@everystack/server 0.4.21 → 0.4.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.21",
+  "version": "0.4.25",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -24,76 +24,99 @@
   ],
   "exports": {
     ".": {
+      "source": "./src/index.ts",
       "types": "./src/index.ts",
       "default": "./src/index.ts"
     },
     "./db": {
+      "source": "./src/db.ts",
       "types": "./src/db.ts",
       "default": "./src/db.ts"
     },
     "./ssr": {
+      "source": "./src/ssr.ts",
       "types": "./src/ssr.ts",
       "default": "./src/ssr.ts"
     },
     "./image": {
+      "source": "./src/image.ts",
       "types": "./src/image.ts",
       "default": "./src/image.ts"
     },
     "./migrate": {
+      "source": "./src/migrate.ts",
       "types": "./src/migrate.ts",
       "default": "./src/migrate.ts"
     },
     "./db-doctor": {
+      "source": "./src/db-doctor.ts",
       "types": "./src/db-doctor.ts",
       "default": "./src/db-doctor.ts"
     },
     "./worker": {
+      "source": "./src/worker.ts",
       "types": "./src/worker.ts",
       "default": "./src/worker.ts"
     },
     "./stubs": {
+      "source": "./src/stubs.ts",
       "types": "./src/stubs.ts",
       "default": "./src/stubs.ts"
     },
     "./testing": {
+      "source": "./src/testing/index.ts",
       "types": "./src/testing/index.ts",
       "default": "./src/testing/index.ts"
     },
     "./jest-preset": "./jest-preset.js",
     "./jest-preset.js": "./jest-preset.js",
     "./plugin": {
+      "source": "./src/plugin.ts",
       "types": "./src/plugin.ts",
       "default": "./src/plugin.ts"
     },
     "./provision": {
+      "source": "./src/provision.ts",
       "types": "./src/provision.ts",
       "default": "./src/provision.ts"
     },
+    "./rotate": {
+      "source": "./src/rotate.ts",
+      "types": "./src/rotate.ts",
+      "default": "./src/rotate.ts"
+    },
     "./cdn": {
+      "source": "./src/cdn/index.ts",
       "types": "./src/cdn/index.ts",
       "default": "./src/cdn/index.ts"
     },
     "./cdn/transforms": {
+      "source": "./src/cdn/transforms.ts",
       "types": "./src/cdn/transforms.ts",
       "default": "./src/cdn/transforms.ts"
     },
     "./kvs": {
+      "source": "./src/kvs.ts",
       "types": "./src/kvs.ts",
       "default": "./src/kvs.ts"
     },
     "./media": {
+      "source": "./src/media.ts",
       "types": "./src/media.ts",
       "default": "./src/media.ts"
     },
     "./pipeline": {
+      "source": "./src/pipeline.ts",
       "types": "./src/pipeline.ts",
       "default": "./src/pipeline.ts"
     },
     "./backup": {
+      "source": "./src/backup.ts",
       "types": "./src/backup.ts",
       "default": "./src/backup.ts"
     },
     "./backup-run": {
+      "source": "./src/backup-run.ts",
       "types": "./src/backup-run.ts",
       "default": "./src/backup-run.ts"
     }
@@ -164,7 +187,7 @@
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
     "@everystack/auth": "0.4.3",
-    "@everystack/cli": "0.4.60"
+    "@everystack/cli": "0.4.64"
   },
   "scripts": {
     "test": "jest",

package/src/db.ts

@@ -24,6 +24,25 @@ function sstLink<T = Record<string, any>>(name: string): T | undefined {
   return loadSstResources()[name] as T | undefined;
 }
 
+// ---------------------------------------------------------------------------
+// Runtime credential override (Phase B: credential rotation)
+// ---------------------------------------------------------------------------
+//
+// The rotate command delivers rotated credentials via Lambda env vars
+// (EVERYSTACK_CRED_*), set during the same UpdateFunctionConfiguration call
+// that bumps EVERYSTACK_GEN. The getters check these before the blob.
+// No S3/SSM reads, no new permissions, credential split preserved.
+//
+// Lifecycle: rotate sets env + updates SST blob → deploy bakes new blob,
+// SST resets env → blob is correct. Until next deploy, env wins over blob.
+
+const CRED_PREFIX = 'EVERYSTACK_CRED_';
+
+/** Read a rotated credential from env, or undefined if not set. */
+function rotatedCred(name: string): string | undefined {
+  return process.env[`${CRED_PREFIX}${name}`] || undefined;
+}
+
 /**
  * Read ANY SST-linked resource by name, without importing `sst` — the
  * bundler-safe replacement for `Resource.<Name>` (e.g. `sstResource('Updates')?.name`
@@ -35,11 +54,9 @@ export function sstResource<T = Record<string, any>>(name: string): T | undefine
 }
 
 export function getDatabaseUrl(): string {
-  // An EXPLICIT DATABASE_URL wins over the component-derived master. This is what
-  // lets the API connection be a least-privilege role (`authenticator`) while the SST
-  // Postgres component still exists to back the owner/ops credential. If the master
-  // resolved first, setting DATABASE_URL to a least-privilege role would be silently
-  // ignored. See docs/plans/credential-split-rls-everywhere.md.
+  // Rotated credential wins (set by db:provision --rotate via env var)
+  const rotated = rotatedCred('DatabaseUrl');
+  if (rotated) return rotated;
 
