@everystack/cli 0.2.22 → 0.2.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.22",
+  "version": "0.2.24",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/cli/aws.ts

@@ -31,6 +31,7 @@ export async function uploadToS3(
   key: string,
   body: Buffer | Uint8Array,
   contentType: string,
+  cacheControl?: string,
 ): Promise<void> {
   const client = await getS3(region);
   const { PutObjectCommand } = await import('@aws-sdk/client-s3');
@@ -39,6 +40,7 @@ export async function uploadToS3(
     Key: key,
     Body: body,
     ContentType: contentType,
+    ...(cacheControl && { CacheControl: cacheControl }),
   }));
 }
 

package/src/cli/commands/update.ts

@@ -410,6 +410,71 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
         }
       }
 
+      // 3.5. Sync media assets to the media bucket (email logos, OG images, etc.)
+      const assetDirs: Array<{ from: string; to: string; include?: string }> | undefined =
+        appConfig.extra?.everystack?.assets;
+      if (assetDirs?.length) {
+        if (!config.mediaBucket) {
+          warn('everystack.assets configured but no mediaBucket found.');
+          info('Add `mediaBucket: media.name` to the return block in sst.config.ts and redeploy.');
+        } else {
+          step('Syncing media assets...');
+          // @ts-ignore — minimatch lacks type declarations in this project
+          const minimatchMod = await import('minimatch');
+          const minimatch: (p: string, pattern: string, opts?: { matchBase?: boolean }) => boolean =
+            minimatchMod.minimatch || minimatchMod.default || minimatchMod;
+          const MEDIA_CONCURRENCY = 10;
+          let mediaUploaded = 0;
+          let mediaSkipped = 0;
+
+          for (const { from: fromDir, to: toPrefix, include } of assetDirs) {
+            const absFrom = path.resolve(fromDir);
+            let files: Awaited<ReturnType<typeof walkDirectory>>;
+            try {
+              files = await walkDirectory(absFrom);
+            } catch {
+              warn(`Media asset directory not found: ${fromDir}`);
+              continue;
+            }
+
+            // Filter by include glob when specified
+            if (include) {
+              files = files.filter(f => minimatch(f.relativePath, include, { matchBase: true }));
+            }
+
+            for (let i = 0; i < files.length; i += MEDIA_CONCURRENCY) {
+              const batch = files.slice(i, i + MEDIA_CONCURRENCY);
+              await Promise.all(batch.map(async (file) => {
+                const s3Key = `${toPrefix}${file.relativePath}`;
+                const data = Buffer.from(file.data, 'base64');
+
+                // Compare MD5 against S3 ETag for diffing
+                const md5 = `"${crypto.createHash('md5').update(data).digest('hex')}"`;
+                const existing = await headS3(config.region, config.mediaBucket!, s3Key);
+                if (existing?.etag === md5) {
+                  mediaSkipped++;
+                  return;
+                }
+
+                await uploadToS3(
+                  config.region,
+                  config.mediaBucket!,
+                  s3Key,
+                  data,
+                  file.contentType,
+                  'public, max-age=31536000, immutable',
+                );
+                mediaUploaded++;
+              }));
+            }
+          }
+
+          if (mediaUploaded > 0 || mediaSkipped > 0) {
+            success(`Media: ${mediaUploaded} new, ${mediaSkipped} unchanged (skipped)`);
+          }
+        }
+      }
+
       // 4. Write release manifests directly to S3 (source of truth for SSR).
       step('Writing release manifests...');
       const updateId = crypto.createHash('sha256')

package/src/cli/config.ts

@@ -19,6 +19,7 @@ export interface CliConfig {
   workerFunctionName?: string;
   updatesBucket: string;
   clientBundlesBucket: string;
+  mediaBucket?: string;
   kvsArn?: string;
   distributionId?: string;
 }
@@ -32,6 +33,7 @@ interface SstOutputs {
   workerFunctionName?: string;
   updatesBucket?: string;
   clientBundlesBucket?: string;
+  mediaBucket?: string;
   kvsArn?: string;
   distributionId?: string;
 }
@@ -101,6 +103,7 @@ export async function resolveConfig(stage?: string): Promise<CliConfig> {
     workerFunctionName: outputs.workerFunctionName,
     updatesBucket: outputs.updatesBucket,
     clientBundlesBucket: outputs.clientBundlesBucket,
+    mediaBucket: outputs.mediaBucket,
     kvsArn: outputs.kvsArn,
     distributionId: outputs.distributionId,
   };

package/src/cli/discover.ts

@@ -23,6 +23,7 @@ interface DiscoveredConfig {
   workerFunctionName?: string;
   updatesBucket: string;
   clientBundlesBucket: string;
+  mediaBucket?: string;
   kvsArn?: string;
   distributionId?: string;
 }
@@ -207,6 +208,7 @@ export async function discoverLambda(
 interface BucketsResult {
   updatesBucket?: string;
   clientBundlesBucket?: string;
+  mediaBucket?: string;
 }
 
