rastack 0.0.38 → 0.0.40

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.0.40](https://github.com/theserverkid/reactapistack/compare/v0.0.39...v0.0.40) (2026-07-12)
+
+
+### Bug Fixes
+
+* `rastack init` now wires the GitHub→Lambda deploy variables ([fa35b97](https://github.com/theserverkid/reactapistack/commit/fa35b9744c2149ff7a9c663ffecdd2d6ad1edec6))
+
+### [0.0.39](https://github.com/theserverkid/reactapistack/compare/v0.0.38...v0.0.39) (2026-07-11)
+
 ### [0.0.38](https://github.com/theserverkid/reactapistack/compare/v0.0.37...v0.0.38) (2026-07-11)
 
 ### [0.0.37](https://github.com/theserverkid/reactapistack/compare/v0.0.36...v0.0.37) (2026-07-11)

package/dist/deploy/config.d.ts

@@ -91,6 +91,14 @@ export declare function normalizeConfig(partial?: PartialDeployConfig): DeployCo
  * config that passes here also passes CloudFormation's own validation.
  */
 export declare function validateConfig(cfg: DeployConfig): string[];
+/**
+ * Return the subset of problems that block standing the **tier-0 bootstrap
+ * stack** up. The bootstrap stack (bootstrap.yaml) is account+region scoped — it
+ * only needs the name prefix, the region, and the GitHub coordinates that anchor
+ * the OIDC trust — so `rastack bootstrap` validates just those, not the per-app
+ * fields (`app`, namespace, Lambda build) that `validateConfig` also requires.
+ */
+export declare function validateBootstrapConfig(cfg: DeployConfig): string[];
 /** Deep-merge a patch over a base config (used by `deploy`/`init` reconfigure). */
 export declare function mergeConfig(base: DeployConfig, patch: PartialDeployConfig): DeployConfig;
 /**
@@ -177,6 +185,16 @@ export interface RepoVariable {
  * Console.
  */
 export declare function repoVariables(cfg: DeployConfig): RepoVariable[];
+/**
+ * The argv (after `gh`) that sets one GitHub repo **Variable** on the config's
+ * repo. `init` runs this for each resolved `repoVariables` entry so the
+ * `deploy-backend.yml` guard (`if: vars.AWS_DEPLOY_ROLE_ARN != ''`) passes and
+ * the very first push actually ships — instead of the variables being a manual
+ * Console step the user has to remember. Uses `gh` (already authenticated to the
+ * user's GitHub) rather than an API token; a pure argv so it is inspectable and
+ * shell-free (`execFileSync`).
+ */
+export declare function ghVariableSetArgs(cfg: DeployConfig, name: string, value: string): string[];
 /**
  * The `RASTACK_*` environment the Lambda reads (docs/serverless-deploy.md §1).
  * The IaC sets these on the function; surfaced here for `rastack deploy` to