   // SST Secret — PascalCase (SST_RESOURCE_DatabaseUrl → { value })
   const pascal = sstLink('DatabaseUrl')?.value as string | undefined;
@@ -99,6 +116,10 @@ export function getMasterDatabaseUrl(): string | null {
  * Returns null when no admin URL is configured (single-credential setup).
  */
 export function getAdminDatabaseUrl(): string | null {
+  // Rotated credential wins (set by db:provision --rotate via env var)
+  const rotated = rotatedCred('AdminDatabaseUrl');
+  if (rotated) return rotated;
+
   // SST Secret — PascalCase (SST_RESOURCE_AdminDatabaseUrl → { value })
   const pascal = sstLink('AdminDatabaseUrl')?.value as string | undefined;
   if (pascal) return pascal;
@@ -360,6 +381,10 @@ export function getAdminSql(): ReturnType<typeof postgres> {
  * different host. Returns null when no replica is configured.
  */
 export function getReadDatabaseUrl(): string | null {
+  // Rotated credential wins (set by db:provision --rotate via env var)
+  const rotated = rotatedCred('ReadDatabaseUrl');
+  if (rotated) return rotated;
+
   // SST Secret — PascalCase (SST_RESOURCE_ReadDatabaseUrl → { value })
   const pascal = sstLink('ReadDatabaseUrl')?.value as string | undefined;
   if (pascal) return pascal;

package/src/provision.ts

@@ -20,7 +20,7 @@
  * without a database; plugin.ts wires the real deps.
  */
 
-import { generateRoleChainSQL, generateAdminRoleSQL, generateSearchPathSQL } from './role-chain';
+import { generateRoleChainSQL, generateAdminRoleSQL, generateSearchPathSQL, generateRotationPairSQL } from './role-chain';
 
 export interface ProvisionPayload {
   /** Password for the least-privilege API login. Alphanumeric only. */
@@ -37,6 +37,8 @@ export interface ProvisionPayload {
    * empty = all-public app, no path set (byte-identical to the pre-search-path-ownership behavior).
    */
   searchPath?: string[];
+  /** Create A/B rotation pairs for credential rotation without downtime. */
+  rotationPairs?: boolean;
 }
 
 export interface ProvisionDeps {
@@ -57,6 +59,7 @@ export interface ProvisionResult {
   adminPasswordSet?: boolean;
   /** true = login proven; null = no way to probe (unverified); absent = no admin requested. */
   adminVerified?: boolean | null;
+  rotationPairsCreated?: boolean;
   error?: string;
 }
 
@@ -136,6 +139,42 @@ export async function runProvision(
     }
   }
 
+  // A/B rotation pairs — create after base roles exist so the membership grants resolve.
+  if (payload.rotationPairs) {
+    const roles = appRoles ?? ['anon', 'authenticated', 'admin'];
+    const authPairSql = generateRotationPairSQL(login, 'NOINHERIT NOBYPASSRLS', roles);
+    await deps.execute(authPairSql);
+
+    // Set search_path on authenticator pair roles (F5 fix)
+    if (searchPath) {
+      for (const suffix of ['_a', '_b']) {
+        const sp = generateSearchPathSQL(`${login}${suffix}`, searchPath);
+        if (sp) await deps.execute(sp);
+      }
+    }
+
+    if (adminSql) {
+      const admin = adminRole ?? 'migrator';
+      // Admin pairs need owner membership to run DDL (F4 fix)
+      const adminPairSql = generateRotationPairSQL(admin, 'INHERIT NOBYPASSRLS');
+      await deps.execute(adminPairSql);
+      // Grant owner → pair roles (same as the base admin role gets)
+      for (const suffix of ['_a', '_b']) {
+        await deps.execute(
+          `DO $$ BEGIN IF current_user <> '${admin}${suffix}' AND NOT pg_has_role('${admin}${suffix}', current_user, 'MEMBER') AND NOT pg_has_role(current_user, '${admin}${suffix}', 'MEMBER') THEN EXECUTE format('GRANT %I TO ${admin}${suffix}', current_user); END IF; END $$;`,
+        );
+      }
+      // Set search_path on admin pair roles (F5 fix)
+      if (searchPath) {
+        for (const suffix of ['_a', '_b']) {
+          const sp = generateSearchPathSQL(`${admin}${suffix}`, searchPath);
+          if (sp) await deps.execute(sp);
+        }
+      }
+    }
+    result.rotationPairsCreated = true;
+  }
+
   // Authenticator LAST — only reached when the admin side (if requested) held up.
   if (authPassword) {
     await deps.execute(`ALTER ROLE ${login} WITH LOGIN PASSWORD '${authPassword}';`);

