rastack 0.0.33 → 0.0.35

package/dist/deploy/io.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Filesystem + prompt helpers shared by the `rastack deploy | ci | init`
+ * entrypoints. Everything pure lives in the sibling modules; this is the small
+ * IO boundary they wrap.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.configPath = configPath;
+exports.loadConfig = loadConfig;
+exports.saveConfig = saveConfig;
+exports.gitRemoteUrl = gitRemoteUrl;
+exports.canPrompt = canPrompt;
+exports.ask = ask;
+exports.withPrompt = withPrompt;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const readline = __importStar(require("readline"));
+const workflows_1 = require("./workflows");
+const config_1 = require("./config");
+/** Absolute path to the deploy config for a project root. */
+function configPath(cwd = process.cwd()) {
+    return path.join(cwd, workflows_1.CONFIG_PATH);
+}
+/** Read + normalize the deploy config, or null when it does not exist yet. */
+function loadConfig(cwd = process.cwd()) {
+    const file = configPath(cwd);
+    if (!fs.existsSync(file))
+        return null;
+    const raw = JSON.parse(fs.readFileSync(file, "utf-8"));
+    return (0, config_1.normalizeConfig)(raw);
+}
+/** Write the deploy config, creating `.rastack/` if needed. */
+function saveConfig(cfg, cwd = process.cwd()) {
+    const file = configPath(cwd);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, JSON.stringify(cfg, null, 2) + "\n");
+    return file;
+}
+/**
+ * Best-effort GitHub `origin` remote URL, for defaulting the repo coordinates.
+ * Returns null when not a git repo or no origin.
+ */
+function gitRemoteUrl(cwd = process.cwd()) {
+    try {
+        // Reads the developer's own git config with a fixed command; no untrusted
+        // input, so there is no command-injection surface.
+        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+        const out = (0, child_process_1.execSync)("git remote get-url origin", {
+            cwd,
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        const url = out.toString().trim();
+        return url || null;
+    }
+    catch {
+        return null;
+    }
+}
+/** True when we can prompt the user (a TTY, and not explicitly opted out). */
+function canPrompt(nonInteractive) {
+    return !nonInteractive && Boolean(process.stdin.isTTY);
+}
+/**
+ * Ask a single question with a default, echoed as `label [default]: `. Returns
+ * the trimmed answer, or the default on an empty line.
+ */
+function ask(rl, label, def) {
+    const suffix = def ? ` [${def}]` : "";
+    return new Promise((resolve) => {
+        rl.question(`  ${label}${suffix}: `, (answer) => {
+            resolve(answer.trim() || def);
+        });
+    });
+}
+/** Run a callback with a readline interface, always closing it. */
+async function withPrompt(fn) {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    try {
+        return await fn(rl);
+    }
+    finally {
+        rl.close();
+    }
+}

package/dist/deploy/workflows.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The files `rastack init` templates into a repo — the base GitHub Actions and
+ * the deploy config — so starting (or reconfiguring) a project is one command.
+ *
+ * The generated workflows lean on `rastack ci`: rather than inlining the build
+ * and deploy shell, each job runs one `rastack ci …` line, and the CLI owns the
+ * steps (tools/src/deploy/ci.ts). That keeps the YAML short and keeps the
+ * pipeline logic versioned with the CLI, testable, and inspectable with
+ * `rastack ci --plan`.
+ *
+ * Pure string builders — `rastack-init.ts` is the thin wrapper that writes them.
+ */
+import { DeployConfig } from "./config";
+/** A templated file: repo-relative path + its contents. */
+export interface ScaffoldFile {
+    path: string;
+    content: string;
+}
+/**
+ * `.github/workflows/ci.yml` — validate resources and compile the manifest on
+ * every push/PR. The clean replacement for hand-written compile/check steps.
+ */
+export declare function renderCiWorkflow(cfg: DeployConfig): string;
+/**
+ * `.github/workflows/deploy-backend.yml` — ship the Rust Lambda on every push to
+ * the deploy branch. Authenticates with GitHub OIDC (no stored keys) and then
+ * runs one line, `rastack ci deploy`, which cross-builds the bundle, bakes the
+ * JWKS, and calls `update-function-code`. That single privileged call is the
+ * whole of CI's blast radius (docs/serverless-deploy.md §2).
+ */
+export declare function renderDeployWorkflow(cfg: DeployConfig): string;
+/** The deploy config written to `.rastack/deploy.json`, pretty-printed. */
+export declare function renderConfigFile(cfg: DeployConfig): string;
+export declare const CONFIG_PATH = ".rastack/deploy.json";
+export declare const CI_WORKFLOW_PATH = ".github/workflows/ci.yml";
+export declare const DEPLOY_WORKFLOW_PATH = ".github/workflows/deploy-backend.yml";
+export interface ScaffoldOptions {
+    /** Omit the GitHub Actions workflows (config only). */
+    noWorkflows?: boolean;
+}
+/**
+ * The full set of files `rastack init` templates: the deploy config plus the two
+ * base workflows. Returned as data so the caller decides what to write, skip, or
+ * overwrite.
+ */
+export declare function scaffoldFiles(cfg: DeployConfig, opts?: ScaffoldOptions): ScaffoldFile[];

