rastack 0.0.41 → 0.0.43

package/src/rastack-bootstrap.ts

@@ -9,7 +9,8 @@
  *                     [--region <r>] [--prefix <p>]
  *                     [--reuse-oidc] [--print] [--yes]
  *
- * It deploys `deploy/cloudformation/bootstrap.yaml`, which creates:
+ * It deploys the `bootstrap.yaml` template bundled with the `rastack` package
+ * (resolved by `resolveDeployAsset`, so it works from any repo), which creates:
  *   • the S3 buckets that hold the Lambda placeholder + hosted templates, and
  *   • the GitHub OIDC provider + trust that lets CI assume a deploy role.
  * It then uploads the Lambda placeholder bundle to the artifacts bucket, so the
@@ -43,6 +44,7 @@ import {
   canPrompt,
   gitRemoteUrl,
   loadConfig,
+  resolveDeployAsset,
   stackOutput,
   uploadPlaceholder,
   withPrompt,
@@ -152,8 +154,9 @@ function printPlan(cfg: DeployConfig, reuseOidc: boolean): void {
   console.log(
     `\n  Bootstrap plan (${bootstrapStackName(cfg)} @ ${cfg.region})\n`,
   );
+  const template = resolveDeployAsset("bootstrap.yaml") ?? undefined;
   console.log("  ── Tier-0 bootstrap stack (bootstrap.yaml) ──");
-  console.log("\n  " + bootstrapStackCommand(cfg, reuseOidc) + "\n");
+  console.log("\n  " + bootstrapStackCommand(cfg, reuseOidc, template) + "\n");
   console.log(
     "  Then `rastack init` (or `rastack bootstrap` again) resolves this stack's\n" +
       "  ArtifactsBucket to create app backends. Nothing here is app-specific.\n",
@@ -166,8 +169,16 @@ function printPlan(cfg: DeployConfig, reuseOidc: boolean): void {
  * already ask to reuse it.
  */
 function deployBootstrap(cfg: DeployConfig, reuseOidc: boolean): void {
+  const template = resolveDeployAsset("bootstrap.yaml");
+  if (!template) {
+    console.error(
+      "  ✗ bootstrap.yaml template not found in the rastack package. Reinstall\n" +
+        "    rastack (`npm i -g rastack`) or run from the framework repo.",
+    );
+    process.exit(1);
+  }
   try {
-    awsRun(bootstrapStackArgs(cfg, reuseOidc));
+    awsRun(bootstrapStackArgs(cfg, reuseOidc, template));
   } catch (err) {
     if (reuseOidc) {
       console.error(
@@ -182,7 +193,7 @@ function deployBootstrap(cfg: DeployConfig, reuseOidc: boolean): void {
       "  • retrying bootstrap, reusing the account's existing GitHub OIDC provider",
     );
     try {
-      awsRun(bootstrapStackArgs(cfg, true));
+      awsRun(bootstrapStackArgs(cfg, true, template));
     } catch (retryErr) {
       console.error(
         `\n  ✗ bootstrap stack deploy failed.\n    ${(retryErr as Error).message}`,
@@ -237,8 +248,8 @@ function standUp(cfg: DeployConfig, reuseOidc: boolean): void {
   console.log("\n▸ Uploading the Lambda placeholder bundle");
   if (!uploadPlaceholder(artifactsBucket, cfg.region)) {
     console.error(
-      "  ✗ deploy/cloudformation/placeholder/bootstrap not found — the placeholder\n" +
-        "    was not uploaded. `rastack init` will upload it on the first app deploy.",
+      "  ✗ Lambda placeholder bundle not found in the rastack package — the\n" +
+        "    placeholder was not uploaded. `rastack init` will upload it on the first app deploy.",
     );
   } else {
     console.log("  ✓ placeholder uploaded");

