rastack 0.0.63 → 0.0.69

package/src/rastack-init.ts

@@ -12,14 +12,17 @@
  *   1. writes `.rastack/deploy.json` + `.github/workflows/{ci,deploy-backend}.yml`
  *      (GitHub coordinates default from the `origin` remote; missing fields are
  *      prompted for on a TTY);
- *   2. resolves the tier-0 bootstrap stack's artifacts bucket — erroring with a
- *      pointer to `rastack bootstrap` when that account+region stack is missing
- *      (init is per-app and never creates account-level infrastructure);
+ *   2. verifies the AWS CLI is logged in, then ensures the tier-0 bootstrap stack
+ *      exists — creating it (the S3 template/placeholder buckets + GitHub OIDC
+ *      provider) when missing, reconciling it when it already does;
  *   3. uploads the Lambda placeholder bundle to that bucket;
  *   4. deploys the per-app backend (app.yaml) with the resolved ArtifactsBucket;
  *   5. reads the stack Outputs back into the config and prints the two GitHub repo
  *      Variables CI needs.
  *
+ * The CloudFormation templates ship inside the `rastack` package; a partial
+ * install falls back to downloading them from reactapistack.com.
+ *
  * Thereafter the recurring code deploy is CI's job — `rastack ci deploy`, which
  * `rastack deploy` also runs. `--no-deploy` scaffolds only; `--print` shows the
  * exact single-line `aws cloudformation deploy` commands without running them.
@@ -30,12 +33,12 @@ import * as path from "path";
 import {
   APP_STACK_OUTPUTS,
   BOOTSTRAP_ARTIFACTS_OUTPUT,
-  BOOTSTRAP_TEMPLATES_OUTPUT,
   DeployConfig,
   DeployOutputs,
   EnvName,
   ENV_NAMES,
   PartialDeployConfig,
+  bootstrapStackCommand,
   bootstrapStackName,
   deployStackCommandForEnv,
   deployStackArgsForEnv,
@@ -58,8 +61,10 @@ import {
 import {
   ask,
   awsAvailable,
+  awsIdentity,
   awsRun,
   canPrompt,
+  ensureBootstrapStack,
   ghAuthLogin,
   ghAuthenticated,
   ghAvailable,
@@ -67,6 +72,7 @@ import {
   gitRemoteUrl,
   loadConfig,
   resolveDeployAsset,
+  resolveTemplateFile,
   saveConfig,
   setRepoVariable,
   stackOutput,
@@ -281,8 +287,10 @@ function envLabel(cfg: DeployConfig, env: EnvName): string {
 
 /**
  * Print the exact commands `init` would run, without touching the cloud
- * (`--print`). The artifacts bucket is read from the bootstrap stack when the
- * AWS CLI is available, else shown as a placeholder.
+ * (`--print`). init stands up *both* stacks, so both `aws cloudformation deploy`
+ * commands are shown: the tier-0 bootstrap stack (created only when missing) and
+ * the per-app backend. The artifacts bucket is read from an existing bootstrap
+ * stack when the AWS CLI is available, else shown as a placeholder.
  */
 function printPlan(cfg: DeployConfig, envs: EnvName[]): void {
   const bucket = awsAvailable()
@@ -295,16 +303,15 @@ function printPlan(cfg: DeployConfig, envs: EnvName[]): void {
   const withBucket = mergeConfig(cfg, {
     artifactsBucket: bucket ?? "<ArtifactsBucketName from bootstrap stack>",
   });
+  const bootstrapTemplate = resolveDeployAsset("bootstrap.yaml") ?? undefined;
   const appTemplate = resolveDeployAsset("app.yaml") ?? undefined;
   console.log(`\n  Deployment plan (${envs.join(" + ")} @ ${cfg.region})\n`);
   console.log(
-    `  ── Prerequisite: the tier-0 bootstrap stack (${bootstrapStackName(cfg)}) must exist ──`,
-  );
-  console.log(
-    `  Create it once per account+region (init does not):  rastack bootstrap --region ${cfg.region}\n`,
+    `  ── 1. Tier-0 bootstrap stack (${bootstrapStackName(cfg)}) — created only when missing ──`,
   );
+  console.log("\n  " + bootstrapStackCommand(cfg, false, bootstrapTemplate) + "\n");
   console.log(
-    "  ── 1. Per-app backend (app.yaml) — one stack per environment ──",
+    "  ── 2. Per-app backend (app.yaml) — one stack per environment ──",
   );
   for (const env of envs) {
     const e = resolveEnvironment(withBucket, env);
@@ -330,9 +337,12 @@ function printPlan(cfg: DeployConfig, envs: EnvName[]): void {
 }
 
