rastack 0.0.37 → 0.0.39

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.0.39](https://github.com/theserverkid/reactapistack/compare/v0.0.38...v0.0.39) (2026-07-11)
+
+### [0.0.38](https://github.com/theserverkid/reactapistack/compare/v0.0.37...v0.0.38) (2026-07-11)
+
 ### [0.0.37](https://github.com/theserverkid/reactapistack/compare/v0.0.36...v0.0.37) (2026-07-11)
 
 ### [0.0.36](https://github.com/theserverkid/reactapistack/compare/v0.0.35...v0.0.36) (2026-07-11)

package/dist/deploy/config.d.ts

@@ -91,6 +91,14 @@ export declare function normalizeConfig(partial?: PartialDeployConfig): DeployCo
  * config that passes here also passes CloudFormation's own validation.
  */
 export declare function validateConfig(cfg: DeployConfig): string[];
+/**
+ * Return the subset of problems that block standing the **tier-0 bootstrap
+ * stack** up. The bootstrap stack (bootstrap.yaml) is account+region scoped — it
+ * only needs the name prefix, the region, and the GitHub coordinates that anchor
+ * the OIDC trust — so `rastack bootstrap` validates just those, not the per-app
+ * fields (`app`, namespace, Lambda build) that `validateConfig` also requires.
+ */
+export declare function validateBootstrapConfig(cfg: DeployConfig): string[];
 /** Deep-merge a patch over a base config (used by `deploy`/`init` reconfigure). */
 export declare function mergeConfig(base: DeployConfig, patch: PartialDeployConfig): DeployConfig;
 /**
@@ -109,10 +117,23 @@ export interface StackParameter {
     key: string;
     value: string;
 }
+/**
+ * Regions where Cognito advanced security (threat protection) is NOT offered, as
+ * of 2026-07. `AWS::Cognito::UserPool` carrying a `UserPoolAddOns` block is
+ * undeployable there — CloudFormation's early-validation ResourceExistenceCheck
+ * rejects the change set — so app.yaml must omit the add-on (AdvancedSecurity=OFF)
+ * in these regions. A denylist (not an allowlist) so new/standard regions keep
+ * the secure default; AWS expands coverage over time, so revisit when they do.
+ */
+export declare const REGIONS_WITHOUT_COGNITO_ASF: ReadonlySet<string>;
+/** Whether Cognito advanced security can be enabled in a region. */
+export declare function cognitoAdvancedSecuritySupported(region: string): boolean;
 /**
  * The `--parameter-overrides` for `aws cloudformation deploy` of app.yaml,
  * derived from the config. Order and keys match the template's `Parameters`.
- * `ArtifactsBucket` (which has no template default) is included only when set.
+ * `ArtifactsBucket` (which has no template default) is included only when set;
+ * `AdvancedSecurity` is forced OFF only in regions that lack the feature (else
+ * the template's ENFORCED default stands).
  */
 export declare function stackParameters(cfg: DeployConfig): StackParameter[];
 /** The in-repo CloudFormation templates `rastack init` deploys from. */

package/dist/deploy/config.js

@@ -18,11 +18,13 @@
  * thin IO wrappers that read/write the file and shell out.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.APP_STACK_OUTPUTS = exports.BOOTSTRAP_TEMPLATES_OUTPUT = exports.BOOTSTRAP_ARTIFACTS_OUTPUT = exports.BOOTSTRAP_TEMPLATE_FILE = exports.APP_TEMPLATE_FILE = exports.DEFAULTS = exports.DEFAULT_LAMBDA = void 0;
+exports.APP_STACK_OUTPUTS = exports.BOOTSTRAP_TEMPLATES_OUTPUT = exports.BOOTSTRAP_ARTIFACTS_OUTPUT = exports.BOOTSTRAP_TEMPLATE_FILE = exports.APP_TEMPLATE_FILE = exports.REGIONS_WITHOUT_COGNITO_ASF = exports.DEFAULTS = exports.DEFAULT_LAMBDA = void 0;
 exports.normalizeConfig = normalizeConfig;
 exports.validateConfig = validateConfig;
+exports.validateBootstrapConfig = validateBootstrapConfig;
 exports.mergeConfig = mergeConfig;
 exports.parseGitHubRemote = parseGitHubRemote;
+exports.cognitoAdvancedSecuritySupported = cognitoAdvancedSecuritySupported;
 exports.stackParameters = stackParameters;
 exports.deployStackArgs = deployStackArgs;
 exports.deployStackCommand = deployStackCommand;
@@ -120,6 +122,33 @@ function validateConfig(cfg) {
         errors.push("lambda.bin is required.");
     return errors;
 }
+/**
+ * Return the subset of problems that block standing the **tier-0 bootstrap
+ * stack** up. The bootstrap stack (bootstrap.yaml) is account+region scoped — it
+ * only needs the name prefix, the region, and the GitHub coordinates that anchor
+ * the OIDC trust — so `rastack bootstrap` validates just those, not the per-app
+ * fields (`app`, namespace, Lambda build) that `validateConfig` also requires.
+ */
+function validateBootstrapConfig(cfg) {
+    const errors = [];
+    if (!SLUG.test(cfg.namePrefix))
+        errors.push(`namePrefix "${cfg.namePrefix}" must match ${SLUG}.`);
+    if (!cfg.region)
+        errors.push("region is required (e.g. `af-south-1`).");
+    else if (!REGION.test(cfg.region))
+        errors.push(`region "${cfg.region}" does not look like an AWS region (e.g. af-south-1).`);
+    if (!cfg.github.owner)
+        errors.push("github.owner is required.");
+    else if (!GH_NAME.test(cfg.github.owner))
+        errors.push(`github.owner "${cfg.github.owner}" is not a valid GitHub name.`);
+    if (!cfg.github.repo)
+        errors.push("github.repo is required.");
+    else if (!GH_NAME.test(cfg.github.repo))
+        errors.push(`github.repo "${cfg.github.repo}" is not a valid GitHub name.`);
+    if (!cfg.github.branch)
+        errors.push("github.branch is required.");
+    return errors;
+}
 /** Deep-merge a patch over a base config (used by `deploy`/`init` reconfigure). */
 function mergeConfig(base, patch) {
     return normalizeConfig({
@@ -149,10 +178,43 @@ function parseGitHubRemote(url) {
         return null;
     return { owner, repo };
 }
+/**
+ * Regions where Cognito advanced security (threat protection) is NOT offered, as
+ * of 2026-07. `AWS::Cognito::UserPool` carrying a `UserPoolAddOns` block is
+ * undeployable there — CloudFormation's early-validation ResourceExistenceCheck
+ * rejects the change set — so app.yaml must omit the add-on (AdvancedSecurity=OFF)
+ * in these regions. A denylist (not an allowlist) so new/standard regions keep
+ * the secure default; AWS expands coverage over time, so revisit when they do.
+ */
+exports.REGIONS_WITHOUT_COGNITO_ASF = new Set([
+    "af-south-1", // Cape Town
+    "ap-east-1", // Hong Kong
+    "ap-east-2", // Taipei
+    "ap-south-2", // Hyderabad
+    "ap-southeast-3", // Jakarta
+    "ap-southeast-4", // Melbourne
+    "ap-southeast-5", // Malaysia
+    "ap-southeast-7", // Thailand
+    "ca-west-1", // Calgary
+    "eu-central-2", // Zurich
+    "eu-south-2", // Spain
+    "me-central-1", // UAE
+    "mx-central-1", // Mexico (Central)
+    "us-gov-east-1",
+    "us-gov-west-1",
+    "cn-north-1", // Beijing
+    "cn-northwest-1", // Ningxia
+]);
+/** Whether Cognito advanced security can be enabled in a region. */
+function cognitoAdvancedSecuritySupported(region) {
+    return !exports.REGIONS_WITHOUT_COGNITO_ASF.has(region);
+}
 /**
  * The `--parameter-overrides` for `aws cloudformation deploy` of app.yaml,
  * derived from the config. Order and keys match the template's `Parameters`.
- * `ArtifactsBucket` (which has no template default) is included only when set.
+ * `ArtifactsBucket` (which has no template default) is included only when set;
+ * `AdvancedSecurity` is forced OFF only in regions that lack the feature (else
+ * the template's ENFORCED default stands).
  */
 function stackParameters(cfg) {
     const params = [
@@ -165,6 +227,8 @@ function stackParameters(cfg) {
     ];
     if (cfg.artifactsBucket)
         params.push({ key: "ArtifactsBucket", value: cfg.artifactsBucket });
+    if (!cognitoAdvancedSecuritySupported(cfg.region))
+        params.push({ key: "AdvancedSecurity", value: "OFF" });
     return params;
 }
 /** The in-repo CloudFormation templates `rastack init` deploys from. */

