@reventlessdev/reventless-seed 1.0.0-alpha.2 → 1.0.0-alpha.20

package/lib/bs/src/Seed_Client.res.mjs

@@ -1,5 +1,6 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Seed_Types$ReventlessSeed from "./Seed_Types.res.mjs";
@@ -21,10 +22,77 @@ function currentToken(t) {
   return t.token;
 }
 
+function endpoint(t) {
+  return t.config.endpoint;
+}
+
 function useToken(t, token) {
   t.token = token;
 }
 
+let availableRolesClaim = "availableRoles";
+
+let groupClaimNames = [
+  "cognito:groups",
+  "groups"
+];
+
+function decodeSegment(segment) {
+  try {
+    return Stdlib_JSON.Decode.object(JSON.parse(Buffer.from(segment, "base64url").toString("utf8")));
+  } catch (exn) {
+    return;
+  }
+}
+
+function claims(t) {
+  return Stdlib_Option.flatMap(t.token, token => Stdlib_Array.reduce(token.split("."), undefined, (found, segment) => {
+    if (found !== undefined) {
+      return found;
+    } else {
+      return decodeSegment(segment);
+    }
+  }));
+}
+
+function asStrings(value) {
+  if (Array.isArray(value)) {
+    return Stdlib_Array.filterMap(value, Stdlib_JSON.Decode.string);
+  }
+  switch (typeof value) {
+    case "string" :
+      return value.split(",").map(prim => prim.trim()).filter(s => s !== "");
+    default:
+      return;
+  }
+}
+
+function claimStrings(t, name) {
+  return Stdlib_Option.flatMap(Stdlib_Option.flatMap(claims(t), c => c[name]), asStrings);
+}
+
+function effectiveGroups(t) {
+  return Stdlib_Array.reduce(groupClaimNames, undefined, (found, name) => {
+    if (found !== undefined) {
+      return found;
+    } else {
+      return claimStrings(t, name);
+    }
+  });
+}
+
+function identitySummary(t) {
+  return Stdlib_Option.map(effectiveGroups(t), groups => {
+    let held = groups.length === 0 ? "no groups" : groups.join(", ");
+    let available = claimStrings(t, availableRolesClaim);
+    if (available !== undefined && available.length !== 0) {
+      return held + ` — narrowed to this role from ` + available.join(", ");
+    } else {
+      return held;
+    }
+  });
+}
+
 function field(json, key) {
   if (typeof json === "object" && json !== null && !Array.isArray(json)) {
     return json[key];
@@ -94,6 +162,57 @@ async function login(t) {
   t.token = Stdlib_Option.flatMap(field(json, "token"), asString);
 }
 
