rastack 0.0.62 → 0.0.64

package/dist/deploy/workflows.js

@@ -12,11 +12,15 @@
  * Pure string builders — `rastack-init.ts` is the thin wrapper that writes them.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEPLOY_WORKFLOW_PATH = exports.CI_WORKFLOW_PATH = exports.CONFIG_PATH = void 0;
+exports.GITIGNORE_PATH = exports.ENV_PATH = exports.DEPLOY_WORKFLOW_PATH = exports.CI_WORKFLOW_PATH = exports.CONFIG_PATH = void 0;
 exports.renderCiWorkflow = renderCiWorkflow;
 exports.renderDeployWorkflow = renderDeployWorkflow;
 exports.renderConfigFile = renderConfigFile;
+exports.renderEnvFile = renderEnvFile;
+exports.applyEnvValues = applyEnvValues;
+exports.gitignoreWith = gitignoreWith;
 exports.scaffoldFiles = scaffoldFiles;
+const config_1 = require("./config");
 /** Node version the templated workflows pin (LTS — safe for a fresh repo). */
 const NODE_VERSION = "22";
 /**
@@ -24,6 +28,8 @@ const NODE_VERSION = "22";
  * every push/PR. The clean replacement for hand-written compile/check steps.
  */
 function renderCiWorkflow(cfg) {
+    const prod = (0, config_1.resolveEnvironment)(cfg, "prod");
+    const dev = (0, config_1.resolveEnvironment)(cfg, "dev");
     return `name: CI
 
 # Validate the resource graph and compile the manifest on every change.
@@ -32,7 +38,7 @@ function renderCiWorkflow(cfg) {
 
 on:
   push:
-    branches: [${cfg.github.branch}]
+    branches: [${prod.branch}, ${dev.branch}]
   pull_request:
 
 permissions:
@@ -61,19 +67,28 @@ jobs:
  */
 function renderDeployWorkflow(cfg) {
     const arch = cfg.lambda.arch === "arm64" ? "arm64" : "x86_64";
+    const prod = (0, config_1.resolveEnvironment)(cfg, "prod");
+    const dev = (0, config_1.resolveEnvironment)(cfg, "dev");
+    // Pick the environment (and rastack --env flag) from the pushed branch.
+    const ghEnv = `\${{ github.ref_name == '${prod.branch}' && '${prod.ghEnvironment}' || '${dev.ghEnvironment}' }}`;
+    const envFlag = `\${{ github.ref_name == '${prod.branch}' && 'prod' || 'dev' }}`;
     return `name: Deploy backend
 
-# Ship the Rust API (rastack-server) to AWS Lambda. Infrastructure is created
-# once by a human via CloudFormation (docs/serverless-deploy.md); this workflow
+# Ship the Rust API (rastack-server) to AWS Lambda — dev and prod. Infrastructure
+# is created once by \`rastack init\` (docs/serverless-deploy.md); this workflow
 # only ever runs \`aws lambda update-function-code\`, wrapped by \`rastack ci\`.
 #
-# Wire these from the CloudFormation stack Outputs as GitHub repo Variables:
+# The environment is chosen from the branch:
+#   ${dev.branch} → ${dev.ghEnvironment} (dev stack)   ${prod.branch} → ${prod.ghEnvironment} (prod stack)
+#
+# Each GitHub Actions Environment holds its own AWS Variables (wired by
+# \`rastack init\` from that environment's stack Outputs):
 #   AWS_DEPLOY_ROLE_ARN   DeployRoleArn   (the OIDC role this job assumes)
 #   AWS_REGION            Region          (${cfg.region})
 
 on:
   push:
-    branches: [${cfg.github.branch}]
+    branches: [${prod.branch}, ${dev.branch}]
 
 # Least privilege: read the repo + mint an OIDC token to assume the deploy role.
 permissions:
@@ -81,15 +96,20 @@ permissions:
   id-token: write
 
 concurrency:
-  group: deploy-backend
+  # One in-flight deploy per branch, so dev and prod never cancel each other.
+  group: deploy-backend-\${{ github.ref_name }}
   cancel-in-progress: true
 
 jobs:
   deploy:
     name: Build & deploy the Lambda (${arch})
     runs-on: ubuntu-latest
-    # Skip on forks / repos that never wired the deploy role, so the job does
-    # not fail red for contributors who cannot (and should not) deploy.
+    # Select the GitHub Environment from the branch. Its scoped Variables
+    # (AWS_DEPLOY_ROLE_ARN / AWS_REGION) then resolve to the right stack, and
+    # prod protection rules (if any) gate the run.
+    environment: ${ghEnv}
+    # Skip on forks / environments that never wired the deploy role, so the job
+    # does not fail red for contributors who cannot (and should not) deploy.
     if: vars.AWS_DEPLOY_ROLE_ARN != ''
     steps:
       - uses: actions/checkout@v4
@@ -116,10 +136,10 @@ jobs:
           role-to-assume: \${{ vars.AWS_DEPLOY_ROLE_ARN }}
           aws-region: \${{ vars.AWS_REGION }}
 
