@reventlessdev/reventless-seed-aws 1.0.0-alpha.4 → 1.0.0-alpha.6

package/lib/ocaml/ReventlessSeedAws.res

@@ -14,11 +14,6 @@ open ReventlessSeed
 
 // ── Node bindings ─────────────────────────────────────────────────────────────
 
-@val @scope("process") external processEnv: dict<string> = "env"
-
-type execOptions = {cwd: string, encoding: string, env?: dict<string>}
-@module("node:child_process")
-external execFileSync: (string, array<string>, execOptions) => string = "execFileSync"
 
 type fetchInit = {method: string, headers: dict<string>, body?: string}
 type response
@@ -41,6 +36,18 @@ let asString = (json: JSON.t): option<string> =>
   | _ => None
   }
 
+// Non-string members are dropped rather than failing the whole map: one
+// malformed entry should not cost a run every endpoint it could have used.
+let asStringDict = (json: JSON.t): dict<string> =>
+  switch json {
+  | Object(obj) =>
+    obj
+    ->Dict.toArray
+    ->Array.filterMap(((k, v)) => v->asString->Option.map(s => (k, s)))
+    ->Dict.fromArray
+  | _ => Dict.make()
+  }
+
 // ── Stack discovery ───────────────────────────────────────────────────────────
 
 // Which Pulumi backend the `pulumi` subprocess reads from. When `backend` is
@@ -53,13 +60,17 @@ let envForBackend = (backend: option<string>): option<dict<string>> =>
   switch backend {
   | None => None
   | Some(url) =>
-    let copy = processEnv->Dict.toArray->Dict.fromArray
+    let copy = NodeProcess.env->Dict.toArray->Dict.fromArray
     copy->Dict.set("PULUMI_BACKEND_URL", url)
     Some(copy)
   }
 
 let pulumi = (~projectDir: string, ~backend: option<string>, args: array<string>): string =>
-  execFileSync("pulumi", args, {cwd: projectDir, encoding: "utf8", env: ?envForBackend(backend)})
+  NodeChildProcess.execFileSync(
+    "pulumi",
+    args,
+    {cwd: projectDir, encoding: "utf8", env: ?envForBackend(backend)},
+  )
 
 // Stacks that actually exist in the Pulumi backend for this project — the names
 // `pulumi stack output --stack <name>` accepts. A `Pulumi.<stack>.yaml` config
@@ -147,70 +158,118 @@ let resolveField = (~envKey: string, ~fromSource: option<string>, ~human: string
     }
   }
 
