
+// --- Presign endpoint ---
+
+interface PresignWebBody {
+  channel?: string;
+  branch?: string;
+  groupId?: string;
+  runtimeVersion: string;
+  clientAssetPaths?: string[];
+}
+
+/**
+ * POST /presign-web
+ *
+ * Authenticates, resolves channel + branch + group, generates presigned
+ * S3 PUT URLs for the server bundle archive and client assets. The CLI
+ * uploads directly to S3 using these URLs, then calls /register-web.
+ */
+export async function handlePresignWeb(request: Request, options: UpdatesHandlerOptions): Promise<Response> {
+  const authResult = await checkAuth(request, options);
+  if (authResult) return authResult;
+
+  let body: PresignWebBody;
+  try {
+    body = await request.json() as PresignWebBody;
+  } catch {
+    return jsonError(400, 'Invalid JSON body.');
+  }
+
+  if (!body.runtimeVersion) {
+    return jsonError(400, 'Missing runtimeVersion.');
+  }
+
+  if (!options.storage.presignPut) {
+    return jsonError(500, 'Storage backend does not support presigned URLs.');
+  }
+
+  // Determine branch name
+  const channelName = body.channel || options.defaultChannel || 'production';
+  const branchName = body.branch || channelName;
+
+  // Write/update channel metadata in S3
+  await ensureChannelInStorage(options.storage, channelName, branchName);
+
+  // Generate groupId locally or use provided one
+  let groupId = body.groupId || crypto.randomUUID();
+
+  // If groupId was provided and DB is available, validate it exists
+  if (body.groupId && options.db) {
+    const [existingGroup] = await options.db
+      .select()
+      .from(runs)
+      .where(and(
+        eq(runs.id, groupId),
+        eq(runs.type, 'release'),
+      ))
+      .limit(1);
+
+    if (!existingGroup) {
+      return jsonError(404, `Update group "${groupId}" not found.`);
+    }
+  }
+
+  // Generate identifiers
+  const updateId = sha256(`${channelName}:${body.runtimeVersion}:${Date.now()}`);
+  const storagePrefix = `releases/${branchName}/${body.runtimeVersion}/${groupId}/web`;
+  const bundleKey = `${storagePrefix}/bundle.tar.br`;
+
+  // Presign server bundle upload URL
+  const bundleUploadUrl = await options.storage.presignPut(bundleKey, 'application/x-tar+br');
+
+  // Presign client asset upload URLs
+  const clientAssetUploadUrls: Record<string, string> = {};
+  if (options.clientBundlesStorage?.presignPut && body.clientAssetPaths) {
+    for (const assetPath of body.clientAssetPaths) {
+      clientAssetUploadUrls[assetPath] = await options.clientBundlesStorage.presignPut(
+        assetPath,
+        guessMime(assetPath),
+      );
+    }
+  }
+
+  // Mirror channel + group to DB
+  await mirrorToDb(options.db, async () => {
+    // Find or create channel
+    let [channel] = await options.db
+      .select()
+      .from(opsItems)
+      .where(and(
+        eq(opsItems.type, 'release_channel'),
+        eq(opsItems.name, channelName),
+      ))
+      .limit(1);
+
+    if (!channel) {
+      const [newChannel] = await options.db
+        .insert(opsItems)
+        .values({
+          type: 'release_channel',
+          name: channelName,
+          status: 'active',
+          data: { branchRef: branchName },
+        })
+        .returning();
+      channel = newChannel;
+    }
+
+    // Map channel to branch if not already mapped
+    const channelData = (channel.data as Record<string, unknown>) || {};
+    if (!channelData.branchRef) {
+      await options.db
+        .update(opsItems)
+        .set({
+          data: { ...channelData, branchRef: branchName },
+          updatedAt: new Date(),
+        })
+        .where(eq(opsItems.id, channel.id))
+        .returning();
+    }
+
+    // Create group if new
+    if (!body.groupId) {
+      await options.db
+        .insert(runs)
+        .values({
+          id: groupId,
+          type: 'release',
+          name: null,
+          status: 'completed',
+          queuedAt: new Date(),
+          completedAt: new Date(),
+          data: {
+            branchRef: branchName,
+            message: null,
+          },
+        })
+        .returning();
+    }
+  });
+
+  return new Response(JSON.stringify({
+    bundleUploadUrl,
+    clientAssetUploadUrls,
+    storagePrefix,
+    bundleKey,
+    updateId,
+    channelName,
+    branchName,
+    groupId,
+  }), {
+    status: 200,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+// --- Register endpoint ---
+
+interface RegisterWebBody {
+  groupId: string;
+  runtimeVersion: string;
+  updateId: string;
+  storagePrefix: string;
+  message?: string;
+  channel?: string;
+}
+
+/**
+ * POST /register-web
+ *
+ * Called by the CLI after uploading the server bundle and client
+ * assets to S3. Writes release metadata to S3 and optionally mirrors to DB.
