rastack 0.0.62 → 0.0.64

package/dist/rastack-init.js

@@ -12,14 +12,17 @@
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
  *      (GitHub coordinates default from the `origin` remote; missing fields are
  *      prompted for on a TTY);
- *   2. resolves the tier-0 bootstrap stack's artifacts bucket — erroring with a
- *      pointer to `rastack bootstrap` when that account+region stack is missing
- *      (init is per-app and never creates account-level infrastructure);
+ *   2. verifies the AWS CLI is logged in, then ensures the tier-0 bootstrap stack
+ *      exists — creating it (the S3 template/placeholder buckets + GitHub OIDC
+ *      provider) when missing, reconciling it when it already does;
  *   3. uploads the Lambda placeholder bundle to that bucket;
  *   4. deploys the per-app backend (app.yaml) with the resolved ArtifactsBucket;
  *   5. reads the stack Outputs back into the config and prints the two GitHub repo
  *      Variables CI needs.
  *
+ * The CloudFormation templates ship inside the `rastack` package; a partial
+ * install falls back to downloading them from reactapistack.com.
+ *
  * Thereafter the recurring code deploy is CI's job — `rastack ci deploy`, which
  * `rastack deploy` also runs. `--no-deploy` scaffolds only; `--print` shows the
  * exact single-line `aws cloudformation deploy` commands without running them.
@@ -63,12 +66,23 @@ const path = __importStar(require("path"));
 const config_1 = require("./deploy/config");
 const workflows_1 = require("./deploy/workflows");
 const io_1 = require("./deploy/io");
+function parseEnvFlag(value) {
+    const v = value.trim().toLowerCase();
+    if (v === "all" || v === "")
+        return [...config_1.ENV_NAMES];
+    if (config_1.ENV_NAMES.includes(v))
+        return [v];
+    console.error(`Unknown --env: expected dev | prod | all.`);
+    process.exit(1);
+}
 function parseFlags(argv) {
-    const patch = { github: {} };
+    const patch = { github: {}, environments: {} };
+    let envs = [...config_1.ENV_NAMES];
     let force = false;
     let noWorkflows = false;
     let noDeploy = false;
     let print = false;
+    const devPatch = () => { var _a; return ((_a = patch.environments).dev ?? (_a.dev = {})); };
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
         const next = () => argv[++i] ?? "";
@@ -85,6 +99,17 @@ function parseFlags(argv) {
             case "--branch":
                 patch.github.branch = next();
                 break;
+            case "--dev-branch":
+                devPatch().branch = next();
+                break;
+            case "--dev-proxy":
+            case "--dev-proxy-upstream":
+                // The dev external-API proxy upstream (a UAT/prod backend URL).
+                devPatch().proxyUpstream = next();
+                break;
+            case "--env":
+                envs = parseEnvFlag(next());
+                break;
             case "--region":
                 patch.region = next();
                 break;
@@ -114,7 +139,10 @@ function parseFlags(argv) {
                 }
         }
     }
-    return { patch, force, noWorkflows, noDeploy, print };
+    // Drop the scratch environments container when nothing was set on it.
+    if (patch.environments && !patch.environments.dev)
+        delete patch.environments;
+    return { patch, envs, force, noWorkflows, noDeploy, print };
 }
 /** Seed a config: existing file → flags → git remote → defaults. */
 function seedConfig(flags) {
@@ -151,6 +179,35 @@ async function promptMissing(cfg) {
         });
     });
 }
+/**
+ * Ensure `.env` is git-ignored and (re)write the generated `.env` with the
+ * current config, preserving any secrets a developer already added. Returns the
+ * repo-relative paths touched, for the written/skipped summary.
+ */
+function writeEnvAndGitignore(cfg) {
+    const touched = [];
+    // 1. git-ignore `.env` (append-merge; never duplicate or clobber).
+    const giAbs = path.join(process.cwd(), workflows_1.GITIGNORE_PATH);
+    const existingGi = fs.existsSync(giAbs)
+        ? fs.readFileSync(giAbs, "utf-8")
+        : "";
+    const nextGi = (0, workflows_1.gitignoreWith)(existingGi, workflows_1.ENV_PATH);
+    if (nextGi !== existingGi) {
+        fs.writeFileSync(giAbs, nextGi);
+        touched.push(workflows_1.GITIGNORE_PATH);
+    }
+    // 2. Upsert the generated RASTACK_* values into `.env` (secrets preserved).
