@reventlessdev/reventless-aws 3.0.0-alpha.252 → 3.0.0-alpha.254

package/CHANGELOG.md

@@ -3,6 +3,34 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.254 (2026-08-02)
+
+### Features
+
+* **aws,core,doc:** environment-tiered CloudWatch log retention and levels ([8032023](https://github.com/ReventlessDev/reventless-core/commit/803202305a7d352484b8df5e58df03c92ca58b5f))
+* **aws,core,spec,seed-aws:** expire uploads nobody committed a reference to ([f63e84c](https://github.com/ReventlessDev/reventless-core/commit/f63e84c1a11cc350b799a6f69a2e7427cf1ea6e9))
+
+
+# 3.0.0-alpha.253 (2026-08-01)
+
+* feat(aws,core,spec)!: qualify store prefixes by plugin and refuse name collisions ([da39405](https://github.com/ReventlessDev/reventless-core/commit/da394059d9f8f981bf7adc79e2c1ce2b429e0267))
+* feat(core,aws)!: name task buckets for their plugin and task ([05203cb](https://github.com/ReventlessDev/reventless-core/commit/05203cb3b0b019401a6f32cf78109f397b6799d5))
+
+### BREAKING CHANGES
+
+* objects minted under the old bare prefix are orphaned and their
+refs unresolvable. The migration is `seed:reset` for the owning plugin, then
+re-seed. Legacy-prefix grandfathering was considered and deliberately dropped —
+it would have added a permanent prefix SET across the deploy argument, both store
+configs, the presign IAM fan-out, the release scope check and the stack output,
+to spare a disposable stack one wipe.
+* a bucket name change is a replace. TaskBucket_S3 now sets
+forceDestroy on disposable stacks (Util_StoreLayout.protectionFor), so pr-*
+stacks recreate cleanly; protected stacks must have the task bucket drained by
+hand before the first deploy after this, or the replace fails BucketNotEmpty.
+
+
+
 # 3.0.0-alpha.252 (2026-08-01)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.252",
+  "version": "3.0.0-alpha.254",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -11,18 +11,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.0",
-    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.1",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-node": "2.0.0-alpha.0",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.62",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.63",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.116",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.201",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.118",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.65",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.91",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.199",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.63"
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.93"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -157,6 +157,58 @@ module MakeWithConfig = (
     ->Pulumi.Config.get("stack")
     ->Option.map(stack => Pulumi.StackReference.make(stack))
 
