@de-otio/trellis 0.7.0 → 0.9.0

package/src/lambda/cleanup-cron.ts

@@ -1,5 +1,8 @@
-import { DynamoDBClient, DeleteItemCommand, QueryCommand } from "@aws-sdk/client-dynamodb";
+import { DynamoDBClient, DeleteItemCommand, PutItemCommand, QueryCommand } from "@aws-sdk/client-dynamodb";
 import { marshall } from "@aws-sdk/util-dynamodb";
+import { Logger } from "@aws-lambda-powertools/logger";
+
+const logger = new Logger({ serviceName: "cleanup-cron" });
 
 const dynamo = new DynamoDBClient({ region: process.env.AWS_REGION });
 const TABLE = process.env.DYNAMODB_TABLE!;
@@ -12,8 +15,8 @@ export const handler = async (): Promise<void> => {
 
   // Acquire cron lock (prevent overlapping executions)
   try {
-    await dynamo.send({
-      ...new (require("@aws-sdk/client-dynamodb").PutItemCommand)({
+    await dynamo.send(
+      new PutItemCommand({
         TableName: TABLE,
         Item: marshall({
           pk: "cron:cleanup",
@@ -25,13 +28,13 @@ export const handler = async (): Promise<void> => {
         ExpressionAttributeNames: { "#ttl": "ttl" },
         ExpressionAttributeValues: marshall({ ":now": now }),
       }),
-    });
+    );
   } catch {
-    console.log(JSON.stringify({ level: "info", msg: "Cleanup cron already running, skipping" }));
+    logger.info("Cleanup cron already running, skipping");
     return;
   }
 
-  console.log(JSON.stringify({ level: "info", msg: "Cleanup cron started" }));
+  logger.info("Cleanup cron started");
   // Additional cleanup logic goes here
-  console.log(JSON.stringify({ level: "info", msg: "Cleanup cron complete" }));
+  logger.info("Cleanup cron complete");
 };

package/src/lambda/create-auth-challenge.ts

@@ -1,6 +1,9 @@
 import { randomBytes, createHash } from "node:crypto";
 import { DynamoDBClient, PutItemCommand, GetItemCommand, UpdateItemCommand } from "@aws-sdk/client-dynamodb";
 import { SESClient, SendEmailCommand } from "@aws-sdk/client-ses";
+import { Logger } from "@aws-lambda-powertools/logger";
+
+const logger = new Logger({ serviceName: "create-auth-challenge" });
 
 const dynamo = new DynamoDBClient({ region: process.env.AWS_REGION });
 const ses = new SESClient({ region: process.env.SES_REGION || process.env.AWS_REGION });
@@ -50,7 +53,7 @@ export const handler = async (event: any) => {
     if (err?.message?.startsWith("RATE_LIMIT_EXCEEDED")) {
       throw err;
     }
-    console.error("Rate limit check failed, proceeding with token generation", err);
+    logger.error("Rate limit check failed, proceeding with token generation", { error: err });
   }
 
   const token = randomBytes(32).toString("base64url");
@@ -71,7 +74,7 @@ export const handler = async (event: any) => {
       },
     }));
   } catch (err) {
-    console.error("Failed to store magic link token", err);
+    logger.error("Failed to store magic link token", { error: err });
     throw err;
   }
 
@@ -100,7 +103,7 @@ export const handler = async (event: any) => {
       },
     }));
   } catch (err) {
-    console.error("Failed to send magic link email", err);
+    logger.error("Failed to send magic link email", { error: err });
     throw err;
   }
 

package/src/lambda/delete-account-worker.ts

@@ -1,11 +1,14 @@
 import type { SQSHandler } from "aws-lambda";
+import { PrismaPg } from "@prisma/adapter-pg";
 import { PrismaClient } from "@prisma/client";
 import { S3Client, DeleteObjectsCommand, ListObjectsV2Command } from "@aws-sdk/client-s3";
-import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
 import { CognitoIdentityProviderClient, AdminDeleteUserCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { Logger } from "@aws-lambda-powertools/logger";
+import { getSecret } from "@aws-lambda-powertools/parameters/secrets";
+
+const logger = new Logger({ serviceName: "delete-account-worker" });
 
 const s3 = new S3Client({ region: process.env.AWS_REGION });
-const secretsClient = new SecretsManagerClient({ region: process.env.AWS_REGION });
 
 const MAX_PAGES = 100;
 
