@everystack/cli 0.2.21 → 0.2.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.21",
+  "version": "0.2.23",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "publishConfig": {
@@ -33,7 +33,7 @@
     },
     "./env": {
       "types": "./src/env.ts",
-      "default": "./src/env.ts"
+      "default": "./src/env.js"
     },
     "./sst": {
       "types": "./src/sst.ts",
@@ -46,6 +46,7 @@
   "scripts": {
     "test": "jest",
     "build": "tsc --build",
+    "prepublishOnly": "tsc --module commonjs --moduleResolution node --target ES2022 --esModuleInterop --skipLibCheck --declaration false --outDir src src/env.ts",
     "lint": "tsc --noEmit"
   },
   "dependencies": {

package/src/env.js

@@ -0,0 +1,154 @@
+"use strict";
+/**
+ * @everystack/cli/env — Deny-by-default environment variable filtering.
+ *
+ * One import in app.config.js. Auto-discovers env.config.js.
+ * Detects build surface, filters secrets by tier, sets EXPO_PUBLIC_* vars.
+ *
+ * Usage:
+ *   const { extra } = require('@everystack/cli/env').load();
+ *   module.exports = { expo: { extra } };
+ *
+ * With explicit config path:
+ *   const { extra } = require('@everystack/cli/env').load({ path: './env.config' });
+ *
+ * Multiple stages. Four buckets. One gate. One file.
+ *
+ * @module
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectSurface = detectSurface;
+exports.loadEnvConfig = loadEnvConfig;
+exports.filterEnv = filterEnv;
+exports.setExpoPublicVars = setExpoPublicVars;
+exports.load = load;
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+/**
+ * Detect the current build surface from environment signals.
+ *
+ * EAS_BUILD / EAS_BUILD_PLATFORM  -> native (EAS native build)
+ * EAS_UPDATE                      -> native (EAS OTA update)
+ * EVERYSTACK_UPDATE               -> web    (everystack update)
+ * none of the above               -> local  (pnpm dev)
+ */
+function detectSurface() {
+    if (process.env.EAS_BUILD || process.env.EAS_BUILD_PLATFORM || process.env.EAS_UPDATE) {
+        return 'native';
+    }
+    if (process.env.EVERYSTACK_UPDATE) {
+        return 'web';
+    }
+    return 'local';
+}
+/**
+ * Load env config from a file path or auto-discover env.config.js in cwd.
+ */
+function loadEnvConfig(configPath) {
+    const resolved = configPath
+        ? path_1.default.resolve(configPath)
+        : findEnvConfig();
+    // Synchronous require — same pattern used throughout the CLI package.
+    // Works in Metro (CJS interop), tsx (SST), and Node CJS.
+    delete require.cache?.[resolved];
+    const mod = require(resolved);
+    return mod.default || mod;
+}
+/**
+ * Auto-discover env.config.js in the current working directory.
+ */
+function findEnvConfig() {
+    const name = 'env.config.js';
+    const fullPath = path_1.default.resolve(process.cwd(), name);
+    if (fs_1.default.existsSync(fullPath)) {
+        return fullPath;
+    }
+    throw new Error('No env.config.js found. Create one:\n\n'
+        + '  module.exports = {\n'
+        + '    server: [],\n'
+        + '    build: [],\n'
+        + '    mobile: [],\n'
+        + '    web: [],\n'
+        + '  };\n');
+}
+/**
+ * Filter process.env through tier allowlists based on the detected surface.
+ *
+ * Deny-by-default: undeclared keys are dropped.
+ * Server and build tiers are NEVER passed through, even if duplicated in other tiers.
+ *
+ * Surface behavior:
+ *   local  -> web + mobile tiers pass
+ *   native -> web + mobile tiers pass
+ *   web    -> web tier only
+ */
+function filterEnv(surface, config) {
+    // Build the allowlist: web tier always passes
+    const allowed = new Set(config.web || []);
+    // Mobile tier: passes on native and local, blocked on web
+    if (surface !== 'web') {
+        for (const k of (config.mobile || [])) {
+            allowed.add(k);
+        }
+    }
+    // server and build tiers are NEVER added to the allowlist.
+    // Actively remove them in case a key appears in multiple tiers.
+    const blocked = new Set([
+        ...(config.server || []),
+        ...(config.build || []),
+    ]);
+    for (const k of blocked) {
+        allowed.delete(k);
+    }
+    // Collect values for allowed keys from process.env
+    const result = {};
+    for (const key of allowed) {
+        if (process.env[key] !== undefined) {
+            result[key] = process.env[key];
+        }
+    }
+    return result;
+}
+/**
+ * Set EXPO_PUBLIC_* process.env vars for web delivery.
+ *
+ * Constants.expoConfig.extra does NOT work on web — Metro never sets
+ * APP_MANIFEST, so Constants.expoConfig is null in the browser. The only
+ * way to deliver env values to web client code is via EXPO_PUBLIC_* vars,
+ * which Metro inlines as literal strings at compile time.
+ *
+ * Sets EXPO_PUBLIC_* for ALL filtered keys so consumers can use either
+ * delivery path (extra on native, EXPO_PUBLIC_* on web).
+ */
+function setExpoPublicVars(filtered) {
+    for (const [key, value] of Object.entries(filtered)) {
+        process.env[`EXPO_PUBLIC_${key}`] = value;
+    }
+}
+/**
+ * Load and filter environment variables for the current build surface.
+ *
+ * Auto-discovers env.config.js in the current working directory,
+ * or accepts an explicit path. Detects the build surface, filters
+ * process.env through the tier allowlists, sets EXPO_PUBLIC_* vars,
+ * and returns the filtered object for expo.extra.
+ *
+ * @example
+ * // app.config.js — auto-discover env.config.js
+ * const { extra } = require('@everystack/cli/env').load();
+ * module.exports = { expo: { extra } };
+ *
+ * @example
+ * // app.config.js — explicit path
+ * const { extra } = require('@everystack/cli/env').load({ path: './env.config' });
+ */
+function load(options) {
+    const config = loadEnvConfig(options?.path);
+    const surface = detectSurface();
+    const filtered = filterEnv(surface, config);
+    setExpoPublicVars(filtered);
+    return { extra: filtered };
+}

