@reventlessdev/reventless-aws 3.0.0-alpha.253 → 3.0.0-alpha.255

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.255 (2026-08-02)
+
+### Bug Fixes
+
+* **aws:** apply tier LOG_LEVEL + managed log groups to bespoke Lambda builders ([8814627](https://github.com/ReventlessDev/reventless-core/commit/8814627a200199616f407f4011d4e0b0e1895397))
+
+
+# 3.0.0-alpha.254 (2026-08-02)
+
+### Features
+
+* **aws,core,doc:** environment-tiered CloudWatch log retention and levels ([8032023](https://github.com/ReventlessDev/reventless-core/commit/803202305a7d352484b8df5e58df03c92ca58b5f))
+* **aws,core,spec,seed-aws:** expire uploads nobody committed a reference to ([f63e84c](https://github.com/ReventlessDev/reventless-core/commit/f63e84c1a11cc350b799a6f69a2e7427cf1ea6e9))
+
+
 # 3.0.0-alpha.253 (2026-08-01)
 
 * feat(aws,core,spec)!: qualify store prefixes by plugin and refuse name collisions ([da39405](https://github.com/ReventlessDev/reventless-core/commit/da394059d9f8f981bf7adc79e2c1ce2b429e0267))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.253",
+  "version": "3.0.0-alpha.255",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -11,18 +11,18 @@
     "@aws-sdk/s3-request-presigner": "3.970.0",
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
-    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.0",
+    "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.1",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.0",
     "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
-    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.62",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.0",
+    "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.63",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.200",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.64",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.117",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.92",
-    "@reventlessdev/reventless-interop": "3.0.0-alpha.30"
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.201",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.118",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.65",
+    "@reventlessdev/reventless-interop": "3.0.0-alpha.30",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.93"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -157,6 +157,58 @@ module MakeWithConfig = (
     ->Pulumi.Config.get("stack")
     ->Option.map(stack => Pulumi.StackReference.make(stack))
 
