@reventlessdev/reventless-seed-aws 1.0.0-alpha.3 → 1.0.0-alpha.30

package/CHANGELOG.md

@@ -3,6 +3,213 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 1.0.0-alpha.30 (2026-09-11)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.29 (2026-09-09)
+
+### Features
+
+* **seed:** choose the role a run acts as, instead of inheriting a stored one ([edf41ca](https://github.com/ReventlessDev/reventless-core/commit/edf41ca80f84bf340679f200ebfeeeb4a590ae03))
+
+
+# 1.0.0-alpha.28 (2026-09-08)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.27 (2026-09-04)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.26 (2026-08-27)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.25 (2026-08-27)
+
+### Bug Fixes
+
+* **seed-aws:** a throttled control plane aborts the reset hold and blames IAM ([95af263](https://github.com/ReventlessDev/reventless-core/commit/95af263afba7dfdfa9a7fc45f494b302dba4baf8))
+
+
+# 1.0.0-alpha.24 (2026-08-23)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.23 (2026-08-20)
+
+### Features
+
+* **seed:** choose the login from the platform's users.yaml ([74e61de](https://github.com/ReventlessDev/reventless-core/commit/74e61de8fba3ee4cc62b368ff12010f162d49db7))
+
+
+# 1.0.0-alpha.22 (2026-08-18)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.21 (2026-08-16)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.20 (2026-08-16)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.19 (2026-08-15)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.18 (2026-08-14)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.17 (2026-08-13)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.16 (2026-08-13)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.15 (2026-08-11)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.14 (2026-08-09)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.13 (2026-08-09)
+
+### Bug Fixes
+
+* **seed-aws:** hold and recycle a stack's runtimes so a reset stays empty ([4baaa38](https://github.com/ReventlessDev/reventless-core/commit/4baaa3827ef30a0adccdef5d2bccc688e7b6686f))
+
+
+# 1.0.0-alpha.12 (2026-08-05)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.11 (2026-08-03)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.10 (2026-08-02)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.9 (2026-08-02)
+
+### Features
+
+* **aws,core,spec,seed-aws:** expire uploads nobody committed a reference to ([f63e84c](https://github.com/ReventlessDev/reventless-core/commit/f63e84c1a11cc350b799a6f69a2e7427cf1ea6e9))
+
+
+# 1.0.0-alpha.8 (2026-08-01)
+
+### Features
+
+* **seed-aws:** wipe a plugin's declared object stores in seed:reset ([2280c5f](https://github.com/ReventlessDev/reventless-core/commit/2280c5f14755d13fff0fe1ac11eb440cd0617f1d))
+
+
+# 1.0.0-alpha.7 (2026-08-01)
+
+### Features
+
+* **upload:** add the release half of the upload contract via the domain API ([448f887](https://github.com/ReventlessDev/reventless-core/commit/448f88714a5875be420f794a08d482fcf4ba8404))
+
+
+# 1.0.0-alpha.6 (2026-07-31)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed-aws
+
+
+
+
+
+# 1.0.0-alpha.5 (2026-07-31)
+
+### Bug Fixes
+
+* **seed:** address a deployment's per-store upload endpoints ([45b226e](https://github.com/ReventlessDev/reventless-core/commit/45b226e00604af9fd28b6fb0b75ba7d3414791f2))
+
+
+# 1.0.0-alpha.4 (2026-07-27)
+
+### Features
+
+* **seed:** guarded AWS store reset (seed:reset) with per-project scope selection ([8446172](https://github.com/ReventlessDev/reventless-core/commit/8446172cbb53776a58f53220d19e96d96ce94508))
+
+
 # 1.0.0-alpha.3 (2026-07-27)
 
