rastack 0.0.42 → 0.0.44

package/dist/dev/harness.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Pure core of `rastack dev` — the local, always-WASM development server.
+ *
+ * `rastack dev` boots the app + admin **in the browser** over the WebAssembly
+ * engine (the same app-generic `rastack-api-core` the Lambda runs, fed the app's
+ * compiled manifest). No native server, no cargo: a dependency-free static
+ * server hands the browser the prebuilt wasm engine, the compiled schema, and
+ * the committed Iceberg warehouse, and a bundled React admin drives it.
+ *
+ * Everything decidable without IO lives here (arg parsing, MIME types, locating
+ * the wasm bundle, the HTML shell) so it is unit-tested without a socket or a
+ * filesystem; `rastack-dev.ts` is the thin IO wrapper that compiles, resolves
+ * the engine, and serves.
+ */
+export interface DevArgs {
+    /** Where the TypeScript resource definitions live (compiled on start). */
+    resourcesDir: string;
+    /** Where `rastack compile` writes schema.rastack.json + openapi.json. */
+    outDir: string;
+    /** The committed Iceberg warehouse served to seed the browser engine. */
+    warehouseDir: string;
+    /** Port the dev server listens on. */
+    port: number;
+    /** Open the browser on start (false with `--no-open`). */
+    open: boolean;
+}
+export declare const DEV_DEFAULTS: DevArgs;
+/**
+ * Parse `rastack dev` args: `--port`, `--warehouse`, `--out`, `--no-open`, and a
+ * single positional resources dir. Unknown flags are ignored (forgiving CLI).
+ */
+export declare function parseDevArgs(argv: string[]): DevArgs;
+/** MIME type for a served path, defaulting to octet-stream (Iceberg data files). */
+export declare function contentType(filePath: string): string;
+/**
+ * Ordered directories to look for the prebuilt wasm bundle (`rastack_wasm.js` +
+ * `rastack_wasm_bg.wasm`). The bundle is shipped inside the package
+ * (`dist/wasm/`, copied at build), so `rastack dev` works from any repo with no
+ * cargo; the repo-local `tools/wasm/` (from a source build) and a sibling of the
+ * running module are fallbacks for development. `dirnameDir` is the directory of
+ * the compiled `rastack-dev.js` (`dist/`), so `../wasm` and `./wasm` cover both
+ * `dist/rastack-dev.js` → `dist/wasm` and `dist/dev/…` layouts.
+ */
+export declare function wasmBundleCandidates(dirnameDir: string, cwd?: string): string[];
+/** The name of the file that marks a directory as a usable wasm bundle. */
+export declare const WASM_ENTRY = "rastack_wasm.js";
+/**
+ * The HTML shell served at `/`. It loads the bundled React admin
+ * (`/dev/admin.js`), which fetches the schema/openapi, boots the wasm engine,
+ * seeds it from `/data/warehouse/`, and renders the admin. Deliberately tiny —
+ * all logic lives in the bundle — mirroring the `rastack design` studio.
+ */
+export declare function renderShell(title?: string): string;

