@reventlessdev/reventless-aws 3.0.0-alpha.252 → 3.0.0-alpha.254

package/src/util/Util_LogRetention.res

@@ -0,0 +1,86 @@
+// How long a stack keeps its logs, and how verbose they are — tiered by
+// environment, the same way `Util_StoreLayout` tiers bucket layout and
+// `Util_HostUiDomain` tiers the host-shell FQDN. Pure functions so both
+// decisions are decidable and unit-testable without touching Pulumi.
+//
+// Retention and level pull in opposite directions between prod and dev, which is
+// the whole reason a single global setting cannot serve both:
+//
+//   prod  — quiet (`info`) and long-lived (365d): incident + forensic window
+//   dev   — loud  (`debug`) and short-lived (3–7d): consumed within hours
+//
+// The `prodStacks` allow-list is `Util_HostUiDomain.resolveProdStacks` — the one
+// notion of "is this stack production" the platform already shares for domain
+// naming and store layout, on purpose. A `configOverride` (from the Pulumi
+// `logRetentionDays` / `logLevel` config keys) wins over the tier default so a
+// stack can be dialled without a code change.
+
+// CloudWatch only accepts a fixed enum of retention values; every number below is
+// a member of it. `0` means "never expire" and is a valid explicit opt-in, but
+// never a tier default — hot CloudWatch storage billed forever is what this
+// tiering exists to bound.
+
+/** Retention in days for a stack. prod/main = 365, beta = 30, `pr-*` = 3,
+    everything else (alpha and any unlisted stack) = 7. A `configOverride` wins. */
+let retentionDaysFor = (
+  ~stack: string,
+  ~prodStacks: array<string>,
+  ~configOverride: option<int>=?,
+): int =>
+  switch configOverride {
+  | Some(days) => days
+  | None =>
+    switch stack {
+    | s if prodStacks->Array.includes(s) => 365
+    | "beta" => 30
+    | s if s->String.startsWith("pr-") => 3
+    | _ => 7
+    }
+  }
+
+/** The default `LOG_LEVEL` for a stack. prod/main and beta stay at `info` so
+    pre-prod behaves like prod and debug detail never leaks payloads in prod;
+    every other stack defaults to `debug` for verbose feedback during active
+    development (paired with short retention, so cheap). A `configOverride`
+    wins. */
+let logLevelFor = (
+  ~stack: string,
+  ~prodStacks: array<string>,
+  ~configOverride: option<string>=?,
+): string =>
+  switch configOverride {
+  | Some(level) => level
+  | None =>
+    switch stack {
+    | s if prodStacks->Array.includes(s) => "info"
+    | "beta" => "info"
+    | _ => "debug"
+    }
+  }
+
+/**
+Whether the framework creates a *managed* CloudWatch log group for this stack, or
+leaves Lambda/AppSync to auto-create an unmanaged one.
+
+**Managed for every stack by default.** A stack deployed on this framework gets
+its log groups from Pulumi on the first `pulumi up`, before Lambda/AppSync would
+lazily auto-create them — so on a fresh stack there is nothing to adopt and no
+`ResourceAlreadyExists` hazard. Every current stack is `alpha`, and there is no
+prod stack to migrate, so extending management to all stacks costs nothing today.
+
+The one case that still needs care is *adopting* a stack that predates managed
+groups: it already carries Lambda's auto-created group, and `CreateLogGroup`
+fails with `ResourceAlreadyExists` rather than adopting it. When such a stack
+ever appears, either `pulumi import` its groups first, or name it in the
+`unmanagedLogGroupStacks` config key to keep it on auto-created groups until the
+import is done. That escape hatch is the "prepared for the future" seam — turning
+a prod adoption into a config flip rather than an edit to this function.
+*/
+let managesLogGroup = (~stack: string, ~unmanagedStacks: array<string>=[]): bool =>
+  !(unmanagedStacks->Array.includes(stack))
+
+/** Parse the `unmanagedLogGroupStacks` config value — a CSV of stack names kept
+    on auto-created groups pending a `pulumi import`. Same tolerant parse as the
+    prod-stacks list: trims, drops empty entries. */
+let parseUnmanagedStacks = (csv: string): array<string> =>
+  csv->String.split(",")->Array.map(String.trim)->Array.filter(s => s !== "")

