rastack 0.0.40 → 0.0.42

package/CHANGELOG.md

@@ -2,6 +2,15 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.0.42](https://github.com/theserverkid/reactapistack/compare/v0.0.41...v0.0.42) (2026-07-12)
+
+
+### Bug Fixes
+
+* **deploy:** bundle CFN templates in the rastack package so init/bootstrap work from any repo ([4b45ee3](https://github.com/theserverkid/reactapistack/commit/4b45ee3440aef0355bc06c5b40bb1fa4f02e496f))
+
+### [0.0.41](https://github.com/theserverkid/reactapistack/compare/v0.0.40...v0.0.41) (2026-07-12)
+
 ### [0.0.40](https://github.com/theserverkid/reactapistack/compare/v0.0.39...v0.0.40) (2026-07-12)
 
 

package/dist/deploy/config.d.ts

@@ -136,17 +136,28 @@ export declare function cognitoAdvancedSecuritySupported(region: string): boolea
  * the template's ENFORCED default stands).
  */
 export declare function stackParameters(cfg: DeployConfig): StackParameter[];
-/** The in-repo CloudFormation templates `rastack init` deploys from. */
+/**
+ * The canonical repo-relative CloudFormation template paths. These are the paths
+ * in the *framework* repo (theserverkid/reactapistack) and the default the argv
+ * builders below embed. A **consumer** repo (the demo, any app) deliberately does
+ * NOT carry a copy of the framework IaC — the templates ship inside the `rastack`
+ * package instead — so `init`/`bootstrap` resolve the real on-disk path via
+ * `resolveDeployAsset` (io.ts) and pass it in as the `templateFile` override.
+ */
 export declare const APP_TEMPLATE_FILE = "deploy/cloudformation/app.yaml";
 export declare const BOOTSTRAP_TEMPLATE_FILE = "deploy/cloudformation/bootstrap.yaml";
-/** The argv that creates the app's infrastructure (app.yaml). */
-export declare function deployStackArgs(cfg: DeployConfig): string[];
+/**
+ * The argv that creates the app's infrastructure (app.yaml). `templateFile`
+ * defaults to the canonical repo-relative path; `init` passes the resolved
+ * package-bundled path so it works from a consumer repo that carries no IaC.
+ */
+export declare function deployStackArgs(cfg: DeployConfig, templateFile?: string): string[];
 /**
  * The one-time `aws cloudformation deploy` command that creates the app's
  * infrastructure (app.yaml), from the in-repo template. `rastack init` runs this
  * for you; it is also printed by `--print` so it can be run by hand.
  */
-export declare function deployStackCommand(cfg: DeployConfig): string;
+export declare function deployStackCommand(cfg: DeployConfig, templateFile?: string): string;
 /**
  * The tier-0 bootstrap stack (bootstrap.yaml) — the S3 buckets that hold the
  * Lambda placeholder + hosted templates, and the GitHub OIDC provider. One per
@@ -160,10 +171,15 @@ export declare function bootstrapStackName(cfg: DeployConfig): string;
  * the template then derives the existing provider's ARN itself.
  */
 export declare function bootstrapStackParameters(cfg: DeployConfig, reuseOidc?: boolean): StackParameter[];
-/** The argv that creates the bootstrap stack (bootstrap.yaml). */
-export declare function bootstrapStackArgs(cfg: DeployConfig, reuseOidc?: boolean): string[];
+/**
+ * The argv that creates the bootstrap stack (bootstrap.yaml). `templateFile`
+ * defaults to the canonical repo-relative path; `init`/`bootstrap` pass the
+ * resolved package-bundled path so it works from a consumer repo that carries no
+ * IaC.
+ */
+export declare function bootstrapStackArgs(cfg: DeployConfig, reuseOidc?: boolean, templateFile?: string): string[];
 /** The one-time `aws cloudformation deploy` command that creates the bootstrap stack. */
-export declare function bootstrapStackCommand(cfg: DeployConfig, reuseOidc?: boolean): string;
+export declare function bootstrapStackCommand(cfg: DeployConfig, reuseOidc?: boolean, templateFile?: string): string;
 /** Stack Output keys `init` reads back off the bootstrap stack. */
 export declare const BOOTSTRAP_ARTIFACTS_OUTPUT = "ArtifactsBucketName";
 export declare const BOOTSTRAP_TEMPLATES_OUTPUT = "TemplatesBucketName";