package/dist/dev/harness.js

@@ -0,0 +1,151 @@
+"use strict";
+/**
+ * Pure core of `rastack dev` — the local, always-WASM development server.
+ *
+ * `rastack dev` boots the app + admin **in the browser** over the WebAssembly
+ * engine (the same app-generic `rastack-api-core` the Lambda runs, fed the app's
+ * compiled manifest). No native server, no cargo: a dependency-free static
+ * server hands the browser the prebuilt wasm engine, the compiled schema, and
+ * the committed Iceberg warehouse, and a bundled React admin drives it.
+ *
+ * Everything decidable without IO lives here (arg parsing, MIME types, locating
+ * the wasm bundle, the HTML shell) so it is unit-tested without a socket or a
+ * filesystem; `rastack-dev.ts` is the thin IO wrapper that compiles, resolves
+ * the engine, and serves.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WASM_ENTRY = exports.DEV_DEFAULTS = void 0;
+exports.parseDevArgs = parseDevArgs;
+exports.contentType = contentType;
+exports.wasmBundleCandidates = wasmBundleCandidates;
+exports.renderShell = renderShell;
+const path = __importStar(require("path"));
+exports.DEV_DEFAULTS = {
+    resourcesDir: "resources",
+    outDir: ".rastack",
+    warehouseDir: "data/warehouse",
+    port: 4321,
+    open: true,
+};
+/**
+ * Parse `rastack dev` args: `--port`, `--warehouse`, `--out`, `--no-open`, and a
+ * single positional resources dir. Unknown flags are ignored (forgiving CLI).
+ */
+function parseDevArgs(argv) {
+    const positional = [];
+    let { resourcesDir, outDir, warehouseDir, port, open } = exports.DEV_DEFAULTS;
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === "--port")
+            port = Number(argv[++i]) || port;
+        else if (a === "--warehouse")
+            warehouseDir = argv[++i] ?? warehouseDir;
+        else if (a === "--out")
+            outDir = argv[++i] ?? outDir;
+        else if (a === "--no-open")
+            open = false;
+        else if (!a.startsWith("-"))
+            positional.push(a);
+    }
+    return {
+        resourcesDir: positional[0] || resourcesDir,
+        outDir,
+        warehouseDir,
+        port,
+        open,
+    };
+}
+const MIME = {
+    ".html": "text/html; charset=utf-8",
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+    // Critical: `WebAssembly.instantiateStreaming` requires this exact type.
+    ".wasm": "application/wasm",
+    ".text": "text/plain; charset=utf-8",
+    ".parquet": "application/octet-stream",
+};
+/** MIME type for a served path, defaulting to octet-stream (Iceberg data files). */
+function contentType(filePath) {
+    const ext = filePath.slice(filePath.lastIndexOf("."));
+    return MIME[ext] ?? "application/octet-stream";
+}
+/**
+ * Ordered directories to look for the prebuilt wasm bundle (`rastack_wasm.js` +
+ * `rastack_wasm_bg.wasm`). The bundle is shipped inside the package
+ * (`dist/wasm/`, copied at build), so `rastack dev` works from any repo with no
+ * cargo; the repo-local `tools/wasm/` (from a source build) and a sibling of the
+ * running module are fallbacks for development. `dirnameDir` is the directory of
+ * the compiled `rastack-dev.js` (`dist/`), so `../wasm` and `./wasm` cover both
+ * `dist/rastack-dev.js` → `dist/wasm` and `dist/dev/…` layouts.
+ */
+function wasmBundleCandidates(dirnameDir, cwd = process.cwd()) {
+    return [
+        path.join(dirnameDir, "wasm"),
+        path.join(dirnameDir, "..", "wasm"),
+        path.join(cwd, "tools", "wasm"),
+        path.join(cwd, "wasm"),
+    ];
+}
+/** The name of the file that marks a directory as a usable wasm bundle. */
+exports.WASM_ENTRY = "rastack_wasm.js";
+/**
+ * The HTML shell served at `/`. It loads the bundled React admin
+ * (`/dev/admin.js`), which fetches the schema/openapi, boots the wasm engine,
+ * seeds it from `/data/warehouse/`, and renders the admin. Deliberately tiny —
+ * all logic lives in the bundle — mirroring the `rastack design` studio.
+ */
+function renderShell(title = "React API Stack — dev") {
+    return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>${title}</title>
+<style>
+  html, body { margin: 0; height: 100%; }
+  #root { min-height: 100%; }
+  .rastack-boot { font: 14px system-ui, sans-serif; padding: 2rem; color: #555; }
+</style>
+</head>
+<body>
+<div id="root"><div class="rastack-boot">Loading the WASM engine…</div></div>
+<script src="/dev/admin.js"></script>
+</body>
+</html>
+`;
+}

package/dist/rastack-dev.d.ts

@@ -0,0 +1,18 @@
+#!/usr/bin/env node
+/**
+ * `rastack dev` — local development, always over the WASM engine.
+ *
+ *   rastack dev [resourcesDir] [--port <n>] [--warehouse <dir>] [--out <dir>] [--no-open]
+ *
+ * Compiles the resources, then boots a dependency-free static server (à la
+ * `rastack design`) that hands the browser everything it needs to run the app +
+ * admin locally over WebAssembly — no native server, no cargo:
+ *   • the bundled React admin (`/dev/admin.js`),
+ *   • the prebuilt WASM engine (`/wasm/…`) shipped in the package,
+ *   • the compiled `schema.rastack.json` / `openapi.json`,
+ *   • the committed Iceberg warehouse (`/data/warehouse/…`) to seed from.
+ *
+ * The engine is resolved from the package's prebuilt bundle; if none is present
+ * but a Rust + wasm toolchain is, it is built from source as a fallback.
+ */
+export {};

