@reventlessdev/reventless-seed-aws 1.0.0-alpha.28 → 1.0.0-alpha.29

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 1.0.0-alpha.29 (2026-09-09)
+
+### Features
+
+* **seed:** choose the role a run acts as, instead of inheriting a stored one ([edf41ca](https://github.com/ReventlessDev/reventless-core/commit/edf41ca80f84bf340679f200ebfeeeb4a590ae03))
+
+
 # 1.0.0-alpha.28 (2026-09-08)
 
 **Note:** Version bump only for package @reventlessdev/reventless-seed-aws

package/lib/bs/.compiler.log

@@ -1,2 +1,2 @@
-#Start(1788869322743)
-#Done(1788869322782)
+#Start(1788992686668)
+#Done(1788992686721)

package/lib/bs/compiler-info.json

@@ -4,5 +4,5 @@
   "bsc_hash": "75e3a59c95cc953608fd3dd6ea6ed68141bba4414a20a52f114261b8a48385fa",
   "rescript_config_hash": "c18a0067c363fd1290f6e7f6fe6212d2e16e201c1702fac667962047f88ed468",
   "runtime_path": "/home/runner/work/reventless-core/reventless-core/node_modules/@rescript/runtime",
-  "generated_at": "1788869322788"
+  "generated_at": "1788992686726"
 }

package/lib/bs/src/ReventlessSeedAws.res

@@ -14,7 +14,6 @@ open ReventlessSeed
 
 // ── Node bindings ─────────────────────────────────────────────────────────────
 
-
 type fetchInit = {method: string, headers: dict<string>, body?: string}
 type response
 @val external fetch: (string, fetchInit) => promise<response> = "fetch"
@@ -77,12 +76,15 @@ let deployedStacks = (~projectDir: string, ~backend: option<string>): array<stri
   }
 
 let stackOutputs = (~projectDir: string, ~backend: option<string>, stack: string): JSON.t => {
-  let raw = try pulumi(~projectDir, ~backend, ["stack", "output", "--stack", stack, "--json"]) catch {
+  let raw = try pulumi(
+    ~projectDir,
+    ~backend,
+    ["stack", "output", "--stack", stack, "--json"],
+  ) catch {
   | _ =>
     throw(
       Seed.Failed(
-        `pulumi stack output --stack ${stack} failed — is pulumi installed, logged in, ` ++
-        "and the stack deployed?",
+        `pulumi stack output --stack ${stack} failed — is pulumi installed, logged in, ` ++ "and the stack deployed?",
       ),
     )
   }
@@ -97,7 +99,11 @@ let backendNote = (~backend: option<string>): string =>
   | None => ""
   }
 
-let resolveStack = async (~projectDir: string, ~backend: option<string>, ~stack: option<string>): string =>
+let resolveStack = async (
+  ~projectDir: string,
+  ~backend: option<string>,
+  ~stack: option<string>,
+): string =>
   switch stack {
   | Some(s) => s
   | None =>
@@ -111,8 +117,7 @@ let resolveStack = async (~projectDir: string, ~backend: option<string>, ~stack:
             `no deployed Pulumi stacks for this project (\`pulumi stack ls\` is empty in ${projectDir})${backendNote(
                 ~backend,
               )}. ` ++
-            "A Pulumi.<stack>.yaml config file alone is not a deployed stack — run `pulumi up` " ++
-            "first, log in to the backend that holds the stack, or set SEED_STACK to target one.",
+            "A Pulumi.<stack>.yaml config file alone is not a deployed stack — run `pulumi up` " ++ "first, log in to the backend that holds the stack, or set SEED_STACK to target one.",
           ),
         )
       }
@@ -123,13 +128,13 @@ let resolveStack = async (~projectDir: string, ~backend: option<string>, ~stack:
 // ── Endpoints ─────────────────────────────────────────────────────────────────
 
 let fetchConfig = async (hostShellUrl: string): JSON.t => {
-  let base = hostShellUrl->String.replaceRegExp(%re("/\/+$/g"), "")
+  let base = hostShellUrl->String.replaceRegExp(/\/+$/g, "")
   let url = `${base}/config.json`
   let res = try await fetch(url, {method: "GET", headers: Dict.make()}) catch {
   | _ => throw(Seed.Failed(`cannot reach ${url}`))
   }
   if !(res->responseOk) {
-    throw(Seed.Failed(`GET ${url} → HTTP ${(res->responseStatus)->Int.toString}`))
+    throw(Seed.Failed(`GET ${url} → HTTP ${res->responseStatus->Int.toString}`))
   }
   await res->responseJson
 }
@@ -232,64 +237,110 @@ let resolveEndpoints = async (
 