package/dist/deploy/config.js

@@ -21,6 +21,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.APP_STACK_OUTPUTS = exports.BOOTSTRAP_TEMPLATES_OUTPUT = exports.BOOTSTRAP_ARTIFACTS_OUTPUT = exports.BOOTSTRAP_TEMPLATE_FILE = exports.APP_TEMPLATE_FILE = exports.REGIONS_WITHOUT_COGNITO_ASF = exports.DEFAULTS = exports.DEFAULT_LAMBDA = void 0;
 exports.normalizeConfig = normalizeConfig;
 exports.validateConfig = validateConfig;
+exports.validateBootstrapConfig = validateBootstrapConfig;
 exports.mergeConfig = mergeConfig;
 exports.parseGitHubRemote = parseGitHubRemote;
 exports.cognitoAdvancedSecuritySupported = cognitoAdvancedSecuritySupported;
@@ -32,6 +33,7 @@ exports.bootstrapStackParameters = bootstrapStackParameters;
 exports.bootstrapStackArgs = bootstrapStackArgs;
 exports.bootstrapStackCommand = bootstrapStackCommand;
 exports.repoVariables = repoVariables;
+exports.ghVariableSetArgs = ghVariableSetArgs;
 exports.lambdaEnv = lambdaEnv;
 exports.DEFAULT_LAMBDA = {
     bin: "bootstrap",
@@ -121,6 +123,33 @@ function validateConfig(cfg) {
         errors.push("lambda.bin is required.");
     return errors;
 }
+/**
+ * Return the subset of problems that block standing the **tier-0 bootstrap
+ * stack** up. The bootstrap stack (bootstrap.yaml) is account+region scoped — it
+ * only needs the name prefix, the region, and the GitHub coordinates that anchor
+ * the OIDC trust — so `rastack bootstrap` validates just those, not the per-app
+ * fields (`app`, namespace, Lambda build) that `validateConfig` also requires.
+ */
+function validateBootstrapConfig(cfg) {
+    const errors = [];
+    if (!SLUG.test(cfg.namePrefix))
+        errors.push(`namePrefix "${cfg.namePrefix}" must match ${SLUG}.`);
+    if (!cfg.region)
+        errors.push("region is required (e.g. `af-south-1`).");
+    else if (!REGION.test(cfg.region))
+        errors.push(`region "${cfg.region}" does not look like an AWS region (e.g. af-south-1).`);
+    if (!cfg.github.owner)
+        errors.push("github.owner is required.");
+    else if (!GH_NAME.test(cfg.github.owner))
+        errors.push(`github.owner "${cfg.github.owner}" is not a valid GitHub name.`);
+    if (!cfg.github.repo)
+        errors.push("github.repo is required.");
+    else if (!GH_NAME.test(cfg.github.repo))
+        errors.push(`github.repo "${cfg.github.repo}" is not a valid GitHub name.`);
+    if (!cfg.github.branch)
+        errors.push("github.branch is required.");
+    return errors;
+}
 /** Deep-merge a patch over a base config (used by `deploy`/`init` reconfigure). */
 function mergeConfig(base, patch) {
     return normalizeConfig({
@@ -317,6 +346,26 @@ function repoVariables(cfg) {
         { name: "AWS_REGION", value: cfg.region, from: "Region stack output" },
     ];
 }
+/**
+ * The argv (after `gh`) that sets one GitHub repo **Variable** on the config's
+ * repo. `init` runs this for each resolved `repoVariables` entry so the
+ * `deploy-backend.yml` guard (`if: vars.AWS_DEPLOY_ROLE_ARN != ''`) passes and
+ * the very first push actually ships — instead of the variables being a manual
+ * Console step the user has to remember. Uses `gh` (already authenticated to the
+ * user's GitHub) rather than an API token; a pure argv so it is inspectable and
+ * shell-free (`execFileSync`).
+ */
+function ghVariableSetArgs(cfg, name, value) {
+    return [
+        "variable",
+        "set",
+        name,
+        "--repo",
+        `${cfg.github.owner}/${cfg.github.repo}`,
+        "--body",
+        value,
+    ];
+}
 /**
  * The `RASTACK_*` environment the Lambda reads (docs/serverless-deploy.md §1).
  * The IaC sets these on the function; surfaced here for `rastack deploy` to