package/dist/deploy/workflows.js

@@ -0,0 +1,145 @@
+"use strict";
+/**
+ * The files `rastack init` templates into a repo — the base GitHub Actions and
+ * the deploy config — so starting (or reconfiguring) a project is one command.
+ *
+ * The generated workflows lean on `rastack ci`: rather than inlining the build
+ * and deploy shell, each job runs one `rastack ci …` line, and the CLI owns the
+ * steps (tools/src/deploy/ci.ts). That keeps the YAML short and keeps the
+ * pipeline logic versioned with the CLI, testable, and inspectable with
+ * `rastack ci --plan`.
+ *
+ * Pure string builders — `rastack-init.ts` is the thin wrapper that writes them.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEPLOY_WORKFLOW_PATH = exports.CI_WORKFLOW_PATH = exports.CONFIG_PATH = void 0;
+exports.renderCiWorkflow = renderCiWorkflow;
+exports.renderDeployWorkflow = renderDeployWorkflow;
+exports.renderConfigFile = renderConfigFile;
+exports.scaffoldFiles = scaffoldFiles;
+/** Node version the templated workflows pin (LTS — safe for a fresh repo). */
+const NODE_VERSION = "22";
+/**
+ * `.github/workflows/ci.yml` — validate resources and compile the manifest on
+ * every push/PR. The clean replacement for hand-written compile/check steps.
+ */
+function renderCiWorkflow(cfg) {
+    return `name: CI
+
+# Validate the resource graph and compile the manifest on every change.
+# The heavy lifting lives in \`rastack ci check\` (see tools/src/deploy/ci.ts),
+# so this workflow stays a single command.
+
+on:
+  push:
+    branches: [${cfg.github.branch}]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '${NODE_VERSION}'
+      - name: Install rastack
+        run: npm install -g rastack
+      - name: Validate resources & compile manifest
+        run: rastack ci check
+`;
+}
+/**
+ * `.github/workflows/deploy-backend.yml` — ship the Rust Lambda on every push to
+ * the deploy branch. Authenticates with GitHub OIDC (no stored keys) and then
+ * runs one line, `rastack ci deploy`, which cross-builds the bundle, bakes the
+ * JWKS, and calls `update-function-code`. That single privileged call is the
+ * whole of CI's blast radius (docs/serverless-deploy.md §2).
+ */
+function renderDeployWorkflow(cfg) {
+    const arch = cfg.lambda.arch === "arm64" ? "arm64" : "x86_64";
+    return `name: Deploy backend
+
+# Ship the Rust API (rastack-server) to AWS Lambda. Infrastructure is created
+# once by a human via CloudFormation (docs/serverless-deploy.md); this workflow
+# only ever runs \`aws lambda update-function-code\`, wrapped by \`rastack ci\`.
+#
+# Wire these from the CloudFormation stack Outputs as GitHub repo Variables:
+#   AWS_DEPLOY_ROLE_ARN   DeployRoleArn   (the OIDC role this job assumes)
+#   AWS_REGION            Region          (${cfg.region})
+
+on:
+  push:
+    branches: [${cfg.github.branch}]
+
+# Least privilege: read the repo + mint an OIDC token to assume the deploy role.
+permissions:
+  contents: read
+  id-token: write
+
+concurrency:
+  group: deploy-backend
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    name: Build & deploy the Lambda (${arch})
+    runs-on: ubuntu-latest
+    # Skip on forks / repos that never wired the deploy role, so the job does
+    # not fail red for contributors who cannot (and should not) deploy.
+    if: vars.AWS_DEPLOY_ROLE_ARN != ''
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '${NODE_VERSION}'
+      - name: Install rastack
+        run: npm install -g rastack
+
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: rust
+      # cargo-lambda cross-builds the custom-runtime binary; it auto-installs
+      # zig (via pip) for the cross-compile when needed.
+      - name: Install cargo-lambda
+        run: pip3 install cargo-lambda
+
+      - name: Configure AWS credentials (OIDC — no stored keys)
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: \${{ vars.AWS_DEPLOY_ROLE_ARN }}
+          aws-region: \${{ vars.AWS_REGION }}
+
+      # One line: compile the manifest, cross-build the bundle, bake the JWKS,
+      # and update-function-code. See \`rastack ci --plan deploy\`.
+      - name: Build & deploy
+        run: rastack ci deploy
+`;
+}
+/** The deploy config written to `.rastack/deploy.json`, pretty-printed. */
+function renderConfigFile(cfg) {
+    return JSON.stringify(cfg, null, 2) + "\n";
+}
+exports.CONFIG_PATH = ".rastack/deploy.json";
+exports.CI_WORKFLOW_PATH = ".github/workflows/ci.yml";
+exports.DEPLOY_WORKFLOW_PATH = ".github/workflows/deploy-backend.yml";
+/**
+ * The full set of files `rastack init` templates: the deploy config plus the two
+ * base workflows. Returned as data so the caller decides what to write, skip, or
+ * overwrite.
+ */
+function scaffoldFiles(cfg, opts = {}) {
+    const files = [
+        { path: exports.CONFIG_PATH, content: renderConfigFile(cfg) },
+    ];
+    if (!opts.noWorkflows) {
+        files.push({ path: exports.CI_WORKFLOW_PATH, content: renderCiWorkflow(cfg) }, { path: exports.DEPLOY_WORKFLOW_PATH, content: renderDeployWorkflow(cfg) });
+    }
+    return files;
+}

