@reventlessdev/reventless-aws 3.0.0-alpha.240 → 3.0.0-alpha.242

package/CHANGELOG.md

@@ -3,6 +3,23 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.242 (2026-07-29)
+
+### Bug Fixes
+
+* **platform:** export the bucket's physical name, not the layout's ([43b8ba4](https://github.com/ReventlessDev/reventless-core/commit/43b8ba4f04499c918c7c16921962ad640ea20198))
+### Features
+
+* **platform:** fail a plugin deploy that needs a store the platform lacks ([8f2b6e6](https://github.com/ReventlessDev/reventless-core/commit/8f2b6e6ca8ea472c70bee40e57c959a64f2a7b4e))
+
+
+# 3.0.0-alpha.241 (2026-07-29)
+
+### Features
+
+* **platform:** serve and publish declared object stores without a host UI ([9cc4700](https://github.com/ReventlessDev/reventless-core/commit/9cc4700dc96f05e3d35fbc912a4c7be7a5531337))
+
+
 # 3.0.0-alpha.240 (2026-07-28)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.240",
+  "version": "3.0.0-alpha.242",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,16 +12,16 @@
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "2.2.0-alpha.25",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.31",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.9",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.61",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.17",
     "@reventlessdev/rescript-uuid": "1.1.0-alpha.17",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.190",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.108",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.54",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.83",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.29"
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.29",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.84",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.109",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.55",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.191"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -44,6 +44,45 @@ let splitApiOutputsRef: ref<option<splitApiOutputs>> = ref(None)
     Call after `makePlatform` — returns `None` in unified mode. */
 let getSplitApiOutputs = () => splitApiOutputsRef.contents
 
+// Object stores provisioned from field declarations — populated by
+// deployPlatform. Access via getObjectStoreEndpoints() after it has been called.
+//
+// A platform whose UI ships from its own stack needs each store's presign
+// endpoint, and `deployPlatform` is the only place that knows it. Without this
+// the store is provisioned and unnameable: the stores are built unconditionally,
+// but every consumer of them used to sit inside `switch hostUiBundle`. Same
+// reason `getSplitApiOutputs` exists — a root cannot re-export what it cannot
+// reach.
+type objectStoreEndpoint = {
+  // The store's qualified `{plugin}.{store}` name. The same string
+  // `pluginStructure.requiredStores` carries, so a UI's binding key and the
+  // declaration's identity are one value rather than two that can drift.
+  store: string,
+  // The path this store's keys are rooted at, and therefore the path it must be
+  // served under for a minted `/{key}` ref to resolve.
+  keyPrefix: string,
+  // The bucket's **physical** name, which is not the name the layout computes:
+  // Pulumi auto-names the resource, so a `SharedBucket` stack asking for
+  // `alpha-stores` gets `alpha-stores-507202d`. An Output because that suffix is
+  // only known after the bucket resolves — and a plain string here is exactly
+  // how this shipped exporting a bucket name that no ARN matches.
+  bucketName: Pulumi.Output.t<string>,
+  uploadUrl: Pulumi.Output.t<string>,
+  // Public base URL the store is served from, when the platform serves it
+  // itself. `None` when a host-UI bundle is deployed — there the shell's own
+  // origin serves the store same-origin and a relative `/{prefix}/…` resolves
+  // without a base.
+  baseUrl: option<Pulumi.Output.t<string>>,
+}
+let objectStoreEndpointsRef: ref<array<objectStoreEndpoint>> = ref([])
+
+/** Returns the object stores this platform provisioned from field declarations.
+
+    Empty when nothing is declared — a legitimate answer rather than a
+    call-order mistake, so this returns `[]` instead of throwing the way
+    `getApiConfig` does. */
+let getObjectStoreEndpoints = () => objectStoreEndpointsRef.contents
+
 module MakeWithConfig = (
   Config: {
     let splitApi: bool
@@ -1552,7 +1591,11 @@ module MakeWithConfig = (
         ~bucketName=storeHandle.bucketName,
         ~servedPrefix=storeHandle.keyPrefix,
       )
-      (`${plugin}.${store}`, keyPrefix, bucketName, presign.url)
+      // `bucketName` is the layout's *logical* name and groups the served view
+      // below; `storeHandle.bucketName` is the physical one Pulumi resolves, and
+      // is what a consumer needs to build an ARN. Carrying both is the point —
+      // they are different strings and only one of them exists in S3.
+      (`${plugin}.${store}`, keyPrefix, bucketName, storeHandle.bucketName, presign.url)
     })
 
     // Group the served view by bucket: one origin and one bucket policy per
@@ -1563,13 +1606,105 @@ module MakeWithConfig = (
       ->Option.map(b => {
         ReventlessInfra.Platform.id: bucketName,
         prefixes: declaredStoreServices
-        ->Array.filterMap(((_, prefix, bn, _)) => bn == bucketName ? Some(prefix) : None),
+        ->Array.filterMap(((_, prefix, bn, _, _)) => bn == bucketName ? Some(prefix) : None),
         bucketId: b.bucketId,
         bucketArn: b.bucketArn,
         bucketRegionalDomainName: b.bucketRegionalDomainName,
       })
     )
 