+  // The declared object stores, as the upload claimer needs them: qualified
+  // name, physical bucket, served prefix.
+  //
+  // Stores are provisioned by the *platform* deploy; the claimer is wired into
+  // the *plugin* stack, because that is where the event log streams it reads
+  // exist. So the two halves meet here — across the stack reference in plugin
+  // mode, and through the platform's own in-process record when platform and
+  // plugin are one program.
+  //
+  // Read lazily (a thunk, not a value) for the monolithic case: `deployPlatform`
+  // fills `objectStoreEndpointsRef` as it provisions, and this is called during
+  // a later plugin build.
+  let claimStores = (): Pulumi.Output.t<array<Upload_Claim_S3.storeConfig>> =>
+    switch platformStackRef {
+    | Some(stackRef) =>
+      // The `objectStores` export: `{ "<plugin>.<store>": {bucketName, keyPrefix} }`.
+      // A platform that provisions none omits the export entirely, which reads
+      // as "no store to claim in" — the claimer then builds nothing, rather
+      // than building something that can reach nothing.
+      (stackRef->Pulumi.StackReference.getOutput("objectStores"): Pulumi.Output.t<option<JSON.t>>)
+      ->Pulumi.Output.apply(objectStores =>
+        objectStores
+        ->Option.flatMap(JSON.Decode.object)
+        ->Option.getOr(Dict.make())
+        ->Dict.toArray
+        ->Array.filterMap(((qualified, v)) =>
+          v
+          ->JSON.Decode.object
+          ->Option.flatMap(o =>
+            switch (
+              o->Dict.get("bucketName")->Option.flatMap(JSON.Decode.string),
+              o->Dict.get("keyPrefix")->Option.flatMap(JSON.Decode.string),
+            ) {
+            | (Some(bucketName), Some(servedPrefix)) =>
+              Some({Upload_Claim_S3.qualified: qualified, bucketName, servedPrefix})
+            | _ => None
+            }
+          )
+        )
+      )
+    | None =>
+      objectStoreEndpointsRef.contents
+      ->Array.map(e =>
+        e.bucketName->Pulumi.Output.apply(bucketName => {
+          Upload_Claim_S3.qualified: e.store,
+          bucketName,
+          servedPrefix: e.keyPrefix,
+        })
+      )
+      ->Pulumi.Output.all
+    }
+
   // ── Merged-mode source SDL assembly (merged-api plan, Phase 3) ────────────
   // Empty base fragment — no types, no mutations, no queries. Used by the
   // plugin Api in split mode (so plugin schema has no core fields) and as the
@@ -172,7 +224,7 @@ module MakeWithConfig = (
   // The upload service (route B) lives on the domain base, not the Admin-gated admin
   // base: `Upload_Presign`/`Upload_Release` take the domain API's default
   // `AllowAuthenticated` auth so any authenticated user can mint/release their own
-  // uploads. See [docs/plans/upload-release-path.md] § "Which API". (Split mode only —
+  // uploads. See [docs/plans/done/upload-release-path.md] § "Which API". (Split mode only —
   // unified mode carries the admin base here instead; it declares no stores in practice,
   // so the upload resolvers below are never created there.)
   let domainBaseFragment = ReventlessCore.GraphQL_Stitcher.encode({
@@ -763,7 +815,7 @@ module MakeWithConfig = (
     // Only active when the Events API resource exists (platform/monolithic mode).
     subscriptionInfraHook: ?domainEventsApiOpt->Option.map(eventsApi =>
       (params: ReventlessCore.Plugin_Helpers.subscriptionInfraParams) => {
-        let {allQueryDbs, allEventTopics, eventLogEntries, opts} = params
+        let {pluginName, allQueryDbs, allEventTopics, eventLogEntries, opts} = params
         let customOpts =
           opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
         // StateTopic Lambda per stream-enabled QueryDb — publishes row changes
@@ -799,19 +851,34 @@ module MakeWithConfig = (
           let isSns =
             EventTopicPublisher_SNS.snsRegistry->Set.has(entry.displayName) ||