package/dist/rastack-dev.js

@@ -0,0 +1,197 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * `rastack dev` — local development, always over the WASM engine.
+ *
+ *   rastack dev [resourcesDir] [--port <n>] [--warehouse <dir>] [--out <dir>] [--no-open]
+ *
+ * Compiles the resources, then boots a dependency-free static server (à la
+ * `rastack design`) that hands the browser everything it needs to run the app +
+ * admin locally over WebAssembly — no native server, no cargo:
+ *   • the bundled React admin (`/dev/admin.js`),
+ *   • the prebuilt WASM engine (`/wasm/…`) shipped in the package,
+ *   • the compiled `schema.rastack.json` / `openapi.json`,
+ *   • the committed Iceberg warehouse (`/data/warehouse/…`) to seed from.
+ *
+ * The engine is resolved from the package's prebuilt bundle; if none is present
+ * but a Rust + wasm toolchain is, it is built from source as a fallback.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const http = __importStar(require("http"));
+const path = __importStar(require("path"));
+const harness_1 = require("./dev/harness");
+const HERE = __dirname; // dist/ when installed
+/** Compile the resources to schema.rastack.json + openapi.json in outDir. */
+function compile(resourcesDir, outDir) {
+    const compiler = path.join(HERE, "rastack-compile.js");
+    const result = (0, child_process_1.spawnSync)(process.execPath, [compiler, "compile", resourcesDir, outDir], { stdio: "inherit" });
+    if (result.status !== 0)
+        return false;
+    return fs.existsSync(path.join(outDir, "schema.rastack.json"));
+}
+/** True when `cargo` is on PATH (the from-source wasm fallback needs it). */
+function cargoAvailable() {
+    try {
+        return ((0, child_process_1.spawnSync)("cargo", ["--version"], { stdio: "ignore" }).status === 0);
+    }
+    catch {
+        return false;
+    }
+}
+/** Locate the prebuilt wasm bundle dir, building from source as a fallback. */
+function resolveWasmDir() {
+    for (const dir of (0, harness_1.wasmBundleCandidates)(HERE)) {
+        if (fs.existsSync(path.join(dir, harness_1.WASM_ENTRY)))
+            return dir;
+    }
+    if (cargoAvailable()) {
+        console.log("\n▸ No prebuilt WASM engine found — building it from source (cargo)…\n");
+        try {
+            // Lazy require so a normal `dev` with a prebuilt bundle never loads it.
+            // eslint-disable-next-line @typescript-eslint/no-var-requires
+            require("./rastack-wasm-build").buildWasm();
+        }
+        catch (err) {
+            console.error(`  ✗ wasm build failed: ${err.message}`);
+            return null;
+        }
+        for (const dir of (0, harness_1.wasmBundleCandidates)(HERE)) {
+            if (fs.existsSync(path.join(dir, harness_1.WASM_ENTRY)))
+                return dir;
+        }
+    }
+    return null;
+}
+/** Serve one file if it exists and stays within `root`; else 404/403. */
+function serveUnder(res, root, relPath) {
+    const safeRoot = path.resolve(root);
+    const rel = decodeURIComponent(relPath).replace(/^\/+/, "");
+    const target = path.resolve(safeRoot, rel);
+    // Path-traversal guard: the resolved target must stay inside the root.
+    if (target !== safeRoot && !target.startsWith(safeRoot + path.sep)) {
+        res.writeHead(403).end("Forbidden");
+        return;
+    }
+    fs.readFile(target, (err, data) => {
+        if (err) {
+            res.writeHead(404).end("Not found");
+            return;
+        }
+        res.writeHead(200, { "Content-Type": (0, harness_1.contentType)(target) }).end(data);
+    });
+}
+/** Serve an exact file (no traversal concern — a fixed internal artifact). */
+function serveFile(res, file) {
+    fs.readFile(file, (err, data) => {
+        if (err) {
+            res.writeHead(404).end("Not found");
+            return;
+        }
+        res.writeHead(200, { "Content-Type": (0, harness_1.contentType)(file) }).end(data);
+    });
+}
+/** Best-effort open the default browser at `url`. */
+function openBrowser(url) {
+    const cmd = process.platform === "darwin"
+        ? "open"
+        : process.platform === "win32"
+            ? "start"
+            : "xdg-open";
+    try {
+        (0, child_process_1.execFileSync)(cmd, [url], { stdio: "ignore" });
+    }
+    catch {
+        /* non-fatal — the URL is printed anyway */
+    }
+}
+function main(argv) {
+    const args = (0, harness_1.parseDevArgs)(argv);
+    console.log(`\n  rastack dev — the app + admin, in your browser over WASM\n`);
+    console.log(`▸ Compiling ${args.resourcesDir} → ${args.outDir}`);
+    if (!compile(args.resourcesDir, args.outDir)) {
+        console.error("  ✗ compile failed — fix the resource graph and re-run.");
+        process.exit(1);
+    }
+    const wasmDir = resolveWasmDir();
+    if (!wasmDir) {
+        console.error("\n  ✗ No WASM engine available.\n" +
+            "    Upgrade rastack for the prebuilt bundle (`rastack update`), or install\n" +
+            "    the Rust toolchain to build it from source:\n" +
+            "      rustup target add wasm32-unknown-unknown\n" +
+            "      cargo install wasm-bindgen-cli\n");
+        process.exit(1);
+    }
+    const adminBundle = path.join(HERE, "admin.js");
+    if (!fs.existsSync(adminBundle)) {
+        console.error("  ✗ admin bundle (dist/admin.js) not found — reinstall rastack.");
+        process.exit(1);
+    }
+    const server = http.createServer((req, res) => {
+        const url = (req.url || "/").split("?")[0];
+        if (req.method !== "GET") {
+            res.writeHead(405).end("Method not allowed");
+            return;
+        }
+        if (url === "/" || url === "/index.html") {
+            res
+                .writeHead(200, { "Content-Type": "text/html; charset=utf-8" })
+                .end((0, harness_1.renderShell)());
+            return;
+        }
+        if (url === "/dev/admin.js")
+            return serveFile(res, adminBundle);
+        if (url.startsWith("/wasm/"))
+            return serveUnder(res, wasmDir, url.slice("/wasm/".length));
+        if (url === "/schema.rastack.json" || url === "/openapi.json")
+            return serveUnder(res, args.outDir, path.basename(url));
+        if (url.startsWith("/data/warehouse/"))
+            return serveUnder(res, args.warehouseDir, url.slice("/data/warehouse/".length));
+        res.writeHead(404).end("Not found");
+    });
+    server.listen(args.port, () => {
+        const url = `http://localhost:${args.port}`;
+        console.log(`  ✓ WASM engine: ${path.relative(process.cwd(), wasmDir)}`);
+        console.log(`\n  ▸ ${url}   (admin at ${url}/#/)\n`);
+        console.log("  Press Ctrl+C to stop.\n");
+        if (args.open)
+            openBrowser(url);
+    });
+}
+if (require.main === module) {
+    main(process.argv.slice(2));
+}

