@everystack/cli 0.2.22 → 0.2.23

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.22",
+  "version": "0.2.23",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/env.ts

@@ -37,6 +37,8 @@ export interface EnvConfig {
   mobile?: string[];
   /** Safe for all client bundles. Gets EXPO_PUBLIC_* for web delivery. */
   web?: string[];
+  /** SST secret declarations (infrastructure). Falls back to server tier if omitted. */
+  secrets?: string[];
 }
 
 /** Build surface — determines which tiers pass through the filter. */

package/src/sst.ts

@@ -1,15 +1,85 @@
 /**
- * @everystack/cli/sst — Shared env config for SST infrastructure.
+ * @everystack/cli/sst — SST infrastructure helpers.
  *
  * Reads the same env.config.js that @everystack/cli/env uses,
  * ensuring sst.config.ts and app.config.js stay in sync.
  *
  * Usage in sst.config.ts:
- *   import { loadEnvConfig } from '@everystack/cli/sst';
- *   const env = loadEnvConfig();
- *   // env.server = ['DATABASE_URL', 'JWT_SECRET']
+ *   const { createSecrets } = await import('@everystack/cli/sst');
+ *   const { secrets, link, environment } = createSecrets(sst.Secret);
  *
  * @module
  */
 
-export { loadEnvConfig, type EnvConfig } from './env.js';
+import { loadEnvConfig, type EnvConfig } from './env.js';
+
+export { loadEnvConfig, type EnvConfig };
+
+/**
+ * Minimal interface matching the subset of sst.Secret we use.
+ *
+ * The real sst.Secret is a global available only inside sst.config.ts's
+ * run() function. We accept it as a constructor parameter to avoid
+ * coupling this package to SST internals.
+ */
+interface SecretInstance {
+  value: unknown;
+}
+
+/** Return type of createSecrets. */
+export interface CreateSecretsResult {
+  /** All secrets keyed by env var name for selective access. */
+  secrets: Record<string, SecretInstance>;
+  /** Flat array of all secret objects for Lambda `link`. */
+  link: SecretInstance[];
+  /** { KEY: secret.value } map for Lambda `environment`. */
+  environment: Record<string, unknown>;
+}
+
+/**
+ * Create SST Secret objects from env.config.js.
+ *
+ * Reads the `secrets` field from env.config.js (falls back to `server`
+ * tier if omitted). Creates one SST Secret per declared key name.
+ *
+ * @param SecretConstructor - The sst.Secret class, passed from run()
+ * @param configPath - Optional path to env.config.js (auto-discovers if omitted)
+ *
+ * @example
+ * const { createSecrets } = await import('@everystack/cli/sst');
+ * const { secrets, link, environment } = createSecrets(sst.Secret);
+ *
+ * // API Lambda — all secrets
+ * new sst.aws.Function('Api', {
+ *   link: [...link, database, media],
+ *   environment: { ENVIRONMENT: $app.stage, ...environment },
+ * });
+ *
+ * // Worker Lambda — selective
+ * new sst.aws.Function('Worker', {
+ *   link: [secrets.DATABASE_URL, secrets.JWT_SECRET],
+ * });
+ *
+ * // CloudFront edge auth
+ * secrets.JWT_SECRET.value.apply((secret) => authFeature({ secret }));
+ */
+export function createSecrets(
+  SecretConstructor: new (name: string) => SecretInstance,
+  configPath?: string,
+): CreateSecretsResult {
+  const config = loadEnvConfig(configPath);
+  const keys = [...new Set(config.secrets ?? config.server ?? [])];
+
+  const secrets: Record<string, SecretInstance> = {};
+  const link: SecretInstance[] = [];
+  const environment: Record<string, unknown> = {};
+
+  for (const key of keys) {
+    const secret = new SecretConstructor(key);
+    secrets[key] = secret;
+    link.push(secret);
+    environment[key] = secret.value;
+  }
+
+  return { secrets, link, environment };
+}