 // ── Cognito login ─────────────────────────────────────────────────────────────
 
-let cognito = (~region: string, ~clientId: string) => async (
-  ~username: string,
-  ~password: string,
-): string => {
-  let body = JSON.stringify(
-    JSON.Encode.object(
-      Dict.fromArray([
-        ("AuthFlow", JSON.Encode.string("USER_PASSWORD_AUTH")),
-        ("ClientId", JSON.Encode.string(clientId)),
-        (
-          "AuthParameters",
-          JSON.Encode.object(
-            Dict.fromArray([
-              ("USERNAME", JSON.Encode.string(username)),
-              ("PASSWORD", JSON.Encode.string(password)),
-            ]),
+let cognito = (~region: string, ~clientId: string) =>
+  async (~username: string, ~password: string): string => {
+    let body = JSON.stringify(
+      JSON.Encode.object(
+        Dict.fromArray([
+          ("AuthFlow", JSON.Encode.string("USER_PASSWORD_AUTH")),
+          ("ClientId", JSON.Encode.string(clientId)),
+          (
+            "AuthParameters",
+            JSON.Encode.object(
+              Dict.fromArray([
+                ("USERNAME", JSON.Encode.string(username)),
+                ("PASSWORD", JSON.Encode.string(password)),
+              ]),
+            ),
           ),
-        ),
-      ]),
-    ),
-  )
-  let headers = Dict.fromArray([
-    ("content-type", "application/x-amz-json-1.1"),
-    ("x-amz-target", "AWSCognitoIdentityProviderService.InitiateAuth"),
-  ])
-  let res = try await fetch(`https://cognito-idp.${region}.amazonaws.com/`, {
-    method: "POST",
-    headers,
-    body,
-  }) catch {
-  | _ => throw(Seed.Failed(`cannot reach Cognito in ${region}`))
-  }
-  let json = await res->responseJson
-  if !(res->responseOk) {
-    let detail =
-      json->field("message")->Option.flatMap(asString)->Option.getOr(JSON.stringify(json))
-    throw(
-      Seed.Failed(
-        `Cognito InitiateAuth failed (HTTP ${(res->responseStatus)->Int.toString}): ${detail}`,
+        ]),
       ),
     )
+    let headers = Dict.fromArray([
+      ("content-type", "application/x-amz-json-1.1"),
+      ("x-amz-target", "AWSCognitoIdentityProviderService.InitiateAuth"),
+    ])
+    let res = try await fetch(
+      `https://cognito-idp.${region}.amazonaws.com/`,
+      {
+        method: "POST",
+        headers,
+        body,
+      },
+    ) catch {
+    | _ => throw(Seed.Failed(`cannot reach Cognito in ${region}`))
+    }
+    let json = await res->responseJson
+    if !(res->responseOk) {
+      let detail =
+        json->field("message")->Option.flatMap(asString)->Option.getOr(JSON.stringify(json))
+      throw(
+        Seed.Failed(
+          `Cognito InitiateAuth failed (HTTP ${res->responseStatus->Int.toString}): ${detail}`,
+        ),
+      )
+    }
+    switch json->field("ChallengeName")->Option.flatMap(asString) {
+    | Some(challenge) =>
+      throw(
+        Seed.Failed(
+          `Cognito returned challenge ${challenge} — set a permanent password first ` ++ "(aws cognito-idp admin-set-user-password … --permanent).",
+        ),
+      )
+    | None => ()
+    }
+    switch json
+    ->field("AuthenticationResult")
+    ->Option.flatMap(ar => ar->field("IdToken"))
+    ->Option.flatMap(asString) {
+    | Some(token) => token
+    | None => throw(Seed.Failed(`Cognito response carried no IdToken: ${JSON.stringify(json)}`))
+    }
+  }
+
+// ── Active role ───────────────────────────────────────────────────────────────
+
+/**
+ * The Cognito path's active-role door: `Platform_SetActiveRole` on the domain
+ * API, which is where the seed already sends everything else.
+ *
+ * It sits on the domain base document at `AllowAuthenticated`, deliberately not
+ * behind the Admin gate — the whole point is that a caller can drop into a
+ * narrower role — so a token already narrowed to `Shopper` can still call this
+ * to widen back out. There is no chicken-and-egg, and no `sub` argument: the
+ * mutation addresses the authorizer-verified caller's own row and nobody else's.
+ *
+ * Returns `None` always: the choice is a stored row, read by the pool's
+ * pre-token-generation trigger on the NEXT login, so the current bearer is
+ * unchanged by it and the caller must re-authenticate to see any effect.
+ *
+ * Split-API only. A unified-mode deployment's single API does not carry the
+ * field, so a refusal naming it is reported as "this deployment offers no role
+ * switch" rather than as a seeding failure.
+ */
+let setActiveRole: Seed.Connect.roleSwitch = async (~client, ~role) => {
+  let argument = switch role {
+  | None => "null"
+  | Some(r) => JSON.stringify(JSON.Encode.string(r))
   }
-  switch json->field("ChallengeName")->Option.flatMap(asString) {
-  | Some(challenge) =>
+  try {
+    let _ = await Seed.Client.gql(
+      client,
+      ~query=`mutation { Platform_SetActiveRole(activeRole: ${argument}) { activeRole availableRoles } }`,
+      ~label="Platform_SetActiveRole",
+    )
+    None
+  } catch {
+  | Seed.Failed(message) =>
     throw(
       Seed.Failed(
-        `Cognito returned challenge ${challenge} — set a permanent password first ` ++
-        "(aws cognito-idp admin-set-user-password … --permanent).",
+        message->String.includes("Platform_SetActiveRole")
+          ? `this deployment offers no role switch — \`Platform_SetActiveRole\` is a split-API ` ++
+            `field, and a unified-mode API does not carry it. Change the role in the host shell ` ++
+            `instead.\n  ${message}`
+          : message,
       ),
     )
-  | None => ()
-  }
-  switch json
-  ->field("AuthenticationResult")
-  ->Option.flatMap(ar => ar->field("IdToken"))
-  ->Option.flatMap(asString) {
-  | Some(token) => token
-  | None => throw(Seed.Failed(`Cognito response carried no IdToken: ${JSON.stringify(json)}`))
   }
 }
 
