rastack 0.0.42 → 0.0.44

package/dist/wasm/rastack_wasm_bg.wasm.d.ts

@@ -0,0 +1,28 @@
+/* tslint:disable */
+/* eslint-disable */
+export const memory: WebAssembly.Memory;
+export const __wbg_rastackapi_free: (a: number, b: number) => void;
+export const rastackapi_exportWarehouse: (a: number) => any;
+export const rastackapi_handle: (a: number, b: number, c: number, d: number, e: number, f: any, g: any) => any;
+export const rastackapi_importWarehouse: (a: number, b: number, c: number) => any;
+export const rastackapi_new: (a: number, b: number, c: number, d: number) => [number, number, number];
+export const rastackapi_seedFile: (a: number, b: number, c: number, d: number, e: number) => any;
+export const rastackapi_setAuth: (a: number, b: number, c: number, d: any) => [number, number];
+export const rust_zstd_wasm_shim_calloc: (a: number, b: number) => number;
+export const rust_zstd_wasm_shim_free: (a: number) => void;
+export const rust_zstd_wasm_shim_malloc: (a: number) => number;
+export const rust_zstd_wasm_shim_memcmp: (a: number, b: number, c: number) => number;
+export const rust_zstd_wasm_shim_memcpy: (a: number, b: number, c: number) => number;
+export const rust_zstd_wasm_shim_memmove: (a: number, b: number, c: number) => number;
+export const rust_zstd_wasm_shim_memset: (a: number, b: number, c: number) => number;
+export const rust_zstd_wasm_shim_qsort: (a: number, b: number, c: number, d: number) => void;
+export const wasm_bindgen_1a7aa9db5392c486___convert__closures_____invoke___wasm_bindgen_1a7aa9db5392c486___JsValue__core_7d5f0a2ba6a62c33___result__Result_____wasm_bindgen_1a7aa9db5392c486___JsError___true_: (a: number, b: number, c: any) => [number, number];
+export const wasm_bindgen_1a7aa9db5392c486___convert__closures_____invoke___js_sys_191ff9fb2bd47800___Function_fn_wasm_bindgen_1a7aa9db5392c486___JsValue_____wasm_bindgen_1a7aa9db5392c486___sys__Undefined___js_sys_191ff9fb2bd47800___Function_fn_wasm_bindgen_1a7aa9db5392c486___JsValue_____wasm_bindgen_1a7aa9db5392c486___sys__Undefined_______true_: (a: number, b: number, c: any, d: any) => void;
+export const __wbindgen_malloc: (a: number, b: number) => number;
+export const __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
+export const __wbindgen_exn_store: (a: number) => void;
+export const __externref_table_alloc: () => number;
+export const __wbindgen_externrefs: WebAssembly.Table;
+export const __wbindgen_destroy_closure: (a: number, b: number) => void;
+export const __externref_table_dealloc: (a: number) => void;
+export const __wbindgen_start: () => void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rastack",
-  "version": "0.0.42",
+  "version": "0.0.44",
   "description": "",
   "main": "runtime.ts",
   "types": "runtime.ts",
@@ -13,7 +13,7 @@
   },
   "scripts": {
     "format": "prettier --write \"**/*.{ts,tsx,md}\"",
-    "build": "tsc && cp src/.prettierrc dist/.prettierrc && node scripts/copy-templates.js",
+    "build": "tsc && cp src/.prettierrc dist/.prettierrc && node scripts/copy-templates.js && node scripts/build-admin.js && node scripts/copy-wasm.js",
     "start": "node dist/index.js",
     "test": "jest"
   },
@@ -50,8 +50,12 @@
     "@types/js-yaml": "^4.0.9",
     "@types/mocha": "^10.0.6",
     "@types/node": "^26.1.0",
+    "@types/react-dom": "^19.2.0",
+    "esbuild": "^0.25.0",
     "eslint": "^10.6.0",
     "jest": "^30.4.2",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
     "ts-jest": "^29.4.11"
   }
 }

