@reventlessdev/reventless-aws 3.0.0-alpha.236 → 3.0.0-alpha.237

package/CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.237 (2026-07-28)
+
+### Features
+
+* **aws:** provision platform capabilities through framework helpers ([5f87c57](https://github.com/ReventlessDev/reventless-core/commit/5f87c57c7c117dccb44c88d6132e5270e8707bc2))
+* **events:** client-publishable /client namespace + local Events transport ([af98ce0](https://github.com/ReventlessDev/reventless-core/commit/af98ce07fb495bc629fcf3dc4f8383a9e0f2890d))
+
+
 # 3.0.0-alpha.236 (2026-07-27)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.236",
+  "version": "3.0.0-alpha.237",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -13,14 +13,14 @@
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.25",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.31",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.61",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.17",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.187",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.17",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.106",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.186",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.50",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.81",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.107",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.51",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.82",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.29"
   },
   "devDependencies": {

package/src/Platform.res

@@ -999,8 +999,12 @@ module MakeWithConfig = (
   // `config.json` next to `index.html` so the shell discovers `apiEndpoint` and
   // `region` at boot without rebuild.
   type hostUiBundleConfig = {
-    assetsDir: string,
-    bundleVersion: string,
+    // Directory holding the built shell bundle. Defaults to the resolved
+    // `@reventlessdev/reventless-host-shell` dist — the line every platform
+    // root used to repeat verbatim. Set it only to host a different bundle.
+    assetsDir?: string,
+    // Defaults to the `~version` passed to `deployPlatform`.
+    bundleVersion?: string,
     // Optional path to a static AutoUI `ui-hints.json` (assistant-authored,
     // plain data — no app rebuild). When set, the deploy reads it and writes it
     // verbatim as a `ui-hints.json` BucketObject beside `config.json`, so the
@@ -1008,23 +1012,26 @@ module MakeWithConfig = (
     // written; the shell treats the resulting 404 as "no hints" and boots
     // unchanged. Single-mode shape: one origin-relative file per deployment.
     uiHintsFile?: string,
-    // Optional AWS Location place-index name. When set, the deploy provisions a
+    // Optional geocoding place index, as returned by
+    // `Capability_Geocoding_AwsLocation.make`. When set, the deploy provisions a
     // public geocoder Lambda Function URL (Geocoder_AwsLocation) and threads its
     // URL into config.json as `geocoderEndpoint`. Unset ⇒ no service, field
     // omitted (byte-identical config.json).
-    geocoderPlaceIndex?: Pulumi.Input.t<string>,
-    // Opt into the direct-to-S3 upload presign service (Upload_Presign_S3). Both
-    // this flag and `uploadBucketName` must be set; the deploy then provisions a
-    // public presign Lambda Function URL and threads its URL into config.json as
-    // `uploadEndpoint`. Unset ⇒ no service, field omitted.
-    enableUploads?: bool,
-    // S3 bucket the upload presign service issues PUT URLs against. Required when
-    // `enableUploads` is true.
-    uploadBucketName?: Pulumi.Input.t<string>,
-    // Buckets served read-only to the UI under a path prefix on the host-shell
-    // CloudFront distribution (same-origin, private, OAC-read). Each entry adds a
-    // `{prefix}/*` ordered cache behavior + origin + scoped BucketPolicy.
-    servedBuckets?: array<ReventlessInfra.Platform.servedBucket>,
+    geocoderPlaceIndex?: ReventlessInfra.Platform.geocoderIndex,
+    // Optional object store for direct-to-S3 uploads, as returned by
+    // `Capability_ObjectStore_S3.make`. When set, the deploy provisions the
+    // presign service (Upload_Presign_S3) against it, threads that service's URL
+    // into config.json as `uploadEndpoint`, and fronts the store read-only on
+    // the host-shell CloudFront distribution under the presign service's own
+    // prefix (a `{prefix}/*` ordered cache behavior + origin + scoped
+    // BucketPolicy, private, OAC-read).
+    //
+    // One field replaces the former `enableUploads` / `uploadBucketName` /
+    // `servedBuckets` trio, which were three ways of saying one thing and left
+    // the prefix to be restated by hand on the serve side. The framework now
+    // writes the prefix once and consumes it on both sides, so a mismatch is
+    // unrepresentable rather than merely discouraged.
+    uploadBucket?: ReventlessInfra.Platform.objectStore,
   }
 