@@ -324,5 +375,6 @@ let connect = (~projectDir: string=".", ~stack=?, ~backend=?, ()): (
       ~label=stackName,
       ~endpoint=eps.graphql,
       ~login=cognito(~region=eps.cognitoRegion, ~clientId=eps.cognitoClientId),
+      ~roleSwitch=setActiveRole,
     )
   }

package/lib/bs/src/ReventlessSeedAws.res.mjs

@@ -4,6 +4,8 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Nodechild_process from "node:child_process";
 import * as Seed$ReventlessSeed from "@reventlessdev/reventless-seed/src/Seed.res.mjs";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Seed_Client$ReventlessSeed from "@reventlessdev/reventless-seed/src/Seed_Client.res.mjs";
 import * as Seed_Prompt$ReventlessSeed from "@reventlessdev/reventless-seed/src/Seed_Prompt.res.mjs";
 import * as Seed_Connect$ReventlessSeed from "@reventlessdev/reventless-seed/src/Seed_Connect.res.mjs";
 
@@ -279,6 +281,25 @@ function cognito(region, clientId) {
   };
 }
 
+async function setActiveRole(client, role) {
+  let argument = role !== undefined ? JSON.stringify(role) : "null";
+  try {
+    await Seed_Client$ReventlessSeed.gql(client, `mutation { Platform_SetActiveRole(activeRole: ` + argument + `) { activeRole availableRoles } }`, "Platform_SetActiveRole");
+    return;
+  } catch (raw_message) {
+    let message = Primitive_exceptions.internalToException(raw_message);
+    if (message.RE_EXN_ID === Seed$ReventlessSeed.Failed) {
+      let message$1 = message._1;
+      throw {
+        RE_EXN_ID: Seed$ReventlessSeed.Failed,
+        _1: message$1.includes("Platform_SetActiveRole") ? `this deployment offers no role switch — \`Platform_SetActiveRole\` is a split-API field, and a unified-mode API does not carry it. Change the role in the host shell instead.\n  ` + message$1 : message$1,
+        Error: new Error()
+      };
+    }
+    throw message;
+  }
+}
+
 function connect($staropt$star, stack, backend, param) {
   return async () => {
     let projectDir = $staropt$star !== undefined ? $staropt$star : ".";
@@ -286,7 +307,7 @@ function connect($staropt$star, stack, backend, param) {
     let backend$1 = url !== undefined ? url : backend;
     let stackName = await resolveStack(projectDir, backend$1, stack);
     let eps = await resolveEndpoints(projectDir, backend$1, stackName);
-    return await Seed_Connect$ReventlessSeed.make(stackName, eps.graphql, cognito(eps.cognitoRegion, eps.cognitoClientId), undefined);
+    return await Seed_Connect$ReventlessSeed.make(stackName, eps.graphql, cognito(eps.cognitoRegion, eps.cognitoClientId), setActiveRole, undefined);
   };
 }
 
