rastack 0.0.48 → 0.0.49

package/CHANGELOG.md

@@ -2,6 +2,8 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.0.49](https://github.com/theserverkid/reactapistack/compare/v0.0.48...v0.0.49) (2026-07-14)
+
 ### [0.0.48](https://github.com/theserverkid/reactapistack/compare/v0.0.47...v0.0.48) (2026-07-13)
 
 ### [0.0.47](https://github.com/theserverkid/reactapistack/compare/v0.0.46...v0.0.47) (2026-07-13)

package/dist/rastack-admin.d.ts

@@ -1,14 +1,21 @@
 #!/usr/bin/env node
 /**
- * `rastack admin` — the full, Django-admin-style console, served by the native
- * `rastack-server` against the real Iceberg warehouse.
+ * `rastack admin` — the full, Django-admin-style console, served **in the
+ * browser over the prebuilt WebAssembly engine** (exactly like `rastack dev`).
  *
  *   rastack admin [resourcesDir] [--warehouse <dir>] [--port <n>] [--out <dir>] [--no-open]
  *
- * Unlike the old server-rendered `/admin`, the console is React API Stack's own
- * React admin (`tools/admin`, built from `rastack/components` + `rastack/theme`)
- * — this command compiles the resources, points the server at the prebuilt
- * bundle (`RASTACK_ADMIN_ASSETS`), and boots it. The bundle talks back to the
- * same server's `/api` over HTTP, so edits persist to the real warehouse.
+ * The console is React API Stack's own React admin (`tools/admin`, built from
+ * `rastack/components` + `rastack/theme`). This command compiles the resources,
+ * then boots a dependency-free static server that hands the browser everything
+ * it needs to run the admin locally over WASM — no native server, no cargo:
+ *   • the bundled React admin (`/dev/admin.js`), which defaults to `mode:"local"`,
+ *   • the prebuilt WASM engine (`/wasm/…`) shipped in the package,
+ *   • the compiled `schema.rastack.json` / `openapi.json`,
+ *   • the committed Iceberg warehouse (`/data/warehouse/…`) to seed from.
+ *
+ * The engine is the single prebuilt `.wasm` bundle shipped in the npm package;
+ * if it is missing the command errors and points at `rastack update` — it never
+ * falls back to a from-source cargo build.
  */
 export {};

