@reventlessdev/reventless-aws 3.0.0-alpha.238 → 3.0.0-alpha.240

package/src/adapter/Upload/Upload_Presign_S3.res

@@ -42,9 +42,19 @@ let make = (
   // bucket's CloudFront `{prefix}/*` behavior so the returned `/{key}` ref
   // resolves.
   ~servedPrefix: string=defaultServedPrefix,
+  // Resource-name stem. Defaults to the single-service name this adapter had
+  // when a deployment could only have one store, so the existing service keeps
+  // its identity; declared stores each pass their own, because there is one
+  // service per store.
+  //
+  // One service per store rather than one service with wildcard write across
+  // stores: a single wide-scoped presigner reintroduces exactly the blast radius
+  // the per-store split exists to remove, and it does so invisibly — every
+  // upload still works.
+  ~name: string="UploadPresignService",
   ~opts=?,
 ): serviceOutputs => {
-  let serviceName = "UploadPresignService"
+  let serviceName = name
   let opts =
     opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
 
@@ -61,12 +71,18 @@ let make = (
   )
 
   // CloudWatch Logs (so failures are observable) plus least-privilege
-  // `s3:PutObject` on any key under the target bucket.
+  // `s3:PutObject` on this store's own keys.
+  //
+  // Scoped to `{bucket}/{servedPrefix}/*`, not to the whole bucket. Because keys
+  // are rooted at the store's prefix in *both* layouts, this one expression is
+  // least-privilege in both: a dedicated bucket's service still cannot write
+  // outside its prefix, and a shared bucket's services cannot write into each
+  // other's stores. The layouts stay one model — even the policy does not fork.
   let _policy =
     bucketName
     ->Pulumi.Output.fromInput
     ->Pulumi.Output.apply(b => {
-      let arn = `arn:aws:s3:::${b}/*`
+      let arn = `arn:aws:s3:::${b}/${servedPrefix}/*`
       let _ = IAM.RolePolicy.make(
         ~name=`${serviceName}Policy`,
         ~args={

package/src/adapter/Upload/Upload_Presign_S3.res.mjs

@@ -14,16 +14,16 @@ import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/
 
 let defaultServedPrefix = "uploads";
 
-function make(bucketName, corsOriginsOpt, servedPrefixOpt, opts) {
+function make(bucketName, corsOriginsOpt, servedPrefixOpt, nameOpt, opts) {
   let corsOrigins = corsOriginsOpt !== undefined ? corsOriginsOpt : ["*"];
   let servedPrefix = servedPrefixOpt !== undefined ? servedPrefixOpt : defaultServedPrefix;
-  let serviceName = "UploadPresignService";
+  let name = nameOpt !== undefined ? nameOpt : "UploadPresignService";
   let opts$1 = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
-  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(serviceName, Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(serviceName, "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
+  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name, "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   bucketName.apply(b => {
-    let arn = `arn:aws:s3:::` + b + `/*`;
-    new (Aws.iam.RolePolicy)(serviceName + `Policy`, {
-      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, serviceName + `Policy`, [
+    let arn = `arn:aws:s3:::` + b + `/` + servedPrefix + `/*`;
+    new (Aws.iam.RolePolicy)(name + `Policy`, {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `Policy`, [
         {
           Sid: "AllowLambdaLogging",
           Effect: "Allow",
@@ -50,7 +50,7 @@ function make(bucketName, corsOriginsOpt, servedPrefixOpt, opts) {
     ]]);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Presign_S3_Ops.res.mjs", packageDirs, undefined);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
-  let lambda = new (Aws.lambda.Function)(serviceName, {
+  let lambda = new (Aws.lambda.Function)(name, {
     handler: "index.handler",
     runtime: "nodejs22.x",
     code: match.code,
@@ -58,7 +58,7 @@ function make(bucketName, corsOriginsOpt, servedPrefixOpt, opts) {
     memorySize: 256,
     timeout: 30,
     layers: layers,
-    tags: AWS_Tags$ReventlessAws.make(serviceName, "Platform", "Runtime", "Platform", undefined, undefined, undefined, undefined),
+    tags: AWS_Tags$ReventlessAws.make(name, "Platform", "Runtime", "Platform", undefined, undefined, undefined, undefined),
     environment: {
       variables: Object.fromEntries([
         [
@@ -85,7 +85,7 @@ function make(bucketName, corsOriginsOpt, servedPrefixOpt, opts) {
     },
     sourceCodeHash: match.sourceCodeHash
   }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
-  let functionUrl = new (Aws.lambda.FunctionUrl)(serviceName + `Url`, {
+  let functionUrl = new (Aws.lambda.FunctionUrl)(name + `Url`, {
     authorizationType: "NONE",
     functionName: lambda.name,
     cors: {

