@reventlessdev/reventless-aws 3.0.0-alpha.239 → 3.0.0-alpha.241

package/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.241 (2026-07-29)
+
+### Features
+
+* **platform:** serve and publish declared object stores without a host UI ([9cc4700](https://github.com/ReventlessDev/reventless-core/commit/9cc4700dc96f05e3d35fbc912a4c7be7a5531337))
+
+
+# 3.0.0-alpha.240 (2026-07-28)
+
+### Features
+
+* **platform:** provision object stores from the fields that declare them ([b5e2a1e](https://github.com/ReventlessDev/reventless-core/commit/b5e2a1ec88099941c113e4963f9c4b346b96b0d6))
+
+
 # 3.0.0-alpha.239 (2026-07-28)
 
 **Note:** Version bump only for package @reventlessdev/reventless-aws

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.239",
+  "version": "3.0.0-alpha.241",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -13,15 +13,15 @@
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.25",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.31",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.61",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.17",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.189",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.107",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.29",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.17",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.53",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.82"
+    "@reventlessdev/reventless-core": "3.0.0-alpha.190",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.108",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.29",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.54",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.83"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -44,6 +44,40 @@ let splitApiOutputsRef: ref<option<splitApiOutputs>> = ref(None)
     Call after `makePlatform` — returns `None` in unified mode. */
 let getSplitApiOutputs = () => splitApiOutputsRef.contents
 
+// Object stores provisioned from field declarations — populated by
+// deployPlatform. Access via getObjectStoreEndpoints() after it has been called.
+//
+// A platform whose UI ships from its own stack needs each store's presign
+// endpoint, and `deployPlatform` is the only place that knows it. Without this
+// the store is provisioned and unnameable: the stores are built unconditionally,
+// but every consumer of them used to sit inside `switch hostUiBundle`. Same
+// reason `getSplitApiOutputs` exists — a root cannot re-export what it cannot
+// reach.
+type objectStoreEndpoint = {
+  // The store's qualified `{plugin}.{store}` name. The same string
+  // `pluginStructure.requiredStores` carries, so a UI's binding key and the
+  // declaration's identity are one value rather than two that can drift.
+  store: string,
+  // The path this store's keys are rooted at, and therefore the path it must be
+  // served under for a minted `/{key}` ref to resolve.
+  keyPrefix: string,
+  bucketName: string,
+  uploadUrl: Pulumi.Output.t<string>,
+  // Public base URL the store is served from, when the platform serves it
+  // itself. `None` when a host-UI bundle is deployed — there the shell's own
+  // origin serves the store same-origin and a relative `/{prefix}/…` resolves
+  // without a base.
+  baseUrl: option<Pulumi.Output.t<string>>,
+}
+let objectStoreEndpointsRef: ref<array<objectStoreEndpoint>> = ref([])
+
+/** Returns the object stores this platform provisioned from field declarations.
+
+    Empty when nothing is declared — a legitimate answer rather than a
+    call-order mistake, so this returns `[]` instead of throwing the way
+    `getApiConfig` does. */
+let getObjectStoreEndpoints = () => objectStoreEndpointsRef.contents
+
 module MakeWithConfig = (
   Config: {
     let splitApi: bool
@@ -1046,7 +1080,11 @@ module MakeWithConfig = (
     platformMergeGate: Pulumi.Output.t<unit>,
   }
 
-  let deployPlatform = (~version, ~hostUiBundle: option<hostUiBundleConfig>=?) => {
+  let deployPlatform = (
+    ~version,
+    ~hostUiBundle: option<hostUiBundleConfig>=?,
+    ~capabilities: array<ReventlessInfra.Platform.capability>=[],
+  ) => {
     log.info(~comp="Platform:deployPlatform", `v${version}`)
     let scheduler = makeScheduler()
     hooks.scheduler := Some(scheduler)
@@ -1452,6 +1490,205 @@ module MakeWithConfig = (
         })
       })
 