package/dist/deploy/config.js

@@ -232,7 +232,14 @@ function stackParameters(cfg) {
         params.push({ key: "AdvancedSecurity", value: "OFF" });
     return params;
 }
-/** The in-repo CloudFormation templates `rastack init` deploys from. */
+/**
+ * The canonical repo-relative CloudFormation template paths. These are the paths
+ * in the *framework* repo (theserverkid/reactapistack) and the default the argv
+ * builders below embed. A **consumer** repo (the demo, any app) deliberately does
+ * NOT carry a copy of the framework IaC — the templates ship inside the `rastack`
+ * package instead — so `init`/`bootstrap` resolve the real on-disk path via
+ * `resolveDeployAsset` (io.ts) and pass it in as the `templateFile` override.
+ */
 exports.APP_TEMPLATE_FILE = "deploy/cloudformation/app.yaml";
 exports.BOOTSTRAP_TEMPLATE_FILE = "deploy/cloudformation/bootstrap.yaml";
 /**
@@ -244,7 +251,8 @@ exports.BOOTSTRAP_TEMPLATE_FILE = "deploy/cloudformation/bootstrap.yaml";
  * accepts *only* a local template file. `--template-url` is exclusive to the
  * low-level `create-stack`/`update-stack`/`create-change-set` commands, so
  * pairing it with `deploy` fails with `the following arguments are required:
- * --template-file`. `init` runs in the repo, where both templates are present.
+ * --template-file`. The file is resolved from the `rastack` package (see
+ * `resolveDeployAsset`), so a consumer repo need not carry the framework IaC.
  */
 function cfnDeployArgs(templateFile, stackName, region, params) {
     return [
@@ -272,17 +280,21 @@ function cfnDeployArgs(templateFile, stackName, region, params) {
 function awsCommand(args) {
     return `aws ${args.join(" ")}`;
 }
-/** The argv that creates the app's infrastructure (app.yaml). */
-function deployStackArgs(cfg) {
-    return cfnDeployArgs(exports.APP_TEMPLATE_FILE, cfg.stackName, cfg.region, stackParameters(cfg));
+/**
+ * The argv that creates the app's infrastructure (app.yaml). `templateFile`
+ * defaults to the canonical repo-relative path; `init` passes the resolved
+ * package-bundled path so it works from a consumer repo that carries no IaC.
+ */
+function deployStackArgs(cfg, templateFile = exports.APP_TEMPLATE_FILE) {
+    return cfnDeployArgs(templateFile, cfg.stackName, cfg.region, stackParameters(cfg));
 }
 /**
  * The one-time `aws cloudformation deploy` command that creates the app's
  * infrastructure (app.yaml), from the in-repo template. `rastack init` runs this
  * for you; it is also printed by `--print` so it can be run by hand.
  */
-function deployStackCommand(cfg) {
-    return awsCommand(deployStackArgs(cfg));
+function deployStackCommand(cfg, templateFile = exports.APP_TEMPLATE_FILE) {
+    return awsCommand(deployStackArgs(cfg, templateFile));
 }
 /**
  * The tier-0 bootstrap stack (bootstrap.yaml) — the S3 buckets that hold the
@@ -309,13 +321,18 @@ function bootstrapStackParameters(cfg, reuseOidc = false) {
         params.push({ key: "CreateOIDCProvider", value: "false" });
     return params;
 }
-/** The argv that creates the bootstrap stack (bootstrap.yaml). */
-function bootstrapStackArgs(cfg, reuseOidc = false) {
-    return cfnDeployArgs(exports.BOOTSTRAP_TEMPLATE_FILE, bootstrapStackName(cfg), cfg.region, bootstrapStackParameters(cfg, reuseOidc));
+/**
+ * The argv that creates the bootstrap stack (bootstrap.yaml). `templateFile`
+ * defaults to the canonical repo-relative path; `init`/`bootstrap` pass the
+ * resolved package-bundled path so it works from a consumer repo that carries no
+ * IaC.
+ */
+function bootstrapStackArgs(cfg, reuseOidc = false, templateFile = exports.BOOTSTRAP_TEMPLATE_FILE) {
+    return cfnDeployArgs(templateFile, bootstrapStackName(cfg), cfg.region, bootstrapStackParameters(cfg, reuseOidc));
 }
 /** The one-time `aws cloudformation deploy` command that creates the bootstrap stack. */
-function bootstrapStackCommand(cfg, reuseOidc = false) {
-    return awsCommand(bootstrapStackArgs(cfg, reuseOidc));
+function bootstrapStackCommand(cfg, reuseOidc = false, templateFile = exports.BOOTSTRAP_TEMPLATE_FILE) {
+    return awsCommand(bootstrapStackArgs(cfg, reuseOidc, templateFile));
 }
 /** Stack Output keys `init` reads back off the bootstrap stack. */
 exports.BOOTSTRAP_ARTIFACTS_OUTPUT = "ArtifactsBucketName";