   // Merged-mode outputs of deployPlatform — the merged API(s), plus the
@@ -1483,10 +1490,28 @@ module MakeWithConfig = (
       | _ => None
       }
 
+      // A served store is fronted under exactly the prefix the presign service
+      // roots its keys at, read from the service's own constant. This is the
+      // whole reason the store arrives as one value: the app no longer restates
+      // the prefix, so it cannot restate it wrongly.
+      let servedBuckets = switch cfg.uploadBucket {
+      | Some(store) => [
+          {
+            ReventlessInfra.Platform.prefix: Upload_Presign_S3.defaultServedPrefix,
+            bucketId: store.bucketId,
+            bucketArn: store.bucketArn,
+            bucketRegionalDomainName: store.bucketRegionalDomainName,
+          },
+        ]
+      | None => []
+      }
+
       let {distributionUrl, bucketName} = Plugin_Stack.makeUiBundleDistribution(
         ~pluginId="host-ui",
-        ~bundleVersion=cfg.bundleVersion,
-        ~assetsDir=cfg.assetsDir,
+        ~bundleVersion=cfg.bundleVersion->Option.getOr(version),
+        ~assetsDir=cfg.assetsDir->Option.getOr(
+          Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-host-shell") ++ "/dist",
+        ),
         ~spaFallback=true,
         ~stableName=true,
         // The explicit BucketObjects below write the production config.json
@@ -1500,8 +1525,8 @@ module MakeWithConfig = (
         // Served buckets front the host-shell distribution with `{prefix}/*`
         // read paths (private, OAC-read) — same origin as the SPA, so served
         // objects are addressable by same-origin relative URL with no config.json
-        // change. Unset ⇒ [] ⇒ distribution byte-identical to today.
-        ~servedBuckets=cfg.servedBuckets->Option.getOr([]),
+        // change. No upload store ⇒ [] ⇒ distribution byte-identical to today.
+        ~servedBuckets,
       )
 
       let regionStr =
@@ -1528,21 +1553,20 @@ module MakeWithConfig = (
       // index is configured; its resolved URL becomes config.json's
       // `geocoderEndpoint`. Unset ⇒ Output<None> ⇒ field omitted below.
       let geocoderEndpointOutput: Pulumi.Output.t<option<string>> = switch cfg.geocoderPlaceIndex {
-      | Some(placeIndexName) =>
-        Geocoder_AwsLocation.make(~placeIndexName).url->Pulumi.Output.apply(u => Some(u))
+      | Some(index) =>
+        Geocoder_AwsLocation.make(
+          ~placeIndexName=index.indexName,
+        ).url->Pulumi.Output.apply(u => Some(u))
       | None => Pulumi.Output.make(None)
       }
 
-      // Optional public upload presign Function URL. Needs both the opt-in flag
-      // and a target bucket; its resolved URL becomes config.json's
-      // `uploadEndpoint`. Otherwise Output<None> ⇒ field omitted below.
-      let uploadEndpointOutput: Pulumi.Output.t<option<string>> = switch (
-        cfg.enableUploads,
-        cfg.uploadBucketName,
-      ) {
-      | (Some(true), Some(bucketName)) =>
-        Upload_Presign_S3.make(~bucketName).url->Pulumi.Output.apply(u => Some(u))
-      | _ => Pulumi.Output.make(None)
+      // Optional public upload presign Function URL, provisioned against the
+      // configured store; its resolved URL becomes config.json's
+      // `uploadEndpoint`. No store ⇒ Output<None> ⇒ field omitted below.
+      let uploadEndpointOutput: Pulumi.Output.t<option<string>> = switch cfg.uploadBucket {
+      | Some(store) =>
+        Upload_Presign_S3.make(~bucketName=store.bucketName).url->Pulumi.Output.apply(u => Some(u))
+      | None => Pulumi.Output.make(None)
       }
 