package/dist/rastack-bootstrap.d.ts

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+/**
+ * `rastack bootstrap` — stand the **tier-0 bootstrap stack** up for an AWS
+ * account. This is the once-per-account+region step that prepares an account to
+ * host React API Stack backends, decoupled from any single app.
+ *
+ *   rastack bootstrap [--owner <o>] [--repo <r>] [--branch <b>]
+ *                     [--region <r>] [--prefix <p>]
+ *                     [--reuse-oidc] [--print] [--yes]
+ *
+ * It deploys `deploy/cloudformation/bootstrap.yaml`, which creates:
+ *   • the S3 buckets that hold the Lambda placeholder + hosted templates, and
+ *   • the GitHub OIDC provider + trust that lets CI assume a deploy role.
+ * It then uploads the Lambda placeholder bundle to the artifacts bucket, so the
+ * account is immediately ready for per-app deploys (`rastack init`).
+ *
+ * `rastack init` still creates this stack on demand if it is missing, so
+ * `bootstrap` is the explicit, app-independent way to do the same thing up front
+ * (e.g. an account admin preparing an account before app teams run `init`).
+ * `--reuse-oidc` skips creating the GitHub OIDC provider (AWS allows only one per
+ * URL per account); `--print` shows the exact single-line `aws cloudformation
+ * deploy` command without touching the cloud.
+ */
+export {};