@@ -13,11 +16,13 @@ let prisma: PrismaClient | null = null;
 
 async function getPrisma(): Promise<PrismaClient> {
   if (prisma) return prisma;
-  const secret = await secretsClient.send(new GetSecretValueCommand({ SecretId: process.env.DB_SECRET_ARN! }));
-  const { username, password, host, port, dbname } = JSON.parse(secret.SecretString!);
-  prisma = new PrismaClient({
-    datasources: { db: { url: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1` } },
+  const { username, password, host, port, dbname } = (await getSecret(process.env.DB_SECRET_ARN!, { transform: "json" })) as unknown as { username: string; password: string; host: string; port: string | number; dbname: string };
+  // Prisma 7 removed the `datasources` constructor option; the connection URL
+  // is now supplied via a driver adapter.
+  const adapter = new PrismaPg({
+    connectionString: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1`,
   });
+  prisma = new PrismaClient({ adapter });
   return prisma;
 }
 
@@ -27,7 +32,7 @@ async function deleteUserMedia(userId: string, mediaBucket: string): Promise<voi
   let pages = 0;
   do {
     if (pages >= MAX_PAGES) {
-      console.log(JSON.stringify({ level: "warn", msg: "S3 pagination circuit breaker hit", userId, pages: MAX_PAGES }));
+      logger.warn("S3 pagination circuit breaker hit", { userId, pages: MAX_PAGES });
       break;
     }
     const list = await s3.send(new ListObjectsV2Command({
@@ -59,12 +64,12 @@ export const handler: SQSHandler = async (event) => {
       });
 
       if (!user) {
-        console.log(JSON.stringify({ level: "warn", msg: "User not found, may already be deleted", userId }));
+        logger.warn("User not found, may already be deleted", { userId });
         continue;
       }
 
       // 2. Delete all database records
-      const { deleteUserData } = await import("../lib/services/user-data-deletion");
+      const { deleteUserData } = await import("../lib/services/user-data-deletion.js");
       const result = await deleteUserData(db, userId);
 
       // 3. Delete S3 media files
@@ -79,13 +84,13 @@ export const handler: SQSHandler = async (event) => {
             Username: user.email,
           }));
         } catch (cognitoErr) {
-          console.warn(JSON.stringify({ level: "warn", msg: "Cognito deletion failed", userId, error: String(cognitoErr) }));
+          logger.warn("Cognito deletion failed", { userId, error: cognitoErr });
         }
       }
 
-      console.log(JSON.stringify({ level: "info", msg: "Account deleted", userId, itemsDeleted: result }));
+      logger.info("Account deleted", { userId, itemsDeleted: result });
     } catch (err) {
-      console.error(JSON.stringify({ level: "error", msg: "Failed to delete account", err, messageId: record.messageId }));
+      logger.error("Failed to delete account", { error: err, messageId: record.messageId });
       failedIds.push(record.messageId);
     }
   }

package/src/lambda/diagnostics-proxy.ts

@@ -3,6 +3,9 @@ import {
   PutItemCommand,
   UpdateItemCommand,
 } from "@aws-sdk/client-dynamodb";
+import { Logger } from "@aws-lambda-powertools/logger";
+
+const logger = new Logger({ serviceName: "diagnostics-proxy" });
 
 const dynamo = new DynamoDBClient({ region: process.env.AWS_REGION });
 const RUNTIME_ID = process.env.RUNTIME_ID!;
@@ -79,13 +82,13 @@ export const handler = async (event: { Records: any[] }) => {
     try {
       alarm = JSON.parse(snsMessage);
     } catch {
-      console.warn("Failed to parse SNS message as JSON, skipping");
+      logger.warn("Failed to parse SNS message as JSON, skipping");
       continue;
     }
 
     // Only act on ALARM state transitions
     if (alarm.NewStateValue !== "ALARM") {
-      console.log(`Skipping non-ALARM state: ${alarm.NewStateValue}`);
+      logger.info("Skipping non-ALARM state", { newStateValue: alarm.NewStateValue });
       continue;
     }
 