       let configJsonContent =
@@ -1580,6 +1604,13 @@ module MakeWithConfig = (
               [
                 ("domainApiEventsEndpoint", JSON.Encode.string(ep)),
                 ("platformApiEventsEndpoint", JSON.Encode.string(ep)),
+                // Capability gate: present iff the API carries the
+                // client-publishable namespace — clients hide publish-dependent
+                // features (presence, transient chat) when absent.
+                (
+                  "clientEventsNamespace",
+                  JSON.Encode.string(AppSync_EventsApi.clientNamespaceName),
+                ),
               ],
             )
           | None => fields

package/src/Platform.res.mjs

@@ -21,6 +21,7 @@ import * as Component$ReventlessCore from "@reventlessdev/reventless-core/src/co
 import * as DcbBackend$ReventlessAws from "./adapter/DcbEventLog/DcbBackend.res.mjs";
 import * as ReadModel$ReventlessCore from "@reventlessdev/reventless-core/src/components/ReadModel/ReadModel.res.mjs";
 import * as PluginSpec$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginSpec.res.mjs";
+import * as Util_Bundle$ReventlessAws from "./util/Util_Bundle.res.mjs";
 import * as Plugin_Stack$ReventlessAws from "./plugin/stack/Plugin_Stack.res.mjs";
 import * as UiFragments$ReventlessCore from "@reventlessdev/reventless-core/src/admin/UiFragmentRegistry/StateViewSlice/UiFragments.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
@@ -883,19 +884,25 @@ function MakeWithConfig(Config) {
       } else {
         customDomain = undefined;
       }
-      let match$3 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", hostUiBundle.bundleVersion, hostUiBundle.assetsDir, true, undefined, true, [
+      let store = hostUiBundle.uploadBucket;
+      let servedBuckets = store !== undefined ? [{
+            prefix: Upload_Presign_S3$ReventlessAws.defaultServedPrefix,
+            bucketId: store.bucketId,
+            bucketArn: store.bucketArn,
+            bucketRegionalDomainName: store.bucketRegionalDomainName
+          }] : [];
+      let match$3 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
         "config.json",
         "ui-hints.json"
-      ], customDomain, Stdlib_Option.getOr(hostUiBundle.servedBuckets, []));
+      ], customDomain, servedBuckets);
       let bucketName = match$3.bucketName;
       let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
       let cognitoPool = Platform_Stack$ReventlessAws.resolveCognitoUserPool();
       let domainEventsEndpointOutput = domainEventsApiOpt !== undefined ? AppSync_EventsApi$ReventlessAws.httpEndpoint(domainEventsApiOpt).apply(ep => ep + "/event") : Pulumi.output(undefined);
-      let placeIndexName = hostUiBundle.geocoderPlaceIndex;
-      let geocoderEndpointOutput = placeIndexName !== undefined ? Geocoder_AwsLocation$ReventlessAws.make(placeIndexName, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
-      let match$4 = hostUiBundle.enableUploads;
-      let match$5 = hostUiBundle.uploadBucketName;
-      let uploadEndpointOutput = match$4 !== undefined && match$4 && match$5 !== undefined ? Upload_Presign_S3$ReventlessAws.make(match$5, undefined, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
+      let index = hostUiBundle.geocoderPlaceIndex;
+      let geocoderEndpointOutput = index !== undefined ? Geocoder_AwsLocation$ReventlessAws.make(index.indexName, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
+      let store$1 = hostUiBundle.uploadBucket;
+      let uploadEndpointOutput = store$1 !== undefined ? Upload_Presign_S3$ReventlessAws.make(store$1.bucketName, undefined, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
       let configJsonContent = Pulumi.all([
