@reventlessdev/reventless-aws 3.0.0-alpha.239 → 3.0.0-alpha.241

package/src/Platform.res.mjs

@@ -36,6 +36,7 @@ import * as PluginBehavior$ReventlessCore from "@reventlessdev/reventless-core/s
 import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
 import * as PgProjectionFeed$ReventlessAws from "./adapter/Postgres/PgProjectionFeed.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "./util/Util_LocalConfig.res.mjs";
+import * as Util_StoreLayout$ReventlessAws from "./util/Util_StoreLayout.res.mjs";
 import * as IndexJs from "@pulumi/pulumi/runtime/index.js";
 import * as AppSync_EventsApi$ReventlessAws from "./adapter/Api/AppSync_EventsApi.res.mjs";
 import * as AppSync_MergedApi$ReventlessAws from "./components/Api/AppSync_MergedApi.res.mjs";
@@ -68,6 +69,7 @@ import * as UiFragments_Projection$ReventlessCore from "@reventlessdev/reventles
 import * as Aggregate_Builder_Single$ReventlessAws from "./components/Aggregate_Builder_Single.res.mjs";
 import * as ReadModel_Builder_Single$ReventlessAws from "./components/ReadModel_Builder_Single.res.mjs";
 import * as StateChangeSlice_Builder$ReventlessAws from "./components/StateChangeSlice_Builder.res.mjs";
+import * as Capability_ObjectStore_S3$ReventlessAws from "./capability/Capability_ObjectStore_S3.res.mjs";
 import * as EventCollectorChannel_SQS$ReventlessAws from "./adapter/EventCollector/EventCollectorChannel_SQS.res.mjs";
 import * as PgChangeFeedRelay_Builder$ReventlessAws from "./adapter/Postgres/PgChangeFeedRelay_Builder.res.mjs";
 import * as RuntimeEnvironment_Lambda$ReventlessAws from "./adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs";
@@ -114,6 +116,14 @@ function getSplitApiOutputs() {
   return splitApiOutputsRef.contents;
 }
 
+let objectStoreEndpointsRef = {
+  contents: []
+};
+
+function getObjectStoreEndpoints() {
+  return objectStoreEndpointsRef.contents;
+}
+
 function MakeWithConfig(Config) {
   Stdlib_Option.forEach(Config.commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
@@ -708,7 +718,8 @@ function MakeWithConfig(Config) {
     log.info("Platform", undefined, `v` + version);
     return Pervasives.failwith("makePlatform is not supported on AWS — deploy the platform with deployPlatform and each plugin with deployPlugin (merged-API composition).");
   };
-  let deployPlatform = (version, hostUiBundle) => {
+  let deployPlatform = (version, hostUiBundle, capabilitiesOpt) => {
+    let capabilities = capabilitiesOpt !== undefined ? capabilitiesOpt : [];
     log.info("Platform:deployPlatform", undefined, `v` + version);
     let scheduler = makeScheduler();
     hooks_scheduler.contents = scheduler;
@@ -868,41 +879,179 @@ function MakeWithConfig(Config) {
         adminResources: param[4]
       });
     });
+    let stackName = Pulumi.getStack();
+    let storeLayout = Util_StoreLayout$ReventlessAws.layoutFor(stackName, Util_HostUiDomain$ReventlessAws.resolveProdStacks());
+    let storeProtection = Util_StoreLayout$ReventlessAws.protectionFor(stackName, undefined);
+    let declaredStores = Stdlib_Array.reduce(Stdlib_Array.filterMap(capabilities, c => {
+      if (typeof c !== "object") {
+        return;
+      } else {
+        return [
+          c.plugin,
+          c.store
+        ];
+      }
+    }), [], (acc, param) => {
+      let store = param[1];
+      let plugin = param[0];
+      if (acc.some(param => param[0] === plugin ? param[1] === store : false)) {
+        return acc;
+      } else {
+        return acc.concat([[
+            plugin,
+            store
+          ]]);
+      }
+    });
+    if (declaredStores.length !== 0) {
+      let tmp;
