@reventlessdev/reventless-seed-aws 1.0.0-alpha.28 → 1.0.0-alpha.29

package/lib/ocaml/ReventlessSeedAws_Reset.res

@@ -50,8 +50,6 @@ module S3 = AwsSdk.S3
 module Lambda = AwsSdk.Lambda
 module Quiesce = ReventlessSeedAws_Quiesce
 
-
-
 // The Pulumi project name, which the framework stamps as `reventless:platform` on
 // every resource (`Plugin.res`: `platformName = getProjectName()`). Discovery
 // MUST scope on this as well as the stack: `reventless:environment` carries only
@@ -72,7 +70,7 @@ let projectName = (~projectDir: string): string => {
     trimmed
     ->String.slice(~start=String.length("name:"), ~end=String.length(trimmed))
     ->String.trim
-    ->String.replaceRegExp(%re("/^[\"']|[\"']$/g"), "")
+    ->String.replaceRegExp(/^[\"']|[\"']$/g, "")
   | None => throw(Seed.Failed(`could not find a \`name:\` field in ${path}.`))
   }
 }
@@ -106,7 +104,7 @@ let chunk = (arr: array<'a>, size: int): array<array<'a>> => {
 
 // Fail-closed name allowlist. A denylist ("everything except prod") fails open
 // the day a new prod-like stack is added and forgotten; this fails closed.
-let nameAllowlist = %re("/^(alpha|dev|pr-.+)$/")
+let nameAllowlist = /^(alpha|dev|pr-.+)$/
 
