@reventlessdev/reventless-aws 3.0.0-alpha.271 → 3.0.0-alpha.273

package/src/adapter/QueryDb/QueryInterceptor_Provisioning.res.mjs

@@ -0,0 +1,92 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Aws from "@pulumi/aws";
+import * as IAM$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/IAM.res.mjs";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as AWS$ReventlessAws from "../AWS.res.mjs";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
+import * as PolicyDocument$PulumiAws from "@reventlessdev/rescript-pulumi-aws/src/IAM/PolicyDocument.res.mjs";
+import * as Util_Bundle$ReventlessAws from "../../util/Util_Bundle.res.mjs";
+import * as QueryInterception$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/QueryInterception/QueryInterception.res.mjs";
+import * as ResourceAttribution$ReventlessCore from "@reventlessdev/reventless-core/src/ResourceAttribution.res.mjs";
+import * as RuntimeEnvironment_Lambda$ReventlessAws from "../Runtime/RuntimeEnvironment_Lambda.res.mjs";
+
+let byApi = new Map();
+
+let namesUsed = {};
+
+function nameFor() {
+  let owner = Stdlib_Option.getOr(ResourceAttribution$ReventlessCore.current.contents.plugin, "Platform");
+  let used = Stdlib_Option.getOr(namesUsed[owner], 0);
+  namesUsed[owner] = used + 1 | 0;
+  if (used === 0) {
+    return owner + "QueryInterceptor";
+  } else {
+    return owner + "QueryInterceptor" + (used + 1 | 0).toString();
+  }
+}
+
+function buildInterceptor(api, opts) {
+  let name = nameFor();
+  let componentOpts_parent = opts.parent;
+  let componentOpts = {
+    parent: componentOpts_parent
+  };
+  let packageDirs = Object.fromEntries([[
+      "@reventlessdev/reventless-aws",
+      Util_Bundle$ReventlessAws.resolvePackageRoot(undefined, "@reventlessdev/reventless-aws")
+    ]]);
+  let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/QueryDb/QueryInterceptor_Lambda.res.mjs", packageDirs, undefined, undefined);
+  let runtime = RuntimeEnvironment_Lambda$ReventlessAws.makeFromCodeAsset(name, {
+    TAG: "Other",
+    _0: "QueryInterceptor"
+  }, "Plugin", match.code, match.sourceCodeHash, undefined, 256, 10, undefined, undefined, undefined, undefined, undefined, componentOpts);
+  let lambdaArn = Output$Pulumi.flatMap(runtime.parts.lambda, lambda => lambda.arn);
+  let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Plugin", "Identity", "Plugin", undefined, undefined, undefined, undefined), opts);
+  Pulumi.all([
+    lambdaArn,
+    dataSourceRole.id
+  ]).apply(param => {
+    new (Aws.iam.RolePolicy)(name + "DataSource", {
+      policy: PolicyDocument$PulumiAws.toJsonString(PolicyDocument$PulumiAws.make(undefined, name + "DataSourcePolicy", [{
+          Sid: "AllowDataSourceInvokeInterceptor",
+          Effect: "Allow",
+          Action: "lambda:InvokeFunction",
+          Resource: param[0]
+        }])),
+      role: param[1]
+    }, opts);
+  });
+  return new (Aws.appsync.DataSource)(name + "DataSource", {
+    type: "AWS_LAMBDA",
+    apiId: Output$Pulumi.flatMap(api, api => api.id),
+    lambdaConfig: {
+      functionArn: lambdaArn
+    },
+    serviceRoleArn: dataSourceRole.arn
+  }, opts).name;
+}
+
+function dataSourceName(api, opts) {
+  if (!QueryInterception$ReventlessCore.isEnabled()) {
+    return;
+  }
+  let existing = byApi.get(api);
+  if (existing !== undefined) {
+    return existing;
+  }
+  let created = buildInterceptor(api, opts);
+  byApi.set(api, created);
+  return created;
+}
+
+export {
+  byApi,
+  namesUsed,
+  nameFor,
+  buildInterceptor,
+  dataSourceName,
+}
+/* byApi Not a pure module */

package/src/adapter/Runtime/EventCollectorEntryPoint_Ops.res

@@ -659,12 +659,9 @@ let warnSkippedExtension = (ext: extensionConfig) =>
 // ── Asset files (bundled alongside index.mjs in the code archive) ───────────
 // pluginDefinition is shipped as a file rather than packed into HANDLER_CONFIG
 // (UpdateFunctionConfiguration has a 5120-byte limit; pluginStructure alone blew
-// past it). process.cwd() is /var/task in Lambda, so a relative URL resolves
-// against the extracted zip.
+// past it). process.cwd() is /var/task in Lambda, where the archive is extracted.
 