-      # One line: compile the manifest, cross-build the bundle, bake the JWKS,
-      # and update-function-code. See \`rastack ci --plan deploy\`.
+      # One line: compile the manifest, cross-build the bundle, bake the env's
+      # Cognito JWKS, and update-function-code for that env's function.
       - name: Build & deploy
-        run: rastack ci deploy
+        run: rastack ci deploy --env ${envFlag}
 `;
 }
 /** The deploy config written to `.rastack/deploy.json`, pretty-printed. */
@@ -129,6 +149,91 @@ function renderConfigFile(cfg) {
 exports.CONFIG_PATH = ".rastack/deploy.json";
 exports.CI_WORKFLOW_PATH = ".github/workflows/ci.yml";
 exports.DEPLOY_WORKFLOW_PATH = ".github/workflows/deploy-backend.yml";
+exports.ENV_PATH = ".env";
+exports.GITIGNORE_PATH = ".gitignore";
+/**
+ * The generated `.env` — the app's **local** environment. Every value is
+ * non-secret (client ids, pool ids, public URLs from the stack Outputs), but the
+ * file is git-ignored by convention (`gitignoreWith`) so a developer can add
+ * their own secrets beside these without ever committing them. Values are blank
+ * until the matching stack is deployed; `rastack init` rewrites the file with the
+ * resolved Outputs after standing the backends up.
+ *
+ * Keys are `RASTACK_<ENV>_*` (a neutral prefix). For a browser bundle, re-export
+ * the ones you need under your bundler's public prefix (EXPO_PUBLIC_/VITE_/…);
+ * `rastack dev` also serves the dev pool config live at `/__rastack/cognito.json`.
+ */
+function renderEnvFile(cfg) {
+    const lines = [
+        "# Generated by `rastack init` — local app environment (git-ignored).",
+        "# Non-secret values from the CloudFormation stack Outputs; add your own",
+        "# secrets below. Re-run `rastack init` to refresh after a deploy.",
+        "",
+        `RASTACK_APP=${cfg.app}`,
+        `RASTACK_REGION=${cfg.region}`,
+        "",
+    ];
+    const envKeys = [
+        ["dev", "DEV"],
+        ["prod", "PROD"],
+    ];
+    for (const [env, prefix] of envKeys) {
+        const e = (0, config_1.resolveEnvironment)(cfg, env);
+        const o = e.outputs ?? {};
+        lines.push(`# ${env} (${e.branch} → ${e.ghEnvironment})`, `RASTACK_${prefix}_API_URL=${o.apiUrl ?? ""}`, `RASTACK_${prefix}_USER_POOL_ID=${o.userPoolId ?? ""}`, `RASTACK_${prefix}_USER_POOL_CLIENT_ID=${o.userPoolClientId ?? ""}`, `RASTACK_${prefix}_HOSTED_UI_URL=${o.hostedUiUrl ?? ""}`, `RASTACK_${prefix}_PROXY_URL=${o.proxyUrl ?? ""}`, "");
+    }
+    return lines.join("\n");
+}
+/**
+ * Upsert the generated `RASTACK_*` keys from `renderEnvFile(cfg)` into an
+ * existing `.env`, preserving every other line (a developer's own secrets,
+ * comments, extra keys). A matching `RASTACK_*=` line is updated in place;
+ * generated keys not yet present are appended. When there is no existing file,
+ * this is exactly `renderEnvFile(cfg)`. Pure — the IO wrapper reads/writes.
+ */
+function applyEnvValues(existing, cfg) {
+    const rendered = renderEnvFile(cfg);
+    if (!existing.trim())
+        return rendered;
+    const generated = new Map();
+    for (const line of rendered.split("\n")) {
+        const m = /^(RASTACK_[A-Z0-9_]+)=(.*)$/.exec(line);
+        if (m)
+            generated.set(m[1], m[2]);
+    }
+    const seen = new Set();
+    const out = existing.split("\n").map((line) => {
+        const m = /^(RASTACK_[A-Z0-9_]+)=/.exec(line);
+        if (m && generated.has(m[1])) {
+            seen.add(m[1]);
+            return `${m[1]}=${generated.get(m[1])}`;
+        }
+        return line;
+    });
+    const missing = [...generated].filter(([k]) => !seen.has(k));
+    if (missing.length) {
+        if (out.length && out[out.length - 1].trim() !== "")
+            out.push("");
+        for (const [k, v] of missing)
+            out.push(`${k}=${v}`);
+        out.push("");
+    }
+    return out.join("\n");
+}
+/**
+ * Return `.gitignore` content with a `.env` entry present (idempotent). Appends
+ * under a labelled block when missing, leaves the file untouched when `.env` is
+ * already ignored — so `rastack init` never duplicates the entry or clobbers a
+ * developer's existing ignore rules.
+ */
+function gitignoreWith(existing, entry = ".env") {
+    const lines = existing.split("\n").map((l) => l.trim());
+    if (lines.includes(entry))
+        return existing;
+    const base = existing.replace(/\n+$/, "");
+    const block = `# rastack — local environment (secrets)\n${entry}\n`;
+    return base ? `${base}\n\n${block}` : block;
+}
 /**
  * The full set of files `rastack init` templates: the deploy config plus the two
  * base workflows. Returned as data so the caller decides what to write, skip, or

