@reventlessdev/reventless-aws 3.0.0-alpha.240 → 3.0.0-alpha.241

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.241 (2026-07-29)
+
+### Features
+
+* **platform:** serve and publish declared object stores without a host UI ([9cc4700](https://github.com/ReventlessDev/reventless-core/commit/9cc4700dc96f05e3d35fbc912a4c7be7a5531337))
+
+
 # 3.0.0-alpha.240 (2026-07-28)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.240",
+  "version": "3.0.0-alpha.241",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,16 +12,16 @@
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.25",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.31",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.61",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.17",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.17",
     "@reventlessdev/reventless-core": "3.0.0-alpha.190",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.108",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.29",
     "@reventlessdev/reventless-postgres": "3.0.0-alpha.54",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.83",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.29"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.83"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -44,6 +44,40 @@ let splitApiOutputsRef: ref<option<splitApiOutputs>> = ref(None)
     Call after `makePlatform` — returns `None` in unified mode. */
 let getSplitApiOutputs = () => splitApiOutputsRef.contents
 
+// Object stores provisioned from field declarations — populated by
+// deployPlatform. Access via getObjectStoreEndpoints() after it has been called.
+//
+// A platform whose UI ships from its own stack needs each store's presign
+// endpoint, and `deployPlatform` is the only place that knows it. Without this
+// the store is provisioned and unnameable: the stores are built unconditionally,
+// but every consumer of them used to sit inside `switch hostUiBundle`. Same
+// reason `getSplitApiOutputs` exists — a root cannot re-export what it cannot
+// reach.
+type objectStoreEndpoint = {
+  // The store's qualified `{plugin}.{store}` name. The same string
+  // `pluginStructure.requiredStores` carries, so a UI's binding key and the
+  // declaration's identity are one value rather than two that can drift.
+  store: string,
+  // The path this store's keys are rooted at, and therefore the path it must be
+  // served under for a minted `/{key}` ref to resolve.
+  keyPrefix: string,
+  bucketName: string,
+  uploadUrl: Pulumi.Output.t<string>,
+  // Public base URL the store is served from, when the platform serves it
+  // itself. `None` when a host-UI bundle is deployed — there the shell's own
+  // origin serves the store same-origin and a relative `/{prefix}/…` resolves
+  // without a base.
+  baseUrl: option<Pulumi.Output.t<string>>,
+}
+let objectStoreEndpointsRef: ref<array<objectStoreEndpoint>> = ref([])
+
+/** Returns the object stores this platform provisioned from field declarations.
+
+    Empty when nothing is declared — a legitimate answer rather than a
+    call-order mistake, so this returns `[]` instead of throwing the way
+    `getApiConfig` does. */
+let getObjectStoreEndpoints = () => objectStoreEndpointsRef.contents
+
 module MakeWithConfig = (
   Config: {
     let splitApi: bool
@@ -1570,6 +1604,91 @@ module MakeWithConfig = (
       })
     )
 