 // The stack's fully-resolved Pulumi config, read once. Reading it whole (rather
 // than `pulumi config get <key>`, which exits non-zero for BOTH a missing key
@@ -114,21 +112,19 @@ let nameAllowlist = %re("/^(alpha|dev|pr-.+)$/")
 // unreadable config is a pulumi/backend problem; an absent flag is a missing
 // opt-in. `pulumi config --json` maps each key to `{value, secret}`.
 let readStackConfig = (~projectDir, ~backend, ~stack): result<dict<JSON.t>, string> =>
-  switch (
-    try Some(ReventlessSeedAws.pulumi(~projectDir, ~backend, ["config", "--json", "--stack", stack])) catch {
-    | _ => None
-    }
-  ) {
+  switch try Some(
+    ReventlessSeedAws.pulumi(~projectDir, ~backend, ["config", "--json", "--stack", stack]),
+  ) catch {
+  | _ => None
+  } {
   | None =>
     Error(
       `could not read the Pulumi config for stack "${stack}" — is pulumi logged in to the right backend, and is the stack deployed?`,
     )
   | Some(raw) =>
-    switch (
-      try Some(JSON.parseOrThrow(raw)) catch {
-      | _ => None
-      }
-    ) {
+    switch try Some(JSON.parseOrThrow(raw)) catch {
+    | _ => None
+    } {
     | Some(Object(obj)) => Ok(obj)
     | _ => Error(`could not parse \`pulumi config --json\` output for stack "${stack}".`)
     }
@@ -304,8 +300,7 @@ let parseObjectStores = (json: option<JSON.t>): result<array<objectStore>, strin
           Ok(Array.concat(stores, [{qualified, plugin, store, bucketName, keyPrefix}]))
         | _ =>
           Error(
-            `the platform stack's \`objectStores\` output has a malformed entry for "${qualified}" — ` ++
-            `expected a {plugin}.{store} key carrying bucketName and keyPrefix.`,
+            `the platform stack's \`objectStores\` output has a malformed entry for "${qualified}" — ` ++ `expected a {plugin}.{store} key carrying bucketName and keyPrefix.`,
           )
         }
       }
@@ -329,8 +324,7 @@ let validateStores = (stores: array<objectStore>): result<unit, string> =>
   switch stores->Array.find(s => s.keyPrefix == "" || s.store->String.includes("/")) {
   | Some(s) =>
     Error(
-      `store "${s.qualified}" has an unusable key prefix ("${s.keyPrefix}") — ` ++
-      `a store name may not be empty or contain "/".`,
+      `store "${s.qualified}" has an unusable key prefix ("${s.keyPrefix}") — ` ++ `a store name may not be empty or contain "/".`,
     )
   | None =>
     switch stores->Array.findMap(a =>
@@ -341,8 +335,7 @@ let validateStores = (stores: array<objectStore>): result<unit, string> =>
           Some(
             `stores "${a.qualified}" and "${b.qualified}" both live at ` ++
             `${a.bucketName}/${a.keyPrefix}/ — a prefix-scoped wipe cannot tell their objects ` ++
-            `apart. Rename one store, or qualify the \`@storageRef\` annotation if they were ` ++
-            `meant to be one shared store.`,
+            `apart. Rename one store, or qualify the \`@storageRef\` annotation if they were ` ++ `meant to be one shared store.`,
           )
         } else if b.keyPrefix->String.startsWith(a.keyPrefix ++ "/") {
           Some(
@@ -386,8 +379,8 @@ let countBucket = async (bucket: string, ~prefix: option<string>=?): int => {
     let out = await S3.ListObjectVersionsCommand.send(
       S3.ListObjectVersionsCommand.make({
         bucket,
-        prefix: ?prefix,
-        keyMarker: ?keyMarker,
+        ?prefix,
+        ?keyMarker,
         versionIdMarker: ?versionMarker,
       }),
     )
@@ -415,7 +408,13 @@ let rec sendBatch = async (
 ): unit =>
   if requests->Array.length > 0 {
     if attempt > 8 {
-      throw(Seed.Failed(`table ${table}: ${(requests->Array.length)->Int.toString} item(s) still unprocessed after 8 retries.`))
+      throw(
+        Seed.Failed(
+          `table ${table}: ${requests