+ */
+export async function handleRegisterWeb(request: Request, options: UpdatesHandlerOptions): Promise<Response> {
+  const authResult = await checkAuth(request, options);
+  if (authResult) return authResult;
+
+  let body: RegisterWebBody;
+  try {
+    body = await request.json() as RegisterWebBody;
+  } catch {
+    return jsonError(400, 'Invalid JSON body.');
+  }
+
+  if (!body.groupId || !body.runtimeVersion || !body.updateId || !body.storagePrefix) {
+    return jsonError(400, 'Missing required fields: groupId, runtimeVersion, updateId, storagePrefix.');
+  }
+
+  // Verify the bundle archive exists in storage
+  const bundleKey = `${body.storagePrefix}/bundle.tar.br`;
+  const bundleExists = await options.storage.exists(bundleKey);
+  if (!bundleExists) {
+    return jsonError(400, 'Server bundle not found at expected location. Upload before registering.');
+  }
+
+  const createdAt = new Date().toISOString();
+
+  // Derive branch from storagePrefix: releases/{branch}/{rv}/{groupId}/web
+  const prefixParts = body.storagePrefix.split('/');
+  const branchName = prefixParts.length >= 2 ? prefixParts[1] : 'production';
+  const channelName = body.channel || branchName;
+
+  // Write web manifest to S3
+  const webManifest = {
+    updateId: body.updateId,
+    runtimeVersion: body.runtimeVersion,
+    platform: 'web',
+    storagePrefix: body.storagePrefix,
+    createdAt,
+  };
+  await options.storage.put(
+    `${body.storagePrefix}/manifest.json`,
+    Buffer.from(JSON.stringify(webManifest)),
+    'application/json',
+  );
+
+  // Write channel pointer manifest (mutable — points to latest versioned release)
+  // Unlike mobile which has per-runtimeVersion pointers ({channel}/{platform}/{rv}/manifest.json),
+  // web uses a single runtimeVersion-agnostic pointer ({channel}/web/manifest.json)
+  // because web SSR has no runtimeVersion header from the client.
+  const channelPointerKey = `${channelName}/web/manifest.json`;
+  await options.storage.put(
+    channelPointerKey,
+    Buffer.from(JSON.stringify(webManifest)),
+    'application/json',
+  );
+
+  // Write group metadata (merge platforms if meta.json already exists)
+  const groupMetaKey = prefixParts.slice(0, 4).join('/') + '/meta.json';
+  let platforms = ['web'];
+  try {
+    const existingMeta = await options.storage.get(groupMetaKey);
+    if (existingMeta) {
+      const parsed = JSON.parse(existingMeta.data.toString('utf8'));
+      if (Array.isArray(parsed.platforms)) {
+        const merged = new Set([...parsed.platforms, 'web']);
+        platforms = [...merged];
+      }
+    }
+  } catch { /* first platform for this group */ }
+
+  await options.storage.put(
+    groupMetaKey,
+    Buffer.from(JSON.stringify({
+      message: body.message || null,
+      branchRef: branchName,
+      platforms,
+      createdAt,
+    })),
+    'application/json',
+  );
+
+  // Mirror to DB
+  let releaseId: string | undefined;
+  await mirrorToDb(options.db, async () => {
+    const [release] = await options.db
+      .insert(buildArtifacts)
+      .values({
+        type: 'ota',
+        runId: body.groupId,
+        runtimeVersion: body.runtimeVersion,
+        platform: 'web',
+        s3Key: body.storagePrefix,
+        data: {
+          updateId: body.updateId,
+          metadata: { storagePrefix: body.storagePrefix },
+          isRollback: false,
+        },
+      })
+      .returning();
+    releaseId = release.id;
+  });
+
+  return new Response(JSON.stringify({
+    releaseId: releaseId || body.groupId,
+    updateId: body.updateId,
+    groupId: body.groupId,
+  }), {
+    status: 201,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+// --- Local helpers ---
+
+function guessMime(filePath: string): string {
+  const ext = filePath.split('.').pop()?.toLowerCase();
+  const map: Record<string, string> = {
+    js: 'application/javascript',
+    mjs: 'application/javascript',
+    json: 'application/json',
+    html: 'text/html',
+    css: 'text/css',
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    gif: 'image/gif',
+    svg: 'image/svg+xml',
+    webp: 'image/webp',
+    ttf: 'font/ttf',
+    woff: 'font/woff',
+    woff2: 'font/woff2',