package/scripts/build-admin.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+/**
+ * Bundle the in-browser admin (`admin/index.tsx` + the reused `rastack/components`
+ * / `rastack/theme` / `rastack/provider` React source) into a single static
+ * `dist/admin.js` that `rastack dev` serves at `/dev/admin.js`.
+ *
+ * `tools/` otherwise builds with plain `tsc`, and the React runtime dirs ship as
+ * `.tsx` source (never compiled), so a bundler is required to turn the admin
+ * entrypoint into a browser asset. esbuild is that bundler. The bare
+ * `rastack/tokens` + `rastack/theme` subpath imports the components use are
+ * aliased to the in-repo sources (mirroring tsconfig `paths` / jest
+ * `moduleNameMapper`). The WASM engine is loaded at runtime via a hidden
+ * `import()` (see admin/index.tsx), so esbuild never tries to resolve it.
+ */
+const path = require("path");
+const esbuild = require("esbuild");
+
+const root = path.join(__dirname, "..");
+
+esbuild
+  .build({
+    entryPoints: [path.join(root, "admin", "index.tsx")],
+    bundle: true,
+    outfile: path.join(root, "dist", "admin.js"),
+    format: "iife",
+    platform: "browser",
+    target: ["es2020"],
+    minify: true,
+    sourcemap: false,
+    jsx: "automatic",
+    // The reused provider/hooks read `process.env.*` (e.g. NEXT_PUBLIC_BASE_URL).
+    // `define` folds NODE_ENV; the banner shims a `process.env` object so any
+    // other lookups resolve to undefined instead of throwing in the browser.
+    define: { "process.env.NODE_ENV": '"production"' },
+    banner: {
+      js: "window.process=window.process||{env:{}};",
+    },
+    alias: {
+      "rastack/tokens": path.join(root, "tokens.ts"),
+      "rastack/theme": path.join(root, "theme", "index.ts"),
+    },
+    logLevel: "info",
+  })
+  .then(() => console.log("build-admin: wrote dist/admin.js"))
+  .catch((err) => {
+    console.error("build-admin: failed\n", err);
+    process.exit(1);
+  });

package/scripts/copy-wasm.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+/**
+ * Copy the prebuilt WASM engine (`tools/wasm/`, produced by
+ * `rastack-wasm-build.js`) into the published package at `dist/wasm/`, so
+ * `rastack dev` serves it from any repo with no cargo. A no-op when no bundle
+ * has been built yet (a normal `pnpm build` on a machine without the Rust
+ * toolchain), so ordinary builds still succeed — the release CI builds the
+ * engine before this runs, and `rastack dev` has a from-source fallback.
+ */
+const fs = require("fs");
+const path = require("path");
+
+const root = path.join(__dirname, "..");
+const src = path.join(root, "wasm");
+const dest = path.join(root, "dist", "wasm");
+const entry = path.join(src, "rastack_wasm.js");
+
+if (!fs.existsSync(entry)) {
+  console.log(
+    "copy-wasm: no prebuilt engine at tools/wasm (skipping — build it with " +
+      "rastack-wasm-build.js to ship it).",
+  );
+  process.exit(0);
+}
+
+fs.mkdirSync(dest, { recursive: true });
+let n = 0;
+for (const name of fs.readdirSync(src)) {
+  const from = path.join(src, name);
+  if (fs.statSync(from).isFile()) {
+    fs.copyFileSync(from, path.join(dest, name));
+    n++;
+  }
+}
+console.log(`copy-wasm: copied ${n} file(s) into dist/wasm`);