@@ -95,14 +98,14 @@ export const handler = async (event: { Records: any[] }) => {
     // Per-alarm cooldown
     const cooldownOk = await checkCooldown(alarmName);
     if (!cooldownOk) {
-      console.log(`Alarm "${alarmName}" is in cooldown, skipping`);
+      logger.info("Alarm is in cooldown, skipping", { alarmName });
       continue;
     }
 
     // Daily invocation cap
     const dailyCount = await incrementDailyCounter();
     if (dailyCount > MAX_DAILY) {
-      console.warn(`Daily cap reached (${dailyCount}/${MAX_DAILY}), skipping`);
+      logger.warn("Daily cap reached, skipping", { dailyCount, maxDaily: MAX_DAILY });
       continue;
     }
 
@@ -128,9 +131,9 @@ export const handler = async (event: { Records: any[] }) => {
           }),
         }),
       );
-      console.log(`Invoked agent for alarm "${alarmName}"`);
+      logger.info("Invoked agent for alarm", { alarmName });
     } catch (err) {
-      console.error(`Failed to invoke agent for alarm "${alarmName}"`, err);
+      logger.error("Failed to invoke agent for alarm", { alarmName, error: err });
       throw err;
     }
   }

package/src/lambda/e2e-sweeper.ts

@@ -21,12 +21,13 @@ import {
   AdminDeleteUserCommand,
 } from "@aws-sdk/client-cognito-identity-provider";
 import { SQSClient, SendMessageCommand } from "@aws-sdk/client-sqs";
-import {
-  CloudWatchClient,
-  PutMetricDataCommand,
-} from "@aws-sdk/client-cloudwatch";
 import { DynamoDBClient, PutItemCommand } from "@aws-sdk/client-dynamodb";
 import { marshall } from "@aws-sdk/util-dynamodb";
+import { Logger } from "@aws-lambda-powertools/logger";
+import { Metrics, MetricUnit } from "@aws-lambda-powertools/metrics";
+
+const logger = new Logger({ serviceName: "e2e-sweeper" });
+const metrics = new Metrics({ namespace: "Trellis/E2E", serviceName: "e2e-sweeper" });
 
 const region = process.env.AWS_REGION || "eu-central-1";
 const stage = process.env.STAGE || "dev";
@@ -36,7 +37,6 @@ const dynamoTable = process.env.DYNAMODB_TABLE!;
 
 const cognito = new CognitoIdentityProviderClient({ region });
 const sqs = new SQSClient({ region });
-const cloudwatch = new CloudWatchClient({ region });
 const dynamo = new DynamoDBClient({ region });
 
 const STALE_THRESHOLD_HOURS = 2;
@@ -57,11 +57,11 @@ export const handler = async (): Promise<void> => {
       ExpressionAttributeValues: marshall({ ":now": now }),
     }));
   } catch {
-    console.log(JSON.stringify({ level: "info", msg: "E2E sweeper already running, skipping" }));
+    logger.info("E2E sweeper already running, skipping");
     return;
   }
 
-  console.log(JSON.stringify({ level: "info", msg: "E2E sweeper started", cutoff: cutoff.toISOString() }));
+  logger.info("E2E sweeper started", { cutoff: cutoff.toISOString() });
 
   let totalQueued = 0;
 
@@ -93,9 +93,9 @@ export const handler = async (): Promise<void> => {
               MessageBody: JSON.stringify({ userId: sub }),
             }));
             totalQueued++;
-            console.log(JSON.stringify({ level: "info", msg: `Queued deletion for ${email}`, userId: sub }));
+            logger.info(`Queued deletion for ${email}`, { userId: sub });
           } catch (err) {
-            console.warn(JSON.stringify({ level: "warn", msg: `Failed to queue deletion for ${email}`, error: String(err) }));
+            logger.warn(`Failed to queue deletion for ${email}`, { error: err });
           }
         }
 
@@ -107,9 +107,9 @@ export const handler = async (): Promise<void> => {
             UserPoolId: userPoolId,
             Username: user.Username,
           }));
-          console.log(JSON.stringify({ level: "info", msg: `Deleted Cognito user ${email}` }));
+          logger.info(`Deleted Cognito user ${email}`);
         } catch (err) {
-          console.warn(JSON.stringify({ level: "warn", msg: `Cognito delete failed for ${email}`, error: String(err) }));
+          logger.warn(`Cognito delete failed for ${email}`, { error: err });
         }
       }
 