+      tmp = storeLayout === "PerStore" ? "bucket per store" : "shared bucket, {store}/… prefixes";
+      let tmp$1;
+      tmp$1 = storeProtection === "Protected" ? "protected" : "unprotected (disposable stack)";
+      log.info("Platform:deployPlatform", undefined, `object stores: ` + tmp + `, ` + tmp$1 + ` — stack ` + stackName);
+    }
+    let storeBuckets = {};
+    let storeBucketOrder = [];
+    let declaredStoreServices = declaredStores.map(param => {
+      let store = param[1];
+      let plugin = param[0];
+      let bucketName = Util_StoreLayout$ReventlessAws.bucketNameFor(storeLayout, stackName, plugin, store);
+      let keyPrefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(store);
+      let b = storeBuckets[bucketName];
+      let bucket;
+      if (b !== undefined) {
+        bucket = b;
+      } else {
+        let tmp;
+        tmp = storeLayout === "PerStore" ? plugin : undefined;
+        let b$1 = Capability_ObjectStore_S3$ReventlessAws.make(bucketName, keyPrefix, tmp, storeProtection === "Protected", storeProtection === "Unprotected", undefined, undefined);
+        storeBuckets[bucketName] = b$1;
+        storeBucketOrder.push(bucketName);
+        bucket = b$1;
+      }
+      let storeHandle = Capability_ObjectStore_S3$ReventlessAws.underPrefix(bucket, keyPrefix);
+      let presign = Upload_Presign_S3$ReventlessAws.make(storeHandle.bucketName, undefined, storeHandle.keyPrefix, `UploadPresign-` + plugin + `-` + store, undefined);
+      return [
+        plugin + `.` + store,
+        keyPrefix,
+        bucketName,
+        presign.url
+      ];
+    });
+    let declaredServedBuckets = Stdlib_Array.filterMap(storeBucketOrder, bucketName => Stdlib_Option.map(storeBuckets[bucketName], b => ({
+      id: bucketName,
+      prefixes: Stdlib_Array.filterMap(declaredStoreServices, param => {
+        if (param[2] === bucketName) {
+          return param[1];
+        }
+      }),
+      bucketId: b.bucketId,
+      bucketArn: b.bucketArn,
+      bucketRegionalDomainName: b.bucketRegionalDomainName
+    })));
+    let match$1 = Util_StoreLayout$ReventlessAws.servingFor(Stdlib_Option.isSome(hostUiBundle), declaredServedBuckets.length);
+    let storeServingBaseUrl;
+    switch (match$1) {
+      case "NoStores" :
+      case "HostShell" :
+        storeServingBaseUrl = undefined;
+        break;
+      case "PlatformOwned" :
+        storeServingBaseUrl = Plugin_Stack$ReventlessAws.makeServedBucketDistribution("object-stores", declaredServedBuckets, undefined);
+        break;
+    }
+    let declaredStoreEndpoints = declaredStoreServices.map(param => ({
+      store: param[0],
+      keyPrefix: param[1],
+      bucketName: param[2],
+      uploadUrl: param[3],
+      baseUrl: storeServingBaseUrl
+    }));
+    objectStoreEndpointsRef.contents = declaredStoreEndpoints;
+    if (declaredStoreEndpoints.length !== 0) {
+      Pulumi$Pulumi.$$export("uploadEndpoints", Pulumi.all(declaredStoreEndpoints.map(e => e.uploadUrl.apply(u => [
+        e.store,
+        u
+      ]))).apply(pairs => Object.fromEntries(pairs)));
+      Pulumi$Pulumi.$$export("objectStores", Pulumi.all(declaredStoreEndpoints.map(e => {
+        let u = e.baseUrl;
+        if (u !== undefined) {
+          return u.apply(b => [
+            e,
+            b
+          ]);
+        } else {
+          return Pulumi.output([
+            e,
+            undefined
+          ]);
+        }
+      })).apply(pairs => Object.fromEntries(pairs.map(param => {
+        let baseUrl = param[1];
+        let e = param[0];
+        return [
+          e.store,
+          Object.fromEntries([
+            [
+              "bucketName",