         Pulumi.all([
           resolvedDomainApiEndpoint,
@@ -949,6 +956,10 @@ function MakeWithConfig(Config) {
             [
               "platformApiEventsEndpoint",
               eventsEpOpt
+            ],
+            [
+              "clientEventsNamespace",
+              AppSync_EventsApi$ReventlessAws.clientNamespaceName
             ]
           ]) : fields;
         let withGeocoder = geocoderEpOpt !== undefined ? withEvents.concat([[
@@ -1866,19 +1877,25 @@ function Make($star) {
       } else {
         customDomain = undefined;
       }
-      let match$3 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", hostUiBundle.bundleVersion, hostUiBundle.assetsDir, true, undefined, true, [
+      let store = hostUiBundle.uploadBucket;
+      let servedBuckets = store !== undefined ? [{
+            prefix: Upload_Presign_S3$ReventlessAws.defaultServedPrefix,
+            bucketId: store.bucketId,
+            bucketArn: store.bucketArn,
+            bucketRegionalDomainName: store.bucketRegionalDomainName
+          }] : [];
+      let match$3 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
         "config.json",
         "ui-hints.json"
-      ], customDomain, Stdlib_Option.getOr(hostUiBundle.servedBuckets, []));
+      ], customDomain, servedBuckets);
       let bucketName = match$3.bucketName;
       let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
       let cognitoPool = Platform_Stack$ReventlessAws.resolveCognitoUserPool();
       let domainEventsEndpointOutput = domainEventsApiOpt !== undefined ? AppSync_EventsApi$ReventlessAws.httpEndpoint(domainEventsApiOpt).apply(ep => ep + "/event") : Pulumi.output(undefined);
-      let placeIndexName = hostUiBundle.geocoderPlaceIndex;
-      let geocoderEndpointOutput = placeIndexName !== undefined ? Geocoder_AwsLocation$ReventlessAws.make(placeIndexName, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
-      let match$4 = hostUiBundle.enableUploads;
-      let match$5 = hostUiBundle.uploadBucketName;
-      let uploadEndpointOutput = match$4 !== undefined && match$4 && match$5 !== undefined ? Upload_Presign_S3$ReventlessAws.make(match$5, undefined, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
+      let index = hostUiBundle.geocoderPlaceIndex;
+      let geocoderEndpointOutput = index !== undefined ? Geocoder_AwsLocation$ReventlessAws.make(index.indexName, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
+      let store$1 = hostUiBundle.uploadBucket;
+      let uploadEndpointOutput = store$1 !== undefined ? Upload_Presign_S3$ReventlessAws.make(store$1.bucketName, undefined, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
       let configJsonContent = Pulumi.all([
         Pulumi.all([
           resolvedDomainApiEndpoint,
@@ -1932,6 +1949,10 @@ function Make($star) {
             [
               "platformApiEventsEndpoint",
               eventsEpOpt
+            ],
+            [
+              "clientEventsNamespace",
+              AppSync_EventsApi$ReventlessAws.clientNamespaceName
             ]
           ]) : fields;
         let withGeocoder = geocoderEpOpt !== undefined ? withEvents.concat([[

package/src/adapter/Api/AppSync_EventsApi.res

@@ -1,11 +1,20 @@
 /** AppSync_EventsApi — creates an IAM-authenticated AppSync Events (Pub/Sub) API
-    with a `default` channel namespace.
+    with a `default` channel namespace and a client-publishable `client`
+    namespace.
 
     This is a companion to the AppSync GraphQL API. Sources A and B push
     real-time events here; clients subscribe to channels such as
     `/default/{topicRoot}/{entityKey}` — see `StateTopic_AppSync.res` for
     channel layout.
 