@@ -118,23 +118,17 @@ export const handler = async (): Promise<void> => {
     } while (paginationToken && pages < MAX_PAGES);
 
   } catch (err) {
-    console.error(JSON.stringify({ level: "error", msg: "Failed to list Cognito users", error: String(err) }));
+    logger.error("Failed to list Cognito users", { error: err });
   }
 
   // Step 4: Emit metric
   try {
-    await cloudwatch.send(new PutMetricDataCommand({
-      Namespace: "Trellis/E2E",
-      MetricData: [{
-        MetricName: "E2eLeakedRecords",
-        Value: totalQueued,
-        Unit: "Count",
-        Dimensions: [{ Name: "Stage", Value: stage }],
-      }],
-    }));
+    const m = metrics.singleMetric();
+    m.addDimension("Stage", stage);
+    m.addMetric("E2eLeakedRecords", MetricUnit.Count, totalQueued);
   } catch (err) {
-    console.error(JSON.stringify({ level: "error", msg: "Failed to emit metric", error: String(err) }));
+    logger.error("Failed to emit metric", { error: err });
   }
 
-  console.log(JSON.stringify({ level: "info", msg: "E2E sweeper complete", totalQueued }));
+  logger.info("E2E sweeper complete", { totalQueued });
 };

package/src/lambda/federation-outbox-worker.ts

@@ -1,8 +1,11 @@
 import type { SQSHandler } from "aws-lambda";
+import { Logger } from "@aws-lambda-powertools/logger";
+
+const logger = new Logger({ serviceName: "federation-outbox-worker" });
 
 export const handler: SQSHandler = async (event) => {
   for (const record of event.Records) {
-    console.log(JSON.stringify({ level: "info", msg: "Processing record", messageId: record.messageId }));
+    logger.info("Processing record", { messageId: record.messageId });
     // TODO: implement
   }
 };

package/src/lambda/followers-events-worker.ts

@@ -1,8 +1,11 @@
 import type { SQSHandler } from "aws-lambda";
+import { Logger } from "@aws-lambda-powertools/logger";
+
+const logger = new Logger({ serviceName: "followers-events-worker" });
 
 export const handler: SQSHandler = async (event) => {
   for (const record of event.Records) {
-    console.log(JSON.stringify({ level: "info", msg: "Processing record", messageId: record.messageId }));
+    logger.info("Processing record", { messageId: record.messageId });
     // TODO: implement
   }
 };

package/src/lambda/hourly-cron.ts

@@ -1,21 +1,51 @@
+import { Logger } from "@aws-lambda-powertools/logger";
+import { Metrics, MetricUnit } from "@aws-lambda-powertools/metrics";
+import { getSecret } from "@aws-lambda-powertools/parameters/secrets";
 import { DynamoDBClient, PutItemCommand } from "@aws-sdk/client-dynamodb";
-import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
 import { marshall } from "@aws-sdk/util-dynamodb";
+import { PrismaPg } from "@prisma/adapter-pg";
 import { PrismaClient } from "@prisma/client";
+import {
+  batchedPruneExpired,
+  resolveInteractionEventConfig,
+} from "../lib/graph/postgres/interaction-events.js";
+
+// AWS Lambda Powertools: structured logging (auto request-id/cold-start
+// context), EMF metrics (no PutMetricData API call), and cached + KMS-decrypted
+// Secrets Manager access. ECS uses the parallel toolchain (pino getLogger +
+// foundation secret resolver); Powertools is Lambda-only.
+const logger = new Logger({ serviceName: "hourly-cron" });
+const metrics = new Metrics({
+  namespace: "Trellis/Retention",
+  serviceName: "hourly-cron",
+});
 
 const dynamo = new DynamoDBClient({ region: process.env.AWS_REGION });
-const secretsClient = new SecretsManagerClient({ region: process.env.AWS_REGION });
 const TABLE = process.env.DYNAMODB_TABLE!;
 
 let prisma: PrismaClient | null = null;
 