package/dist/deploy/io.d.ts

@@ -7,6 +7,21 @@ import * as readline from "readline";
 import { DeployConfig } from "./config";
 /** Absolute path to the deploy config for a project root. */
 export declare function configPath(cwd?: string): string;
+/**
+ * Resolve a CloudFormation asset (`app.yaml`, `bootstrap.yaml`, or the
+ * `placeholder/bootstrap` Lambda bundle) to an absolute on-disk path.
+ *
+ * The templates are the **framework's** IaC, not the consumer's — the demo repo
+ * and every future app repo deliberately do not carry a copy (see
+ * deploy/cloudformation/README.md). So `init`/`bootstrap`, which run in those
+ * repos, cannot assume `deploy/cloudformation/<asset>` exists relative to the
+ * cwd — that is exactly the `Invalid template path deploy/cloudformation/…`
+ * failure. Instead the assets ship *inside* the `rastack` package (copied into
+ * `dist/templates/cloudformation/` at build time) and are resolved from the
+ * install location, with fallbacks so running from source or from the framework
+ * repo itself still works. Returns null when no candidate exists.
+ */
+export declare function resolveDeployAsset(relPath: string, cwd?: string): string | null;
 /** Read + normalize the deploy config, or null when it does not exist yet. */
 export declare function loadConfig(cwd?: string): DeployConfig | null;
 /** Write the deploy config, creating `.rastack/` if needed. */

