@everystack/server 0.3.1 → 0.3.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -139,8 +139,8 @@
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/auth": "0.3.0",
-    "@everystack/cli": "0.3.3"
+    "@everystack/auth": "0.3.1",
+    "@everystack/cli": "0.3.27"
   },
   "scripts": {
     "test": "jest",

package/src/backup-run.ts

@@ -132,17 +132,10 @@ export async function listBackups(deps: BackupRunDeps, stage: string): Promise<B
  * pg_restore throws with its stderr. (We start strict and observe benign-error behavior on the
  * deploy smoke test; the flags --no-owner/--no-privileges/--no-comments remove the usual offenders.)
  */
-export async function runRestore(deps: BackupRunDeps, id: string): Promise<{ id: string; restored: true }> {
-  const key = keyForId(id);
-  if (!key) throw new Error(`Malformed backup id: ${id}`);
-  const env = { ...process.env, ...pgEnvFromUrl(deps.adminUrl) };
-  const dbName = dbNameFromUrl(deps.adminUrl);
-
-  const s3 = await getS3(deps.region);
-  const { GetObjectCommand } = await import('@aws-sdk/client-s3');
-  const obj: any = await s3.send(new GetObjectCommand({ Bucket: deps.bucket, Key: key }));
-  if (!obj.Body) throw new Error(`Backup not found: ${id}`);
-  const body = obj.Body as Readable;
+/** The shared restore pipeline: gzipped custom-format archive stream → gunzip → pg_restore. */
+async function restoreFromStream(adminUrl: string, body: Readable): Promise<void> {
+  const env = { ...process.env, ...pgEnvFromUrl(adminUrl) };
+  const dbName = dbNameFromUrl(adminUrl);
 
   const child = spawn('pg_restore', pgRestoreArgs(dbName), { env, stdio: ['pipe', 'ignore', 'pipe'] });
   let stderr = '';
@@ -154,8 +147,48 @@ export async function runRestore(deps: BackupRunDeps, id: string): Promise<{ id:
   });
 
   await Promise.all([
-    pipeline(body, createGunzip(), child.stdin!), // S3 → gunzip → pg_restore stdin
+    pipeline(body, createGunzip(), child.stdin!), // source → gunzip → pg_restore stdin
     childExit,
   ]);
+}
+
+export async function runRestore(deps: BackupRunDeps, id: string): Promise<{ id: string; restored: true }> {
+  const key = keyForId(id);
+  if (!key) throw new Error(`Malformed backup id: ${id}`);
+
+  const s3 = await getS3(deps.region);
+  const { GetObjectCommand } = await import('@aws-sdk/client-s3');
+  const obj: any = await s3.send(new GetObjectCommand({ Bucket: deps.bucket, Key: key }));
+  if (!obj.Body) throw new Error(`Backup not found: ${id}`);
+
+  await restoreFromStream(deps.adminUrl, obj.Body as Readable);
   return { id, restored: true };
 }
+
+/** The URL mode's precondition — a presigned http(s) download, never a path or bucket ref. */
+export function assertRestoreUrl(url: string): void {
+  if (!/^https?:\/\//.test(url)) {
+    throw new Error('db:restore url must be an http(s) URL — a presigned backup download (everystack db:backup:download / db:fork mints one).');
+  }
+}
+
+/**
+ * Restore from a presigned URL — the cross-stage fork's hand-off
+ * (docs/plans/branch-stages.md). A backup lives in its SOURCE stage's
+ * bucket, and this stage's Lambda has no IAM path to it; the operator who
+ * can read the source's backups and invoke this action IS the
+ * authorization, and the URL expires. Same stream pipeline as the id mode.
+ */
+export async function runRestoreFromUrl(
+  deps: Pick<BackupRunDeps, 'adminUrl'>,
+  url: string,
+): Promise<{ restored: true }> {
+  assertRestoreUrl(url);
+  const res = await fetch(url);
+  if (!res.ok || !res.body) {
+    throw new Error(`fetching the backup failed: HTTP ${res.status} — presigned URLs expire in an hour; mint a fresh one.`);
+  }
+  const { Readable: NodeReadable } = await import('node:stream');
+  await restoreFromStream(deps.adminUrl, NodeReadable.fromWeb(res.body as any));
+  return { restored: true };
+}

package/src/image.ts

@@ -155,6 +155,63 @@ export function parseParams(query: Record<string, string | undefined>): Transfor
   return params;
 }
 
