@everystack/cli 0.2.17 → 0.2.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.17",
+  "version": "0.2.19",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/cli/aws.ts

@@ -42,6 +42,35 @@ export async function uploadToS3(
   }));
 }
 
+export async function headS3(
+  region: string,
+  bucket: string,
+  key: string,
+): Promise<{ etag: string; size?: number } | null> {
+  const client = await getS3(region);
+  const { HeadObjectCommand } = await import('@aws-sdk/client-s3');
+  try {
+    const response = await client.send(new HeadObjectCommand({
+      Bucket: bucket,
+      Key: key,
+    }));
+    return {
+      etag: response.ETag || '',
+      size: response.ContentLength,
+    };
+  } catch (err: unknown) {
+    if (err && typeof err === 'object' && 'name' in err) {
+      const name = (err as { name: string }).name;
+      if (name === 'NotFound' || name === '404') return null;
+    }
+    if (err && typeof err === 'object' && '$metadata' in err) {
+      const meta = (err as { $metadata: { httpStatusCode?: number } }).$metadata;
+      if (meta?.httpStatusCode === 404) return null;
+    }
+    throw err;
+  }
+}
+
 export async function getFromS3(
   region: string,
   bucket: string,

package/src/cli/commands/secrets.ts

@@ -13,8 +13,11 @@
  * Requires IAM permissions: ssm:GetParameter, s3:GetObject, s3:PutObject, kms:Decrypt.
  */
 
+import fs from 'node:fs/promises';
+import path from 'node:path';
 import { step, success, fail, info, warn } from '../output.js';
 import { loadSstSecrets, putSstSecrets } from '../utils/secrets.js';
+import { parseDotenv, serializeDotenv } from '../utils/dotenv.js';
 
 interface SecretsContext {
   appName: string;
@@ -112,6 +115,101 @@ async function removeSecret(ctx: SecretsContext, name: string): Promise<void> {
   success(`${name} removed from stage "${ctx.stage}"`);
 }
 
+// ---------------------------------------------------------------------------
+// Import
+// ---------------------------------------------------------------------------
+
+async function importSecrets(
+  ctx: SecretsContext,
+  filePath: string,
+  flags: Record<string, string>,
+): Promise<void> {
+  step(`Importing secrets from ${filePath}...`);
+
+  let content: string;
+  try {
+    content = await fs.readFile(path.resolve(filePath), 'utf8');
+  } catch (err: any) {
+    if (err.code === 'ENOENT') {
+      fail(`File not found: ${filePath}`);
+    } else {
+      fail(`Could not read file: ${err.message}`);
+    }
+    process.exit(1);
+  }
+
+  const parsed = parseDotenv(content);
+  const parsedCount = Object.keys(parsed).length;
+
+  if (parsedCount === 0) {
+    warn(`No secrets found in ${filePath}`);
+    return;
+  }
+
+  let merged: Record<string, string>;
+
+  if (flags.replace === 'true') {
+    // Replace mode: parsed entries become the entire secrets map
+    const existing = await loadSstSecrets(ctx);
+    const existingCount = Object.keys(existing).length;
+    if (existingCount > 0) {
+      warn(`Replacing all ${existingCount} existing secret(s)`);
+    }
+    merged = parsed;
+  } else {
+    // Merge mode (default): add new keys, overwrite matching keys, preserve the rest
+    const existing = await loadSstSecrets(ctx);
+    const existingKeys = new Set(Object.keys(existing));
+    let updated = 0;
+    for (const key of Object.keys(parsed)) {
+      if (existingKeys.has(key)) updated++;
+    }
+    merged = { ...existing, ...parsed };
+    const newCount = parsedCount - updated;
+    const detail = updated > 0 ? ` (${newCount} new, ${updated} updated)` : '';
+    await putSstSecrets(ctx, merged);
+    success(`${parsedCount} secret(s) imported to stage "${ctx.stage}"${detail}`);
+    return;
+  }
+
+  await putSstSecrets(ctx, merged);
+  success(`${parsedCount} secret(s) imported to stage "${ctx.stage}"`);
+}
+
+// ---------------------------------------------------------------------------
+// Export
+// ---------------------------------------------------------------------------
+
+async function exportSecrets(ctx: SecretsContext, filePath: string | undefined): Promise<void> {
+  if (filePath) {
+    step(`Exporting secrets from ${ctx.appName}/${ctx.stage}...`);
+  }
+
+  const secrets = await loadSstSecrets(ctx);
+  const count = Object.keys(secrets).length;
+
+  if (count === 0) {
+    warn('No secrets to export');
+    return;
+  }
+
+  const serialized = serializeDotenv(secrets);
+
+  if (filePath) {
+    const resolved = path.resolve(filePath);
+    try {
+      await fs.writeFile(resolved, serialized, 'utf8');
+    } catch (err: any) {
+      fail(`Could not write file: ${err.message}`);
+      process.exit(1);
+    }
+    success(`${count} secret(s) exported to ${filePath}`);
+  } else {
+    // Stdout mode: raw output, pipeable
+    process.stdout.write(serialized);
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Command entry point
 // ---------------------------------------------------------------------------
@@ -174,6 +272,23 @@ export async function secretsCommand(
         break;
       }
 
