@everystack/cli 0.2.21 → 0.2.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.21",
+  "version": "0.2.22",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "publishConfig": {
@@ -33,7 +33,7 @@
     },
     "./env": {
       "types": "./src/env.ts",
-      "default": "./src/env.ts"
+      "default": "./src/env.js"
     },
     "./sst": {
       "types": "./src/sst.ts",
@@ -46,6 +46,7 @@
   "scripts": {
     "test": "jest",
     "build": "tsc --build",
+    "prepublishOnly": "tsc --module commonjs --moduleResolution node --target ES2022 --esModuleInterop --skipLibCheck --declaration false --outDir src src/env.ts",
     "lint": "tsc --noEmit"
   },
   "dependencies": {

package/src/env.js

@@ -0,0 +1,154 @@
+"use strict";
+/**
+ * @everystack/cli/env — Deny-by-default environment variable filtering.
+ *
+ * One import in app.config.js. Auto-discovers env.config.js.
+ * Detects build surface, filters secrets by tier, sets EXPO_PUBLIC_* vars.
+ *
+ * Usage:
+ *   const { extra } = require('@everystack/cli/env').load();
+ *   module.exports = { expo: { extra } };
+ *
+ * With explicit config path:
+ *   const { extra } = require('@everystack/cli/env').load({ path: './env.config' });
+ *
+ * Multiple stages. Four buckets. One gate. One file.
+ *
+ * @module
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectSurface = detectSurface;
+exports.loadEnvConfig = loadEnvConfig;
+exports.filterEnv = filterEnv;
+exports.setExpoPublicVars = setExpoPublicVars;
+exports.load = load;
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+/**
+ * Detect the current build surface from environment signals.
+ *
+ * EAS_BUILD / EAS_BUILD_PLATFORM  -> native (EAS native build)
+ * EAS_UPDATE                      -> native (EAS OTA update)
+ * EVERYSTACK_UPDATE               -> web    (everystack update)
+ * none of the above               -> local  (pnpm dev)
+ */
+function detectSurface() {
+    if (process.env.EAS_BUILD || process.env.EAS_BUILD_PLATFORM || process.env.EAS_UPDATE) {
+        return 'native';
+    }
+    if (process.env.EVERYSTACK_UPDATE) {
+        return 'web';
+    }
+    return 'local';
+}
+/**
+ * Load env config from a file path or auto-discover env.config.js in cwd.
+ */
+function loadEnvConfig(configPath) {
+    const resolved = configPath
+        ? path_1.default.resolve(configPath)
+        : findEnvConfig();
+    // Synchronous require — same pattern used throughout the CLI package.
+    // Works in Metro (CJS interop), tsx (SST), and Node CJS.
+    delete require.cache?.[resolved];
+    const mod = require(resolved);
+    return mod.default || mod;
+}
+/**
+ * Auto-discover env.config.js in the current working directory.
+ */
+function findEnvConfig() {
+    const name = 'env.config.js';
+    const fullPath = path_1.default.resolve(process.cwd(), name);
+    if (fs_1.default.existsSync(fullPath)) {
+        return fullPath;
+    }
+    throw new Error('No env.config.js found. Create one:\n\n'
+        + '  module.exports = {\n'
+        + '    server: [],\n'
+        + '    build: [],\n'
+        + '    mobile: [],\n'
+        + '    web: [],\n'
+        + '  };\n');
+}
+/**
+ * Filter process.env through tier allowlists based on the detected surface.
+ *
+ * Deny-by-default: undeclared keys are dropped.
+ * Server and build tiers are NEVER passed through, even if duplicated in other tiers.
+ *
+ * Surface behavior:
+ *   local  -> web + mobile tiers pass
+ *   native -> web + mobile tiers pass
+ *   web    -> web tier only
+ */
+function filterEnv(surface, config) {
+    // Build the allowlist: web tier always passes
+    const allowed = new Set(config.web || []);
+    // Mobile tier: passes on native and local, blocked on web
+    if (surface !== 'web') {
+        for (const k of (config.mobile || [])) {
+            allowed.add(k);
+        }
+    }
+    // server and build tiers are NEVER added to the allowlist.
+    // Actively remove them in case a key appears in multiple tiers.
+    const blocked = new Set([
+        ...(config.server || []),
+        ...(config.build || []),
+    ]);
+    for (const k of blocked) {
+        allowed.delete(k);
+    }
+    // Collect values for allowed keys from process.env
+    const result = {};
+    for (const key of allowed) {
+        if (process.env[key] !== undefined) {
+            result[key] = process.env[key];
+        }
+    }
+    return result;
+}
+/**
+ * Set EXPO_PUBLIC_* process.env vars for web delivery.
+ *
+ * Constants.expoConfig.extra does NOT work on web — Metro never sets
+ * APP_MANIFEST, so Constants.expoConfig is null in the browser. The only
+ * way to deliver env values to web client code is via EXPO_PUBLIC_* vars,
+ * which Metro inlines as literal strings at compile time.
+ *
+ * Sets EXPO_PUBLIC_* for ALL filtered keys so consumers can use either
+ * delivery path (extra on native, EXPO_PUBLIC_* on web).
+ */
+function setExpoPublicVars(filtered) {
+    for (const [key, value] of Object.entries(filtered)) {
+        process.env[`EXPO_PUBLIC_${key}`] = value;
+    }
+}
+/**
+ * Load and filter environment variables for the current build surface.
+ *
+ * Auto-discovers env.config.js in the current working directory,
+ * or accepts an explicit path. Detects the build surface, filters
+ * process.env through the tier allowlists, sets EXPO_PUBLIC_* vars,
+ * and returns the filtered object for expo.extra.
+ *
+ * @example
+ * // app.config.js — auto-discover env.config.js
+ * const { extra } = require('@everystack/cli/env').load();
+ * module.exports = { expo: { extra } };
+ *
+ * @example
+ * // app.config.js — explicit path
+ * const { extra } = require('@everystack/cli/env').load({ path: './env.config' });
+ */
+function load(options) {
+    const config = loadEnvConfig(options?.path);
+    const surface = detectSurface();
+    const filtered = filterEnv(surface, config);
+    setExpoPublicVars(filtered);
+    return { extra: filtered };
+}