@reventlessdev/reventless-aws 3.0.0-alpha.250 → 3.0.0-alpha.252

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.252 (2026-08-01)
+
+### Bug Fixes
+
+* **aws:** let a dead letter be seen ([e64949b](https://github.com/ReventlessDev/reventless-core/commit/e64949bb3f4965cb8e6fc7a2f04971290ebe43bf))
+* **aws:** let the Function URL own CORS on the upload and geocoder services ([19d4b7f](https://github.com/ReventlessDev/reventless-core/commit/19d4b7f26f0925b7c659a1b37555e952bb7c7f46))
+### Features
+
+* **upload:** add the release half of the upload contract via the domain API ([448f887](https://github.com/ReventlessDev/reventless-core/commit/448f88714a5875be420f794a08d482fcf4ba8404))
+
+
+# 3.0.0-alpha.251 (2026-08-01)
+
+### Bug Fixes
+
+* **core:** drain the inbound audit log per request, not wholesale ([e18d4ec](https://github.com/ReventlessDev/reventless-core/commit/e18d4ec4b7ffb38a9e2bd3594d39a07e2ee91851))
+
+
 # 3.0.0-alpha.250 (2026-08-01)
 
 **Note:** Version bump only for package @reventlessdev/reventless-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.250",
+  "version": "3.0.0-alpha.252",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -11,18 +11,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.0",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.0",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.0",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.62",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.115",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.197",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.116",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.90",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.61"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.91",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.199",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.63"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -67,7 +67,6 @@ type objectStoreEndpoint = {
   // only known after the bucket resolves — and a plain string here is exactly
   // how this shipped exporting a bucket name that no ARN matches.
   bucketName: Pulumi.Output.t<string>,
-  uploadUrl: Pulumi.Output.t<string>,
   // Public base URL the store is served from, when the platform serves it
   // itself. `None` when a host-UI bundle is deployed — there the shell's own
   // origin serves the store same-origin and a relative `/{prefix}/…` resolves
@@ -170,9 +169,15 @@ module MakeWithConfig = (
   // "Relay node resolution" section of the merged-api plan (never resolved on
   // any deployed AWS platform, zero consumers; the Node interface and global
   // IDs stay).
+  // The upload service (route B) lives on the domain base, not the Admin-gated admin
+  // base: `Upload_Presign`/`Upload_Release` take the domain API's default
+  // `AllowAuthenticated` auth so any authenticated user can mint/release their own
+  // uploads. See [docs/plans/upload-release-path.md] § "Which API". (Split mode only —
+  // unified mode carries the admin base here instead; it declares no stores in practice,
+  // so the upload resolvers below are never created there.)
   let domainBaseFragment = ReventlessCore.GraphQL_Stitcher.encode({
-    types: [],
-    mutations: [],
+    types: ReventlessCore.Platform_AdminApi.uploadTypes,
+    mutations: ReventlessCore.Platform_AdminApi.uploadMutationFields,
     queries: ["  Platform_ping: String"],
     subscriptions: [],
     subscriptionSources: [],
@@ -1585,17 +1590,14 @@ module MakeWithConfig = (
         b
       }
       let storeHandle = bucket->Capability_ObjectStore_S3.underPrefix(~keyPrefix)
-      // One presign service per store, scoped to that store's own prefix.
-      let presign = Upload_Presign_S3.make(
-        ~name=`UploadPresign-${plugin}-${store}`,
-        ~bucketName=storeHandle.bucketName,
-        ~servedPrefix=storeHandle.keyPrefix,
-      )
       // `bucketName` is the layout's *logical* name and groups the served view
       // below; `storeHandle.bucketName` is the physical one Pulumi resolves, and
       // is what a consumer needs to build an ARN. Carrying both is the point —
       // they are different strings and only one of them exists in S3.
