rastack 0.0.36 → 0.0.38

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.0.38](https://github.com/theserverkid/reactapistack/compare/v0.0.37...v0.0.38) (2026-07-11)
+
+### [0.0.37](https://github.com/theserverkid/reactapistack/compare/v0.0.36...v0.0.37) (2026-07-11)
+
 ### [0.0.36](https://github.com/theserverkid/reactapistack/compare/v0.0.35...v0.0.36) (2026-07-11)
 
 ### [0.0.35](https://github.com/theserverkid/reactapistack/compare/v0.0.34...v0.0.35) (2026-07-11)

package/dist/deploy/config.d.ts

@@ -64,7 +64,7 @@ export interface DeployConfig {
     resourcesDir: string;
     /** Where `rastack compile` writes the manifest + OpenAPI. */
     outDir: string;
-    /** Bootstrap templates bucket that hosts `app.yaml` (for the launch command). */
+    /** Bootstrap templates bucket that hosts `app.yaml` (recorded for reference). */
     templatesBucket?: string;
     /** Bootstrap artifacts bucket holding the Lambda placeholder bundle. */
     artifactsBucket?: string;
@@ -109,14 +109,25 @@ export interface StackParameter {
     key: string;
     value: string;
 }
+/**
+ * Regions where Cognito advanced security (threat protection) is NOT offered, as
+ * of 2026-07. `AWS::Cognito::UserPool` carrying a `UserPoolAddOns` block is
+ * undeployable there — CloudFormation's early-validation ResourceExistenceCheck
+ * rejects the change set — so app.yaml must omit the add-on (AdvancedSecurity=OFF)
+ * in these regions. A denylist (not an allowlist) so new/standard regions keep
+ * the secure default; AWS expands coverage over time, so revisit when they do.
+ */
+export declare const REGIONS_WITHOUT_COGNITO_ASF: ReadonlySet<string>;
+/** Whether Cognito advanced security can be enabled in a region. */
+export declare function cognitoAdvancedSecuritySupported(region: string): boolean;
 /**
  * The `--parameter-overrides` for `aws cloudformation deploy` of app.yaml,
  * derived from the config. Order and keys match the template's `Parameters`.
- * `ArtifactsBucket` (which has no template default) is included only when set.
+ * `ArtifactsBucket` (which has no template default) is included only when set;
+ * `AdvancedSecurity` is forced OFF only in regions that lack the feature (else
+ * the template's ENFORCED default stands).
  */
 export declare function stackParameters(cfg: DeployConfig): StackParameter[];
-/** The S3 URL app.yaml is launched from, when the templates bucket is known. */
-export declare function templateUrl(cfg: DeployConfig): string | null;
 /** The in-repo CloudFormation templates `rastack init` deploys from. */
 export declare const APP_TEMPLATE_FILE = "deploy/cloudformation/app.yaml";
 export declare const BOOTSTRAP_TEMPLATE_FILE = "deploy/cloudformation/bootstrap.yaml";
@@ -124,9 +135,8 @@ export declare const BOOTSTRAP_TEMPLATE_FILE = "deploy/cloudformation/bootstrap.
 export declare function deployStackArgs(cfg: DeployConfig): string[];
 /**
  * The one-time `aws cloudformation deploy` command that creates the app's
- * infrastructure (app.yaml). Launched from the hosted template URL when the
- * templates bucket is known, else from the in-repo `app.yaml`. `rastack init`
- * runs this for you; it is also printed by `--print` so it can be run by hand.
+ * infrastructure (app.yaml), from the in-repo template. `rastack init` runs this
+ * for you; it is also printed by `--print` so it can be run by hand.
  */
 export declare function deployStackCommand(cfg: DeployConfig): string;
 /**