-type url
-@new external makeUrl: (string, string) => url = "URL"
-@module("node:fs") external readFileSyncUrl: (url, string) => string = "readFileSync"
+let assetPath = (fileName: string): string => NodePath.join([NodeProcess.cwd(), fileName])
 
 // pluginDefinition.json is written at deploy time as a stable JSON literal
 // matching Reventless.Plugin.pluginDefinitionSchema (PluginRuntime_Builder), so
@@ -675,9 +672,7 @@ external asPluginDefinition: JSON.t => Reventless.Plugin.pluginDefinition = "%id
 
 let loadPluginDefinition = (): Reventless.Plugin.pluginDefinition =>
   try {
-    readFileSyncUrl(makeUrl("./pluginDefinition.json", `file://${NodeProcess.cwd()}/`), "utf-8")
-    ->JSON.parseOrThrow
-    ->asPluginDefinition
+    assetPath("pluginDefinition.json")->NodeFs.readFileSync->JSON.parseOrThrow->asPluginDefinition
   } catch {
   | exn =>
     JsError.throwWithMessage(
@@ -691,7 +686,7 @@ let loadPluginDefinition = (): Reventless.Plugin.pluginDefinition =>
 // both map to None.
 let loadUiFragments = (): option<JSON.t> =>
   try {
-    switch readFileSyncUrl(makeUrl("./uiFragments.json", `file://${NodeProcess.cwd()}/`), "utf-8")->JSON.parseOrThrow {
+    switch assetPath("uiFragments.json")->NodeFs.readFileSync->JSON.parseOrThrow {
     | JSON.Null => None
     | json => Some(json)
     }

package/src/adapter/Runtime/EventCollectorEntryPoint_Ops.res.mjs

@@ -1,6 +1,7 @@
 // Generated by ReScript, PLEASE EDIT WITH CARE
 
 import * as Nodefs from "node:fs";
+import * as Nodepath from "node:path";
 import * as Stdlib_JSON from "@rescript/runtime/lib/es6/Stdlib_JSON.js";
 import * as Stdlib_Array from "@rescript/runtime/lib/es6/Stdlib_Array.js";
 import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
@@ -515,9 +516,13 @@ function warnSkippedExtension(ext) {
   });
 }
 
+function assetPath(fileName) {
+  return Nodepath.join(process.cwd(), fileName);
+}
+
 function loadPluginDefinition() {
   try {
-    return JSON.parse(Nodefs.readFileSync(new URL("./pluginDefinition.json", `file://` + process.cwd() + `/`), "utf-8"));
+    return JSON.parse(Nodefs.readFileSync(assetPath("pluginDefinition.json"), "utf8"));
   } catch (raw_exn) {
     let exn = Primitive_exceptions.internalToException(raw_exn);
     return Stdlib_JsError.throwWithMessage("Failed to load pluginDefinition.json from asset zip: " + exnMessage(exn));
@@ -526,7 +531,7 @@ function loadPluginDefinition() {
 
 function loadUiFragments() {
   try {
-    let json = JSON.parse(Nodefs.readFileSync(new URL("./uiFragments.json", `file://` + process.cwd() + `/`), "utf-8"));
+    let json = JSON.parse(Nodefs.readFileSync(assetPath("uiFragments.json"), "utf8"));
     if (json === null) {
       return;
     } else {
@@ -642,6 +647,7 @@ export {
   buildPublishToAggregates,
   extensionPublishDicts,
   warnSkippedExtension,
+  assetPath,
   loadPluginDefinition,
   loadUiFragments,
   pushHandler,

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res

@@ -145,17 +145,7 @@ let makeFromCodeAsset: (
   let opts =
     opts->Option.map(ReventlessCore.Util.Pulumi.ComponentResourceOptions.toCustomResourceOptions)
 
