@everystack/server 0.4.25 → 0.4.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.25",
+  "version": "0.4.26",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -186,8 +186,8 @@
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/auth": "0.4.3",
-    "@everystack/cli": "0.4.64"
+    "@everystack/cli": "0.4.65",
+    "@everystack/auth": "0.4.3"
   },
   "scripts": {
     "test": "jest",

package/src/plugin.ts

@@ -846,6 +846,75 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
     };
 
 
+    // --- db:rotate — A/B role detection, provisioning, retirement, draining ---
+    // Runs inside the VPC on the operator connection. The CLI orchestrates the
+    // AWS side (secret writes, rolling restart, verification) around these calls.
+    actions['db:rotate'] = async (payload, _ctx) => {
+      const { sql } = await import('drizzle-orm');
+      const {
+        detectActiveRole,
+        provisionInactiveRole,
+        retireRole,
+        countRoleSessions,
+        terminateRoleSessions,
+      } = await import('./rotate');
+
+      const p = (payload ?? {}) as {
+        action: 'detect' | 'provision' | 'retire' | 'count-sessions' | 'terminate-sessions' | 'probe-login';
+        baseRole?: string;
+        password?: string;
+        role?: string;
+        url?: string;
+      };
+
+      const deps = {
+        query: async (s: string) => {
+          const rows = await opsDb.execute(sql.raw(s));
+          return rows as any[];
+        },
+        execute: async (s: string) => { await opsDb.execute(sql.raw(s)); },
+      };
+
+      try {
+        switch (p.action) {
+          case 'detect':
+            return await detectActiveRole(p.baseRole ?? 'authenticator', deps);
+          case 'provision': {
+            if (!p.baseRole || !p.password) return { error: 'baseRole and password required' };
+            const slot = await detectActiveRole(p.baseRole, deps);
+            if (!slot) return { error: `No rotation pairs for ${p.baseRole}` };
+            await provisionInactiveRole(slot, p.password, deps);
+            return { ...slot, provisioned: true };
+          }
+          case 'retire':
+            if (!p.role) return { error: 'role required' };
+            await retireRole(p.role, deps);
+            return { retired: p.role };
+          case 'count-sessions':
+            if (!p.role) return { error: 'role required' };
+            return { count: await countRoleSessions(p.role, deps) };
+          case 'terminate-sessions':
+            if (!p.role) return { error: 'role required' };
+            return { terminated: await terminateRoleSessions(p.role, deps) };
+          case 'probe-login': {
+            if (!p.url) return { error: 'url required' };
+            const { default: postgres } = await import('postgres');
+            const probe = postgres(p.url, { max: 1, connect_timeout: 5, ssl: 'prefer' });
+            try {
+              await probe`SELECT 1`;
+              return { connected: true };
+            } finally {
+              await probe.end({ timeout: 1 });
+            }
+          }
+          default:
+            return { error: `Unknown rotate action: ${p.action}` };
+        }
+      } catch (err: any) {
+        return { error: err?.message || String(err) };
+      }
+    };
+
     // --- db:backups / db:restore — list + restore logical backups ---
     // db:backup and db:export are pg_dump work and now run in the ephemeral Task lane
     // (@everystack/jobs dbTaskPlugin) — the ops Lambda holds no pg binaries. db:backups is a plain