rastack 0.0.59 → 0.0.61

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+### [0.0.61](https://github.com/theserverkid/reactapistack/compare/v0.0.60...v0.0.61) (2026-07-19)
+
+
+### Features
+
+* **engine:** activate typed Parquet columns from the manifest ([45711c3](https://github.com/theserverkid/reactapistack/commit/45711c3bfc9c69cc2e841e1d8a31bc38728e58de))
+* **engine:** implement local-first sync server endpoints ([10d7e86](https://github.com/theserverkid/reactapistack/commit/10d7e861e8d574e0bb059ef3e3ce3538069d818f))
+* **store:** real typed per-field Parquet columns (Iceberg encoding) ([12d6f1f](https://github.com/theserverkid/reactapistack/commit/12d6f1fbe3d6326f54c79c33a3c9ea576d389f8f))
+
+### [0.0.60](https://github.com/theserverkid/reactapistack/compare/v0.0.59...v0.0.60) (2026-07-18)
+
+
+### Bug Fixes
+
+* repair perf bench + SAST breakage from the root refactor ([396994b](https://github.com/theserverkid/reactapistack/commit/396994b29f66034b108493a90f561179387c6ce3))
+
 ### [0.0.59](https://github.com/theserverkid/reactapistack/compare/v0.0.58...v0.0.59) (2026-07-18)
 
 

package/README.md

@@ -15,7 +15,7 @@ S3 at the bottom, with a stateless Rust API in between.
             └───────────────────────▲─────────────────────┘
                                     │  your types, resolved via the manifest
             ┌───────────────────────┴─────────────────────┐
-            │   TypeScript resources → `rastack compile`       │   API EXPOSURE
+            │   TypeScript resources → compile step        │   API EXPOSURE
             │   FK inferred from types → manifest+OpenAPI  │   SURFACE
             └───────────────────────▲─────────────────────┘
                                     │  schema.rastack.json (manifest)
@@ -41,7 +41,7 @@ S3 at the bottom, with a stateless Rust API in between.
 
 | Surface | What it is | Package(s) |
 | --- | --- | --- |
-| **API exposure** | TypeScript resources → `rastack compile` (FK inferred from types) → manifest + OpenAPI → pass your type to `useData` / `useForm` (typed TanStack Query hooks, no codegen) | the repo root, published as `rastack` (npm) — `components/`, `hooks/`, `theme/`, … |
+| **API exposure** | TypeScript resources → in-process compile (FK inferred from types) → manifest + OpenAPI → pass your type to `useData` / `useForm` (typed TanStack Query hooks, no codegen) | the repo root, published as `rastack` (npm) — `components/`, `hooks/`, `theme/`, … |
 | **Database storage** | A stateless Rust API that stores every model as an Apache Iceberg table on object storage — snapshots, ACID on S3, columnar Parquet | `engine/` (`serve/rastack-server`) |
 | **DevOps** | Serverless Rust on AWS Lambda + S3: stateless compute, state in object storage, infrastructure-as-code, scale-to-zero — driven by `rastack init` / `deploy` / `ci` | `deploy/cloudformation/`, `examples/serverless/` |
 
@@ -81,9 +81,9 @@ export const Terminal = resource("airports", "terminal", {
 ```
 
 ```bash
-rastack compile resources .rastack # TS → schema.rastack.json + openapi.json (FK detected)
-rastack dev                        # the app + admin, in-browser over the WASM engine
-rastack admin                      # Django-admin-style DB browser
+# No compile step to run — it happens in-process. Author your resources, then:
+rastack dev                        # compiles + serves your app in-browser over the WASM engine
+rastack admin                      # Django-admin-style DB browser over the same engine
 ```
 
 ```tsx
@@ -106,22 +106,26 @@ the importer, the server, and the in-browser WASM engine alike.
 
