@reventlessdev/reventless-aws 3.0.0-alpha.252 → 3.0.0-alpha.254

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -115,7 +115,9 @@ let makeFromCodeAsset: (
   ~logRetentionDays: int=?,
   /** Provision the DCB append-retry/conflict CloudWatch metric filters on this
       Lambda's log group (command-handler Lambdas only). Requires a managed log
-      group, so it only takes effect when `~logRetentionDays` is also set. */
+      group, so it only takes effect when one is created — i.e. when
+      `~logRetentionDays` is set or the stack tier manages its groups
+      (`Util_LogRetention.managesLogGroup`). */
   ~dcbMetrics: bool=?,
   /** Place the Lambda in a VPC (needed to reach RDS/managed Postgres). When set,
       the execution role also gets the EC2 network-interface permissions AWS
@@ -143,6 +145,18 @@ let makeFromCodeAsset: (
   let opts =
     opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
 
+  // The environment tier drives retention, default log level and whether the log
+  // group is Pulumi-managed. Resolved once from the stack name and the shared
+  // prod allow-list (the same notion of "production" that names the host-shell
+  // domain and the store layout).
+  let stack = Pulumi.Pulumi.getStackName()
+  let prodStacks = Util_HostUiDomain.resolveProdStacks()
+  // Stacks explicitly held on auto-created log groups pending a `pulumi import`
+  // (none today — the escape hatch for adopting a pre-existing stack later).
+  let unmanagedStacks = Util_LogRetention.parseUnmanagedStacks(
+    Util_LocalConfig.get("unmanagedLogGroupStacks")->Option.getOr(""),
+  )
+
   // One attribution identity for every resource provisioned here: same owning
   // component and kind throughout, distinct piece roles — the function itself,
   // the execution identity it assumes, and its log group are three pieces of one
@@ -219,9 +233,7 @@ let makeFromCodeAsset: (
     ->Option.getOr([])
     ->Pulumi.Input.make
 
-  let variables = Dict.fromArray([
-    ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
-  ])
+  let variables = Dict.fromArray([("Environment", stack->Pulumi.Input.make)])
   envVars->Dict.forEachWithKey((value, key) => {
     variables->Dict.set(key, value)
   })
@@ -229,6 +241,21 @@ let makeFromCodeAsset: (
     variables->Dict.set(key, value)
   })
 
+  // Default the logger's minimum level per environment tier when nothing already
+  // pinned one (caller `envVars` or a consumer-registered `additionalEnvVars`
+  // win). Verbose on disposable dev stacks, quiet on prod/beta — for every
+  // Lambda, not just the command handlers.
+  if variables->Dict.get("LOG_LEVEL")->Option.isNone {
+    variables->Dict.set(
+      "LOG_LEVEL",
+      Util_LogRetention.logLevelFor(
+        ~stack,
+        ~prodStacks,
+        ~configOverride=?Util_LocalConfig.get("logLevel"),
+      )->Pulumi.Input.make,
+    )
+  }
+
   // ESM self-containment (Option C): every code archive built by
   // Util_Bundle.buildCodeArchive ships register-hook.mjs + layer-resolver.mjs at
   // /var/task. --import registers the resolve hook so the ESM entry point (and the
@@ -263,13 +290,44 @@ let makeFromCodeAsset: (
     ~opts?,
   )
 