package/src/capability/Capability_ObjectStore_S3.res

@@ -20,9 +20,20 @@
 // both cost and delete semantics and belongs to a deployment's judgement rather
 // than to a framework default.
 //
-// Follow-up, once a store's lifecycle follows a declaration rather than an
-// explicit line of app code: `protect` / `retainOnDelete`, so an accidental
-// removal of that declaration cannot destroy a bucket holding live objects.
+// A store's lifecycle now follows a *declaration*, which changes the risk. A
+// hand-written bucket could only be destroyed by editing a line of Pulumi; a
+// declared one can be destroyed by renaming a field, because the last
+// `@storageRef("productImages")` disappearing removes the requirement. Hence
+// `~protect`, on by default and turned off only for stacks that are routinely
+// torn down — see `Util_StoreLayout.protectionFor`, which decides that from
+// disposability rather than from the store's layout.
+//
+// Not to be confused with the framework's other buckets: a **store** is
+// declared by a field's type and holds values that events reference, so its
+// objects outlive any single deploy. A **task bucket** (`TaskBucket_S3`) is
+// wired by a slice and holds transient input, and the plugin-bundle and
+// host-ui-bundle buckets are hosting substrate. Neither has a `@storageRef`
+// field pointing at it, and neither is provisioned from a declaration.
 
 open PulumiAws
 
@@ -39,24 +50,62 @@ let defaultCorsRules: S3.Bucket.corsRules = [
 ]
 
 /** Create an object store bucket with framework attribution tags and an
-    all-true public-access block. */
+    all-true public-access block.
+
+    `~keyPrefix` is the path this store's object keys are rooted at; it travels
+    in the returned record so the mint side and the serve side read one value
+    instead of restating it.
+
+    `~plugin` attributes the store to the plugin whose field declared it. The
+    bucket is created by the platform deploy — that is where the serving CDN and
+    the presign services live, and where a shared bucket has a single owner — so
+    ownership is expressed in the tags rather than in which stack ran `make`.
+
+    `~protect` (default on) blocks `pulumi destroy` and accidental replacement.
+    `~forceDestroy` is its counterpart for disposable stacks: a protected bucket
+    cannot be torn down, so a PR stack would leak exactly the buckets that
+    sharing exists to save. */
 let make = (
   ~name: string,
+  ~keyPrefix: string=Upload_Presign_S3.defaultServedPrefix,
+  ~plugin: option<string>=?,
+  ~protect: bool=true,
+  ~forceDestroy: bool=false,
   ~corsRules: S3.Bucket.corsRules=defaultCorsRules,
   ~opts: option<Pulumi.CustomResourceOptions.t>=?,
 ): ReventlessInfra.Platform.objectStore => {
+  // A declared store is plugin substrate; the legacy hand-written store, which
+  // names no plugin, stays platform-scoped so its tags are unchanged.
+  let (kind, scope) = switch plugin {
+  | Some(_) => (
+      ReventlessCore.ComponentType.Plugin,
+      ReventlessCore.ResourceAttribution.Scope.Plugin,
+    )
+  | None => (
+      ReventlessCore.ComponentType.Platform,
+      ReventlessCore.ResourceAttribution.Scope.Platform,
+    )
+  }
+
+  let opts: Pulumi.CustomResourceOptions.t = {
+    ...opts->Option.getOr({}),
+    protect,
+  }
+
   let bucket = S3.Bucket.make(
     ~name,
     ~args={
       corsRules: corsRules->Pulumi.Input.make,
+      forceDestroy: forceDestroy->Pulumi.Input.make,
       tags: AWS.Tags.make(
         ~name,
-        ~kind=ReventlessCore.ComponentType.Platform,
+        ~kind,
         ~role=Other("ObjectStore"),
-        ~scope=Platform,
+        ~scope,
+        ~plugin?,
       ),
     },
-    ~opts?,
+    ~opts,
   )
 
