@reventlessdev/reventless-aws 3.0.0-alpha.254 → 3.0.0-alpha.255

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.255 (2026-08-02)
+
+### Bug Fixes
+
+* **aws:** apply tier LOG_LEVEL + managed log groups to bespoke Lambda builders ([8814627](https://github.com/ReventlessDev/reventless-core/commit/8814627a200199616f407f4011d4e0b0e1895397))
+
+
 # 3.0.0-alpha.254 (2026-08-02)
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.254",
+  "version": "3.0.0-alpha.255",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "dependencies": {
@@ -12,12 +12,12 @@
     "sury": "11.0.0-alpha.4",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.1",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-node": "2.0.0-alpha.0",
     "@reventlessdev/rescript-pulumi-aws": "2.4.0-alpha.63",
-    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
     "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.18",
     "@reventlessdev/reventless-core": "3.0.0-alpha.201",
     "@reventlessdev/reventless-infra": "3.0.0-alpha.118",
     "@reventlessdev/reventless-postgres": "3.0.0-alpha.65",

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res

@@ -120,6 +120,7 @@ let make = (
             ("ADMIN_ENTRY_JSON", adminEntryJson->Pulumi.Input.make),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
+            Util_LambdaLogging.logLevelEntry(),
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
@@ -127,6 +128,19 @@ let make = (
     ~opts,
   )
 
+  Util_LambdaLogging.makeManagedLogGroup(
+    ~name=name ++ "Lambda",
+    ~lambdaName=lambda.name,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "LambdaLogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts,
+    (),
+  )
+
   let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
     ~name=name ++ "DataSource",
     ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,

package/src/adapter/Api/Platform_ComponentDefinitions_Lambda.res.mjs

@@ -11,6 +11,7 @@ import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 import * as AppSync_Resolver_Native$ReventlessAws from "./AppSync_Resolver_Native.res.mjs";
 import * as Platform_Admin_Structure$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_Admin_Structure.res.mjs";
 import * as Platform_ComponentDefinitionsApi$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_ComponentDefinitionsApi.res.mjs";
@@ -86,11 +87,13 @@ function make(api, pluginReadModelTableName, opts) {
         [
           "ESM_FALLBACK_DIRS",
           Util_Bundle$ReventlessAws.esmFallbackDirs
-        ]
+        ],
+        Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
     sourceCodeHash: match.sourceCodeHash
   }, opts$1);
+  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", lambda.name, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   Pulumi.all([
     lambda.arn,

package/src/adapter/Api/Platform_UIFragments_Lambda.res

@@ -111,6 +111,7 @@ let make = (
             ("UI_FRAGMENT_RM_TABLE", uiFragmentRegistryTableName->Pulumi.Output.asInput),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
+            Util_LambdaLogging.logLevelEntry(),
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
@@ -118,6 +119,19 @@ let make = (
     ~opts,
   )
 
+  Util_LambdaLogging.makeManagedLogGroup(
+    ~name=name ++ "Lambda",
+    ~lambdaName=lambda.name,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "LambdaLogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts,
+    (),
+  )
+
   let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
     ~name=name ++ "DataSource",
     ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,

package/src/adapter/Api/Platform_UIFragments_Lambda.res.mjs

@@ -11,6 +11,7 @@ import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 import * as AppSync_Resolver_Native$ReventlessAws from "./AppSync_Resolver_Native.res.mjs";
 
 let resolverCode = `
@@ -79,11 +80,13 @@ function make(api, uiFragmentRegistryTableName, schemaReady, opts) {
         [
           "ESM_FALLBACK_DIRS",
           Util_Bundle$ReventlessAws.esmFallbackDirs
-        ]
+        ],
+        Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
     sourceCodeHash: match.sourceCodeHash
   }, opts$1);
+  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", lambda.name, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   Pulumi.all([
     lambda.arn,

package/src/adapter/Geocoder/Geocoder_AwsLocation.res

@@ -122,6 +122,7 @@ let make = (
             ("PLACE_INDEX_NAME", placeIndexName),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
+            Util_LambdaLogging.logLevelEntry(),
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
@@ -129,6 +130,19 @@ let make = (
     ~opts?,
   )
 