package/dist/deploy/io.d.ts

@@ -17,7 +17,7 @@ export declare function saveConfig(cfg: DeployConfig, cwd?: string): string;
  */
 export declare function gitRemoteUrl(cwd?: string): string | null;
 /** True when we can prompt the user (a TTY, and not explicitly opted out). */
-export declare function canPrompt(nonInteractive: boolean): boolean;
+export declare function canPrompt(nonInteractive?: boolean): boolean;
 /** Capture `aws <args>` stdout, or null when the CLI is absent / the call fails. */
 export declare function awsCapture(args: string[], cwd?: string): string | null;
 /** Run `aws <args>` streaming output; throws on a non-zero exit. */
@@ -37,6 +37,29 @@ export declare function stackOutput(stackName: string, key: string, region: stri
  * on every `init`. Returns false when the placeholder file is missing.
  */
 export declare function uploadPlaceholder(artifactsBucket: string, region: string, cwd?: string): boolean;
+/** True when the GitHub CLI is on PATH. */
+export declare function ghAvailable(): boolean;
+/**
+ * True when `gh` already holds valid credentials for github.com. `gh auth
+ * status` exits non-zero when logged out, so a thrown call means "not connected".
+ */
+export declare function ghAuthenticated(cwd?: string): boolean;
+/**
+ * Connect `gh` to GitHub interactively (`gh auth login`) as part of `init`, so
+ * the repo Variables can be set right after. Streamed to the terminal — the
+ * browser/device-code flow needs the TTY — and left to `gh`'s own prompts so the
+ * user picks how to authenticate (browser or a pasted token). Returns true when
+ * the login exits 0.
+ */
+export declare function ghAuthLogin(cwd?: string): boolean;
+/**
+ * Set one GitHub repo Variable via `gh variable set`. Returns true on success,
+ * false when `gh` is missing, unauthenticated, or the call otherwise fails —
+ * the caller falls back to printing the value for the user to wire by hand.
+ * `execFileSync` (no shell) so the ARN/region values are never interpolated
+ * into a command line.
+ */
+export declare function setRepoVariable(args: string[], cwd?: string): boolean;
 /**
  * Ask a single question with a default, echoed as `label [default]: `. Returns
  * the trimmed answer, or the default on an empty line.

package/dist/deploy/io.js

@@ -48,6 +48,10 @@ exports.awsRun = awsRun;
 exports.awsAvailable = awsAvailable;
 exports.stackOutput = stackOutput;
 exports.uploadPlaceholder = uploadPlaceholder;
+exports.ghAvailable = ghAvailable;
+exports.ghAuthenticated = ghAuthenticated;
+exports.ghAuthLogin = ghAuthLogin;
+exports.setRepoVariable = setRepoVariable;
 exports.ask = ask;
 exports.withPrompt = withPrompt;
 const child_process_1 = require("child_process");
@@ -98,7 +102,7 @@ function gitRemoteUrl(cwd = process.cwd()) {
     }
 }
 /** True when we can prompt the user (a TTY, and not explicitly opted out). */
-function canPrompt(nonInteractive) {
+function canPrompt(nonInteractive = false) {
     return !nonInteractive && Boolean(process.stdin.isTTY);
 }
 // ── AWS CLI boundary ─────────────────────────────────────────────────────────
@@ -175,6 +179,75 @@ function uploadPlaceholder(artifactsBucket, region, cwd = process.cwd()) {
     ]);
     return true;
 }
+// ── GitHub CLI boundary ──────────────────────────────────────────────────────
+// After the stack is up `init` wires the two repo Variables CI reads
+// (AWS_DEPLOY_ROLE_ARN / AWS_REGION) through the developer's own `gh` — already
+// authenticated to their GitHub — so the pipeline fires on the first push
+// instead of leaving the wiring as a manual Console step. Best-effort: absent or
+// unauthenticated `gh` degrades to the printed instructions.
+/** True when the GitHub CLI is on PATH. */
+function ghAvailable() {
+    try {
+        (0, child_process_1.execFileSync)("gh", ["--version"], { stdio: ["ignore", "pipe", "pipe"] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * True when `gh` already holds valid credentials for github.com. `gh auth
+ * status` exits non-zero when logged out, so a thrown call means "not connected".
+ */
+function ghAuthenticated(cwd = process.cwd()) {
+    try {
+        (0, child_process_1.execFileSync)("gh", ["auth", "status", "--hostname", "github.com"], {
+            cwd,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Connect `gh` to GitHub interactively (`gh auth login`) as part of `init`, so
+ * the repo Variables can be set right after. Streamed to the terminal — the
+ * browser/device-code flow needs the TTY — and left to `gh`'s own prompts so the
+ * user picks how to authenticate (browser or a pasted token). Returns true when
+ * the login exits 0.
+ */
+function ghAuthLogin(cwd = process.cwd()) {
+    try {
+        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+        (0, child_process_1.execFileSync)("gh", ["auth", "login", "--hostname", "github.com"], {
+            cwd,
+            stdio: "inherit",
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Set one GitHub repo Variable via `gh variable set`. Returns true on success,
+ * false when `gh` is missing, unauthenticated, or the call otherwise fails —
+ * the caller falls back to printing the value for the user to wire by hand.
+ * `execFileSync` (no shell) so the ARN/region values are never interpolated
+ * into a command line.
+ */
+function setRepoVariable(args, cwd = process.cwd()) {
+    try {
+        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+        (0, child_process_1.execFileSync)("gh", args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Ask a single question with a default, echoed as `label [default]: `. Returns
  * the trimmed answer, or the default on an empty line.