 /**
- * Stand the infrastructure up: ensure the bootstrap stack + artifacts bucket,
- * upload the Lambda placeholder, deploy app.yaml, and read the Outputs back into
- * the config. Returns the config enriched with the resolved buckets + outputs.
+ * Stand the infrastructure up: verify the AWS CLI is logged in, ensure the
+ * tier-0 bootstrap stack (creating it when missing), upload the Lambda
+ * placeholder, deploy app.yaml, and read the Outputs back into the config.
+ * `init` is the single command that stands up *everything* — there is no
+ * separate manual bootstrap step. Returns the config enriched with the resolved
+ * buckets + outputs.
  */
 async function standUp(
   cfg: DeployConfig,
@@ -347,33 +357,32 @@ async function standUp(
     process.exit(1);
   }
 
-  // 1. Resolve the artifacts bucket from the tier-0 bootstrap stack. That stack
-  //    is an account+region once-off — the S3 buckets that host the templates +
-  //    Lambda placeholder, and the GitHub OIDC provider. `init` is a per-app
-  //    command and deliberately does NOT create it: standing up account-level
-  //    infrastructure is `rastack bootstrap`'s job (run once by an account admin),
-  //    so a missing bootstrap stack is a clear, actionable error, not an implicit
-  //    account mutation buried inside an app deploy.
-  const artifactsBucket = stackOutput(
-    bootstrapStackName(cfg),
-    BOOTSTRAP_ARTIFACTS_OUTPUT,
-    cfg.region,
-  );
-  const templatesBucket = stackOutput(
-    bootstrapStackName(cfg),
-    BOOTSTRAP_TEMPLATES_OUTPUT,
-    cfg.region,
-  );
-  if (!artifactsBucket) {
+  // Verify the AWS CLI is actually logged in before creating any stacks, so a
+  // missing/expired credential fails fast with an actionable message rather than
+  // a cryptic `cloudformation deploy` error partway through.
+  const account = awsIdentity(cfg.region);
+  if (!account) {
     console.error(
-      `\n  ✗ Bootstrap stack ${bootstrapStackName(cfg)} not found in ${cfg.region}.\n` +
-        "    It is the once-per-account+region step that hosts the CloudFormation\n" +
-        "    templates and the Lambda placeholder every app deploy reads. Create it\n" +
-        "    first (an account admin does this once), then re-run `rastack init`:\n\n" +
-        `      rastack bootstrap --region ${cfg.region}\n`,
+      "  ✗ the AWS CLI has no usable credentials — it is not logged in.\n" +
+        "    Configure credentials, then re-run `rastack init`:\n" +
+        "      aws configure            # static access key / secret\n" +
+        "      aws sso login            # or an existing SSO session\n" +
+        "    Or re-run with --print to see the commands, or --no-deploy to skip.",
     );
     process.exit(1);
   }
+  console.log(`  ✓ AWS account ${account} (${cfg.region})`);
+
+  // 1. Ensure the tier-0 bootstrap stack exists — the S3 buckets that host the
+  //    templates + Lambda placeholder and the GitHub OIDC provider. init creates
+  //    it when missing (idempotent for an existing one), so a single command
+  //    takes an account+repo from nothing to a deployed backend.
+  const { artifactsBucket, templatesBucket } = await ensureBootstrapStack(
+    cfg,
+  ).catch((err: Error) => {
+    console.error(`\n  ✗ ${err.message}`);
+    process.exit(1);
+  });
   console.log(`  ✓ artifacts bucket: ${artifactsBucket}`);
 
