@reventlessdev/reventless-seed 1.0.0-alpha.1 → 1.0.0-alpha.3

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 1.0.0-alpha.3 (2026-07-27)
+
+### Features
+
+* **seed:** refuse to seed onto a non-empty store (fresh-store guard) ([987613f](https://github.com/ReventlessDev/reventless-core/commit/987613f0767fc4391297dfeed3a6b19cd76d8157))
+
+
+# 1.0.0-alpha.2 (2026-07-26)
+
+### Features
+
+* **seed:** per-provider seed scripts, shared machinery, exportable data sets ([ba43e9e](https://github.com/ReventlessDev/reventless-core/commit/ba43e9efab84dd2955b6dafd1e187fd4aad699ad))
+
+
 # 1.0.0-alpha.1 (2026-07-26)
 
 ### Bug Fixes

package/lib/bs/.compiler.log

@@ -1,2 +1,2 @@
-#Start(1785055307106)
-#Done(1785055311634)
+#Start(1785139469133)
+#Done(1785139473598)

package/lib/bs/ReventlessSeed.mlmap

@@ -1,6 +1,8 @@
 randjbuildsystem
 Seed
 Seed_Client
+Seed_Connect
+Seed_Prompt
 Seed_Random
 Seed_Runner
 Seed_Types

package/lib/bs/compiler-info.json

@@ -4,5 +4,5 @@
   "bsc_hash": "75e3a59c95cc953608fd3dd6ea6ed68141bba4414a20a52f114261b8a48385fa",
   "rescript_config_hash": "ad3a9d479584c1d6e4fe10cd993d9e290f74732e9b0cb3dd5d7429e88b4bba38",
   "runtime_path": "/home/runner/work/reventless-core/reventless-core/node_modules/@rescript/runtime",
-  "generated_at": "1785055311640"
+  "generated_at": "1785139473607"
 }

package/lib/bs/src/Seed.res

@@ -9,9 +9,27 @@ module Random = Seed_Random
 module Client = Seed_Client
 module Runner = Seed_Runner
 module Upload = Seed_Upload
+module Prompt = Seed_Prompt
+module Connect = Seed_Connect
 
 exception Failed = Seed_Types.Failed
 
+// A live target a data set seeds against: an authenticated client, the upload
+// endpoint (empty when the deployment serves no uploads), and a label.
+type connection = Seed_Connect.connection = {
+  client: Seed_Client.t,
+  uploadEndpoint: string,
+  label: string,
+}
+
+// A named, seedable data set. `seed` owns everything domain-specific.
+type dataSet = Seed_Runner.dataSet = {
+  name: string,
+  label: string,
+  seed: connection => promise<unit>,
+  probeViews?: array<string>,
+}
+
 type rec value = Seed_Types.value =
   | String(string)
   | Id(string)

package/lib/bs/src/Seed.res.mjs

@@ -10,6 +10,10 @@ let Runner;
 
 let Upload;
 
+let Prompt;
+
+let Connect;
+
 let Failed = Seed_Types$ReventlessSeed.Failed;
 
 let mutation = Seed_Types$ReventlessSeed.mutation;
@@ -25,6 +29,8 @@ export {
   Client,
   Runner,
   Upload,
+  Prompt,
+  Connect,
   Failed,
   mutation,
   ids,

package/lib/bs/src/Seed_Client.res

@@ -27,9 +27,12 @@ let sleep = (ms: int): promise<unit> => Promise.make((resolve, _) => setTimeout(
 
 type config = {
   endpoint: string,
-  loginEndpoint: string,
-  username: string,
-  password: string,
+  // Present only for the `login` flow (a platform that mints tokens over HTTP,
+  // e.g. the local dev `/__inmemory/login`). Omit when the bearer is supplied
+  // out-of-band via `useToken` (e.g. a Cognito id token minted by the caller).
+  loginEndpoint?: string,
+  username?: string,
+  password?: string,
 }
 
 type t = {config: config, mutable token: option<string>}
@@ -40,6 +43,11 @@ let make = (~config: config): t => {config, token: None}
     Seed.Upload) can authenticate side-channel requests with the same identity. */
 let currentToken = (t: t): option<string> => t.token
 