-  // The environment tier drives retention, default log level and whether the log
-  // group is Pulumi-managed. Resolved once from the stack name and the shared
-  // prod allow-list (the same notion of "production" that names the host-shell
-  // domain and the store layout).
   let stack = Pulumi.Pulumi.getStackName()
-  let prodStacks = Util_HostUiDomain.resolveProdStacks()
-  // Stacks explicitly held on auto-created log groups pending a `pulumi import`
-  // (none today — the escape hatch for adopting a pre-existing stack later).
-  let unmanagedStacks = Util_LogRetention.parseUnmanagedStacks(
-    Util_LocalConfig.get("unmanagedLogGroupStacks")->Option.getOr(""),
-  )
 
   // One attribution identity for every resource provisioned here: same owning
   // component and kind throughout, distinct piece roles — the function itself,
@@ -285,6 +275,26 @@ let makeFromCodeAsset: (
     variables->Dict.set("RUNTIME_EXTENSIONS", config->JSON.stringify->Pulumi.Input.make)
   }
 
+  // Managed CloudWatch log group with explicit retention, created **before** the
+  // function so the function can be told to write to it. That ordering is what
+  // keeps the deploy the owner: a group created after its function races the
+  // auto-create that the function's first invocation triggers, and losing that
+  // race is permanent — the group persists, so every retry fails identically.
+  // Runtimes with a heartbeat, a stream subscription or a schedule are invoked
+  // within seconds of existing, so they lost it most reliably.
+  //
+  // Created when the caller pins `~logRetentionDays` (the app-developer opt-in)
+  // OR the stack manages its groups — every stack by default, bar any named in
+  // `unmanagedLogGroupStacks`. When neither holds, Lambda auto-creates an
+  // unmanaged group with no retention, as before.
+  let logGroup = Util_LambdaLogging.makeManagedLogGroup(
+    ~name,
+    ~retentionDaysOverride=?logRetentionDays,
+    ~tags=tagsFor(~resourceName=`${name}LogGroup`, ~role=Logs),
+    ~opts?,
+    (),
+  )
+
   let tags = tagsFor(~resourceName=name, ~role=Runtime)
   let lambda = Lambda.Function.make(
     ~name,
@@ -305,60 +315,20 @@ let makeFromCodeAsset: (
       vpcConfig: ?vpcConfig,
       environment: ({Lambda.Function.variables: variables}: Lambda.Function.functionEnvironment)
         ->Pulumi.Input.make,
+      // Points the function at the group above and, by reading its name output,
+      // orders the function after it.
+      loggingConfig: ?Util_LambdaLogging.loggingConfigFor(logGroup),
     },
     ~opts?,
   )
 
-  // Managed CloudWatch log-group with explicit retention. Created when the caller
-  // pins `~logRetentionDays` (the app-developer opt-in) OR the stack manages its
-  // groups — every stack by default, bar any named in `unmanagedLogGroupStacks`
-  // (see `Util_LogRetention.managesLogGroup`). When neither holds, Lambda
-  // auto-creates an unmanaged group with no retention.
-  //
-  // Precedence for the retention value: explicit `~logRetentionDays` → the
-  // `logRetentionDays` config key → the environment tier default.
-  //
-  // The group name derives from the function's *physical* name output, not the
-  // logical `name`. `Lambda.Function` has no `name` arg, so its physical name
-  // always carries Pulumi's `-<7hex>` suffix; a literal `/aws/lambda/${name}`
-  // would create an empty group beside the real one, leave orphan accumulation
-  // unchanged, and collide across stacks sharing an account.
-  let managedRetention = switch (
-    logRetentionDays,
-    Util_LogRetention.managesLogGroup(~stack, ~unmanagedStacks),
-  ) {
-  | (Some(days), _) => Some(days)
-  | (None, true) =>
-    Some(
-      Util_LogRetention.retentionDaysFor(
-        ~stack,
-        ~prodStacks,
-        ~configOverride=?Util_LocalConfig.get("logRetentionDays")->Option.flatMap(s =>
-          Int.fromString(s)
-        ),
-      ),
-    )
-  | (None, false) => None
-  }
-  managedRetention->Option.forEach(days => {
-    let logGroup = Cloudwatch.LogGroup.make(
-      ~name=`${name}LogGroup`,
-      ~args={
-        name: lambda.name
-        ->Pulumi.Output.apply(n => `/aws/lambda/${n}`)
-        ->Pulumi.Output.asInput,
-        retentionInDays: days->Pulumi.Input.make,
-        tags: tagsFor(~resourceName=`${name}LogGroup`, ~role=Logs),
-      },
-      ~opts?,
-    )
-
-    // DCB command-handler Lambdas: extract the provider-neutral metric lines
-    // emitted by StateChangeSlice_Callback (`{reventlessMetric, slice, value}`)
-    // into CloudWatch metrics. Attached to the managed log group above so there
-    // is no race against Lambda's lazy auto-created group. Namespace/dimension
-    // are CloudWatch-specific and live here, not in core (provider-neutral).
-    if dcbMetrics {
+  // DCB command-handler Lambdas: extract the provider-neutral metric lines
+  // emitted by StateChangeSlice_Callback (`{reventlessMetric, slice, value}`)
+  // into CloudWatch metrics. Attached to the managed log group, which is the only
+  // group the function ever writes to. Namespace/dimension are CloudWatch-specific
+  // and live here, not in core (provider-neutral).
+  if dcbMetrics {
+    logGroup->Option.forEach(logGroup =>
       Util_DcbMetrics.metricNames->Array.forEach(metricName => {
         let _ = Cloudwatch.LogMetricFilter.make(
           ~name=`${name}${metricName}Filter`,
@@ -370,8 +340,8 @@ let makeFromCodeAsset: (
           ~opts?,
         )
       })
-    }
-  })
+    )
+  }
 