package/src/dev/harness.ts

@@ -0,0 +1,130 @@
+/**
+ * Pure core of `rastack dev` — the local, always-WASM development server.
+ *
+ * `rastack dev` boots the app + admin **in the browser** over the WebAssembly
+ * engine (the same app-generic `rastack-api-core` the Lambda runs, fed the app's
+ * compiled manifest). No native server, no cargo: a dependency-free static
+ * server hands the browser the prebuilt wasm engine, the compiled schema, and
+ * the committed Iceberg warehouse, and a bundled React admin drives it.
+ *
+ * Everything decidable without IO lives here (arg parsing, MIME types, locating
+ * the wasm bundle, the HTML shell) so it is unit-tested without a socket or a
+ * filesystem; `rastack-dev.ts` is the thin IO wrapper that compiles, resolves
+ * the engine, and serves.
+ */
+
+import * as path from "path";
+
+export interface DevArgs {
+  /** Where the TypeScript resource definitions live (compiled on start). */
+  resourcesDir: string;
+  /** Where `rastack compile` writes schema.rastack.json + openapi.json. */
+  outDir: string;
+  /** The committed Iceberg warehouse served to seed the browser engine. */
+  warehouseDir: string;
+  /** Port the dev server listens on. */
+  port: number;
+  /** Open the browser on start (false with `--no-open`). */
+  open: boolean;
+}
+
+export const DEV_DEFAULTS: DevArgs = {
+  resourcesDir: "resources",
+  outDir: ".rastack",
+  warehouseDir: "data/warehouse",
+  port: 4321,
+  open: true,
+};
+
+/**
+ * Parse `rastack dev` args: `--port`, `--warehouse`, `--out`, `--no-open`, and a
+ * single positional resources dir. Unknown flags are ignored (forgiving CLI).
+ */
+export function parseDevArgs(argv: string[]): DevArgs {
+  const positional: string[] = [];
+  let { resourcesDir, outDir, warehouseDir, port, open } = DEV_DEFAULTS;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--port") port = Number(argv[++i]) || port;
+    else if (a === "--warehouse") warehouseDir = argv[++i] ?? warehouseDir;
+    else if (a === "--out") outDir = argv[++i] ?? outDir;
+    else if (a === "--no-open") open = false;
+    else if (!a.startsWith("-")) positional.push(a);
+  }
+  return {
+    resourcesDir: positional[0] || resourcesDir,
+    outDir,
+    warehouseDir,
+    port,
+    open,
+  };
+}
+
+const MIME: Record<string, string> = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".mjs": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  // Critical: `WebAssembly.instantiateStreaming` requires this exact type.
+  ".wasm": "application/wasm",
+  ".text": "text/plain; charset=utf-8",
+  ".parquet": "application/octet-stream",
+};
+
+/** MIME type for a served path, defaulting to octet-stream (Iceberg data files). */
+export function contentType(filePath: string): string {
+  const ext = filePath.slice(filePath.lastIndexOf("."));
+  return MIME[ext] ?? "application/octet-stream";
+}
+
+/**
+ * Ordered directories to look for the prebuilt wasm bundle (`rastack_wasm.js` +
+ * `rastack_wasm_bg.wasm`). The bundle is shipped inside the package
+ * (`dist/wasm/`, copied at build), so `rastack dev` works from any repo with no
+ * cargo; the repo-local `tools/wasm/` (from a source build) and a sibling of the
+ * running module are fallbacks for development. `dirnameDir` is the directory of
+ * the compiled `rastack-dev.js` (`dist/`), so `../wasm` and `./wasm` cover both
+ * `dist/rastack-dev.js` → `dist/wasm` and `dist/dev/…` layouts.
+ */
+export function wasmBundleCandidates(
+  dirnameDir: string,
+  cwd = process.cwd(),
+): string[] {
+  return [
+    path.join(dirnameDir, "wasm"),
+    path.join(dirnameDir, "..", "wasm"),
+    path.join(cwd, "tools", "wasm"),
+    path.join(cwd, "wasm"),
+  ];
+}
+
+/** The name of the file that marks a directory as a usable wasm bundle. */
+export const WASM_ENTRY = "rastack_wasm.js";
+
+/**
+ * The HTML shell served at `/`. It loads the bundled React admin
+ * (`/dev/admin.js`), which fetches the schema/openapi, boots the wasm engine,
+ * seeds it from `/data/warehouse/`, and renders the admin. Deliberately tiny —
+ * all logic lives in the bundle — mirroring the `rastack design` studio.
+ */
+export function renderShell(title = "React API Stack — dev"): string {
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>${title}</title>
+<style>
+  html, body { margin: 0; height: 100%; }
+  #root { min-height: 100%; }
+  .rastack-boot { font: 14px system-ui, sans-serif; padding: 2rem; color: #555; }
+</style>
+</head>
+<body>
+<div id="root"><div class="rastack-boot">Loading the WASM engine…</div></div>
+<script src="/dev/admin.js"></script>
+</body>
+</html>
+`;
+}