package/dist/rastack-bootstrap.d.ts

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+/**
+ * `rastack bootstrap` — stand the **tier-0 bootstrap stack** up for an AWS
+ * account. This is the once-per-account+region step that prepares an account to
+ * host React API Stack backends, decoupled from any single app.
+ *
+ *   rastack bootstrap [--owner <o>] [--repo <r>] [--branch <b>]
+ *                     [--region <r>] [--prefix <p>]
+ *                     [--reuse-oidc] [--print] [--yes]
+ *
+ * It deploys `deploy/cloudformation/bootstrap.yaml`, which creates:
+ *   • the S3 buckets that hold the Lambda placeholder + hosted templates, and
+ *   • the GitHub OIDC provider + trust that lets CI assume a deploy role.
+ * It then uploads the Lambda placeholder bundle to the artifacts bucket, so the
+ * account is immediately ready for per-app deploys (`rastack init`).
+ *
+ * `rastack init` still creates this stack on demand if it is missing, so
+ * `bootstrap` is the explicit, app-independent way to do the same thing up front
+ * (e.g. an account admin preparing an account before app teams run `init`).
+ * `--reuse-oidc` skips creating the GitHub OIDC provider (AWS allows only one per
+ * URL per account); `--print` shows the exact single-line `aws cloudformation
+ * deploy` command without touching the cloud.
+ */
+export {};

