@everystack/cli 0.2.12 → 0.2.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.12",
+  "version": "0.2.13",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "publishConfig": {
@@ -54,6 +54,7 @@
     "@aws-sdk/client-cloudwatch-logs": "3.1053.0",
     "@aws-sdk/client-lambda": "3.1053.0",
     "@aws-sdk/client-s3": "3.1053.0",
+    "@aws-sdk/client-ssm": "3.1053.0",
     "@aws-sdk/s3-request-presigner": "3.1053.0",
     "drizzle-orm": "0.41.0",
     "expo-updates": "55.0.21",
@@ -73,6 +74,9 @@
     "@aws-sdk/client-lambda": {
       "optional": true
     },
+    "@aws-sdk/client-ssm": {
+      "optional": true
+    },
     "expo-updates": {
       "optional": true
     },
@@ -90,6 +94,7 @@
     "@aws-sdk/client-cloudwatch-logs": "3.1053.0",
     "@aws-sdk/client-lambda": "3.1053.0",
     "@aws-sdk/client-s3": "3.1053.0",
+    "@aws-sdk/client-ssm": "3.1053.0",
     "@aws-sdk/s3-request-presigner": "3.1053.0",
     "@types/jest": "29.5.14",
     "@types/node": "22.19.18",

package/src/cli/commands/secrets.ts

@@ -0,0 +1,270 @@
+/**
+ * Secrets management — read/write SST secrets in AWS SSM Parameter Store.
+ *
+ * SST v3 stores secrets at: /sst/{appName}/{stage}/Secret/{name}/value
+ * These are SecureString parameters encrypted with the default KMS key.
+ *
+ * Full interop with `sst secret set/list` — same SSM paths, same encryption.
+ * Secrets set via `everystack secrets set` are readable by SST and vice versa.
+ *
+ * Requires IAM permissions: ssm:GetParametersByPath, ssm:GetParameter,
+ * ssm:PutParameter, ssm:DeleteParameter, kms:Decrypt, kms:Encrypt.
+ */
+
+import { step, success, fail, info, warn } from '../output.js';
+
+interface SecretsContext {
+  appName: string;
+  stage: string;
+  region: string;
+}
+
+async function resolveContext(flags: Record<string, string>): Promise<SecretsContext> {
+  const stage = flags.stage;
+  if (!stage) {
+    fail('--stage is required for secrets management');
+    info('Usage: everystack secrets list --stage <name>');
+    process.exit(1);
+  }
+
+  const { parseAppName } = await import('../discover.js');
+  const appName = await parseAppName();
+  const region = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';
+
+  return { appName, stage, region };
+}
+
+function ssmPath(ctx: SecretsContext, name?: string): string {
+  const base = `/sst/${ctx.appName}/${ctx.stage}/Secret`;
+  return name ? `${base}/${name}/value` : `${base}/`;
+}
+
+async function getSSM(region: string) {
+  const { SSMClient } = await import('@aws-sdk/client-ssm');
+  return new SSMClient({ region });
+}
+
+// ---------------------------------------------------------------------------
+// List
+// ---------------------------------------------------------------------------
+
+async function listSecrets(ctx: SecretsContext): Promise<void> {
+  step(`Loading secrets for ${ctx.appName}/${ctx.stage}...`);
+
+  const client = await getSSM(ctx.region);
+  const { GetParametersByPathCommand } = await import('@aws-sdk/client-ssm');
+
+  const names: string[] = [];
+  let nextToken: string | undefined;
+
+  do {
+    const response = await client.send(
+      new GetParametersByPathCommand({
+        Path: ssmPath(ctx),
+        Recursive: true,
+        WithDecryption: false, // Don't decrypt — we only need names
+        NextToken: nextToken,
+      }),
+    );
+
+    for (const param of response.Parameters || []) {
+      if (!param.Name) continue;
+      const parts = param.Name.split('/');
+      const secretIndex = parts.indexOf('Secret');
+      if (secretIndex >= 0 && secretIndex + 1 < parts.length) {
+        names.push(parts[secretIndex + 1]);
+      }
+    }
+
+    nextToken = response.NextToken;
+  } while (nextToken);
+
+  if (names.length === 0) {
+    info('No secrets found');
+    info(`Set one with: everystack secrets set KEY "value" --stage ${ctx.stage}`);
+    return;
+  }
+
+  success(`${names.length} secret(s):`);
+  for (const name of names.sort()) {
+    console.log(`  ${name}`);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Get
+// ---------------------------------------------------------------------------
+
+async function getSecret(ctx: SecretsContext, name: string): Promise<void> {
+  step(`Reading ${name}...`);
+
+  const client = await getSSM(ctx.region);
+  const { GetParameterCommand } = await import('@aws-sdk/client-ssm');
+
+  try {
+    const response = await client.send(
+      new GetParameterCommand({
+        Name: ssmPath(ctx, name),
+        WithDecryption: true,
+      }),
+    );
+
+    if (response.Parameter?.Value !== undefined) {