   // 2. Upload the placeholder the function is created from (shared by all envs).
@@ -389,11 +398,11 @@ async function standUp(
     artifactsBucket,
     templatesBucket: templatesBucket ?? undefined,
   });
-  const appTemplate = resolveDeployAsset("app.yaml");
+  const appTemplate = await resolveTemplateFile("app.yaml");
   if (!appTemplate) {
     console.error(
-      "  ✗ app.yaml template not found in the rastack package. Reinstall rastack\n" +
-        "    (`npm i -g rastack`) or run from the framework repo.",
+      "  ✗ app.yaml template not found in the rastack package and could not be\n" +
+        "    downloaded from reactapistack.com. Reinstall rastack (`npm i -g rastack`).",
     );
     process.exit(1);
   }
@@ -623,7 +632,7 @@ async function main(argv: string[]): Promise<void> {
       .map((env) => resolveEnvironment(cfg, env).stackName)
       .join(" + ");
     const ok = await confirm(
-      `Deploy ${stacks} to AWS ${cfg.region} now? (requires the bootstrap stack to exist) [y/N]`,
+      `Deploy ${stacks} to AWS ${cfg.region} now? (creates the bootstrap stack if missing) [y/N]`,
     );
     if (!ok) {
       console.log(

package/src/rastack.ts

@@ -13,7 +13,7 @@
  *   rastack generate [--schema-only]            Generate typed hooks from OpenAPI
  *   rastack tokens  [input] [outDir]            Compile design tokens → CSS vars + typed theme
  *   rastack design  [input] [--port n]          Live design-system studio (showcase + edit)
- *   rastack dev     [--port n] [--warehouse d]  Local dev: run your app in-browser over WASM
+ *   rastack dev     [--port n] [--warehouse d]  Local dev: your app in the browser, the API in native Rust
  *   rastack admin   [--warehouse dir] [--port n] Full admin console — React UI (rastack/components) over the native server
  *   rastack import <file> --resource app.model  Load CSV/XLSX/PDF data and validate it (state machine)
  *   rastack scan   [files...] [--fail-on-pii]   (LEGACY, pre-Rust) Scan CSVs for PII and schema info
@@ -72,7 +72,7 @@ switch (command) {
     console.error(
       "`rastack compile` has been removed — compilation now runs automatically\n" +
         "inside the two modalities of use:\n" +
-        "  • rastack dev    local development (compiles, then serves over WASM)\n" +
+        "  • rastack dev    local development (compiles, then proxies /api to native rastack-server)\n" +
         "  • rastack ci     the deploy pipeline (compiles the manifest + OpenAPI)\n\n" +
         "Introspect the resource graph with: rastack check | list | urls\n",
     );
@@ -85,9 +85,8 @@ switch (command) {
     run("rastack-compile.js", [command, ...rest]);
     break;
   case "dev":
-    // Local development: serve your app in the browser over the WASM engine
-    // (no native server, no cargo). The admin console is a separate command,
-    // `rastack admin`. Replaces `serve` + `wasm`.
+    // Local development: serve your app and proxy /api to native rastack-server.
+    // The admin console is a separate command, `rastack admin`.
     run("rastack-dev.js", rest);
     break;
   case "admin":
@@ -162,7 +161,7 @@ switch (command) {
         `  rastack generate [--schema-only]\n` +
         `  rastack tokens  [input] [outDir] [--prefix p]  Compile design tokens → CSS vars + typed theme\n` +
         `  rastack design  [input] [--port n]             Live design-system studio (showcase + edit)\n` +
-        `  rastack dev     [--port n] [--warehouse dir] [--app dir] [--no-open]  Run your app in-browser over WASM (local dev)\n` +
+        `  rastack dev     [--port n] [--warehouse dir] [--app dir] [--no-open]  App in the browser, API in native rastack-server\n` +
         `  rastack admin   [--warehouse dir] [--port n] [--no-open]  Full admin console (React UI over the native server; needs a built rastack-server)\n` +
         `  rastack import <file.csv|.xlsx|.pdf> --resource app.model [--related app.model=<file>] [--out cleaned.json]\n` +
         `  rastack scan   [files...] [--fail-on-pii]                     (legacy, pre-Rust)\n` +