+    Namespace auth asymmetry:
+    - `default` namespace — publish AWS_IAM only (the SigV4-signed Lambda
+      publishers); a browser must never be able to forge a change descriptor.
+    - `client` namespace  — publish + subscribe Cognito (and IAM): ephemeral
+      client→client fan-out (presence, typing, transient chat). Payloads are
+      opaque to the platform and client-asserted — consumers treat them as
+      untrusted input. See docs/plans/events-client-publish-channels.md.
+
     Usage (in platform/plugin builder after the GraphQL API is created):
       let eventsApi = AppSync_EventsApi.make(
         ~name="DomainEventsApi",
@@ -73,8 +82,16 @@ type t = {
   api: Api.t,
   /** The `default` channel namespace created on the API. */
   defaultNamespace: option<ChannelNamespace.t>,
+  /** The client-publishable `client` namespace. Absent on plugin-stack
+      phantoms (namespaces live on the platform stack's API). */
+  clientNamespace?: ChannelNamespace.t,
 }
 
+/** Namespace name for client-publishable channels (paths under `/client/`).
+    Emitted into the host-ui config as `clientEventsNamespace` so clients can
+    gate publish-dependent features on its presence. */
+let clientNamespaceName = "client"
+
 /** Create an AppSync Events API with dual auth (Cognito + AWS_IAM) and a
     `default` channel namespace.
 
@@ -161,7 +178,31 @@ let make = (
     ~opts=Some({...opts, parent: api->Pulumi.Resource.makeFromJs}),
   )
 
-  {name, api, defaultNamespace: Some(defaultNamespace)}
+  // Client-publishable namespace: per-namespace auth modes override the
+  // API-level `defaultPublishAuthModes` (IAM-only), so authenticated browsers
+  // can publish ephemeral payloads on `/client/**` while `/default/**` change
+  // descriptors stay Lambda-only.
+  let clientAuthModes: Pulumi.Input.t<
+    array<Pulumi.Input.t<ChannelNamespace.authMode>>,
+  > =
+    [
+      ({authType: Api.amazonCognitoUserPools->Pulumi.Input.make}: ChannelNamespace.authMode)
+      ->Pulumi.Input.make,
+      ({authType: Api.awsIam->Pulumi.Input.make}: ChannelNamespace.authMode)
+      ->Pulumi.Input.make,
+    ]->Pulumi.Input.make
+  let clientNamespace = ChannelNamespace.make(
+    ~name=name ++ "ClientNS",
+    ~args={
+      apiId: api.apiId->Pulumi.Output.asInput,
+      name: clientNamespaceName->Pulumi.Input.make,
+      publishAuthModes: clientAuthModes,
+      subscribeAuthModes: clientAuthModes,
+    },
+    ~opts=Some({...opts, parent: api->Pulumi.Resource.makeFromJs}),
+  )
+
+  {name, api, defaultNamespace: Some(defaultNamespace), clientNamespace}
 }
 
 /** HTTP endpoint URL for use as Lambda `APPSYNC_ENDPOINT` env var.

package/src/adapter/Api/AppSync_EventsApi.res.mjs

@@ -17,6 +17,8 @@ function clearSubscribeAuth() {
   subscribeAuthRef.contents = undefined;
 }
 
+let clientNamespaceName = "client";
+
 function make(name, cognitoUserPoolId, awsRegion, opts) {
   let iamMode = {
     authType: AwsNative_AppSync_Api$PulumiAws.awsIam
@@ -69,10 +71,26 @@ function make(name, cognitoUserPoolId, awsRegion, opts) {
     codeHandlers: codeHandlersInput,
     handlerConfigs: handlerConfigsInput
   }, (newrecord.parent = api, newrecord));
+  let clientAuthModes = [
+    {
+      authType: AwsNative_AppSync_Api$PulumiAws.amazonCognitoUserPools
+    },
+    {
+      authType: AwsNative_AppSync_Api$PulumiAws.awsIam
+    }
+  ];
+  let newrecord$1 = {...opts};
+  let clientNamespace = new (AwsNative.appsync.ChannelNamespace)(name + "ClientNS", {
+    apiId: api.apiId,
+    name: clientNamespaceName,
+    publishAuthModes: clientAuthModes,
+    subscribeAuthModes: clientAuthModes
+  }, (newrecord$1.parent = api, newrecord$1));
   return {
     name: name,
     api: api,
-    defaultNamespace: defaultNamespace
+    defaultNamespace: defaultNamespace,
+    clientNamespace: clientNamespace
   };
 }
 