-      (`${plugin}.${store}`, keyPrefix, bucketName, storeHandle.bucketName, presign.url)
+      //
+      // Presigning is no longer per store: one platform-API Upload service (below)
+      // covers every declared store, keyed by the qualified `{plugin}.{store}` name.
+      (`${plugin}.${store}`, keyPrefix, bucketName, storeHandle.bucketName)
     })
 
     // Group the served view by bucket: one origin and one bucket policy per
@@ -1606,7 +1608,7 @@ module MakeWithConfig = (
       ->Option.map(b => {
         ReventlessInfra.Platform.id: bucketName,
         prefixes: declaredStoreServices
-        ->Array.filterMap(((_, prefix, bn, _, _)) => bn == bucketName ? Some(prefix) : None),
+        ->Array.filterMap(((_, prefix, bn, _)) => bn == bucketName ? Some(prefix) : None),
         bucketId: b.bucketId,
         bucketArn: b.bucketArn,
         bucketRegionalDomainName: b.bucketRegionalDomainName,
@@ -1645,30 +1647,58 @@ module MakeWithConfig = (
       keyPrefix,
       _logicalBucketName,
       physicalBucketName,
-      uploadUrl,
     )) => {
       store,
       keyPrefix,
       bucketName: physicalBucketName->Pulumi.Output.fromInput,
-      uploadUrl,
       baseUrl: storeServingBaseUrl,
     })
     objectStoreEndpointsRef := declaredStoreEndpoints
 
+    // One domain-API Upload service (route B1) covers every declared store plus the
+    // legacy `hostUiBundle.uploadBucket`, keyed by the qualified `{plugin}.{store}` name
+    // the caller passes as the `store` argument. On the domain API (not the Admin-gated
+    // platform API — see the plan's "Which API" note) so any authenticated user can
+    // mint/release. Created here in the outer scope — not inside the `hostUiBundle`
+    // branch — because a platform whose UI ships from another stack still has declared
+    // stores that need presigning. `uploads` keys the legacy store, matching the prefix
+    // it has always served under.
+    let uploadServiceStores =
+      declaredStoreServices
+      ->Array.map(((qualified, keyPrefix, _logical, physicalBucketName)) => {
+        Upload_Presign_S3.qualified: qualified,
+        bucketName: physicalBucketName,
+        servedPrefix: keyPrefix,
+      })
+      ->Array.concat(
+        switch hostUiBundle->Option.flatMap(c => c.uploadBucket) {
+        | Some(store) => [
+            {
+              Upload_Presign_S3.qualified: store.keyPrefix,
+              bucketName: store.bucketName,
+              servedPrefix: store.keyPrefix,
+            },
+          ]
+        | None => []
+        },
+      )
+    if uploadServiceStores->Array.length > 0 {
+      let _uploadService = Upload_Presign_S3.make(
+        ~api=domainApi,
+        ~stores=uploadServiceStores,
+        ~opts={},
+      )
+    }
+
     // Exported unconditionally — the provisioning above already is. Their only
     // consumers used to sit inside `switch hostUiBundle`, which left a platform
     // whose UI ships from another stack holding stores it could not name.
     //
     // Omitted entirely when nothing is declared, so a deployment with no
-    // declared store keeps a byte-identical output set.
+    // declared store keeps a byte-identical output set. The presign endpoint is no
+    // longer exported — under route B the client calls the platform API's
+    // `Upload_Presign` mutation, so there is no per-store URL to publish.
     if declaredStoreEndpoints->Array.length > 0 {
-      Pulumi.Pulumi.export(
-        "uploadEndpoints",
-        declaredStoreEndpoints
-        ->Array.map(e => e.uploadUrl->Pulumi.Output.apply(u => (e.store, JSON.Encode.string(u))))
-        ->Pulumi.Output.all
-        ->Pulumi.Output.apply(pairs => pairs->Dict.fromArray->JSON.Encode.object),
-      )
       Pulumi.Pulumi.export(
         "objectStores",
         declaredStoreEndpoints
@@ -1826,27 +1856,11 @@ module MakeWithConfig = (
       | None => Pulumi.Output.make(None)
       }
 
-      // Optional public upload presign Function URL, provisioned against the
-      // configured store; its resolved URL becomes config.json's
-      // `uploadEndpoint`. No store ⇒ Output<None> ⇒ field omitted below.