+    // ── Serving the declared stores ───────────────────────────────────────
+    //
+    // A store's bucket blocks public policy and takes its read grant only from
+    // a distribution's BucketPolicy, so "provisioned" and "readable" are two
+    // different things. When a host UI bundle is deployed, its distribution
+    // fronts the stores same-origin (below) and a relative `/{prefix}/…`
+    // resolves with no base URL. When it is not, the platform fronts them
+    // itself — otherwise every declared store is write-only.
+    //
+    // Never both: two distributions fronting one bucket would each write the
+    // bucket's single allowed policy and silently unpick the other's grant.
+    // `Util_StoreLayout.servingFor` is where that exclusion is decided, so it is
+    // one testable choice rather than a condition spelled out here.
+    let storeServingBaseUrl: option<Pulumi.Output.t<string>> = switch Util_StoreLayout.servingFor(
+      ~hasHostUiBundle=hostUiBundle->Option.isSome,
+      ~declaredBucketCount=declaredServedBuckets->Array.length,
+    ) {
+    | NoStores | HostShell => None
+    | PlatformOwned =>
+      Some(
+        Plugin_Stack.makeServedBucketDistribution(
+          ~name="object-stores",
+          ~servedBuckets=declaredServedBuckets,
+        ),
+      )
+    }
+
+    let declaredStoreEndpoints = declaredStoreServices->Array.map(((
+      store,
+      keyPrefix,
+      _logicalBucketName,
+      physicalBucketName,
+      uploadUrl,
+    )) => {
+      store,
+      keyPrefix,
+      bucketName: physicalBucketName->Pulumi.Output.fromInput,
+      uploadUrl,
+      baseUrl: storeServingBaseUrl,
+    })
+    objectStoreEndpointsRef := declaredStoreEndpoints
+
+    // Exported unconditionally — the provisioning above already is. Their only
+    // consumers used to sit inside `switch hostUiBundle`, which left a platform
+    // whose UI ships from another stack holding stores it could not name.
+    //
+    // Omitted entirely when nothing is declared, so a deployment with no
+    // declared store keeps a byte-identical output set.
+    if declaredStoreEndpoints->Array.length > 0 {
+      Pulumi.Pulumi.export(
+        "uploadEndpoints",
+        declaredStoreEndpoints
+        ->Array.map(e => e.uploadUrl->Pulumi.Output.apply(u => (e.store, JSON.Encode.string(u))))
+        ->Pulumi.Output.all
+        ->Pulumi.Output.apply(pairs => pairs->Dict.fromArray->JSON.Encode.object),
+      )
+      Pulumi.Pulumi.export(
+        "objectStores",
+        declaredStoreEndpoints
+        ->Array.map(e =>
+          Pulumi.Output.all2((e.bucketName, e.baseUrl->Pulumi.Output.allOpt))->Pulumi.Output.apply(((
+            bucketName,
+            baseUrl,
+          )) => (e, bucketName, baseUrl))
+        )
+        ->Pulumi.Output.all
+        ->Pulumi.Output.apply(resolved =>
+          resolved
+          ->Array.map(((e, bucketName, baseUrl)) => (
+            e.store,
+            [
+              ("bucketName", JSON.Encode.string(bucketName)),
+              ("keyPrefix", JSON.Encode.string(e.keyPrefix)),
+            ]
+            // Absent when the host shell serves the store: there the object is
+            // addressable same-origin and a base URL would be a second, and
+            // wrong, way to reach it.
+            ->Array.concat(
+              switch baseUrl {
+              | Some(b) => [("baseUrl", JSON.Encode.string(b))]
+              | None => []
+              },
+            )
+            ->Dict.fromArray
+            ->JSON.Encode.object,
+          ))
+          ->Dict.fromArray
+          ->JSON.Encode.object
+        ),
+      )
+    }
+
     // Host UI shell deployment — opt-in via ~hostUiBundle. The shell SPA is
     // hosted on its own CloudFront distribution; `config.json` is generated
     // at deploy time with the resolved API endpoints, region, and Cognito
@@ -1706,7 +1841,7 @@ module MakeWithConfig = (
       // built before per-store binding reads it and is unaffected.
       let storeUploadEndpointsOutput: Pulumi.Output.t<array<(string, string)>> =
         declaredStoreServices
-        ->Array.map(((qualified, _, _, url)) => url->Pulumi.Output.apply(u => (qualified, u)))
+        ->Array.map(((qualified, _, _, _, url)) => url->Pulumi.Output.apply(u => (qualified, u)))
         ->Pulumi.Output.all
 
       let configJsonContent =
@@ -1934,11 +2069,66 @@ module MakeWithConfig = (
         ~mergedApiIdentifier=checkedMergedApiArn,
         ~association,
       )
+
+      // ── Capability coverage ────────────────────────────────────────────────
+      //
+      // `requiredStores` is what this plugin's fields *declare*; the platform's
+      // `objectStores` output is what it actually provisioned. A store in the
+      // first and not the second is the split-stack ordering hazard: the
+      // platform deploys before the plugin and cannot see the plugin's schemas,
+      // so the capability list is hand-written and can simply be wrong.
+      //
+      // It is worth failing on because every symptom is silent. The upload
+      // input finds no per-store endpoint, falls back to the legacy single
+      // service, and writes to whatever bucket that serves — a 2xx, a plausible
+      // ref, and the wrong destination. A case slip in the hand-written name
+      // produces exactly that, and so does forgetting the entry entirely.
+      //
+      // Two outcomes rather than one, because "you got it wrong" and "you have
+      // not started" deserve different answers. A platform exporting no stores
+      // at all has not adopted capability provisioning; failing it would break
+      // deployments that are working. A platform exporting *some* stores but
+      // not this one has adopted it and is missing or misspelling an entry.
+      //
+      // Folded into the association export for the same reason the merge gate
+      // is: a dangling `apply` is not guaranteed to be evaluated, and a check
+      // that might not run is not a check.
+      let capabilityGate: Pulumi.Output.t<unit> =
+        (pluginOutputs.pluginStructure, stackRef->Pulumi.StackReference.getOutput("objectStores"))
+        ->Pulumi.Output.all2
+        ->Pulumi.Output.apply((((structure, objectStores): (_, option<JSON.t>))) => {
+          let required =
+            structure->Option.flatMap(s => s.requiredStores)->Option.getOr([])
+          let provisioned =
+            objectStores
+            ->Option.flatMap(JSON.Decode.object)
+            ->Option.map(Dict.keysToArray)
+            ->Option.getOr([])
+          switch Util_StoreLayout.coverageFor(~required, ~provisioned) {
+          | Covered => ()
+          | NotAdopted(missing) =>
+            log.warn(
+              ~comp="Platform:deployPlugin",
+              `declares ${missing->Array.join(", ")} but the platform stack provisions no object stores — ` ++
+              `add them to the platform's ~capabilities and redeploy the platform first, ` ++
+              `or uploads will fall back to the legacy service and write to the wrong bucket`,
+            )
+          | Missing({missing, provisioned}) =>
+            JsError.throwWithMessage(
+              `Plugin requires object store(s) the platform does not provision: ${missing->Array.join(", ")}.\n` ++
+              `  The platform stack provisions: ${provisioned->Array.join(", ")}.\n` ++
+              `  A store's key is {plugin}.{store}, where {plugin} is the name the plugin registers — ` ++
+              `check the capability's spelling and case against it.\n` ++
+              `  Add the missing entr(ies) to the platform's ~capabilities and redeploy the platform stack first.`,
+            )
+          }
+        })
+
       Pulumi.Pulumi.export(
         "sourceApiAssociationId",
-        (association.associationId, mergeGate)
-        ->Pulumi.Output.all2
-        ->Pulumi.Output.apply(((id, _)) => id),
+        (association.associationId, mergeGate, capabilityGate)
+        ->Pulumi.Output.all3
+        ->Pulumi.Output.apply(((id, _, _)) => id),
       )
       Pulumi.Pulumi.export(
         "pluginSourceApiId",

package/src/Platform.res.mjs

@@ -11,6 +11,7 @@ import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output
 import * as Pulumi$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Pulumi.res.mjs";
 import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Plugin$ReventlessAws from "./components/Plugin.res.mjs";
 import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
@@ -116,6 +117,14 @@ function getSplitApiOutputs() {
   return splitApiOutputsRef.contents;
 }
 
