@everystack/cli 0.2.30 → 0.2.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.30",
+  "version": "0.2.33",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/cli/commands/console.ts

@@ -15,7 +15,7 @@ import * as readline from 'node:readline';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as os from 'node:os';
-import { resolveConfig, type CliConfig } from '../config.js';
+import { resolveConfig, opsFunction, type CliConfig } from '../config.js';
 import { invokeAction } from '../aws.js';
 import { success, fail, info } from '../output.js';
 import { formatResult } from '../utils/table.js';
@@ -189,7 +189,7 @@ export async function consoleCommand(flags: Record<string, string>): Promise<voi
     process.exit(1);
   }
 
-  success(`Connected to ${stage} (${config.region}) — ${config.apiFunctionName}`);
+  success(`Connected to ${stage} (${config.region}) — ${opsFunction(config)}`);
   if (sandbox) {
     info('Sandbox mode: all changes will be rolled back after each expression.');
   }
@@ -219,7 +219,7 @@ export async function consoleCommand(flags: Record<string, string>): Promise<voi
     if (cachedMeta) return cachedMeta;
     cachedMeta = await invokeAction(
       config.region,
-      config.apiFunctionName,
+      opsFunction(config),
       'console:meta',
       {},
     ) as ConsoleMeta;
@@ -342,7 +342,7 @@ export async function consoleCommand(flags: Record<string, string>): Promise<voi
 
           const loginResult: any = await invokeAction(
             config.region,
-            config.apiFunctionName,
+            opsFunction(config),
             'console',
             loginPayload,
           );
@@ -423,7 +423,7 @@ export async function consoleCommand(flags: Record<string, string>): Promise<voi
 
       const result: any = await invokeAction(
         config.region,
-        config.apiFunctionName,
+        opsFunction(config),
         'console',
         payload,
       );

package/src/cli/commands/db.ts

@@ -5,7 +5,7 @@
  * No HTTP endpoints, no shared secrets — IAM is the authorization layer.
  */
 
-import { resolveConfig } from '../config.js';
+import { resolveConfig, opsFunction } from '../config.js';
 import { invokeAction } from '../aws.js';
 import { step, success, fail, info } from '../output.js';
 
@@ -19,13 +19,13 @@ export async function dbMigrateCommand(flags: Record<string, string>): Promise<v
     process.exit(1);
   }
 
-  info(`Region: ${config.region}, Function: ${config.apiFunctionName}`);
+  info(`Region: ${config.region}, Function: ${opsFunction(config)}`);
   step('Running migrations via Lambda invoke...');
 
   try {
     const result: any = await invokeAction(
       config.region,
-      config.apiFunctionName,
+      opsFunction(config),
       'migrate',
       {},
     );
@@ -51,13 +51,13 @@ export async function dbSeedCommand(flags: Record<string, string>): Promise<void
     process.exit(1);
   }
 
-  info(`Region: ${config.region}, Function: ${config.apiFunctionName}`);
+  info(`Region: ${config.region}, Function: ${opsFunction(config)}`);
   step('Running seed via Lambda invoke...');
 
   try {
     const result: any = await invokeAction(
       config.region,
-      config.apiFunctionName,
+      opsFunction(config),
       'seed',
       {},
     );
@@ -87,14 +87,14 @@ export async function dbResetCommand(flags: Record<string, string>): Promise<voi
     process.exit(1);
   }
 
-  info(`Region: ${config.region}, Function: ${config.apiFunctionName}`);
+  info(`Region: ${config.region}, Function: ${opsFunction(config)}`);
   info('This will DROP every schema (auth, dist, logs, ops, public) and re-run migrations.');
   step('Resetting database via Lambda invoke...');
 
   try {
     const result: any = await invokeAction(
       config.region,
-      config.apiFunctionName,
+      opsFunction(config),
       'db:reset',
       {},
     );
@@ -120,7 +120,7 @@ export async function dbPsqlCommand(flags: Record<string, string>): Promise<void
     process.exit(1);
   }
 
-  info(`Region: ${config.region}, Function: ${config.apiFunctionName}`);
+  info(`Region: ${config.region}, Function: ${opsFunction(config)}`);
 
