rastack 0.0.61 → 0.0.63

package/dist/deploy/io.js

@@ -53,6 +53,7 @@ exports.ghAvailable = ghAvailable;
 exports.ghAuthenticated = ghAuthenticated;
 exports.ghAuthLogin = ghAuthLogin;
 exports.setRepoVariable = setRepoVariable;
+exports.ghEnvironmentCreate = ghEnvironmentCreate;
 exports.ask = ask;
 exports.withPrompt = withPrompt;
 const child_process_1 = require("child_process");
@@ -278,6 +279,22 @@ function setRepoVariable(args, cwd = process.cwd()) {
         return false;
     }
 }
+/**
+ * Create (idempotently, via `gh api --method PUT`) a GitHub Actions Environment
+ * so its scoped Variables can be set. Returns true on success. Best-effort — a
+ * missing/unauthenticated `gh` or an API error degrades to the printed
+ * instructions, exactly like `setRepoVariable`.
+ */
+function ghEnvironmentCreate(args, cwd = process.cwd()) {
+    try {
+        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+        (0, child_process_1.execFileSync)("gh", args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Ask a single question with a default, echoed as `label [default]: `. Returns
  * the trimmed answer, or the default on an empty line.

package/dist/deploy/workflows.d.ts

@@ -34,6 +34,36 @@ export declare function renderConfigFile(cfg: DeployConfig): string;
 export declare const CONFIG_PATH = ".rastack/deploy.json";
 export declare const CI_WORKFLOW_PATH = ".github/workflows/ci.yml";
 export declare const DEPLOY_WORKFLOW_PATH = ".github/workflows/deploy-backend.yml";
+export declare const ENV_PATH = ".env";
+export declare const GITIGNORE_PATH = ".gitignore";
+/**
+ * The generated `.env` — the app's **local** environment. Every value is
+ * non-secret (client ids, pool ids, public URLs from the stack Outputs), but the
+ * file is git-ignored by convention (`gitignoreWith`) so a developer can add
+ * their own secrets beside these without ever committing them. Values are blank
+ * until the matching stack is deployed; `rastack init` rewrites the file with the
+ * resolved Outputs after standing the backends up.
+ *
+ * Keys are `RASTACK_<ENV>_*` (a neutral prefix). For a browser bundle, re-export
+ * the ones you need under your bundler's public prefix (EXPO_PUBLIC_/VITE_/…);
+ * `rastack dev` also serves the dev pool config live at `/__rastack/cognito.json`.
+ */
+export declare function renderEnvFile(cfg: DeployConfig): string;
+/**
+ * Upsert the generated `RASTACK_*` keys from `renderEnvFile(cfg)` into an
+ * existing `.env`, preserving every other line (a developer's own secrets,
+ * comments, extra keys). A matching `RASTACK_*=` line is updated in place;
+ * generated keys not yet present are appended. When there is no existing file,
+ * this is exactly `renderEnvFile(cfg)`. Pure — the IO wrapper reads/writes.
+ */
+export declare function applyEnvValues(existing: string, cfg: DeployConfig): string;
+/**
+ * Return `.gitignore` content with a `.env` entry present (idempotent). Appends
+ * under a labelled block when missing, leaves the file untouched when `.env` is
+ * already ignored — so `rastack init` never duplicates the entry or clobbers a
+ * developer's existing ignore rules.
+ */
+export declare function gitignoreWith(existing: string, entry?: string): string;
 export interface ScaffoldOptions {
     /** Omit the GitHub Actions workflows (config only). */
     noWorkflows?: boolean;