+let objectStoreEndpointsRef = {
+  contents: []
+};
+
+function getObjectStoreEndpoints() {
+  return objectStoreEndpointsRef.contents;
+}
+
 function MakeWithConfig(Config) {
   Stdlib_Option.forEach(Config.commandHandlerConfig.aggregates, param => {
     Stdlib_Option.forEach(param.sync, AggregateRuntime_Builder_Single$ReventlessAws.setConfig);
@@ -927,6 +936,7 @@ function MakeWithConfig(Config) {
         plugin + `.` + store,
         keyPrefix,
         bucketName,
+        storeHandle.bucketName,
         presign.url
       ];
     });
@@ -941,18 +951,70 @@ function MakeWithConfig(Config) {
       bucketArn: b.bucketArn,
       bucketRegionalDomainName: b.bucketRegionalDomainName
     })));
+    let match$1 = Util_StoreLayout$ReventlessAws.servingFor(Stdlib_Option.isSome(hostUiBundle), declaredServedBuckets.length);
+    let storeServingBaseUrl;
+    switch (match$1) {
+      case "NoStores" :
+      case "HostShell" :
+        storeServingBaseUrl = undefined;
+        break;
+      case "PlatformOwned" :
+        storeServingBaseUrl = Plugin_Stack$ReventlessAws.makeServedBucketDistribution("object-stores", declaredServedBuckets, undefined);
+        break;
+    }
+    let declaredStoreEndpoints = declaredStoreServices.map(param => ({
+      store: param[0],
+      keyPrefix: param[1],
+      bucketName: param[3],
+      uploadUrl: param[4],
+      baseUrl: storeServingBaseUrl
+    }));
+    objectStoreEndpointsRef.contents = declaredStoreEndpoints;
+    if (declaredStoreEndpoints.length !== 0) {
+      Pulumi$Pulumi.$$export("uploadEndpoints", Pulumi.all(declaredStoreEndpoints.map(e => e.uploadUrl.apply(u => [
+        e.store,
+        u
+      ]))).apply(pairs => Object.fromEntries(pairs)));
+      Pulumi$Pulumi.$$export("objectStores", Pulumi.all(declaredStoreEndpoints.map(e => Pulumi.all([
+        e.bucketName,
+        Output$Pulumi.allOpt(e.baseUrl)
+      ]).apply(param => [
+        e,
+        param[0],
+        param[1]
+      ]))).apply(resolved => Object.fromEntries(resolved.map(param => {
+        let baseUrl = param[2];
+        let e = param[0];
+        return [
+          e.store,
+          Object.fromEntries([
+            [
+              "bucketName",
+              param[1]
+            ],
+            [
+              "keyPrefix",
+              e.keyPrefix
+            ]
+          ].concat(baseUrl !== undefined ? [[
+                "baseUrl",
+                baseUrl
+              ]] : []))
+        ];
+      }))));
+    }
     if (hostUiBundle !== undefined) {
-      let match$1 = Util_LocalConfig$ReventlessAws.get("hostUiBaseDomain");
-      let match$2 = Util_LocalConfig$ReventlessAws.get("hostUiHostedZoneId");
+      let match$2 = Util_LocalConfig$ReventlessAws.get("hostUiBaseDomain");
+      let match$3 = Util_LocalConfig$ReventlessAws.get("hostUiHostedZoneId");
       let customDomain;
-      if (match$1 !== undefined && match$2 !== undefined) {
+      if (match$2 !== undefined && match$3 !== undefined) {
         let stack = Pulumi.getStack();
         let baseName = Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("hostUiBaseName"), Pulumi.getProject());
         let prodStacks = Stdlib_Option.getOr(Stdlib_Option.map(Util_LocalConfig$ReventlessAws.get("hostUiProdStacks"), Util_HostUiDomain$ReventlessAws.parseProdStacks), Util_HostUiDomain$ReventlessAws.defaultProdStacks);
-        let fqdn = Util_HostUiDomain$ReventlessAws.deriveFqdn(baseName, stack, match$1, prodStacks);
+        let fqdn = Util_HostUiDomain$ReventlessAws.deriveFqdn(baseName, stack, match$2, prodStacks);
         customDomain = {
           fqdn: fqdn,
-          hostedZoneId: match$2
+          hostedZoneId: match$3
         };
       } else {
         customDomain = undefined;
@@ -967,11 +1029,11 @@ function MakeWithConfig(Config) {
               bucketRegionalDomainName: store.bucketRegionalDomainName
             }] : []
       ).concat(declaredServedBuckets);
-      let match$3 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
+      let match$4 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
         "config.json",
         "ui-hints.json"
       ], customDomain, servedBuckets);
-      let bucketName = match$3.bucketName;
+      let bucketName = match$4.bucketName;
       let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
       let cognitoPool = Platform_Stack$ReventlessAws.resolveCognitoUserPool();
       let domainEventsEndpointOutput = domainEventsApiOpt !== undefined ? AppSync_EventsApi$ReventlessAws.httpEndpoint(domainEventsApiOpt).apply(ep => ep + "/event") : Pulumi.output(undefined);
@@ -981,7 +1043,7 @@ function MakeWithConfig(Config) {
       let uploadEndpointOutput = store$1 !== undefined ? Upload_Presign_S3$ReventlessAws.make(store$1.bucketName, undefined, undefined, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
       let storeUploadEndpointsOutput = Pulumi.all(declaredStoreServices.map(param => {
         let qualified = param[0];
-        return param[3].apply(u => [
+        return param[4].apply(u => [
           qualified,
           u
         ]);
@@ -1083,7 +1145,7 @@ function MakeWithConfig(Config) {
           contentType: "application/json"
         });
       }
-      Pulumi$Pulumi.$$export("hostShellUrl", match$3.distributionUrl);
+      Pulumi$Pulumi.$$export("hostShellUrl", match$4.distributionUrl);
     }
     return Pulumi$Pulumi.getOutputs();
   };
@@ -1142,9 +1204,25 @@ function MakeWithConfig(Config) {
       ]).apply(param => param[0]);
       let association = AppSync_MergedApi$ReventlessAws.associateSourceWithMergedArn("PluginSourceAssociation", arnAfterSchemaPush, domainApi, {});
       let mergeGate = AppSync_MergedApi$ReventlessAws.mergeStatusGateWith(checkedMergedApiArn, association);
+      let capabilityGate = Pulumi.all([
+        pluginOutputs.pluginStructure,
+        stackRef.getOutput("objectStores")
+      ]).apply(param => {
+        let required = Stdlib_Option.getOr(Stdlib_Option.flatMap(param[0], s => s.requiredStores), []);
+        let provisioned = Stdlib_Option.getOr(Stdlib_Option.map(Stdlib_Option.flatMap(param[1], Stdlib_JSON.Decode.object), prim => Object.keys(prim)), []);
+        let missing = Util_StoreLayout$ReventlessAws.coverageFor(required, provisioned);
+        if (typeof missing !== "object") {
+          return;
+        } else if (missing.TAG === "NotAdopted") {
+          return log.warn("Platform:deployPlugin", undefined, `declares ` + missing._0.join(", ") + ` but the platform stack provisions no object stores — add them to the platform's ~capabilities and redeploy the platform first, or uploads will fall back to the legacy service and write to the wrong bucket`);
+        } else {
+          return Stdlib_JsError.throwWithMessage(`Plugin requires object store(s) the platform does not provision: ` + missing.missing.join(", ") + `.\n` + (`  The platform stack provisions: ` + missing.provisioned.join(", ") + `.\n`) + `  A store's key is {plugin}.{store}, where {plugin} is the name the plugin registers — check the capability's spelling and case against it.\n  Add the missing entr(ies) to the platform's ~capabilities and redeploy the platform stack first.`);
+        }
+      });
       Pulumi$Pulumi.$$export("sourceApiAssociationId", Pulumi.all([
         association.associationId,
-        mergeGate
+        mergeGate,
+        capabilityGate
       ]).apply(param => param[0]));
       Pulumi$Pulumi.$$export("pluginSourceApiId", Output$Pulumi.flatMap(domainApi, api => api.id));