+/** Injects a bearer obtained out-of-band (e.g. a Cognito id token), instead of
+    minting one via `login`. Provider-agnostic: the harness only cares that the
+    token is a valid bearer for `endpoint`. */
+let useToken = (t: t, token: string): unit => t.token = Some(token)
+
 // ── JSON helpers ────────────────────────────────────────────────────────────
 
 let field = (json: JSON.t, key: string): option<JSON.t> =>
@@ -61,28 +69,31 @@ let nodeString = (node: JSON.t, key: string): option<string> =>
 // ── Requests ────────────────────────────────────────────────────────────────
 
 let login = async (t: t): unit => {
+  let loginEndpoint = switch t.config.loginEndpoint {
+  | Some(e) => e
+  | None => throw(Failed("login: no loginEndpoint configured — supply one or call useToken"))
+  }
+  let username = t.config.username->Option.getOr("")
+  let password = t.config.password->Option.getOr("")
   let body = JSON.stringify(
     JSON.Encode.object(
       Dict.fromArray([
-        ("username", JSON.Encode.string(t.config.username)),
-        ("password", JSON.Encode.string(t.config.password)),
+        ("username", JSON.Encode.string(username)),
+        ("password", JSON.Encode.string(password)),
       ]),
     ),
   )
   let res = try await fetch(
-    t.config.loginEndpoint,
+    loginEndpoint,
     {method: "POST", headers: Dict.fromArray([("content-type", "application/json")]), body},
   ) catch {
-  | _ =>
-    throw(
-      Failed(`login: cannot reach ${t.config.loginEndpoint} — is the platform running?`),
-    )
+  | _ => throw(Failed(`login: cannot reach ${loginEndpoint} — is the platform running?`))
   }
   if !(res->responseOk) {
     let detail = await res->responseText
     throw(
       Failed(
-        `login as "${t.config.username}" failed with HTTP ${(res->responseStatus)
+        `login as "${username}" failed with HTTP ${(res->responseStatus)
             ->Int.toString}: ${detail}`,
       ),
     )

package/lib/bs/src/Seed_Client.res.mjs

@@ -21,6 +21,10 @@ function currentToken(t) {
   return t.token;
 }
 
+function useToken(t, token) {
+  t.token = token;
+}
+
 function field(json, key) {
   if (typeof json === "object" && json !== null && !Array.isArray(json)) {
     return json[key];
@@ -38,19 +42,32 @@ function nodeString(node, key) {
 }
 
 async function login(t) {
+  let e = t.config.loginEndpoint;
+  let loginEndpoint;
+  if (e !== undefined) {
+    loginEndpoint = e;
+  } else {
+    throw {
+      RE_EXN_ID: Seed_Types$ReventlessSeed.Failed,
+      _1: "login: no loginEndpoint configured — supply one or call useToken",
+      Error: new Error()
+    };
+  }
+  let username = Stdlib_Option.getOr(t.config.username, "");
+  let password = Stdlib_Option.getOr(t.config.password, "");
   let body = JSON.stringify(Object.fromEntries([
     [
       "username",
-      t.config.username
+      username
     ],
     [
       "password",
-      t.config.password
+      password
     ]
   ]));
   let res;
   try {
-    res = await fetch(t.config.loginEndpoint, {
+    res = await fetch(loginEndpoint, {
       method: "POST",
       headers: Object.fromEntries([[
           "content-type",
@@ -61,7 +78,7 @@ async function login(t) {
   } catch (exn) {
     throw {
       RE_EXN_ID: Seed_Types$ReventlessSeed.Failed,
-      _1: `login: cannot reach ` + t.config.loginEndpoint + ` — is the platform running?`,
+      _1: `login: cannot reach ` + loginEndpoint + ` — is the platform running?`,
       Error: new Error()
     };
   }
@@ -69,7 +86,7 @@ async function login(t) {
     let detail = await res.text();
     throw {
       RE_EXN_ID: Seed_Types$ReventlessSeed.Failed,
-      _1: `login as "` + t.config.username + `" failed with HTTP ` + res.status.toString() + `: ` + detail,
+      _1: `login as "` + username + `" failed with HTTP ` + res.status.toString() + `: ` + detail,
       Error: new Error()
     };
   }
@@ -227,6 +244,7 @@ export {
   sleep,
   make,
   currentToken,
+  useToken,
   field,
   asString,
   nodeString,