package/dist/rastack-ci.d.ts

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+/**
+ * `rastack ci` — run the CI pipeline for a phase, so GitHub Actions stays a
+ * one-liner.
+ *
+ *   rastack ci <check|build|deploy> [--plan] [--skip-build]
+ *              [--function <name>] [--jwks-url <url>] [--bin <cmd>]
+ *
+ *   check    validate the resource graph + compile the manifest (a CI gate)
+ *   build    cross-build the Lambda bundle and bake the Cognito JWKS in
+ *   deploy   build (unless --skip-build) then `update-function-code`
+ *
+ * The steps are a pure function of `.rastack/deploy.json` (see
+ * tools/src/deploy/ci.ts); `--plan` prints them without running anything.
+ * Function name / JWKS URL come from the config's stack outputs when wired, else
+ * are resolved live from CloudFormation at run time.
+ */
+export {};

package/dist/rastack-ci.js

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * `rastack ci` — run the CI pipeline for a phase, so GitHub Actions stays a
+ * one-liner.
+ *
+ *   rastack ci <check|build|deploy> [--plan] [--skip-build]
+ *              [--function <name>] [--jwks-url <url>] [--bin <cmd>]
+ *
+ *   check    validate the resource graph + compile the manifest (a CI gate)
+ *   build    cross-build the Lambda bundle and bake the Cognito JWKS in
+ *   deploy   build (unless --skip-build) then `update-function-code`
+ *
+ * The steps are a pure function of `.rastack/deploy.json` (see
+ * tools/src/deploy/ci.ts); `--plan` prints them without running anything.
+ * Function name / JWKS URL come from the config's stack outputs when wired, else
+ * are resolved live from CloudFormation at run time.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const child_process_1 = require("child_process");
+const ci_1 = require("./deploy/ci");
+const io_1 = require("./deploy/io");
+const PHASES = ["check", "build", "deploy"];
+function parseFlags(argv) {
+    let phase = "";
+    let plan = false;
+    const opts = {
+        bin: process.env.RASTACK_BIN || "rastack",
+        functionName: process.env.RASTACK_FUNCTION || undefined,
+        jwksUrl: process.env.RASTACK_JWKS_URL || undefined,
+    };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = () => argv[++i] ?? "";
+        switch (a) {
+            case "--plan":
+            case "--dry-run":
+                plan = true;
+                break;
+            case "--skip-build":
+                opts.skipBuild = true;
+                break;
+            case "--function":
+                opts.functionName = next();
+                break;
+            case "--jwks-url":
+                opts.jwksUrl = next();
+                break;
+            case "--bin":
+                opts.bin = next();
+                break;
+            default:
+                if (a.startsWith("-")) {
+                    console.error(`Unknown flag: ${a}`);
+                    process.exit(1);
+                }
+                else if (!phase && PHASES.includes(a)) {
+                    phase = a;
+                }
+                else if (!phase) {