+  // The declared object stores, as the upload claimer needs them: qualified
+  // name, physical bucket, served prefix.
+  //
+  // Stores are provisioned by the *platform* deploy; the claimer is wired into
+  // the *plugin* stack, because that is where the event log streams it reads
+  // exist. So the two halves meet here — across the stack reference in plugin
+  // mode, and through the platform's own in-process record when platform and
+  // plugin are one program.
+  //
+  // Read lazily (a thunk, not a value) for the monolithic case: `deployPlatform`
+  // fills `objectStoreEndpointsRef` as it provisions, and this is called during
+  // a later plugin build.
+  let claimStores = (): Pulumi.Output.t<array<Upload_Claim_S3.storeConfig>> =>
+    switch platformStackRef {
+    | Some(stackRef) =>
+      // The `objectStores` export: `{ "<plugin>.<store>": {bucketName, keyPrefix} }`.
+      // A platform that provisions none omits the export entirely, which reads
+      // as "no store to claim in" — the claimer then builds nothing, rather
+      // than building something that can reach nothing.
+      (stackRef->Pulumi.StackReference.getOutput("objectStores"): Pulumi.Output.t<option<JSON.t>>)
+      ->Pulumi.Output.apply(objectStores =>
+        objectStores
+        ->Option.flatMap(JSON.Decode.object)
+        ->Option.getOr(Dict.make())
+        ->Dict.toArray
+        ->Array.filterMap(((qualified, v)) =>
+          v
+          ->JSON.Decode.object
+          ->Option.flatMap(o =>
+            switch (
+              o->Dict.get("bucketName")->Option.flatMap(JSON.Decode.string),
+              o->Dict.get("keyPrefix")->Option.flatMap(JSON.Decode.string),
+            ) {
+            | (Some(bucketName), Some(servedPrefix)) =>
+              Some({Upload_Claim_S3.qualified: qualified, bucketName, servedPrefix})
+            | _ => None
+            }
+          )
+        )
+      )
+    | None =>
+      objectStoreEndpointsRef.contents
+      ->Array.map(e =>
+        e.bucketName->Pulumi.Output.apply(bucketName => {
+          Upload_Claim_S3.qualified: e.store,
+          bucketName,
+          servedPrefix: e.keyPrefix,
+        })
+      )
+      ->Pulumi.Output.all
+    }
+
   // ── Merged-mode source SDL assembly (merged-api plan, Phase 3) ────────────
   // Empty base fragment — no types, no mutations, no queries. Used by the
   // plugin Api in split mode (so plugin schema has no core fields) and as the
@@ -172,7 +224,7 @@ module MakeWithConfig = (
   // The upload service (route B) lives on the domain base, not the Admin-gated admin
   // base: `Upload_Presign`/`Upload_Release` take the domain API's default
   // `AllowAuthenticated` auth so any authenticated user can mint/release their own
-  // uploads. See [docs/plans/upload-release-path.md] § "Which API". (Split mode only —
+  // uploads. See [docs/plans/done/upload-release-path.md] § "Which API". (Split mode only —
   // unified mode carries the admin base here instead; it declares no stores in practice,
   // so the upload resolvers below are never created there.)
   let domainBaseFragment = ReventlessCore.GraphQL_Stitcher.encode({
@@ -763,7 +815,7 @@ module MakeWithConfig = (
     // Only active when the Events API resource exists (platform/monolithic mode).
     subscriptionInfraHook: ?domainEventsApiOpt->Option.map(eventsApi =>
       (params: ReventlessCore.Plugin_Helpers.subscriptionInfraParams) => {
-        let {allQueryDbs, allEventTopics, eventLogEntries, opts} = params
+        let {pluginName, allQueryDbs, allEventTopics, eventLogEntries, opts} = params
         let customOpts =
           opts->ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions
         // StateTopic Lambda per stream-enabled QueryDb — publishes row changes
@@ -799,19 +851,34 @@ module MakeWithConfig = (
           let isSns =
             EventTopicPublisher_SNS.snsRegistry->Set.has(entry.displayName) ||
             EventTopicPublisher_SNS.snsRegistry->Set.has(entry.busKey)
-          let eventTopicOutputs =
-            isSns
-              ? allEventTopics
-                ->Dict.get(entry.displayName)
-                ->Option.orElse(allEventTopics->Dict.get(entry.busKey))
-              : None
-          eventTopicOutputs->Option.forEach(outputs =>
-            EventLogSubscription_AppSync.make(
-              ~name=entry.displayName,
-              ~topicName=entry.displayName,
+          let topicOutputs =
+            allEventTopics
+            ->Dict.get(entry.displayName)
+            ->Option.orElse(allEventTopics->Dict.get(entry.busKey))
+          isSns
+            ? topicOutputs->Option.forEach(outputs =>
+                EventLogSubscription_AppSync.make(
+                  ~name=entry.displayName,
+                  ~topicName=entry.displayName,
+                  ~eventTopicOutputs=outputs,
+                  ~eventsApi,
+                  ~opts=customOpts,
+                )
+              )
+            : ()
+          // Register this event log with the upload claimer if — and only if —
+          // its events declare a `@storageRef` field. An event log that declares
+          // none is not registered, so a platform whose plugins declare no store