-  // Optional CloudWatch log-group with explicit retention. When not set, Lambda
-  // auto-creates a log group with no retention (logs accumulate indefinitely).
-  logRetentionDays->Option.forEach(days => {
+  // Managed CloudWatch log-group with explicit retention. Created when the caller
+  // pins `~logRetentionDays` (the app-developer opt-in) OR the stack manages its
+  // groups — every stack by default, bar any named in `unmanagedLogGroupStacks`
+  // (see `Util_LogRetention.managesLogGroup`). When neither holds, Lambda
+  // auto-creates an unmanaged group with no retention.
+  //
+  // Precedence for the retention value: explicit `~logRetentionDays` → the
+  // `logRetentionDays` config key → the environment tier default.
+  //
+  // The group name derives from the function's *physical* name output, not the
+  // logical `name`. `Lambda.Function` has no `name` arg, so its physical name
+  // always carries Pulumi's `-<7hex>` suffix; a literal `/aws/lambda/${name}`
+  // would create an empty group beside the real one, leave orphan accumulation
+  // unchanged, and collide across stacks sharing an account.
+  let managedRetention = switch (
+    logRetentionDays,
+    Util_LogRetention.managesLogGroup(~stack, ~unmanagedStacks),
+  ) {
+  | (Some(days), _) => Some(days)
+  | (None, true) =>
+    Some(
+      Util_LogRetention.retentionDaysFor(
+        ~stack,
+        ~prodStacks,
+        ~configOverride=?Util_LocalConfig.get("logRetentionDays")->Option.flatMap(s =>
+          Int.fromString(s)
+        ),
+      ),
+    )
+  | (None, false) => None
+  }
+  managedRetention->Option.forEach(days => {
     let logGroup = Cloudwatch.LogGroup.make(
       ~name=`${name}LogGroup`,
       ~args={
-        name: `/aws/lambda/${name}`->Pulumi.Input.make,
+        name: lambda.name
+        ->Pulumi.Output.apply(n => `/aws/lambda/${n}`)
+        ->Pulumi.Output.asInput,
         retentionInDays: days->Pulumi.Input.make,
         tags: tagsFor(~resourceName=`${name}LogGroup`, ~role=Logs),
       },

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs

@@ -20,6 +20,9 @@ import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Lambda$ReventlessAws from "../../util/Util_Lambda.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as Util_IAM_Role$ReventlessAws from "../../util/Util_IAM_Role.res.mjs";
+import * as Util_LocalConfig$ReventlessAws from "../../util/Util_LocalConfig.res.mjs";
+import * as Util_HostUiDomain$ReventlessAws from "../../util/Util_HostUiDomain.res.mjs";
+import * as Util_LogRetention$ReventlessAws from "../../util/Util_LogRetention.res.mjs";
 
 let additionalEnvVars = {};
 
@@ -50,6 +53,9 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
   let timeout = timeoutOpt !== undefined ? timeoutOpt : Runtime$ReventlessCore.CommandHandlerDefaults.timeout;
   let dcbMetrics = dcbMetricsOpt !== undefined ? dcbMetricsOpt : false;
   let opts$1 = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
+  let stack = Pulumi.getStack();
+  let prodStacks = Util_HostUiDomain$ReventlessAws.resolveProdStacks();
+  let unmanagedStacks = Util_LogRetention$ReventlessAws.parseUnmanagedStacks(Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("unmanagedLogGroupStacks"), ""));
   let tagsFor = (resourceName, role) => AWS_Tags$ReventlessAws.make(resourceName, componentKind, role, undefined, name, undefined, undefined, undefined);
   let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.Lambda.principal), tagsFor(name, "Identity"), opts$1);
   Stdlib_Option.forEach(vpcConfig, param => {
@@ -87,7 +93,7 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
   let variables = Object.fromEntries([[
       "Environment",
-      Pulumi.getStack()
+      stack
     ]]);
   Stdlib_Dict.forEachWithKey(envVars, (value, key) => {
     variables[key] = value;
@@ -95,6 +101,9 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
   Stdlib_Dict.forEachWithKey(additionalEnvVars, (value, key) => {
     variables[key] = value;
   });
+  if (Stdlib_Option.isNone(variables["LOG_LEVEL"])) {
+    variables["LOG_LEVEL"] = Util_LogRetention$ReventlessAws.logLevelFor(stack, prodStacks, Util_LocalConfig$ReventlessAws.get("logLevel"));
+  }
   variables["NODE_OPTIONS"] = Util_Bundle$ReventlessAws.esmLoaderNodeOptions;
   variables["ESM_FALLBACK_DIRS"] = Util_Bundle$ReventlessAws.esmFallbackDirs;
   let tags = tagsFor(name, "Runtime");
@@ -117,9 +126,13 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
     })),
     vpcConfig: vpcConfig
   }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
-  Stdlib_Option.forEach(logRetentionDays, days => {
+  let match = Util_LogRetention$ReventlessAws.managesLogGroup(stack, unmanagedStacks);
+  let managedRetention = logRetentionDays !== undefined ? logRetentionDays : (
+      match ? Util_LogRetention$ReventlessAws.retentionDaysFor(stack, prodStacks, Stdlib_Option.flatMap(Util_LocalConfig$ReventlessAws.get("logRetentionDays"), s => Stdlib_Int.fromString(s, undefined))) : undefined
+    );
+  Stdlib_Option.forEach(managedRetention, days => {
     let logGroup = new (Aws.cloudwatch.LogGroup)(name + `LogGroup`, {
-      name: `/aws/lambda/` + name,
+      name: lambda.name.apply(n => `/aws/lambda/` + n),
       retentionInDays: days,
       tags: tagsFor(name + `LogGroup`, "Logs")
     }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);