package/dist/rastack-init.d.ts

@@ -11,8 +11,9 @@
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
  *      (GitHub coordinates default from the `origin` remote; missing fields are
  *      prompted for on a TTY);
- *   2. resolves the tier-0 bootstrap stack's artifacts bucket — and CREATES the
- *      bootstrap stack if it does not exist yet;
+ *   2. resolves the tier-0 bootstrap stack's artifacts bucket — erroring with a
+ *      pointer to `rastack bootstrap` when that account+region stack is missing
+ *      (init is per-app and never creates account-level infrastructure);
  *   3. uploads the Lambda placeholder bundle to that bucket;
  *   4. deploys the per-app backend (app.yaml) with the resolved ArtifactsBucket;
  *   5. reads the stack Outputs back into the config and prints the two GitHub repo

package/dist/rastack-init.js

@@ -12,8 +12,9 @@
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
  *      (GitHub coordinates default from the `origin` remote; missing fields are
  *      prompted for on a TTY);
- *   2. resolves the tier-0 bootstrap stack's artifacts bucket — and CREATES the
- *      bootstrap stack if it does not exist yet;
+ *   2. resolves the tier-0 bootstrap stack's artifacts bucket — erroring with a
+ *      pointer to `rastack bootstrap` when that account+region stack is missing
+ *      (init is per-app and never creates account-level infrastructure);
  *   3. uploads the Lambda placeholder bundle to that bucket;
  *   4. deploys the per-app backend (app.yaml) with the resolved ArtifactsBucket;
  *   5. reads the stack Outputs back into the config and prints the two GitHub repo
@@ -187,14 +188,13 @@ function printPlan(cfg) {
     const withBucket = (0, config_1.mergeConfig)(cfg, {
         artifactsBucket: bucket ?? "<ArtifactsBucketName from bootstrap stack>",
     });
-    const bootstrapTemplate = (0, io_1.resolveDeployAsset)("bootstrap.yaml") ?? undefined;
     const appTemplate = (0, io_1.resolveDeployAsset)("app.yaml") ?? undefined;
     console.log(`\n  Deployment plan (${cfg.stackName} @ ${cfg.region})\n`);
-    console.log(`  ── 1. Bootstrap stack (${(0, config_1.bootstrapStackName)(cfg)}) — run only if it does not exist ──`);
-    console.log("\n  " + (0, config_1.bootstrapStackCommand)(cfg, false, bootstrapTemplate) + "\n");
-    console.log("  ── 2. Per-app backend (app.yaml) ──");
+    console.log(`  ── Prerequisite: the tier-0 bootstrap stack (${(0, config_1.bootstrapStackName)(cfg)}) must exist ──`);
+    console.log(`  Create it once per account+region (init does not):  rastack bootstrap --region ${cfg.region}\n`);
+    console.log("  ── 1. Per-app backend (app.yaml) — what init deploys ──");
     console.log("\n  " + (0, config_1.deployStackCommand)(withBucket, appTemplate) + "\n");
-    console.log("  ── 3. Wire these GitHub repo Variables from the stack Outputs ──");
+    console.log("  ── 2. Wire these GitHub repo Variables from the stack Outputs ──");
     console.log(table((0, config_1.repoVariables)(cfg).map((v) => ({
         key: v.name,
         value: v.value || `<${v.from}>`,
@@ -211,18 +211,22 @@ async function standUp(cfg, interactive) {
             "    or re-run with --print to see the commands, or --no-deploy to skip.");
         process.exit(1);
     }
-    // 1. Resolve the artifacts bucket; bootstrap the tier-0 stack if it is absent.
-    let artifactsBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
-    let templatesBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_TEMPLATES_OUTPUT, cfg.region);
+    // 1. Resolve the artifacts bucket from the tier-0 bootstrap stack. That stack
+    //    is an account+region once-off — the S3 buckets that host the templates +
