@reventlessdev/reventless-seed-aws 1.0.0-alpha.3 → 1.0.0-alpha.30

package/package.json

@@ -1,13 +1,16 @@
 {
   "name": "@reventlessdev/reventless-seed-aws",
-  "version": "1.0.0-alpha.3",
-  "description": "AWS connect for the Reventless seed harness — stack discovery and Cognito login, no AWS SDK",
+  "version": "1.0.0-alpha.30",
+  "description": "AWS connect + guarded reset for the Reventless seed harness — stack discovery, Cognito login, and a tag-scoped, allowlisted store wipe",
   "license": "Apache-2.0",
   "dependencies": {
-    "@reventlessdev/reventless-seed": "1.0.0-alpha.3"
+    "@reventlessdev/rescript-node": "2.0.0-alpha.11",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.18",
+    "@reventlessdev/reventless-seed": "1.0.0-alpha.21"
   },
   "devDependencies": {
-    "rescript": "12.3.0"
+    "rescript": "12.3.0",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10"
   },
   "peerDependencies": {
     "rescript": "12.3.0"

package/rescript.json

@@ -11,10 +11,18 @@
     {
       "dir": "src",
       "subdirs": true
+    },
+    {
+      "dir": "tests",
+      "subdirs": true,
+      "type": "dev"
     }
   ],
   "dependencies": [
-    "@reventlessdev/reventless-seed"
+    "@reventlessdev/reventless-seed",
+    "@reventlessdev/rescript-aws-sdk",
+    "@reventlessdev/rescript-node",
+    "@reventlessdev/rescript-jest"
   ],
   "compiler-flags": [],
   "suffix": ".res.mjs"

package/src/ReventlessSeedAws.res

@@ -14,12 +14,6 @@ open ReventlessSeed
 
 // ── Node bindings ─────────────────────────────────────────────────────────────
 
-@val @scope("process") external processEnv: dict<string> = "env"
-
-type execOptions = {cwd: string, encoding: string, env?: dict<string>}
-@module("node:child_process")
-external execFileSync: (string, array<string>, execOptions) => string = "execFileSync"
-
 type fetchInit = {method: string, headers: dict<string>, body?: string}
 type response
 @val external fetch: (string, fetchInit) => promise<response> = "fetch"
@@ -53,13 +47,17 @@ let envForBackend = (backend: option<string>): option<dict<string>> =>
   switch backend {
   | None => None
   | Some(url) =>
-    let copy = processEnv->Dict.toArray->Dict.fromArray
+    let copy = NodeProcess.env->Dict.toArray->Dict.fromArray
     copy->Dict.set("PULUMI_BACKEND_URL", url)
     Some(copy)
   }
 
 let pulumi = (~projectDir: string, ~backend: option<string>, args: array<string>): string =>
-  execFileSync("pulumi", args, {cwd: projectDir, encoding: "utf8", env: ?envForBackend(backend)})
+  NodeChildProcess.execFileSync(
+    "pulumi",
+    args,
+    {cwd: projectDir, encoding: "utf8", env: ?envForBackend(backend)},
+  )
 
 // Stacks that actually exist in the Pulumi backend for this project — the names
 // `pulumi stack output --stack <name>` accepts. A `Pulumi.<stack>.yaml` config
@@ -78,12 +76,15 @@ let deployedStacks = (~projectDir: string, ~backend: option<string>): array<stri
   }
 
 let stackOutputs = (~projectDir: string, ~backend: option<string>, stack: string): JSON.t => {
-  let raw = try pulumi(~projectDir, ~backend, ["stack", "output", "--stack", stack, "--json"]) catch {
+  let raw = try pulumi(
+    ~projectDir,
+    ~backend,
+    ["stack", "output", "--stack", stack, "--json"],
+  ) catch {
   | _ =>
     throw(
       Seed.Failed(
-        `pulumi stack output --stack ${stack} failed — is pulumi installed, logged in, ` ++
-        "and the stack deployed?",
+        `pulumi stack output --stack ${stack} failed — is pulumi installed, logged in, ` ++ "and the stack deployed?",
       ),
     )
   }
@@ -98,7 +99,11 @@ let backendNote = (~backend: option<string>): string =>
   | None => ""
   }
 