package/src/adapter/Runtime/StateChangeSliceRuntime_Builder_Single.res

@@ -107,6 +107,11 @@ let forDcbCommandTopic = (
         }
       })
     )
+    // First-class log-level override → LOG_LEVEL, winning over any generic
+    // envVars entry. When unset, makeFromCodeAsset applies the tier default.
+    cfg.logLevel->Option.forEach(level =>
+      envVars->Dict.set("LOG_LEVEL", level->Pulumi.Output.make->Pulumi.Output.asInput)
+    )
 
     // Build HANDLER_CONFIG JSON: array of {spec, behavior} objects so the entry point
     // can dynamically import both modules and apply the curried StateChangeSlice_Callback.Make

package/src/adapter/Runtime/StateChangeSliceRuntime_Builder_Single.res.mjs

@@ -53,6 +53,9 @@ function forDcbCommandTopic(slicePaths, inboundSlicesOpt, dcbTableName, pluginNa
       return;
     }
   }));
+  Stdlib_Option.forEach(cfg.logLevel, level => {
+    envVars["LOG_LEVEL"] = Pulumi.output(level);
+  });
   let sliceModulesJson = slicePaths.map(param => {
     let s = Stdlib_Option.getOr(JSON.stringify(param[0]), `""`);
     let b = Stdlib_Option.getOr(JSON.stringify(param[1]), `""`);

package/src/adapter/Task/TaskBucket_S3.res

@@ -125,10 +125,21 @@ let connect = (
 let make: ReventlessCore.Task_Adapter.bucketMaker<bucketParts> = (~name, ~opts) => {
   let opts = opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
 
+  // A task bucket holds transient input a slice consumes, so disposability
+  // follows the stack, exactly as it does for declared stores. It matters
+  // because a bucket name change is a *replace*, and a replace of a non-empty
+  // bucket fails the deploy with `BucketNotEmpty` — which would wedge precisely
+  // the throwaway stacks that are recreated most often. Protected stacks keep
+  // the safe default and drain by hand.
+  let forceDestroy =
+    Util_StoreLayout.protectionFor(~stack=Pulumi.Pulumi.getStackName()) ==
+      Util_StoreLayout.Unprotected
+
   let bucket = {
     PulumiAws.S3.Bucket.make(
       ~name,
       ~args={
+        forceDestroy: forceDestroy->Pulumi.Input.make,
         corsRules: [
           {
             PulumiAws.S3.Bucket.allowedHeaders: ["*"],

package/src/adapter/Task/TaskBucket_S3.res.mjs

@@ -11,6 +11,7 @@ import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adap
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
 import * as Adapter_Helpers$ReventlessAws from "../Adapter_Helpers.res.mjs";
+import * as Util_StoreLayout$ReventlessAws from "../../util/Util_StoreLayout.res.mjs";
 import * as TaskBucket_S3_Runtime$ReventlessAws from "./TaskBucket_S3_Runtime.res.mjs";
 
 function subscribeLambda2S3Bucket(lambda, name, bucket, opts) {
@@ -75,6 +76,7 @@ function connect(name, bucket, bucketMode, commandTopics, runtime, opts) {
 