+    //    Lambda placeholder, and the GitHub OIDC provider. `init` is a per-app
+    //    command and deliberately does NOT create it: standing up account-level
+    //    infrastructure is `rastack bootstrap`'s job (run once by an account admin),
+    //    so a missing bootstrap stack is a clear, actionable error, not an implicit
+    //    account mutation buried inside an app deploy.
+    const artifactsBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
+    const templatesBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_TEMPLATES_OUTPUT, cfg.region);
     if (!artifactsBucket) {
-        console.log(`\n▸ Bootstrap stack ${(0, config_1.bootstrapStackName)(cfg)} not found — creating it (once per account+region).`);
-        deployBootstrap(cfg);
-        artifactsBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
-        templatesBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_TEMPLATES_OUTPUT, cfg.region);
-        if (!artifactsBucket) {
-            console.error("  ✗ bootstrap stack created but its ArtifactsBucket output could not be read.");
-            process.exit(1);
-        }
+        console.error(`\n  ✗ Bootstrap stack ${(0, config_1.bootstrapStackName)(cfg)} not found in ${cfg.region}.\n` +
+            "    It is the once-per-account+region step that hosts the CloudFormation\n" +
+            "    templates and the Lambda placeholder every app deploy reads. Create it\n" +
+            "    first (an account admin does this once), then re-run `rastack init`:\n\n" +
+            `      rastack bootstrap --region ${cfg.region}\n`);
+        process.exit(1);
     }
     console.log(`  ✓ artifacts bucket: ${artifactsBucket}`);
     // 2. Upload the placeholder the function is created from.
@@ -305,31 +309,6 @@ function wireRepoVariables(cfg, interactive) {
         }
     }
 }
-/** Deploy the bootstrap stack, retrying once against an existing OIDC provider. */
-function deployBootstrap(cfg) {
-    const template = (0, io_1.resolveDeployAsset)("bootstrap.yaml");
-    if (!template) {
-        console.error("  ✗ bootstrap.yaml template not found in the rastack package. Reinstall\n" +
-            "    rastack (`npm i -g rastack`) or run from the framework repo.");
-        process.exit(1);
-    }
-    try {
-        (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, false, template));
-    }
-    catch {
-        // The most common cause is an account that already has a GitHub OIDC
-        // provider (only one is allowed per URL). Retry telling the template to
-        // reuse it instead of creating a second.
-        console.log("  • retrying bootstrap, reusing the account's existing GitHub OIDC provider");
-        try {
-            (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, true, template));
-        }
-        catch (err) {
-            console.error(`\n  ✗ bootstrap stack deploy failed.\n    ${err.message}`);
-            process.exit(1);
-        }
-    }
-}
 function printSummary(cfg) {
     console.log(`\n  ✓ ${cfg.app} is deployed (${cfg.stackName} @ ${cfg.region})`);
     if (cfg.outputs?.apiUrl)
@@ -399,7 +378,7 @@ async function main(argv) {
         return;
     }
     if ((0, io_1.canPrompt)()) {
-        const ok = await confirm(`Deploy ${cfg.stackName} to AWS ${cfg.region} now? (creates the bootstrap stack if needed) [y/N]`);
+        const ok = await confirm(`Deploy ${cfg.stackName} to AWS ${cfg.region} now? (requires the bootstrap stack to exist) [y/N]`);
         if (!ok) {
             console.log("\n  Skipped the deploy. Re-run to deploy, or `rastack init --print` for the commands.\n");
             return;