+            ->Array.length
+            ->Int.toString} item(s) still unprocessed after 8 retries.`,
+        ),
+      )
     }
     let out = await Ddb.DocumentClient.BatchWriteCommand.send(
       Ddb.DocumentClient.BatchWriteCommand.make({
@@ -456,7 +455,9 @@ let truncateTable = async (table: string): unit => {
       ->Option.getOr([])
       ->Array.map(item => {
         let key =
-          keyAttrs->Array.filterMap(attr => item->field(attr)->Option.map(v => (attr, v)))->Dict.fromArray
+          keyAttrs
+          ->Array.filterMap(attr => item->field(attr)->Option.map(v => (attr, v)))
+          ->Dict.fromArray
         ({deleteRequest: {key: key}}: Ddb.DocumentClient.BatchWriteCommand.writeRequest)
       })
     let batches = chunk(requests, Ddb.DocumentClient.BatchWriteCommand.maxBatchSize)
@@ -481,15 +482,15 @@ let emptyBucket = async (bucket: string, ~prefix: option<string>=?): unit => {
     let out = await S3.ListObjectVersionsCommand.send(
       S3.ListObjectVersionsCommand.make({
         bucket,
-        prefix: ?prefix,
-        keyMarker: ?keyMarker,
+        ?prefix,
+        ?keyMarker,
         versionIdMarker: ?versionMarker,
       }),
     )
     let ids =
-      Array.concat(out.versions->Option.getOr([]), out.deleteMarkers->Option.getOr([]))->Array.map(v => (
-        {key: v.key, versionId: v.versionId}: S3.DeleteObjectsCommand.objectIdentifier
-      ))
+      Array.concat(out.versions->Option.getOr([]), out.deleteMarkers->Option.getOr([]))->Array.map((
+        v
+      ): S3.DeleteObjectsCommand.objectIdentifier => {key: v.key, versionId: v.versionId})
     if ids->Array.length > 0 {
       let res = await S3.DeleteObjectsCommand.send(
         S3.DeleteObjectsCommand.make({
@@ -501,7 +502,7 @@ let emptyBucket = async (bucket: string, ~prefix: option<string>=?): unit => {
       | Some(errs) if errs->Array.length > 0 =>
         throw(
           Seed.Failed(
-            `failed to delete ${(errs->Array.length)->Int.toString} object(s) from ${bucket}: ${errs
+            `failed to delete ${errs->Array.length->Int.toString} object(s) from ${bucket}: ${errs
               ->Array.get(0)
               ->Option.flatMap(e => e.message)
               ->Option.getOr("unknown")}`,
@@ -583,6 +584,7 @@ let chooseScope = async (~targets: array<target>): array<target> => {
     let options = []
     if domain->Array.length > 0 {
       options->Array.push((`domain — ${labelsOf(domain)}`, domain))
+
       // Single-plugin entries only when there is more than one, else they just
       // duplicate the `domain` entry.
       if domain->Array.length > 1 {
@@ -610,7 +612,9 @@ let gateTarget = (~target: target, ~backend, ~stack): string => {
   | Ok(c) => c
   | Error(message) => throw(Seed.Failed(message))
   }
-  switch configValue(cfg, "reventless:wipeable")->Option.map(v => v->String.trim->String.toLowerCase) {
+  switch configValue(cfg, "reventless:wipeable")->Option.map(v =>
+    v->String.trim->String.toLowerCase
+  ) {
   | Some("true") => ()
   | _ =>
     throw(
@@ -666,13 +670,11 @@ let refillMessage = (~refilled: array<(string, int)>, ~heldCount: int): string =
     ->Array.join("")
   let diagnosis = if heldCount > 0 {
     `\n\n  The wipe deleted these and something wrote them back. All ${heldCount->Int.toString} runtime(s) ` ++
-    `in scope were held at zero concurrency for the whole wipe, so the writer was an invocation already ` ++
-    `in flight when the hold took effect. Re-running clears it.`
+    `in scope were held at zero concurrency for the whole wipe, so the writer was an invocation already ` ++ `in flight when the hold took effect. Re-running clears it.`
   } else {
     `\n\n  The wipe deleted these and a running runtime wrote them back. The stack was NOT held ` ++
