@reventlessdev/reventless-seed 1.0.0-alpha.2 → 1.0.0-alpha.20

package/CHANGELOG.md

@@ -3,6 +3,143 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 1.0.0-alpha.20 (2026-09-08)
+
+### Features
+
+* **seed:** a run says which identity its token carries, not which one it asked for ([063da61](https://github.com/ReventlessDev/reventless-core/commit/063da6110a2d89333bd3d99f4c7cb1bc579d78f0))
+
+
+# 1.0.0-alpha.19 (2026-09-04)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed
+
+
+
+
+
+# 1.0.0-alpha.18 (2026-08-27)
+
+### Bug Fixes
+
+* **seed:** one endpoint-side fault throws away every command that landed ([6126dca](https://github.com/ReventlessDev/reventless-core/commit/6126dca7c62d193cf3a4efe379160af8207faa86))
+
+
+# 1.0.0-alpha.17 (2026-08-20)
+
+### Features
+
+* **seed:** choose the login from the platform's users.yaml ([74e61de](https://github.com/ReventlessDev/reventless-core/commit/74e61de8fba3ee4cc62b368ff12010f162d49db7))
+
+
+# 1.0.0-alpha.16 (2026-08-18)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed
+
+
+
+
+
+# 1.0.0-alpha.15 (2026-08-16)
+
+### Bug Fixes
+
+* **seed:** let seed:reset take the yes it asks for ([1f646f6](https://github.com/ReventlessDev/reventless-core/commit/1f646f6ce13a4238e92b7047ee31650ccc4de4f3))
+* **seed:** report the retirements the projection has actually applied ([91bc877](https://github.com/ReventlessDev/reventless-core/commit/91bc877d90fc69dab76ff0fb9aae9ea989107aed))
+
+
+# 1.0.0-alpha.14 (2026-08-15)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed
+
+
+
+
+
+# 1.0.0-alpha.13 (2026-08-14)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed
+
+
+
+
+
+# 1.0.0-alpha.12 (2026-08-13)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed
+
+
+
+
+
+# 1.0.0-alpha.11 (2026-08-11)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed
+
+
+
+
+
+# 1.0.0-alpha.10 (2026-08-09)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed
+
+
+
+
+
+# 1.0.0-alpha.9 (2026-08-05)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed
+
+
+
+
+
+# 1.0.0-alpha.8 (2026-08-02)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed
+
+
+
+
+
+# 1.0.0-alpha.7 (2026-08-01)
+
+### Features
+
+* **upload:** add the release half of the upload contract via the domain API ([448f887](https://github.com/ReventlessDev/reventless-core/commit/448f88714a5875be420f794a08d482fcf4ba8404))
+
+
+# 1.0.0-alpha.6 (2026-07-31)
+
+**Note:** Version bump only for package @reventlessdev/reventless-seed
+
+
+
+
+
+# 1.0.0-alpha.5 (2026-07-31)
+
+### Bug Fixes
+
+* **seed:** address a deployment's per-store upload endpoints ([45b226e](https://github.com/ReventlessDev/reventless-core/commit/45b226e00604af9fd28b6fb0b75ba7d3414791f2))
+
+
+# 1.0.0-alpha.4 (2026-07-27)
+
+### Features
+
+* **seed:** guarded AWS store reset (seed:reset) with per-project scope selection ([8446172](https://github.com/ReventlessDev/reventless-core/commit/8446172cbb53776a58f53220d19e96d96ce94508))
+
+
+# 1.0.0-alpha.3 (2026-07-27)
+
+### Features
+
+* **seed:** refuse to seed onto a non-empty store (fresh-store guard) ([987613f](https://github.com/ReventlessDev/reventless-core/commit/987613f0767fc4391297dfeed3a6b19cd76d8157))
+
+
 # 1.0.0-alpha.2 (2026-07-26)
 