package/dist/rastack-bootstrap.js

@@ -0,0 +1,222 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * `rastack bootstrap` — stand the **tier-0 bootstrap stack** up for an AWS
+ * account. This is the once-per-account+region step that prepares an account to
+ * host React API Stack backends, decoupled from any single app.
+ *
+ *   rastack bootstrap [--owner <o>] [--repo <r>] [--branch <b>]
+ *                     [--region <r>] [--prefix <p>]
+ *                     [--reuse-oidc] [--print] [--yes]
+ *
+ * It deploys `deploy/cloudformation/bootstrap.yaml`, which creates:
+ *   • the S3 buckets that hold the Lambda placeholder + hosted templates, and
+ *   • the GitHub OIDC provider + trust that lets CI assume a deploy role.
+ * It then uploads the Lambda placeholder bundle to the artifacts bucket, so the
+ * account is immediately ready for per-app deploys (`rastack init`).
+ *
+ * `rastack init` still creates this stack on demand if it is missing, so
+ * `bootstrap` is the explicit, app-independent way to do the same thing up front
+ * (e.g. an account admin preparing an account before app teams run `init`).
+ * `--reuse-oidc` skips creating the GitHub OIDC provider (AWS allows only one per
+ * URL per account); `--print` shows the exact single-line `aws cloudformation
+ * deploy` command without touching the cloud.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const config_1 = require("./deploy/config");
+const io_1 = require("./deploy/io");
+function parseFlags(argv) {
+    const patch = { github: {} };
+    let reuseOidc = false;
+    let print = false;
+    let nonInteractive = false;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = () => argv[++i] ?? "";
+        switch (a) {
+            case "--owner":
+                patch.github.owner = next();
+                break;
+            case "--repo":
+                patch.github.repo = next();
+                break;
+            case "--branch":
+                patch.github.branch = next();
+                break;
+            case "--region":
+                patch.region = next();
+                break;
+            case "--prefix":
+                patch.namePrefix = next();
+                break;
+            case "--reuse-oidc":
+                reuseOidc = true;
+                break;
+            case "--print":
+            case "--dry-run":
+                print = true;
+                break;
+            case "--yes":
+            case "-y":
+            case "--non-interactive":
+                nonInteractive = true;
+                break;
+            default:
+                if (a.startsWith("-")) {
+                    console.error(`Unknown flag: ${a}`);
+                    process.exit(1);
+                }
+        }
+    }
+    return { patch, reuseOidc, print, nonInteractive };
+}
+/** Seed a config: existing file → flags → git remote → defaults. */
+function seedConfig(flags) {
+    const existing = (0, io_1.loadConfig)();
+    let cfg = existing
+        ? (0, config_1.mergeConfig)(existing, flags.patch)
+        : (0, config_1.normalizeConfig)(flags.patch);
+    // Default the GitHub coordinates from `origin` when not already known — they
+    // anchor the OIDC trust the bootstrap stack sets up.
+    if (!cfg.github.owner || !cfg.github.repo) {
+        const url = (0, io_1.gitRemoteUrl)();
+        const remote = url ? (0, config_1.parseGitHubRemote)(url) : null;
+        if (remote) {
+            cfg = (0, config_1.mergeConfig)(cfg, {
+                github: {
+                    owner: cfg.github.owner || remote.owner,
+                    repo: cfg.github.repo || remote.repo,
+                },
+            });
+        }
+    }
+    return cfg;
+}
+async function promptMissing(cfg) {
+    return (0, io_1.withPrompt)(async (rl) => {
+        const owner = await (0, io_1.ask)(rl, "GitHub owner", cfg.github.owner);
+        const repo = await (0, io_1.ask)(rl, "GitHub repo", cfg.github.repo);
+        const branch = await (0, io_1.ask)(rl, "Deploy branch", cfg.github.branch);
+        const region = await (0, io_1.ask)(rl, "AWS region", cfg.region);
+        const prefix = await (0, io_1.ask)(rl, "Name prefix", cfg.namePrefix);
+        return (0, config_1.mergeConfig)(cfg, {
+            region,
+            namePrefix: prefix,
+            github: { owner, repo, branch },
+        });
+    });
+}
+/** Yes/no confirmation with a default of "no" — gates the cloud-mutating step. */
+async function confirm(question) {
+    return (0, io_1.withPrompt)(async (rl) => {
+        const answer = await (0, io_1.ask)(rl, question, "no");
+        return /^y(es)?$/i.test(answer.trim());
+    });
+}
+/** Print the exact command `bootstrap` would run, without touching the cloud. */
+function printPlan(cfg, reuseOidc) {
+    console.log(`\n  Bootstrap plan (${(0, config_1.bootstrapStackName)(cfg)} @ ${cfg.region})\n`);
+    console.log("  ── Tier-0 bootstrap stack (bootstrap.yaml) ──");
+    console.log("\n  " + (0, config_1.bootstrapStackCommand)(cfg, reuseOidc) + "\n");
+    console.log("  Then `rastack init` (or `rastack bootstrap` again) resolves this stack's\n" +
+        "  ArtifactsBucket to create app backends. Nothing here is app-specific.\n");
+}
+/**
+ * Deploy the bootstrap stack, retrying once against an account that already has
+ * a GitHub OIDC provider (AWS allows only one per URL) when the caller did not
+ * already ask to reuse it.
+ */
+function deployBootstrap(cfg, reuseOidc) {
+    try {
+        (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, reuseOidc));
+    }
+    catch (err) {
+        if (reuseOidc) {
+            console.error(`\n  ✗ bootstrap stack deploy failed.\n    ${err.message}`);
+            process.exit(1);
+        }
+        // The most common cause is an account that already has a GitHub OIDC
+        // provider. Retry telling the template to reuse it instead of creating a
+        // second (which CloudFormation rejects).
+        console.log("  • retrying bootstrap, reusing the account's existing GitHub OIDC provider");
+        try {
+            (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, true));
+        }
+        catch (retryErr) {
+            console.error(`\n  ✗ bootstrap stack deploy failed.\n    ${retryErr.message}`);
+            process.exit(1);
+        }
+    }
+}
+/** Stand the tier-0 bootstrap stack up and upload the Lambda placeholder. */
+function standUp(cfg, reuseOidc) {
+    if (!(0, io_1.awsAvailable)()) {
+        console.error("  ✗ the AWS CLI is not on PATH. Install it and configure credentials,\n" +
+            "    or re-run with --print to see the command.");
+        process.exit(1);
+    }
+    const stack = (0, config_1.bootstrapStackName)(cfg);
+    const existing = (0, io_1.stackOutput)(stack, config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
+    if (existing) {
+        console.log(`\n▸ Bootstrap stack ${stack} already exists — reconciling (idempotent).`);
+    }
+    else {
+        console.log(`\n▸ Creating bootstrap stack ${stack} (@ ${cfg.region})`);
+    }
+    deployBootstrap(cfg, reuseOidc);
+    const artifactsBucket = (0, io_1.stackOutput)(stack, config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
+    const templatesBucket = (0, io_1.stackOutput)(stack, config_1.BOOTSTRAP_TEMPLATES_OUTPUT, cfg.region);
+    if (!artifactsBucket) {
+        console.error("  ✗ bootstrap stack deployed but its ArtifactsBucket output could not be read.");
+        process.exit(1);
+    }
+    console.log(`  ✓ artifacts bucket:  ${artifactsBucket}`);
+    if (templatesBucket)
+        console.log(`  ✓ templates bucket:  ${templatesBucket}`);
+    // Upload the placeholder the app.yaml function is later created from, so the
+    // account is ready for `rastack init` without a second manual step.
+    console.log("\n▸ Uploading the Lambda placeholder bundle");
+    if (!(0, io_1.uploadPlaceholder)(artifactsBucket, cfg.region)) {
+        console.error("  ✗ deploy/cloudformation/placeholder/bootstrap not found — the placeholder\n" +
+            "    was not uploaded. `rastack init` will upload it on the first app deploy.");
+    }
+    else {
+        console.log("  ✓ placeholder uploaded");
+    }
+    console.log(`\n  ✓ account bootstrapped (${stack} @ ${cfg.region}).\n` +
+        `    Run \`rastack init\` in an app repo to deploy a backend against it.\n`);
+}
+async function main(argv) {
+    const flags = parseFlags(argv);
+    let cfg = seedConfig(flags);
+    if ((0, io_1.canPrompt)(flags.nonInteractive) && !flags.print) {
+        console.log("\n  rastack bootstrap — stand the tier-0 AWS account stack up\n");
+        cfg = await promptMissing(cfg);
+    }
+    const errors = (0, config_1.validateBootstrapConfig)(cfg);
+    if (errors.length) {
+        for (const e of errors)
+            console.error(`  ✗ ${e}`);
+        console.error(`\n  ${errors.length} problem(s). Pass the missing values as flags` +
+            ` (--owner, --repo, --branch, --region, --prefix).`);
+        process.exit(1);
+    }
+    if (flags.print) {
+        printPlan(cfg, flags.reuseOidc);
+        return;
+    }
+    if ((0, io_1.canPrompt)(flags.nonInteractive)) {
+        const ok = await confirm(`Create/update bootstrap stack ${(0, config_1.bootstrapStackName)(cfg)} in AWS ${cfg.region} now? [y/N]`);
+        if (!ok) {
+            console.log("\n  Skipped. Re-run to deploy, or `rastack bootstrap --print` for the command.\n");
+            return;
+        }
+    }
+    standUp(cfg, flags.reuseOidc);
+}
+if (require.main === module) {
+    main(process.argv.slice(2)).catch((err) => {
+        console.error(`  ✗ ${err.message}`);
+        process.exit(1);
+    });
+}