@@ -90,6 +108,7 @@ export {
   subscribeAuthRef,
   registerSubscribeAuth,
   clearSubscribeAuth,
+  clientNamespaceName,
   make,
   httpEndpoint,
 }

package/src/adapter/Upload/Upload_Presign_S3.res

@@ -25,13 +25,23 @@ type serviceOutputs = {
   resources: array<Pulumi.Output.t<string>>,
 }
 
+/**
+The prefix presigned object keys are rooted at, and therefore the prefix the
+store must be served under for the returned `/{key}` ref to resolve.
+
+Exported so the serve side reads the same constant the mint side writes. The two
+have to agree exactly: a mismatch deploys green and 404s every object, because
+nothing at deploy time compares a minted key against a cache behavior.
+*/
+let defaultServedPrefix = "uploads"
+
 let make = (
   ~bucketName: Pulumi.Input.t<string>,
   ~corsOrigins: array<string>=["*"],
   // Prefix the presigned object keys are rooted at; must match the served
   // bucket's CloudFront `{prefix}/*` behavior so the returned `/{key}` ref
-  // resolves. Defaults to `uploads`.
-  ~servedPrefix: string="uploads",
+  // resolves.
+  ~servedPrefix: string=defaultServedPrefix,
   ~opts=?,
 ): serviceOutputs => {
   let serviceName = "UploadPresignService"

package/src/adapter/Upload/Upload_Presign_S3.res.mjs

@@ -12,9 +12,11 @@ import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/sr
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 
+let defaultServedPrefix = "uploads";
+
 function make(bucketName, corsOriginsOpt, servedPrefixOpt, opts) {
   let corsOrigins = corsOriginsOpt !== undefined ? corsOriginsOpt : ["*"];
-  let servedPrefix = servedPrefixOpt !== undefined ? servedPrefixOpt : "uploads";
+  let servedPrefix = servedPrefixOpt !== undefined ? servedPrefixOpt : defaultServedPrefix;
   let serviceName = "UploadPresignService";
   let opts$1 = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
   let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(serviceName, Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(serviceName, "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
@@ -102,6 +104,7 @@ function make(bucketName, corsOriginsOpt, servedPrefixOpt, opts) {
 }
 
 export {
+  defaultServedPrefix,
   make,
 }
 /* @pulumi/aws Not a pure module */

package/src/capability/Capability_Geocoding_AwsLocation.res

@@ -0,0 +1,51 @@
+// A geocoding place index, provisioned with the framework's house conventions
+// applied — the address-search backing for geo-point command inputs.
+//
+// Beyond the attribution tags every framework resource carries, this helper
+// exists to move two settings out of application code. `dataSource` picks the
+// geospatial data provider and `intendedUse` decides whether results may be
+// stored; between them they determine the licensing terms, the per-request
+// price, and how long returned data may be retained. Those are deployment
+// decisions — a change of provider can be a contractual matter — so they read
+// from deploy-time config the way the host-shell's custom domain does, rather
+// than being literals in an app's `Main.res`.
+//
+// Config keys (env var `REVENTLESS_<SCREAMING_SNAKE>` → `Pulumi.local.yaml`,
+// see `Util_LocalConfig`):
+//   - `geocoderDataSource`  — "Esri" | "Grab" | "Here". Default "Esri".
+//   - `geocoderIntendedUse` — "SingleUse" | "Storage". Default "SingleUse".
+//
+// The defaults reproduce what deployments wrote by hand, so adopting this
+// helper is not a licensing-tier change.
+
+open PulumiAws
+
+let defaultDataSource = "Esri"
+let defaultIntendedUse = "SingleUse"
+
+/** Create a place index with framework attribution tags and config-driven
+    provider/retention settings. */
+let make = (~name: string, ~opts: option<Pulumi.CustomResourceOptions.t>=?): ReventlessInfra.Platform.geocoderIndex => {
+  let dataSource = Util_LocalConfig.get("geocoderDataSource")->Option.getOr(defaultDataSource)
+  let intendedUse = Util_LocalConfig.get("geocoderIntendedUse")->Option.getOr(defaultIntendedUse)
+
+  let index = Location.PlaceIndex.make(
+    ~name,
+    ~args={
+      indexName: Pulumi.Input.make(name),
+      dataSource: Pulumi.Input.make(dataSource),
+      dataSourceConfiguration: Pulumi.Input.make({
+        Location.PlaceIndex.intendedUse: Pulumi.Input.make(intendedUse),
+      }),
+      tags: AWS.Tags.make(
+        ~name,
+        ~kind=ReventlessCore.ComponentType.Platform,
+        ~role=Other("Geocoder"),
+        ~scope=Platform,
+      ),
+    },
+    ~opts?,
+  )
+
+  {indexName: index.indexName->Pulumi.Output.asInput}
+}

