rastack 0.0.33 → 0.0.35

package/dist/rastack-init.js

@@ -0,0 +1,183 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * `rastack init` — template the base GitHub Actions + deploy config into a repo.
+ *
+ *   rastack init [--app <slug>] [--owner <o>] [--repo <r>] [--branch <b>]
+ *                [--region <r>] [--force] [--no-workflows] [--yes]
+ *
+ * Scaffolds a new project (or reconfigures an existing one) so it is ready to
+ * deploy: `.rastack/deploy.json` plus `.github/workflows/{ci,deploy-backend}.yml`,
+ * both of which run `rastack ci`. GitHub coordinates default from the repo's
+ * `origin` remote; missing fields are prompted for on a TTY. Existing files are
+ * left untouched unless `--force`.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const config_1 = require("./deploy/config");
+const workflows_1 = require("./deploy/workflows");
+const io_1 = require("./deploy/io");
+function parseFlags(argv) {
+    const patch = { github: {} };
+    let force = false;
+    let noWorkflows = false;
+    let nonInteractive = false;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = () => argv[++i] ?? "";
+        switch (a) {
+            case "--app":
+                patch.app = next();
+                break;
+            case "--owner":
+                patch.github.owner = next();
+                break;
+            case "--repo":
+                patch.github.repo = next();
+                break;
+            case "--branch":
+                patch.github.branch = next();
+                break;
+            case "--region":
+                patch.region = next();
+                break;
+            case "--prefix":
+                patch.namePrefix = next();
+                break;
+            case "--force":
+                force = true;
+                break;
+            case "--no-workflows":
+                noWorkflows = true;
+                break;
+            case "--yes":
+            case "-y":
+            case "--non-interactive":
+                nonInteractive = true;
+                break;
+            default:
+                if (a.startsWith("-")) {
+                    console.error(`Unknown flag: ${a}`);
+                    process.exit(1);
+                }
+        }
+    }
+    return { patch, force, noWorkflows, nonInteractive };
+}
+/** Seed a config: existing file → flags → git remote → defaults. */
+function seedConfig(flags) {
+    const existing = (0, io_1.loadConfig)();
+    let cfg = existing
+        ? (0, config_1.mergeConfig)(existing, flags.patch)
+        : (0, config_1.normalizeConfig)(flags.patch);
+    // Default the GitHub coordinates from `origin` when not already known.
+    if (!cfg.github.owner || !cfg.github.repo) {
+        const url = (0, io_1.gitRemoteUrl)();
+        const remote = url ? (0, config_1.parseGitHubRemote)(url) : null;
+        if (remote) {
+            cfg = (0, config_1.mergeConfig)(cfg, {
+                github: {
+                    owner: cfg.github.owner || remote.owner,
+                    repo: cfg.github.repo || remote.repo,
+                },
+            });
+        }
+    }
+    return cfg;
+}
+async function promptMissing(cfg) {
+    return (0, io_1.withPrompt)(async (rl) => {
+        const app = await (0, io_1.ask)(rl, "App slug", cfg.app || path.basename(process.cwd()));
+        const owner = await (0, io_1.ask)(rl, "GitHub owner", cfg.github.owner);
+        const repo = await (0, io_1.ask)(rl, "GitHub repo", cfg.github.repo);
+        const branch = await (0, io_1.ask)(rl, "Deploy branch", cfg.github.branch);
+        const region = await (0, io_1.ask)(rl, "AWS region", cfg.region);
+        return (0, config_1.mergeConfig)(cfg, {
+            app,
+            region,
+            github: { owner, repo, branch },
+        });
+    });
+}
+async function main(argv) {
+    const flags = parseFlags(argv);
+    let cfg = seedConfig(flags);
+    if ((0, io_1.canPrompt)(flags.nonInteractive)) {
+        console.log("\n  rastack init — scaffold the deploy config + GitHub Actions\n");
+        cfg = await promptMissing(cfg);
+    }
+    const errors = (0, config_1.validateConfig)(cfg);
+    // In non-interactive mode a still-incomplete config is fatal; interactively we
+    // still write what we have so the user can finish it in the file, but warn.
+    if (errors.length) {
+        const label = flags.nonInteractive ? "✗" : "⚠";
+        for (const e of errors)
+            console.error(`  ${label} ${e}`);
+        if (flags.nonInteractive) {
+            console.error(`\n  ${errors.length} problem(s). Pass the missing values as flags.`);
+            process.exit(1);
+        }
+    }
+    const files = (0, workflows_1.scaffoldFiles)(cfg, { noWorkflows: flags.noWorkflows });
+    const written = [];
+    const skipped = [];
+    for (const f of files) {
+        const abs = path.join(process.cwd(), f.path);
+        if (fs.existsSync(abs) && !flags.force) {
+            skipped.push(f.path);
+            continue;
+        }
+        fs.mkdirSync(path.dirname(abs), { recursive: true });
+        fs.writeFileSync(abs, f.content);
+        written.push(f.path);
+    }
+    console.log("");
+    for (const w of written)
+        console.log(`  ✓ wrote ${w}`);
+    for (const s of skipped)
+        console.log(`  • skipped ${s} (exists — pass --force to overwrite)`);
+    console.log(`\n  Next:\n` +
+        `    1. rastack deploy   — review the config and print the stack launch command\n` +
+        `    2. create the CloudFormation stack (once), then wire the repo Variables it prints\n` +
+        `    3. push to ${cfg.github.branch} — CI runs \`rastack ci deploy\`\n`);
+}
+if (require.main === module) {
+    main(process.argv.slice(2)).catch((err) => {
+        console.error(`  ✗ ${err.message}`);
+        process.exit(1);
+    });
+}

