@reventlessdev/reventless-aws 3.0.0-alpha.337 → 3.0.0-alpha.338

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# 3.0.0-alpha.338 (2026-09-07)
+
+### Bug Fixes
+
+* **aws:** give the dead-letter handler a managed log group ([8631bd4](https://github.com/ReventlessDev/reventless-core/commit/8631bd457d168a5996c42e48db3c66d353bdda34))
+* **aws:** stop a dead letter from being redelivered every three minutes ([1ae3a06](https://github.com/ReventlessDev/reventless-core/commit/1ae3a0686003c05079214a4eeeb60a38fcb775af))
+* **aws:** the alarm backend stops wrapping Outputs in options ([476d974](https://github.com/ReventlessDev/reventless-core/commit/476d974223748024ae637b6cd5a6ebee95c21354))
+* **logging:** log a message's identity, not its serialisation ([cd7467a](https://github.com/ReventlessDev/reventless-core/commit/cd7467abdc59609279f16f358cdd8884cc49f063))
+* **ui:** a declared slot module is named, not only written ([de000ba](https://github.com/ReventlessDev/reventless-core/commit/de000baf428249f64cfc719ed52df3760198b82a))
+### Features
+
+* **aws:** alarm every execution unit a stack provisions ([46614af](https://github.com/ReventlessDev/reventless-core/commit/46614af92efb9596a09d3e7a15699712707b7ca6))
+* **ui:** a deployment can name the module that draws its own surfaces ([b43828c](https://github.com/ReventlessDev/reventless-core/commit/b43828ca50cddd31f7aefae016669fcb7c059838))
+
+
 # 3.0.0-alpha.337 (2026-09-04)
 
 * feat(spec)!: one optional encoding on the wire, with no annotation ([320f91d](https://github.com/ReventlessDev/reventless-core/commit/320f91daa8bd90812a6e82069e7a1cb473041930))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reventlessdev/reventless-aws",
-  "version": "3.0.0-alpha.337",
+  "version": "3.0.0-alpha.338",
   "description": "AWS adapters for Reventless",
   "license": "Apache-2.0",
   "bin": {
@@ -16,17 +16,17 @@
     "sury": "11.0.0-rc.2",
     "uuid": "^13.0.0",
     "@reventlessdev/rescript-aws-sdk": "3.0.0-alpha.15",
-    "@reventlessdev/rescript-node": "2.0.0-alpha.9",
-    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
     "@reventlessdev/rescript-effect": "0.1.0-alpha.32",
+    "@reventlessdev/rescript-jest": "1.0.0-alpha.10",
+    "@reventlessdev/rescript-node": "2.0.0-alpha.9",
     "@reventlessdev/rescript-pulumi-aws": "3.0.0-alpha.8",
     "@reventlessdev/rescript-pulumi-pulumi": "2.3.0-alpha.19",
-    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
-    "@reventlessdev/reventless-core": "3.0.0-alpha.256",
-    "@reventlessdev/reventless-infra": "3.0.0-alpha.157",
+    "@reventlessdev/reventless-core": "3.0.0-alpha.257",
+    "@reventlessdev/reventless-infra": "3.0.0-alpha.158",
     "@reventlessdev/reventless-interop": "3.0.0-alpha.35",
-    "@reventlessdev/reventless-postgres": "3.0.0-alpha.120",
-    "@reventlessdev/reventless-spec": "3.0.0-alpha.129"
+    "@reventlessdev/rescript-uuid": "2.0.0-alpha.0",
+    "@reventlessdev/reventless-postgres": "3.0.0-alpha.121",
+    "@reventlessdev/reventless-spec": "3.0.0-alpha.130"
   },
   "devDependencies": {
     "rescript": "12.3.0",