-// Returns (graphqlEndpoint, uploadEndpoint, cognitoRegion, cognitoClientId).
-// `uploadEndpoint` is "" when the deployment publishes none — the data set's
-// upload phase no-ops on empty.
-let resolveEndpoints = async (~projectDir: string, ~backend: option<string>, ~stack: string): (
-  string,
-  string,
-  string,
-  string,
-) => {
-  let outputs = stackOutputs(~projectDir, ~backend, stack)
-  switch outputs->field("hostShellUrl")->Option.flatMap(asString) {
-  | Some(hostShellUrl) =>
-    let cfg = await fetchConfig(hostShellUrl)
+// Same precedence, for a value whose absence is a legitimate answer rather than
+// a broken deployment: a stack that declares no store publishes no upload
+// endpoint, and that must stay a no-op at the data set instead of failing the
+// run before a single command is sent.
+let optionalField = (~envKey: string, ~fromSource: option<string>): string =>
+  switch Seed.Prompt.envValue(envKey) {
+  | Some(v) => v
+  | None => fromSource->Option.getOr("")
+  }
+
+// Which document publishes the deployment's endpoints. A stack that serves a
+// host shell publishes them in the shell's `config.json` under the client's key
+// names; one that does not publishes them as stack outputs under Pulumi's. The
+// two arms name different keys for the same values, which is why this is a
+// variant and not a merged lookup.
+type source = HostShellConfig(JSON.t) | StackOutputs(JSON.t)
+
+type endpoints = {
+  graphql: string,
+  // The legacy single presign service; "" when the deployment publishes none.
+  uploadEndpoint: string,
+  // Qualified `{plugin}.{store}` → that store's presign endpoint. Empty when the
+  // deployment declares no store.
+  uploadEndpoints: dict<string>,
+  cognitoRegion: string,
+  cognitoClientId: string,
+}
+
+/**
+ * The endpoints a source document publishes — pure, so the branch selection and
+ * every key it reads can be exercised with synthetic documents.
+ *
+ * `uploadEndpoints` is read on **both** arms. It was read on neither: the
+ * host-shell arm looked only at the singular `uploadEndpoint`, and the
+ * stack-output arm had no upload lookup at all, so a platform that publishes its
+ * stores and no host shell resolved "" and reported itself as serving no
+ * uploads.
+ *
+ * `REVENTLESS_UPLOAD_ENDPOINT` still overrides the singular endpoint and does
+ * not touch the map: one string cannot express a map, so it could only ever
+ * override one store and would need a naming convention to say which.
+ */
+let endpointsFrom = (~stack: string, source: source): endpoints =>
+  switch source {
+  | HostShellConfig(cfg) =>
     let fromCfg = key => cfg->field(key)->Option.flatMap(asString)
-    let endpoint = resolveField(
-      ~envKey="REVENTLESS_GRAPHQL_ENDPOINT",
-      ~fromSource=fromCfg("apiEndpoint"),
-      ~human="apiEndpoint",
-    )
-    let uploadEndpoint = resolveField(
-      ~envKey="REVENTLESS_UPLOAD_ENDPOINT",
-      ~fromSource=fromCfg("uploadEndpoint"),
-      ~human="uploadEndpoint",
-    )
-    let region = resolveField(
-      ~envKey="AWS_REGION",
-      ~fromSource=fromCfg("region"),
-      ~human="region",
-    )
-    let clientId = resolveField(
-      ~envKey="COGNITO_CLIENT_ID",
-      ~fromSource=fromCfg("cognitoClientId"),
-      ~human="cognitoClientId",
-    )
-    (endpoint, uploadEndpoint, region, clientId)
-  | None =>
+    {
+      graphql: resolveField(
+        ~envKey="REVENTLESS_GRAPHQL_ENDPOINT",
+        ~fromSource=fromCfg("apiEndpoint"),
+        ~human="apiEndpoint",
+      ),
+      uploadEndpoint: optionalField(
+        ~envKey="REVENTLESS_UPLOAD_ENDPOINT",
+        ~fromSource=fromCfg("uploadEndpoint"),
+      ),
+      uploadEndpoints: cfg->field("uploadEndpoints")->Option.mapOr(Dict.make(), asStringDict),
+      cognitoRegion: resolveField(
+        ~envKey="AWS_REGION",
+        ~fromSource=fromCfg("region"),
+        ~human="region",
+      ),
+      cognitoClientId: resolveField(
+        ~envKey="COGNITO_CLIENT_ID",
+        ~fromSource=fromCfg("cognitoClientId"),
+        ~human="cognitoClientId",
+      ),
+    }
+  | StackOutputs(outputs) =>
     let out = key => outputs->field(key)->Option.flatMap(asString)
-    let endpoint = switch (
-      Seed.Prompt.envValue("REVENTLESS_GRAPHQL_ENDPOINT"),
-      out("domainMergedApiEndpoint"),
-      out("domainApiEndpoint"),
-    ) {
-    | (Some(v), _, _) | (_, Some(v), _) | (_, _, Some(v)) => v
-    | _ =>
-      throw(
-        Seed.Failed(
-          `stack "${stack}" exports neither domainMergedApiEndpoint nor domainApiEndpoint`,
-        ),
-      )
+    {
+      graphql: switch (
+        Seed.Prompt.envValue("REVENTLESS_GRAPHQL_ENDPOINT"),
+        out("domainMergedApiEndpoint"),
+        out("domainApiEndpoint"),
+      ) {
+      | (Some(v), _, _) | (_, Some(v), _) | (_, _, Some(v)) => v
+      | _ =>
+        throw(
+          Seed.Failed(
+            `stack "${stack}" exports neither domainMergedApiEndpoint nor domainApiEndpoint`,
+          ),
+        )
+      },
+      // No stack output carries the legacy single service — it exists only in a
+      // host shell's config.json — so here the env override is its only source.
+      uploadEndpoint: optionalField(~envKey="REVENTLESS_UPLOAD_ENDPOINT", ~fromSource=None),
+      uploadEndpoints: outputs->field("uploadEndpoints")->Option.mapOr(Dict.make(), asStringDict),
+      cognitoRegion: resolveField(
+        ~envKey="AWS_REGION",
+        ~fromSource=out("cognitoRegion"),
+        ~human="cognitoRegion",
+      ),
+      cognitoClientId: resolveField(
+        ~envKey="COGNITO_CLIENT_ID",
+        ~fromSource=out("cognitoUserPoolClientId"),
+        ~human="cognitoUserPoolClientId",
+      ),
     }
-    let region = resolveField(
-      ~envKey="AWS_REGION",
-      ~fromSource=out("cognitoRegion"),
-      ~human="cognitoRegion",
-    )
-    let clientId = resolveField(
-      ~envKey="COGNITO_CLIENT_ID",
-      ~fromSource=out("cognitoUserPoolClientId"),
-      ~human="cognitoUserPoolClientId",
-    )
-    // Absent → "" → the data set skips its upload phase.
-    let uploadEndpoint = Seed.Prompt.envValue("REVENTLESS_UPLOAD_ENDPOINT")->Option.getOr("")
-    (endpoint, uploadEndpoint, region, clientId)
   }
+
+let resolveEndpoints = async (
+  ~projectDir: string,
+  ~backend: option<string>,
+  ~stack: string,
+): endpoints => {
+  let outputs = stackOutputs(~projectDir, ~backend, stack)
+  let source = switch outputs->field("hostShellUrl")->Option.flatMap(asString) {
+  | Some(hostShellUrl) => HostShellConfig(await fetchConfig(hostShellUrl))
+  | None => StackOutputs(outputs)
+  }
+  endpointsFrom(~stack, source)
 }
 