package/src/capability/Capability_Geocoding_AwsLocation.res.mjs

@@ -0,0 +1,37 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as AWS_Tags$ReventlessAws from "../adapter/AWS_Tags.res.mjs";
+import * as Util_LocalConfig$ReventlessAws from "../util/Util_LocalConfig.res.mjs";
+
+let defaultDataSource = "Esri";
+
+let defaultIntendedUse = "SingleUse";
+
+function make(name, opts) {
+  let dataSource = Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("geocoderDataSource"), defaultDataSource);
+  let intendedUse = Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("geocoderIntendedUse"), defaultIntendedUse);
+  let index = new (Aws.location.PlaceIndex)(name, {
+    indexName: name,
+    dataSource: dataSource,
+    dataSourceConfiguration: {
+      intendedUse: intendedUse
+    },
+    tags: AWS_Tags$ReventlessAws.make(name, "Platform", {
+      TAG: "Other",
+      _0: "Geocoder"
+    }, "Platform", undefined, undefined, undefined, undefined)
+  }, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined);
+  return {
+    indexName: index.indexName
+  };
+}
+
+export {
+  defaultDataSource,
+  defaultIntendedUse,
+  make,
+}
+/* @pulumi/aws Not a pure module */

package/src/capability/Capability_ObjectStore_S3.res

@@ -0,0 +1,84 @@
+// An object store, provisioned with the framework's house conventions applied.
+//
+// Deployments used to hand-write this bucket with raw Pulumi, which meant every
+// convention the framework applies to its own buckets had to be remembered by
+// hand — and the attribution tags in particular were routinely forgotten. Tags
+// are not cosmetic here: operational tooling discovers a platform's resources
+// *only* through `reventless:platform` + `reventless:environment` tag filters
+// against the Resource Groups Tagging API, so an untagged bucket is invisible
+// to it. A store wipe would then leave every uploaded object behind while the
+// events referencing them are gone.
+//
+// The returned record is what `deployPlatform`'s `~hostUiBundle` takes, so the
+// bucket is described once and both the write path (presigned PUTs) and the
+// read path (served read-only from the UI origin) are derived from it.
+//
+// Encryption and versioning are deliberately left at the account/AWS defaults,
+// matching the framework's own buckets (`TaskBucket_S3`, the plugin bundle
+// bucket): S3 applies AES256 to new buckets by default, and versioning is
+// one-way — once enabled it can be suspended but never removed — so it changes
+// both cost and delete semantics and belongs to a deployment's judgement rather
+// than to a framework default.
+//
+// Follow-up, once a store's lifecycle follows a declaration rather than an
+// explicit line of app code: `protect` / `retainOnDelete`, so an accidental
+// removal of that declaration cannot destroy a bucket holding live objects.
+
+open PulumiAws
+
+// Browser direct-PUT needs CORS. These defaults match what deployments wrote by
+// hand; `~corsRules` overrides them for a store the browser never touches.
+let defaultCorsRules: S3.Bucket.corsRules = [