package/src/Platform.res

@@ -1172,6 +1172,18 @@ module MakeWithConfig = (
     // written; the shell treats the resulting 404 as "no hints" and boots
     // unchanged. Single-mode shape: one origin-relative file per deployment.
     uiHintsFile?: string,
+    // Optional ES module registering AutoUI slot renderers — the part of a
+    // surface that has to be drawn rather than said (a tile with the name over
+    // the picture, a card face in a different type scale). When set, the deploy
+    // reads it and writes it verbatim as a `ui-slots.js` BucketObject beside
+    // `config.json`. Unset ⇒ no file written; the shell treats the resulting 404
+    // as "no slots" and every mode draws its own regions.
+    //
+    // A module in the bundle's own origin rather than a fragment served from the
+    // admin API, because the registry has to be populated for *every* caller —
+    // including one served from a baked manifest, who issues no admin query and
+    // for whom federation overrides therefore never apply.
+    uiSlotsFile?: string,
     // Optional baked component manifest. Declared here so a deployment can state
     // it once; the emission that writes the file is not wired on this platform
     // yet, and a declaration without it writes nothing.
@@ -2090,11 +2102,16 @@ module MakeWithConfig = (
         ~stableName=true,
         // The explicit BucketObjects below write the production config.json
         // (resolved API endpoints + Cognito IDs) and, when configured, a
-        // ui-hints.json. The host-shell bundle's public/config.json and
-        // public/ui-hints.json are dev-mode fallbacks — exclude them from the
-        // bundle upload so the explicit BucketObjects don't race the bundle on
-        // the same S3 keys.
-        ~excludeFiles=["config.json", "ui-hints.json"],
+        // ui-hints.json and a ui-slots.js. The host-shell bundle's
+        // public/config.json and public/ui-hints.json are dev-mode fallbacks —
+        // exclude them from the bundle upload so the explicit BucketObjects
+        // don't race the bundle on the same S3 keys.
+        //
+        // `ui-slots.js` is excluded on the same rule though the shell ships no
+        // such file today, and that is the point: were one ever added, it would
+        // be a fallback for *appearance*, and a deployment inheriting a
+        // stranger's appearance is exactly the failure that is hard to notice.
+        ~excludeFiles=["config.json", "ui-hints.json", ReventlessCore.Platform_UiSlots.fileName],
         ~customDomain?,
         // Served buckets front the host-shell distribution with `{prefix}/*`
         // read paths (private, OAC-read) — same origin as the SPA, so served
@@ -2297,6 +2314,7 @@ module MakeWithConfig = (
             ~computed=withEvents,
             ~viewModes=?cfg.viewModes,
             ~bakedManifest=?cfg.bakedManifest,
+            ~uiSlotsFile=?cfg.uiSlotsFile,
             ~shellConfig=?cfg.shellConfig,
           )
           ->JSON.Encode.object
@@ -2336,6 +2354,42 @@ module MakeWithConfig = (
         )
       }
 
+      // Optional AutoUI slot renderers. Read verbatim and written beside the
+      // hints file above — same seam, one file over, and the same rule that an
+      // undeclared deployment writes nothing.
+      //
+      // Unlike the hints there is no content check at deploy time, because there
+      // is no cheap one (see `readFileVerbatim`): a module is known to be good
+      // once a browser has evaluated it. What the deploy owes instead is a
+      // correct content type, which is the difference between the shell
+      // importing this file and the shell refusing it — a module served as
+      // `application/octet-stream` is blocked before it is read.
+      //
+      // Same origin as the bundle, deliberately: it rides this distribution, so
+      // no CSP relaxation is involved and none is configured (this deploy sets
+      // no response-headers policy at all). A slots file that loads locally and
+      // silently fails on AWS is the worst shape this can take, and cross-origin
+      // is how it would take it.
+      switch cfg.uiSlotsFile {
+      | None => ()
+      | Some(slotsPath) =>
+        let slotsContent = Util_StaticBundle.readFileVerbatim(
+          ~path=slotsPath,
+          ~label="host-ui ui-slots",
+        )
+        let _ = PulumiAws.S3.BucketObject.make(
+          ~name="host-ui-ui-slots-js",
+          ~args={
+            bucket: bucketName->Pulumi.Output.asInput,
+            // The same string the `uiSlotsUrl` above points at — see
+            // `Platform_UiSlots` for why it is stated once.
+            key: Pulumi.Input.make(ReventlessCore.Platform_UiSlots.fileName),
+            content: Pulumi.Input.make(slotsContent),
+            contentType: Pulumi.Input.make("application/javascript; charset=utf-8"),
+          },
+        )
+      }
+
       // The bake's write, granted here because here is where both facts are
       // known: which bucket serves the shell, and that this deployment declared a
       // manifest at all. Scoped to the one key the deploy told the shell to fetch

