@everystack/cli 0.2.13 → 0.2.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.13",
+  "version": "0.2.16",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/cli/commands/secrets.ts

@@ -1,17 +1,20 @@
 /**
- * Secrets management — read/write SST secrets in AWS SSM Parameter Store.
+ * Secrets management — read/write SST Ion secrets.
  *
- * SST v3 stores secrets at: /sst/{appName}/{stage}/Secret/{name}/value
- * These are SecureString parameters encrypted with the default KMS key.
+ * SST Ion stores secrets as AES-256-GCM encrypted JSON in S3:
+ *   Bucket: sst-state-{random} (resolved from /sst/bootstrap SSM param)
+ *   Key:    secret/{appName}/{stage}.json
  *
- * Full interop with `sst secret set/list` — same SSM paths, same encryption.
+ * The encryption passphrase lives in SSM at /sst/passphrase/{appName}/{stage}.
+ *
+ * Full interop with `sst secret set/list` — same S3 objects, same encryption.
  * Secrets set via `everystack secrets set` are readable by SST and vice versa.
  *
- * Requires IAM permissions: ssm:GetParametersByPath, ssm:GetParameter,
- * ssm:PutParameter, ssm:DeleteParameter, kms:Decrypt, kms:Encrypt.
+ * Requires IAM permissions: ssm:GetParameter, s3:GetObject, s3:PutObject, kms:Decrypt.
  */
 
 import { step, success, fail, info, warn } from '../output.js';
+import { loadSstSecrets, putSstSecrets } from '../utils/secrets.js';
 
 interface SecretsContext {
   appName: string;
@@ -34,16 +37,6 @@ async function resolveContext(flags: Record<string, string>): Promise<SecretsCon
   return { appName, stage, region };
 }
 
-function ssmPath(ctx: SecretsContext, name?: string): string {
-  const base = `/sst/${ctx.appName}/${ctx.stage}/Secret`;
-  return name ? `${base}/${name}/value` : `${base}/`;
-}
-
-async function getSSM(region: string) {
-  const { SSMClient } = await import('@aws-sdk/client-ssm');
-  return new SSMClient({ region });
-}
-
 // ---------------------------------------------------------------------------
 // List
 // ---------------------------------------------------------------------------
@@ -51,33 +44,8 @@ async function getSSM(region: string) {
 async function listSecrets(ctx: SecretsContext): Promise<void> {
   step(`Loading secrets for ${ctx.appName}/${ctx.stage}...`);
 
-  const client = await getSSM(ctx.region);
-  const { GetParametersByPathCommand } = await import('@aws-sdk/client-ssm');
-
-  const names: string[] = [];
-  let nextToken: string | undefined;
-
-  do {
-    const response = await client.send(
-      new GetParametersByPathCommand({
-        Path: ssmPath(ctx),
-        Recursive: true,
-        WithDecryption: false, // Don't decrypt — we only need names
-        NextToken: nextToken,
-      }),
-    );
-
-    for (const param of response.Parameters || []) {
-      if (!param.Name) continue;
-      const parts = param.Name.split('/');
-      const secretIndex = parts.indexOf('Secret');
-      if (secretIndex >= 0 && secretIndex + 1 < parts.length) {
-        names.push(parts[secretIndex + 1]);
-      }
-    }
-
-    nextToken = response.NextToken;
-  } while (nextToken);
+  const secrets = await loadSstSecrets(ctx);
+  const names = Object.keys(secrets).sort();
 
   if (names.length === 0) {
     info('No secrets found');
@@ -86,7 +54,7 @@ async function listSecrets(ctx: SecretsContext): Promise<void> {
   }
 
   success(`${names.length} secret(s):`);
-  for (const name of names.sort()) {
+  for (const name of names) {
     console.log(`  ${name}`);
   }
 }
@@ -98,30 +66,15 @@ async function listSecrets(ctx: SecretsContext): Promise<void> {
 async function getSecret(ctx: SecretsContext, name: string): Promise<void> {
   step(`Reading ${name}...`);
 
-  const client = await getSSM(ctx.region);
-  const { GetParameterCommand } = await import('@aws-sdk/client-ssm');
+  const secrets = await loadSstSecrets(ctx);
+  const value = secrets[name];
 