+      case 'import': {
+        const filePath = positionalArgs[0];
+        if (!filePath) {
+          fail('Missing file path');
+          info('Usage: everystack secrets import <file> --stage <stage> [--replace]');
+          process.exit(1);
+        }
+        await importSecrets(ctx, filePath, flags);
+        break;
+      }
+
+      case 'export': {
+        const filePath = positionalArgs[0]; // optional — stdout if omitted
+        await exportSecrets(ctx, filePath);
+        break;
+      }
+
       default:
         fail(`Unknown secrets subcommand: ${subcommand}`);
         printSecretsHelp();
@@ -195,12 +310,21 @@ Usage:
   everystack secrets get  <name>       --stage <name>    Print a secret value
   everystack secrets set  <name> <value> --stage <name>  Set or update a secret
   everystack secrets remove <name>     --stage <name>    Delete a secret
+  everystack secrets import <file>     --stage <name>    Import secrets from .env file (merge)
+  everystack secrets export [file]     --stage <name>    Export secrets to .env file (or stdout)
 
 Examples:
   everystack secrets list --stage production
   everystack secrets set MAPBOX_API_KEY "pk.abc123" --stage production
   everystack secrets get JWT_SECRET --stage dev
   everystack secrets remove OLD_KEY --stage dev
+  everystack secrets import .env.production --stage production
+  everystack secrets import .env --stage dev --replace
+  everystack secrets export --stage dev > .env.local
+  everystack secrets export secrets.env --stage production
+
+Flags:
+  --replace   (import only) Replace all secrets instead of merging
 
 Interop:
   Secrets are stored in the SST Ion S3 state backend with AES-256-GCM encryption.

package/src/cli/commands/update.ts

@@ -6,7 +6,7 @@ import { pipeline } from 'node:stream/promises';
 import { createWriteStream } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { resolveConfig, type CliConfig } from '../config.js';
-import { uploadToS3, invokeAction } from '../aws.js';
+import { uploadToS3, headS3, invokeAction } from '../aws.js';
 import { step, success, warn, fail, info } from '../output.js';
 import { exportApp } from '../utils/export.js';
 import { walkDirectory } from '../utils/walk.js';
@@ -186,7 +186,10 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
       const branchName = branch || channel;
       const storagePrefix = `releases/${branchName}/${runtimeVersion}/${groupId}/${platform}`;
 
-      // Upload each asset directly to S3 with content hashing
+      // Upload each asset directly to S3 with content hashing.
+      // Non-launch assets use a shared content-addressed store (assets/{hash}{ext})
+      // so identical files across releases are stored once. Launch assets (JS bundles)
+      // remain per-release for rollback isolation.
       const uploaded: Array<{
         path: string;
         s3Key: string;
@@ -199,12 +202,42 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
       }> = [];
 