   let lambdaResource = lambda->Util.Lambda.functionToResource(~tags=tags->Pulumi.Output.fromInput)
 

package/src/adapter/Runtime/RuntimeEnvironment_Lambda.res.mjs

@@ -22,10 +22,7 @@ import * as Util_Pulumi$ReventlessCore from "@reventlessdev/reventless-core/src/
 import * as Util_IAM_Role$ReventlessAws from "../../util/Util_IAM_Role.res.mjs";
 import * as ComponentType$ReventlessCore from "@reventlessdev/reventless-core/src/ComponentType.res.mjs";
 import * as Util_DcbMetrics$ReventlessAws from "../../util/Util_DcbMetrics.res.mjs";
-import * as Util_LocalConfig$ReventlessAws from "../../util/Util_LocalConfig.res.mjs";
 import * as RuntimeExtension$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/RuntimeExtension/RuntimeExtension.res.mjs";
-import * as Util_HostUiDomain$ReventlessAws from "../../util/Util_HostUiDomain.res.mjs";
-import * as Util_LogRetention$ReventlessAws from "../../util/Util_LogRetention.res.mjs";
 import * as Util_LambdaLogging$ReventlessAws from "../../util/Util_LambdaLogging.res.mjs";
 import * as ResourceAttribution$ReventlessCore from "@reventlessdev/reventless-core/src/ResourceAttribution.res.mjs";
 