package/src/Platform.res.mjs

@@ -51,6 +51,7 @@ import * as AppSync_EventsApi$ReventlessAws from "./adapter/Api/AppSync_EventsAp
 import * as AppSync_MergedApi$ReventlessAws from "./components/Api/AppSync_MergedApi.res.mjs";
 import * as GraphQL_Stitcher$ReventlessCore from "@reventlessdev/reventless-core/src/components/Api/GraphQL_Stitcher.res.mjs";
 import * as NoEventMappings$ReventlessInfra from "@reventlessdev/reventless-infra/src/types/NoEventMappings.res.mjs";
+import * as Platform_UiSlots$ReventlessCore from "@reventlessdev/reventless-core/src/admin/Platform_UiSlots.res.mjs";
 import * as Upload_Presign_S3$ReventlessAws from "./adapter/Upload/Upload_Presign_S3.res.mjs";
 import * as Util_HostUiDomain$ReventlessAws from "./util/Util_HostUiDomain.res.mjs";
 import * as Util_StaticBundle$ReventlessAws from "./util/Util_StaticBundle.res.mjs";
@@ -1145,7 +1146,8 @@ function MakeWithConfig(Config) {
       ).concat(declaredServedBuckets);
       let match$4 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot(true, "@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
         "config.json",
-        "ui-hints.json"
+        "ui-hints.json",
+        Platform_UiSlots$ReventlessCore.fileName
       ], customDomain, servedBuckets);
       let bucketName = match$4.bucketName;
       let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
@@ -1247,7 +1249,7 @@ function MakeWithConfig(Config) {
               AppSync_EventsApi$ReventlessAws.clientNamespaceName
             ]
           ]) : computed;
-        return JSON.stringify(Util_ShellConfig$ReventlessAws.fields(withEvents, hostUiBundle.viewModes, hostUiBundle.bakedManifest, hostUiBundle.shellConfig));
+        return JSON.stringify(Util_ShellConfig$ReventlessAws.fields(withEvents, hostUiBundle.viewModes, hostUiBundle.bakedManifest, hostUiBundle.uiSlotsFile, hostUiBundle.shellConfig));
       });
       new (Aws.s3.BucketObject)("host-ui-config-json", {
         bucket: bucketName,
@@ -1265,6 +1267,16 @@ function MakeWithConfig(Config) {
           contentType: "application/json"
         });
       }
+      let slotsPath = hostUiBundle.uiSlotsFile;
+      if (slotsPath !== undefined) {
+        let slotsContent = Util_StaticBundle$ReventlessAws.readFileVerbatim(slotsPath, "host-ui ui-slots");
+        new (Aws.s3.BucketObject)("host-ui-ui-slots-js", {
+          bucket: bucketName,
+          key: Platform_UiSlots$ReventlessCore.fileName,
+          content: slotsContent,
+          contentType: "application/javascript; charset=utf-8"
+        });
+      }
       let match$9 = hostUiBundle.bakedManifest;
       if (componentDefinitions !== undefined && match$9 !== undefined) {
         let manifestKeys = Platform_BakedManifest$ReventlessCore.files(match$9).map(param => param[0]);
@@ -2506,7 +2518,8 @@ function Make($star) {
       ).concat(declaredServedBuckets);
       let match$4 = Plugin_Stack$ReventlessAws.makeUiBundleDistribution("host-ui", Stdlib_Option.getOr(hostUiBundle.bundleVersion, version), Stdlib_Option.getOr(hostUiBundle.assetsDir, Util_Bundle$ReventlessAws.resolvePackageRoot(true, "@reventlessdev/reventless-host-shell") + "/dist"), true, undefined, true, [
         "config.json",
-        "ui-hints.json"
+        "ui-hints.json",
+        Platform_UiSlots$ReventlessCore.fileName
       ], customDomain, servedBuckets);
       let bucketName = match$4.bucketName;
       let regionStr = Stdlib_Option.getOr(new Pulumi.Config("aws").get("region"), "unknown");
@@ -2608,7 +2621,7 @@ function Make($star) {
               AppSync_EventsApi$ReventlessAws.clientNamespaceName
             ]
           ]) : computed;
-        return JSON.stringify(Util_ShellConfig$ReventlessAws.fields(withEvents, hostUiBundle.viewModes, hostUiBundle.bakedManifest, hostUiBundle.shellConfig));
+        return JSON.stringify(Util_ShellConfig$ReventlessAws.fields(withEvents, hostUiBundle.viewModes, hostUiBundle.bakedManifest, hostUiBundle.uiSlotsFile, hostUiBundle.shellConfig));
       });
       new (Aws.s3.BucketObject)("host-ui-config-json", {
         bucket: bucketName,
@@ -2626,6 +2639,16 @@ function Make($star) {
           contentType: "application/json"
         });
       }
+      let slotsPath = hostUiBundle.uiSlotsFile;
+      if (slotsPath !== undefined) {
+        let slotsContent = Util_StaticBundle$ReventlessAws.readFileVerbatim(slotsPath, "host-ui ui-slots");
+        new (Aws.s3.BucketObject)("host-ui-ui-slots-js", {
+          bucket: bucketName,
+          key: Platform_UiSlots$ReventlessCore.fileName,
+          content: slotsContent,
+          contentType: "application/javascript; charset=utf-8"
+        });
+      }
       let match$9 = hostUiBundle.bakedManifest;
       if (componentDefinitions !== undefined && match$9 !== undefined) {
         let manifestKeys = Platform_BakedManifest$ReventlessCore.files(match$9).map(param => param[0]);