+    const envAbs = path.join(process.cwd(), workflows_1.ENV_PATH);
+    const existingEnv = fs.existsSync(envAbs)
+        ? fs.readFileSync(envAbs, "utf-8")
+        : "";
+    const nextEnv = (0, workflows_1.applyEnvValues)(existingEnv, cfg);
+    if (nextEnv !== existingEnv) {
+        fs.writeFileSync(envAbs, nextEnv);
+        touched.push(workflows_1.ENV_PATH);
+    }
+    return touched;
+}
 /** Yes/no confirmation with a default of "no" — gates the cloud-mutating steps. */
 async function confirm(question) {
     return (0, io_1.withPrompt)(async (rl) => {
@@ -164,104 +221,137 @@ function table(rows) {
     return rows.map((r) => `    ${r.key.padEnd(width)}  ${r.value}`).join("\n");
 }
 /**
- * Read the app.yaml stack Outputs into a `DeployOutputs`, skipping any that are
- * not resolvable yet (best-effort — a freshly created stack has them all).
+ * Read one environment's app.yaml stack Outputs into a `DeployOutputs`, skipping
+ * any not resolvable yet (best-effort — a freshly created stack has them all).
  */
-function readAppOutputs(cfg) {
+function readEnvOutputs(cfg, env) {
+    const stackName = (0, config_1.resolveEnvironment)(cfg, env).stackName;
     const outputs = {};
     for (const { key, field } of config_1.APP_STACK_OUTPUTS) {
-        const value = (0, io_1.stackOutput)(cfg.stackName, key, cfg.region);
+        const value = (0, io_1.stackOutput)(stackName, key, cfg.region);
         if (value)
             outputs[field] = value;
     }
     return outputs;
 }
+/** Merge an environment's resolved outputs back into the config in the right slot. */
+function withEnvOutputs(cfg, env, outputs) {
+    return env === "prod"
+        ? (0, config_1.mergeConfig)(cfg, { outputs })
+        : (0, config_1.mergeConfig)(cfg, { environments: { dev: { outputs } } });
+}
+/** Human label for an environment ("dev" / "prod") plus its branch. */
+function envLabel(cfg, env) {
+    const e = (0, config_1.resolveEnvironment)(cfg, env);
+    return `${env} (${e.branch} → ${e.ghEnvironment})`;
+}
 /**
  * Print the exact commands `init` would run, without touching the cloud
- * (`--print`). The artifacts bucket is read from the bootstrap stack when the
- * AWS CLI is available, else shown as a placeholder.
+ * (`--print`). init stands up *both* stacks, so both `aws cloudformation deploy`
+ * commands are shown: the tier-0 bootstrap stack (created only when missing) and
+ * the per-app backend. The artifacts bucket is read from an existing bootstrap
+ * stack when the AWS CLI is available, else shown as a placeholder.
  */
-function printPlan(cfg) {
+function printPlan(cfg, envs) {
     const bucket = (0, io_1.awsAvailable)()
         ? (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region)
         : null;
     const withBucket = (0, config_1.mergeConfig)(cfg, {
         artifactsBucket: bucket ?? "<ArtifactsBucketName from bootstrap stack>",
     });
+    const bootstrapTemplate = (0, io_1.resolveDeployAsset)("bootstrap.yaml") ?? undefined;
     const appTemplate = (0, io_1.resolveDeployAsset)("app.yaml") ?? undefined;
-    console.log(`\n  Deployment plan (${cfg.stackName} @ ${cfg.region})\n`);
-    console.log(`  ── Prerequisite: the tier-0 bootstrap stack (${(0, config_1.bootstrapStackName)(cfg)}) must exist ──`);
-    console.log(`  Create it once per account+region (init does not):  rastack bootstrap --region ${cfg.region}\n`);
-    console.log("  ── 1. Per-app backend (app.yaml) — what init deploys ──");
-    console.log("\n  " + (0, config_1.deployStackCommand)(withBucket, appTemplate) + "\n");
-    console.log("  ── 2. Wire these GitHub repo Variables from the stack Outputs ──");
-    console.log(table((0, config_1.repoVariables)(cfg).map((v) => ({
-        key: v.name,
-        value: v.value || `<${v.from}>`,
-    }))) + "\n");
+    console.log(`\n  Deployment plan (${envs.join(" + ")} @ ${cfg.region})\n`);
+    console.log(`  ── 1. Tier-0 bootstrap stack (${(0, config_1.bootstrapStackName)(cfg)}) — created only when missing ──`);
+    console.log("\n  " + (0, config_1.bootstrapStackCommand)(cfg, false, bootstrapTemplate) + "\n");
+    console.log("  ── 2. Per-app backend (app.yaml) — one stack per environment ──");