@@ -59,8 +56,6 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
   let dcbMetrics = dcbMetricsOpt !== undefined ? dcbMetricsOpt : false;
   let opts$1 = Stdlib_Option.map(opts, Util_Pulumi$ReventlessCore.ComponentResourceOptions.toCustomResourceOptions);
   let stack = Pulumi.getStack();
-  let prodStacks = Util_HostUiDomain$ReventlessAws.resolveProdStacks();
-  let unmanagedStacks = Util_LogRetention$ReventlessAws.parseUnmanagedStacks(Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("unmanagedLogGroupStacks"), ""));
   let tagsFor = (resourceName, role) => AWS_Tags$ReventlessAws.make(resourceName, componentKind, role, undefined, name, undefined, undefined, undefined);
   let lambdaRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name, Pulumi.output(AWS$ReventlessAws.Lambda.principal), tagsFor(name, "Identity"), opts$1);
   Stdlib_Option.forEach(vpcConfig, param => {
@@ -136,6 +131,7 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
     ]);
     variables["RUNTIME_EXTENSIONS"] = JSON.stringify(config);
   }
+  let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name, logRetentionDays, tagsFor(name + `LogGroup`, "Logs"), opts$1, undefined);
   let tags = tagsFor(name, "Runtime");
   let lambda = new (Aws.lambda.Function)(name, {
     handler: "index.handler",
@@ -154,19 +150,11 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
     ephemeralStorage: Stdlib_Option.map(ephemeralStorageMb, mb => ({
       size: mb
     })),
-    vpcConfig: vpcConfig
+    vpcConfig: vpcConfig,
+    loggingConfig: Util_LambdaLogging$ReventlessAws.loggingConfigFor(logGroup)
   }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
-  let match$1 = Util_LogRetention$ReventlessAws.managesLogGroup(stack, unmanagedStacks);
-  let managedRetention = logRetentionDays !== undefined ? logRetentionDays : (
-      match$1 ? Util_LogRetention$ReventlessAws.retentionDaysFor(stack, prodStacks, Stdlib_Option.flatMap(Util_LocalConfig$ReventlessAws.get("logRetentionDays"), s => Stdlib_Int.fromString(s, undefined))) : undefined
-    );
-  Stdlib_Option.forEach(managedRetention, days => {
-    let logGroup = new (Aws.cloudwatch.LogGroup)(name + `LogGroup`, {
-      name: lambda.name.apply(n => `/aws/lambda/` + n),
-      retentionInDays: days,
-      tags: tagsFor(name + `LogGroup`, "Logs")
-    }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
-    if (dcbMetrics) {
+  if (dcbMetrics) {
+    Stdlib_Option.forEach(logGroup, logGroup => {
       Util_DcbMetrics$ReventlessAws.metricNames.forEach(metricName => {
         new (Aws.cloudwatch.LogMetricFilter)(name + metricName + `Filter`, {
           pattern: Util_DcbMetrics$ReventlessAws.patternFor(metricName),
@@ -174,9 +162,8 @@ function makeFromCodeAsset(name, unitKind, componentKind, code, sourceCodeHash,
           metricTransformation: Util_DcbMetrics$ReventlessAws.transformationFor(metricName)
         }, opts$1 !== undefined ? Primitive_option.valFromOption(opts$1) : undefined);
       });
-      return;
-    }
-  });
+    });
+  }
   let lambdaResource = Util_Lambda$ReventlessAws.functionToResource(tags, lambda);
   Monitoring$ReventlessCore.notify(unitKind, name, lambdaResource);
   return {

package/src/adapter/StateTopic/StateTopic_AppSync.res

@@ -218,6 +218,20 @@ let finish = (
 
     let appsyncEndpoint = AppSync_EventsApi.httpEndpoint(eventsApi)
 
+    // Created before the function that writes to it — see
+    // `Util_LambdaLogging.makeManagedLogGroup` for why the ordering matters.
+    let logGroup = Util_LambdaLogging.makeManagedLogGroup(
+      ~name=name ++ "StateTopicPublisher",
+      ~tags=AWS.Tags.make(
+        ~name=name ++ "StateTopicPublisherLogGroup",
+        ~kind=ReventlessCore.QueryDb.componentType,
+        ~role=Logs,
+        ~component=name,
+      ),
+      ~opts,
+      (),
+    )
+
     let lambda = Lambda.Function.make(
       ~name=name ++ "StateTopicPublisher",
       ~args={
@@ -242,23 +256,11 @@ let finish = (
             ]),
           }: Lambda.Function.functionEnvironment
         )->Pulumi.Input.make,
+        loggingConfig: ?Util_LambdaLogging.loggingConfigFor(logGroup),
       },
       ~opts,
     )
 
-    Util_LambdaLogging.makeManagedLogGroup(
-      ~name=name ++ "StateTopicPublisher",
-      ~lambdaName=lambda.name,
-      ~tags=AWS.Tags.make(
-        ~name=name ++ "StateTopicPublisherLogGroup",
-        ~kind=ReventlessCore.QueryDb.componentType,
-        ~role=Logs,
-        ~component=name,
-      ),
-      ~opts,
-      (),
-    )
-
     // One EventSourceMapping per stream, all targeting the shared Lambda.
     // Retry posture: the handler throws on 5xx / network errors and logs-and-
     // continues on 4xx. `maximumRetryAttempts: 3` bounds the per-record

