rastack 0.0.63 → 0.0.64

package/dist/compile/analyze.js

@@ -172,7 +172,17 @@ function analyzeField(name, initializer, checker) {
         const app = literalTypeProp(fieldType, "__app", checker, initializer);
         const model = literalTypeProp(fieldType, "__model", checker, initializer);
         if (app && model) {
-            return { name, type: "fk", relation: { app, model } };
+            const fk = { name, type: "fk", relation: { app, model } };
+            // `s.ref(() => X, { null: true })` — a nullable relation (a shared secret
+            // with no project, an unassigned task). The options object is the ref
+            // call's second argument, read the same way scalar constraints are.
+            if (ts.isCallExpression(initializer)) {
+                const opts = literalToValue(initializer.arguments[1]);
+                if (opts && typeof opts === "object" && opts.null === true) {
+                    fk.null = true;
+                }
+            }
+            return fk;
         }
         return undefined;
     }

package/dist/define/index.d.ts

@@ -64,6 +64,11 @@ export interface Ref<App extends string, Model extends string> {
     readonly __model: Model;
     /** The authored `() => Resource` thunk — carried at runtime. */
     readonly target?: () => ResourceType<App, Model, any>;
+    /** Optional FK constraints — `null: true` makes the relation nullable
+     * (e.g. a shared secret with no project, or an unassigned task). */
+    readonly options?: {
+        null?: boolean;
+    };
 }
 export interface StringOptions {
     maxLength?: number;
@@ -105,7 +110,9 @@ export declare const s: {
      * the relation from the *type* `Ref<App, Model>` this returns, and the
      * runtime keeps the thunk so `manifestFromResources()` can resolve it too.
      */
-    ref<A extends string, M extends string>(thunk: () => ResourceType<A, M, any>): Ref<A, M>;
+    ref<A extends string, M extends string>(thunk: () => ResourceType<A, M, any>, options?: {
+        null?: boolean;
+    }): Ref<A, M>;
 };
 export type AnyField = Scalar<string> | Ref<string, string>;
 /** Local-first sync configuration (mirrors the old Python `class Sync:`). */

package/dist/define/index.js

@@ -56,8 +56,8 @@ exports.s = {
      * the relation from the *type* `Ref<App, Model>` this returns, and the
      * runtime keeps the thunk so `manifestFromResources()` can resolve it too.
      */
-    ref(thunk) {
-        return { __rastackRef: true, target: thunk };
+    ref(thunk, options) {
+        return { __rastackRef: true, target: thunk, options };
     },
 };
 /** Define a resource. Capture app/model (and options) as literal types. */

package/dist/define/manifest.js

@@ -89,11 +89,17 @@ function runtimeField(res, name, value) {
         if (!isResourceValue(target)) {
             throw new Error(`manifestFromResources: ${res.app}.${res.model}.${name} is an s.ref(...) whose target thunk did not return a resource() value`);
         }
-        return {
+        const fk = {
             name,
             type: "fk",
             relation: { app: target.app, model: target.model },
         };
+        // A nullable FK (`s.ref(() => X, { null: true })`) — e.g. a shared secret
+        // with no project — so the engine allows and stores a null relation.
+        if (field.options?.null === true) {
+            fk.null = true;
+        }
+        return fk;
     }
     if (typeof field.__rastackScalar !== "string")
         return undefined;

