@reventlessdev/reventless-aws 3.0.0-alpha.239 → 3.0.0-alpha.241

package/src/capability/Capability_ObjectStore_S3.res

@@ -20,9 +20,20 @@
 // both cost and delete semantics and belongs to a deployment's judgement rather
 // than to a framework default.
 //
-// Follow-up, once a store's lifecycle follows a declaration rather than an
-// explicit line of app code: `protect` / `retainOnDelete`, so an accidental
-// removal of that declaration cannot destroy a bucket holding live objects.
+// A store's lifecycle now follows a *declaration*, which changes the risk. A
+// hand-written bucket could only be destroyed by editing a line of Pulumi; a
+// declared one can be destroyed by renaming a field, because the last
+// `@storageRef("productImages")` disappearing removes the requirement. Hence
+// `~protect`, on by default and turned off only for stacks that are routinely
+// torn down — see `Util_StoreLayout.protectionFor`, which decides that from
+// disposability rather than from the store's layout.
+//
+// Not to be confused with the framework's other buckets: a **store** is
+// declared by a field's type and holds values that events reference, so its
+// objects outlive any single deploy. A **task bucket** (`TaskBucket_S3`) is
+// wired by a slice and holds transient input, and the plugin-bundle and
+// host-ui-bundle buckets are hosting substrate. Neither has a `@storageRef`
+// field pointing at it, and neither is provisioned from a declaration.
 
 open PulumiAws
 
@@ -39,24 +50,62 @@ let defaultCorsRules: S3.Bucket.corsRules = [
 ]
 
 /** Create an object store bucket with framework attribution tags and an
-    all-true public-access block. */
+    all-true public-access block.
+
+    `~keyPrefix` is the path this store's object keys are rooted at; it travels
+    in the returned record so the mint side and the serve side read one value
+    instead of restating it.
+
+    `~plugin` attributes the store to the plugin whose field declared it. The
+    bucket is created by the platform deploy — that is where the serving CDN and
+    the presign services live, and where a shared bucket has a single owner — so
+    ownership is expressed in the tags rather than in which stack ran `make`.
+
+    `~protect` (default on) blocks `pulumi destroy` and accidental replacement.
+    `~forceDestroy` is its counterpart for disposable stacks: a protected bucket
+    cannot be torn down, so a PR stack would leak exactly the buckets that
+    sharing exists to save. */
 let make = (
   ~name: string,
+  ~keyPrefix: string=Upload_Presign_S3.defaultServedPrefix,
+  ~plugin: option<string>=?,
+  ~protect: bool=true,
+  ~forceDestroy: bool=false,
   ~corsRules: S3.Bucket.corsRules=defaultCorsRules,
   ~opts: option<Pulumi.CustomResourceOptions.t>=?,
 ): ReventlessInfra.Platform.objectStore => {
+  // A declared store is plugin substrate; the legacy hand-written store, which
+  // names no plugin, stays platform-scoped so its tags are unchanged.
+  let (kind, scope) = switch plugin {
+  | Some(_) => (
+      ReventlessCore.ComponentType.Plugin,
+      ReventlessCore.ResourceAttribution.Scope.Plugin,
+    )
+  | None => (
+      ReventlessCore.ComponentType.Platform,
+      ReventlessCore.ResourceAttribution.Scope.Platform,
+    )
+  }
+
+  let opts: Pulumi.CustomResourceOptions.t = {
+    ...opts->Option.getOr({}),
+    protect,
+  }
+
   let bucket = S3.Bucket.make(
     ~name,
     ~args={
       corsRules: corsRules->Pulumi.Input.make,
+      forceDestroy: forceDestroy->Pulumi.Input.make,
       tags: AWS.Tags.make(
         ~name,
-        ~kind=ReventlessCore.ComponentType.Platform,
+        ~kind,
         ~role=Other("ObjectStore"),
-        ~scope=Platform,
+        ~scope,
+        ~plugin?,
       ),
     },
-    ~opts?,
+    ~opts,
   )
 