 ### Features

package/lib/bs/.compiler.log

@@ -1,2 +1,2 @@
-#Start(1785092483117)
-#Done(1785092488019)
+#Start(1788869322834)
+#Done(1788869322875)

package/lib/bs/.sourcedirs.json

@@ -0,0 +1 @@
+{"cmt_scan":[{"also_scan_build_root":true,"build_root":"lib/bs","scan_dirs":["src","tests"]}],"dirs":["src","tests"],"generated":[],"pkgs":[["@reventlessdev/rescript-jest","/home/runner/work/reventless-core/reventless-core/rescript/jest"],["@reventlessdev/rescript-node","/home/runner/work/reventless-core/reventless-core/rescript/node"]],"version":2}

package/lib/bs/ReventlessSeed.mlmap

@@ -1,9 +1,14 @@
 randjbuildsystem
 Seed
 Seed_Client
+Seed_ClientTest
 Seed_Connect
 Seed_Prompt
+Seed_PromptTest
 Seed_Random
+Seed_RandomTest
 Seed_Runner
 Seed_Types
 Seed_Upload
+Seed_Users
+Seed_UsersTest

package/lib/bs/compiler-info.json

@@ -2,7 +2,7 @@
   "version": "12.3.0",
   "bsc_path": "/home/runner/work/reventless-core/reventless-core/node_modules/@rescript/linux-x64/bin/bsc.exe",
   "bsc_hash": "75e3a59c95cc953608fd3dd6ea6ed68141bba4414a20a52f114261b8a48385fa",
-  "rescript_config_hash": "ad3a9d479584c1d6e4fe10cd993d9e290f74732e9b0cb3dd5d7429e88b4bba38",
+  "rescript_config_hash": "25cfff836d200084949fdfdfec2f6875901bfee1f04d84634eca252ef1ca1ef1",
   "runtime_path": "/home/runner/work/reventless-core/reventless-core/node_modules/@rescript/runtime",
-  "generated_at": "1785092488035"
+  "generated_at": "1788869322878"
 }

package/lib/bs/src/Seed.res

@@ -10,15 +10,17 @@ module Client = Seed_Client
 module Runner = Seed_Runner
 module Upload = Seed_Upload
 module Prompt = Seed_Prompt
+module Users = Seed_Users
 module Connect = Seed_Connect
 
 exception Failed = Seed_Types.Failed
 
-// A live target a data set seeds against: an authenticated client, the upload
-// endpoint (empty when the deployment serves no uploads), and a label.
+// A live target a data set seeds against: an authenticated client, whether uploads
+// are skipped this run, and a label. Uploads mint through the domain API's
+// `Upload_Presign` mutation on the client (route B), so no upload endpoint is carried.
 type connection = Seed_Connect.connection = {
   client: Seed_Client.t,
-  uploadEndpoint: string,
+  uploadsSkipped: bool,
   label: string,
 }
 
@@ -27,6 +29,7 @@ type dataSet = Seed_Runner.dataSet = {
   name: string,
   label: string,
   seed: connection => promise<unit>,
+  probeViews?: array<string>,
 }
 
 type rec value = Seed_Types.value =

package/lib/bs/src/Seed.res.mjs

@@ -12,6 +12,8 @@ let Upload;
 
 let Prompt;
 
+let Users;
+
 let Connect;
 
 let Failed = Seed_Types$ReventlessSeed.Failed;
@@ -30,6 +32,7 @@ export {
   Runner,
   Upload,
   Prompt,
+  Users,
   Connect,
   Failed,
   mutation,

package/lib/bs/src/Seed_Client.res

@@ -43,11 +43,96 @@ let make = (~config: config): t => {config, token: None}
     Seed.Upload) can authenticate side-channel requests with the same identity. */
 let currentToken = (t: t): option<string> => t.token
 
+/** The GraphQL endpoint this client targets — so `Seed.Upload` can resolve a
+    relative presigned `uploadUrl` against the same origin. */
+let endpoint = (t: t): string => t.config.endpoint
+
 /** Injects a bearer obtained out-of-band (e.g. a Cognito id token), instead of
     minting one via `login`. Provider-agnostic: the harness only cares that the
     token is a valid bearer for `endpoint`. */
 let useToken = (t: t, token: string): unit => t.token = Some(token)
 