   // A served store is read through the UI's CDN via an origin access control,
@@ -80,5 +129,18 @@ let make = (
     bucketId: bucket.id->Pulumi.Output.asInput,
     bucketArn: bucket.arn->Pulumi.Output.asInput,
     bucketRegionalDomainName: bucket.bucketRegionalDomainName->Pulumi.Output.asInput,
+    keyPrefix,
   }
 }
+
+/** The same bucket, addressed under a different key prefix.
+
+    A shared-layout stack puts every declared store in one bucket, so the bucket
+    is created once and each store is that bucket seen through its own prefix.
+    Splitting this out keeps the memoisation of "one bucket per physical name"
+    separate from "one store per declaration", which are different cardinalities
+    the moment a layout shares. */
+let underPrefix = (
+  store: ReventlessInfra.Platform.objectStore,
+  ~keyPrefix: string,
+): ReventlessInfra.Platform.objectStore => {...store, keyPrefix}

package/src/capability/Capability_ObjectStore_S3.res.mjs

@@ -1,8 +1,9 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Aws from "@pulumi/aws";
-import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as AWS_Tags$ReventlessAws from "../adapter/AWS_Tags.res.mjs";
+import * as Upload_Presign_S3$ReventlessAws from "../adapter/Upload/Upload_Presign_S3.res.mjs";
 
 let defaultCorsRules = [{
     allowedHeaders: ["*"],
@@ -17,15 +18,28 @@ let defaultCorsRules = [{
     maxAgeSeconds: 3000
   }];
 
-function make(name, corsRulesOpt, opts) {
+function make(name, keyPrefixOpt, plugin, protectOpt, forceDestroyOpt, corsRulesOpt, opts) {
+  let keyPrefix = keyPrefixOpt !== undefined ? keyPrefixOpt : Upload_Presign_S3$ReventlessAws.defaultServedPrefix;
+  let protect = protectOpt !== undefined ? protectOpt : true;
+  let forceDestroy = forceDestroyOpt !== undefined ? forceDestroyOpt : false;
   let corsRules = corsRulesOpt !== undefined ? corsRulesOpt : defaultCorsRules;
+  let match = plugin !== undefined ? [
+      "Plugin",
+      "Plugin"
+    ] : [
+      "Platform",
+      "Platform"
+    ];
+  let newrecord = {...Stdlib_Option.getOr(opts, {})};
+  newrecord.protect = protect;
   let bucket = new (Aws.s3.Bucket)(name, {
     corsRules: corsRules,
-    tags: AWS_Tags$ReventlessAws.make(name, "Platform", {
+    forceDestroy: forceDestroy,
+    tags: AWS_Tags$ReventlessAws.make(name, match[0], {
       TAG: "Other",
       _0: "ObjectStore"
-    }, "Platform", undefined, undefined, undefined, undefined)
-  }, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined);
+    }, match[1], undefined, undefined, plugin, undefined)
+  }, newrecord);
   new (Aws.s3.BucketPublicAccessBlock)(name + "-pab", {
     bucket: bucket.id,
     blockPublicAcls: true,
@@ -37,12 +51,24 @@ function make(name, corsRulesOpt, opts) {
     bucketName: bucket.bucket,
     bucketId: bucket.id,
     bucketArn: bucket.arn,
-    bucketRegionalDomainName: bucket.bucketRegionalDomainName
+    bucketRegionalDomainName: bucket.bucketRegionalDomainName,
+    keyPrefix: keyPrefix
+  };
+}
+
+function underPrefix(store, keyPrefix) {
+  return {
+    bucketName: store.bucketName,
+    bucketId: store.bucketId,
+    bucketArn: store.bucketArn,
+    bucketRegionalDomainName: store.bucketRegionalDomainName,
+    keyPrefix: keyPrefix
   };
 }
 
 export {
   defaultCorsRules,
   make,
+  underPrefix,
 }
 /* @pulumi/aws Not a pure module */