   // A served store is read through the UI's CDN via an origin access control,
@@ -80,5 +129,18 @@ let make = (
     bucketId: bucket.id->Pulumi.Output.asInput,
     bucketArn: bucket.arn->Pulumi.Output.asInput,
     bucketRegionalDomainName: bucket.bucketRegionalDomainName->Pulumi.Output.asInput,
+    keyPrefix,
   }
 }
+
+/** The same bucket, addressed under a different key prefix.
+
+    A shared-layout stack puts every declared store in one bucket, so the bucket
+    is created once and each store is that bucket seen through its own prefix.
+    Splitting this out keeps the memoisation of "one bucket per physical name"
+    separate from "one store per declaration", which are different cardinalities
+    the moment a layout shares. */
+let underPrefix = (
+  store: ReventlessInfra.Platform.objectStore,
+  ~keyPrefix: string,
+): ReventlessInfra.Platform.objectStore => {...store, keyPrefix}

package/src/capability/Capability_ObjectStore_S3.res.mjs

@@ -1,8 +1,9 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Aws from "@pulumi/aws";
-import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as AWS_Tags$ReventlessAws from "../adapter/AWS_Tags.res.mjs";
+import * as Upload_Presign_S3$ReventlessAws from "../adapter/Upload/Upload_Presign_S3.res.mjs";
 
 let defaultCorsRules = [{
     allowedHeaders: ["*"],
@@ -17,15 +18,28 @@ let defaultCorsRules = [{
     maxAgeSeconds: 3000
   }];
 
-function make(name, corsRulesOpt, opts) {
+function make(name, keyPrefixOpt, plugin, protectOpt, forceDestroyOpt, corsRulesOpt, opts) {
+  let keyPrefix = keyPrefixOpt !== undefined ? keyPrefixOpt : Upload_Presign_S3$ReventlessAws.defaultServedPrefix;
+  let protect = protectOpt !== undefined ? protectOpt : true;
+  let forceDestroy = forceDestroyOpt !== undefined ? forceDestroyOpt : false;
   let corsRules = corsRulesOpt !== undefined ? corsRulesOpt : defaultCorsRules;
+  let match = plugin !== undefined ? [
+      "Plugin",
+      "Plugin"
+    ] : [
+      "Platform",
+      "Platform"
+    ];
+  let newrecord = {...Stdlib_Option.getOr(opts, {})};
+  newrecord.protect = protect;
   let bucket = new (Aws.s3.Bucket)(name, {
     corsRules: corsRules,
-    tags: AWS_Tags$ReventlessAws.make(name, "Platform", {
+    forceDestroy: forceDestroy,
+    tags: AWS_Tags$ReventlessAws.make(name, match[0], {
       TAG: "Other",
       _0: "ObjectStore"
-    }, "Platform", undefined, undefined, undefined, undefined)
-  }, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined);
+    }, match[1], undefined, undefined, plugin, undefined)
+  }, newrecord);
   new (Aws.s3.BucketPublicAccessBlock)(name + "-pab", {
     bucket: bucket.id,
     blockPublicAcls: true,
@@ -37,12 +51,24 @@ function make(name, corsRulesOpt, opts) {
     bucketName: bucket.bucket,
     bucketId: bucket.id,
     bucketArn: bucket.arn,
-    bucketRegionalDomainName: bucket.bucketRegionalDomainName
+    bucketRegionalDomainName: bucket.bucketRegionalDomainName,
+    keyPrefix: keyPrefix
+  };
+}
+
+function underPrefix(store, keyPrefix) {
+  return {
+    bucketName: store.bucketName,
+    bucketId: store.bucketId,
+    bucketArn: store.bucketArn,
+    bucketRegionalDomainName: store.bucketRegionalDomainName,
+    keyPrefix: keyPrefix
   };
 }
 
 export {
   defaultCorsRules,
   make,
+  underPrefix,
 }
 /* @pulumi/aws Not a pure module */