       const UPLOAD_CONCURRENCY = 6;
+      let newAssets = 0;
+      let skippedAssets = 0;
       for (let i = 0; i < assets.length; i += UPLOAD_CONCURRENCY) {
         const batch = assets.slice(i, i + UPLOAD_CONCURRENCY);
         try {
           await Promise.all(batch.map(async (asset) => {
             const data = Buffer.from(asset.data, 'base64');
-            const s3Key = `${storagePrefix}/${asset.path}`;
+            const sha256 = crypto.createHash('sha256').update(data).digest('base64')
+              .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+            const md5 = crypto.createHash('md5').update(data).digest('hex');
+
+            // Launch assets → per-release path (changes every build, needs rollback isolation)
+            // Non-launch assets → shared content-addressed path (fonts, images — rarely change)
+            const s3Key = asset.isLaunchAsset
+              ? `${storagePrefix}/${asset.path}`
+              : `assets/${sha256}${asset.fileExtension}`;
+
+            // Skip upload if shared asset already exists
+            if (!asset.isLaunchAsset) {
+              const existing = await headS3(config.region, config.updatesBucket, s3Key);
+              if (existing) {
+                skippedAssets++;
+                uploaded.push({
+                  path: asset.path,
+                  s3Key,
+                  contentHash: sha256,
+                  filename: md5,
+                  mimeType: asset.contentType,
+                  fileExtension: asset.fileExtension,
+                  isLaunchAsset: asset.isLaunchAsset,
+                  sizeBytes: data.length,
+                });
+                return;
+              }
+            }
+
             await uploadToS3(
               config.region,
               config.updatesBucket,
@@ -212,9 +245,7 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
               data,
               asset.contentType,
             );
-            const sha256 = crypto.createHash('sha256').update(data).digest('base64')
-              .replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-            const md5 = crypto.createHash('md5').update(data).digest('hex');
+            newAssets++;
             uploaded.push({
               path: asset.path,
               s3Key,
@@ -258,7 +289,11 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
           process.exit(1);
         }
         if (result?.groupId && !groupId) groupId = result.groupId;
-        success(`${platform}: ${uploaded.length} assets`);
+        if (skippedAssets > 0) {
+          success(`${platform}: ${newAssets} new, ${skippedAssets} unchanged (skipped)`);
+        } else {
+          success(`${platform}: ${uploaded.length} assets`);
+        }
       } catch (err: any) {
         fail(`Registration failed for ${platform}: ${err.message}`);
         info('Ensure your IAM user/role has lambda:InvokeFunction permission.');
@@ -345,11 +380,18 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
         step(`Uploading ${clientAssets.length} client assets...`);
         const UPLOAD_CONCURRENCY = 10;
         let uploaded = 0;
+        let skipped = 0;
 
         for (let i = 0; i < clientAssets.length; i += UPLOAD_CONCURRENCY) {
           const batch = clientAssets.slice(i, i + UPLOAD_CONCURRENCY);
           try {
             await Promise.all(batch.map(async (asset) => {
+              // Skip upload if asset already exists (content-hash filenames = identical content)
+              const existing = await headS3(config.region, config.clientBundlesBucket, asset.relativePath);
+              if (existing) {
+                skipped++;
+                return;
+              }
               const data = Buffer.from(asset.data, 'base64');
               await uploadToS3(
                 config.region,
@@ -367,7 +409,11 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
             process.exit(1);
           }
         }
-        success(`${uploaded}/${clientAssets.length} assets uploaded to s3://${config.clientBundlesBucket}/`);
+        if (skipped > 0) {
+          success(`${uploaded} new, ${skipped} unchanged (skipped)`);
+        } else {
+          success(`${uploaded}/${clientAssets.length} assets uploaded to s3://${config.clientBundlesBucket}/`);
+        }
       }
 
       // 4. Write release manifests directly to S3 (source of truth for SSR).

package/src/cli/index.ts

@@ -196,6 +196,8 @@ Usage:
   everystack secrets get       <name> --stage <name>                Print a secret value
   everystack secrets set       <name> <value> --stage <name>        Set or update a secret
   everystack secrets remove    <name> --stage <name>                Delete a secret
+  everystack secrets import    <file> --stage <name> [--replace]    Import secrets from .env file
+  everystack secrets export    [file] --stage <name>                Export secrets to .env format
 
 Stage resolution:
   --stage <name>  Discover AWS resources for the given stage by querying AWS APIs.

