@everystack/cli 0.2.1 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/cli/commands/update.ts

@@ -5,7 +5,7 @@ import zlib from 'node:zlib';
 import { pipeline } from 'node:stream/promises';
 import { createWriteStream } from 'node:fs';
 import { spawn } from 'node:child_process';
-import { resolveConfig } from '../config.js';
+import { resolveConfig, type CliConfig } from '../config.js';
 import { uploadToS3, invokeAction } from '../aws.js';
 import { step, success, warn, fail, info } from '../output.js';
 import { exportApp, isDistStale } from '../utils/export.js';
@@ -20,6 +20,38 @@ export interface UpdateFlags {
 }
 
 export async function updateCommand(flags: UpdateFlags & Record<string, string>): Promise<void> {
+  // Signal publish context so app.config.js can detect it's not a dev session.
+  // Without this, dotenv guards that skip .env.local for EAS_BUILD/EAS_UPDATE
+  // don't know to skip for everystack update, causing local dev overrides
+  // (e.g. OUTBOUND_HOST=localhost → LAN IP) to leak into the manifest.
+  process.env.EVERYSTACK_UPDATE = '1';
+
+  // Propagate --stage to ENVIRONMENT before app.config.js evaluation.
+  // Without this, the manifest snapshots whatever the local shell has
+  // (often unset → 'development'), baking wrong API URLs and feature
+  // flags into the OTA update.  Only set if not already supplied.
+  if (flags.stage) {
+    process.env.ENVIRONMENT ||= flags.stage;
+  }
+
+  // When --stage is provided, resolve deployed config early so HOST_URL
+  // is correct before app.config.js evaluation and expo export.
+  // loadSstOutputs() reads .sst/outputs.json (last deploy, any stage)
+  // which may be from a different stage entirely.
+  let resolvedConfig: CliConfig | undefined;
+  if (flags.stage) {
+    try {
+      step('Resolving deployed config...');
+      resolvedConfig = await resolveConfig(flags.stage);
+      if (resolvedConfig.baseUrl) {
+        process.env.HOST_URL ||= resolvedConfig.baseUrl;
+      }
+      success(`Region: ${resolvedConfig.region}, Function: ${resolvedConfig.apiFunctionName}`);
+    } catch {
+      // Stage may not be deployed yet — HOST_URL falls back to loadSstOutputs
+    }
+  }
+
   const branch = flags.branch;
   const channel = flags.channel || branch || flags.stage || 'production';
   const message = flags.message || '';
@@ -82,15 +114,19 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
   // Mobile platforms — direct S3 upload + IAM-authed Lambda invoke (mirrors web path).
   // No HTTP publish endpoint, no shared bearer token, no WAF body-size limits.
   if (mobilePlatforms.length > 0) {
-    step('Resolving deployed config...');
-    let config;
-    try {
-      config = await resolveConfig(flags.stage);
-    } catch (err: any) {
-      fail(err.message);
-      process.exit(1);
+    let config: CliConfig;
+    if (resolvedConfig) {
+      config = resolvedConfig;
+    } else {
+      step('Resolving deployed config...');
+      try {
+        config = await resolveConfig(flags.stage);
+      } catch (err: any) {
+        fail(err.message);
+        process.exit(1);
+      }
+      success(`Region: ${config.region}, Function: ${config.apiFunctionName}`);
     }
-    success(`Region: ${config.region}, Function: ${config.apiFunctionName}`);
 
     for (const platform of mobilePlatforms) {
       const platformMetadata = metadata?.fileMetadata?.[platform];
@@ -197,16 +233,20 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
     if (!(await fileExists(routesJson))) {
       warn('Skipping web (no server export found — ensure app.json has "output": "server")');
     } else {
-      // Resolve SST config for direct AWS access
-      step('Resolving deployed config...');
-      let config;
-      try {
-        config = await resolveConfig(flags.stage);
-      } catch (err: any) {
-        fail(err.message);
-        process.exit(1);
+      // Resolve SST config for direct AWS access (reuse early resolution if available)
+      let config: CliConfig;
+      if (resolvedConfig) {
+        config = resolvedConfig;
+      } else {
+        step('Resolving deployed config...');
+        try {
+          config = await resolveConfig(flags.stage);
+        } catch (err: any) {
+          fail(err.message);
+          process.exit(1);
+        }
+        success(`Region: ${config.region}, Function: ${config.apiFunctionName}`);
       }
-      success(`Region: ${config.region}, Function: ${config.apiFunctionName}`);
 
