@reventlessdev/reventless-aws 3.0.0-alpha.253 → 3.0.0-alpha.254

package/CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.254 (2026-08-02)
+
+### Features
+
+* **aws,core,doc:** environment-tiered CloudWatch log retention and levels ([8032023](https://github.com/ReventlessDev/reventless-core/commit/803202305a7d352484b8df5e58df03c92ca58b5f))
+* **aws,core,spec,seed-aws:** expire uploads nobody committed a reference to ([f63e84c](https://github.com/ReventlessDev/reventless-core/commit/f63e84c1a11cc350b799a6f69a2e7427cf1ea6e9))
+
+
 # 3.0.0-alpha.253 (2026-08-01)
 
 * feat(aws,core,spec)!: qualify store prefixes by plugin and refuse name collisions ([da39405](https://github.com/ReventlessDev/reventless-core/commit/da394059d9f8f981bf7adc79e2c1ce2b429e0267))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.253",
+  "version": "3.0.0-alpha.254",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -11,18 +11,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.0",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.1",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
     "@reventlessdev/rescript-node": "2.0.0-alpha.0",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.62",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.63",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.200",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.64",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.117",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.92",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.30"
+    "@reventlessdev/reventless-core": "3.0.0-alpha.201",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.118",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.65",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.93"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -157,6 +157,58 @@ module MakeWithConfig = (
     ->Pulumi.Config.get("stack")
     ->Option.map(stack => Pulumi.StackReference.make(stack))
 