-      let uploadEndpointOutput: Pulumi.Output.t<option<string>> = switch cfg.uploadBucket {
-      | Some(store) =>
-        Upload_Presign_S3.make(~bucketName=store.bucketName).url->Pulumi.Output.apply(u => Some(u))
-      | None => Pulumi.Output.make(None)
-      }
-
-      // Per-store presign endpoints, keyed by the store's qualified name. This
-      // is what lets an upload input bind to the store its field *declares*
-      // rather than inferring one from the field's name — the endpoint exists
-      // per store, so there is something concrete to bind to.
-      //
-      // `uploadEndpoint` (singular) stays as the legacy service's URL: a shell
-      // built before per-store binding reads it and is unaffected.
-      let storeUploadEndpointsOutput: Pulumi.Output.t<array<(string, string)>> =
-        declaredStoreServices
-        ->Array.map(((qualified, _, _, _, url)) => url->Pulumi.Output.apply(u => (qualified, u)))
-        ->Pulumi.Output.all
-
+      // Presign endpoints are no longer written to config.json: under route B the
+      // client calls the platform API's `Upload_Presign` mutation (reachable from
+      // `platformApiEndpoint`, already present) with the store it declares, so there
+      // is no per-store URL to publish. The store's *serving* base URL still travels
+      // in the `objectStores` stack output above.
       let configJsonContent =
         (
           (
@@ -1857,14 +1871,12 @@ module MakeWithConfig = (
           )->Pulumi.Output.all4,
           domainEventsEndpointOutput,
           geocoderEndpointOutput,
-          (uploadEndpointOutput, storeUploadEndpointsOutput)->Pulumi.Output.all2,
         )
-        ->Pulumi.Output.all4
+        ->Pulumi.Output.all3
         ->Pulumi.Output.apply(((
           (domainEp, platformEp, poolId, clientId),
           eventsEpOpt,
           geocoderEpOpt,
-          (uploadEpOpt, storeUploadEps),
         )) => {
           let fields = [
             ("apiEndpoint", JSON.Encode.string(domainEp)),
@@ -1897,29 +1909,7 @@ module MakeWithConfig = (
           | Some(ep) => Array.concat(withEvents, [("geocoderEndpoint", JSON.Encode.string(ep))])
           | None => withEvents
           }
-          let withUpload = switch uploadEpOpt {
-          | Some(ep) => Array.concat(withGeocoder, [("uploadEndpoint", JSON.Encode.string(ep))])
-          | None => withGeocoder
-          }
-          // Omitted entirely when nothing is declared, so a deployment without
-          // declared stores writes a byte-identical config.json.