-  try {
-    const response = await client.send(
-      new GetParameterCommand({
-        Name: ssmPath(ctx, name),
-        WithDecryption: true,
-      }),
-    );
-
-    if (response.Parameter?.Value !== undefined) {
-      console.log(response.Parameter.Value);
-    } else {
-      fail(`Secret "${name}" has no value`);
-      process.exit(1);
-    }
-  } catch (err: any) {
-    if (err.name === 'ParameterNotFound') {
-      fail(`Secret "${name}" not found in stage "${ctx.stage}"`);
-      info(`Set it with: everystack secrets set ${name} "value" --stage ${ctx.stage}`);
-      process.exit(1);
-    }
-    throw err;
+  if (value !== undefined) {
+    console.log(value);
+  } else {
+    fail(`Secret "${name}" not found in stage "${ctx.stage}"`);
+    info(`Set it with: everystack secrets set ${name} "value" --stage ${ctx.stage}`);
+    process.exit(1);
   }
 }
 
@@ -132,17 +85,10 @@ async function getSecret(ctx: SecretsContext, name: string): Promise<void> {
 async function setSecret(ctx: SecretsContext, name: string, value: string): Promise<void> {
   step(`Setting ${name}...`);
 
-  const client = await getSSM(ctx.region);
-  const { PutParameterCommand } = await import('@aws-sdk/client-ssm');
-
-  await client.send(
-    new PutParameterCommand({
-      Name: ssmPath(ctx, name),
-      Value: value,
-      Type: 'SecureString',
-      Overwrite: true,
-    }),
-  );
+  // Load existing secrets, merge, and write back
+  const secrets = await loadSstSecrets(ctx);
+  secrets[name] = value;
+  await putSstSecrets(ctx, secrets);
 
   success(`${name} set for stage "${ctx.stage}"`);
 }
@@ -154,23 +100,16 @@ async function setSecret(ctx: SecretsContext, name: string, value: string): Prom
 async function removeSecret(ctx: SecretsContext, name: string): Promise<void> {
   step(`Removing ${name}...`);
 
-  const client = await getSSM(ctx.region);
-  const { DeleteParameterCommand } = await import('@aws-sdk/client-ssm');
-
-  try {
-    await client.send(
-      new DeleteParameterCommand({
-        Name: ssmPath(ctx, name),
-      }),
-    );
-    success(`${name} removed from stage "${ctx.stage}"`);
-  } catch (err: any) {
-    if (err.name === 'ParameterNotFound') {
-      warn(`Secret "${name}" not found in stage "${ctx.stage}" (already removed?)`);
-      return;
-    }
-    throw err;
+  const secrets = await loadSstSecrets(ctx);
+  if (!(name in secrets)) {
+    warn(`Secret "${name}" not found in stage "${ctx.stage}" (already removed?)`);
+    return;
   }
+
+  delete secrets[name];
+  await putSstSecrets(ctx, secrets);
+
+  success(`${name} removed from stage "${ctx.stage}"`);
 }
 
 // ---------------------------------------------------------------------------
@@ -242,14 +181,14 @@ export async function secretsCommand(
     }
   } catch (err: any) {
     fail(err.message);
-    info('Ensure your IAM user/role has ssm:* and kms:Decrypt permissions.');
+    info('Ensure your IAM user/role has ssm:GetParameter, s3:GetObject, and kms:Decrypt permissions.');
     process.exit(1);
   }
 }
 
 function printSecretsHelp(): void {
   console.log(`
-everystack secrets — Manage SST secrets (SSM Parameter Store)
+everystack secrets — Manage SST Ion secrets
 
 Usage:
   everystack secrets list              --stage <name>    List all secret names
@@ -264,7 +203,7 @@ Examples:
   everystack secrets remove OLD_KEY --stage dev
 
 Interop:
-  Secrets are stored at the same SSM path as \`sst secret set\`.
-  Both tools read and write the same values — full interop.
+  Secrets are stored in the SST Ion S3 state backend with AES-256-GCM encryption.
+  Both tools read and write the same values — full interop with \`sst secret\`.
 `);
 }

package/src/cli/commands/update.ts

@@ -9,8 +9,8 @@ import { resolveConfig, type CliConfig } from '../config.js';
 import { uploadToS3, invokeAction } from '../aws.js';
 import { step, success, warn, fail, info } from '../output.js';
 import { exportApp } from '../utils/export.js';
-import { loadSstSecrets } from '../utils/secrets.js';
 import { walkDirectory } from '../utils/walk.js';
+import { loadSstSecrets } from '../utils/secrets.js';
 
 export interface UpdateFlags {
   channel?: string;
@@ -60,31 +60,27 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
       // Stage may not be deployed yet — HOST_URL falls back to loadSstOutputs
     }
 