package/dist/deploy/config.js

@@ -18,13 +18,13 @@
  * thin IO wrappers that read/write the file and shell out.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.APP_STACK_OUTPUTS = exports.BOOTSTRAP_TEMPLATES_OUTPUT = exports.BOOTSTRAP_ARTIFACTS_OUTPUT = exports.BOOTSTRAP_TEMPLATE_FILE = exports.APP_TEMPLATE_FILE = exports.DEFAULTS = exports.DEFAULT_LAMBDA = void 0;
+exports.APP_STACK_OUTPUTS = exports.BOOTSTRAP_TEMPLATES_OUTPUT = exports.BOOTSTRAP_ARTIFACTS_OUTPUT = exports.BOOTSTRAP_TEMPLATE_FILE = exports.APP_TEMPLATE_FILE = exports.REGIONS_WITHOUT_COGNITO_ASF = exports.DEFAULTS = exports.DEFAULT_LAMBDA = void 0;
 exports.normalizeConfig = normalizeConfig;
 exports.validateConfig = validateConfig;
 exports.mergeConfig = mergeConfig;
 exports.parseGitHubRemote = parseGitHubRemote;
+exports.cognitoAdvancedSecuritySupported = cognitoAdvancedSecuritySupported;
 exports.stackParameters = stackParameters;
-exports.templateUrl = templateUrl;
 exports.deployStackArgs = deployStackArgs;
 exports.deployStackCommand = deployStackCommand;
 exports.bootstrapStackName = bootstrapStackName;
@@ -150,10 +150,43 @@ function parseGitHubRemote(url) {
         return null;
     return { owner, repo };
 }
+/**
+ * Regions where Cognito advanced security (threat protection) is NOT offered, as
+ * of 2026-07. `AWS::Cognito::UserPool` carrying a `UserPoolAddOns` block is
+ * undeployable there — CloudFormation's early-validation ResourceExistenceCheck
+ * rejects the change set — so app.yaml must omit the add-on (AdvancedSecurity=OFF)
+ * in these regions. A denylist (not an allowlist) so new/standard regions keep
+ * the secure default; AWS expands coverage over time, so revisit when they do.
+ */
+exports.REGIONS_WITHOUT_COGNITO_ASF = new Set([
+    "af-south-1", // Cape Town
+    "ap-east-1", // Hong Kong
+    "ap-east-2", // Taipei
+    "ap-south-2", // Hyderabad
+    "ap-southeast-3", // Jakarta
+    "ap-southeast-4", // Melbourne
+    "ap-southeast-5", // Malaysia
+    "ap-southeast-7", // Thailand
+    "ca-west-1", // Calgary
+    "eu-central-2", // Zurich
+    "eu-south-2", // Spain
+    "me-central-1", // UAE
+    "mx-central-1", // Mexico (Central)
+    "us-gov-east-1",
+    "us-gov-west-1",
+    "cn-north-1", // Beijing
+    "cn-northwest-1", // Ningxia
+]);
+/** Whether Cognito advanced security can be enabled in a region. */
+function cognitoAdvancedSecuritySupported(region) {
+    return !exports.REGIONS_WITHOUT_COGNITO_ASF.has(region);
+}
 /**
  * The `--parameter-overrides` for `aws cloudformation deploy` of app.yaml,
  * derived from the config. Order and keys match the template's `Parameters`.
- * `ArtifactsBucket` (which has no template default) is included only when set.
+ * `ArtifactsBucket` (which has no template default) is included only when set;
+ * `AdvancedSecurity` is forced OFF only in regions that lack the feature (else
+ * the template's ENFORCED default stands).
  */
 function stackParameters(cfg) {
     const params = [
@@ -166,14 +199,10 @@ function stackParameters(cfg) {
     ];
     if (cfg.artifactsBucket)
         params.push({ key: "ArtifactsBucket", value: cfg.artifactsBucket });
+    if (!cognitoAdvancedSecuritySupported(cfg.region))
+        params.push({ key: "AdvancedSecurity", value: "OFF" });
     return params;
 }
-/** The S3 URL app.yaml is launched from, when the templates bucket is known. */
-function templateUrl(cfg) {
-    if (!cfg.templatesBucket)
-        return null;
-    return `https://${cfg.templatesBucket}.s3.${cfg.region}.amazonaws.com/app.yaml`;
-}
 /** The in-repo CloudFormation templates `rastack init` deploys from. */
 exports.APP_TEMPLATE_FILE = "deploy/cloudformation/app.yaml";
 exports.BOOTSTRAP_TEMPLATE_FILE = "deploy/cloudformation/bootstrap.yaml";
@@ -181,15 +210,19 @@ exports.BOOTSTRAP_TEMPLATE_FILE = "deploy/cloudformation/bootstrap.yaml";
  * The argv (after `aws`) for an `aws cloudformation deploy`. `init` feeds this to
  * `execFileSync` (no shell), and the printed command string is just this joined
  * with spaces — so what is shown is exactly what runs.
+ *
+ * Always `--template-file`: the high-level `aws cloudformation deploy` command
+ * accepts *only* a local template file. `--template-url` is exclusive to the
+ * low-level `create-stack`/`update-stack`/`create-change-set` commands, so
+ * pairing it with `deploy` fails with `the following arguments are required:
+ * --template-file`. `init` runs in the repo, where both templates are present.
  */
-function cfnDeployArgs(template, stackName, region, params) {
-    const t = template.url
-        ? ["--template-url", template.url]
-        : ["--template-file", template.file];
+function cfnDeployArgs(templateFile, stackName, region, params) {
     return [
         "cloudformation",
         "deploy",
-        ...t,
+        "--template-file",
+        templateFile,
         "--stack-name",
         stackName,
         "--capabilities",
@@ -212,14 +245,12 @@ function awsCommand(args) {
 }
 /** The argv that creates the app's infrastructure (app.yaml). */
 function deployStackArgs(cfg) {
-    const src = templateUrl(cfg);
-    return cfnDeployArgs(src ? { url: src } : { file: exports.APP_TEMPLATE_FILE }, cfg.stackName, cfg.region, stackParameters(cfg));
+    return cfnDeployArgs(exports.APP_TEMPLATE_FILE, cfg.stackName, cfg.region, stackParameters(cfg));
 }
 /**
  * The one-time `aws cloudformation deploy` command that creates the app's
- * infrastructure (app.yaml). Launched from the hosted template URL when the
- * templates bucket is known, else from the in-repo `app.yaml`. `rastack init`
- * runs this for you; it is also printed by `--print` so it can be run by hand.
+ * infrastructure (app.yaml), from the in-repo template. `rastack init` runs this
+ * for you; it is also printed by `--print` so it can be run by hand.
  */
 function deployStackCommand(cfg) {
     return awsCommand(deployStackArgs(cfg));
@@ -251,7 +282,7 @@ function bootstrapStackParameters(cfg, reuseOidc = false) {
 }
 /** The argv that creates the bootstrap stack (bootstrap.yaml). */
 function bootstrapStackArgs(cfg, reuseOidc = false) {
-    return cfnDeployArgs({ file: exports.BOOTSTRAP_TEMPLATE_FILE }, bootstrapStackName(cfg), cfg.region, bootstrapStackParameters(cfg, reuseOidc));
+    return cfnDeployArgs(exports.BOOTSTRAP_TEMPLATE_FILE, bootstrapStackName(cfg), cfg.region, bootstrapStackParameters(cfg, reuseOidc));
 }
 /** The one-time `aws cloudformation deploy` command that creates the bootstrap stack. */
 function bootstrapStackCommand(cfg, reuseOidc = false) {