+              e.bucketName
+            ],
+            [
+              "keyPrefix",
+              e.keyPrefix
+            ]
+          ].concat(baseUrl !== undefined ? [[
+                "baseUrl",
+                baseUrl
+              ]] : []))
+        ];
+      }))));
+    }
     if (hostUiBundle !== undefined) {
-      let match$1 = Util_LocalConfig$ReventlessAws.get("hostUiBaseDomain");
-      let match$2 = Util_LocalConfig$ReventlessAws.get("hostUiHostedZoneId");
+      let match$2 = Util_LocalConfig$ReventlessAws.get("hostUiBaseDomain");
+      let match$3 = Util_LocalConfig$ReventlessAws.get("hostUiHostedZoneId");
       let customDomain;
-      if (match$1 !== undefined && match$2 !== undefined) {
+      if (match$2 !== undefined && match$3 !== undefined) {
         let stack = Pulumi.getStack();
         let baseName = Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("hostUiBaseName"), Pulumi.getProject());
         let prodStacks = Stdlib_Option.getOr(Stdlib_Option.map(Util_LocalConfig$ReventlessAws.get("hostUiProdStacks"), Util_HostUiDomain$ReventlessAws.parseProdStacks), Util_HostUiDomain$ReventlessAws.defaultProdStacks);
-        let fqdn = Util_HostUiDomain$ReventlessAws.deriveFqdn(baseName, stack, match$1, prodStacks);
+        let fqdn = Util_HostUiDomain$ReventlessAws.deriveFqdn(baseName, stack, match$2, prodStacks);
         customDomain = {
           fqdn: fqdn,
-          hostedZoneId: match$2
+          hostedZoneId: match$3
         };
       } else {
         customDomain = undefined;
       }
       let store = hostUiBundle.uploadBucket;
-      let servedBuckets = store !== undefined ? [{
-            prefix: Upload_Presign_S3$ReventlessAws.defaultServedPrefix,
-            bucketId: store.bucketId,
-            bucketArn: store.bucketArn,
-            bucketRegionalDomainName: store.bucketRegionalDomainName
-          }] : [];
-      let match$3 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
+      let servedBuckets = (
+        store !== undefined ? [{
+              id: store.keyPrefix,
+              prefixes: [store.keyPrefix],
+              bucketId: store.bucketId,
+              bucketArn: store.bucketArn,
+              bucketRegionalDomainName: store.bucketRegionalDomainName
+            }] : []
+      ).concat(declaredServedBuckets);
+      let match$4 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
         "config.json",
         "ui-hints.json"
       ], customDomain, servedBuckets);
-      let bucketName = match$3.bucketName;
+      let bucketName = match$4.bucketName;
       let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
       let cognitoPool = Platform_Stack$ReventlessAws.resolveCognitoUserPool();
       let domainEventsEndpointOutput = domainEventsApiOpt !== undefined ? AppSync_EventsApi$ReventlessAws.httpEndpoint(domainEventsApiOpt).apply(ep => ep + "/event") : Pulumi.output(undefined);
       let index = hostUiBundle.geocoderPlaceIndex;
       let geocoderEndpointOutput = index !== undefined ? Geocoder_AwsLocation$ReventlessAws.make(index.indexName, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
       let store$1 = hostUiBundle.uploadBucket;
-      let uploadEndpointOutput = store$1 !== undefined ? Upload_Presign_S3$ReventlessAws.make(store$1.bucketName, undefined, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
+      let uploadEndpointOutput = store$1 !== undefined ? Upload_Presign_S3$ReventlessAws.make(store$1.bucketName, undefined, undefined, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
+      let storeUploadEndpointsOutput = Pulumi.all(declaredStoreServices.map(param => {