+          // provisions no claimer at all. `isSns` is the same synchronous answer
+          // the subscription above turns on, so the two cannot disagree about
+          // which channel an event log publishes through.
+          topicOutputs->Option.forEach(outputs =>
+            Upload_Claim_S3.make(
+              ~plugin=pluginName,
+              ~eventLogName=entry.displayName,
+              ~eventSchema=entry.eventSchema,
               ~eventTopicOutputs=outputs,
-              ~eventsApi,
-              ~opts=customOpts,
+              ~isStreamBacked=!isSns,
             )
           )
         })
@@ -822,6 +889,9 @@ module MakeWithConfig = (
         // empty because the hook hasn't run yet. Admin's hook fires synchronously,
         // but the call site is unified here so admin and plugins share one path.
         StateTopic_AppSync.finish(~eventsApi, ~opts={})
+        // Same timing constraint, same reason: the claimer's registry is filled
+        // by the loop just above and drained here.
+        Upload_Claim_S3.finish(~plugin=pluginName, ~stores=claimStores, ~opts=customOpts)
       }
     ),
   }
@@ -1063,12 +1133,15 @@ module MakeWithConfig = (
     // omitted (byte-identical config.json).
     geocoderPlaceIndex?: ReventlessInfra.Platform.geocoderIndex,
     // Optional object store for direct-to-S3 uploads, as returned by
-    // `Capability_ObjectStore_S3.make`. When set, the deploy provisions the
-    // presign service (Upload_Presign_S3) against it, threads that service's URL
-    // into config.json as `uploadEndpoint`, and fronts the store read-only on
-    // the host-shell CloudFront distribution under the presign service's own
-    // prefix (a `{prefix}/*` ordered cache behavior + origin + scoped
-    // BucketPolicy, private, OAC-read).
+    // `Capability_ObjectStore_S3.make`. When set, the deploy registers it with
+    // the platform's one Upload service (`Upload_Presign_S3`) under the `uploads`
+    // store key, and fronts the store read-only on the host-shell CloudFront
+    // distribution under that prefix (a `{prefix}/*` ordered cache behavior +
+    // origin + scoped BucketPolicy, private, OAC-read).
+    //
+    // No endpoint is written into config.json: under route B a caller mints
+    // through the domain API's `Upload_Presign` mutation, naming the store, so
+    // there is no per-store URL to publish or to resolve.
     //
     // One field replaces the former `enableUploads` / `uploadBucketName` /
     // `servedBuckets` trio, which were three ways of saying one thing and left
@@ -1584,6 +1657,46 @@ module MakeWithConfig = (
     // policy and one CDN origin however many stores live in it.
     let storeBuckets: Dict.t<ReventlessInfra.Platform.objectStore> = Dict.make()
     let storeBucketOrder: array<string> = []
+
+    // Which stores expire their never-claimed uploads, grouped by the bucket
+    // they live in. Computed before any bucket is created, because a bucket
+    // carries its lifecycle rules from birth and a shared-layout bucket is
+    // created once for several stores — the first store through the loop below
+    // would otherwise be the only one whose setting was ever read.
+    //
+    // Off unless a deployment names the store. See `Util_StoreLayout.pendingExpiryFor`
+    // for why this is a deployment's setting and not a declaration's, and why
+    // there is deliberately no default.
+    let pendingExpiryConfig = Util_LocalConfig.get("pendingUploadExpiryDays")
+    let pendingExpiryByBucket: Dict.t<array<Capability_ObjectStore_S3.pendingExpiry>> = Dict.make()
+    declaredStores->Array.forEach(((plugin, store)) =>
+      Util_StoreLayout.pendingExpiryFor(
+        ~config=pendingExpiryConfig,
+        ~store=`${plugin}.${store}`,
+      )->Option.forEach(days => {
+        let bucketName = Util_StoreLayout.bucketNameFor(
+          ~layout=storeLayout,
+          ~stack=stackName,
+          ~plugin,
+          ~store,
+        )
+        let prefix = Util_StoreLayout.keyPrefixFor(~plugin, ~store)
+        pendingExpiryByBucket->Dict.set(
+          bucketName,
+          pendingExpiryByBucket
+          ->Dict.get(bucketName)
+          ->Option.getOr([])
+          ->Array.concat([{Capability_ObjectStore_S3.prefix, days}]),
+        )
+        log.info(
+          ~comp="Platform:deployPlatform",
+          `object store ${plugin}.${store}: never-claimed uploads under ${prefix}/ expire after ` ++
+          `${days->Int.toString} days. Claimed objects and objects minted before the claim ` ++
+          `component existed carry no pending tag and are outside the rule.`,
+        )
+      })
+    )
+
     let declaredStoreServices = declaredStores->Array.map(((plugin, store)) => {
       let bucketName = Util_StoreLayout.bucketNameFor(
         ~layout=storeLayout,
@@ -1608,6 +1721,7 @@ module MakeWithConfig = (
           // disposable stack would leak exactly the buckets sharing exists to
           // save. The two settings are opposite faces of one decision.
           ~forceDestroy=storeProtection == Unprotected,
+          ~expirePending=pendingExpiryByBucket->Dict.get(bucketName)->Option.getOr([]),
         )
         storeBuckets->Dict.set(bucketName, b)
         storeBucketOrder->Array.push(bucketName)