-    // Load SST secrets for this stage and inject into process.env.
-    // This replaces .env.local during `everystack update` — same pattern
-    // as EAS injecting stored secrets during `eas update`.
-    // app.config.js merges { ...easInfo, ...process.env }, so these win.
+    // Inject SST secrets into process.env so app.config.js / Metro can read them.
+    // The CLI injects ALL secrets — the app's deny-by-default filter (e.g.
+    // expo-secrets.config.js) is the security boundary that gates what reaches
+    // the bundle. This avoids requiring `sst shell` in deploy scripts.
     try {
-      step('Loading SST secrets...');
       const { parseAppName } = await import('../discover.js');
       const appName = await parseAppName();
-      const region = resolvedConfig?.region
-        || process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';
+      const region = resolvedConfig?.region || process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';
+      step('Loading SST secrets...');
       const secrets = await loadSstSecrets({ appName, stage: flags.stage, region });
-      const names = Object.keys(secrets);
-      if (names.length > 0) {
-        for (const [key, value] of Object.entries(secrets)) {
-          process.env[key] ||= value;
+      let injected = 0;
+      for (const [k, v] of Object.entries(secrets)) {
+        if (!process.env[k]) {
+          process.env[k] = v;
+          injected++;
         }
-        success(`Loaded ${names.length} secrets: ${names.join(', ')}`);
-      } else {
-        info('No SST secrets found for this stage');
       }
+      success(`${injected} secret(s) injected into env (${Object.keys(secrets).length} total)`);
     } catch (err: any) {
-      // Secret loading is best-effort — the user may not have SSM permissions
-      // or may not use SST secrets (e.g. env vars set manually).
       warn(`Could not load SST secrets: ${err.message}`);
-      info('Set secrets with: pnpm sst secret set KEY "value" --stage ' + flags.stage);
+      info('Secrets may be unavailable during export. Provide env vars from the caller if needed.');
     }
   }
 
@@ -98,21 +94,6 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
   const appConfig = await loadAppConfig();
   const runtimeVersion = appConfig.runtimeVersion;
 
-  // Validate: SSR flags in the expo-router plugin config will crash native devices.
-  // The bundle is compiled with server rendering code paths that have no server at runtime.
-  const ssrFlags = getExpoRouterSsrFlags(appConfig);
-  if (ssrFlags.useServerRendering || ssrFlags.useServerDataLoaders) {
-    fail('Export contains server rendering flags that will crash native devices.');
-    info('expo-router plugin has unstable_useServerRendering or unstable_useServerDataLoaders enabled.');
-    info('Use SSR_ENABLED to opt in only for web server exports:');
-    info('');
-    info("  ['expo-router', {");
-    info('    unstable_useServerRendering: !!process.env.SSR_ENABLED,');
-    info('    unstable_useServerDataLoaders: !!process.env.SSR_ENABLED,');
-    info('  }]');
-    process.exit(1);
-  }
-
   if (!runtimeVersion) {
     fail('No runtimeVersion found in app.json/app.config.js');
     info('Add "runtimeVersion" to your app.json, e.g.:');
@@ -125,6 +106,23 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
   const distDir = path.resolve('dist');
   const needsMobile = platformFilter !== 'web';
 
+  // Validate: SSR flags in the expo-router plugin config will crash native devices.
+  // Only check when mobile platforms are involved — web-only updates want SSR enabled.
+  if (needsMobile) {
+    const ssrFlags = getExpoRouterSsrFlags(appConfig);
+    if (ssrFlags.useServerRendering || ssrFlags.useServerDataLoaders) {
+      fail('Export contains server rendering flags that will crash native devices.');
+      info('expo-router plugin has unstable_useServerRendering or unstable_useServerDataLoaders enabled.');
+      info('Use SSR_ENABLED to opt in only for web server exports:');
+      info('');
+      info("  ['expo-router', {");
+      info('    unstable_useServerRendering: !!process.env.SSR_ENABLED,');
+      info('    unstable_useServerDataLoaders: !!process.env.SSR_ENABLED,');
+      info('  }]');
+      process.exit(1);
+    }
+  }
+
   // First export: mobile-safe bundles (no SSR_ENABLED).
   // Always re-export — stale dist/ is the #1 cause of broken OTA pushes.
   if (needsMobile) {