+        let qualified = param[0];
+        return param[3].apply(u => [
+          qualified,
+          u
+        ]);
+      }));
       let configJsonContent = Pulumi.all([
         Pulumi.all([
           resolvedDomainApiEndpoint,
@@ -912,20 +1061,25 @@ function MakeWithConfig(Config) {
         ]),
         domainEventsEndpointOutput,
         geocoderEndpointOutput,
-        uploadEndpointOutput
+        Pulumi.all([
+          uploadEndpointOutput,
+          storeUploadEndpointsOutput
+        ])
       ]).apply(param => {
-        let uploadEpOpt = param[3];
+        let match = param[3];
+        let storeUploadEps = match[1];
+        let uploadEpOpt = match[0];
         let geocoderEpOpt = param[2];
         let eventsEpOpt = param[1];
-        let match = param[0];
+        let match$1 = param[0];
         let fields = [
           [
             "apiEndpoint",
-            match[0]
+            match$1[0]
           ],
           [
             "platformApiEndpoint",
-            match[1]
+            match$1[1]
           ],
           [
             "region",
@@ -937,11 +1091,11 @@ function MakeWithConfig(Config) {
           ],
           [
             "cognitoUserPoolId",
-            match[2]
+            match$1[2]
           ],
           [
             "cognitoClientId",
-            match[3]
+            match$1[3]
           ],
           [
             "liveUpdates",
@@ -970,7 +1124,14 @@ function MakeWithConfig(Config) {
               "uploadEndpoint",
               uploadEpOpt
             ]]) : withGeocoder;
-        return JSON.stringify(Object.fromEntries(withUpload));
+        let withStoreUploads = storeUploadEps.length !== 0 ? withUpload.concat([[
+              "uploadEndpoints",
+              Object.fromEntries(storeUploadEps.map(param => [
+                param[0],
+                param[1]
+              ]))
+            ]]) : withUpload;
+        return JSON.stringify(Object.fromEntries(withStoreUploads));
       });
       new (Aws.s3.BucketObject)("host-ui-config-json", {
         bucket: bucketName,
@@ -988,7 +1149,7 @@ function MakeWithConfig(Config) {
           contentType: "application/json"
         });
       }
-      Pulumi$Pulumi.$$export("hostShellUrl", match$3.distributionUrl);
+      Pulumi$Pulumi.$$export("hostShellUrl", match$4.distributionUrl);
     }
     return Pulumi$Pulumi.getOutputs();
   };
@@ -1724,7 +1885,8 @@ function Make($star) {
     log.info("Platform", undefined, `v` + version);
     return Pervasives.failwith("makePlatform is not supported on AWS — deploy the platform with deployPlatform and each plugin with deployPlugin (merged-API composition).");
   };
-  let deployPlatform = (version, hostUiBundle) => {
+  let deployPlatform = (version, hostUiBundle, capabilitiesOpt) => {
+    let capabilities = capabilitiesOpt !== undefined ? capabilitiesOpt : [];
     log.info("Platform:deployPlatform", undefined, `v` + version);
     let scheduler = makeScheduler();
     hooks_scheduler.contents = scheduler;
@@ -1861,41 +2023,179 @@ function Make($star) {
         adminResources: param[4]
       });
     });
+    let stackName = Pulumi.getStack();
+    let storeLayout = Util_StoreLayout$ReventlessAws.layoutFor(stackName, Util_HostUiDomain$ReventlessAws.resolveProdStacks());
+    let storeProtection = Util_StoreLayout$ReventlessAws.protectionFor(stackName, undefined);
+    let declaredStores = Stdlib_Array.reduce(Stdlib_Array.filterMap(capabilities, c => {
+      if (typeof c !== "object") {
+        return;
+      } else {
+        return [
+          c.plugin,
+          c.store
+        ];
+      }
+    }), [], (acc, param) => {