       Pulumi$Pulumi.$$export("pluginSourceApiEndpoint", Output$Pulumi.flatMap(domainApi, api => api.uris.apply(uris => uris.GRAPHQL)));
@@ -2013,6 +2091,7 @@ function Make($star) {
         plugin + `.` + store,
         keyPrefix,
         bucketName,
+        storeHandle.bucketName,
         presign.url
       ];
     });
@@ -2027,18 +2106,70 @@ function Make($star) {
       bucketArn: b.bucketArn,
       bucketRegionalDomainName: b.bucketRegionalDomainName
     })));
+    let match$1 = Util_StoreLayout$ReventlessAws.servingFor(Stdlib_Option.isSome(hostUiBundle), declaredServedBuckets.length);
+    let storeServingBaseUrl;
+    switch (match$1) {
+      case "NoStores" :
+      case "HostShell" :
+        storeServingBaseUrl = undefined;
+        break;
+      case "PlatformOwned" :
+        storeServingBaseUrl = Plugin_Stack$ReventlessAws.makeServedBucketDistribution("object-stores", declaredServedBuckets, undefined);
+        break;
+    }
+    let declaredStoreEndpoints = declaredStoreServices.map(param => ({
+      store: param[0],
+      keyPrefix: param[1],
+      bucketName: param[3],
+      uploadUrl: param[4],
+      baseUrl: storeServingBaseUrl
+    }));
+    objectStoreEndpointsRef.contents = declaredStoreEndpoints;
+    if (declaredStoreEndpoints.length !== 0) {
+      Pulumi$Pulumi.$$export("uploadEndpoints", Pulumi.all(declaredStoreEndpoints.map(e => e.uploadUrl.apply(u => [
+        e.store,
+        u
+      ]))).apply(pairs => Object.fromEntries(pairs)));
+      Pulumi$Pulumi.$$export("objectStores", Pulumi.all(declaredStoreEndpoints.map(e => Pulumi.all([
+        e.bucketName,
+        Output$Pulumi.allOpt(e.baseUrl)
+      ]).apply(param => [
+        e,
+        param[0],
+        param[1]
+      ]))).apply(resolved => Object.fromEntries(resolved.map(param => {
+        let baseUrl = param[2];
+        let e = param[0];
+        return [
+          e.store,
+          Object.fromEntries([
+            [
+              "bucketName",
+              param[1]
+            ],
+            [
+              "keyPrefix",
+              e.keyPrefix
+            ]
+          ].concat(baseUrl !== undefined ? [[
+                "baseUrl",
+                baseUrl
+              ]] : []))
+        ];
+      }))));
+    }
     if (hostUiBundle !== undefined) {
-      let match$1 = Util_LocalConfig$ReventlessAws.get("hostUiBaseDomain");
-      let match$2 = Util_LocalConfig$ReventlessAws.get("hostUiHostedZoneId");
+      let match$2 = Util_LocalConfig$ReventlessAws.get("hostUiBaseDomain");
+      let match$3 = Util_LocalConfig$ReventlessAws.get("hostUiHostedZoneId");
       let customDomain;
-      if (match$1 !== undefined && match$2 !== undefined) {
+      if (match$2 !== undefined && match$3 !== undefined) {
         let stack = Pulumi.getStack();
         let baseName = Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("hostUiBaseName"), Pulumi.getProject());
         let prodStacks = Stdlib_Option.getOr(Stdlib_Option.map(Util_LocalConfig$ReventlessAws.get("hostUiProdStacks"), Util_HostUiDomain$ReventlessAws.parseProdStacks), Util_HostUiDomain$ReventlessAws.defaultProdStacks);
-        let fqdn = Util_HostUiDomain$ReventlessAws.deriveFqdn(baseName, stack, match$1, prodStacks);
+        let fqdn = Util_HostUiDomain$ReventlessAws.deriveFqdn(baseName, stack, match$2, prodStacks);
         customDomain = {
           fqdn: fqdn,
-          hostedZoneId: match$2
+          hostedZoneId: match$3
         };
       } else {
         customDomain = undefined;
@@ -2053,11 +2184,11 @@ function Make($star) {
               bucketRegionalDomainName: store.bucketRegionalDomainName
             }] : []
       ).concat(declaredServedBuckets);
-      let match$3 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
+      let match$4 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot("@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
         "config.json",
         "ui-hints.json"
       ], customDomain, servedBuckets);
-      let bucketName = match$3.bucketName;
+      let bucketName = match$4.bucketName;
       let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
       let cognitoPool = Platform_Stack$ReventlessAws.resolveCognitoUserPool();
       let domainEventsEndpointOutput = domainEventsApiOpt !== undefined ? AppSync_EventsApi$ReventlessAws.httpEndpoint(domainEventsApiOpt).apply(ep => ep + "/event") : Pulumi.output(undefined);
@@ -2067,7 +2198,7 @@ function Make($star) {
       let uploadEndpointOutput = store$1 !== undefined ? Upload_Presign_S3$ReventlessAws.make(store$1.bucketName, undefined, undefined, undefined, undefined).url.apply(u => u) : Pulumi.output(undefined);
       let storeUploadEndpointsOutput = Pulumi.all(declaredStoreServices.map(param => {
         let qualified = param[0];
-        return param[3].apply(u => [
+        return param[4].apply(u => [
           qualified,
           u
         ]);
@@ -2169,7 +2300,7 @@ function Make($star) {
           contentType: "application/json"
         });
       }
-      Pulumi$Pulumi.$$export("hostShellUrl", match$3.distributionUrl);
+      Pulumi$Pulumi.$$export("hostShellUrl", match$4.distributionUrl);
     }
     return Pulumi$Pulumi.getOutputs();
   };
@@ -2228,9 +2359,25 @@ function Make($star) {
       ]).apply(param => param[0]);
       let association = AppSync_MergedApi$ReventlessAws.associateSourceWithMergedArn("PluginSourceAssociation", arnAfterSchemaPush, domainApi, {});
       let mergeGate = AppSync_MergedApi$ReventlessAws.mergeStatusGateWith(checkedMergedApiArn, association);
+      let capabilityGate = Pulumi.all([
+        pluginOutputs.pluginStructure,
+        stackRef.getOutput("objectStores")
+      ]).apply(param => {
+        let required = Stdlib_Option.getOr(Stdlib_Option.flatMap(param[0], s => s.requiredStores), []);
+        let provisioned = Stdlib_Option.getOr(Stdlib_Option.map(Stdlib_Option.flatMap(param[1], Stdlib_JSON.Decode.object), prim => Object.keys(prim)), []);
+        let missing = Util_StoreLayout$ReventlessAws.coverageFor(required, provisioned);
+        if (typeof missing !== "object") {
+          return;
+        } else if (missing.TAG === "NotAdopted") {
+          return log.warn("Platform:deployPlugin", undefined, `declares ` + missing._0.join(", ") + ` but the platform stack provisions no object stores — add them to the platform's ~capabilities and redeploy the platform first, or uploads will fall back to the legacy service and write to the wrong bucket`);
+        } else {
+          return Stdlib_JsError.throwWithMessage(`Plugin requires object store(s) the platform does not provision: ` + missing.missing.join(", ") + `.\n` + (`  The platform stack provisions: ` + missing.provisioned.join(", ") + `.\n`) + `  A store's key is {plugin}.{store}, where {plugin} is the name the plugin registers — check the capability's spelling and case against it.\n  Add the missing entr(ies) to the platform's ~capabilities and redeploy the platform stack first.`);
+        }
+      });
       Pulumi$Pulumi.$$export("sourceApiAssociationId", Pulumi.all([
         association.associationId,
-        mergeGate
+        mergeGate,
+        capabilityGate
       ]).apply(param => param[0]));
       Pulumi$Pulumi.$$export("pluginSourceApiId", Output$Pulumi.flatMap(domainApi, api => api.id));
       Pulumi$Pulumi.$$export("pluginSourceApiEndpoint", Output$Pulumi.flatMap(domainApi, api => api.uris.apply(uris => uris.GRAPHQL)));
@@ -2321,6 +2468,8 @@ export {
   getApiConfig,
   splitApiOutputsRef,
   getSplitApiOutputs,
+  objectStoreEndpointsRef,
+  getObjectStoreEndpoints,
   MakeWithConfig,
   Make,
 }