package/src/plugin/stack/Plugin_Stack.res

@@ -225,17 +225,26 @@ let makeUiBundleDistribution = (
   // CachingOptimized policy is safe. Prepended to `orderedCacheBehaviors` so a
   // served path is matched before the SPA-serving default behavior and never
   // routed to the bundle bucket.
-  let servedOriginId = (prefix: string): string => "served-" ++ prefix
-  let servedCacheBehavior = (prefix: string): PulumiAws.CloudFront.Distribution.orderedCacheBehavior => {
+  let servedOriginId = (id: string): string => "served-" ++ id
+  let servedCacheBehavior = (
+    ~prefix: string,
+    ~originId: string,
+  ): PulumiAws.CloudFront.Distribution.orderedCacheBehavior => {
     pathPattern: Pulumi.Input.make(prefix ++ "/*"),
-    targetOriginId: Pulumi.Input.make(servedOriginId(prefix)),
+    targetOriginId: Pulumi.Input.make(originId),
     viewerProtocolPolicy: Pulumi.Input.make("redirect-to-https"),
     allowedMethods: Pulumi.Input.make(["GET", "HEAD"]),
     cachedMethods: Pulumi.Input.make(["GET", "HEAD"]),
     cachePolicyId: Pulumi.Input.make(cachingOptimizedPolicyId),
   }
   let orderedCacheBehaviors = Array.concat(
-    servedBuckets->Array.map(sb => servedCacheBehavior(sb.prefix)),
+    // One behavior per served prefix; several prefixes may share one origin when
+    // they live in the same bucket.
+    servedBuckets->Array.flatMap(sb =>
+      sb.prefixes->Array.map(prefix =>
+        servedCacheBehavior(~prefix, ~originId=servedOriginId(sb.id))
+      )
+    ),
     Array.concat(
       [noCacheBehavior("/remoteEntry.js")],
       spaFallback ? [noCacheBehavior("/" ++ indexDocument), noCacheBehavior("/config.json")] : [],
@@ -336,7 +345,7 @@ let makeUiBundleDistribution = (
             // per-bucket read grant is the served bucket's own BucketPolicy below).
             servedBuckets->Array.map(sb => {
               PulumiAws.CloudFront.Distribution.domainName: sb.bucketRegionalDomainName,
-              originId: Pulumi.Input.make(servedOriginId(sb.prefix)),
+              originId: Pulumi.Input.make(servedOriginId(sb.id)),
               originAccessControlId: Pulumi.Input.make(oacId),
             }),
           )
@@ -432,9 +441,13 @@ let makeUiBundleDistribution = (
   // object is fetchable at `https://<ui-domain>/{prefix}/<key>` while the bucket
   // stays private (direct S3 GET is 403). Mirrors the bundle bucket policy above;
   // the served bucket keeps its own all-true BucketPublicAccessBlock (app-owned).
+  //
+  // Exactly one policy per bucket — S3 permits no more. Grouping prefixes into
+  // one `servedBucket` is what makes that structural rather than a rule to
+  // remember.
   servedBuckets->Array.forEach(sb => {
     let _ = PulumiAws.S3.BucketPolicy.make(
-      ~name=name ++ "-served-" ++ sb.prefix ++ "-policy",
+      ~name=name ++ "-served-" ++ sb.id ++ "-policy",
       ~args={
         bucket: sb.bucketId,
         policy: (sb.bucketArn->Pulumi.Output.fromInput, distribution.arn)

package/src/plugin/stack/Plugin_Stack.res.mjs

@@ -119,11 +119,11 @@ function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbac
     ],
     cachePolicyId: cachingDisabledPolicyId
   });
-  let orderedCacheBehaviors = servedBuckets.map(sb => {
-    let prefix = sb.prefix;
+  let orderedCacheBehaviors = servedBuckets.flatMap(sb => sb.prefixes.map(prefix => {
+    let originId = "served-" + sb.id;
     return {
       pathPattern: prefix + "/*",
-      targetOriginId: "served-" + prefix,
+      targetOriginId: originId,
       viewerProtocolPolicy: "redirect-to-https",
       allowedMethods: [
         "GET",
@@ -135,7 +135,7 @@ function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbac
       ],
       cachePolicyId: cachingOptimizedPolicyId
     };
-  }).concat([noCacheBehavior("/remoteEntry.js")].concat(spaFallback ? [
+  })).concat([noCacheBehavior("/remoteEntry.js")].concat(spaFallback ? [
       noCacheBehavior("/" + indexDocument),
       noCacheBehavior("/config.json")
     ] : []));
@@ -188,7 +188,7 @@ function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbac
           originAccessControlId: oacId
         }].concat(servedBuckets.map(sb => ({
         domainName: sb.bucketRegionalDomainName,
-        originId: "served-" + sb.prefix,
+        originId: "served-" + sb.id,
         originAccessControlId: oacId
       })));
     }),
@@ -253,7 +253,7 @@ function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbac
     }))
   });
   servedBuckets.forEach(sb => {
-    new (Aws.s3.BucketPolicy)(name + "-served-" + sb.prefix + "-policy", {
+    new (Aws.s3.BucketPolicy)(name + "-served-" + sb.id + "-policy", {
       bucket: sb.bucketId,
       policy: Pulumi.all([
         sb.bucketArn,