package/dist/rastack-admin.js

@@ -1,16 +1,23 @@
 #!/usr/bin/env node
 "use strict";
 /**
- * `rastack admin` — the full, Django-admin-style console, served by the native
- * `rastack-server` against the real Iceberg warehouse.
+ * `rastack admin` — the full, Django-admin-style console, served **in the
+ * browser over the prebuilt WebAssembly engine** (exactly like `rastack dev`).
  *
  *   rastack admin [resourcesDir] [--warehouse <dir>] [--port <n>] [--out <dir>] [--no-open]
  *
- * Unlike the old server-rendered `/admin`, the console is React API Stack's own
- * React admin (`tools/admin`, built from `rastack/components` + `rastack/theme`)
- * — this command compiles the resources, points the server at the prebuilt
- * bundle (`RASTACK_ADMIN_ASSETS`), and boots it. The bundle talks back to the
- * same server's `/api` over HTTP, so edits persist to the real warehouse.
+ * The console is React API Stack's own React admin (`tools/admin`, built from
+ * `rastack/components` + `rastack/theme`). This command compiles the resources,
+ * then boots a dependency-free static server that hands the browser everything
+ * it needs to run the admin locally over WASM — no native server, no cargo:
+ *   • the bundled React admin (`/dev/admin.js`), which defaults to `mode:"local"`,
+ *   • the prebuilt WASM engine (`/wasm/…`) shipped in the package,
+ *   • the compiled `schema.rastack.json` / `openapi.json`,
+ *   • the committed Iceberg warehouse (`/data/warehouse/…`) to seed from.
+ *
+ * The engine is the single prebuilt `.wasm` bundle shipped in the npm package;
+ * if it is missing the command errors and points at `rastack update` — it never
+ * falls back to a from-source cargo build.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -48,6 +55,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
+const http = __importStar(require("http"));
 const path = __importStar(require("path"));
 const harness_1 = require("./dev/harness");
 const HERE = __dirname; // dist/ when installed — the bundle lives beside us.
@@ -59,6 +67,42 @@ function compile(resourcesDir, outDir) {
         return false;
     return fs.existsSync(path.join(outDir, "schema.rastack.json"));
 }
+/** Locate the prebuilt wasm bundle dir shipped in the package (no cargo fallback). */
+function resolveWasmDir() {
+    for (const dir of (0, harness_1.wasmBundleCandidates)(HERE)) {
+        if (fs.existsSync(path.join(dir, harness_1.WASM_ENTRY)))
+            return dir;
+    }
+    return null;
+}
+/** Serve one file if it exists and stays within `root`; else 404/403. */
+function serveUnder(res, root, relPath) {
+    const safeRoot = path.resolve(root);
+    const rel = decodeURIComponent(relPath).replace(/^\/+/, "");
+    const target = path.resolve(safeRoot, rel);
+    // Path-traversal guard: the resolved target must stay inside the root.
+    if (target !== safeRoot && !target.startsWith(safeRoot + path.sep)) {
+        res.writeHead(403).end("Forbidden");
+        return;
+    }
+    fs.readFile(target, (err, data) => {
+        if (err) {
+            res.writeHead(404).end("Not found");
+            return;
+        }
+        res.writeHead(200, { "Content-Type": (0, harness_1.contentType)(target) }).end(data);
+    });
+}
+/** Serve an exact file (no traversal concern — a fixed internal artifact). */
+function serveFile(res, file) {
+    fs.readFile(file, (err, data) => {
+        if (err) {
+            res.writeHead(404).end("Not found");
+            return;
+        }
+        res.writeHead(200, { "Content-Type": (0, harness_1.contentType)(file) }).end(data);
+    });
+}
 /** Best-effort open the default browser at `url`. */
 function openBrowser(url) {
     const cmd = process.platform === "darwin"
@@ -81,47 +125,48 @@ function main(argv) {
         console.error("  ✗ compile failed — fix the resource graph and re-run.");
         process.exit(1);
     }
-    const bundle = path.join(HERE, "admin.js");
-    if (!fs.existsSync(bundle)) {
-        console.error("  ✗ admin bundle (dist/admin.js) not found — reinstall rastack.");
+    const wasmDir = resolveWasmDir();
+    if (!wasmDir) {
+        console.error("\n  ✗ No prebuilt WASM engine found in this rastack install.\n" +
+            "    Update rastack to pull the prebuilt bundle:\n" +
+            "      rastack update\n");
         process.exit(1);
     }
-    const repoRoot = path.resolve(HERE, "..", "..");
-    const binary = process.env.RASTACK_SERVER_BIN ||
-        path.join(repoRoot, "rust", "target", "release", "rastack-server");
-    const manifest = path.join(args.outDir, "schema.rastack.json");
-    const serverArgs = [
-        "admin",
-        "--manifest",
-        manifest,
-        "--warehouse",
-        args.warehouseDir,
-        "--addr",
-        `127.0.0.1:${args.port}`,
-        // Local dev context: the admin runs unauthenticated, exactly like the old
-        // native admin. Production admins run the server with --jwks/--admin-group.
-        "--insecure-dev-auth",
-    ];
-    const url = `http://127.0.0.1:${args.port}/admin/`;
-    // The server serves the React bundle from here; hand the path via env so the
-    // Rust side stays free of JS-toolchain knowledge.
-    const child = (0, child_process_1.spawn)(binary, serverArgs, {
-        stdio: "inherit",
-        env: { ...process.env, RASTACK_ADMIN_ASSETS: HERE },
-    });
-    child.on("error", () => {
-        console.error(`  ✗ Could not run the Rust server (${binary}). Build it first:\n` +
-            `      cd rust && cargo build --release\n`);
+    const adminBundle = path.join(HERE, "admin.js");
+    if (!fs.existsSync(adminBundle)) {
+        console.error("  ✗ admin bundle (dist/admin.js) not found — reinstall rastack.");
         process.exit(1);
+    }
+    const server = http.createServer((req, res) => {
+        const url = (req.url || "/").split("?")[0];
+        if (req.method !== "GET") {
+            res.writeHead(405).end("Method not allowed");
+            return;
+        }
+        if (url === "/" || url === "/index.html") {
+            res
+                .writeHead(200, { "Content-Type": "text/html; charset=utf-8" })
+                .end((0, harness_1.renderShell)("React API Stack — admin"));
+            return;
+        }
+        if (url === "/dev/admin.js")
+            return serveFile(res, adminBundle);
+        if (url.startsWith("/wasm/"))
+            return serveUnder(res, wasmDir, url.slice("/wasm/".length));
+        if (url === "/schema.rastack.json" || url === "/openapi.json")
+            return serveUnder(res, args.outDir, path.basename(url));
+        if (url.startsWith("/data/warehouse/"))
+            return serveUnder(res, args.warehouseDir, url.slice("/data/warehouse/".length));
+        res.writeHead(404).end("Not found");
     });
-    child.on("exit", (code) => process.exit(code ?? 0));
-    // Give the server a moment to bind, then print + open.
-    setTimeout(() => {
+    server.listen(args.port, () => {
+        const url = `http://localhost:${args.port}`;
+        console.log(`  ✓ WASM engine: ${path.relative(process.cwd(), wasmDir)}`);
         console.log(`\n  ▸ ${url}\n`);
         console.log("  Press Ctrl+C to stop.\n");
         if (args.open)
             openBrowser(url);
-    }, 700);
+    });
 }
 if (require.main === module) {
     main(process.argv.slice(2));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rastack",
-  "version": "0.0.48",
+  "version": "0.0.49",
   "description": "",
   "main": "runtime.ts",
   "types": "runtime.ts",

