rastack 0.0.64 → 0.0.69

package/src/dev/native-server.ts

@@ -0,0 +1,164 @@
+/**
+ * Start the native `rastack-server` binary — the same `rastack-api-core`
+ * process Lambda runs. The browser never executes this binary. `rastack dev`
+ * proxies `/api` to it; `rastack admin` lets the binary serve `/admin` itself.
+ */
+
+import { spawn, spawnSync, type ChildProcess } from "child_process";
+import * as fs from "fs";
+import * as net from "net";
+import * as path from "path";
+import { serverBinaryCandidates } from "./harness";
+
+export interface NativeServerOpts {
+  /** Absolute path to the `rastack-server` binary. */
+  bin: string;
+  /** `serve` is the API. `admin` mounts the React console at `/admin`. */
+  command: "serve" | "admin";
+  manifest: string;
+  warehouse: string;
+  /** `host:port` the binary binds. */
+  addr: string;
+  /** Directory that contains `admin.js` (`RASTACK_ADMIN_ASSETS`). */
+  adminAssets?: string;
+}
+
+const MISSING = `
+  ✗ No native rastack-server binary.
+    The API does not run in the browser. rastack dev and rastack admin start
+    the native Rust server (rastack-api-core) and the page talks to it over HTTP.
+    Build it from this repo:
+
+      cargo build -p rastack-server --manifest-path engine/Cargo.toml
+
+    Or set RASTACK_SERVER to the binary. There is no in-browser engine.
+`;
+
+/**
+ * `rastack-server` on PATH. Walks the directories ourselves so the lookup
+ * never goes through a shell (`command -v` with `shell: true`).
+ */
+function serverOnPath(): string | null {
+  const entries = (process.env.PATH ?? "").split(path.delimiter);
+  for (const dir of entries) {
+    if (!dir) continue;
+    const candidate = path.join(dir, "rastack-server");
+    try {
+      if (fs.existsSync(candidate)) return candidate;
+    } catch {
+      // An unreadable PATH entry is not a candidate.
+    }
+  }
+  return null;
+}
+
+/** `RASTACK_SERVER`, a workspace target dir, or `rastack-server` on PATH. */
+export function resolveServerBinary(cwd: string): string | null {
+  const fromEnv = process.env.RASTACK_SERVER;
+  if (fromEnv && fs.existsSync(fromEnv)) return fromEnv;
+  for (const candidate of serverBinaryCandidates(cwd)) {
+    if (fs.existsSync(candidate)) return candidate;
+  }
+  return serverOnPath();
+}
+
+function cargoAvailable(): boolean {
+  try {
+    return spawnSync("cargo", ["--version"], { stdio: "ignore" }).status === 0;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Locate the native binary, building it with cargo when this repo's workspace
+ * is present and the binary is not. Throws when nothing native can be started.
+ */
+export function ensureServerBinary(cwd: string): string {
+  const ready = resolveServerBinary(cwd);
+  if (ready) return ready;
+  const manifest = path.join(cwd, "engine", "Cargo.toml");
+  if (fs.existsSync(manifest) && cargoAvailable()) {
+    console.log(
+      "\n▸ Building native rastack-server (cargo build -p rastack-server)…\n",
+    );
+    const built = spawnSync(
+      "cargo",
+      ["build", "-p", "rastack-server", "--manifest-path", manifest],
+      { stdio: "inherit" },
+    );
+    if (built.status === 0) {
+      const after = resolveServerBinary(cwd);
+      if (after) return after;
+    }
+  }
+  throw new Error(MISSING.trim());
+}
+
+/** Spawn `rastack-server serve|admin`. Stdio is inherited. */
+export function startNativeServer(opts: NativeServerOpts): ChildProcess {
+  const env: NodeJS.ProcessEnv = { ...process.env };
+  if (opts.adminAssets) env.RASTACK_ADMIN_ASSETS = opts.adminAssets;
+  // `bin` is resolveServerBinary's result: RASTACK_SERVER (a file that exists),
+  // a workspace target path, or a PATH entry named rastack-server. It is not
+  // request input. The command cannot be a string literal because the path
+  // depends on which of those three resolved. The nosemgrep comment has to sit
+  // on the line directly above the tainted argument — that is the line Semgrep
+  // reports, not the `spawn(` line.
+  const bin = opts.bin;
+  return spawn(
+    // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process
+    bin,
+    [
+      opts.command,
+      "--manifest",
+      opts.manifest,
+      "--warehouse",
+      opts.warehouse,
+      "--addr",
+      opts.addr,
+      "--insecure-dev-auth",
+    ],
+    { stdio: "inherit", env },
+  );
+}
+
+/** Resolve once the process accepts TCP, or reject if it exits or times out. */
+export function waitForTcp(
+  port: number,
+  child: ChildProcess,
+  timeoutMs = 30_000,
+): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const deadline = Date.now() + timeoutMs;
+    let settled = false;
+    const finish = (err?: Error) => {
+      if (settled) return;
+      settled = true;
+      if (err) reject(err);
+      else resolve();
+    };
+    child.once("exit", (code) =>
+      finish(
+        new Error(
+          `rastack-server exited (${code ?? "?"}) before it accepted connections`,
+        ),
+      ),
+    );
+    const tick = () => {
+      if (settled) return;
+      if (Date.now() > deadline) {
+        finish(
+          new Error(`rastack-server did not listen on 127.0.0.1:${port}`),
+        );
+        return;
+      }
+      const socket = net.connect(port, "127.0.0.1", () => {
+        socket.end();
+        finish();
+      });
+      socket.on("error", () => setTimeout(tick, 100));
+    };
+    tick();
+  });
+}