+                    console.error(`Unknown ci phase: "${a}" (expected ${PHASES.join(" | ")}).`);
+                    process.exit(1);
+                }
+        }
+    }
+    if (!phase) {
+        console.error(`Usage: rastack ci <${PHASES.join(" | ")}> [--plan] [--skip-build]\n`);
+        process.exit(1);
+    }
+    return { phase, plan, opts };
+}
+function printPlan(phase, steps) {
+    console.log(`\n  rastack ci ${phase} — ${steps.length} step(s):\n`);
+    steps.forEach((s, i) => {
+        const at = s.cwd ? ` (in ${s.cwd}/)` : "";
+        console.log(`  ${i + 1}. ${s.name}${at}`);
+        console.log(`     $ ${s.run}\n`);
+    });
+}
+function runSteps(phase, steps) {
+    for (const step of steps) {
+        console.log(`\n▸ ${step.name}${step.cwd ? ` (in ${step.cwd}/)` : ""}`);
+        console.log(`  $ ${step.run}`);
+        try {
+            // Runs a CI pipeline step derived from the developer's own deploy config
+            // — no untrusted input. A shell is required for the `$(aws …)` output
+            // substitutions the plan uses to resolve stack outputs at run time.
+            // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+            (0, child_process_1.execSync)(step.run, {
+                stdio: "inherit",
+                cwd: step.cwd,
+                env: process.env,
+            });
+        }
+        catch {
+            console.error(`\n  ✗ step failed: ${step.name}`);
+            process.exit(1);
+        }
+    }
+    console.log(`\n  ✓ rastack ci ${phase} complete.`);
+}
+function main(argv) {
+    const { phase, plan, opts } = parseFlags(argv);
+    const cfg = (0, io_1.loadConfig)();
+    if (!cfg) {
+        console.error("  ✗ no .rastack/deploy.json found. Run `rastack init` (or `rastack deploy`) first.");
+        process.exit(1);
+        return;
+    }
+    const steps = (0, ci_1.ciPlan)(phase, cfg, opts);
+    if (plan)
+        printPlan(phase, steps);
+    else
+        runSteps(phase, steps);
+}
+if (require.main === module) {
+    main(process.argv.slice(2));
+}

package/dist/rastack-deploy.d.ts

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+/**
+ * `rastack deploy` — configure a repo's serverless deployment.
+ *
+ *   rastack deploy [--app <slug>] [--region <r>] [--owner <o>] [--repo <r>]
+ *                  [--branch <b>] [--namespace <n>] [--templates-bucket <b>]
+ *                  [--artifacts-bucket <b>] [--arch arm64|x86_64]
+ *                  [--print] [--run] [--yes]
+ *
+ * Writes/updates `.rastack/deploy.json` (creating it if `rastack init` has not
+ * run) and prints exactly how to stand the app up: the one-time
+ * `aws cloudformation deploy` that creates all infrastructure, the GitHub repo
+ * Variables CI reads, and the Lambda's runtime env. Infra is created once by a
+ * human — this command *configures* that step, it does not silently mutate the
+ * cloud. `--run` executes the launch command for you; `--print` is
+ * non-interactive (config as-is).
+ *
+ * The recurring code deploy is CI's job (`rastack ci deploy`), not this command.
+ */
+export {};

