@everystack/server 0.2.24 → 0.2.27

package/jest-preset.js

@@ -9,28 +9,52 @@
  * jest appends `/jest-preset.js` to the preset string itself, so it resolves
  * this file as `@everystack/server/jest-preset.js`.
  *
+ * IMPORTANT — this preset OWNS `transform`. Jest gives your config precedence on
+ * shared keys, so if your jest config also defines `transform`, it REPLACES the
+ * ts-jest block below and the explicit `@everystack/server/testing` pin is lost.
+ * A dedicated server-boundary project should set only
+ * `{ preset: '@everystack/server' }` (plus non-transform keys). If you must
+ * customize, spread this preset and leave `transform`/`moduleNameMapper` alone:
+ *   const p = require('@everystack/server/jest-preset');
+ *   module.exports = { ...p, testTimeout: 30000 };
+ *
  * Why a preset is needed
  * ----------------------
- * @everystack packages ship TypeScript source, and their subpaths (like
- * `@everystack/server/testing`) are reachable only through the package
- * `exports` map. Two things have to be true for a consumer to import them:
- *
- *  1. TypeScript must read the `exports` map. Only `node16`/`nodenext`/`bundler`
- *     resolution does. ts-jest under `module: commonjs` silently falls back to
- *     classic `node` resolution, which ignores `exports` → TS2307. NodeNext is
- *     the one mode that reads `exports` AND emits CommonJS for jest. Its hybrid
- *     module kind makes ts-jest warn TS151002; we silence only that one code
- *     (NOT via `isolatedModules: true`, which would switch ts-jest to
- *     transpile-only and drop type-checking entirely).
+ * @everystack ships TypeScript source, and `@everystack/server/testing` is a
+ * subpath reachable only through the package `exports` map. ts-jest's resolution
+ * of that subpath is unreliable on a COLD cache (fresh CI, `jest --no-cache`):
+ * it intermittently fails to read the exports map and throws
+ * `TS2307: Cannot find module '@everystack/server/testing'` — passing only once a
+ * warm cache exists, so it's green locally and red in CI. Flattening the export
+ * target does not fix it; an explicit pin does.
  *
- *  2. jest must TRANSFORM the shipped `.ts` source. Source in `node_modules` is
- *     ignored by default, so the `transformIgnorePatterns` allowlist below opts
- *     `@everystack/*` back in. (Inside this monorepo the pnpm symlink escapes
- *     `node_modules` and hides this requirement — real installs need it.)
+ * So this preset resolves its OWN testing entry from disk (below) and pins it two
+ * ways, both cache-independent:
+ *   - tsconfig `paths`        → the type-checker resolves it deterministically.
+ *   - `moduleNameMapper`      → the jest runtime resolves it deterministically.
+ * It also opts `@everystack/*` back into transformation (source ships as `.ts`,
+ * and `node_modules` is not transformed by default).
  *
  * Requires `ts-jest` and `typescript` in the consuming project (already present
  * for any TS jest setup).
  */
+const path = require('path');
+const fs = require('fs');
+
+// Resolve this package's `testing` entry from the preset's own location, so the
+// pin points at a real file regardless of layout (flat src/testing.ts or nested
+// src/testing/index.ts) or where the package is installed.
+const TESTING_ENTRY = ['src/testing.ts', 'src/testing/index.ts']
+  .map((rel) => path.join(__dirname, rel))
+  .find((abs) => fs.existsSync(abs));
+
+const testingPin = TESTING_ENTRY
+  ? { '@everystack/server/testing': [TESTING_ENTRY] }
+  : {};
+const testingMapper = TESTING_ENTRY
+  ? { '^@everystack/server/testing$': TESTING_ENTRY }
+  : {};
+
 module.exports = {
   testEnvironment: 'node',
   moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx', 'json', 'node'],
@@ -46,6 +70,9 @@ module.exports = {
           esModuleInterop: true,
           skipLibCheck: true,
           types: ['jest', 'node'],
+          baseUrl: __dirname,
+          // Pin the exports subpath so the type-checker resolves it cold.
+          paths: testingPin,
         },
         // 151002: "hybrid module kind needs isolatedModules" — expected under
         // NodeNext; suppressing it keeps full type-checking on (real type errors
@@ -56,8 +83,10 @@ module.exports = {
   },
   // @everystack packages ship source, not built dist — transform them.
   transformIgnorePatterns: ['/node_modules/(?!@everystack/)'],
-  // NodeNext consumers may write `.js` on relative ESM specifiers; map to source.
   moduleNameMapper: {
+    // Pin the exports subpath so the jest runtime resolves it cold.
+    ...testingMapper,
+    // NodeNext consumers may write `.js` on relative ESM specifiers; map to source.
     '^(\\.{1,2}/.*)\\.js$': '$1',
   },
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.2.24",
+  "version": "0.2.27",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -74,6 +74,11 @@
       "default": "./src/media.ts"
     }
   },
+  "scripts": {
+    "test": "jest",
+    "build": "tsc --build",
+    "lint": "tsc --noEmit"
+  },
   "peerDependencies": {
     "esbuild": ">=0.20.0",
     "@aws-sdk/client-cloudfront-keyvaluestore": ">=3.1053.0",
@@ -123,6 +128,8 @@
   "devDependencies": {
     "@aws-sdk/client-cloudfront-keyvaluestore": "3.1053.0",
     "@aws-sdk/signature-v4a": "3.1063.0",
+    "@everystack/auth": "workspace:*",
+    "@everystack/cli": "workspace:*",
     "@types/aws-lambda": "8.10.161",
     "@types/jest": "29.5.14",
     "@types/node": "22.19.18",
@@ -132,13 +139,6 @@
     "postgres": "3.4.9",
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
-    "typescript": "5.9.3",
-    "@everystack/auth": "0.2.6",
-    "@everystack/cli": "0.2.39"
-  },
-  "scripts": {
-    "test": "jest",
-    "build": "tsc --build",
-    "lint": "tsc --noEmit"
+    "typescript": "5.9.3"
   }
-}
+}