+let transientErrorTypes = [
+  "InternalFailure",
+  "ServiceUnavailable",
+  "ServiceUnavailableError",
+  "Throttling",
+  "ThrottlingException",
+  "TooManyRequestsException",
+  "RequestTimeout"
+];
+
+function isTransient(errors) {
+  let entries = Stdlib_JSON.Decode.array(errors);
+  if (entries !== undefined && entries.length !== 0) {
+    return entries.every(e => {
+      let errorType = nodeString(e, "errorType");
+      if (errorType !== undefined) {
+        return transientErrorTypes.includes(errorType);
+      } else {
+        return false;
+      }
+    });
+  } else {
+    return false;
+  }
+}
+
+function isDenied(errors) {
+  let entries = Stdlib_JSON.Decode.array(errors);
+  if (entries !== undefined) {
+    return entries.some(e => {
+      let match = nodeString(e, "errorType");
+      let match$1 = nodeString(e, "message");
+      if (match !== undefined) {
+        if (match.includes("Unauthorized")) {
+          return true;
+        } else if (match$1 !== undefined) {
+          return match$1.includes("Not Authorized");
+        } else {
+          return false;
+        }
+      } else if (match$1 !== undefined) {
+        return match$1.includes("Not Authorized");
+      } else {
+        return false;
+      }
+    });
+  } else {
+    return false;
+  }
+}
+
 async function gql(t, query, label) {
   let headers = Object.fromEntries([[
       "content-type",
@@ -107,30 +226,40 @@ async function gql(t, query, label) {
       "query",
       query
     ]]));
-  let res;
-  try {
-    res = await fetch(t.config.endpoint, {
-      method: "POST",
-      headers: headers,
-      body: body
-    });
-  } catch (exn) {
-    throw {
-      RE_EXN_ID: Seed_Types$ReventlessSeed.Failed,
-      _1: label + `: cannot reach ` + t.config.endpoint + ` — is the platform running?`,
-      Error: new Error()
-    };
-  }
-  let json = await res.json();
-  let errors = field(json, "errors");
-  if (errors !== undefined) {
+  let attempt = async n => {
+    let res;
+    try {
+      res = await fetch(t.config.endpoint, {
+        method: "POST",
+        headers: headers,
+        body: body
+      });
+    } catch (exn) {
+      throw {
+        RE_EXN_ID: Seed_Types$ReventlessSeed.Failed,
+        _1: label + `: cannot reach ` + t.config.endpoint + ` — is the platform running?`,
+        Error: new Error()
+      };
+    }
+    let json = await res.json();
+    let errors = field(json, "errors");
+    if (errors === undefined) {
+      return Stdlib_Option.getOr(field(json, "data"), null);
+    }
+    if (isTransient(errors) && n < 4) {
+      await sleep((250 * (1 << (n - 1 | 0)) | 0) + (Math.random() * 250 | 0) | 0);
+      return await attempt(n + 1 | 0);
+    }
+    let tried = n > 1 ? `\n  gave up after ` + n.toString() + ` attempts` : "";
+    let summary = isDenied(errors) ? identitySummary(t) : undefined;
+    let identity = summary !== undefined ? `\n  identity: ` + summary : "";
     throw {
       RE_EXN_ID: Seed_Types$ReventlessSeed.Failed,
-      _1: label + ` failed\n  query: ` + query + `\n  response: ` + JSON.stringify(errors),
+      _1: label + ` failed\n  query: ` + query + `\n  response: ` + JSON.stringify(errors) + identity + tried,
       Error: new Error()
     };
-  }
-  return Stdlib_Option.getOr(field(json, "data"), null);
+  };
+  return await attempt(1);
 }
 
 let commandResultSelection = `__typename
@@ -171,14 +300,16 @@ async function sendAll(t, mutations) {
   }
 }
 
-async function queryAllNodes(t, fieldName, selection) {
+async function queryAllNodes(t, fieldName, selection, argsOpt) {
+  let args = argsOpt !== undefined ? argsOpt : "";
   let nodes = [];
   let after;
   let more = true;
+  let extra = args === "" ? "" : `, ` + args;
   while (more) {
     let c = after;
     let cursor = c !== undefined ? `, after: ` + Seed_Types$ReventlessSeed.quote(c) : "";
-    let query = `{ ` + fieldName + `(first: 100` + cursor + `) { edges { node { ` + selection + ` } } pageInfo { hasNextPage endCursor } } }`;
+    let query = `{ ` + fieldName + `(first: 100` + extra + cursor + `) { edges { node { ` + selection + ` } } pageInfo { hasNextPage endCursor } } }`;
     let data = await gql(t, query, fieldName);
     let connection = Stdlib_Option.getOr(field(data, fieldName), null);
     let match = field(connection, "edges");
@@ -205,7 +336,30 @@ async function queryAllNodes(t, fieldName, selection) {
 }
 