+  // The declared object stores, as the upload claimer needs them: qualified
+  // name, physical bucket, served prefix.
+  //
+  // Stores are provisioned by the *platform* deploy; the claimer is wired into
+  // the *plugin* stack, because that is where the event log streams it reads
+  // exist. So the two halves meet here — across the stack reference in plugin
+  // mode, and through the platform's own in-process record when platform and
+  // plugin are one program.
+  //
+  // Read lazily (a thunk, not a value) for the monolithic case: `deployPlatform`
+  // fills `objectStoreEndpointsRef` as it provisions, and this is called during
+  // a later plugin build.
+  let claimStores = (): Pulumi.Output.t<array<Upload_Claim_S3.storeConfig>> =>
+    switch platformStackRef {
+    | Some(stackRef) =>
+      // The `objectStores` export: `{ "<plugin>.<store>": {bucketName, keyPrefix} }`.
+      // A platform that provisions none omits the export entirely, which reads
+      // as "no store to claim in" — the claimer then builds nothing, rather
+      // than building something that can reach nothing.
+      (stackRef->Pulumi.StackReference.getOutput("objectStores"): Pulumi.Output.t<option<JSON.t>>)
+      ->Pulumi.Output.apply(objectStores =>
+        objectStores
+        ->Option.flatMap(JSON.Decode.object)
+        ->Option.getOr(Dict.make())
+        ->Dict.toArray
+        ->Array.filterMap(((qualified, v)) =>
+          v
+          ->JSON.Decode.object
+          ->Option.flatMap(o =>
+            switch (
+              o->Dict.get("bucketName")->Option.flatMap(JSON.Decode.string),
+              o->Dict.get("keyPrefix")->Option.flatMap(JSON.Decode.string),
+            ) {
+            | (Some(bucketName), Some(servedPrefix)) =>
+              Some({Upload_Claim_S3.qualified: qualified, bucketName, servedPrefix})
+            | _ => None
+            }
+          )
+        )
+      )
+    | None =>
+      objectStoreEndpointsRef.contents
+      ->Array.map(e =>
+        e.bucketName->Pulumi.Output.apply(bucketName => {
+          Upload_Claim_S3.qualified: e.store,
+          bucketName,
+          servedPrefix: e.keyPrefix,
+        })
+      )
+      ->Pulumi.Output.all
+    }
+
   // ── Merged-mode source SDL assembly (merged-api plan, Phase 3) ────────────
   // Empty base fragment — no types, no mutations, no queries. Used by the
   // plugin Api in split mode (so plugin schema has no core fields) and as the
@@ -172,7 +224,7 @@ module MakeWithConfig = (
   // The upload service (route B) lives on the domain base, not the Admin-gated admin
   // base: `Upload_Presign`/`Upload_Release` take the domain API's default
   // `AllowAuthenticated` auth so any authenticated user can mint/release their own
-  // uploads. See [docs/plans/upload-release-path.md] § "Which API". (Split mode only —
+  // uploads. See [docs/plans/done/upload-release-path.md] § "Which API". (Split mode only —
   // unified mode carries the admin base here instead; it declares no stores in practice,
   // so the upload resolvers below are never created there.)
   let domainBaseFragment = ReventlessCore.GraphQL_Stitcher.encode({
@@ -763,7 +815,7 @@ module MakeWithConfig = (
     // Only active when the Events API resource exists (platform/monolithic mode).
     subscriptionInfraHook: ?domainEventsApiOpt->Option.map(eventsApi =>
       (params: ReventlessCore.Plugin_Helpers.subscriptionInfraParams) => {
-        let {allQueryDbs, allEventTopics, eventLogEntries, opts} = params
+        let {pluginName, allQueryDbs, allEventTopics, eventLogEntries, opts} = params
         let customOpts =
           opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
         // StateTopic Lambda per stream-enabled QueryDb — publishes row changes
@@ -799,19 +851,34 @@ module MakeWithConfig = (
           let isSns =
             EventTopicPublisher_SNS.snsRegistry->Set.has(entry.displayName) ||
             EventTopicPublisher_SNS.snsRegistry->Set.has(entry.busKey)
-          let eventTopicOutputs =
-            isSns
-              ? allEventTopics
-                ->Dict.get(entry.displayName)
-                ->Option.orElse(allEventTopics->Dict.get(entry.busKey))
-              : None
-          eventTopicOutputs->Option.forEach(outputs =>
-            EventLogSubscription_AppSync.make(
-              ~name=entry.displayName,
-              ~topicName=entry.displayName,
+          let topicOutputs =
+            allEventTopics
+            ->Dict.get(entry.displayName)
+            ->Option.orElse(allEventTopics->Dict.get(entry.busKey))
+          isSns
+            ? topicOutputs->Option.forEach(outputs =>
+                EventLogSubscription_AppSync.make(
+                  ~name=entry.displayName,
+                  ~topicName=entry.displayName,
+                  ~eventTopicOutputs=outputs,
+                  ~eventsApi,
+                  ~opts=customOpts,
+                )
+              )
+            : ()
+          // Register this event log with the upload claimer if — and only if —
+          // its events declare a `@storageRef` field. An event log that declares
+          // none is not registered, so a platform whose plugins declare no store
