@everystack/server 0.4.6 → 0.4.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.6",
+  "version": "0.4.8",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -155,9 +155,9 @@
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
+    "@everystack/cli": "0.4.22",
     "@everystack/auth": "0.4.0",
-    "@everystack/pg-tools": "0.4.0",
-    "@everystack/cli": "0.4.20"
+    "@everystack/pg-tools": "0.4.0"
   },
   "scripts": {
     "test": "jest",

package/src/db.ts

@@ -9,27 +9,19 @@
 
 import { drizzle } from 'drizzle-orm/postgres-js';
 import postgres from 'postgres';
+import { loadSstResources } from './sst-resources';
 
 /**
- * Read an SST-linked resource WITHOUT importing the `sst` package. SST injects
- * every link as `process.env.SST_RESOURCE_<Name>` (a JSON blob) — SST's own
- * Resource proxy just parses that env var (see sst/dist/resource/shared.js:
- * `raw[name] = JSON.parse(process.env['SST_RESOURCE_' + name])`). Reading it
- * directly means this module never imports `sst`, which is a deploy-time
- * construct: Metro/esbuild cannot bundle it, and SST's own build-time
- * version-check plugin mis-reads a node_module's `sst` import and fails the
- * build. So the API/SSR helpers stayed unbundleable in the exact runtime half
- * the framework targets. Returns undefined when the link is absent — every
+ * Read an SST-linked resource WITHOUT importing the `sst` package. `sst` is a
+ * deploy-time construct: importing it makes this module unbundleable (Metro) and
+ * trips SST's own build-time version-check plugin. `loadSstResources` reads every
+ * mechanism SST uses to deliver links — per-name env, the bundled JSON, and the
+ * encrypted key file (SST >= ~4.13's Lambda default) — so this resolves the same
+ * links `Resource.<Name>` would. Returns undefined when the link is absent; every
  * getter then falls through to process.env, unchanged.
  */
 function sstLink<T = Record<string, any>>(name: string): T | undefined {
-  const raw = process.env[`SST_RESOURCE_${name}`];
-  if (!raw) return undefined;
-  try {
-    return JSON.parse(raw) as T;
-  } catch {
-    return undefined;
-  }
+  return loadSstResources()[name] as T | undefined;
 }
 
 /**

package/src/plugin.ts

@@ -420,6 +420,16 @@ export function ssrPlugin(options: SsrPluginOptions = {}): (ctx: PluginContext)
     if (options.stripQueryParams) ssrOptions.stripQueryParams = options.stripQueryParams;
     if (options.injectHydrateFlag !== undefined) ssrOptions.injectHydrateFlag = options.injectHydrateFlag;
 
+    // Fail LOUD on the misconfiguration, not silent 404. Without ctx.updatesStorage the SSR
+    // fallback can never serve `/` (getWebHandler has no bundle source) — but /api still works,
+    // so it reads like a broken bundle, not a missing link. A consumer lost hours to exactly
+    // this silent null. Log once at init with the fix.
+    if (!(ctx as SsrContext).updatesStorage) {
+      log('error', 'ssrPlugin: no updatesStorage in the plugin context — every non-API route will 404. '
+        + 'Wire it in createAppContext: updatesStorage = await createStorage({ type: "s3", '
+        + 'bucket: sstResource<{name:string}>("Updates")?.name }) and LINK the Updates bucket to this function.');
+    }
+
     return async (request: Request): Promise<Response> => {
       const webHandler = await getWebHandler(
         (ctx as SsrContext).updatesStorage,
@@ -978,6 +988,50 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
       }
     };
 
+    // --- db:reconcile — the credential-free DERIVED-layer apply (the db:apply twin) ---
+    // The STATE edge (db:apply) runs in the ops Lambda; this is the DERIVED edge's lane so a
+    // least-privileged operator never needs the raw admin URL to deploy functions/views/matviews.
+    // Unlike db:apply's portable plan, a reconcile plan needs LIVE introspection (source hash vs
+    // live def hash), so the whole executeReconcile runs HERE on the operator connection: the CLI
+    // ships only the declared derived objects (bundle-independent — they come from the models
+    // barrel), and this introspects → plans → applies, emitting its own SET search_path. The DDL
+    // batch and its provenance/schema_log land in one transaction, same as the direct path.
+    actions['db:reconcile'] = async (payload, _ctx) => {
+      const p = (payload ?? {}) as {
+        declared?: any[];
+        renamedTables?: any;
+        apply?: boolean;
+        baseline?: boolean;
+        rebaseline?: boolean;
+        rebuild?: boolean;
+        overwriteDrift?: boolean;
+        actor?: string | null;
+        gitRef?: string | null;
+      };
+      try {
+        const { executeReconcile } = await import('@everystack/cli/reconcile');
+        const { sql } = await import('drizzle-orm');
+        const runner = async (query: string): Promise<any[]> => {
+          const result: any = await opsDb.execute(sql.raw(query));
+          return Array.isArray(result) ? result : result?.rows ?? [];
+        };
+        const run = await executeReconcile(runner, {
+          declared: p.declared,
+          renamedTables: p.renamedTables,
+          apply: p.apply,
+          baseline: p.baseline,
+          rebaseline: p.rebaseline,
+          rebuild: p.rebuild,
+          overwriteDrift: p.overwriteDrift,
+          actor: p.actor ?? null,
+          gitRef: p.gitRef ?? null,
+        } as any);
+        return { plan: run.plan, applied: run.applied, statements: run.statements, refusal: run.refusal ?? null };
+      } catch (err: any) {
+        return { error: err?.message || String(err) };
+      }
+    };
+
     // --- pipeline:run — the credential-free ingest reproduction (Phase 3, Brick 5) ---
     // The orchestrator runs HERE, in the ops Lambda, over the operator connection: a
     // deployed stage's small curated overlays reproduce via IAM, never a held URL. The