package/dist/rastack-update.js

@@ -54,6 +54,8 @@ const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const path = __importStar(require("path"));
 const update_1 = require("./update");
+/** The npm executable for this platform (`npm.cmd` on Windows, else `npm`). */
+const NPM = (0, update_1.npmBinary)();
 /** The installed rastack package directory (…/rastack), one up from dist/. */
 const PKG_DIR = path.join(__dirname, "..");
 const PKG_JSON = path.join(PKG_DIR, "package.json");
@@ -69,7 +71,7 @@ function readVersion(file) {
 /** Capture `npm <args>` stdout, or null when npm is absent / the call fails. */
 function npmCapture(args) {
     try {
-        return (0, child_process_1.execFileSync)("npm", args, {
+        return (0, child_process_1.execFileSync)(NPM, args, {
             stdio: ["ignore", "pipe", "pipe"],
         })
             .toString()
@@ -119,7 +121,7 @@ function main(argv) {
         // Re-runs the developer's own npm to update this global package — no
         // untrusted input, and execFileSync (no shell) avoids any injection.
         // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-        (0, child_process_1.execFileSync)("npm", args, { stdio: "inherit", env });
+        (0, child_process_1.execFileSync)(NPM, args, { stdio: "inherit", env });
     }
     catch (err) {
         console.error(`\n  ✗ npm failed to update rastack. Re-run for detail:\n    npm install -g ${(0, update_1.npmInstallArgs)(flags.version)[2]}\n    ${err.message}`);