 // ── Cognito login ─────────────────────────────────────────────────────────────
@@ -302,15 +361,12 @@ let connect = (~projectDir: string=".", ~stack=?, ~backend=?, ()): (
     | None => backend
     }
     let stackName = await resolveStack(~projectDir, ~backend, ~stack)
-    let (endpoint, uploadEndpoint, region, clientId) = await resolveEndpoints(
-      ~projectDir,
-      ~backend,
-      ~stack=stackName,
-    )
+    let eps = await resolveEndpoints(~projectDir, ~backend, ~stack=stackName)
     await Seed.Connect.make(
       ~label=stackName,
-      ~endpoint,
-      ~uploadEndpoint,
-      ~login=cognito(~region, ~clientId),
+      ~endpoint=eps.graphql,
+      ~uploadEndpoint=eps.uploadEndpoint,
+      ~uploadEndpoints=eps.uploadEndpoints,
+      ~login=cognito(~region=eps.cognitoRegion, ~clientId=eps.cognitoClientId),
     )
   }

package/lib/ocaml/ReventlessSeedAws_Reset.res

@@ -48,14 +48,7 @@ module Ddb = AwsSdk.DynamoDb
 module Rgt = AwsSdk.ResourceGroupsTaggingApi
 module S3 = AwsSdk.S3
 
-@scope("process") @val external exit: int => unit = "exit"
-@scope("process") @val external processEnv: dict<string> = "env"
-@module("node:fs") external readFileSync: (string, string) => string = "readFileSync"
 
-type stream
-@scope("process") @val external stdin: stream = "stdin"
-// `process.stdin.isTTY` is `true` interactively and `undefined` under a pipe/CI.
-@get external isTTY: stream => option<bool> = "isTTY"
 