-          let withStoreUploads = switch storeUploadEps {
-          | [] => withUpload
-          | eps =>
-            Array.concat(
-              withUpload,
-              [
-                (
-                  "uploadEndpoints",
-                  eps
-                  ->Array.map(((qualified, url)) => (qualified, JSON.Encode.string(url)))
-                  ->Dict.fromArray
-                  ->JSON.Encode.object,
-                ),
-              ],
-            )
-          }
-          withStoreUploads->Dict.fromArray->JSON.Encode.object->JSON.stringify
+          withGeocoder->Dict.fromArray->JSON.Encode.object->JSON.stringify
         })
 
       let _ = PulumiAws.S3.BucketObject.make(

package/src/Platform.res.mjs

@@ -156,8 +156,8 @@ function MakeWithConfig(Config) {
   };
   let platformStackRef = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
   let domainBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
-    types: [],
-    mutations: [],
+    types: Platform_AdminApi$ReventlessCore.uploadTypes,
+    mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields,
     queries: ["  Platform_ping: String"],
     subscriptions: [],
     subscriptionSources: []
@@ -931,13 +931,11 @@ function MakeWithConfig(Config) {
         bucket = b$1;
       }
       let storeHandle = Capability_ObjectStore_S3$ReventlessAws.underPrefix(bucket, keyPrefix);
-      let presign = Upload_Presign_S3$ReventlessAws.make(storeHandle.bucketName, undefined, storeHandle.keyPrefix, `UploadPresign-` + plugin + `-` + store, undefined);
       return [
         plugin + `.` + store,
         keyPrefix,
         bucketName,
-        storeHandle.bucketName,
-        presign.url
+        storeHandle.bucketName
       ];
     });
     let declaredServedBuckets = Stdlib_Array.filterMap(storeBucketOrder, bucketName => Stdlib_Option.map(storeBuckets[bucketName], b => ({
@@ -966,15 +964,23 @@ function MakeWithConfig(Config) {
       store: param[0],
       keyPrefix: param[1],
       bucketName: param[3],
-      uploadUrl: param[4],
       baseUrl: storeServingBaseUrl
     }));
     objectStoreEndpointsRef.contents = declaredStoreEndpoints;
+    let store = Stdlib_Option.flatMap(hostUiBundle, c => c.uploadBucket);
+    let uploadServiceStores = declaredStoreServices.map(param => ({
+      qualified: param[0],
+      bucketName: param[3],
+      servedPrefix: param[1]
+    })).concat(store !== undefined ? [{
+          qualified: store.keyPrefix,
+          bucketName: store.bucketName,
+          servedPrefix: store.keyPrefix
+        }] : []);
+    if (uploadServiceStores.length !== 0) {
+      Upload_Presign_S3$ReventlessAws.make(domainApi, uploadServiceStores, undefined, undefined, {});
+    }
     if (declaredStoreEndpoints.length !== 0) {
-      Pulumi$Pulumi.$$export("uploadEndpoints", Pulumi.all(declaredStoreEndpoints.map(e => e.uploadUrl.apply(u => [
-        e.store,
-        u
-      ]))).apply(pairs => Object.fromEntries(pairs)));
       Pulumi$Pulumi.$$export("objectStores", Pulumi.all(declaredStoreEndpoints.map(e => Pulumi.all([
         e.bucketName,
         Output$Pulumi.allOpt(e.baseUrl)
@@ -1019,14 +1025,14 @@ function MakeWithConfig(Config) {
       } else {
         customDomain = undefined;
       }
-      let store = hostUiBundle.uploadBucket;
+      let store$1 = hostUiBundle.uploadBucket;
       let servedBuckets = (
-        store !== undefined ? [{
-              id: store.keyPrefix,
-              prefixes: [store.keyPrefix],
-              bucketId: store.bucketId,
-              bucketArn: store.bucketArn,
-              bucketRegionalDomainName: store.bucketRegionalDomainName
+        store$1 !== undefined ? [{
+              id: store$1.keyPrefix,
+              prefixes: [store$1.keyPrefix],
+              bucketId: store$1.bucketId,
+              bucketArn: store$1.bucketArn,
+              bucketRegionalDomainName: store$1.bucketRegionalDomainName