package/dist/deploy/workflows.js

@@ -12,11 +12,15 @@
  * Pure string builders — `rastack-init.ts` is the thin wrapper that writes them.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEPLOY_WORKFLOW_PATH = exports.CI_WORKFLOW_PATH = exports.CONFIG_PATH = void 0;
+exports.GITIGNORE_PATH = exports.ENV_PATH = exports.DEPLOY_WORKFLOW_PATH = exports.CI_WORKFLOW_PATH = exports.CONFIG_PATH = void 0;
 exports.renderCiWorkflow = renderCiWorkflow;
 exports.renderDeployWorkflow = renderDeployWorkflow;
 exports.renderConfigFile = renderConfigFile;
+exports.renderEnvFile = renderEnvFile;
+exports.applyEnvValues = applyEnvValues;
+exports.gitignoreWith = gitignoreWith;
 exports.scaffoldFiles = scaffoldFiles;
+const config_1 = require("./config");
 /** Node version the templated workflows pin (LTS — safe for a fresh repo). */
 const NODE_VERSION = "22";
 /**
@@ -24,6 +28,8 @@ const NODE_VERSION = "22";
  * every push/PR. The clean replacement for hand-written compile/check steps.
  */
 function renderCiWorkflow(cfg) {
+    const prod = (0, config_1.resolveEnvironment)(cfg, "prod");
+    const dev = (0, config_1.resolveEnvironment)(cfg, "dev");
     return `name: CI
 
 # Validate the resource graph and compile the manifest on every change.
@@ -32,7 +38,7 @@ function renderCiWorkflow(cfg) {
 
 on:
   push:
-    branches: [${cfg.github.branch}]
+    branches: [${prod.branch}, ${dev.branch}]
   pull_request:
 
 permissions:
@@ -61,19 +67,28 @@ jobs:
  */
 function renderDeployWorkflow(cfg) {
     const arch = cfg.lambda.arch === "arm64" ? "arm64" : "x86_64";
+    const prod = (0, config_1.resolveEnvironment)(cfg, "prod");
+    const dev = (0, config_1.resolveEnvironment)(cfg, "dev");
+    // Pick the environment (and rastack --env flag) from the pushed branch.
+    const ghEnv = `\${{ github.ref_name == '${prod.branch}' && '${prod.ghEnvironment}' || '${dev.ghEnvironment}' }}`;
+    const envFlag = `\${{ github.ref_name == '${prod.branch}' && 'prod' || 'dev' }}`;
     return `name: Deploy backend
 
-# Ship the Rust API (rastack-server) to AWS Lambda. Infrastructure is created
-# once by a human via CloudFormation (docs/serverless-deploy.md); this workflow
+# Ship the Rust API (rastack-server) to AWS Lambda — dev and prod. Infrastructure
+# is created once by \`rastack init\` (docs/serverless-deploy.md); this workflow
 # only ever runs \`aws lambda update-function-code\`, wrapped by \`rastack ci\`.
 #
-# Wire these from the CloudFormation stack Outputs as GitHub repo Variables:
+# The environment is chosen from the branch:
+#   ${dev.branch} → ${dev.ghEnvironment} (dev stack)   ${prod.branch} → ${prod.ghEnvironment} (prod stack)
+#
+# Each GitHub Actions Environment holds its own AWS Variables (wired by
+# \`rastack init\` from that environment's stack Outputs):
 #   AWS_DEPLOY_ROLE_ARN   DeployRoleArn   (the OIDC role this job assumes)
 #   AWS_REGION            Region          (${cfg.region})
 
 on:
   push:
-    branches: [${cfg.github.branch}]
+    branches: [${prod.branch}, ${dev.branch}]
 
 # Least privilege: read the repo + mint an OIDC token to assume the deploy role.
 permissions:
@@ -81,15 +96,20 @@ permissions:
   id-token: write
 
 concurrency:
-  group: deploy-backend
+  # One in-flight deploy per branch, so dev and prod never cancel each other.
+  group: deploy-backend-\${{ github.ref_name }}
   cancel-in-progress: true
 
 jobs:
   deploy:
     name: Build & deploy the Lambda (${arch})
     runs-on: ubuntu-latest
-    # Skip on forks / repos that never wired the deploy role, so the job does
-    # not fail red for contributors who cannot (and should not) deploy.
+    # Select the GitHub Environment from the branch. Its scoped Variables
+    # (AWS_DEPLOY_ROLE_ARN / AWS_REGION) then resolve to the right stack, and
+    # prod protection rules (if any) gate the run.
+    environment: ${ghEnv}
+    # Skip on forks / environments that never wired the deploy role, so the job
+    # does not fail red for contributors who cannot (and should not) deploy.
     if: vars.AWS_DEPLOY_ROLE_ARN != ''
     steps:
       - uses: actions/checkout@v4
@@ -116,10 +136,10 @@ jobs:
           role-to-assume: \${{ vars.AWS_DEPLOY_ROLE_ARN }}
           aws-region: \${{ vars.AWS_REGION }}
 