 async function countNodes(t, field) {
-  return (await queryAllNodes(t, field, "id")).length;
+  return (await queryAllNodes(t, field, "id", undefined)).length;
+}
+
+async function queryAllNodesUntil(t, field, selection, argsOpt, satisfied, onTimeout, timeoutMsOpt) {
+  let args = argsOpt !== undefined ? argsOpt : "";
+  let timeoutMs = timeoutMsOpt !== undefined ? timeoutMsOpt : 60000;
+  let deadline = Date.now() + timeoutMs;
+  let result;
+  while (result === undefined) {
+    let nodes = await queryAllNodes(t, field, selection, args);
+    if (satisfied(nodes)) {
+      result = nodes;
+    } else {
+      if (Date.now() > deadline) {
+        throw {
+          RE_EXN_ID: Seed_Types$ReventlessSeed.Failed,
+          _1: onTimeout(nodes),
+          Error: new Error()
+        };
+      }
+      await sleep(500);
+    }
+  };
+  return Stdlib_Option.getOr(result, []);
 }
 
 async function waitForIds(t, fieldName, ids, timeoutMsOpt) {
@@ -240,21 +394,40 @@ async function waitForIds(t, fieldName, ids, timeoutMsOpt) {
   return Stdlib_Option.getOr(result, 0);
 }
 
+let activeRoleClaim = "activeRole";
+
+let attempts = 4;
+
 export {
   sleep,
   make,
   currentToken,
+  endpoint,
   useToken,
+  activeRoleClaim,
+  availableRolesClaim,
+  groupClaimNames,
+  decodeSegment,
+  claims,
+  asStrings,
+  claimStrings,
+  effectiveGroups,
+  identitySummary,
   field,
   asString,
   nodeString,
   login,
+  transientErrorTypes,
+  isTransient,
+  isDenied,
+  attempts,
   gql,
   commandResultSelection,
   send,
   sendAll,
   queryAllNodes,
   countNodes,
+  queryAllNodesUntil,
   waitForIds,
 }
 /* No side effect */

package/lib/bs/src/Seed_Connect.res

@@ -1,15 +1,23 @@
 // Turns endpoints plus a login function into a ready `connection`.
 //
 // A connection is what a data set seeds against: an authenticated GraphQL
-// client, the upload endpoint (empty when the deployment serves no uploads), and
-// a human label for the target. `make` is provider-agnostic — it prompts for
+// client, the deployment's upload endpoints (empty when it serves no uploads),
+// and a human label for the target. `make` is provider-agnostic — it prompts for
 // credentials, calls the supplied `login` to obtain a bearer, and wires it onto
 // the client via `useToken`. Where the bearer comes from (a local `/login`
 // round-trip, a Cognito id token) is the caller's concern.
 
 open Seed_Types
 
-type connection = {client: Seed_Client.t, uploadEndpoint: string, label: string}
+// Under route B the client mints uploads through the domain API's `Upload_Presign`
+// mutation (authenticated by the same bearer as commands), so a connection needs no
+// upload endpoint — just the authenticated client and whether uploads are skipped this
+// run (`SEED_SKIP_UPLOADS`). Which store an asset uploads into is the caller's `~store`.
+type connection = {
+  client: Seed_Client.t,
+  uploadsSkipped: bool,
+  label: string,
+}
 