package/src/plugin/stack/Plugin_Stack.res

@@ -538,3 +538,193 @@ let makeUiBundleDistribution = (
     bucketName: bucket.bucket,
   }
 }
+
+/**
+Front a set of served buckets with a CloudFront distribution of their own, with
+no SPA bundle behind it.
+
+`makeUiBundleDistribution` can already serve buckets, but only as a side car to
+a UI bundle. A platform that deploys no shell — because its UI ships from its
+own stack — still provisions stores and then has nothing to serve them from:
+the bucket is created with an all-true public-access block and takes its read
+grant solely from a distribution's `BucketPolicy`, so with no distribution the
+objects are unreachable by anything.
+
+Serving lives with the stack that owns the buckets, and that is not a style
+preference. **S3 permits exactly one bucket policy per bucket.** If the read
+grant were written by whichever stack happened to build a distribution, two
+distributions fronting one store would silently overwrite each other's grant —
+deploying green and 404ing the loser's objects. Keeping the policy next to the
+bucket makes a second writer impossible rather than merely discouraged.
+
+Returns the public base URL. A consumer needs that and the store's prefix to
+address an object; it needs no bucket identity at all, which is both a smaller
+contract and one that cannot collide.
+*/
+let makeServedBucketDistribution = (
+  ~name: string,
+  ~servedBuckets: array<ReventlessInfra.Platform.servedBucket>,
+  ~customDomain: option<customDomain>=?,
+): Pulumi.Output.t<string> => {
+  let oac = PulumiAws.CloudFront.OriginAccessControl.make(
+    ~name=name ++ "-oac",
+    ~args={
+      originAccessControlOriginType: Pulumi.Input.make("s3"),
+      signingBehavior: Pulumi.Input.make("always"),
+      signingProtocol: Pulumi.Input.make("sigv4"),
+    },
+  )
+
+  let originIdFor = (id: string): string => "served-" ++ id
+
+  // CloudFront requires a default behavior, and with no bundle origin there is
+  // nothing neutral to point it at. The first served bucket takes it; every
+  // real path is matched by its own `{prefix}/*` behavior first, so the default
+  // is only reached by a request for a path no store claims — which 404s at S3,
+  // the correct answer.
+  let defaultOriginId = switch servedBuckets->Array.get(0) {
+  | Some(sb) => originIdFor(sb.id)
+  | None =>
+    JsError.throwWithMessage(
+      "Plugin_Stack.makeServedBucketDistribution: no served buckets — call only when at least one store is declared",
+    )
+  }
+
+  let viewerCertificate: PulumiAws.CloudFront.Distribution.viewerCertificate = switch customDomain {
+  | None => {
+      cloudfrontDefaultCertificate: Pulumi.Input.make(true),
+    }
+  | Some({fqdn, hostedZoneId: _}) =>
+    let usEast1 = _getUsEast1Provider()
+    let cert = PulumiAws.Acm.Certificate.make(
+      ~name=name ++ "-cert",
+      ~args={
+        domainName: Pulumi.Input.make(fqdn),
+        validationMethod: Pulumi.Input.make("DNS"),
+      },
+      ~opts={provider: usEast1},
+    )
+    {
+      acmCertificateArn: cert.arn->Pulumi.Output.asInput,
+      sslSupportMethod: Pulumi.Input.make("sni-only"),
+      minimumProtocolVersion: Pulumi.Input.make("TLSv1.2_2021"),
+    }
+  }
+
+  let distribution = PulumiAws.CloudFront.Distribution.make(
+    ~name=name ++ "-cdn",
+    ~args={
+      enabled: Pulumi.Input.make(true),
+      aliases: ?switch customDomain {
+      | None => None
+      | Some({fqdn}) => Some(Pulumi.Input.make([fqdn]))
+      },
+      origins: oac.id->Pulumi.Output.apply(oacId =>
+        servedBuckets->Array.map(sb => {
+          PulumiAws.CloudFront.Distribution.domainName: sb.bucketRegionalDomainName,
+          originId: Pulumi.Input.make(originIdFor(sb.id)),
+          originAccessControlId: Pulumi.Input.make(oacId),
+        })
+      )
+      ->Pulumi.Output.asInput,
+      defaultCacheBehavior: Pulumi.Input.make(
+        (
+          {
+            targetOriginId: Pulumi.Input.make(defaultOriginId),
+            viewerProtocolPolicy: Pulumi.Input.make("redirect-to-https"),
+            allowedMethods: Pulumi.Input.make(["GET", "HEAD"]),
+            cachedMethods: Pulumi.Input.make(["GET", "HEAD"]),
+            cachePolicyId: Pulumi.Input.make(cachingOptimizedPolicyId),
+          }: PulumiAws.CloudFront.Distribution.defaultCacheBehavior
+        ),
+      ),
+      // One behavior per served prefix. Store objects have immutable uuid keys,
+      // so the long-TTL CachingOptimized policy is safe.
+      orderedCacheBehaviors: Pulumi.Input.make(
+        servedBuckets->Array.flatMap(sb =>
+          sb.prefixes->Array.map(prefix => {
+            PulumiAws.CloudFront.Distribution.pathPattern: Pulumi.Input.make(prefix ++ "/*"),
+            targetOriginId: Pulumi.Input.make(originIdFor(sb.id)),
+            viewerProtocolPolicy: Pulumi.Input.make("redirect-to-https"),
+            allowedMethods: Pulumi.Input.make(["GET", "HEAD"]),
+            cachedMethods: Pulumi.Input.make(["GET", "HEAD"]),
+            cachePolicyId: Pulumi.Input.make(cachingOptimizedPolicyId),
+          })
+        ),
+      ),
+      restrictions: Pulumi.Input.make({
+        PulumiAws.CloudFront.Distribution.geoRestriction: Pulumi.Input.make({
+          PulumiAws.CloudFront.Distribution.restrictionType: Pulumi.Input.make("none"),
+        }),
+      }),
+      viewerCertificate: Pulumi.Input.make(viewerCertificate),
+      comment: Pulumi.Input.make(name ++ " object store CDN"),
+      tags: AWS.Tags.make(
+        ~name=name ++ "-cdn",
+        ~kind=ReventlessCore.ComponentType.Platform,
+        ~role=Hosting,
+        ~scope=Platform,
+      ),
+    },
+  )
+
+  switch customDomain {
+  | None => ()
+  | Some({fqdn, hostedZoneId}) =>
+    let _ = PulumiAws.Route53.Record.make(
+      ~name=name ++ "-domain-alias",
+      ~args={
+        zoneId: Pulumi.Input.make(hostedZoneId),
+        name: Pulumi.Input.make(fqdn),
+        type_: Pulumi.Input.make("A"),
+        aliases: [
+          (
+            {
+              name: distribution.domainName->Pulumi.Output.asInput,
+              zoneId: Pulumi.Input.make(cloudFrontAliasZoneId),
+              evaluateTargetHealth: Pulumi.Input.make(false),
+            }: PulumiAws.Route53.Record.alias
+          ),
+        ]->Pulumi.Input.make,
+      },
+    )
+  }
+
+  // One policy per bucket — see the module doc above for why this is here and
+  // not in the consuming stack.
+  servedBuckets->Array.forEach(sb => {
+    let _ = PulumiAws.S3.BucketPolicy.make(
+      ~name=name ++ "-served-" ++ sb.id ++ "-policy",
+      ~args={
+        bucket: sb.bucketId,
+        policy: (sb.bucketArn->Pulumi.Output.fromInput, distribution.arn)
+          ->Pulumi.Output.all2
+          ->Pulumi.Output.apply(((bucketArn, distributionArn)) =>
+            {
+              "Version": "2012-10-17",
+              "Statement": [
+                {
+                  "Sid": "AllowCloudFrontServicePrincipal",
+                  "Effect": "Allow",
+                  "Principal": {"Service": "cloudfront.amazonaws.com"},
+                  "Action": "s3:GetObject",
+                  "Resource": bucketArn ++ "/*",
+                  "Condition": {
+                    "StringEquals": {"AWS:SourceArn": distributionArn},
+                  },
+                },
+              ],
+            }
+            ->JSON.stringifyAny
+            ->Option.getUnsafe
+          )
+          ->Pulumi.Output.asInput,
+      },
+    )
+  })
+
+  switch customDomain {
+  | Some({fqdn}) => Pulumi.Output.make("https://" ++ fqdn)
+  | None => distribution.domainName->Pulumi.Output.apply(d => "https://" ++ d)
+  }
+}