+    // ── Serving the declared stores ───────────────────────────────────────
+    //
+    // A store's bucket blocks public policy and takes its read grant only from
+    // a distribution's BucketPolicy, so "provisioned" and "readable" are two
+    // different things. When a host UI bundle is deployed, its distribution
+    // fronts the stores same-origin (below) and a relative `/{prefix}/…`
+    // resolves with no base URL. When it is not, the platform fronts them
+    // itself — otherwise every declared store is write-only.
+    //
+    // Never both: two distributions fronting one bucket would each write the
+    // bucket's single allowed policy and silently unpick the other's grant.
+    // `Util_StoreLayout.servingFor` is where that exclusion is decided, so it is
+    // one testable choice rather than a condition spelled out here.
+    let storeServingBaseUrl: option<Pulumi.Output.t<string>> = switch Util_StoreLayout.servingFor(
+      ~hasHostUiBundle=hostUiBundle->Option.isSome,
+      ~declaredBucketCount=declaredServedBuckets->Array.length,
+    ) {
+    | NoStores | HostShell => None
+    | PlatformOwned =>
+      Some(
+        Plugin_Stack.makeServedBucketDistribution(
+          ~name="object-stores",
+          ~servedBuckets=declaredServedBuckets,
+        ),
+      )
+    }
+
+    let declaredStoreEndpoints = declaredStoreServices->Array.map(((
+      store,
+      keyPrefix,
+      bucketName,
+      uploadUrl,
+    )) => {store, keyPrefix, bucketName, uploadUrl, baseUrl: storeServingBaseUrl})
+    objectStoreEndpointsRef := declaredStoreEndpoints
+
+    // Exported unconditionally — the provisioning above already is. Their only
+    // consumers used to sit inside `switch hostUiBundle`, which left a platform
+    // whose UI ships from another stack holding stores it could not name.
+    //
+    // Omitted entirely when nothing is declared, so a deployment with no
+    // declared store keeps a byte-identical output set.
+    if declaredStoreEndpoints->Array.length > 0 {
+      Pulumi.Pulumi.export(
+        "uploadEndpoints",
+        declaredStoreEndpoints
+        ->Array.map(e => e.uploadUrl->Pulumi.Output.apply(u => (e.store, JSON.Encode.string(u))))
+        ->Pulumi.Output.all
+        ->Pulumi.Output.apply(pairs => pairs->Dict.fromArray->JSON.Encode.object),
+      )
+      Pulumi.Pulumi.export(
+        "objectStores",
+        declaredStoreEndpoints
+        ->Array.map(e =>
+          switch e.baseUrl {
+          | Some(u) => u->Pulumi.Output.apply(b => (e, Some(b)))
+          | None => Pulumi.Output.make((e, None))
+          }
+        )
+        ->Pulumi.Output.all
+        ->Pulumi.Output.apply(pairs =>
+          pairs
+          ->Array.map(((e, baseUrl)) => (
+            e.store,
+            [
+              ("bucketName", JSON.Encode.string(e.bucketName)),
+              ("keyPrefix", JSON.Encode.string(e.keyPrefix)),
+            ]
+            // Absent when the host shell serves the store: there the object is
+            // addressable same-origin and a base URL would be a second, and
+            // wrong, way to reach it.
+            ->Array.concat(
+              switch baseUrl {
+              | Some(b) => [("baseUrl", JSON.Encode.string(b))]
+              | None => []
+              },
+            )
+            ->Dict.fromArray
+            ->JSON.Encode.object,
+          ))
+          ->Dict.fromArray
+          ->JSON.Encode.object
+        ),
+      )
+    }
+
     // Host UI shell deployment — opt-in via ~hostUiBundle. The shell SPA is
     // hosted on its own CloudFront distribution; `config.json` is generated
     // at deploy time with the resolved API endpoints, region, and Cognito

package/src/Platform.res.mjs

@@ -116,6 +116,14 @@ function getSplitApiOutputs() {
   return splitApiOutputsRef.contents;
 }
 