package/src/adapter/Monitoring/Monitoring_CloudWatch.res

@@ -0,0 +1,197 @@
+// A CloudWatch alarm on every execution unit the framework provisions.
+//
+// Monitoring is deliberately not a framework concern — core announces a unit
+// through the `Monitoring` seam and says nothing about what to do with it (see
+// docs/plans/done/monitoring-hook-seam.md). This is one backend for that seam,
+// living here rather than in core because it is provider-native to the bone:
+// CloudWatch metrics, an SNS topic, an AWS notion of what "failing" means.
+//
+// It exists because the stacks this repo deploys itself had nothing attached, and
+// those are the stacks where framework defects surface first — a wedged aggregate
+// went unnoticed for twelve hours and was found by reading a bill. See
+// docs/plans/no-monitoring-backend-on-deployed-stacks.md.
+//
+// A deploy program opts in with one line, before it builds its platform:
+//
+//     ReventlessAws.Monitoring_CloudWatch.use()
+//
+// and the deployment decides whether that line does anything:
+//
+//     alarmEmail                 ops@example.com   creates a topic + email subscription
+//     alarmTopicArn              arn:aws:sns:...   publishes to a topic that exists
+//     alarmSilenceWindowSeconds  3600              how long a scheduler may be quiet
+//
+// With neither address configured the backend provisions nothing at all, so a
+// stack that has not opted in deploys byte-identical to one built without this
+// module. That is what makes `use()` safe to commit unconditionally.
+//
+// Each key is read through `Util_LocalConfig` first — `REVENTLESS_ALARM_EMAIL` in
+// CI, a gitignored `Pulumi.local.yaml` on a workstation — before the stack's own
+// `platform:` config. Where alerts go is per-deployment and often personal, and a
+// tracked `Pulumi.<stack>.yaml` in a public repository is the wrong place for
+// somebody's inbox.
+open PulumiAws
+
+module M = ReventlessCore.Monitoring
+
+// Local override first (env var, then the gitignored sidecar), then stack config.
+let configured = (key: string): option<string> =>
+  switch Util_LocalConfig.get(key) {
+  | Some(_) as local => local
+  | None => Pulumi.Config.make(Some("platform"))->Pulumi.Config.get(key)
+  }
+
+let configuredEmail = () => configured("alarmEmail")
+let configuredTopicArn = () => configured("alarmTopicArn")
+
+let silenceWindowSeconds = () =>
+  configured("alarmSilenceWindowSeconds")
+  ->Option.flatMap(Int.fromString(_))
+  ->Option.getOr(Util_AlarmSpec.defaultSilenceWindowSeconds)
+
+let topicName = "ReventlessAlarms"
+
+// The memo's three states, spelled as a variant rather than an option: an
+// `option<Pulumi.Output.t<_>>` is banned repo-wide because an Output is a Proxy
+// that answers ReScript's nested-option probe, so one generic combinator on it
+// silently yields None. "Not asked yet" and "asked, nothing configured" are
+// distinct here anyway, which an option cannot say.
+type topic =
+  | Unresolved
+  | NoTopic
+  | Topic(Pulumi.Output.t<string>)
+
+// Resolved once, on the first alarm — so a stack that provisions no units, or one
+// that has not configured an address, creates no topic either.
+let resolvedTopic: ref<topic> = ref(Unresolved)
+
+// An ARN the stack already owns wins over creating one: an estate with somewhere
+// for alerts to go (a chat relay, a pager, one topic shared by several stacks)
+// should point at it rather than accumulate a topic per stack that nobody reads.
+let ensureTopicArn = (): topic =>
+  switch resolvedTopic.contents {
+  | Topic(_) as resolved => resolved
+  | NoTopic => NoTopic
+  | Unresolved =>
+    let resolved = switch (configuredTopicArn(), configuredEmail()) {
+    | (Some(arn), _) => Topic(arn->Pulumi.Output.make)
+    | (None, Some(email)) =>
+      let topic = SNS.Topic.make(
+        ~name=topicName,
+        ~args={
+          SNS.Topic.tags: AWS.Tags.make(
+            ~name=topicName,
+            ~kind=ReventlessCore.ComponentType.Plugin,
+            ~role=Other("Alarm"),
+            ~scope=Plugin,
+          ),