+    // ── Declared object stores ────────────────────────────────────────────
+    //
+    // The store a field declares is the store that gets provisioned. Before
+    // this, a `@storageRef("productImages")` annotation and a hand-written
+    // bucket name were two unrelated strings: deleting the annotation left the
+    // bucket, and adding one provisioned nothing.
+    //
+    // Provisioned here, in the platform deploy, rather than in each plugin's
+    // stack. Three things force it: the serving CDN lives here, the presign
+    // services live here, and a shared-layout bucket has several plugins'
+    // stores in it, so no single plugin stack can own it. Ownership is carried
+    // in the tags instead — a per-store bucket is tagged to the plugin whose
+    // field declared it; a shared bucket is platform substrate, because that is
+    // what it is.
+    let stackName = Pulumi.Pulumi.getStackName()
+    let storeLayout = Util_StoreLayout.layoutFor(
+      ~stack=stackName,
+      ~prodStacks=Util_HostUiDomain.resolveProdStacks(),
+    )
+    let storeProtection = Util_StoreLayout.protectionFor(~stack=stackName)
+
+    // Dedup by `(plugin, store)` — that pair is a store's identity, and many
+    // fields legitimately name one store.
+    let declaredStores =
+      capabilities
+      ->Array.filterMap(c =>
+        switch c {
+        | ObjectStore({plugin, store}) => Some((plugin, store))
+        | Geocoding => None
+        }
+      )
+      ->Array.reduce([], (acc, (plugin, store)) =>
+        acc->Array.some(((p, s)) => p == plugin && s == store)
+          ? acc
+          : Array.concat(acc, [(plugin, store)])
+      )
+
+    if declaredStores->Array.length > 0 {
+      // The fail-open in `layoutFor` is only dangerous while it is silent: a
+      // production stack that is not on the prod list gets the shared layout and
+      // nothing errors. Log the choice on every deploy so it surfaces the first
+      // time it happens rather than at an audit.
+      log.info(
+        ~comp="Platform:deployPlatform",
+        `object stores: ${switch storeLayout {
+          | PerStore => "bucket per store"
+          | SharedBucket => "shared bucket, {store}/… prefixes"
+          }}, ${switch storeProtection {
+          | Protected => "protected"
+          | Unprotected => "unprotected (disposable stack)"
+          }} — stack ${stackName}`,
+      )
+    }
+
+    // One bucket per *physical name*, which is one per store under `PerStore`
+    // and one for the whole stack under `SharedBucket`. Grouped rather than
+    // mapped because those cardinalities differ, and a bucket carries only one
+    // policy and one CDN origin however many stores live in it.
+    let storeBuckets: Dict.t<ReventlessInfra.Platform.objectStore> = Dict.make()
+    let storeBucketOrder: array<string> = []
+    let declaredStoreServices = declaredStores->Array.map(((plugin, store)) => {
+      let bucketName = Util_StoreLayout.bucketNameFor(
+        ~layout=storeLayout,
+        ~stack=stackName,
+        ~plugin,
+        ~store,
+      )
+      let keyPrefix = Util_StoreLayout.keyPrefixFor(~store)
+      let bucket = switch storeBuckets->Dict.get(bucketName) {
+      | Some(b) => b
+      | None =>
+        let b = Capability_ObjectStore_S3.make(
+          ~name=bucketName,
+          ~keyPrefix,
+          // A shared bucket belongs to no single plugin; a dedicated one does.
+          ~plugin=?switch storeLayout {
+          | PerStore => Some(plugin)
+          | SharedBucket => None
+          },
+          ~protect=storeProtection == Protected,
+          // A protected bucket blocks `pulumi destroy`, so protecting a
+          // disposable stack would leak exactly the buckets sharing exists to
+          // save. The two settings are opposite faces of one decision.
+          ~forceDestroy=storeProtection == Unprotected,
+        )
+        storeBuckets->Dict.set(bucketName, b)
+        storeBucketOrder->Array.push(bucketName)
+        b
+      }
+      let storeHandle = bucket->Capability_ObjectStore_S3.underPrefix(~keyPrefix)
+      // One presign service per store, scoped to that store's own prefix.
+      let presign = Upload_Presign_S3.make(
+        ~name=`UploadPresign-${plugin}-${store}`,
+        ~bucketName=storeHandle.bucketName,
+        ~servedPrefix=storeHandle.keyPrefix,
+      )
+      (`${plugin}.${store}`, keyPrefix, bucketName, presign.url)
+    })
+
+    // Group the served view by bucket: one origin and one bucket policy per
+    // bucket, carrying every prefix served from it.
+    let declaredServedBuckets = storeBucketOrder->Array.filterMap(bucketName =>
+      storeBuckets
+      ->Dict.get(bucketName)
+      ->Option.map(b => {
+        ReventlessInfra.Platform.id: bucketName,
+        prefixes: declaredStoreServices
+        ->Array.filterMap(((_, prefix, bn, _)) => bn == bucketName ? Some(prefix) : None),
+        bucketId: b.bucketId,
+        bucketArn: b.bucketArn,
+        bucketRegionalDomainName: b.bucketRegionalDomainName,
+      })
+    )
+
+    // ── Serving the declared stores ───────────────────────────────────────