+let objectStoreEndpointsRef = {
+  contents: []
+};
+
+function getObjectStoreEndpoints() {
+  return objectStoreEndpointsRef.contents;
+}
+
 function MakeWithConfig(Config) {
   Stdlib_Option.forEach(Config.commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
@@ -941,18 +949,76 @@ function MakeWithConfig(Config) {
       bucketArn: b.bucketArn,
       bucketRegionalDomainName: b.bucketRegionalDomainName
     })));
+    let match$1 = Util_StoreLayout$ReventlessAws.servingFor(Stdlib_Option.isSome(hostUiBundle), declaredServedBuckets.length);
+    let storeServingBaseUrl;
+    switch (match$1) {
+      case "NoStores" :
+      case "HostShell" :
+        storeServingBaseUrl = undefined;
+        break;
+      case "PlatformOwned" :
+        storeServingBaseUrl = Plugin_Stack$ReventlessAws.makeServedBucketDistribution("object-stores", declaredServedBuckets, undefined);
+        break;
+    }
+    let declaredStoreEndpoints = declaredStoreServices.map(param => ({
+      store: param[0],
+      keyPrefix: param[1],
+      bucketName: param[2],
+      uploadUrl: param[3],
+      baseUrl: storeServingBaseUrl
+    }));
+    objectStoreEndpointsRef.contents = declaredStoreEndpoints;
+    if (declaredStoreEndpoints.length !== 0) {
+      Pulumi$Pulumi.$$export("uploadEndpoints", Pulumi.all(declaredStoreEndpoints.map(e => e.uploadUrl.apply(u => [
+        e.store,
+        u
+      ]))).apply(pairs => Object.fromEntries(pairs)));
+      Pulumi$Pulumi.$$export("objectStores", Pulumi.all(declaredStoreEndpoints.map(e => {
+        let u = e.baseUrl;
+        if (u !== undefined) {
+          return u.apply(b => [
+            e,
+            b
+          ]);
+        } else {
+          return Pulumi.output([
+            e,
+            undefined
+          ]);
+        }
+      })).apply(pairs => Object.fromEntries(pairs.map(param => {
+        let baseUrl = param[1];
+        let e = param[0];
+        return [
+          e.store,
+          Object.fromEntries([
+            [
+              "bucketName",
+              e.bucketName
+            ],
+            [
+              "keyPrefix",
+              e.keyPrefix
+            ]
+          ].concat(baseUrl !== undefined ? [[
+                "baseUrl",
+                baseUrl
+              ]] : []))
+        ];
+      }))));
+    }
     if (hostUiBundle !== undefined) {
-      let match$1 = Util_LocalConfig$ReventlessAws.get("hostUiBaseDomain");
-      let match$2 = Util_LocalConfig$ReventlessAws.get("hostUiHostedZoneId");
+      let match$2 = Util_LocalConfig$ReventlessAws.get("hostUiBaseDomain");
+      let match$3 = Util_LocalConfig$ReventlessAws.get("hostUiHostedZoneId");
       let customDomain;
-      if (match$1 !== undefined && match$2 !== undefined) {
+      if (match$2 !== undefined && match$3 !== undefined) {
         let stack = Pulumi.getStack();
         let baseName = Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("hostUiBaseName"), Pulumi.getProject());
         let prodStacks = Stdlib_Option.getOr(Stdlib_Option.map(Util_LocalConfig$ReventlessAws.get("hostUiProdStacks"), Util_HostUiDomain$ReventlessAws.parseProdStacks), Util_HostUiDomain$ReventlessAws.defaultProdStacks);
-        let fqdn = Util_HostUiDomain$ReventlessAws.deriveFqdn(baseName, stack, match$1, prodStacks);
+        let fqdn = Util_HostUiDomain$ReventlessAws.deriveFqdn(baseName, stack, match$2, prodStacks);
         customDomain = {
           fqdn: fqdn,
-          hostedZoneId: match$2
+          hostedZoneId: match$3
         };
       } else {
         customDomain = undefined;
@@ -967,11 +1033,11 @@ function MakeWithConfig(Config) {
               bucketRegionalDomainName: store.bucketRegionalDomainName
             }] : []
       ).concat(declaredServedBuckets);
-      let match$3 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
+      let match$4 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
         "config.json",
         "ui-hints.json"
       ], customDomain, servedBuckets);
-      let bucketName = match$3.bucketName;
+      let bucketName = match$4.bucketName;
       let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
       let cognitoPool = Platform_Stack$ReventlessAws.resolveCognitoUserPool();
       let domainEventsEndpointOutput = domainEventsApiOpt !== undefined ? AppSync_EventsApi$ReventlessAws.httpEndpoint(domainEventsApiOpt).apply(ep => ep + "/event") : Pulumi.output(undefined);
@@ -1083,7 +1149,7 @@ function MakeWithConfig(Config) {
           contentType: "application/json"
         });
       }
-      Pulumi$Pulumi.$$export("hostShellUrl", match$3.distributionUrl);
+      Pulumi$Pulumi.$$export("hostShellUrl", match$4.distributionUrl);