package/src/util/Util_LogRetention.res.mjs

@@ -0,0 +1,43 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+
+function retentionDaysFor(stack, prodStacks, configOverride) {
+  if (configOverride !== undefined) {
+    return configOverride;
+  } else if (prodStacks.includes(stack)) {
+    return 365;
+  } else if (stack === "beta") {
+    return 30;
+  } else if (stack.startsWith("pr-")) {
+    return 3;
+  } else {
+    return 7;
+  }
+}
+
+function logLevelFor(stack, prodStacks, configOverride) {
+  if (configOverride !== undefined) {
+    return configOverride;
+  } else if (prodStacks.includes(stack) || stack === "beta") {
+    return "info";
+  } else {
+    return "debug";
+  }
+}
+
+function managesLogGroup(stack, unmanagedStacksOpt) {
+  let unmanagedStacks = unmanagedStacksOpt !== undefined ? unmanagedStacksOpt : [];
+  return !unmanagedStacks.includes(stack);
+}
+
+function parseUnmanagedStacks(csv) {
+  return csv.split(",").map(prim => prim.trim()).filter(s => s !== "");
+}
+
+export {
+  retentionDaysFor,
+  logLevelFor,
+  managesLogGroup,
+  parseUnmanagedStacks,
+}
+/* No side effect */

package/src/util/Util_StoreLayout.res

@@ -109,20 +109,36 @@ let bucketNameFor = (~layout: t, ~stack: string, ~plugin: string, ~store: string
   }
 
 /**
-The prefix a store's object keys are rooted at — the store name, in **both**
+The prefix a store's object keys are rooted at — `{plugin}/{store}`, in **both**
 layouts.
 
-This is the property that keeps the two layouts one model rather than a fork.
-The presign service mints `{store}/{identity}{uuid}/{file}` either way, so the
-stored ref is `/{store}/…` regardless of which bucket sits behind it, and only
-the CDN origin differs. Refs live in an append-only event log: one that encoded
-its bucket layout would be environment-specific and unrewritable, so a prod dump
-restored into a PR stack would carry refs that cannot resolve.
+Layout-invariance is what keeps the two layouts one model rather than a fork.
+The presign service mints `{prefix}/{identity}/{uuid}/{file}` either way, so the
+stored ref is `/{prefix}/…` regardless of which bucket sits behind it, and only
+the CDN origin differs. Refs live in an append-only event log: a prefix that
+encoded its bucket layout would be environment-specific and unrewritable, so a
+prod dump restored into a PR stack would carry refs that cannot resolve. Plugin
+and store are stack-invariant, so qualifying by plugin costs none of that.
+
+Qualified because the prefix is a **platform-global** namespace: one distribution
+fronts every store bucket and takes one cache behavior per prefix, so a bare
+store name made two plugins declaring `productImages` unroutable — in either
+layout, since the per-store layout still lands both prefixes on the one
+distribution. Qualifying narrows uniqueness from "per platform" to "per plugin",
+which is what plugin isolation wants and what a platform composing plugins it
+did not author needs.
 
 The cost is a slightly redundant prefix inside a dedicated bucket
-(`catalog-productImages/productImages/…`). Take the redundancy.
+(`catalog-productImages/Catalog/productImages/…`). Take the redundancy.
+
+**Changing this string is breaking.** Minted refs are `/{prefix}/…` in an
+append-only event log, so objects written under an earlier prefix become
+unreachable and their refs unresolvable. There is deliberately no grandfathering
+machinery: a stack that predates a change to this function empties its stores
+(`seed:reset`, which wipes per plugin) and re-seeds. Carrying a permanent prefix
+set to spare a disposable stack one wipe is the worse trade.
 */
-let keyPrefixFor = (~store: string): string => store
+let keyPrefixFor = (~plugin: string, ~store: string): string => `${plugin}/${store}`
 