 /**
  * Prompts for credentials, calls `login` to mint a bearer, and returns a
@@ -19,22 +27,25 @@ type connection = {client: Seed_Client.t, uploadEndpoint: string, label: string}
 let make = async (
   ~label: string,
   ~endpoint: string,
-  ~uploadEndpoint: string,
   ~login: (~username: string, ~password: string) => promise<string>,
   ~localDefaults: bool=false,
 ): connection => {
-  // `SEED_SKIP_UPLOADS` forces the connection to carry no upload endpoint, so a
-  // data set's upload phase no-ops the same way it does when a deployment serves
-  // none. Use it to seed domain data fast, or to skip a broken/absent upload path
-  // without editing the data set. It is the single knob: an empty
-  // `REVENTLESS_UPLOAD_ENDPOINT` env reads as "unset" (falls back to discovery),
-  // so this is the reliable way to disable uploads.
-  let uploadEndpoint = Seed_Prompt.envValue("SEED_SKIP_UPLOADS")->Option.isSome ? "" : uploadEndpoint
+  // `SEED_SKIP_UPLOADS` forces the upload phase to no-op — seed domain data fast, or
+  // skip a broken/absent upload path without editing the data set. The data set reads
+  // `connection.uploadsSkipped` and reports the skip.
+  let uploadsSkipped = Seed_Upload.uploadsSkipped()
   let (username, password) = await Seed_Prompt.credentials(~localDefaults)
   let token = await login(~username, ~password)
   let client = Seed_Client.make(~config={endpoint: endpoint})
   client->Seed_Client.useToken(token)
-  {client, uploadEndpoint, label}
+  // What the bearer grants, which is not always what the account list showed: a
+  // token narrowed to one role presents that role alone. Said at login so the
+  // run starts from the identity it will actually be refused or served under.
+  switch Seed_Client.identitySummary(client) {
+  | Some(summary) => Console.log(`Acting as: ${summary}`)
+  | None => ()
+  }
+  {client, uploadsSkipped, label}
 }
 
 /**
@@ -63,21 +74,19 @@ let envOr = (key: string, fallback: string): string =>
  * A ready `connect` thunk for the local dev platform, with the localhost
  * defaults baked in and overridable per endpoint (arg, then env var, then
  * default). Empty input at the credential prompt falls back to `admin`/`admin`.
+ *
+ * No upload endpoint: uploads mint through the domain API's `Upload_Presign` mutation
+ * on the same `graphql` endpoint, with the store passed per asset.
  */
-let local = (~graphql=?, ~upload=?, ~login=?, ()): (unit => promise<connection>) => {
+let local = (~graphql=?, ~login=?, ()): (unit => promise<connection>) => {
   let endpoint =
     graphql->Option.getOr(envOr("REVENTLESS_GRAPHQL_ENDPOINT", "http://localhost:4000/graphql"))
-  let uploadEndpoint =
-    upload->Option.getOr(
-      envOr("REVENTLESS_UPLOAD_ENDPOINT", "http://localhost:4000/__inmemory/upload"),
-    )
   let loginEndpoint =
     login->Option.getOr(envOr("REVENTLESS_LOGIN_ENDPOINT", "http://localhost:4000/__inmemory/login"))
   () =>
     make(
       ~label="local",
       ~endpoint,
-      ~uploadEndpoint,
       ~login=viaLoginEndpoint(~loginEndpoint),
       ~localDefaults=true,
     )

package/lib/bs/src/Seed_Connect.res.mjs

@@ -4,19 +4,24 @@ import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Seed_Types$ReventlessSeed from "./Seed_Types.res.mjs";
 import * as Seed_Client$ReventlessSeed from "./Seed_Client.res.mjs";
 import * as Seed_Prompt$ReventlessSeed from "./Seed_Prompt.res.mjs";
+import * as Seed_Upload$ReventlessSeed from "./Seed_Upload.res.mjs";
 
-async function make(label, endpoint, uploadEndpoint, login, localDefaultsOpt) {
+async function make(label, endpoint, login, localDefaultsOpt) {
   let localDefaults = localDefaultsOpt !== undefined ? localDefaultsOpt : false;
-  let uploadEndpoint$1 = Stdlib_Option.isSome(Seed_Prompt$ReventlessSeed.envValue("SEED_SKIP_UPLOADS")) ? "" : uploadEndpoint;
+  let uploadsSkipped = Seed_Upload$ReventlessSeed.uploadsSkipped();
   let match = await Seed_Prompt$ReventlessSeed.credentials(localDefaults);
   let token = await login(match[0], match[1]);
   let client = Seed_Client$ReventlessSeed.make({
     endpoint: endpoint
   });
   Seed_Client$ReventlessSeed.useToken(client, token);
+  let summary = Seed_Client$ReventlessSeed.identitySummary(client);
+  if (summary !== undefined) {
+    console.log(`Acting as: ` + summary);
+  }
   return {
     client: client,
-    uploadEndpoint: uploadEndpoint$1,
+    uploadsSkipped: uploadsSkipped,
     label: label
   };
 }
@@ -46,11 +51,10 @@ function envOr(key, fallback) {
   return Stdlib_Option.getOr(Seed_Prompt$ReventlessSeed.envValue(key), fallback);
 }
 