 ## Ship it — one command per stage
 
-The DevOps surface is a CLI too. A new repo is scaffolded, configured, and
-deployed with three commands, and GitHub Actions stays a one-liner because the
-pipeline lives in the CLI, not the YAML:
+The DevOps surface is a CLI too. A new repo goes from nothing to deployed in
+three commands, and GitHub Actions stays a one-liner because the pipeline lives
+in the CLI, not the YAML:
 
 ```bash
-rastack init                       # template .github/workflows + .rastack/deploy.json
-rastack deploy                     # configure the deployment; print the stack launch command
+rastack bootstrap                  # once per AWS account+region: buckets + GitHub OIDC
+rastack init                       # per app: scaffold .github/workflows + .rastack/deploy.json AND stand the backend up
 rastack ci deploy                  # what CI runs: build the arm64 Lambda, bake the JWKS, ship the code
 ```
 
-`init` scaffolds the base GitHub Actions and a deploy config (defaulting the
-GitHub coordinates from your `origin` remote); `deploy` fills that config in and
-prints the one-time `aws cloudformation deploy` plus the repo Variables to wire;
-`ci` runs the build/deploy pipeline so a workflow is just
-`run: rastack ci deploy` (`rastack ci --plan deploy` prints every step). Full
-guide: **[docs/serverless-deploy.md](docs/serverless-deploy.md)**.
+`bootstrap` stands the tier-0 account stack up once (the template-hosting
+buckets + the GitHub OIDC provider), decoupled from any app. `init` is per-app:
+it scaffolds the base GitHub Actions and a deploy config (defaulting the GitHub
+coordinates from your `origin` remote), then stands the serverless backend up —
+deploying `app.yaml`, reading the stack Outputs back into the config, and wiring
+the GitHub repo Variables so the first push deploys. From then on infrastructure
+is fixed and CI only ships code: `rastack ci deploy` builds and runs
+`update-function-code` (`rastack deploy` is an alias for it), so a workflow step
+is just `run: rastack ci deploy` (`rastack ci --plan deploy` prints every step).
+Full guide: **[docs/serverless-deploy.md](docs/serverless-deploy.md)**.
 
 ## Run the whole API in the browser
 

package/dist/rastack-dev.js

@@ -205,7 +205,12 @@ function startMetro(cwd, port) {
         EXPO_NO_TELEMETRY: "1",
     };
     delete env.CI;
-    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+    // `shell:true` is deliberate: it keeps the npx / npx.cmd split portable across
+    // POSIX and Windows. The only interpolated value is `port`, a number resolved
+    // by findFreePort (never user-controlled), so there is no shell-injection
+    // surface — suppress the spawn-shell-true audit rule (and its child-process
+    // sibling) here rather than break Windows portability.
+    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process, javascript.lang.security.audit.spawn-shell-true.spawn-shell-true
     const child = (0, child_process_1.spawn)(`npx expo start --web --port ${port}`, {
         cwd,
         env,

package/dist/rastack.d.ts

@@ -15,8 +15,8 @@
  *   rastack dev     [--port n] [--warehouse d]  Local dev: run your app in-browser over WASM
  *   rastack admin   [--warehouse dir] [--port n] Full admin console — React UI (rastack/components) over the native server
  *   rastack import <file> --resource app.model  Load CSV/XLSX/PDF data and validate it (state machine)
- *   rastack scan   [files...] [--fail-on-pii]   Scan CSVs for PII and schema info
- *   rastack seed   [--env dev] [--source gs://] Load CSVs into Iceberg namespace
+ *   rastack scan   [files...] [--fail-on-pii]   (LEGACY, pre-Rust) Scan CSVs for PII and schema info
+ *   rastack seed   [--env dev] [--source gs://] (LEGACY, pre-Rust) Load CSVs into Iceberg namespace
  *   rastack bootstrap [--owner o] [--repo r]    Stand the tier-0 AWS account stack up (once per account+region)
  *   rastack init   [--app slug] [--force]       Scaffold config + GitHub Actions AND stand the backend up
  *   rastack deploy [--plan]                     Ship code to the Lambda (alias for `rastack ci deploy`)