@@ -304,6 +325,7 @@ export {
   endpointsFrom,
   resolveEndpoints,
   cognito,
+  setActiveRole,
   connect,
 }
 /* node:child_process Not a pure module */

package/lib/bs/src/ReventlessSeedAws_Quiesce.res

@@ -153,8 +153,9 @@ let restoreConcurrency = async (~client, ~h: held): option<string> =>
   | () => None
   | exception exn =>
     Some(
-      `LEFT SWITCHED OFF: could not restore concurrency on ${h.functionName} (${errorText(exn)}). ` ++
-      `It is still reserved at 0 and will not run until that is undone.`,
+      `LEFT SWITCHED OFF: could not restore concurrency on ${h.functionName} (${errorText(
+          exn,
+        )}). ` ++ `It is still reserved at 0 and will not run until that is undone.`,
     )
   }
 
@@ -181,7 +182,9 @@ let release = async (~client, ~held: array<held>): array<string> => {
     | () => None
     | exception exn =>
       Some(
-        `could not restore the environment of ${h.functionName} (${errorText(exn)}) — it may still ` ++
+        `could not restore the environment of ${h.functionName} (${errorText(
+            exn,
+          )}) — it may still ` ++
         `carry ${markerKey}, which is inert and is removed by the next deploy.`,
       )
     }
@@ -207,8 +210,9 @@ let recycle = async (~client, ~held: array<held>): array<string> => {
     | () => None
     | exception exn =>
       Some(
-        `could not recycle ${h.functionName} (${errorText(exn)}) — a warm container may still hold ` ++
-        `pre-wipe state and write it back. Redeploy or update that function to clear it.`,
+        `could not recycle ${h.functionName} (${errorText(
+            exn,
+          )}) — a warm container may still hold ` ++ `pre-wipe state and write it back. Redeploy or update that function to clear it.`,
       )
     }
   })
@@ -283,12 +287,10 @@ let hold = async (~client, ~functionNames: array<string>): array<held> => {
     let advice = if reason->isThrottle {
       `The Lambda control plane throttled the hold. That budget is per account and region and is ` ++
       `shared with anything else using it — a deploy, an inspector sync, another stack in the same ` ++
-      `region — so this is transient and nothing is wrong with the credentials. Wait for whatever ` ++
-      `else is running to finish and re-run.`
+      `region — so this is transient and nothing is wrong with the credentials. Wait for whatever ` ++ `else is running to finish and re-run.`
     } else {
       `The reset holds every runtime in scope for the length of the wipe, which needs ` ++
-      `lambda:GetFunctionConcurrency, lambda:GetFunctionConfiguration, lambda:PutFunctionConcurrency, ` ++
-      `lambda:DeleteFunctionConcurrency and lambda:UpdateFunctionConfiguration.`
+      `lambda:GetFunctionConcurrency, lambda:GetFunctionConfiguration, lambda:PutFunctionConcurrency, ` ++ `lambda:DeleteFunctionConcurrency and lambda:UpdateFunctionConfiguration.`
     }
     throw(
       ReventlessSeed.Seed.Failed(

package/lib/bs/src/ReventlessSeedAws_Reconcile.res

@@ -123,7 +123,7 @@ let listObjects = async (~bucket: string, ~prefix: string): array<object> => {
       S3.ListObjectVersionsCommand.make({
         bucket,
         prefix: `${prefix}/`,
-        keyMarker: ?keyMarker,
+        ?keyMarker,
         versionIdMarker: ?versionMarker,
       }),
     )
@@ -153,8 +153,7 @@ let listObjects = async (~bucket: string, ~prefix: string): array<object> => {
       let tagging = await S3.GetObjectTaggingCommand.send(
         S3.GetObjectTaggingCommand.make({bucket, key}),
       )
-      let pending =
-        tagging.tagSet->Option.getOr([])->Array.some(t => t.key == pendingTagKey)
+      let pending = tagging.tagSet->Option.getOr([])->Array.some(t => t.key == pendingTagKey)
       objects->Array.push({key, ref: `/${key}`, pending})
     })
   )
@@ -224,10 +223,17 @@ let print = (r: report): bool => {
   Console.log("")
   Console.log(`  ${r.store}   ${r.bucket}/${r.prefix}/`)
   Console.log(`    event rows scanned: ${r.eventRows->Int.toString}`)
-  let line = (label, n) => Console.log(`      ${n->Int.toString->String.padStart(8, " ")}  ${label}`)
+  let line = (label, n) =>
+    Console.log(`      ${n->Int.toString->String.padStart(8, " ")}  ${label}`)
   line("referenced, still tagged pending  ← must be 0", r.referencedButPending->Array.length)
-  line("unreferenced, tagged pending      ← what expiry would delete", r.unreferencedPending->Array.length)
-  line("unreferenced, untagged            ← outside the rule", r.unreferencedUntagged->Array.length)
+  line(
+    "unreferenced, tagged pending      ← what expiry would delete",
+    r.unreferencedPending->Array.length,
+  )
+  line(
+    "unreferenced, untagged            ← outside the rule",
+    r.unreferencedUntagged->Array.length,
+  )
   line("referenced but missing            ← dangling refs", r.danglingRefs->Array.length)
 