     }
     return Pulumi$Pulumi.getOutputs();
   };
@@ -2027,18 +2093,76 @@ function Make($star) {
       bucketArn: b.bucketArn,
       bucketRegionalDomainName: b.bucketRegionalDomainName
     })));
+    let match$1 = Util_StoreLayout$ReventlessAws.servingFor(Stdlib_Option.isSome(hostUiBundle), declaredServedBuckets.length);
+    let storeServingBaseUrl;
+    switch (match$1) {
+      case "NoStores" :
+      case "HostShell" :
+        storeServingBaseUrl = undefined;
+        break;
+      case "PlatformOwned" :
+        storeServingBaseUrl = Plugin_Stack$ReventlessAws.makeServedBucketDistribution("object-stores", declaredServedBuckets, undefined);
+        break;
+    }
+    let declaredStoreEndpoints = declaredStoreServices.map(param => ({
+      store: param[0],
+      keyPrefix: param[1],
+      bucketName: param[2],
+      uploadUrl: param[3],
+      baseUrl: storeServingBaseUrl
+    }));
+    objectStoreEndpointsRef.contents = declaredStoreEndpoints;
+    if (declaredStoreEndpoints.length !== 0) {
+      Pulumi$Pulumi.$$export("uploadEndpoints", Pulumi.all(declaredStoreEndpoints.map(e => e.uploadUrl.apply(u => [
+        e.store,
+        u
+      ]))).apply(pairs => Object.fromEntries(pairs)));
+      Pulumi$Pulumi.$$export("objectStores", Pulumi.all(declaredStoreEndpoints.map(e => {
+        let u = e.baseUrl;
+        if (u !== undefined) {
+          return u.apply(b => [
+            e,
+            b
+          ]);
+        } else {
+          return Pulumi.output([
+            e,
+            undefined
+          ]);
+        }
+      })).apply(pairs => Object.fromEntries(pairs.map(param => {
+        let baseUrl = param[1];
+        let e = param[0];
+        return [
+          e.store,
+          Object.fromEntries([
+            [
+              "bucketName",
+              e.bucketName
+            ],
+            [
+              "keyPrefix",
+              e.keyPrefix
+            ]
+          ].concat(baseUrl !== undefined ? [[
+                "baseUrl",
+                baseUrl
+              ]] : []))
+        ];
+      }))));
+    }
     if (hostUiBundle !== undefined) {
-      let match$1 = Util_LocalConfig$ReventlessAws.get("hostUiBaseDomain");
-      let match$2 = Util_LocalConfig$ReventlessAws.get("hostUiHostedZoneId");
+      let match$2 = Util_LocalConfig$ReventlessAws.get("hostUiBaseDomain");
+      let match$3 = Util_LocalConfig$ReventlessAws.get("hostUiHostedZoneId");
       let customDomain;
-      if (match$1 !== undefined && match$2 !== undefined) {
+      if (match$2 !== undefined && match$3 !== undefined) {
         let stack = Pulumi.getStack();
         let baseName = Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("hostUiBaseName"), Pulumi.getProject());
         let prodStacks = Stdlib_Option.getOr(Stdlib_Option.map(Util_LocalConfig$ReventlessAws.get("hostUiProdStacks"), Util_HostUiDomain$ReventlessAws.parseProdStacks), Util_HostUiDomain$ReventlessAws.defaultProdStacks);
-        let fqdn = Util_HostUiDomain$ReventlessAws.deriveFqdn(baseName, stack, match$1, prodStacks);
+        let fqdn = Util_HostUiDomain$ReventlessAws.deriveFqdn(baseName, stack, match$2, prodStacks);
         customDomain = {
           fqdn: fqdn,
-          hostedZoneId: match$2
+          hostedZoneId: match$3
         };
       } else {
         customDomain = undefined;
@@ -2053,11 +2177,11 @@ function Make($star) {
               bucketRegionalDomainName: store.bucketRegionalDomainName
             }] : []
       ).concat(declaredServedBuckets);
-      let match$3 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
+      let match$4 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
         "config.json",
         "ui-hints.json"
       ], customDomain, servedBuckets);
-      let bucketName = match$3.bucketName;
+      let bucketName = match$4.bucketName;
       let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
       let cognitoPool = Platform_Stack$ReventlessAws.resolveCognitoUserPool();
       let domainEventsEndpointOutput = domainEventsApiOpt !== undefined ? AppSync_EventsApi$ReventlessAws.httpEndpoint(domainEventsApiOpt).apply(ep => ep + "/event") : Pulumi.output(undefined);
@@ -2169,7 +2293,7 @@ function Make($star) {
           contentType: "application/json"
         });
       }
-      Pulumi$Pulumi.$$export("hostShellUrl", match$3.distributionUrl);
+      Pulumi$Pulumi.$$export("hostShellUrl", match$4.distributionUrl);
     }
     return Pulumi$Pulumi.getOutputs();
   };
@@ -2321,6 +2445,8 @@ export {
   getApiConfig,
   splitApiOutputsRef,
   getSplitApiOutputs,
+  objectStoreEndpointsRef,
+  getObjectStoreEndpoints,
   MakeWithConfig,
   Make,
 }

