@auth-craft/aws-cf-stack 1.5.0 → 1.6.1

package/lib/create-admin.sh

@@ -10,11 +10,16 @@ create_admin() {
   local email="${LAMBDA_SUPER_ADMIN_EMAIL:-}"
   local password="${LAMBDA_SUPER_ADMIN_PASSWORD:-}"
   local name="${LAMBDA_SUPER_ADMIN_NAME:-Super Admin}"
-  local setup_token="${LAMBDA_AUTH_SETUP_TOKEN:-${AUTH_SETUP_TOKEN:-}}"
 
-  if [[ -z "$email" || -z "$password" || -z "$setup_token" ]]; then
-    warn "Super-admin creds not configured — skipping."
-    info "Set LAMBDA_SUPER_ADMIN_EMAIL, LAMBDA_SUPER_ADMIN_PASSWORD, LAMBDA_AUTH_SETUP_TOKEN to enable."
+  # Email + password are required to bootstrap the super-admin. Report exactly which are
+  # missing so a partial config isn't confusing. (The CLI is idempotent: if an active
+  # owner already exists in the system tenant it's a no-op, so re-runs are safe.)
+  local -a missing=()
+  [[ -z "$email" ]] && missing+=("LAMBDA_SUPER_ADMIN_EMAIL")
+  [[ -z "$password" ]] && missing+=("LAMBDA_SUPER_ADMIN_PASSWORD")
+  if [[ ${#missing[@]} -gt 0 ]]; then
+    warn "Super-admin skipped — missing: ${missing[*]}"
+    info "Set LAMBDA_SUPER_ADMIN_EMAIL and LAMBDA_SUPER_ADMIN_PASSWORD to enable."
     SUPER_ADMIN_STATUS="skipped"
     export SUPER_ADMIN_STATUS
     return 0
@@ -30,23 +35,24 @@ create_admin() {
 
   local output status
   set +e
-  output="$(AUTH_SETUP_TOKEN="$setup_token" node "$entry" create-super-admin \
+  output="$(node "$entry" create-super-admin \
     --database-type dynamodb \
     --dynamodb-table "$DYNAMODB_TABLE" \
     --dynamodb-region "$AWS_REGION" \
     --email "$email" \
     --password "$password" \
-    --name "$name" \
-    --setup-token "$setup_token" 2>&1)"
+    --name "$name" 2>&1)"
   status=$?
   set -e
 
   echo "$output"
 
+  # Match the exact error CODE, not a loose substring: EXISTENCE_CHECK_FAILED's message
+  # also contains "already exists" and must NOT be mistaken for success.
   if [[ $status -eq 0 ]]; then
     success "Super admin created"
     SUPER_ADMIN_STATUS="created"
-  elif echo "$output" | grep -qi "SUPER_ADMIN_EXISTS\|already exists"; then
+  elif echo "$output" | grep -qE '\[SUPER_ADMIN_EXISTS\]|SUPER_ADMIN_EXISTS'; then
     info "Super admin already exists (no action needed)"
     SUPER_ADMIN_STATUS="exists"
   else

package/lib/deploy-gateway.sh

@@ -151,6 +151,11 @@ deploy_one_worker() {
   config_file="$WRANGLER_DIR/wrangler.toml"
   if [[ -n "$cors_kv_id" || -n "$disable_public_url" ]]; then
     config_file="$(mktemp "${TMPDIR:-/tmp}/wrangler-${label}.XXXXXX.toml")"
+    # `main` in the shipped toml is RELATIVE to the toml's own dir (../assets/...). A temp
+    # config lives elsewhere (e.g. /tmp), so that relative path would resolve wrong and
+    # wrangler can't find the worker bundle. Rewrite it to the absolute asset path. This
+    # runs for BOTH branches below (disable-public-url and plain copy).
+    local abs_main="$GATEWAY_ASSET_DIR/worker.js"
     if [[ -n "$disable_public_url" ]]; then
       # Turn off the workers.dev URL *and* the per-version preview URLs in a single
       # deploy (no REST API round-trip; CF won't drop preview URLs just for workers_dev
@@ -158,8 +163,9 @@ deploy_one_worker() {
       # any [table] header or TOML scopes them under it (e.g. [build]). We drop the
       # shipped `workers_dev = true` (TOML forbids duplicate keys) and inject both flags
       # immediately after the first root key (`name = …`), before [build].
-      awk '
-        /^[[:space:]]*workers_dev[[:space:]]*=/ { next }   # drop original (anywhere)
+      awk -v abs_main="$abs_main" '
+        /^[[:space:]]*workers_dev[[:space:]]*=/ { next }                 # drop original (anywhere)
+        /^[[:space:]]*main[[:space:]]*=/ { print "main = \"" abs_main "\""; next }  # absolutize
         { print }
         !injected && /^[[:space:]]*name[[:space:]]*=/ {
           print "workers_dev = false"; print "preview_urls = false"; injected = 1
@@ -167,7 +173,10 @@ deploy_one_worker() {
       ' "$WRANGLER_DIR/wrangler.toml" >"$config_file"
       info "  public URL disabled: workers.dev + preview URLs off (Pages-proxy / Service Binding only)"
     else
-      cat "$WRANGLER_DIR/wrangler.toml" >"$config_file"
+      awk -v abs_main="$abs_main" '
+        /^[[:space:]]*main[[:space:]]*=/ { print "main = \"" abs_main "\""; next }  # absolutize
+        { print }
+      ' "$WRANGLER_DIR/wrangler.toml" >"$config_file"
     fi
     if [[ -n "$cors_kv_id" ]]; then
       {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth-craft/aws-cf-stack",
-  "version": "1.5.0",
+  "version": "1.6.1",
   "description": "Self-contained, versioned distribution of the Auth Craft AWS (DynamoDB + Lambda) + Cloudflare gateway stack. Bundles prebuilt Lambda/worker artifacts + CDK app so consumers deploy without cloning auth-craft.",
   "type": "module",
   "bin": {