package/dist/update.d.ts

@@ -23,6 +23,14 @@ export interface UpdateFlags {
  * 0.0.40`). Unknown values default to `latest`.
  */
 export declare function parseUpdateFlags(argv: string[]): UpdateFlags;
+/**
+ * The npm executable to spawn for a platform. On Windows npm is a `.cmd` shim,
+ * not a real executable, so `execFile("npm", …)` (no shell) fails with
+ * `spawnSync npm ENOENT` — the direct-spawn path only resolves real binaries,
+ * never `PATHEXT` scripts. Spawn `npm.cmd` there; POSIX keeps plain `npm`.
+ * (`aws` is unaffected — it installs as `aws.exe`, a real executable.)
+ */
+export declare function npmBinary(platform?: string): string;
 /** The npm package spec to install for a target version. */
 export declare function installSpec(version: string): string;
 /** The `npm <args>` (after the `npm` binary) that installs the target globally. */

package/dist/update.js

@@ -12,6 +12,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseUpdateFlags = parseUpdateFlags;
+exports.npmBinary = npmBinary;
 exports.installSpec = installSpec;
 exports.npmInstallArgs = npmInstallArgs;
 exports.globalPrefixFromPackageDir = globalPrefixFromPackageDir;
@@ -48,6 +49,16 @@ function parseUpdateFlags(argv) {
     }
     return { version, check, dryRun };
 }
+/**
+ * The npm executable to spawn for a platform. On Windows npm is a `.cmd` shim,
+ * not a real executable, so `execFile("npm", …)` (no shell) fails with
+ * `spawnSync npm ENOENT` — the direct-spawn path only resolves real binaries,
+ * never `PATHEXT` scripts. Spawn `npm.cmd` there; POSIX keeps plain `npm`.
+ * (`aws` is unaffected — it installs as `aws.exe`, a real executable.)
+ */
+function npmBinary(platform = process.platform) {
+    return platform === "win32" ? "npm.cmd" : "npm";
+}
 /** The npm package spec to install for a target version. */
 function installSpec(version) {
     return !version || version === "latest" ? "rastack" : `rastack@${version}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rastack",
-  "version": "0.0.36",
+  "version": "0.0.38",
   "description": "",
   "main": "runtime.ts",
   "types": "runtime.ts",

package/src/deploy/config.ts

@@ -63,7 +63,7 @@ export interface DeployConfig {
   resourcesDir: string;
   /** Where `rastack compile` writes the manifest + OpenAPI. */
   outDir: string;
-  /** Bootstrap templates bucket that hosts `app.yaml` (for the launch command). */
+  /** Bootstrap templates bucket that hosts `app.yaml` (recorded for reference). */
   templatesBucket?: string;
   /** Bootstrap artifacts bucket holding the Lambda placeholder bundle. */
   artifactsBucket?: string;
@@ -227,10 +227,45 @@ export interface StackParameter {
   value: string;
 }
 