package/src/util/Util_HostUiDomain.res

@@ -26,3 +26,20 @@ let parseProdStacks = (csv: string): array<string> =>
   ->String.split(",")
   ->Array.map(String.trim)
   ->Array.filter(s => s !== "")
+
+/**
+The stacks this deployment considers production, resolved from config.
+
+The one notion of "is this stack production", deliberately shared rather than
+answered twice. Domain naming asked it first; object-store layout asks it too,
+and a second key would be two flags that can disagree — the state where a stack
+gets a production domain and non-production storage, or the reverse, with
+nothing to flag the mismatch.
+
+Impure by necessity (it reads config); the derivations that consume it stay
+pure and unit-tested.
+*/
+let resolveProdStacks = (): array<string> =>
+  Util_LocalConfig.get("hostUiProdStacks")
+  ->Option.map(parseProdStacks)
+  ->Option.getOr(defaultProdStacks)

package/src/util/Util_HostUiDomain.res.mjs

@@ -1,5 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Util_LocalConfig$ReventlessAws from "./Util_LocalConfig.res.mjs";
 
 let defaultProdStacks = [
   "prod",
@@ -18,9 +20,14 @@ function parseProdStacks(csv) {
   return csv.split(",").map(prim => prim.trim()).filter(s => s !== "");
 }
 
+function resolveProdStacks() {
+  return Stdlib_Option.getOr(Stdlib_Option.map(Util_LocalConfig$ReventlessAws.get("hostUiProdStacks"), parseProdStacks), defaultProdStacks);
+}
+
 export {
   defaultProdStacks,
   deriveFqdn,
   parseProdStacks,
+  resolveProdStacks,
 }
-/* No side effect */
+/* Util_LocalConfig-ReventlessAws Not a pure module */

