@everystack/cli 0.4.19 → 0.4.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.19",
+  "version": "0.4.20",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/commands/db.ts

@@ -207,9 +207,54 @@ export function buildProvisionSecretPlan(args: {
   return { updates, notes, warnings };
 }
 
+/** The provisioning core's shape (mirrors @everystack/server/provision — no compile-time dep,
+ *  same seam as pipeline-loader). */
+export interface ServerProvision {
+  runProvision(
+    payload: { authPassword?: string; adminPassword?: string },
+    deps: {
+      execute: (sql: string) => Promise<unknown>;
+      connection?: { host: string; port?: number | string; database: string } | null;
+      connectProbe?: (url: string) => Promise<void>;
+    },
+  ): Promise<any>;
+}
+
+/**
+ * Lazily load the provisioning core from the @everystack/server peer (runtime only —
+ * the CLI keeps no compile-time dependency on the server package). A missing peer gets
+ * the install remedy, not a raw ERR_MODULE_NOT_FOUND.
+ */
+export async function loadServerProvision(importer?: () => Promise<unknown>): Promise<ServerProvision> {
+  const spec = '@everystack/server/provision';
+  try {
+    return (await (importer ? importer() : import(spec))) as ServerProvision;
+  } catch (err: unknown) {
+    const code = (err as { code?: string })?.code;
+    const message = String((err as { message?: string })?.message ?? err);
+    if (code === 'ERR_MODULE_NOT_FOUND' || code === 'MODULE_NOT_FOUND' || /Cannot find (package|module)/.test(message)) {
+      throw new Error(
+        'db:provision --database-url needs @everystack/server (>= 0.4.6) installed in this app — '
+        + 'it carries the provisioning logic:\n  pnpm add @everystack/server',
+      );
+    }
+    throw err;
+  }
+}
+
+/** host/port/database from a postgres URL — the direct venue's connection info. */
+export function parseUrlConnection(url: string): { host: string; port: string; database: string } {
+  const u = new URL(url);
+  return {
+    host: u.hostname,
+    port: u.port || '5432',
+    database: u.pathname.replace(/^\//, ''),
+  };
+}
+
 export async function dbProvisionCommand(flags: Record<string, string>): Promise<void> {
   if (!flags.stage) {
-    fail('--stage is required for db:provision (it writes the DATABASE_URL secret for that stage)');
+    fail('--stage is required for db:provision (it writes the stage\'s DATABASE_URL secret — the new credentials are never displayed, so they must land in the secret store)');
     process.exit(1);
   }
 
@@ -222,7 +267,16 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
     process.exit(1);
   }
 
-  info(`Region: ${config.region}, Function: ${opsFunction(config)}`);
+  // Venue: an explicit --database-url runs the role chain over a DIRECT connection — the
+  // bring-your-own-RDS shape, where the operator holds the master URL and the deployed app
+  // has no dbPlugin/Ops Lambda to dispatch to. --stage still names the secret store the new
+  // credentials are written to. No flag = the ops-Lambda venue, unchanged.
+  const directUrl = flags['database-url'];
+  if (directUrl) {
+    info(`Region: ${config.region}, venue: direct connection (bring-your-own database)`);
+  } else {
+    info(`Region: ${config.region}, Function: ${opsFunction(config)}`);
+  }
   info('Creating the least-privilege role chain on your EXISTING database (no database is created).');
   step('Provisioning roles...');
 
@@ -233,17 +287,58 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   const adminPassword = randomBytes(24).toString('hex');
 