     `(SEED_RESET_NO_QUIESCE), so nothing stopped it, and re-running will not help: the writer keeps the ` ++
-    `state in memory and restores it on every invocation, identical each time. Re-run without ` ++
-    `SEED_RESET_NO_QUIESCE so the runtimes are held and recycled.`
+    `state in memory and restores it on every invocation, identical each time. Re-run without ` ++ `SEED_RESET_NO_QUIESCE so the runtimes are held and recycled.`
   }
   `${total->Int.toString} item(s)/object(s) came back after the wipe:${lines}${diagnosis}`
 }
@@ -700,6 +702,7 @@ let reportAll = (resolvedList: array<resolved>, ~stack, ~region): int => {
     if r.bucketCounts->Array.length == 0 {
       Console.log("      (none)")
     }
+
     // Declared stores get their own section rather than being folded in with the
     // plain buckets: the unit is a prefix inside a bucket that other plugins also
     // write to, and the operator needs to see which is which before confirming.
@@ -770,8 +773,7 @@ let run = (~stack=?, ~backend=?, ~targets: array<target>, ()): unit => {
         // this resolution exists to fix.
         Console.log("")
         Console.log(
-          "Note: no `platform` target is declared, so declared object stores could not be " ++
-          "resolved — any uploaded objects will be left in place.",
+          "Note: no `platform` target is declared, so declared object stores could not be " ++ "resolved — any uploaded objects will be left in place.",
         )
         []
       | Some(pt) =>
@@ -910,8 +912,7 @@ let run = (~stack=?, ~backend=?, ~targets: array<target>, ()): unit => {
       let interactive = NodeProcess.stdin->NodeProcess.isTTY->Option.getOr(false)
       let confirmed = if interactive {
         let typed = await Seed.Prompt.ask(
-          `About to permanently empty ${total->Int.toString} item(s)/object(s) across the selected scope of "${stack}". ` ++
-          `Type the stack name to confirm, or press Enter to keep this a dry run: `,
+          `About to permanently empty ${total->Int.toString} item(s)/object(s) across the selected scope of "${stack}". ` ++ `Type the stack name to confirm, or press Enter to keep this a dry run: `,
         )
         typed->String.trim == stack
       } else {
@@ -932,9 +933,10 @@ let run = (~stack=?, ~backend=?, ~targets: array<target>, ()): unit => {
       // durable while the runtimes that own the data are running — see
       // ReventlessSeedAws_Quiesce for the mechanism and for why emptying the
       // upstream stores first does not substitute for this.
-      let functionNames = resolvedList->Array.reduce([], (acc, r) =>
-        Array.concat(acc, r.functions->Array.filter(f => !(acc->Array.includes(f))))
-      )
+      let functionNames =
+        resolvedList->Array.reduce([], (acc, r) =>
+          Array.concat(acc, r.functions->Array.filter(f => !(acc->Array.includes(f))))
+        )
       let quiesce = !noQuiesce() && functionNames->Array.length > 0
       let lambdaClient = Lambda.client(~region, ())
       let held = if quiesce {
@@ -946,8 +948,7 @@ let run = (~stack=?, ~backend=?, ~targets: array<target>, ()): unit => {
         if functionNames->Array.length > 0 {
           Console.log("")
           Console.log(
-            "Note: SEED_RESET_NO_QUIESCE is set — the stack's runtimes keep running through the wipe. " ++
-            "A runtime that holds state across invocations can write it straight back over an emptied store.",
+            "Note: SEED_RESET_NO_QUIESCE is set — the stack's runtimes keep running through the wipe. " ++ "A runtime that holds state across invocations can write it straight back over an emptied store.",
           )
         }
         []
@@ -1078,7 +1079,9 @@ let run = (~stack=?, ~backend=?, ~targets: array<target>, ()): unit => {
       }
 