package/dist/deploy/io.d.ts

@@ -22,6 +22,27 @@ export declare function configPath(cwd?: string): string;
  * repo itself still works. Returns null when no candidate exists.
  */
 export declare function resolveDeployAsset(relPath: string, cwd?: string): string | null;
+/**
+ * Base URL the framework's CloudFormation templates are published at. The same
+ * site that hosts the installer (`reactapistack.com/setup.sh`) serves the base
+ * templates, so a CLI whose bundled copy is missing (a partial install, or a
+ * globally-linked dev build) can still fetch them.
+ */
+export declare const TEMPLATE_BASE_URL = "https://reactapistack.com/cloudformation";
+/**
+ * Download a published CloudFormation template to a temp file, returning its
+ * path — or null on any failure (offline, 404, write error). Used as the
+ * fallback when the template is not bundled with the install.
+ */
+export declare function downloadTemplate(name: string, base?: string): Promise<string | null>;
+/**
+ * Resolve a CloudFormation template to a local file path for `aws cloudformation
+ * deploy` (which accepts only `--template-file`). Prefers the copy bundled with
+ * the `rastack` install; when that is missing, downloads it from the React API
+ * Stack website. Returns null only when the template is neither bundled nor
+ * fetchable.
+ */
+export declare function resolveTemplateFile(name: string, cwd?: string): Promise<string | null>;
 /** Read + normalize the deploy config, or null when it does not exist yet. */
 export declare function loadConfig(cwd?: string): DeployConfig | null;
 /** Write the deploy config, creating `.rastack/` if needed. */
@@ -39,6 +60,14 @@ export declare function awsCapture(args: string[], cwd?: string): string | null;
 export declare function awsRun(args: string[], cwd?: string): void;
 /** True when the AWS CLI is on PATH. */
 export declare function awsAvailable(): boolean;
+/**
+ * The AWS account id the CLI's active credentials resolve to, or null when the
+ * CLI has no usable credentials (not logged in, an expired SSO session, or no
+ * configured profile). `init`/`bootstrap` call this to fail fast with an
+ * actionable "log in" message before attempting a stack deploy, instead of
+ * letting the first `cloudformation deploy` fail with a cryptic AWS error.
+ */
+export declare function awsIdentity(region?: string): string | null;
 /**
  * A single Output value of a CloudFormation stack, or null when the stack does
  * not exist or the key is unset. `describe-stacks` prints `None` for a missing
@@ -52,6 +81,27 @@ export declare function stackOutput(stackName: string, key: string, region: stri
  * on every `init`. Returns false when the placeholder file is missing.
  */
 export declare function uploadPlaceholder(artifactsBucket: string, region: string, cwd?: string): boolean;
+/**
+ * Deploy the tier-0 bootstrap stack, retrying once against an account that
+ * already has a GitHub OIDC provider — AWS allows only one provider per URL, so
+ * a second create is rejected and the retry tells the template to reuse the
+ * existing one. Throws on failure (after the retry). Shared by `rastack init`
+ * and `rastack bootstrap` so both stand the stack up identically.
+ */
+export declare function deployBootstrap(cfg: DeployConfig, reuseOidc: boolean, template: string): void;
+/**
+ * Ensure the tier-0 bootstrap stack exists for this account+region, **creating
+ * it when missing**, and return its artifacts/templates buckets. This is why
+ * `rastack init` is a single command that stands up *everything* — the
+ * account-level bootstrap stack and the per-app backend — with no separate
+ * `rastack bootstrap` step. Idempotent: an existing stack is reconciled in
+ * place. Throws with an actionable message when the template cannot be resolved,
+ * the deploy fails, or the buckets can't be read back.
+ */
+export declare function ensureBootstrapStack(cfg: DeployConfig, reuseOidc?: boolean): Promise<{
+    artifactsBucket: string;
+    templatesBucket: string | null;
+}>;
 /** True when the GitHub CLI is on PATH. */
 export declare function ghAvailable(): boolean;
 /**