package/src/plugin/stack/Plugin_Stack.res

@@ -225,17 +225,26 @@ let makeUiBundleDistribution = (
   // CachingOptimized policy is safe. Prepended to `orderedCacheBehaviors` so a
   // served path is matched before the SPA-serving default behavior and never
   // routed to the bundle bucket.
-  let servedOriginId = (prefix: string): string => "served-" ++ prefix
-  let servedCacheBehavior = (prefix: string): PulumiAws.CloudFront.Distribution.orderedCacheBehavior => {
+  let servedOriginId = (id: string): string => "served-" ++ id
+  let servedCacheBehavior = (
+    ~prefix: string,
+    ~originId: string,
+  ): PulumiAws.CloudFront.Distribution.orderedCacheBehavior => {
     pathPattern: Pulumi.Input.make(prefix ++ "/*"),
-    targetOriginId: Pulumi.Input.make(servedOriginId(prefix)),
+    targetOriginId: Pulumi.Input.make(originId),
     viewerProtocolPolicy: Pulumi.Input.make("redirect-to-https"),
     allowedMethods: Pulumi.Input.make(["GET", "HEAD"]),
     cachedMethods: Pulumi.Input.make(["GET", "HEAD"]),
     cachePolicyId: Pulumi.Input.make(cachingOptimizedPolicyId),
   }
   let orderedCacheBehaviors = Array.concat(
-    servedBuckets->Array.map(sb => servedCacheBehavior(sb.prefix)),
+    // One behavior per served prefix; several prefixes may share one origin when
+    // they live in the same bucket.
+    servedBuckets->Array.flatMap(sb =>
+      sb.prefixes->Array.map(prefix =>
+        servedCacheBehavior(~prefix, ~originId=servedOriginId(sb.id))
+      )
+    ),
     Array.concat(
       [noCacheBehavior("/remoteEntry.js")],
       spaFallback ? [noCacheBehavior("/" ++ indexDocument), noCacheBehavior("/config.json")] : [],
@@ -336,7 +345,7 @@ let makeUiBundleDistribution = (
             // per-bucket read grant is the served bucket's own BucketPolicy below).
             servedBuckets->Array.map(sb => {
               PulumiAws.CloudFront.Distribution.domainName: sb.bucketRegionalDomainName,
-              originId: Pulumi.Input.make(servedOriginId(sb.prefix)),
+              originId: Pulumi.Input.make(servedOriginId(sb.id)),
               originAccessControlId: Pulumi.Input.make(oacId),
             }),
           )
@@ -432,9 +441,13 @@ let makeUiBundleDistribution = (
   // object is fetchable at `https://<ui-domain>/{prefix}/<key>` while the bucket
   // stays private (direct S3 GET is 403). Mirrors the bundle bucket policy above;
   // the served bucket keeps its own all-true BucketPublicAccessBlock (app-owned).
+  //
+  // Exactly one policy per bucket — S3 permits no more. Grouping prefixes into
+  // one `servedBucket` is what makes that structural rather than a rule to
+  // remember.
   servedBuckets->Array.forEach(sb => {
     let _ = PulumiAws.S3.BucketPolicy.make(
-      ~name=name ++ "-served-" ++ sb.prefix ++ "-policy",
+      ~name=name ++ "-served-" ++ sb.id ++ "-policy",
       ~args={
         bucket: sb.bucketId,
         policy: (sb.bucketArn->Pulumi.Output.fromInput, distribution.arn)
@@ -525,3 +538,193 @@ let makeUiBundleDistribution = (
     bucketName: bucket.bucket,
   }
 }
+
+/**
+Front a set of served buckets with a CloudFront distribution of their own, with
+no SPA bundle behind it.
+
+`makeUiBundleDistribution` can already serve buckets, but only as a side car to
+a UI bundle. A platform that deploys no shell — because its UI ships from its
+own stack — still provisions stores and then has nothing to serve them from:
+the bucket is created with an all-true public-access block and takes its read