package/src/rastack-init.ts

@@ -12,8 +12,9 @@
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
  *      (GitHub coordinates default from the `origin` remote; missing fields are
  *      prompted for on a TTY);
- *   2. resolves the tier-0 bootstrap stack's artifacts bucket — and CREATES the
- *      bootstrap stack if it does not exist yet;
+ *   2. resolves the tier-0 bootstrap stack's artifacts bucket — erroring with a
+ *      pointer to `rastack bootstrap` when that account+region stack is missing
+ *      (init is per-app and never creates account-level infrastructure);
  *   3. uploads the Lambda placeholder bundle to that bucket;
  *   4. deploys the per-app backend (app.yaml) with the resolved ArtifactsBucket;
  *   5. reads the stack Outputs back into the config and prints the two GitHub repo
@@ -33,8 +34,6 @@ import {
   DeployConfig,
   DeployOutputs,
   PartialDeployConfig,
-  bootstrapStackArgs,
-  bootstrapStackCommand,
   bootstrapStackName,
   deployStackArgs,
   deployStackCommand,
@@ -56,6 +55,7 @@ import {
   ghAvailable,
   gitRemoteUrl,
   loadConfig,
+  resolveDeployAsset,
   saveConfig,
   setRepoVariable,
   stackOutput,
@@ -209,15 +209,18 @@ function printPlan(cfg: DeployConfig): void {
   const withBucket = mergeConfig(cfg, {
     artifactsBucket: bucket ?? "<ArtifactsBucketName from bootstrap stack>",
   });
+  const appTemplate = resolveDeployAsset("app.yaml") ?? undefined;
   console.log(`\n  Deployment plan (${cfg.stackName} @ ${cfg.region})\n`);
   console.log(
-    `  ── 1. Bootstrap stack (${bootstrapStackName(cfg)}) — run only if it does not exist ──`,
+    `  ── Prerequisite: the tier-0 bootstrap stack (${bootstrapStackName(cfg)}) must exist ──`,
   );
-  console.log("\n  " + bootstrapStackCommand(cfg) + "\n");
-  console.log("  ── 2. Per-app backend (app.yaml) ──");
-  console.log("\n  " + deployStackCommand(withBucket) + "\n");
   console.log(
-    "  ── 3. Wire these GitHub repo Variables from the stack Outputs ──",
+    `  Create it once per account+region (init does not):  rastack bootstrap --region ${cfg.region}\n`,
+  );
+  console.log("  ── 1. Per-app backend (app.yaml) — what init deploys ──");
+  console.log("\n  " + deployStackCommand(withBucket, appTemplate) + "\n");
+  console.log(
+    "  ── 2. Wire these GitHub repo Variables from the stack Outputs ──",
   );
   console.log(
     table(
@@ -246,38 +249,32 @@ async function standUp(
     process.exit(1);
   }
 
-  // 1. Resolve the artifacts bucket; bootstrap the tier-0 stack if it is absent.
-  let artifactsBucket = stackOutput(
+  // 1. Resolve the artifacts bucket from the tier-0 bootstrap stack. That stack
+  //    is an account+region once-off — the S3 buckets that host the templates +
+  //    Lambda placeholder, and the GitHub OIDC provider. `init` is a per-app
+  //    command and deliberately does NOT create it: standing up account-level
+  //    infrastructure is `rastack bootstrap`'s job (run once by an account admin),
+  //    so a missing bootstrap stack is a clear, actionable error, not an implicit
+  //    account mutation buried inside an app deploy.
+  const artifactsBucket = stackOutput(
     bootstrapStackName(cfg),
     BOOTSTRAP_ARTIFACTS_OUTPUT,
     cfg.region,
   );
-  let templatesBucket = stackOutput(
+  const templatesBucket = stackOutput(
     bootstrapStackName(cfg),
     BOOTSTRAP_TEMPLATES_OUTPUT,
     cfg.region,
   );
   if (!artifactsBucket) {
-    console.log(
-      `\n▸ Bootstrap stack ${bootstrapStackName(cfg)} not found — creating it (once per account+region).`,
-    );
-    deployBootstrap(cfg);
-    artifactsBucket = stackOutput(
-      bootstrapStackName(cfg),
-      BOOTSTRAP_ARTIFACTS_OUTPUT,
-      cfg.region,
-    );
-    templatesBucket = stackOutput(
-      bootstrapStackName(cfg),
-      BOOTSTRAP_TEMPLATES_OUTPUT,
-      cfg.region,
+    console.error(
+      `\n  ✗ Bootstrap stack ${bootstrapStackName(cfg)} not found in ${cfg.region}.\n` +
+        "    It is the once-per-account+region step that hosts the CloudFormation\n" +
+        "    templates and the Lambda placeholder every app deploy reads. Create it\n" +
+        "    first (an account admin does this once), then re-run `rastack init`:\n\n" +
+        `      rastack bootstrap --region ${cfg.region}\n`,
     );
-    if (!artifactsBucket) {
-      console.error(
-        "  ✗ bootstrap stack created but its ArtifactsBucket output could not be read.",
-      );
-      process.exit(1);
-    }
+    process.exit(1);
   }
   console.log(`  ✓ artifacts bucket: ${artifactsBucket}`);
 