package/dist/deploy/io.js

@@ -38,8 +38,11 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.TEMPLATE_BASE_URL = void 0;
 exports.configPath = configPath;
 exports.resolveDeployAsset = resolveDeployAsset;
+exports.downloadTemplate = downloadTemplate;
+exports.resolveTemplateFile = resolveTemplateFile;
 exports.loadConfig = loadConfig;
 exports.saveConfig = saveConfig;
 exports.gitRemoteUrl = gitRemoteUrl;
@@ -47,8 +50,11 @@ exports.canPrompt = canPrompt;
 exports.awsCapture = awsCapture;
 exports.awsRun = awsRun;
 exports.awsAvailable = awsAvailable;
+exports.awsIdentity = awsIdentity;
 exports.stackOutput = stackOutput;
 exports.uploadPlaceholder = uploadPlaceholder;
+exports.deployBootstrap = deployBootstrap;
+exports.ensureBootstrapStack = ensureBootstrapStack;
 exports.ghAvailable = ghAvailable;
 exports.ghAuthenticated = ghAuthenticated;
 exports.ghAuthLogin = ghAuthLogin;
@@ -58,6 +64,7 @@ exports.ask = ask;
 exports.withPrompt = withPrompt;
 const child_process_1 = require("child_process");
 const fs = __importStar(require("fs"));
+const https = __importStar(require("https"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
 const readline = __importStar(require("readline"));
@@ -97,6 +104,54 @@ function resolveDeployAsset(relPath, cwd = process.cwd()) {
     }
     return null;
 }
+/**
+ * Base URL the framework's CloudFormation templates are published at. The same
+ * site that hosts the installer (`reactapistack.com/setup.sh`) serves the base
+ * templates, so a CLI whose bundled copy is missing (a partial install, or a
+ * globally-linked dev build) can still fetch them.
+ */
+exports.TEMPLATE_BASE_URL = "https://reactapistack.com/cloudformation";
+/**
+ * Download a published CloudFormation template to a temp file, returning its
+ * path — or null on any failure (offline, 404, write error). Used as the
+ * fallback when the template is not bundled with the install.
+ */
+function downloadTemplate(name, base = exports.TEMPLATE_BASE_URL) {
+    const url = `${base}/${name}`;
+    return new Promise((resolve) => {
+        https
+            .get(url, (res) => {
+            if (res.statusCode !== 200) {
+                res.resume();
+                resolve(null);
+                return;
+            }
+            const chunks = [];
+            res.on("data", (c) => chunks.push(c));
+            res.on("end", () => {
+                try {
+                    const dest = path.join(os.tmpdir(), `rastack-${path.basename(name)}`);
+                    fs.writeFileSync(dest, Buffer.concat(chunks));
+                    resolve(dest);
+                }
+                catch {
+                    resolve(null);
+                }
+            });
+        })
+            .on("error", () => resolve(null));
+    });
+}
+/**
+ * Resolve a CloudFormation template to a local file path for `aws cloudformation
+ * deploy` (which accepts only `--template-file`). Prefers the copy bundled with
+ * the `rastack` install; when that is missing, downloads it from the React API
+ * Stack website. Returns null only when the template is neither bundled nor
+ * fetchable.
+ */
+async function resolveTemplateFile(name, cwd = process.cwd()) {
+    return resolveDeployAsset(name, cwd) ?? (await downloadTemplate(name));
+}
 /** Read + normalize the deploy config, or null when it does not exist yet. */
 function loadConfig(cwd = process.cwd()) {
     const file = configPath(cwd);
@@ -163,6 +218,26 @@ function awsRun(args, cwd = process.cwd()) {
 function awsAvailable() {
     return awsCapture(["--version"]) !== null;
 }
+/**
+ * The AWS account id the CLI's active credentials resolve to, or null when the