package/src/Platform.res.mjs

@@ -35,6 +35,7 @@ import * as EventLogBackend$ReventlessAws from "./adapter/EventLog/EventLogBacke
 import * as Platform_Admin$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_Admin.res.mjs";
 import * as PluginBehavior$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/lifecycle/PluginBehavior.res.mjs";
 import * as Plugin_Helpers$ReventlessCore from "@reventlessdev/reventless-core/src/plugin/component/Plugin_Helpers.res.mjs";
+import * as Upload_Claim_S3$ReventlessAws from "./adapter/Upload/Upload_Claim_S3.res.mjs";
 import * as PgProjectionFeed$ReventlessAws from "./adapter/Postgres/PgProjectionFeed.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "./util/Util_LocalConfig.res.mjs";
 import * as Util_StoreLayout$ReventlessAws from "./util/Util_StoreLayout.res.mjs";
@@ -156,6 +157,30 @@ function MakeWithConfig(Config) {
     contents: "Domain"
   };
   let platformStackRef = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
+  let claimStores = () => {
+    if (platformStackRef !== undefined) {
+      return Primitive_option.valFromOption(platformStackRef).getOutput("objectStores").apply(objectStores => Stdlib_Array.filterMap(Object.entries(Stdlib_Option.getOr(Stdlib_Option.flatMap(objectStores, Stdlib_JSON.Decode.object), {})), param => {
+        let qualified = param[0];
+        return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(param[1]), o => {
+          let match = Stdlib_Option.flatMap(o["bucketName"], Stdlib_JSON.Decode.string);
+          let match$1 = Stdlib_Option.flatMap(o["keyPrefix"], Stdlib_JSON.Decode.string);
+          if (match !== undefined && match$1 !== undefined) {
+            return {
+              qualified: qualified,
+              bucketName: match,
+              servedPrefix: match$1
+            };
+          }
+        });
+      }));
+    } else {
+      return Pulumi.all(objectStoreEndpointsRef.contents.map(e => e.bucketName.apply(bucketName => ({
+        qualified: e.store,
+        bucketName: bucketName,
+        servedPrefix: e.keyPrefix
+      }))));
+    }
+  };
   let domainBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
     types: Platform_AdminApi$ReventlessCore.uploadTypes,
     mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields,
@@ -457,6 +482,7 @@ function MakeWithConfig(Config) {
   let hooks_subscriptionInfraHook = Stdlib_Option.map(domainEventsApiOpt, eventsApi => (params => {
     let allEventTopics = params.allEventTopics;
     let allQueryDbs = params.allQueryDbs;
+    let pluginName = params.pluginName;
     let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(params.opts);
     Stdlib_Dict.forEachWithKey(allQueryDbs, (_queryDbOutputs, readModelName) => {
       if (!QueryDbStorage_DynamoDbStream$ReventlessAws.streamRegistry.has(readModelName)) {
@@ -467,10 +493,14 @@ function MakeWithConfig(Config) {
     });
     params.eventLogEntries.forEach(entry => {
       let isSns = EventTopicPublisher_SNS$ReventlessAws.snsRegistry.has(entry.displayName) || EventTopicPublisher_SNS$ReventlessAws.snsRegistry.has(entry.busKey);
-      let eventTopicOutputs = isSns ? Stdlib_Option.orElse(allEventTopics[entry.displayName], allEventTopics[entry.busKey]) : undefined;
-      Stdlib_Option.forEach(eventTopicOutputs, outputs => EventLogSubscription_AppSync$ReventlessAws.make(entry.displayName, entry.displayName, outputs, eventsApi, customOpts));
+      let topicOutputs = Stdlib_Option.orElse(allEventTopics[entry.displayName], allEventTopics[entry.busKey]);
+      if (isSns) {
+        Stdlib_Option.forEach(topicOutputs, outputs => EventLogSubscription_AppSync$ReventlessAws.make(entry.displayName, entry.displayName, outputs, eventsApi, customOpts));
+      }
+      Stdlib_Option.forEach(topicOutputs, outputs => Upload_Claim_S3$ReventlessAws.make(pluginName, entry.displayName, entry.eventSchema, outputs, !isSns));