+/**
+ * Regions where Cognito advanced security (threat protection) is NOT offered, as
+ * of 2026-07. `AWS::Cognito::UserPool` carrying a `UserPoolAddOns` block is
+ * undeployable there — CloudFormation's early-validation ResourceExistenceCheck
+ * rejects the change set — so app.yaml must omit the add-on (AdvancedSecurity=OFF)
+ * in these regions. A denylist (not an allowlist) so new/standard regions keep
+ * the secure default; AWS expands coverage over time, so revisit when they do.
+ */
+export const REGIONS_WITHOUT_COGNITO_ASF: ReadonlySet<string> = new Set([
+  "af-south-1", // Cape Town
+  "ap-east-1", // Hong Kong
+  "ap-east-2", // Taipei
+  "ap-south-2", // Hyderabad
+  "ap-southeast-3", // Jakarta
+  "ap-southeast-4", // Melbourne
+  "ap-southeast-5", // Malaysia
+  "ap-southeast-7", // Thailand
+  "ca-west-1", // Calgary
+  "eu-central-2", // Zurich
+  "eu-south-2", // Spain
+  "me-central-1", // UAE
+  "mx-central-1", // Mexico (Central)
+  "us-gov-east-1",
+  "us-gov-west-1",
+  "cn-north-1", // Beijing
+  "cn-northwest-1", // Ningxia
+]);
+
+/** Whether Cognito advanced security can be enabled in a region. */
+export function cognitoAdvancedSecuritySupported(region: string): boolean {
+  return !REGIONS_WITHOUT_COGNITO_ASF.has(region);
+}
+
 /**
  * The `--parameter-overrides` for `aws cloudformation deploy` of app.yaml,
  * derived from the config. Order and keys match the template's `Parameters`.
- * `ArtifactsBucket` (which has no template default) is included only when set.
+ * `ArtifactsBucket` (which has no template default) is included only when set;
+ * `AdvancedSecurity` is forced OFF only in regions that lack the feature (else
+ * the template's ENFORCED default stands).
  */
 export function stackParameters(cfg: DeployConfig): StackParameter[] {
   const params: StackParameter[] = [
@@ -243,15 +278,11 @@ export function stackParameters(cfg: DeployConfig): StackParameter[] {
   ];
   if (cfg.artifactsBucket)
     params.push({ key: "ArtifactsBucket", value: cfg.artifactsBucket });
+  if (!cognitoAdvancedSecuritySupported(cfg.region))
+    params.push({ key: "AdvancedSecurity", value: "OFF" });
   return params;
 }
 
-/** The S3 URL app.yaml is launched from, when the templates bucket is known. */
-export function templateUrl(cfg: DeployConfig): string | null {
-  if (!cfg.templatesBucket) return null;
-  return `https://${cfg.templatesBucket}.s3.${cfg.region}.amazonaws.com/app.yaml`;
-}
-
 /** The in-repo CloudFormation templates `rastack init` deploys from. */
 export const APP_TEMPLATE_FILE = "deploy/cloudformation/app.yaml";
 export const BOOTSTRAP_TEMPLATE_FILE = "deploy/cloudformation/bootstrap.yaml";
@@ -260,20 +291,24 @@ export const BOOTSTRAP_TEMPLATE_FILE = "deploy/cloudformation/bootstrap.yaml";
  * The argv (after `aws`) for an `aws cloudformation deploy`. `init` feeds this to
  * `execFileSync` (no shell), and the printed command string is just this joined
  * with spaces — so what is shown is exactly what runs.
+ *
+ * Always `--template-file`: the high-level `aws cloudformation deploy` command
+ * accepts *only* a local template file. `--template-url` is exclusive to the
+ * low-level `create-stack`/`update-stack`/`create-change-set` commands, so
+ * pairing it with `deploy` fails with `the following arguments are required:
+ * --template-file`. `init` runs in the repo, where both templates are present.
  */
 function cfnDeployArgs(
-  template: { file?: string; url?: string },
+  templateFile: string,
   stackName: string,
   region: string,
   params: StackParameter[],
 ): string[] {
-  const t = template.url
-    ? ["--template-url", template.url]
-    : ["--template-file", template.file!];
   return [
     "cloudformation",
     "deploy",
-    ...t,
+    "--template-file",
+    templateFile,
     "--stack-name",
     stackName,
     "--capabilities",
@@ -298,9 +333,8 @@ function awsCommand(args: string[]): string {
 
 /** The argv that creates the app's infrastructure (app.yaml). */
 export function deployStackArgs(cfg: DeployConfig): string[] {
-  const src = templateUrl(cfg);
   return cfnDeployArgs(
-    src ? { url: src } : { file: APP_TEMPLATE_FILE },
+    APP_TEMPLATE_FILE,
     cfg.stackName,
     cfg.region,
     stackParameters(cfg),
@@ -309,9 +343,8 @@ export function deployStackArgs(cfg: DeployConfig): string[] {
 