   let result: any;
-  try {
-    result = await invokeAction(config.region, opsFunction(config), 'db:provision', { authPassword, adminPassword });
-  } catch (err: any) {
-    fail(`db:provision failed: ${err.message}`);
-    for (const line of opsAdviceLines(err, [IAM_ADVICE])) info(line);
-    process.exit(1);
+  let conn: any;
+  if (directUrl) {
+    try {
+      const { runProvision } = await loadServerProvision();
+      const { createUrlRunner } = await import('../db-source.js');
+      const { runner, end } = await createUrlRunner(directUrl);
+      try {
+        result = await runProvision({ authPassword, adminPassword }, {
+          execute: async (statement) => runner(statement),
+          connection: parseUrlConnection(directUrl),
+          // Same probe as the ops-Lambda venue: a real login as the new role, DDL-capable.
+          connectProbe: async (probeUrl) => {
+            const { default: postgres } = await import('postgres');
+            const probe = postgres(probeUrl, { max: 1, connect_timeout: 5, ssl: 'prefer' });
+            try {
+              await probe`SELECT 1`;
+              await probe.unsafe('CREATE TEMP TABLE _everystack_provision_probe (x int)');
+              await probe.unsafe('DROP TABLE _everystack_provision_probe');
+            } finally {
+              await probe.end({ timeout: 1 });
+            }
+          },
+        });
+      } finally {
+        await end?.();
+      }
+    } catch (err: any) {
+      fail(`db:provision failed: ${err.message}`);
+      process.exit(1);
+    }
+    conn = parseUrlConnection(directUrl);
+  } else {
+    try {
+      result = await invokeAction(config.region, opsFunction(config), 'db:provision', { authPassword, adminPassword });
+    } catch (err: any) {
+      fail(`db:provision failed: ${err.message}`);
+      if (/Unknown action/i.test(String(err.message))) {
+        info('The deployed handler has no dbPlugin (no Ops Lambda). For a bring-your-own database,');
+        info('run the DIRECT venue instead: everystack db:provision --stage <stage> --database-url <master-url>');
+      }
+      for (const line of opsAdviceLines(err, [IAM_ADVICE])) info(line);
+      process.exit(1);
+    }
   }
   if (result?.error) {
     // Includes the admin-verification refusal: the action set NO authenticator password,
     // so nothing here rewrites DATABASE_URL — the working credentials are untouched.
     fail(`db:provision failed: ${result.error}`);
+    if (!directUrl && /Unknown action/i.test(String(result.error))) {
+      info('The deployed handler has no dbPlugin (no Ops Lambda). For a bring-your-own database,');
+      info('run the DIRECT venue instead: everystack db:provision --stage <stage> --database-url <master-url>');
+    }
     process.exit(1);
   }
   success(`Role chain ready: ${result.loginRole} (LOGIN, NOINHERIT, no BYPASSRLS) → can SET ROLE to ${result.appRoles.join(', ')}`);
@@ -252,11 +347,13 @@ export async function dbProvisionCommand(flags: Record<string, string>): Promise
   }
 
   // Resolve host/port/db (not secret) to build the connection strings in memory.
-  let conn: any;
-  try {
-    conn = await invokeAction(config.region, opsFunction(config), 'db:psql', {});
-  } catch {
-    /* handled below */
+  // Direct venue already knows them from the URL itself.
+  if (!directUrl) {
+    try {
+      conn = await invokeAction(config.region, opsFunction(config), 'db:psql', {});
+    } catch {
+      /* handled below */
+    }
   }
   if (!conn?.host) {
     fail('Could not resolve the database host to build DATABASE_URL.');

package/src/cli/commands/update.ts

@@ -32,6 +32,46 @@ export interface UpdateFlags {
   export?: string;
 }
 
+/**
+ * The runtimeVersion as a STRING — the only shape the release path can carry.
+ * Expo's config allows a policy object; interpolating one into the S3 key
+ * produced `releases/dev/[object Object]/…` (a consumer field report). Locally
+ * derivable policies resolve here; the build-time ones (fingerprint,
+ * nativeVersion — computed by native tooling, undefined for a web publish)
+ * are refused with the remedies instead of silently corrupting the key.
+ */
+export function resolveRuntimeVersion(appConfig: {
+  runtimeVersion?: unknown;
+  version?: string;
+  sdkVersion?: string;
+}): string {
+  const rv = appConfig.runtimeVersion;
+  if (typeof rv === 'string') return rv;
+  const policy = (rv as { policy?: string } | undefined)?.policy;
+  if (policy === 'appVersion') {
+    if (!appConfig.version) {
+      throw new Error("runtimeVersion policy 'appVersion' needs a \"version\" field in app.json — add one, or set an explicit string runtimeVersion.");
+    }
+    return appConfig.version;
+  }
+  if (policy === 'sdkVersion') {
+    if (!appConfig.sdkVersion) {
+      throw new Error("runtimeVersion policy 'sdkVersion' needs an \"sdkVersion\" field in app.json — add one, or set an explicit string runtimeVersion.");
+    }
+    return appConfig.sdkVersion;
+  }
+  if (policy === 'fingerprint' || policy === 'nativeVersion') {
+    throw new Error(
+      `runtimeVersion policy '${policy}' is computed by the native build tooling (EAS / @expo/fingerprint) — `
+      + 'everystack update cannot resolve it, and for a web publish it is undefined. '
+      + 'Use an explicit string runtimeVersion, or { "policy": "appVersion" } to track your app version.',
+    );
+  }
+  throw new Error(
+    `Unsupported runtimeVersion ${JSON.stringify(rv)} — use an explicit string, { "policy": "appVersion" }, or { "policy": "sdkVersion" }.`,
+  );
+}
+
 export async function updateCommand(flags: UpdateFlags & Record<string, string>): Promise<void> {
   // Signal publish context so app.config.js can detect it's not a dev session.
   // Without this, dotenv guards that skip .env.local for EAS_BUILD/EAS_UPDATE
@@ -98,15 +138,22 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
   // Read app config
   step('Reading app config...');
   const appConfig = await loadAppConfig();
-  const runtimeVersion = appConfig.runtimeVersion;
 