package/src/adapter/StateTopic/StateTopic_AppSync.res.mjs

@@ -90,6 +90,7 @@ function finish(eventsApi, opts) {
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/StateTopic/StateTopic_AppSync_Ops.res.mjs", packageDirs, undefined, false);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
   let appsyncEndpoint = AppSync_EventsApi$ReventlessAws.httpEndpoint(eventsApi);
+  let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "StateTopicPublisher", undefined, AWS_Tags$ReventlessAws.make(name + "StateTopicPublisherLogGroup", QueryDb$ReventlessCore.componentType, "Logs", undefined, name, undefined, undefined, undefined), opts, undefined);
   let lambda = new (Aws.lambda.Function)(name + "StateTopicPublisher", {
     handler: "index.handler",
     runtime: "nodejs22.x",
@@ -124,9 +125,9 @@ function finish(eventsApi, opts) {
         Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
-    sourceCodeHash: match.sourceCodeHash
+    sourceCodeHash: match.sourceCodeHash,
+    loggingConfig: Util_LambdaLogging$ReventlessAws.loggingConfigFor(logGroup)
   }, opts);
-  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "StateTopicPublisher", lambda.name, AWS_Tags$ReventlessAws.make(name + "StateTopicPublisherLogGroup", QueryDb$ReventlessCore.componentType, "Logs", undefined, name, undefined, undefined, undefined), opts, undefined);
   entries.forEach(entry => {
     let esmName = entry.topicName + "Stream2" + name + "StateTopic";
     new (Aws.lambda.EventSourceMapping)(esmName, {

package/src/adapter/Upload/Upload_Claim_S3.res

@@ -266,6 +266,20 @@ let finish = (
       ->Option.getOr([])
       ->Pulumi.Input.make
 
+    // Created before the function that writes to it — see
+    // `Util_LambdaLogging.makeManagedLogGroup` for why the ordering matters.
+    let logGroup = Util_LambdaLogging.makeManagedLogGroup(
+      ~name,
+      ~tags=AWS.Tags.make(
+        ~name=name ++ "LogGroup",
+        ~kind=ReventlessCore.ComponentType.Plugin,
+        ~role=Logs,
+        ~component=name,
+      ),
+      ~opts,
+      (),
+    )
+
     let lambda = Lambda.Function.make(
       ~name,
       ~args={
@@ -295,23 +309,11 @@ let finish = (
             ]),
           }: Lambda.Function.functionEnvironment
         )->Pulumi.Input.make,
+        loggingConfig: ?Util_LambdaLogging.loggingConfigFor(logGroup),
       },
       ~opts,
     )
 
-    Util_LambdaLogging.makeManagedLogGroup(
-      ~name,
-      ~lambdaName=lambda.name,
-      ~tags=AWS.Tags.make(
-        ~name=name ++ "LogGroup",
-        ~kind=ReventlessCore.ComponentType.Plugin,
-        ~role=Logs,
-        ~component=name,
-      ),
-      ~opts,
-      (),
-    )
-
     // One mapping per event log stream, all targeting the one Lambda.
     // `maximumRetryAttempts` bounds a permanently failing record so it cannot
     // wedge the shard — the default of -1 retries forever, which would turn one

package/src/adapter/Upload/Upload_Claim_S3.res.mjs

@@ -125,6 +125,7 @@ function finish(plugin, stores, iteratorAgeAlarmMsOpt, opts) {
     ]]);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Claim_S3_Ops.res.mjs", packageDirs, undefined, false);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name, undefined, AWS_Tags$ReventlessAws.make(name + "LogGroup", "Plugin", "Logs", undefined, name, undefined, undefined, undefined), opts, undefined);
   let lambda = new (Aws.lambda.Function)(name, {
     handler: "index.handler",
     runtime: "nodejs22.x",
@@ -159,9 +160,9 @@ function finish(plugin, stores, iteratorAgeAlarmMsOpt, opts) {
         Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
-    sourceCodeHash: match.sourceCodeHash
+    sourceCodeHash: match.sourceCodeHash,
+    loggingConfig: Util_LambdaLogging$ReventlessAws.loggingConfigFor(logGroup)
   }, opts);
-  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name, lambda.name, AWS_Tags$ReventlessAws.make(name + "LogGroup", "Plugin", "Logs", undefined, name, undefined, undefined, undefined), opts, undefined);
   entries.forEach((entry, i) => {
     let esmName = name + `Stream` + i.toString();
     new (Aws.lambda.EventSourceMapping)(esmName, {

package/src/adapter/Upload/Upload_Presign_S3.res

@@ -184,6 +184,20 @@ let make = (
     ->Option.getOr([])
     ->Pulumi.Input.make
 