+  Util_LambdaLogging.makeManagedLogGroup(
+    ~name=serviceName,
+    ~lambdaName=lambda.name,
+    ~tags=AWS.Tags.make(
+      ~name=serviceName ++ "LogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts?,
+    (),
+  )
+
   let functionUrl = FunctionUrl.make(
     ~name=`${serviceName}Url`,
     ~args={

package/src/adapter/Geocoder/Geocoder_AwsLocation.res.mjs

@@ -11,6 +11,7 @@ import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 
 function make(placeIndexName, corsOriginsOpt, opts) {
   let corsOrigins = corsOriginsOpt !== undefined ? corsOriginsOpt : ["*"];
@@ -73,11 +74,13 @@ function make(placeIndexName, corsOriginsOpt, opts) {
         [
           "ESM_FALLBACK_DIRS",
           Util_Bundle$ReventlessAws.esmFallbackDirs
-        ]
+        ],
+        Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
     sourceCodeHash: match.sourceCodeHash
   }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
+  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(serviceName, lambda.name, AWS_Tags$ReventlessAws.make(serviceName + "LogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let functionUrl = new (Aws.lambda.FunctionUrl)(serviceName + `Url`, {
     authorizationType: "NONE",
     functionName: lambda.name,

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -243,18 +243,9 @@ let makeFromCodeAsset: (
 
   // Default the logger's minimum level per environment tier when nothing already
   // pinned one (caller `envVars` or a consumer-registered `additionalEnvVars`
-  // win). Verbose on disposable dev stacks, quiet on prod/beta — for every
-  // Lambda, not just the command handlers.
-  if variables->Dict.get("LOG_LEVEL")->Option.isNone {
-    variables->Dict.set(
-      "LOG_LEVEL",
-      Util_LogRetention.logLevelFor(
-        ~stack,
-        ~prodStacks,
-        ~configOverride=?Util_LocalConfig.get("logLevel"),
-      )->Pulumi.Input.make,
-    )
-  }
+  // win) — for every Lambda, via the shared helper so the bespoke
+  // `Lambda.Function.make` builders apply the identical policy.
+  Util_LambdaLogging.applyLogLevelDefault(variables)
 
   // ESM self-containment (Option C): every code archive built by
   // Util_Bundle.buildCodeArchive ships register-hook.mjs + layer-resolver.mjs at

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs

@@ -23,6 +23,7 @@ import * as Util_IAM_Role$ReventlessAws from "../../util/Util_IAM_Role.res.mjs";
 import * as Util_LocalConfig$ReventlessAws from "../../util/Util_LocalConfig.res.mjs";
 import * as Util_HostUiDomain$ReventlessAws from "../../util/Util_HostUiDomain.res.mjs";
 import * as Util_LogRetention$ReventlessAws from "../../util/Util_LogRetention.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 
 let additionalEnvVars = {};
 
@@ -101,9 +102,7 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
   Stdlib_Dict.forEachWithKey(additionalEnvVars, (value, key) => {
     variables[key] = value;
   });
-  if (Stdlib_Option.isNone(variables["LOG_LEVEL"])) {
-    variables["LOG_LEVEL"] = Util_LogRetention$ReventlessAws.logLevelFor(stack, prodStacks, Util_LocalConfig$ReventlessAws.get("logLevel"));
-  }
+  Util_LambdaLogging$ReventlessAws.applyLogLevelDefault(variables);
   variables["NODE_OPTIONS"] = Util_Bundle$ReventlessAws.esmLoaderNodeOptions;
   variables["ESM_FALLBACK_DIRS"] = Util_Bundle$ReventlessAws.esmFallbackDirs;
   let tags = tagsFor(name, "Runtime");

package/src/adapter/StateTopic/StateTopic_AppSync.res

@@ -237,6 +237,7 @@ let finish = (
               ("STATE_TOPIC_MAP", topicMapJson->Pulumi.Output.asInput),
               ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
               ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
+              Util_LambdaLogging.logLevelEntry(),
             ]),
           }: Lambda.Function.functionEnvironment
         )->Pulumi.Input.make,
@@ -244,6 +245,19 @@ let finish = (
       ~opts,
     )
 