package/dist/rastack-deploy.js

@@ -0,0 +1,196 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * `rastack deploy` — configure a repo's serverless deployment.
+ *
+ *   rastack deploy [--app <slug>] [--region <r>] [--owner <o>] [--repo <r>]
+ *                  [--branch <b>] [--namespace <n>] [--templates-bucket <b>]
+ *                  [--artifacts-bucket <b>] [--arch arm64|x86_64]
+ *                  [--print] [--run] [--yes]
+ *
+ * Writes/updates `.rastack/deploy.json` (creating it if `rastack init` has not
+ * run) and prints exactly how to stand the app up: the one-time
+ * `aws cloudformation deploy` that creates all infrastructure, the GitHub repo
+ * Variables CI reads, and the Lambda's runtime env. Infra is created once by a
+ * human — this command *configures* that step, it does not silently mutate the
+ * cloud. `--run` executes the launch command for you; `--print` is
+ * non-interactive (config as-is).
+ *
+ * The recurring code deploy is CI's job (`rastack ci deploy`), not this command.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const child_process_1 = require("child_process");
+const config_1 = require("./deploy/config");
+const io_1 = require("./deploy/io");
+function parseFlags(argv) {
+    const patch = { github: {}, lambda: {} };
+    let print = false;
+    let run = false;
+    let nonInteractive = false;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = () => argv[++i] ?? "";
+        switch (a) {
+            case "--app":
+                patch.app = next();
+                break;
+            case "--region":
+                patch.region = next();
+                break;
+            case "--owner":
+                patch.github.owner = next();
+                break;
+            case "--repo":
+                patch.github.repo = next();
+                break;
+            case "--branch":
+                patch.github.branch = next();
+                break;
+            case "--prefix":
+                patch.namePrefix = next();
+                break;
+            case "--namespace":
+                patch.namespace = next();
+                break;
+            case "--stack-name":
+                patch.stackName = next();
+                break;
+            case "--templates-bucket":
+                patch.templatesBucket = next();
+                break;
+            case "--artifacts-bucket":
+                patch.artifactsBucket = next();
+                break;
+            case "--arch":
+                patch.lambda.arch = next();
+                break;
+            case "--print":
+                print = true;
+                nonInteractive = true;
+                break;
+            case "--run":
+                run = true;
+                break;
+            case "--yes":
+            case "-y":
+            case "--non-interactive":
+                nonInteractive = true;
+                break;
+            default:
+                if (a.startsWith("-")) {
+                    console.error(`Unknown flag: ${a}`);
+                    process.exit(1);
+                }
+        }
+    }
+    return { patch, print, run, nonInteractive };
+}
+function seedConfig(patch) {
+    const existing = (0, io_1.loadConfig)();
+    return existing ? (0, config_1.mergeConfig)(existing, patch) : (0, config_1.normalizeConfig)(patch);
+}
+async function promptMissing(cfg) {
+    return (0, io_1.withPrompt)(async (rl) => {
+        const app = await (0, io_1.ask)(rl, "App slug", cfg.app);
+        const owner = await (0, io_1.ask)(rl, "GitHub owner", cfg.github.owner);
+        const repo = await (0, io_1.ask)(rl, "GitHub repo", cfg.github.repo);
+        const branch = await (0, io_1.ask)(rl, "Deploy branch", cfg.github.branch);
+        const region = await (0, io_1.ask)(rl, "AWS region", cfg.region);
+        const namespace = await (0, io_1.ask)(rl, "Iceberg namespace", cfg.namespace);
+        const artifactsBucket = await (0, io_1.ask)(rl, "Artifacts bucket (from bootstrap stack)", cfg.artifactsBucket ?? "");
+        const templatesBucket = await (0, io_1.ask)(rl, "Templates bucket (from bootstrap stack, optional)", cfg.templatesBucket ?? "");
+        return (0, config_1.mergeConfig)(cfg, {
+            app,
+            region,
+            namespace,