+      let store = param[1];
+      let plugin = param[0];
+      if (acc.some(param => param[0] === plugin ? param[1] === store : false)) {
+        return acc;
+      } else {
+        return acc.concat([[
+            plugin,
+            store
+          ]]);
+      }
+    });
+    if (declaredStores.length !== 0) {
+      let tmp;
+      tmp = storeLayout === "PerStore" ? "bucket per store" : "shared bucket, {store}/… prefixes";
+      let tmp$1;
+      tmp$1 = storeProtection === "Protected" ? "protected" : "unprotected (disposable stack)";
+      log.info("Platform:deployPlatform", undefined, `object stores: ` + tmp + `, ` + tmp$1 + ` — stack ` + stackName);
+    }
+    let storeBuckets = {};
+    let storeBucketOrder = [];
+    let declaredStoreServices = declaredStores.map(param => {
+      let store = param[1];
+      let plugin = param[0];
+      let bucketName = Util_StoreLayout$ReventlessAws.bucketNameFor(storeLayout, stackName, plugin, store);
+      let keyPrefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(store);
+      let b = storeBuckets[bucketName];
+      let bucket;
+      if (b !== undefined) {
+        bucket = b;
+      } else {
+        let tmp;
+        tmp = storeLayout === "PerStore" ? plugin : undefined;
+        let b$1 = Capability_ObjectStore_S3$ReventlessAws.make(bucketName, keyPrefix, tmp, storeProtection === "Protected", storeProtection === "Unprotected", undefined, undefined);
+        storeBuckets[bucketName] = b$1;
+        storeBucketOrder.push(bucketName);
+        bucket = b$1;
+      }
+      let storeHandle = Capability_ObjectStore_S3$ReventlessAws.underPrefix(bucket, keyPrefix);
+      let presign = Upload_Presign_S3$ReventlessAws.make(storeHandle.bucketName, undefined, storeHandle.keyPrefix, `UploadPresign-` + plugin + `-` + store, undefined);
+      return [
+        plugin + `.` + store,
+        keyPrefix,
+        bucketName,
+        presign.url
+      ];
+    });
+    let declaredServedBuckets = Stdlib_Array.filterMap(storeBucketOrder, bucketName => Stdlib_Option.map(storeBuckets[bucketName], b => ({
+      id: bucketName,
+      prefixes: Stdlib_Array.filterMap(declaredStoreServices, param => {
+        if (param[2] === bucketName) {
+          return param[1];
+        }
+      }),
+      bucketId: b.bucketId,
+      bucketArn: b.bucketArn,
+      bucketRegionalDomainName: b.bucketRegionalDomainName
+    })));
+    let match$1 = Util_StoreLayout$ReventlessAws.servingFor(Stdlib_Option.isSome(hostUiBundle), declaredServedBuckets.length);
+    let storeServingBaseUrl;
+    switch (match$1) {
+      case "NoStores" :
+      case "HostShell" :
+        storeServingBaseUrl = undefined;
+        break;
+      case "PlatformOwned" :
+        storeServingBaseUrl = Plugin_Stack$ReventlessAws.makeServedBucketDistribution("object-stores", declaredServedBuckets, undefined);
+        break;
+    }
+    let declaredStoreEndpoints = declaredStoreServices.map(param => ({
+      store: param[0],
+      keyPrefix: param[1],
+      bucketName: param[2],
+      uploadUrl: param[3],
+      baseUrl: storeServingBaseUrl
+    }));
+    objectStoreEndpointsRef.contents = declaredStoreEndpoints;
+    if (declaredStoreEndpoints.length !== 0) {
+      Pulumi$Pulumi.$$export("uploadEndpoints", Pulumi.all(declaredStoreEndpoints.map(e => e.uploadUrl.apply(u => [
+        e.store,
+        u
+      ]))).apply(pairs => Object.fromEntries(pairs)));
+      Pulumi$Pulumi.$$export("objectStores", Pulumi.all(declaredStoreEndpoints.map(e => {
+        let u = e.baseUrl;
+        if (u !== undefined) {
+          return u.apply(b => [
+            e,
+            b