 // The Pulumi project name, which the framework stamps as `reventless:platform` on
 // every resource (`Plugin.res`: `platformName = getProjectName()`). Discovery
@@ -66,7 +59,7 @@ type stream
 // the target project's Pulumi.yaml — the same dir the pulumi subprocess uses.
 let projectName = (~projectDir: string): string => {
   let path = `${projectDir}/Pulumi.yaml`
-  let raw = try readFileSync(path, "utf8") catch {
+  let raw = try NodeFs.readFileSync(path) catch {
   | _ => throw(Seed.Failed(`could not read ${path} to scope the wipe to this Pulumi project.`))
   }
   switch raw
@@ -561,7 +554,7 @@ let run = (~stack=?, ~backend=?, ~targets: array<target>, ()): unit => {
           ),
         )
       }
-      processEnv->Dict.set("AWS_REGION", region)
+      NodeProcess.env->Dict.set("AWS_REGION", region)
 
       // Discover + count each target, scoped to its own project via the platform
       // tag so a same-named stack from another project is never touched.
@@ -597,7 +590,7 @@ let run = (~stack=?, ~backend=?, ~targets: array<target>, ()): unit => {
         Seed.Prompt.close()
         Console.log("")
         Console.log(`Nothing to reset — the selected scope already reads empty in ${region}.`)
-        exit(0)
+        NodeProcess.exit(0)
       }
 
       // Confirmation. Interactively, re-typing the exact stack name IS the
@@ -606,7 +599,7 @@ let run = (~stack=?, ~backend=?, ~targets: array<target>, ()): unit => {
       // TTY (CI/scripts) there is nothing to type into, so
       // REVENTLESS_WIPE_CONFIRM=<stack> is the equivalent opt-in. Dry-run is the
       // default either way.
-      let interactive = stdin->isTTY->Option.getOr(false)
+      let interactive = NodeProcess.stdin->NodeProcess.isTTY->Option.getOr(false)
       let confirmed = if interactive {
         let typed = await Seed.Prompt.ask(
           `About to permanently empty ${total->Int.toString} item(s)/object(s) across the selected scope of "${stack}". ` ++
@@ -624,7 +617,7 @@ let run = (~stack=?, ~backend=?, ~targets: array<target>, ()): unit => {
             ? "Dry run — nothing was deleted."
             : `Dry run — nothing was deleted. Set REVENTLESS_WIPE_CONFIRM=${stack} to empty this scope non-interactively.`,
         )
-        exit(0)
+        NodeProcess.exit(0)
       }
 
       for i in 0 to resolvedList->Array.length - 1 {
@@ -681,19 +674,19 @@ let run = (~stack=?, ~backend=?, ~targets: array<target>, ()): unit => {
 
       Console.log("")
       Console.log(`Reset complete — the selected scope of "${stack}" reads empty and is re-seedable.`)
-      exit(0)
+      NodeProcess.exit(0)
     } catch {
     | Seed.Failed(message) =>
       Seed.Prompt.close()
       Console.error("")
       Console.error(`Reset aborted — ${message}`)
-      exit(1)
+      NodeProcess.exit(1)
     | exn =>
       Seed.Prompt.close()
       Console.error("")
       Console.error("Reset aborted with an unexpected error:")
       Console.error(exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown"))
-      exit(1)
+      NodeProcess.exit(1)
     }
   }
   go()->ignore

package/package.json

@@ -1,14 +1,16 @@
 {
   "name": "@reventlessdev/reventless-seed-aws",
-  "version": "1.0.0-alpha.4",
+  "version": "1.0.0-alpha.6",
   "description": "AWS connect + guarded reset for the Reventless seed harness — stack discovery, Cognito login, and a tag-scoped, allowlisted store wipe",
   "license": "Apache-2.0",
   "dependencies": {
-    "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.25",
-    "@reventlessdev/reventless-seed": "1.0.0-alpha.4"
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.0",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-seed": "1.0.0-alpha.6"
   },
   "devDependencies": {
-    "rescript": "12.3.0"
+    "rescript": "12.3.0",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10"
   },
   "peerDependencies": {
     "rescript": "12.3.0"