package/dist/rastack-bootstrap.js

@@ -124,60 +124,31 @@ function printPlan(cfg, reuseOidc) {
         "  ArtifactsBucket to create app backends. Nothing here is app-specific.\n");
 }
 /**
- * Deploy the bootstrap stack, retrying once against an account that already has
- * a GitHub OIDC provider (AWS allows only one per URL) when the caller did not
- * already ask to reuse it.
+ * Stand the tier-0 bootstrap stack up and upload the Lambda placeholder. The
+ * deploy (with the GitHub-OIDC-reuse retry) and template resolution are shared
+ * with `rastack init` via `ensureBootstrapStack`, so both stand the stack up
+ * identically.
  */
-function deployBootstrap(cfg, reuseOidc) {
-    const template = (0, io_1.resolveDeployAsset)("bootstrap.yaml");
-    if (!template) {
-        console.error("  ✗ bootstrap.yaml template not found in the rastack package. Reinstall\n" +
-            "    rastack (`npm i -g rastack`) or run from the framework repo.");
-        process.exit(1);
-    }
-    try {
-        (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, reuseOidc, template));
-    }
-    catch (err) {
-        if (reuseOidc) {
-            console.error(`\n  ✗ bootstrap stack deploy failed.\n    ${err.message}`);
-            process.exit(1);
-        }
-        // The most common cause is an account that already has a GitHub OIDC
-        // provider. Retry telling the template to reuse it instead of creating a
-        // second (which CloudFormation rejects).
-        console.log("  • retrying bootstrap, reusing the account's existing GitHub OIDC provider");
-        try {
-            (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, true, template));
-        }
-        catch (retryErr) {
-            console.error(`\n  ✗ bootstrap stack deploy failed.\n    ${retryErr.message}`);
-            process.exit(1);
-        }
-    }
-}
-/** Stand the tier-0 bootstrap stack up and upload the Lambda placeholder. */
-function standUp(cfg, reuseOidc) {
+async function standUp(cfg, reuseOidc) {
     if (!(0, io_1.awsAvailable)()) {
         console.error("  ✗ the AWS CLI is not on PATH. Install it and configure credentials,\n" +
             "    or re-run with --print to see the command.");
         process.exit(1);
     }
-    const stack = (0, config_1.bootstrapStackName)(cfg);
-    const existing = (0, io_1.stackOutput)(stack, config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
-    if (existing) {
-        console.log(`\n▸ Bootstrap stack ${stack} already exists — reconciling (idempotent).`);
-    }
-    else {
-        console.log(`\n▸ Creating bootstrap stack ${stack} (@ ${cfg.region})`);
-    }
-    deployBootstrap(cfg, reuseOidc);
-    const artifactsBucket = (0, io_1.stackOutput)(stack, config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
-    const templatesBucket = (0, io_1.stackOutput)(stack, config_1.BOOTSTRAP_TEMPLATES_OUTPUT, cfg.region);
-    if (!artifactsBucket) {
-        console.error("  ✗ bootstrap stack deployed but its ArtifactsBucket output could not be read.");
+    // Verify the AWS CLI is logged in before attempting a stack deploy.
+    const account = (0, io_1.awsIdentity)(cfg.region);
+    if (!account) {
+        console.error("  ✗ the AWS CLI has no usable credentials — it is not logged in.\n" +
+            "    Run `aws configure` (or `aws sso login`), then re-run `rastack bootstrap`.\n" +
+            "    Or re-run with --print to see the command.");
         process.exit(1);
     }
+    console.log(`  ✓ AWS account ${account} (${cfg.region})`);
+    const stack = (0, config_1.bootstrapStackName)(cfg);
+    const { artifactsBucket, templatesBucket } = await (0, io_1.ensureBootstrapStack)(cfg, reuseOidc).catch((err) => {
+        console.error(`\n  ✗ ${err.message}`);
+        process.exit(1);
+    });
     console.log(`  ✓ artifacts bucket:  ${artifactsBucket}`);
     if (templatesBucket)
         console.log(`  ✓ templates bucket:  ${templatesBucket}`);
@@ -220,7 +191,7 @@ async function main(argv) {
             return;
         }
     }
-    standUp(cfg, flags.reuseOidc);
+    await standUp(cfg, flags.reuseOidc);
 }
 if (require.main === module) {
     main(process.argv.slice(2)).catch((err) => {