+          // provisions no claimer at all. `isSns` is the same synchronous answer
+          // the subscription above turns on, so the two cannot disagree about
+          // which channel an event log publishes through.
+          topicOutputs->Option.forEach(outputs =>
+            Upload_Claim_S3.make(
+              ~plugin=pluginName,
+              ~eventLogName=entry.displayName,
+              ~eventSchema=entry.eventSchema,
               ~eventTopicOutputs=outputs,
-              ~eventsApi,
-              ~opts=customOpts,
+              ~isStreamBacked=!isSns,
             )
           )
         })
@@ -822,6 +889,9 @@ module MakeWithConfig = (
         // empty because the hook hasn't run yet. Admin's hook fires synchronously,
         // but the call site is unified here so admin and plugins share one path.
         StateTopic_AppSync.finish(~eventsApi, ~opts={})
+        // Same timing constraint, same reason: the claimer's registry is filled
+        // by the loop just above and drained here.
+        Upload_Claim_S3.finish(~plugin=pluginName, ~stores=claimStores, ~opts=customOpts)
       }
     ),
   }
@@ -1063,12 +1133,15 @@ module MakeWithConfig = (
     // omitted (byte-identical config.json).
     geocoderPlaceIndex?: ReventlessInfra.Platform.geocoderIndex,
     // Optional object store for direct-to-S3 uploads, as returned by
-    // `Capability_ObjectStore_S3.make`. When set, the deploy provisions the
-    // presign service (Upload_Presign_S3) against it, threads that service's URL
-    // into config.json as `uploadEndpoint`, and fronts the store read-only on
-    // the host-shell CloudFront distribution under the presign service's own
-    // prefix (a `{prefix}/*` ordered cache behavior + origin + scoped
-    // BucketPolicy, private, OAC-read).
+    // `Capability_ObjectStore_S3.make`. When set, the deploy registers it with
+    // the platform's one Upload service (`Upload_Presign_S3`) under the `uploads`
+    // store key, and fronts the store read-only on the host-shell CloudFront
+    // distribution under that prefix (a `{prefix}/*` ordered cache behavior +
+    // origin + scoped BucketPolicy, private, OAC-read).
+    //
+    // No endpoint is written into config.json: under route B a caller mints
+    // through the domain API's `Upload_Presign` mutation, naming the store, so
+    // there is no per-store URL to publish or to resolve.
     //
     // One field replaces the former `enableUploads` / `uploadBucketName` /
     // `servedBuckets` trio, which were three ways of saying one thing and left
@@ -1584,6 +1657,46 @@ module MakeWithConfig = (
     // policy and one CDN origin however many stores live in it.
     let storeBuckets: Dict.t<ReventlessInfra.Platform.objectStore> = Dict.make()
     let storeBucketOrder: array<string> = []
+
+    // Which stores expire their never-claimed uploads, grouped by the bucket
+    // they live in. Computed before any bucket is created, because a bucket
+    // carries its lifecycle rules from birth and a shared-layout bucket is
+    // created once for several stores — the first store through the loop below
+    // would otherwise be the only one whose setting was ever read.
+    //
+    // Off unless a deployment names the store. See `Util_StoreLayout.pendingExpiryFor`
+    // for why this is a deployment's setting and not a declaration's, and why
+    // there is deliberately no default.
+    let pendingExpiryConfig = Util_LocalConfig.get("pendingUploadExpiryDays")
+    let pendingExpiryByBucket: Dict.t<array<Capability_ObjectStore_S3.pendingExpiry>> = Dict.make()
+    declaredStores->Array.forEach(((plugin, store)) =>
+      Util_StoreLayout.pendingExpiryFor(
+        ~config=pendingExpiryConfig,
+        ~store=`${plugin}.${store}`,
+      )->Option.forEach(days => {
+        let bucketName = Util_StoreLayout.bucketNameFor(
+          ~layout=storeLayout,
+          ~stack=stackName,
+          ~plugin,
+          ~store,
+        )
+        let prefix = Util_StoreLayout.keyPrefixFor(~plugin, ~store)
+        pendingExpiryByBucket->Dict.set(
+          bucketName,
+          pendingExpiryByBucket
+          ->Dict.get(bucketName)
+          ->Option.getOr([])
+          ->Array.concat([{Capability_ObjectStore_S3.prefix, days}]),
+        )
+        log.info(
+          ~comp="Platform:deployPlatform",
+          `object store ${plugin}.${store}: never-claimed uploads under ${prefix}/ expire after ` ++
+          `${days->Int.toString} days. Claimed objects and objects minted before the claim ` ++
+          `component existed carry no pending tag and are outside the rule.`,
+        )
+      })
+    )
+
     let declaredStoreServices = declaredStores->Array.map(((plugin, store)) => {
       let bucketName = Util_StoreLayout.bucketNameFor(
         ~layout=storeLayout,
@@ -1608,6 +1721,7 @@ module MakeWithConfig = (
           // disposable stack would leak exactly the buckets sharing exists to
           // save. The two settings are opposite faces of one decision.
           ~forceDestroy=storeProtection == Unprotected,
+          ~expirePending=pendingExpiryByBucket->Dict.get(bucketName)->Option.getOr([]),
         )
         storeBuckets->Dict.set(bucketName, b)
         storeBucketOrder->Array.push(bucketName)