     });
     StateTopic_AppSync$ReventlessAws.finish(eventsApi, {});
+    Upload_Claim_S3$ReventlessAws.finish(pluginName, claimStores, undefined, customOpts);
   }));
   let hooks_preResolversSchemaHook = (name, version, pluginFragment) => {
     let sdl = AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(pluginFragment);
@@ -925,6 +955,21 @@ function MakeWithConfig(Config) {
     }
     let storeBuckets = {};
     let storeBucketOrder = [];
+    let pendingExpiryConfig = Util_LocalConfig$ReventlessAws.get("pendingUploadExpiryDays");
+    let pendingExpiryByBucket = {};
+    declaredStores.forEach(param => {
+      let store = param[1];
+      let plugin = param[0];
+      Stdlib_Option.forEach(Util_StoreLayout$ReventlessAws.pendingExpiryFor(pendingExpiryConfig, plugin + `.` + store), days => {
+        let bucketName = Util_StoreLayout$ReventlessAws.bucketNameFor(storeLayout, stackName, plugin, store);
+        let prefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(plugin, store);
+        pendingExpiryByBucket[bucketName] = Stdlib_Option.getOr(pendingExpiryByBucket[bucketName], []).concat([{
+            prefix: prefix,
+            days: days
+          }]);
+        log.info("Platform:deployPlatform", undefined, `object store ` + plugin + `.` + store + `: never-claimed uploads under ` + prefix + `/ expire after ` + (days.toString() + ` days. Claimed objects and objects minted before the claim `) + `component existed carry no pending tag and are outside the rule.`);
+      });
+    });
     let declaredStoreServices = declaredStores.map(param => {
       let store = param[1];
       let plugin = param[0];
@@ -937,7 +982,7 @@ function MakeWithConfig(Config) {
       } else {
         let tmp;
         tmp = storeLayout === "PerStore" ? plugin : undefined;
-        let b$1 = Capability_ObjectStore_S3$ReventlessAws.make(bucketName, keyPrefix, tmp, storeProtection === "Protected", storeProtection === "Unprotected", undefined, undefined);
+        let b$1 = Capability_ObjectStore_S3$ReventlessAws.make(bucketName, keyPrefix, tmp, storeProtection === "Protected", storeProtection === "Unprotected", Stdlib_Option.getOr(pendingExpiryByBucket[bucketName], []), undefined, undefined);
         storeBuckets[bucketName] = b$1;
         storeBucketOrder.push(bucketName);
         bucket = b$1;
@@ -1324,6 +1369,30 @@ function Make($star) {
     contents: "Domain"
   };
   let platformStackRef = Stdlib_Option.map(new Pulumi.Config("platform").get("stack"), stack => new Pulumi.StackReference(stack));
+  let claimStores = () => {
+    if (platformStackRef !== undefined) {
+      return Primitive_option.valFromOption(platformStackRef).getOutput("objectStores").apply(objectStores => Stdlib_Array.filterMap(Object.entries(Stdlib_Option.getOr(Stdlib_Option.flatMap(objectStores, Stdlib_JSON.Decode.object), {})), param => {
+        let qualified = param[0];
+        return Stdlib_Option.flatMap(Stdlib_JSON.Decode.object(param[1]), o => {
+          let match = Stdlib_Option.flatMap(o["bucketName"], Stdlib_JSON.Decode.string);
+          let match$1 = Stdlib_Option.flatMap(o["keyPrefix"], Stdlib_JSON.Decode.string);
+          if (match !== undefined && match$1 !== undefined) {
+            return {
+              qualified: qualified,
+              bucketName: match,
+              servedPrefix: match$1
+            };
+          }
+        });
+      }));
+    } else {
+      return Pulumi.all(objectStoreEndpointsRef.contents.map(e => e.bucketName.apply(bucketName => ({
+        qualified: e.store,
+        bucketName: bucketName,
+        servedPrefix: e.keyPrefix
+      }))));
+    }
+  };
   let domainBaseFragment = GraphQL_Stitcher$ReventlessCore.encode({
     types: Platform_AdminApi$ReventlessCore.uploadTypes,
     mutations: Platform_AdminApi$ReventlessCore.uploadMutationFields,
@@ -1625,6 +1694,7 @@ function Make($star) {