+    for (const env of envs) {
+        const e = (0, config_1.resolveEnvironment)(withBucket, env);
+        console.log(`\n  # ${envLabel(withBucket, env)} — stack ${e.stackName}`);
+        console.log("  " + (0, config_1.deployStackCommandForEnv)(withBucket, env, appTemplate));
+    }
+    console.log("\n  ── 2. Wire each GitHub Environment's Variables from its stack Outputs ──");
+    for (const env of envs) {
+        const e = (0, config_1.resolveEnvironment)(cfg, env);
+        console.log(`\n  # GitHub Environment: ${e.ghEnvironment}`);
+        console.log(table((0, config_1.repoVariablesForEnv)(cfg, env).map((v) => ({
+            key: v.name,
+            value: v.value || `<${v.from}>`,
+        }))));
+    }
+    console.log("");
 }
 /**
- * Stand the infrastructure up: ensure the bootstrap stack + artifacts bucket,
- * upload the Lambda placeholder, deploy app.yaml, and read the Outputs back into
- * the config. Returns the config enriched with the resolved buckets + outputs.
+ * Stand the infrastructure up: verify the AWS CLI is logged in, ensure the
+ * tier-0 bootstrap stack (creating it when missing), upload the Lambda
+ * placeholder, deploy app.yaml, and read the Outputs back into the config.
+ * `init` is the single command that stands up *everything* — there is no
+ * separate manual bootstrap step. Returns the config enriched with the resolved
+ * buckets + outputs.
  */
-async function standUp(cfg, interactive) {
+async function standUp(cfg, envs, interactive) {
     if (!(0, io_1.awsAvailable)()) {
         console.error("  ✗ the AWS CLI is not on PATH. Install it and configure credentials,\n" +
             "    or re-run with --print to see the commands, or --no-deploy to skip.");
         process.exit(1);
     }
-    // 1. Resolve the artifacts bucket from the tier-0 bootstrap stack. That stack
-    //    is an account+region once-off — the S3 buckets that host the templates +
-    //    Lambda placeholder, and the GitHub OIDC provider. `init` is a per-app
-    //    command and deliberately does NOT create it: standing up account-level
-    //    infrastructure is `rastack bootstrap`'s job (run once by an account admin),
-    //    so a missing bootstrap stack is a clear, actionable error, not an implicit
-    //    account mutation buried inside an app deploy.
-    const artifactsBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
-    const templatesBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_TEMPLATES_OUTPUT, cfg.region);
-    if (!artifactsBucket) {
-        console.error(`\n  ✗ Bootstrap stack ${(0, config_1.bootstrapStackName)(cfg)} not found in ${cfg.region}.\n` +
-            "    It is the once-per-account+region step that hosts the CloudFormation\n" +
-            "    templates and the Lambda placeholder every app deploy reads. Create it\n" +
-            "    first (an account admin does this once), then re-run `rastack init`:\n\n" +
-            `      rastack bootstrap --region ${cfg.region}\n`);
+    // Verify the AWS CLI is actually logged in before creating any stacks, so a
+    // missing/expired credential fails fast with an actionable message rather than
+    // a cryptic `cloudformation deploy` error partway through.
+    const account = (0, io_1.awsIdentity)(cfg.region);
+    if (!account) {
+        console.error("  ✗ the AWS CLI has no usable credentials — it is not logged in.\n" +
+            "    Configure credentials, then re-run `rastack init`:\n" +
+            "      aws configure            # static access key / secret\n" +
+            "      aws sso login            # or an existing SSO session\n" +
+            "    Or re-run with --print to see the commands, or --no-deploy to skip.");
         process.exit(1);
     }
+    console.log(`  ✓ AWS account ${account} (${cfg.region})`);
+    // 1. Ensure the tier-0 bootstrap stack exists — the S3 buckets that host the
+    //    templates + Lambda placeholder and the GitHub OIDC provider. init creates
+    //    it when missing (idempotent for an existing one), so a single command
+    //    takes an account+repo from nothing to a deployed backend.