 /**
  * The one-time `aws cloudformation deploy` command that creates the app's
- * infrastructure (app.yaml). Launched from the hosted template URL when the
- * templates bucket is known, else from the in-repo `app.yaml`. `rastack init`
- * runs this for you; it is also printed by `--print` so it can be run by hand.
+ * infrastructure (app.yaml), from the in-repo template. `rastack init` runs this
+ * for you; it is also printed by `--print` so it can be run by hand.
  */
 export function deployStackCommand(cfg: DeployConfig): string {
   return awsCommand(deployStackArgs(cfg));
@@ -352,7 +385,7 @@ export function bootstrapStackArgs(
   reuseOidc = false,
 ): string[] {
   return cfnDeployArgs(
-    { file: BOOTSTRAP_TEMPLATE_FILE },
+    BOOTSTRAP_TEMPLATE_FILE,
     bootstrapStackName(cfg),
     cfg.region,
     bootstrapStackParameters(cfg, reuseOidc),

package/src/rastack-update.ts

@@ -22,11 +22,15 @@ import { readFileSync } from "fs";
 import * as path from "path";
 import {
   globalPrefixFromPackageDir,
+  npmBinary,
   npmInstallArgs,
   parseUpdateFlags,
   updateAvailable,
 } from "./update";
 
+/** The npm executable for this platform (`npm.cmd` on Windows, else `npm`). */
+const NPM = npmBinary();
+
 /** The installed rastack package directory (…/rastack), one up from dist/. */
 const PKG_DIR = path.join(__dirname, "..");
 const PKG_JSON = path.join(PKG_DIR, "package.json");
@@ -43,7 +47,7 @@ function readVersion(file: string): string {
 /** Capture `npm <args>` stdout, or null when npm is absent / the call fails. */
 function npmCapture(args: string[]): string | null {
   try {
-    return execFileSync("npm", args, {
+    return execFileSync(NPM, args, {
       stdio: ["ignore", "pipe", "pipe"],
     })
       .toString()
@@ -102,7 +106,7 @@ function main(argv: string[]): void {
     // Re-runs the developer's own npm to update this global package — no
     // untrusted input, and execFileSync (no shell) avoids any injection.
     // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-    execFileSync("npm", args, { stdio: "inherit", env });
+    execFileSync(NPM, args, { stdio: "inherit", env });
   } catch (err) {
     console.error(
       `\n  ✗ npm failed to update rastack. Re-run for detail:\n    npm install -g ${npmInstallArgs(flags.version)[2]}\n    ${(err as Error).message}`,

package/src/update.ts

@@ -50,6 +50,17 @@ export function parseUpdateFlags(argv: string[]): UpdateFlags {
   return { version, check, dryRun };
 }
 
+/**
+ * The npm executable to spawn for a platform. On Windows npm is a `.cmd` shim,
+ * not a real executable, so `execFile("npm", …)` (no shell) fails with
+ * `spawnSync npm ENOENT` — the direct-spawn path only resolves real binaries,
+ * never `PATHEXT` scripts. Spawn `npm.cmd` there; POSIX keeps plain `npm`.
+ * (`aws` is unaffected — it installs as `aws.exe`, a real executable.)
+ */
+export function npmBinary(platform: string = process.platform): string {
+  return platform === "win32" ? "npm.cmd" : "npm";
+}
+
 /** The npm package spec to install for a target version. */
 export function installSpec(version: string): string {
   return !version || version === "latest" ? "rastack" : `rastack@${version}`;

package/test/deploy.spec.ts

@@ -11,6 +11,7 @@ import {
   bootstrapStackCommand,
   bootstrapStackName,
   bootstrapStackParameters,
+  cognitoAdvancedSecuritySupported,
   APP_STACK_OUTPUTS,
   lambdaEnv,
   mergeConfig,
@@ -19,7 +20,6 @@ import {
   repoVariables,
   scaffoldFiles,
   stackParameters,
-  templateUrl,
   validateConfig,
   zipStore,
   renderCiWorkflow,
@@ -169,7 +169,10 @@ describe("parseGitHubRemote", () => {
 