package/dist/rastack.js

@@ -16,8 +16,8 @@
  *   rastack dev     [--port n] [--warehouse d]  Local dev: run your app in-browser over WASM
  *   rastack admin   [--warehouse dir] [--port n] Full admin console — React UI (rastack/components) over the native server
  *   rastack import <file> --resource app.model  Load CSV/XLSX/PDF data and validate it (state machine)
- *   rastack scan   [files...] [--fail-on-pii]   Scan CSVs for PII and schema info
- *   rastack seed   [--env dev] [--source gs://] Load CSVs into Iceberg namespace
+ *   rastack scan   [files...] [--fail-on-pii]   (LEGACY, pre-Rust) Scan CSVs for PII and schema info
+ *   rastack seed   [--env dev] [--source gs://] (LEGACY, pre-Rust) Load CSVs into Iceberg namespace
  *   rastack bootstrap [--owner o] [--repo r]    Stand the tier-0 AWS account stack up (once per account+region)
  *   rastack init   [--app slug] [--force]       Scaffold config + GitHub Actions AND stand the backend up
  *   rastack deploy [--plan]                     Ship code to the Lambda (alias for `rastack ci deploy`)
@@ -108,9 +108,14 @@ switch (command) {
         run("rastack-import.js", rest);
         break;
     case "scan":
+        console.error("⚠ `rastack scan` is a legacy command from the pre-Rust architecture and\n" +
+            "  will be removed; it does not use the object-storage engine.\n");
         run("scan.js");
         break;
     case "seed":
+        console.error("⚠ `rastack seed` is a legacy command from the pre-Rust architecture and\n" +
+            "  will be removed; it emits DDL/shell against an external Iceberg catalog\n" +
+            "  and does not use the object-storage engine.\n");
         run("seed.js");
         break;
     case "bootstrap":
@@ -151,8 +156,8 @@ switch (command) {
             `  rastack dev     [--port n] [--warehouse dir] [--app dir] [--no-open]  Run your app in-browser over WASM (local dev)\n` +
             `  rastack admin   [--warehouse dir] [--port n] [--no-open]  Full admin console (React UI over the native server; needs a built rastack-server)\n` +
             `  rastack import <file.csv|.xlsx|.pdf> --resource app.model [--related app.model=<file>] [--out cleaned.json]\n` +
-            `  rastack scan   [files...] [--fail-on-pii]\n` +
-            `  rastack seed   [--env dev|staging] [--source gs://bucket/ | ./myapp-dev/]\n` +
+            `  rastack scan   [files...] [--fail-on-pii]                     (legacy, pre-Rust)\n` +
+            `  rastack seed   [--env dev|staging] [--source gs://bucket/ | ./myapp-dev/]  (legacy, pre-Rust)\n` +
             `  rastack bootstrap [--owner o] [--repo r] [--region r] [--prefix p] [--reuse-oidc] [--print]  Stand the AWS account stack up\n` +
             `  rastack init   [--app slug] [--owner o] [--repo r] [--print] [--no-deploy]  Scaffold + stand the backend up\n` +
             `  rastack deploy [--plan]                                       Ship code to the Lambda (alias for ci deploy)\n` +

package/dist/wasm/rastack_wasm.js

@@ -375,7 +375,7 @@ function __wbg_get_imports() {
             return ret;
         },
         __wbindgen_cast_0000000000000001: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 83, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 87, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen_ac0f9960a408a037___convert__closures_____invoke___wasm_bindgen_ac0f9960a408a037___JsValue__core_9b3796e30d99ddb7___result__Result_____wasm_bindgen_ac0f9960a408a037___JsError___true_);
             return ret;
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rastack",
-  "version": "0.0.59",
+  "version": "0.0.61",
   "description": "",
   "main": "runtime.ts",
   "types": "runtime.ts",

