rastack 0.0.42 → 0.0.43

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.0.43](https://github.com/theserverkid/reactapistack/compare/v0.0.42...v0.0.43) (2026-07-12)
+
+
+### Bug Fixes
+
+* **init:** require the bootstrap stack instead of creating it ([085c59d](https://github.com/theserverkid/reactapistack/commit/085c59df4a61c5d28312edb7d0895c5b2f0442b5))
+* **update:** silence Node DEP0190 when launching npm on Windows ([959fe61](https://github.com/theserverkid/reactapistack/commit/959fe6177ec4e6e0d634e2751a1099717f2bda3b))
+
 ### [0.0.42](https://github.com/theserverkid/reactapistack/compare/v0.0.41...v0.0.42) (2026-07-12)
 
 

package/dist/rastack-init.d.ts

@@ -11,8 +11,9 @@
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
  *      (GitHub coordinates default from the `origin` remote; missing fields are
  *      prompted for on a TTY);
- *   2. resolves the tier-0 bootstrap stack's artifacts bucket — and CREATES the
- *      bootstrap stack if it does not exist yet;
+ *   2. resolves the tier-0 bootstrap stack's artifacts bucket — erroring with a
+ *      pointer to `rastack bootstrap` when that account+region stack is missing
+ *      (init is per-app and never creates account-level infrastructure);
  *   3. uploads the Lambda placeholder bundle to that bucket;
  *   4. deploys the per-app backend (app.yaml) with the resolved ArtifactsBucket;
  *   5. reads the stack Outputs back into the config and prints the two GitHub repo