package/src/sst-resources.ts

@@ -0,0 +1,80 @@
+/**
+ * @everystack/server/sst-resources — read SST-linked resources WITHOUT importing `sst`.
+ *
+ * `sst` is a deploy-time construct: importing it makes @everystack/server unbundleable
+ * (Metro) and trips SST's own build-time version-check plugin. So we read the resources the
+ * way SST delivers them, mirroring `sst/dist/resource/node.js` exactly:
+ *
+ *   1. per-name env — `process.env.SST_RESOURCE_<Name>` (JSON)
+ *   2. the bundled all-resources JSON — `process.env.SST_RESOURCES_JSON`
+ *   3. the ENCRYPTED key file — `SST_KEY_FILE` + `SST_KEY` (SST >= ~4.13's Lambda default,
+ *      aes-256-gcm, 12-byte zero nonce, 16-byte auth tag appended)
+ *
+ * (1) alone — the 0.4.5 sst-removal's mistake — misses everything on a modern SST Lambda,
+ * where only `SST_RESOURCE_App` is plain env and every real link rides the encrypted blob.
+ * `node:crypto`/`node:fs` are builtins already shipped in this package's server-bundle path
+ * (ssr.ts, backup-run.ts) — never the `sst` package, so nothing here breaks a bundle.
+ */
+
+import crypto from 'node:crypto';
+import { readFileSync } from 'node:fs';
+
+let cache: Record<string, any> | undefined;
+
+/** Decrypt the SST key file exactly as sst/dist/resource/node.js does. Throws on any format
+ *  mismatch (bad key, truncated file) — the caller swallows it and uses the other sources. */
+function decryptKeyFile(keyFile: string, keyB64: string): Record<string, any> {
+  const key = Buffer.from(keyB64, 'base64');
+  const encrypted = readFileSync(keyFile);
+  const nonce = Buffer.alloc(12, 0);
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, nonce);
+  decipher.setAuthTag(encrypted.subarray(-16));
+  const decrypted = Buffer.concat([decipher.update(encrypted.subarray(0, -16)), decipher.final()]);
+  return JSON.parse(decrypted.toString());
+}
+
+/**
+ * The merged SST resource map, loaded once and cached (resources are container-stable on a
+ * Lambda). Every source is best-effort — a malformed one is skipped, never fatal — so an app
+ * that only ever sets plain env still resolves what it has, and local/Metro (no SST env) gets
+ * an empty map. Later sources win, matching SST's own precedence.
+ */
+export function loadSstResources(): Record<string, any> {
+  if (cache) return cache;
+  const raw: Record<string, any> = {};
+  const env = process.env;
+
+  for (const [k, v] of Object.entries(env)) {
+    if (v && k.startsWith('SST_RESOURCE_')) {
+      try {
+        raw[k.slice('SST_RESOURCE_'.length)] = JSON.parse(v);
+      } catch {
+        /* not JSON — skip this key */
+      }
+    }
+  }
+
+  if (env.SST_RESOURCES_JSON) {
+    try {
+      Object.assign(raw, JSON.parse(env.SST_RESOURCES_JSON));
+    } catch {
+      /* malformed — skip */
+    }
+  }
+
+  if (env.SST_KEY_FILE && env.SST_KEY) {
+    try {
+      Object.assign(raw, decryptKeyFile(env.SST_KEY_FILE, env.SST_KEY));
+    } catch {
+      /* undecryptable — fall through to what the env already gave us */
+    }
+  }
+
+  cache = raw;
+  return raw;
+}
+
+/** Test seam: drop the cache so a fresh env is re-read. */
+export function resetSstResourceCache(): void {
+  cache = undefined;
+}