   let hooks_subscriptionInfraHook = Stdlib_Option.map(domainEventsApiOpt, eventsApi => (params => {
     let allEventTopics = params.allEventTopics;
     let allQueryDbs = params.allQueryDbs;
+    let pluginName = params.pluginName;
     let customOpts = Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions(params.opts);
     Stdlib_Dict.forEachWithKey(allQueryDbs, (_queryDbOutputs, readModelName) => {
       if (!QueryDbStorage_DynamoDbStream$ReventlessAws.streamRegistry.has(readModelName)) {
@@ -1635,10 +1705,14 @@ function Make($star) {
     });
     params.eventLogEntries.forEach(entry => {
       let isSns = EventTopicPublisher_SNS$ReventlessAws.snsRegistry.has(entry.displayName) || EventTopicPublisher_SNS$ReventlessAws.snsRegistry.has(entry.busKey);
-      let eventTopicOutputs = isSns ? Stdlib_Option.orElse(allEventTopics[entry.displayName], allEventTopics[entry.busKey]) : undefined;
-      Stdlib_Option.forEach(eventTopicOutputs, outputs => EventLogSubscription_AppSync$ReventlessAws.make(entry.displayName, entry.displayName, outputs, eventsApi, customOpts));
+      let topicOutputs = Stdlib_Option.orElse(allEventTopics[entry.displayName], allEventTopics[entry.busKey]);
+      if (isSns) {
+        Stdlib_Option.forEach(topicOutputs, outputs => EventLogSubscription_AppSync$ReventlessAws.make(entry.displayName, entry.displayName, outputs, eventsApi, customOpts));
+      }
+      Stdlib_Option.forEach(topicOutputs, outputs => Upload_Claim_S3$ReventlessAws.make(pluginName, entry.displayName, entry.eventSchema, outputs, !isSns));
     });
     StateTopic_AppSync$ReventlessAws.finish(eventsApi, {});
+    Upload_Claim_S3$ReventlessAws.finish(pluginName, claimStores, undefined, customOpts);
   }));
   let hooks_preResolversSchemaHook = (name, version, pluginFragment) => {
     let sdl = AppSync_Adapter$ReventlessAws.stitchStandaloneWithAwsDirectives(pluginFragment);
@@ -2070,6 +2144,21 @@ function Make($star) {
     }
     let storeBuckets = {};
     let storeBucketOrder = [];
+    let pendingExpiryConfig = Util_LocalConfig$ReventlessAws.get("pendingUploadExpiryDays");
+    let pendingExpiryByBucket = {};
+    declaredStores.forEach(param => {
+      let store = param[1];
+      let plugin = param[0];
+      Stdlib_Option.forEach(Util_StoreLayout$ReventlessAws.pendingExpiryFor(pendingExpiryConfig, plugin + `.` + store), days => {
+        let bucketName = Util_StoreLayout$ReventlessAws.bucketNameFor(storeLayout, stackName, plugin, store);
+        let prefix = Util_StoreLayout$ReventlessAws.keyPrefixFor(plugin, store);
+        pendingExpiryByBucket[bucketName] = Stdlib_Option.getOr(pendingExpiryByBucket[bucketName], []).concat([{
+            prefix: prefix,
+            days: days
+          }]);
+        log.info("Platform:deployPlatform", undefined, `object store ` + plugin + `.` + store + `: never-claimed uploads under ` + prefix + `/ expire after ` + (days.toString() + ` days. Claimed objects and objects minted before the claim `) + `component existed carry no pending tag and are outside the rule.`);
+      });
+    });
     let declaredStoreServices = declaredStores.map(param => {
       let store = param[1];
       let plugin = param[0];
@@ -2082,7 +2171,7 @@ function Make($star) {
       } else {
         let tmp;
         tmp = storeLayout === "PerStore" ? plugin : undefined;
-        let b$1 = Capability_ObjectStore_S3$ReventlessAws.make(bucketName, keyPrefix, tmp, storeProtection === "Protected", storeProtection === "Unprotected", undefined, undefined);
+        let b$1 = Capability_ObjectStore_S3$ReventlessAws.make(bucketName, keyPrefix, tmp, storeProtection === "Protected", storeProtection === "Unprotected", Stdlib_Option.getOr(pendingExpiryByBucket[bucketName], []), undefined, undefined);
         storeBuckets[bucketName] = b$1;
         storeBucketOrder.push(bucketName);
         bucket = b$1;