package/dist/rastack.d.ts

@@ -15,5 +15,8 @@
  *   rastack wasm                                Compile the API to WebAssembly (in-browser local dev)
  *   rastack scan   [files...] [--fail-on-pii]   Scan CSVs for PII and schema info
  *   rastack seed   [--env dev] [--source gs://] Load CSVs into Iceberg namespace
+ *   rastack init   [--app slug] [--force]       Template the base GitHub Actions + deploy config
+ *   rastack deploy [--print] [--run]            Configure the serverless deployment
+ *   rastack ci     <check|build|deploy> [--plan] Run the CI pipeline (keeps Actions a one-liner)
  */
 export {};

package/dist/rastack.js

@@ -16,23 +16,44 @@
  *   rastack wasm                                Compile the API to WebAssembly (in-browser local dev)
  *   rastack scan   [files...] [--fail-on-pii]   Scan CSVs for PII and schema info
  *   rastack seed   [--env dev] [--source gs://] Load CSVs into Iceberg namespace
+ *   rastack init   [--app slug] [--force]       Template the base GitHub Actions + deploy config
+ *   rastack deploy [--print] [--run]            Configure the serverless deployment
+ *   rastack ci     <check|build|deploy> [--plan] Run the CI pipeline (keeps Actions a one-liner)
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const child_process_1 = require("child_process");
+const fs_1 = require("fs");
 const path_1 = __importDefault(require("path"));
 const [command, ...rest] = process.argv.slice(2);
+/** Print the installed package version (used by the installer to verify). */
+function printVersion() {
+    try {
+        const pkg = JSON.parse((0, fs_1.readFileSync)(path_1.default.join(__dirname, "..", "package.json"), "utf-8"));
+        console.log(pkg.version);
+    }
+    catch {
+        console.log("unknown");
+    }
+}
 function run(script, args = rest) {
-    // `rastack` is a local developer CLI: `script` is a fixed internal dist filename
-    // and `args` come from the developer's own shell (process.argv), not from an
-    // untrusted network request — there is no command-injection surface here.
-    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-    (0, child_process_1.execSync)(`node ${path_1.default.join(__dirname, script)} ${args.join(" ")}`, {
-        stdio: "inherit",
-        env: process.env,
-    });
+    try {
+        // `rastack` is a local developer CLI: `script` is a fixed internal dist filename
+        // and `args` come from the developer's own shell (process.argv), not from an
+        // untrusted network request — there is no command-injection surface here.
+        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+        (0, child_process_1.execSync)(`node ${path_1.default.join(__dirname, script)} ${args.join(" ")}`, {
+            stdio: "inherit",
+            env: process.env,
+        });
+    }
+    catch (err) {
+        // The subcommand already printed its own error over inherited stdio; just
+        // propagate its exit code without dumping node's child_process stack trace.
+        process.exit(err.status ?? 1);
+    }
 }
 /** Invoke the compiled Rust server binary (built by `cargo build` in rust/). */
 function runRust(subcommand) {
@@ -55,6 +76,11 @@ function runRust(subcommand) {
     process.exit(result.status ?? 0);
 }
 switch (command) {
+    case "--version":
+    case "-v":
+    case "version":
+        printVersion();
+        break;
     case "compile":
     case "check":
     case "list":
@@ -86,6 +112,18 @@ switch (command) {
     case "seed":
         run("seed.js");
         break;
+    case "init":
+        // Template the base GitHub Actions + deploy config into a repo.
+        run("rastack-init.js", rest);
+        break;
+    case "deploy":
+        // Configure the serverless deployment (writes .rastack/deploy.json).
+        run("rastack-deploy.js", rest);
+        break;
+    case "ci":
+        // Run a CI pipeline phase (check | build | deploy).
+        run("rastack-ci.js", rest);
+        break;
     case "generate":
     case "gen":
         // Proxy to existing rastack codegen pipeline
@@ -102,6 +140,9 @@ switch (command) {
             `  rastack serve | admin [--warehouse dir]\n` +
             `  rastack wasm                                Compile the API to WebAssembly (browser local dev)\n` +
             `  rastack scan   [files...] [--fail-on-pii]\n` +
-            `  rastack seed   [--env dev|staging] [--source gs://bucket/ | ./myapp-dev/]\n`);
+            `  rastack seed   [--env dev|staging] [--source gs://bucket/ | ./myapp-dev/]\n` +
+            `  rastack init   [--app slug] [--owner o] [--repo r] [--force]  Template GitHub Actions + deploy config\n` +
+            `  rastack deploy [--app slug] [--print] [--run]                 Configure the serverless deployment\n` +
+            `  rastack ci     <check|build|deploy> [--plan]                  Run the CI pipeline (cleaner Actions)\n`);
         process.exit(1);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rastack",
-  "version": "0.0.33",
+  "version": "0.0.35",
   "description": "",
   "main": "runtime.ts",
   "types": "runtime.ts",