+// ── What the bearer actually grants ─────────────────────────────────────────
+//
+// An account's listed groups are not necessarily the ones its token carries:
+// both platforms narrow a token to the single role the caller last chose to act
+// as. So a seed can log in as an account that looks eligible and be refused, and
+// the account list cannot explain it — only the token can.
+
+/** Claim names a narrowed token carries. These mirror the cross-provider
+    contract in `ReventlessCore.Auth_ActiveRole`; spelled out rather than
+    imported because this harness deliberately depends on no framework package. */
+let activeRoleClaim = "activeRole"
+let availableRolesClaim = "availableRoles"
+
+/** Group claim per provider, tried in order. */
+let groupClaimNames = ["cognito:groups", "groups"]
+
+let decodeSegment = (segment: string): option<dict<JSON.t>> =>
+  try {
+    segment
+    ->NodeBuffer.fromStringBase64Url
+    ->NodeBuffer.toStringUtf8
+    ->JSON.parseOrThrow
+    ->JSON.Decode.object
+  } catch {
+  | _ => None
+  }
+
+/** The bearer's payload, from whichever segment carries it — a Cognito JWT puts
+    it second and a local dev token first, so trying each in turn saves this from
+    having to know which platform signed the token. A segment that is not a JSON
+    object (a signature) simply does not decode. */
+let claims = (t: t): option<dict<JSON.t>> =>
+  t.token->Option.flatMap(token =>
+    token
+    ->String.split(".")
+    ->Array.reduce(None, (found, segment) =>
+      switch found {
+      | Some(_) => found
+      | None => decodeSegment(segment)
+      }
+    )
+  )
+
+// Arrays on the group claim, comma-joined on `availableRoles`.
+let asStrings = (value: JSON.t): option<array<string>> =>
+  switch value {
+  | Array(entries) => Some(entries->Array.filterMap(JSON.Decode.string))
+  | String(joined) =>
+    Some(joined->String.split(",")->Array.map(String.trim)->Array.filter(s => s != ""))
+  | _ => None
+  }
+
+let claimStrings = (t: t, name: string): option<array<string>> =>
+  t->claims->Option.flatMap(c => c->Dict.get(name))->Option.flatMap(asStrings)
+
+/** The groups the bearer actually presents — what every enforcement point reads.
+    `None` when the token is opaque to us, which is not an error: it just means
+    this cannot add anything. */
+let effectiveGroups = (t: t): option<array<string>> =>
+  groupClaimNames->Array.reduce(None, (found, name) =>
+    switch found {
+    | Some(_) => found
+    | None => t->claimStrings(name)
+    }
+  )
+
+/** One line naming the identity the bearer carries, and — when it was narrowed —
+    the membership it was narrowed from. The second half is the point: without it
+    a refusal looks like a misconfigured grant rather than a role switch. */
+let identitySummary = (t: t): option<string> =>
+  t
+  ->effectiveGroups
+  ->Option.map(groups => {
+    let held = groups->Array.length == 0 ? "no groups" : groups->Array.join(", ")
+    switch t->claimStrings(availableRolesClaim) {
+    | Some(available) if available->Array.length > 0 =>
+      `${held} — narrowed to this role from ${available->Array.join(", ")}`
+    | _ => held
+    }
+  })
+
 // ── JSON helpers ────────────────────────────────────────────────────────────
 
 let field = (json: JSON.t, key: string): option<JSON.t> =>
@@ -102,10 +187,72 @@ let login = async (t: t): unit => {
   t.token = json->field("token")->Option.flatMap(asString)
 }
 