+    Util_LambdaLogging.makeManagedLogGroup(
+      ~name=name ++ "StateTopicPublisher",
+      ~lambdaName=lambda.name,
+      ~tags=AWS.Tags.make(
+        ~name=name ++ "StateTopicPublisherLogGroup",
+        ~kind=ReventlessCore.QueryDb.componentType,
+        ~role=Logs,
+        ~component=name,
+      ),
+      ~opts,
+      (),
+    )
+
     // One EventSourceMapping per stream, all targeting the shared Lambda.
     // Retry posture: the handler throws on 5xx / network errors and logs-and-
     // continues on 4xx. `maximumRetryAttempts: 3` bounds the per-record

package/src/adapter/StateTopic/StateTopic_AppSync.res.mjs

@@ -12,6 +12,7 @@ import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/sr
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_ReadModel$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_ReadModel.res.mjs";
 import * as AppSync_EventsApi$ReventlessAws from "../Api/AppSync_EventsApi.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 import * as Util_DynamoDbStream$ReventlessAws from "../../util/Util_DynamoDbStream.res.mjs";
 
 let registry = {};
@@ -119,11 +120,13 @@ function finish(eventsApi, opts) {
         [
           "ESM_FALLBACK_DIRS",
           Util_Bundle$ReventlessAws.esmFallbackDirs
-        ]
+        ],
+        Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
     sourceCodeHash: match.sourceCodeHash
   }, opts);
+  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "StateTopicPublisher", lambda.name, AWS_Tags$ReventlessAws.make(name + "StateTopicPublisherLogGroup", QueryDb$ReventlessCore.componentType, "Logs", undefined, name, undefined, undefined, undefined), opts, undefined);
   entries.forEach(entry => {
     let esmName = entry.topicName + "Stream2" + name + "StateTopic";
     new (Aws.lambda.EventSourceMapping)(esmName, {

package/src/adapter/Upload/Upload_Claim_S3.res

@@ -290,6 +290,7 @@ let finish = (
               ("CLAIM_REF_FIELDS", refFieldsJson->Pulumi.Output.asInput),
               ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
               ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
+              Util_LambdaLogging.logLevelEntry(),
             ]),
           }: Lambda.Function.functionEnvironment
         )->Pulumi.Input.make,
@@ -297,6 +298,19 @@ let finish = (
       ~opts,
     )
 
+    Util_LambdaLogging.makeManagedLogGroup(
+      ~name,
+      ~lambdaName=lambda.name,
+      ~tags=AWS.Tags.make(
+        ~name=name ++ "LogGroup",
+        ~kind=ReventlessCore.ComponentType.Plugin,
+        ~role=Logs,
+        ~component=name,
+      ),
+      ~opts,
+      (),
+    )
+
     // One mapping per event log stream, all targeting the one Lambda.
     // `maximumRetryAttempts` bounds a permanently failing record so it cannot
     // wedge the shard — the default of -1 retries forever, which would turn one

package/src/adapter/Upload/Upload_Claim_S3.res.mjs

@@ -11,6 +11,7 @@ import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as StorageRefFields$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/StorageRefFields.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 import * as Util_DynamoDbStream$ReventlessAws from "../../util/Util_DynamoDbStream.res.mjs";
 
 let registry = {};
@@ -154,11 +155,13 @@ function finish(plugin, stores, iteratorAgeAlarmMsOpt, opts) {
         [
           "ESM_FALLBACK_DIRS",
           Util_Bundle$ReventlessAws.esmFallbackDirs
-        ]
+        ],
+        Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
     sourceCodeHash: match.sourceCodeHash
   }, opts);
+  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name, lambda.name, AWS_Tags$ReventlessAws.make(name + "LogGroup", "Plugin", "Logs", undefined, name, undefined, undefined, undefined), opts, undefined);
   entries.forEach((entry, i) => {
     let esmName = name + `Stream` + i.toString();
     new (Aws.lambda.EventSourceMapping)(esmName, {

package/src/adapter/Upload/Upload_Presign_S3.res

@@ -208,6 +208,7 @@ let make = (
             ("RELEASE_WINDOW_SECONDS", releaseWindowSeconds->Int.toString->Pulumi.Input.make),
             ("NODE_OPTIONS", Util_Bundle.esmLoaderNodeOptions->Pulumi.Input.make),
             ("ESM_FALLBACK_DIRS", Util_Bundle.esmFallbackDirs->Pulumi.Input.make),
+            Util_LambdaLogging.logLevelEntry(),
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
@@ -215,6 +216,19 @@ let make = (
     ~opts,
   )
 