package/src/Platform.res.mjs

@@ -35,6 +35,7 @@ import * as EventLogBackend$ReventlessAws from "./adapter/EventLog/EventLogBacke
 import * as Platform_Admin$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_Admin.res.mjs";
 import * as PluginBehavior$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginBehavior.res.mjs";
 import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
+import * as Upload_Claim_S3$ReventlessAws from "./adapter/Upload/Upload_Claim_S3.res.mjs";
 import * as PgProjectionFeed$ReventlessAws from "./adapter/Postgres/PgProjectionFeed.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "./util/Util_LocalConfig.res.mjs";
 import * as Util_StoreLayout$ReventlessAws from "./util/Util_StoreLayout.res.mjs";
@@ -156,6 +157,30 @@ function MakeWithConfig(Config) {
     contents: "Domain"
   };
   let platformStackRef = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
+  let claimStores = () => {
+    if (platformStackRef !== undefined) {
+      return Primitive_option.valFromOption(platformStackRef).getOutput("objectStores").apply(objectStores => Stdlib_Array.filterMap(Object.entries(Stdlib_Option.getOr(Stdlib_Option.flatMap(objectStores, Stdlib_JSON.Decode.object), {})), param => {
+        let qualified = param[0];
+        return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(param[1]), o => {
+          let match = Stdlib_Option.flatMap(o["bucketName"], Stdlib_JSON.Decode.string);
+          let match$1 = Stdlib_Option.flatMap(o["keyPrefix"], Stdlib_JSON.Decode.string);
+          if (match !== undefined && match$1 !== undefined) {
+            return {
+              qualified: qualified,
+              bucketName: match,
+              servedPrefix: match$1
+            };
+          }
+        });
+      }));
+    } else {
+      return Pulumi.all(objectStoreEndpointsRef.contents.map(e => e.bucketName.apply(bucketName => ({
+        qualified: e.store,
+        bucketName: bucketName,
+        servedPrefix: e.keyPrefix
+      }))));
+    }
+  };
   let domainBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
     types: Platform_AdminApi$ReventlessCore.uploadTypes,
     mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields,
@@ -457,6 +482,7 @@ function MakeWithConfig(Config) {
   let hooks_subscriptionInfraHook = Stdlib_Option.map(domainEventsApiOpt, eventsApi => (params => {
     let allEventTopics = params.allEventTopics;
     let allQueryDbs = params.allQueryDbs;
+    let pluginName = params.pluginName;
     let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(params.opts);
     Stdlib_Dict.forEachWithKey(allQueryDbs, (_queryDbOutputs, readModelName) => {
       if (!QueryDbStorage_DynamoDbStream$ReventlessAws.streamRegistry.has(readModelName)) {
@@ -467,10 +493,14 @@ function MakeWithConfig(Config) {
     });
     params.eventLogEntries.forEach(entry => {
       let isSns = EventTopicPublisher_SNS$ReventlessAws.snsRegistry.has(entry.displayName) || EventTopicPublisher_SNS$ReventlessAws.snsRegistry.has(entry.busKey);
-      let eventTopicOutputs = isSns ? Stdlib_Option.orElse(allEventTopics[entry.displayName], allEventTopics[entry.busKey]) : undefined;
-      Stdlib_Option.forEach(eventTopicOutputs, outputs => EventLogSubscription_AppSync$ReventlessAws.make(entry.displayName, entry.displayName, outputs, eventsApi, customOpts));
+      let topicOutputs = Stdlib_Option.orElse(allEventTopics[entry.displayName], allEventTopics[entry.busKey]);
+      if (isSns) {
+        Stdlib_Option.forEach(topicOutputs, outputs => EventLogSubscription_AppSync$ReventlessAws.make(entry.displayName, entry.displayName, outputs, eventsApi, customOpts));
+      }
+      Stdlib_Option.forEach(topicOutputs, outputs => Upload_Claim_S3$ReventlessAws.make(pluginName, entry.displayName, entry.eventSchema, outputs, !isSns));
     });