package/dist/rastack-bootstrap.js

@@ -0,0 +1,222 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * `rastack bootstrap` — stand the **tier-0 bootstrap stack** up for an AWS
+ * account. This is the once-per-account+region step that prepares an account to
+ * host React API Stack backends, decoupled from any single app.
+ *
+ *   rastack bootstrap [--owner <o>] [--repo <r>] [--branch <b>]
+ *                     [--region <r>] [--prefix <p>]
+ *                     [--reuse-oidc] [--print] [--yes]
+ *
+ * It deploys `deploy/cloudformation/bootstrap.yaml`, which creates:
+ *   • the S3 buckets that hold the Lambda placeholder + hosted templates, and
+ *   • the GitHub OIDC provider + trust that lets CI assume a deploy role.
+ * It then uploads the Lambda placeholder bundle to the artifacts bucket, so the
+ * account is immediately ready for per-app deploys (`rastack init`).
+ *
+ * `rastack init` still creates this stack on demand if it is missing, so
+ * `bootstrap` is the explicit, app-independent way to do the same thing up front
+ * (e.g. an account admin preparing an account before app teams run `init`).
+ * `--reuse-oidc` skips creating the GitHub OIDC provider (AWS allows only one per
+ * URL per account); `--print` shows the exact single-line `aws cloudformation
+ * deploy` command without touching the cloud.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const config_1 = require("./deploy/config");
+const io_1 = require("./deploy/io");
+function parseFlags(argv) {
+    const patch = { github: {} };
+    let reuseOidc = false;
+    let print = false;
+    let nonInteractive = false;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = () => argv[++i] ?? "";
+        switch (a) {
+            case "--owner":
+                patch.github.owner = next();
+                break;
+            case "--repo":
+                patch.github.repo = next();
+                break;
+            case "--branch":
+                patch.github.branch = next();
+                break;
+            case "--region":
+                patch.region = next();
+                break;
+            case "--prefix":
+                patch.namePrefix = next();
+                break;
+            case "--reuse-oidc":
+                reuseOidc = true;
+                break;
+            case "--print":
+            case "--dry-run":
+                print = true;
+                break;
+            case "--yes":
+            case "-y":
+            case "--non-interactive":
+                nonInteractive = true;
+                break;
+            default:
+                if (a.startsWith("-")) {
+                    console.error(`Unknown flag: ${a}`);
+                    process.exit(1);
+                }
+        }
+    }
+    return { patch, reuseOidc, print, nonInteractive };
+}
+/** Seed a config: existing file → flags → git remote → defaults. */
+function seedConfig(flags) {
+    const existing = (0, io_1.loadConfig)();
+    let cfg = existing
+        ? (0, config_1.mergeConfig)(existing, flags.patch)
+        : (0, config_1.normalizeConfig)(flags.patch);
+    // Default the GitHub coordinates from `origin` when not already known — they
+    // anchor the OIDC trust the bootstrap stack sets up.
+    if (!cfg.github.owner || !cfg.github.repo) {
+        const url = (0, io_1.gitRemoteUrl)();
+        const remote = url ? (0, config_1.parseGitHubRemote)(url) : null;
+        if (remote) {
+            cfg = (0, config_1.mergeConfig)(cfg, {
+                github: {
+                    owner: cfg.github.owner || remote.owner,
+                    repo: cfg.github.repo || remote.repo,
+                },
+            });
+        }
+    }
+    return cfg;
+}
+async function promptMissing(cfg) {
+    return (0, io_1.withPrompt)(async (rl) => {
+        const owner = await (0, io_1.ask)(rl, "GitHub owner", cfg.github.owner);
+        const repo = await (0, io_1.ask)(rl, "GitHub repo", cfg.github.repo);
+        const branch = await (0, io_1.ask)(rl, "Deploy branch", cfg.github.branch);
+        const region = await (0, io_1.ask)(rl, "AWS region", cfg.region);
+        const prefix = await (0, io_1.ask)(rl, "Name prefix", cfg.namePrefix);
+        return (0, config_1.mergeConfig)(cfg, {
+            region,
+            namePrefix: prefix,
+            github: { owner, repo, branch },
+        });
+    });
+}
+/** Yes/no confirmation with a default of "no" — gates the cloud-mutating step. */
+async function confirm(question) {
+    return (0, io_1.withPrompt)(async (rl) => {
+        const answer = await (0, io_1.ask)(rl, question, "no");
+        return /^y(es)?$/i.test(answer.trim());
+    });
+}
+/** Print the exact command `bootstrap` would run, without touching the cloud. */
+function printPlan(cfg, reuseOidc) {
+    console.log(`\n  Bootstrap plan (${(0, config_1.bootstrapStackName)(cfg)} @ ${cfg.region})\n`);
+    console.log("  ── Tier-0 bootstrap stack (bootstrap.yaml) ──");
+    console.log("\n  " + (0, config_1.bootstrapStackCommand)(cfg, reuseOidc) + "\n");