package/dist/rastack-ci.js

@@ -19,9 +19,17 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const child_process_1 = require("child_process");
 const compile_1 = require("./compile");
+const config_1 = require("./deploy/config");
 const ci_1 = require("./deploy/ci");
 const io_1 = require("./deploy/io");
 const PHASES = ["check", "build", "deploy"];
+/** Coerce a string to an `EnvName`, or undefined when unset/unrecognised. */
+function parseEnv(value) {
+    const v = (value ?? "").trim();
+    return config_1.ENV_NAMES.includes(v)
+        ? v
+        : undefined;
+}
 function parseFlags(argv) {
     let phase = "";
     let plan = false;
@@ -29,6 +37,7 @@ function parseFlags(argv) {
         bin: process.env.RASTACK_BIN || "rastack",
         functionName: process.env.RASTACK_FUNCTION || undefined,
         jwksUrl: process.env.RASTACK_JWKS_URL || undefined,
+        env: parseEnv(process.env.RASTACK_ENV),
     };
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
@@ -47,6 +56,15 @@ function parseFlags(argv) {
             case "--jwks-url":
                 opts.jwksUrl = next();
                 break;
+            case "--env": {
+                const env = parseEnv(next());
+                if (!env) {
+                    console.error(`Unknown --env: expected ${config_1.ENV_NAMES.join(" | ")}.`);
+                    process.exit(1);
+                }
+                opts.env = env;
+                break;
+            }
             case "--bin":
                 opts.bin = next();
                 break;
@@ -65,7 +83,7 @@ function parseFlags(argv) {
         }
     }
     if (!phase) {
-        console.error(`Usage: rastack ci <${PHASES.join(" | ")}> [--plan] [--skip-build]\n`);
+        console.error(`Usage: rastack ci <${PHASES.join(" | ")}> [--env dev|prod] [--plan] [--skip-build]\n`);
         process.exit(1);
     }
     return { phase, plan, opts };