package/src/external/envelope.ts

@@ -1,7 +1,7 @@
 /**
  * Normalise an upstream response into rastack's REST contract — the DRF-shaped
  * list envelope and bare detail object the typed hooks and `<DataTable>` expect,
- * identical to what the Rust API and the WASM/local engine emit.
+ * identical to what the native Rust API emits.
  *
  * External APIs rarely page the way rastack does (GitHub uses `per_page` + Link
  * headers; a GraphQL list just returns an array), so the envelope is synthesised

package/src/external/service.ts

@@ -1,8 +1,8 @@
 /**
  * The mini local proxy service — the "lambda you run while iterating".
  *
- * `rastack dev` already serves the app + admin over WASM for the stack's *own*
- * resources. This adds the other half for **external** resources: a request
+ * `rastack dev` proxies the stack's own resources to the native
+ * `rastack-server`. This adds the other half for **external** resources: a request
  * handler it mounts under `/api/`, so `useData("github.repo")` works locally,
  * cached, before any real Lambda is deployed. It is a thin adapter over the pure
  * {@link handleExternalRequest} core — parse the path, resolve dev auth from env

package/src/external/types.ts

@@ -2,7 +2,7 @@
  * External-API bindings — how a rastack `app.model` is served from an upstream
  * REST or GraphQL API.
  *
- * The stack's own resources are served by the Rust API / WASM engine over the
+ * The stack's own resources are served by the native Rust API over the
  * `/api/{app}/v1/{model}/` contract. An **external** resource (a GitHub repo, an
  * Expo project, an AWS stack) is served by the proxy instead: it speaks the same
  * contract to the client, and translates each request into an upstream call,