package/src/plugin/stack/Plugin_Stack.res.mjs

@@ -303,6 +303,121 @@ function makeUiBundleDistribution(pluginId, bundleVersion, assetsDir, spaFallbac
   };
 }
 
+function makeServedBucketDistribution(name, servedBuckets, customDomain) {
+  let oac = new (Aws.cloudfront.OriginAccessControl)(name + "-oac", {
+    originAccessControlOriginType: "s3",
+    signingBehavior: "always",
+    signingProtocol: "sigv4"
+  });
+  let sb = servedBuckets[0];
+  let defaultOriginId = sb !== undefined ? "served-" + sb.id : Stdlib_JsError.throwWithMessage("Plugin_Stack.makeServedBucketDistribution: no served buckets — call only when at least one store is declared");
+  let viewerCertificate;
+  if (customDomain !== undefined) {
+    let usEast1 = _getUsEast1Provider();
+    let cert = new (Aws.acm.Certificate)(name + "-cert", {
+      domainName: customDomain.fqdn,
+      validationMethod: "DNS"
+    }, {
+      provider: Primitive_option.some(usEast1)
+    });
+    viewerCertificate = {
+      acmCertificateArn: cert.arn,
+      sslSupportMethod: "sni-only",
+      minimumProtocolVersion: "TLSv1.2_2021"
+    };
+  } else {
+    viewerCertificate = {
+      cloudfrontDefaultCertificate: true
+    };
+  }
+  let distribution = new (Aws.cloudfront.Distribution)(name + "-cdn", {
+    enabled: true,
+    aliases: customDomain !== undefined ? [customDomain.fqdn] : undefined,
+    origins: oac.id.apply(oacId => servedBuckets.map(sb => ({
+      domainName: sb.bucketRegionalDomainName,
+      originId: "served-" + sb.id,
+      originAccessControlId: oacId
+    }))),
+    defaultCacheBehavior: {
+      targetOriginId: defaultOriginId,
+      viewerProtocolPolicy: "redirect-to-https",
+      allowedMethods: [
+        "GET",
+        "HEAD"
+      ],
+      cachedMethods: [
+        "GET",
+        "HEAD"
+      ],
+      cachePolicyId: cachingOptimizedPolicyId
+    },
+    orderedCacheBehaviors: servedBuckets.flatMap(sb => sb.prefixes.map(prefix => ({
+      pathPattern: prefix + "/*",
+      targetOriginId: "served-" + sb.id,
+      viewerProtocolPolicy: "redirect-to-https",
+      allowedMethods: [
+        "GET",
+        "HEAD"
+      ],
+      cachedMethods: [
+        "GET",
+        "HEAD"
+      ],
+      cachePolicyId: cachingOptimizedPolicyId
+    }))),
+    restrictions: {
+      geoRestriction: {
+        restrictionType: "none"
+      }
+    },
+    viewerCertificate: viewerCertificate,
+    comment: name + " object store CDN",
+    tags: AWS_Tags$ReventlessAws.make(name + "-cdn", "Platform", "Hosting", "Platform", undefined, undefined, undefined, undefined)
+  });
+  if (customDomain !== undefined) {
+    new (Aws.route53.Record)(name + "-domain-alias", {
+      zoneId: customDomain.hostedZoneId,
+      name: customDomain.fqdn,
+      type: "A",
+      aliases: [{
+          name: distribution.domainName,
+          zoneId: cloudFrontAliasZoneId,
+          evaluateTargetHealth: false
+        }]
+    });
+  }
+  servedBuckets.forEach(sb => {
+    new (Aws.s3.BucketPolicy)(name + "-served-" + sb.id + "-policy", {
+      bucket: sb.bucketId,
+      policy: Pulumi.all([
+        sb.bucketArn,
+        distribution.arn
+      ]).apply(param => JSON.stringify({
+        Version: "2012-10-17",
+        Statement: [{
+            Sid: "AllowCloudFrontServicePrincipal",
+            Effect: "Allow",
+            Principal: {
+              Service: "cloudfront.amazonaws.com"
+            },
+            Action: "s3:GetObject",
+            Resource: param[0] + "/*",
+            Condition: {
+              StringEquals: {
+                "AWS:SourceArn": param[1]
+              }
+            }
+          }]
+      }))
+    });
+  });
+  if (customDomain !== undefined) {
+    return Pulumi.output("https://" + customDomain.fqdn);
+  } else {
+    return distribution.domainName.apply(d => "https://" + d);
+  }
+}
+
 export {
   log,
   cachingOptimizedPolicyId,
@@ -313,5 +428,6 @@ export {
   cacheControlFor,
   invalidateDistribution,
   makeUiBundleDistribution,
+  makeServedBucketDistribution,
 }
 /* log Not a pure module */