+          ]);
+        } else {
+          return Pulumi.output([
+            e,
+            undefined
+          ]);
+        }
+      })).apply(pairs => Object.fromEntries(pairs.map(param => {
+        let baseUrl = param[1];
+        let e = param[0];
+        return [
+          e.store,
+          Object.fromEntries([
+            [
+              "bucketName",
+              e.bucketName
+            ],
+            [
+              "keyPrefix",
+              e.keyPrefix
+            ]
+          ].concat(baseUrl !== undefined ? [[
+                "baseUrl",
+                baseUrl
+              ]] : []))
+        ];
+      }))));
+    }
     if (hostUiBundle !== undefined) {
-      let match$1 = Util_LocalConfig$ReventlessAws.get("hostUiBaseDomain");
-      let match$2 = Util_LocalConfig$ReventlessAws.get("hostUiHostedZoneId");
+      let match$2 = Util_LocalConfig$ReventlessAws.get("hostUiBaseDomain");
+      let match$3 = Util_LocalConfig$ReventlessAws.get("hostUiHostedZoneId");
       let customDomain;
-      if (match$1 !== undefined && match$2 !== undefined) {
+      if (match$2 !== undefined && match$3 !== undefined) {
         let stack = Pulumi.getStack();
         let baseName = Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("hostUiBaseName"), Pulumi.getProject());
         let prodStacks = Stdlib_Option.getOr(Stdlib_Option.map(Util_LocalConfig$ReventlessAws.get("hostUiProdStacks"), Util_HostUiDomain$ReventlessAws.parseProdStacks), Util_HostUiDomain$ReventlessAws.defaultProdStacks);
-        let fqdn = Util_HostUiDomain$ReventlessAws.deriveFqdn(baseName, stack, match$1, prodStacks);
+        let fqdn = Util_HostUiDomain$ReventlessAws.deriveFqdn(baseName, stack, match$2, prodStacks);
         customDomain = {
           fqdn: fqdn,
-          hostedZoneId: match$2
+          hostedZoneId: match$3
         };
       } else {
         customDomain = undefined;
       }
       let store = hostUiBundle.uploadBucket;
-      let servedBuckets = store !== undefined ? [{
-            prefix: Upload_Presign_S3$ReventlessAws.defaultServedPrefix,
-            bucketId: store.bucketId,
-            bucketArn: store.bucketArn,
-            bucketRegionalDomainName: store.bucketRegionalDomainName
-          }] : [];
-      let match$3 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
+      let servedBuckets = (
+        store !== undefined ? [{
+              id: store.keyPrefix,
+              prefixes: [store.keyPrefix],
+              bucketId: store.bucketId,
+              bucketArn: store.bucketArn,
+              bucketRegionalDomainName: store.bucketRegionalDomainName
+            }] : []
+      ).concat(declaredServedBuckets);
+      let match$4 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
         "config.json",
         "ui-hints.json"
       ], customDomain, servedBuckets);
-      let bucketName = match$3.bucketName;
+      let bucketName = match$4.bucketName;
       let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
       let cognitoPool = Platform_Stack$ReventlessAws.resolveCognitoUserPool();
       let domainEventsEndpointOutput = domainEventsApiOpt !== undefined ? AppSync_EventsApi$ReventlessAws.httpEndpoint(domainEventsApiOpt).apply(ep => ep + "/event") : Pulumi.output(undefined);
       let index = hostUiBundle.geocoderPlaceIndex;
       let geocoderEndpointOutput = index !== undefined ? Geocoder_AwsLocation$ReventlessAws.make(index.indexName, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
       let store$1 = hostUiBundle.uploadBucket;
-      let uploadEndpointOutput = store$1 !== undefined ? Upload_Presign_S3$ReventlessAws.make(store$1.bucketName, undefined, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