package/src/util/Util_StoreLayout.res

@@ -0,0 +1,104 @@
+// How a stack lays out the object stores its plugins declare, and how hard it
+// protects them. Pure functions so both decisions are decidable and unit-
+// testable without touching Pulumi — the same shape `Util_HostUiDomain` uses
+// for the host-shell FQDN.
+//
+// Two decisions, deliberately independent:
+//
+//   layout      — one bucket per store, or one bucket per stack with `{store}/…`
+//                 prefixes inside it
+//   protection  — whether an accidental removal may destroy the store
+//
+// It is tempting to make one switch decide both, and that is wrong. `alpha`
+// shares a bucket *and* holds hand-entered data worth protecting; a `pr-*`
+// stack shares a bucket and must be destroyable or teardown leaks exactly the
+// buckets sharing exists to save. Layout answers "how many buckets"; protection
+// answers "is this data disposable". Those are different questions about the
+// same stack.
+//
+// Why production alone gets per-store buckets: the growth term is
+// `plugins × stores × stacks`, and stacks is the factor that actually grows —
+// the stack allowlist admits `pr-*`, so per-PR environments multiply every
+// plugin's every store against a 100-bucket account default. Production does
+// not multiply. It is also the only environment where a bucket boundary (rather
+// than a prefix boundary) is worth its cost, since the honest price of sharing
+// is that per-store least-privilege degrades from a bucket ARN to a prefix ARN.
+
+/** How many buckets a stack's declared stores get. */
+type t =
+  | PerStore
+  | SharedBucket
+
+/** Whether a store may be destroyed by an accidental removal. */
+type protection =
+  | Protected
+  | Unprotected
+
+/**
+Stack-name prefixes whose stacks are disposable.
+
+`pr-*` matches the stack allowlist's per-PR environments. A prefix rather than
+an exact list because the whole point of these stacks is that nobody enumerates
+them in advance.
+*/
+let defaultEphemeralPrefixes = ["pr-"]
+
+/**
+Production gets a bucket per store; every other stack shares one.
+
+`prodStacks` comes from `Util_HostUiDomain.resolveProdStacks` — the same notion
+of "production" that names the host-shell domain, on purpose.
+
+Note this polarity **fails open**: a new production stack whose name is not on
+the list (`production`, `live`, `prod-eu`) silently gets the weaker layout and
+nothing errors. That is the accepted cost of keying off a name allowlist, paid
+down by the list being config-overridable and by the deploy logging the layout
+it chose — a silent fail-open is only dangerous while it is silent.
+*/
+let layoutFor = (~stack: string, ~prodStacks: array<string>): t =>
+  prodStacks->Array.includes(stack) ? PerStore : SharedBucket
+
+/**
+Destroy semantics follow disposability, **not** layout.
+
+`alpha` shares a bucket and is still protected: it declares
+`reventless:wipeable`, but that authorises the reset tool to empty stores
+*deliberately*, after a scope prompt and a typed confirmation. It does not say a
+field rename may destroy a bucket by accident. Only stacks that are routinely
+torn down are unprotected.
+*/
+let protectionFor = (~stack: string, ~ephemeralPrefixes: array<string>=defaultEphemeralPrefixes): protection =>
+  ephemeralPrefixes->Array.some(p => stack->String.startsWith(p)) ? Unprotected : Protected
+
+/**
+The bucket a store's objects live in.
+
+Per-store: `{plugin}-{store}`, so the physical name traces back to the
+declaration that required it — a store rename becomes a visible replace in
+review rather than a silent one. Shared: one `{stack}-stores` bucket for every
+declared store on the stack.
+
+Pulumi appends its own suffix for global uniqueness, so neither form has to
+carry an account or region discriminator.
+*/
+let bucketNameFor = (~layout: t, ~stack: string, ~plugin: string, ~store: string): string =>
+  switch layout {
+  | PerStore => `${plugin}-${store}`
+  | SharedBucket => `${stack}-stores`
+  }
+
+/**
+The prefix a store's object keys are rooted at — the store name, in **both**
+layouts.
+
+This is the property that keeps the two layouts one model rather than a fork.
+The presign service mints `{store}/{identity}{uuid}/{file}` either way, so the
+stored ref is `/{store}/…` regardless of which bucket sits behind it, and only
+the CDN origin differs. Refs live in an append-only event log: one that encoded
+its bucket layout would be environment-specific and unrewritable, so a prod dump
+restored into a PR stack would carry refs that cannot resolve.
+
+The cost is a slightly redundant prefix inside a dedicated bucket
+(`catalog-productImages/productImages/…`). Take the redundancy.
+*/
+let keyPrefixFor = (~store: string): string => store

package/src/util/Util_StoreLayout.res.mjs

@@ -0,0 +1,42 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+let defaultEphemeralPrefixes = ["pr-"];
+
+function layoutFor(stack, prodStacks) {
+  if (prodStacks.includes(stack)) {
+    return "PerStore";
+  } else {
+    return "SharedBucket";
+  }
+}
+
+function protectionFor(stack, ephemeralPrefixesOpt) {
+  let ephemeralPrefixes = ephemeralPrefixesOpt !== undefined ? ephemeralPrefixesOpt : defaultEphemeralPrefixes;
+  if (ephemeralPrefixes.some(p => stack.startsWith(p))) {
+    return "Unprotected";
+  } else {
+    return "Protected";
+  }
+}
+
+function bucketNameFor(layout, stack, plugin, store) {
+  if (layout === "PerStore") {
+    return plugin + `-` + store;
+  } else {
+    return stack + `-stores`;
+  }
+}
+
+function keyPrefixFor(store) {
+  return store;
+}
+
+export {
+  defaultEphemeralPrefixes,
+  layoutFor,
+  protectionFor,
+  bucketNameFor,
+  keyPrefixFor,
+}
+/* No side effect */