+    //
+    // A store's bucket blocks public policy and takes its read grant only from
+    // a distribution's BucketPolicy, so "provisioned" and "readable" are two
+    // different things. When a host UI bundle is deployed, its distribution
+    // fronts the stores same-origin (below) and a relative `/{prefix}/…`
+    // resolves with no base URL. When it is not, the platform fronts them
+    // itself — otherwise every declared store is write-only.
+    //
+    // Never both: two distributions fronting one bucket would each write the
+    // bucket's single allowed policy and silently unpick the other's grant.
+    // `Util_StoreLayout.servingFor` is where that exclusion is decided, so it is
+    // one testable choice rather than a condition spelled out here.
+    let storeServingBaseUrl: option<Pulumi.Output.t<string>> = switch Util_StoreLayout.servingFor(
+      ~hasHostUiBundle=hostUiBundle->Option.isSome,
+      ~declaredBucketCount=declaredServedBuckets->Array.length,
+    ) {
+    | NoStores | HostShell => None
+    | PlatformOwned =>
+      Some(
+        Plugin_Stack.makeServedBucketDistribution(
+          ~name="object-stores",
+          ~servedBuckets=declaredServedBuckets,
+        ),
+      )
+    }
+
+    let declaredStoreEndpoints = declaredStoreServices->Array.map(((
+      store,
+      keyPrefix,
+      bucketName,
+      uploadUrl,
+    )) => {store, keyPrefix, bucketName, uploadUrl, baseUrl: storeServingBaseUrl})
+    objectStoreEndpointsRef := declaredStoreEndpoints
+
+    // Exported unconditionally — the provisioning above already is. Their only
+    // consumers used to sit inside `switch hostUiBundle`, which left a platform
+    // whose UI ships from another stack holding stores it could not name.
+    //
+    // Omitted entirely when nothing is declared, so a deployment with no
+    // declared store keeps a byte-identical output set.
+    if declaredStoreEndpoints->Array.length > 0 {
+      Pulumi.Pulumi.export(
+        "uploadEndpoints",
+        declaredStoreEndpoints
+        ->Array.map(e => e.uploadUrl->Pulumi.Output.apply(u => (e.store, JSON.Encode.string(u))))
+        ->Pulumi.Output.all
+        ->Pulumi.Output.apply(pairs => pairs->Dict.fromArray->JSON.Encode.object),
+      )
+      Pulumi.Pulumi.export(
+        "objectStores",
+        declaredStoreEndpoints
+        ->Array.map(e =>
+          switch e.baseUrl {
+          | Some(u) => u->Pulumi.Output.apply(b => (e, Some(b)))
+          | None => Pulumi.Output.make((e, None))
+          }
+        )
+        ->Pulumi.Output.all
+        ->Pulumi.Output.apply(pairs =>
+          pairs
+          ->Array.map(((e, baseUrl)) => (
+            e.store,
+            [
+              ("bucketName", JSON.Encode.string(e.bucketName)),
+              ("keyPrefix", JSON.Encode.string(e.keyPrefix)),
+            ]
+            // Absent when the host shell serves the store: there the object is
+            // addressable same-origin and a base URL would be a second, and
+            // wrong, way to reach it.
+            ->Array.concat(
+              switch baseUrl {
+              | Some(b) => [("baseUrl", JSON.Encode.string(b))]
+              | None => []
+              },
+            )
+            ->Dict.fromArray
+            ->JSON.Encode.object,
+          ))
+          ->Dict.fromArray
+          ->JSON.Encode.object
+        ),
+      )
+    }
+
     // Host UI shell deployment — opt-in via ~hostUiBundle. The shell SPA is
     // hosted on its own CloudFront distribution; `config.json` is generated
     // at deploy time with the resolved API endpoints, region, and Cognito
@@ -1494,17 +1731,27 @@ module MakeWithConfig = (
       // roots its keys at, read from the service's own constant. This is the
       // whole reason the store arrives as one value: the app no longer restates
       // the prefix, so it cannot restate it wrongly.
-      let servedBuckets = switch cfg.uploadBucket {
-      | Some(store) => [
-          {
-            ReventlessInfra.Platform.prefix: Upload_Presign_S3.defaultServedPrefix,
-            bucketId: store.bucketId,
-            bucketArn: store.bucketArn,
-            bucketRegionalDomainName: store.bucketRegionalDomainName,
-          },
-        ]
-      | None => []
-      }
+      //
+      // The legacy hand-configured store is served alongside the declared ones,
+      // not replaced by them. Refs live in an append-only event log, so the
+      // `/uploads/…` values already written there can never be rewritten;
+      // `uploads` is therefore treated as a store that happens to predate the
+      // declaration, and keeps its prefix permanently.
+      let servedBuckets = Array.concat(
+        switch cfg.uploadBucket {
+        | Some(store) => [
+            {
+              ReventlessInfra.Platform.id: store.keyPrefix,
+              prefixes: [store.keyPrefix],
+              bucketId: store.bucketId,
+              bucketArn: store.bucketArn,
+              bucketRegionalDomainName: store.bucketRegionalDomainName,
+            },
+          ]
+        | None => []
+        },
+        declaredServedBuckets,
+      )
 