-function local(graphql, upload, login, param) {
+function local(graphql, login, param) {
   let endpoint = Stdlib_Option.getOr(graphql, Stdlib_Option.getOr(Seed_Prompt$ReventlessSeed.envValue("REVENTLESS_GRAPHQL_ENDPOINT"), "http://localhost:4000/graphql"));
-  let uploadEndpoint = Stdlib_Option.getOr(upload, Stdlib_Option.getOr(Seed_Prompt$ReventlessSeed.envValue("REVENTLESS_UPLOAD_ENDPOINT"), "http://localhost:4000/__inmemory/upload"));
   let loginEndpoint = Stdlib_Option.getOr(login, Stdlib_Option.getOr(Seed_Prompt$ReventlessSeed.envValue("REVENTLESS_LOGIN_ENDPOINT"), "http://localhost:4000/__inmemory/login"));
-  return () => make("local", endpoint, uploadEndpoint, viaLoginEndpoint(loginEndpoint), true);
+  return () => make("local", endpoint, viaLoginEndpoint(loginEndpoint), true);
 }
 
 export {

package/lib/bs/src/Seed_Prompt.res

@@ -1,7 +1,7 @@
 // One shared readline interface for every interactive prompt in a seed run.
 //
 // The reason this module exists: creating and closing a fresh `readline`
-// interface per prompt leaves stdin paused after the first `close`, so the
+// interface per prompt leaves NodeProcess.stdin paused after the first `close`, so the
 // second prompt (password after username) never fires and the run hangs. A
 // single interface, created lazily and closed exactly once, avoids that — and a
 // `muted` gate on its output lets password entry reuse the same interface
@@ -14,18 +14,8 @@ open Seed_Types
 
 // ── Node bindings ─────────────────────────────────────────────────────────────
 
-type stream
-@val @scope("process") external stdin: stream = "stdin"
-@val @scope("process") external stdout: stream = "stdout"
-@send external writeStream: (stream, string) => unit = "write"
-@get external isTTY: stream => bool = "isTTY"
-@send external pauseStream: stream => unit = "pause"
-@send external unrefStream: stream => unit = "unref"
-
-@scope("process") @val external processEnv: dict<string> = "env"
-
 type rl
-type rlOptions = {input: stream, output: stream, terminal?: bool}
+type rlOptions = {input: NodeProcess.stream, output: NodeProcess.stream, terminal?: bool}
 @module("node:readline") external createInterface: rlOptions => rl = "createInterface"
 @send external question: (rl, string, string => unit) => unit = "question"
 @send external closeRl: rl => unit = "close"
@@ -42,10 +32,10 @@ let iface = (): rl =>
   switch rlRef.contents {
   | Some(rl) => rl
   | None =>
-    let rl = createInterface({input: stdin, output: stdout, terminal: true})
+    let rl = createInterface({input: NodeProcess.stdin, output: NodeProcess.stdout, terminal: true})
     rl->setWriteToOutput(s =>
       if !muted.contents {
-        stdout->writeStream(s)
+        NodeProcess.stdout->NodeProcess.write(s)
       }
     )
     rlRef := Some(rl)
@@ -58,23 +48,23 @@ let close = (): unit =>
     rl->closeRl
     rlRef := None
     // Closing the interface is not enough: a terminal-mode readline leaves
-    // stdin resumed and reffed, which keeps the event loop alive so the CLI
+    // NodeProcess.stdin resumed and reffed, which keeps the event loop alive so the CLI
     // never exits after seeding. Release it explicitly.
-    stdin->pauseStream
-    stdin->unrefStream
+    NodeProcess.stdin->NodeProcess.pause
+    NodeProcess.stdin->NodeProcess.unref
   | None => ()
   }
 