package/dist/deploy/io.js

@@ -39,6 +39,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.configPath = configPath;
+exports.resolveDeployAsset = resolveDeployAsset;
 exports.loadConfig = loadConfig;
 exports.saveConfig = saveConfig;
 exports.gitRemoteUrl = gitRemoteUrl;
@@ -66,6 +67,35 @@ const zip_1 = require("./zip");
 function configPath(cwd = process.cwd()) {
     return path.join(cwd, workflows_1.CONFIG_PATH);
 }
+/**
+ * Resolve a CloudFormation asset (`app.yaml`, `bootstrap.yaml`, or the
+ * `placeholder/bootstrap` Lambda bundle) to an absolute on-disk path.
+ *
+ * The templates are the **framework's** IaC, not the consumer's — the demo repo
+ * and every future app repo deliberately do not carry a copy (see
+ * deploy/cloudformation/README.md). So `init`/`bootstrap`, which run in those
+ * repos, cannot assume `deploy/cloudformation/<asset>` exists relative to the
+ * cwd — that is exactly the `Invalid template path deploy/cloudformation/…`
+ * failure. Instead the assets ship *inside* the `rastack` package (copied into
+ * `dist/templates/cloudformation/` at build time) and are resolved from the
+ * install location, with fallbacks so running from source or from the framework
+ * repo itself still works. Returns null when no candidate exists.
+ */
+function resolveDeployAsset(relPath, cwd = process.cwd()) {
+    const candidates = [
+        // Installed package: dist/deploy/io.js → dist/templates/cloudformation/…
+        path.join(__dirname, "..", "templates", "cloudformation", relPath),
+        // Running from TS source: tools/src/deploy/io.ts → repo-root deploy/…
+        path.join(__dirname, "..", "..", "..", "deploy", "cloudformation", relPath),
+        // Invoked inside the framework repo itself (cwd is the repo root).
+        path.join(cwd, "deploy", "cloudformation", relPath),
+    ];
+    for (const candidate of candidates) {
+        if (fs.existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
 /** Read + normalize the deploy config, or null when it does not exist yet. */
 function loadConfig(cwd = process.cwd()) {
     const file = configPath(cwd);
@@ -161,8 +191,8 @@ function stackOutput(stackName, key, region) {
  * on every `init`. Returns false when the placeholder file is missing.
  */
 function uploadPlaceholder(artifactsBucket, region, cwd = process.cwd()) {
-    const src = path.join(cwd, "deploy/cloudformation/placeholder/bootstrap");
-    if (!fs.existsSync(src))
+    const src = resolveDeployAsset("placeholder/bootstrap", cwd);
+    if (!src)
         return false;
     const zip = (0, zip_1.zipStore)([
         { name: "bootstrap", data: fs.readFileSync(src), mode: 0o755 },

package/dist/rastack-bootstrap.d.ts

@@ -8,7 +8,8 @@
  *                     [--region <r>] [--prefix <p>]
  *                     [--reuse-oidc] [--print] [--yes]
  *
- * It deploys `deploy/cloudformation/bootstrap.yaml`, which creates:
+ * It deploys the `bootstrap.yaml` template bundled with the `rastack` package
+ * (resolved by `resolveDeployAsset`, so it works from any repo), which creates:
  *   • the S3 buckets that hold the Lambda placeholder + hosted templates, and
  *   • the GitHub OIDC provider + trust that lets CI assume a deploy role.
  * It then uploads the Lambda placeholder bundle to the artifacts bucket, so the