+interface DbSecret {
+  username: string;
+  password: string;
+  host: string;
+  port: string | number;
+  dbname: string;
+}
+
 async function getPrisma(): Promise<PrismaClient> {
   if (prisma) return prisma;
-  const secret = await secretsClient.send(new GetSecretValueCommand({ SecretId: process.env.DB_SECRET_ARN! }));
-  const { username, password, host, port, dbname } = JSON.parse(secret.SecretString!);
-  prisma = new PrismaClient({
-    datasources: { db: { url: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1` } },
+  // getSecret caches + KMS-decrypts; transform:"json" parses the secret value.
+  const { username, password, host, port, dbname } = (await getSecret(
+    process.env.DB_SECRET_ARN!,
+    { transform: "json" },
+  )) as unknown as DbSecret;
+  // Prisma 7 removed the `datasources` constructor option; the connection URL
+  // is now supplied via a driver adapter.
+  const adapter = new PrismaPg({
+    connectionString: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1`,
   });
+  prisma = new PrismaClient({ adapter });
   return prisma;
 }
 
@@ -37,11 +67,11 @@ export const handler = async (): Promise<void> => {
       ExpressionAttributeValues: marshall({ ":now": now }),
     }));
   } catch {
-    console.log(JSON.stringify({ level: "info", msg: "Hourly cron already running, skipping" }));
+    logger.info("Hourly cron already running, skipping");
     return;
   }
 
-  console.log(JSON.stringify({ level: "info", msg: "Hourly cron started" }));
+  logger.info("Hourly cron started");
 
   const db = await getPrisma();
 
@@ -61,10 +91,10 @@ export const handler = async (): Promise<void> => {
       const result = await db.mediaFile.deleteMany({
         where: { id: { in: staleMedia.map((m) => m.id) } },
       });
-      console.log(JSON.stringify({ level: "info", msg: "Stale media cleaned", deleted: result.count }));
+      logger.info("Stale media cleaned", { deleted: result.count });
     }
   } catch (err) {
-    console.error(JSON.stringify({ level: "error", msg: "Stale media cleanup failed", error: String(err) }));
+    logger.error("Stale media cleanup failed", { error: err });
   }
 
   // 2. Soft-delete orphaned media past 24h grace period
@@ -79,25 +109,87 @@ export const handler = async (): Promise<void> => {
       data: { deletedAt: new Date() },
     });
     if (result.count > 0) {
-      console.log(JSON.stringify({ level: "info", msg: "Orphaned media soft-deleted", count: result.count }));
+      logger.info("Orphaned media soft-deleted", { count: result.count });
     }
   } catch (err) {
-    console.error(JSON.stringify({ level: "error", msg: "Orphaned media cleanup failed", error: String(err) }));
+    logger.error("Orphaned media cleanup failed", { error: err });
   }
 
-  // 3. Clean up expired security events
+  const eventConfig = resolveInteractionEventConfig();
+
+  // 3. Clean up expired security events (retentionUntil < now).
+  //    Surveillance-hardening Phase 0 (P2): retrofitted from a single unbounded
+  //    deleteMany to the SAME batched helper as InteractionEvent — a mass-expiry
+  //    backlog on one deleteMany would lock the table.
   try {
-    const result = await db.securityEvent.deleteMany({
-      where: {
-        retentionUntil: { lte: new Date() },
+    const cutoff = new Date();
+    const result = await batchedPruneExpired({
+      findExpiredIds: async (take) => {
+        const rows = await db.securityEvent.findMany({
+          where: { retentionUntil: { lt: cutoff } },
+          select: { id: true },
+          take,
+        });
+        return rows.map((r) => r.id);
       },
+      deleteByIds: async (ids) => {
+        const res = await db.securityEvent.deleteMany({ where: { id: { in: ids } } });
+        return res.count;
+      },
+      batchSize: eventConfig.pruneBatchSize,
+      maxIterations: eventConfig.pruneMaxIterations,
     });
-    if (result.count > 0) {
-      console.log(JSON.stringify({ level: "info", msg: "Expired security events cleaned", deleted: result.count }));
+    if (result.deleted > 0 || result.circuitBreakerTripped) {
+      logger.info("Expired security events cleaned", { deleted: result.deleted, circuitBreakerTripped: result.circuitBreakerTripped });
     }
+    emitPruneMetrics("SecurityEvent", result, false);
   } catch (err) {
-    console.error(JSON.stringify({ level: "error", msg: "Security event cleanup failed", error: String(err) }));
+    logger.error("Security event cleanup failed", { error: err });
+    emitPruneMetrics("SecurityEvent", { deleted: 0, circuitBreakerTripped: false }, true);
   }
 