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -120,6 +120,7 @@ let make = (
             ("ADMIN_ENTRY_JSON", adminEntryJson->Pulumi.Input.make),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
+            Util_LambdaLogging.logLevelEntry(),
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
@@ -127,6 +128,19 @@ let make = (
     ~opts,
   )
 
+  Util_LambdaLogging.makeManagedLogGroup(
+    ~name=name ++ "Lambda",
+    ~lambdaName=lambda.name,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "LambdaLogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts,
+    (),
+  )
+
   let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
     ~name=name ++ "DataSource",
     ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -11,6 +11,7 @@ import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 import * as AppSync_Resolver_Native$ReventlessAws from "./AppSync_Resolver_Native.res.mjs";
 import * as Platform_Admin_Structure$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_Admin_Structure.res.mjs";
 import * as Platform_ComponentDefinitionsApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_ComponentDefinitionsApi.res.mjs";
@@ -86,11 +87,13 @@ function make(api, pluginReadModelTableName, opts) {
         [
           "ESM_FALLBACK_DIRS",
           Util_Bundle$ReventlessAws.esmFallbackDirs
-        ]
+        ],
+        Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
     sourceCodeHash: match.sourceCodeHash
   }, opts$1);
+  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", lambda.name, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   Pulumi.all([
     lambda.arn,

package/src/adapter/Api/Platform_UIFragments_Lambda.res

@@ -111,6 +111,7 @@ let make = (
             ("UI_FRAGMENT_RM_TABLE", uiFragmentRegistryTableName->Pulumi.Output.asInput),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
+            Util_LambdaLogging.logLevelEntry(),
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
@@ -118,6 +119,19 @@ let make = (
     ~opts,
   )
 