     StateTopic_AppSync$ReventlessAws.finish(eventsApi, {});
+    Upload_Claim_S3$ReventlessAws.finish(pluginName, claimStores, undefined, customOpts);
   }));
   let hooks_preResolversSchemaHook = (name, version, pluginFragment) => {
     let sdl = AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(pluginFragment);
@@ -925,6 +955,21 @@ function MakeWithConfig(Config) {
     }
     let storeBuckets = {};
     let storeBucketOrder = [];
+    let pendingExpiryConfig = Util_LocalConfig$ReventlessAws.get("pendingUploadExpiryDays");
+    let pendingExpiryByBucket = {};
+    declaredStores.forEach(param => {
+      let store = param[1];
+      let plugin = param[0];
+      Stdlib_Option.forEach(Util_StoreLayout$ReventlessAws.pendingExpiryFor(pendingExpiryConfig, plugin + `.` + store), days => {
+        let bucketName = Util_StoreLayout$ReventlessAws.bucketNameFor(storeLayout, stackName, plugin, store);
+        let prefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(plugin, store);
+        pendingExpiryByBucket[bucketName] = Stdlib_Option.getOr(pendingExpiryByBucket[bucketName], []).concat([{
+            prefix: prefix,
+            days: days
+          }]);
+        log.info("Platform:deployPlatform", undefined, `object store ` + plugin + `.` + store + `: never-claimed uploads under ` + prefix + `/ expire after ` + (days.toString() + ` days. Claimed objects and objects minted before the claim `) + `component existed carry no pending tag and are outside the rule.`);
+      });
+    });
     let declaredStoreServices = declaredStores.map(param => {
       let store = param[1];
       let plugin = param[0];
@@ -937,7 +982,7 @@ function MakeWithConfig(Config) {
       } else {
         let tmp;
         tmp = storeLayout === "PerStore" ? plugin : undefined;
-        let b$1 = Capability_ObjectStore_S3$ReventlessAws.make(bucketName, keyPrefix, tmp, storeProtection === "Protected", storeProtection === "Unprotected", undefined, undefined);
+        let b$1 = Capability_ObjectStore_S3$ReventlessAws.make(bucketName, keyPrefix, tmp, storeProtection === "Protected", storeProtection === "Unprotected", Stdlib_Option.getOr(pendingExpiryByBucket[bucketName], []), undefined, undefined);
         storeBuckets[bucketName] = b$1;
         storeBucketOrder.push(bucketName);
         bucket = b$1;
@@ -1324,6 +1369,30 @@ function Make($star) {
     contents: "Domain"
   };
   let platformStackRef = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
+  let claimStores = () => {
+    if (platformStackRef !== undefined) {
+      return Primitive_option.valFromOption(platformStackRef).getOutput("objectStores").apply(objectStores => Stdlib_Array.filterMap(Object.entries(Stdlib_Option.getOr(Stdlib_Option.flatMap(objectStores, Stdlib_JSON.Decode.object), {})), param => {
+        let qualified = param[0];
+        return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(param[1]), o => {
+          let match = Stdlib_Option.flatMap(o["bucketName"], Stdlib_JSON.Decode.string);
+          let match$1 = Stdlib_Option.flatMap(o["keyPrefix"], Stdlib_JSON.Decode.string);
+          if (match !== undefined && match$1 !== undefined) {
+            return {
+              qualified: qualified,
+              bucketName: match,
+              servedPrefix: match$1
+            };
+          }
+        });
+      }));
+    } else {
+      return Pulumi.all(objectStoreEndpointsRef.contents.map(e => e.bucketName.apply(bucketName => ({
+        qualified: e.store,
+        bucketName: bucketName,
+        servedPrefix: e.keyPrefix
+      }))));
+    }
+  };
   let domainBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
     types: Platform_AdminApi$ReventlessCore.uploadTypes,
     mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields,
@@ -1625,6 +1694,7 @@ function Make($star) {