package/dist/rastack-update.js

@@ -54,6 +54,8 @@ const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const path = __importStar(require("path"));
 const update_1 = require("./update");
+/** The npm executable for this platform (`npm.cmd` on Windows, else `npm`). */
+const NPM = (0, update_1.npmBinary)();
 /** The installed rastack package directory (…/rastack), one up from dist/. */
 const PKG_DIR = path.join(__dirname, "..");
 const PKG_JSON = path.join(PKG_DIR, "package.json");
@@ -69,7 +71,7 @@ function readVersion(file) {
 /** Capture `npm <args>` stdout, or null when npm is absent / the call fails. */
 function npmCapture(args) {
     try {
-        return (0, child_process_1.execFileSync)("npm", args, {
+        return (0, child_process_1.execFileSync)(NPM, args, {
             stdio: ["ignore", "pipe", "pipe"],
         })
             .toString()
@@ -119,7 +121,7 @@ function main(argv) {
         // Re-runs the developer's own npm to update this global package — no
         // untrusted input, and execFileSync (no shell) avoids any injection.
         // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-        (0, child_process_1.execFileSync)("npm", args, { stdio: "inherit", env });
+        (0, child_process_1.execFileSync)(NPM, args, { stdio: "inherit", env });
     }
     catch (err) {
         console.error(`\n  ✗ npm failed to update rastack. Re-run for detail:\n    npm install -g ${(0, update_1.npmInstallArgs)(flags.version)[2]}\n    ${err.message}`);

package/dist/rastack.d.ts

@@ -15,6 +15,7 @@
  *   rastack wasm                                Compile the API to WebAssembly (in-browser local dev)
  *   rastack scan   [files...] [--fail-on-pii]   Scan CSVs for PII and schema info
  *   rastack seed   [--env dev] [--source gs://] Load CSVs into Iceberg namespace
+ *   rastack bootstrap [--owner o] [--repo r]    Stand the tier-0 AWS account stack up (once per account+region)
  *   rastack init   [--app slug] [--force]       Scaffold config + GitHub Actions AND stand the backend up
  *   rastack deploy [--plan]                     Ship code to the Lambda (alias for `rastack ci deploy`)
  *   rastack ci     <check|build|deploy> [--plan] Run the CI pipeline (keeps Actions a one-liner)

package/dist/rastack.js

@@ -16,6 +16,7 @@
  *   rastack wasm                                Compile the API to WebAssembly (in-browser local dev)
  *   rastack scan   [files...] [--fail-on-pii]   Scan CSVs for PII and schema info
  *   rastack seed   [--env dev] [--source gs://] Load CSVs into Iceberg namespace
+ *   rastack bootstrap [--owner o] [--repo r]    Stand the tier-0 AWS account stack up (once per account+region)
  *   rastack init   [--app slug] [--force]       Scaffold config + GitHub Actions AND stand the backend up
  *   rastack deploy [--plan]                     Ship code to the Lambda (alias for `rastack ci deploy`)
  *   rastack ci     <check|build|deploy> [--plan] Run the CI pipeline (keeps Actions a one-liner)
@@ -113,6 +114,11 @@ switch (command) {
     case "seed":
         run("seed.js");
         break;
+    case "bootstrap":
+        // Stand the tier-0 bootstrap stack up (buckets + GitHub OIDC) for an AWS
+        // account — the once-per-account+region step, decoupled from any app.
+        run("rastack-bootstrap.js", rest);
+        break;
     case "init":
         // Scaffold config + GitHub Actions and stand the serverless backend up.
         run("rastack-init.js", rest);
@@ -148,6 +154,7 @@ switch (command) {
             `  rastack wasm                                Compile the API to WebAssembly (browser local dev)\n` +
             `  rastack scan   [files...] [--fail-on-pii]\n` +
             `  rastack seed   [--env dev|staging] [--source gs://bucket/ | ./myapp-dev/]\n` +
+            `  rastack bootstrap [--owner o] [--repo r] [--region r] [--prefix p] [--reuse-oidc] [--print]  Stand the AWS account stack up\n` +
             `  rastack init   [--app slug] [--owner o] [--repo r] [--print] [--no-deploy]  Scaffold + stand the backend up\n` +
             `  rastack deploy [--plan]                                       Ship code to the Lambda (alias for ci deploy)\n` +
             `  rastack ci     <check|build|deploy> [--plan]                  Run the CI pipeline (cleaner Actions)\n` +

package/dist/update.d.ts

@@ -23,6 +23,14 @@ export interface UpdateFlags {
  * 0.0.40`). Unknown values default to `latest`.
  */
 export declare function parseUpdateFlags(argv: string[]): UpdateFlags;
+/**
+ * The npm executable to spawn for a platform. On Windows npm is a `.cmd` shim,
+ * not a real executable, so `execFile("npm", …)` (no shell) fails with
+ * `spawnSync npm ENOENT` — the direct-spawn path only resolves real binaries,
+ * never `PATHEXT` scripts. Spawn `npm.cmd` there; POSIX keeps plain `npm`.
+ * (`aws` is unaffected — it installs as `aws.exe`, a real executable.)
+ */
+export declare function npmBinary(platform?: string): string;
 /** The npm package spec to install for a target version. */
 export declare function installSpec(version: string): string;
 /** The `npm <args>` (after the `npm` binary) that installs the target globally. */

