@everystack/cli 0.2.12 → 0.2.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.12",
+  "version": "0.2.14",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "publishConfig": {
@@ -54,6 +54,7 @@
     "@aws-sdk/client-cloudwatch-logs": "3.1053.0",
     "@aws-sdk/client-lambda": "3.1053.0",
     "@aws-sdk/client-s3": "3.1053.0",
+    "@aws-sdk/client-ssm": "3.1053.0",
     "@aws-sdk/s3-request-presigner": "3.1053.0",
     "drizzle-orm": "0.41.0",
     "expo-updates": "55.0.21",
@@ -73,6 +74,9 @@
     "@aws-sdk/client-lambda": {
       "optional": true
     },
+    "@aws-sdk/client-ssm": {
+      "optional": true
+    },
     "expo-updates": {
       "optional": true
     },
@@ -90,6 +94,7 @@
     "@aws-sdk/client-cloudwatch-logs": "3.1053.0",
     "@aws-sdk/client-lambda": "3.1053.0",
     "@aws-sdk/client-s3": "3.1053.0",
+    "@aws-sdk/client-ssm": "3.1053.0",
     "@aws-sdk/s3-request-presigner": "3.1053.0",
     "@types/jest": "29.5.14",
     "@types/node": "22.19.18",

package/src/cli/commands/secrets.ts

@@ -0,0 +1,209 @@
+/**
+ * Secrets management — read/write SST Ion secrets.
+ *
+ * SST Ion stores secrets as AES-256-GCM encrypted JSON in S3:
+ *   Bucket: sst-state-{random} (resolved from /sst/bootstrap SSM param)
+ *   Key:    secret/{appName}/{stage}.json
+ *
+ * The encryption passphrase lives in SSM at /sst/passphrase/{appName}/{stage}.
+ *
+ * Full interop with `sst secret set/list` — same S3 objects, same encryption.
+ * Secrets set via `everystack secrets set` are readable by SST and vice versa.
+ *
+ * Requires IAM permissions: ssm:GetParameter, s3:GetObject, s3:PutObject, kms:Decrypt.
+ */
+
+import { step, success, fail, info, warn } from '../output.js';
+import { loadSstSecrets, putSstSecrets } from '../utils/secrets.js';
+
+interface SecretsContext {
+  appName: string;
+  stage: string;
+  region: string;
+}
+
+async function resolveContext(flags: Record<string, string>): Promise<SecretsContext> {
+  const stage = flags.stage;
+  if (!stage) {
+    fail('--stage is required for secrets management');
+    info('Usage: everystack secrets list --stage <name>');
+    process.exit(1);
+  }
+
+  const { parseAppName } = await import('../discover.js');
+  const appName = await parseAppName();
+  const region = process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';
+
+  return { appName, stage, region };
+}
+
+// ---------------------------------------------------------------------------
+// List
+// ---------------------------------------------------------------------------
+
+async function listSecrets(ctx: SecretsContext): Promise<void> {
+  step(`Loading secrets for ${ctx.appName}/${ctx.stage}...`);
+
+  const secrets = await loadSstSecrets(ctx);
+  const names = Object.keys(secrets).sort();
+
+  if (names.length === 0) {
+    info('No secrets found');
+    info(`Set one with: everystack secrets set KEY "value" --stage ${ctx.stage}`);
+    return;
+  }
+
+  success(`${names.length} secret(s):`);
+  for (const name of names) {
+    console.log(`  ${name}`);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Get
+// ---------------------------------------------------------------------------
+
+async function getSecret(ctx: SecretsContext, name: string): Promise<void> {
+  step(`Reading ${name}...`);
+
+  const secrets = await loadSstSecrets(ctx);
+  const value = secrets[name];
+
+  if (value !== undefined) {
+    console.log(value);
+  } else {
+    fail(`Secret "${name}" not found in stage "${ctx.stage}"`);
+    info(`Set it with: everystack secrets set ${name} "value" --stage ${ctx.stage}`);
+    process.exit(1);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Set
+// ---------------------------------------------------------------------------
+
+async function setSecret(ctx: SecretsContext, name: string, value: string): Promise<void> {
+  step(`Setting ${name}...`);
+
+  // Load existing secrets, merge, and write back
+  const secrets = await loadSstSecrets(ctx);