package/dist/rastack-bootstrap.js

@@ -9,7 +9,8 @@
  *                     [--region <r>] [--prefix <p>]
  *                     [--reuse-oidc] [--print] [--yes]
  *
- * It deploys `deploy/cloudformation/bootstrap.yaml`, which creates:
+ * It deploys the `bootstrap.yaml` template bundled with the `rastack` package
+ * (resolved by `resolveDeployAsset`, so it works from any repo), which creates:
  *   • the S3 buckets that hold the Lambda placeholder + hosted templates, and
  *   • the GitHub OIDC provider + trust that lets CI assume a deploy role.
  * It then uploads the Lambda placeholder bundle to the artifacts bucket, so the
@@ -116,8 +117,9 @@ async function confirm(question) {
 /** Print the exact command `bootstrap` would run, without touching the cloud. */
 function printPlan(cfg, reuseOidc) {
     console.log(`\n  Bootstrap plan (${(0, config_1.bootstrapStackName)(cfg)} @ ${cfg.region})\n`);
+    const template = (0, io_1.resolveDeployAsset)("bootstrap.yaml") ?? undefined;
     console.log("  ── Tier-0 bootstrap stack (bootstrap.yaml) ──");
-    console.log("\n  " + (0, config_1.bootstrapStackCommand)(cfg, reuseOidc) + "\n");
+    console.log("\n  " + (0, config_1.bootstrapStackCommand)(cfg, reuseOidc, template) + "\n");
     console.log("  Then `rastack init` (or `rastack bootstrap` again) resolves this stack's\n" +
         "  ArtifactsBucket to create app backends. Nothing here is app-specific.\n");
 }
@@ -127,8 +129,14 @@ function printPlan(cfg, reuseOidc) {
  * already ask to reuse it.
  */
 function deployBootstrap(cfg, reuseOidc) {
+    const template = (0, io_1.resolveDeployAsset)("bootstrap.yaml");
+    if (!template) {
+        console.error("  ✗ bootstrap.yaml template not found in the rastack package. Reinstall\n" +
+            "    rastack (`npm i -g rastack`) or run from the framework repo.");
+        process.exit(1);
+    }
     try {
-        (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, reuseOidc));
+        (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, reuseOidc, template));
     }
     catch (err) {
         if (reuseOidc) {
@@ -140,7 +148,7 @@ function deployBootstrap(cfg, reuseOidc) {
         // second (which CloudFormation rejects).
         console.log("  • retrying bootstrap, reusing the account's existing GitHub OIDC provider");
         try {
-            (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, true));
+            (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, true, template));
         }
         catch (retryErr) {
             console.error(`\n  ✗ bootstrap stack deploy failed.\n    ${retryErr.message}`);
@@ -177,8 +185,8 @@ function standUp(cfg, reuseOidc) {
     // account is ready for `rastack init` without a second manual step.
     console.log("\n▸ Uploading the Lambda placeholder bundle");
     if (!(0, io_1.uploadPlaceholder)(artifactsBucket, cfg.region)) {
-        console.error("  ✗ deploy/cloudformation/placeholder/bootstrap not found — the placeholder\n" +
-            "    was not uploaded. `rastack init` will upload it on the first app deploy.");
+        console.error("  ✗ Lambda placeholder bundle not found in the rastack package — the\n" +
+            "    placeholder was not uploaded. `rastack init` will upload it on the first app deploy.");
     }
     else {
         console.log("  ✓ placeholder uploaded");

package/dist/rastack-init.js

@@ -187,11 +187,13 @@ function printPlan(cfg) {
     const withBucket = (0, config_1.mergeConfig)(cfg, {
         artifactsBucket: bucket ?? "<ArtifactsBucketName from bootstrap stack>",
     });
+    const bootstrapTemplate = (0, io_1.resolveDeployAsset)("bootstrap.yaml") ?? undefined;
+    const appTemplate = (0, io_1.resolveDeployAsset)("app.yaml") ?? undefined;
     console.log(`\n  Deployment plan (${cfg.stackName} @ ${cfg.region})\n`);
     console.log(`  ── 1. Bootstrap stack (${(0, config_1.bootstrapStackName)(cfg)}) — run only if it does not exist ──`);
-    console.log("\n  " + (0, config_1.bootstrapStackCommand)(cfg) + "\n");
+    console.log("\n  " + (0, config_1.bootstrapStackCommand)(cfg, false, bootstrapTemplate) + "\n");
     console.log("  ── 2. Per-app backend (app.yaml) ──");
-    console.log("\n  " + (0, config_1.deployStackCommand)(withBucket) + "\n");
+    console.log("\n  " + (0, config_1.deployStackCommand)(withBucket, appTemplate) + "\n");
     console.log("  ── 3. Wire these GitHub repo Variables from the stack Outputs ──");
     console.log(table((0, config_1.repoVariables)(cfg).map((v) => ({
         key: v.name,
@@ -226,7 +228,7 @@ async function standUp(cfg, interactive) {
     // 2. Upload the placeholder the function is created from.
     console.log("\n▸ Uploading the Lambda placeholder bundle");
     if (!(0, io_1.uploadPlaceholder)(artifactsBucket, cfg.region)) {
-        console.error("  ✗ deploy/cloudformation/placeholder/bootstrap not found — cannot create the function.");
+        console.error("  ✗ Lambda placeholder bundle not found in the rastack package — cannot create the function.");
         process.exit(1);
     }
     // 3. Deploy the per-app backend with the resolved bucket wired in.
@@ -234,9 +236,15 @@ async function standUp(cfg, interactive) {
         artifactsBucket,
         templatesBucket: templatesBucket ?? undefined,
     });
+    const appTemplate = (0, io_1.resolveDeployAsset)("app.yaml");
+    if (!appTemplate) {
+        console.error("  ✗ app.yaml template not found in the rastack package. Reinstall rastack\n" +
+            "    (`npm i -g rastack`) or run from the framework repo.");
+        process.exit(1);
+    }
     console.log(`\n▸ Deploying ${cfg.stackName}`);
     try {
-        (0, io_1.awsRun)((0, config_1.deployStackArgs)(cfg));
+        (0, io_1.awsRun)((0, config_1.deployStackArgs)(cfg, appTemplate));
     }
     catch (err) {
         console.error(`\n  ✗ aws cloudformation deploy failed for ${cfg.stackName}.\n    ${err.message}`);
@@ -299,8 +307,14 @@ function wireRepoVariables(cfg, interactive) {
 }
 /** Deploy the bootstrap stack, retrying once against an existing OIDC provider. */
 function deployBootstrap(cfg) {
+    const template = (0, io_1.resolveDeployAsset)("bootstrap.yaml");
+    if (!template) {
+        console.error("  ✗ bootstrap.yaml template not found in the rastack package. Reinstall\n" +
+            "    rastack (`npm i -g rastack`) or run from the framework repo.");
+        process.exit(1);
+    }
     try {
-        (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg));
+        (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, false, template));
     }
     catch {
         // The most common cause is an account that already has a GitHub OIDC
@@ -308,7 +322,7 @@ function deployBootstrap(cfg) {
         // reuse it instead of creating a second.
         console.log("  • retrying bootstrap, reusing the account's existing GitHub OIDC provider");
         try {
-            (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, true));
+            (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, true, template));
         }
         catch (err) {
             console.error(`\n  ✗ bootstrap stack deploy failed.\n    ${err.message}`);