package/dist/update.js

@@ -12,6 +12,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseUpdateFlags = parseUpdateFlags;
+exports.npmBinary = npmBinary;
 exports.installSpec = installSpec;
 exports.npmInstallArgs = npmInstallArgs;
 exports.globalPrefixFromPackageDir = globalPrefixFromPackageDir;
@@ -48,6 +49,16 @@ function parseUpdateFlags(argv) {
     }
     return { version, check, dryRun };
 }
+/**
+ * The npm executable to spawn for a platform. On Windows npm is a `.cmd` shim,
+ * not a real executable, so `execFile("npm", …)` (no shell) fails with
+ * `spawnSync npm ENOENT` — the direct-spawn path only resolves real binaries,
+ * never `PATHEXT` scripts. Spawn `npm.cmd` there; POSIX keeps plain `npm`.
+ * (`aws` is unaffected — it installs as `aws.exe`, a real executable.)
+ */
+function npmBinary(platform = process.platform) {
+    return platform === "win32" ? "npm.cmd" : "npm";
+}
 /** The npm package spec to install for a target version. */
 function installSpec(version) {
     return !version || version === "latest" ? "rastack" : `rastack@${version}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rastack",
-  "version": "0.0.37",
+  "version": "0.0.39",
   "description": "",
   "main": "runtime.ts",
   "types": "runtime.ts",

package/src/deploy/config.ts

@@ -184,6 +184,37 @@ export function validateConfig(cfg: DeployConfig): string[] {
   return errors;
 }
 
+/**
+ * Return the subset of problems that block standing the **tier-0 bootstrap
+ * stack** up. The bootstrap stack (bootstrap.yaml) is account+region scoped — it
+ * only needs the name prefix, the region, and the GitHub coordinates that anchor
+ * the OIDC trust — so `rastack bootstrap` validates just those, not the per-app
+ * fields (`app`, namespace, Lambda build) that `validateConfig` also requires.
+ */
+export function validateBootstrapConfig(cfg: DeployConfig): string[] {
+  const errors: string[] = [];
+  if (!SLUG.test(cfg.namePrefix))
+    errors.push(`namePrefix "${cfg.namePrefix}" must match ${SLUG}.`);
+
+  if (!cfg.region) errors.push("region is required (e.g. `af-south-1`).");
+  else if (!REGION.test(cfg.region))
+    errors.push(
+      `region "${cfg.region}" does not look like an AWS region (e.g. af-south-1).`,
+    );
+
+  if (!cfg.github.owner) errors.push("github.owner is required.");
+  else if (!GH_NAME.test(cfg.github.owner))
+    errors.push(
+      `github.owner "${cfg.github.owner}" is not a valid GitHub name.`,
+    );
+  if (!cfg.github.repo) errors.push("github.repo is required.");
+  else if (!GH_NAME.test(cfg.github.repo))
+    errors.push(`github.repo "${cfg.github.repo}" is not a valid GitHub name.`);
+  if (!cfg.github.branch) errors.push("github.branch is required.");
+
+  return errors;
+}
+
 /** Deep-merge a patch over a base config (used by `deploy`/`init` reconfigure). */
 export function mergeConfig(
   base: DeployConfig,
@@ -227,10 +258,45 @@ export interface StackParameter {
   value: string;
 }
 
+/**
+ * Regions where Cognito advanced security (threat protection) is NOT offered, as
+ * of 2026-07. `AWS::Cognito::UserPool` carrying a `UserPoolAddOns` block is
+ * undeployable there — CloudFormation's early-validation ResourceExistenceCheck
+ * rejects the change set — so app.yaml must omit the add-on (AdvancedSecurity=OFF)
+ * in these regions. A denylist (not an allowlist) so new/standard regions keep
+ * the secure default; AWS expands coverage over time, so revisit when they do.
+ */
+export const REGIONS_WITHOUT_COGNITO_ASF: ReadonlySet<string> = new Set([
+  "af-south-1", // Cape Town
+  "ap-east-1", // Hong Kong
+  "ap-east-2", // Taipei
+  "ap-south-2", // Hyderabad
+  "ap-southeast-3", // Jakarta
+  "ap-southeast-4", // Melbourne
+  "ap-southeast-5", // Malaysia
+  "ap-southeast-7", // Thailand
+  "ca-west-1", // Calgary
+  "eu-central-2", // Zurich
+  "eu-south-2", // Spain
+  "me-central-1", // UAE
+  "mx-central-1", // Mexico (Central)
+  "us-gov-east-1",
+  "us-gov-west-1",
+  "cn-north-1", // Beijing
+  "cn-northwest-1", // Ningxia
+]);
+
+/** Whether Cognito advanced security can be enabled in a region. */
+export function cognitoAdvancedSecuritySupported(region: string): boolean {
+  return !REGIONS_WITHOUT_COGNITO_ASF.has(region);
+}
+
 /**
  * The `--parameter-overrides` for `aws cloudformation deploy` of app.yaml,
  * derived from the config. Order and keys match the template's `Parameters`.
- * `ArtifactsBucket` (which has no template default) is included only when set.
+ * `ArtifactsBucket` (which has no template default) is included only when set;
+ * `AdvancedSecurity` is forced OFF only in regions that lack the feature (else
+ * the template's ENFORCED default stands).
  */
 export function stackParameters(cfg: DeployConfig): StackParameter[] {
   const params: StackParameter[] = [
@@ -243,6 +309,8 @@ export function stackParameters(cfg: DeployConfig): StackParameter[] {
   ];
   if (cfg.artifactsBucket)
     params.push({ key: "ArtifactsBucket", value: cfg.artifactsBucket });
+  if (!cognitoAdvancedSecuritySupported(cfg.region))
+    params.push({ key: "AdvancedSecurity", value: "OFF" });
   return params;
 }
 