+  secrets[name] = value;
+  await putSstSecrets(ctx, secrets);
+
+  success(`${name} set for stage "${ctx.stage}"`);
+}
+
+// ---------------------------------------------------------------------------
+// Remove
+// ---------------------------------------------------------------------------
+
+async function removeSecret(ctx: SecretsContext, name: string): Promise<void> {
+  step(`Removing ${name}...`);
+
+  const secrets = await loadSstSecrets(ctx);
+  if (!(name in secrets)) {
+    warn(`Secret "${name}" not found in stage "${ctx.stage}" (already removed?)`);
+    return;
+  }
+
+  delete secrets[name];
+  await putSstSecrets(ctx, secrets);
+
+  success(`${name} removed from stage "${ctx.stage}"`);
+}
+
+// ---------------------------------------------------------------------------
+// Command entry point
+// ---------------------------------------------------------------------------
+
+export async function secretsCommand(
+  subcommand: string | undefined,
+  positionalArgs: string[],
+  flags: Record<string, string>,
+): Promise<void> {
+  if (!subcommand || subcommand === '--help' || subcommand === '-h') {
+    printSecretsHelp();
+    process.exit(0);
+  }
+
+  let ctx: SecretsContext;
+  try {
+    ctx = await resolveContext(flags);
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
+
+  try {
+    switch (subcommand) {
+      case 'list':
+        await listSecrets(ctx);
+        break;
+
+      case 'get': {
+        const name = positionalArgs[0];
+        if (!name) {
+          fail('Missing secret name');
+          info('Usage: everystack secrets get <name> --stage <stage>');
+          process.exit(1);
+        }
+        await getSecret(ctx, name);
+        break;
+      }
+
+      case 'set': {
+        const name = positionalArgs[0];
+        const value = positionalArgs[1];
+        if (!name || value === undefined) {
+          fail('Missing secret name or value');
+          info('Usage: everystack secrets set <name> <value> --stage <stage>');
+          process.exit(1);
+        }
+        await setSecret(ctx, name, value);
+        break;
+      }
+
+      case 'remove': {
+        const name = positionalArgs[0];
+        if (!name) {
+          fail('Missing secret name');
+          info('Usage: everystack secrets remove <name> --stage <stage>');
+          process.exit(1);
+        }
+        await removeSecret(ctx, name);
+        break;
+      }
+
+      default:
+        fail(`Unknown secrets subcommand: ${subcommand}`);
+        printSecretsHelp();
+        process.exit(1);
+    }
+  } catch (err: any) {
+    fail(err.message);
+    info('Ensure your IAM user/role has ssm:GetParameter, s3:GetObject, and kms:Decrypt permissions.');
+    process.exit(1);
+  }
+}
+
+function printSecretsHelp(): void {
+  console.log(`
+everystack secrets — Manage SST Ion secrets
+
+Usage:
+  everystack secrets list              --stage <name>    List all secret names
+  everystack secrets get  <name>       --stage <name>    Print a secret value
+  everystack secrets set  <name> <value> --stage <name>  Set or update a secret
+  everystack secrets remove <name>     --stage <name>    Delete a secret
+
+Examples:
+  everystack secrets list --stage production
+  everystack secrets set MAPBOX_API_KEY "pk.abc123" --stage production
+  everystack secrets get JWT_SECRET --stage dev
+  everystack secrets remove OLD_KEY --stage dev
+
+Interop:
+  Secrets are stored in the SST Ion S3 state backend with AES-256-GCM encryption.
+  Both tools read and write the same values — full interop with \`sst secret\`.
+`);
+}

package/src/cli/commands/update.ts

@@ -9,6 +9,7 @@ import { resolveConfig, type CliConfig } from '../config.js';
 import { uploadToS3, invokeAction } from '../aws.js';
 import { step, success, warn, fail, info } from '../output.js';
 import { exportApp } from '../utils/export.js';
+import { loadSstSecrets } from '../utils/secrets.js';
 import { walkDirectory } from '../utils/walk.js';
 