package/lib/bs/src/Seed_Connect.res

@@ -0,0 +1,84 @@
+// Turns endpoints plus a login function into a ready `connection`.
+//
+// A connection is what a data set seeds against: an authenticated GraphQL
+// client, the upload endpoint (empty when the deployment serves no uploads), and
+// a human label for the target. `make` is provider-agnostic — it prompts for
+// credentials, calls the supplied `login` to obtain a bearer, and wires it onto
+// the client via `useToken`. Where the bearer comes from (a local `/login`
+// round-trip, a Cognito id token) is the caller's concern.
+
+open Seed_Types
+
+type connection = {client: Seed_Client.t, uploadEndpoint: string, label: string}
+
+/**
+ * Prompts for credentials, calls `login` to mint a bearer, and returns a
+ * connection with that bearer already applied. `login` returns the bearer so a
+ * single `useToken` path serves every provider.
+ */
+let make = async (
+  ~label: string,
+  ~endpoint: string,
+  ~uploadEndpoint: string,
+  ~login: (~username: string, ~password: string) => promise<string>,
+  ~localDefaults: bool=false,
+): connection => {
+  // `SEED_SKIP_UPLOADS` forces the connection to carry no upload endpoint, so a
+  // data set's upload phase no-ops the same way it does when a deployment serves
+  // none. Use it to seed domain data fast, or to skip a broken/absent upload path
+  // without editing the data set. It is the single knob: an empty
+  // `REVENTLESS_UPLOAD_ENDPOINT` env reads as "unset" (falls back to discovery),
+  // so this is the reliable way to disable uploads.
+  let uploadEndpoint = Seed_Prompt.envValue("SEED_SKIP_UPLOADS")->Option.isSome ? "" : uploadEndpoint
+  let (username, password) = await Seed_Prompt.credentials(~localDefaults)
+  let token = await login(~username, ~password)
+  let client = Seed_Client.make(~config={endpoint: endpoint})
+  client->Seed_Client.useToken(token)
+  {client, uploadEndpoint, label}
+}
+
+/**
+ * A login function backed by an HTTP login endpoint (the local dev
+ * `/__inmemory/login` shape: POST `{username, password}` → `{token}`). Reuses
+ * `Seed_Client.login` but hands the token back for `useToken`.
+ */
+let viaLoginEndpoint = (~loginEndpoint: string) => async (
+  ~username: string,
+  ~password: string,
+): string => {
+  let client = Seed_Client.make(
+    ~config={endpoint: loginEndpoint, loginEndpoint, username, password},
+  )
+  await Seed_Client.login(client)
+  switch Seed_Client.currentToken(client) {
+  | Some(token) => token
+  | None => throw(Failed(`login at ${loginEndpoint} returned no token`))
+  }
+}
+
+let envOr = (key: string, fallback: string): string =>
+  Seed_Prompt.envValue(key)->Option.getOr(fallback)
+
+/**
+ * A ready `connect` thunk for the local dev platform, with the localhost
+ * defaults baked in and overridable per endpoint (arg, then env var, then
+ * default). Empty input at the credential prompt falls back to `admin`/`admin`.
+ */
+let local = (~graphql=?, ~upload=?, ~login=?, ()): (unit => promise<connection>) => {
+  let endpoint =
+    graphql->Option.getOr(envOr("REVENTLESS_GRAPHQL_ENDPOINT", "http://localhost:4000/graphql"))
+  let uploadEndpoint =
+    upload->Option.getOr(
+      envOr("REVENTLESS_UPLOAD_ENDPOINT", "http://localhost:4000/__inmemory/upload"),
+    )
+  let loginEndpoint =
+    login->Option.getOr(envOr("REVENTLESS_LOGIN_ENDPOINT", "http://localhost:4000/__inmemory/login"))
+  () =>
+    make(
+      ~label="local",
+      ~endpoint,
+      ~uploadEndpoint,
+      ~login=viaLoginEndpoint(~loginEndpoint),
+      ~localDefaults=true,
+    )
+}