package/src/validate/transitions.ts

@@ -23,7 +23,7 @@
  * list), and this module is the *shared executable form* of it: the same pure
  * functions guard a form submit (`useForm(...).transition("board")`), the
  * record machine (`runRecordMachine` with a `previous` row in context), and —
- * re-implemented 1:1 in `rastack-api-core` — every server/WASM write. A write
+ * re-implemented 1:1 in `rastack-api-core` — every native-server write. A write
  * that jumps between states without a declared edge is rejected on every
  * surface, which is what makes a transition "a backend function that is
  * state-machine safe": the only way to move a record between states is a

package/dist/rastack-wasm-build.d.ts

@@ -1,19 +0,0 @@
-#!/usr/bin/env node
-/**
- * Compile the Rust API to WebAssembly for in-browser local dev — the engine
- * `rastack dev` serves and `<RAStackProvider mode="local">` loads.
- *
- * Pipeline:
- *   1. cargo build -p rastack-wasm --release --target wasm32-unknown-unknown
- *   2. wasm-bindgen --target web  → wasm/rastack_wasm.js + rastack_wasm_bg.wasm
- *   3. wasm-opt -Oz (if available) to shrink the binary
- *
- * This is invoked by the release CI (to bundle a prebuilt engine into the npm
- * package) and by `rastack dev` as a from-source fallback when no prebuilt
- * bundle is present but the toolchain is. Prereqs:
- *   rustup target add wasm32-unknown-unknown
- *   cargo install wasm-bindgen-cli   (version must match the wasm-bindgen crate)
- */
-/** Run the full compile → wasm-bindgen → optimise pipeline. Throws via `run`'s
- *  `process.exit` on a missing tool or a non-zero step. */
-export declare function buildWasm(): void;

package/dist/rastack-wasm-build.js

@@ -1,94 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-/**
- * Compile the Rust API to WebAssembly for in-browser local dev — the engine
- * `rastack dev` serves and `<RAStackProvider mode="local">` loads.
- *
- * Pipeline:
- *   1. cargo build -p rastack-wasm --release --target wasm32-unknown-unknown
- *   2. wasm-bindgen --target web  → wasm/rastack_wasm.js + rastack_wasm_bg.wasm
- *   3. wasm-opt -Oz (if available) to shrink the binary
- *
- * This is invoked by the release CI (to bundle a prebuilt engine into the npm
- * package) and by `rastack dev` as a from-source fallback when no prebuilt
- * bundle is present but the toolchain is. Prereqs:
- *   rustup target add wasm32-unknown-unknown
- *   cargo install wasm-bindgen-cli   (version must match the wasm-bindgen crate)
- */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildWasm = buildWasm;
-const child_process_1 = require("child_process");
-const fs_1 = __importDefault(require("fs"));
-const path_1 = __importDefault(require("path"));
-const repoRoot = path_1.default.resolve(__dirname, "..");
-const rustDir = path_1.default.join(repoRoot, "engine");
-const outDir = path_1.default.join(repoRoot, "wasm");
-const wasmPath = path_1.default.join(rustDir, "target", "wasm32-unknown-unknown", "release", "rastack_wasm.wasm");
-function run(cmd, args, cwd = repoRoot) {
-    // Local build tool: `cmd`/`args` are the fixed toolchain invocations below
-    // (cargo, wasm-bindgen, wasm-opt), not untrusted input — no injection surface.
-    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-    const result = (0, child_process_1.spawnSync)(cmd, args, {
-        stdio: "inherit",
-        cwd,
-        env: process.env,
-    });
-    if (result.error) {
-        console.error(`\nCould not run \`${cmd}\`. Is it installed and on PATH?`);
-        if (cmd === "wasm-bindgen") {
-            console.error("  cargo install wasm-bindgen-cli");
-        }
-        process.exit(1);
-    }
-    if (result.status !== 0) {
-        process.exit(result.status ?? 1);
-    }
-}
-function has(cmd) {
-    // Probes a fixed toolchain name (e.g. "wasm-opt") for availability; not
-    // untrusted input.
-    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
-    return (0, child_process_1.spawnSync)(cmd, ["--version"], { stdio: "ignore" }).status === 0;
-}
-/** Run the full compile → wasm-bindgen → optimise pipeline. Throws via `run`'s
- *  `process.exit` on a missing tool or a non-zero step. */
-function buildWasm() {
-    console.log("→ cargo build -p rastack-wasm --release (wasm32-unknown-unknown)");
-    run("cargo", [
-        "build",
-        "-p",
-        "rastack-wasm",
-        "--release",
-        "--target",
-        "wasm32-unknown-unknown",
-    ], rustDir);
-    console.log("→ wasm-bindgen → wasm/");
-    run("wasm-bindgen", [
-        "--target",
-        "web",
-        "--out-dir",
-        outDir,
-        "--out-name",
-        "rastack_wasm",
-        wasmPath,
-    ]);
-    // Mark the emitted bundle as ESM so Node and bundlers treat it correctly
-    // without forcing the parent rastack package to be a module.
-    fs_1.default.writeFileSync(path_1.default.join(outDir, "package.json"), JSON.stringify({ type: "module", sideEffects: false }, null, 2) + "\n");
-    if (has("wasm-opt")) {
-        console.log("→ wasm-opt -Oz");
-        const bg = path_1.default.join(outDir, "rastack_wasm_bg.wasm");
-        run("wasm-opt", ["-Oz", "-o", bg, bg]);
-    }
-    else {
-        console.log("· wasm-opt not found — skipping size optimisation (optional)");
-    }
-    const size = fs_1.default.statSync(path_1.default.join(outDir, "rastack_wasm_bg.wasm")).size;
-    console.log(`✓ wasm engine built: wasm/ (${(size / 1024).toFixed(0)} KB)`);
-}
-if (require.main === module) {
-    buildWasm();
-}