 export interface UpdateFlags {
@@ -24,7 +25,7 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
   // Signal publish context so app.config.js can detect it's not a dev session.
   // Without this, dotenv guards that skip .env.local for EAS_BUILD/EAS_UPDATE
   // don't know to skip for everystack update, causing local dev overrides
-  // (e.g. OUTBOUND_HOST=localhost → LAN IP) to leak into the manifest.
+  // (e.g. localhost overrides → LAN IP) to leak into the manifest.
   process.env.EVERYSTACK_UPDATE = '1';
 
   // Resolve ENVIRONMENT before app.config.js evaluation so the manifest
@@ -58,6 +59,49 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
     } catch {
       // Stage may not be deployed yet — HOST_URL falls back to loadSstOutputs
     }
+
+    // Load EXPO_PUBLIC_* secrets for this stage and inject into process.env.
+    // Only public secrets are injected — server secrets (DATABASE_URL, JWT_SECRET, etc.)
+    // are provided by SST Resource linking at Lambda runtime.
+    // app.config.js merges { ...easInfo, ...process.env }, so these win over .env.local.
+    try {
+      step('Loading SST secrets...');
+      const { parseAppName } = await import('../discover.js');
+      const appName = await parseAppName();
+      const region = resolvedConfig?.region
+        || process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';
+      const secrets = await loadSstSecrets({ appName, stage: flags.stage, region });
+      const allNames = Object.keys(secrets);
+      const publicSecrets = Object.entries(secrets).filter(([k]) => k.startsWith('EXPO_PUBLIC_'));
+      const skipped = allNames.length - publicSecrets.length;
+      if (publicSecrets.length > 0) {
+        for (const [key, value] of publicSecrets) {
+          process.env[key] ||= value;
+        }
+        success(`Injected ${publicSecrets.length} EXPO_PUBLIC_* secrets: ${publicSecrets.map(([k]) => k).join(', ')}`);
+      } else if (allNames.length > 0) {
+        info('No EXPO_PUBLIC_* secrets found (server secrets are provided by SST at runtime)');
+      } else {
+        info('No SST secrets found for this stage');
+      }
+      if (skipped > 0) {
+        info(`Skipped ${skipped} server secret(s) — provided by SST Resource linking at Lambda runtime`);
+      }
+    } catch (err: any) {
+      // Secret loading is best-effort — the user may not have permissions
+      // or may not use SST secrets (e.g. env vars set manually).
+      const msg = err.message || String(err);
+      if (msg.includes("Cannot find package '@aws-sdk/client-ssm'")) {
+        warn('Secrets skipped: @aws-sdk/client-ssm not installed');
+        info('Install with: pnpm add -D @aws-sdk/client-ssm');
+      } else if (msg.includes("Cannot find package '@aws-sdk/client-s3'")) {
+        warn('Secrets skipped: @aws-sdk/client-s3 not installed');
+        info('Install with: pnpm add -D @aws-sdk/client-s3');
+      } else {
+        warn(`Could not load SST secrets: ${msg}`);
+      }
+      info('Set secrets with: everystack secrets set KEY "value" --stage ' + flags.stage);
+    }
   }
 
   const branch = flags.branch;

package/src/cli/index.ts

@@ -12,6 +12,7 @@ import { cachePurgeCommand } from './commands/cache.js';
 import { diagCommand } from './commands/diag.js';
 import { analyzeSSRCommand } from './commands/analyze.js';
 import { logsErrorsCommand, logsTailCommand, logsQueryCommand } from './commands/logs.js';
+import { secretsCommand } from './commands/secrets.js';
 import { fail } from './output.js';
 