package/src/rastack-admin.ts

@@ -1,81 +1,29 @@
 #!/usr/bin/env node
 
 /**
- * `rastack admin` — the full, Django-admin-style console, served **in the
- * browser over the prebuilt WebAssembly engine** (exactly like `rastack dev`).
+ * `rastack admin` — the Django-admin-style console, served by the native
+ * `rastack-server` process.
  *
  *   rastack admin [resourcesDir] [--warehouse <dir>] [--port <n>] [--out <dir>] [--no-open]
  *
- * The console is React API Stack's own React admin (`tools/admin`, built from
- * `rastack/components` + `rastack/theme`). This command compiles the resources,
- * then boots a dependency-free static server that hands the browser everything
- * it needs to run the admin locally over WASM — no native server, no cargo:
- *   • the bundled React admin (`/dev/admin.js`), which defaults to `mode:"local"`,
- *   • the prebuilt WASM engine (`/wasm/…`) shipped in the package,
- *   • the compiled `schema.rastack.json` / `openapi.json`,
- *   • the committed Iceberg warehouse (`/data/warehouse/…`) to seed from.
- *
- * The engine is the single prebuilt `.wasm` bundle shipped in the npm package;
- * if it is missing the command errors and points at `rastack update` — it never
- * falls back to a from-source cargo build.
+ * Compiles the resources, then starts `rastack-server admin`. That process is
+ * the API (`rastack-api-core`) and it serves the React bundle at `/admin/`.
+ * The browser renders the console and calls `/api` on that same origin.
+ * The engine does not run in the browser.
  */
 
 import { execFileSync } from "child_process";
 import * as fs from "fs";
-import * as http from "http";
 import * as path from "path";
 import { runCompile } from "./compile";
+import { parseAdminArgs } from "./dev/harness";
 import {
-  WASM_ENTRY,
-  contentType,
-  parseAdminArgs,
-  renderShell,
-  wasmBundleCandidates,
-} from "./dev/harness";
-
-const HERE = __dirname; // dist/ when installed — the bundle lives beside us.
-
-/** Locate the prebuilt wasm bundle dir shipped in the package (no cargo fallback). */
-function resolveWasmDir(): string | null {
-  for (const dir of wasmBundleCandidates(HERE)) {
-    if (fs.existsSync(path.join(dir, WASM_ENTRY))) return dir;
-  }
-  return null;
-}
+  ensureServerBinary,
+  startNativeServer,
+  waitForTcp,
+} from "./dev/native-server";
 
-/** Serve one file if it exists and stays within `root`; else 404/403. */
-function serveUnder(
-  res: http.ServerResponse,
-  root: string,
-  relPath: string,
-): void {
-  const safeRoot = path.resolve(root);
-  const rel = decodeURIComponent(relPath).replace(/^\/+/, "");
-  const target = path.resolve(safeRoot, rel);
-  // Path-traversal guard: the resolved target must stay inside the root.
-  if (target !== safeRoot && !target.startsWith(safeRoot + path.sep)) {
-    res.writeHead(403).end("Forbidden");
-    return;
-  }
-  fs.readFile(target, (err, data) => {
-    if (err) {
-      res.writeHead(404).end("Not found");
-      return;
-    }
-    res.writeHead(200, { "Content-Type": contentType(target) }).end(data);
-  });
-}
-
-/** Serve an exact file (no traversal concern — a fixed internal artifact). */
-function serveFile(res: http.ServerResponse, file: string): void {
-  fs.readFile(file, (err, data) => {
-    if (err) {
-      res.writeHead(404).end("Not found");
-      return;
-    }
-    res.writeHead(200, { "Content-Type": contentType(file) }).end(data);
-  });
-}
+const HERE = __dirname; // dist/ when installed — admin.js lives beside us.
 
 /** Best-effort open the default browser at `url`. */
 function openBrowser(url: string): void {
@@ -92,11 +40,12 @@ function openBrowser(url: string): void {
   }
 }
 
-function main(argv: string[]): void {
+async function main(argv: string[]): Promise<void> {
   const args = parseAdminArgs(argv);
+  const cwd = process.cwd();
 
   console.log(
-    `\n  rastack admin — the database console, built with React API Stack\n`,
+    `\n  rastack admin — the database console, on the native Rust server\n`,
   );
   console.log(`▸ Compiling ${args.resourcesDir} → ${args.outDir}`);
   if (!runCompile(args.resourcesDir, args.outDir)) {
@@ -104,16 +53,6 @@ function main(argv: string[]): void {
     process.exit(1);
   }
 