package/rescript.json

@@ -11,11 +11,18 @@
     {
       "dir": "src",
       "subdirs": true
+    },
+    {
+      "dir": "tests",
+      "subdirs": true,
+      "type": "dev"
     }
   ],
   "dependencies": [
     "@reventlessdev/reventless-seed",
-    "@reventlessdev/rescript-aws-sdk"
+    "@reventlessdev/rescript-aws-sdk",
+    "@reventlessdev/rescript-node",
+    "@reventlessdev/rescript-jest"
   ],
   "compiler-flags": [],
   "suffix": ".res.mjs"

package/src/ReventlessSeedAws.res

@@ -14,11 +14,6 @@ open ReventlessSeed
 
 // ── Node bindings ─────────────────────────────────────────────────────────────
 
-@val @scope("process") external processEnv: dict<string> = "env"
-
-type execOptions = {cwd: string, encoding: string, env?: dict<string>}
-@module("node:child_process")
-external execFileSync: (string, array<string>, execOptions) => string = "execFileSync"
 
 type fetchInit = {method: string, headers: dict<string>, body?: string}
 type response
@@ -41,6 +36,18 @@ let asString = (json: JSON.t): option<string> =>
   | _ => None
   }
 
+// Non-string members are dropped rather than failing the whole map: one
+// malformed entry should not cost a run every endpoint it could have used.
+let asStringDict = (json: JSON.t): dict<string> =>
+  switch json {
+  | Object(obj) =>
+    obj
+    ->Dict.toArray
+    ->Array.filterMap(((k, v)) => v->asString->Option.map(s => (k, s)))
+    ->Dict.fromArray
+  | _ => Dict.make()
+  }
+
 // ── Stack discovery ───────────────────────────────────────────────────────────
 
 // Which Pulumi backend the `pulumi` subprocess reads from. When `backend` is
@@ -53,13 +60,17 @@ let envForBackend = (backend: option<string>): option<dict<string>> =>
   switch backend {
   | None => None
   | Some(url) =>
-    let copy = processEnv->Dict.toArray->Dict.fromArray
+    let copy = NodeProcess.env->Dict.toArray->Dict.fromArray
     copy->Dict.set("PULUMI_BACKEND_URL", url)
     Some(copy)
   }
 
 let pulumi = (~projectDir: string, ~backend: option<string>, args: array<string>): string =>
-  execFileSync("pulumi", args, {cwd: projectDir, encoding: "utf8", env: ?envForBackend(backend)})
+  NodeChildProcess.execFileSync(
+    "pulumi",
+    args,
+    {cwd: projectDir, encoding: "utf8", env: ?envForBackend(backend)},
+  )
 
 // Stacks that actually exist in the Pulumi backend for this project — the names
 // `pulumi stack output --stack <name>` accepts. A `Pulumi.<stack>.yaml` config
@@ -147,70 +158,118 @@ let resolveField = (~envKey: string, ~fromSource: option<string>, ~human: string
     }
   }
 