 function make(name, opts) {
   let opts$1 = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(opts);
+  let forceDestroy = Util_StoreLayout$ReventlessAws.protectionFor(Pulumi.getStack(), undefined) === "Unprotected";
   let bucket = new (Aws.s3.Bucket)(name, {
     corsRules: [{
         allowedHeaders: ["*"],
@@ -93,6 +95,7 @@ function make(name, opts) {
         ],
         maxAgeSeconds: 3000
       }],
+    forceDestroy: forceDestroy,
     tags: AWS_Tags$ReventlessAws.make(name, Task$ReventlessCore.componentType, {
       TAG: "Other",
       _0: "Bucket"

package/src/adapter/Upload/Upload_Claim_S3.res

@@ -0,0 +1,361 @@
+// The claim component: an uploaded object stops being provisional when a
+// committed event references it.
+//
+// Deploy-time half of [docs/plans/done/upload-pending-claim-and-expiry.md] Step 2.
+// `make` registers one event log whose events declare at least one
+// `@storageRef` field; `finish` builds the single Lambda that serves all of
+// them, its stream subscriptions, its IAM, and the alarm on how far behind it
+// is. Registered from the platform's subscription hook and finished from inside
+// it, for the same reason `StateTopic_AppSync` is: the hook fires from within a
+// `Pulumi.Output.apply` chain, so a `finish` called after `P.make()` returns
+// would drain an empty registry.
+//
+// It is not a plugin's concern in the domain sense — a ref minted by one plugin
+// can be referenced by another's event, and no plugin owns a store's contents —
+// but it is provisioned per plugin stack, because that is where the event log
+// tables and their streams exist. The store side (bucket and served prefix)
+// crosses in from the platform stack, which is where stores are provisioned.
+//
+// Input breadth is the thing to guard. Only event logs with a declared
+// ref-bearing field are registered, and within one only the declared fields are
+// read; if this ever grows toward "read every event" it has become a projection
+// and belongs in that machinery instead.
+
+open PulumiAws
+
+// ── Registry ─────────────────────────────────────────────────────────────────
+
+type entry = {
+  /** The event log's DynamoDB table. Doubles as the routing key: the handler
+      recovers it from each record's `eventSourceARN`. */
+  tableName: Pulumi.Output.t<string>,
+  streamArn: Pulumi.Output.t<string>,
+  refFields: array<ReventlessCore.StorageRefFields.eventRefFields>,
+}
+
+/** One registry per plugin — one claimer Lambda per plugin stack. `make`
+    appends, `finish` drains. */
+let registry: dict<array<entry>> = Dict.make()
+
+/** Event logs that declare a ref-bearing field but publish through a channel
+    this component cannot read (an SNS-backed event topic rather than a
+    DynamoDB stream). Their objects stay tagged forever, which is safe while the
+    lifecycle rule is off and data loss once it is on — so the deploy says so. */
+let unreachable: dict<array<string>> = Dict.make()
+
+let log = ReventlessCore.Logger.fromEnv()
+
+let appendTo = (reg: dict<array<'a>>, key: string, value: 'a) =>
+  reg->Dict.set(key, reg->Dict.get(key)->Option.getOr([])->Array.concat([value]))
+
+// ── Registration ─────────────────────────────────────────────────────────────
+
+/**
+Register one event log with the plugin's claimer.
+
+`~eventSchema` is read for `@storageRef` declarations; an event log with none is
+not registered at all, so a platform whose plugins declare no store provisions
+no claimer. `~plugin` qualifies a store the annotation left unqualified, which
+is the same resolution the deploy used when it provisioned the store.
+
+`~isStreamBacked` says whether the event log's topic publishes through a
+DynamoDB stream — the default for both aggregate and DCB logs — rather than
+SNS. Decided by the caller because the platform already makes exactly that
+call synchronously from `EventTopicPublisher_SNS`'s registry; asking the