package/src/rastack-dev.ts

@@ -0,0 +1,197 @@
+#!/usr/bin/env node
+
+/**
+ * `rastack dev` — local development, always over the WASM engine.
+ *
+ *   rastack dev [resourcesDir] [--port <n>] [--warehouse <dir>] [--out <dir>] [--no-open]
+ *
+ * Compiles the resources, then boots a dependency-free static server (à la
+ * `rastack design`) that hands the browser everything it needs to run the app +
+ * admin locally over WebAssembly — no native server, no cargo:
+ *   • the bundled React admin (`/dev/admin.js`),
+ *   • the prebuilt WASM engine (`/wasm/…`) shipped in the package,
+ *   • the compiled `schema.rastack.json` / `openapi.json`,
+ *   • the committed Iceberg warehouse (`/data/warehouse/…`) to seed from.
+ *
+ * The engine is resolved from the package's prebuilt bundle; if none is present
+ * but a Rust + wasm toolchain is, it is built from source as a fallback.
+ */
+
+import { execFileSync, spawnSync } from "child_process";
+import * as fs from "fs";
+import * as http from "http";
+import * as path from "path";
+import {
+  WASM_ENTRY,
+  contentType,
+  parseDevArgs,
+  renderShell,
+  wasmBundleCandidates,
+} from "./dev/harness";
+
+const HERE = __dirname; // dist/ when installed
+
+/** Compile the resources to schema.rastack.json + openapi.json in outDir. */
+function compile(resourcesDir: string, outDir: string): boolean {
+  const compiler = path.join(HERE, "rastack-compile.js");
+  const result = spawnSync(
+    process.execPath,
+    [compiler, "compile", resourcesDir, outDir],
+    { stdio: "inherit" },
+  );
+  if (result.status !== 0) return false;
+  return fs.existsSync(path.join(outDir, "schema.rastack.json"));
+}
+
+/** True when `cargo` is on PATH (the from-source wasm fallback needs it). */
+function cargoAvailable(): boolean {
+  try {
+    return (
+      spawnSync("cargo", ["--version"], { stdio: "ignore" }).status === 0
+    );
+  } catch {
+    return false;
+  }
+}
+
+/** Locate the prebuilt wasm bundle dir, building from source as a fallback. */
+function resolveWasmDir(): string | null {
+  for (const dir of wasmBundleCandidates(HERE)) {
+    if (fs.existsSync(path.join(dir, WASM_ENTRY))) return dir;
+  }
+  if (cargoAvailable()) {
+    console.log(
+      "\n▸ No prebuilt WASM engine found — building it from source (cargo)…\n",
+    );
+    try {
+      // Lazy require so a normal `dev` with a prebuilt bundle never loads it.
+      // eslint-disable-next-line @typescript-eslint/no-var-requires
+      require("./rastack-wasm-build").buildWasm();
+    } catch (err) {
+      console.error(`  ✗ wasm build failed: ${(err as Error).message}`);
+      return null;
+    }
+    for (const dir of wasmBundleCandidates(HERE)) {
+      if (fs.existsSync(path.join(dir, WASM_ENTRY))) return dir;
+    }
+  }
+  return null;
+}
+
+/** Serve one file if it exists and stays within `root`; else 404/403. */
+function serveUnder(
+  res: http.ServerResponse,
+  root: string,
+  relPath: string,
+): void {
+  const safeRoot = path.resolve(root);
+  const rel = decodeURIComponent(relPath).replace(/^\/+/, "");
+  const target = path.resolve(safeRoot, rel);
+  // Path-traversal guard: the resolved target must stay inside the root.
+  if (target !== safeRoot && !target.startsWith(safeRoot + path.sep)) {
+    res.writeHead(403).end("Forbidden");