       Console.log("")
-      Console.log(`Reset complete — the selected scope of "${stack}" reads empty and is re-seedable.`)
+      Console.log(
+        `Reset complete — the selected scope of "${stack}" reads empty and is re-seedable.`,
+      )
       NodeProcess.exit(0)
     } catch {
     | Seed.Failed(message) =>
@@ -1090,7 +1093,9 @@ let run = (~stack=?, ~backend=?, ~targets: array<target>, ()): unit => {
       Seed.Prompt.close()
       Console.error("")
       Console.error("Reset aborted with an unexpected error:")
-      Console.error(exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown"))
+      Console.error(
+        exn->JsExn.fromException->Option.flatMap(JsExn.message)->Option.getOr("unknown"),
+      )
       NodeProcess.exit(1)
     }
   }

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@reventlessdev/reventless-seed-aws",
-  "version": "1.0.0-alpha.28",
+  "version": "1.0.0-alpha.29",
   "description": "AWS connect + guarded reset for the Reventless seed harness — stack discovery, Cognito login, and a tag-scoped, allowlisted store wipe",
   "license": "Apache-2.0",
   "dependencies": {
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.16",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.10",
-    "@reventlessdev/reventless-seed": "1.0.0-alpha.20"
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.17",
+    "@reventlessdev/reventless-seed": "1.0.0-alpha.21",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.11"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/ReventlessSeedAws.res

@@ -14,7 +14,6 @@ open ReventlessSeed
 
 // ── Node bindings ─────────────────────────────────────────────────────────────
 
-
 type fetchInit = {method: string, headers: dict<string>, body?: string}
 type response
 @val external fetch: (string, fetchInit) => promise<response> = "fetch"
@@ -77,12 +76,15 @@ let deployedStacks = (~projectDir: string, ~backend: option<string>): array<stri
   }
 
 let stackOutputs = (~projectDir: string, ~backend: option<string>, stack: string): JSON.t => {
-  let raw = try pulumi(~projectDir, ~backend, ["stack", "output", "--stack", stack, "--json"]) catch {
+  let raw = try pulumi(
+    ~projectDir,
+    ~backend,
+    ["stack", "output", "--stack", stack, "--json"],
+  ) catch {
   | _ =>
     throw(
       Seed.Failed(
-        `pulumi stack output --stack ${stack} failed — is pulumi installed, logged in, ` ++
-        "and the stack deployed?",
+        `pulumi stack output --stack ${stack} failed — is pulumi installed, logged in, ` ++ "and the stack deployed?",
       ),
     )
   }
@@ -97,7 +99,11 @@ let backendNote = (~backend: option<string>): string =>
   | None => ""
   }
 
-let resolveStack = async (~projectDir: string, ~backend: option<string>, ~stack: option<string>): string =>
+let resolveStack = async (
+  ~projectDir: string,
+  ~backend: option<string>,
+  ~stack: option<string>,
+): string =>
   switch stack {
   | Some(s) => s
   | None =>
@@ -111,8 +117,7 @@ let resolveStack = async (~projectDir: string, ~backend: option<string>, ~stack:
             `no deployed Pulumi stacks for this project (\`pulumi stack ls\` is empty in ${projectDir})${backendNote(
                 ~backend,
               )}. ` ++
-            "A Pulumi.<stack>.yaml config file alone is not a deployed stack — run `pulumi up` " ++
-            "first, log in to the backend that holds the stack, or set SEED_STACK to target one.",
+            "A Pulumi.<stack>.yaml config file alone is not a deployed stack — run `pulumi up` " ++ "first, log in to the backend that holds the stack, or set SEED_STACK to target one.",
           ),
         )
       }
@@ -123,13 +128,13 @@ let resolveStack = async (~projectDir: string, ~backend: option<string>, ~stack:
 // ── Endpoints ─────────────────────────────────────────────────────────────────
 