       let {distributionUrl, bucketName} = Plugin_Stack.makeUiBundleDistribution(
         ~pluginId="host-ui",
@@ -1569,6 +1816,18 @@ module MakeWithConfig = (
       | None => Pulumi.Output.make(None)
       }
 
+      // Per-store presign endpoints, keyed by the store's qualified name. This
+      // is what lets an upload input bind to the store its field *declares*
+      // rather than inferring one from the field's name — the endpoint exists
+      // per store, so there is something concrete to bind to.
+      //
+      // `uploadEndpoint` (singular) stays as the legacy service's URL: a shell
+      // built before per-store binding reads it and is unaffected.
+      let storeUploadEndpointsOutput: Pulumi.Output.t<array<(string, string)>> =
+        declaredStoreServices
+        ->Array.map(((qualified, _, _, url)) => url->Pulumi.Output.apply(u => (qualified, u)))
+        ->Pulumi.Output.all
+
       let configJsonContent =
         (
           (
@@ -1579,14 +1838,14 @@ module MakeWithConfig = (
           )->Pulumi.Output.all4,
           domainEventsEndpointOutput,
           geocoderEndpointOutput,
-          uploadEndpointOutput,
+          (uploadEndpointOutput, storeUploadEndpointsOutput)->Pulumi.Output.all2,
         )
         ->Pulumi.Output.all4
         ->Pulumi.Output.apply(((
           (domainEp, platformEp, poolId, clientId),
           eventsEpOpt,
           geocoderEpOpt,
-          uploadEpOpt,
+          (uploadEpOpt, storeUploadEps),
         )) => {
           let fields = [
             ("apiEndpoint", JSON.Encode.string(domainEp)),
@@ -1623,7 +1882,25 @@ module MakeWithConfig = (
           | Some(ep) => Array.concat(withGeocoder, [("uploadEndpoint", JSON.Encode.string(ep))])
           | None => withGeocoder
           }
-          withUpload->Dict.fromArray->JSON.Encode.object->JSON.stringify
+          // Omitted entirely when nothing is declared, so a deployment without
+          // declared stores writes a byte-identical config.json.
+          let withStoreUploads = switch storeUploadEps {
+          | [] => withUpload
+          | eps =>
+            Array.concat(
+              withUpload,
+              [
+                (
+                  "uploadEndpoints",
+                  eps
+                  ->Array.map(((qualified, url)) => (qualified, JSON.Encode.string(url)))
+                  ->Dict.fromArray
+                  ->JSON.Encode.object,
+                ),
+              ],
+            )
+          }
+          withStoreUploads->Dict.fromArray->JSON.Encode.object->JSON.stringify
         })
 
       let _ = PulumiAws.S3.BucketObject.make(