package/src/deploy/ci.ts

@@ -0,0 +1,177 @@
+/**
+ * `rastack ci` — the CI pipeline as a *plan of shell steps*, derived purely from
+ * the deploy config.
+ *
+ * The whole point is to make GitHub Actions cleaner: instead of thirty lines of
+ * inline bash (compile the manifest, cross-build the arm64 Lambda, bake the
+ * Cognito JWKS, assemble the zip, `update-function-code`, wait, print the URL),
+ * a workflow runs one line — `rastack ci deploy` — and this module owns the
+ * steps. Because the plan is a pure function of the config, it is fully testable
+ * without AWS or a Rust toolchain, and `rastack ci --plan` prints exactly what
+ * will run.
+ *
+ * Values that only exist after the stack is created (the function name, the API
+ * URL, the JWKS URL) are either taken from `cfg.outputs` when already resolved,
+ * or emitted as a live `$(aws cloudformation describe-stacks …)` substitution so
+ * the same plan works before and after they are wired into the config.
+ */
+
+import { DeployConfig } from "./config";
+
+export type CiPhase = "check" | "build" | "deploy";
+
+export interface CiStep {
+  /** Human label, echoed before the step runs. */
+  name: string;
+  /** The shell command to execute. */
+  run: string;
+  /** Working directory relative to the repo root (default: repo root). */
+  cwd?: string;
+}
+
+export interface CiPlanOptions {
+  /** How to invoke the rastack CLI for nested steps (default: `rastack`). */
+  bin?: string;
+  /** Skip the build steps in `deploy` (code already built this job). */
+  skipBuild?: boolean;
+  /** Override the function name (else from cfg.outputs, else resolved live). */
+  functionName?: string;
+  /** Override the JWKS URL (else from cfg.outputs, else resolved live). */
+  jwksUrl?: string;
+}
+
+/**
+ * A stack Output value: the literal from `cfg.outputs` if wired, else a shell
+ * command substitution that resolves it live from CloudFormation. Keeping the
+ * fallback inline (rather than a separate step) means the plan is a flat list of
+ * self-contained commands that read correctly in any order.
+ */
+function stackOutput(
+  cfg: DeployConfig,
+  outputKey: string,
+  literal?: string,
+): string {
+  if (literal) return literal;
+  return (
+    `$(aws cloudformation describe-stacks --stack-name ${cfg.stackName} ` +
+    `--region ${cfg.region} ` +
+    `--query "Stacks[0].Outputs[?OutputKey=='${outputKey}'].OutputValue" ` +
+    `--output text)`
+  );
+}
+
+/** The Lambda staging directory `cargo lambda build` writes the binary into. */
+function stageDir(cfg: DeployConfig): string {
+  return `rust/target/lambda/${cfg.lambda.bin}`;
+}
+
+/** `check` — validate the resource graph and compile the manifest. A CI gate. */
+export function checkSteps(cfg: DeployConfig, bin: string): CiStep[] {
+  return [
+    {
+      name: "Validate resource graph",
+      run: `${bin} check ${cfg.resourcesDir}`,
+    },
+    {
+      name: "Compile manifest + OpenAPI",
+      run: `${bin} compile ${cfg.resourcesDir} ${cfg.outDir}`,