+grant solely from a distribution's `BucketPolicy`, so with no distribution the
+objects are unreachable by anything.
+
+Serving lives with the stack that owns the buckets, and that is not a style
+preference. **S3 permits exactly one bucket policy per bucket.** If the read
+grant were written by whichever stack happened to build a distribution, two
+distributions fronting one store would silently overwrite each other's grant —
+deploying green and 404ing the loser's objects. Keeping the policy next to the
+bucket makes a second writer impossible rather than merely discouraged.
+
+Returns the public base URL. A consumer needs that and the store's prefix to
+address an object; it needs no bucket identity at all, which is both a smaller
+contract and one that cannot collide.
+*/
+let makeServedBucketDistribution = (
+  ~name: string,
+  ~servedBuckets: array<ReventlessInfra.Platform.servedBucket>,
+  ~customDomain: option<customDomain>=?,
+): Pulumi.Output.t<string> => {
+  let oac = PulumiAws.CloudFront.OriginAccessControl.make(
+    ~name=name ++ "-oac",
+    ~args={
+      originAccessControlOriginType: Pulumi.Input.make("s3"),
+      signingBehavior: Pulumi.Input.make("always"),
+      signingProtocol: Pulumi.Input.make("sigv4"),
+    },
+  )
+
+  let originIdFor = (id: string): string => "served-" ++ id
+
+  // CloudFront requires a default behavior, and with no bundle origin there is
+  // nothing neutral to point it at. The first served bucket takes it; every
+  // real path is matched by its own `{prefix}/*` behavior first, so the default
+  // is only reached by a request for a path no store claims — which 404s at S3,
+  // the correct answer.
+  let defaultOriginId = switch servedBuckets->Array.get(0) {
+  | Some(sb) => originIdFor(sb.id)
+  | None =>
+    JsError.throwWithMessage(
+      "Plugin_Stack.makeServedBucketDistribution: no served buckets — call only when at least one store is declared",
+    )
+  }
+
+  let viewerCertificate: PulumiAws.CloudFront.Distribution.viewerCertificate = switch customDomain {
+  | None => {
+      cloudfrontDefaultCertificate: Pulumi.Input.make(true),
+    }
+  | Some({fqdn, hostedZoneId: _}) =>
+    let usEast1 = _getUsEast1Provider()
+    let cert = PulumiAws.Acm.Certificate.make(
+      ~name=name ++ "-cert",
+      ~args={
+        domainName: Pulumi.Input.make(fqdn),
+        validationMethod: Pulumi.Input.make("DNS"),
+      },
+      ~opts={provider: usEast1},
+    )
+    {
+      acmCertificateArn: cert.arn->Pulumi.Output.asInput,
+      sslSupportMethod: Pulumi.Input.make("sni-only"),
+      minimumProtocolVersion: Pulumi.Input.make("TLSv1.2_2021"),
+    }
+  }
+
+  let distribution = PulumiAws.CloudFront.Distribution.make(
+    ~name=name ++ "-cdn",
+    ~args={
+      enabled: Pulumi.Input.make(true),
+      aliases: ?switch customDomain {
+      | None => None
+      | Some({fqdn}) => Some(Pulumi.Input.make([fqdn]))
+      },
+      origins: oac.id->Pulumi.Output.apply(oacId =>
+        servedBuckets->Array.map(sb => {
+          PulumiAws.CloudFront.Distribution.domainName: sb.bucketRegionalDomainName,
+          originId: Pulumi.Input.make(originIdFor(sb.id)),
+          originAccessControlId: Pulumi.Input.make(oacId),
+        })
+      )
+      ->Pulumi.Output.asInput,
+      defaultCacheBehavior: Pulumi.Input.make(
+        (
+          {
+            targetOriginId: Pulumi.Input.make(defaultOriginId),
+            viewerProtocolPolicy: Pulumi.Input.make("redirect-to-https"),
+            allowedMethods: Pulumi.Input.make(["GET", "HEAD"]),