 **Note:** Version bump only for package @reventlessdev/reventless-seed-aws

package/lib/bs/.compiler.log

@@ -1,2 +1,2 @@
-#Start(1785139469141)
-#Done(1785139473591)
+#Start(1789087760185)
+#Done(1789087760226)

package/lib/bs/.sourcedirs.json

@@ -0,0 +1 @@
+{"cmt_scan":[{"also_scan_build_root":true,"build_root":"lib/bs","scan_dirs":["src","tests"]}],"dirs":["src","tests"],"generated":[],"pkgs":[["@reventlessdev/rescript-aws-sdk","/home/runner/work/reventless-core/reventless-core/rescript/aws-sdk"],["@reventlessdev/rescript-jest","/home/runner/work/reventless-core/reventless-core/rescript/jest"],["@reventlessdev/rescript-node","/home/runner/work/reventless-core/reventless-core/rescript/node"],["@reventlessdev/reventless-seed","/home/runner/work/reventless-core/reventless-core/reventless/seed"]],"version":2}

package/lib/bs/compiler-info.json

@@ -2,7 +2,7 @@
   "version": "12.3.0",
   "bsc_path": "/home/runner/work/reventless-core/reventless-core/node_modules/@rescript/linux-x64/bin/bsc.exe",
   "bsc_hash": "75e3a59c95cc953608fd3dd6ea6ed68141bba4414a20a52f114261b8a48385fa",
-  "rescript_config_hash": "a0f3879e5fe6709f54eab455ba07fa768dc067bd625516a260ee882dd14e06fe",
+  "rescript_config_hash": "c18a0067c363fd1290f6e7f6fe6212d2e16e201c1702fac667962047f88ed468",
   "runtime_path": "/home/runner/work/reventless-core/reventless-core/node_modules/@rescript/runtime",
-  "generated_at": "1785139473607"
+  "generated_at": "1789087760231"
 }

package/lib/bs/src/ReventlessSeedAws.res

@@ -14,12 +14,6 @@ open ReventlessSeed
 
 // ── Node bindings ─────────────────────────────────────────────────────────────
 
-@val @scope("process") external processEnv: dict<string> = "env"
-
-type execOptions = {cwd: string, encoding: string, env?: dict<string>}
-@module("node:child_process")
-external execFileSync: (string, array<string>, execOptions) => string = "execFileSync"
-
 type fetchInit = {method: string, headers: dict<string>, body?: string}
 type response
 @val external fetch: (string, fetchInit) => promise<response> = "fetch"
@@ -53,13 +47,17 @@ let envForBackend = (backend: option<string>): option<dict<string>> =>
   switch backend {
   | None => None
   | Some(url) =>
-    let copy = processEnv->Dict.toArray->Dict.fromArray
+    let copy = NodeProcess.env->Dict.toArray->Dict.fromArray
     copy->Dict.set("PULUMI_BACKEND_URL", url)
     Some(copy)
   }
 
 let pulumi = (~projectDir: string, ~backend: option<string>, args: array<string>): string =>
-  execFileSync("pulumi", args, {cwd: projectDir, encoding: "utf8", env: ?envForBackend(backend)})
+  NodeChildProcess.execFileSync(
+    "pulumi",
+    args,
+    {cwd: projectDir, encoding: "utf8", env: ?envForBackend(backend)},
+  )
 
 // Stacks that actually exist in the Pulumi backend for this project — the names
 // `pulumi stack output --stack <name>` accepts. A `Pulumi.<stack>.yaml` config
@@ -78,12 +76,15 @@ let deployedStacks = (~projectDir: string, ~backend: option<string>): array<stri
   }
 
 let stackOutputs = (~projectDir: string, ~backend: option<string>, stack: string): JSON.t => {
-  let raw = try pulumi(~projectDir, ~backend, ["stack", "output", "--stack", stack, "--json"]) catch {
+  let raw = try pulumi(
+    ~projectDir,
+    ~backend,
+    ["stack", "output", "--stack", stack, "--json"],
+  ) catch {
   | _ =>
     throw(
       Seed.Failed(
-        `pulumi stack output --stack ${stack} failed — is pulumi installed, logged in, ` ++
-        "and the stack deployed?",
+        `pulumi stack output --stack ${stack} failed — is pulumi installed, logged in, ` ++ "and the stack deployed?",
       ),
     )
   }
@@ -98,7 +99,11 @@ let backendNote = (~backend: option<string>): string =>
   | None => ""
   }
 