package/dist/rastack-update.js

@@ -74,15 +74,24 @@ function readVersion(file) {
         return "unknown";
     }
 }
+/**
+ * Run npm and return stdout, or throw on failure. Windows must launch the
+ * `npm.cmd` shim through a shell; we pass one command string to `execSync`
+ * rather than an args array with `shell: true` (Node 22+ DEP0190 — args would be
+ * concatenated unescaped). The only non-literal token, the version, is already
+ * sanitized (`sanitizeVersion`). POSIX keeps the shell-free `execFile`.
+ */
+function runNpm(args, opts) {
+    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+    return NPM_SHELL
+        ? (0, child_process_1.execSync)((0, update_1.npmShellCommand)(NPM, args), opts)
+        : (0, child_process_1.execFileSync)(NPM, args, opts);
+}
 /** Capture `npm <args>` stdout, or null when npm is absent / the call fails. */
 function npmCapture(args) {
     try {
-        return (0, child_process_1.execFileSync)(NPM, args, {
-            stdio: ["ignore", "pipe", "pipe"],
-            shell: NPM_SHELL,
-        })
-            .toString()
-            .trim();
+        const out = runNpm(args, { stdio: ["ignore", "pipe", "pipe"] });
+        return (out ?? "").toString().trim();
     }
     catch {
         return null;
@@ -129,8 +138,7 @@ function main(argv) {
         // the `.cmd` shim is launched through a shell (EINVAL otherwise); the only
         // caller-supplied token — the version — is sanitized in `parseUpdateFlags`,
         // and every other arg is a fixed literal, so nothing injectable reaches it.
-        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-        (0, child_process_1.execFileSync)(NPM, args, { stdio: "inherit", env, shell: NPM_SHELL });
+        runNpm(args, { stdio: "inherit", env });
     }
     catch (err) {
         console.error(`\n  ✗ npm failed to update rastack. Re-run for detail:\n    npm install -g ${(0, update_1.npmInstallArgs)(flags.version)[2]}\n    ${err.message}`);

package/dist/rastack-wasm-build.d.ts

@@ -1,14 +1,19 @@
 #!/usr/bin/env node
 /**
- * `rastack wasm` — compile the Rust API to WebAssembly for in-browser local dev.
+ * Compile the Rust API to WebAssembly for in-browser local dev — the engine
+ * `rastack dev` serves and `<RAStackProvider mode="local">` loads.
  *
  * Pipeline:
  *   1. cargo build -p rastack-wasm --release --target wasm32-unknown-unknown
- *   2. wasm-bindgen --target web  → stack/wasm/rastack_wasm.js + rastack_wasm_bg.wasm
+ *   2. wasm-bindgen --target web  → tools/wasm/rastack_wasm.js + rastack_wasm_bg.wasm
  *   3. wasm-opt -Oz (if available) to shrink the binary
  *
- * The generated bundle is what `<RAStackProvider mode="local">` loads. Prereqs:
+ * This is invoked by the release CI (to bundle a prebuilt engine into the npm
+ * package) and by `rastack dev` as a from-source fallback when no prebuilt
+ * bundle is present but the toolchain is. Prereqs:
  *   rustup target add wasm32-unknown-unknown
  *   cargo install wasm-bindgen-cli   (version must match the wasm-bindgen crate)
  */
-export {};
+/** Run the full compile → wasm-bindgen → optimise pipeline. Throws via `run`'s
+ *  `process.exit` on a missing tool or a non-zero step. */
+export declare function buildWasm(): void;