package/lib/bs/src/Seed_Connect.res.mjs

@@ -0,0 +1,62 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Seed_Types$ReventlessSeed from "./Seed_Types.res.mjs";
+import * as Seed_Client$ReventlessSeed from "./Seed_Client.res.mjs";
+import * as Seed_Prompt$ReventlessSeed from "./Seed_Prompt.res.mjs";
+
+async function make(label, endpoint, uploadEndpoint, login, localDefaultsOpt) {
+  let localDefaults = localDefaultsOpt !== undefined ? localDefaultsOpt : false;
+  let uploadEndpoint$1 = Stdlib_Option.isSome(Seed_Prompt$ReventlessSeed.envValue("SEED_SKIP_UPLOADS")) ? "" : uploadEndpoint;
+  let match = await Seed_Prompt$ReventlessSeed.credentials(localDefaults);
+  let token = await login(match[0], match[1]);
+  let client = Seed_Client$ReventlessSeed.make({
+    endpoint: endpoint
+  });
+  Seed_Client$ReventlessSeed.useToken(client, token);
+  return {
+    client: client,
+    uploadEndpoint: uploadEndpoint$1,
+    label: label
+  };
+}
+
+function viaLoginEndpoint(loginEndpoint) {
+  return async (username, password) => {
+    let client = Seed_Client$ReventlessSeed.make({
+      endpoint: loginEndpoint,
+      loginEndpoint: loginEndpoint,
+      username: username,
+      password: password
+    });
+    await Seed_Client$ReventlessSeed.login(client);
+    let token = Seed_Client$ReventlessSeed.currentToken(client);
+    if (token !== undefined) {
+      return token;
+    }
+    throw {
+      RE_EXN_ID: Seed_Types$ReventlessSeed.Failed,
+      _1: `login at ` + loginEndpoint + ` returned no token`,
+      Error: new Error()
+    };
+  };
+}
+
+function envOr(key, fallback) {
+  return Stdlib_Option.getOr(Seed_Prompt$ReventlessSeed.envValue(key), fallback);
+}
+
+function local(graphql, upload, login, param) {
+  let endpoint = Stdlib_Option.getOr(graphql, Stdlib_Option.getOr(Seed_Prompt$ReventlessSeed.envValue("REVENTLESS_GRAPHQL_ENDPOINT"), "http://localhost:4000/graphql"));
+  let uploadEndpoint = Stdlib_Option.getOr(upload, Stdlib_Option.getOr(Seed_Prompt$ReventlessSeed.envValue("REVENTLESS_UPLOAD_ENDPOINT"), "http://localhost:4000/__inmemory/upload"));
+  let loginEndpoint = Stdlib_Option.getOr(login, Stdlib_Option.getOr(Seed_Prompt$ReventlessSeed.envValue("REVENTLESS_LOGIN_ENDPOINT"), "http://localhost:4000/__inmemory/login"));
+  return () => make("local", endpoint, uploadEndpoint, viaLoginEndpoint(loginEndpoint), true);
+}
+
+export {
+  make,
+  viaLoginEndpoint,
+  envOr,
+  local,
+}
+/* Seed_Prompt-ReventlessSeed Not a pure module */