-let resolveStack = async (~projectDir: string, ~backend: option<string>, ~stack: option<string>): string =>
+let resolveStack = async (
+  ~projectDir: string,
+  ~backend: option<string>,
+  ~stack: option<string>,
+): string =>
   switch stack {
   | Some(s) => s
   | None =>
@@ -112,8 +117,7 @@ let resolveStack = async (~projectDir: string, ~backend: option<string>, ~stack:
             `no deployed Pulumi stacks for this project (\`pulumi stack ls\` is empty in ${projectDir})${backendNote(
                 ~backend,
               )}. ` ++
-            "A Pulumi.<stack>.yaml config file alone is not a deployed stack — run `pulumi up` " ++
-            "first, log in to the backend that holds the stack, or set SEED_STACK to target one.",
+            "A Pulumi.<stack>.yaml config file alone is not a deployed stack — run `pulumi up` " ++ "first, log in to the backend that holds the stack, or set SEED_STACK to target one.",
           ),
         )
       }
@@ -124,13 +128,13 @@ let resolveStack = async (~projectDir: string, ~backend: option<string>, ~stack:
 // ── Endpoints ─────────────────────────────────────────────────────────────────
 
 let fetchConfig = async (hostShellUrl: string): JSON.t => {
-  let base = hostShellUrl->String.replaceRegExp(%re("/\/+$/g"), "")
+  let base = hostShellUrl->String.replaceRegExp(/\/+$/g, "")
   let url = `${base}/config.json`
   let res = try await fetch(url, {method: "GET", headers: Dict.make()}) catch {
   | _ => throw(Seed.Failed(`cannot reach ${url}`))
   }
   if !(res->responseOk) {
-    throw(Seed.Failed(`GET ${url} → HTTP ${(res->responseStatus)->Int.toString}`))
+    throw(Seed.Failed(`GET ${url} → HTTP ${res->responseStatus->Int.toString}`))
   }
   await res->responseJson
 }
@@ -147,132 +151,196 @@ let resolveField = (~envKey: string, ~fromSource: option<string>, ~human: string
     }
   }
 