 /**
 Who serves the declared stores — and the answer is never "both".
@@ -173,3 +189,40 @@ let coverageFor = (~required: array<string>, ~provisioned: array<string>): cover
   | (missing, provisioned) => Missing({missing, provisioned})
   }
 }
+
+/**
+After how many days a store expires objects still tagged pending — `None`, which
+is the default, meaning it expires nothing.
+
+The setting is a deployment's, not a declaration's: `@storageRef("productImages")`
+says a store is needed, and says nothing about how long an unclaimed upload
+should live there. Read from the `pendingUploadExpiryDays` config key (env var
+`REVENTLESS_PENDING_UPLOAD_EXPIRY_DAYS`, or the `Pulumi.local.yaml` sidecar) as a
+comma-separated list of `{plugin}.{store}=days` pairs:
+
+    pendingUploadExpiryDays: "Catalog.productImages=30, Ordering.receipts=14"
+
+**Per store and off by default, on purpose.** Enabling this is the one step in
+the mechanism that deletes data, and it is only sound once the claim component
+has been live long enough for reconciliation to confirm that the objects still
+tagged pending really are the unreferenced ones. A global switch — or a default
+value — would turn it on for stores nobody had checked yet, which is the whole
+failure this sequencing exists to prevent. A store that accumulates forever is a
+legitimate choice, and stays the choice until a deployment says otherwise.
+
+Only positive whole days are accepted. A malformed or non-positive entry is
+ignored rather than rounded or defaulted: guessing at what a typo meant, in the
+one setting that deletes objects, is not a service.
+*/
+let pendingExpiryFor = (~config: option<string>, ~store: string): option<int> =>
+  config
+  ->Option.getOr("")
+  ->String.split(",")
+  ->Array.filterMap(entry =>
+    switch entry->String.split("=") {
+    | [name, days] if name->String.trim == store =>
+      days->String.trim->Int.fromString->Option.filter(d => d > 0)
+    | _ => None
+    }
+  )
+  ->Array.get(0)

package/src/util/Util_StoreLayout.res.mjs

@@ -1,5 +1,8 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
+import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
+import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
 
 let defaultEphemeralPrefixes = ["pr-"];
 
@@ -28,8 +31,8 @@ function bucketNameFor(layout, stack, plugin, store) {
   }
 }
 
-function keyPrefixFor(store) {
-  return store;
+function keyPrefixFor(plugin, store) {
+  return plugin + `/` + store;
 }
 
 function servingFor(hasHostUiBundle, declaredBucketCount) {
@@ -64,6 +67,20 @@ function coverageFor(required, provisioned) {
   }
 }
 
+function pendingExpiryFor(config, store) {
+  return Stdlib_Array.filterMap(Stdlib_Option.getOr(config, "").split(","), entry => {
+      let match = entry.split("=");
+      if (match.length !== 2) {
+        return;
+      }
+      let name = match[0];
+      let days = match[1];
+      if (name.trim() === store) {
+        return Stdlib_Option.filter(Stdlib_Int.fromString(days.trim(), undefined), d => d > 0);
+      }
+    })[0];
+}
+
 export {
   defaultEphemeralPrefixes,
   layoutFor,
@@ -72,5 +89,6 @@ export {
   keyPrefixFor,
   servingFor,
   coverageFor,
+  pendingExpiryFor,
 }
 /* No side effect */