+    console.log("  Then `rastack init` (or `rastack bootstrap` again) resolves this stack's\n" +
+        "  ArtifactsBucket to create app backends. Nothing here is app-specific.\n");
+}
+/**
+ * Deploy the bootstrap stack, retrying once against an account that already has
+ * a GitHub OIDC provider (AWS allows only one per URL) when the caller did not
+ * already ask to reuse it.
+ */
+function deployBootstrap(cfg, reuseOidc) {
+    try {
+        (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, reuseOidc));
+    }
+    catch (err) {
+        if (reuseOidc) {
+            console.error(`\n  ✗ bootstrap stack deploy failed.\n    ${err.message}`);
+            process.exit(1);
+        }
+        // The most common cause is an account that already has a GitHub OIDC
+        // provider. Retry telling the template to reuse it instead of creating a
+        // second (which CloudFormation rejects).
+        console.log("  • retrying bootstrap, reusing the account's existing GitHub OIDC provider");
+        try {
+            (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, true));
+        }
+        catch (retryErr) {
+            console.error(`\n  ✗ bootstrap stack deploy failed.\n    ${retryErr.message}`);
+            process.exit(1);
+        }
+    }
+}
+/** Stand the tier-0 bootstrap stack up and upload the Lambda placeholder. */
+function standUp(cfg, reuseOidc) {
+    if (!(0, io_1.awsAvailable)()) {
+        console.error("  ✗ the AWS CLI is not on PATH. Install it and configure credentials,\n" +
+            "    or re-run with --print to see the command.");
+        process.exit(1);
+    }
+    const stack = (0, config_1.bootstrapStackName)(cfg);
+    const existing = (0, io_1.stackOutput)(stack, config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
+    if (existing) {
+        console.log(`\n▸ Bootstrap stack ${stack} already exists — reconciling (idempotent).`);
+    }
+    else {
+        console.log(`\n▸ Creating bootstrap stack ${stack} (@ ${cfg.region})`);
+    }
+    deployBootstrap(cfg, reuseOidc);
+    const artifactsBucket = (0, io_1.stackOutput)(stack, config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
+    const templatesBucket = (0, io_1.stackOutput)(stack, config_1.BOOTSTRAP_TEMPLATES_OUTPUT, cfg.region);
+    if (!artifactsBucket) {
+        console.error("  ✗ bootstrap stack deployed but its ArtifactsBucket output could not be read.");
+        process.exit(1);
+    }
+    console.log(`  ✓ artifacts bucket:  ${artifactsBucket}`);
+    if (templatesBucket)
+        console.log(`  ✓ templates bucket:  ${templatesBucket}`);
+    // Upload the placeholder the app.yaml function is later created from, so the
+    // account is ready for `rastack init` without a second manual step.
+    console.log("\n▸ Uploading the Lambda placeholder bundle");
+    if (!(0, io_1.uploadPlaceholder)(artifactsBucket, cfg.region)) {
+        console.error("  ✗ deploy/cloudformation/placeholder/bootstrap not found — the placeholder\n" +
+            "    was not uploaded. `rastack init` will upload it on the first app deploy.");
+    }
+    else {
+        console.log("  ✓ placeholder uploaded");
+    }
+    console.log(`\n  ✓ account bootstrapped (${stack} @ ${cfg.region}).\n` +
+        `    Run \`rastack init\` in an app repo to deploy a backend against it.\n`);
+}
+async function main(argv) {
+    const flags = parseFlags(argv);
+    let cfg = seedConfig(flags);
+    if ((0, io_1.canPrompt)(flags.nonInteractive) && !flags.print) {
+        console.log("\n  rastack bootstrap — stand the tier-0 AWS account stack up\n");
+        cfg = await promptMissing(cfg);
+    }
+    const errors = (0, config_1.validateBootstrapConfig)(cfg);
+    if (errors.length) {
+        for (const e of errors)
+            console.error(`  ✗ ${e}`);
+        console.error(`\n  ${errors.length} problem(s). Pass the missing values as flags` +
+            ` (--owner, --repo, --branch, --region, --prefix).`);
+        process.exit(1);
+    }
+    if (flags.print) {
+        printPlan(cfg, flags.reuseOidc);
+        return;
+    }
+    if ((0, io_1.canPrompt)(flags.nonInteractive)) {
+        const ok = await confirm(`Create/update bootstrap stack ${(0, config_1.bootstrapStackName)(cfg)} in AWS ${cfg.region} now? [y/N]`);
+        if (!ok) {
+            console.log("\n  Skipped. Re-run to deploy, or `rastack bootstrap --print` for the command.\n");
+            return;
+        }
+    }
+    standUp(cfg, flags.reuseOidc);
+}
+if (require.main === module) {
+    main(process.argv.slice(2)).catch((err) => {
+        console.error(`  ✗ ${err.message}`);
+        process.exit(1);
+    });
+}

package/dist/rastack-init.d.ts

@@ -5,7 +5,7 @@
  *
  *   rastack init [--app <slug>] [--owner <o>] [--repo <r>] [--branch <b>]
  *                [--region <r>] [--prefix <p>] [--namespace <n>]
- *                [--force] [--no-workflows] [--no-deploy] [--print] [--yes]
+ *                [--force] [--no-workflows] [--no-deploy] [--print]
  *
  * This is the one command that takes you from nothing to deployed. It:
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`