package/dist/rastack-init.js

@@ -12,8 +12,9 @@
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
  *      (GitHub coordinates default from the `origin` remote; missing fields are
  *      prompted for on a TTY);
- *   2. resolves the tier-0 bootstrap stack's artifacts bucket — and CREATES the
- *      bootstrap stack if it does not exist yet;
+ *   2. resolves the tier-0 bootstrap stack's artifacts bucket — erroring with a
+ *      pointer to `rastack bootstrap` when that account+region stack is missing
+ *      (init is per-app and never creates account-level infrastructure);
  *   3. uploads the Lambda placeholder bundle to that bucket;
  *   4. deploys the per-app backend (app.yaml) with the resolved ArtifactsBucket;
  *   5. reads the stack Outputs back into the config and prints the two GitHub repo
@@ -187,14 +188,13 @@ function printPlan(cfg) {
     const withBucket = (0, config_1.mergeConfig)(cfg, {
         artifactsBucket: bucket ?? "<ArtifactsBucketName from bootstrap stack>",
     });
-    const bootstrapTemplate = (0, io_1.resolveDeployAsset)("bootstrap.yaml") ?? undefined;
     const appTemplate = (0, io_1.resolveDeployAsset)("app.yaml") ?? undefined;
     console.log(`\n  Deployment plan (${cfg.stackName} @ ${cfg.region})\n`);
-    console.log(`  ── 1. Bootstrap stack (${(0, config_1.bootstrapStackName)(cfg)}) — run only if it does not exist ──`);
-    console.log("\n  " + (0, config_1.bootstrapStackCommand)(cfg, false, bootstrapTemplate) + "\n");
-    console.log("  ── 2. Per-app backend (app.yaml) ──");
+    console.log(`  ── Prerequisite: the tier-0 bootstrap stack (${(0, config_1.bootstrapStackName)(cfg)}) must exist ──`);
+    console.log(`  Create it once per account+region (init does not):  rastack bootstrap --region ${cfg.region}\n`);
+    console.log("  ── 1. Per-app backend (app.yaml) — what init deploys ──");
     console.log("\n  " + (0, config_1.deployStackCommand)(withBucket, appTemplate) + "\n");
-    console.log("  ── 3. Wire these GitHub repo Variables from the stack Outputs ──");
+    console.log("  ── 2. Wire these GitHub repo Variables from the stack Outputs ──");
     console.log(table((0, config_1.repoVariables)(cfg).map((v) => ({
         key: v.name,
         value: v.value || `<${v.from}>`,
@@ -211,18 +211,22 @@ async function standUp(cfg, interactive) {
             "    or re-run with --print to see the commands, or --no-deploy to skip.");
         process.exit(1);
     }
-    // 1. Resolve the artifacts bucket; bootstrap the tier-0 stack if it is absent.
-    let artifactsBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
-    let templatesBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_TEMPLATES_OUTPUT, cfg.region);
+    // 1. Resolve the artifacts bucket from the tier-0 bootstrap stack. That stack
+    //    is an account+region once-off — the S3 buckets that host the templates +
+    //    Lambda placeholder, and the GitHub OIDC provider. `init` is a per-app
+    //    command and deliberately does NOT create it: standing up account-level
+    //    infrastructure is `rastack bootstrap`'s job (run once by an account admin),
+    //    so a missing bootstrap stack is a clear, actionable error, not an implicit
+    //    account mutation buried inside an app deploy.
+    const artifactsBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
+    const templatesBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_TEMPLATES_OUTPUT, cfg.region);
     if (!artifactsBucket) {
-        console.log(`\n▸ Bootstrap stack ${(0, config_1.bootstrapStackName)(cfg)} not found — creating it (once per account+region).`);
-        deployBootstrap(cfg);
-        artifactsBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
-        templatesBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_TEMPLATES_OUTPUT, cfg.region);
-        if (!artifactsBucket) {
-            console.error("  ✗ bootstrap stack created but its ArtifactsBucket output could not be read.");
-            process.exit(1);
-        }
+        console.error(`\n  ✗ Bootstrap stack ${(0, config_1.bootstrapStackName)(cfg)} not found in ${cfg.region}.\n` +
+            "    It is the once-per-account+region step that hosts the CloudFormation\n" +
+            "    templates and the Lambda placeholder every app deploy reads. Create it\n" +
+            "    first (an account admin does this once), then re-run `rastack init`:\n\n" +
+            `      rastack bootstrap --region ${cfg.region}\n`);
+        process.exit(1);
     }
     console.log(`  ✓ artifacts bucket: ${artifactsBucket}`);
     // 2. Upload the placeholder the function is created from.
@@ -305,31 +309,6 @@ function wireRepoVariables(cfg, interactive) {
         }
     }
 }
-/** Deploy the bootstrap stack, retrying once against an existing OIDC provider. */
-function deployBootstrap(cfg) {
-    const template = (0, io_1.resolveDeployAsset)("bootstrap.yaml");
-    if (!template) {
-        console.error("  ✗ bootstrap.yaml template not found in the rastack package. Reinstall\n" +
-            "    rastack (`npm i -g rastack`) or run from the framework repo.");
-        process.exit(1);
-    }
-    try {
-        (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, false, template));
-    }
-    catch {
-        // The most common cause is an account that already has a GitHub OIDC
-        // provider (only one is allowed per URL). Retry telling the template to
-        // reuse it instead of creating a second.
-        console.log("  • retrying bootstrap, reusing the account's existing GitHub OIDC provider");
-        try {
-            (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, true, template));
-        }
-        catch (err) {
-            console.error(`\n  ✗ bootstrap stack deploy failed.\n    ${err.message}`);
-            process.exit(1);
-        }
-    }
-}
 function printSummary(cfg) {
     console.log(`\n  ✓ ${cfg.app} is deployed (${cfg.stackName} @ ${cfg.region})`);
     if (cfg.outputs?.apiUrl)
@@ -399,7 +378,7 @@ async function main(argv) {
         return;
     }
     if ((0, io_1.canPrompt)()) {
-        const ok = await confirm(`Deploy ${cfg.stackName} to AWS ${cfg.region} now? (creates the bootstrap stack if needed) [y/N]`);
+        const ok = await confirm(`Deploy ${cfg.stackName} to AWS ${cfg.region} now? (requires the bootstrap stack to exist) [y/N]`);
         if (!ok) {
             console.log("\n  Skipped the deploy. Re-run to deploy, or `rastack init --print` for the commands.\n");
             return;