 const args = process.argv.slice(2);
@@ -138,6 +139,22 @@ async function main() {
     case 'logs:query':
       await logsQueryCommand(flags);
       break;
+    case 'secrets': {
+      // secrets <subcommand> [positional...] [--flags]
+      // Extract positional args: everything after subcommand that isn't a flag or flag value
+      const sub = args[1] && !args[1].startsWith('-') ? args[1] : undefined;
+      const positional: string[] = [];
+      for (let i = 2; i < args.length; i++) {
+        if (args[i].startsWith('-')) {
+          // Skip flag and its value
+          if (args[i + 1] && !args[i + 1].startsWith('-')) i++;
+          continue;
+        }
+        positional.push(args[i]);
+      }
+      await secretsCommand(sub, positional, flags);
+      break;
+    }
     default:
       fail(`Unknown command: ${command}`);
       printHelp();
@@ -175,6 +192,10 @@ Usage:
   everystack channels list
   everystack channels create   --name <name> [--branch <name>]
   everystack channels edit     --name <name> --branch <name>
+  everystack secrets list      --stage <name>                       List all secret names
+  everystack secrets get       <name> --stage <name>                Print a secret value
+  everystack secrets set       <name> <value> --stage <name>        Set or update a secret
+  everystack secrets remove    <name> --stage <name>                Delete a secret
 
 Stage resolution:
   --stage <name>  Discover AWS resources for the given stage by querying AWS APIs.