package/src/image.ts

@@ -155,6 +155,63 @@ export function parseParams(query: Record<string, string | undefined>): Transfor
   return params;
 }
 
+/**
+ * ISOBMFF `ftyp` brands that mean "HEVC-coded HEIF" — i.e. a HEIC still image
+ * (iPhones shoot these by default). Sharp reports all of these as format
+ * `'heif'`, and our HEIC rescue path (heic-decode) can decode them.
+ */
+const HEIC_BRANDS = new Set([
+  'heic', 'heix', 'heim', 'heis', 'hevc', 'hevx', 'hevm', 'hevs', 'mif1', 'msf1',
+]);
+const AVIF_BRANDS = new Set(['avif', 'avis']);
+
+/**
+ * Identify an image format from its magic bytes, independently of Sharp.
+ *
+ * Sharp builds without libheif cannot even *identify* a HEIF container —
+ * `sharp(buf).metadata()` throws, format detection yields `undefined`, and a
+ * real HEIC photo is misrouted down the non-image passthrough path (413 when
+ * over the passthrough cap, or raw `image/heic` bytes that only Safari renders).
+ * Trusting the bytes instead of Sharp makes HEIC detection build-independent and
+ * lets the existing `heif` rescue path fire.
+ *
+ * Returns a Sharp-compatible format string (`jpeg`, `png`, `gif`, `webp`,
+ * `heif`, `avif`) or `undefined` when the bytes aren't a recognized image.
+ */
+export function sniffImageFormat(data: Buffer): string | undefined {
+  if (data.length < 3) return undefined;
+
+  // JPEG: FF D8 FF
+  if (data[0] === 0xff && data[1] === 0xd8 && data[2] === 0xff) return 'jpeg';
+  // PNG: 89 50 4E 47 0D 0A 1A 0A
+  if (
+    data[0] === 0x89 && data[1] === 0x50 && data[2] === 0x4e && data[3] === 0x47 &&
+    data[4] === 0x0d && data[5] === 0x0a && data[6] === 0x1a && data[7] === 0x0a
+  ) return 'png';
+  // GIF: "GIF87a" / "GIF89a"
+  if (data.toString('ascii', 0, 3) === 'GIF') return 'gif';
+  // WebP: "RIFF"...."WEBP"
+  if (data.toString('ascii', 0, 4) === 'RIFF' && data.toString('ascii', 8, 12) === 'WEBP') return 'webp';
+  // TIFF: "II*\0" / "MM\0*"
+  if (
+    (data[0] === 0x49 && data[1] === 0x49 && data[2] === 0x2a && data[3] === 0x00) ||
+    (data[0] === 0x4d && data[1] === 0x4d && data[2] === 0x00 && data[3] === 0x2a)
+  ) return 'tiff';
+
+  // ISOBMFF (HEIC/HEIF/AVIF): [4-byte size]["ftyp"][major brand][minor][compatible…]
+  if (data.toString('ascii', 4, 8) === 'ftyp') {
+    const boxSize = Math.min(data.readUInt32BE(0) || data.length, data.length);
+    const brands: string[] = [data.toString('ascii', 8, 12)];
+    for (let off = 16; off + 4 <= boxSize; off += 4) {
+      brands.push(data.toString('ascii', off, off + 4));
+    }
+    if (brands.some((b) => HEIC_BRANDS.has(b))) return 'heif';
+    if (brands.some((b) => AVIF_BRANDS.has(b))) return 'avif';
+  }
+
+  return undefined;
+}
+
 function isNotFound(error: any): boolean {