package/src/rastack-bootstrap.ts

@@ -0,0 +1,299 @@
+#!/usr/bin/env node
+
+/**
+ * `rastack bootstrap` — stand the **tier-0 bootstrap stack** up for an AWS
+ * account. This is the once-per-account+region step that prepares an account to
+ * host React API Stack backends, decoupled from any single app.
+ *
+ *   rastack bootstrap [--owner <o>] [--repo <r>] [--branch <b>]
+ *                     [--region <r>] [--prefix <p>]
+ *                     [--reuse-oidc] [--print] [--yes]
+ *
+ * It deploys `deploy/cloudformation/bootstrap.yaml`, which creates:
+ *   • the S3 buckets that hold the Lambda placeholder + hosted templates, and
+ *   • the GitHub OIDC provider + trust that lets CI assume a deploy role.
+ * It then uploads the Lambda placeholder bundle to the artifacts bucket, so the
+ * account is immediately ready for per-app deploys (`rastack init`).
+ *
+ * `rastack init` still creates this stack on demand if it is missing, so
+ * `bootstrap` is the explicit, app-independent way to do the same thing up front
+ * (e.g. an account admin preparing an account before app teams run `init`).
+ * `--reuse-oidc` skips creating the GitHub OIDC provider (AWS allows only one per
+ * URL per account); `--print` shows the exact single-line `aws cloudformation
+ * deploy` command without touching the cloud.
+ */
+
+import {
+  BOOTSTRAP_ARTIFACTS_OUTPUT,
+  BOOTSTRAP_TEMPLATES_OUTPUT,
+  DeployConfig,
+  PartialDeployConfig,
+  bootstrapStackArgs,
+  bootstrapStackCommand,
+  bootstrapStackName,
+  mergeConfig,
+  normalizeConfig,
+  parseGitHubRemote,
+  validateBootstrapConfig,
+} from "./deploy/config";
+import {
+  ask,
+  awsAvailable,
+  awsRun,
+  canPrompt,
+  gitRemoteUrl,
+  loadConfig,
+  stackOutput,
+  uploadPlaceholder,
+  withPrompt,
+} from "./deploy/io";
+
+interface Flags {
+  patch: PartialDeployConfig;
+  reuseOidc: boolean;
+  print: boolean;
+  nonInteractive: boolean;
+}
+
+function parseFlags(argv: string[]): Flags {
+  const patch: PartialDeployConfig = { github: {} };
+  let reuseOidc = false;
+  let print = false;
+  let nonInteractive = false;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const next = () => argv[++i] ?? "";
+    switch (a) {
+      case "--owner":
+        patch.github!.owner = next();
+        break;
+      case "--repo":
+        patch.github!.repo = next();
+        break;
+      case "--branch":
+        patch.github!.branch = next();
+        break;
+      case "--region":
+        patch.region = next();
+        break;
+      case "--prefix":
+        patch.namePrefix = next();
+        break;
+      case "--reuse-oidc":
+        reuseOidc = true;
+        break;
+      case "--print":
+      case "--dry-run":
+        print = true;
+        break;
+      case "--yes":
+      case "-y":
+      case "--non-interactive":
+        nonInteractive = true;
+        break;
+      default:
+        if (a.startsWith("-")) {
+          console.error(`Unknown flag: ${a}`);
+          process.exit(1);
+        }
+    }
+  }
+  return { patch, reuseOidc, print, nonInteractive };
+}
+
+/** Seed a config: existing file → flags → git remote → defaults. */
+function seedConfig(flags: Flags): DeployConfig {
+  const existing = loadConfig();
+  let cfg = existing
+    ? mergeConfig(existing, flags.patch)
+    : normalizeConfig(flags.patch);
+  // Default the GitHub coordinates from `origin` when not already known — they
+  // anchor the OIDC trust the bootstrap stack sets up.
+  if (!cfg.github.owner || !cfg.github.repo) {
+    const url = gitRemoteUrl();
+    const remote = url ? parseGitHubRemote(url) : null;
+    if (remote) {
+      cfg = mergeConfig(cfg, {
+        github: {
+          owner: cfg.github.owner || remote.owner,
+          repo: cfg.github.repo || remote.repo,
+        },
+      });
+    }
+  }
+  return cfg;
+}
+
+async function promptMissing(cfg: DeployConfig): Promise<DeployConfig> {
+  return withPrompt(async (rl) => {
+    const owner = await ask(rl, "GitHub owner", cfg.github.owner);
+    const repo = await ask(rl, "GitHub repo", cfg.github.repo);
+    const branch = await ask(rl, "Deploy branch", cfg.github.branch);
+    const region = await ask(rl, "AWS region", cfg.region);
+    const prefix = await ask(rl, "Name prefix", cfg.namePrefix);
+    return mergeConfig(cfg, {
+      region,
+      namePrefix: prefix,
+      github: { owner, repo, branch },
+    });
+  });
+}
+
+/** Yes/no confirmation with a default of "no" — gates the cloud-mutating step. */
+async function confirm(question: string): Promise<boolean> {
+  return withPrompt(async (rl) => {
+    const answer = await ask(rl, question, "no");
+    return /^y(es)?$/i.test(answer.trim());
+  });
+}
+
+/** Print the exact command `bootstrap` would run, without touching the cloud. */
+function printPlan(cfg: DeployConfig, reuseOidc: boolean): void {
+  console.log(
+    `\n  Bootstrap plan (${bootstrapStackName(cfg)} @ ${cfg.region})\n`,
+  );
+  console.log("  ── Tier-0 bootstrap stack (bootstrap.yaml) ──");
+  console.log("\n  " + bootstrapStackCommand(cfg, reuseOidc) + "\n");
+  console.log(
+    "  Then `rastack init` (or `rastack bootstrap` again) resolves this stack's\n" +
+      "  ArtifactsBucket to create app backends. Nothing here is app-specific.\n",
+  );
+}
+
+/**
+ * Deploy the bootstrap stack, retrying once against an account that already has
+ * a GitHub OIDC provider (AWS allows only one per URL) when the caller did not
+ * already ask to reuse it.
+ */
+function deployBootstrap(cfg: DeployConfig, reuseOidc: boolean): void {
+  try {
+    awsRun(bootstrapStackArgs(cfg, reuseOidc));
+  } catch (err) {
+    if (reuseOidc) {
+      console.error(
+        `\n  ✗ bootstrap stack deploy failed.\n    ${(err as Error).message}`,
+      );
+      process.exit(1);
+    }
+    // The most common cause is an account that already has a GitHub OIDC
+    // provider. Retry telling the template to reuse it instead of creating a
+    // second (which CloudFormation rejects).
+    console.log(
+      "  • retrying bootstrap, reusing the account's existing GitHub OIDC provider",
+    );
+    try {
+      awsRun(bootstrapStackArgs(cfg, true));
+    } catch (retryErr) {
+      console.error(
+        `\n  ✗ bootstrap stack deploy failed.\n    ${(retryErr as Error).message}`,
+      );
+      process.exit(1);
+    }
+  }
+}
+
+/** Stand the tier-0 bootstrap stack up and upload the Lambda placeholder. */
+function standUp(cfg: DeployConfig, reuseOidc: boolean): void {
+  if (!awsAvailable()) {
+    console.error(
+      "  ✗ the AWS CLI is not on PATH. Install it and configure credentials,\n" +
+        "    or re-run with --print to see the command.",
+    );
+    process.exit(1);
+  }
+
+  const stack = bootstrapStackName(cfg);
+  const existing = stackOutput(stack, BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
+  if (existing) {
+    console.log(
+      `\n▸ Bootstrap stack ${stack} already exists — reconciling (idempotent).`,
+    );
+  } else {
+    console.log(`\n▸ Creating bootstrap stack ${stack} (@ ${cfg.region})`);
+  }
+  deployBootstrap(cfg, reuseOidc);
+
+  const artifactsBucket = stackOutput(
+    stack,
+    BOOTSTRAP_ARTIFACTS_OUTPUT,
+    cfg.region,
+  );
+  const templatesBucket = stackOutput(
+    stack,
+    BOOTSTRAP_TEMPLATES_OUTPUT,
+    cfg.region,
+  );
+  if (!artifactsBucket) {
+    console.error(
+      "  ✗ bootstrap stack deployed but its ArtifactsBucket output could not be read.",
+    );
+    process.exit(1);
+  }
+  console.log(`  ✓ artifacts bucket:  ${artifactsBucket}`);
+  if (templatesBucket) console.log(`  ✓ templates bucket:  ${templatesBucket}`);
+
+  // Upload the placeholder the app.yaml function is later created from, so the
+  // account is ready for `rastack init` without a second manual step.
+  console.log("\n▸ Uploading the Lambda placeholder bundle");
+  if (!uploadPlaceholder(artifactsBucket, cfg.region)) {
+    console.error(
+      "  ✗ deploy/cloudformation/placeholder/bootstrap not found — the placeholder\n" +
+        "    was not uploaded. `rastack init` will upload it on the first app deploy.",
+    );
+  } else {
+    console.log("  ✓ placeholder uploaded");
+  }
+
+  console.log(
+    `\n  ✓ account bootstrapped (${stack} @ ${cfg.region}).\n` +
+      `    Run \`rastack init\` in an app repo to deploy a backend against it.\n`,
+  );
+}
+
+async function main(argv: string[]): Promise<void> {
+  const flags = parseFlags(argv);
+  let cfg = seedConfig(flags);
+
+  if (canPrompt(flags.nonInteractive) && !flags.print) {
+    console.log(
+      "\n  rastack bootstrap — stand the tier-0 AWS account stack up\n",
+    );
+    cfg = await promptMissing(cfg);
+  }
+
+  const errors = validateBootstrapConfig(cfg);
+  if (errors.length) {
+    for (const e of errors) console.error(`  ✗ ${e}`);
+    console.error(
+      `\n  ${errors.length} problem(s). Pass the missing values as flags` +
+        ` (--owner, --repo, --branch, --region, --prefix).`,
+    );
+    process.exit(1);
+  }
+
+  if (flags.print) {
+    printPlan(cfg, flags.reuseOidc);
+    return;
+  }
+
+  if (canPrompt(flags.nonInteractive)) {
+    const ok = await confirm(
+      `Create/update bootstrap stack ${bootstrapStackName(cfg)} in AWS ${cfg.region} now? [y/N]`,
+    );
+    if (!ok) {
+      console.log(
+        "\n  Skipped. Re-run to deploy, or `rastack bootstrap --print` for the command.\n",
+      );
+      return;
+    }
+  }
+
+  standUp(cfg, flags.reuseOidc);
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2)).catch((err) => {
+    console.error(`  ✗ ${(err as Error).message}`);
+    process.exit(1);
+  });
+}