+  // Created before the function that writes to it — see
+  // `Util_LambdaLogging.makeManagedLogGroup` for why the ordering matters.
+  let logGroup = Util_LambdaLogging.makeManagedLogGroup(
+    ~name=name ++ "Lambda",
+    ~tags=AWS.Tags.make(
+      ~name=name ++ "LambdaLogGroup",
+      ~kind=ReventlessCore.ComponentType.Platform,
+      ~role=Logs,
+      ~scope=Platform,
+    ),
+    ~opts,
+    (),
+  )
+
   let lambda = Lambda.Function.make(
     ~name=name ++ "Lambda",
     ~args={
@@ -213,23 +227,11 @@ let make = (
           ]),
         }: Lambda.Function.functionEnvironment
       )->Pulumi.Input.make,
+      loggingConfig: ?Util_LambdaLogging.loggingConfigFor(logGroup),
     },
     ~opts,
   )
 
-  Util_LambdaLogging.makeManagedLogGroup(
-    ~name=name ++ "Lambda",
-    ~lambdaName=lambda.name,
-    ~tags=AWS.Tags.make(
-      ~name=name ++ "LambdaLogGroup",
-      ~kind=ReventlessCore.ComponentType.Platform,
-      ~role=Logs,
-      ~scope=Platform,
-    ),
-    ~opts,
-    (),
-  )
-
   let dataSourceRole = IAM.Role.makeWithDefaultPolicy(
     ~name=name ++ "DataSource",
     ~servicePrincipal=AWS.AppSync.principal->Pulumi.Output.make,

package/src/adapter/Upload/Upload_Presign_S3.res.mjs

@@ -94,6 +94,7 @@ function make(api, stores, releaseWindowSecondsOpt, nameOpt, opts) {
     ]]);
   let match = Util_Bundle$ReventlessAws.buildCodeArchive("@reventlessdev/reventless-aws/src/adapter/Upload/Upload_Presign_S3_Ops.res.mjs", packageDirs, undefined, false);
   let layers = Stdlib_Option.getOr(Stdlib_Option.map(Lambda$PulumiAws.reventlessLayerArn, arn => [arn]), []);
+  let logGroup = Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", undefined, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let lambda = new (Aws.lambda.Function)(name + "Lambda", {
     handler: "index.handler",
     runtime: "nodejs22.x",
@@ -128,9 +129,9 @@ function make(api, stores, releaseWindowSecondsOpt, nameOpt, opts) {
         Util_LambdaLogging$ReventlessAws.logLevelEntry()
       ])
     },
-    sourceCodeHash: match.sourceCodeHash
+    sourceCodeHash: match.sourceCodeHash,
+    loggingConfig: Util_LambdaLogging$ReventlessAws.loggingConfigFor(logGroup)
   }, opts$1);
-  Util_LambdaLogging$ReventlessAws.makeManagedLogGroup(name + "Lambda", lambda.name, AWS_Tags$ReventlessAws.make(name + "LambdaLogGroup", "Platform", "Logs", "Platform", undefined, undefined, undefined, undefined), opts$1, undefined);
   let dataSourceRole = IAM$PulumiAws.Role.makeWithDefaultPolicy(name + "DataSource", Pulumi.output(AWS$ReventlessAws.AppSync.principal), AWS_Tags$ReventlessAws.make(name + "DataSource", "Platform", "Identity", "Platform", undefined, undefined, undefined, undefined), opts$1);
   Pulumi.all([
     lambda.arn,

