@everystack/server 0.4.3 → 0.4.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -151,8 +151,8 @@
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/cli": "0.4.12",
     "@everystack/auth": "0.4.0",
+    "@everystack/cli": "0.4.19",
     "@everystack/pg-tools": "0.4.0"
   },
   "scripts": {

package/src/db.ts

@@ -7,19 +7,26 @@
  * transparently. Works with createSecrets() or manual sst.Secret declarations.
  */
 
-import { Resource } from 'sst';
 import { drizzle } from 'drizzle-orm/postgres-js';
 import postgres from 'postgres';
 
 /**
- * Safely read a Resource property. Returns undefined if the Resource
- * or property doesn't exist (avoids runtime throw from SST's proxy).
+ * Read an SST-linked resource WITHOUT importing the `sst` package. SST injects
+ * every link as `process.env.SST_RESOURCE_<Name>` (a JSON blob) — SST's own
+ * Resource proxy just parses that env var (see sst/dist/resource/shared.js:
+ * `raw[name] = JSON.parse(process.env['SST_RESOURCE_' + name])`). Reading it
+ * directly means this module never imports `sst`, which is a deploy-time
+ * construct: Metro/esbuild cannot bundle it, and SST's own build-time
+ * version-check plugin mis-reads a node_module's `sst` import and fails the
+ * build. So the API/SSR helpers stayed unbundleable in the exact runtime half
+ * the framework targets. Returns undefined when the link is absent — every
+ * getter then falls through to process.env, unchanged.
  */
-function tryResource<T>(fn: () => T): T | undefined {
+function sstLink<T = Record<string, any>>(name: string): T | undefined {
+  const raw = process.env[`SST_RESOURCE_${name}`];
+  if (!raw) return undefined;
   try {
-    const val = fn();
-    // SST's Resource proxy may return undefined for missing keys
-    return val === undefined ? undefined : val;
+    return JSON.parse(raw) as T;
   } catch {
     return undefined;
   }
@@ -32,11 +39,11 @@ export function getDatabaseUrl(): string {
   // resolved first, setting DATABASE_URL to a least-privilege role would be silently
   // ignored. See docs/plans/credential-split-rls-everywhere.md.
 
-  // SST Secret — PascalCase (Resource.DatabaseUrl.value)
-  const pascal = tryResource(() => (Resource as any).DatabaseUrl?.value as string);
+  // SST Secret — PascalCase (SST_RESOURCE_DatabaseUrl → { value })
+  const pascal = sstLink('DatabaseUrl')?.value as string | undefined;
   if (pascal) return pascal;
-  // SST Secret — raw env name (Resource.DATABASE_URL.value)
-  const raw = tryResource(() => (Resource as any).DATABASE_URL?.value as string);
+  // SST Secret — raw env name (SST_RESOURCE_DATABASE_URL → { value })
+  const raw = sstLink('DATABASE_URL')?.value as string | undefined;
   if (raw) return raw;
   // process.env fallback
   if (process.env.DATABASE_URL) return process.env.DATABASE_URL;
@@ -54,8 +61,25 @@ export function getDatabaseUrl(): string {
  * no dedicated ADMIN_DATABASE_URL is provisioned — kept separate from getDatabaseUrl() so the
  * operator path never accidentally resolves the least-privilege DATABASE_URL secret.
  */
+export interface DatabaseComponentInfo {
+  username: string;
+  password: string;
+  host: string;
+  port: number;
+  database: string;
+}
+
+/**
+ * The linked SST Postgres component's connection fields, or null when none is linked.
+ * The single reader of the `Database` link — callers that only need host/port/database
+ * (db:psql, provision probe) use this instead of importing `sst`.
+ */
+export function getDatabaseComponentInfo(): DatabaseComponentInfo | null {
+  return sstLink<DatabaseComponentInfo>('Database') ?? null;
+}
+
 export function getMasterDatabaseUrl(): string | null {
-  const db = tryResource(() => Resource.Database);
+  const db = getDatabaseComponentInfo();
   if (db?.host) {
     return `postgresql://${db.username}:${db.password}@${db.host}:${db.port}/${db.database}`;
   }
@@ -73,11 +97,11 @@ export function getMasterDatabaseUrl(): string | null {
  * Returns null when no admin URL is configured (single-credential setup).
  */
 export function getAdminDatabaseUrl(): string | null {
-  // SST Secret — PascalCase (Resource.AdminDatabaseUrl.value)
-  const pascal = tryResource(() => (Resource as any).AdminDatabaseUrl?.value as string);
+  // SST Secret — PascalCase (SST_RESOURCE_AdminDatabaseUrl → { value })
+  const pascal = sstLink('AdminDatabaseUrl')?.value as string | undefined;
   if (pascal) return pascal;
-  // SST Secret — raw env name (Resource.ADMIN_DATABASE_URL.value)
-  const raw = tryResource(() => (Resource as any).ADMIN_DATABASE_URL?.value as string);
+  // SST Secret — raw env name (SST_RESOURCE_ADMIN_DATABASE_URL → { value })
+  const raw = sstLink('ADMIN_DATABASE_URL')?.value as string | undefined;
   if (raw) return raw;
   // process.env fallback
   if (process.env.ADMIN_DATABASE_URL) return process.env.ADMIN_DATABASE_URL;
@@ -85,17 +109,45 @@ export function getAdminDatabaseUrl(): string | null {
 }
 