+    return;
+  }
+  fs.readFile(target, (err, data) => {
+    if (err) {
+      res.writeHead(404).end("Not found");
+      return;
+    }
+    res.writeHead(200, { "Content-Type": contentType(target) }).end(data);
+  });
+}
+
+/** Serve an exact file (no traversal concern — a fixed internal artifact). */
+function serveFile(res: http.ServerResponse, file: string): void {
+  fs.readFile(file, (err, data) => {
+    if (err) {
+      res.writeHead(404).end("Not found");
+      return;
+    }
+    res.writeHead(200, { "Content-Type": contentType(file) }).end(data);
+  });
+}
+
+/** Best-effort open the default browser at `url`. */
+function openBrowser(url: string): void {
+  const cmd =
+    process.platform === "darwin"
+      ? "open"
+      : process.platform === "win32"
+        ? "start"
+        : "xdg-open";
+  try {
+    execFileSync(cmd, [url], { stdio: "ignore" });
+  } catch {
+    /* non-fatal — the URL is printed anyway */
+  }
+}
+
+function main(argv: string[]): void {
+  const args = parseDevArgs(argv);
+
+  console.log(`\n  rastack dev — the app + admin, in your browser over WASM\n`);
+  console.log(`▸ Compiling ${args.resourcesDir} → ${args.outDir}`);
+  if (!compile(args.resourcesDir, args.outDir)) {
+    console.error("  ✗ compile failed — fix the resource graph and re-run.");
+    process.exit(1);
+  }
+
+  const wasmDir = resolveWasmDir();
+  if (!wasmDir) {
+    console.error(
+      "\n  ✗ No WASM engine available.\n" +
+        "    Upgrade rastack for the prebuilt bundle (`rastack update`), or install\n" +
+        "    the Rust toolchain to build it from source:\n" +
+        "      rustup target add wasm32-unknown-unknown\n" +
+        "      cargo install wasm-bindgen-cli\n",
+    );
+    process.exit(1);
+  }
+
+  const adminBundle = path.join(HERE, "admin.js");
+  if (!fs.existsSync(adminBundle)) {
+    console.error(
+      "  ✗ admin bundle (dist/admin.js) not found — reinstall rastack.",
+    );
+    process.exit(1);
+  }
+
+  const server = http.createServer((req, res) => {
+    const url = (req.url || "/").split("?")[0];
+    if (req.method !== "GET") {
+      res.writeHead(405).end("Method not allowed");
+      return;
+    }
+    if (url === "/" || url === "/index.html") {
+      res
+        .writeHead(200, { "Content-Type": "text/html; charset=utf-8" })
+        .end(renderShell());
+      return;
+    }
+    if (url === "/dev/admin.js") return serveFile(res, adminBundle);
+    if (url.startsWith("/wasm/"))
+      return serveUnder(res, wasmDir, url.slice("/wasm/".length));
+    if (url === "/schema.rastack.json" || url === "/openapi.json")
+      return serveUnder(res, args.outDir, path.basename(url));
+    if (url.startsWith("/data/warehouse/"))
+      return serveUnder(
+        res,
+        args.warehouseDir,
+        url.slice("/data/warehouse/".length),
+      );
+    res.writeHead(404).end("Not found");
+  });
+
+  server.listen(args.port, () => {
+    const url = `http://localhost:${args.port}`;
+    console.log(`  ✓ WASM engine: ${path.relative(process.cwd(), wasmDir)}`);
+    console.log(`\n  ▸ ${url}   (admin at ${url}/#/)\n`);
+    console.log("  Press Ctrl+C to stop.\n");
+    if (args.open) openBrowser(url);
+  });
+}
+
+if (require.main === module) {
+  main(process.argv.slice(2));
+}