package/src/cli/utils/secrets.ts

@@ -1,14 +1,21 @@
 /**
- * Load SST secrets from AWS SSM Parameter Store.
+ * Load SST Ion secrets from S3 state backend.
  *
- * SST v3 stores secrets at: /sst/{appName}/{stage}/Secret/{name}/value
- * These are SecureString parameters encrypted with the default KMS key.
+ * SST Ion stores secrets as AES-256-GCM encrypted JSON in S3:
+ *   Bucket: sst-state-{random} (from /sst/bootstrap SSM parameter)
+ *   Key:    secret/{appName}/{stage}.json
  *
- * The CLI fetches all secrets for a stage and returns them as a flat
- * key-value map. The caller injects them into process.env before
- * expo export, so app.config.js picks them up via `...process.env`.
+ * The encryption passphrase is stored in SSM at:
+ *   /sst/passphrase/{appName}/{stage}  (SecureString)
+ *
+ * Flow: fetch passphrase from SSM → fetch encrypted blob from S3 → AES-GCM decrypt → JSON parse.
+ *
+ * Requires IAM permissions: ssm:GetParameter, s3:GetObject, kms:Decrypt.
  */
 
+import crypto from 'node:crypto';
+import { gunzipSync } from 'node:zlib';
+
 export interface LoadSecretsOptions {
   appName: string;
   stage: string;
@@ -16,49 +23,173 @@ export interface LoadSecretsOptions {
 }
 
 /**
- * Fetch all SST secrets for a given app + stage from SSM Parameter Store.
+ * Resolve the SST state bucket name from the /sst/bootstrap SSM parameter.
+ */
+async function getStateBucket(region: string): Promise<string> {
+  const { SSMClient, GetParameterCommand } = await import('@aws-sdk/client-ssm');
+  const client = new SSMClient({ region });
+  const result = await client.send(
+    new GetParameterCommand({
+      Name: '/sst/bootstrap',
+      WithDecryption: false,
+    }),
+  );
+  if (!result.Parameter?.Value) {
+    throw new Error('SST bootstrap not found — has `sst deploy` been run?');
+  }
+  const data = JSON.parse(result.Parameter.Value);
+  if (!data.state) {
+    throw new Error('SST bootstrap missing state bucket');
+  }
+  return data.state as string;
+}
+
+/**
+ * Fetch the passphrase for a given app + stage from SSM.
+ */
+async function getPassphrase(region: string, appName: string, stage: string): Promise<string> {
+  const { SSMClient, GetParameterCommand } = await import('@aws-sdk/client-ssm');
+  const client = new SSMClient({ region });
+  const result = await client.send(
+    new GetParameterCommand({
+      Name: `/sst/passphrase/${appName}/${stage}`,
+      WithDecryption: true,
+    }),
+  );
+  if (!result.Parameter?.Value) {
+    throw new Error(`No SST passphrase found for ${appName}/${stage}`);
+  }
+  return result.Parameter.Value;
+}
+
+/**
+ * Fetch the encrypted secrets blob from S3.
+ */
+async function getSecretBlob(
+  region: string,
+  bucket: string,
+  appName: string,
+  stage: string,
+): Promise<Buffer | null> {
+  const { S3Client, GetObjectCommand } = await import('@aws-sdk/client-s3');
+  const client = new S3Client({ region });
+  try {
+    const result = await client.send(
+      new GetObjectCommand({
+        Bucket: bucket,
+        Key: `secret/${appName}/${stage}.json`,
+      }),
+    );
+    if (!result.Body) return null;
+    const bytes = await result.Body.transformToByteArray();
+    return Buffer.from(bytes);
+  } catch (err: any) {
+    if (err.name === 'NoSuchKey' || err.Code === 'NoSuchKey') {
+      return null;
+    }
+    throw err;
+  }
+}
+
+/**
+ * Decrypt AES-256-GCM ciphertext using a base64-encoded passphrase.
+ *
+ * SST Ion format: nonce (12 bytes) + ciphertext + auth tag (16 bytes appended by GCM Seal).
+ * Go's gcm.Seal() appends the tag to the ciphertext, so we split accordingly.
+ */
+function decrypt(encrypted: Buffer, passphrase: string): Buffer {
+  const key = Buffer.from(passphrase, 'base64');
+  const nonceSize = 12; // AES-GCM standard nonce size
+  const tagSize = 16; // AES-GCM auth tag size
+
+  if (encrypted.length < nonceSize + tagSize) {
+    throw new Error('Encrypted data too short');
+  }
+
+  const nonce = encrypted.subarray(0, nonceSize);
+  const ciphertextWithTag = encrypted.subarray(nonceSize);
+  const ciphertext = ciphertextWithTag.subarray(0, ciphertextWithTag.length - tagSize);
+  const tag = ciphertextWithTag.subarray(ciphertextWithTag.length - tagSize);
+
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, nonce);
+  decipher.setAuthTag(tag);
+
+  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return decrypted;
+}
+
+/**
+ * Fetch all SST Ion secrets for a given app + stage.
  *
  * Returns a map of { SECRET_NAME: decrypted_value }.
- * Paginates automatically — SSM returns max 10 parameters per page.
  *
- * Requires IAM permissions: ssm:GetParametersByPath, kms:Decrypt.
+ * Requires IAM permissions: ssm:GetParameter, s3:GetObject, kms:Decrypt.
  */
 export async function loadSstSecrets(
   options: LoadSecretsOptions,
 ): Promise<Record<string, string>> {
-  const { SSMClient, GetParametersByPathCommand } = await import(
-    '@aws-sdk/client-ssm'
-  );
+  const { appName, stage, region } = options;
 