@@ -285,7 +282,7 @@ async function standUp(
   console.log("\n▸ Uploading the Lambda placeholder bundle");
   if (!uploadPlaceholder(artifactsBucket, cfg.region)) {
     console.error(
-      "  ✗ deploy/cloudformation/placeholder/bootstrap not found — cannot create the function.",
+      "  ✗ Lambda placeholder bundle not found in the rastack package — cannot create the function.",
     );
     process.exit(1);
   }
@@ -295,9 +292,17 @@ async function standUp(
     artifactsBucket,
     templatesBucket: templatesBucket ?? undefined,
   });
+  const appTemplate = resolveDeployAsset("app.yaml");
+  if (!appTemplate) {
+    console.error(
+      "  ✗ app.yaml template not found in the rastack package. Reinstall rastack\n" +
+        "    (`npm i -g rastack`) or run from the framework repo.",
+    );
+    process.exit(1);
+  }
   console.log(`\n▸ Deploying ${cfg.stackName}`);
   try {
-    awsRun(deployStackArgs(cfg));
+    awsRun(deployStackArgs(cfg, appTemplate));
   } catch (err) {
     console.error(
       `\n  ✗ aws cloudformation deploy failed for ${cfg.stackName}.\n    ${(err as Error).message}`,
@@ -370,28 +375,6 @@ function wireRepoVariables(cfg: DeployConfig, interactive: boolean): void {
   }
 }
 
-/** Deploy the bootstrap stack, retrying once against an existing OIDC provider. */
-function deployBootstrap(cfg: DeployConfig): void {
-  try {
-    awsRun(bootstrapStackArgs(cfg));
-  } catch {
-    // The most common cause is an account that already has a GitHub OIDC
-    // provider (only one is allowed per URL). Retry telling the template to
-    // reuse it instead of creating a second.
-    console.log(
-      "  • retrying bootstrap, reusing the account's existing GitHub OIDC provider",
-    );
-    try {
-      awsRun(bootstrapStackArgs(cfg, true));
-    } catch (err) {
-      console.error(
-        `\n  ✗ bootstrap stack deploy failed.\n    ${(err as Error).message}`,
-      );
-      process.exit(1);
-    }
-  }
-}
-
 function printSummary(cfg: DeployConfig): void {
   console.log(
     `\n  ✓ ${cfg.app} is deployed (${cfg.stackName} @ ${cfg.region})`,
@@ -483,7 +466,7 @@ async function main(argv: string[]): Promise<void> {
 
   if (canPrompt()) {
     const ok = await confirm(
-      `Deploy ${cfg.stackName} to AWS ${cfg.region} now? (creates the bootstrap stack if needed) [y/N]`,
+      `Deploy ${cfg.stackName} to AWS ${cfg.region} now? (requires the bootstrap stack to exist) [y/N]`,
     );
     if (!ok) {
       console.log(

package/src/rastack-update.ts

@@ -17,13 +17,14 @@
  * global location. Pure decisions live in `update.ts`; this is the IO wrapper.
  */
 