package/src/plugin/stack/Plugin_Stack.res

@@ -538,3 +538,193 @@ let makeUiBundleDistribution = (
     bucketName: bucket.bucket,
   }
 }
+
+/**
+Front a set of served buckets with a CloudFront distribution of their own, with
+no SPA bundle behind it.
+
+`makeUiBundleDistribution` can already serve buckets, but only as a side car to
+a UI bundle. A platform that deploys no shell — because its UI ships from its
+own stack — still provisions stores and then has nothing to serve them from:
+the bucket is created with an all-true public-access block and takes its read
+grant solely from a distribution's `BucketPolicy`, so with no distribution the
+objects are unreachable by anything.
+
+Serving lives with the stack that owns the buckets, and that is not a style
+preference. **S3 permits exactly one bucket policy per bucket.** If the read
+grant were written by whichever stack happened to build a distribution, two
+distributions fronting one store would silently overwrite each other's grant —
+deploying green and 404ing the loser's objects. Keeping the policy next to the
+bucket makes a second writer impossible rather than merely discouraged.
+
+Returns the public base URL. A consumer needs that and the store's prefix to
+address an object; it needs no bucket identity at all, which is both a smaller
+contract and one that cannot collide.
+*/
+let makeServedBucketDistribution = (
+  ~name: string,
+  ~servedBuckets: array<ReventlessInfra.Platform.servedBucket>,
+  ~customDomain: option<customDomain>=?,
+): Pulumi.Output.t<string> => {
+  let oac = PulumiAws.CloudFront.OriginAccessControl.make(
+    ~name=name ++ "-oac",
+    ~args={
+      originAccessControlOriginType: Pulumi.Input.make("s3"),
+      signingBehavior: Pulumi.Input.make("always"),
+      signingProtocol: Pulumi.Input.make("sigv4"),
+    },
+  )
+
+  let originIdFor = (id: string): string => "served-" ++ id
+
+  // CloudFront requires a default behavior, and with no bundle origin there is
+  // nothing neutral to point it at. The first served bucket takes it; every
+  // real path is matched by its own `{prefix}/*` behavior first, so the default
+  // is only reached by a request for a path no store claims — which 404s at S3,
+  // the correct answer.
+  let defaultOriginId = switch servedBuckets->Array.get(0) {
+  | Some(sb) => originIdFor(sb.id)
+  | None =>
+    JsError.throwWithMessage(
+      "Plugin_Stack.makeServedBucketDistribution: no served buckets — call only when at least one store is declared",
+    )
+  }
+
+  let viewerCertificate: PulumiAws.CloudFront.Distribution.viewerCertificate = switch customDomain {
+  | None => {
+      cloudfrontDefaultCertificate: Pulumi.Input.make(true),
+    }
+  | Some({fqdn, hostedZoneId: _}) =>
+    let usEast1 = _getUsEast1Provider()
+    let cert = PulumiAws.Acm.Certificate.make(
+      ~name=name ++ "-cert",
+      ~args={
+        domainName: Pulumi.Input.make(fqdn),
+        validationMethod: Pulumi.Input.make("DNS"),
+      },
+      ~opts={provider: usEast1},
+    )
+    {
+      acmCertificateArn: cert.arn->Pulumi.Output.asInput,
+      sslSupportMethod: Pulumi.Input.make("sni-only"),
+      minimumProtocolVersion: Pulumi.Input.make("TLSv1.2_2021"),
+    }
+  }
+
+  let distribution = PulumiAws.CloudFront.Distribution.make(
+    ~name=name ++ "-cdn",
+    ~args={
+      enabled: Pulumi.Input.make(true),
+      aliases: ?switch customDomain {
+      | None => None
+      | Some({fqdn}) => Some(Pulumi.Input.make([fqdn]))
+      },
+      origins: oac.id->Pulumi.Output.apply(oacId =>
+        servedBuckets->Array.map(sb => {
+          PulumiAws.CloudFront.Distribution.domainName: sb.bucketRegionalDomainName,
+          originId: Pulumi.Input.make(originIdFor(sb.id)),
+          originAccessControlId: Pulumi.Input.make(oacId),
+        })
+      )