   // If -c flag is provided, execute SQL via Lambda and return results
   if (flags.c) {
@@ -128,7 +128,7 @@ export async function dbPsqlCommand(flags: Record<string, string>): Promise<void
     try {
       const result: any = await invokeAction(
         config.region,
-        config.apiFunctionName,
+        opsFunction(config),
         'db:query',
         { sql: flags.c },
       );

package/src/cli/commands/update.ts

@@ -6,7 +6,7 @@ import { pipeline } from 'node:stream/promises';
 import { createWriteStream } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { resolveConfig, type CliConfig } from '../config.js';
-import { uploadToS3, headS3, listS3, deleteS3, invokeAction } from '../aws.js';
+import { uploadToS3, headS3, invokeAction } from '../aws.js';
 import { step, success, warn, fail, info } from '../output.js';
 import { exportApp } from '../utils/export.js';
 import { walkDirectory } from '../utils/walk.js';
@@ -486,7 +486,9 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
             }
           }
 
-          // Write manifest (no-cache so CDN always revalidates)
+          // Write new manifest (no-cache so CDN always revalidates).
+          // Old fingerprinted assets are intentionally kept — emails and other
+          // rendered content reference them forever. Storage cost is negligible.
           const manifest = {
             version: 1,
             generatedAt: new Date().toISOString(),
@@ -501,30 +503,6 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
             'no-cache',
           );
 
-          // Prune stale fingerprinted files — scoped to configured prefixes only.
-          // Skip pruning entirely if any prefix is empty (would list the whole bucket).
-          const FINGERPRINT_RE = /-[0-9a-f]{8}\.[^.]+$/;
-          const prefixes = [...new Set(assetDirs.map(d => d.to))];
-          const allKeys: string[] = [];
-          const hasSafePrefix = prefixes.every(p => p.length > 0);
-          if (hasSafePrefix) {
-            for (const prefix of prefixes) {
-              const keys = await listS3(config.region, config.mediaBucket!, prefix);
-              allKeys.push(...keys);
-            }
-          } else {
-            warn('Skipping media prune: asset prefix is empty (would list entire bucket).');
-          }
-          const currentValues = new Set(Object.values(manifestFiles));
-          currentValues.add('media-manifest.json');
-          const staleKeys = allKeys.filter(key =>
-            FINGERPRINT_RE.test(key) && !currentValues.has(key)
-          );
-          if (staleKeys.length > 0) {
-            await deleteS3(config.region, config.mediaBucket!, staleKeys);
-            info(`Pruned ${staleKeys.length} stale media asset(s)`);
-          }
-
           if (mediaUploaded > 0 || mediaSkipped > 0) {
             success(`Media: ${mediaUploaded} new, ${mediaSkipped} unchanged (skipped)`);
           }

package/src/cli/config.ts

@@ -15,6 +15,8 @@ export interface CliConfig {
   baseUrl: string;
   region: string;
   apiFunctionName: string;
+  /** Dedicated operator function (db/console actions). Falls back to apiFunctionName. */
+  opsFunctionName?: string;
   imageFunctionName?: string;
   workerFunctionName?: string;
   updatesBucket: string;
@@ -24,11 +26,17 @@ export interface CliConfig {
   distributionId?: string;
 }
 
+/** Operator invoke target — dedicated ops function when deployed, else the API function. */
+export function opsFunction(config: CliConfig): string {
+  return config.opsFunctionName ?? config.apiFunctionName;
+}
+
 interface SstOutputs {
   routerUrl?: string;
   apiUrl?: string;
   imageUrl?: string;
   apiFunctionName?: string;
+  opsFunctionName?: string;
   imageFunctionName?: string;
   workerFunctionName?: string;
   updatesBucket?: string;
@@ -99,6 +107,7 @@ export async function resolveConfig(stage?: string): Promise<CliConfig> {
     baseUrl: outputs.routerUrl,
     region,
     apiFunctionName: outputs.apiFunctionName,
+    opsFunctionName: outputs.opsFunctionName,
     imageFunctionName: outputs.imageFunctionName,
     workerFunctionName: outputs.workerFunctionName,
     updatesBucket: outputs.updatesBucket,

package/src/cli/discover.ts

@@ -19,6 +19,7 @@ interface DiscoveredConfig {
   baseUrl: string;
   region: string;
   apiFunctionName: string;
+  opsFunctionName?: string;
   imageFunctionName?: string;
   workerFunctionName?: string;
   updatesBucket: string;
@@ -261,10 +262,11 @@ export async function discoverConfig(
   const prefix = `${appName}-${stage}-`;
 