   // Every object untagged reads as "the claimer has caught up with everything",
@@ -238,13 +244,16 @@ let print = (r: report): bool => {
     r.referencedButPending->Array.length +
     r.unreferencedPending->Array.length +
     r.unreferencedUntagged->Array.length
-  if objectCount > 0 && r.referencedButPending->Array.length == 0 && r.unreferencedPending->Array.length == 0 {
+  if (
+    objectCount > 0 &&
+    r.referencedButPending->Array.length == 0 &&
+    r.unreferencedPending->Array.length == 0
+  ) {
     Console.log("")
     Console.log(
       `    Note: none of the ${objectCount->Int.toString} objects carry "${pendingTagKey}". That is ` ++
       "what a fully-claimed store looks like — and also what it looks like if the mint side " ++
-      "never wrote the tag (a store whose objects all predate it) or if this tool's tag key has " ++
-      "drifted from the deploy's.",
+      "never wrote the tag (a store whose objects all predate it) or if this tool's tag key has " ++ "drifted from the deploy's.",
     )
   }
 
@@ -258,8 +267,7 @@ let print = (r: report): bool => {
     Console.log("")
     Console.log(
       "    Do NOT enable this store's expiry rule. Either the claim component is behind or " ++
-      "stopped (check its IteratorAge alarm), or a field holding these refs is missing its " ++
-      "`@storageRef` annotation — in which case the claimer never sees it and never will.",
+      "stopped (check its IteratorAge alarm), or a field holding these refs is missing its " ++ "`@storageRef` annotation — in which case the claimer never sees it and never will.",
     )
   }
   r.referencedButPending->Array.length == 0
@@ -293,8 +301,7 @@ let run = (~stack=?, ~backend=?, ~targets: array<ReventlessSeedAws_Reset.target>
       | None =>
         throw(
           Seed.Failed(
-            "no `platform` target is declared — declared object stores live in the platform " ++
-            "project's stack output and cannot be resolved without it.",
+            "no `platform` target is declared — declared object stores live in the platform " ++ "project's stack output and cannot be resolved without it.",
           ),
         )
       }
@@ -320,8 +327,7 @@ let run = (~stack=?, ~backend=?, ~targets: array<ReventlessSeedAws_Reset.target>
       } else {
         let region = switch Seed.Prompt.envValue("AWS_REGION") {
         | Some(r) if r != "" => r
-        | _ =>
-          throw(Seed.Failed("could not resolve the AWS region — set AWS_REGION."))
+        | _ => throw(Seed.Failed("could not resolve the AWS region — set AWS_REGION."))
         }
         Seed.Runner.heading(`Reconcile: stack "${stack}" in ${region}`)
 
@@ -356,14 +362,12 @@ let run = (~stack=?, ~backend=?, ~targets: array<ReventlessSeedAws_Reset.target>
         if allClear.contents {
           Console.log(
             "Every referenced object has been claimed. Enabling a store's expiry rule " ++
-            "(`pendingUploadExpiryDays: \"<plugin>.<store>=<days>\"`) would delete only " ++
-            "objects nothing references.",
+            "(`pendingUploadExpiryDays: \"<plugin>.<store>=<days>\"`) would delete only " ++ "objects nothing references.",
           )
         } else {
           throw(
             Seed.Failed(
-              "at least one referenced object is still tagged pending — see above. No store's " ++
-              "expiry rule should be enabled while this is true.",
+              "at least one referenced object is still tagged pending — see above. No store's " ++ "expiry rule should be enabled while this is true.",
             ),
           )
         }
@@ -377,7 +381,9 @@ let run = (~stack=?, ~backend=?, ~targets: array<ReventlessSeedAws_Reset.target>
     | exn =>
       Console.error("")
       Console.error("Reconcile failed with an unexpected error:")
-      Console.error(exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown"))
+      Console.error(
+        exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown"),
+      )
       NodeProcess.exit(1)
     }
   }