+      console.log(response.Parameter.Value);
+    } else {
+      fail(`Secret "${name}" has no value`);
+      process.exit(1);
+    }
+  } catch (err: any) {
+    if (err.name === 'ParameterNotFound') {
+      fail(`Secret "${name}" not found in stage "${ctx.stage}"`);
+      info(`Set it with: everystack secrets set ${name} "value" --stage ${ctx.stage}`);
+      process.exit(1);
+    }
+    throw err;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Set
+// ---------------------------------------------------------------------------
+
+async function setSecret(ctx: SecretsContext, name: string, value: string): Promise<void> {
+  step(`Setting ${name}...`);
+
+  const client = await getSSM(ctx.region);
+  const { PutParameterCommand } = await import('@aws-sdk/client-ssm');
+
+  await client.send(
+    new PutParameterCommand({
+      Name: ssmPath(ctx, name),
+      Value: value,
+      Type: 'SecureString',
+      Overwrite: true,
+    }),
+  );
+
+  success(`${name} set for stage "${ctx.stage}"`);
+}
+
+// ---------------------------------------------------------------------------
+// Remove
+// ---------------------------------------------------------------------------
+
+async function removeSecret(ctx: SecretsContext, name: string): Promise<void> {
+  step(`Removing ${name}...`);
+
+  const client = await getSSM(ctx.region);
+  const { DeleteParameterCommand } = await import('@aws-sdk/client-ssm');
+
+  try {
+    await client.send(
+      new DeleteParameterCommand({
+        Name: ssmPath(ctx, name),
+      }),
+    );
+    success(`${name} removed from stage "${ctx.stage}"`);
+  } catch (err: any) {
+    if (err.name === 'ParameterNotFound') {
+      warn(`Secret "${name}" not found in stage "${ctx.stage}" (already removed?)`);
+      return;
+    }
+    throw err;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Command entry point
+// ---------------------------------------------------------------------------
+
+export async function secretsCommand(
+  subcommand: string | undefined,
+  positionalArgs: string[],
+  flags: Record<string, string>,
+): Promise<void> {
+  if (!subcommand || subcommand === '--help' || subcommand === '-h') {
+    printSecretsHelp();
+    process.exit(0);
+  }
+
+  let ctx: SecretsContext;
+  try {
+    ctx = await resolveContext(flags);
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
+
+  try {
+    switch (subcommand) {
+      case 'list':
+        await listSecrets(ctx);
+        break;
+
+      case 'get': {
+        const name = positionalArgs[0];
+        if (!name) {
+          fail('Missing secret name');
+          info('Usage: everystack secrets get <name> --stage <stage>');
+          process.exit(1);
+        }
+        await getSecret(ctx, name);
+        break;
+      }
+
+      case 'set': {
+        const name = positionalArgs[0];
+        const value = positionalArgs[1];
+        if (!name || value === undefined) {
+          fail('Missing secret name or value');
+          info('Usage: everystack secrets set <name> <value> --stage <stage>');
+          process.exit(1);
+        }
+        await setSecret(ctx, name, value);
+        break;
+      }
+
+      case 'remove': {
+        const name = positionalArgs[0];
+        if (!name) {
+          fail('Missing secret name');
+          info('Usage: everystack secrets remove <name> --stage <stage>');
+          process.exit(1);
+        }
+        await removeSecret(ctx, name);
+        break;
+      }
+
+      default:
+        fail(`Unknown secrets subcommand: ${subcommand}`);
+        printSecretsHelp();
+        process.exit(1);
+    }
+  } catch (err: any) {
+    fail(err.message);
+    info('Ensure your IAM user/role has ssm:* and kms:Decrypt permissions.');
+    process.exit(1);
+  }
+}
+
+function printSecretsHelp(): void {
+  console.log(`
+everystack secrets — Manage SST secrets (SSM Parameter Store)
+
+Usage:
+  everystack secrets list              --stage <name>    List all secret names
+  everystack secrets get  <name>       --stage <name>    Print a secret value
+  everystack secrets set  <name> <value> --stage <name>  Set or update a secret
+  everystack secrets remove <name>     --stage <name>    Delete a secret
+
+Examples:
+  everystack secrets list --stage production
+  everystack secrets set MAPBOX_API_KEY "pk.abc123" --stage production
+  everystack secrets get JWT_SECRET --stage dev
+  everystack secrets remove OLD_KEY --stage dev
+
+Interop:
+  Secrets are stored at the same SSM path as \`sst secret set\`.
+  Both tools read and write the same values — full interop.
+`);
+}