+        },
+      )
+      let _subscription = SNS.TopicSubscription.make(
+        ~name=topicName ++ "Email",
+        ~args={
+          endpoint: email->Pulumi.Input.make,
+          topic: topic.arn->Pulumi.Output.asInput,
+          protocol: Email,
+        },
+        ~opts=None,
+      )
+      Topic(topic.arn)
+    | (None, None) => NoTopic
+    }
+    resolvedTopic := resolved
+    resolved
+  }
+
+let alarmFor = (
+  ~spec: Util_AlarmSpec.t,
+  ~kind: M.unitKind,
+  ~name: string,
+  ~component: ReventlessInfra.Adapter.resource,
+  ~plugin: option<string>,
+  ~platform: option<string>,
+  ~logLocator: Pulumi.Output.t<string>,
+  ~topicArn: Pulumi.Output.t<string>,
+) => {
+  let resourceName = Util_AlarmSpec.resourceName(~kind, ~name, ~plugin, ~suffix=spec.suffix)
+  let actions = [topicArn->Pulumi.Output.asInput]->Pulumi.Input.make
+
+  // The description is the only field a state-change message carries, so it is
+  // also where the log group goes — an alert names the unit and the metric and
+  // never where to read what happened. `~logLocator` is an Output, so the whole
+  // description resolves late; `""` is a unit with no logs of its own.
+  let describe = logs =>
+    Util_AlarmSpec.description(~kind, ~name, ~plugin, ~platform, ~spec, ~logs)
+  let alarmDescription =
+    logLocator
+    ->Pulumi.Output.map(g => describe(g == "" ? None : Some(g)))
+    ->Pulumi.Output.asInput
+
+  Cloudwatch.MetricAlarm.make(
+    ~name=resourceName,
+    ~args={
+      comparisonOperator: spec.comparisonOperator->Pulumi.Input.make,
+      evaluationPeriods: spec.evaluationPeriods->Pulumi.Input.make,
+      metricName: spec.metricName->Pulumi.Input.make,
+      namespace: spec.namespace->Pulumi.Input.make,
+      period: spec.period->Pulumi.Input.make,
+      statistic: spec.statistic->Pulumi.Input.make,
+      threshold: spec.threshold->Pulumi.Input.make,
+      // Every unit this seam announces on AWS is a Lambda function, which is what
+      // makes one dimension enough. A future non-Lambda execution unit needs the
+      // namespace and dimension to come from the announcement rather than from here.
+      dimensions: component.name
+      ->Pulumi.Output.apply(fn => Dict.fromArray([("FunctionName", fn)]))
+      ->Pulumi.Output.asInput,
+      treatMissingData: spec.treatMissingData->Pulumi.Input.make,
+      alarmActions: actions,
+      // Without these the channel reports every incident and no recovery, and a
+      // reader cannot tell an ongoing outage from one that cleared minutes later.
+      okActions: actions,
+      alarmDescription,
+      tags: AWS.Tags.make(
+        ~name=resourceName,
+        ~kind=ReventlessCore.ComponentType.Plugin,
+        ~role=Other("Alarm"),
+        ~component=name,
+        ~plugin?,
+        ~platform?,
+      ),
+    },
+  )
+}
+
+module Backend: M.Backend = {
+  let onProvisioned = (~kind, ~name, ~component, ~plugin, ~platform, ~logLocator) => {
+    // The seam hands the log address as an option; collapse it here, at the one
+    // boundary that has to, so no `option<Pulumi.Output.t<_>>` travels further.
+    let logLocator = switch logLocator {
+    | Some(locator) => locator
+    | None => ""->Pulumi.Output.make
+    }
+    switch ensureTopicArn() {
+    | Unresolved | NoTopic => ()
+    | Topic(topicArn) =>
+      Util_AlarmSpec.forKind(~kind, ~silenceWindowSeconds=silenceWindowSeconds())->Array.forEach(
+        spec => {
+          let _alarm = alarmFor(
+            ~spec,
+            ~kind,
+            ~name,
+            ~component,
+            ~plugin,
+            ~platform,
+            ~logLocator,
+            ~topicArn,
+          )
+        },
+      )
+    }
+  }
+}
+
+/** Register this backend. Call it before building the platform — announcements
+    made earlier still arrive, because the seam holds them until someone
+    registers, but resources this creates must belong to the deploy program's own
+    run. Safe on a stack that configures no address: it provisions nothing. */
+let use = () => M.use(module(Backend: M.Backend))