+  Util_LambdaLogging.makeManagedLogGroup(
+    ~name=name ++ "Lambda",
+    ~lambdaName=lambda.name,
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "LambdaLogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts,
+    (),
+  )
+
   let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
     ~name=name ++ "DataSource",
     ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,

package/src/adapter/Upload/Upload_Presign_S3.res.mjs

@@ -11,6 +11,7 @@ import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
 import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
 import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
 import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/util/Util_Pulumi.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 import * as AppSync_Resolver_Native$ReventlessAws from "../Api/AppSync_Resolver_Native.res.mjs";
 
 function invokeCode(operation) {
@@ -123,11 +124,13 @@ function make(api, stores, releaseWindowSecondsOpt, nameOpt, opts) {
         [
           "ESM_FALLBACK_DIRS",
           Util_Bundle$ReventlessAws.esmFallbackDirs
-        ]
+        ],
+        Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
     sourceCodeHash: match.sourceCodeHash
   }, opts$1);
+  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", lambda.name, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   Pulumi.all([
     lambda.arn,

package/src/util/Util_DeadLetterQueue.res

@@ -105,6 +105,7 @@ let handler = Lambda.Function.make(
       {
         Lambda.Function.variables: Dict.fromArray([
           ("Environment", Pulumi.Pulumi.getStackName()->Pulumi.Input.make),
+          Util_LambdaLogging.logLevelEntry(),
         ]),
       }: Lambda.Function.functionEnvironment
     )->Pulumi.Input.make,

package/src/util/Util_DeadLetterQueue.res.mjs

@@ -11,6 +11,7 @@ import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/sr
 import * as Monitoring$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Monitoring/Monitoring.res.mjs";
 import * as Util_Bundle$ReventlessAws from "./Util_Bundle.res.mjs";
 import * as Util_Lambda$ReventlessAws from "./Util_Lambda.res.mjs";
+import * as Util_LambdaLogging$ReventlessAws from "./Util_LambdaLogging.res.mjs";
 import * as Util_EventSourceMapping$ReventlessAws from "./Util_EventSourceMapping.res.mjs";
 
 let name = "DeadLetterQueue";
@@ -73,10 +74,13 @@ let handler = new (Aws.lambda.Function)(name, {
   layers: layers,
   tags: AWS_Tags$ReventlessAws.make(name, "Plugin", "DeadLetter", "Plugin", undefined, undefined, undefined, undefined),
   environment: {
-    variables: Object.fromEntries([[
+    variables: Object.fromEntries([
+      [
         "Environment",
         Pulumi.getStack()
-      ]])
+      ],
+      Util_LambdaLogging$ReventlessAws.logLevelEntry()
+    ])
   },
   sourceCodeHash: sourceCodeHash
 }, opts);

package/src/util/Util_LambdaLogging.res

@@ -0,0 +1,83 @@
+// Shared application of the environment-tiered logging policy
+// (`Util_LogRetention`) to Lambdas. `RuntimeEnvironment_Lambda.makeFromCodeAsset`
+// and the bespoke `Lambda.Function.make` builders (DeadLetterQueue, Upload,
+// Geocoder, the platform UI Lambdas, the state-topic publisher) all route the
+// `LOG_LEVEL` default and the managed log group through here, so a builder cannot
+// silently miss the tier policy — the gap that left ~8 platform Lambdas on the
+// logger's default and unmanaged, forever-retained log groups.
+open PulumiAws
+
+// Stack + prod allow-list + the unmanaged-groups escape hatch, resolved from
+// config. Impure by necessity (reads the stack name and config keys); the tier
+// decisions it feeds are the pure functions in `Util_LogRetention`.
+let stackContext = () => {
+  let stack = Pulumi.Pulumi.getStackName()
+  let prodStacks = Util_HostUiDomain.resolveProdStacks()
+  let unmanagedStacks = Util_LogRetention.parseUnmanagedStacks(
+    Util_LocalConfig.get("unmanagedLogGroupStacks")->Option.getOr(""),
+  )
+  (stack, prodStacks, unmanagedStacks)
+}
+
+// The `("LOG_LEVEL", <tier default>)` env-var entry. For the bespoke builders
+// that assemble their env with `Dict.fromArray([...])` and never pin LOG_LEVEL —
+// they just append this entry.
+let logLevelEntry = (): (string, Pulumi.Input.t<string>) => {
+  let (stack, prodStacks, _) = stackContext()
+  (
+    "LOG_LEVEL",
+    Util_LogRetention.logLevelFor(
+      ~stack,
+      ~prodStacks,
+      ~configOverride=?Util_LocalConfig.get("logLevel"),
+    )->Pulumi.Input.make,
+  )
+}
+
+// Default `LOG_LEVEL` to the environment tier when the caller has not pinned one.
+// Mutates the given variables dict in place, so it must run after the caller's
+// own env vars are set (theirs win). For `makeFromCodeAsset`, whose callers can
+// pass LOG_LEVEL through `envVars`.
+let applyLogLevelDefault = (variables: dict<Pulumi.Input.t<string>>) =>
+  if variables->Dict.get("LOG_LEVEL")->Option.isNone {
+    let (key, value) = logLevelEntry()
+    variables->Dict.set(key, value)
+  }
+
+// Create a managed CloudWatch log group with tier retention for a Lambda when the
+// stack manages its groups (`Util_LogRetention.managesLogGroup`). The group name
+// derives from the function's own *physical* name output — never the logical
+// name — so it matches the group Lambda would auto-create and carries Pulumi's
+// uniqueness suffix. The caller supplies `~tags` (Logs-role, its own attribution
+// convention) and `~opts` (so the group parents to the same component and is torn
+// down with it — closing the orphan-group loop for the bespoke builders too). The
+// trailing `()` terminates the optional `~opts`.
+let makeManagedLogGroup = (
+  ~name: string,
+  ~lambdaName: Pulumi.Output.t<string>,
+  ~tags,
+  ~opts=?,
+  (),
+) => {
+  let (stack, prodStacks, unmanagedStacks) = stackContext()
+  if Util_LogRetention.managesLogGroup(~stack, ~unmanagedStacks) {
+    let days = Util_LogRetention.retentionDaysFor(
+      ~stack,
+      ~prodStacks,
+      ~configOverride=?Util_LocalConfig.get("logRetentionDays")->Option.flatMap(s =>
+        Int.fromString(s)
+      ),
+    )
+    let _ = Cloudwatch.LogGroup.make(
+      ~name=`${name}LogGroup`,
+      ~args={
+        name: lambdaName
+        ->Pulumi.Output.apply(n => `/aws/lambda/${n}`)
+        ->Pulumi.Output.asInput,
+        retentionInDays: days->Pulumi.Input.make,
+        tags,
+      },
+      ~opts?,
+    )
+  }
+}