+            artifactsBucket,
+            templatesBucket,
+            github: { owner, repo, branch },
+        });
+    });
+}
+/** Pad a list of `Key=Value` rows into an aligned table. */
+function table(rows) {
+    const width = Math.max(0, ...rows.map((r) => r.key.length));
+    return rows.map((r) => `    ${r.key.padEnd(width)}  ${r.value}`).join("\n");
+}
+function printSummary(cfg) {
+    const src = (0, config_1.templateUrl)(cfg);
+    console.log(`\n  Deployment config (${cfg.stackName} @ ${cfg.region})\n`);
+    console.log("  ── 1. Create the infrastructure (once, by a human) ──");
+    if (!cfg.artifactsBucket) {
+        console.log("    ⚠ artifactsBucket is unset — app.yaml requires it. Run the bootstrap\n" +
+            "      stack first, then set --artifacts-bucket (its ArtifactsBucketName output).");
+    }
+    if (!src) {
+        console.log("    (launching from the in-repo template; set --templates-bucket to launch\n" +
+            "     the hosted app.yaml by URL instead)");
+    }
+    console.log("\n" + (0, config_1.deployStackCommand)(cfg) + "\n");
+    console.log("  ── 2. Wire the GitHub repo Variables (from the stack Outputs) ──");
+    console.log(table((0, config_1.repoVariables)(cfg).map((v) => ({
+        key: v.name,
+        value: v.value || `<${v.from}>`,
+    }))));
+    console.log("\n  ── 3. The Lambda runtime env (set by the stack) ──");
+    console.log(table((0, config_1.lambdaEnv)(cfg)));
+    console.log(`\n  ── 4. Then every push to ${cfg.github.branch} runs \`rastack ci deploy\`. ──\n`);
+}
+function runLaunch(cfg) {
+    const params = (0, config_1.stackParameters)(cfg).map((p) => `${p.key}=${p.value}`);
+    const src = (0, config_1.templateUrl)(cfg);
+    const args = [
+        "cloudformation",
+        "deploy",
+        ...(src
+            ? ["--template-url", src]
+            : ["--template-file", "deploy/cloudformation/app.yaml"]),
+        "--stack-name",
+        cfg.stackName,
+        "--capabilities",
+        "CAPABILITY_NAMED_IAM",
+        "--region",
+        cfg.region,
+        "--parameter-overrides",
+        ...params,
+    ];
+    console.log(`\n  ▸ aws ${args.join(" ")}\n`);
+    try {
+        // Runs the developer's own AWS CLI with args built from their config — no
+        // untrusted input, and `execFileSync` (no shell) avoids any injection.
+        (0, child_process_1.execFileSync)("aws", args, { stdio: "inherit" });
+    }
+    catch (err) {
+        console.error(`\n  ✗ aws cloudformation deploy failed. Is the AWS CLI installed and are` +
+            ` your credentials configured?\n    ${err.message}`);
+        process.exit(1);
+    }
+}
+async function main(argv) {
+    const flags = parseFlags(argv);
+    let cfg = seedConfig(flags.patch);
+    if ((0, io_1.canPrompt)(flags.nonInteractive)) {
+        console.log("\n  rastack deploy — configure the serverless deployment\n");
+        cfg = await promptMissing(cfg);
+    }
+    const errors = (0, config_1.validateConfig)(cfg);
+    if (errors.length) {
+        for (const e of errors)
+            console.error(`  ✗ ${e}`);
+        console.error(`\n  ${errors.length} problem(s) — fix the config and re-run.`);
+        process.exit(1);
+    }
+    if (!flags.print) {
+        const file = (0, io_1.saveConfig)(cfg);
+        console.log(`  ✓ saved ${file}`);
+    }
+    printSummary(cfg);
+    if (flags.run)
+        runLaunch(cfg);
+}
+if (require.main === module) {
+    main(process.argv.slice(2)).catch((err) => {
+        console.error(`  ✗ ${err.message}`);
+        process.exit(1);
+    });
+}

package/dist/rastack-init.d.ts

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+/**
+ * `rastack init` — template the base GitHub Actions + deploy config into a repo.
+ *
+ *   rastack init [--app <slug>] [--owner <o>] [--repo <r>] [--branch <b>]
+ *                [--region <r>] [--force] [--no-workflows] [--yes]
+ *
+ * Scaffolds a new project (or reconfigures an existing one) so it is ready to
+ * deploy: `.rastack/deploy.json` plus `.github/workflows/{ci,deploy-backend}.yml`,
+ * both of which run `rastack ci`. GitHub coordinates default from the repo's
+ * `origin` remote; missing fields are prompted for on a TTY. Existing files are
+ * left untouched unless `--force`.
+ */
+export {};