package/src/cli/utils/secrets.ts

@@ -0,0 +1,195 @@
+/**
+ * Load SST Ion secrets from S3 state backend.
+ *
+ * SST Ion stores secrets as AES-256-GCM encrypted JSON in S3:
+ *   Bucket: sst-state-{random} (from /sst/bootstrap SSM parameter)
+ *   Key:    secret/{appName}/{stage}.json
+ *
+ * The encryption passphrase is stored in SSM at:
+ *   /sst/passphrase/{appName}/{stage}  (SecureString)
+ *
+ * Flow: fetch passphrase from SSM → fetch encrypted blob from S3 → AES-GCM decrypt → JSON parse.
+ *
+ * Requires IAM permissions: ssm:GetParameter, s3:GetObject, kms:Decrypt.
+ */
+
+import crypto from 'node:crypto';
+import { gunzipSync } from 'node:zlib';
+
+export interface LoadSecretsOptions {
+  appName: string;
+  stage: string;
+  region: string;
+}
+
+/**
+ * Resolve the SST state bucket name from the /sst/bootstrap SSM parameter.
+ */
+async function getStateBucket(region: string): Promise<string> {
+  const { SSMClient, GetParameterCommand } = await import('@aws-sdk/client-ssm');
+  const client = new SSMClient({ region });
+  const result = await client.send(
+    new GetParameterCommand({
+      Name: '/sst/bootstrap',
+      WithDecryption: false,
+    }),
+  );
+  if (!result.Parameter?.Value) {
+    throw new Error('SST bootstrap not found — has `sst deploy` been run?');
+  }
+  const data = JSON.parse(result.Parameter.Value);
+  if (!data.state) {
+    throw new Error('SST bootstrap missing state bucket');
+  }
+  return data.state as string;
+}
+
+/**
+ * Fetch the passphrase for a given app + stage from SSM.
+ */
+async function getPassphrase(region: string, appName: string, stage: string): Promise<string> {
+  const { SSMClient, GetParameterCommand } = await import('@aws-sdk/client-ssm');
+  const client = new SSMClient({ region });
+  const result = await client.send(
+    new GetParameterCommand({
+      Name: `/sst/passphrase/${appName}/${stage}`,
+      WithDecryption: true,
+    }),
+  );
+  if (!result.Parameter?.Value) {
+    throw new Error(`No SST passphrase found for ${appName}/${stage}`);
+  }
+  return result.Parameter.Value;
+}
+
+/**
+ * Fetch the encrypted secrets blob from S3.
+ */
+async function getSecretBlob(
+  region: string,
+  bucket: string,
+  appName: string,
+  stage: string,
+): Promise<Buffer | null> {
+  const { S3Client, GetObjectCommand } = await import('@aws-sdk/client-s3');
+  const client = new S3Client({ region });
+  try {
+    const result = await client.send(
+      new GetObjectCommand({
+        Bucket: bucket,
+        Key: `secret/${appName}/${stage}.json`,
+      }),
+    );
+    if (!result.Body) return null;
+    const bytes = await result.Body.transformToByteArray();
+    return Buffer.from(bytes);
+  } catch (err: any) {
+    if (err.name === 'NoSuchKey' || err.Code === 'NoSuchKey') {
+      return null;
+    }
+    throw err;
+  }
+}
+
+/**
+ * Decrypt AES-256-GCM ciphertext using a base64-encoded passphrase.
+ *
+ * SST Ion format: nonce (12 bytes) + ciphertext + auth tag (16 bytes appended by GCM Seal).
+ * Go's gcm.Seal() appends the tag to the ciphertext, so we split accordingly.
+ */
+function decrypt(encrypted: Buffer, passphrase: string): Buffer {
+  const key = Buffer.from(passphrase, 'base64');
+  const nonceSize = 12; // AES-GCM standard nonce size
+  const tagSize = 16; // AES-GCM auth tag size
+
+  if (encrypted.length < nonceSize + tagSize) {
+    throw new Error('Encrypted data too short');
+  }
+
+  const nonce = encrypted.subarray(0, nonceSize);
+  const ciphertextWithTag = encrypted.subarray(nonceSize);
+  const ciphertext = ciphertextWithTag.subarray(0, ciphertextWithTag.length - tagSize);
+  const tag = ciphertextWithTag.subarray(ciphertextWithTag.length - tagSize);
+
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, nonce);
+  decipher.setAuthTag(tag);
+
+  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return decrypted;
+}
+
+/**
+ * Fetch all SST Ion secrets for a given app + stage.
+ *
+ * Returns a map of { SECRET_NAME: decrypted_value }.
+ *
+ * Requires IAM permissions: ssm:GetParameter, s3:GetObject, kms:Decrypt.
+ */
+export async function loadSstSecrets(
+  options: LoadSecretsOptions,
+): Promise<Record<string, string>> {
+  const { appName, stage, region } = options;
+
+  // 1. Get the state bucket name from /sst/bootstrap
+  const bucket = await getStateBucket(region);
+
+  // 2. Get the passphrase from SSM
+  const passphrase = await getPassphrase(region, appName, stage);
+
+  // 3. Fetch the encrypted secrets blob from S3
+  let blob = await getSecretBlob(region, bucket, appName, stage);
+  if (!blob) {
+    return {};
+  }
+
+  // 4. Try gzip decompress (SST may compress the data)
+  try {
+    blob = gunzipSync(blob);
+  } catch {
+    // Not gzipped, use raw
+  }
+
+  // 5. Decrypt with AES-256-GCM
+  const decrypted = decrypt(blob, passphrase);
+
+  // 6. Parse the JSON map
+  const secrets: Record<string, string> = JSON.parse(decrypted.toString('utf8'));
+  return secrets;
+}
+
+/**
+ * Encrypt and store secrets to the SST Ion S3 state backend.
+ */
+export async function putSstSecrets(
+  options: LoadSecretsOptions,
+  secrets: Record<string, string>,
+): Promise<void> {
+  const { appName, stage, region } = options;
+
+  const bucket = await getStateBucket(region);
+  const passphrase = await getPassphrase(region, appName, stage);
+
+  // Encrypt with AES-256-GCM (same format as SST Ion's Go code)
+  const key = Buffer.from(passphrase, 'base64');
+  const nonce = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, nonce);
+
+  const jsonBytes = Buffer.from(JSON.stringify(secrets), 'utf8');
+  const encrypted = Buffer.concat([cipher.update(jsonBytes), cipher.final()]);
+  const tag = cipher.getAuthTag();
+
+  // Format: nonce + ciphertext + tag (matches Go's gcm.Seal output)
+  const blob = Buffer.concat([nonce, encrypted, tag]);
+
+  // Write to S3
+  const { S3Client, PutObjectCommand } = await import('@aws-sdk/client-s3');
+  const client = new S3Client({ region });
+  await client.send(
+    new PutObjectCommand({
+      Bucket: bucket,
+      Key: `secret/${appName}/${stage}.json`,
+      Body: blob,
+      ContentType: 'application/json',
+    }),
+  );
+}