-  const wasmDir = resolveWasmDir();
-  if (!wasmDir) {
-    console.error(
-      "\n  ✗ No prebuilt WASM engine found in this rastack install.\n" +
-        "    Update rastack to pull the prebuilt bundle:\n" +
-        "      rastack update\n",
-    );
-    process.exit(1);
-  }
-
   const adminBundle = path.join(HERE, "admin.js");
   if (!fs.existsSync(adminBundle)) {
     console.error(
@@ -122,41 +61,61 @@ function main(argv: string[]): void {
     process.exit(1);
   }
 
-  const server = http.createServer((req, res) => {
-    const url = (req.url || "/").split("?")[0];
-    if (req.method !== "GET") {
-      res.writeHead(405).end("Method not allowed");
-      return;
-    }
-    if (url === "/" || url === "/index.html") {
-      res
-        .writeHead(200, { "Content-Type": "text/html; charset=utf-8" })
-        .end(renderShell("React API Stack — admin"));
-      return;
-    }
-    if (url === "/dev/admin.js") return serveFile(res, adminBundle);
-    if (url.startsWith("/wasm/"))
-      return serveUnder(res, wasmDir, url.slice("/wasm/".length));
-    if (url === "/schema.rastack.json" || url === "/openapi.json")
-      return serveUnder(res, args.outDir, path.basename(url));
-    if (url.startsWith("/data/warehouse/"))
-      return serveUnder(
-        res,
-        args.warehouseDir,
-        url.slice("/data/warehouse/".length),
-      );
-    res.writeHead(404).end("Not found");
+  let bin: string;
+  try {
+    bin = ensureServerBinary(cwd);
+  } catch (err) {
+    console.error(`\n${(err as Error).message}\n`);
+    process.exit(1);
+  }
+
+  const manifest = path.resolve(cwd, args.outDir, "schema.rastack.json");
+  const warehouse = path.resolve(cwd, args.warehouseDir);
+  const child = startNativeServer({
+    bin,
+    command: "admin",
+    manifest,
+    warehouse,
+    addr: `127.0.0.1:${args.port}`,
+    adminAssets: HERE,
   });
 
-  server.listen(args.port, () => {
-    const url = `http://localhost:${args.port}`;
-    console.log(`  ✓ WASM engine: ${path.relative(process.cwd(), wasmDir)}`);
-    console.log(`\n  ▸ ${url}\n`);
-    console.log("  Press Ctrl+C to stop.\n");
-    if (args.open) openBrowser(url);
+  const stop = () => {
+    try {
+      child.kill("SIGTERM");
+    } catch {
+      /* already gone */
+    }
+  };
+  process.on("SIGINT", () => {
+    stop();
+    process.exit(0);
+  });
+  process.on("SIGTERM", () => {
+    stop();
+    process.exit(0);
   });
+
+  try {
+    await waitForTcp(args.port, child);
+  } catch (err) {
+    console.error(`\n${(err as Error).message}\n`);
+    stop();
+    process.exit(1);
+  }
+
+  const url = `http://127.0.0.1:${args.port}/admin/`;
+  console.log(`  ✓ native engine: ${bin}`);
+  console.log(`\n  ▸ ${url}\n`);
+  console.log("  Press Ctrl+C to stop.\n");
+  if (args.open) openBrowser(url);
+
+  child.on("exit", (code) => process.exit(code ?? 0));
 }
 
 if (require.main === module) {
-  main(process.argv.slice(2));
+  main(process.argv.slice(2)).catch((err) => {
+    console.error(err);
+    process.exit(1);
+  });
 }

package/src/rastack-design.ts

@@ -12,8 +12,7 @@
  * source and hitting **Save** writes it back and recompiles `tokens.css` /
  * `tokens.ts`, so the rest of the app picks the change up on reload.
  *
- * In keeping with the local-first ethos (the whole API runs in the browser via
- * WASM), the studio needs no build step and no external dependencies.
+ * The studio needs no build step and no external dependencies.
  */
 
 import * as http from "http";