@everystack/cli 0.2.7 → 0.2.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "publishConfig": {
@@ -41,8 +41,9 @@
     "lint": "tsc --noEmit"
   },
   "dependencies": {
+    "@aws-sdk/client-cloudfront": "3.1053.0",
     "@aws-sdk/client-cloudfront-keyvaluestore": "3.1053.0",
-    "@aws-sdk/signature-v4a": "3.1031.0",
+    "@aws-sdk/signature-v4a": "3.1048.0",
     "glob": "13.0.6",
     "node-forge": "1.4.0",
     "structured-headers": "1.0.1",
@@ -50,7 +51,6 @@
   },
   "peerDependencies": {
     "@everystack/server": ">=0.1.0",
-    "@aws-sdk/client-cloudfront": "3.1053.0",
     "@aws-sdk/client-cloudwatch-logs": "3.1053.0",
     "@aws-sdk/client-lambda": "3.1053.0",
     "@aws-sdk/client-s3": "3.1053.0",
@@ -64,9 +64,6 @@
     "@everystack/server": {
       "optional": true
     },
-    "@aws-sdk/client-cloudfront": {
-      "optional": true
-    },
     "@aws-sdk/client-cloudwatch-logs": {
       "optional": true
     },
@@ -90,7 +87,6 @@
     }
   },
   "devDependencies": {
-    "@aws-sdk/client-cloudfront": "3.1053.0",
     "@aws-sdk/client-cloudwatch-logs": "3.1053.0",
     "@aws-sdk/client-lambda": "3.1053.0",
     "@aws-sdk/client-s3": "3.1053.0",

package/src/cli/aws.ts

@@ -136,6 +136,16 @@ export async function createInvalidation(
 /**
  * Write a versioning key to CloudFront KeyValueStore.
  * KVS requires ETag for optimistic concurrency — DescribeKeyValueStore first.
+ *
+ * KVS endpoints require SigV4a (asymmetric) signing. The SDK discovers the
+ * SigV4a implementation via a mutable singleton in @smithy/signature-v4 that
+ * @smithy/signature-v4a populates as a side-effect import. When the dependency
+ * tree resolves duplicate copies of @smithy/signature-v4, the singleton splits:
+ * the signer registers into one copy while the KVS client reads from another.
+ *
+ * We bypass this entirely by constructing SignatureV4a explicitly and passing it
+ * as `signer` to the client. When `config.signer` is set, resolveAwsSdkSigV4Config
+ * uses it directly — SignatureV4MultiRegion and the container are never consulted.
  */
 export async function putKvsKey(
   region: string,
@@ -143,15 +153,24 @@ export async function putKvsKey(
   key: string,
   value: string,
 ): Promise<void> {
-  // KVS requires SigV4a (asymmetric) signing — load pure-JS implementation
-  await import('@aws-sdk/signature-v4a');
+  const { SignatureV4a } = await import('@aws-sdk/signature-v4a');
+  const { defaultProvider } = await import('@aws-sdk/credential-provider-node');
+  const { Hash } = await import('@smithy/core/serde');
   const {
     CloudFrontKeyValueStoreClient,
     DescribeKeyValueStoreCommand,
     PutKeyCommand,
   } = await import('@aws-sdk/client-cloudfront-keyvaluestore');
 
-  if (!kvsClient) kvsClient = new CloudFrontKeyValueStoreClient({ region });
+  if (!kvsClient) {
+    const signer = new SignatureV4a({
+      credentials: defaultProvider(),
+      region: '*',
+      service: 'cloudfront-keyvaluestore',
+      sha256: Hash.bind(null, 'sha256'),
+    });
+    kvsClient = new CloudFrontKeyValueStoreClient({ region, signer });
+  }
 
   const desc = await kvsClient.send(
     new DescribeKeyValueStoreCommand({ KvsARN: kvsArn })

package/src/handler/assets.ts

@@ -1,10 +1,13 @@
 import type { UpdatesHandlerOptions } from './types';
 
+const debug = process.env.DEBUG_UPDATES === '1';
+
 export async function handleAssets(request: Request, options: UpdatesHandlerOptions): Promise<Response> {
   const url = new URL(request.url);
   const key = url.searchParams.get('key');
 
   if (!key) {
+    console.warn('[updates] asset request rejected: no key');
     return new Response(JSON.stringify({ error: 'No asset key provided.' }), {
       status: 400,
       headers: { 'content-type': 'application/json' },
@@ -15,6 +18,7 @@ export async function handleAssets(request: Request, options: UpdatesHandlerOpti
   // Lambda function URLs cap responses at 6 MB; Hermes bytecode bundles exceed that.
   if (options.storage.presignGet) {
     const presignedUrl = await options.storage.presignGet(key);
+    debug && console.log('[updates] asset redirect', { key });
     return new Response(null, {
       status: 302,
       headers: {
@@ -29,6 +33,7 @@ export async function handleAssets(request: Request, options: UpdatesHandlerOpti
   const result = await options.storage.get(key);
 
   if (!result) {
+    console.warn('[updates] asset not found', { key });
     return new Response(JSON.stringify({ error: `Asset "${key}" not found.` }), {
       status: 404,
       headers: { 'content-type': 'application/json' },

package/src/handler/index.ts

@@ -71,6 +71,7 @@ export function createUpdatesHandler(options: UpdatesHandlerOptions): (request:
       return handleEditChannel(request, options, channelName);
     }
 
+    console.warn('[updates] 404 unmatched route', { method: request.method, pathname });
     return new Response(JSON.stringify({ error: 'Not found' }), {
       status: 404,
       headers: { 'content-type': 'application/json' },

package/src/handler/manifest.ts

@@ -6,6 +6,8 @@ import { buildMultipartResponse } from './multipart';
 import { signRSASHA256, convertSHA256HashToUUID, convertToDictionaryItemsRepresentation } from './signing';
 import { jsonError } from './helpers';
 