 let fetchConfig = async (hostShellUrl: string): JSON.t => {
-  let base = hostShellUrl->String.replaceRegExp(%re("/\/+$/g"), "")
+  let base = hostShellUrl->String.replaceRegExp(/\/+$/g, "")
   let url = `${base}/config.json`
   let res = try await fetch(url, {method: "GET", headers: Dict.make()}) catch {
   | _ => throw(Seed.Failed(`cannot reach ${url}`))
   }
   if !(res->responseOk) {
-    throw(Seed.Failed(`GET ${url} → HTTP ${(res->responseStatus)->Int.toString}`))
+    throw(Seed.Failed(`GET ${url} → HTTP ${res->responseStatus->Int.toString}`))
   }
   await res->responseJson
 }
@@ -232,64 +237,110 @@ let resolveEndpoints = async (
 
 // ── Cognito login ─────────────────────────────────────────────────────────────
 
-let cognito = (~region: string, ~clientId: string) => async (
-  ~username: string,
-  ~password: string,
-): string => {
-  let body = JSON.stringify(
-    JSON.Encode.object(
-      Dict.fromArray([
-        ("AuthFlow", JSON.Encode.string("USER_PASSWORD_AUTH")),
-        ("ClientId", JSON.Encode.string(clientId)),
-        (
-          "AuthParameters",
-          JSON.Encode.object(
-            Dict.fromArray([
-              ("USERNAME", JSON.Encode.string(username)),
-              ("PASSWORD", JSON.Encode.string(password)),
-            ]),
+let cognito = (~region: string, ~clientId: string) =>
+  async (~username: string, ~password: string): string => {
+    let body = JSON.stringify(
+      JSON.Encode.object(
+        Dict.fromArray([
+          ("AuthFlow", JSON.Encode.string("USER_PASSWORD_AUTH")),
+          ("ClientId", JSON.Encode.string(clientId)),
+          (
+            "AuthParameters",
+            JSON.Encode.object(
+              Dict.fromArray([
+                ("USERNAME", JSON.Encode.string(username)),
+                ("PASSWORD", JSON.Encode.string(password)),
+              ]),
+            ),
           ),
-        ),
-      ]),
-    ),
-  )
-  let headers = Dict.fromArray([
-    ("content-type", "application/x-amz-json-1.1"),
-    ("x-amz-target", "AWSCognitoIdentityProviderService.InitiateAuth"),
-  ])
-  let res = try await fetch(`https://cognito-idp.${region}.amazonaws.com/`, {
-    method: "POST",
-    headers,
-    body,
-  }) catch {
-  | _ => throw(Seed.Failed(`cannot reach Cognito in ${region}`))
-  }
-  let json = await res->responseJson
-  if !(res->responseOk) {
-    let detail =
-      json->field("message")->Option.flatMap(asString)->Option.getOr(JSON.stringify(json))
-    throw(
-      Seed.Failed(
-        `Cognito InitiateAuth failed (HTTP ${(res->responseStatus)->Int.toString}): ${detail}`,
+        ]),
       ),
     )
+    let headers = Dict.fromArray([
+      ("content-type", "application/x-amz-json-1.1"),
+      ("x-amz-target", "AWSCognitoIdentityProviderService.InitiateAuth"),
+    ])
+    let res = try await fetch(
+      `https://cognito-idp.${region}.amazonaws.com/`,
+      {
+        method: "POST",
+        headers,
+        body,
+      },
+    ) catch {
+    | _ => throw(Seed.Failed(`cannot reach Cognito in ${region}`))
+    }
+    let json = await res->responseJson
+    if !(res->responseOk) {
+      let detail =
+        json->field("message")->Option.flatMap(asString)->Option.getOr(JSON.stringify(json))
+      throw(
+        Seed.Failed(
+          `Cognito InitiateAuth failed (HTTP ${res->responseStatus->Int.toString}): ${detail}`,
+        ),
+      )
+    }
+    switch json->field("ChallengeName")->Option.flatMap(asString) {
+    | Some(challenge) =>
+      throw(
+        Seed.Failed(
+          `Cognito returned challenge ${challenge} — set a permanent password first ` ++ "(aws cognito-idp admin-set-user-password … --permanent).",
+        ),
+      )
+    | None => ()
+    }
+    switch json
+    ->field("AuthenticationResult")
+    ->Option.flatMap(ar => ar->field("IdToken"))
+    ->Option.flatMap(asString) {
+    | Some(token) => token
+    | None => throw(Seed.Failed(`Cognito response carried no IdToken: ${JSON.stringify(json)}`))
+    }
+  }
+
+// ── Active role ───────────────────────────────────────────────────────────────
+
+/**
+ * The Cognito path's active-role door: `Platform_SetActiveRole` on the domain
+ * API, which is where the seed already sends everything else.
+ *
+ * It sits on the domain base document at `AllowAuthenticated`, deliberately not
+ * behind the Admin gate — the whole point is that a caller can drop into a
+ * narrower role — so a token already narrowed to `Shopper` can still call this
+ * to widen back out. There is no chicken-and-egg, and no `sub` argument: the
+ * mutation addresses the authorizer-verified caller's own row and nobody else's.
+ *
+ * Returns `None` always: the choice is a stored row, read by the pool's
+ * pre-token-generation trigger on the NEXT login, so the current bearer is
+ * unchanged by it and the caller must re-authenticate to see any effect.
+ *
+ * Split-API only. A unified-mode deployment's single API does not carry the
+ * field, so a refusal naming it is reported as "this deployment offers no role
+ * switch" rather than as a seeding failure.
+ */
+let setActiveRole: Seed.Connect.roleSwitch = async (~client, ~role) => {
+  let argument = switch role {
+  | None => "null"
+  | Some(r) => JSON.stringify(JSON.Encode.string(r))
   }
-  switch json->field("ChallengeName")->Option.flatMap(asString) {
-  | Some(challenge) =>
+  try {
+    let _ = await Seed.Client.gql(
+      client,
+      ~query=`mutation { Platform_SetActiveRole(activeRole: ${argument}) { activeRole availableRoles } }`,
+      ~label="Platform_SetActiveRole",
+    )
+    None
+  } catch {
+  | Seed.Failed(message) =>
     throw(
       Seed.Failed(
-        `Cognito returned challenge ${challenge} — set a permanent password first ` ++
-        "(aws cognito-idp admin-set-user-password … --permanent).",
+        message->String.includes("Platform_SetActiveRole")
+          ? `this deployment offers no role switch — \`Platform_SetActiveRole\` is a split-API ` ++
+            `field, and a unified-mode API does not carry it. Change the role in the host shell ` ++
+            `instead.\n  ${message}`
+          : message,
       ),
     )
-  | None => ()
-  }
-  switch json
-  ->field("AuthenticationResult")
-  ->Option.flatMap(ar => ar->field("IdToken"))
-  ->Option.flatMap(asString) {
-  | Some(token) => token
-  | None => throw(Seed.Failed(`Cognito response carried no IdToken: ${JSON.stringify(json)}`))
   }
 }
 