   let hooks_subscriptionInfraHook = Stdlib_Option.map(domainEventsApiOpt, eventsApi => (params => {
     let allEventTopics = params.allEventTopics;
     let allQueryDbs = params.allQueryDbs;
+    let pluginName = params.pluginName;
     let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(params.opts);
     Stdlib_Dict.forEachWithKey(allQueryDbs, (_queryDbOutputs, readModelName) => {
       if (!QueryDbStorage_DynamoDbStream$ReventlessAws.streamRegistry.has(readModelName)) {
@@ -1635,10 +1705,14 @@ function Make($star) {
     });
     params.eventLogEntries.forEach(entry => {
       let isSns = EventTopicPublisher_SNS$ReventlessAws.snsRegistry.has(entry.displayName) || EventTopicPublisher_SNS$ReventlessAws.snsRegistry.has(entry.busKey);
-      let eventTopicOutputs = isSns ? Stdlib_Option.orElse(allEventTopics[entry.displayName], allEventTopics[entry.busKey]) : undefined;
-      Stdlib_Option.forEach(eventTopicOutputs, outputs => EventLogSubscription_AppSync$ReventlessAws.make(entry.displayName, entry.displayName, outputs, eventsApi, customOpts));
+      let topicOutputs = Stdlib_Option.orElse(allEventTopics[entry.displayName], allEventTopics[entry.busKey]);
+      if (isSns) {
+        Stdlib_Option.forEach(topicOutputs, outputs => EventLogSubscription_AppSync$ReventlessAws.make(entry.displayName, entry.displayName, outputs, eventsApi, customOpts));
+      }
+      Stdlib_Option.forEach(topicOutputs, outputs => Upload_Claim_S3$ReventlessAws.make(pluginName, entry.displayName, entry.eventSchema, outputs, !isSns));
     });
     StateTopic_AppSync$ReventlessAws.finish(eventsApi, {});
+    Upload_Claim_S3$ReventlessAws.finish(pluginName, claimStores, undefined, customOpts);
   }));
   let hooks_preResolversSchemaHook = (name, version, pluginFragment) => {
     let sdl = AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(pluginFragment);
@@ -2070,6 +2144,21 @@ function Make($star) {
     }
     let storeBuckets = {};
     let storeBucketOrder = [];
+    let pendingExpiryConfig = Util_LocalConfig$ReventlessAws.get("pendingUploadExpiryDays");
+    let pendingExpiryByBucket = {};
+    declaredStores.forEach(param => {
+      let store = param[1];
+      let plugin = param[0];
+      Stdlib_Option.forEach(Util_StoreLayout$ReventlessAws.pendingExpiryFor(pendingExpiryConfig, plugin + `.` + store), days => {
+        let bucketName = Util_StoreLayout$ReventlessAws.bucketNameFor(storeLayout, stackName, plugin, store);
+        let prefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(plugin, store);
+        pendingExpiryByBucket[bucketName] = Stdlib_Option.getOr(pendingExpiryByBucket[bucketName], []).concat([{
+            prefix: prefix,
+            days: days
+          }]);
+        log.info("Platform:deployPlatform", undefined, `object store ` + plugin + `.` + store + `: never-claimed uploads under ` + prefix + `/ expire after ` + (days.toString() + ` days. Claimed objects and objects minted before the claim `) + `component existed carry no pending tag and are outside the rule.`);
+      });
+    });
     let declaredStoreServices = declaredStores.map(param => {
       let store = param[1];
       let plugin = param[0];
@@ -2082,7 +2171,7 @@ function Make($star) {
       } else {
         let tmp;
         tmp = storeLayout === "PerStore" ? plugin : undefined;
-        let b$1 = Capability_ObjectStore_S3$ReventlessAws.make(bucketName, keyPrefix, tmp, storeProtection === "Protected", storeProtection === "Unprotected", undefined, undefined);
+        let b$1 = Capability_ObjectStore_S3$ReventlessAws.make(bucketName, keyPrefix, tmp, storeProtection === "Protected", storeProtection === "Unprotected", Stdlib_Option.getOr(pendingExpiryByBucket[bucketName], []), undefined, undefined);
         storeBuckets[bucketName] = b$1;
         storeBucketOrder.push(bucketName);
         bucket = b$1;