+ * CLI has no usable credentials (not logged in, an expired SSO session, or no
+ * configured profile). `init`/`bootstrap` call this to fail fast with an
+ * actionable "log in" message before attempting a stack deploy, instead of
+ * letting the first `cloudformation deploy` fail with a cryptic AWS error.
+ */
+function awsIdentity(region) {
+    const args = [
+        "sts",
+        "get-caller-identity",
+        "--query",
+        "Account",
+        "--output",
+        "text",
+    ];
+    if (region)
+        args.push("--region", region);
+    return awsCapture(args);
+}
 /**
  * A single Output value of a CloudFormation stack, or null when the stack does
  * not exist or the key is unset. `describe-stacks` prints `None` for a missing
@@ -210,6 +285,55 @@ function uploadPlaceholder(artifactsBucket, region, cwd = process.cwd()) {
     ]);
     return true;
 }
+/**
+ * Deploy the tier-0 bootstrap stack, retrying once against an account that
+ * already has a GitHub OIDC provider — AWS allows only one provider per URL, so
+ * a second create is rejected and the retry tells the template to reuse the
+ * existing one. Throws on failure (after the retry). Shared by `rastack init`
+ * and `rastack bootstrap` so both stand the stack up identically.
+ */
+function deployBootstrap(cfg, reuseOidc, template) {
+    try {
+        awsRun((0, config_1.bootstrapStackArgs)(cfg, reuseOidc, template));
+    }
+    catch (err) {
+        if (reuseOidc)
+            throw err;
+        console.log("  • retrying bootstrap, reusing the account's existing GitHub OIDC provider");
+        awsRun((0, config_1.bootstrapStackArgs)(cfg, true, template));
+    }
+}
+/**
+ * Ensure the tier-0 bootstrap stack exists for this account+region, **creating
+ * it when missing**, and return its artifacts/templates buckets. This is why
+ * `rastack init` is a single command that stands up *everything* — the
+ * account-level bootstrap stack and the per-app backend — with no separate
+ * `rastack bootstrap` step. Idempotent: an existing stack is reconciled in
+ * place. Throws with an actionable message when the template cannot be resolved,
+ * the deploy fails, or the buckets can't be read back.
+ */
+async function ensureBootstrapStack(cfg, reuseOidc = false) {
+    const stack = (0, config_1.bootstrapStackName)(cfg);
+    const existing = stackOutput(stack, config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
+    if (existing) {
+        console.log(`  ✓ bootstrap stack ${stack} already exists — reconciling`);
+    }
+    else {
+        console.log(`\n▸ Creating the tier-0 bootstrap stack ${stack} (@ ${cfg.region})`);
+    }
+    const template = await resolveTemplateFile("bootstrap.yaml");
+    if (!template) {
+        throw new Error("bootstrap.yaml template not found in the rastack package and could not be\n" +
+            "    downloaded from reactapistack.com. Reinstall rastack (`npm i -g rastack`).");
+    }
+    deployBootstrap(cfg, reuseOidc, template);
+    const artifactsBucket = stackOutput(stack, config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
+    const templatesBucket = stackOutput(stack, config_1.BOOTSTRAP_TEMPLATES_OUTPUT, cfg.region);
+    if (!artifactsBucket) {
+        throw new Error(`bootstrap stack ${stack} deployed but its ArtifactsBucket output could not be read.`);
+    }
+    return { artifactsBucket, templatesBucket };
+}
 // ── GitHub CLI boundary ──────────────────────────────────────────────────────
 // After the stack is up `init` wires the two repo Variables CI reads
 // (AWS_DEPLOY_ROLE_ARN / AWS_REGION) through the developer's own `gh` — already