+      ->Pulumi.Output.asInput,
+      defaultCacheBehavior: Pulumi.Input.make(
+        (
+          {
+            targetOriginId: Pulumi.Input.make(defaultOriginId),
+            viewerProtocolPolicy: Pulumi.Input.make("redirect-to-https"),
+            allowedMethods: Pulumi.Input.make(["GET", "HEAD"]),
+            cachedMethods: Pulumi.Input.make(["GET", "HEAD"]),
+            cachePolicyId: Pulumi.Input.make(cachingOptimizedPolicyId),
+          }: PulumiAws.CloudFront.Distribution.defaultCacheBehavior
+        ),
+      ),
+      // One behavior per served prefix. Store objects have immutable uuid keys,
+      // so the long-TTL CachingOptimized policy is safe.
+      orderedCacheBehaviors: Pulumi.Input.make(
+        servedBuckets->Array.flatMap(sb =>
+          sb.prefixes->Array.map(prefix => {
+            PulumiAws.CloudFront.Distribution.pathPattern: Pulumi.Input.make(prefix ++ "/*"),
+            targetOriginId: Pulumi.Input.make(originIdFor(sb.id)),
+            viewerProtocolPolicy: Pulumi.Input.make("redirect-to-https"),
+            allowedMethods: Pulumi.Input.make(["GET", "HEAD"]),
+            cachedMethods: Pulumi.Input.make(["GET", "HEAD"]),
+            cachePolicyId: Pulumi.Input.make(cachingOptimizedPolicyId),
+          })
+        ),
+      ),
+      restrictions: Pulumi.Input.make({
+        PulumiAws.CloudFront.Distribution.geoRestriction: Pulumi.Input.make({
+          PulumiAws.CloudFront.Distribution.restrictionType: Pulumi.Input.make("none"),
+        }),
+      }),
+      viewerCertificate: Pulumi.Input.make(viewerCertificate),
+      comment: Pulumi.Input.make(name ++ " object store CDN"),
+      tags: AWS.Tags.make(
+        ~name=name ++ "-cdn",
+        ~kind=ReventlessCore.ComponentType.Platform,
+        ~role=Hosting,
+        ~scope=Platform,
+      ),
+    },
+  )
+
+  switch customDomain {
+  | None => ()
+  | Some({fqdn, hostedZoneId}) =>
+    let _ = PulumiAws.Route53.Record.make(
+      ~name=name ++ "-domain-alias",
+      ~args={
+        zoneId: Pulumi.Input.make(hostedZoneId),
+        name: Pulumi.Input.make(fqdn),
+        type_: Pulumi.Input.make("A"),
+        aliases: [
+          (
+            {
+              name: distribution.domainName->Pulumi.Output.asInput,
+              zoneId: Pulumi.Input.make(cloudFrontAliasZoneId),
+              evaluateTargetHealth: Pulumi.Input.make(false),
+            }: PulumiAws.Route53.Record.alias
+          ),
+        ]->Pulumi.Input.make,
+      },
+    )
+  }
+
+  // One policy per bucket — see the module doc above for why this is here and
+  // not in the consuming stack.
+  servedBuckets->Array.forEach(sb => {
+    let _ = PulumiAws.S3.BucketPolicy.make(
+      ~name=name ++ "-served-" ++ sb.id ++ "-policy",
+      ~args={
+        bucket: sb.bucketId,
+        policy: (sb.bucketArn->Pulumi.Output.fromInput, distribution.arn)
+          ->Pulumi.Output.all2
+          ->Pulumi.Output.apply(((bucketArn, distributionArn)) =>
+            {
+              "Version": "2012-10-17",
+              "Statement": [
+                {
+                  "Sid": "AllowCloudFrontServicePrincipal",
+                  "Effect": "Allow",
+                  "Principal": {"Service": "cloudfront.amazonaws.com"},
+                  "Action": "s3:GetObject",
+                  "Resource": bucketArn ++ "/*",
+                  "Condition": {
+                    "StringEquals": {"AWS:SourceArn": distributionArn},
+                  },
+                },
+              ],
+            }
+            ->JSON.stringifyAny
+            ->Option.getUnsafe
+          )
+          ->Pulumi.Output.asInput,
+      },
+    )
+  })
+
+  switch customDomain {
+  | Some({fqdn}) => Pulumi.Output.make("https://" ++ fqdn)
+  | None => distribution.domainName->Pulumi.Output.apply(d => "https://" ++ d)
+  }
+}