package/src/role-chain.ts

@@ -95,6 +95,36 @@ export function generateSearchPathSQL(role: string, searchPath: string[]): strin
   return `ALTER ROLE ${role} SET search_path = ${searchPath.join(', ')};\n`;
 }
 
+/**
+ * Generate idempotent DDL for an A/B login-role pair used by credential rotation.
+ * Each pair has the same membership as the base role. One starts with LOGIN (active),
+ * the other with NOLOGIN (inactive). `db:provision --rotate` swaps them.
+ */
+export function generateRotationPairSQL(
+  baseRole: string,
+  attributes: string,
+  appRoles?: string[],
+): string {
+  assertIdent(baseRole, 'baseRole');
+  const a = `${baseRole}_a`;
+  const b = `${baseRole}_b`;
+
+  const lines: string[] = [];
+  for (const [role, login] of [[a, 'LOGIN'], [b, 'NOLOGIN']] as const) {
+    lines.push(
+      `DO $$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${role}') THEN CREATE ROLE ${role} ${login} ${attributes}; END IF; END $$;`,
+    );
+  }
+  if (appRoles) {
+    for (const appRole of appRoles) {
+      assertIdent(appRole, 'app role');
+      lines.push(`GRANT ${appRole} TO ${a};`);
+      lines.push(`GRANT ${appRole} TO ${b};`);
+    }
+  }
+  return lines.join('\n') + '\n';
+}
+
 export interface AdminRoleOptions {
   /**
    * The LOGIN role operator tasks (migrate/seed/DDL/console) connect as — the OTHER half