package/src/adapter/Runtime/AggregateRuntime_Builder_Single.res

@@ -298,6 +298,11 @@ let finish = () =>
             }
           })
         )
+        // First-class log-level override → LOG_LEVEL, winning over any generic
+        // envVars entry. When unset, makeFromCodeAsset applies the tier default.
+        cfg.logLevel->Option.forEach(level =>
+          envVars->Dict.set("LOG_LEVEL", level->Pulumi.Output.make->Pulumi.Output.asInput)
+        )
 
         // Build AssetArchive: static re-export + user packages
         let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(

package/src/adapter/Runtime/AggregateRuntime_Builder_Single.res.mjs

@@ -197,6 +197,9 @@ function finish() {
           return;
         }
       }));
+      Stdlib_Option.forEach(cfg.logLevel, level => {
+        envVars["LOG_LEVEL"] = Pulumi.output(level);
+      });
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
       Stdlib_Option.forEach(cfg.sqsBatchSize, CommandTopicChannel_SQS_Sync$ReventlessAws.setBatchSize);
       let vpcConfig = pgSelection !== undefined ? pgSelection.securityGroupId.apply(sgId => ({

package/src/adapter/Runtime/AggregateRuntime_Builder_Single_Async.res

@@ -276,6 +276,11 @@ let finish = () =>
             }
           })
         )
+        // First-class log-level override → LOG_LEVEL, winning over any generic
+        // envVars entry. When unset, makeFromCodeAsset applies the tier default.
+        cfg.logLevel->Option.forEach(level =>
+          envVars->Dict.set("LOG_LEVEL", level->Pulumi.Output.make->Pulumi.Output.asInput)
+        )
 
         // Build AssetArchive: static re-export + user packages
         let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(

package/src/adapter/Runtime/AggregateRuntime_Builder_Single_Async.res.mjs

@@ -186,6 +186,9 @@ function finish() {
           return;
         }
       }));
+      Stdlib_Option.forEach(cfg.logLevel, level => {
+        envVars["LOG_LEVEL"] = Pulumi.output(level);
+      });
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
       Stdlib_Option.forEach(cfg.sqsBatchSize, CommandTopicChannel_SQS_Async$ReventlessAws.setBatchSize);
       let vpcConfig = pgSelection !== undefined ? pgSelection.securityGroupId.apply(sgId => ({

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -115,7 +115,9 @@ let makeFromCodeAsset: (
   ~logRetentionDays: int=?,
   /** Provision the DCB append-retry/conflict CloudWatch metric filters on this
       Lambda's log group (command-handler Lambdas only). Requires a managed log
-      group, so it only takes effect when `~logRetentionDays` is also set. */
+      group, so it only takes effect when one is created — i.e. when
+      `~logRetentionDays` is set or the stack tier manages its groups
+      (`Util_LogRetention.managesLogGroup`). */
   ~dcbMetrics: bool=?,
   /** Place the Lambda in a VPC (needed to reach RDS/managed Postgres). When set,
       the execution role also gets the EC2 network-interface permissions AWS
@@ -143,6 +145,18 @@ let makeFromCodeAsset: (
   let opts =
     opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
 
+  // The environment tier drives retention, default log level and whether the log
+  // group is Pulumi-managed. Resolved once from the stack name and the shared
+  // prod allow-list (the same notion of "production" that names the host-shell
+  // domain and the store layout).
+  let stack = Pulumi.Pulumi.getStackName()
+  let prodStacks = Util_HostUiDomain.resolveProdStacks()
+  // Stacks explicitly held on auto-created log groups pending a `pulumi import`
+  // (none today — the escape hatch for adopting a pre-existing stack later).
+  let unmanagedStacks = Util_LogRetention.parseUnmanagedStacks(
+    Util_LocalConfig.get("unmanagedLogGroupStacks")->Option.getOr(""),
+  )
+
   // One attribution identity for every resource provisioned here: same owning
   // component and kind throughout, distinct piece roles — the function itself,
   // the execution identity it assumes, and its log group are three pieces of one
@@ -219,9 +233,7 @@ let makeFromCodeAsset: (
     ->Option.getOr([])
     ->Pulumi.Input.make
 