   // Run CF function + Lambda + S3 discovery in parallel
-  const [cfResult, lambdaResult, bucketsResult, imageFn, workerFn] = await Promise.all([
+  const [cfResult, lambdaResult, bucketsResult, opsFn, imageFn, workerFn] = await Promise.all([
     discoverCfFunction(region, prefix),
     discoverLambda(region, prefix),
     discoverBuckets(region, prefix),
+    discoverFunction(region, prefix, 'OpsFunction').catch(() => undefined),
     discoverFunction(region, prefix, 'ImageFunction').catch(() => undefined),
     discoverFunction(region, prefix, 'WorkerFunction')
       .then(fn => fn || discoverFunction(region, prefix, 'JobsSubscriber'))
@@ -311,6 +313,7 @@ export async function discoverConfig(
     baseUrl: lambdaResult.routerUrl || '',
     region,
     apiFunctionName: lambdaResult.functionName,
+    opsFunctionName: opsFn,
     imageFunctionName: imageFn,
     workerFunctionName: workerFn,
     updatesBucket: bucketsResult.updatesBucket,
@@ -326,13 +329,14 @@ export async function discoverConfig(
 // ---------------------------------------------------------------------------
 
 const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
-const CACHE_VERSION = 2; // Bump when CachedOutputs schema changes to invalidate stale caches
+const CACHE_VERSION = 3; // Bump when CachedOutputs schema changes to invalidate stale caches
 
 interface CachedOutputs {
   _cachedAt: number;
   _version?: number;
   routerUrl?: string;
   apiFunctionName?: string;
+  opsFunctionName?: string;
   imageFunctionName?: string;
   workerFunctionName?: string;
   updatesBucket?: string;
@@ -359,6 +363,7 @@ export async function getCachedConfig(stage: string): Promise<DiscoveredConfig |
       baseUrl: cached.routerUrl || '',
       region: process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION || 'us-east-1',
       apiFunctionName: cached.apiFunctionName,
+      opsFunctionName: cached.opsFunctionName,
       imageFunctionName: cached.imageFunctionName,
       workerFunctionName: cached.workerFunctionName,
       updatesBucket: cached.updatesBucket,
@@ -378,6 +383,7 @@ export async function setCachedConfig(stage: string, config: DiscoveredConfig):
     _version: CACHE_VERSION,
     routerUrl: config.baseUrl,
     apiFunctionName: config.apiFunctionName,
+    opsFunctionName: config.opsFunctionName,
     imageFunctionName: config.imageFunctionName,
     workerFunctionName: config.workerFunctionName,
     updatesBucket: config.updatesBucket,

package/src/env.js

@@ -120,14 +120,25 @@ function filterEnv(surface, config) {
  * way to deliver env values to web client code is via EXPO_PUBLIC_* vars,
  * which Metro inlines as literal strings at compile time.
  *
- * Sets EXPO_PUBLIC_* for ALL filtered keys so consumers can use either
- * delivery path (extra on native, EXPO_PUBLIC_* on web).
+ * When `webKeys` is provided, only those keys get EXPO_PUBLIC_* vars.
+ * The inline path exists solely because web has no `extra` — so it must
+ * carry only web-tier values. Mobile-tier keys are delivered via `extra`
+ * on native and must never reach the Metro inline path: a mis-surfaced
+ * web export would otherwise bake them into public JS.
  */
-function setExpoPublicVars(filtered) {
+function setExpoPublicVars(filtered, webKeys) {
+    const allowed = webKeys ? new Set(webKeys) : null;
     for (const [key, value] of Object.entries(filtered)) {
+        if (allowed && !allowed.has(key))
+            continue;
         process.env[`EXPO_PUBLIC_${key}`] = value;
     }
 }
+/** Stages where the permissive `local` tier set is acceptable. */
+const NON_DEPLOYABLE_STAGES = new Set(['', 'development', 'dev', 'local', 'test']);
+function isDeployableStage(stage) {
+    return !NON_DEPLOYABLE_STAGES.has((stage ?? '').toLowerCase());
+}
 /**
  * Load and filter environment variables for the current build surface.
  *
@@ -148,7 +159,23 @@ function setExpoPublicVars(filtered) {
 function load(options) {
     const config = loadEnvConfig(options?.path);
     const surface = detectSurface();
+    // Fail closed: surface fell through to `local` (the most permissive tier
+    // set) while ENVIRONMENT names a deployable stage. Mixed signals mean a
+    // misconfigured build — refuse to bundle rather than risk shipping the
+    // mobile tier in a web export. EVERYSTACK_SURFACE=local is the explicit
+    // escape hatch for debugging.
+    if (surface === 'local' && isDeployableStage(process.env.ENVIRONMENT)) {
+        if (process.env.EVERYSTACK_SURFACE === 'local') {
+            console.warn(`[everystack/env] ENVIRONMENT=${process.env.ENVIRONMENT} but EVERYSTACK_SURFACE=local — `
+                + 'bundling with the local tier set (mobile keys included). Debug builds only.');
+        }
+        else {
+            throw new Error(`[everystack/env] Surface resolved to 'local' but ENVIRONMENT=${process.env.ENVIRONMENT}. `
+                + "Deployable builds must run under 'everystack update' (EVERYSTACK_UPDATE) or EAS (EAS_BUILD). "
+                + 'Refusing to bundle with the local tier set. Set EVERYSTACK_SURFACE=local to override for debugging.');
+        }
+    }
     const filtered = filterEnv(surface, config);
-    setExpoPublicVars(filtered);
+    setExpoPublicVars(filtered, config.web ?? []);
     return { extra: filtered };
 }