             }] : []
       ).concat(declaredServedBuckets);
       let match$4 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot(true, "@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
@@ -1039,15 +1045,6 @@ function MakeWithConfig(Config) {
       let domainEventsEndpointOutput = domainEventsApiOpt !== undefined ? AppSync_EventsApi$ReventlessAws.httpEndpoint(domainEventsApiOpt).apply(ep => ep + "/event") : Pulumi.output(undefined);
       let index = hostUiBundle.geocoderPlaceIndex;
       let geocoderEndpointOutput = index !== undefined ? Geocoder_AwsLocation$ReventlessAws.make(index.indexName, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
-      let store$1 = hostUiBundle.uploadBucket;
-      let uploadEndpointOutput = store$1 !== undefined ? Upload_Presign_S3$ReventlessAws.make(store$1.bucketName, undefined, undefined, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
-      let storeUploadEndpointsOutput = Pulumi.all(declaredStoreServices.map(param => {
-        let qualified = param[0];
-        return param[4].apply(u => [
-          qualified,
-          u
-        ]);
-      }));
       let configJsonContent = Pulumi.all([
         Pulumi.all([
           resolvedDomainApiEndpoint,
@@ -1056,26 +1053,19 @@ function MakeWithConfig(Config) {
           cognitoPool.clientId
         ]),
         domainEventsEndpointOutput,
-        geocoderEndpointOutput,
-        Pulumi.all([
-          uploadEndpointOutput,
-          storeUploadEndpointsOutput
-        ])
+        geocoderEndpointOutput
       ]).apply(param => {
-        let match = param[3];
-        let storeUploadEps = match[1];
-        let uploadEpOpt = match[0];
         let geocoderEpOpt = param[2];
         let eventsEpOpt = param[1];
-        let match$1 = param[0];
+        let match = param[0];
         let fields = [
           [
             "apiEndpoint",
-            match$1[0]
+            match[0]
           ],
           [
             "platformApiEndpoint",
-            match$1[1]
+            match[1]
           ],
           [
             "region",
@@ -1087,11 +1077,11 @@ function MakeWithConfig(Config) {
           ],
           [
             "cognitoUserPoolId",
-            match$1[2]
+            match[2]
           ],
           [
             "cognitoClientId",
-            match$1[3]
+            match[3]
           ],
           [
             "liveUpdates",
@@ -1116,18 +1106,7 @@ function MakeWithConfig(Config) {
               "geocoderEndpoint",
               geocoderEpOpt
             ]]) : withEvents;
-        let withUpload = uploadEpOpt !== undefined ? withGeocoder.concat([[
-              "uploadEndpoint",
-              uploadEpOpt
-            ]]) : withGeocoder;
-        let withStoreUploads = storeUploadEps.length !== 0 ? withUpload.concat([[
-              "uploadEndpoints",
-              Object.fromEntries(storeUploadEps.map(param => [
-                param[0],
-                param[1]
-              ]))
-            ]]) : withUpload;
-        return JSON.stringify(Object.fromEntries(withStoreUploads));
+        return JSON.stringify(Object.fromEntries(withGeocoder));
       });
       new (Aws.s3.BucketObject)("host-ui-config-json", {
         bucket: bucketName,
@@ -1334,8 +1313,8 @@ function Make($star) {
   };
   let platformStackRef = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
   let domainBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
-    types: [],
-    mutations: [],
+    types: Platform_AdminApi$ReventlessCore.uploadTypes,
+    mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields,
     queries: ["  Platform_ping: String"],
     subscriptions: [],
     subscriptionSources: []
@@ -2086,13 +2065,11 @@ function Make($star) {
         bucket = b$1;
       }
       let storeHandle = Capability_ObjectStore_S3$ReventlessAws.underPrefix(bucket, keyPrefix);