-// Returns (graphqlEndpoint, uploadEndpoint, cognitoRegion, cognitoClientId).
-// `uploadEndpoint` is "" when the deployment publishes none — the data set's
-// upload phase no-ops on empty.
-let resolveEndpoints = async (~projectDir: string, ~backend: option<string>, ~stack: string): (
-  string,
-  string,
-  string,
-  string,
-) => {
-  let outputs = stackOutputs(~projectDir, ~backend, stack)
-  switch outputs->field("hostShellUrl")->Option.flatMap(asString) {
-  | Some(hostShellUrl) =>
-    let cfg = await fetchConfig(hostShellUrl)
+// Which document publishes the deployment's endpoints. A stack that serves a
+// host shell publishes them in the shell's `config.json` under the client's key
+// names; one that does not publishes them as stack outputs under Pulumi's. The
+// two arms name different keys for the same values, which is why this is a
+// variant and not a merged lookup.
+type source = HostShellConfig(JSON.t) | StackOutputs(JSON.t)
+
+type endpoints = {
+  graphql: string,
+  cognitoRegion: string,
+  cognitoClientId: string,
+}
+
+/**
+ * The endpoints a source document publishes — pure, so the branch selection and
+ * every key it reads can be exercised with synthetic documents.
+ *
+ * Upload endpoints are no longer resolved here: under route B the seed mints through
+ * the domain API's `Upload_Presign` mutation on `graphql`, passing the store per asset,
+ * so there is no per-store URL to discover.
+ */
+let endpointsFrom = (~stack: string, source: source): endpoints =>
+  switch source {
+  | HostShellConfig(cfg) =>
     let fromCfg = key => cfg->field(key)->Option.flatMap(asString)
-    let endpoint = resolveField(
-      ~envKey="REVENTLESS_GRAPHQL_ENDPOINT",
-      ~fromSource=fromCfg("apiEndpoint"),
-      ~human="apiEndpoint",
-    )
-    let uploadEndpoint = resolveField(
-      ~envKey="REVENTLESS_UPLOAD_ENDPOINT",
-      ~fromSource=fromCfg("uploadEndpoint"),
-      ~human="uploadEndpoint",
-    )
-    let region = resolveField(
-      ~envKey="AWS_REGION",
-      ~fromSource=fromCfg("region"),
-      ~human="region",
-    )
-    let clientId = resolveField(
-      ~envKey="COGNITO_CLIENT_ID",
-      ~fromSource=fromCfg("cognitoClientId"),
-      ~human="cognitoClientId",
-    )
-    (endpoint, uploadEndpoint, region, clientId)
-  | None =>
+    {
+      graphql: resolveField(
+        ~envKey="REVENTLESS_GRAPHQL_ENDPOINT",
+        ~fromSource=fromCfg("apiEndpoint"),
+        ~human="apiEndpoint",
+      ),
+      cognitoRegion: resolveField(
+        ~envKey="AWS_REGION",
+        ~fromSource=fromCfg("region"),
+        ~human="region",
+      ),
+      cognitoClientId: resolveField(
+        ~envKey="COGNITO_CLIENT_ID",
+        ~fromSource=fromCfg("cognitoClientId"),
+        ~human="cognitoClientId",
+      ),
+    }
+  | StackOutputs(outputs) =>
     let out = key => outputs->field(key)->Option.flatMap(asString)
-    let endpoint = switch (
-      Seed.Prompt.envValue("REVENTLESS_GRAPHQL_ENDPOINT"),
-      out("domainMergedApiEndpoint"),
-      out("domainApiEndpoint"),
-    ) {
-    | (Some(v), _, _) | (_, Some(v), _) | (_, _, Some(v)) => v
-    | _ =>
-      throw(
-        Seed.Failed(
-          `stack "${stack}" exports neither domainMergedApiEndpoint nor domainApiEndpoint`,
-        ),
-      )
+    {
+      graphql: switch (
+        Seed.Prompt.envValue("REVENTLESS_GRAPHQL_ENDPOINT"),
+        out("domainMergedApiEndpoint"),
+        out("domainApiEndpoint"),
+      ) {
+      | (Some(v), _, _) | (_, Some(v), _) | (_, _, Some(v)) => v
+      | _ =>
+        throw(
+          Seed.Failed(
+            `stack "${stack}" exports neither domainMergedApiEndpoint nor domainApiEndpoint`,
+          ),
+        )
+      },
+      cognitoRegion: resolveField(
+        ~envKey="AWS_REGION",
+        ~fromSource=out("cognitoRegion"),
+        ~human="cognitoRegion",
+      ),
+      cognitoClientId: resolveField(
+        ~envKey="COGNITO_CLIENT_ID",
+        ~fromSource=out("cognitoUserPoolClientId"),
+        ~human="cognitoUserPoolClientId",
+      ),
     }
-    let region = resolveField(
-      ~envKey="AWS_REGION",
-      ~fromSource=out("cognitoRegion"),
-      ~human="cognitoRegion",
-    )
-    let clientId = resolveField(
-      ~envKey="COGNITO_CLIENT_ID",
-      ~fromSource=out("cognitoUserPoolClientId"),
-      ~human="cognitoUserPoolClientId",
-    )
-    // Absent → "" → the data set skips its upload phase.
-    let uploadEndpoint = Seed.Prompt.envValue("REVENTLESS_UPLOAD_ENDPOINT")->Option.getOr("")
-    (endpoint, uploadEndpoint, region, clientId)
   }
+
+let resolveEndpoints = async (
+  ~projectDir: string,
+  ~backend: option<string>,
+  ~stack: string,
+): endpoints => {
+  let outputs = stackOutputs(~projectDir, ~backend, stack)
+  let source = switch outputs->field("hostShellUrl")->Option.flatMap(asString) {
+  | Some(hostShellUrl) => HostShellConfig(await fetchConfig(hostShellUrl))
+  | None => StackOutputs(outputs)
+  }
+  endpointsFrom(~stack, source)
 }
 