             EventTopicPublisher_SNS.snsRegistry->Set.has(entry.busKey)
-          let eventTopicOutputs =
-            isSns
-              ? allEventTopics
-                ->Dict.get(entry.displayName)
-                ->Option.orElse(allEventTopics->Dict.get(entry.busKey))
-              : None
-          eventTopicOutputs->Option.forEach(outputs =>
-            EventLogSubscription_AppSync.make(
-              ~name=entry.displayName,
-              ~topicName=entry.displayName,
+          let topicOutputs =
+            allEventTopics
+            ->Dict.get(entry.displayName)
+            ->Option.orElse(allEventTopics->Dict.get(entry.busKey))
+          isSns
+            ? topicOutputs->Option.forEach(outputs =>
+                EventLogSubscription_AppSync.make(
+                  ~name=entry.displayName,
+                  ~topicName=entry.displayName,
+                  ~eventTopicOutputs=outputs,
+                  ~eventsApi,
+                  ~opts=customOpts,
+                )
+              )
+            : ()
+          // Register this event log with the upload claimer if — and only if —
+          // its events declare a `@storageRef` field. An event log that declares
+          // none is not registered, so a platform whose plugins declare no store
+          // provisions no claimer at all. `isSns` is the same synchronous answer
+          // the subscription above turns on, so the two cannot disagree about
+          // which channel an event log publishes through.
+          topicOutputs->Option.forEach(outputs =>
+            Upload_Claim_S3.make(
+              ~plugin=pluginName,
+              ~eventLogName=entry.displayName,
+              ~eventSchema=entry.eventSchema,
               ~eventTopicOutputs=outputs,
-              ~eventsApi,
-              ~opts=customOpts,
+              ~isStreamBacked=!isSns,
             )
           )
         })
@@ -822,6 +889,9 @@ module MakeWithConfig = (
         // empty because the hook hasn't run yet. Admin's hook fires synchronously,
         // but the call site is unified here so admin and plugins share one path.
         StateTopic_AppSync.finish(~eventsApi, ~opts={})
+        // Same timing constraint, same reason: the claimer's registry is filled
+        // by the loop just above and drained here.
+        Upload_Claim_S3.finish(~plugin=pluginName, ~stores=claimStores, ~opts=customOpts)
       }
     ),
   }
@@ -1063,12 +1133,15 @@ module MakeWithConfig = (
     // omitted (byte-identical config.json).
     geocoderPlaceIndex?: ReventlessInfra.Platform.geocoderIndex,
     // Optional object store for direct-to-S3 uploads, as returned by
-    // `Capability_ObjectStore_S3.make`. When set, the deploy provisions the
-    // presign service (Upload_Presign_S3) against it, threads that service's URL
-    // into config.json as `uploadEndpoint`, and fronts the store read-only on
-    // the host-shell CloudFront distribution under the presign service's own
-    // prefix (a `{prefix}/*` ordered cache behavior + origin + scoped
-    // BucketPolicy, private, OAC-read).
+    // `Capability_ObjectStore_S3.make`. When set, the deploy registers it with
+    // the platform's one Upload service (`Upload_Presign_S3`) under the `uploads`
+    // store key, and fronts the store read-only on the host-shell CloudFront
+    // distribution under that prefix (a `{prefix}/*` ordered cache behavior +
+    // origin + scoped BucketPolicy, private, OAC-read).
+    //
+    // No endpoint is written into config.json: under route B a caller mints
+    // through the domain API's `Upload_Presign` mutation, naming the store, so
+    // there is no per-store URL to publish or to resolve.
     //
     // One field replaces the former `enableUploads` / `uploadBucketName` /
     // `servedBuckets` trio, which were three ways of saying one thing and left
@@ -1537,6 +1610,30 @@ module MakeWithConfig = (
           : Array.concat(acc, [(plugin, store)])
       )
 