-      let presign = Upload_Presign_S3$ReventlessAws.make(storeHandle.bucketName, undefined, storeHandle.keyPrefix, `UploadPresign-` + plugin + `-` + store, undefined);
       return [
         plugin + `.` + store,
         keyPrefix,
         bucketName,
-        storeHandle.bucketName,
-        presign.url
+        storeHandle.bucketName
       ];
     });
     let declaredServedBuckets = Stdlib_Array.filterMap(storeBucketOrder, bucketName => Stdlib_Option.map(storeBuckets[bucketName], b => ({
@@ -2121,15 +2098,23 @@ function Make($star) {
       store: param[0],
       keyPrefix: param[1],
       bucketName: param[3],
-      uploadUrl: param[4],
       baseUrl: storeServingBaseUrl
     }));
     objectStoreEndpointsRef.contents = declaredStoreEndpoints;
+    let store = Stdlib_Option.flatMap(hostUiBundle, c => c.uploadBucket);
+    let uploadServiceStores = declaredStoreServices.map(param => ({
+      qualified: param[0],
+      bucketName: param[3],
+      servedPrefix: param[1]
+    })).concat(store !== undefined ? [{
+          qualified: store.keyPrefix,
+          bucketName: store.bucketName,
+          servedPrefix: store.keyPrefix
+        }] : []);
+    if (uploadServiceStores.length !== 0) {
+      Upload_Presign_S3$ReventlessAws.make(domainApi, uploadServiceStores, undefined, undefined, {});
+    }
     if (declaredStoreEndpoints.length !== 0) {
-      Pulumi$Pulumi.$$export("uploadEndpoints", Pulumi.all(declaredStoreEndpoints.map(e => e.uploadUrl.apply(u => [
-        e.store,
-        u
-      ]))).apply(pairs => Object.fromEntries(pairs)));
       Pulumi$Pulumi.$$export("objectStores", Pulumi.all(declaredStoreEndpoints.map(e => Pulumi.all([
         e.bucketName,
         Output$Pulumi.allOpt(e.baseUrl)
@@ -2174,14 +2159,14 @@ function Make($star) {
       } else {
         customDomain = undefined;
       }
-      let store = hostUiBundle.uploadBucket;
+      let store$1 = hostUiBundle.uploadBucket;
       let servedBuckets = (
-        store !== undefined ? [{
-              id: store.keyPrefix,
-              prefixes: [store.keyPrefix],
-              bucketId: store.bucketId,
-              bucketArn: store.bucketArn,
-              bucketRegionalDomainName: store.bucketRegionalDomainName
+        store$1 !== undefined ? [{
+              id: store$1.keyPrefix,
+              prefixes: [store$1.keyPrefix],
+              bucketId: store$1.bucketId,
+              bucketArn: store$1.bucketArn,
+              bucketRegionalDomainName: store$1.bucketRegionalDomainName
             }] : []
       ).concat(declaredServedBuckets);
       let match$4 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot(true, "@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
@@ -2194,15 +2179,6 @@ function Make($star) {
       let domainEventsEndpointOutput = domainEventsApiOpt !== undefined ? AppSync_EventsApi$ReventlessAws.httpEndpoint(domainEventsApiOpt).apply(ep => ep + "/event") : Pulumi.output(undefined);
       let index = hostUiBundle.geocoderPlaceIndex;
       let geocoderEndpointOutput = index !== undefined ? Geocoder_AwsLocation$ReventlessAws.make(index.indexName, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
-      let store$1 = hostUiBundle.uploadBucket;
-      let uploadEndpointOutput = store$1 !== undefined ? Upload_Presign_S3$ReventlessAws.make(store$1.bucketName, undefined, undefined, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
-      let storeUploadEndpointsOutput = Pulumi.all(declaredStoreServices.map(param => {
-        let qualified = param[0];
-        return param[4].apply(u => [
-          qualified,
-          u
-        ]);
-      }));
       let configJsonContent = Pulumi.all([
         Pulumi.all([
           resolvedDomainApiEndpoint,
@@ -2211,26 +2187,19 @@ function Make($star) {
           cognitoPool.clientId
         ]),
         domainEventsEndpointOutput,
-        geocoderEndpointOutput,
-        Pulumi.all([
-          uploadEndpointOutput,