-import { execFileSync } from "child_process";
+import { execFileSync, execSync } from "child_process";
 import { readFileSync } from "fs";
 import * as path from "path";
 import {
   globalPrefixFromPackageDir,
   npmBinary,
   npmInstallArgs,
+  npmShellCommand,
   npmSpawnShell,
   parseUpdateFlags,
   updateAvailable,
@@ -52,15 +53,28 @@ function readVersion(file: string): string {
   }
 }
 
+/**
+ * Run npm and return stdout, or throw on failure. Windows must launch the
+ * `npm.cmd` shim through a shell; we pass one command string to `execSync`
+ * rather than an args array with `shell: true` (Node 22+ DEP0190 — args would be
+ * concatenated unescaped). The only non-literal token, the version, is already
+ * sanitized (`sanitizeVersion`). POSIX keeps the shell-free `execFile`.
+ */
+function runNpm(
+  args: string[],
+  opts: { stdio: "inherit" | ["ignore", "pipe", "pipe"]; env?: NodeJS.ProcessEnv },
+): Buffer | null {
+  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+  return NPM_SHELL
+    ? execSync(npmShellCommand(NPM, args), opts)
+    : execFileSync(NPM, args, opts);
+}
+
 /** Capture `npm <args>` stdout, or null when npm is absent / the call fails. */
 function npmCapture(args: string[]): string | null {
   try {
-    return execFileSync(NPM, args, {
-      stdio: ["ignore", "pipe", "pipe"],
-      shell: NPM_SHELL,
-    })
-      .toString()
-      .trim();
+    const out = runNpm(args, { stdio: ["ignore", "pipe", "pipe"] });
+    return (out ?? "").toString().trim();
   } catch {
     return null;
   }
@@ -116,8 +130,7 @@ function main(argv: string[]): void {
     // the `.cmd` shim is launched through a shell (EINVAL otherwise); the only
     // caller-supplied token — the version — is sanitized in `parseUpdateFlags`,
     // and every other arg is a fixed literal, so nothing injectable reaches it.
-    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-    execFileSync(NPM, args, { stdio: "inherit", env, shell: NPM_SHELL });
+    runNpm(args, { stdio: "inherit", env });
   } catch (err) {
     console.error(
       `\n  ✗ npm failed to update rastack. Re-run for detail:\n    npm install -g ${npmInstallArgs(flags.version)[2]}\n    ${(err as Error).message}`,

package/src/update.ts

@@ -90,6 +90,20 @@ export function npmSpawnShell(platform: string = process.platform): boolean {
   return platform === "win32";
 }
 
+/**
+ * The single command string used to launch npm on platforms that must go through
+ * a shell (Windows — see `npmSpawnShell`). Node 22+ deprecates passing an args
+ * *array* together with `shell: true` (DEP0190: the args are concatenated, not
+ * escaped), so the shell path builds one string and runs it via `execSync`
+ * instead. Joining with spaces is safe here because every token is a fixed
+ * literal except the version, which `sanitizeVersion` constrains to
+ * `[A-Za-z0-9._-]` (no shell metacharacters). POSIX never uses this — it keeps
+ * the shell-free, array-based `execFile`, which has no concatenation at all.
+ */
+export function npmShellCommand(binary: string, args: string[]): string {
+  return [binary, ...args].join(" ");
+}
+
 /** The npm package spec to install for a target version. */
 export function installSpec(version: string): string {
   return !version || version === "latest" ? "rastack" : `rastack@${version}`;

package/test/deploy.spec.ts

@@ -243,6 +243,19 @@ describe("stack parameters + launch command", () => {
       "deploy",
     ]);
   });
+
+  it("accepts a template-file override (the package-resolved path)", () => {
+    // `init` runs in a consumer repo that carries no framework IaC, so it passes
+    // the path the template was resolved to inside the `rastack` package.
+    const cfg = base({ artifactsBucket: "art" });
+    const abs = "/opt/rastack/dist/templates/cloudformation/app.yaml";
+    expect(deployStackArgs(cfg, abs)).toContain(abs);
+    expect(deployStackCommand(cfg, abs)).toContain(`--template-file ${abs}`);
+    // Default is unchanged when no override is given.
+    expect(deployStackCommand(cfg)).toContain(
+      "--template-file deploy/cloudformation/app.yaml",
+    );
+  });
 });
 