-let resolveStack = async (~projectDir: string, ~backend: option<string>, ~stack: option<string>): string =>
+let resolveStack = async (
+  ~projectDir: string,
+  ~backend: option<string>,
+  ~stack: option<string>,
+): string =>
   switch stack {
   | Some(s) => s
   | None =>
@@ -112,8 +117,7 @@ let resolveStack = async (~projectDir: string, ~backend: option<string>, ~stack:
             `no deployed Pulumi stacks for this project (\`pulumi stack ls\` is empty in ${projectDir})${backendNote(
                 ~backend,
               )}. ` ++
-            "A Pulumi.<stack>.yaml config file alone is not a deployed stack — run `pulumi up` " ++
-            "first, log in to the backend that holds the stack, or set SEED_STACK to target one.",
+            "A Pulumi.<stack>.yaml config file alone is not a deployed stack — run `pulumi up` " ++ "first, log in to the backend that holds the stack, or set SEED_STACK to target one.",
           ),
         )
       }
@@ -124,13 +128,13 @@ let resolveStack = async (~projectDir: string, ~backend: option<string>, ~stack:
 // ── Endpoints ─────────────────────────────────────────────────────────────────
 
 let fetchConfig = async (hostShellUrl: string): JSON.t => {
-  let base = hostShellUrl->String.replaceRegExp(%re("/\/+$/g"), "")
+  let base = hostShellUrl->String.replaceRegExp(/\/+$/g, "")
   let url = `${base}/config.json`
   let res = try await fetch(url, {method: "GET", headers: Dict.make()}) catch {
   | _ => throw(Seed.Failed(`cannot reach ${url}`))
   }
   if !(res->responseOk) {
-    throw(Seed.Failed(`GET ${url} → HTTP ${(res->responseStatus)->Int.toString}`))
+    throw(Seed.Failed(`GET ${url} → HTTP ${res->responseStatus->Int.toString}`))
   }
   await res->responseJson
 }
@@ -147,132 +151,196 @@ let resolveField = (~envKey: string, ~fromSource: option<string>, ~human: string
     }
   }
 