package/src/rastack-admin.ts

@@ -1,22 +1,36 @@
 #!/usr/bin/env node
 
 /**
- * `rastack admin` — the full, Django-admin-style console, served by the native
- * `rastack-server` against the real Iceberg warehouse.
+ * `rastack admin` — the full, Django-admin-style console, served **in the
+ * browser over the prebuilt WebAssembly engine** (exactly like `rastack dev`).
  *
  *   rastack admin [resourcesDir] [--warehouse <dir>] [--port <n>] [--out <dir>] [--no-open]
  *
- * Unlike the old server-rendered `/admin`, the console is React API Stack's own
- * React admin (`tools/admin`, built from `rastack/components` + `rastack/theme`)
- * — this command compiles the resources, points the server at the prebuilt
- * bundle (`RASTACK_ADMIN_ASSETS`), and boots it. The bundle talks back to the
- * same server's `/api` over HTTP, so edits persist to the real warehouse.
+ * The console is React API Stack's own React admin (`tools/admin`, built from
+ * `rastack/components` + `rastack/theme`). This command compiles the resources,
+ * then boots a dependency-free static server that hands the browser everything
+ * it needs to run the admin locally over WASM — no native server, no cargo:
+ *   • the bundled React admin (`/dev/admin.js`), which defaults to `mode:"local"`,
+ *   • the prebuilt WASM engine (`/wasm/…`) shipped in the package,
+ *   • the compiled `schema.rastack.json` / `openapi.json`,
+ *   • the committed Iceberg warehouse (`/data/warehouse/…`) to seed from.
+ *
+ * The engine is the single prebuilt `.wasm` bundle shipped in the npm package;
+ * if it is missing the command errors and points at `rastack update` — it never
+ * falls back to a from-source cargo build.
  */
 
-import { execFileSync, spawn, spawnSync } from "child_process";
+import { execFileSync, spawnSync } from "child_process";
 import * as fs from "fs";
+import * as http from "http";
 import * as path from "path";
-import { parseAdminArgs } from "./dev/harness";
+import {
+  WASM_ENTRY,
+  contentType,
+  parseAdminArgs,
+  renderShell,
+  wasmBundleCandidates,
+} from "./dev/harness";
 
 const HERE = __dirname; // dist/ when installed — the bundle lives beside us.
 
@@ -32,6 +46,48 @@ function compile(resourcesDir: string, outDir: string): boolean {
   return fs.existsSync(path.join(outDir, "schema.rastack.json"));
 }
 
+/** Locate the prebuilt wasm bundle dir shipped in the package (no cargo fallback). */
+function resolveWasmDir(): string | null {
+  for (const dir of wasmBundleCandidates(HERE)) {
+    if (fs.existsSync(path.join(dir, WASM_ENTRY))) return dir;
+  }
+  return null;
+}
+
+/** Serve one file if it exists and stays within `root`; else 404/403. */
+function serveUnder(
+  res: http.ServerResponse,
+  root: string,
+  relPath: string,
+): void {
+  const safeRoot = path.resolve(root);
+  const rel = decodeURIComponent(relPath).replace(/^\/+/, "");
+  const target = path.resolve(safeRoot, rel);
+  // Path-traversal guard: the resolved target must stay inside the root.
+  if (target !== safeRoot && !target.startsWith(safeRoot + path.sep)) {
+    res.writeHead(403).end("Forbidden");
+    return;
+  }
+  fs.readFile(target, (err, data) => {
+    if (err) {
+      res.writeHead(404).end("Not found");
+      return;
+    }
+    res.writeHead(200, { "Content-Type": contentType(target) }).end(data);
+  });
+}
+
+/** Serve an exact file (no traversal concern — a fixed internal artifact). */
+function serveFile(res: http.ServerResponse, file: string): void {
+  fs.readFile(file, (err, data) => {
+    if (err) {
+      res.writeHead(404).end("Not found");
+      return;
+    }
+    res.writeHead(200, { "Content-Type": contentType(file) }).end(data);
+  });
+}
+
 /** Best-effort open the default browser at `url`. */
 function openBrowser(url: string): void {
   const cmd =
@@ -57,54 +113,57 @@ function main(argv: string[]): void {
     process.exit(1);
   }
 