package/dist/rastack-dev.js

@@ -60,6 +60,8 @@ const http = __importStar(require("http"));
 const net = __importStar(require("net"));
 const path = __importStar(require("path"));
 const compile_1 = require("./compile");
+const config_1 = require("./deploy/config");
+const io_1 = require("./deploy/io");
 const harness_1 = require("./dev/harness");
 const HERE = __dirname; // dist/ when installed
 /** True when `cargo` is on PATH (the from-source wasm fallback needs it). */
@@ -131,6 +133,38 @@ function serveFile(res, file) {
         res.writeHead(200, { "Content-Type": (0, harness_1.contentType)(file) }).end(data);
     });
 }
+/**
+ * Serve the dev environment's Cognito coordinates (`/__rastack/cognito.json`) so
+ * a locally-running app can sign in against the *real* dev user pool. Read from
+ * `.rastack/deploy.json`'s dev outputs; `{}` when the dev stack isn't deployed
+ * yet (the app then falls back to `mode:"local"`). Returns whether a real config
+ * was found, for the startup hint.
+ */
+function serveDevCognito(res, cwd) {
+    let body = "{}";
+    try {
+        const cfg = (0, io_1.loadConfig)(cwd);
+        const runtime = cfg ? (0, config_1.cognitoRuntimeConfig)(cfg, "dev") : null;
+        if (runtime)
+            body = JSON.stringify(runtime);
+    }
+    catch {
+        /* no/invalid config → empty object, app uses the local shim */
+    }
+    res
+        .writeHead(200, { "Content-Type": "application/json; charset=utf-8" })
+        .end(body);
+}
+/** Whether a real dev Cognito config is available to advertise on startup. */
+function hasDevCognito(cwd) {
+    try {
+        const cfg = (0, io_1.loadConfig)(cwd);
+        return Boolean(cfg && (0, config_1.cognitoRuntimeConfig)(cfg, "dev"));
+    }
+    catch {
+        return false;
+    }
+}
 /** Best-effort open the default browser at `url`. */
 function openBrowser(url) {
     const cmd = process.platform === "darwin"
@@ -190,7 +224,7 @@ function getFreePort() {
         srv.listen(0, "127.0.0.1", () => {
             const addr = srv.address();
             const port = addr && typeof addr === "object" ? addr.port : 0;
-            srv.close(() => (port ? resolve(port) : reject(new Error("no free port"))));
+            srv.close(() => port ? resolve(port) : reject(new Error("no free port")));
         });
     });
 }
@@ -240,7 +274,13 @@ function waitForMetro(port, timeoutMs = 120000) {
 }
 /** Reverse-proxy one HTTP request/response pair to Metro. */
 function proxyToMetro(req, res, port) {
-    const proxyReq = http.request({ host: "127.0.0.1", port, method: req.method, path: req.url, headers: req.headers }, (proxyRes) => {
+    const proxyReq = http.request({
+        host: "127.0.0.1",
+        port,
+        method: req.method,
+        path: req.url,
+        headers: req.headers,
+    }, (proxyRes) => {
         res.writeHead(proxyRes.statusCode || 502, proxyRes.headers);
         proxyRes.pipe(res);
     });
@@ -310,6 +350,8 @@ async function runMetroMode(args, cwd) {
             return serveUnder(res, wasmDir, url.slice("/wasm/".length));
         if (url === "/schema.rastack.json" || url === "/openapi.json")
             return serveUnder(res, args.outDir, path.basename(url));
+        if (url === "/__rastack/cognito.json")
+            return serveDevCognito(res, cwd);
         if (url.startsWith("/data/warehouse/"))
             return serveUnder(res, args.warehouseDir, url.slice("/data/warehouse/".length));
         // Everything else → the live Metro bundle (HTML, JS, assets, HMR polls).
@@ -372,6 +414,8 @@ async function main(argv) {
             return serveUnder(res, wasmDir, url.slice("/wasm/".length));
         if (url === "/schema.rastack.json" || url === "/openapi.json")
             return serveUnder(res, args.outDir, path.basename(url));
+        if (url === "/__rastack/cognito.json")
+            return serveDevCognito(res, cwd);
         if (url.startsWith("/data/warehouse/"))
             return serveUnder(res, args.warehouseDir, url.slice("/data/warehouse/".length));
         // No app → the Django-style welcome page (root only; else 404).
@@ -404,6 +448,8 @@ async function main(argv) {
             console.log(`  ✓ app: ${path.relative(process.cwd(), appRoot) || "."}`);
         else
             console.log(`  ○ no app found — serving the welcome page`);
+        if (hasDevCognito(cwd))
+            console.log(`  ✓ dev Cognito: /__rastack/cognito.json (sign in against the real dev pool)`);
         console.log(`\n  ▸ ${url}\n`);
         console.log("  Need the database console? Run `rastack admin`. Ctrl+C to stop.\n");
         if (args.open)

package/dist/rastack-init.d.ts

@@ -11,14 +11,17 @@
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
  *      (GitHub coordinates default from the `origin` remote; missing fields are
  *      prompted for on a TTY);
- *   2. resolves the tier-0 bootstrap stack's artifacts bucket — erroring with a
- *      pointer to `rastack bootstrap` when that account+region stack is missing
- *      (init is per-app and never creates account-level infrastructure);
+ *   2. verifies the AWS CLI is logged in, then ensures the tier-0 bootstrap stack
+ *      exists — creating it (the S3 template/placeholder buckets + GitHub OIDC
+ *      provider) when missing, reconciling it when it already does;
  *   3. uploads the Lambda placeholder bundle to that bucket;
  *   4. deploys the per-app backend (app.yaml) with the resolved ArtifactsBucket;
  *   5. reads the stack Outputs back into the config and prints the two GitHub repo
  *      Variables CI needs.
  *
+ * The CloudFormation templates ship inside the `rastack` package; a partial
+ * install falls back to downloading them from reactapistack.com.
+ *
  * Thereafter the recurring code deploy is CI's job — `rastack ci deploy`, which
  * `rastack deploy` also runs. `--no-deploy` scaffolds only; `--print` shows the
  * exact single-line `aws cloudformation deploy` commands without running them.