+    map: 'application/json',
+  };
+  return map[ext || ''] || 'application/octet-stream';
+}

package/src/handler/publish.ts

@@ -0,0 +1,346 @@
+import crypto from 'crypto';
+import { eq, and } from 'drizzle-orm';
+import type { UpdatesHandlerOptions } from './types';
+import { opsItems, runs, buildArtifacts } from '../schema';
+import { sha256, sha256Base64Url, md5Hex } from './signing';
+import {
+  checkAuth,
+  jsonError,
+  mirrorToDb,
+  buildManifestJson,
+  ensureChannelInStorage,
+  type ManifestAssetRecord,
+} from './helpers';
+
+interface PublishBody {
+  channel?: string;
+  branch?: string;
+  groupId?: string;
+  runtimeVersion: string;
+  platform: string;
+  message?: string;
+  expoConfig?: Record<string, unknown>;
+  metadata: Record<string, unknown>;
+  assets: PublishAsset[];
+}
+
+interface PublishAsset {
+  path: string;
+  data: string; // base64-encoded
+  contentType: string;
+  fileExtension: string;
+  isLaunchAsset?: boolean;
+}
+
+/**
+ * Asset record produced AFTER assets have been uploaded to S3.
+ * Used by `registerMobileRelease` (called from CLI after direct S3 upload)
+ * and built internally by `handlePublish` (legacy HTTP path).
+ */
+export interface RegisterMobileAsset {
+  path: string;
+  s3Key: string;
+  contentHash: string;   // sha256, base64url
+  filename: string;      // md5, hex
+  mimeType: string;
+  fileExtension: string;
+  isLaunchAsset: boolean;
+  sizeBytes: number;
+}
+
+export interface RegisterMobileParams {
+  channel?: string;
+  branch?: string;
+  groupId?: string;
+  /** True when groupId refers to a pre-existing release run (skip insert, validate it exists). */
+  groupAlreadyExists?: boolean;
+  runtimeVersion: string;
+  platform: 'ios' | 'android';
+  message?: string;
+  expoConfig?: Record<string, unknown>;
+  metadata: Record<string, unknown>;
+  storagePrefix: string;
+  assets: RegisterMobileAsset[];
+}
+
+export interface RegisterMobileResult {
+  releaseId: string;
+  updateId: string;
+  channel: string;
+  branch: string;
+  groupId: string;
+  platform: string;
+  assetCount: number;
+}
+
+/**
+ * Register a mobile release whose assets have already been uploaded to S3.
+ *
+ * Writes the manifest, channel pointer, and group meta to S3, then optionally
+ * mirrors the release + asset records to the database. Used by both:
+ *   - `handlePublish` (HTTP /publish, legacy) — uploads assets, then calls this
+ *   - The example app's `register-mobile` onAction — CLI uploads via IAM/S3
+ *     directly, then invokes this through Lambda.
+ */
+export async function registerMobileRelease(
+  options: UpdatesHandlerOptions,
+  params: RegisterMobileParams,
+): Promise<RegisterMobileResult> {
+  const channelName = params.channel || options.defaultChannel || 'production';
+  const branchName = params.branch || channelName;
+  const createdAt = new Date().toISOString();
+  const callerProvidedGroup = params.groupAlreadyExists === true;
+  const groupId = params.groupId || crypto.randomUUID();
+  const basePath = options.basePath || '';
+
+  // Validate group if provided + DB available
+  if (callerProvidedGroup && options.db) {
+    const [existingGroup] = await options.db
+      .select()
+      .from(runs)
+      .where(and(
+        eq(runs.id, groupId),
+        eq(runs.type, 'release'),
+      ))
+      .limit(1);
+    if (!existingGroup) {
+      throw new Error(`Update group "${groupId}" not found.`);
+    }
+  }
+
+  const updateId = sha256(JSON.stringify(params.metadata));
+
+  const assetRecords: Array<ManifestAssetRecord & { sizeBytes: number }> =
+    params.assets.map(a => ({
+      s3Key: a.s3Key,
+      contentHash: a.contentHash,
+      filename: a.filename,
+      mimeType: a.mimeType,
+      fileExtension: a.fileExtension.startsWith('.') ? a.fileExtension : `.${a.fileExtension}`,
+      isLaunchAsset: a.isLaunchAsset,
+      sizeBytes: a.sizeBytes,
+    }));
+
+  const manifest = buildManifestJson(
+    updateId, params.runtimeVersion, createdAt, assetRecords,
+    params.expoConfig, options.baseUrl, basePath,
+  );
+  const manifestBuffer = Buffer.from(JSON.stringify(manifest), 'utf8');
+
+  // Versioned manifest
+  await options.storage.put(