-  const client = new SSMClient({ region: options.region });
-  const prefix = `/sst/${options.appName}/${options.stage}/Secret/`;
-  const secrets: Record<string, string> = {};
-
-  let nextToken: string | undefined;
-  do {
-    const response = await client.send(
-      new GetParametersByPathCommand({
-        Path: prefix,
-        WithDecryption: true,
-        Recursive: true,
-        NextToken: nextToken,
-      }),
-    );
+  // 1. Get the state bucket name from /sst/bootstrap
+  const bucket = await getStateBucket(region);
 
-    for (const param of response.Parameters || []) {
-      if (!param.Name || param.Value === undefined) continue;
-      // Path: /sst/{app}/{stage}/Secret/{NAME}/value → extract NAME
-      const parts = param.Name.split('/');
-      // parts: ['', 'sst', app, stage, 'Secret', NAME, 'value']
-      const secretIndex = parts.indexOf('Secret');
-      if (secretIndex >= 0 && secretIndex + 1 < parts.length) {
-        const name = parts[secretIndex + 1];
-        secrets[name] = param.Value;
-      }
-    }
+  // 2. Get the passphrase from SSM
+  const passphrase = await getPassphrase(region, appName, stage);
+
+  // 3. Fetch the encrypted secrets blob from S3
+  let blob = await getSecretBlob(region, bucket, appName, stage);
+  if (!blob) {
+    return {};
+  }
+
+  // 4. Try gzip decompress (SST may compress the data)
+  try {
+    blob = gunzipSync(blob);
+  } catch {
+    // Not gzipped, use raw
+  }
 
-    nextToken = response.NextToken;
-  } while (nextToken);
+  // 5. Decrypt with AES-256-GCM
+  const decrypted = decrypt(blob, passphrase);
 
+  // 6. Parse the JSON map
+  const secrets: Record<string, string> = JSON.parse(decrypted.toString('utf8'));
   return secrets;
 }
+
+/**
+ * Encrypt and store secrets to the SST Ion S3 state backend.
+ */
+export async function putSstSecrets(
+  options: LoadSecretsOptions,
+  secrets: Record<string, string>,
+): Promise<void> {
+  const { appName, stage, region } = options;
+
+  const bucket = await getStateBucket(region);
+  const passphrase = await getPassphrase(region, appName, stage);
+
+  // Encrypt with AES-256-GCM (same format as SST Ion's Go code)
+  const key = Buffer.from(passphrase, 'base64');
+  const nonce = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, nonce);
+
+  const jsonBytes = Buffer.from(JSON.stringify(secrets), 'utf8');
+  const encrypted = Buffer.concat([cipher.update(jsonBytes), cipher.final()]);
+  const tag = cipher.getAuthTag();
+
+  // Format: nonce + ciphertext + tag (matches Go's gcm.Seal output)
+  const blob = Buffer.concat([nonce, encrypted, tag]);
+
+  // Write to S3
+  const { S3Client, PutObjectCommand } = await import('@aws-sdk/client-s3');
+  const client = new S3Client({ region });
+  await client.send(
+    new PutObjectCommand({
+      Bucket: bucket,
+      Key: `secret/${appName}/${stage}.json`,
+      Body: blob,
+      ContentType: 'application/json',
+    }),
+  );
+}