+    // Refuse two stores that cannot be told apart, BEFORE a single resource is
+    // created. Left to the deploy, the same collision surfaces as a CloudFront
+    // error about a duplicate path pattern — minutes in, naming a path pattern
+    // rather than the two plugins — and only after the intermixed objects and
+    // the over-broad presign grant have already been provisioned.
+    //
+    // Checked on the prefix, so it costs nothing to keep once prefixes are
+    // qualified: a qualified prefix simply stops colliding, while the check
+    // still guards any bare prefix that outlives the change.
+    switch ReventlessCore.StorePrefixCollision.collisionsFor(
+      ~stores=declaredStores->Array.map(((plugin, store)) => {
+        ReventlessCore.StorePrefixCollision.qualified: `${plugin}.${store}`,
+        prefix: Util_StoreLayout.keyPrefixFor(~plugin, ~store),
+      }),
+    ) {
+    | [] => ()
+    | collisions =>
+      JsError.throwWithMessage(
+        collisions
+        ->Array.map(ReventlessCore.StorePrefixCollision.collisionMessage)
+        ->Array.join("\n\n"),
+      )
+    }
+
     if declaredStores->Array.length > 0 {
       // The fail-open in `layoutFor` is only dangerous while it is silent: a
       // production stack that is not on the prod list gets the shared layout and
@@ -1560,6 +1657,46 @@ module MakeWithConfig = (
     // policy and one CDN origin however many stores live in it.
     let storeBuckets: Dict.t<ReventlessInfra.Platform.objectStore> = Dict.make()
     let storeBucketOrder: array<string> = []
+
+    // Which stores expire their never-claimed uploads, grouped by the bucket
+    // they live in. Computed before any bucket is created, because a bucket
+    // carries its lifecycle rules from birth and a shared-layout bucket is
+    // created once for several stores — the first store through the loop below
+    // would otherwise be the only one whose setting was ever read.
+    //
+    // Off unless a deployment names the store. See `Util_StoreLayout.pendingExpiryFor`
+    // for why this is a deployment's setting and not a declaration's, and why
+    // there is deliberately no default.
+    let pendingExpiryConfig = Util_LocalConfig.get("pendingUploadExpiryDays")
+    let pendingExpiryByBucket: Dict.t<array<Capability_ObjectStore_S3.pendingExpiry>> = Dict.make()
+    declaredStores->Array.forEach(((plugin, store)) =>
+      Util_StoreLayout.pendingExpiryFor(
+        ~config=pendingExpiryConfig,
+        ~store=`${plugin}.${store}`,
+      )->Option.forEach(days => {
+        let bucketName = Util_StoreLayout.bucketNameFor(
+          ~layout=storeLayout,
+          ~stack=stackName,
+          ~plugin,
+          ~store,
+        )
+        let prefix = Util_StoreLayout.keyPrefixFor(~plugin, ~store)
+        pendingExpiryByBucket->Dict.set(
+          bucketName,
+          pendingExpiryByBucket
+          ->Dict.get(bucketName)
+          ->Option.getOr([])
+          ->Array.concat([{Capability_ObjectStore_S3.prefix, days}]),
+        )
+        log.info(
+          ~comp="Platform:deployPlatform",
+          `object store ${plugin}.${store}: never-claimed uploads under ${prefix}/ expire after ` ++
+          `${days->Int.toString} days. Claimed objects and objects minted before the claim ` ++
+          `component existed carry no pending tag and are outside the rule.`,
+        )
+      })
+    )
+
     let declaredStoreServices = declaredStores->Array.map(((plugin, store)) => {
       let bucketName = Util_StoreLayout.bucketNameFor(
         ~layout=storeLayout,
@@ -1567,7 +1704,7 @@ module MakeWithConfig = (
         ~plugin,
         ~store,
       )
-      let keyPrefix = Util_StoreLayout.keyPrefixFor(~store)
+      let keyPrefix = Util_StoreLayout.keyPrefixFor(~plugin, ~store)
       let bucket = switch storeBuckets->Dict.get(bucketName) {
       | Some(b) => b
       | None =>
@@ -1584,6 +1721,7 @@ module MakeWithConfig = (
           // disposable stack would leak exactly the buckets sharing exists to
           // save. The two settings are opposite faces of one decision.
           ~forceDestroy=storeProtection == Unprotected,
+          ~expirePending=pendingExpiryByBucket->Dict.get(bucketName)->Option.getOr([]),
         )
         storeBuckets->Dict.set(bucketName, b)
         storeBucketOrder->Array.push(bucketName)