+/** Error types the endpoint returns for a fault on its own side rather than a
+    problem with the document. They say nothing about the request, so the same
+    request sent again can succeed — and across the few hundred commands a seed
+    issues, one of these is ordinary rather than exceptional.
+
+    Everything else — a validation error, an unknown field, a refused token — is
+    an answer, and the same answer comes back however many times it is asked. */
+let transientErrorTypes = [
+  "InternalFailure",
+  "ServiceUnavailable",
+  "ServiceUnavailableError",
+  "Throttling",
+  "ThrottlingException",
+  "TooManyRequestsException",
+  "RequestTimeout",
+]
+
+/** Every entry must be transient for the document to be worth resending: one
+    real error alongside a transient one still means the request was wrong. An
+    empty `errors` array is not a reason to retry either. */
+let isTransient = (errors: JSON.t): bool =>
+  switch errors->JSON.Decode.array {
+  | None | Some([]) => false
+  | Some(entries) =>
+    entries->Array.every(e =>
+      switch e->nodeString("errorType") {
+      | Some(errorType) => transientErrorTypes->Array.includes(errorType)
+      | None => false
+      }
+    )
+  }
+
+/** An authorization refusal, in either platform's vocabulary — AppSync answers
+    `errorType: "Unauthorized"`, the local server carries it in the message. */
+let isDenied = (errors: JSON.t): bool =>
+  switch errors->JSON.Decode.array {
+  | None => false
+  | Some(entries) =>
+    entries->Array.some(e =>
+      switch (e->nodeString("errorType"), e->nodeString("message")) {
+      | (Some(errorType), _) if errorType->String.includes("Unauthorized") => true
+      | (_, Some(message)) => message->String.includes("Not Authorized")
+      | _ => false
+      }
+    )
+  }
+
+let attempts = 4
+
 /**
  * Sends one GraphQL document and returns its `data`. A GraphQL-level error
  * aborts the run: a half-seeded store is worse than an empty one, because it
  * looks like a working dataset.
+ *
+ * Which is exactly why a fault on the endpoint's own side must not abort it. A
+ * seed issues hundreds of commands, many of them concurrently and all of them
+ * against runtimes that a preceding reset left cold, so a single
+ * `InternalFailure` somewhere in the batch is a normal event. Treating it as
+ * fatal threw away every command that had already landed and demanded a full
+ * wipe and re-run — for a request that would have succeeded on being asked
+ * again. So resend those, backing off between tries, and keep failing fast on
+ * everything that is an answer rather than a fault.
+ *
+ * The backoff is jittered because the commands go out in concurrent batches: a
+ * fixed delay would have the whole batch retry in lockstep and rebuild the same
+ * burst that provoked the fault.
  */
 let gql = async (t: t, ~query: string, ~label: string): JSON.t => {
   let headers = Dict.fromArray([("content-type", "application/json")])
@@ -116,18 +263,38 @@ let gql = async (t: t, ~query: string, ~label: string): JSON.t => {
   let body = JSON.stringify(
     JSON.Encode.object(Dict.fromArray([("query", JSON.Encode.string(query))])),
   )
-  let res = try await fetch(t.config.endpoint, {method: "POST", headers, body}) catch {
-  | _ =>
-    throw(Failed(`${label}: cannot reach ${t.config.endpoint} — is the platform running?`))
-  }
-  let json = await res->responseJson
-  switch json->field("errors") {
-  | Some(errors) =>
-    throw(
-      Failed(`${label} failed\n  query: ${query}\n  response: ${JSON.stringify(errors)}`),
-    )
-  | None => json->field("data")->Option.getOr(JSON.Encode.null)
+  let rec attempt = async (n: int): JSON.t => {
+    let res = try await fetch(t.config.endpoint, {method: "POST", headers, body}) catch {
+    | _ =>
+      throw(Failed(`${label}: cannot reach ${t.config.endpoint} — is the platform running?`))
+    }
+    let json = await res->responseJson
+    switch json->field("errors") {
+    | Some(errors) =>
+      if errors->isTransient && n < attempts {
+        await sleep(250 * Int.shiftLeft(1, n - 1) + Int.fromFloat(Math.random() *. 250.))
+        await attempt(n + 1)
+      } else {
+        let tried = n > 1 ? `\n  gave up after ${n->Int.toString} attempts` : ""
+        // A refusal is the one failure the response cannot explain on its own:
+        // it names the field, never the caller. The account list can't either —
+        // it holds membership, and a narrowed token carries less.
+        let identity = switch isDenied(errors) ? t->identitySummary : None {
+        | Some(summary) => `\n  identity: ${summary}`
+        | None => ""
+        }
+        throw(
+          Failed(
+            `${label} failed\n  query: ${query}\n  response: ${JSON.stringify(
+                errors,
+              )}${identity}${tried}`,
+          ),
+        )
+      }
+    | None => json->field("data")->Option.getOr(JSON.Encode.null)
+    }
   }
+  await attempt(1)
 }
 