package/dist/rastack-update.js

@@ -74,15 +74,24 @@ function readVersion(file) {
         return "unknown";
     }
 }
+/**
+ * Run npm and return stdout, or throw on failure. Windows must launch the
+ * `npm.cmd` shim through a shell; we pass one command string to `execSync`
+ * rather than an args array with `shell: true` (Node 22+ DEP0190 — args would be
+ * concatenated unescaped). The only non-literal token, the version, is already
+ * sanitized (`sanitizeVersion`). POSIX keeps the shell-free `execFile`.
+ */
+function runNpm(args, opts) {
+    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+    return NPM_SHELL
+        ? (0, child_process_1.execSync)((0, update_1.npmShellCommand)(NPM, args), opts)
+        : (0, child_process_1.execFileSync)(NPM, args, opts);
+}
 /** Capture `npm <args>` stdout, or null when npm is absent / the call fails. */
 function npmCapture(args) {
     try {
-        return (0, child_process_1.execFileSync)(NPM, args, {
-            stdio: ["ignore", "pipe", "pipe"],
-            shell: NPM_SHELL,
-        })
-            .toString()
-            .trim();
+        const out = runNpm(args, { stdio: ["ignore", "pipe", "pipe"] });
+        return (out ?? "").toString().trim();
     }
     catch {
         return null;
@@ -129,8 +138,7 @@ function main(argv) {
         // the `.cmd` shim is launched through a shell (EINVAL otherwise); the only
         // caller-supplied token — the version — is sanitized in `parseUpdateFlags`,
         // and every other arg is a fixed literal, so nothing injectable reaches it.
-        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-        (0, child_process_1.execFileSync)(NPM, args, { stdio: "inherit", env, shell: NPM_SHELL });
+        runNpm(args, { stdio: "inherit", env });
     }
     catch (err) {
         console.error(`\n  ✗ npm failed to update rastack. Re-run for detail:\n    npm install -g ${(0, update_1.npmInstallArgs)(flags.version)[2]}\n    ${err.message}`);

package/dist/update.d.ts

@@ -52,6 +52,17 @@ export declare function npmBinary(platform?: string): string;
  * shell means no injection surface).
  */
 export declare function npmSpawnShell(platform?: string): boolean;
+/**
+ * The single command string used to launch npm on platforms that must go through
+ * a shell (Windows — see `npmSpawnShell`). Node 22+ deprecates passing an args
+ * *array* together with `shell: true` (DEP0190: the args are concatenated, not
+ * escaped), so the shell path builds one string and runs it via `execSync`
+ * instead. Joining with spaces is safe here because every token is a fixed
+ * literal except the version, which `sanitizeVersion` constrains to
+ * `[A-Za-z0-9._-]` (no shell metacharacters). POSIX never uses this — it keeps
+ * the shell-free, array-based `execFile`, which has no concatenation at all.
+ */
+export declare function npmShellCommand(binary: string, args: string[]): string;
 /** The npm package spec to install for a target version. */
 export declare function installSpec(version: string): string;
 /** The `npm <args>` (after the `npm` binary) that installs the target globally. */

package/dist/update.js

@@ -15,6 +15,7 @@ exports.parseUpdateFlags = parseUpdateFlags;
 exports.sanitizeVersion = sanitizeVersion;
 exports.npmBinary = npmBinary;
 exports.npmSpawnShell = npmSpawnShell;
+exports.npmShellCommand = npmShellCommand;
 exports.installSpec = installSpec;
 exports.npmInstallArgs = npmInstallArgs;
 exports.globalPrefixFromPackageDir = globalPrefixFromPackageDir;
@@ -88,6 +89,19 @@ function npmBinary(platform = process.platform) {
 function npmSpawnShell(platform = process.platform) {
     return platform === "win32";
 }
+/**
+ * The single command string used to launch npm on platforms that must go through
+ * a shell (Windows — see `npmSpawnShell`). Node 22+ deprecates passing an args
+ * *array* together with `shell: true` (DEP0190: the args are concatenated, not
+ * escaped), so the shell path builds one string and runs it via `execSync`
+ * instead. Joining with spaces is safe here because every token is a fixed
+ * literal except the version, which `sanitizeVersion` constrains to
+ * `[A-Za-z0-9._-]` (no shell metacharacters). POSIX never uses this — it keeps
+ * the shell-free, array-based `execFile`, which has no concatenation at all.
+ */
+function npmShellCommand(binary, args) {
+    return [binary, ...args].join(" ");
+}
 /** The npm package spec to install for a target version. */
 function installSpec(version) {
     return !version || version === "latest" ? "rastack" : `rastack@${version}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rastack",
-  "version": "0.0.42",
+  "version": "0.0.43",
   "description": "",
   "main": "runtime.ts",
   "types": "runtime.ts",