+    `${params.storagePrefix}/manifest.json`,
+    manifestBuffer,
+    'application/json',
+  );
+
+  // Channel pointer
+  await options.storage.put(
+    `${channelName}/${params.platform}/${params.runtimeVersion}/manifest.json`,
+    manifestBuffer,
+    'application/json',
+  );
+
+  // Channel metadata
+  await ensureChannelInStorage(options.storage, channelName, branchName);
+
+  // Group meta (merge platforms across multi-platform publishes)
+  const groupMetaKey = `releases/${branchName}/${params.runtimeVersion}/${groupId}/meta.json`;
+  let platforms: string[] = [params.platform];
+  try {
+    const existingMeta = await options.storage.get(groupMetaKey);
+    if (existingMeta) {
+      const parsed = JSON.parse(existingMeta.data.toString('utf8'));
+      if (Array.isArray(parsed.platforms)) {
+        platforms = [...new Set([...parsed.platforms, params.platform])];
+      }
+    }
+  } catch { /* first platform for this group */ }
+
+  await options.storage.put(
+    groupMetaKey,
+    Buffer.from(JSON.stringify({
+      message: params.message || null,
+      branchRef: branchName,
+      platforms,
+      createdAt,
+    })),
+    'application/json',
+  );
+
+  // DB mirror — non-blocking, no-op without db
+  let releaseId: string | undefined;
+  await mirrorToDb(options.db, async () => {
+    let [channel] = await options.db
+      .select()
+      .from(opsItems)
+      .where(and(
+        eq(opsItems.type, 'release_channel'),
+        eq(opsItems.name, channelName),
+      ))
+      .limit(1);
+
+    if (!channel) {
+      const [newChannel] = await options.db
+        .insert(opsItems)
+        .values({
+          type: 'release_channel',
+          name: channelName,
+          status: 'active',
+          data: { branchRef: branchName },
+        })
+        .returning();
+      channel = newChannel;
+    }
+
+    const channelData = (channel.data as Record<string, unknown>) || {};
+    if (!channelData.branchRef) {
+      await options.db
+        .update(opsItems)
+        .set({
+          data: { ...channelData, branchRef: branchName },
+          updatedAt: new Date(),
+        })
+        .where(eq(opsItems.id, channel.id))
+        .returning();
+    }
+
+    if (!callerProvidedGroup) {
+      await options.db
+        .insert(runs)
+        .values({
+          id: groupId,
+          type: 'release',
+          name: params.message || null,
+          status: 'completed',
+          queuedAt: new Date(),
+          completedAt: new Date(),
+          data: {
+            branchRef: branchName,
+            message: params.message || null,
+          },
+        })
+        .returning();
+    }
+
+    const [release] = await options.db
+      .insert(buildArtifacts)
+      .values({
+        type: 'ota',
+        runId: groupId,
+        runtimeVersion: params.runtimeVersion,
+        platform: params.platform,
+        s3Key: params.storagePrefix,
+        data: {
+          updateId,
+          expoConfig: params.expoConfig || null,
+          metadata: params.metadata,
+          isRollback: false,
+        },
+      })
+      .returning();
+    releaseId = release.id;
+
+    for (const a of assetRecords) {
+      await options.db
+        .insert(buildArtifacts)
+        .values({
+          type: 'ota_asset',
+          runId: groupId,
+          s3Key: a.s3Key,
+          contentHash: a.contentHash,
+          filename: a.filename,
+          mimeType: a.mimeType,
+          sizeBytes: a.sizeBytes,
+          data: {
+            fileExtension: a.fileExtension,
+            isLaunchAsset: a.isLaunchAsset,
+          },
+        })
+        .returning();
+    }
+  });
+
+  return {
+    releaseId: releaseId || groupId,
+    updateId,
+    channel: channelName,
+    branch: branchName,
+    groupId,
+    platform: params.platform,
+    assetCount: assetRecords.length,
+  };
+}
+
+export async function handlePublish(request: Request, options: UpdatesHandlerOptions): Promise<Response> {
+  // Auth check
+  const authResult = await checkAuth(request, options);
+  if (authResult) return authResult;
+
+  // Parse body
+  let body: PublishBody;
+  try {
+    body = await request.json() as PublishBody;