package/src/plugin/stack/Plugin_Stack.res.mjs

@@ -303,6 +303,121 @@ function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbac
   };
 }
 
+function makeServedBucketDistribution(name, servedBuckets, customDomain) {
+  let oac = new (Aws.cloudfront.OriginAccessControl)(name + "-oac", {
+    originAccessControlOriginType: "s3",
+    signingBehavior: "always",
+    signingProtocol: "sigv4"
+  });
+  let sb = servedBuckets[0];
+  let defaultOriginId = sb !== undefined ? "served-" + sb.id : Stdlib_JsError.throwWithMessage("Plugin_Stack.makeServedBucketDistribution: no served buckets — call only when at least one store is declared");
+  let viewerCertificate;
+  if (customDomain !== undefined) {
+    let usEast1 = _getUsEast1Provider();
+    let cert = new (Aws.acm.Certificate)(name + "-cert", {
+      domainName: customDomain.fqdn,
+      validationMethod: "DNS"
+    }, {
+      provider: Primitive_option.some(usEast1)
+    });
+    viewerCertificate = {
+      acmCertificateArn: cert.arn,
+      sslSupportMethod: "sni-only",
+      minimumProtocolVersion: "TLSv1.2_2021"
+    };
+  } else {
+    viewerCertificate = {
+      cloudfrontDefaultCertificate: true
+    };
+  }
+  let distribution = new (Aws.cloudfront.Distribution)(name + "-cdn", {
+    enabled: true,
+    aliases: customDomain !== undefined ? [customDomain.fqdn] : undefined,
+    origins: oac.id.apply(oacId => servedBuckets.map(sb => ({
+      domainName: sb.bucketRegionalDomainName,
+      originId: "served-" + sb.id,
+      originAccessControlId: oacId
+    }))),
+    defaultCacheBehavior: {
+      targetOriginId: defaultOriginId,
+      viewerProtocolPolicy: "redirect-to-https",
+      allowedMethods: [
+        "GET",
+        "HEAD"
+      ],
+      cachedMethods: [
+        "GET",
+        "HEAD"
+      ],
+      cachePolicyId: cachingOptimizedPolicyId
+    },
+    orderedCacheBehaviors: servedBuckets.flatMap(sb => sb.prefixes.map(prefix => ({
+      pathPattern: prefix + "/*",
+      targetOriginId: "served-" + sb.id,
+      viewerProtocolPolicy: "redirect-to-https",
+      allowedMethods: [
+        "GET",
+        "HEAD"
+      ],
+      cachedMethods: [
+        "GET",
+        "HEAD"
+      ],
+      cachePolicyId: cachingOptimizedPolicyId
+    }))),
+    restrictions: {
+      geoRestriction: {
+        restrictionType: "none"
+      }
+    },
+    viewerCertificate: viewerCertificate,
+    comment: name + " object store CDN",
+    tags: AWS_Tags$ReventlessAws.make(name + "-cdn", "Platform", "Hosting", "Platform", undefined, undefined, undefined, undefined)
+  });
+  if (customDomain !== undefined) {
+    new (Aws.route53.Record)(name + "-domain-alias", {
+      zoneId: customDomain.hostedZoneId,
+      name: customDomain.fqdn,
+      type: "A",
+      aliases: [{
+          name: distribution.domainName,
+          zoneId: cloudFrontAliasZoneId,
+          evaluateTargetHealth: false
+        }]
+    });
+  }
+  servedBuckets.forEach(sb => {
+    new (Aws.s3.BucketPolicy)(name + "-served-" + sb.id + "-policy", {
+      bucket: sb.bucketId,
+      policy: Pulumi.all([
+        sb.bucketArn,
+        distribution.arn
+      ]).apply(param => JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [{
+            Sid: "AllowCloudFrontServicePrincipal",
+            Effect: "Allow",
+            Principal: {
+              Service: "cloudfront.amazonaws.com"
+            },
+            Action: "s3:GetObject",
+            Resource: param[0] + "/*",
+            Condition: {
+              StringEquals: {
+                "AWS:SourceArn": param[1]
+              }
+            }
+          }]
+      }))
+    });
+  });
+  if (customDomain !== undefined) {
+    return Pulumi.output("https://" + customDomain.fqdn);
+  } else {
+    return distribution.domainName.apply(d => "https://" + d);
+  }
+}
+
 export {
   log,
   cachingOptimizedPolicyId,
@@ -313,5 +428,6 @@ export {
   cacheControlFor,
   invalidateDistribution,
   makeUiBundleDistribution,
+  makeServedBucketDistribution,
 }
 /* log Not a pure module */

package/src/util/Util_StoreLayout.res

@@ -34,6 +34,16 @@ type protection =
   | Protected
   | Unprotected
 
+/** Which distribution fronts the declared stores. */
+type serving =
+  /** No store is declared, so nothing is served. */
+  | NoStores
+  /** The host shell's own distribution serves them same-origin, so a minted
+      `/{prefix}/…` ref resolves relative and there is no base URL. */
+  | HostShell
+  /** The platform fronts them itself, because no host shell is deployed. */
+  | PlatformOwned
+
 /**
 Stack-name prefixes whose stacks are disposable.
 
@@ -102,3 +112,25 @@ The cost is a slightly redundant prefix inside a dedicated bucket
 (`catalog-productImages/productImages/…`). Take the redundancy.
 */
 let keyPrefixFor = (~store: string): string => store
+
+/**
+Who serves the declared stores — and the answer is never "both".
+
+A store's bucket blocks public policy and takes its read grant solely from a
+distribution's `BucketPolicy`. **S3 permits exactly one bucket policy per
+bucket**, so two distributions fronting one store would each write that single
+policy and silently unpick the other's grant: green deploy, 404s afterwards.
+Making this one function's return a three-way choice is what keeps "both" from
+being expressible.
+
+The polarity is the useful part. Provisioning a store and serving it are
+separate; before this, serving happened only as a side car to a host-UI bundle,
+so a platform whose UI shipped from its own stack provisioned stores that
+nothing could read.
+*/
+let servingFor = (~hasHostUiBundle: bool, ~declaredBucketCount: int): serving =>
+  switch (hasHostUiBundle, declaredBucketCount) {
+  | (_, 0) => NoStores
+  | (true, _) => HostShell
+  | (false, _) => PlatformOwned
+  }