package/src/util/Util_StoreLayout.res

@@ -34,6 +34,27 @@ type protection =
   | Protected
   | Unprotected
 
+/** Whether the platform provisions everything a plugin's fields declare. */
+type coverage =
+  /** Every declared store is provisioned. */
+  | Covered
+  /** The platform provisions no stores at all — it has not adopted capability
+      provisioning, which is a different situation from getting it wrong. */
+  | NotAdopted(array<string>)
+  /** The platform provisions stores, but not these. Carries what it does
+      provision, because the usual cause is a near-miss worth showing. */
+  | Missing({missing: array<string>, provisioned: array<string>})
+
+/** Which distribution fronts the declared stores. */
+type serving =
+  /** No store is declared, so nothing is served. */
+  | NoStores
+  /** The host shell's own distribution serves them same-origin, so a minted
+      `/{prefix}/…` ref resolves relative and there is no base URL. */
+  | HostShell
+  /** The platform fronts them itself, because no host shell is deployed. */
+  | PlatformOwned
+
 /**
 Stack-name prefixes whose stacks are disposable.
 
@@ -102,3 +123,53 @@ The cost is a slightly redundant prefix inside a dedicated bucket
 (`catalog-productImages/productImages/…`). Take the redundancy.
 */
 let keyPrefixFor = (~store: string): string => store
+
+/**
+Who serves the declared stores — and the answer is never "both".
+
+A store's bucket blocks public policy and takes its read grant solely from a
+distribution's `BucketPolicy`. **S3 permits exactly one bucket policy per
+bucket**, so two distributions fronting one store would each write that single
+policy and silently unpick the other's grant: green deploy, 404s afterwards.
+Making this one function's return a three-way choice is what keeps "both" from
+being expressible.
+
+The polarity is the useful part. Provisioning a store and serving it are
+separate; before this, serving happened only as a side car to a host-UI bundle,
+so a platform whose UI shipped from its own stack provisioned stores that
+nothing could read.
+*/
+let servingFor = (~hasHostUiBundle: bool, ~declaredBucketCount: int): serving =>
+  switch (hasHostUiBundle, declaredBucketCount) {
+  | (_, 0) => NoStores
+  | (true, _) => HostShell
+  | (false, _) => PlatformOwned
+  }
+
+/**
+Does the platform provision what the plugin's fields declare?
+
+The split-stack ordering hazard, stated as a set difference: the platform
+deploys before the plugin and cannot read its schemas, so its capability list is
+written by hand and can simply be wrong. `required` comes from
+`pluginStructure.requiredStores`; `provisioned` from the platform's exported
+`objectStores` keys. Both are qualified `{plugin}.{store}`.
+
+**Three outcomes, not two.** A platform provisioning nothing has not adopted
+capability provisioning; failing it would break deployments that work today. A
+platform provisioning *some* stores but not this one has adopted it and has a
+missing or misspelled entry. Collapsing those two into one verdict forces a
+choice between breaking the first group and not helping the second.
+
+Worth being strict about because every symptom is silent: the upload input finds
+no per-store endpoint, falls back to the legacy single service, and writes to
+whatever bucket that serves — a 2xx, a plausible ref, and the wrong destination.
+*/
+let coverageFor = (~required: array<string>, ~provisioned: array<string>): coverage => {
+  let missing = required->Array.filter(r => !(provisioned->Array.includes(r)))
+  switch (missing, provisioned) {
+  | ([], _) => Covered
+  | (missing, []) => NotAdopted(missing)
+  | (missing, provisioned) => Missing({missing, provisioned})
+  }
+}

package/src/util/Util_StoreLayout.res.mjs

@@ -32,11 +32,45 @@ function keyPrefixFor(store) {
   return store;
 }
 
+function servingFor(hasHostUiBundle, declaredBucketCount) {
+  if (declaredBucketCount !== 0) {
+    if (hasHostUiBundle) {
+      return "HostShell";
+    } else {
+      return "PlatformOwned";
+    }
+  } else {
+    return "NoStores";
+  }
+}
+
+function coverageFor(required, provisioned) {
+  let missing = required.filter(r => !provisioned.includes(r));
+  if (missing.length !== 0) {
+    if (provisioned.length !== 0) {
+      return {
+        TAG: "Missing",
+        missing: missing,
+        provisioned: provisioned
+      };
+    } else {
+      return {
+        TAG: "NotAdopted",
+        _0: missing
+      };
+    }
+  } else {
+    return "Covered";
+  }
+}
+
 export {
   defaultEphemeralPrefixes,
   layoutFor,
   protectionFor,
   bucketNameFor,
   keyPrefixFor,
+  servingFor,
+  coverageFor,
 }
 /* No side effect */

package/tests/Util_StoreLayoutTest.res

@@ -40,6 +40,120 @@ describe("Util_StoreLayout.layoutFor", () => {
   )
 })
 