package/src/Platform.res.mjs

@@ -35,6 +35,7 @@ import * as EventLogBackend$ReventlessAws from "./adapter/EventLog/EventLogBacke
 import * as Platform_Admin$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_Admin.res.mjs";
 import * as PluginBehavior$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginBehavior.res.mjs";
 import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
+import * as Upload_Claim_S3$ReventlessAws from "./adapter/Upload/Upload_Claim_S3.res.mjs";
 import * as PgProjectionFeed$ReventlessAws from "./adapter/Postgres/PgProjectionFeed.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "./util/Util_LocalConfig.res.mjs";
 import * as Util_StoreLayout$ReventlessAws from "./util/Util_StoreLayout.res.mjs";
@@ -59,6 +60,7 @@ import * as Geocoder_AwsLocation$ReventlessAws from "./adapter/Geocoder/Geocoder
 import * as QueryEngine_DynamoDb$ReventlessAws from "./adapter/QueryEngine/QueryEngine_DynamoDb.res.mjs";
 import * as PluginRuntime_Builder$ReventlessAws from "./plugin/runtime/PluginRuntime_Builder.res.mjs";
 import * as PluginsReadModelSpec$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginsReadModelSpec.res.mjs";
+import * as StorePrefixCollision$ReventlessCore from "@reventlessdev/reventless-core/src/util/StorePrefixCollision.res.mjs";
 import * as ExtensionPoint_Builder$ReventlessAws from "./components/ExtensionPoint_Builder.res.mjs";
 import * as StateViewSlice_Builder$ReventlessAws from "./components/StateViewSlice_Builder.res.mjs";
 import * as Task_Builder_PerBucket$ReventlessAws from "./components/Task_Builder_PerBucket.res.mjs";
@@ -155,6 +157,30 @@ function MakeWithConfig(Config) {
     contents: "Domain"
   };
   let platformStackRef = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
+  let claimStores = () => {
+    if (platformStackRef !== undefined) {
+      return Primitive_option.valFromOption(platformStackRef).getOutput("objectStores").apply(objectStores => Stdlib_Array.filterMap(Object.entries(Stdlib_Option.getOr(Stdlib_Option.flatMap(objectStores, Stdlib_JSON.Decode.object), {})), param => {
+        let qualified = param[0];
+        return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(param[1]), o => {
+          let match = Stdlib_Option.flatMap(o["bucketName"], Stdlib_JSON.Decode.string);
+          let match$1 = Stdlib_Option.flatMap(o["keyPrefix"], Stdlib_JSON.Decode.string);
+          if (match !== undefined && match$1 !== undefined) {
+            return {
+              qualified: qualified,
+              bucketName: match,
+              servedPrefix: match$1
+            };
+          }
+        });
+      }));
+    } else {
+      return Pulumi.all(objectStoreEndpointsRef.contents.map(e => e.bucketName.apply(bucketName => ({
+        qualified: e.store,
+        bucketName: bucketName,
+        servedPrefix: e.keyPrefix
+      }))));
+    }
+  };
   let domainBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
     types: Platform_AdminApi$ReventlessCore.uploadTypes,
     mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields,
@@ -456,6 +482,7 @@ function MakeWithConfig(Config) {
   let hooks_subscriptionInfraHook = Stdlib_Option.map(domainEventsApiOpt, eventsApi => (params => {
     let allEventTopics = params.allEventTopics;
     let allQueryDbs = params.allQueryDbs;
+    let pluginName = params.pluginName;
     let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(params.opts);
     Stdlib_Dict.forEachWithKey(allQueryDbs, (_queryDbOutputs, readModelName) => {
       if (!QueryDbStorage_DynamoDbStream$ReventlessAws.streamRegistry.has(readModelName)) {
@@ -466,10 +493,14 @@ function MakeWithConfig(Config) {
     });
     params.eventLogEntries.forEach(entry => {
       let isSns = EventTopicPublisher_SNS$ReventlessAws.snsRegistry.has(entry.displayName) || EventTopicPublisher_SNS$ReventlessAws.snsRegistry.has(entry.busKey);
-      let eventTopicOutputs = isSns ? Stdlib_Option.orElse(allEventTopics[entry.displayName], allEventTopics[entry.busKey]) : undefined;
-      Stdlib_Option.forEach(eventTopicOutputs, outputs => EventLogSubscription_AppSync$ReventlessAws.make(entry.displayName, entry.displayName, outputs, eventsApi, customOpts));
+      let topicOutputs = Stdlib_Option.orElse(allEventTopics[entry.displayName], allEventTopics[entry.busKey]);
+      if (isSns) {
+        Stdlib_Option.forEach(topicOutputs, outputs => EventLogSubscription_AppSync$ReventlessAws.make(entry.displayName, entry.displayName, outputs, eventsApi, customOpts));
+      }
+      Stdlib_Option.forEach(topicOutputs, outputs => Upload_Claim_S3$ReventlessAws.make(pluginName, entry.displayName, entry.eventSchema, outputs, !isSns));
     });
     StateTopic_AppSync$ReventlessAws.finish(eventsApi, {});
+    Upload_Claim_S3$ReventlessAws.finish(pluginName, claimStores, undefined, customOpts);
   }));