+resource here would only get the answer inside an `apply`, which is after
+`finish` has drained the registry.
+*/
+let make = (
+  ~plugin: string,
+  ~eventLogName: string,
+  ~eventSchema: S.t<unknown>,
+  ~eventTopicOutputs: ReventlessInfra.EventTopic.outputs,
+  ~isStreamBacked: bool,
+) => {
+  let refFields = ReventlessCore.StorageRefFields.fromEventSchema(~plugin, eventSchema)
+  if refFields->Array.length > 0 {
+    // An SNS-backed topic carries the same events, but not on a channel this
+    // Lambda subscribes to. Recorded as a gap rather than skipped in silence:
+    // its objects would keep the pending tag forever, which reads as "working"
+    // right up until a store enables expiry.
+    switch isStreamBacked ? eventTopicOutputs.resources->Array.get(0) : None {
+    | None => unreachable->appendTo(plugin, eventLogName)
+    | Some(streamResource) =>
+      registry->appendTo(
+        plugin,
+        {
+          tableName: streamResource.name,
+          streamArn: streamResource->Util_DynamoDbStream.streamArnFromDynamoDbTableResource,
+          refFields,
+        },
+      )
+    }
+  }
+}
+
+// ── Finalize ─────────────────────────────────────────────────────────────────
+
+/** A store the claimer may untag in, resolved to what the handler needs. */
+type storeConfig = {
+  qualified: string,
+  bucketName: string,
+  servedPrefix: string,
+}
+
+/**
+Build the plugin's claimer from everything `make` registered.
+
+`~stores` is the platform's declared object stores — in a plugin stack they
+arrive from the platform stack's `objectStores` export, which is why it is an
+Output. A thunk rather than the Output itself because most plugins register
+nothing here, and resolving another stack's export to build a claimer that is
+not going to exist is work with no reader.
+
+`~iteratorAgeAlarmMs` is the lag the alarm fires at. Lag is the one failure mode
+that deletes data: if this Lambda stops and nobody notices, referenced objects
+keep the tag and an enabled lifecycle rule expires them. The default is an hour
+against an expiry measured in days, so a stall is noticed with room to fix it.
+*/
+let finish = (
+  ~plugin: string,
+  ~stores: unit => Pulumi.Output.t<array<storeConfig>>,
+  ~iteratorAgeAlarmMs: float=3_600_000.,
+  ~opts: Pulumi.CustomResourceOptions.t,
+) => {
+  switch unreachable->Dict.get(plugin)->Option.filter(logs => logs->Array.length > 0) {
+  | Some(logs) =>
+    log.warn(
+      ~comp="Upload_Claim",
+      `event log(s) ${logs->Array.join(", ")} declare storage-ref fields but publish through an ` ++
+      `SNS event topic, which the claimer does not subscribe to — objects those events reference ` ++
+      `keep the pending tag. Do not enable a store's expiry rule while this is true.`,
+    )
+    unreachable->Dict.set(plugin, [])
+  | _ => ()
+  }
+
+  switch registry->Dict.get(plugin) {
+  | None | Some([]) => ()
+  | Some(entries) =>
+    let name = plugin ++ "UploadClaim"
+    let stores = stores()
+
+    let lambdaRole = IAM.Role.makeWithDefaultPolicy(
+      ~name=name ++ "Role",
+      ~servicePrincipal=AWS.Lambda.principal->Pulumi.Output.make,
+      ~tags=AWS.Tags.make(
+        ~name=name ++ "Role",
+        ~kind=ReventlessCore.ComponentType.Plugin,
+        ~role=Identity,
+        ~component=name,
+      ),
+      ~opts,
+    )
+
+    // Read every registered stream; tag and untag under every declared store's
+    // served prefix, never a whole bucket. `GetObjectTagging` is what makes the
+    // untag a read-modify-write that preserves a deployment's own tags rather
+    // than a `DeleteObjectTagging` that would take them with it.
+    let _policy =
+      (entries->Array.map(e => e.streamArn)->Pulumi.Output.all, stores)
+      ->Pulumi.Output.all2
+      ->Pulumi.Output.apply(((streamArns, stores)) => {
+        open PolicyDocument
+        let objectArns =
