@everystack/server 0.3.2 → 0.3.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.3.2",
+  "version": "0.3.3",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -74,11 +74,6 @@
       "default": "./src/media.ts"
     }
   },
-  "scripts": {
-    "test": "jest",
-    "build": "tsc --build",
-    "lint": "tsc --noEmit"
-  },
   "peerDependencies": {
     "esbuild": ">=0.20.0",
     "@aws-sdk/client-cloudfront-keyvaluestore": ">=3.1053.0",
@@ -134,8 +129,6 @@
     "@aws-sdk/client-s3": "3.1053.0",
     "@aws-sdk/lib-storage": "3.1053.0",
     "@aws-sdk/signature-v4a": "3.1063.0",
-    "@everystack/auth": "workspace:*",
-    "@everystack/cli": "workspace:*",
     "@types/aws-lambda": "8.10.161",
     "@types/jest": "29.5.14",
     "@types/node": "22.19.18",
@@ -145,6 +138,13 @@
     "postgres": "3.4.9",
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
-    "typescript": "5.9.3"
+    "typescript": "5.9.3",
+    "@everystack/auth": "0.3.1",
+    "@everystack/cli": "0.3.27"
+  },
+  "scripts": {
+    "test": "jest",
+    "build": "tsc --build",
+    "lint": "tsc --noEmit"
   }
-}
+}

package/src/backup-run.ts

@@ -132,17 +132,10 @@ export async function listBackups(deps: BackupRunDeps, stage: string): Promise<B
  * pg_restore throws with its stderr. (We start strict and observe benign-error behavior on the
  * deploy smoke test; the flags --no-owner/--no-privileges/--no-comments remove the usual offenders.)
  */
-export async function runRestore(deps: BackupRunDeps, id: string): Promise<{ id: string; restored: true }> {
-  const key = keyForId(id);
-  if (!key) throw new Error(`Malformed backup id: ${id}`);
-  const env = { ...process.env, ...pgEnvFromUrl(deps.adminUrl) };
-  const dbName = dbNameFromUrl(deps.adminUrl);
-
-  const s3 = await getS3(deps.region);
-  const { GetObjectCommand } = await import('@aws-sdk/client-s3');
-  const obj: any = await s3.send(new GetObjectCommand({ Bucket: deps.bucket, Key: key }));
-  if (!obj.Body) throw new Error(`Backup not found: ${id}`);
-  const body = obj.Body as Readable;
+/** The shared restore pipeline: gzipped custom-format archive stream → gunzip → pg_restore. */
+async function restoreFromStream(adminUrl: string, body: Readable): Promise<void> {
+  const env = { ...process.env, ...pgEnvFromUrl(adminUrl) };
+  const dbName = dbNameFromUrl(adminUrl);
 
   const child = spawn('pg_restore', pgRestoreArgs(dbName), { env, stdio: ['pipe', 'ignore', 'pipe'] });
   let stderr = '';
@@ -154,8 +147,48 @@ export async function runRestore(deps: BackupRunDeps, id: string): Promise<{ id:
   });
 
   await Promise.all([
-    pipeline(body, createGunzip(), child.stdin!), // S3 → gunzip → pg_restore stdin
+    pipeline(body, createGunzip(), child.stdin!), // source → gunzip → pg_restore stdin
     childExit,
   ]);
+}
+
+export async function runRestore(deps: BackupRunDeps, id: string): Promise<{ id: string; restored: true }> {
+  const key = keyForId(id);
+  if (!key) throw new Error(`Malformed backup id: ${id}`);
+
+  const s3 = await getS3(deps.region);
+  const { GetObjectCommand } = await import('@aws-sdk/client-s3');
+  const obj: any = await s3.send(new GetObjectCommand({ Bucket: deps.bucket, Key: key }));
+  if (!obj.Body) throw new Error(`Backup not found: ${id}`);
+
+  await restoreFromStream(deps.adminUrl, obj.Body as Readable);
   return { id, restored: true };
 }
+
+/** The URL mode's precondition — a presigned http(s) download, never a path or bucket ref. */
+export function assertRestoreUrl(url: string): void {
+  if (!/^https?:\/\//.test(url)) {
+    throw new Error('db:restore url must be an http(s) URL — a presigned backup download (everystack db:backup:download / db:fork mints one).');
+  }
+}
+
+/**
+ * Restore from a presigned URL — the cross-stage fork's hand-off
+ * (docs/plans/branch-stages.md). A backup lives in its SOURCE stage's
+ * bucket, and this stage's Lambda has no IAM path to it; the operator who
+ * can read the source's backups and invoke this action IS the
+ * authorization, and the URL expires. Same stream pipeline as the id mode.
+ */
+export async function runRestoreFromUrl(
+  deps: Pick<BackupRunDeps, 'adminUrl'>,
+  url: string,
+): Promise<{ restored: true }> {
+  assertRestoreUrl(url);
+  const res = await fetch(url);
+  if (!res.ok || !res.body) {
+    throw new Error(`fetching the backup failed: HTTP ${res.status} — presigned URLs expire in an hour; mint a fresh one.`);
+  }
+  const { Readable: NodeReadable } = await import('node:stream');
+  await restoreFromStream(deps.adminUrl, NodeReadable.fromWeb(res.body as any));
+  return { restored: true };
+}

package/src/plugin.ts

@@ -797,16 +797,17 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
       };
 
       actions['db:restore'] = async (payload, _ctx) => {
-        const { id, confirm } = (payload ?? {}) as { id?: string; confirm?: boolean };
-        if (!id) return { error: 'db:restore requires { id }' };
+        const { id, url, confirm } = (payload ?? {}) as { id?: string; url?: string; confirm?: boolean };
+        if (!id && !url) return { error: "db:restore requires { id } (a backup in this stage's bucket) or { url } (a presigned cross-stage hand-off — db:fork mints one)" };
+        if (id && url) return { error: 'db:restore takes { id } or { url }, not both' };
         if (confirm !== true) {
           return { error: 'db:restore is destructive (drops + replaces the target DB). Pass confirm:true to proceed.' };
         }
         const r = await resolveBackupDeps();
         if ('error' in r) return { error: r.error };
-        const { runRestore } = await import('./backup-run');
+        const { runRestore, runRestoreFromUrl } = await import('./backup-run');
         try {
-          return await runRestore(r.deps, id);
+          return url ? await runRestoreFromUrl(r.deps, url) : await runRestore(r.deps, id!);
         } catch (err: any) {
           return { error: err?.message || String(err) };
         }