   let hooks_preResolversSchemaHook = (name, version, pluginFragment) => {
     let sdl = AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(pluginFragment);
@@ -904,6 +935,17 @@ function MakeWithConfig(Config) {
           ]]);
       }
     });
+    let collisions = StorePrefixCollision$ReventlessCore.collisionsFor(declaredStores.map(param => {
+      let store = param[1];
+      let plugin = param[0];
+      return {
+        qualified: plugin + `.` + store,
+        prefix: Util_StoreLayout$ReventlessAws.keyPrefixFor(plugin, store)
+      };
+    }));
+    if (collisions.length !== 0) {
+      Stdlib_JsError.throwWithMessage(collisions.map(StorePrefixCollision$ReventlessCore.collisionMessage).join("\n\n"));
+    }
     if (declaredStores.length !== 0) {
       let tmp;
       tmp = storeLayout === "PerStore" ? "bucket per store" : "shared bucket, {store}/… prefixes";
@@ -913,11 +955,26 @@ function MakeWithConfig(Config) {
     }
     let storeBuckets = {};
     let storeBucketOrder = [];
+    let pendingExpiryConfig = Util_LocalConfig$ReventlessAws.get("pendingUploadExpiryDays");
+    let pendingExpiryByBucket = {};
+    declaredStores.forEach(param => {
+      let store = param[1];
+      let plugin = param[0];
+      Stdlib_Option.forEach(Util_StoreLayout$ReventlessAws.pendingExpiryFor(pendingExpiryConfig, plugin + `.` + store), days => {
+        let bucketName = Util_StoreLayout$ReventlessAws.bucketNameFor(storeLayout, stackName, plugin, store);
+        let prefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(plugin, store);
+        pendingExpiryByBucket[bucketName] = Stdlib_Option.getOr(pendingExpiryByBucket[bucketName], []).concat([{
+            prefix: prefix,
+            days: days
+          }]);
+        log.info("Platform:deployPlatform", undefined, `object store ` + plugin + `.` + store + `: never-claimed uploads under ` + prefix + `/ expire after ` + (days.toString() + ` days. Claimed objects and objects minted before the claim `) + `component existed carry no pending tag and are outside the rule.`);
+      });
+    });
     let declaredStoreServices = declaredStores.map(param => {
       let store = param[1];
       let plugin = param[0];
       let bucketName = Util_StoreLayout$ReventlessAws.bucketNameFor(storeLayout, stackName, plugin, store);
-      let keyPrefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(store);
+      let keyPrefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(plugin, store);
       let b = storeBuckets[bucketName];
       let bucket;
       if (b !== undefined) {
@@ -925,7 +982,7 @@ function MakeWithConfig(Config) {
       } else {
         let tmp;
         tmp = storeLayout === "PerStore" ? plugin : undefined;
-        let b$1 = Capability_ObjectStore_S3$ReventlessAws.make(bucketName, keyPrefix, tmp, storeProtection === "Protected", storeProtection === "Unprotected", undefined, undefined);
+        let b$1 = Capability_ObjectStore_S3$ReventlessAws.make(bucketName, keyPrefix, tmp, storeProtection === "Protected", storeProtection === "Unprotected", Stdlib_Option.getOr(pendingExpiryByBucket[bucketName], []), undefined, undefined);
         storeBuckets[bucketName] = b$1;
         storeBucketOrder.push(bucketName);
         bucket = b$1;
@@ -1312,6 +1369,30 @@ function Make($star) {
     contents: "Domain"
   };
   let platformStackRef = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
+  let claimStores = () => {
+    if (platformStackRef !== undefined) {
+      return Primitive_option.valFromOption(platformStackRef).getOutput("objectStores").apply(objectStores => Stdlib_Array.filterMap(Object.entries(Stdlib_Option.getOr(Stdlib_Option.flatMap(objectStores, Stdlib_JSON.Decode.object), {})), param => {
+        let qualified = param[0];
+        return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(param[1]), o => {
+          let match = Stdlib_Option.flatMap(o["bucketName"], Stdlib_JSON.Decode.string);
+          let match$1 = Stdlib_Option.flatMap(o["keyPrefix"], Stdlib_JSON.Decode.string);
+          if (match !== undefined && match$1 !== undefined) {
+            return {
+              qualified: qualified,
+              bucketName: match,
+              servedPrefix: match$1
+            };
+          }
+        });
+      }));
+    } else {
+      return Pulumi.all(objectStoreEndpointsRef.contents.map(e => e.bucketName.apply(bucketName => ({
+        qualified: e.store,
+        bucketName: bucketName,
+        servedPrefix: e.keyPrefix
+      }))));
+    }
+  };
   let domainBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
     types: Platform_AdminApi$ReventlessCore.uploadTypes,
     mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields,
@@ -1613,6 +1694,7 @@ function Make($star) {
   let hooks_subscriptionInfraHook = Stdlib_Option.map(domainEventsApiOpt, eventsApi => (params => {