+    const { artifactsBucket, templatesBucket } = await (0, io_1.ensureBootstrapStack)(cfg).catch((err) => {
+        console.error(`\n  ✗ ${err.message}`);
+        process.exit(1);
+    });
     console.log(`  ✓ artifacts bucket: ${artifactsBucket}`);
-    // 2. Upload the placeholder the function is created from.
+    // 2. Upload the placeholder the function is created from (shared by all envs).
     console.log("\n▸ Uploading the Lambda placeholder bundle");
     if (!(0, io_1.uploadPlaceholder)(artifactsBucket, cfg.region)) {
         console.error("  ✗ Lambda placeholder bundle not found in the rastack package — cannot create the function.");
         process.exit(1);
     }
-    // 3. Deploy the per-app backend with the resolved bucket wired in.
     cfg = (0, config_1.mergeConfig)(cfg, {
         artifactsBucket,
         templatesBucket: templatesBucket ?? undefined,
     });
-    const appTemplate = (0, io_1.resolveDeployAsset)("app.yaml");
+    const appTemplate = await (0, io_1.resolveTemplateFile)("app.yaml");
     if (!appTemplate) {
-        console.error("  ✗ app.yaml template not found in the rastack package. Reinstall rastack\n" +
-            "    (`npm i -g rastack`) or run from the framework repo.");
+        console.error("  ✗ app.yaml template not found in the rastack package and could not be\n" +
+            "    downloaded from reactapistack.com. Reinstall rastack (`npm i -g rastack`).");
         process.exit(1);
     }
-    console.log(`\n▸ Deploying ${cfg.stackName}`);
-    try {
-        (0, io_1.awsRun)((0, config_1.deployStackArgs)(cfg, appTemplate));
-    }
-    catch (err) {
-        console.error(`\n  ✗ aws cloudformation deploy failed for ${cfg.stackName}.\n    ${err.message}`);
-        process.exit(1);
+    // 3. Deploy one stack per environment — each with its own Cognito pool,
+    //    warehouse, Lambda and API — reading the Outputs back into the config.
+    for (const env of envs) {
+        const stackName = (0, config_1.resolveEnvironment)(cfg, env).stackName;
+        console.log(`\n▸ Deploying ${envLabel(cfg, env)} — ${stackName}`);
+        try {
+            (0, io_1.awsRun)((0, config_1.deployStackArgsForEnv)(cfg, env, appTemplate));
+        }
+        catch (err) {
+            console.error(`\n  ✗ aws cloudformation deploy failed for ${stackName}.\n    ${err.message}`);
+            process.exit(1);
+        }
+        cfg = withEnvOutputs(cfg, env, readEnvOutputs(cfg, env));
+        (0, io_1.saveConfig)(cfg);
     }
-    // 4. Read the Outputs back into the config so CI has them without a live lookup.
-    const outputs = readAppOutputs(cfg);
-    cfg = (0, config_1.mergeConfig)(cfg, { outputs });
-    (0, io_1.saveConfig)(cfg);
-    // 5. Connect the GitHub CLI and wire the repo Variables CI reads, so the FIRST
-    //    push actually ships. Without this the deploy-backend workflow's `if:
-    //    vars.AWS_DEPLOY_ROLE_ARN != ''` guard silently skips every run.
-    wireRepoVariables(cfg, interactive);
+    // 4. Connect the GitHub CLI and wire each environment's scoped Variables, so
+    //    the FIRST push actually ships. Without this the deploy-backend workflow's
+    //    `if: vars.AWS_DEPLOY_ROLE_ARN != ''` guard silently skips every run.
+    wireEnvironments(cfg, envs, interactive);
     return cfg;
 }
 /**
@@ -275,58 +365,97 @@ async function standUp(cfg, interactive) {
  * (and isn't) done.
  */
 const wiredVariables = new Set();
-function wireRepoVariables(cfg, interactive) {
-    const vars = (0, config_1.repoVariables)(cfg).filter((v) => v.value);
-    if (!vars.length)
+/** Key a wired Variable by its GitHub Environment so dev/prod don't collide. */
+function wiredKey(ghEnvironment, name) {
+    return `${ghEnvironment ?? ""}:${name}`;
+}
+/**
+ * Create each environment's GitHub Actions Environment and wire its scoped
+ * `AWS_DEPLOY_ROLE_ARN` / `AWS_REGION` Variables via `gh`, so the GitHub →
+ * Lambda pipeline is live for both dev and prod the moment `init` finishes.