-// Returns (graphqlEndpoint, uploadEndpoint, cognitoRegion, cognitoClientId).
-// `uploadEndpoint` is "" when the deployment publishes none — the data set's
-// upload phase no-ops on empty.
-let resolveEndpoints = async (~projectDir: string, ~backend: option<string>, ~stack: string): (
-  string,
-  string,
-  string,
-  string,
-) => {
-  let outputs = stackOutputs(~projectDir, ~backend, stack)
-  switch outputs->field("hostShellUrl")->Option.flatMap(asString) {
-  | Some(hostShellUrl) =>
-    let cfg = await fetchConfig(hostShellUrl)
+// Which document publishes the deployment's endpoints. A stack that serves a
+// host shell publishes them in the shell's `config.json` under the client's key
+// names; one that does not publishes them as stack outputs under Pulumi's. The
+// two arms name different keys for the same values, which is why this is a
+// variant and not a merged lookup.
+type source = HostShellConfig(JSON.t) | StackOutputs(JSON.t)
+
+type endpoints = {
+  graphql: string,
+  cognitoRegion: string,
+  cognitoClientId: string,
+}
+
+/**
+ * The endpoints a source document publishes — pure, so the branch selection and
+ * every key it reads can be exercised with synthetic documents.
+ *
+ * Upload endpoints are no longer resolved here: under route B the seed mints through
+ * the domain API's `Upload_Presign` mutation on `graphql`, passing the store per asset,
+ * so there is no per-store URL to discover.
+ */
+let endpointsFrom = (~stack: string, source: source): endpoints =>
+  switch source {
+  | HostShellConfig(cfg) =>
     let fromCfg = key => cfg->field(key)->Option.flatMap(asString)
-    let endpoint = resolveField(
-      ~envKey="REVENTLESS_GRAPHQL_ENDPOINT",
-      ~fromSource=fromCfg("apiEndpoint"),
-      ~human="apiEndpoint",
-    )
-    let uploadEndpoint = resolveField(
-      ~envKey="REVENTLESS_UPLOAD_ENDPOINT",
-      ~fromSource=fromCfg("uploadEndpoint"),
-      ~human="uploadEndpoint",
-    )
-    let region = resolveField(
-      ~envKey="AWS_REGION",
-      ~fromSource=fromCfg("region"),
-      ~human="region",
-    )
-    let clientId = resolveField(
-      ~envKey="COGNITO_CLIENT_ID",
-      ~fromSource=fromCfg("cognitoClientId"),
-      ~human="cognitoClientId",
-    )
-    (endpoint, uploadEndpoint, region, clientId)
-  | None =>
+    {
+      graphql: resolveField(
+        ~envKey="REVENTLESS_GRAPHQL_ENDPOINT",
+        ~fromSource=fromCfg("apiEndpoint"),
+        ~human="apiEndpoint",
+      ),
+      cognitoRegion: resolveField(
+        ~envKey="AWS_REGION",
+        ~fromSource=fromCfg("region"),
+        ~human="region",
+      ),
+      cognitoClientId: resolveField(
+        ~envKey="COGNITO_CLIENT_ID",
+        ~fromSource=fromCfg("cognitoClientId"),
+        ~human="cognitoClientId",
+      ),
+    }
+  | StackOutputs(outputs) =>
     let out = key => outputs->field(key)->Option.flatMap(asString)
-    let endpoint = switch (
-      Seed.Prompt.envValue("REVENTLESS_GRAPHQL_ENDPOINT"),
-      out("domainMergedApiEndpoint"),
-      out("domainApiEndpoint"),
-    ) {
-    | (Some(v), _, _) | (_, Some(v), _) | (_, _, Some(v)) => v
-    | _ =>
-      throw(
-        Seed.Failed(
-          `stack "${stack}" exports neither domainMergedApiEndpoint nor domainApiEndpoint`,
-        ),
-      )
+    {
+      graphql: switch (
+        Seed.Prompt.envValue("REVENTLESS_GRAPHQL_ENDPOINT"),
+        out("domainMergedApiEndpoint"),
+        out("domainApiEndpoint"),
+      ) {
+      | (Some(v), _, _) | (_, Some(v), _) | (_, _, Some(v)) => v
+      | _ =>
+        throw(
+          Seed.Failed(
+            `stack "${stack}" exports neither domainMergedApiEndpoint nor domainApiEndpoint`,
+          ),
+        )
+      },
+      cognitoRegion: resolveField(
+        ~envKey="AWS_REGION",
+        ~fromSource=out("cognitoRegion"),
+        ~human="cognitoRegion",
+      ),
+      cognitoClientId: resolveField(
+        ~envKey="COGNITO_CLIENT_ID",
+        ~fromSource=out("cognitoUserPoolClientId"),
+        ~human="cognitoUserPoolClientId",
+      ),
     }
-    let region = resolveField(
-      ~envKey="AWS_REGION",
-      ~fromSource=out("cognitoRegion"),
-      ~human="cognitoRegion",
-    )
-    let clientId = resolveField(
-      ~envKey="COGNITO_CLIENT_ID",
-      ~fromSource=out("cognitoUserPoolClientId"),
-      ~human="cognitoUserPoolClientId",
-    )
-    // Absent → "" → the data set skips its upload phase.
-    let uploadEndpoint = Seed.Prompt.envValue("REVENTLESS_UPLOAD_ENDPOINT")->Option.getOr("")
-    (endpoint, uploadEndpoint, region, clientId)
   }
+
+let resolveEndpoints = async (
+  ~projectDir: string,
+  ~backend: option<string>,
+  ~stack: string,
+): endpoints => {
+  let outputs = stackOutputs(~projectDir, ~backend, stack)
+  let source = switch outputs->field("hostShellUrl")->Option.flatMap(asString) {
+  | Some(hostShellUrl) => HostShellConfig(await fetchConfig(hostShellUrl))
+  | None => StackOutputs(outputs)
+  }
+  endpointsFrom(~stack, source)
 }
 
 // ── Cognito login ─────────────────────────────────────────────────────────────
 