     let allEventTopics = params.allEventTopics;
     let allQueryDbs = params.allQueryDbs;
+    let pluginName = params.pluginName;
     let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(params.opts);
     Stdlib_Dict.forEachWithKey(allQueryDbs, (_queryDbOutputs, readModelName) => {
       if (!QueryDbStorage_DynamoDbStream$ReventlessAws.streamRegistry.has(readModelName)) {
@@ -1623,10 +1705,14 @@ function Make($star) {
     });
     params.eventLogEntries.forEach(entry => {
       let isSns = EventTopicPublisher_SNS$ReventlessAws.snsRegistry.has(entry.displayName) || EventTopicPublisher_SNS$ReventlessAws.snsRegistry.has(entry.busKey);
-      let eventTopicOutputs = isSns ? Stdlib_Option.orElse(allEventTopics[entry.displayName], allEventTopics[entry.busKey]) : undefined;
-      Stdlib_Option.forEach(eventTopicOutputs, outputs => EventLogSubscription_AppSync$ReventlessAws.make(entry.displayName, entry.displayName, outputs, eventsApi, customOpts));
+      let topicOutputs = Stdlib_Option.orElse(allEventTopics[entry.displayName], allEventTopics[entry.busKey]);
+      if (isSns) {
+        Stdlib_Option.forEach(topicOutputs, outputs => EventLogSubscription_AppSync$ReventlessAws.make(entry.displayName, entry.displayName, outputs, eventsApi, customOpts));
+      }
+      Stdlib_Option.forEach(topicOutputs, outputs => Upload_Claim_S3$ReventlessAws.make(pluginName, entry.displayName, entry.eventSchema, outputs, !isSns));
     });
     StateTopic_AppSync$ReventlessAws.finish(eventsApi, {});
+    Upload_Claim_S3$ReventlessAws.finish(pluginName, claimStores, undefined, customOpts);
   }));
   let hooks_preResolversSchemaHook = (name, version, pluginFragment) => {
     let sdl = AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(pluginFragment);
@@ -2038,6 +2124,17 @@ function Make($star) {
           ]]);
       }
     });
+    let collisions = StorePrefixCollision$ReventlessCore.collisionsFor(declaredStores.map(param => {
+      let store = param[1];
+      let plugin = param[0];
+      return {
+        qualified: plugin + `.` + store,
+        prefix: Util_StoreLayout$ReventlessAws.keyPrefixFor(plugin, store)
+      };
+    }));
+    if (collisions.length !== 0) {
+      Stdlib_JsError.throwWithMessage(collisions.map(StorePrefixCollision$ReventlessCore.collisionMessage).join("\n\n"));
+    }
     if (declaredStores.length !== 0) {
       let tmp;
       tmp = storeLayout === "PerStore" ? "bucket per store" : "shared bucket, {store}/… prefixes";
@@ -2047,11 +2144,26 @@ function Make($star) {
     }
     let storeBuckets = {};
     let storeBucketOrder = [];
+    let pendingExpiryConfig = Util_LocalConfig$ReventlessAws.get("pendingUploadExpiryDays");
+    let pendingExpiryByBucket = {};
+    declaredStores.forEach(param => {
+      let store = param[1];
+      let plugin = param[0];
+      Stdlib_Option.forEach(Util_StoreLayout$ReventlessAws.pendingExpiryFor(pendingExpiryConfig, plugin + `.` + store), days => {
+        let bucketName = Util_StoreLayout$ReventlessAws.bucketNameFor(storeLayout, stackName, plugin, store);
+        let prefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(plugin, store);
+        pendingExpiryByBucket[bucketName] = Stdlib_Option.getOr(pendingExpiryByBucket[bucketName], []).concat([{
+            prefix: prefix,
+            days: days
+          }]);
+        log.info("Platform:deployPlatform", undefined, `object store ` + plugin + `.` + store + `: never-claimed uploads under ` + prefix + `/ expire after ` + (days.toString() + ` days. Claimed objects and objects minted before the claim `) + `component existed carry no pending tag and are outside the rule.`);
+      });
+    });
     let declaredStoreServices = declaredStores.map(param => {
       let store = param[1];
       let plugin = param[0];
       let bucketName = Util_StoreLayout$ReventlessAws.bucketNameFor(storeLayout, stackName, plugin, store);
-      let keyPrefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(store);
+      let keyPrefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(plugin, store);
       let b = storeBuckets[bucketName];
       let bucket;
       if (b !== undefined) {
@@ -2059,7 +2171,7 @@ function Make($star) {
       } else {
         let tmp;
         tmp = storeLayout === "PerStore" ? plugin : undefined;
-        let b$1 = Capability_ObjectStore_S3$ReventlessAws.make(bucketName, keyPrefix, tmp, storeProtection === "Protected", storeProtection === "Unprotected", undefined, undefined);
+        let b$1 = Capability_ObjectStore_S3$ReventlessAws.make(bucketName, keyPrefix, tmp, storeProtection === "Protected", storeProtection === "Unprotected", Stdlib_Option.getOr(pendingExpiryByBucket[bucketName], []), undefined, undefined);
         storeBuckets[bucketName] = b$1;
         storeBucketOrder.push(bucketName);
         bucket = b$1;