+/**
+ * ISOBMFF `ftyp` brands that mean "HEVC-coded HEIF" — i.e. a HEIC still image
+ * (iPhones shoot these by default). Sharp reports all of these as format
+ * `'heif'`, and our HEIC rescue path (heic-decode) can decode them.
+ */
+const HEIC_BRANDS = new Set([
+  'heic', 'heix', 'heim', 'heis', 'hevc', 'hevx', 'hevm', 'hevs', 'mif1', 'msf1',
+]);
+const AVIF_BRANDS = new Set(['avif', 'avis']);
+
+/**
+ * Identify an image format from its magic bytes, independently of Sharp.
+ *
+ * Sharp builds without libheif cannot even *identify* a HEIF container —
+ * `sharp(buf).metadata()` throws, format detection yields `undefined`, and a
+ * real HEIC photo is misrouted down the non-image passthrough path (413 when
+ * over the passthrough cap, or raw `image/heic` bytes that only Safari renders).
+ * Trusting the bytes instead of Sharp makes HEIC detection build-independent and
+ * lets the existing `heif` rescue path fire.
+ *
+ * Returns a Sharp-compatible format string (`jpeg`, `png`, `gif`, `webp`,
+ * `heif`, `avif`) or `undefined` when the bytes aren't a recognized image.
+ */
+export function sniffImageFormat(data: Buffer): string | undefined {
+  if (data.length < 3) return undefined;
+
+  // JPEG: FF D8 FF
+  if (data[0] === 0xff && data[1] === 0xd8 && data[2] === 0xff) return 'jpeg';
+  // PNG: 89 50 4E 47 0D 0A 1A 0A
+  if (
+    data[0] === 0x89 && data[1] === 0x50 && data[2] === 0x4e && data[3] === 0x47 &&
+    data[4] === 0x0d && data[5] === 0x0a && data[6] === 0x1a && data[7] === 0x0a
+  ) return 'png';
+  // GIF: "GIF87a" / "GIF89a"
+  if (data.toString('ascii', 0, 3) === 'GIF') return 'gif';
+  // WebP: "RIFF"...."WEBP"
+  if (data.toString('ascii', 0, 4) === 'RIFF' && data.toString('ascii', 8, 12) === 'WEBP') return 'webp';
+  // TIFF: "II*\0" / "MM\0*"
+  if (
+    (data[0] === 0x49 && data[1] === 0x49 && data[2] === 0x2a && data[3] === 0x00) ||
+    (data[0] === 0x4d && data[1] === 0x4d && data[2] === 0x00 && data[3] === 0x2a)
+  ) return 'tiff';
+
+  // ISOBMFF (HEIC/HEIF/AVIF): [4-byte size]["ftyp"][major brand][minor][compatible…]
+  if (data.toString('ascii', 4, 8) === 'ftyp') {
+    const boxSize = Math.min(data.readUInt32BE(0) || data.length, data.length);
+    const brands: string[] = [data.toString('ascii', 8, 12)];
+    for (let off = 16; off + 4 <= boxSize; off += 4) {
+      brands.push(data.toString('ascii', off, off + 4));
+    }
+    if (brands.some((b) => HEIC_BRANDS.has(b))) return 'heif';
+    if (brands.some((b) => AVIF_BRANDS.has(b))) return 'avif';
+  }
+
+  return undefined;
+}
+
 function isNotFound(error: any): boolean {
   return (
     error.name === 'NotFound' ||
@@ -367,7 +424,15 @@ export function createImageHandler(
         const meta = await sharp(originalData).metadata();
         detectedFormat = meta.format; // jpeg, png, webp, gif, tiff, heif, etc.
       } catch {
-        // Sharp can't parse it — not an image
+        // Sharp can't parse it — not an image, OR a HEIF container this Sharp
+        // build has no libheif to identify. Fall through to the magic-byte sniff.
+      }
+
+      // A Sharp build without libheif throws on HEIF and leaves detectedFormat
+      // undefined, misrouting real HEIC photos to the non-image passthrough
+      // below. Sniff the bytes so `heif` is detected and the rescue path fires.
+      if (!detectedFormat) {
+        detectedFormat = sniffImageFormat(originalData);
       }
 
       if (!detectedFormat) {

package/src/plugin.ts

@@ -797,16 +797,17 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
       };
 
       actions['db:restore'] = async (payload, _ctx) => {
-        const { id, confirm } = (payload ?? {}) as { id?: string; confirm?: boolean };
-        if (!id) return { error: 'db:restore requires { id }' };
+        const { id, url, confirm } = (payload ?? {}) as { id?: string; url?: string; confirm?: boolean };
+        if (!id && !url) return { error: "db:restore requires { id } (a backup in this stage's bucket) or { url } (a presigned cross-stage hand-off — db:fork mints one)" };
+        if (id && url) return { error: 'db:restore takes { id } or { url }, not both' };
         if (confirm !== true) {
           return { error: 'db:restore is destructive (drops + replaces the target DB). Pass confirm:true to proceed.' };
         }
         const r = await resolveBackupDeps();
         if ('error' in r) return { error: r.error };
-        const { runRestore } = await import('./backup-run');
+        const { runRestore, runRestoreFromUrl } = await import('./backup-run');
         try {
-          return await runRestore(r.deps, id);
+          return url ? await runRestoreFromUrl(r.deps, url) : await runRestore(r.deps, id!);
         } catch (err: any) {
           return { error: err?.message || String(err) };
         }