+describe("Util_StoreLayout.servingFor", () => {
+  testSync("no declared store means nothing to serve", () =>
+    expect(Util_StoreLayout.servingFor(~hasHostUiBundle=false, ~declaredBucketCount=0))->toEqual(
+      Util_StoreLayout.NoStores,
+    )
+  )
+
+  testSync("a host shell serves the stores from its own origin", () =>
+    expect(Util_StoreLayout.servingFor(~hasHostUiBundle=true, ~declaredBucketCount=1))->toEqual(
+      Util_StoreLayout.HostShell,
+    )
+  )
+
+  // The case that was previously unrepresentable and produced a write-only
+  // store: stores are provisioned unconditionally, but serving used to happen
+  // only as a side car to a host-UI bundle.
+  testSync("no host shell means the platform serves them itself", () =>
+    expect(Util_StoreLayout.servingFor(~hasHostUiBundle=false, ~declaredBucketCount=1))->toEqual(
+      Util_StoreLayout.PlatformOwned,
+    )
+  )
+
+  // A bucket carries exactly one policy, so two distributions fronting one
+  // store would unpick each other's read grant. The three-way return is what
+  // makes "both" unrepresentable — asserted so it stays that way.
+  testSync("a host shell wins even with several buckets — never both", () =>
+    expect(Util_StoreLayout.servingFor(~hasHostUiBundle=true, ~declaredBucketCount=3))->toEqual(
+      Util_StoreLayout.HostShell,
+    )
+  )
+
+  // Declaring nothing outranks having a shell: with no store there is no
+  // bucket, no policy and no origin, whoever is deployed.
+  testSync("no store outranks a host shell", () =>
+    expect(Util_StoreLayout.servingFor(~hasHostUiBundle=true, ~declaredBucketCount=0))->toEqual(
+      Util_StoreLayout.NoStores,
+    )
+  )
+})
+
+describe("Util_StoreLayout.coverageFor", () => {
+  testSync("everything declared is provisioned", () =>
+    expect(
+      Util_StoreLayout.coverageFor(
+        ~required=["Catalog.productImages"],
+        ~provisioned=["Catalog.productImages"],
+      ),
+    )->toEqual(Util_StoreLayout.Covered)
+  )
+
+  testSync("declaring nothing is covered, whatever the platform provisions", () =>
+    expect(Util_StoreLayout.coverageFor(~required=[], ~provisioned=["Catalog.productImages"]))->toEqual(
+      Util_StoreLayout.Covered,
+    )
+  )
+
+  // A platform provisioning nothing has not adopted capability provisioning.
+  // Failing it would break deployments that work today, so this is the arm that
+  // must NOT be a hard error.
+  testSync("a platform provisioning nothing has not adopted, rather than got it wrong", () =>
+    expect(Util_StoreLayout.coverageFor(~required=["Catalog.productImages"], ~provisioned=[]))->toEqual(
+      Util_StoreLayout.NotAdopted(["Catalog.productImages"]),
+    )
+  )
+
+  // The case that shipped: the platform declared the store under a lowercased
+  // plugin name, so both sides had a productImages store and neither matched.
+  // It carries what IS provisioned because the cause is usually a near-miss.
+  testSync("a near-miss reports both sides — this is the case-slip shape", () =>
+    expect(
+      Util_StoreLayout.coverageFor(
+        ~required=["Catalog.productImages"],
+        ~provisioned=["catalog.productImages"],
+      ),
+    )->toEqual(
+      Util_StoreLayout.Missing({
+        missing: ["Catalog.productImages"],
+        provisioned: ["catalog.productImages"],
+      }),
+    )
+  )
+
+  testSync("only the uncovered stores are reported missing", () =>
+    expect(
+      Util_StoreLayout.coverageFor(
+        ~required=["Catalog.productImages", "Catalog.manuals"],
+        ~provisioned=["Catalog.productImages"],
+      ),
+    )->toEqual(
+      Util_StoreLayout.Missing({
+        missing: ["Catalog.manuals"],
+        provisioned: ["Catalog.productImages"],
+      }),
+    )
+  )
+
+  // Matching is exact. Suffix or case-insensitive matching would "fix" the
+  // case slip above by silently binding to the wrong store, and two plugins may
+  // legitimately name a store the same.
+  testSync("matching is exact — a suffix match is not a match", () =>
+    expect(
+      Util_StoreLayout.coverageFor(
+        ~required=["Catalog.productImages"],
+        ~provisioned=["Ordering.productImages"],
+      ),
+    )->toEqual(
+      Util_StoreLayout.Missing({
+        missing: ["Catalog.productImages"],
+        provisioned: ["Ordering.productImages"],
+      }),
+    )
+  )
+})
+
 describe("Util_StoreLayout.protectionFor", () => {
   // The pairing a single layout-driven switch would have got wrong: alpha
   // shares a bucket and is still protected.

package/tests/Util_StoreLayoutTest.res.mjs

@@ -27,6 +27,63 @@ globalThis.describe("Util_StoreLayout.layoutFor", () => {
   });
 });
 
+globalThis.describe("Util_StoreLayout.servingFor", () => {
+  globalThis.test("no declared store means nothing to serve", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.servingFor(false, 0)).toEqual("NoStores");
+  });
+  globalThis.test("a host shell serves the stores from its own origin", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.servingFor(true, 1)).toEqual("HostShell");
+  });
+  globalThis.test("no host shell means the platform serves them itself", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.servingFor(false, 1)).toEqual("PlatformOwned");
+  });
+  globalThis.test("a host shell wins even with several buckets — never both", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.servingFor(true, 3)).toEqual("HostShell");
+  });
+  globalThis.test("no store outranks a host shell", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.servingFor(true, 0)).toEqual("NoStores");
+  });
+});
+
+globalThis.describe("Util_StoreLayout.coverageFor", () => {
+  globalThis.test("everything declared is provisioned", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.coverageFor(["Catalog.productImages"], ["Catalog.productImages"])).toEqual("Covered");
+  });
+  globalThis.test("declaring nothing is covered, whatever the platform provisions", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.coverageFor([], ["Catalog.productImages"])).toEqual("Covered");
+  });
+  globalThis.test("a platform provisioning nothing has not adopted, rather than got it wrong", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.coverageFor(["Catalog.productImages"], [])).toEqual({
+      TAG: "NotAdopted",
+      _0: ["Catalog.productImages"]
+    });
+  });
+  globalThis.test("a near-miss reports both sides — this is the case-slip shape", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.coverageFor(["Catalog.productImages"], ["catalog.productImages"])).toEqual({
+      TAG: "Missing",
+      missing: ["Catalog.productImages"],
+      provisioned: ["catalog.productImages"]
+    });
+  });
+  globalThis.test("only the uncovered stores are reported missing", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.coverageFor([
+      "Catalog.productImages",
+      "Catalog.manuals"
+    ], ["Catalog.productImages"])).toEqual({
+      TAG: "Missing",
+      missing: ["Catalog.manuals"],
+      provisioned: ["Catalog.productImages"]
+    });
+  });
+  globalThis.test("matching is exact — a suffix match is not a match", () => {
+    globalThis.expect(Util_StoreLayout$ReventlessAws.coverageFor(["Catalog.productImages"], ["Ordering.productImages"])).toEqual({
+      TAG: "Missing",
+      missing: ["Catalog.productImages"],
+      provisioned: ["Ordering.productImages"]
+    });
+  });
+});
+
 globalThis.describe("Util_StoreLayout.protectionFor", () => {
   globalThis.test("alpha shares a bucket and is still protected", () => {
     globalThis.expect(Util_StoreLayout$ReventlessAws.layoutFor("alpha", Util_HostUiDomain$ReventlessAws.defaultProdStacks)).toEqual("SharedBucket");