package/src/components/Api/AppSync_Adapter.res

@@ -552,19 +552,23 @@ let _makeApiResourceWith = (
   // Managed log group with tiered retention for AppSync's own field-resolver logs,
   // which land in `/aws/appsync/apis/<id>` and otherwise live forever with no
   // retention. Managed on every stack by default (bar any in
-  // `unmanagedLogGroupStacks`), same as the Lambda groups. The name derives from
-  // the API id output so it matches the group AppSync writes to, and Pulumi
-  // therefore tears it down with the API.
+  // `unmanagedLogGroupStacks`), same as the Lambda groups.
+  //
+  // Unlike a Lambda's group this one cannot be created ahead of the resource that
+  // writes to it: the name comes from the API's server-assigned id, so the group
+  // is always second and any request the API serves in between creates it first.
+  // `Util_LogGroup_Adopting` is what makes losing that order survivable — it
+  // adopts an existing group rather than failing `ResourceAlreadyExists`.
   let stack = Pulumi.Pulumi.getStackName()
   let prodStacks = Util_HostUiDomain.resolveProdStacks()
   let unmanagedStacks = Util_LogRetention.parseUnmanagedStacks(
     Util_LocalConfig.get("unmanagedLogGroupStacks")->Option.getOr(""),
   )
   if Util_LogRetention.managesLogGroup(~stack, ~unmanagedStacks) {
-    let _ = Cloudwatch.LogGroup.make(
+    let _ = Util_LogGroup_Adopting.make(
       ~name=`${name}AppSyncLogGroup`,
-      ~args={
-        name: graphQLApi.id
+      ~props={
+        logGroupName: graphQLApi.id
         ->Pulumi.Output.apply(id => `/aws/appsync/apis/${id}`)
         ->Pulumi.Output.asInput,
         retentionInDays: Util_LogRetention.retentionDaysFor(
@@ -574,14 +578,14 @@ let _makeApiResourceWith = (
             Int.fromString(s)
           ),
         )->Pulumi.Input.make,
-        tags: AWS.Tags.make(
+        tags: AWS.Tags.makeDict(
           ~name=`${name}AppSyncLogGroup`,
           ~kind=ReventlessCore.ComponentType.Plugin,
           ~role=Logs,
           ~scope=Plugin,
-        ),
+        )->Pulumi.Input.make,
       },
-      ~opts=customOpts,
+      ~opts=Some(customOpts),
     )
   }
 

package/src/components/Api/AppSync_Adapter.res.mjs

@@ -21,6 +21,7 @@ import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core
 import * as Util_HostUiDomain$ReventlessAws from "../../util/Util_HostUiDomain.res.mjs";
 import * as Util_LogRetention$ReventlessAws from "../../util/Util_LogRetention.res.mjs";
 import * as AppSync_SdlDecorate$ReventlessAws from "./AppSync_SdlDecorate.res.mjs";
+import * as Util_LogGroup_Adopting$ReventlessAws from "../../util/Util_LogGroup_Adopting.res.mjs";
 import * as GraphQL_FragmentGenerator$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_FragmentGenerator.res.mjs";
 
 let log = Logger$ReventlessCore.fromEnv();
@@ -316,10 +317,10 @@ function _makeApiResourceWith(name, schema, userPoolConfig, opts) {
   let prodStacks = Util_HostUiDomain$ReventlessAws.resolveProdStacks();
   let unmanagedStacks = Util_LogRetention$ReventlessAws.parseUnmanagedStacks(Stdlib_Option.getOr(Util_LocalConfig$ReventlessAws.get("unmanagedLogGroupStacks"), ""));
   if (Util_LogRetention$ReventlessAws.managesLogGroup(stack, unmanagedStacks)) {
-    new (Aws.cloudwatch.LogGroup)(name + `AppSyncLogGroup`, {
-      name: graphQLApi.id.apply(id => `/aws/appsync/apis/` + id),
+    Util_LogGroup_Adopting$ReventlessAws.make(name + `AppSyncLogGroup`, {
+      logGroupName: graphQLApi.id.apply(id => `/aws/appsync/apis/` + id),
       retentionInDays: Util_LogRetention$ReventlessAws.retentionDaysFor(stack, prodStacks, Stdlib_Option.flatMap(Util_LocalConfig$ReventlessAws.get("logRetentionDays"), s => Stdlib_Int.fromString(s, undefined))),
-      tags: AWS_Tags$ReventlessAws.make(name + `AppSyncLogGroup`, "Plugin", "Logs", "Plugin", undefined, undefined, undefined, undefined)
+      tags: AWS_Tags$ReventlessAws.makeDict(name + `AppSyncLogGroup`, "Plugin", "Logs", "Plugin", undefined, undefined, undefined, undefined)
     }, customOpts);
   }
   return [