package/dist/rastack-bootstrap.js

@@ -124,60 +124,31 @@ function printPlan(cfg, reuseOidc) {
         "  ArtifactsBucket to create app backends. Nothing here is app-specific.\n");
 }
 /**
- * Deploy the bootstrap stack, retrying once against an account that already has
- * a GitHub OIDC provider (AWS allows only one per URL) when the caller did not
- * already ask to reuse it.
+ * Stand the tier-0 bootstrap stack up and upload the Lambda placeholder. The
+ * deploy (with the GitHub-OIDC-reuse retry) and template resolution are shared
+ * with `rastack init` via `ensureBootstrapStack`, so both stand the stack up
+ * identically.
  */
-function deployBootstrap(cfg, reuseOidc) {
-    const template = (0, io_1.resolveDeployAsset)("bootstrap.yaml");
-    if (!template) {
-        console.error("  ✗ bootstrap.yaml template not found in the rastack package. Reinstall\n" +
-            "    rastack (`npm i -g rastack`) or run from the framework repo.");
-        process.exit(1);
-    }
-    try {
-        (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, reuseOidc, template));
-    }
-    catch (err) {
-        if (reuseOidc) {
-            console.error(`\n  ✗ bootstrap stack deploy failed.\n    ${err.message}`);
-            process.exit(1);
-        }
-        // The most common cause is an account that already has a GitHub OIDC
-        // provider. Retry telling the template to reuse it instead of creating a
-        // second (which CloudFormation rejects).
-        console.log("  • retrying bootstrap, reusing the account's existing GitHub OIDC provider");
-        try {
-            (0, io_1.awsRun)((0, config_1.bootstrapStackArgs)(cfg, true, template));
-        }
-        catch (retryErr) {
-            console.error(`\n  ✗ bootstrap stack deploy failed.\n    ${retryErr.message}`);
-            process.exit(1);
-        }
-    }
-}
-/** Stand the tier-0 bootstrap stack up and upload the Lambda placeholder. */
-function standUp(cfg, reuseOidc) {
+async function standUp(cfg, reuseOidc) {
     if (!(0, io_1.awsAvailable)()) {
         console.error("  ✗ the AWS CLI is not on PATH. Install it and configure credentials,\n" +
             "    or re-run with --print to see the command.");
         process.exit(1);
     }
-    const stack = (0, config_1.bootstrapStackName)(cfg);
-    const existing = (0, io_1.stackOutput)(stack, config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
-    if (existing) {
-        console.log(`\n▸ Bootstrap stack ${stack} already exists — reconciling (idempotent).`);
-    }
-    else {
-        console.log(`\n▸ Creating bootstrap stack ${stack} (@ ${cfg.region})`);
-    }
-    deployBootstrap(cfg, reuseOidc);
-    const artifactsBucket = (0, io_1.stackOutput)(stack, config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
-    const templatesBucket = (0, io_1.stackOutput)(stack, config_1.BOOTSTRAP_TEMPLATES_OUTPUT, cfg.region);
-    if (!artifactsBucket) {
-        console.error("  ✗ bootstrap stack deployed but its ArtifactsBucket output could not be read.");
+    // Verify the AWS CLI is logged in before attempting a stack deploy.
+    const account = (0, io_1.awsIdentity)(cfg.region);
+    if (!account) {
+        console.error("  ✗ the AWS CLI has no usable credentials — it is not logged in.\n" +
+            "    Run `aws configure` (or `aws sso login`), then re-run `rastack bootstrap`.\n" +
+            "    Or re-run with --print to see the command.");
         process.exit(1);
     }
+    console.log(`  ✓ AWS account ${account} (${cfg.region})`);
+    const stack = (0, config_1.bootstrapStackName)(cfg);
+    const { artifactsBucket, templatesBucket } = await (0, io_1.ensureBootstrapStack)(cfg, reuseOidc).catch((err) => {
+        console.error(`\n  ✗ ${err.message}`);
+        process.exit(1);
+    });
     console.log(`  ✓ artifacts bucket:  ${artifactsBucket}`);
     if (templatesBucket)
         console.log(`  ✓ templates bucket:  ${templatesBucket}`);
@@ -220,7 +191,7 @@ async function main(argv) {
             return;
         }
     }
-    standUp(cfg, flags.reuseOidc);
+    await standUp(cfg, flags.reuseOidc);
 }
 if (require.main === module) {
     main(process.argv.slice(2)).catch((err) => {

package/dist/rastack-init.d.ts

@@ -11,14 +11,17 @@
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
  *      (GitHub coordinates default from the `origin` remote; missing fields are
  *      prompted for on a TTY);
- *   2. resolves the tier-0 bootstrap stack's artifacts bucket — erroring with a
- *      pointer to `rastack bootstrap` when that account+region stack is missing
- *      (init is per-app and never creates account-level infrastructure);
+ *   2. verifies the AWS CLI is logged in, then ensures the tier-0 bootstrap stack
+ *      exists — creating it (the S3 template/placeholder buckets + GitHub OIDC
+ *      provider) when missing, reconciling it when it already does;
  *   3. uploads the Lambda placeholder bundle to that bucket;
  *   4. deploys the per-app backend (app.yaml) with the resolved ArtifactsBucket;
  *   5. reads the stack Outputs back into the config and prints the two GitHub repo
  *      Variables CI needs.
  *
+ * The CloudFormation templates ship inside the `rastack` package; a partial
+ * install falls back to downloading them from reactapistack.com.
+ *
  * Thereafter the recurring code deploy is CI's job — `rastack ci deploy`, which
  * `rastack deploy` also runs. `--no-deploy` scaffolds only; `--print` shows the
  * exact single-line `aws cloudformation deploy` commands without running them.