-      # One line: compile the manifest, cross-build the bundle, bake the JWKS,
-      # and update-function-code. See \`rastack ci --plan deploy\`.
+      # One line: compile the manifest, cross-build the bundle, bake the env's
+      # Cognito JWKS, and update-function-code for that env's function.
       - name: Build & deploy
-        run: rastack ci deploy
+        run: rastack ci deploy --env ${envFlag}
 `;
 }
 /** The deploy config written to `.rastack/deploy.json`, pretty-printed. */
@@ -129,6 +149,91 @@ function renderConfigFile(cfg) {
 exports.CONFIG_PATH = ".rastack/deploy.json";
 exports.CI_WORKFLOW_PATH = ".github/workflows/ci.yml";
 exports.DEPLOY_WORKFLOW_PATH = ".github/workflows/deploy-backend.yml";
+exports.ENV_PATH = ".env";
+exports.GITIGNORE_PATH = ".gitignore";
+/**
+ * The generated `.env` — the app's **local** environment. Every value is
+ * non-secret (client ids, pool ids, public URLs from the stack Outputs), but the
+ * file is git-ignored by convention (`gitignoreWith`) so a developer can add
+ * their own secrets beside these without ever committing them. Values are blank
+ * until the matching stack is deployed; `rastack init` rewrites the file with the
+ * resolved Outputs after standing the backends up.
+ *
+ * Keys are `RASTACK_<ENV>_*` (a neutral prefix). For a browser bundle, re-export
+ * the ones you need under your bundler's public prefix (EXPO_PUBLIC_/VITE_/…);
+ * `rastack dev` also serves the dev pool config live at `/__rastack/cognito.json`.
+ */
+function renderEnvFile(cfg) {
+    const lines = [
+        "# Generated by `rastack init` — local app environment (git-ignored).",
+        "# Non-secret values from the CloudFormation stack Outputs; add your own",
+        "# secrets below. Re-run `rastack init` to refresh after a deploy.",
+        "",
+        `RASTACK_APP=${cfg.app}`,
+        `RASTACK_REGION=${cfg.region}`,
+        "",
+    ];
+    const envKeys = [
+        ["dev", "DEV"],
+        ["prod", "PROD"],
+    ];
+    for (const [env, prefix] of envKeys) {
+        const e = (0, config_1.resolveEnvironment)(cfg, env);
+        const o = e.outputs ?? {};
+        lines.push(`# ${env} (${e.branch} → ${e.ghEnvironment})`, `RASTACK_${prefix}_API_URL=${o.apiUrl ?? ""}`, `RASTACK_${prefix}_USER_POOL_ID=${o.userPoolId ?? ""}`, `RASTACK_${prefix}_USER_POOL_CLIENT_ID=${o.userPoolClientId ?? ""}`, `RASTACK_${prefix}_HOSTED_UI_URL=${o.hostedUiUrl ?? ""}`, `RASTACK_${prefix}_PROXY_URL=${o.proxyUrl ?? ""}`, "");
+    }
+    return lines.join("\n");
+}
+/**
+ * Upsert the generated `RASTACK_*` keys from `renderEnvFile(cfg)` into an
+ * existing `.env`, preserving every other line (a developer's own secrets,
+ * comments, extra keys). A matching `RASTACK_*=` line is updated in place;
+ * generated keys not yet present are appended. When there is no existing file,
+ * this is exactly `renderEnvFile(cfg)`. Pure — the IO wrapper reads/writes.
+ */
+function applyEnvValues(existing, cfg) {
+    const rendered = renderEnvFile(cfg);
+    if (!existing.trim())
+        return rendered;
+    const generated = new Map();
+    for (const line of rendered.split("\n")) {
+        const m = /^(RASTACK_[A-Z0-9_]+)=(.*)$/.exec(line);
+        if (m)
+            generated.set(m[1], m[2]);
+    }
+    const seen = new Set();
+    const out = existing.split("\n").map((line) => {
+        const m = /^(RASTACK_[A-Z0-9_]+)=/.exec(line);
+        if (m && generated.has(m[1])) {
+            seen.add(m[1]);
+            return `${m[1]}=${generated.get(m[1])}`;
+        }
+        return line;
+    });
+    const missing = [...generated].filter(([k]) => !seen.has(k));
+    if (missing.length) {
+        if (out.length && out[out.length - 1].trim() !== "")
+            out.push("");
+        for (const [k, v] of missing)
+            out.push(`${k}=${v}`);
+        out.push("");
+    }
+    return out.join("\n");
+}
+/**
+ * Return `.gitignore` content with a `.env` entry present (idempotent). Appends
+ * under a labelled block when missing, leaves the file untouched when `.env` is
+ * already ignored — so `rastack init` never duplicates the entry or clobbers a
+ * developer's existing ignore rules.
+ */
+function gitignoreWith(existing, entry = ".env") {
+    const lines = existing.split("\n").map((l) => l.trim());
+    if (lines.includes(entry))
+        return existing;
+    const base = existing.replace(/\n+$/, "");
+    const block = `# rastack — local environment (secrets)\n${entry}\n`;
+    return base ? `${base}\n\n${block}` : block;
+}
 /**
  * The full set of files `rastack init` templates: the deploy config plus the two
  * base workflows. Returned as data so the caller decides what to write, skip, or