 export function getJwtSecret(): Uint8Array {
-  // PascalCase Resource (Resource.JwtSecret.value)
-  const pascal = tryResource(() => (Resource as any).JwtSecret?.value as string);
+  // PascalCase Secret (SST_RESOURCE_JwtSecret → { value })
+  const pascal = sstLink('JwtSecret')?.value as string | undefined;
   if (pascal) return new TextEncoder().encode(pascal);
-  // Raw env name Resource (Resource.JWT_SECRET.value)
-  const raw = tryResource(() => (Resource as any).JWT_SECRET?.value as string);
+  // Raw env name Secret (SST_RESOURCE_JWT_SECRET → { value })
+  const raw = sstLink('JWT_SECRET')?.value as string | undefined;
   if (raw) return new TextEncoder().encode(raw);
   // process.env fallback
   if (process.env.JWT_SECRET) return new TextEncoder().encode(process.env.JWT_SECRET);
   throw new Error('JWT_SECRET not set — link an sst.Secret or set process.env.JWT_SECRET');
 }
 
+/**
+ * The ssl option for a connection URL: an explicit `sslmode` query param wins
+ * (return no override — postgres.js honors the URL natively), otherwise default
+ * to 'require' (RDS). This is what lets ONE handler serve both venues: local
+ * Postgres appends `?sslmode=disable` to its URL, deployed stages carry no
+ * param and keep TLS. An unparseable URL fails toward TLS and lets the connect
+ * report the real error.
+ */
+export function sslOptionForUrl(url: string): 'require' | undefined {
+  try {
+    return new URL(url).searchParams.has('sslmode') ? undefined : 'require';
+  } catch {
+    return 'require';
+  }
+}
+
+/** postgres.js options shared by every connection — ssl derived from the URL. */
+function connectionOptions(url: string, maxConnections?: number): Parameters<typeof postgres>[1] {
+  const ssl = sslOptionForUrl(url);
+  return {
+    max: maxConnections ?? 1,
+    idle_timeout: 60,
+    connect_timeout: 5,
+    max_lifetime: 60 * 5,
+    ...(ssl ? { ssl } : {}),
+  };
+}
+
 // Lazy singleton DB connection
 let dbInstance: ReturnType<typeof drizzle> | null = null;
 let sqlClient: ReturnType<typeof postgres> | null = null;
@@ -110,13 +162,7 @@ export function createDb<T extends Record<string, unknown>>(
   if (dbInstance) return { db: dbInstance, schema };
 
   const url = getDatabaseUrl();
-  sqlClient = postgres(url, {
-    max: options?.maxConnections ?? 1,
-    idle_timeout: 60,
-    connect_timeout: 5,
-    max_lifetime: 60 * 5,
-    ssl: 'require',
-  });
+  sqlClient = postgres(url, connectionOptions(url, options?.maxConnections));
   dbInstance = drizzle(sqlClient, { schema });
   return { db: dbInstance, schema };
 }
@@ -242,13 +288,7 @@ export function createAdminDb<T extends Record<string, unknown>>(
     return createDb(schema, options);
   }
 