package/src/env.ts

@@ -148,15 +148,30 @@ export function filterEnv(surface: Surface, config: EnvConfig): Record<string, s
  * way to deliver env values to web client code is via EXPO_PUBLIC_* vars,
  * which Metro inlines as literal strings at compile time.
  *
- * Sets EXPO_PUBLIC_* for ALL filtered keys so consumers can use either
- * delivery path (extra on native, EXPO_PUBLIC_* on web).
+ * When `webKeys` is provided, only those keys get EXPO_PUBLIC_* vars.
+ * The inline path exists solely because web has no `extra` — so it must
+ * carry only web-tier values. Mobile-tier keys are delivered via `extra`
+ * on native and must never reach the Metro inline path: a mis-surfaced
+ * web export would otherwise bake them into public JS.
  */
-export function setExpoPublicVars(filtered: Record<string, string>): void {
+export function setExpoPublicVars(
+  filtered: Record<string, string>,
+  webKeys?: string[]
+): void {
+  const allowed = webKeys ? new Set(webKeys) : null;
   for (const [key, value] of Object.entries(filtered)) {
+    if (allowed && !allowed.has(key)) continue;
     process.env[`EXPO_PUBLIC_${key}`] = value;
   }
 }
 
+/** Stages where the permissive `local` tier set is acceptable. */
+const NON_DEPLOYABLE_STAGES = new Set(['', 'development', 'dev', 'local', 'test']);
+
+function isDeployableStage(stage: string | undefined): boolean {
+  return !NON_DEPLOYABLE_STAGES.has((stage ?? '').toLowerCase());
+}
+
 /**
  * Load and filter environment variables for the current build surface.
  *
@@ -177,7 +192,28 @@ export function setExpoPublicVars(filtered: Record<string, string>): void {
 export function load(options?: { path?: string }): { extra: Record<string, string> } {
   const config = loadEnvConfig(options?.path);
   const surface = detectSurface();
+
+  // Fail closed: surface fell through to `local` (the most permissive tier
+  // set) while ENVIRONMENT names a deployable stage. Mixed signals mean a
+  // misconfigured build — refuse to bundle rather than risk shipping the
+  // mobile tier in a web export. EVERYSTACK_SURFACE=local is the explicit
+  // escape hatch for debugging.
+  if (surface === 'local' && isDeployableStage(process.env.ENVIRONMENT)) {
+    if (process.env.EVERYSTACK_SURFACE === 'local') {
+      console.warn(
+        `[everystack/env] ENVIRONMENT=${process.env.ENVIRONMENT} but EVERYSTACK_SURFACE=local — `
+        + 'bundling with the local tier set (mobile keys included). Debug builds only.'
+      );
+    } else {
+      throw new Error(
+        `[everystack/env] Surface resolved to 'local' but ENVIRONMENT=${process.env.ENVIRONMENT}. `
+        + "Deployable builds must run under 'everystack update' (EVERYSTACK_UPDATE) or EAS (EAS_BUILD). "
+        + 'Refusing to bundle with the local tier set. Set EVERYSTACK_SURFACE=local to override for debugging.'
+      );
+    }
+  }
+
   const filtered = filterEnv(surface, config);
-  setExpoPublicVars(filtered);
+  setExpoPublicVars(filtered, config.web ?? []);
   return { extra: filtered };
 }