package/dist/wasm/package.json

@@ -1,4 +0,0 @@
-{
-  "type": "module",
-  "sideEffects": false
-}

package/dist/wasm/rastack_wasm.d.ts

@@ -1,100 +0,0 @@
-/* tslint:disable */
-/* eslint-disable */
-
-/**
- * The in-browser API engine. Cheap to clone (everything behind `Arc`), which
- * is what lets each async call own its state without borrowing across `await`.
- */
-export class RastackApi {
-    free(): void;
-    [Symbol.dispose](): void;
-    /**
-     * Snapshot the entire warehouse to a blob for persistence (`data/` folder,
-     * IndexedDB, or an upload to S3).
-     */
-    exportWarehouse(): Promise<any>;
-    /**
-     * Handle one request. `query` is a `{ [k]: string }` object, `body` any
-     * JSON value (or `undefined`). Resolves to `{ status, body }`.
-     */
-    handle(method: string, path: string, query: any, body: any): Promise<any>;
-    /**
-     * Seed the warehouse from a blob previously produced by
-     * [`export_warehouse`](Self::export_warehouse) (the `data/` folder or an
-     * IndexedDB/OPFS snapshot).
-     */
-    importWarehouse(blob: Uint8Array): Promise<any>;
-    /**
-     * Build an engine from the compiled manifest (`schema.rastack.json`) and an
-     * optional OpenAPI document (`openapi.json`, served at `/api/schema/`).
-     */
-    constructor(manifest_json: string, openapi_json?: string | null);
-    /**
-     * Seed one Iceberg file (metadata or data file) at its warehouse key. The
-     * provider walks the committed `data/warehouse` Iceberg tree over HTTP and
-     * calls this for each file, so the browser reads the *actual* Iceberg files
-     * — no bundled blob.
-     */
-    seedFile(key: string, bytes: Uint8Array): Promise<any>;
-    /**
-     * Run subsequent requests as a signed-in identity (the Cognito `sub` and
-     * `cognito:groups` claims). Owner fields are stamped from — and row
-     * filters and tenant scoping keyed by — this subject, matching the server
-     * byte-for-byte. Pass no subject to fall back to the trusted local
-     * context.
-     */
-    setAuth(subject: string | null | undefined, groups: any): void;
-}
-
-export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembly.Module;
-
-export interface InitOutput {
-    readonly memory: WebAssembly.Memory;
-    readonly __wbg_rastackapi_free: (a: number, b: number) => void;
-    readonly rastackapi_exportWarehouse: (a: number) => any;
-    readonly rastackapi_handle: (a: number, b: number, c: number, d: number, e: number, f: any, g: any) => any;
-    readonly rastackapi_importWarehouse: (a: number, b: number, c: number) => any;
-    readonly rastackapi_new: (a: number, b: number, c: number, d: number) => [number, number, number];
-    readonly rastackapi_seedFile: (a: number, b: number, c: number, d: number, e: number) => any;