+  Util_LambdaLogging.makeManagedLogGroup(
+    ~name=name ++ "Lambda",
+    ~lambdaName=lambda.name,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "LambdaLogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts,
+    (),
+  )
+
   let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
     ~name=name ++ "DataSource",
     ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,

package/src/adapter/Api/Platform_UIFragments_Lambda.res.mjs

@@ -11,6 +11,7 @@ import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 import * as AppSync_Resolver_Native$ReventlessAws from "./AppSync_Resolver_Native.res.mjs";
 
 let resolverCode = `
@@ -79,11 +80,13 @@ function make(api, uiFragmentRegistryTableName, schemaReady, opts) {
         [
           "ESM_FALLBACK_DIRS",
           Util_Bundle$ReventlessAws.esmFallbackDirs
-        ]
+        ],
+        Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
     sourceCodeHash: match.sourceCodeHash
   }, opts$1);
+  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", lambda.name, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   Pulumi.all([
     lambda.arn,

package/src/adapter/Geocoder/Geocoder_AwsLocation.res

@@ -122,6 +122,7 @@ let make = (
             ("PLACE_INDEX_NAME", placeIndexName),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
+            Util_LambdaLogging.logLevelEntry(),
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
@@ -129,6 +130,19 @@ let make = (
     ~opts?,
   )
 
+  Util_LambdaLogging.makeManagedLogGroup(
+    ~name=serviceName,
+    ~lambdaName=lambda.name,
+    ~tags=AWS.Tags.make(
+      ~name=serviceName ++ "LogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts?,
+    (),
+  )
+
   let functionUrl = FunctionUrl.make(
     ~name=`${serviceName}Url`,
     ~args={

package/src/adapter/Geocoder/Geocoder_AwsLocation.res.mjs

@@ -11,6 +11,7 @@ import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 
 function make(placeIndexName, corsOriginsOpt, opts) {
   let corsOrigins = corsOriginsOpt !== undefined ? corsOriginsOpt : ["*"];
@@ -73,11 +74,13 @@ function make(placeIndexName, corsOriginsOpt, opts) {
         [
           "ESM_FALLBACK_DIRS",
           Util_Bundle$ReventlessAws.esmFallbackDirs
-        ]
+        ],
+        Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
     sourceCodeHash: match.sourceCodeHash
   }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
+  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(serviceName, lambda.name, AWS_Tags$ReventlessAws.make(serviceName + "LogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let functionUrl = new (Aws.lambda.FunctionUrl)(serviceName + `Url`, {
     authorizationType: "NONE",
     functionName: lambda.name,

package/src/adapter/Runtime/AggregateRuntime_Builder_Single.res

@@ -298,6 +298,11 @@ let finish = () =>
             }
           })
         )
+        // First-class log-level override → LOG_LEVEL, winning over any generic
+        // envVars entry. When unset, makeFromCodeAsset applies the tier default.
+        cfg.logLevel->Option.forEach(level =>
+          envVars->Dict.set("LOG_LEVEL", level->Pulumi.Output.make->Pulumi.Output.asInput)
+        )
 
         // Build AssetArchive: static re-export + user packages
         let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(

package/src/adapter/Runtime/AggregateRuntime_Builder_Single.res.mjs

@@ -197,6 +197,9 @@ function finish() {
           return;
         }
       }));
+      Stdlib_Option.forEach(cfg.logLevel, level => {
+        envVars["LOG_LEVEL"] = Pulumi.output(level);
+      });
       let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Runtime/AggregateEntryPoint.mjs", packageDirs, undefined);
       Stdlib_Option.forEach(cfg.sqsBatchSize, CommandTopicChannel_SQS_Sync$ReventlessAws.setBatchSize);
       let vpcConfig = pgSelection !== undefined ? pgSelection.securityGroupId.apply(sgId => ({

package/src/adapter/Runtime/AggregateRuntime_Builder_Single_Async.res

@@ -276,6 +276,11 @@ let finish = () =>
             }
           })
         )
+        // First-class log-level override → LOG_LEVEL, winning over any generic
+        // envVars entry. When unset, makeFromCodeAsset applies the tier default.
+        cfg.logLevel->Option.forEach(level =>
+          envVars->Dict.set("LOG_LEVEL", level->Pulumi.Output.make->Pulumi.Output.asInput)
+        )
 
         // Build AssetArchive: static re-export + user packages
         let {code, sourceCodeHash} = Util_Bundle.buildCodeArchive(