package/src/rastack-init.ts

@@ -12,8 +12,9 @@
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
  *      (GitHub coordinates default from the `origin` remote; missing fields are
  *      prompted for on a TTY);
- *   2. resolves the tier-0 bootstrap stack's artifacts bucket — and CREATES the
- *      bootstrap stack if it does not exist yet;
+ *   2. resolves the tier-0 bootstrap stack's artifacts bucket — erroring with a
+ *      pointer to `rastack bootstrap` when that account+region stack is missing
+ *      (init is per-app and never creates account-level infrastructure);
  *   3. uploads the Lambda placeholder bundle to that bucket;
  *   4. deploys the per-app backend (app.yaml) with the resolved ArtifactsBucket;
  *   5. reads the stack Outputs back into the config and prints the two GitHub repo
@@ -33,8 +34,6 @@ import {
   DeployConfig,
   DeployOutputs,
   PartialDeployConfig,
-  bootstrapStackArgs,
-  bootstrapStackCommand,
   bootstrapStackName,
   deployStackArgs,
   deployStackCommand,
@@ -210,17 +209,18 @@ function printPlan(cfg: DeployConfig): void {
   const withBucket = mergeConfig(cfg, {
     artifactsBucket: bucket ?? "<ArtifactsBucketName from bootstrap stack>",
   });
-  const bootstrapTemplate = resolveDeployAsset("bootstrap.yaml") ?? undefined;
   const appTemplate = resolveDeployAsset("app.yaml") ?? undefined;
   console.log(`\n  Deployment plan (${cfg.stackName} @ ${cfg.region})\n`);
   console.log(
-    `  ── 1. Bootstrap stack (${bootstrapStackName(cfg)}) — run only if it does not exist ──`,
+    `  ── Prerequisite: the tier-0 bootstrap stack (${bootstrapStackName(cfg)}) must exist ──`,
   );
-  console.log("\n  " + bootstrapStackCommand(cfg, false, bootstrapTemplate) + "\n");
-  console.log("  ── 2. Per-app backend (app.yaml) ──");
+  console.log(
+    `  Create it once per account+region (init does not):  rastack bootstrap --region ${cfg.region}\n`,
+  );
+  console.log("  ── 1. Per-app backend (app.yaml) — what init deploys ──");
   console.log("\n  " + deployStackCommand(withBucket, appTemplate) + "\n");
   console.log(
-    "  ── 3. Wire these GitHub repo Variables from the stack Outputs ──",
+    "  ── 2. Wire these GitHub repo Variables from the stack Outputs ──",
   );
   console.log(
     table(
@@ -249,38 +249,32 @@ async function standUp(
     process.exit(1);
   }
 