-  let variables = Dict.fromArray([
-    ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
-  ])
+  let variables = Dict.fromArray([("Environment", stack->Pulumi.Input.make)])
   envVars->Dict.forEachWithKey((value, key) => {
     variables->Dict.set(key, value)
   })
@@ -229,6 +241,21 @@ let makeFromCodeAsset: (
     variables->Dict.set(key, value)
   })
 
+  // Default the logger's minimum level per environment tier when nothing already
+  // pinned one (caller `envVars` or a consumer-registered `additionalEnvVars`
+  // win). Verbose on disposable dev stacks, quiet on prod/beta — for every
+  // Lambda, not just the command handlers.
+  if variables->Dict.get("LOG_LEVEL")->Option.isNone {
+    variables->Dict.set(
+      "LOG_LEVEL",
+      Util_LogRetention.logLevelFor(
+        ~stack,
+        ~prodStacks,
+        ~configOverride=?Util_LocalConfig.get("logLevel"),
+      )->Pulumi.Input.make,
+    )
+  }
+
   // ESM self-containment (Option C): every code archive built by
   // Util_Bundle.buildCodeArchive ships register-hook.mjs + layer-resolver.mjs at
   // /var/task. --import registers the resolve hook so the ESM entry point (and the
@@ -263,13 +290,44 @@ let makeFromCodeAsset: (
     ~opts?,
   )
 
-  // Optional CloudWatch log-group with explicit retention. When not set, Lambda
-  // auto-creates a log group with no retention (logs accumulate indefinitely).
-  logRetentionDays->Option.forEach(days => {
+  // Managed CloudWatch log-group with explicit retention. Created when the caller
+  // pins `~logRetentionDays` (the app-developer opt-in) OR the stack manages its
+  // groups — every stack by default, bar any named in `unmanagedLogGroupStacks`
+  // (see `Util_LogRetention.managesLogGroup`). When neither holds, Lambda
+  // auto-creates an unmanaged group with no retention.
+  //
+  // Precedence for the retention value: explicit `~logRetentionDays` → the
+  // `logRetentionDays` config key → the environment tier default.
+  //
+  // The group name derives from the function's *physical* name output, not the
+  // logical `name`. `Lambda.Function` has no `name` arg, so its physical name
+  // always carries Pulumi's `-<7hex>` suffix; a literal `/aws/lambda/${name}`
+  // would create an empty group beside the real one, leave orphan accumulation
+  // unchanged, and collide across stacks sharing an account.
+  let managedRetention = switch (
+    logRetentionDays,
+    Util_LogRetention.managesLogGroup(~stack, ~unmanagedStacks),
+  ) {
+  | (Some(days), _) => Some(days)
+  | (None, true) =>
+    Some(
+      Util_LogRetention.retentionDaysFor(
+        ~stack,
+        ~prodStacks,
+        ~configOverride=?Util_LocalConfig.get("logRetentionDays")->Option.flatMap(s =>
+          Int.fromString(s)
+        ),
+      ),
+    )
+  | (None, false) => None
+  }
+  managedRetention->Option.forEach(days => {
     let logGroup = Cloudwatch.LogGroup.make(
       ~name=`${name}LogGroup`,
       ~args={
-        name: `/aws/lambda/${name}`->Pulumi.Input.make,
+        name: lambda.name
+        ->Pulumi.Output.apply(n => `/aws/lambda/${n}`)
+        ->Pulumi.Output.asInput,
         retentionInDays: days->Pulumi.Input.make,
         tags: tagsFor(~resourceName=`${name}LogGroup`, ~role=Logs),
       },