 // ── Cognito login ─────────────────────────────────────────────────────────────
 
-let cognito = (~region: string, ~clientId: string) => async (
-  ~username: string,
-  ~password: string,
-): string => {
-  let body = JSON.stringify(
-    JSON.Encode.object(
-      Dict.fromArray([
-        ("AuthFlow", JSON.Encode.string("USER_PASSWORD_AUTH")),
-        ("ClientId", JSON.Encode.string(clientId)),
-        (
-          "AuthParameters",
-          JSON.Encode.object(
-            Dict.fromArray([
-              ("USERNAME", JSON.Encode.string(username)),
-              ("PASSWORD", JSON.Encode.string(password)),
-            ]),
+let cognito = (~region: string, ~clientId: string) =>
+  async (~username: string, ~password: string): string => {
+    let body = JSON.stringify(
+      JSON.Encode.object(
+        Dict.fromArray([
+          ("AuthFlow", JSON.Encode.string("USER_PASSWORD_AUTH")),
+          ("ClientId", JSON.Encode.string(clientId)),
+          (
+            "AuthParameters",
+            JSON.Encode.object(
+              Dict.fromArray([
+                ("USERNAME", JSON.Encode.string(username)),
+                ("PASSWORD", JSON.Encode.string(password)),
+              ]),
+            ),
           ),
-        ),
-      ]),
-    ),
-  )
-  let headers = Dict.fromArray([
-    ("content-type", "application/x-amz-json-1.1"),
-    ("x-amz-target", "AWSCognitoIdentityProviderService.InitiateAuth"),
-  ])
-  let res = try await fetch(`https://cognito-idp.${region}.amazonaws.com/`, {
-    method: "POST",
-    headers,
-    body,
-  }) catch {
-  | _ => throw(Seed.Failed(`cannot reach Cognito in ${region}`))
-  }
-  let json = await res->responseJson
-  if !(res->responseOk) {
-    let detail =
-      json->field("message")->Option.flatMap(asString)->Option.getOr(JSON.stringify(json))
-    throw(
-      Seed.Failed(
-        `Cognito InitiateAuth failed (HTTP ${(res->responseStatus)->Int.toString}): ${detail}`,
+        ]),
       ),
     )
+    let headers = Dict.fromArray([
+      ("content-type", "application/x-amz-json-1.1"),
+      ("x-amz-target", "AWSCognitoIdentityProviderService.InitiateAuth"),
+    ])
+    let res = try await fetch(
+      `https://cognito-idp.${region}.amazonaws.com/`,
+      {
+        method: "POST",
+        headers,
+        body,
+      },
+    ) catch {
+    | _ => throw(Seed.Failed(`cannot reach Cognito in ${region}`))
+    }
+    let json = await res->responseJson
+    if !(res->responseOk) {
+      let detail =
+        json->field("message")->Option.flatMap(asString)->Option.getOr(JSON.stringify(json))
+      throw(
+        Seed.Failed(
+          `Cognito InitiateAuth failed (HTTP ${res->responseStatus->Int.toString}): ${detail}`,
+        ),
+      )
+    }
+    switch json->field("ChallengeName")->Option.flatMap(asString) {
+    | Some(challenge) =>
+      throw(
+        Seed.Failed(
+          `Cognito returned challenge ${challenge} — set a permanent password first ` ++ "(aws cognito-idp admin-set-user-password … --permanent).",
+        ),
+      )
+    | None => ()
+    }
+    switch json
+    ->field("AuthenticationResult")
+    ->Option.flatMap(ar => ar->field("IdToken"))
+    ->Option.flatMap(asString) {
+    | Some(token) => token