package/src/rastack-update.ts

@@ -22,11 +22,15 @@ import { readFileSync } from "fs";
 import * as path from "path";
 import {
   globalPrefixFromPackageDir,
+  npmBinary,
   npmInstallArgs,
   parseUpdateFlags,
   updateAvailable,
 } from "./update";
 
+/** The npm executable for this platform (`npm.cmd` on Windows, else `npm`). */
+const NPM = npmBinary();
+
 /** The installed rastack package directory (…/rastack), one up from dist/. */
 const PKG_DIR = path.join(__dirname, "..");
 const PKG_JSON = path.join(PKG_DIR, "package.json");
@@ -43,7 +47,7 @@ function readVersion(file: string): string {
 /** Capture `npm <args>` stdout, or null when npm is absent / the call fails. */
 function npmCapture(args: string[]): string | null {
   try {
-    return execFileSync("npm", args, {
+    return execFileSync(NPM, args, {
       stdio: ["ignore", "pipe", "pipe"],
     })
       .toString()
@@ -102,7 +106,7 @@ function main(argv: string[]): void {
     // Re-runs the developer's own npm to update this global package — no
     // untrusted input, and execFileSync (no shell) avoids any injection.
     // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-    execFileSync("npm", args, { stdio: "inherit", env });
+    execFileSync(NPM, args, { stdio: "inherit", env });
   } catch (err) {
     console.error(
       `\n  ✗ npm failed to update rastack. Re-run for detail:\n    npm install -g ${npmInstallArgs(flags.version)[2]}\n    ${(err as Error).message}`,

package/src/rastack.ts

@@ -16,6 +16,7 @@
  *   rastack wasm                                Compile the API to WebAssembly (in-browser local dev)
  *   rastack scan   [files...] [--fail-on-pii]   Scan CSVs for PII and schema info
  *   rastack seed   [--env dev] [--source gs://] Load CSVs into Iceberg namespace
+ *   rastack bootstrap [--owner o] [--repo r]    Stand the tier-0 AWS account stack up (once per account+region)
  *   rastack init   [--app slug] [--force]       Scaffold config + GitHub Actions AND stand the backend up
  *   rastack deploy [--plan]                     Ship code to the Lambda (alias for `rastack ci deploy`)
  *   rastack ci     <check|build|deploy> [--plan] Run the CI pipeline (keeps Actions a one-liner)
@@ -118,6 +119,11 @@ switch (command) {
   case "seed":
     run("seed.js");
     break;
+  case "bootstrap":
+    // Stand the tier-0 bootstrap stack up (buckets + GitHub OIDC) for an AWS
+    // account — the once-per-account+region step, decoupled from any app.
+    run("rastack-bootstrap.js", rest);
+    break;
   case "init":
     // Scaffold config + GitHub Actions and stand the serverless backend up.
     run("rastack-init.js", rest);
@@ -154,6 +160,7 @@ switch (command) {
         `  rastack wasm                                Compile the API to WebAssembly (browser local dev)\n` +
         `  rastack scan   [files...] [--fail-on-pii]\n` +
         `  rastack seed   [--env dev|staging] [--source gs://bucket/ | ./myapp-dev/]\n` +
+        `  rastack bootstrap [--owner o] [--repo r] [--region r] [--prefix p] [--reuse-oidc] [--print]  Stand the AWS account stack up\n` +
         `  rastack init   [--app slug] [--owner o] [--repo r] [--print] [--no-deploy]  Scaffold + stand the backend up\n` +
         `  rastack deploy [--plan]                                       Ship code to the Lambda (alias for ci deploy)\n` +
         `  rastack ci     <check|build|deploy> [--plan]                  Run the CI pipeline (cleaner Actions)\n` +

package/src/update.ts

@@ -50,6 +50,17 @@ export function parseUpdateFlags(argv: string[]): UpdateFlags {
   return { version, check, dryRun };
 }
 