package/dist/rastack-init.js

@@ -12,14 +12,17 @@
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
  *      (GitHub coordinates default from the `origin` remote; missing fields are
  *      prompted for on a TTY);
- *   2. resolves the tier-0 bootstrap stack's artifacts bucket — erroring with a
- *      pointer to `rastack bootstrap` when that account+region stack is missing
- *      (init is per-app and never creates account-level infrastructure);
+ *   2. verifies the AWS CLI is logged in, then ensures the tier-0 bootstrap stack
+ *      exists — creating it (the S3 template/placeholder buckets + GitHub OIDC
+ *      provider) when missing, reconciling it when it already does;
  *   3. uploads the Lambda placeholder bundle to that bucket;
  *   4. deploys the per-app backend (app.yaml) with the resolved ArtifactsBucket;
  *   5. reads the stack Outputs back into the config and prints the two GitHub repo
  *      Variables CI needs.
  *
+ * The CloudFormation templates ship inside the `rastack` package; a partial
+ * install falls back to downloading them from reactapistack.com.
+ *
  * Thereafter the recurring code deploy is CI's job — `rastack ci deploy`, which
  * `rastack deploy` also runs. `--no-deploy` scaffolds only; `--print` shows the
  * exact single-line `aws cloudformation deploy` commands without running them.
@@ -244,8 +247,10 @@ function envLabel(cfg, env) {
 }
 /**
  * Print the exact commands `init` would run, without touching the cloud
- * (`--print`). The artifacts bucket is read from the bootstrap stack when the
- * AWS CLI is available, else shown as a placeholder.
+ * (`--print`). init stands up *both* stacks, so both `aws cloudformation deploy`
+ * commands are shown: the tier-0 bootstrap stack (created only when missing) and
+ * the per-app backend. The artifacts bucket is read from an existing bootstrap
+ * stack when the AWS CLI is available, else shown as a placeholder.
  */
 function printPlan(cfg, envs) {
     const bucket = (0, io_1.awsAvailable)()
@@ -254,11 +259,12 @@ function printPlan(cfg, envs) {
     const withBucket = (0, config_1.mergeConfig)(cfg, {
         artifactsBucket: bucket ?? "<ArtifactsBucketName from bootstrap stack>",
     });
+    const bootstrapTemplate = (0, io_1.resolveDeployAsset)("bootstrap.yaml") ?? undefined;
     const appTemplate = (0, io_1.resolveDeployAsset)("app.yaml") ?? undefined;
     console.log(`\n  Deployment plan (${envs.join(" + ")} @ ${cfg.region})\n`);
-    console.log(`  ── Prerequisite: the tier-0 bootstrap stack (${(0, config_1.bootstrapStackName)(cfg)}) must exist ──`);
-    console.log(`  Create it once per account+region (init does not):  rastack bootstrap --region ${cfg.region}\n`);
-    console.log("  ── 1. Per-app backend (app.yaml) — one stack per environment ──");
+    console.log(`  ── 1. Tier-0 bootstrap stack (${(0, config_1.bootstrapStackName)(cfg)}) — created only when missing ──`);
+    console.log("\n  " + (0, config_1.bootstrapStackCommand)(cfg, false, bootstrapTemplate) + "\n");
+    console.log("  ── 2. Per-app backend (app.yaml) — one stack per environment ──");
     for (const env of envs) {
         const e = (0, config_1.resolveEnvironment)(withBucket, env);
         console.log(`\n  # ${envLabel(withBucket, env)} — stack ${e.stackName}`);
@@ -276,9 +282,12 @@ function printPlan(cfg, envs) {
     console.log("");
 }
 /**
- * Stand the infrastructure up: ensure the bootstrap stack + artifacts bucket,
- * upload the Lambda placeholder, deploy app.yaml, and read the Outputs back into
- * the config. Returns the config enriched with the resolved buckets + outputs.
+ * Stand the infrastructure up: verify the AWS CLI is logged in, ensure the
+ * tier-0 bootstrap stack (creating it when missing), upload the Lambda
+ * placeholder, deploy app.yaml, and read the Outputs back into the config.
+ * `init` is the single command that stands up *everything* — there is no
+ * separate manual bootstrap step. Returns the config enriched with the resolved
+ * buckets + outputs.
  */
 async function standUp(cfg, envs, interactive) {
     if (!(0, io_1.awsAvailable)()) {
@@ -286,23 +295,27 @@ async function standUp(cfg, envs, interactive) {
             "    or re-run with --print to see the commands, or --no-deploy to skip.");