+    | None => throw(Seed.Failed(`Cognito response carried no IdToken: ${JSON.stringify(json)}`))
+    }
+  }
+
+// ── Active role ───────────────────────────────────────────────────────────────
+
+/**
+ * The Cognito path's active-role door: `Platform_SetActiveRole` on the domain
+ * API, which is where the seed already sends everything else.
+ *
+ * It sits on the domain base document at `AllowAuthenticated`, deliberately not
+ * behind the Admin gate — the whole point is that a caller can drop into a
+ * narrower role — so a token already narrowed to `Shopper` can still call this
+ * to widen back out. There is no chicken-and-egg, and no `sub` argument: the
+ * mutation addresses the authorizer-verified caller's own row and nobody else's.
+ *
+ * Returns `None` always: the choice is a stored row, read by the pool's
+ * pre-token-generation trigger on the NEXT login, so the current bearer is
+ * unchanged by it and the caller must re-authenticate to see any effect.
+ *
+ * Split-API only. A unified-mode deployment's single API does not carry the
+ * field, so a refusal naming it is reported as "this deployment offers no role
+ * switch" rather than as a seeding failure.
+ */
+let setActiveRole: Seed.Connect.roleSwitch = async (~client, ~role) => {
+  let argument = switch role {
+  | None => "null"
+  | Some(r) => JSON.stringify(JSON.Encode.string(r))
   }
-  switch json->field("ChallengeName")->Option.flatMap(asString) {
-  | Some(challenge) =>
+  try {
+    let _ = await Seed.Client.gql(
+      client,
+      ~query=`mutation { Platform_SetActiveRole(activeRole: ${argument}) { activeRole availableRoles } }`,
+      ~label="Platform_SetActiveRole",
+    )
+    None
+  } catch {
+  | Seed.Failed(message) =>
     throw(
       Seed.Failed(
-        `Cognito returned challenge ${challenge} — set a permanent password first ` ++
-        "(aws cognito-idp admin-set-user-password … --permanent).",
+        message->String.includes("Platform_SetActiveRole")
+          ? `this deployment offers no role switch — \`Platform_SetActiveRole\` is a split-API ` ++
+            `field, and a unified-mode API does not carry it. Change the role in the host shell ` ++
+            `instead.\n  ${message}`
+          : message,
       ),
     )
-  | None => ()
-  }
-  switch json
-  ->field("AuthenticationResult")
-  ->Option.flatMap(ar => ar->field("IdToken"))
-  ->Option.flatMap(asString) {
-  | Some(token) => token
-  | None => throw(Seed.Failed(`Cognito response carried no IdToken: ${JSON.stringify(json)}`))
   }
 }
 
@@ -302,15 +370,11 @@ let connect = (~projectDir: string=".", ~stack=?, ~backend=?, ()): (
     | None => backend
     }
     let stackName = await resolveStack(~projectDir, ~backend, ~stack)
-    let (endpoint, uploadEndpoint, region, clientId) = await resolveEndpoints(
-      ~projectDir,
-      ~backend,
-      ~stack=stackName,
-    )
+    let eps = await resolveEndpoints(~projectDir, ~backend, ~stack=stackName)
     await Seed.Connect.make(
       ~label=stackName,
-      ~endpoint,
-      ~uploadEndpoint,
-      ~login=cognito(~region, ~clientId),
+      ~endpoint=eps.graphql,
+      ~login=cognito(~region=eps.cognitoRegion, ~clientId=eps.cognitoClientId),
+      ~roleSwitch=setActiveRole,
     )
   }