-  console.log(JSON.stringify({ level: "info", msg: "Hourly cron complete" }));
+  // 4. Prune expired InteractionEvent rows (expiresAt < now), batched with a
+  //    circuit breaker (Surveillance-hardening Phase 0, P2). Silent retention
+  //    failure converts the behavioral log into the unbounded surveillance
+  //    asset the threat model forbids — so prune failure / a tripped breaker
+  //    raises a CloudWatch metric to alarm on.
+  try {
+    const { InteractionEventOps } = await import("../lib/graph/postgres/interaction-events.js");
+    const ops = new InteractionEventOps(db, eventConfig);
+    const result = await ops.prune(new Date());
+    if (result.deleted > 0 || result.circuitBreakerTripped) {
+      logger.info("Expired interaction events pruned", { deleted: result.deleted, circuitBreakerTripped: result.circuitBreakerTripped });
+    }
+    emitPruneMetrics("InteractionEvent", result, false);
+  } catch (err) {
+    logger.error("Interaction event pruning failed", { error: err });
+    emitPruneMetrics("InteractionEvent", { deleted: 0, circuitBreakerTripped: false }, true);
+  }
+
+  // All retention metrics are emitted per-table via singleMetric() (immediate
+  // EMF), so there's nothing buffered on `metrics` to publish here.
+  logger.info("Hourly cron complete");
 };
+
+/**
+ * Emit retention-pruning metrics as EMF (Trellis/Retention namespace), fail-
+ * open. `Pruned` counts deleted rows; `PruneFailed` flags an exception;
+ * `PruneCircuitBreakerTripped` flags a drained-iteration-cap backlog — alarm on
+ * the latter two so retention never silently stops. A per-table `singleMetric`
+ * isolates the `Table` dimension so the two tables don't cross-contaminate.
+ */
+function emitPruneMetrics(
+  table: "SecurityEvent" | "InteractionEvent",
+  result: { deleted: number; circuitBreakerTripped: boolean },
+  failed: boolean,
+): void {
+  try {
+    const m = metrics.singleMetric();
+    m.addDimension("Table", table);
+    m.addMetric("Pruned", MetricUnit.Count, result.deleted);
+    m.addMetric("PruneFailed", MetricUnit.Count, failed ? 1 : 0);
+    m.addMetric("PruneCircuitBreakerTripped", MetricUnit.Count, result.circuitBreakerTripped ? 1 : 0);
+  } catch (err) {
+    logger.error("Retention metrics emit failed", { table, error: err });
+  }
+}

package/src/lambda/link-check-worker.ts

@@ -1,8 +1,11 @@
 import type { SQSHandler } from "aws-lambda";
+import { Logger } from "@aws-lambda-powertools/logger";
+
+const logger = new Logger({ serviceName: "link-check-worker" });
 
 export const handler: SQSHandler = async (event) => {
   for (const record of event.Records) {
-    console.log(JSON.stringify({ level: "info", msg: "Processing record", messageId: record.messageId }));
+    logger.info("Processing record", { messageId: record.messageId });
     // TODO: implement
   }
 };

package/src/lambda/maintenance-cron.ts

@@ -1,21 +1,32 @@
 import { DynamoDBClient, PutItemCommand } from "@aws-sdk/client-dynamodb";
-import { SecretsManagerClient, GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
 import { marshall } from "@aws-sdk/util-dynamodb";
+import { PrismaPg } from "@prisma/adapter-pg";
 import { PrismaClient } from "@prisma/client";
+import { Logger } from "@aws-lambda-powertools/logger";
+import { getSecret } from "@aws-lambda-powertools/parameters/secrets";
+
+const logger = new Logger({ serviceName: "maintenance-cron" });
 
 const dynamo = new DynamoDBClient({ region: process.env.AWS_REGION });
-const secretsClient = new SecretsManagerClient({ region: process.env.AWS_REGION });
 const TABLE = process.env.DYNAMODB_TABLE!;
 
 let prisma: PrismaClient | null = null;
 