 // ── Commands ────────────────────────────────────────────────────────────────
@@ -175,18 +342,27 @@ let sendAll = async (t: t, mutations: array<mutation>): unit =>
  * Walks a Relay-style connection to the end. Connections page at 50 by default,
  * so any count taken from a single request silently truncates.
  */
-let queryAllNodes = async (t: t, ~field as fieldName: string, ~selection: string): array<
-  JSON.t,
-> => {
+// `~args` is spliced into the connection's argument list — `"includeRetired: true"`
+// is the case it exists for, and the only way to read rows the resolvers withhold
+// by default. Literal GraphQL rather than a typed argument list because a seed
+// writes the query it means; the alternative is a builder that has to grow a case
+// per argument the platform adds.
+let queryAllNodes = async (
+  t: t,
+  ~field as fieldName: string,
+  ~selection: string,
+  ~args: string="",
+): array<JSON.t> => {
   let nodes = []
   let after = ref(None)
   let more = ref(true)
+  let extra = args == "" ? "" : `, ${args}`
   while more.contents {
     let cursor = switch after.contents {
     | Some(c) => `, after: ${quote(c)}`
     | None => ""
     }
-    let query = `{ ${fieldName}(first: 100${cursor}) { edges { node { ${selection} } } pageInfo { hasNextPage endCursor } } }`
+    let query = `{ ${fieldName}(first: 100${extra}${cursor}) { edges { node { ${selection} } } pageInfo { hasNextPage endCursor } } }`
     let data = await gql(t, ~query, ~label=fieldName)
     let connection = data->field(fieldName)->Option.getOr(JSON.Encode.null)
     switch connection->field("edges") {
@@ -216,6 +392,43 @@ let queryAllNodes = async (t: t, ~field as fieldName: string, ~selection: string
 let countNodes = async (t: t, ~field: string): int =>
   (await queryAllNodes(t, ~field, ~selection="id"))->Array.length
 
+/**
+ * Polls a connection field until the collected nodes satisfy `satisfied`, or the
+ * timeout elapses. Read models are eventually consistent: a view queried the
+ * instant after the writes that feed it can still read empty or partial (a
+ * DynamoDB connection scan is eventually consistent by default, and the write and
+ * read-back can land on different replicas), so a cross-check that asserts on a
+ * single immediate read races the projection. Same rationale as `waitForIds`,
+ * for the "observe the whole connection" case rather than a fixed id set.
+ *
+ * On timeout, throws `Failed(onTimeout(finalNodes))` so the caller can report
+ * what the view actually settled on — distinguishing a still-empty view from a
+ * genuine count mismatch — instead of a bare assertion.
+ */
+let queryAllNodesUntil = async (
+  t: t,
+  ~field: string,
+  ~selection: string,
+  ~args: string="",
+  ~satisfied: array<JSON.t> => bool,
+  ~onTimeout: array<JSON.t> => string,
+  ~timeoutMs: int=60000,
+): array<JSON.t> => {
+  let deadline = nowMs() +. Int.toFloat(timeoutMs)
+  let result = ref(None)
+  while result.contents == None {
+    let nodes = await queryAllNodes(t, ~field, ~selection, ~args)
+    if satisfied(nodes) {
+      result := Some(nodes)
+    } else if nowMs() > deadline {
+      throw(Failed(onTimeout(nodes)))
+    } else {
+      await sleep(500)
+    }
+  }
+  result.contents->Option.getOr([])
+}
+
 /**
  * Polls a `<View>ByIds` field until every id is present.
  *