+/**
+ * The npm executable to spawn for a platform. On Windows npm is a `.cmd` shim,
+ * not a real executable, so `execFile("npm", …)` (no shell) fails with
+ * `spawnSync npm ENOENT` — the direct-spawn path only resolves real binaries,
+ * never `PATHEXT` scripts. Spawn `npm.cmd` there; POSIX keeps plain `npm`.
+ * (`aws` is unaffected — it installs as `aws.exe`, a real executable.)
+ */
+export function npmBinary(platform: string = process.platform): string {
+  return platform === "win32" ? "npm.cmd" : "npm";
+}
+
 /** The npm package spec to install for a target version. */
 export function installSpec(version: string): string {
   return !version || version === "latest" ? "rastack" : `rastack@${version}`;

package/test/deploy.spec.ts

@@ -11,6 +11,7 @@ import {
   bootstrapStackCommand,
   bootstrapStackName,
   bootstrapStackParameters,
+  cognitoAdvancedSecuritySupported,
   APP_STACK_OUTPUTS,
   lambdaEnv,
   mergeConfig,
@@ -20,6 +21,7 @@ import {
   scaffoldFiles,
   stackParameters,
   validateConfig,
+  validateBootstrapConfig,
   zipStore,
   renderCiWorkflow,
   renderDeployWorkflow,
@@ -168,7 +170,10 @@ describe("parseGitHubRemote", () => {
 
 describe("stack parameters + launch command", () => {
   it("emits the app.yaml parameters in template order", () => {
-    const params = stackParameters(base({ artifactsBucket: "art-bucket" }));
+    // A region WITH Cognito advanced security, so AdvancedSecurity is left off.
+    const params = stackParameters(
+      base({ region: "us-east-1", artifactsBucket: "art-bucket" }),
+    );
     expect(params.map((p) => p.key)).toEqual([
       "AppName",
       "NamePrefix",
@@ -181,9 +186,24 @@ describe("stack parameters + launch command", () => {
   });
 
   it("omits ArtifactsBucket when unset (it has no template default)", () => {
-    expect(stackParameters(base()).map((p) => p.key)).not.toContain(
-      "ArtifactsBucket",
+    expect(
+      stackParameters(base({ region: "us-east-1" })).map((p) => p.key),
+    ).not.toContain("ArtifactsBucket");
+  });
+
+  it("forces AdvancedSecurity=OFF only in regions lacking Cognito ASF", () => {
+    // af-south-1 (the repo default) has no threat protection — a User Pool with
+    // a UserPoolAddOns block is undeployable, so the override must be emitted.
+    expect(cognitoAdvancedSecuritySupported("af-south-1")).toBe(false);
+    expect(cognitoAdvancedSecuritySupported("us-east-1")).toBe(true);
+
+    const capeTown = stackParameters(base({ region: "af-south-1" }));
+    expect(capeTown.find((p) => p.key === "AdvancedSecurity")?.value).toBe(
+      "OFF",
     );
+
+    const virginia = stackParameters(base({ region: "us-east-1" }));
+    expect(virginia.map((p) => p.key)).not.toContain("AdvancedSecurity");
   });
 
   it("always launches from the in-repo --template-file (deploy takes no URL)", () => {
@@ -259,6 +279,31 @@ describe("bootstrap stack", () => {
     expect(cmd).toContain("--stack-name rastack-bootstrap");
     expect(`aws ${bootstrapStackArgs(base()).join(" ")}`).toBe(cmd);
   });
+
+  it("validates only the account-level fields, not the per-app ones", () => {
+    // A config with no `app` is fine for bootstrap — it never touches app.yaml.
+    const cfg = normalizeConfig({
+      github: { owner: "theserverkid", repo: "reactapistack-demo" },
+    });
+    expect(validateConfig(cfg)).toContain(
+      "app is required (a short slug, e.g. `airline`).",
+    );
+    expect(validateBootstrapConfig(cfg)).toEqual([]);
+  });
+
+  it("still flags a bad prefix, region, or GitHub coordinates", () => {
+    expect(
+      validateBootstrapConfig(base({ namePrefix: "Bad_Prefix" })),
+    ).toContainEqual(expect.stringContaining("namePrefix"));
+    expect(
+      validateBootstrapConfig(base({ region: "not-a-region" })),
+    ).toContainEqual(expect.stringContaining("region"));
+    expect(
+      validateBootstrapConfig(
+        normalizeConfig({ app: "airline", github: { repo: "demo" } }),
+      ),
+    ).toContain("github.owner is required.");
+  });
 });
 
 describe("app stack outputs map", () => {

package/test/update.spec.ts

@@ -2,6 +2,7 @@ import {
   compareSemver,
   globalPrefixFromPackageDir,
   installSpec,
+  npmBinary,
   npmInstallArgs,
   parseUpdateFlags,
   updateAvailable,
@@ -47,6 +48,14 @@ describe("update — npm spec + args", () => {
     ]);
     expect(npmInstallArgs("0.0.40")[2]).toBe("rastack@0.0.40");
   });
+
+  it("spawns npm.cmd on Windows and plain npm elsewhere", () => {
+    // npm is a `.cmd` shim on Windows; execFile (no shell) can't launch a bare
+    // `npm` there, so the wrapper must target `npm.cmd`. POSIX keeps `npm`.
+    expect(npmBinary("win32")).toBe("npm.cmd");
+    expect(npmBinary("linux")).toBe("npm");
+    expect(npmBinary("darwin")).toBe("npm");
+  });
 });
 
 describe("update — global prefix derivation", () => {