@everystack/cli 0.2.28 → 0.2.30

package/README.md

@@ -132,6 +132,22 @@ everystack update \
 
 This bundles your app, uploads assets to storage, creates a release record, and signs the manifest.
 
+Media assets configured in `app.config.js` under `extra.everystack.assets` are fingerprinted with 8-char content hashes (e.g., `logo.png` → `logo-a1b2c3d4.png`) and synced to the media bucket. A `media-manifest.json` mapping logical names to fingerprinted paths is written to the bucket root. Stale fingerprinted files from previous deploys are pruned automatically.
+
+```javascript
+// app.config.js
+extra: {
+  everystack: {
+    assets: [
+      { from: 'server/email/assets', to: 'email/', include: '*.{png,jpg}' },
+      { from: 'assets/og', to: 'og/' },
+    ],
+  },
+}
+```
+
+Use `@everystack/server/media` to resolve fingerprinted URLs at runtime in SSR, email templates, and workers.
+
 ### Code Signing
 
 Generate RSA key pair for manifest signing:
@@ -164,6 +180,24 @@ everystack db:psql --stage dev          # Open a psql session via Lambda
 
 `db:migrate` and `db:seed` dispatch to your Lambda's `onAction` handler. `db:psql` proxies a PostgreSQL session through the Lambda, so your database credentials never leave AWS.
 
+### Interactive Console
+
+```bash
+everystack console --stage dev          # Connect to deployed database
+everystack console --stage dev --sandbox  # Sandbox mode: rolls back after each expression
+```
+
+A REPL connected to your deployed database with `db`, `schema`, and `eq`/`and`/`or` helpers in scope. Supports multiline input, persistent history, and tab completion.
+
+**Dot commands:**
+- `.tables` / `.schema [table]` — Inspect database schema
+- `.login` — Authenticate with email/password (hidden input)
+- `.user` — Show current auth context
+- `.logout` — Clear auth context
+- `.sandbox` — Toggle sandbox mode
+
+After `.login`, queries run with RLS policies applied via `pgSettings`. The `current_user` variable is available in scope. Passwords are redacted from history.
+
 ## Client: React Native
 
 ### UpdatesProvider

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.28",
+  "version": "0.2.30",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/cli/aws.ts

@@ -96,6 +96,51 @@ export async function getFromS3(
   }
 }
 
+export async function listS3(
+  region: string,
+  bucket: string,
+  prefix?: string,
+): Promise<string[]> {
+  const client = await getS3(region);
+  const { ListObjectsV2Command } = await import('@aws-sdk/client-s3');
+  const keys: string[] = [];
+  let continuationToken: string | undefined;
+  do {
+    const response = await client.send(new ListObjectsV2Command({
+      Bucket: bucket,
+      ...(prefix && { Prefix: prefix }),
+      ContinuationToken: continuationToken,
+    }));
+    if (response.Contents) {
+      for (const obj of response.Contents) {
+        if (obj.Key) keys.push(obj.Key);
+      }
+    }
+    continuationToken = response.IsTruncated ? response.NextContinuationToken : undefined;
+  } while (continuationToken);
+  return keys;
+}
+
+export async function deleteS3(
+  region: string,
+  bucket: string,
+  keys: string[],
+): Promise<void> {
+  if (keys.length === 0) return;
+  const client = await getS3(region);
+  const { DeleteObjectsCommand } = await import('@aws-sdk/client-s3');
+  for (let i = 0; i < keys.length; i += 1000) {
+    const batch = keys.slice(i, i + 1000);
+    await client.send(new DeleteObjectsCommand({
+      Bucket: bucket,
+      Delete: {
+        Objects: batch.map(key => ({ Key: key })),
+        Quiet: true,
+      },
+    }));
+  }
+}
+
 export async function invokeAction(
   region: string,
   functionName: string,

package/src/cli/commands/console.ts

@@ -67,7 +67,7 @@ export function formatScope(meta: ConsoleMeta): string {
 
 /** Format .user output: current auth context. */
 export function formatUser(user: Record<string, unknown> | null): string {
-  if (!user) return 'No user context. Use login(email, password) or asUser(id) to authenticate.';
+  if (!user) return 'No user context. Use .login or asUser(id) to authenticate.';
   return Object.entries(user).map(([k, v]) => `  ${k}: ${JSON.stringify(v)}`).join('\n');
 }
 
@@ -78,12 +78,13 @@ export function formatHelp(): string {
     '  .columns <Table>   Show columns for a table',
     '  .rpc               List registered RPC functions',
     '  .scope             List all variables in scope',
+    '  .login             Log in with hidden password prompt',
     '  .user              Show current auth context',
     '  .logout            Clear auth context',
     '  .clear             Clear the terminal',
     '  .exit              Exit the console',
     '',
-    '  Auth: login(email, password), asUser(id), logout()',
+    '  Auth: asUser(id), current_user, logout()',
   ].join('\n');
 }
 