         process.exit(1);
     }
-    // 1. Resolve the artifacts bucket from the tier-0 bootstrap stack. That stack
-    //    is an account+region once-off — the S3 buckets that host the templates +
-    //    Lambda placeholder, and the GitHub OIDC provider. `init` is a per-app
-    //    command and deliberately does NOT create it: standing up account-level
-    //    infrastructure is `rastack bootstrap`'s job (run once by an account admin),
-    //    so a missing bootstrap stack is a clear, actionable error, not an implicit
-    //    account mutation buried inside an app deploy.
-    const artifactsBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_ARTIFACTS_OUTPUT, cfg.region);
-    const templatesBucket = (0, io_1.stackOutput)((0, config_1.bootstrapStackName)(cfg), config_1.BOOTSTRAP_TEMPLATES_OUTPUT, cfg.region);
-    if (!artifactsBucket) {
-        console.error(`\n  ✗ Bootstrap stack ${(0, config_1.bootstrapStackName)(cfg)} not found in ${cfg.region}.\n` +
-            "    It is the once-per-account+region step that hosts the CloudFormation\n" +
-            "    templates and the Lambda placeholder every app deploy reads. Create it\n" +
-            "    first (an account admin does this once), then re-run `rastack init`:\n\n" +
-            `      rastack bootstrap --region ${cfg.region}\n`);
+    // Verify the AWS CLI is actually logged in before creating any stacks, so a
+    // missing/expired credential fails fast with an actionable message rather than
+    // a cryptic `cloudformation deploy` error partway through.
+    const account = (0, io_1.awsIdentity)(cfg.region);
+    if (!account) {
+        console.error("  ✗ the AWS CLI has no usable credentials — it is not logged in.\n" +
+            "    Configure credentials, then re-run `rastack init`:\n" +
+            "      aws configure            # static access key / secret\n" +
+            "      aws sso login            # or an existing SSO session\n" +
+            "    Or re-run with --print to see the commands, or --no-deploy to skip.");
         process.exit(1);
     }
+    console.log(`  ✓ AWS account ${account} (${cfg.region})`);
+    // 1. Ensure the tier-0 bootstrap stack exists — the S3 buckets that host the
+    //    templates + Lambda placeholder and the GitHub OIDC provider. init creates
+    //    it when missing (idempotent for an existing one), so a single command
+    //    takes an account+repo from nothing to a deployed backend.
+    const { artifactsBucket, templatesBucket } = await (0, io_1.ensureBootstrapStack)(cfg).catch((err) => {
+        console.error(`\n  ✗ ${err.message}`);
+        process.exit(1);
+    });
     console.log(`  ✓ artifacts bucket: ${artifactsBucket}`);
     // 2. Upload the placeholder the function is created from (shared by all envs).
     console.log("\n▸ Uploading the Lambda placeholder bundle");
@@ -314,10 +327,10 @@ async function standUp(cfg, envs, interactive) {
         artifactsBucket,
         templatesBucket: templatesBucket ?? undefined,
     });
-    const appTemplate = (0, io_1.resolveDeployAsset)("app.yaml");
+    const appTemplate = await (0, io_1.resolveTemplateFile)("app.yaml");
     if (!appTemplate) {
-        console.error("  ✗ app.yaml template not found in the rastack package. Reinstall rastack\n" +
-            "    (`npm i -g rastack`) or run from the framework repo.");
+        console.error("  ✗ app.yaml template not found in the rastack package and could not be\n" +
+            "    downloaded from reactapistack.com. Reinstall rastack (`npm i -g rastack`).");
         process.exit(1);
     }
     // 3. Deploy one stack per environment — each with its own Cognito pool,
@@ -501,7 +514,7 @@ async function main(argv) {
         const stacks = flags.envs
             .map((env) => (0, config_1.resolveEnvironment)(cfg, env).stackName)
             .join(" + ");
-        const ok = await confirm(`Deploy ${stacks} to AWS ${cfg.region} now? (requires the bootstrap stack to exist) [y/N]`);
+        const ok = await confirm(`Deploy ${stacks} to AWS ${cfg.region} now? (creates the bootstrap stack if missing) [y/N]`);
         if (!ok) {
             console.log("\n  Skipped the deploy. Re-run to deploy, or `rastack init --print` for the commands.\n");
             return;