 // ── Env + TTY ─────────────────────────────────────────────────────────────────
 
 let envValue = (key: string): option<string> =>
-  switch processEnv->Dict.get(key) {
+  switch NodeProcess.env->Dict.get(key) {
   | Some(v) if v->String.trim != "" => Some(v->String.trim)
   | _ => None
   }
 
 let requireTty = (): unit =>
-  if !(stdin->isTTY) {
+  if !(NodeProcess.stdin->NodeProcess.isTTY->Option.getOr(false)) {
     throw(
       Failed(
         "no TTY for an interactive prompt — set the documented SEED_* / REVENTLESS_DEMO_* " ++
@@ -101,23 +91,45 @@ let askHidden = (query: string): promise<string> =>
     let rl = iface()
     rl->question(query, answer => {
       muted := false
-      stdout->writeStream("\n")
+      NodeProcess.stdout->NodeProcess.write("\n")
       resolve(answer)
     })
     muted := true
   })
 
+/**
+ * Whether an answer means yes — the one vocabulary, for the typed reply and the
+ * env var that stands in for it alike.
+ *
+ * It exists because those two drifted: a `[y/N]` prompt took `y`, and the env
+ * var beside it took only `1` or `yes`, so the obvious `SEED_RESET_CONFIRM=y`
+ * silently fell through to the interactive branch — which, on the CI runs the
+ * variable exists for, has no TTY and throws. Two spellings of one question are
+ * one spelling too many; callers ask this instead of comparing strings.
+ *
+ * Trimmed and case-folded, so `Yes`/` y ` answer the same as `y`.
+ */
+let isAffirmative = (answer: string): bool =>
+  switch answer->String.trim->String.toLowerCase {
+  | "y" | "yes" | "1" => true
+  | _ => false
+  }
+
 /**
  * Chooses one of `options` (a label paired with the value it selects).
  *
  * Auto-returns when there is a single option, so a lone data set or stack needs
  * no keypress. `env` (e.g. `SEED_SET`) preselects by matching label or 1-based
  * index, so CI runs without a TTY. Otherwise it prints a numbered menu.
+ *
+ * `defaultIndex` makes Enter a valid answer, selecting that 0-based option;
+ * without one every reply must name a choice.
  */
 let select = async (
   ~title: string,
   ~options: array<(string, 'a)>,
   ~env=?,
+  ~defaultIndex=?,
 ): 'a =>
   switch options {
   | [(_, only)] => only
@@ -145,29 +157,38 @@ let select = async (
       options->Array.forEachWithIndex(((label, _), i) =>
         Console.log(`  ${(i + 1)->Int.toString}) ${label}`)
       )
+      let fallback = defaultIndex->Option.flatMap(i => options->Array.get(i))
+      let hint = switch (defaultIndex, fallback) {
+      | (Some(i), Some(_)) => ` (default ${(i + 1)->Int.toString})`
+      | _ => ""
+      }
       let rec pick = async (): 'a => {
-        let answer = await ask(`\nSelect [1-${(options->Array.length)->Int.toString}]: `)
-        switch Int.fromString(answer) {
-        | Some(n) if n >= 1 && n <= options->Array.length =>
-          let (_, value) = options->Array.getUnsafe(n - 1)
-          value
+        let answer = await ask(
+          `\nSelect [1-${(options->Array.length)->Int.toString}]${hint}: `,
+        )
+        switch (answer, fallback) {
+        | ("", Some((_, value))) => value
         | _ =>
-          Console.log("  Not a valid choice.")
-          await pick()
+          switch Int.fromString(answer) {
+          | Some(n) if n >= 1 && n <= options->Array.length =>
+            let (_, value) = options->Array.getUnsafe(n - 1)
+            value
+          | _ =>
+            Console.log("  Not a valid choice.")
+            await pick()
+          }
         }
       }
       await pick()
     }
   }
 