+            cachedMethods: Pulumi.Input.make(["GET", "HEAD"]),
+            cachePolicyId: Pulumi.Input.make(cachingOptimizedPolicyId),
+          }: PulumiAws.CloudFront.Distribution.defaultCacheBehavior
+        ),
+      ),
+      // One behavior per served prefix. Store objects have immutable uuid keys,
+      // so the long-TTL CachingOptimized policy is safe.
+      orderedCacheBehaviors: Pulumi.Input.make(
+        servedBuckets->Array.flatMap(sb =>
+          sb.prefixes->Array.map(prefix => {
+            PulumiAws.CloudFront.Distribution.pathPattern: Pulumi.Input.make(prefix ++ "/*"),
+            targetOriginId: Pulumi.Input.make(originIdFor(sb.id)),
+            viewerProtocolPolicy: Pulumi.Input.make("redirect-to-https"),
+            allowedMethods: Pulumi.Input.make(["GET", "HEAD"]),
+            cachedMethods: Pulumi.Input.make(["GET", "HEAD"]),
+            cachePolicyId: Pulumi.Input.make(cachingOptimizedPolicyId),
+          })
+        ),
+      ),
+      restrictions: Pulumi.Input.make({
+        PulumiAws.CloudFront.Distribution.geoRestriction: Pulumi.Input.make({
+          PulumiAws.CloudFront.Distribution.restrictionType: Pulumi.Input.make("none"),
+        }),
+      }),
+      viewerCertificate: Pulumi.Input.make(viewerCertificate),
+      comment: Pulumi.Input.make(name ++ " object store CDN"),
+      tags: AWS.Tags.make(
+        ~name=name ++ "-cdn",
+        ~kind=ReventlessCore.ComponentType.Platform,
+        ~role=Hosting,
+        ~scope=Platform,
+      ),
+    },
+  )
+
+  switch customDomain {
+  | None => ()
+  | Some({fqdn, hostedZoneId}) =>
+    let _ = PulumiAws.Route53.Record.make(
+      ~name=name ++ "-domain-alias",
+      ~args={
+        zoneId: Pulumi.Input.make(hostedZoneId),
+        name: Pulumi.Input.make(fqdn),
+        type_: Pulumi.Input.make("A"),
+        aliases: [
+          (
+            {
+              name: distribution.domainName->Pulumi.Output.asInput,
+              zoneId: Pulumi.Input.make(cloudFrontAliasZoneId),
+              evaluateTargetHealth: Pulumi.Input.make(false),
+            }: PulumiAws.Route53.Record.alias
+          ),
+        ]->Pulumi.Input.make,
+      },
+    )
+  }
+
+  // One policy per bucket — see the module doc above for why this is here and
+  // not in the consuming stack.
+  servedBuckets->Array.forEach(sb => {
+    let _ = PulumiAws.S3.BucketPolicy.make(
+      ~name=name ++ "-served-" ++ sb.id ++ "-policy",
+      ~args={
+        bucket: sb.bucketId,
+        policy: (sb.bucketArn->Pulumi.Output.fromInput, distribution.arn)
+          ->Pulumi.Output.all2
+          ->Pulumi.Output.apply(((bucketArn, distributionArn)) =>
+            {
+              "Version": "2012-10-17",
+              "Statement": [
+                {
+                  "Sid": "AllowCloudFrontServicePrincipal",
+                  "Effect": "Allow",
+                  "Principal": {"Service": "cloudfront.amazonaws.com"},
+                  "Action": "s3:GetObject",
+                  "Resource": bucketArn ++ "/*",
+                  "Condition": {
+                    "StringEquals": {"AWS:SourceArn": distributionArn},
+                  },
+                },
+              ],
+            }
+            ->JSON.stringifyAny
+            ->Option.getUnsafe
+          )
+          ->Pulumi.Output.asInput,
+      },
+    )
+  })
+
+  switch customDomain {
+  | Some({fqdn}) => Pulumi.Output.make("https://" ++ fqdn)
+  | None => distribution.domainName->Pulumi.Output.apply(d => "https://" ++ d)
+  }
+}