package/src/util/Util_LambdaLogging.res.mjs

@@ -0,0 +1,59 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
+import * as Aws from "@pulumi/aws";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Util_LocalConfig$ReventlessAws from "./Util_LocalConfig.res.mjs";
+import * as Util_HostUiDomain$ReventlessAws from "./Util_HostUiDomain.res.mjs";
+import * as Util_LogRetention$ReventlessAws from "./Util_LogRetention.res.mjs";
+
+function stackContext() {
+  let stack = Pulumi.getStack();
+  let prodStacks = Util_HostUiDomain$ReventlessAws.resolveProdStacks();
+  let unmanagedStacks = Util_LogRetention$ReventlessAws.parseUnmanagedStacks(Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("unmanagedLogGroupStacks"), ""));
+  return [
+    stack,
+    prodStacks,
+    unmanagedStacks
+  ];
+}
+
+function logLevelEntry() {
+  let match = stackContext();
+  return [
+    "LOG_LEVEL",
+    Util_LogRetention$ReventlessAws.logLevelFor(match[0], match[1], Util_LocalConfig$ReventlessAws.get("logLevel"))
+  ];
+}
+
+function applyLogLevelDefault(variables) {
+  if (!Stdlib_Option.isNone(variables["LOG_LEVEL"])) {
+    return;
+  }
+  let match = logLevelEntry();
+  variables[match[0]] = match[1];
+}
+
+function makeManagedLogGroup(name, lambdaName, tags, opts, param) {
+  let match = stackContext();
+  let stack = match[0];
+  if (!Util_LogRetention$ReventlessAws.managesLogGroup(stack, match[2])) {
+    return;
+  }
+  let days = Util_LogRetention$ReventlessAws.retentionDaysFor(stack, match[1], Stdlib_Option.flatMap(Util_LocalConfig$ReventlessAws.get("logRetentionDays"), s => Stdlib_Int.fromString(s, undefined)));
+  new (Aws.cloudwatch.LogGroup)(name + `LogGroup`, {
+    name: lambdaName.apply(n => `/aws/lambda/` + n),
+    retentionInDays: days,
+    tags: tags
+  }, opts !== undefined ? Primitive_option.valFromOption(opts) : undefined);
+}
+
+export {
+  stackContext,
+  logLevelEntry,
+  applyLogLevelDefault,
+  makeManagedLogGroup,
+}
+/* @pulumi/aws Not a pure module */