package/dist/wasm/rastack_wasm.js

@@ -375,7 +375,7 @@ function __wbg_get_imports() {
             return ret;
         },
         __wbindgen_cast_0000000000000001: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 88, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 90, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen_ac0f9960a408a037___convert__closures_____invoke___wasm_bindgen_ac0f9960a408a037___JsValue__core_9b3796e30d99ddb7___result__Result_____wasm_bindgen_ac0f9960a408a037___JsError___true_);
             return ret;
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rastack",
-  "version": "0.0.63",
+  "version": "0.0.64",
   "description": "",
   "main": "runtime.ts",
   "types": "runtime.ts",

package/provider/provider.tsx

@@ -170,6 +170,11 @@ export function RAStackProvider({
         const existing = await persistence.load();
         if (existing) {
           await engine.importWarehouse(existing);
+        } else if (config.seedWarehouse) {
+          // Seed from a bundled warehouse blob (exportWarehouse format) rather
+          // than loose Iceberg files.
+          const seed = await config.seedWarehouse();
+          if (seed) await engine.importWarehouse(seed);
         } else {
           const base = config.warehouseBaseUrl ?? "/data/warehouse/";
           const resources = manifestResources(manifest);
@@ -208,6 +213,24 @@ export function RAStackProvider({
       }, 400);
       persistRef.current = persist;
 
+      // Persist at the *engine* level, not just in the axios adapter. Consumers
+      // that talk to the engine directly (the admin console calls
+      // `engine.handle("DELETE", …)` straight, bypassing the generated hooks /
+      // axios seam) must still have their writes saved to IndexedDB — otherwise
+      // every reload re-seeds from the committed warehouse and silently
+      // resurrects deleted rows. Wrapping `handle` here makes persistence fire
+      // for both paths (the adapter's `onWrite` below then coalesces into the
+      // same debounce, so an app-hook write persists exactly once).
+      const MUTATING = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+      const rawHandle = engine.handle.bind(engine);
+      engine.handle = ((method: string, path: string, query?: any, body?: any) =>
+        Promise.resolve(rawHandle(method, path, query, body)).then((res: any) => {
+          if (MUTATING.has(String(method).toUpperCase()) && res && res.status < 300) {
+            persist();
+          }
+          return res;
+        })) as typeof engine.handle;
+
       engineRef.current = engine;
       configureApi({
         baseURL: "",

package/provider/types.ts

@@ -152,6 +152,15 @@ export interface RAStackProviderConfig {
   fileSource?: import("../cache").WarehouseFileSource;
   /** `s3` mode: how to load/save the warehouse blob from object storage. */
   warehouse?: WarehouseSource;
+  /**
+   * Seed `local` mode from a **bundled warehouse blob** — the format
+   * `exportWarehouse()` produces and `importWarehouse()` consumes — instead of
+   * walking loose Iceberg files under `warehouseBaseUrl`. Use this when the app
+   * commits a single warehouse blob asset (e.g. bundled JSON) rather than a
+   * directory of parquet files. Takes precedence over `warehouseBaseUrl` /
+   * `fileSource` seeding, and is ignored once a persisted local copy exists.
+   */
+  seedWarehouse?: () => Uint8Array | null | Promise<Uint8Array | null>;
   /**
    * Override how the WASM module is loaded. Supply this from app code (where
    * your bundler can resolve the generated bundle) if the default loader can't