 /**
@@ -224,19 +226,22 @@ export async function discoverBuckets(
 
   const updatesNeedle = `${prefix}updatesbucket-`.toLowerCase();
   const clientNeedle = `${prefix}clientbundlesbucket-`.toLowerCase();
+  const mediaNeedle = `${prefix}mediabucket-`.toLowerCase();
 
   let updatesBucket: string | undefined;
   let clientBundlesBucket: string | undefined;
+  let mediaBucket: string | undefined;
 
   for (const b of buckets) {
     if (!b.Name) continue;
     const lower = b.Name.toLowerCase();
     if (lower.startsWith(updatesNeedle)) updatesBucket = b.Name;
     if (lower.startsWith(clientNeedle)) clientBundlesBucket = b.Name;
-    if (updatesBucket && clientBundlesBucket) break;
+    if (lower.startsWith(mediaNeedle)) mediaBucket = b.Name;
+    if (updatesBucket && clientBundlesBucket && mediaBucket) break;
   }
 
-  return { updatesBucket, clientBundlesBucket };
+  return { updatesBucket, clientBundlesBucket, mediaBucket };
 }
 
 // ---------------------------------------------------------------------------
@@ -295,6 +300,7 @@ export async function discoverConfig(
     workerFunctionName: workerFn,
     updatesBucket: bucketsResult.updatesBucket,
     clientBundlesBucket: bucketsResult.clientBundlesBucket,
+    mediaBucket: bucketsResult.mediaBucket,
     kvsArn: cfResult.kvsArn,
     distributionId,
   };

package/src/cli/utils/walk.ts

@@ -20,10 +20,14 @@ const MIME_MAP: Record<string, string> = {
   '.gif': 'image/gif',
   '.svg': 'image/svg+xml',
   '.webp': 'image/webp',
+  '.avif': 'image/avif',
+  '.ico': 'image/x-icon',
   '.ttf': 'font/ttf',
   '.otf': 'font/otf',
   '.woff': 'font/woff',
   '.woff2': 'font/woff2',
+  '.mp4': 'video/mp4',
+  '.pdf': 'application/pdf',
   '.map': 'application/json',
 };
 

package/src/env.ts

@@ -37,6 +37,8 @@ export interface EnvConfig {
   mobile?: string[];
   /** Safe for all client bundles. Gets EXPO_PUBLIC_* for web delivery. */
   web?: string[];
+  /** SST secret declarations (infrastructure). Falls back to server tier if omitted. */
+  secrets?: string[];
 }
 
 /** Build surface — determines which tiers pass through the filter. */

package/src/sst.ts

@@ -1,15 +1,85 @@
 /**
- * @everystack/cli/sst — Shared env config for SST infrastructure.
+ * @everystack/cli/sst — SST infrastructure helpers.
  *
  * Reads the same env.config.js that @everystack/cli/env uses,
  * ensuring sst.config.ts and app.config.js stay in sync.
  *
  * Usage in sst.config.ts:
- *   import { loadEnvConfig } from '@everystack/cli/sst';
- *   const env = loadEnvConfig();
- *   // env.server = ['DATABASE_URL', 'JWT_SECRET']
+ *   const { createSecrets } = await import('@everystack/cli/sst');
+ *   const { secrets, link, environment } = createSecrets(sst.Secret);
  *
  * @module
  */
 
-export { loadEnvConfig, type EnvConfig } from './env.js';
+import { loadEnvConfig, type EnvConfig } from './env.js';
+
+export { loadEnvConfig, type EnvConfig };
+
+/**
+ * Minimal interface matching the subset of sst.Secret we use.
+ *
+ * The real sst.Secret is a global available only inside sst.config.ts's
+ * run() function. We accept it as a constructor parameter to avoid
+ * coupling this package to SST internals.
+ */
+interface SecretInstance {
+  value: unknown;
+}
+
+/** Return type of createSecrets. */
+export interface CreateSecretsResult {
+  /** All secrets keyed by env var name for selective access. */
+  secrets: Record<string, SecretInstance>;
+  /** Flat array of all secret objects for Lambda `link`. */
+  link: SecretInstance[];
+  /** { KEY: secret.value } map for Lambda `environment`. */
+  environment: Record<string, unknown>;
+}
+
+/**
+ * Create SST Secret objects from env.config.js.
+ *
+ * Reads the `secrets` field from env.config.js (falls back to `server`
+ * tier if omitted). Creates one SST Secret per declared key name.
+ *
+ * @param SecretConstructor - The sst.Secret class, passed from run()
+ * @param configPath - Optional path to env.config.js (auto-discovers if omitted)
+ *
+ * @example
+ * const { createSecrets } = await import('@everystack/cli/sst');
+ * const { secrets, link, environment } = createSecrets(sst.Secret);
+ *
+ * // API Lambda — all secrets
+ * new sst.aws.Function('Api', {
+ *   link: [...link, database, media],
+ *   environment: { ENVIRONMENT: $app.stage, ...environment },
+ * });
+ *
+ * // Worker Lambda — selective
+ * new sst.aws.Function('Worker', {
+ *   link: [secrets.DATABASE_URL, secrets.JWT_SECRET],
+ * });
+ *
+ * // CloudFront edge auth
+ * secrets.JWT_SECRET.value.apply((secret) => authFeature({ secret }));
+ */
+export function createSecrets(
+  SecretConstructor: new (name: string) => SecretInstance,
+  configPath?: string,
+): CreateSecretsResult {
+  const config = loadEnvConfig(configPath);
+  const keys = [...new Set(config.secrets ?? config.server ?? [])];
+
+  const secrets: Record<string, SecretInstance> = {};
+  const link: SecretInstance[] = [];
+  const environment: Record<string, unknown> = {};
+
+  for (const key of keys) {
+    const secret = new SecretConstructor(key);
+    secrets[key] = secret;
+    link.push(secret);
+    environment[key] = secret.value;
+  }
+
+  return { secrets, link, environment };
+}