package/dist/rastack-update.js

@@ -56,6 +56,12 @@ const path = __importStar(require("path"));
 const update_1 = require("./update");
 /** The npm executable for this platform (`npm.cmd` on Windows, else `npm`). */
 const NPM = (0, update_1.npmBinary)();
+/**
+ * Whether to launch npm through a shell. Required on Windows, where a bare
+ * `.cmd` spawn is rejected with `EINVAL` since the Node CVE-2024-27980 fix;
+ * false on POSIX so the direct spawn stays injection-free.
+ */
+const NPM_SHELL = (0, update_1.npmSpawnShell)();
 /** The installed rastack package directory (…/rastack), one up from dist/. */
 const PKG_DIR = path.join(__dirname, "..");
 const PKG_JSON = path.join(PKG_DIR, "package.json");
@@ -73,6 +79,7 @@ function npmCapture(args) {
     try {
         return (0, child_process_1.execFileSync)(NPM, args, {
             stdio: ["ignore", "pipe", "pipe"],
+            shell: NPM_SHELL,
         })
             .toString()
             .trim();
@@ -118,10 +125,12 @@ function main(argv) {
     }
     console.log(`\n▸ Updating rastack (${current} → ${flags.version}) in ${prefix}\n`);
     try {
-        // Re-runs the developer's own npm to update this global package — no
-        // untrusted input, and execFileSync (no shell) avoids any injection.
+        // Re-runs the developer's own npm to update this global package. On Windows
+        // the `.cmd` shim is launched through a shell (EINVAL otherwise); the only
+        // caller-supplied token — the version — is sanitized in `parseUpdateFlags`,
+        // and every other arg is a fixed literal, so nothing injectable reaches it.
         // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-        (0, child_process_1.execFileSync)(NPM, args, { stdio: "inherit", env });
+        (0, child_process_1.execFileSync)(NPM, args, { stdio: "inherit", env, shell: NPM_SHELL });
     }
     catch (err) {
         console.error(`\n  ✗ npm failed to update rastack. Re-run for detail:\n    npm install -g ${(0, update_1.npmInstallArgs)(flags.version)[2]}\n    ${err.message}`);