 describe("bootstrap stack", () => {
@@ -281,6 +294,21 @@ describe("bootstrap stack", () => {
     expect(`aws ${bootstrapStackArgs(base()).join(" ")}`).toBe(cmd);
   });
 
+  it("accepts a template-file override (the package-resolved path)", () => {
+    const abs = "/opt/rastack/dist/templates/cloudformation/bootstrap.yaml";
+    expect(bootstrapStackArgs(base(), false, abs)).toContain(abs);
+    expect(bootstrapStackCommand(base(), true, abs)).toContain(
+      `--template-file ${abs}`,
+    );
+    // Reuse-OIDC + override compose without disturbing the default path.
+    expect(bootstrapStackArgs(base(), true, abs)).toContain(
+      "CreateOIDCProvider=false",
+    );
+    expect(bootstrapStackCommand(base())).toContain(
+      "--template-file deploy/cloudformation/bootstrap.yaml",
+    );
+  });
+
   it("validates only the account-level fields, not the per-app ones", () => {
     // A config with no `app` is fine for bootstrap — it never touches app.yaml.
     const cfg = normalizeConfig({
@@ -513,3 +541,28 @@ describe("scaffold", () => {
     expect(files.map((f) => f.path)).toEqual([CONFIG_PATH]);
   });
 });
+
+describe("resolveDeployAsset — bundled template resolution", () => {
+  // eslint-disable-next-line @typescript-eslint/no-var-requires
+  const { resolveDeployAsset } = require("../src/deploy/io");
+  const path = require("path");
+
+  it("resolves the framework templates to an existing file", () => {
+    for (const name of ["app.yaml", "bootstrap.yaml"]) {
+      const resolved = resolveDeployAsset(name);
+      expect(resolved).not.toBeNull();
+      expect(path.isAbsolute(resolved)).toBe(true);
+      expect(resolved.endsWith(name)).toBe(true);
+    }
+  });
+
+  it("resolves the Lambda placeholder bundle", () => {
+    const resolved = resolveDeployAsset(path.join("placeholder", "bootstrap"));
+    expect(resolved).not.toBeNull();
+    expect(resolved.endsWith(path.join("placeholder", "bootstrap"))).toBe(true);
+  });
+
+  it("returns null for an asset that does not exist", () => {
+    expect(resolveDeployAsset("does-not-exist.yaml")).toBeNull();
+  });
+});

package/test/update.spec.ts

@@ -4,6 +4,7 @@ import {
   installSpec,
   npmBinary,
   npmInstallArgs,
+  npmShellCommand,
   npmSpawnShell,
   parseUpdateFlags,
   sanitizeVersion,
@@ -67,6 +68,18 @@ describe("update — npm spec + args", () => {
     expect(npmSpawnShell("linux")).toBe(false);
     expect(npmSpawnShell("darwin")).toBe(false);
   });
+
+  it("joins the shell command as one string (avoids the Node DEP0190 warning)", () => {
+    // The Windows path runs npm via `execSync(<string>)` rather than
+    // `execFileSync(npm, args, { shell: true })`, which Node 22+ deprecates
+    // (args concatenated, not escaped). The sanitized version keeps it safe.
+    expect(npmShellCommand("npm.cmd", npmInstallArgs("latest"))).toBe(
+      "npm.cmd install -g rastack --no-fund --no-audit --loglevel=error",
+    );
+    expect(npmShellCommand("npm.cmd", npmInstallArgs("0.0.42"))).toContain(
+      "rastack@0.0.42",
+    );
+  });
 });
 
 describe("update — version sanitization", () => {