@everystack/server 0.4.17 → 0.4.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.17",
+  "version": "0.4.19",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -163,8 +163,8 @@
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/cli": "0.4.47",
-    "@everystack/auth": "0.4.1"
+    "@everystack/auth": "0.4.2",
+    "@everystack/cli": "0.4.49"
   },
   "scripts": {
     "test": "jest",

package/src/index.ts

@@ -336,11 +336,13 @@ export function createLambdaHandler(
           'cache-control': 'no-store',
           'x-request-id': requestId,
         },
+        // The error itself is already logged above against this same id, which `logs:query
+        // --traceId` looks up directly. Returning it here too would only copy it into an
+        // untrusted channel. The id goes in the BODY as well as the header because most clients
+        // surface a body and drop headers, and a caller who cannot quote the id cannot be helped.
         body: JSON.stringify({
           error: 'Internal Server Error',
-          ...(process.env.ENVIRONMENT === 'dev'
-            ? { details: String(error) }
-            : {}),
+          requestId,
         }),
       };
     }

package/src/plugin.ts

@@ -315,11 +315,11 @@ export function createPluginLambdaHandler(
           'cache-control': 'no-store',
           'x-request-id': requestId,
         },
+        // See the note on the same catch in index.ts: the error is already logged against this
+        // id, and `logs:query --traceId` resolves it. The id rides the body as well as the header.
         body: JSON.stringify({
           error: 'Internal Server Error',
-          ...(process.env.ENVIRONMENT === 'dev'
-            ? { details: String(error) }
-            : {}),
+          requestId,
         }),
       };
     }
@@ -481,6 +481,24 @@ export interface DbPluginOptions {
   connectionInfo?: () => Promise<Record<string, string>>;
   /** Enable console action (default: true) */
   allowConsole?: boolean;
+  /**
+   * Enable the `seed` action. Default FALSE.
+   *
+   * Previously gated on `ctx.environment !== 'dev'` — i.e. on the stage being NAMED `dev`.
+   * `ENVIRONMENT` comes from `$app.stage`, so that refused a genuine dev stage called
+   * `development` and allowed a shared pre-prod someone happened to call `dev`. Declare the
+   * intent instead of naming a stage into it.
+   */
+  allowSeed?: boolean;
+  /**
+   * Enable the `db:reset` action, which runs `DROP SCHEMA ... CASCADE` on every schema in
+   * `schemas` and replays migrations. Default FALSE. **There is no undo.**
+   *
+   * Same history as `allowSeed`, higher stakes: a stage name decided whether a destructive verb
+   * was reachable. IAM already controls who may invoke the action at all; this controls whether
+   * the deployment offers it in the first place.
+   */
+  allowReset?: boolean;
   /** Optional read-replica URL for db:query. When unset, db:query runs on the operator
    *  connection. (No env fallback — pass it explicitly if you have a replica.) */
   readDatabaseUrl?: string;
@@ -581,17 +599,28 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
     if (options.seed) {
       const seedFn = options.seed;
       actions.seed = async (_payload, ctx) => {
-        if (ctx.environment !== 'dev') {
-          return { error: 'Seed is only available in dev environment' };
+        if (!options.allowSeed) {
+          return {
+            error:
+              'seed is not enabled on this deployment. Pass `allowSeed: true` to dbPlugin for the '
+              + 'stages where seeding is intended. (This was previously allowed whenever the stage '
+              + 'was NAMED "dev", which is a deployment label, not a decision.)',
+          };
         }
         return await seedFn(opsDb, ctx.schema);
       };
     }
 
     // --- db:reset ---
-    actions['db:reset'] = async (_payload, ctx) => {
-      if (ctx.environment !== 'dev') {
-        return { error: 'db:reset is only available in dev environment' };
+    actions['db:reset'] = async (_payload, _ctx) => {
+      if (!options.allowReset) {
+        return {
+          error:
+            'db:reset is not enabled on this deployment. It DROPS every schema in `schemas` and '
+            + 'replays migrations, and there is no undo. Pass `allowReset: true` to dbPlugin only '
+            + 'on stages where that is acceptable. (This was previously allowed whenever the stage '
+            + 'was NAMED "dev", which is a deployment label, not a decision.)',
+        };
       }
       // Refuse BEFORE the drop: reset replays migrations after wiping the schemas — with no
       // migrations there is nothing to rebuild from, and the drop would strand the database.