package/src/adapter/Monitoring/Monitoring_CloudWatch.res.mjs

@@ -0,0 +1,144 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Stdlib_Int from "@rescript/runtime/lib/es6/Stdlib_Int.js";
+import * as Aws from "@pulumi/aws";
+import * as Output$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Output.res.mjs";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as AWS_Tags$ReventlessAws from "../AWS_Tags.res.mjs";
+import * as Monitoring$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Monitoring/Monitoring.res.mjs";
+import * as Util_AlarmSpec$ReventlessAws from "../../util/Util_AlarmSpec.res.mjs";
+import * as Util_LocalConfig$ReventlessAws from "../../util/Util_LocalConfig.res.mjs";
+
+function configured(key) {
+  let local = Util_LocalConfig$ReventlessAws.get(key);
+  if (local !== undefined) {
+    return local;
+  } else {
+    return new Pulumi.Config("platform").get(key);
+  }
+}
+
+function configuredEmail() {
+  return configured("alarmEmail");
+}
+
+function configuredTopicArn() {
+  return configured("alarmTopicArn");
+}
+
+function silenceWindowSeconds() {
+  return Stdlib_Option.getOr(Stdlib_Option.flatMap(configured("alarmSilenceWindowSeconds"), __x => Stdlib_Int.fromString(__x, undefined)), Util_AlarmSpec$ReventlessAws.defaultSilenceWindowSeconds);
+}
+
+let topicName = "ReventlessAlarms";
+
+let resolvedTopic = {
+  contents: "Unresolved"
+};
+
+function ensureTopicArn() {
+  let resolved = resolvedTopic.contents;
+  if (typeof resolved === "object") {
+    return resolved;
+  }
+  if (resolved !== "Unresolved") {
+    return "NoTopic";
+  }
+  let match = configured("alarmTopicArn");
+  let match$1 = configured("alarmEmail");
+  let resolved$1;
+  if (match !== undefined) {
+    resolved$1 = {
+      TAG: "Topic",
+      _0: Pulumi.output(match)
+    };
+  } else if (match$1 !== undefined) {
+    let topic = new (Aws.sns.Topic)(topicName, {
+      tags: AWS_Tags$ReventlessAws.make(topicName, "Plugin", {
+        TAG: "Other",
+        _0: "Alarm"
+      }, "Plugin", undefined, undefined, undefined, undefined)
+    });
+    new (Aws.sns.TopicSubscription)(topicName + "Email", {
+      endpoint: match$1,
+      topic: topic.arn,
+      protocol: "email"
+    }, undefined);
+    resolved$1 = {
+      TAG: "Topic",
+      _0: topic.arn
+    };
+  } else {
+    resolved$1 = "NoTopic";
+  }
+  resolvedTopic.contents = resolved$1;
+  return resolved$1;
+}
+
+function alarmFor(spec, kind, name, component, plugin, platform, logLocator, topicArn) {
+  let resourceName = Util_AlarmSpec$ReventlessAws.resourceName(kind, name, plugin, spec.suffix);
+  let actions = [topicArn];
+  let alarmDescription = Output$Pulumi.map(logLocator, g => {
+    let logs = g === "" ? undefined : g;