package/dist/rastack-ci.js

@@ -19,9 +19,17 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const child_process_1 = require("child_process");
 const compile_1 = require("./compile");
+const config_1 = require("./deploy/config");
 const ci_1 = require("./deploy/ci");
 const io_1 = require("./deploy/io");
 const PHASES = ["check", "build", "deploy"];
+/** Coerce a string to an `EnvName`, or undefined when unset/unrecognised. */
+function parseEnv(value) {
+    const v = (value ?? "").trim();
+    return config_1.ENV_NAMES.includes(v)
+        ? v
+        : undefined;
+}
 function parseFlags(argv) {
     let phase = "";
     let plan = false;
@@ -29,6 +37,7 @@ function parseFlags(argv) {
         bin: process.env.RASTACK_BIN || "rastack",
         functionName: process.env.RASTACK_FUNCTION || undefined,
         jwksUrl: process.env.RASTACK_JWKS_URL || undefined,
+        env: parseEnv(process.env.RASTACK_ENV),
     };
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
@@ -47,6 +56,15 @@ function parseFlags(argv) {
             case "--jwks-url":
                 opts.jwksUrl = next();
                 break;
+            case "--env": {
+                const env = parseEnv(next());
+                if (!env) {
+                    console.error(`Unknown --env: expected ${config_1.ENV_NAMES.join(" | ")}.`);
+                    process.exit(1);
+                }
+                opts.env = env;
+                break;
+            }
             case "--bin":
                 opts.bin = next();
                 break;
@@ -65,7 +83,7 @@ function parseFlags(argv) {
         }
     }
     if (!phase) {
-        console.error(`Usage: rastack ci <${PHASES.join(" | ")}> [--plan] [--skip-build]\n`);
+        console.error(`Usage: rastack ci <${PHASES.join(" | ")}> [--env dev|prod] [--plan] [--skip-build]\n`);
         process.exit(1);
     }
     return { phase, plan, opts };