package/src/rastack-dev.ts

@@ -193,7 +193,12 @@ function startMetro(cwd: string, port: number): ChildProcess {
     EXPO_NO_TELEMETRY: "1",
   };
   delete env.CI;
-  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+  // `shell:true` is deliberate: it keeps the npx / npx.cmd split portable across
+  // POSIX and Windows. The only interpolated value is `port`, a number resolved
+  // by findFreePort (never user-controlled), so there is no shell-injection
+  // surface — suppress the spawn-shell-true audit rule (and its child-process
+  // sibling) here rather than break Windows portability.
+  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process, javascript.lang.security.audit.spawn-shell-true.spawn-shell-true
   const child = spawn(`npx expo start --web --port ${port}`, {
     cwd,
     env,

package/src/rastack.ts

@@ -16,8 +16,8 @@
  *   rastack dev     [--port n] [--warehouse d]  Local dev: run your app in-browser over WASM
  *   rastack admin   [--warehouse dir] [--port n] Full admin console — React UI (rastack/components) over the native server
  *   rastack import <file> --resource app.model  Load CSV/XLSX/PDF data and validate it (state machine)
- *   rastack scan   [files...] [--fail-on-pii]   Scan CSVs for PII and schema info
- *   rastack seed   [--env dev] [--source gs://] Load CSVs into Iceberg namespace
+ *   rastack scan   [files...] [--fail-on-pii]   (LEGACY, pre-Rust) Scan CSVs for PII and schema info
+ *   rastack seed   [--env dev] [--source gs://] (LEGACY, pre-Rust) Load CSVs into Iceberg namespace
  *   rastack bootstrap [--owner o] [--repo r]    Stand the tier-0 AWS account stack up (once per account+region)
  *   rastack init   [--app slug] [--force]       Scaffold config + GitHub Actions AND stand the backend up
  *   rastack deploy [--plan]                     Ship code to the Lambda (alias for `rastack ci deploy`)
@@ -111,9 +111,18 @@ switch (command) {
     run("rastack-import.js", rest);
     break;
   case "scan":
+    console.error(
+      "⚠ `rastack scan` is a legacy command from the pre-Rust architecture and\n" +
+        "  will be removed; it does not use the object-storage engine.\n",
+    );
     run("scan.js");
     break;
   case "seed":
+    console.error(
+      "⚠ `rastack seed` is a legacy command from the pre-Rust architecture and\n" +
+        "  will be removed; it emits DDL/shell against an external Iceberg catalog\n" +
+        "  and does not use the object-storage engine.\n",
+    );
     run("seed.js");
     break;
   case "bootstrap":
@@ -155,8 +164,8 @@ switch (command) {
         `  rastack dev     [--port n] [--warehouse dir] [--app dir] [--no-open]  Run your app in-browser over WASM (local dev)\n` +
         `  rastack admin   [--warehouse dir] [--port n] [--no-open]  Full admin console (React UI over the native server; needs a built rastack-server)\n` +
         `  rastack import <file.csv|.xlsx|.pdf> --resource app.model [--related app.model=<file>] [--out cleaned.json]\n` +
-        `  rastack scan   [files...] [--fail-on-pii]\n` +
-        `  rastack seed   [--env dev|staging] [--source gs://bucket/ | ./myapp-dev/]\n` +
+        `  rastack scan   [files...] [--fail-on-pii]                     (legacy, pre-Rust)\n` +
+        `  rastack seed   [--env dev|staging] [--source gs://bucket/ | ./myapp-dev/]  (legacy, pre-Rust)\n` +
         `  rastack bootstrap [--owner o] [--repo r] [--region r] [--prefix p] [--reuse-oidc] [--print]  Stand the AWS account stack up\n` +
         `  rastack init   [--app slug] [--owner o] [--repo r] [--print] [--no-deploy]  Scaffold + stand the backend up\n` +
         `  rastack deploy [--plan]                                       Ship code to the Lambda (alias for ci deploy)\n` +