package/tests/Upload_ClaimTest.res

@@ -0,0 +1,132 @@
+// The claim component's pure decisions — no S3, no DynamoDB stream.
+//
+// Everything between "a committed event appeared" and "an S3 untag happens" is
+// decided by three functions in `Upload_Claim_S3_Ops`: which table a record came
+// from, which refs a declared field holds, and whether a ref resolves to an
+// object this claimer may touch. The untag itself has no branching left in it,
+// so pinning these pins the behaviour that matters.
+//
+// The direction under test throughout is refusal. An untag this component
+// wrongly *skips* costs a delayed cleanup; one it wrongly *performs* removes the
+// only thing standing between an object and an expiry rule.
+
+open JestGlobals
+
+module Ops = Upload_Claim_S3_Ops
+
+// `stores` and `refFieldsByTable` are read from the environment at module load,
+// so these tests exercise the decision functions against explicitly-built
+// inputs rather than a configured module — which is also the honest scope: the
+// env parsing is `JSON.parse` plus field reads.
+
+describe("Upload_Claim_S3_Ops.tableNameFromEventSourceArn", () => {
+  testSync("reads the table name out of a stream ARN", () =>
+    expect(
+      Ops.tableNameFromEventSourceArn(
+        "arn:aws:dynamodb:eu-west-1:123456789012:table/CatalogDcbEventLog-a1b2c3/stream/2026-08-02T00:00:00.000",
+      ),
+    )->toEqual(Some("CatalogDcbEventLog-a1b2c3"))
+  )
+
+  testSync("returns None for an ARN that is not a table stream", () =>
+    expect(Ops.tableNameFromEventSourceArn("arn:aws:sqs:eu-west-1:123456789012:SomeQueue"))->toEqual(
+      None,
+    )
+  )
+})
+
+describe("Upload_Claim_S3_Ops.keyOfRef", () => {
+  testSync("strips the leading slash the mint side writes", () =>
+    expect(Ops.keyOfRef("/Catalog/productImages/sub/uuid/p.png"))->toBe(
+      "Catalog/productImages/sub/uuid/p.png",
+    )
+  )
+
+  testSync("leaves an already-bare key alone", () =>
+    expect(Ops.keyOfRef("Catalog/productImages/sub/uuid/p.png"))->toBe(
+      "Catalog/productImages/sub/uuid/p.png",
+    )
+  )
+})
+
+describe("Upload_Claim_S3_Ops.refsOfField", () => {
+  let single: Ops.refField = {field: "imageUrl", many: false, store: "Catalog.productImages"}
+  let multi: Ops.refField = {field: "imageUrls", many: true, store: "Catalog.productImages"}
+  let ref1 = "/Catalog/productImages/sub/one/p.png"
+  let ref2 = "/Catalog/productImages/sub/two/q.png"
+
+  testSync("reads one ref from a string field", () =>
+    expect(
+      Ops.refsOfField(~data=Dict.fromArray([("imageUrl", JSON.Encode.string(ref1))]), single),
+    )->toEqual([ref1])
+  )
+
+  testSync("reads every ref from an array field", () =>
+    expect(
+      Ops.refsOfField(
+        ~data=Dict.fromArray([
+          ("imageUrls", JSON.Encode.array([JSON.Encode.string(ref1), JSON.Encode.string(ref2)])),
+        ]),
+        multi,
+      ),
+    )->toEqual([ref1, ref2])
+  )
+
+  // `StorageRef` admits "" as the "no object" sentinel, so a present-but-empty
+  // field must cost no S3 call rather than resolving to the store's root.
+  testSync("ignores the empty-string sentinel", () =>
+    expect(
+      Ops.refsOfField(~data=Dict.fromArray([("imageUrl", JSON.Encode.string(""))]), single),
+    )->toEqual([])
+  )
+
+  testSync("ignores an absent field", () =>
+    expect(Ops.refsOfField(~data=Dict.make(), single))->toEqual([])
+  )
+
+  // Arity is declared, not sniffed: a field declared single that arrives as an
+  // array (or the reverse) is a schema and a deploy disagreeing, and reading it
+  // anyway would mean guessing which one is right.
+  testSync("a single-arity field ignores an array value", () =>
+    expect(
+      Ops.refsOfField(
+        ~data=Dict.fromArray([("imageUrl", JSON.Encode.array([JSON.Encode.string(ref1)]))]),
+        single,
+      ),
+    )->toEqual([])
+  )
+
+  testSync("a multi-arity field ignores a bare string value", () =>
+    expect(
+      Ops.refsOfField(~data=Dict.fromArray([("imageUrls", JSON.Encode.string(ref1))]), multi),
+    )->toEqual([])
+  )
+
+  testSync("ignores non-string elements of an array field", () =>
+    expect(
+      Ops.refsOfField(
+        ~data=Dict.fromArray([
+          ("imageUrls", JSON.Encode.array([JSON.Encode.string(ref1), JSON.Encode.int(7)])),
+        ]),
+        multi,
+      ),
+    )->toEqual([ref1])
+  )
+})
+
+describe("Upload_Claim_S3_Ops.claim", () => {
+  // The tag key is the contract between three separately-deployed things: the
+  // presigned PUT that writes it, this component that removes it, and the
+  // lifecycle rule that expires what still carries it. A drift in any one of
+  // them is silent — a rule filtered on a key nobody writes matches nothing, and
+  // a claimer stripping the wrong key leaves every object tagged.
+  testSync("removes the same tag the mint side writes", () =>
+    expect(Upload_PendingTag.key)->toBe("reventless:pending")
+  )
+
+  // The presigned URL carries `Tagging` as a URL-encoded query string, so the
+  // colon has to survive one decode by S3 to land as the key above.
+  testSync("the presign tagging parameter decodes to that key and value", () =>
+    expect(Upload_PendingTag.putObjectTagging)->toBe("reventless%3Apending=true")
+  )
+})