-let cognito = (~region: string, ~clientId: string) => async (
-  ~username: string,
-  ~password: string,
-): string => {
-  let body = JSON.stringify(
-    JSON.Encode.object(
-      Dict.fromArray([
-        ("AuthFlow", JSON.Encode.string("USER_PASSWORD_AUTH")),
-        ("ClientId", JSON.Encode.string(clientId)),
-        (
-          "AuthParameters",
-          JSON.Encode.object(
-            Dict.fromArray([
-              ("USERNAME", JSON.Encode.string(username)),
-              ("PASSWORD", JSON.Encode.string(password)),
-            ]),
+let cognito = (~region: string, ~clientId: string) =>
+  async (~username: string, ~password: string): string => {
+    let body = JSON.stringify(
+      JSON.Encode.object(
+        Dict.fromArray([
+          ("AuthFlow", JSON.Encode.string("USER_PASSWORD_AUTH")),
+          ("ClientId", JSON.Encode.string(clientId)),
+          (
+            "AuthParameters",
+            JSON.Encode.object(
+              Dict.fromArray([
+                ("USERNAME", JSON.Encode.string(username)),
+                ("PASSWORD", JSON.Encode.string(password)),
+              ]),
+            ),
           ),
-        ),
-      ]),
-    ),
-  )
-  let headers = Dict.fromArray([
-    ("content-type", "application/x-amz-json-1.1"),
-    ("x-amz-target", "AWSCognitoIdentityProviderService.InitiateAuth"),
-  ])
-  let res = try await fetch(`https://cognito-idp.${region}.amazonaws.com/`, {
-    method: "POST",
-    headers,
-    body,
-  }) catch {
-  | _ => throw(Seed.Failed(`cannot reach Cognito in ${region}`))
-  }
-  let json = await res->responseJson
-  if !(res->responseOk) {
-    let detail =
-      json->field("message")->Option.flatMap(asString)->Option.getOr(JSON.stringify(json))
-    throw(
-      Seed.Failed(
-        `Cognito InitiateAuth failed (HTTP ${(res->responseStatus)->Int.toString}): ${detail}`,
+        ]),
       ),
     )
+    let headers = Dict.fromArray([
+      ("content-type", "application/x-amz-json-1.1"),
+      ("x-amz-target", "AWSCognitoIdentityProviderService.InitiateAuth"),
+    ])
+    let res = try await fetch(
+      `https://cognito-idp.${region}.amazonaws.com/`,
+      {
+        method: "POST",
+        headers,
+        body,
+      },
+    ) catch {
+    | _ => throw(Seed.Failed(`cannot reach Cognito in ${region}`))
+    }
+    let json = await res->responseJson
+    if !(res->responseOk) {
+      let detail =
+        json->field("message")->Option.flatMap(asString)->Option.getOr(JSON.stringify(json))
+      throw(
+        Seed.Failed(
+          `Cognito InitiateAuth failed (HTTP ${res->responseStatus->Int.toString}): ${detail}`,
+        ),
+      )
+    }
+    switch json->field("ChallengeName")->Option.flatMap(asString) {
+    | Some(challenge) =>
+      throw(
+        Seed.Failed(
+          `Cognito returned challenge ${challenge} — set a permanent password first ` ++ "(aws cognito-idp admin-set-user-password … --permanent).",
+        ),
+      )
+    | None => ()
+    }
+    switch json
+    ->field("AuthenticationResult")
+    ->Option.flatMap(ar => ar->field("IdToken"))
+    ->Option.flatMap(asString) {
+    | Some(token) => token
+    | None => throw(Seed.Failed(`Cognito response carried no IdToken: ${JSON.stringify(json)}`))
+    }
+  }
+
+// ── Active role ───────────────────────────────────────────────────────────────
+
+/**
+ * The Cognito path's active-role door: `Platform_SetActiveRole` on the domain
+ * API, which is where the seed already sends everything else.
+ *
+ * It sits on the domain base document at `AllowAuthenticated`, deliberately not
+ * behind the Admin gate — the whole point is that a caller can drop into a
+ * narrower role — so a token already narrowed to `Shopper` can still call this
+ * to widen back out. There is no chicken-and-egg, and no `sub` argument: the
+ * mutation addresses the authorizer-verified caller's own row and nobody else's.
+ *
+ * Returns `None` always: the choice is a stored row, read by the pool's
+ * pre-token-generation trigger on the NEXT login, so the current bearer is
+ * unchanged by it and the caller must re-authenticate to see any effect.
+ *
+ * Split-API only. A unified-mode deployment's single API does not carry the
+ * field, so a refusal naming it is reported as "this deployment offers no role
+ * switch" rather than as a seeding failure.
+ */
+let setActiveRole: Seed.Connect.roleSwitch = async (~client, ~role) => {
+  let argument = switch role {
+  | None => "null"
+  | Some(r) => JSON.stringify(JSON.Encode.string(r))
   }
-  switch json->field("ChallengeName")->Option.flatMap(asString) {
-  | Some(challenge) =>
+  try {
+    let _ = await Seed.Client.gql(
+      client,
+      ~query=`mutation { Platform_SetActiveRole(activeRole: ${argument}) { activeRole availableRoles } }`,
+      ~label="Platform_SetActiveRole",
+    )
+    None
+  } catch {
+  | Seed.Failed(message) =>
     throw(
       Seed.Failed(
-        `Cognito returned challenge ${challenge} — set a permanent password first ` ++
-        "(aws cognito-idp admin-set-user-password … --permanent).",
+        message->String.includes("Platform_SetActiveRole")
+          ? `this deployment offers no role switch — \`Platform_SetActiveRole\` is a split-API ` ++
+            `field, and a unified-mode API does not carry it. Change the role in the host shell ` ++
+            `instead.\n  ${message}`
+          : message,
       ),
     )
-  | None => ()
-  }
-  switch json
-  ->field("AuthenticationResult")
-  ->Option.flatMap(ar => ar->field("IdToken"))
-  ->Option.flatMap(asString) {
-  | Some(token) => token
-  | None => throw(Seed.Failed(`Cognito response carried no IdToken: ${JSON.stringify(json)}`))
   }
 }
 