package/src/plugin/stack/Plugin_Stack.res.mjs

@@ -119,11 +119,11 @@ function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbac
     ],
     cachePolicyId: cachingDisabledPolicyId
   });
-  let orderedCacheBehaviors = servedBuckets.map(sb => {
-    let prefix = sb.prefix;
+  let orderedCacheBehaviors = servedBuckets.flatMap(sb => sb.prefixes.map(prefix => {
+    let originId = "served-" + sb.id;
     return {
       pathPattern: prefix + "/*",
-      targetOriginId: "served-" + prefix,
+      targetOriginId: originId,
       viewerProtocolPolicy: "redirect-to-https",
       allowedMethods: [
         "GET",
@@ -135,7 +135,7 @@ function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbac
       ],
       cachePolicyId: cachingOptimizedPolicyId
     };
-  }).concat([noCacheBehavior("/remoteEntry.js")].concat(spaFallback ? [
+  })).concat([noCacheBehavior("/remoteEntry.js")].concat(spaFallback ? [
       noCacheBehavior("/" + indexDocument),
       noCacheBehavior("/config.json")
     ] : []));
@@ -188,7 +188,7 @@ function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbac
           originAccessControlId: oacId
         }].concat(servedBuckets.map(sb => ({
         domainName: sb.bucketRegionalDomainName,
-        originId: "served-" + sb.prefix,
+        originId: "served-" + sb.id,
         originAccessControlId: oacId
       })));
     }),
@@ -253,7 +253,7 @@ function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbac
     }))
   });
   servedBuckets.forEach(sb => {
-    new (Aws.s3.BucketPolicy)(name + "-served-" + sb.prefix + "-policy", {
+    new (Aws.s3.BucketPolicy)(name + "-served-" + sb.id + "-policy", {
       bucket: sb.bucketId,
       policy: Pulumi.all([
         sb.bucketArn,
@@ -303,6 +303,121 @@ function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbac
   };
 }
 