package/src/env.ts

@@ -37,6 +37,8 @@ export interface EnvConfig {
   mobile?: string[];
   /** Safe for all client bundles. Gets EXPO_PUBLIC_* for web delivery. */
   web?: string[];
+  /** SST secret declarations (infrastructure). Falls back to server tier if omitted. */
+  secrets?: string[];
 }
 
 /** Build surface — determines which tiers pass through the filter. */

package/src/sst.ts

@@ -1,15 +1,85 @@
 /**
- * @everystack/cli/sst — Shared env config for SST infrastructure.
+ * @everystack/cli/sst — SST infrastructure helpers.
  *
  * Reads the same env.config.js that @everystack/cli/env uses,
  * ensuring sst.config.ts and app.config.js stay in sync.
  *
  * Usage in sst.config.ts:
- *   import { loadEnvConfig } from '@everystack/cli/sst';
- *   const env = loadEnvConfig();
- *   // env.server = ['DATABASE_URL', 'JWT_SECRET']
+ *   const { createSecrets } = await import('@everystack/cli/sst');
+ *   const { secrets, link, environment } = createSecrets(sst.Secret);
  *
  * @module
  */
 
-export { loadEnvConfig, type EnvConfig } from './env.js';
+import { loadEnvConfig, type EnvConfig } from './env.js';
+
+export { loadEnvConfig, type EnvConfig };
+
+/**
+ * Minimal interface matching the subset of sst.Secret we use.
+ *
+ * The real sst.Secret is a global available only inside sst.config.ts's
+ * run() function. We accept it as a constructor parameter to avoid
+ * coupling this package to SST internals.
+ */
+interface SecretInstance {
+  value: unknown;
+}
+
+/** Return type of createSecrets. */
+export interface CreateSecretsResult {
+  /** All secrets keyed by env var name for selective access. */
+  secrets: Record<string, SecretInstance>;
+  /** Flat array of all secret objects for Lambda `link`. */
+  link: SecretInstance[];
+  /** { KEY: secret.value } map for Lambda `environment`. */
+  environment: Record<string, unknown>;
+}
+
+/**
+ * Create SST Secret objects from env.config.js.
+ *
+ * Reads the `secrets` field from env.config.js (falls back to `server`
+ * tier if omitted). Creates one SST Secret per declared key name.
+ *
+ * @param SecretConstructor - The sst.Secret class, passed from run()
+ * @param configPath - Optional path to env.config.js (auto-discovers if omitted)
+ *
+ * @example
+ * const { createSecrets } = await import('@everystack/cli/sst');
+ * const { secrets, link, environment } = createSecrets(sst.Secret);
+ *
+ * // API Lambda — all secrets
+ * new sst.aws.Function('Api', {
+ *   link: [...link, database, media],
+ *   environment: { ENVIRONMENT: $app.stage, ...environment },
+ * });
+ *
+ * // Worker Lambda — selective
+ * new sst.aws.Function('Worker', {
+ *   link: [secrets.DATABASE_URL, secrets.JWT_SECRET],
+ * });
+ *
+ * // CloudFront edge auth
+ * secrets.JWT_SECRET.value.apply((secret) => authFeature({ secret }));
+ */
+export function createSecrets(
+  SecretConstructor: new (name: string) => SecretInstance,
+  configPath?: string,
+): CreateSecretsResult {
+  const config = loadEnvConfig(configPath);
+  const keys = [...new Set(config.secrets ?? config.server ?? [])];
+
+  const secrets: Record<string, SecretInstance> = {};
+  const link: SecretInstance[] = [];
+  const environment: Record<string, unknown> = {};
+
+  for (const key of keys) {
+    const secret = new SecretConstructor(key);
+    secrets[key] = secret;
+    link.push(secret);
+    environment[key] = secret.value;
+  }
+
+  return { secrets, link, environment };
+}