+    return Util_AlarmSpec$ReventlessAws.description(kind, name, plugin, platform, spec, logs);
+  });
+  return new (Aws.cloudwatch.MetricAlarm)(resourceName, {
+    comparisonOperator: spec.comparisonOperator,
+    evaluationPeriods: spec.evaluationPeriods,
+    metricName: spec.metricName,
+    namespace: spec.namespace,
+    period: spec.period,
+    statistic: spec.statistic,
+    threshold: spec.threshold,
+    dimensions: component.name.apply(fn => Object.fromEntries([[
+        "FunctionName",
+        fn
+      ]])),
+    treatMissingData: spec.treatMissingData,
+    alarmActions: actions,
+    okActions: actions,
+    alarmDescription: alarmDescription,
+    tags: AWS_Tags$ReventlessAws.make(resourceName, "Plugin", {
+      TAG: "Other",
+      _0: "Alarm"
+    }, undefined, name, undefined, plugin, platform)
+  });
+}
+
+function onProvisioned(kind, name, component, plugin, platform, logLocator) {
+  let logLocator$1 = logLocator !== undefined ? logLocator : Pulumi.output("");
+  let topicArn = ensureTopicArn();
+  if (typeof topicArn !== "object") {
+    return;
+  }
+  let topicArn$1 = topicArn._0;
+  Util_AlarmSpec$ReventlessAws.forKind(kind, silenceWindowSeconds()).forEach(spec => {
+    alarmFor(spec, kind, name, component, plugin, platform, logLocator$1, topicArn$1);
+  });
+}
+
+let Backend = {
+  onProvisioned: onProvisioned
+};
+
+function use() {
+  Monitoring$ReventlessCore.use(Backend);
+}
+
+let M;
+
+export {
+  M,
+  configured,
+  configuredEmail,
+  configuredTopicArn,
+  silenceWindowSeconds,
+  topicName,
+  resolvedTopic,
+  ensureTopicArn,
+  alarmFor,
+  Backend,
+  use,
+}
+/* @pulumi/aws Not a pure module */

package/src/adapter/QueryEngine/QueryEngine_DynamoDb.res

@@ -98,7 +98,11 @@ let queryByTableName = (
       limit,
     }
   }
-  ReventlessCore.EffectLogger.logDebug(~comp=__MODULE__, "queryByTableName params: " ++ params->JSON.stringifyAny->Option.getOr(""))
+  ReventlessCore.EffectLogger.logDebug(
+    ~comp=__MODULE__,
+    "queryByTableName params: " ++
+    params->JSON.stringifyAny->Option.getOr("")->ReventlessCore.LogFormat.truncate,
+  )
   ->Effect.flatMap(_ =>
     Util_DynamoDb_Runtime.queryStream(params)
     ->Stream.runCollect
@@ -130,7 +134,11 @@ let scanByTableName = (~tableName, ~filterConfigs, ~limit) => {
     expressionAttributeValues: ?attributeValues,
     limit,
   }
-  ReventlessCore.EffectLogger.logDebug(~comp=__MODULE__, "scanByTableName params: " ++ params->JSON.stringifyAny->Option.getOr(""))
+  ReventlessCore.EffectLogger.logDebug(
+    ~comp=__MODULE__,
+    "scanByTableName params: " ++
+    params->JSON.stringifyAny->Option.getOr("")->ReventlessCore.LogFormat.truncate,
+  )
   ->Effect.flatMap(_ =>
     Util_DynamoDb_Runtime.scanStream(params)
     ->Stream.runCollect