-    readonly rastackapi_setAuth: (a: number, b: number, c: number, d: any) => [number, number];
-    readonly rust_zstd_wasm_shim_calloc: (a: number, b: number) => number;
-    readonly rust_zstd_wasm_shim_free: (a: number) => void;
-    readonly rust_zstd_wasm_shim_malloc: (a: number) => number;
-    readonly rust_zstd_wasm_shim_memcmp: (a: number, b: number, c: number) => number;
-    readonly rust_zstd_wasm_shim_memcpy: (a: number, b: number, c: number) => number;
-    readonly rust_zstd_wasm_shim_memmove: (a: number, b: number, c: number) => number;
-    readonly rust_zstd_wasm_shim_memset: (a: number, b: number, c: number) => number;
-    readonly rust_zstd_wasm_shim_qsort: (a: number, b: number, c: number, d: number) => void;
-    readonly wasm_bindgen_ac0f9960a408a037___convert__closures_____invoke___wasm_bindgen_ac0f9960a408a037___JsValue__core_9b3796e30d99ddb7___result__Result_____wasm_bindgen_ac0f9960a408a037___JsError___true_: (a: number, b: number, c: any) => [number, number];
-    readonly wasm_bindgen_ac0f9960a408a037___convert__closures_____invoke___js_sys_10c47e7ecd0a94ab___Function_fn_wasm_bindgen_ac0f9960a408a037___JsValue_____wasm_bindgen_ac0f9960a408a037___sys__Undefined___js_sys_10c47e7ecd0a94ab___Function_fn_wasm_bindgen_ac0f9960a408a037___JsValue_____wasm_bindgen_ac0f9960a408a037___sys__Undefined_______true_: (a: number, b: number, c: any, d: any) => void;
-    readonly __wbindgen_malloc: (a: number, b: number) => number;
-    readonly __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
-    readonly __wbindgen_exn_store: (a: number) => void;
-    readonly __externref_table_alloc: () => number;
-    readonly __wbindgen_externrefs: WebAssembly.Table;
-    readonly __wbindgen_destroy_closure: (a: number, b: number) => void;
-    readonly __externref_table_dealloc: (a: number) => void;
-    readonly __wbindgen_start: () => void;
-}
-
-export type SyncInitInput = BufferSource | WebAssembly.Module;
-
-/**
- * Instantiates the given `module`, which can either be bytes or
- * a precompiled `WebAssembly.Module`.
- *
- * @param {{ module: SyncInitInput }} module - Passing `SyncInitInput` directly is deprecated.
- *
- * @returns {InitOutput}
- */
-export function initSync(module: { module: SyncInitInput } | SyncInitInput): InitOutput;
-
-/**
- * If `module_or_path` is {RequestInfo} or {URL}, makes a request and
- * for everything else, calls `WebAssembly.instantiate` directly.
- *
- * @param {{ module_or_path: InitInput | Promise<InitInput> }} module_or_path - Passing `InitInput` directly is deprecated.
- *
- * @returns {Promise<InitOutput>}
- */
-export default function __wbg_init (module_or_path?: { module_or_path: InitInput | Promise<InitInput> } | InitInput | Promise<InitInput>): Promise<InitOutput>;