   return (
     error.name === 'NotFound' ||
@@ -367,7 +424,15 @@ export function createImageHandler(
         const meta = await sharp(originalData).metadata();
         detectedFormat = meta.format; // jpeg, png, webp, gif, tiff, heif, etc.
       } catch {
-        // Sharp can't parse it — not an image
+        // Sharp can't parse it — not an image, OR a HEIF container this Sharp
+        // build has no libheif to identify. Fall through to the magic-byte sniff.
+      }
+
+      // A Sharp build without libheif throws on HEIF and leaves detectedFormat
+      // undefined, misrouting real HEIC photos to the non-image passthrough
+      // below. Sniff the bytes so `heif` is detected and the rescue path fires.
+      if (!detectedFormat) {
+        detectedFormat = sniffImageFormat(originalData);
       }
 
       if (!detectedFormat) {

package/src/plugin.ts

@@ -582,6 +582,36 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
       }
     };
 
+    // --- db:authz:probe — the authorization red-team's execution path ---
+    // Runs the CLI-built probe SQL (SET ROLE + attempt per role/table/command, each in
+    // its own savepoint) inside ONE transaction that ALWAYS rolls back, then returns the
+    // outcome rows. Unlike db:query this permits writes — they are required to test
+    // INSERT/UPDATE/DELETE privileges — but the forced rollback guarantees nothing
+    // persists. IAM-gated like every action. The CLI owns the SQL (authz-redteam.ts);
+    // this is the thin, transactional, self-reverting runner it needs.
+    actions['db:authz:probe'] = async (payload, _ctx) => {
+      const { setup, read } = (payload ?? {}) as { setup?: string; read?: string };
+      if (!setup || !read) {
+        return { error: 'db:authz:probe requires { setup, read } SQL strings' };
+      }
+      const { sql } = await import('drizzle-orm');
+      const PROBE_ROLLBACK = Symbol('authz_probe_rollback');
+      let rows: any[] = [];
+      try {
+        await opsDb.transaction(async (tx: any) => {
+          await tx.execute(sql.raw(setup));
+          const result: any = await tx.execute(sql.raw(read));
+          rows = Array.isArray(result) ? result : result?.rows ?? [];
+          throw PROBE_ROLLBACK; // discard every probe write
+        });
+      } catch (err: unknown) {
+        if (err !== PROBE_ROLLBACK) {
+          return { error: (err as any)?.message || String(err) };
+        }
+      }
+      return { rows };
+    };
+
     // --- db:doctor — "is my database actually secure?" ---
     // Probes the api connection (createDb / DATABASE_URL) and the operator connection
     // (opsDb / ADMIN_DATABASE_URL) from inside the VPC and reports whether the api path