package/src/cli/utils/dotenv.ts

@@ -0,0 +1,105 @@
+/**
+ * Pure .env parser and serializer. No dependencies.
+ *
+ * Supports:
+ *   KEY=value
+ *   KEY="double quoted value"
+ *   KEY='single quoted value'
+ *   # comments (full-line)
+ *   Empty/whitespace-only lines (skipped)
+ *   export KEY=value (optional prefix)
+ *   Escape sequences in double quotes: \n, \r, \t, \\, \"
+ *   UTF-8 BOM stripping
+ */
+
+/**
+ * Parse a .env-formatted string into key-value pairs.
+ * Duplicate keys: last one wins.
+ */
+export function parseDotenv(content: string): Record<string, string> {
+  const result: Record<string, string> = {};
+
+  // Strip UTF-8 BOM
+  const clean = content.charCodeAt(0) === 0xfeff ? content.slice(1) : content;
+
+  for (const rawLine of clean.split('\n')) {
+    const line = rawLine.trim();
+
+    // Skip empty lines and comments
+    if (!line || line.startsWith('#')) continue;
+
+    // Strip optional `export ` prefix
+    const stripped = line.startsWith('export ') ? line.slice(7) : line;
+
+    // Find first `=`
+    const eqIndex = stripped.indexOf('=');
+    if (eqIndex === -1) continue;
+
+    const key = stripped.slice(0, eqIndex).trim();
+    if (!key) continue;
+
+    let value = stripped.slice(eqIndex + 1);
+
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+      // Double-quoted: strip quotes and process escapes
+      value = value.slice(1, -1);
+      // Process escapes — use a single pass to avoid double-expansion
+      value = value.replace(/\\([nrt"\\])/g, (_, ch) => {
+        switch (ch) {
+          case 'n': return '\n';
+          case 'r': return '\r';
+          case 't': return '\t';
+          case '"': return '"';
+          case '\\': return '\\';
+          default: return ch;
+        }
+      });
+    } else if (value.startsWith("'") && value.endsWith("'") && value.length >= 2) {
+      // Single-quoted: strip quotes, literal (no escape processing)
+      value = value.slice(1, -1);
+    } else {
+      // Unquoted: trim whitespace
+      value = value.trim();
+    }
+
+    result[key] = value;
+  }
+
+  return result;
+}
+
+/**
+ * Serialize a key-value map to .env format.
+ *
+ * Keys are sorted alphabetically for deterministic output.
+ * Values are double-quoted when they contain whitespace, quotes, #, backslashes, or newlines.
+ */
+export function serializeDotenv(secrets: Record<string, string>): string {
+  const keys = Object.keys(secrets).sort();
+  if (keys.length === 0) return '';
+
+  const lines: string[] = [];
+
+  for (const key of keys) {
+    const value = secrets[key];
+
+    if (needsQuoting(value)) {
+      const escaped = value
+        .replace(/\\/g, '\\\\')
+        .replace(/"/g, '\\"')
+        .replace(/\n/g, '\\n')
+        .replace(/\r/g, '\\r')
+        .replace(/\t/g, '\\t');
+      lines.push(`${key}="${escaped}"`);
+    } else {
+      lines.push(`${key}=${value}`);
+    }
+  }
+
+  return lines.join('\n') + '\n';
+}
+
+function needsQuoting(value: string): boolean {
+  if (value === '') return true;
+  return /[\s"'#\\]/.test(value) || value.includes('\n');
+}

package/src/handler/publish.ts

@@ -304,20 +304,40 @@ export async function handlePublish(request: Request, options: UpdatesHandlerOpt
   const groupId = body.groupId || crypto.randomUUID();
   const storagePrefix = `releases/${branchName}/${body.runtimeVersion}/${groupId}/${body.platform}`;
 
-  // Upload assets to storage, building post-upload records
+  // Upload assets to storage, building post-upload records.
+  // Non-launch assets use a shared content-addressed store (assets/{hash}{ext})
+  // so identical files across releases are stored once. Launch assets (JS bundles)
+  // remain per-release for rollback isolation.
   const uploadedAssets: RegisterMobileAsset[] = [];
   for (const asset of body.assets) {
     const data = Buffer.from(asset.data, 'base64');
-    const s3Key = `${storagePrefix}/${asset.path}`;
-    await options.storage.put(s3Key, data, asset.contentType);
+    const isLaunch = asset.isLaunchAsset ?? false;
+    const contentHash = sha256Base64Url(data);
+    const ext = asset.fileExtension.startsWith('.') ? asset.fileExtension : `.${asset.fileExtension}`;
+
+    // Launch assets → per-release path; non-launch → shared content-addressed path
+    const s3Key = isLaunch
+      ? `${storagePrefix}/${asset.path}`
+      : `assets/${contentHash}${ext}`;
+
+    // Skip upload if shared asset already exists
+    if (!isLaunch) {
+      const exists = await options.storage.exists(s3Key);
+      if (!exists) {
+        await options.storage.put(s3Key, data, asset.contentType);
+      }
+    } else {
+      await options.storage.put(s3Key, data, asset.contentType);
+    }
+
     uploadedAssets.push({
       path: asset.path,
       s3Key,
-      contentHash: sha256Base64Url(data),
+      contentHash,
       filename: md5Hex(data),
       mimeType: asset.contentType,
       fileExtension: asset.fileExtension,
-      isLaunchAsset: asset.isLaunchAsset ?? false,
+      isLaunchAsset: isLaunch,
       sizeBytes: data.length,
     });
   }