-// Returns (graphqlEndpoint, uploadEndpoint, cognitoRegion, cognitoClientId).
-// `uploadEndpoint` is "" when the deployment publishes none — the data set's
-// upload phase no-ops on empty.
-let resolveEndpoints = async (~projectDir: string, ~backend: option<string>, ~stack: string): (
-  string,
-  string,
-  string,
-  string,
-) => {
-  let outputs = stackOutputs(~projectDir, ~backend, stack)
-  switch outputs->field("hostShellUrl")->Option.flatMap(asString) {
-  | Some(hostShellUrl) =>
-    let cfg = await fetchConfig(hostShellUrl)
+// Same precedence, for a value whose absence is a legitimate answer rather than
+// a broken deployment: a stack that declares no store publishes no upload
+// endpoint, and that must stay a no-op at the data set instead of failing the
+// run before a single command is sent.
+let optionalField = (~envKey: string, ~fromSource: option<string>): string =>
+  switch Seed.Prompt.envValue(envKey) {
+  | Some(v) => v
+  | None => fromSource->Option.getOr("")
+  }
+
+// Which document publishes the deployment's endpoints. A stack that serves a
+// host shell publishes them in the shell's `config.json` under the client's key
+// names; one that does not publishes them as stack outputs under Pulumi's. The
+// two arms name different keys for the same values, which is why this is a
+// variant and not a merged lookup.
+type source = HostShellConfig(JSON.t) | StackOutputs(JSON.t)
+
+type endpoints = {
+  graphql: string,
+  // The legacy single presign service; "" when the deployment publishes none.
+  uploadEndpoint: string,
+  // Qualified `{plugin}.{store}` → that store's presign endpoint. Empty when the
+  // deployment declares no store.
+  uploadEndpoints: dict<string>,
+  cognitoRegion: string,
+  cognitoClientId: string,
+}
+
+/**
+ * The endpoints a source document publishes — pure, so the branch selection and
+ * every key it reads can be exercised with synthetic documents.
+ *
+ * `uploadEndpoints` is read on **both** arms. It was read on neither: the
+ * host-shell arm looked only at the singular `uploadEndpoint`, and the
+ * stack-output arm had no upload lookup at all, so a platform that publishes its
+ * stores and no host shell resolved "" and reported itself as serving no
+ * uploads.
+ *
+ * `REVENTLESS_UPLOAD_ENDPOINT` still overrides the singular endpoint and does
+ * not touch the map: one string cannot express a map, so it could only ever
+ * override one store and would need a naming convention to say which.
+ */
+let endpointsFrom = (~stack: string, source: source): endpoints =>
+  switch source {
+  | HostShellConfig(cfg) =>
     let fromCfg = key => cfg->field(key)->Option.flatMap(asString)
-    let endpoint = resolveField(
-      ~envKey="REVENTLESS_GRAPHQL_ENDPOINT",
-      ~fromSource=fromCfg("apiEndpoint"),
-      ~human="apiEndpoint",
-    )
-    let uploadEndpoint = resolveField(
-      ~envKey="REVENTLESS_UPLOAD_ENDPOINT",
-      ~fromSource=fromCfg("uploadEndpoint"),
-      ~human="uploadEndpoint",
-    )
-    let region = resolveField(
-      ~envKey="AWS_REGION",
-      ~fromSource=fromCfg("region"),
-      ~human="region",
-    )
-    let clientId = resolveField(
-      ~envKey="COGNITO_CLIENT_ID",
-      ~fromSource=fromCfg("cognitoClientId"),
-      ~human="cognitoClientId",
-    )
-    (endpoint, uploadEndpoint, region, clientId)
-  | None =>
+    {
+      graphql: resolveField(
+        ~envKey="REVENTLESS_GRAPHQL_ENDPOINT",
+        ~fromSource=fromCfg("apiEndpoint"),
+        ~human="apiEndpoint",
+      ),
+      uploadEndpoint: optionalField(
+        ~envKey="REVENTLESS_UPLOAD_ENDPOINT",
+        ~fromSource=fromCfg("uploadEndpoint"),
+      ),
+      uploadEndpoints: cfg->field("uploadEndpoints")->Option.mapOr(Dict.make(), asStringDict),