-/**
- * Prompts for a username (visible) and password (echo muted).
- *
- * `REVENTLESS_DEMO_USER` / `REVENTLESS_DEMO_PASSWORD` skip the prompts. With
- * `localDefaults`, empty input falls back to `admin`/`admin` — the dev login.
- */
-let credentials = async (~localDefaults: bool=false): (string, string) => {
-  let username = switch envValue("REVENTLESS_DEMO_USER") {
+// Typing both halves is the fallback, not the first offer: it is what happens
+// when the platform keeps no accounts file. `envUser` is threaded in so a
+// `REVENTLESS_DEMO_USER` that named nobody in the file still skips the username
+// prompt rather than asking for a name that was already given.
+let askCredentials = async (~localDefaults: bool, ~envUser: option<string>): (string, string) => {
+  let username = switch envUser {
   | Some(u) => u
   | None =>
     requireTty()
@@ -181,6 +202,60 @@ let credentials = async (~localDefaults: bool=false): (string, string) => {
     let entered = await askHidden(localDefaults ? "Password [admin]: " : "Password: ")
     entered == "" && localDefaults ? "admin" : entered
   }
+  (username, password)
+}
+
+// The accounts file the platform already keeps (`.reventless/users.yaml`, or
+// `SEED_USERS_FILE`). It records the password beside the username, so choosing
+// an account is the whole credential step — nothing is typed.
+//
+// A named `REVENTLESS_DEMO_USER` picks its entry directly; otherwise the file's
+// accounts are offered in the order it defines them, first as the default.
+// `None` means the file has nothing to offer and the caller should ask.
+let fromUsersFile = async (~envUser: option<string>): option<(string, string)> =>
+  switch Seed_Users.load(~path=?envValue("SEED_USERS_FILE")) {
+  | None => None
+  | Some((path, users)) =>
+    let chosen = switch envUser {
+    | Some(name) => users->Array.find(u => u.username == name)
+    | None =>
+      Some(
+        await select(
+          ~title=`User (${path}):`,
+          ~options=users->Array.map(u => (Seed_Users.label(u), u)),
+          ~env="SEED_USER",
+          ~defaultIndex=0,
+        ),
+      )
+    }
+    // Logged for every arm, including the single-account file that selects
+    // itself without a keypress: which identity seeded the data is the thing an
+    // operator checks when owner-scoped rows turn up under the wrong account.
+    chosen->Option.map(u => {
+      Console.log(`Logging in as ${u.username} (from ${path})`)
+      (u.username, u.password)
+    })
+  }
+
+/**
+ * Resolves the credentials a seed run logs in with.
+ *
+ * `REVENTLESS_DEMO_USER` + `REVENTLESS_DEMO_PASSWORD` together are the
+ * non-interactive path and skip everything below. Otherwise the platform's
+ * `.reventless/users.yaml` supplies the accounts to choose from, and only a
+ * platform without one falls back to typing both halves — where, with
+ * `localDefaults`, empty input means `admin`/`admin`.
+ */
+let credentials = async (~localDefaults: bool=false): (string, string) => {
+  let envUser = envValue("REVENTLESS_DEMO_USER")
+  let (username, password) = switch (envUser, envValue("REVENTLESS_DEMO_PASSWORD")) {
+  | (Some(u), Some(p)) => (u, p)
+  | _ =>
+    switch await fromUsersFile(~envUser) {
+    | Some(pair) => pair
+    | None => await askCredentials(~localDefaults, ~envUser)
+    }
+  }
   if username == "" || password == "" {
     throw(Failed("username and password are required."))
   }