package/src/cli/commands/update.ts

@@ -9,6 +9,7 @@ import { resolveConfig, type CliConfig } from '../config.js';
 import { uploadToS3, invokeAction } from '../aws.js';
 import { step, success, warn, fail, info } from '../output.js';
 import { exportApp } from '../utils/export.js';
+import { loadSstSecrets } from '../utils/secrets.js';
 import { walkDirectory } from '../utils/walk.js';
 
 export interface UpdateFlags {
@@ -24,7 +25,7 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
   // Signal publish context so app.config.js can detect it's not a dev session.
   // Without this, dotenv guards that skip .env.local for EAS_BUILD/EAS_UPDATE
   // don't know to skip for everystack update, causing local dev overrides
-  // (e.g. OUTBOUND_HOST=localhost → LAN IP) to leak into the manifest.
+  // (e.g. localhost overrides → LAN IP) to leak into the manifest.
   process.env.EVERYSTACK_UPDATE = '1';
 
   // Resolve ENVIRONMENT before app.config.js evaluation so the manifest
@@ -58,6 +59,33 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
     } catch {
       // Stage may not be deployed yet — HOST_URL falls back to loadSstOutputs
     }
+
+    // Load SST secrets for this stage and inject into process.env.
+    // This replaces .env.local during `everystack update` — same pattern
+    // as EAS injecting stored secrets during `eas update`.
+    // app.config.js merges { ...easInfo, ...process.env }, so these win.
+    try {
+      step('Loading SST secrets...');
+      const { parseAppName } = await import('../discover.js');
+      const appName = await parseAppName();
+      const region = resolvedConfig?.region
+        || process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';
+      const secrets = await loadSstSecrets({ appName, stage: flags.stage, region });
+      const names = Object.keys(secrets);
+      if (names.length > 0) {
+        for (const [key, value] of Object.entries(secrets)) {
+          process.env[key] ||= value;
+        }
+        success(`Loaded ${names.length} secrets: ${names.join(', ')}`);
+      } else {
+        info('No SST secrets found for this stage');
+      }
+    } catch (err: any) {
+      // Secret loading is best-effort — the user may not have SSM permissions
+      // or may not use SST secrets (e.g. env vars set manually).
+      warn(`Could not load SST secrets: ${err.message}`);
+      info('Set secrets with: pnpm sst secret set KEY "value" --stage ' + flags.stage);
+    }
   }
 
   const branch = flags.branch;