@@ -302,15 +370,11 @@ let connect = (~projectDir: string=".", ~stack=?, ~backend=?, ()): (
     | None => backend
     }
     let stackName = await resolveStack(~projectDir, ~backend, ~stack)
-    let (endpoint, uploadEndpoint, region, clientId) = await resolveEndpoints(
-      ~projectDir,
-      ~backend,
-      ~stack=stackName,
-    )
+    let eps = await resolveEndpoints(~projectDir, ~backend, ~stack=stackName)
     await Seed.Connect.make(
       ~label=stackName,
-      ~endpoint,
-      ~uploadEndpoint,
-      ~login=cognito(~region, ~clientId),
+      ~endpoint=eps.graphql,
+      ~login=cognito(~region=eps.cognitoRegion, ~clientId=eps.cognitoClientId),
+      ~roleSwitch=setActiveRole,
     )
   }

package/src/ReventlessSeedAws.res.mjs

@@ -4,6 +4,8 @@ import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Nodechild_process from "node:child_process";
 import * as Seed$ReventlessSeed from "@reventlessdev/reventless-seed/src/Seed.res.mjs";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Seed_Client$ReventlessSeed from "@reventlessdev/reventless-seed/src/Seed_Client.res.mjs";
 import * as Seed_Prompt$ReventlessSeed from "@reventlessdev/reventless-seed/src/Seed_Prompt.res.mjs";
 import * as Seed_Connect$ReventlessSeed from "@reventlessdev/reventless-seed/src/Seed_Connect.res.mjs";
 
@@ -108,7 +110,7 @@ async function resolveStack(projectDir, backend, stack) {
   return await Seed_Prompt$ReventlessSeed.select("Stack:", stacks.map(s => [
     s,
     s
-  ]), undefined);
+  ]), undefined, undefined);
 }
 
 async function fetchConfig(hostShellUrl) {
@@ -152,34 +154,28 @@ function resolveField(envKey, fromSource, human) {
   };
 }
 