package/dist/rastack-dev.js

@@ -60,6 +60,8 @@ const http = __importStar(require("http"));
 const net = __importStar(require("net"));
 const path = __importStar(require("path"));
 const compile_1 = require("./compile");
+const config_1 = require("./deploy/config");
+const io_1 = require("./deploy/io");
 const harness_1 = require("./dev/harness");
 const HERE = __dirname; // dist/ when installed
 /** True when `cargo` is on PATH (the from-source wasm fallback needs it). */
@@ -131,6 +133,38 @@ function serveFile(res, file) {
         res.writeHead(200, { "Content-Type": (0, harness_1.contentType)(file) }).end(data);
     });
 }
+/**
+ * Serve the dev environment's Cognito coordinates (`/__rastack/cognito.json`) so
+ * a locally-running app can sign in against the *real* dev user pool. Read from
+ * `.rastack/deploy.json`'s dev outputs; `{}` when the dev stack isn't deployed
+ * yet (the app then falls back to `mode:"local"`). Returns whether a real config
+ * was found, for the startup hint.
+ */
+function serveDevCognito(res, cwd) {
+    let body = "{}";
+    try {
+        const cfg = (0, io_1.loadConfig)(cwd);
+        const runtime = cfg ? (0, config_1.cognitoRuntimeConfig)(cfg, "dev") : null;
+        if (runtime)
+            body = JSON.stringify(runtime);
+    }
+    catch {
+        /* no/invalid config → empty object, app uses the local shim */
+    }
+    res
+        .writeHead(200, { "Content-Type": "application/json; charset=utf-8" })
+        .end(body);
+}
+/** Whether a real dev Cognito config is available to advertise on startup. */
+function hasDevCognito(cwd) {
+    try {
+        const cfg = (0, io_1.loadConfig)(cwd);
+        return Boolean(cfg && (0, config_1.cognitoRuntimeConfig)(cfg, "dev"));
+    }
+    catch {
+        return false;
+    }
+}
 /** Best-effort open the default browser at `url`. */
 function openBrowser(url) {
     const cmd = process.platform === "darwin"
@@ -190,7 +224,7 @@ function getFreePort() {
         srv.listen(0, "127.0.0.1", () => {
             const addr = srv.address();
             const port = addr && typeof addr === "object" ? addr.port : 0;
-            srv.close(() => (port ? resolve(port) : reject(new Error("no free port"))));
+            srv.close(() => port ? resolve(port) : reject(new Error("no free port")));
         });
     });
 }
@@ -240,7 +274,13 @@ function waitForMetro(port, timeoutMs = 120000) {
 }
 /** Reverse-proxy one HTTP request/response pair to Metro. */
 function proxyToMetro(req, res, port) {
-    const proxyReq = http.request({ host: "127.0.0.1", port, method: req.method, path: req.url, headers: req.headers }, (proxyRes) => {
+    const proxyReq = http.request({
+        host: "127.0.0.1",
+        port,
+        method: req.method,
+        path: req.url,
+        headers: req.headers,
+    }, (proxyRes) => {
         res.writeHead(proxyRes.statusCode || 502, proxyRes.headers);
         proxyRes.pipe(res);
     });
@@ -310,6 +350,8 @@ async function runMetroMode(args, cwd) {
             return serveUnder(res, wasmDir, url.slice("/wasm/".length));
         if (url === "/schema.rastack.json" || url === "/openapi.json")
             return serveUnder(res, args.outDir, path.basename(url));
+        if (url === "/__rastack/cognito.json")
+            return serveDevCognito(res, cwd);
         if (url.startsWith("/data/warehouse/"))
             return serveUnder(res, args.warehouseDir, url.slice("/data/warehouse/".length));
         // Everything else → the live Metro bundle (HTML, JS, assets, HMR polls).
@@ -372,6 +414,8 @@ async function main(argv) {
             return serveUnder(res, wasmDir, url.slice("/wasm/".length));
         if (url === "/schema.rastack.json" || url === "/openapi.json")
             return serveUnder(res, args.outDir, path.basename(url));
+        if (url === "/__rastack/cognito.json")
+            return serveDevCognito(res, cwd);
         if (url.startsWith("/data/warehouse/"))
             return serveUnder(res, args.warehouseDir, url.slice("/data/warehouse/".length));
         // No app → the Django-style welcome page (root only; else 404).
@@ -404,6 +448,8 @@ async function main(argv) {
             console.log(`  ✓ app: ${path.relative(process.cwd(), appRoot) || "."}`);
         else
             console.log(`  ○ no app found — serving the welcome page`);
+        if (hasDevCognito(cwd))
+            console.log(`  ✓ dev Cognito: /__rastack/cognito.json (sign in against the real dev pool)`);
         console.log(`\n  ▸ ${url}\n`);
         console.log("  Need the database console? Run `rastack admin`. Ctrl+C to stop.\n");
         if (args.open)