+  } catch {
+    return jsonError(400, 'Invalid JSON body.');
+  }
+
+  // Validate required fields
+  if (!body.runtimeVersion) {
+    return jsonError(400, 'Missing runtimeVersion.');
+  }
+  if (!body.platform || !['ios', 'android', 'web'].includes(body.platform)) {
+    return jsonError(400, 'Invalid platform. Expected ios, android, or web.');
+  }
+  if (!body.metadata) {
+    return jsonError(400, 'Missing metadata.');
+  }
+  if (!body.assets || !Array.isArray(body.assets) || body.assets.length === 0) {
+    return jsonError(400, 'Missing or empty assets.');
+  }
+
+  const channelName = body.channel || options.defaultChannel || 'production';
+  const branchName = body.branch || channelName;
+  const groupId = body.groupId || crypto.randomUUID();
+  const storagePrefix = `releases/${branchName}/${body.runtimeVersion}/${groupId}/${body.platform}`;
+
+  // Upload assets to storage, building post-upload records
+  const uploadedAssets: RegisterMobileAsset[] = [];
+  for (const asset of body.assets) {
+    const data = Buffer.from(asset.data, 'base64');
+    const s3Key = `${storagePrefix}/${asset.path}`;
+    await options.storage.put(s3Key, data, asset.contentType);
+    uploadedAssets.push({
+      path: asset.path,
+      s3Key,
+      contentHash: sha256Base64Url(data),
+      filename: md5Hex(data),
+      mimeType: asset.contentType,
+      fileExtension: asset.fileExtension,
+      isLaunchAsset: asset.isLaunchAsset ?? false,
+      sizeBytes: data.length,
+    });
+  }
+
+  try {
+    const result = await registerMobileRelease(options, {
+      channel: body.channel,
+      branch: body.branch,
+      groupId,
+      groupAlreadyExists: !!body.groupId,
+      runtimeVersion: body.runtimeVersion,
+      platform: body.platform as 'ios' | 'android',
+      message: body.message,
+      expoConfig: body.expoConfig,
+      metadata: body.metadata,
+      storagePrefix,
+      assets: uploadedAssets,
+    });
+    return new Response(JSON.stringify(result), {
+      status: 201,
+      headers: { 'content-type': 'application/json' },
+    });
+  } catch (err: any) {
+    return jsonError(404, err?.message || 'Registration failed');
+  }
+}

package/src/handler/signing.ts

@@ -0,0 +1,29 @@
+import crypto from 'crypto';
+
+export function signRSASHA256(data: string, privateKey: string): string {
+  const sign = crypto.createSign('RSA-SHA256');
+  sign.update(data, 'utf8');
+  sign.end();
+  return sign.sign(privateKey, 'base64');
+}
+
+export function convertSHA256HashToUUID(hash: string): string {
+  return `${hash.slice(0, 8)}-${hash.slice(8, 12)}-${hash.slice(12, 16)}-${hash.slice(16, 20)}-${hash.slice(20, 32)}`;
+}
+
+export function convertToDictionaryItemsRepresentation(obj: Record<string, string>): any {
+  return new Map(Object.entries(obj).map(([k, v]) => [k, [v, new Map()]]));
+}
+
+export function sha256(data: string | Buffer): string {
+  return crypto.createHash('sha256').update(data).digest('hex');
+}
+
+export function sha256Base64Url(data: string | Buffer): string {
+  const base64 = crypto.createHash('sha256').update(data).digest('base64');
+  return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+export function md5Hex(data: string | Buffer): string {
+  return crypto.createHash('md5').update(data).digest('hex');
+}

package/src/handler/types.ts

@@ -0,0 +1,16 @@
+import type { StorageAdapter } from '../storage/index';
+
+export interface UpdatesHandlerOptions {
+  /** Drizzle DB instance. Optional — without it, only S3 flat-file manifests work. */
+  db?: any;
+  storage: StorageAdapter;
+  baseUrl: string;
+  basePath?: string;
+  auth?: {
+    verifyToken: (token: string) => Promise<Record<string, unknown> | null>;
+  };
+  privateKey?: string;
+  defaultChannel?: string;
+  /** Storage adapter for client bundles (JS/CSS/images served via CloudFront). */
+  clientBundlesStorage?: StorageAdapter;
+}

package/src/index.ts

@@ -0,0 +1,4 @@
+export { createUpdatesHandler } from './handler/index';
+export { createStorage } from './storage/index';
+export type { StorageAdapter, StorageOptions } from './storage/index';
+export type { UpdatesHandlerOptions } from './handler/types';