 describe("stack parameters + launch command", () => {
   it("emits the app.yaml parameters in template order", () => {
-    const params = stackParameters(base({ artifactsBucket: "art-bucket" }));
+    // A region WITH Cognito advanced security, so AdvancedSecurity is left off.
+    const params = stackParameters(
+      base({ region: "us-east-1", artifactsBucket: "art-bucket" }),
+    );
     expect(params.map((p) => p.key)).toEqual([
       "AppName",
       "NamePrefix",
@@ -182,30 +185,41 @@ describe("stack parameters + launch command", () => {
   });
 
   it("omits ArtifactsBucket when unset (it has no template default)", () => {
-    expect(stackParameters(base()).map((p) => p.key)).not.toContain(
-      "ArtifactsBucket",
-    );
+    expect(
+      stackParameters(base({ region: "us-east-1" })).map((p) => p.key),
+    ).not.toContain("ArtifactsBucket");
   });
 
-  it("builds the template URL only when the templates bucket is known", () => {
-    expect(templateUrl(base())).toBeNull();
-    expect(templateUrl(base({ templatesBucket: "tpl" }))).toBe(
-      "https://tpl.s3.af-south-1.amazonaws.com/app.yaml",
+  it("forces AdvancedSecurity=OFF only in regions lacking Cognito ASF", () => {
+    // af-south-1 (the repo default) has no threat protection — a User Pool with
+    // a UserPoolAddOns block is undeployable, so the override must be emitted.
+    expect(cognitoAdvancedSecuritySupported("af-south-1")).toBe(false);
+    expect(cognitoAdvancedSecuritySupported("us-east-1")).toBe(true);
+
+    const capeTown = stackParameters(base({ region: "af-south-1" }));
+    expect(capeTown.find((p) => p.key === "AdvancedSecurity")?.value).toBe(
+      "OFF",
     );
+
+    const virginia = stackParameters(base({ region: "us-east-1" }));
+    expect(virginia.map((p) => p.key)).not.toContain("AdvancedSecurity");
   });
 
-  it("launches by URL when hosted, else from the in-repo template", () => {
+  it("always launches from the in-repo --template-file (deploy takes no URL)", () => {
+    // `aws cloudformation deploy` accepts ONLY `--template-file`; `--template-url`
+    // is exclusive to create-stack/update-stack and makes deploy reject the
+    // command. Even with a known templates bucket, the local file is used.
     const hosted = deployStackCommand(
       base({ templatesBucket: "tpl", artifactsBucket: "art" }),
     );
-    expect(hosted).toContain(
-      "--template-url https://tpl.s3.af-south-1.amazonaws.com/app.yaml",
-    );
+    expect(hosted).toContain("--template-file deploy/cloudformation/app.yaml");
+    expect(hosted).not.toContain("--template-url");
     expect(hosted).toContain("--stack-name rastack-airline");
     expect(hosted).toContain("ArtifactsBucket=art");
 
     const local = deployStackCommand(base());
     expect(local).toContain("--template-file deploy/cloudformation/app.yaml");
+    expect(local).not.toContain("--template-url");
   });
 
   it("emits ONE line (PowerShell-safe — no backslash continuations)", () => {

package/test/update.spec.ts

@@ -2,6 +2,7 @@ import {
   compareSemver,
   globalPrefixFromPackageDir,
   installSpec,
+  npmBinary,
   npmInstallArgs,
   parseUpdateFlags,
   updateAvailable,
@@ -47,6 +48,14 @@ describe("update — npm spec + args", () => {
     ]);
     expect(npmInstallArgs("0.0.40")[2]).toBe("rastack@0.0.40");
   });
+
+  it("spawns npm.cmd on Windows and plain npm elsewhere", () => {
+    // npm is a `.cmd` shim on Windows; execFile (no shell) can't launch a bare
+    // `npm` there, so the wrapper must target `npm.cmd`. POSIX keeps `npm`.
+    expect(npmBinary("win32")).toBe("npm.cmd");
+    expect(npmBinary("linux")).toBe("npm");
+    expect(npmBinary("darwin")).toBe("npm");
+  });
 });
 
 describe("update — global prefix derivation", () => {