package/src/rastack-init.ts

@@ -12,8 +12,9 @@
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
  *      (GitHub coordinates default from the `origin` remote; missing fields are
  *      prompted for on a TTY);
- *   2. resolves the tier-0 bootstrap stack's artifacts bucket — and CREATES the
- *      bootstrap stack if it does not exist yet;
+ *   2. resolves the tier-0 bootstrap stack's artifacts bucket — erroring with a
+ *      pointer to `rastack bootstrap` when that account+region stack is missing
+ *      (init is per-app and never creates account-level infrastructure);
  *   3. uploads the Lambda placeholder bundle to that bucket;
  *   4. deploys the per-app backend (app.yaml) with the resolved ArtifactsBucket;
  *   5. reads the stack Outputs back into the config and prints the two GitHub repo
@@ -33,8 +34,6 @@ import {
   DeployConfig,
   DeployOutputs,
   PartialDeployConfig,
-  bootstrapStackArgs,
-  bootstrapStackCommand,
   bootstrapStackName,
   deployStackArgs,
   deployStackCommand,
@@ -210,17 +209,18 @@ function printPlan(cfg: DeployConfig): void {
   const withBucket = mergeConfig(cfg, {
     artifactsBucket: bucket ?? "<ArtifactsBucketName from bootstrap stack>",
   });
-  const bootstrapTemplate = resolveDeployAsset("bootstrap.yaml") ?? undefined;
   const appTemplate = resolveDeployAsset("app.yaml") ?? undefined;
   console.log(`\n  Deployment plan (${cfg.stackName} @ ${cfg.region})\n`);
   console.log(
-    `  ── 1. Bootstrap stack (${bootstrapStackName(cfg)}) — run only if it does not exist ──`,
+    `  ── Prerequisite: the tier-0 bootstrap stack (${bootstrapStackName(cfg)}) must exist ──`,
   );
-  console.log("\n  " + bootstrapStackCommand(cfg, false, bootstrapTemplate) + "\n");
-  console.log("  ── 2. Per-app backend (app.yaml) ──");
+  console.log(
+    `  Create it once per account+region (init does not):  rastack bootstrap --region ${cfg.region}\n`,
+  );
+  console.log("  ── 1. Per-app backend (app.yaml) — what init deploys ──");
   console.log("\n  " + deployStackCommand(withBucket, appTemplate) + "\n");
   console.log(
-    "  ── 3. Wire these GitHub repo Variables from the stack Outputs ──",
+    "  ── 2. Wire these GitHub repo Variables from the stack Outputs ──",
   );
   console.log(
     table(
@@ -249,38 +249,32 @@ async function standUp(
     process.exit(1);
   }
 
-  // 1. Resolve the artifacts bucket; bootstrap the tier-0 stack if it is absent.
-  let artifactsBucket = stackOutput(
+  // 1. Resolve the artifacts bucket from the tier-0 bootstrap stack. That stack
+  //    is an account+region once-off — the S3 buckets that host the templates +
+  //    Lambda placeholder, and the GitHub OIDC provider. `init` is a per-app
+  //    command and deliberately does NOT create it: standing up account-level
+  //    infrastructure is `rastack bootstrap`'s job (run once by an account admin),
+  //    so a missing bootstrap stack is a clear, actionable error, not an implicit
+  //    account mutation buried inside an app deploy.
+  const artifactsBucket = stackOutput(
     bootstrapStackName(cfg),
     BOOTSTRAP_ARTIFACTS_OUTPUT,
     cfg.region,
   );
-  let templatesBucket = stackOutput(
+  const templatesBucket = stackOutput(
     bootstrapStackName(cfg),
     BOOTSTRAP_TEMPLATES_OUTPUT,
     cfg.region,
   );
   if (!artifactsBucket) {
-    console.log(
-      `\n▸ Bootstrap stack ${bootstrapStackName(cfg)} not found — creating it (once per account+region).`,
-    );
-    deployBootstrap(cfg);
-    artifactsBucket = stackOutput(
-      bootstrapStackName(cfg),
-      BOOTSTRAP_ARTIFACTS_OUTPUT,
-      cfg.region,
-    );
-    templatesBucket = stackOutput(
-      bootstrapStackName(cfg),
-      BOOTSTRAP_TEMPLATES_OUTPUT,
-      cfg.region,
+    console.error(
+      `\n  ✗ Bootstrap stack ${bootstrapStackName(cfg)} not found in ${cfg.region}.\n` +
+        "    It is the once-per-account+region step that hosts the CloudFormation\n" +
+        "    templates and the Lambda placeholder every app deploy reads. Create it\n" +
+        "    first (an account admin does this once), then re-run `rastack init`:\n\n" +
+        `      rastack bootstrap --region ${cfg.region}\n`,
     );
-    if (!artifactsBucket) {
-      console.error(
-        "  ✗ bootstrap stack created but its ArtifactsBucket output could not be read.",
-      );
-      process.exit(1);
-    }
+    process.exit(1);
   }
   console.log(`  ✓ artifacts bucket: ${artifactsBucket}`);
 
@@ -381,36 +375,6 @@ function wireRepoVariables(cfg: DeployConfig, interactive: boolean): void {
   }
 }
 