@@ -104,6 +105,44 @@ interface ConsoleMeta {
   scope: string[];
 }
 
+// ─── Password Prompt ────────────────────────────────────────────────────────
+
+/** Prompt for a value with output suppressed (password entry). */
+export function questionHidden(
+  rl: readline.Interface,
+  prompt: string,
+): Promise<string> {
+  return new Promise((resolve) => {
+    const output = (rl as any).output as NodeJS.WritableStream;
+    const origWrite = output.write.bind(output);
+    let promptShown = false;
+
+    (output as any).write = function (str: string, ...args: any[]) {
+      if (!promptShown) {
+        promptShown = true;
+        return origWrite(str, ...args);
+      }
+      // Suppress echo of password characters
+      return true;
+    };
+
+    rl.question(prompt, (answer) => {
+      (output as any).write = origWrite;
+      origWrite('\n');
+      resolve(answer);
+    });
+  });
+}
+
+/** Redact password arguments in login() calls for history storage. */
+export function redactLogin(expression: string): string {
+  // Match login('email', 'password') or login("email", "password")
+  return expression.replace(
+    /(login\s*\([^,]+,\s*)(['"`]).*?\2(\s*\))/g,
+    "$1$2***$2$3",
+  );
+}
+
 // ─── History ─────────────────────────────────────────────────────────────────
 
 /** Load history from disk, truncating to HISTORY_MAX lines. */
@@ -278,6 +317,51 @@ export async function consoleCommand(flags: Record<string, string>): Promise<voi
         return true;
       }
 
+      case '.login': {
+        const email = await new Promise<string>((resolve) => {
+          rl.question('  Email: ', resolve);
+        });
+        if (!email.trim()) {
+          fail('Email is required');
+          rl.setPrompt(getPrompt());
+          rl.prompt();
+          return true;
+        }
+        const password = await questionHidden(rl, '  Password: ');
+        if (!password) {
+          rl.setPrompt(getPrompt());
+          rl.prompt();
+          return true;
+        }
+        try {
+          const loginPayload: Record<string, unknown> = {
+            expression: `await login(${JSON.stringify(email.trim())}, ${JSON.stringify(password)})`,
+          };
+          if (currentUser) loginPayload.user = currentUser;
+          if (sandbox) loginPayload.sandbox = true;
+
+          const loginResult: any = await invokeAction(
+            config.region,
+            config.apiFunctionName,
+            'console',
+            loginPayload,
+          );
+          if (loginResult?._auth !== undefined) {
+            currentUser = loginResult._auth.user;
+          }
+          if (loginResult?.error) {
+            fail(loginResult.error);
+          } else {
+            console.log(formatResult(loginResult?.result));
+          }
+        } catch (err: any) {
+          fail(err.message);
+        }
+        rl.setPrompt(getPrompt());
+        rl.prompt();
+        return true;
+      }
+
       case '.user':
         console.log(formatUser(currentUser));
         rl.prompt();
@@ -355,7 +439,7 @@ export async function consoleCommand(flags: Record<string, string>): Promise<voi
       } else {
         console.log(formatResult(result?.result));
       }
-      appendHistory(expression);
+      appendHistory(redactLogin(expression));
     } catch (err: any) {
       fail(err.message);
     }

package/src/cli/commands/update.ts

@@ -6,12 +6,23 @@ import { pipeline } from 'node:stream/promises';
 import { createWriteStream } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { resolveConfig, type CliConfig } from '../config.js';
-import { uploadToS3, headS3, invokeAction } from '../aws.js';
+import { uploadToS3, headS3, listS3, deleteS3, invokeAction } from '../aws.js';
 import { step, success, warn, fail, info } from '../output.js';
 import { exportApp } from '../utils/export.js';
 import { walkDirectory } from '../utils/walk.js';
 import { loadSstSecrets } from '../utils/secrets.js';
 
+/**
+ * Embed an 8-char content hash in a filename for cache busting.
+ * `logo.png` + data → `logo-a1b2c3d4.png`
+ */
+export function fingerprintPath(relativePath: string, data: Buffer): string {
+  const hash8 = crypto.createHash('md5').update(data).digest('hex').slice(0, 8);
+  const ext = path.extname(relativePath);
+  const base = ext ? relativePath.slice(0, -ext.length) : relativePath;
+  return `${base}-${hash8}${ext}`;
+}
+
 export interface UpdateFlags {
   channel?: string;
   branch?: string;
@@ -410,7 +421,7 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
         }
       }
 