-          storeUploadEndpointsOutput
-        ])
+        geocoderEndpointOutput
       ]).apply(param => {
-        let match = param[3];
-        let storeUploadEps = match[1];
-        let uploadEpOpt = match[0];
         let geocoderEpOpt = param[2];
         let eventsEpOpt = param[1];
-        let match$1 = param[0];
+        let match = param[0];
         let fields = [
           [
             "apiEndpoint",
-            match$1[0]
+            match[0]
           ],
           [
             "platformApiEndpoint",
-            match$1[1]
+            match[1]
           ],
           [
             "region",
@@ -2242,11 +2211,11 @@ function Make($star) {
           ],
           [
             "cognitoUserPoolId",
-            match$1[2]
+            match[2]
           ],
           [
             "cognitoClientId",
-            match$1[3]
+            match[3]
           ],
           [
             "liveUpdates",
@@ -2271,18 +2240,7 @@ function Make($star) {
               "geocoderEndpoint",
               geocoderEpOpt
             ]]) : withEvents;
-        let withUpload = uploadEpOpt !== undefined ? withGeocoder.concat([[
-              "uploadEndpoint",
-              uploadEpOpt
-            ]]) : withGeocoder;
-        let withStoreUploads = storeUploadEps.length !== 0 ? withUpload.concat([[
-              "uploadEndpoints",
-              Object.fromEntries(storeUploadEps.map(param => [
-                param[0],
-                param[1]
-              ]))
-            ]]) : withUpload;
-        return JSON.stringify(Object.fromEntries(withStoreUploads));
+        return JSON.stringify(Object.fromEntries(withGeocoder));
       });
       new (Aws.s3.BucketObject)("host-ui-config-json", {
         bucket: bucketName,

package/src/adapter/Geocoder/Geocoder_AwsLocation_Ops.res

@@ -60,14 +60,16 @@ type response = {
   body: string,
 }
 
-// Permissive CORS so the browser demo can call the endpoint from any origin.
-let corsHeaders = () =>
-  Dict.fromArray([
-    ("content-type", "application/json"),
-    ("access-control-allow-origin", "*"),
-    ("access-control-allow-methods", "GET,OPTIONS"),
-    ("access-control-allow-headers", "*"),
-  ])
+// CORS belongs to the Function URL's own `cors` configuration and to nothing
+// else. AWS injects the allow-origin header itself whenever the request carries
+// an `Origin`, so a handler that also sets one sends the header *twice* — and a
+// browser rejects `Access-Control-Allow-Origin: *, *` outright, failing every
+// cross-origin call while leaving `curl` (which sends no `Origin`, so AWS adds
+// nothing) working perfectly.
+//
+// It is also the only way `~corsOrigins` can mean anything: a hardcoded `*`
+// here would keep answering `*` for a deployment that narrowed the allow-list.
+let jsonHeaders = () => Dict.fromArray([("content-type", "application/json")])
 
 // Pull `q` from the parsed query-string params, falling back to the raw string.
 let readQueryParam = (event: functionUrlEvent): option<string> =>
@@ -93,7 +95,7 @@ let handler = async (event: functionUrlEvent): response => {
     let indexName = getEnv("PLACE_INDEX_NAME")->Option.getOr("")
     let q = readQueryParam(event)->Option.getOr("")
     if indexName == "" || q == "" {
-      {statusCode: 200, headers: corsHeaders(), body: "[]"}
+      {statusCode: 200, headers: jsonHeaders(), body: "[]"}
     } else {
       let client = makeLocationClient()
       let resp = await client->send(
@@ -124,13 +126,13 @@ let handler = async (event: functionUrlEvent): response => {
         )
       {
         statusCode: 200,
-        headers: corsHeaders(),
+        headers: jsonHeaders(),
         body: results->JSON.Encode.array->JSON.stringify,
       }
     }
   } catch {
   | exn =>
     Console.error2("Geocoder: search failed", exn)
-    {statusCode: 200, headers: corsHeaders(), body: "[]"}
+    {statusCode: 200, headers: jsonHeaders(), body: "[]"}
   }
 }