+          stores->Array.map(s => `arn:aws:s3:::${s.bucketName}/${s.servedPrefix}/*`)
+        let _rolePolicy = IAM.RolePolicy.make(
+          ~name=name ++ "Policy",
+          ~args={
+            policy: PolicyDocument.make(
+              ~id=name ++ "Policy",
+              ~statements=[
+                {
+                  sid: "AllowLambdaLogging",
+                  effect: Allow,
+                  actions: Actions([
+                    "logs:CreateLogGroup",
+                    "logs:CreateLogStream",
+                    "logs:PutLogEvents",
+                  ]),
+                  resources: Resource("arn:aws:logs:*:*:*"),
+                },
+                {
+                  sid: "AllowReadEventLogStream",
+                  effect: Allow,
+                  actions: Actions([
+                    "dynamodb:DescribeStream",
+                    "dynamodb:GetRecords",
+                    "dynamodb:GetShardIterator",
+                    "dynamodb:ListStreams",
+                  ]),
+                  resources: Resources(streamArns),
+                },
+                {
+                  sid: "AllowClaimObjectTagging",
+                  effect: Allow,
+                  actions: Actions(["s3:GetObjectTagging", "s3:PutObjectTagging"]),
+                  resources: Resources(objectArns),
+                },
+              ],
+            )
+            ->PolicyDocument.toJsonString
+            ->Pulumi.Input.make,
+            role: lambdaRole.id->Pulumi.Output.asInput,
+          },
+          ~opts,
+        )
+      })
+
+    // `CLAIM_REF_FIELDS` — `{ <tableName>: { <eventType>: [refField] } }`. The
+    // whole of the handler's input: a table absent here is a table it reads no
+    // record from.
+    let refFieldsJson =
+      entries
+      ->Array.map(e => e.tableName)
+      ->Pulumi.Output.all
+      ->Pulumi.Output.apply(tableNames => {
+        let byTable = Dict.make()
+        tableNames->Array.forEachWithIndex((tableName, i) =>
+          byTable->Dict.set(
+            tableName,
+            ReventlessCore.StorageRefFields.toJson((entries->Array.getUnsafe(i)).refFields),
+          )
+        )
+        byTable->JSON.Encode.object->JSON.stringify
+      })
+
+    // `UPLOAD_STORES` — the same qualified-name → {bucket, prefix} shape the
+    // presign service reads, so mint and claim resolve a store identically.
+    let uploadStoresJson =
+      stores->Pulumi.Output.apply(stores =>
+        stores
+        ->Array.map(s => (
+          s.qualified,
+          Dict.fromArray([
+            ("bucket", JSON.Encode.string(s.bucketName)),
+            ("prefix", JSON.Encode.string(s.servedPrefix)),
+          ])->JSON.Encode.object,
+        ))
+        ->Dict.fromArray
+        ->JSON.Encode.object
+        ->JSON.stringify
+      )
+
+    // Compiled EntryPoint rather than a serialized closure, for the reason the
+    // presign service is one: the handler reaches the AWS SDK v3 S3 client, and
+    // a serialized closure bakes the deploy machine's SDK internals into an
+    // archive that then resolves its transitives from independently-versioned
+    // layer sources that disagree at cold start. The bundled `_Ops` module keeps
+    // bare `@aws-sdk/*` imports and resolves them through the resolve-hook, so
+    // one internally consistent SDK loads.
+    let packageDirs = Dict.fromArray([
+      (
+        "@reventlessdev/reventless-aws",
+        Util_Bundle.resolvePackageRoot("@reventlessdev/reventless-aws"),
+      ),
+    ])
+    let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(
+      ~entryPointModule="@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Claim_S3_Ops.res.mjs",
+      ~packageDirs,
+    )
+
+    let layers =
+      Lambda.reventlessLayerArn
+      ->Option.map(arn => [arn->Pulumi.Input.make])
+      ->Option.getOr([])
+      ->Pulumi.Input.make
+