+ */
+function wireEnvironments(cfg, envs, interactive) {
+    const anyValue = envs.some((env) => (0, config_1.repoVariablesForEnv)(cfg, env).some((v) => v.value));
+    if (!anyValue)
         return;
     if (!(0, io_1.ghAvailable)()) {
-        console.log("\n▸ GitHub CLI (`gh`) not found — skipping repo Variable wiring.\n" +
+        console.log("\n▸ GitHub CLI (`gh`) not found — skipping environment + Variable wiring.\n" +
             "  Install `gh` (https://cli.github.com) and re-run, or wire the\n" +
             "  Variables below by hand so pushes deploy.");
         return;
     }
-    // Connect `gh` to GitHub if it isn't already, so it can set the Variables.
+    // Connect `gh` to GitHub if it isn't already, so it can create environments.
     if (!(0, io_1.ghAuthenticated)()) {
         if (interactive) {
             console.log("\n▸ Connecting the GitHub CLI to your account (`gh auth login`)");
             (0, io_1.ghAuthLogin)();
         }
         if (!(0, io_1.ghAuthenticated)()) {
-            console.log("\n▸ GitHub CLI is not connected — skipping repo Variable wiring.\n" +
+            console.log("\n▸ GitHub CLI is not connected — skipping environment wiring.\n" +
                 "  Run `gh auth login`, then wire the Variables below by hand.");
             return;
         }
     }
-    console.log("\n▸ Wiring the GitHub repo Variables CI reads (via `gh`)");
-    for (const v of vars) {
-        const ok = (0, io_1.setRepoVariable)((0, config_1.ghVariableSetArgs)(cfg, v.name, v.value));
-        if (ok) {
-            wiredVariables.add(v.name);
-            console.log(`  ✓ set ${v.name}`);
+    console.log("\n▸ Creating GitHub Environments + wiring their Variables (via `gh`)");
+    for (const env of envs) {
+        const e = (0, config_1.resolveEnvironment)(cfg, env);
+        // Create the Environment first — a Variable can only be scoped to one that
+        // already exists. Idempotent (PUT), so re-running init is safe.
+        if (!(0, io_1.ghEnvironmentCreate)((0, config_1.ghEnvironmentCreateArgs)(cfg, e.ghEnvironment))) {
+            console.log(`  • could not create GitHub Environment ${e.ghEnvironment} — create it by hand`);
+            continue;
         }
-        else {
-            console.log(`  • could not set ${v.name} — wire it by hand (below)`);
+        for (const v of (0, config_1.repoVariablesForEnv)(cfg, env).filter((x) => x.value)) {
+            const ok = (0, io_1.setRepoVariable)((0, config_1.ghVariableSetArgs)(cfg, v.name, v.value, v.ghEnvironment));
+            if (ok) {
+                wiredVariables.add(wiredKey(v.ghEnvironment, v.name));
+                console.log(`  ✓ set ${e.ghEnvironment}/${v.name}`);
+            }
+            else {
+                console.log(`  • could not set ${e.ghEnvironment}/${v.name} — wire it by hand (below)`);
+            }
         }
     }
 }
-function printSummary(cfg) {
-    console.log(`\n  ✓ ${cfg.app} is deployed (${cfg.stackName} @ ${cfg.region})`);
-    if (cfg.outputs?.apiUrl)
-        console.log(`    API:  ${cfg.outputs.apiUrl}`);
+function printSummary(cfg, envs) {
+    console.log(`\n  ✓ ${cfg.app} is deployed @ ${cfg.region}`);
+    for (const env of envs) {
+        const e = (0, config_1.resolveEnvironment)(cfg, env);
+        console.log(`\n  ${env} — ${e.stackName}`);
+        if (e.outputs?.apiUrl)
+            console.log(`    API:        ${e.outputs.apiUrl}`);
+        if (e.outputs?.hostedUiUrl)
+            console.log(`    Hosted UI:  ${e.outputs.hostedUiUrl}`);
+        if (e.outputs?.userPoolId)
+            console.log(`    User Pool:  ${e.outputs.userPoolId}`);
+        if (e.outputs?.proxyUrl)
+            console.log(`    Proxy:      ${e.outputs.proxyUrl}`);
+    }
     // Only the Variables `init` could NOT wire itself remain a manual step.