-async function resolveEndpoints(projectDir, backend, stack) {
-  let outputs = stackOutputs(projectDir, backend, stack);
-  let hostShellUrl = Stdlib_Option.flatMap(field(outputs, "hostShellUrl"), asString);
-  if (hostShellUrl !== undefined) {
-    let cfg = await fetchConfig(hostShellUrl);
+function endpointsFrom(stack, source) {
+  if (source.TAG === "HostShellConfig") {
+    let cfg = source._0;
     let fromCfg = key => Stdlib_Option.flatMap(field(cfg, key), asString);
-    let endpoint = resolveField("REVENTLESS_GRAPHQL_ENDPOINT", fromCfg("apiEndpoint"), "apiEndpoint");
-    let uploadEndpoint = resolveField("REVENTLESS_UPLOAD_ENDPOINT", fromCfg("uploadEndpoint"), "uploadEndpoint");
-    let region = resolveField("AWS_REGION", fromCfg("region"), "region");
-    let clientId = resolveField("COGNITO_CLIENT_ID", fromCfg("cognitoClientId"), "cognitoClientId");
-    return [
-      endpoint,
-      uploadEndpoint,
-      region,
-      clientId
-    ];
+    return {
+      graphql: resolveField("REVENTLESS_GRAPHQL_ENDPOINT", fromCfg("apiEndpoint"), "apiEndpoint"),
+      cognitoRegion: resolveField("AWS_REGION", fromCfg("region"), "region"),
+      cognitoClientId: resolveField("COGNITO_CLIENT_ID", fromCfg("cognitoClientId"), "cognitoClientId")
+    };
   }
+  let outputs = source._0;
   let out = key => Stdlib_Option.flatMap(field(outputs, key), asString);
   let match = Seed_Prompt$ReventlessSeed.envValue("REVENTLESS_GRAPHQL_ENDPOINT");
   let match$1 = out("domainMergedApiEndpoint");
   let match$2 = out("domainApiEndpoint");
-  let endpoint$1;
+  let tmp;
   if (match !== undefined) {
-    endpoint$1 = match;
+    tmp = match;
   } else if (match$1 !== undefined) {
-    endpoint$1 = match$1;
+    tmp = match$1;
   } else if (match$2 !== undefined) {
-    endpoint$1 = match$2;
+    tmp = match$2;
   } else {
     throw {
       RE_EXN_ID: Seed$ReventlessSeed.Failed,
@@ -187,15 +183,24 @@ async function resolveEndpoints(projectDir, backend, stack) {
       Error: new Error()
     };
   }
-  let region$1 = resolveField("AWS_REGION", out("cognitoRegion"), "cognitoRegion");
-  let clientId$1 = resolveField("COGNITO_CLIENT_ID", out("cognitoUserPoolClientId"), "cognitoUserPoolClientId");
-  let uploadEndpoint$1 = Stdlib_Option.getOr(Seed_Prompt$ReventlessSeed.envValue("REVENTLESS_UPLOAD_ENDPOINT"), "");
-  return [
-    endpoint$1,
-    uploadEndpoint$1,
-    region$1,
-    clientId$1
-  ];
+  return {
+    graphql: tmp,
+    cognitoRegion: resolveField("AWS_REGION", out("cognitoRegion"), "cognitoRegion"),
+    cognitoClientId: resolveField("COGNITO_CLIENT_ID", out("cognitoUserPoolClientId"), "cognitoUserPoolClientId")
+  };
+}
+
+async function resolveEndpoints(projectDir, backend, stack) {
+  let outputs = stackOutputs(projectDir, backend, stack);
+  let hostShellUrl = Stdlib_Option.flatMap(field(outputs, "hostShellUrl"), asString);
+  let source = hostShellUrl !== undefined ? ({
+      TAG: "HostShellConfig",
+      _0: await fetchConfig(hostShellUrl)
+    }) : ({
+      TAG: "StackOutputs",
+      _0: outputs
+    });
+  return endpointsFrom(stack, source);
 }
 
 function cognito(region, clientId) {
@@ -276,14 +281,33 @@ function cognito(region, clientId) {
   };
 }
 
+async function setActiveRole(client, role) {
+  let argument = role !== undefined ? JSON.stringify(role) : "null";
+  try {
+    await Seed_Client$ReventlessSeed.gql(client, `mutation { Platform_SetActiveRole(activeRole: ` + argument + `) { activeRole availableRoles } }`, "Platform_SetActiveRole");
+    return;
+  } catch (raw_message) {
+    let message = Primitive_exceptions.internalToException(raw_message);
+    if (message.RE_EXN_ID === Seed$ReventlessSeed.Failed) {
+      let message$1 = message._1;
+      throw {
+        RE_EXN_ID: Seed$ReventlessSeed.Failed,
+        _1: message$1.includes("Platform_SetActiveRole") ? `this deployment offers no role switch — \`Platform_SetActiveRole\` is a split-API field, and a unified-mode API does not carry it. Change the role in the host shell instead.\n  ` + message$1 : message$1,
+        Error: new Error()
+      };
+    }
+    throw message;
+  }
+}
+
 function connect($staropt$star, stack, backend, param) {
   return async () => {
     let projectDir = $staropt$star !== undefined ? $staropt$star : ".";
     let url = Seed_Prompt$ReventlessSeed.envValue("SEED_PULUMI_BACKEND");
     let backend$1 = url !== undefined ? url : backend;
     let stackName = await resolveStack(projectDir, backend$1, stack);
-    let match = await resolveEndpoints(projectDir, backend$1, stackName);
-    return await Seed_Connect$ReventlessSeed.make(stackName, match[0], match[1], cognito(match[2], match[3]), undefined);
+    let eps = await resolveEndpoints(projectDir, backend$1, stackName);
+    return await Seed_Connect$ReventlessSeed.make(stackName, eps.graphql, cognito(eps.cognitoRegion, eps.cognitoClientId), setActiveRole, undefined);
   };
 }
 
@@ -298,8 +322,10 @@ export {
   resolveStack,
   fetchConfig,
   resolveField,
+  endpointsFrom,
   resolveEndpoints,
   cognito,
+  setActiveRole,
   connect,
 }
 /* node:child_process Not a pure module */