+    let lambda = Lambda.Function.make(
+      ~name,
+      ~args={
+        handler: "index.handler"->Pulumi.Input.make,
+        runtime: "nodejs22.x"->Pulumi.Input.make,
+        code: code->Pulumi.Input.make,
+        sourceCodeHash: sourceCodeHash->Pulumi.Input.make,
+        role: lambdaRole.arn->Pulumi.Output.asInput,
+        memorySize: 256->Pulumi.Input.make,
+        timeout: 60->Pulumi.Input.make,
+        layers,
+        tags: AWS.Tags.make(
+          ~name,
+          ~kind=ReventlessCore.ComponentType.Plugin,
+          ~role=Runtime,
+          ~component=name,
+        ),
+        environment: (
+          {
+            Lambda.Function.variables: Dict.fromArray([
+              ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
+              ("UPLOAD_STORES", uploadStoresJson->Pulumi.Output.asInput),
+              ("CLAIM_REF_FIELDS", refFieldsJson->Pulumi.Output.asInput),
+              ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
+              ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
+            ]),
+          }: Lambda.Function.functionEnvironment
+        )->Pulumi.Input.make,
+      },
+      ~opts,
+    )
+
+    // One mapping per event log stream, all targeting the one Lambda.
+    // `maximumRetryAttempts` bounds a permanently failing record so it cannot
+    // wedge the shard — the default of -1 retries forever, which would turn one
+    // bad record into unbounded claim lag, which is the failure that deletes
+    // data. `bisectBatchOnFunctionError` isolates it across those retries.
+    entries->Array.forEachWithIndex((entry, i) => {
+      let esmName = `${name}Stream${i->Int.toString}`
+      let _esm = EventSourceMapping.make(
+        ~name=esmName,
+        ~args={
+          EventSourceMapping.functionName: lambda.arn->Pulumi.Output.asInput,
+          eventSourceArn: entry.streamArn->Pulumi.Output.asInput,
+          startingPosition: LATEST,
+          maximumRetryAttempts: 3,
+          bisectBatchOnFunctionError: true,
+          tags: AWS.Tags.make(
+            ~name=esmName,
+            ~kind=ReventlessCore.ComponentType.Plugin,
+            ~role=EventSourceMapping,
+            ~component=name,
+          ),
+        },
+        ~opts=Some(opts),
+      )
+    })
+
+    // How far behind the claimer is, alarmed rather than merely emitted.
+    // `IteratorAge` is the stream consumer's own lag and needs no custom metric;
+    // `treatMissingData: "notBreaching"` keeps a quiet platform — no events, so
+    // no data points — out of alarm.
+    let _alarm = Cloudwatch.MetricAlarm.make(
+      ~name=name ++ "Lag",
+      ~args={
+        comparisonOperator: "GreaterThanThreshold"->Pulumi.Input.make,
+        evaluationPeriods: 3->Pulumi.Input.make,
+        metricName: "IteratorAge"->Pulumi.Input.make,
+        namespace: "AWS/Lambda"->Pulumi.Input.make,
+        period: 300->Pulumi.Input.make,
+        statistic: "Maximum"->Pulumi.Input.make,
+        threshold: iteratorAgeAlarmMs->Pulumi.Input.make,
+        dimensions: lambda.name
+        ->Pulumi.Output.apply(fn => Dict.fromArray([("FunctionName", fn)]))
+        ->Pulumi.Output.asInput,
+        treatMissingData: "notBreaching"->Pulumi.Input.make,
+        alarmDescription: (`${name} is behind on committed events. While it is behind, objects an ` ++
+        `event already references still carry the pending tag — and a store with an expiry rule ` ++
+        `enabled will delete them.`)->Pulumi.Input.make,
+        tags: AWS.Tags.make(
+          ~name=name ++ "Lag",
+          ~kind=ReventlessCore.ComponentType.Plugin,
+          ~role=Other("Alarm"),
+          ~component=name,
+        ),
+      },
+      ~opts,
+    )
+
+    // Drain, so a second construction in the same process (tests, dev reload)
+    // starts from empty rather than re-registering every stream.
+    registry->Dict.set(plugin, [])
+  }
+}