package/tests/Upload_ClaimTest.res.mjs

@@ -0,0 +1,101 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Upload_PendingTag$ReventlessAws from "../src/adapter/Upload/Upload_PendingTag.res.mjs";
+import * as Upload_Claim_S3_Ops$ReventlessAws from "../src/adapter/Upload/Upload_Claim_S3_Ops.res.mjs";
+
+globalThis.describe("Upload_Claim_S3_Ops.tableNameFromEventSourceArn", () => {
+  globalThis.test("reads the table name out of a stream ARN", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.tableNameFromEventSourceArn("arn:aws:dynamodb:eu-west-1:123456789012:table/CatalogDcbEventLog-a1b2c3/stream/2026-08-02T00:00:00.000")).toEqual("CatalogDcbEventLog-a1b2c3");
+  });
+  globalThis.test("returns None for an ARN that is not a table stream", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.tableNameFromEventSourceArn("arn:aws:sqs:eu-west-1:123456789012:SomeQueue")).toEqual(undefined);
+  });
+});
+
+globalThis.describe("Upload_Claim_S3_Ops.keyOfRef", () => {
+  globalThis.test("strips the leading slash the mint side writes", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.keyOfRef("/Catalog/productImages/sub/uuid/p.png")).toBe("Catalog/productImages/sub/uuid/p.png");
+  });
+  globalThis.test("leaves an already-bare key alone", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.keyOfRef("Catalog/productImages/sub/uuid/p.png")).toBe("Catalog/productImages/sub/uuid/p.png");
+  });
+});
+
+globalThis.describe("Upload_Claim_S3_Ops.refsOfField", () => {
+  let single = {
+    field: "imageUrl",
+    many: false,
+    store: "Catalog.productImages"
+  };
+  let multi = {
+    field: "imageUrls",
+    many: true,
+    store: "Catalog.productImages"
+  };
+  let ref1 = "/Catalog/productImages/sub/one/p.png";
+  let ref2 = "/Catalog/productImages/sub/two/q.png";
+  globalThis.test("reads one ref from a string field", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrl",
+        ref1
+      ]]), single)).toEqual([ref1]);
+  });
+  globalThis.test("reads every ref from an array field", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrls",
+        [
+          ref1,
+          ref2
+        ]
+      ]]), multi)).toEqual([
+      ref1,
+      ref2
+    ]);
+  });
+  globalThis.test("ignores the empty-string sentinel", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrl",
+        ""
+      ]]), single)).toEqual([]);
+  });
+  globalThis.test("ignores an absent field", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField({}, single)).toEqual([]);
+  });
+  globalThis.test("a single-arity field ignores an array value", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrl",
+        [ref1]
+      ]]), single)).toEqual([]);
+  });
+  globalThis.test("a multi-arity field ignores a bare string value", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrls",
+        ref1
+      ]]), multi)).toEqual([]);
+  });
+  globalThis.test("ignores non-string elements of an array field", () => {
+    globalThis.expect(Upload_Claim_S3_Ops$ReventlessAws.refsOfField(Object.fromEntries([[
+        "imageUrls",
+        [
+          ref1,
+          7
+        ]
+      ]]), multi)).toEqual([ref1]);
+  });
+});
+
+globalThis.describe("Upload_Claim_S3_Ops.claim", () => {
+  globalThis.test("removes the same tag the mint side writes", () => {
+    globalThis.expect(Upload_PendingTag$ReventlessAws.key).toBe("reventless:pending");
+  });
+  globalThis.test("the presign tagging parameter decodes to that key and value", () => {
+    globalThis.expect(Upload_PendingTag$ReventlessAws.putObjectTagging).toBe("reventless%3Apending=true");
+  });
+});
+
+let Ops;
+
+export {
+  Ops,
+}
+/*  Not a pure module */