package/src/util/Util_StoreLayout.res.mjs

@@ -32,11 +32,24 @@ function keyPrefixFor(store) {
   return store;
 }
 
+function servingFor(hasHostUiBundle, declaredBucketCount) {
+  if (declaredBucketCount !== 0) {
+    if (hasHostUiBundle) {
+      return "HostShell";
+    } else {
+      return "PlatformOwned";
+    }
+  } else {
+    return "NoStores";
+  }
+}
+
 export {
   defaultEphemeralPrefixes,
   layoutFor,
   protectionFor,
   bucketNameFor,
   keyPrefixFor,
+  servingFor,
 }
 /* No side effect */

package/tests/Util_StoreLayoutTest.res

@@ -40,6 +40,46 @@ describe("Util_StoreLayout.layoutFor", () => {
   )
 })
 
+describe("Util_StoreLayout.servingFor", () => {
+  testSync("no declared store means nothing to serve", () =>
+    expect(Util_StoreLayout.servingFor(~hasHostUiBundle=false, ~declaredBucketCount=0))->toEqual(
+      Util_StoreLayout.NoStores,
+    )
+  )
+
+  testSync("a host shell serves the stores from its own origin", () =>
+    expect(Util_StoreLayout.servingFor(~hasHostUiBundle=true, ~declaredBucketCount=1))->toEqual(
+      Util_StoreLayout.HostShell,
+    )
+  )
+
+  // The case that was previously unrepresentable and produced a write-only
+  // store: stores are provisioned unconditionally, but serving used to happen
+  // only as a side car to a host-UI bundle.
+  testSync("no host shell means the platform serves them itself", () =>
+    expect(Util_StoreLayout.servingFor(~hasHostUiBundle=false, ~declaredBucketCount=1))->toEqual(
+      Util_StoreLayout.PlatformOwned,
+    )
+  )
+
+  // A bucket carries exactly one policy, so two distributions fronting one
+  // store would unpick each other's read grant. The three-way return is what
+  // makes "both" unrepresentable — asserted so it stays that way.
+  testSync("a host shell wins even with several buckets — never both", () =>
+    expect(Util_StoreLayout.servingFor(~hasHostUiBundle=true, ~declaredBucketCount=3))->toEqual(
+      Util_StoreLayout.HostShell,
+    )
+  )
+
+  // Declaring nothing outranks having a shell: with no store there is no
+  // bucket, no policy and no origin, whoever is deployed.
+  testSync("no store outranks a host shell", () =>
+    expect(Util_StoreLayout.servingFor(~hasHostUiBundle=true, ~declaredBucketCount=0))->toEqual(
+      Util_StoreLayout.NoStores,
+    )
+  )
+})
+
 describe("Util_StoreLayout.protectionFor", () => {
   // The pairing a single layout-driven switch would have got wrong: alpha
   // shares a bucket and is still protected.

package/tests/Util_StoreLayoutTest.res.mjs

@@ -27,6 +27,24 @@ globalThis.describe("Util_StoreLayout.layoutFor", () => {
   });
 });
 
+globalThis.describe("Util_StoreLayout.servingFor", () => {
+  globalThis.test("no declared store means nothing to serve", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.servingFor(false, 0)).toEqual("NoStores");
+  });
+  globalThis.test("a host shell serves the stores from its own origin", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.servingFor(true, 1)).toEqual("HostShell");
+  });
+  globalThis.test("no host shell means the platform serves them itself", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.servingFor(false, 1)).toEqual("PlatformOwned");
+  });
+  globalThis.test("a host shell wins even with several buckets — never both", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.servingFor(true, 3)).toEqual("HostShell");
+  });
+  globalThis.test("no store outranks a host shell", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.servingFor(true, 0)).toEqual("NoStores");
+  });
+});
+
 globalThis.describe("Util_StoreLayout.protectionFor", () => {
   globalThis.test("alpha shares a bucket and is still protected", () => {
     globalThis.expect(Util_StoreLayout$ReventlessAws.layoutFor("alpha", Util_HostUiDomain$ReventlessAws.defaultProdStacks)).toEqual("SharedBucket");