-  const bundle = path.join(HERE, "admin.js");
-  if (!fs.existsSync(bundle)) {
-    console.error("  ✗ admin bundle (dist/admin.js) not found — reinstall rastack.");
+  const wasmDir = resolveWasmDir();
+  if (!wasmDir) {
+    console.error(
+      "\n  ✗ No prebuilt WASM engine found in this rastack install.\n" +
+        "    Update rastack to pull the prebuilt bundle:\n" +
+        "      rastack update\n",
+    );
     process.exit(1);
   }
 
-  const repoRoot = path.resolve(HERE, "..", "..");
-  const binary =
-    process.env.RASTACK_SERVER_BIN ||
-    path.join(repoRoot, "rust", "target", "release", "rastack-server");
-
-  const manifest = path.join(args.outDir, "schema.rastack.json");
-  const serverArgs = [
-    "admin",
-    "--manifest",
-    manifest,
-    "--warehouse",
-    args.warehouseDir,
-    "--addr",
-    `127.0.0.1:${args.port}`,
-    // Local dev context: the admin runs unauthenticated, exactly like the old
-    // native admin. Production admins run the server with --jwks/--admin-group.
-    "--insecure-dev-auth",
-  ];
-
-  const url = `http://127.0.0.1:${args.port}/admin/`;
-  // The server serves the React bundle from here; hand the path via env so the
-  // Rust side stays free of JS-toolchain knowledge.
-  const child = spawn(binary, serverArgs, {
-    stdio: "inherit",
-    env: { ...process.env, RASTACK_ADMIN_ASSETS: HERE },
-  });
-
-  child.on("error", () => {
+  const adminBundle = path.join(HERE, "admin.js");
+  if (!fs.existsSync(adminBundle)) {
     console.error(
-      `  ✗ Could not run the Rust server (${binary}). Build it first:\n` +
-        `      cd rust && cargo build --release\n`,
+      "  ✗ admin bundle (dist/admin.js) not found — reinstall rastack.",
     );
     process.exit(1);
+  }
+
+  const server = http.createServer((req, res) => {
+    const url = (req.url || "/").split("?")[0];
+    if (req.method !== "GET") {
+      res.writeHead(405).end("Method not allowed");
+      return;
+    }
+    if (url === "/" || url === "/index.html") {
+      res
+        .writeHead(200, { "Content-Type": "text/html; charset=utf-8" })
+        .end(renderShell("React API Stack — admin"));
+      return;
+    }
+    if (url === "/dev/admin.js") return serveFile(res, adminBundle);
+    if (url.startsWith("/wasm/"))
+      return serveUnder(res, wasmDir, url.slice("/wasm/".length));
+    if (url === "/schema.rastack.json" || url === "/openapi.json")
+      return serveUnder(res, args.outDir, path.basename(url));
+    if (url.startsWith("/data/warehouse/"))
+      return serveUnder(
+        res,
+        args.warehouseDir,
+        url.slice("/data/warehouse/".length),
+      );
+    res.writeHead(404).end("Not found");
   });
-  child.on("exit", (code) => process.exit(code ?? 0));
 
-  // Give the server a moment to bind, then print + open.
-  setTimeout(() => {
+  server.listen(args.port, () => {
+    const url = `http://localhost:${args.port}`;
+    console.log(`  ✓ WASM engine: ${path.relative(process.cwd(), wasmDir)}`);
     console.log(`\n  ▸ ${url}\n`);
     console.log("  Press Ctrl+C to stop.\n");
     if (args.open) openBrowser(url);
-  }, 700);
+  });
 }
 
 if (require.main === module) {