package/lib/bs/src/Seed_Prompt.res

@@ -0,0 +1,188 @@
+// One shared readline interface for every interactive prompt in a seed run.
+//
+// The reason this module exists: creating and closing a fresh `readline`
+// interface per prompt leaves stdin paused after the first `close`, so the
+// second prompt (password after username) never fires and the run hangs. A
+// single interface, created lazily and closed exactly once, avoids that — and a
+// `muted` gate on its output lets password entry reuse the same interface
+// instead of opening a second one just to suppress the echo.
+//
+// Node bindings are declared here as typed externals; this package is
+// stdlib-only, so no `%raw`.
+
+open Seed_Types
+
+// ── Node bindings ─────────────────────────────────────────────────────────────
+
+type stream
+@val @scope("process") external stdin: stream = "stdin"
+@val @scope("process") external stdout: stream = "stdout"
+@send external writeStream: (stream, string) => unit = "write"
+@get external isTTY: stream => bool = "isTTY"
+@send external pauseStream: stream => unit = "pause"
+@send external unrefStream: stream => unit = "unref"
+
+@scope("process") @val external processEnv: dict<string> = "env"
+
+type rl
+type rlOptions = {input: stream, output: stream, terminal?: bool}
+@module("node:readline") external createInterface: rlOptions => rl = "createInterface"
+@send external question: (rl, string, string => unit) => unit = "question"
+@send external closeRl: rl => unit = "close"
+@set external setWriteToOutput: (rl, string => unit) => unit = "_writeToOutput"
+
+// ── Shared interface ──────────────────────────────────────────────────────────
+
+// Created on first use, closed once via `close`. `muted` gates the echo so the
+// same interface serves both visible and hidden prompts.
+let rlRef: ref<option<rl>> = ref(None)
+let muted = ref(false)
+
+let iface = (): rl =>
+  switch rlRef.contents {
+  | Some(rl) => rl
+  | None =>
+    let rl = createInterface({input: stdin, output: stdout, terminal: true})
+    rl->setWriteToOutput(s =>
+      if !muted.contents {
+        stdout->writeStream(s)
+      }
+    )
+    rlRef := Some(rl)
+    rl
+  }
+
+let close = (): unit =>
+  switch rlRef.contents {
+  | Some(rl) =>
+    rl->closeRl
+    rlRef := None
+    // Closing the interface is not enough: a terminal-mode readline leaves
+    // stdin resumed and reffed, which keeps the event loop alive so the CLI
+    // never exits after seeding. Release it explicitly.
+    stdin->pauseStream
+    stdin->unrefStream
+  | None => ()
+  }
+
+// ── Env + TTY ─────────────────────────────────────────────────────────────────
+
+let envValue = (key: string): option<string> =>
+  switch processEnv->Dict.get(key) {
+  | Some(v) if v->String.trim != "" => Some(v->String.trim)
+  | _ => None
+  }
+
+let requireTty = (): unit =>
+  if !(stdin->isTTY) {
+    throw(
+      Failed(
+        "no TTY for an interactive prompt — set the documented SEED_* / REVENTLESS_DEMO_* " ++
+        "env vars to run non-interactively.",
+      ),
+    )
+  }
+
+// ── Prompts ───────────────────────────────────────────────────────────────────
+
+let ask = (query: string): promise<string> =>
+  Promise.make((resolve, _) => {
+    let rl = iface()
+    rl->question(query, answer => resolve(answer->String.trim))
+  })
+
+// Same interface, echo suppressed for the keystrokes. `question` writes the
+// prompt synchronously first (while unmuted), then muting is switched on so only
+// the typed characters are hidden — the canonical readline recipe, which keeps
+// the line editor's cursor state consistent (a manual write + empty `question`
+// left some terminals unable to read the next line).
+let askHidden = (query: string): promise<string> =>
+  Promise.make((resolve, _) => {
+    let rl = iface()
+    rl->question(query, answer => {
+      muted := false
+      stdout->writeStream("\n")
+      resolve(answer)
+    })
+    muted := true
+  })
+
+/**
+ * Chooses one of `options` (a label paired with the value it selects).
+ *
+ * Auto-returns when there is a single option, so a lone data set or stack needs
+ * no keypress. `env` (e.g. `SEED_SET`) preselects by matching label or 1-based
+ * index, so CI runs without a TTY. Otherwise it prints a numbered menu.
+ */
+let select = async (
+  ~title: string,
+  ~options: array<(string, 'a)>,
+  ~env=?,
+): 'a =>
+  switch options {
+  | [(_, only)] => only
+  | _ =>
+    let fromEnv =
+      env
+      ->Option.flatMap(envValue)
+      ->Option.flatMap(v =>
+        switch options->Array.findIndex(((label, _)) => label == v) {
+        | -1 =>
+          switch Int.fromString(v) {
+          | Some(n) if n >= 1 && n <= options->Array.length => options->Array.get(n - 1)
+          | _ => None
+          }
+        | i => options->Array.get(i)
+        }
+      )
+    switch fromEnv {
+    | Some((_, value)) => value
+    | None =>
+      requireTty()
+      Console.log("")
+      Console.log(title)
+      Console.log("")
+      options->Array.forEachWithIndex(((label, _), i) =>
+        Console.log(`  ${(i + 1)->Int.toString}) ${label}`)
+      )
+      let rec pick = async (): 'a => {
+        let answer = await ask(`\nSelect [1-${(options->Array.length)->Int.toString}]: `)
+        switch Int.fromString(answer) {
+        | Some(n) if n >= 1 && n <= options->Array.length =>
+          let (_, value) = options->Array.getUnsafe(n - 1)
+          value
+        | _ =>
+          Console.log("  Not a valid choice.")
+          await pick()
+        }
+      }
+      await pick()
+    }
+  }
+
+/**
+ * Prompts for a username (visible) and password (echo muted).
+ *
+ * `REVENTLESS_DEMO_USER` / `REVENTLESS_DEMO_PASSWORD` skip the prompts. With
+ * `localDefaults`, empty input falls back to `admin`/`admin` — the dev login.
+ */
+let credentials = async (~localDefaults: bool=false): (string, string) => {
+  let username = switch envValue("REVENTLESS_DEMO_USER") {
+  | Some(u) => u
+  | None =>
+    requireTty()
+    let entered = await ask(localDefaults ? "Username [admin]: " : "Username: ")
+    entered == "" && localDefaults ? "admin" : entered
+  }
+  let password = switch envValue("REVENTLESS_DEMO_PASSWORD") {
+  | Some(p) => p
+  | None =>
+    requireTty()
+    let entered = await askHidden(localDefaults ? "Password [admin]: " : "Password: ")
+    entered == "" && localDefaults ? "admin" : entered
+  }
+  if username == "" || password == "" {
+    throw(Failed("username and password are required."))
+  }
+  (username, password)
+}