-  if (!runtimeVersion) {
+  if (!appConfig.runtimeVersion) {
     fail('No runtimeVersion found in app.json/app.config.js');
     info('Add "runtimeVersion" to your app.json, e.g.:');
-    info('  { "expo": { "runtimeVersion": { "policy": "fingerprint" } } }');
+    info('  { "expo": { "runtimeVersion": "1.0.0" } }        (explicit string)');
+    info('  { "expo": { "runtimeVersion": { "policy": "appVersion" } } }  (tracks "version")');
     info('See: https://docs.expo.dev/eas-update/runtime-versions/');
     process.exit(1);
   }
+  let runtimeVersion: string;
+  try {
+    runtimeVersion = resolveRuntimeVersion(appConfig);
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
   success(`Runtime version: ${runtimeVersion}`);
 
   const distDir = path.resolve('dist');
@@ -561,13 +608,20 @@ export async function updateCommand(flags: UpdateFlags & Record<string, string>)
         );
         if (result?.error) {
           info(`DB mirror skipped: ${result.error}`);
+          // The dispatcher answers Unknown action as result.error, not a throw — explain
+          // there too, or the miss reads like a failure with no remedy.
+          if (/Unknown action/i.test(String(result.error))) {
+            info('This is optional — the S3 manifests are the source of truth for serving.');
+            info('For DB-backed release tracking, add updatesPlugin (from @everystack/cli/plugin) to the deployed handler.');
+          }
         } else {
           info(`Release mirrored to DB: channel=${result?.channel || channel}`);
         }
       } catch (err: any) {
         // register-web is optional — the S3 manifests are the source of truth.
         if (err.message?.includes('Unknown action')) {
-          info('Tip: add a "register-web" case to onAction for DB-backed release tracking.');
+          info('DB mirror skipped (optional — S3 manifests are the source of truth).');
+          info('For DB-backed release tracking, add updatesPlugin (from @everystack/cli/plugin) to the deployed handler.');
         } else {
           info(`DB mirror skipped: ${err.message}`);
         }

package/src/cli/index.ts

@@ -353,7 +353,7 @@ Usage:
   everystack db:psql           --stage <name>  Interactive ADMIN psql (IAM-gated; resolves the admin URL in-process)
   everystack db:psql           [--stage <name>] -c <command>  Run one query via Lambda (works for private RDS)
   everystack db:doctor         [--stage <name>]  Check the DB is least-privilege + RLS-subject (api vs operator connection)
-  everystack db:provision      [--stage <name>]  Create the least-privilege role chain on an EXISTING database (idempotent; creates no DB)
+  everystack db:provision      --stage <name> [--database-url <url>]  Create the least-privilege role chain on an EXISTING database (idempotent; creates no DB). --database-url = DIRECT venue for a bring-your-own database (no Ops Lambda needed); --stage names the secret store either way
   everystack db:snapshot       [--stage <name>] [--instance <id>]  Take a physical RDS snapshot (instant DR point; RDS only — use db:backup for portable logical backups)
   everystack db:snapshots      [--stage <name>] [--instance <id>]  List manual RDS snapshots for the instance
   everystack db:backup:probe   [--stage <name>]  Verify the pg_dump layer is attached + version-compatible with the server