       // 1. Create tar+brotli archive of server bundle
       step('Creating server bundle archive...');

package/src/cli/index.ts

@@ -38,10 +38,29 @@ function parseFlags(args: string[]): Record<string, string> {
  * Auto-detect HOST_URL from SST outputs.
  * SST writes .sst/outputs.json after every deploy with { routerUrl, apiUrl, ... }.
  * If HOST_URL isn't already set, use the routerUrl from the last deploy.
+ *
+ * When a stage is specified, checks the stage-specific cached config first.
+ * .sst/outputs.json reflects the last deploy (any stage) and may be wrong
+ * when publishing to a different stage.
  */
-async function loadSstOutputs(): Promise<void> {
+async function loadSstOutputs(stage?: string): Promise<void> {
   if (process.env.HOST_URL) return;
 
+  // When --stage is provided, try stage-specific cache first
+  if (stage) {
+    const stagePath = path.resolve('.sst', `outputs.${stage}.json`);
+    try {
+      const raw = await fs.readFile(stagePath, 'utf8');
+      const cached = JSON.parse(raw);
+      if (cached.routerUrl) {
+        process.env.HOST_URL = cached.routerUrl;
+        return;
+      }
+    } catch {
+      // No cached config for this stage — fall through to default
+    }
+  }
+
   const outputsPath = path.resolve('.sst', 'outputs.json');
   try {
     const raw = await fs.readFile(outputsPath, 'utf8');
@@ -63,7 +82,7 @@ async function main() {
   const flags = parseFlags(args.slice(1));
 
   // Auto-detect deployed URL from SST outputs
-  await loadSstOutputs();
+  await loadSstOutputs(flags.stage);
 
   switch (command) {
     case 'update':

package/src/handler/assets.ts

@@ -11,6 +11,21 @@ export async function handleAssets(request: Request, options: UpdatesHandlerOpti
     });
   }
 
+  // Redirect to a presigned S3 URL instead of proxying the bytes through Lambda.
+  // Lambda function URLs cap responses at 6 MB; Hermes bytecode bundles exceed that.
+  if (options.storage.presignGet) {
+    const presignedUrl = await options.storage.presignGet(key);
+    return new Response(null, {
+      status: 302,
+      headers: {
+        location: presignedUrl,
+        'cache-control': 'private, max-age=300',
+      },
+    });
+  }
+
+  // Fallback: direct streaming for non-S3 backends (local dev, filesystem).
+  // No Lambda payload limit applies in these environments.
   const result = await options.storage.get(key);
 
   if (!result) {

package/src/storage/index.ts

@@ -8,6 +8,8 @@ export interface StorageAdapter {
   delete(key: string): Promise<void>;
   /** Generate a presigned PUT URL. S3-only — returns null for other backends. */
   presignPut?(key: string, contentType: string, expiresIn?: number): Promise<string>;
+  /** Generate a presigned GET URL. S3-only — returns undefined for other backends. */
+  presignGet?(key: string, expiresIn?: number): Promise<string>;
 }
 
 export type StorageOptions =

package/src/storage/s3.ts

@@ -122,4 +122,14 @@ export class S3StorageAdapter implements StorageAdapter {
       ContentType: contentType,
     }), { expiresIn });
   }
+
+  async presignGet(key: string, expiresIn: number = 3600): Promise<string> {
+    const { GetObjectCommand } = await import('@aws-sdk/client-s3');
+    const { getSignedUrl } = await import('@aws-sdk/s3-request-presigner');
+    const client = await this.getClient();
+    return getSignedUrl(client, new GetObjectCommand({
+      Bucket: this.bucket,
+      Key: key,
+    }), { expiresIn });
+  }
 }