+      let uploadEndpointOutput = store$1 !== undefined ? Upload_Presign_S3$ReventlessAws.make(store$1.bucketName, undefined, undefined, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
+      let storeUploadEndpointsOutput = Pulumi.all(declaredStoreServices.map(param => {
+        let qualified = param[0];
+        return param[3].apply(u => [
+          qualified,
+          u
+        ]);
+      }));
       let configJsonContent = Pulumi.all([
         Pulumi.all([
           resolvedDomainApiEndpoint,
@@ -1905,20 +2205,25 @@ function Make($star) {
         ]),
         domainEventsEndpointOutput,
         geocoderEndpointOutput,
-        uploadEndpointOutput
+        Pulumi.all([
+          uploadEndpointOutput,
+          storeUploadEndpointsOutput
+        ])
       ]).apply(param => {
-        let uploadEpOpt = param[3];
+        let match = param[3];
+        let storeUploadEps = match[1];
+        let uploadEpOpt = match[0];
         let geocoderEpOpt = param[2];
         let eventsEpOpt = param[1];
-        let match = param[0];
+        let match$1 = param[0];
         let fields = [
           [
             "apiEndpoint",
-            match[0]
+            match$1[0]
           ],
           [
             "platformApiEndpoint",
-            match[1]
+            match$1[1]
           ],
           [
             "region",
@@ -1930,11 +2235,11 @@ function Make($star) {
           ],
           [
             "cognitoUserPoolId",
-            match[2]
+            match$1[2]
           ],
           [
             "cognitoClientId",
-            match[3]
+            match$1[3]
           ],
           [
             "liveUpdates",
@@ -1963,7 +2268,14 @@ function Make($star) {
               "uploadEndpoint",
               uploadEpOpt
             ]]) : withGeocoder;
-        return JSON.stringify(Object.fromEntries(withUpload));
+        let withStoreUploads = storeUploadEps.length !== 0 ? withUpload.concat([[
+              "uploadEndpoints",
+              Object.fromEntries(storeUploadEps.map(param => [
+                param[0],
+                param[1]
+              ]))
+            ]]) : withUpload;
+        return JSON.stringify(Object.fromEntries(withStoreUploads));
       });
       new (Aws.s3.BucketObject)("host-ui-config-json", {
         bucket: bucketName,
@@ -1981,7 +2293,7 @@ function Make($star) {
           contentType: "application/json"
         });
       }
-      Pulumi$Pulumi.$$export("hostShellUrl", match$3.distributionUrl);
+      Pulumi$Pulumi.$$export("hostShellUrl", match$4.distributionUrl);
     }
     return Pulumi$Pulumi.getOutputs();
   };
@@ -2133,6 +2445,8 @@ export {
   getApiConfig,
   splitApiOutputsRef,
   getSplitApiOutputs,
+  objectStoreEndpointsRef,
+  getObjectStoreEndpoints,
   MakeWithConfig,
   Make,
 }

package/src/adapter/Upload/Upload_Presign_S3.res

@@ -42,9 +42,19 @@ let make = (
   // bucket's CloudFront `{prefix}/*` behavior so the returned `/{key}` ref
   // resolves.
   ~servedPrefix: string=defaultServedPrefix,
+  // Resource-name stem. Defaults to the single-service name this adapter had
+  // when a deployment could only have one store, so the existing service keeps
+  // its identity; declared stores each pass their own, because there is one
+  // service per store.
+  //
+  // One service per store rather than one service with wildcard write across
+  // stores: a single wide-scoped presigner reintroduces exactly the blast radius
+  // the per-store split exists to remove, and it does so invisibly — every
+  // upload still works.