-  // 1. Resolve the artifacts bucket; bootstrap the tier-0 stack if it is absent.
-  let artifactsBucket = stackOutput(
+  // 1. Resolve the artifacts bucket from the tier-0 bootstrap stack. That stack
+  //    is an account+region once-off — the S3 buckets that host the templates +
+  //    Lambda placeholder, and the GitHub OIDC provider. `init` is a per-app
+  //    command and deliberately does NOT create it: standing up account-level
+  //    infrastructure is `rastack bootstrap`'s job (run once by an account admin),
+  //    so a missing bootstrap stack is a clear, actionable error, not an implicit
+  //    account mutation buried inside an app deploy.
+  const artifactsBucket = stackOutput(
     bootstrapStackName(cfg),
     BOOTSTRAP_ARTIFACTS_OUTPUT,
     cfg.region,
   );
-  let templatesBucket = stackOutput(
+  const templatesBucket = stackOutput(
     bootstrapStackName(cfg),
     BOOTSTRAP_TEMPLATES_OUTPUT,
     cfg.region,
   );
   if (!artifactsBucket) {
-    console.log(
-      `\n▸ Bootstrap stack ${bootstrapStackName(cfg)} not found — creating it (once per account+region).`,
-    );
-    deployBootstrap(cfg);
-    artifactsBucket = stackOutput(
-      bootstrapStackName(cfg),
-      BOOTSTRAP_ARTIFACTS_OUTPUT,
-      cfg.region,
-    );
-    templatesBucket = stackOutput(
-      bootstrapStackName(cfg),
-      BOOTSTRAP_TEMPLATES_OUTPUT,
-      cfg.region,
+    console.error(
+      `\n  ✗ Bootstrap stack ${bootstrapStackName(cfg)} not found in ${cfg.region}.\n` +
+        "    It is the once-per-account+region step that hosts the CloudFormation\n" +
+        "    templates and the Lambda placeholder every app deploy reads. Create it\n" +
+        "    first (an account admin does this once), then re-run `rastack init`:\n\n" +
+        `      rastack bootstrap --region ${cfg.region}\n`,
     );
-    if (!artifactsBucket) {
-      console.error(
-        "  ✗ bootstrap stack created but its ArtifactsBucket output could not be read.",
-      );
-      process.exit(1);
-    }
+    process.exit(1);
   }
   console.log(`  ✓ artifacts bucket: ${artifactsBucket}`);
 
@@ -381,36 +375,6 @@ function wireRepoVariables(cfg: DeployConfig, interactive: boolean): void {
   }
 }
 
-/** Deploy the bootstrap stack, retrying once against an existing OIDC provider. */
-function deployBootstrap(cfg: DeployConfig): void {
-  const template = resolveDeployAsset("bootstrap.yaml");
-  if (!template) {
-    console.error(
-      "  ✗ bootstrap.yaml template not found in the rastack package. Reinstall\n" +
-        "    rastack (`npm i -g rastack`) or run from the framework repo.",
-    );
-    process.exit(1);
-  }
-  try {
-    awsRun(bootstrapStackArgs(cfg, false, template));
-  } catch {
-    // The most common cause is an account that already has a GitHub OIDC
-    // provider (only one is allowed per URL). Retry telling the template to
-    // reuse it instead of creating a second.
-    console.log(
-      "  • retrying bootstrap, reusing the account's existing GitHub OIDC provider",
-    );
-    try {
-      awsRun(bootstrapStackArgs(cfg, true, template));
-    } catch (err) {
-      console.error(
-        `\n  ✗ bootstrap stack deploy failed.\n    ${(err as Error).message}`,
-      );
-      process.exit(1);
-    }
-  }
-}
-
 function printSummary(cfg: DeployConfig): void {
   console.log(
     `\n  ✓ ${cfg.app} is deployed (${cfg.stackName} @ ${cfg.region})`,
@@ -502,7 +466,7 @@ async function main(argv: string[]): Promise<void> {
 
   if (canPrompt()) {
     const ok = await confirm(
-      `Deploy ${cfg.stackName} to AWS ${cfg.region} now? (creates the bootstrap stack if needed) [y/N]`,
+      `Deploy ${cfg.stackName} to AWS ${cfg.region} now? (requires the bootstrap stack to exist) [y/N]`,
     );
     if (!ok) {
       console.log(

package/src/rastack-update.ts

@@ -17,13 +17,14 @@
  * global location. Pure decisions live in `update.ts`; this is the IO wrapper.
  */
 
-import { execFileSync } from "child_process";
+import { execFileSync, execSync } from "child_process";
 import { readFileSync } from "fs";
 import * as path from "path";
 import {
   globalPrefixFromPackageDir,
   npmBinary,
   npmInstallArgs,
+  npmShellCommand,
   npmSpawnShell,
   parseUpdateFlags,
   updateAvailable,
@@ -52,15 +53,28 @@ function readVersion(file: string): string {
   }
 }
 