-      // 3.5. Sync media assets to the media bucket (email logos, OG images, etc.)
+      // 3.5. Sync fingerprinted media assets to the media bucket (email logos, OG images, etc.)
       const assetDirs: Array<{ from: string; to: string; include?: string }> | undefined =
         appConfig.extra?.everystack?.assets;
       if (assetDirs?.length) {
@@ -426,6 +437,7 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
           const MEDIA_CONCURRENCY = 10;
           let mediaUploaded = 0;
           let mediaSkipped = 0;
+          const manifestFiles: Record<string, string> = {};
 
           for (const { from: fromDir, to: toPrefix, include } of assetDirs) {
             const absFrom = path.resolve(fromDir);
@@ -445,13 +457,17 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
             for (let i = 0; i < files.length; i += MEDIA_CONCURRENCY) {
               const batch = files.slice(i, i + MEDIA_CONCURRENCY);
               await Promise.all(batch.map(async (file) => {
-                const s3Key = `${toPrefix}${file.relativePath}`;
                 const data = Buffer.from(file.data, 'base64');
+                const fingerprinted = fingerprintPath(file.relativePath, data);
+                const logicalKey = `${toPrefix}${file.relativePath}`;
+                const s3Key = `${toPrefix}${fingerprinted}`;
+
+                manifestFiles[logicalKey] = s3Key;
 
-                // Compare MD5 against S3 ETag for diffing
-                const md5 = `"${crypto.createHash('md5').update(data).digest('hex')}"`;
+                // Fingerprinted key encodes the content hash — if it exists, content is identical
                 const existing = await headS3(config.region, config.mediaBucket!, s3Key);
-                if (existing?.etag === md5) {
+                if (existing) {
+                  info(`  ${logicalKey} → ${s3Key} (unchanged)`);
                   mediaSkipped++;
                   return;
                 }
@@ -464,11 +480,51 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
                   file.contentType,
                   'public, max-age=31536000, immutable',
                 );
+                info(`  ${logicalKey} → ${s3Key}`);
                 mediaUploaded++;
               }));
             }
           }
 
+          // Write manifest (no-cache so CDN always revalidates)
+          const manifest = {
+            version: 1,
+            generatedAt: new Date().toISOString(),
+            files: manifestFiles,
+          };
+          await uploadToS3(
+            config.region,
+            config.mediaBucket!,
+            'media-manifest.json',
+            Buffer.from(JSON.stringify(manifest, null, 2)),
+            'application/json',
+            'no-cache',
+          );
+
+          // Prune stale fingerprinted files — scoped to configured prefixes only.
+          // Skip pruning entirely if any prefix is empty (would list the whole bucket).
+          const FINGERPRINT_RE = /-[0-9a-f]{8}\.[^.]+$/;
+          const prefixes = [...new Set(assetDirs.map(d => d.to))];
+          const allKeys: string[] = [];
+          const hasSafePrefix = prefixes.every(p => p.length > 0);
+          if (hasSafePrefix) {
+            for (const prefix of prefixes) {
+              const keys = await listS3(config.region, config.mediaBucket!, prefix);
+              allKeys.push(...keys);
+            }
+          } else {
+            warn('Skipping media prune: asset prefix is empty (would list entire bucket).');
+          }
+          const currentValues = new Set(Object.values(manifestFiles));
+          currentValues.add('media-manifest.json');
+          const staleKeys = allKeys.filter(key =>
+            FINGERPRINT_RE.test(key) && !currentValues.has(key)
+          );
+          if (staleKeys.length > 0) {
+            await deleteS3(config.region, config.mediaBucket!, staleKeys);
+            info(`Pruned ${staleKeys.length} stale media asset(s)`);
+          }
+
           if (mediaUploaded > 0 || mediaSkipped > 0) {
             success(`Media: ${mediaUploaded} new, ${mediaSkipped} unchanged (skipped)`);
           }

package/src/cli/utils/completer.ts

@@ -11,7 +11,7 @@
 
 // ─── Constants ──────────────────────────────────────────────────────────────
 
-const DOT_COMMANDS = ['.tables', '.columns', '.rpc', '.scope', '.user', '.logout', '.help', '.clear', '.exit'];
+const DOT_COMMANDS = ['.tables', '.columns', '.rpc', '.scope', '.login', '.user', '.logout', '.help', '.clear', '.exit'];
 
 const MODEL_METHODS = ['find(', 'where(', 'all()', 'first()', 'last()', 'count()', 'table'];
 const CHAIN_METHODS = ['where(', 'orderBy(', 'limit(', 'offset(', 'first()', 'last()', 'count()', 'all()'];