package/tests/Util_LogRetentionTest.res

@@ -0,0 +1,122 @@
+open JestGlobals
+
+let prodStacks = Util_HostUiDomain.defaultProdStacks
+
+describe("Util_LogRetention.retentionDaysFor", () => {
+  testSync("prod keeps logs a year", () =>
+    expect(Util_LogRetention.retentionDaysFor(~stack="prod", ~prodStacks))->toBe(365)
+  )
+
+  testSync("'main' is production too, by the shared prod list", () =>
+    expect(Util_LogRetention.retentionDaysFor(~stack="main", ~prodStacks))->toBe(365)
+  )
+
+  testSync("beta keeps a month of pre-prod history", () =>
+    expect(Util_LogRetention.retentionDaysFor(~stack="beta", ~prodStacks))->toBe(30)
+  )
+
+  testSync("a PR stack keeps the minimum — torn down quickly", () =>
+    expect(Util_LogRetention.retentionDaysFor(~stack="pr-1234", ~prodStacks))->toBe(3)
+  )
+
+  testSync("alpha keeps a week — active development, consumed within hours", () =>
+    expect(Util_LogRetention.retentionDaysFor(~stack="alpha", ~prodStacks))->toBe(7)
+  )
+
+  // Same fail-open as the store-layout allow-list: an unlisted production name
+  // silently gets the dev tier. Asserted so it is a decision on record and the
+  // config override is the documented fix.
+  testSync("an unlisted stack falls open to the dev tier", () =>
+    expect(Util_LogRetention.retentionDaysFor(~stack="production", ~prodStacks))->toBe(7)
+  )
+
+  testSync("adding it to the prod list is the fix", () =>
+    expect(
+      Util_LogRetention.retentionDaysFor(~stack="production", ~prodStacks=["prod", "production"]),
+    )->toBe(365)
+  )
+
+  // The config key is the escape hatch — a stack dialled without a code change,
+  // including `0` (never expire) as an explicit opt-in.
+  testSync("a config override wins over the tier default", () =>
+    expect(Util_LogRetention.retentionDaysFor(~stack="alpha", ~prodStacks, ~configOverride=14))->toBe(14)
+  )
+
+  testSync("0 = never expire is expressible via the override", () =>
+    expect(Util_LogRetention.retentionDaysFor(~stack="prod", ~prodStacks, ~configOverride=0))->toBe(0)
+  )
+})
+
+describe("Util_LogRetention.logLevelFor", () => {
+  // Retention and level pull in opposite directions: prod is long-lived AND
+  // quiet; the dev stacks are short-lived AND loud.
+  testSync("prod is quiet — info, no debug noise or payload leakage", () =>
+    expect(Util_LogRetention.logLevelFor(~stack="prod", ~prodStacks))->toBe("info")
+  )
+
+  testSync("beta mirrors prod so pre-prod behaves like prod", () =>
+    expect(Util_LogRetention.logLevelFor(~stack="beta", ~prodStacks))->toBe("info")
+  )
+
+  testSync("alpha is verbose — debug feedback during active development", () =>
+    expect(Util_LogRetention.logLevelFor(~stack="alpha", ~prodStacks))->toBe("debug")
+  )
+
+  testSync("a PR stack is verbose too", () =>
+    expect(Util_LogRetention.logLevelFor(~stack="pr-7", ~prodStacks))->toBe("debug")
+  )
+
+  testSync("a config override wins over the tier default", () =>
+    expect(
+      Util_LogRetention.logLevelFor(~stack="prod", ~prodStacks, ~configOverride="debug"),
+    )->toBe("debug")
+  )
+})
+
+describe("Util_LogRetention.managesLogGroup", () => {
+  // Managed for every stack by default — a stack deployed on this framework gets
+  // its groups from Pulumi before Lambda/AppSync would auto-create them, so a
+  // fresh stack has nothing to adopt.
+  testSync("alpha is managed", () =>
+    expect(Util_LogRetention.managesLogGroup(~stack="alpha"))->toBe(true)
+  )
+
+  testSync("a PR stack is managed", () =>
+    expect(Util_LogRetention.managesLogGroup(~stack="pr-42"))->toBe(true)
+  )
+
+  testSync("prod is managed too — a fresh prod stack has no group to adopt", () =>
+    expect(Util_LogRetention.managesLogGroup(~stack="prod"))->toBe(true)
+  )
+
+  testSync("beta is managed too", () =>
+    expect(Util_LogRetention.managesLogGroup(~stack="beta"))->toBe(true)
+  )
+
+  // The escape hatch: a stack pending a `pulumi import` stays on auto-created
+  // groups until the import is done — a config flip, not a code change.
+  testSync("a stack named in unmanagedLogGroupStacks is left auto-created", () =>
+    expect(
+      Util_LogRetention.managesLogGroup(~stack="legacy-prod", ~unmanagedStacks=["legacy-prod"]),
+    )->toBe(false)
+  )
+
+  testSync("only the named stacks are excluded — others stay managed", () =>
+    expect(
+      Util_LogRetention.managesLogGroup(~stack="alpha", ~unmanagedStacks=["legacy-prod"]),
+    )->toBe(true)
+  )
+})
+
+describe("Util_LogRetention.parseUnmanagedStacks", () => {
+  testSync("empty config manages every stack", () =>
+    expect(Util_LogRetention.parseUnmanagedStacks(""))->toEqual([])
+  )
+
+  testSync("CSV is trimmed and empty entries dropped", () =>
+    expect(Util_LogRetention.parseUnmanagedStacks(" legacy-prod , , old-beta "))->toEqual([
+      "legacy-prod",
+      "old-beta",
+    ])
+  )
+})