@everystack/cli 0.2.14 → 0.2.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.14",
+  "version": "0.2.17",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/cli/commands/update.ts

@@ -9,8 +9,8 @@ import { resolveConfig, type CliConfig } from '../config.js';
 import { uploadToS3, invokeAction } from '../aws.js';
 import { step, success, warn, fail, info } from '../output.js';
 import { exportApp } from '../utils/export.js';
-import { loadSstSecrets } from '../utils/secrets.js';
 import { walkDirectory } from '../utils/walk.js';
+import { loadSstSecrets } from '../utils/secrets.js';
 
 export interface UpdateFlags {
   channel?: string;
@@ -60,47 +60,27 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
       // Stage may not be deployed yet — HOST_URL falls back to loadSstOutputs
     }
 
-    // Load EXPO_PUBLIC_* secrets for this stage and inject into process.env.
-    // Only public secrets are injected — server secrets (DATABASE_URL, JWT_SECRET, etc.)
-    // are provided by SST Resource linking at Lambda runtime.
-    // app.config.js merges { ...easInfo, ...process.env }, so these win over .env.local.
+    // Inject SST secrets into process.env so app.config.js / Metro can read them.
+    // The CLI injects ALL secrets — the app's deny-by-default filter (e.g.
+    // expo-secrets.config.js) is the security boundary that gates what reaches
+    // the bundle. This avoids requiring `sst shell` in deploy scripts.
     try {
-      step('Loading SST secrets...');
       const { parseAppName } = await import('../discover.js');
       const appName = await parseAppName();
-      const region = resolvedConfig?.region
-        || process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';
+      const region = resolvedConfig?.region || process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1';
+      step('Loading SST secrets...');
       const secrets = await loadSstSecrets({ appName, stage: flags.stage, region });
-      const allNames = Object.keys(secrets);
-      const publicSecrets = Object.entries(secrets).filter(([k]) => k.startsWith('EXPO_PUBLIC_'));
-      const skipped = allNames.length - publicSecrets.length;
-      if (publicSecrets.length > 0) {
-        for (const [key, value] of publicSecrets) {
-          process.env[key] ||= value;
+      let injected = 0;
+      for (const [k, v] of Object.entries(secrets)) {
+        if (!process.env[k]) {
+          process.env[k] = v;
+          injected++;
         }
-        success(`Injected ${publicSecrets.length} EXPO_PUBLIC_* secrets: ${publicSecrets.map(([k]) => k).join(', ')}`);
-      } else if (allNames.length > 0) {
-        info('No EXPO_PUBLIC_* secrets found (server secrets are provided by SST at runtime)');
-      } else {
-        info('No SST secrets found for this stage');
-      }
-      if (skipped > 0) {
-        info(`Skipped ${skipped} server secret(s) — provided by SST Resource linking at Lambda runtime`);
       }
+      success(`${injected} secret(s) injected into env (${Object.keys(secrets).length} total)`);
     } catch (err: any) {
-      // Secret loading is best-effort — the user may not have permissions
-      // or may not use SST secrets (e.g. env vars set manually).
-      const msg = err.message || String(err);
-      if (msg.includes("Cannot find package '@aws-sdk/client-ssm'")) {
-        warn('Secrets skipped: @aws-sdk/client-ssm not installed');
-        info('Install with: pnpm add -D @aws-sdk/client-ssm');
-      } else if (msg.includes("Cannot find package '@aws-sdk/client-s3'")) {
-        warn('Secrets skipped: @aws-sdk/client-s3 not installed');
-        info('Install with: pnpm add -D @aws-sdk/client-s3');
-      } else {
-        warn(`Could not load SST secrets: ${msg}`);
-      }
-      info('Set secrets with: everystack secrets set KEY "value" --stage ' + flags.stage);
+      warn(`Could not load SST secrets: ${err.message}`);
+      info('Secrets may be unavailable during export. Provide env vars from the caller if needed.');
     }
   }
 
@@ -114,21 +94,6 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
   const appConfig = await loadAppConfig();
   const runtimeVersion = appConfig.runtimeVersion;
 
-  // Validate: SSR flags in the expo-router plugin config will crash native devices.
-  // The bundle is compiled with server rendering code paths that have no server at runtime.
-  const ssrFlags = getExpoRouterSsrFlags(appConfig);
-  if (ssrFlags.useServerRendering || ssrFlags.useServerDataLoaders) {
-    fail('Export contains server rendering flags that will crash native devices.');
-    info('expo-router plugin has unstable_useServerRendering or unstable_useServerDataLoaders enabled.');
-    info('Use SSR_ENABLED to opt in only for web server exports:');
-    info('');
-    info("  ['expo-router', {");
-    info('    unstable_useServerRendering: !!process.env.SSR_ENABLED,');
-    info('    unstable_useServerDataLoaders: !!process.env.SSR_ENABLED,');
-    info('  }]');
-    process.exit(1);
-  }
-
   if (!runtimeVersion) {
     fail('No runtimeVersion found in app.json/app.config.js');
     info('Add "runtimeVersion" to your app.json, e.g.:');
@@ -141,6 +106,23 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
   const distDir = path.resolve('dist');
   const needsMobile = platformFilter !== 'web';
 
+  // Validate: SSR flags in the expo-router plugin config will crash native devices.
+  // Only check when mobile platforms are involved — web-only updates want SSR enabled.
+  if (needsMobile) {
+    const ssrFlags = getExpoRouterSsrFlags(appConfig);
+    if (ssrFlags.useServerRendering || ssrFlags.useServerDataLoaders) {
+      fail('Export contains server rendering flags that will crash native devices.');
+      info('expo-router plugin has unstable_useServerRendering or unstable_useServerDataLoaders enabled.');
+      info('Use SSR_ENABLED to opt in only for web server exports:');
+      info('');
+      info("  ['expo-router', {");
+      info('    unstable_useServerRendering: !!process.env.SSR_ENABLED,');
+      info('    unstable_useServerDataLoaders: !!process.env.SSR_ENABLED,');
+      info('  }]');
+      process.exit(1);
+    }
+  }
+
   // First export: mobile-safe bundles (no SSR_ENABLED).
   // Always re-export — stale dist/ is the #1 cause of broken OTA pushes.
   if (needsMobile) {

package/src/cli/utils/export.ts

@@ -3,7 +3,7 @@ import fs from 'fs/promises';
 import path from 'path';
 
 export function exportApp(platform?: string): Promise<void> {
-  const args = ['expo', 'export', '--output-dir', 'dist'];
+  const args = ['expo', 'export', '--output-dir', 'dist', '--clear'];
   if (platform) args.push('--platform', platform);
 
   return new Promise((resolve, reject) => {