+const debug = process.env.DEBUG_UPDATES === '1';
+
 export async function handleManifest(request: Request, options: UpdatesHandlerOptions): Promise<Response> {
   const headers = request.headers;
 
@@ -14,24 +16,46 @@ export async function handleManifest(request: Request, options: UpdatesHandlerOp
 
   const platform = headers.get('expo-platform');
   if (platform !== 'ios' && platform !== 'android') {
+    console.warn('[updates] manifest request rejected: unsupported platform', {
+      platform: headers.get('expo-platform'),
+    });
     return jsonError(400, 'Unsupported platform. Expected either ios or android.');
   }
 
   const runtimeVersion = headers.get('expo-runtime-version');
   if (!runtimeVersion) {
+    console.warn('[updates] manifest request rejected: no runtimeVersion');
     return jsonError(400, 'No runtimeVersion provided.');
   }
 
   const channelName = headers.get('expo-channel-name') || options.defaultChannel || 'production';
 
+  debug && console.log('[updates] manifest request', {
+    platform,
+    runtimeVersion,
+    channelName,
+    currentUpdateId: headers.get('expo-current-update-id'),
+    protocolVersion,
+    expectSignature: !!headers.get('expo-expect-signature'),
+  });
+
   // Try S3 flat-file manifest first (works without DB)
+  const s3Key = `${channelName}/${platform}/${runtimeVersion}/manifest.json`;
   const s3Manifest = await tryS3Manifest(options, channelName, platform, runtimeVersion);
   if (s3Manifest) {
+    debug && console.log('[updates] S3 manifest found', {
+      key: s3Key,
+      updateId: s3Manifest.id,
+      assetCount: s3Manifest.assets?.length,
+      hasLaunchAsset: !!s3Manifest.launchAsset,
+    });
     return buildManifestResponse(request, s3Manifest, options, protocolVersion);
   }
+  debug && console.log('[updates] S3 manifest not found', { key: s3Key });
 
   // Fall back to DB-based lookup (V2)
   if (!options.db) {
+    debug && console.log('[updates] no DB configured, returning 404');
     return jsonError(404, `No update found for ${channelName}/${platform}/${runtimeVersion}`);
   }
 
@@ -50,13 +74,16 @@ export async function handleManifest(request: Request, options: UpdatesHandlerOp
       .limit(1);
 
     if (!channel) {
+      console.warn('[updates] DB channel not found', { channelName });
       return jsonError(404, `Channel "${channelName}" not found.`);
     }
 
     const branchRef = (channel.data as Record<string, unknown>)?.branchRef as string;
     if (!branchRef) {
+      console.warn('[updates] DB channel has no branch mapping', { channelName });
       return jsonError(404, `Channel "${channelName}" has no branch mapping.`);
     }
+    debug && console.log('[updates] DB channel resolved', { channelName, branchRef });
 
     // Look up latest release (buildArtifact type='ota') via run branchRef
     const releaseResults = await options.db
@@ -74,9 +101,15 @@ export async function handleManifest(request: Request, options: UpdatesHandlerOp
       .limit(1);
 
     if (!releaseResults[0]) {
+      console.warn('[updates] DB release not found', { branchRef, runtimeVersion, platform });
       return jsonError(404, `No update found for runtime version: ${runtimeVersion}`);
     }
     release = releaseResults[0].release;
+    debug && console.log('[updates] DB release found', {
+      releaseId: release.id,
+      runId: release.runId,
+      updateId: (release.data as Record<string, unknown>)?.updateId,
+    });
 
     // Look up assets (buildArtifacts type='ota_asset') for this release's run
     assets = await options.db
@@ -86,8 +119,12 @@ export async function handleManifest(request: Request, options: UpdatesHandlerOp
         eq(buildArtifacts.type, 'ota_asset'),
         eq(buildArtifacts.runId, release.runId),
       ));
-  } catch {
+  } catch (err) {
     // DB unavailable or tables don't exist — not an error in V1
+    console.error('[updates] DB lookup error', {
+      error: err instanceof Error ? err.message : String(err),
+      channelName, platform, runtimeVersion,
+    });
     return jsonError(404, `No update found for ${channelName}/${platform}/${runtimeVersion}`);
   }
 
@@ -95,6 +132,7 @@ export async function handleManifest(request: Request, options: UpdatesHandlerOp
 
   // Handle rollback
   if (releaseData.isRollback) {
+    debug && console.log('[updates] response: rollback', { protocolVersion });
     if (protocolVersion === 0) {
       return jsonError(400, 'Rollbacks not supported on protocol version 0');
     }
@@ -106,6 +144,9 @@ export async function handleManifest(request: Request, options: UpdatesHandlerOp
   const updateId = releaseData.updateId as string;
   const releaseUUID = convertSHA256HashToUUID(updateId);
   if (currentUpdateId === releaseUUID && protocolVersion === 1) {
+    debug && console.log('[updates] response: noUpdateAvailable', {
+      currentUpdateId, releaseUUID,
+    });
     return buildNoUpdateAvailableResponse(request, options, protocolVersion);
   }
 
@@ -148,6 +189,13 @@ export async function handleManifest(request: Request, options: UpdatesHandlerOp
     },
   };
 
+  debug && console.log('[updates] response: manifest', {
+    updateId: releaseUUID,
+    assetCount: regularAssets.length,
+    hasLaunchAsset: !!launchAsset,
+    source: 'db',
+  });
+
   return buildManifestResponse(request, manifest, options, protocolVersion);
 }