package/src/cli/index.ts

@@ -12,6 +12,7 @@ import { cachePurgeCommand } from './commands/cache.js';
 import { diagCommand } from './commands/diag.js';
 import { analyzeSSRCommand } from './commands/analyze.js';
 import { logsErrorsCommand, logsTailCommand, logsQueryCommand } from './commands/logs.js';
+import { secretsCommand } from './commands/secrets.js';
 import { fail } from './output.js';
 
 const args = process.argv.slice(2);
@@ -138,6 +139,22 @@ async function main() {
     case 'logs:query':
       await logsQueryCommand(flags);
       break;
+    case 'secrets': {
+      // secrets <subcommand> [positional...] [--flags]
+      // Extract positional args: everything after subcommand that isn't a flag or flag value
+      const sub = args[1] && !args[1].startsWith('-') ? args[1] : undefined;
+      const positional: string[] = [];
+      for (let i = 2; i < args.length; i++) {
+        if (args[i].startsWith('-')) {
+          // Skip flag and its value
+          if (args[i + 1] && !args[i + 1].startsWith('-')) i++;
+          continue;
+        }
+        positional.push(args[i]);
+      }
+      await secretsCommand(sub, positional, flags);
+      break;
+    }
     default:
       fail(`Unknown command: ${command}`);
       printHelp();
@@ -175,6 +192,10 @@ Usage:
   everystack channels list
   everystack channels create   --name <name> [--branch <name>]
   everystack channels edit     --name <name> --branch <name>
+  everystack secrets list      --stage <name>                       List all secret names
+  everystack secrets get       <name> --stage <name>                Print a secret value
+  everystack secrets set       <name> <value> --stage <name>        Set or update a secret
+  everystack secrets remove    <name> --stage <name>                Delete a secret
 
 Stage resolution:
   --stage <name>  Discover AWS resources for the given stage by querying AWS APIs.

package/src/cli/utils/secrets.ts

@@ -0,0 +1,64 @@
+/**
+ * Load SST secrets from AWS SSM Parameter Store.
+ *
+ * SST v3 stores secrets at: /sst/{appName}/{stage}/Secret/{name}/value
+ * These are SecureString parameters encrypted with the default KMS key.
+ *
+ * The CLI fetches all secrets for a stage and returns them as a flat
+ * key-value map. The caller injects them into process.env before
+ * expo export, so app.config.js picks them up via `...process.env`.
+ */
+
+export interface LoadSecretsOptions {
+  appName: string;
+  stage: string;
+  region: string;
+}
+
+/**
+ * Fetch all SST secrets for a given app + stage from SSM Parameter Store.
+ *
+ * Returns a map of { SECRET_NAME: decrypted_value }.
+ * Paginates automatically — SSM returns max 10 parameters per page.
+ *
+ * Requires IAM permissions: ssm:GetParametersByPath, kms:Decrypt.
+ */
+export async function loadSstSecrets(
+  options: LoadSecretsOptions,
+): Promise<Record<string, string>> {
+  const { SSMClient, GetParametersByPathCommand } = await import(
+    '@aws-sdk/client-ssm'
+  );
+
+  const client = new SSMClient({ region: options.region });
+  const prefix = `/sst/${options.appName}/${options.stage}/Secret/`;
+  const secrets: Record<string, string> = {};
+
+  let nextToken: string | undefined;
+  do {
+    const response = await client.send(
+      new GetParametersByPathCommand({
+        Path: prefix,
+        WithDecryption: true,
+        Recursive: true,
+        NextToken: nextToken,
+      }),
+    );
+
+    for (const param of response.Parameters || []) {
+      if (!param.Name || param.Value === undefined) continue;
+      // Path: /sst/{app}/{stage}/Secret/{NAME}/value → extract NAME
+      const parts = param.Name.split('/');
+      // parts: ['', 'sst', app, stage, 'Secret', NAME, 'value']
+      const secretIndex = parts.indexOf('Secret');
+      if (secretIndex >= 0 && secretIndex + 1 < parts.length) {
+        const name = parts[secretIndex + 1];
+        secrets[name] = param.Value;
+      }
+    }
+
+    nextToken = response.NextToken;
+  } while (nextToken);
+
+  return secrets;
+}