package/src/adapter/Runtime/AggregateRuntime_Builder_Single.res

@@ -298,6 +298,11 @@ let finish = () =>
             }
           })
         )
+        // First-class log-level override → LOG_LEVEL, winning over any generic
+        // envVars entry. When unset, makeFromCodeAsset applies the tier default.
+        cfg.logLevel->Option.forEach(level =>
+          envVars->Dict.set("LOG_LEVEL", level->Pulumi.Output.make->Pulumi.Output.asInput)
+        )
 
         // Build AssetArchive: static re-export + user packages
         let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(

package/src/adapter/Runtime/AggregateRuntime_Builder_Single.res.mjs

@@ -197,6 +197,9 @@ function finish() {
           return;
         }
       }));
+      Stdlib_Option.forEach(cfg.logLevel, level => {
+        envVars["LOG_LEVEL"] = Pulumi.output(level);
+      });
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
       Stdlib_Option.forEach(cfg.sqsBatchSize, CommandTopicChannel_SQS_Sync$ReventlessAws.setBatchSize);
       let vpcConfig = pgSelection !== undefined ? pgSelection.securityGroupId.apply(sgId => ({

package/src/adapter/Runtime/AggregateRuntime_Builder_Single_Async.res

@@ -276,6 +276,11 @@ let finish = () =>
             }
           })
         )
+        // First-class log-level override → LOG_LEVEL, winning over any generic
+        // envVars entry. When unset, makeFromCodeAsset applies the tier default.
+        cfg.logLevel->Option.forEach(level =>
+          envVars->Dict.set("LOG_LEVEL", level->Pulumi.Output.make->Pulumi.Output.asInput)
+        )
 
         // Build AssetArchive: static re-export + user packages
         let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(

package/src/adapter/Runtime/AggregateRuntime_Builder_Single_Async.res.mjs

@@ -186,6 +186,9 @@ function finish() {
           return;
         }
       }));
+      Stdlib_Option.forEach(cfg.logLevel, level => {
+        envVars["LOG_LEVEL"] = Pulumi.output(level);
+      });
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
       Stdlib_Option.forEach(cfg.sqsBatchSize, CommandTopicChannel_SQS_Async$ReventlessAws.setBatchSize);
       let vpcConfig = pgSelection !== undefined ? pgSelection.securityGroupId.apply(sgId => ({