+  ~name: string="UploadPresignService",
   ~opts=?,
 ): serviceOutputs => {
-  let serviceName = "UploadPresignService"
+  let serviceName = name
   let opts =
     opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
 
@@ -61,12 +71,18 @@ let make = (
   )
 
   // CloudWatch Logs (so failures are observable) plus least-privilege
-  // `s3:PutObject` on any key under the target bucket.
+  // `s3:PutObject` on this store's own keys.
+  //
+  // Scoped to `{bucket}/{servedPrefix}/*`, not to the whole bucket. Because keys
+  // are rooted at the store's prefix in *both* layouts, this one expression is
+  // least-privilege in both: a dedicated bucket's service still cannot write
+  // outside its prefix, and a shared bucket's services cannot write into each
+  // other's stores. The layouts stay one model — even the policy does not fork.
   let _policy =
     bucketName
     ->Pulumi.Output.fromInput
     ->Pulumi.Output.apply(b => {
-      let arn = `arn:aws:s3:::${b}/*`
+      let arn = `arn:aws:s3:::${b}/${servedPrefix}/*`
       let _ = IAM.RolePolicy.make(
         ~name=`${serviceName}Policy`,
         ~args={

package/src/adapter/Upload/Upload_Presign_S3.res.mjs

@@ -14,16 +14,16 @@ import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/
 
 let defaultServedPrefix = "uploads";
 
-function make(bucketName, corsOriginsOpt, servedPrefixOpt, opts) {
+function make(bucketName, corsOriginsOpt, servedPrefixOpt, nameOpt, opts) {
   let corsOrigins = corsOriginsOpt !== undefined ? corsOriginsOpt : ["*"];
   let servedPrefix = servedPrefixOpt !== undefined ? servedPrefixOpt : defaultServedPrefix;
-  let serviceName = "UploadPresignService";
+  let name = nameOpt !== undefined ? nameOpt : "UploadPresignService";
   let opts$1 = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
-  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(serviceName, Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(serviceName, "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
+  let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.Lambda.principal), AWS_Tags$ReventlessAws.make(name, "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   bucketName.apply(b => {
-    let arn = `arn:aws:s3:::` + b + `/*`;
-    new (Aws.iam.RolePolicy)(serviceName + `Policy`, {
-      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, serviceName + `Policy`, [
+    let arn = `arn:aws:s3:::` + b + `/` + servedPrefix + `/*`;
+    new (Aws.iam.RolePolicy)(name + `Policy`, {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + `Policy`, [
         {
           Sid: "AllowLambdaLogging",
           Effect: "Allow",
@@ -50,7 +50,7 @@ function make(bucketName, corsOriginsOpt, servedPrefixOpt, opts) {
     ]]);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Presign_S3_Ops.res.mjs", packageDirs, undefined);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
-  let lambda = new (Aws.lambda.Function)(serviceName, {
+  let lambda = new (Aws.lambda.Function)(name, {
     handler: "index.handler",
     runtime: "nodejs22.x",
     code: match.code,
@@ -58,7 +58,7 @@ function make(bucketName, corsOriginsOpt, servedPrefixOpt, opts) {
     memorySize: 256,
     timeout: 30,
     layers: layers,
-    tags: AWS_Tags$ReventlessAws.make(serviceName, "Platform", "Runtime", "Platform", undefined, undefined, undefined, undefined),
+    tags: AWS_Tags$ReventlessAws.make(name, "Platform", "Runtime", "Platform", undefined, undefined, undefined, undefined),
     environment: {
       variables: Object.fromEntries([
         [
@@ -85,7 +85,7 @@ function make(bucketName, corsOriginsOpt, servedPrefixOpt, opts) {
     },
     sourceCodeHash: match.sourceCodeHash
   }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
-  let functionUrl = new (Aws.lambda.FunctionUrl)(serviceName + `Url`, {
+  let functionUrl = new (Aws.lambda.FunctionUrl)(name + `Url`, {
     authorizationType: "NONE",
     functionName: lambda.name,
     cors: {