-  adminSqlClient = postgres(adminUrl, {
-    max: options?.maxConnections ?? 1,
-    idle_timeout: 60,
-    connect_timeout: 5,
-    max_lifetime: 60 * 5,
-    ssl: 'require',
-  });
+  adminSqlClient = postgres(adminUrl, connectionOptions(adminUrl, options?.maxConnections));
   adminDbInstance = drizzle(adminSqlClient, { schema });
   return { db: adminDbInstance, schema };
 }
@@ -272,11 +312,11 @@ export function getAdminSql(): ReturnType<typeof postgres> {
  * different host. Returns null when no replica is configured.
  */
 export function getReadDatabaseUrl(): string | null {
-  // SST Secret — PascalCase (Resource.ReadDatabaseUrl.value)
-  const pascal = tryResource(() => (Resource as any).ReadDatabaseUrl?.value as string);
+  // SST Secret — PascalCase (SST_RESOURCE_ReadDatabaseUrl → { value })
+  const pascal = sstLink('ReadDatabaseUrl')?.value as string | undefined;
   if (pascal) return pascal;
-  // SST Secret — raw env name (Resource.READ_DATABASE_URL.value)
-  const raw = tryResource(() => (Resource as any).READ_DATABASE_URL?.value as string);
+  // SST Secret — raw env name (SST_RESOURCE_READ_DATABASE_URL → { value })
+  const raw = sstLink('READ_DATABASE_URL')?.value as string | undefined;
   if (raw) return raw;
   // process.env fallback
   if (process.env.READ_DATABASE_URL) return process.env.READ_DATABASE_URL;
@@ -314,13 +354,7 @@ export function createReadDb<T extends Record<string, unknown>>(
   const url = getReadDatabaseUrl();
   if (!url) return createDb(schema, options);
 
-  readSqlClient = postgres(url, {
-    max: options?.maxConnections ?? 1,
-    idle_timeout: 60,
-    connect_timeout: 5,
-    max_lifetime: 60 * 5,
-    ssl: 'require',
-  });
+  readSqlClient = postgres(url, connectionOptions(url, options?.maxConnections));
   readDbInstance = drizzle(readSqlClient, { schema });
   return { db: readDbInstance, schema };
 }

package/src/plugin.ts

@@ -42,8 +42,8 @@ export interface PluginContext {
   verifyToken: (token: string) => Promise<Record<string, unknown> | null>;
   /** Runtime environment */
   environment: string;
-  /** Publish a background job */
-  publishJob: (type: string, payload: unknown, options?: { schedulable?: boolean; runAt?: Date }) => Promise<string>;
+  /** Publish a background job. Optional — a lean app with no @everystack/jobs never sets it. */
+  publishJob?: (type: string, payload: unknown, options?: { schedulable?: boolean; runAt?: Date }) => Promise<string>;
   /** Cancel a scheduled job */
   cancelJob?: (jobId: string) => Promise<void>;
   /** Reschedule a pending job */
@@ -596,18 +596,12 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
       if (options.connectionInfo) {
         return await options.connectionInfo();
       }
-      try {
-        const { Resource } = await import('sst');
-        return {
-          host: (Resource as any).Database.host,
-          port: (Resource as any).Database.port,
-          database: (Resource as any).Database.database,
-          username: (Resource as any).Database.username,
-          password: (Resource as any).Database.password,
-        };
-      } catch {
+      const { getDatabaseComponentInfo } = await import('./db');
+      const db = getDatabaseComponentInfo();
+      if (!db) {
         return { error: 'No connectionInfo callback provided and SST Resource.Database not available' };
       }
+      return { host: db.host, port: db.port, database: db.database, username: db.username, password: db.password };
     };
 
     // --- db:query ---
@@ -778,13 +772,10 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
           connection = { host: info.host, port: info.port, database: info.database };
         }
       } else {
-        try {
-          const { Resource } = await import('sst');
-          const db = (Resource as any).Database;
-          if (db?.host) connection = { host: db.host, port: db.port, database: db.database };
-        } catch {
-          // No linked component and no callback — the admin login lands unverified.
-        }
+        const { getDatabaseComponentInfo } = await import('./db');
+        const db = getDatabaseComponentInfo();
+        // No linked component and no callback — the admin login lands unverified.
+        if (db?.host) connection = { host: db.host, port: db.port, database: db.database };
       }
 
       return await runProvision(