refactor(bucket-provisioner): own the physical bucket naming policy

[pyramation]

Summary

The physical-bucket naming policy — {prefix}-{bucketKey}-{sha256(prefix/databaseId/bucketKey)} — lived privately inside graphile-settings/src/presigned-url-resolver.ts. That made it unreachable for any bucket creator outside a customer's GraphQL request: notably the storage:provision_bucket reconciler in constructive-db, which currently has no way to name a tenant bucket and would otherwise invent one (a bare default shared by every tenant, stamped permanently onto physical_name).

This moves the policy, byte-for-byte unchanged, into @constructive-io/bucket-provisioner — the package every creator already depends on — and exports it:

import { mintPhysicalBucketName } from '@constructive-io/bucket-provisioner';
mintPhysicalBucketName(prefix, databaseId, bucketKey); // '{prefix}-{key}-{digest12}'

graphile-settings keeps the env reading (getBucketNamePrefix() → CDN_BUCKET_NAME, still throwing rather than defaulting) and both resolver factories; the shared package stays env-free and dependency-free (node crypto only). No produced name changes — deliberately: the whole point is that existing physical_name values remain valid and that the lazy first-upload path, the eager provisionBucket mutation, and the reconciler cannot disagree.

Tests cover the properties the callers rely on: determinism, distinct names for the same key in different databases, distinct names for keys that agree only past the truncation budget, S3 legality (/^[a-z0-9-]{3,63}$/, no edge hyphens), and the digest-only fallback when both readable components sanitize away. The existing caller-level assertion that the presigned resolver and the provisioner resolver agree still holds.

Follow-up in constructive-db: bump this package and have the reconciler mint through it instead of using the bucket key.

Link to Devin session: https://app.devin.ai/sessions/967dd6f667004819ae392597f090a3cd
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[tenki-reviewer]

Review complete. No issues found — approved ✅.

---

This PR extracts the mintPhysicalBucketName helper out of graphile-settings' presigned URL resolver into a new public module packages/bucket-provisioner/src/naming.ts, re-exports it from the package index, and adds a test suite. The extracted function is byte-for-byte identical to the original (only the error-message source prefix changed), so behavior is preserved across the lazy and eager provisioning paths.

Files	Change
graphile/graphile-settings/src/presigned-url-resolver.ts	Removes the local hash/name-minting implementation and imports mintPhysicalBucketName from @constructive-io/bucket-provisioner.
packages/bucket-provisioner/src/naming.ts	New module holding the moved mintPhysicalBucketName implementation.
packages/bucket-provisioner/src/index.ts	Exports the new naming module for consumers.
packages/bucket-provisioner/__tests__/naming.test.ts	Adds tests covering repeated calls, database separation, truncation, S3 naming compliance, and empty components.

_{Reviewed commit: 817c42c}