package/src/adapter/QueryEngine/QueryEngine_DynamoDb.res.mjs

@@ -8,6 +8,7 @@ import * as Effect from "effect/Effect";
 import * as Pulumi from "@pulumi/pulumi";
 import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
 import * as Adapter$ReventlessCore from "@reventlessdev/reventless-core/src/adapter/Adapter.res.mjs";
+import * as LogFormat$ReventlessCore from "@reventlessdev/reventless-core/src/util/LogFormat.res.mjs";
 import * as EffectLogger$ReventlessCore from "@reventlessdev/reventless-core/src/util/EffectLogger.res.mjs";
 import * as Util_DynamoDb$ReventlessAws from "../../util/Util_DynamoDb.res.mjs";
 import * as DynamoDb_Error$ReventlessAws from "../../errors/DynamoDb_Error.res.mjs";
@@ -166,7 +167,7 @@ function queryByTableName(tableName, keyOpt, id, subIdConfig, filterConfigsOpt,
     Limit: params_Limit,
     ScanIndexForward: params_ScanIndexForward
   };
-  return Effect.runPromise(Effect.flatMap(EffectLogger$ReventlessCore.logDebug("QueryEngine_DynamoDb-ReventlessAws", undefined, "queryByTableName params: " + Stdlib_Option.getOr(JSON.stringify(params), "")), () => Effect.catchAll(Effect.map(Stream.runCollect(Util_DynamoDb_Runtime$ReventlessAws.queryStream(params)), items => items.map(js => JSON.parse(JSON.stringify(js)))), err => {
+  return Effect.runPromise(Effect.flatMap(EffectLogger$ReventlessCore.logDebug("QueryEngine_DynamoDb-ReventlessAws", undefined, "queryByTableName params: " + LogFormat$ReventlessCore.truncate(Stdlib_Option.getOr(JSON.stringify(params), ""))), () => Effect.catchAll(Effect.map(Stream.runCollect(Util_DynamoDb_Runtime$ReventlessAws.queryStream(params)), items => items.map(js => JSON.parse(JSON.stringify(js)))), err => {
     let msg = DynamoDb_Error$ReventlessAws.message(err);
     return Effect.map(EffectLogger$ReventlessCore.logError("QueryEngine_DynamoDb-ReventlessAws", undefined, "queryByTableName: " + msg), () => []);
   })));
@@ -196,7 +197,7 @@ function scanByTableName(tableName, filterConfigs, limit) {
     FilterExpression: params_FilterExpression,
     Limit: params_Limit
   };
-  return Effect.runPromise(Effect.flatMap(EffectLogger$ReventlessCore.logDebug("QueryEngine_DynamoDb-ReventlessAws", undefined, "scanByTableName params: " + Stdlib_Option.getOr(JSON.stringify(params), "")), () => Effect.catchAll(Effect.map(Stream.runCollect(Util_DynamoDb_Runtime$ReventlessAws.scanStream(params)), items => items.map(js => JSON.parse(JSON.stringify(js)))), err => {
+  return Effect.runPromise(Effect.flatMap(EffectLogger$ReventlessCore.logDebug("QueryEngine_DynamoDb-ReventlessAws", undefined, "scanByTableName params: " + LogFormat$ReventlessCore.truncate(Stdlib_Option.getOr(JSON.stringify(params), ""))), () => Effect.catchAll(Effect.map(Stream.runCollect(Util_DynamoDb_Runtime$ReventlessAws.scanStream(params)), items => items.map(js => JSON.parse(JSON.stringify(js)))), err => {
     let msg = DynamoDb_Error$ReventlessAws.message(err);
     return Effect.map(EffectLogger$ReventlessCore.logError("QueryEngine_DynamoDb-ReventlessAws", undefined, "scanByTableName: " + msg), () => []);
   })));