+  {
+    S3.Bucket.allowedHeaders: ["*"],
+    allowedMethods: ["HEAD", "GET", "PUT", "POST"],
+    allowedOrigins: ["*"],
+    exposeHeaders: ["ETag"],
+    maxAgeSeconds: 3000,
+  },
+]
+
+/** Create an object store bucket with framework attribution tags and an
+    all-true public-access block. */
+let make = (
+  ~name: string,
+  ~corsRules: S3.Bucket.corsRules=defaultCorsRules,
+  ~opts: option<Pulumi.CustomResourceOptions.t>=?,
+): ReventlessInfra.Platform.objectStore => {
+  let bucket = S3.Bucket.make(
+    ~name,
+    ~args={
+      corsRules: corsRules->Pulumi.Input.make,
+      tags: AWS.Tags.make(
+        ~name,
+        ~kind=ReventlessCore.ComponentType.Platform,
+        ~role=Other("ObjectStore"),
+        ~scope=Platform,
+      ),
+    },
+    ~opts?,
+  )
+
+  // A served store is read through the UI's CDN via an origin access control,
+  // never directly, so it keeps its own all-true public-access block. Account
+  // level S3 defaults happen to cover this today, which makes its absence a
+  // latent gap rather than a live exposure — but one that turns live the moment
+  // an account default changes.
+  let _pab = S3.BucketPublicAccessBlock.make(
+    ~name=name ++ "-pab",
+    ~args={
+      bucket: bucket.id->Pulumi.Output.asInput,
+      blockPublicAcls: Pulumi.Input.make(true),
+      blockPublicPolicy: Pulumi.Input.make(true),
+      ignorePublicAcls: Pulumi.Input.make(true),
+      restrictPublicBuckets: Pulumi.Input.make(true),
+    },
+  )
+
+  {
+    bucketName: bucket.bucket->Pulumi.Output.asInput,
+    bucketId: bucket.id->Pulumi.Output.asInput,
+    bucketArn: bucket.arn->Pulumi.Output.asInput,
+    bucketRegionalDomainName: bucket.bucketRegionalDomainName->Pulumi.Output.asInput,
+  }
+}

package/src/capability/Capability_ObjectStore_S3.res.mjs

@@ -0,0 +1,48 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as AWS_Tags$ReventlessAws from "../adapter/AWS_Tags.res.mjs";
+
+let defaultCorsRules = [{
+    allowedHeaders: ["*"],
+    allowedMethods: [
+      "HEAD",
+      "GET",
+      "PUT",
+      "POST"
+    ],
+    allowedOrigins: ["*"],
+    exposeHeaders: ["ETag"],
+    maxAgeSeconds: 3000
+  }];
+
+function make(name, corsRulesOpt, opts) {
+  let corsRules = corsRulesOpt !== undefined ? corsRulesOpt : defaultCorsRules;
+  let bucket = new (Aws.s3.Bucket)(name, {
+    corsRules: corsRules,
+    tags: AWS_Tags$ReventlessAws.make(name, "Platform", {
+      TAG: "Other",
+      _0: "ObjectStore"
+    }, "Platform", undefined, undefined, undefined, undefined)
+  }, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined);
+  new (Aws.s3.BucketPublicAccessBlock)(name + "-pab", {
+    bucket: bucket.id,
+    blockPublicAcls: true,
+    blockPublicPolicy: true,
+    ignorePublicAcls: true,
+    restrictPublicBuckets: true
+  });
+  return {
+    bucketName: bucket.bucket,
+    bucketId: bucket.id,
+    bucketArn: bucket.arn,
+    bucketRegionalDomainName: bucket.bucketRegionalDomainName
+  };
+}
+
+export {
+  defaultCorsRules,
+  make,
+}
+/* @pulumi/aws Not a pure module */