@@ -324,5 +375,6 @@ let connect = (~projectDir: string=".", ~stack=?, ~backend=?, ()): (
       ~label=stackName,
       ~endpoint=eps.graphql,
       ~login=cognito(~region=eps.cognitoRegion, ~clientId=eps.cognitoClientId),
+      ~roleSwitch=setActiveRole,
     )
   }

package/src/ReventlessSeedAws.res.mjs

@@ -4,6 +4,8 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Nodechild_process from "node:child_process";
 import * as Seed$ReventlessSeed from "@reventlessdev/reventless-seed/src/Seed.res.mjs";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Seed_Client$ReventlessSeed from "@reventlessdev/reventless-seed/src/Seed_Client.res.mjs";
 import * as Seed_Prompt$ReventlessSeed from "@reventlessdev/reventless-seed/src/Seed_Prompt.res.mjs";
 import * as Seed_Connect$ReventlessSeed from "@reventlessdev/reventless-seed/src/Seed_Connect.res.mjs";
 
@@ -279,6 +281,25 @@ function cognito(region, clientId) {
   };
 }
 
+async function setActiveRole(client, role) {
+  let argument = role !== undefined ? JSON.stringify(role) : "null";
+  try {
+    await Seed_Client$ReventlessSeed.gql(client, `mutation { Platform_SetActiveRole(activeRole: ` + argument + `) { activeRole availableRoles } }`, "Platform_SetActiveRole");
+    return;
+  } catch (raw_message) {
+    let message = Primitive_exceptions.internalToException(raw_message);
+    if (message.RE_EXN_ID === Seed$ReventlessSeed.Failed) {
+      let message$1 = message._1;
+      throw {
+        RE_EXN_ID: Seed$ReventlessSeed.Failed,
+        _1: message$1.includes("Platform_SetActiveRole") ? `this deployment offers no role switch — \`Platform_SetActiveRole\` is a split-API field, and a unified-mode API does not carry it. Change the role in the host shell instead.\n  ` + message$1 : message$1,
+        Error: new Error()
+      };
+    }
+    throw message;
+  }
+}
+
 function connect($staropt$star, stack, backend, param) {
   return async () => {
     let projectDir = $staropt$star !== undefined ? $staropt$star : ".";
@@ -286,7 +307,7 @@ function connect($staropt$star, stack, backend, param) {
     let backend$1 = url !== undefined ? url : backend;
     let stackName = await resolveStack(projectDir, backend$1, stack);
     let eps = await resolveEndpoints(projectDir, backend$1, stackName);
-    return await Seed_Connect$ReventlessSeed.make(stackName, eps.graphql, cognito(eps.cognitoRegion, eps.cognitoClientId), undefined);
+    return await Seed_Connect$ReventlessSeed.make(stackName, eps.graphql, cognito(eps.cognitoRegion, eps.cognitoClientId), setActiveRole, undefined);
   };
 }
 
@@ -304,6 +325,7 @@ export {
   endpointsFrom,
   resolveEndpoints,
   cognito,
+  setActiveRole,
   connect,
 }
 /* node:child_process Not a pure module */

package/src/ReventlessSeedAws_Quiesce.res

@@ -153,8 +153,9 @@ let restoreConcurrency = async (~client, ~h: held): option<string> =>
   | () => None
   | exception exn =>
     Some(
-      `LEFT SWITCHED OFF: could not restore concurrency on ${h.functionName} (${errorText(exn)}). ` ++
-      `It is still reserved at 0 and will not run until that is undone.`,
+      `LEFT SWITCHED OFF: could not restore concurrency on ${h.functionName} (${errorText(
+          exn,
+        )}). ` ++ `It is still reserved at 0 and will not run until that is undone.`,
     )
   }
 
@@ -181,7 +182,9 @@ let release = async (~client, ~held: array<held>): array<string> => {
     | () => None
     | exception exn =>
       Some(
-        `could not restore the environment of ${h.functionName} (${errorText(exn)}) — it may still ` ++
+        `could not restore the environment of ${h.functionName} (${errorText(
+            exn,
+          )}) — it may still ` ++
         `carry ${markerKey}, which is inert and is removed by the next deploy.`,
       )
     }
@@ -207,8 +210,9 @@ let recycle = async (~client, ~held: array<held>): array<string> => {
     | () => None
     | exception exn =>
       Some(
-        `could not recycle ${h.functionName} (${errorText(exn)}) — a warm container may still hold ` ++
-        `pre-wipe state and write it back. Redeploy or update that function to clear it.`,
+        `could not recycle ${h.functionName} (${errorText(
+            exn,
+          )}) — a warm container may still hold ` ++ `pre-wipe state and write it back. Redeploy or update that function to clear it.`,
       )
     }
   })
@@ -283,12 +287,10 @@ let hold = async (~client, ~functionNames: array<string>): array<held> => {
     let advice = if reason->isThrottle {
       `The Lambda control plane throttled the hold. That budget is per account and region and is ` ++
       `shared with anything else using it — a deploy, an inspector sync, another stack in the same ` ++
-      `region — so this is transient and nothing is wrong with the credentials. Wait for whatever ` ++
-      `else is running to finish and re-run.`
+      `region — so this is transient and nothing is wrong with the credentials. Wait for whatever ` ++ `else is running to finish and re-run.`
     } else {
       `The reset holds every runtime in scope for the length of the wipe, which needs ` ++
-      `lambda:GetFunctionConcurrency, lambda:GetFunctionConfiguration, lambda:PutFunctionConcurrency, ` ++
-      `lambda:DeleteFunctionConcurrency and lambda:UpdateFunctionConfiguration.`
+      `lambda:GetFunctionConcurrency, lambda:GetFunctionConfiguration, lambda:PutFunctionConcurrency, ` ++ `lambda:DeleteFunctionConcurrency and lambda:UpdateFunctionConfiguration.`
     }
     throw(
       ReventlessSeed.Seed.Failed(