+    },
+  ];
+}
+
+/**
+ * `build` — produce the deployable Lambda bundle: compile the manifest,
+ * cross-build the custom-runtime binary, bake the Cognito JWKS in, and zip the
+ * binary together with the files it reads at `/var/task`.
+ */
+export function buildSteps(
+  cfg: DeployConfig,
+  opts: CiPlanOptions = {},
+): CiStep[] {
+  const bin = opts.bin ?? "rastack";
+  const stage = stageDir(cfg);
+  const archFlag = cfg.lambda.arch === "arm64" ? "--arm64" : "--x86-64";
+  const jwks = stackOutput(
+    cfg,
+    "JwksUrl",
+    opts.jwksUrl ?? cfg.outputs?.jwksUrl,
+  );
+  return [
+    {
+      name: "Compile manifest + OpenAPI",
+      run: `${bin} compile ${cfg.resourcesDir} ${cfg.outDir}`,
+    },
+    {
+      name: "Cross-build the Lambda binary",
+      run: `cargo lambda build --release ${archFlag} --bin ${cfg.lambda.bin} --features ${cfg.lambda.features}`,
+      cwd: "rust",
+    },
+    {
+      name: "Bake the Cognito JWKS into the bundle",
+      run: `curl -fsSL "${jwks}" -o ${stage}/jwks.json`,
+    },
+    {
+      name: "Stage the manifest + OpenAPI",
+      run: `cp ${cfg.outDir}/schema.rastack.json ${cfg.outDir}/openapi.json ${stage}/`,
+    },
+    {
+      name: "Assemble the deployment bundle",
+      run: `zip -j ${stage}/bootstrap.zip ${stage}/${cfg.lambda.bin} ${stage}/schema.rastack.json ${stage}/openapi.json ${stage}/jwks.json`,
+    },
+  ];
+}
+
+/**
+ * `deploy` — the whole CI job: build (unless already built), then ship the code
+ * with the single privileged call CI is allowed, `update-function-code`, wait
+ * for it to settle, and print the API URL.
+ */
+export function deploySteps(
+  cfg: DeployConfig,
+  opts: CiPlanOptions = {},
+): CiStep[] {
+  const stage = stageDir(cfg);
+  const zip = `${stage}/bootstrap.zip`;
+  const fn = stackOutput(
+    cfg,
+    "FunctionName",
+    opts.functionName ?? cfg.outputs?.functionName,
+  );
+  const apiUrl = stackOutput(cfg, "ApiUrl", cfg.outputs?.apiUrl);
+  const steps: CiStep[] = opts.skipBuild ? [] : buildSteps(cfg, opts);
+  steps.push(
+    {
+      name: "Ship the code (update-function-code)",
+      run:
+        `aws lambda update-function-code --function-name ${fn} ` +
+        `--zip-file fileb://${zip} --region ${cfg.region} --publish ` +
+        `--output text --query LastModified`,
+    },
+    {
+      name: "Wait for the function to update",
+      run: `aws lambda wait function-updated --function-name ${fn} --region ${cfg.region}`,
+    },
+    {
+      name: "Report the API URL",
+      run: `echo "Deployed ${cfg.app} → ${apiUrl}"`,
+    },
+  );
+  return steps;
+}
+
+/** Build the ordered step list for a phase. */
+export function ciPlan(
+  phase: CiPhase,
+  cfg: DeployConfig,
+  opts: CiPlanOptions = {},
+): CiStep[] {
+  const bin = opts.bin ?? "rastack";
+  switch (phase) {
+    case "check":
+      return checkSteps(cfg, bin);
+    case "build":
+      return buildSteps(cfg, opts);
+    case "deploy":
+      return deploySteps(cfg, opts);
+  }
+}