 async function getPrisma(): Promise<PrismaClient> {
   if (prisma) return prisma;
-  const secret = await secretsClient.send(new GetSecretValueCommand({ SecretId: process.env.DB_SECRET_ARN! }));
-  const { username, password, host, port, dbname } = JSON.parse(secret.SecretString!);
-  prisma = new PrismaClient({
-    datasources: { db: { url: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1` } },
+  const { username, password, host, port, dbname } = (await getSecret(process.env.DB_SECRET_ARN!, { transform: "json" })) as unknown as {
+    username: string;
+    password: string;
+    host: string;
+    port: string | number;
+    dbname: string;
+  };
+  // Prisma 7 removed the `datasources` constructor option; the connection URL
+  // is now supplied via a driver adapter.
+  const adapter = new PrismaPg({
+    connectionString: `postgresql://${username}:${encodeURIComponent(password)}@${host}:${port}/${dbname}?connection_limit=1`,
   });
+  prisma = new PrismaClient({ adapter });
   return prisma;
 }
 
@@ -37,11 +48,11 @@ export const handler = async (): Promise<void> => {
       ExpressionAttributeValues: marshall({ ":now": now }),
     }));
   } catch {
-    console.log(JSON.stringify({ level: "info", msg: "Maintenance cron already running, skipping" }));
+    logger.info("Maintenance cron already running, skipping");
     return;
   }
 
-  console.log(JSON.stringify({ level: "info", msg: "Maintenance cron started" }));
+  logger.info("Maintenance cron started");
 
   const db = await getPrisma();
 
@@ -67,12 +78,12 @@ export const handler = async (): Promise<void> => {
             TableName: TABLE,
             Key: marshall({ pk, sk: "lock" }),
           }));
-          console.log(JSON.stringify({ level: "info", msg: "Stale cron lock removed", lock: pk }));
+          logger.info("Stale cron lock removed", { lock: pk });
         }
       }
     }
   } catch (err) {
-    console.error(JSON.stringify({ level: "error", msg: "Stale lock cleanup failed", error: String(err) }));
+    logger.error("Stale lock cleanup failed", { error: err });
   }
 
   // 3. Vacuum analyze critical tables (via advisory lock to prevent concurrent runs)
@@ -83,13 +94,13 @@ export const handler = async (): Promise<void> => {
       await db.$executeRawUnsafe("ANALYZE posts");
       await db.$executeRawUnsafe("ANALYZE media_files");
       await db.$executeRawUnsafe("ANALYZE follows");
-      console.log(JSON.stringify({ level: "info", msg: "ANALYZE completed on critical tables" }));
+      logger.info("ANALYZE completed on critical tables");
     } finally {
       await db.$executeRaw`SELECT pg_advisory_unlock(42)`;
     }
   } catch (err) {
-    console.error(JSON.stringify({ level: "error", msg: "ANALYZE failed", error: String(err) }));
+    logger.error("ANALYZE failed", { error: err });
   }
 
-  console.log(JSON.stringify({ level: "info", msg: "Maintenance cron complete" }));
+  logger.info("Maintenance cron complete");
 };

package/src/lambda/media-processing-worker.ts

@@ -1,5 +1,8 @@
 import type { SQSHandler } from "aws-lambda";
 import { S3Client, GetObjectCommand, PutObjectCommand } from "@aws-sdk/client-s3";
+import { Logger } from "@aws-lambda-powertools/logger";
+
+const logger = new Logger({ serviceName: "media-processing-worker" });
 
 const s3 = new S3Client({ region: process.env.AWS_REGION });
 
@@ -54,10 +57,10 @@ export const handler: SQSHandler = async (event) => {
           })),
         ]);
 
-        console.log(JSON.stringify({ level: "info", msg: "Media processed", key, hash }));
+        logger.info("Media processed", { key, hash });
       }
     } catch (err) {
-      console.error(JSON.stringify({ level: "error", msg: "Media processing failed", err, messageId: record.messageId }));
+      logger.error("Media processing failed", { error: err, messageId: record.messageId });
       failedIds.push(record.messageId);
     }
   }

package/src/lambda/media-reconciliation-worker.ts

@@ -1,8 +1,11 @@
 import type { SQSHandler } from "aws-lambda";
+import { Logger } from "@aws-lambda-powertools/logger";
+
+const logger = new Logger({ serviceName: "media-reconciliation-worker" });
 
 export const handler: SQSHandler = async (event) => {
   for (const record of event.Records) {
-    console.log(JSON.stringify({ level: "info", msg: "Processing record", messageId: record.messageId }));
+    logger.info("Processing record", { messageId: record.messageId });
     // TODO: implement
   }
 };