package/src/rotate.ts

@@ -0,0 +1,146 @@
+/**
+ * Credential rotation — the database-side logic for A/B role swaps.
+ *
+ * Pure functions + dependency-injected IO so the rotation order is testable
+ * without a database. The CLI orchestrates the AWS side (SSM writes, rolling
+ * restart, origin verification).
+ */
+
+const IDENT = /^[a-z_][a-z0-9_]*$/;
+
+function assertIdent(name: string, what: string): void {
+  if (!IDENT.test(name)) {
+    throw new Error(`Invalid ${what}: ${JSON.stringify(name)} — must match ${IDENT}`);
+  }
+}
+
+export interface RotationSlot {
+  baseRole: string;
+  activeRole: string;
+  inactiveRole: string;
+}
+
+export interface RotationDeps {
+  query: (sql: string) => Promise<any[]>;
+  execute: (sql: string) => Promise<unknown>;
+}
+
+/**
+ * Detect which _a/_b role has LOGIN (the active one).
+ * Returns null if neither exists (rotation pairs not provisioned).
+ */
+export async function detectActiveRole(
+  baseRole: string,
+  deps: RotationDeps,
+): Promise<RotationSlot | null> {
+  assertIdent(baseRole, 'baseRole');
+  const a = `${baseRole}_a`;
+  const b = `${baseRole}_b`;
+
+  const rows = await deps.query(
+    `SELECT rolname, rolcanlogin FROM pg_roles WHERE rolname IN ('${a}', '${b}')`,
+  );
+
+  const aRow = rows.find((r: any) => r.rolname === a);
+  const bRow = rows.find((r: any) => r.rolname === b);
+
+  if (!aRow && !bRow) return null;
+  if (!aRow || !bRow) {
+    throw new Error(
+      `Only one rotation role exists (${aRow ? a : b}). Run db:provision with rotationPairs first.`,
+    );
+  }
+
+  if (aRow.rolcanlogin && !bRow.rolcanlogin) {
+    return { baseRole, activeRole: a, inactiveRole: b };
+  }
+  if (bRow.rolcanlogin && !aRow.rolcanlogin) {
+    return { baseRole, activeRole: b, inactiveRole: a };
+  }
+  if (aRow.rolcanlogin && bRow.rolcanlogin) {
+    return { baseRole, activeRole: a, inactiveRole: b };
+  }
+  throw new Error(`Neither ${a} nor ${b} has LOGIN. Run db:provision to fix the role chain.`);
+}
+
+/**
+ * Provision the inactive role: set password, grant LOGIN.
+ */
+const ALNUM = /^[A-Za-z0-9]+$/;
+
+export async function provisionInactiveRole(
+  slot: RotationSlot,
+  password: string,
+  deps: RotationDeps,
+): Promise<void> {
+  if (!ALNUM.test(password)) {
+    throw new Error('password must be alphanumeric (generate via randomBytes hex)');
+  }
+  const { inactiveRole } = slot;
+  assertIdent(inactiveRole, 'inactiveRole');
+  await deps.execute(`ALTER ROLE ${inactiveRole} WITH LOGIN PASSWORD '${password}';`);
+}
+
+/**
+ * Retire the old active role: REVOKE LOGIN so no new connections succeed.
+ */
+export async function retireRole(
+  roleName: string,
+  deps: RotationDeps,
+): Promise<void> {
+  assertIdent(roleName, 'role');
+  await deps.execute(`ALTER ROLE ${roleName} WITH NOLOGIN;`);
+}
+
+/**
+ * Count active sessions for a role.
+ */
+export async function countRoleSessions(
+  roleName: string,
+  deps: RotationDeps,
+): Promise<number> {
+  assertIdent(roleName, 'role');
+  const rows = await deps.query(
+    `SELECT count(*)::int AS n FROM pg_stat_activity WHERE usename = '${roleName}'`,
+  );
+  return rows[0]?.n ?? 0;
+}
+
+/**
+ * Terminate all sessions for a role.
+ */
+export async function terminateRoleSessions(
+  roleName: string,
+  deps: RotationDeps,
+): Promise<number> {
+  assertIdent(roleName, 'role');
+  const rows = await deps.query(
+    `SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE usename = '${roleName}'`,
+  );
+  return rows.length;
+}
+
+/**
+ * Drain old role sessions: poll, then terminate after grace period.
+ * Returns when session count reaches zero.
+ */
+export async function drainRole(
+  roleName: string,
+  graceMs: number,
+  deps: RotationDeps,
+): Promise<{ drained: boolean; terminated: number }> {
+  const deadline = Date.now() + graceMs;
+  const POLL_MS = 2_000;
+
+  while (Date.now() < deadline) {
+    const count = await countRoleSessions(roleName, deps);
+    if (count === 0) return { drained: true, terminated: 0 };
+    await new Promise((r) => setTimeout(r, POLL_MS));
+  }
+
+  const remaining = await countRoleSessions(roleName, deps);
+  if (remaining === 0) return { drained: true, terminated: 0 };
+
+  const terminated = await terminateRoleSessions(roleName, deps);
+  return { drained: true, terminated };
+}

package/src/ssr.ts

@@ -161,7 +161,7 @@ export function deharvestLoaderData(html: string): string {
  *
  * @param innerHandler - The expo-server request handler
  * @param options - SSR processing options
- * @param metadata - Release metadata (createdAt used for X-Server-Debug header)
+ * @param metadata - Release metadata emitted as x-everystack-{release,runtime,created} headers
  */
 export function wrapSsrHandler(
   innerHandler: (request: Request) => Promise<Response>,
@@ -193,9 +193,11 @@ export function wrapSsrHandler(
     // Delegate to inner handler
     const response = await innerHandler(cleanRequest);
 
-    // Set debug fingerprint — release timestamp identifies the serving bundle
+    // Release identity headers — observable by probes, cache:purge, and update --verify
     const headers = new Headers(response.headers);
-    if (metadata?.createdAt) headers.set('X-Server-Debug', metadata.createdAt);
+    if (metadata?.updateId) headers.set('x-everystack-release', metadata.updateId);
+    if (metadata?.runtimeVersion) headers.set('x-everystack-runtime', metadata.runtimeVersion);
+    if (metadata?.createdAt) headers.set('x-everystack-created', metadata.createdAt);
 
     // Non-HTML responses pass through untouched
     const ct = headers.get('content-type') || '';
@@ -460,6 +462,16 @@ export async function getWebHandler(
   // across many releases on a long-lived warm container.
   await pruneOldReleaseDirs(channelBase, buildDir);
 
+  // Clear Metro's in-memory module registry so the new bundle's modules load
+  // fresh. Metro stores registered modules in a globalThis Map keyed by numeric
+  // ID; IDs can collide across exports (e.g. drizzle-orm appears in both
+  // render.js and loaders/index.js with the same ID). Without a clear, the old
+  // bundle's factories stay resident and the new bundle's __d silently skips
+  // any ID it has already seen, serving stale or incompatible code.
+  if (typeof (globalThis as any).__c === 'function') {
+    (globalThis as any).__c();
+  }
+
   if (options?.afterExtract) {
     await options.afterExtract(buildDir);
   }