-/** Deploy the bootstrap stack, retrying once against an existing OIDC provider. */
-function deployBootstrap(cfg: DeployConfig): void {
-  const template = resolveDeployAsset("bootstrap.yaml");
-  if (!template) {
-    console.error(
-      "  ✗ bootstrap.yaml template not found in the rastack package. Reinstall\n" +
-        "    rastack (`npm i -g rastack`) or run from the framework repo.",
-    );
-    process.exit(1);
-  }
-  try {
-    awsRun(bootstrapStackArgs(cfg, false, template));
-  } catch {
-    // The most common cause is an account that already has a GitHub OIDC
-    // provider (only one is allowed per URL). Retry telling the template to
-    // reuse it instead of creating a second.
-    console.log(
-      "  • retrying bootstrap, reusing the account's existing GitHub OIDC provider",
-    );
-    try {
-      awsRun(bootstrapStackArgs(cfg, true, template));
-    } catch (err) {
-      console.error(
-        `\n  ✗ bootstrap stack deploy failed.\n    ${(err as Error).message}`,
-      );
-      process.exit(1);
-    }
-  }
-}
-
 function printSummary(cfg: DeployConfig): void {
   console.log(
     `\n  ✓ ${cfg.app} is deployed (${cfg.stackName} @ ${cfg.region})`,
@@ -502,7 +466,7 @@ async function main(argv: string[]): Promise<void> {
 
   if (canPrompt()) {
     const ok = await confirm(
-      `Deploy ${cfg.stackName} to AWS ${cfg.region} now? (creates the bootstrap stack if needed) [y/N]`,
+      `Deploy ${cfg.stackName} to AWS ${cfg.region} now? (requires the bootstrap stack to exist) [y/N]`,
     );
     if (!ok) {
       console.log(

package/src/rastack-update.ts

@@ -17,13 +17,14 @@
  * global location. Pure decisions live in `update.ts`; this is the IO wrapper.
  */
 
-import { execFileSync } from "child_process";
+import { execFileSync, execSync } from "child_process";
 import { readFileSync } from "fs";
 import * as path from "path";
 import {
   globalPrefixFromPackageDir,
   npmBinary,
   npmInstallArgs,
+  npmShellCommand,
   npmSpawnShell,
   parseUpdateFlags,
   updateAvailable,
@@ -52,15 +53,28 @@ function readVersion(file: string): string {
   }
 }
 
+/**
+ * Run npm and return stdout, or throw on failure. Windows must launch the
+ * `npm.cmd` shim through a shell; we pass one command string to `execSync`
+ * rather than an args array with `shell: true` (Node 22+ DEP0190 — args would be
+ * concatenated unescaped). The only non-literal token, the version, is already
+ * sanitized (`sanitizeVersion`). POSIX keeps the shell-free `execFile`.
+ */
+function runNpm(
+  args: string[],
+  opts: { stdio: "inherit" | ["ignore", "pipe", "pipe"]; env?: NodeJS.ProcessEnv },
+): Buffer | null {
+  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+  return NPM_SHELL
+    ? execSync(npmShellCommand(NPM, args), opts)
+    : execFileSync(NPM, args, opts);
+}
+
 /** Capture `npm <args>` stdout, or null when npm is absent / the call fails. */
 function npmCapture(args: string[]): string | null {
   try {
-    return execFileSync(NPM, args, {
-      stdio: ["ignore", "pipe", "pipe"],
-      shell: NPM_SHELL,
-    })
-      .toString()
-      .trim();
+    const out = runNpm(args, { stdio: ["ignore", "pipe", "pipe"] });
+    return (out ?? "").toString().trim();
   } catch {
     return null;
   }
@@ -116,8 +130,7 @@ function main(argv: string[]): void {
     // the `.cmd` shim is launched through a shell (EINVAL otherwise); the only
     // caller-supplied token — the version — is sanitized in `parseUpdateFlags`,
     // and every other arg is a fixed literal, so nothing injectable reaches it.
-    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-    execFileSync(NPM, args, { stdio: "inherit", env, shell: NPM_SHELL });
+    runNpm(args, { stdio: "inherit", env });
   } catch (err) {
     console.error(
       `\n  ✗ npm failed to update rastack. Re-run for detail:\n    npm install -g ${npmInstallArgs(flags.version)[2]}\n    ${(err as Error).message}`,