+      cognitoRegion: resolveField(
+        ~envKey="AWS_REGION",
+        ~fromSource=fromCfg("region"),
+        ~human="region",
+      ),
+      cognitoClientId: resolveField(
+        ~envKey="COGNITO_CLIENT_ID",
+        ~fromSource=fromCfg("cognitoClientId"),
+        ~human="cognitoClientId",
+      ),
+    }
+  | StackOutputs(outputs) =>
     let out = key => outputs->field(key)->Option.flatMap(asString)
-    let endpoint = switch (
-      Seed.Prompt.envValue("REVENTLESS_GRAPHQL_ENDPOINT"),
-      out("domainMergedApiEndpoint"),
-      out("domainApiEndpoint"),
-    ) {
-    | (Some(v), _, _) | (_, Some(v), _) | (_, _, Some(v)) => v
-    | _ =>
-      throw(
-        Seed.Failed(
-          `stack "${stack}" exports neither domainMergedApiEndpoint nor domainApiEndpoint`,
-        ),
-      )
+    {
+      graphql: switch (
+        Seed.Prompt.envValue("REVENTLESS_GRAPHQL_ENDPOINT"),
+        out("domainMergedApiEndpoint"),
+        out("domainApiEndpoint"),
+      ) {
+      | (Some(v), _, _) | (_, Some(v), _) | (_, _, Some(v)) => v
+      | _ =>
+        throw(
+          Seed.Failed(
+            `stack "${stack}" exports neither domainMergedApiEndpoint nor domainApiEndpoint`,
+          ),
+        )
+      },
+      // No stack output carries the legacy single service — it exists only in a
+      // host shell's config.json — so here the env override is its only source.
+      uploadEndpoint: optionalField(~envKey="REVENTLESS_UPLOAD_ENDPOINT", ~fromSource=None),
+      uploadEndpoints: outputs->field("uploadEndpoints")->Option.mapOr(Dict.make(), asStringDict),
+      cognitoRegion: resolveField(
+        ~envKey="AWS_REGION",
+        ~fromSource=out("cognitoRegion"),
+        ~human="cognitoRegion",
+      ),
+      cognitoClientId: resolveField(
+        ~envKey="COGNITO_CLIENT_ID",
+        ~fromSource=out("cognitoUserPoolClientId"),
+        ~human="cognitoUserPoolClientId",
+      ),
     }
-    let region = resolveField(
-      ~envKey="AWS_REGION",
-      ~fromSource=out("cognitoRegion"),
-      ~human="cognitoRegion",
-    )
-    let clientId = resolveField(
-      ~envKey="COGNITO_CLIENT_ID",
-      ~fromSource=out("cognitoUserPoolClientId"),
-      ~human="cognitoUserPoolClientId",
-    )
-    // Absent → "" → the data set skips its upload phase.
-    let uploadEndpoint = Seed.Prompt.envValue("REVENTLESS_UPLOAD_ENDPOINT")->Option.getOr("")
-    (endpoint, uploadEndpoint, region, clientId)
   }
+
+let resolveEndpoints = async (
+  ~projectDir: string,
+  ~backend: option<string>,
+  ~stack: string,
+): endpoints => {
+  let outputs = stackOutputs(~projectDir, ~backend, stack)
+  let source = switch outputs->field("hostShellUrl")->Option.flatMap(asString) {
+  | Some(hostShellUrl) => HostShellConfig(await fetchConfig(hostShellUrl))
+  | None => StackOutputs(outputs)
+  }
+  endpointsFrom(~stack, source)
 }
 
 // ── Cognito login ─────────────────────────────────────────────────────────────
@@ -302,15 +361,12 @@ let connect = (~projectDir: string=".", ~stack=?, ~backend=?, ()): (
     | None => backend
     }
     let stackName = await resolveStack(~projectDir, ~backend, ~stack)
-    let (endpoint, uploadEndpoint, region, clientId) = await resolveEndpoints(
-      ~projectDir,
-      ~backend,
-      ~stack=stackName,
-    )
+    let eps = await resolveEndpoints(~projectDir, ~backend, ~stack=stackName)
     await Seed.Connect.make(
       ~label=stackName,
-      ~endpoint,
-      ~uploadEndpoint,
-      ~login=cognito(~region, ~clientId),
+      ~endpoint=eps.graphql,
+      ~uploadEndpoint=eps.uploadEndpoint,
+      ~uploadEndpoints=eps.uploadEndpoints,
+      ~login=cognito(~region=eps.cognitoRegion, ~clientId=eps.cognitoClientId),
     )
   }