+/**
+ * Run npm and return stdout, or throw on failure. Windows must launch the
+ * `npm.cmd` shim through a shell; we pass one command string to `execSync`
+ * rather than an args array with `shell: true` (Node 22+ DEP0190 — args would be
+ * concatenated unescaped). The only non-literal token, the version, is already
+ * sanitized (`sanitizeVersion`). POSIX keeps the shell-free `execFile`.
+ */
+function runNpm(
+  args: string[],
+  opts: { stdio: "inherit" | ["ignore", "pipe", "pipe"]; env?: NodeJS.ProcessEnv },
+): Buffer | null {
+  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+  return NPM_SHELL
+    ? execSync(npmShellCommand(NPM, args), opts)
+    : execFileSync(NPM, args, opts);
+}
+
 /** Capture `npm <args>` stdout, or null when npm is absent / the call fails. */
 function npmCapture(args: string[]): string | null {
   try {
-    return execFileSync(NPM, args, {
-      stdio: ["ignore", "pipe", "pipe"],
-      shell: NPM_SHELL,
-    })
-      .toString()
-      .trim();
+    const out = runNpm(args, { stdio: ["ignore", "pipe", "pipe"] });
+    return (out ?? "").toString().trim();
   } catch {
     return null;
   }
@@ -116,8 +130,7 @@ function main(argv: string[]): void {
     // the `.cmd` shim is launched through a shell (EINVAL otherwise); the only
     // caller-supplied token — the version — is sanitized in `parseUpdateFlags`,
     // and every other arg is a fixed literal, so nothing injectable reaches it.
-    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-    execFileSync(NPM, args, { stdio: "inherit", env, shell: NPM_SHELL });
+    runNpm(args, { stdio: "inherit", env });
   } catch (err) {
     console.error(
       `\n  ✗ npm failed to update rastack. Re-run for detail:\n    npm install -g ${npmInstallArgs(flags.version)[2]}\n    ${(err as Error).message}`,

package/src/update.ts

@@ -90,6 +90,20 @@ export function npmSpawnShell(platform: string = process.platform): boolean {
   return platform === "win32";
 }
 
+/**
+ * The single command string used to launch npm on platforms that must go through
+ * a shell (Windows — see `npmSpawnShell`). Node 22+ deprecates passing an args
+ * *array* together with `shell: true` (DEP0190: the args are concatenated, not
+ * escaped), so the shell path builds one string and runs it via `execSync`
+ * instead. Joining with spaces is safe here because every token is a fixed
+ * literal except the version, which `sanitizeVersion` constrains to
+ * `[A-Za-z0-9._-]` (no shell metacharacters). POSIX never uses this — it keeps
+ * the shell-free, array-based `execFile`, which has no concatenation at all.
+ */
+export function npmShellCommand(binary: string, args: string[]): string {
+  return [binary, ...args].join(" ");
+}
+
 /** The npm package spec to install for a target version. */
 export function installSpec(version: string): string {
   return !version || version === "latest" ? "rastack" : `rastack@${version}`;

package/test/update.spec.ts

@@ -4,6 +4,7 @@ import {
   installSpec,
   npmBinary,
   npmInstallArgs,
+  npmShellCommand,
   npmSpawnShell,
   parseUpdateFlags,
   sanitizeVersion,
@@ -67,6 +68,18 @@ describe("update — npm spec + args", () => {
     expect(npmSpawnShell("linux")).toBe(false);
     expect(npmSpawnShell("darwin")).toBe(false);
   });
+
+  it("joins the shell command as one string (avoids the Node DEP0190 warning)", () => {
+    // The Windows path runs npm via `execSync(<string>)` rather than
+    // `execFileSync(npm, args, { shell: true })`, which Node 22+ deprecates
+    // (args concatenated, not escaped). The sanitized version keeps it safe.
+    expect(npmShellCommand("npm.cmd", npmInstallArgs("latest"))).toBe(
+      "npm.cmd install -g rastack --no-fund --no-audit --loglevel=error",
+    );
+    expect(npmShellCommand("npm.cmd", npmInstallArgs("0.0.42"))).toContain(
+      "rastack@0.0.42",
+    );
+  });
 });
 
 describe("update — version sanitization", () => {