+function makeServedBucketDistribution(name, servedBuckets, customDomain) {
+  let oac = new (Aws.cloudfront.OriginAccessControl)(name + "-oac", {
+    originAccessControlOriginType: "s3",
+    signingBehavior: "always",
+    signingProtocol: "sigv4"
+  });
+  let sb = servedBuckets[0];
+  let defaultOriginId = sb !== undefined ? "served-" + sb.id : Stdlib_JsError.throwWithMessage("Plugin_Stack.makeServedBucketDistribution: no served buckets — call only when at least one store is declared");
+  let viewerCertificate;
+  if (customDomain !== undefined) {
+    let usEast1 = _getUsEast1Provider();
+    let cert = new (Aws.acm.Certificate)(name + "-cert", {
+      domainName: customDomain.fqdn,
+      validationMethod: "DNS"
+    }, {
+      provider: Primitive_option.some(usEast1)
+    });
+    viewerCertificate = {
+      acmCertificateArn: cert.arn,
+      sslSupportMethod: "sni-only",
+      minimumProtocolVersion: "TLSv1.2_2021"
+    };
+  } else {
+    viewerCertificate = {
+      cloudfrontDefaultCertificate: true
+    };
+  }
+  let distribution = new (Aws.cloudfront.Distribution)(name + "-cdn", {
+    enabled: true,
+    aliases: customDomain !== undefined ? [customDomain.fqdn] : undefined,
+    origins: oac.id.apply(oacId => servedBuckets.map(sb => ({
+      domainName: sb.bucketRegionalDomainName,
+      originId: "served-" + sb.id,
+      originAccessControlId: oacId
+    }))),
+    defaultCacheBehavior: {
+      targetOriginId: defaultOriginId,
+      viewerProtocolPolicy: "redirect-to-https",
+      allowedMethods: [
+        "GET",
+        "HEAD"
+      ],
+      cachedMethods: [
+        "GET",
+        "HEAD"
+      ],
+      cachePolicyId: cachingOptimizedPolicyId
+    },
+    orderedCacheBehaviors: servedBuckets.flatMap(sb => sb.prefixes.map(prefix => ({
+      pathPattern: prefix + "/*",
+      targetOriginId: "served-" + sb.id,
+      viewerProtocolPolicy: "redirect-to-https",
+      allowedMethods: [
+        "GET",
+        "HEAD"
+      ],
+      cachedMethods: [
+        "GET",
+        "HEAD"
+      ],
+      cachePolicyId: cachingOptimizedPolicyId
+    }))),
+    restrictions: {
+      geoRestriction: {
+        restrictionType: "none"
+      }
+    },
+    viewerCertificate: viewerCertificate,
+    comment: name + " object store CDN",
+    tags: AWS_Tags$ReventlessAws.make(name + "-cdn", "Platform", "Hosting", "Platform", undefined, undefined, undefined, undefined)
+  });
+  if (customDomain !== undefined) {
+    new (Aws.route53.Record)(name + "-domain-alias", {
+      zoneId: customDomain.hostedZoneId,
+      name: customDomain.fqdn,
+      type: "A",
+      aliases: [{
+          name: distribution.domainName,
+          zoneId: cloudFrontAliasZoneId,
+          evaluateTargetHealth: false
+        }]
+    });
+  }
+  servedBuckets.forEach(sb => {
+    new (Aws.s3.BucketPolicy)(name + "-served-" + sb.id + "-policy", {
+      bucket: sb.bucketId,
+      policy: Pulumi.all([
+        sb.bucketArn,
+        distribution.arn
+      ]).apply(param => JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [{
+            Sid: "AllowCloudFrontServicePrincipal",
+            Effect: "Allow",
+            Principal: {
+              Service: "cloudfront.amazonaws.com"
+            },
+            Action: "s3:GetObject",
+            Resource: param[0] + "/*",
+            Condition: {
+              StringEquals: {
+                "AWS:SourceArn": param[1]
+              }
+            }
+          }]
+      }))
+    });
+  });
+  if (customDomain !== undefined) {
+    return Pulumi.output("https://" + customDomain.fqdn);
+  } else {
+    return distribution.domainName.apply(d => "https://" + d);
+  }
+}
+
 export {
   log,
   cachingOptimizedPolicyId,
@@ -313,5 +428,6 @@ export {
   cacheControlFor,
   invalidateDistribution,
   makeUiBundleDistribution,
+  makeServedBucketDistribution,
 }
 /* log Not a pure module */

package/src/util/Util_HostUiDomain.res

@@ -26,3 +26,20 @@ let parseProdStacks = (csv: string): array<string> =>
   ->String.split(",")
   ->Array.map(String.trim)
   ->Array.filter(s => s !== "")
+
+/**
+The stacks this deployment considers production, resolved from config.
+
+The one notion of "is this stack production", deliberately shared rather than
+answered twice. Domain naming asked it first; object-store layout asks it too,
+and a second key would be two flags that can disagree — the state where a stack
+gets a production domain and non-production storage, or the reverse, with
+nothing to flag the mismatch.
+
+Impure by necessity (it reads config); the derivations that consume it stay
+pure and unit-tested.
+*/
+let resolveProdStacks = (): array<string> =>
+  Util_LocalConfig.get("hostUiProdStacks")
+  ->Option.map(parseProdStacks)
+  ->Option.getOr(defaultProdStacks)

package/src/util/Util_HostUiDomain.res.mjs

@@ -1,5 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Util_LocalConfig$ReventlessAws from "./Util_LocalConfig.res.mjs";
 
 let defaultProdStacks = [
   "prod",
@@ -18,9 +20,14 @@ function parseProdStacks(csv) {
   return csv.split(",").map(prim => prim.trim()).filter(s => s !== "");
 }
 
+function resolveProdStacks() {
+  return Stdlib_Option.getOr(Stdlib_Option.map(Util_LocalConfig$ReventlessAws.get("hostUiProdStacks"), parseProdStacks), defaultProdStacks);
+}
+
 export {
   defaultProdStacks,
   deriveFqdn,
   parseProdStacks,
+  resolveProdStacks,
 }
-/* No side effect */
+/* Util_LocalConfig-ReventlessAws Not a pure module */