-    const pending = (0, config_1.repoVariables)(cfg).filter((v) => !wiredVariables.has(v.name));
+    const pending = [];
+    for (const env of envs) {
+        const e = (0, config_1.resolveEnvironment)(cfg, env);
+        for (const v of (0, config_1.repoVariablesForEnv)(cfg, env)) {
+            if (!wiredVariables.has(wiredKey(v.ghEnvironment, v.name)))
+                pending.push({
+                    key: `${e.ghEnvironment}/${v.name}`,
+                    value: v.value || `<${v.from}>`,
+                });
+        }
+    }
     if (pending.length) {
-        console.log("\n  Wire these GitHub repo Variables so CI can ship code (Settings → Variables):");
-        console.log(table(pending.map((v) => ({
-            key: v.name,
-            value: v.value || `<${v.from}>`,
-        }))));
+        console.log("\n  Wire these per-environment GitHub Variables so CI can ship code\n" +
+            "  (Settings → Environments → <env> → Variables):");
+        console.log(table(pending));
     }
     else {
-        console.log("\n  ✓ wired the GitHub repo Variables CI reads (AWS_DEPLOY_ROLE_ARN, AWS_REGION).");
+        console.log("\n  ✓ wired every GitHub Environment's Variables (AWS_DEPLOY_ROLE_ARN, AWS_REGION).");
     }
-    console.log(`\n  Every push to ${cfg.github.branch} now ships code via \`rastack ci deploy\`` +
-        ` (also runnable locally as \`rastack deploy\`).\n`);
+    const dev = (0, config_1.resolveEnvironment)(cfg, "dev");
+    const prod = (0, config_1.resolveEnvironment)(cfg, "prod");
+    console.log(`\n  Pushes now ship code via \`rastack ci deploy\`:\n` +
+        `    ${prod.branch} → prod (${prod.ghEnvironment})   ${dev.branch} → dev (${dev.ghEnvironment})\n` +
+        `  Run one locally with \`rastack deploy --env dev\` / \`--env prod\`.\n`);
 }
 async function main(argv) {
     const flags = parseFlags(argv);
@@ -362,6 +491,10 @@ async function main(argv) {
         fs.writeFileSync(abs, f.content);
         written.push(f.path);
     }
+    // The `.env` (local app environment) + its `.gitignore` entry are standard —
+    // generated on every init, secrets preserved, refreshed with Outputs post-deploy.
+    for (const p of writeEnvAndGitignore(cfg))
+        written.push(p);
     console.log("");
     for (const w of written)
         console.log(`  ✓ wrote ${w}`);
@@ -369,7 +502,7 @@ async function main(argv) {
         console.log(`  • skipped ${s} (exists — pass --force to overwrite)`);
     // 2. Deploy (unless opted out).
     if (flags.print) {
-        printPlan(cfg);
+        printPlan(cfg, flags.envs);
         return;
     }
     if (flags.noDeploy) {
@@ -378,14 +511,20 @@ async function main(argv) {
         return;
     }
     if ((0, io_1.canPrompt)()) {
-        const ok = await confirm(`Deploy ${cfg.stackName} to AWS ${cfg.region} now? (requires the bootstrap stack to exist) [y/N]`);
+        const stacks = flags.envs
+            .map((env) => (0, config_1.resolveEnvironment)(cfg, env).stackName)
+            .join(" + ");
+        const ok = await confirm(`Deploy ${stacks} to AWS ${cfg.region} now? (creates the bootstrap stack if missing) [y/N]`);
         if (!ok) {
             console.log("\n  Skipped the deploy. Re-run to deploy, or `rastack init --print` for the commands.\n");
             return;
         }
     }
-    cfg = await standUp(cfg, (0, io_1.canPrompt)());
-    printSummary(cfg);
+    cfg = await standUp(cfg, flags.envs, (0, io_1.canPrompt)());
+    // Refresh `.env` with the resolved stack Outputs (API URLs, pool/client ids).
+    for (const p of writeEnvAndGitignore(cfg))
+        console.log(`  ✓ updated ${p}`);
+    printSummary(cfg, flags.envs);
 }
 if (require.main === module) {
     main(process.argv.slice(2)).catch((err) => {

package/dist/rastack.js

@@ -130,6 +130,7 @@ switch (command) {
     case "deploy":
         // Ship code to the Lambda — an alias for the CI code deploy. Infrastructure
         // is stood up once by `rastack init`; `deploy` only ever ships code.
+        // `--env dev|prod` picks which environment's function to update.
         run("rastack-ci.js", ["deploy", ...rest]);
         break;
     case "ci":