@go-to-k/cdkd 0.219.8 → 0.220.0

package/dist/{deploy-engine-Bl8wyosc.js → deploy-engine-CFaK71E9.js}

@@ -5,7 +5,7 @@ import { DeleteObjectCommand, GetBucketLocationCommand, GetObjectCommand, HeadBu
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
 import { AttachRolePolicyCommand, CreateRoleCommand, DeleteRoleCommand, DeleteRolePermissionsBoundaryCommand, DeleteRolePolicyCommand, DetachRolePolicyCommand, GetRoleCommand, GetRolePolicyCommand, IAMClient, ListAttachedRolePoliciesCommand, ListInstanceProfilesForRoleCommand, ListRolePoliciesCommand, ListRoleTagsCommand, ListRolesCommand, NoSuchEntityException, PutRolePermissionsBoundaryCommand, PutRolePolicyCommand, RemoveRoleFromInstanceProfileCommand, TagRoleCommand, UntagRoleCommand, UpdateAssumeRolePolicyCommand, UpdateRoleCommand } from "@aws-sdk/client-iam";
 import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
-import { GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
+import { GetFunctionCommand, GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctionConfigurationCommand, waitUntilFunctionActiveV2, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client } from "@aws-sdk/client-ec2";
 import { DescribeTableCommand } from "@aws-sdk/client-dynamodb";
@@ -3383,6 +3383,60 @@ var S3StateBackend = class {
 		}
 	}
 	/**
+	* Raw sidecar-object write under the state bucket. Used for non-state
+	* auxiliary files that share the bucket + region-resolution plumbing
+	* (e.g. deployment-event JSONL streams + their `index.json`, issue
+	* #808) without going through the state-schema validation that
+	* `saveState` applies. No optimistic locking — callers own their key
+	* uniqueness / last-writer-wins semantics.
+	*/
+	async putRawObject(key, body, contentType = "application/json") {
+		await this.ensureClientForBucket();
+		await this.s3Client.send(new PutObjectCommand({
+			Bucket: this.config.bucket,
+			Key: key,
+			Body: body,
+			ContentLength: Buffer.byteLength(body),
+			ContentType: contentType
+		}));
+	}
+	/**
+	* Raw sidecar-object read under the state bucket. Returns `null` when
+	* the key does not exist; other errors propagate.
+	*/
+	async getRawObject(key) {
+		await this.ensureClientForBucket();
+		try {
+			return await (await this.s3Client.send(new GetObjectCommand({
+				Bucket: this.config.bucket,
+				Key: key
+			}))).Body?.transformToString() ?? null;
+		} catch (error) {
+			if (isNoSuchKey(error) || error.name === "NotFound") return null;
+			throw error;
+		}
+	}
+	/**
+	* Raw key listing under an arbitrary key prefix in the state bucket
+	* (paginated). Used by `cdkd events` to discover regions / runs under
+	* `{prefix}/{stackName}/.../deployments/`.
+	*/
+	async listRawKeys(keyPrefix) {
+		await this.ensureClientForBucket();
+		const keys = [];
+		let continuationToken;
+		do {
+			const response = await this.s3Client.send(new ListObjectsV2Command({
+				Bucket: this.config.bucket,
+				Prefix: keyPrefix,
+				...continuationToken && { ContinuationToken: continuationToken }
+			}));
+			for (const obj of response.Contents ?? []) if (obj.Key) keys.push(obj.Key);
+			continuationToken = response.IsTruncated ? response.NextContinuationToken : void 0;
+		} while (continuationToken);
+		return keys;
+	}
+	/**
 	* HeadObject probe — returns true on 200, false on NotFound. Other errors
 	* propagate so we don't accidentally swallow IAM denials.
 	*/
@@ -7539,6 +7593,10 @@ var CustomResourceProvider = class CustomResourceProvider {
 			return;
 		}
 		if (typeof serviceToken !== "string") throw new ProvisioningError(`Custom Resource ${logicalId}: ServiceToken is not a resolved string ARN (got ${typeof serviceToken}). This usually indicates state was written by a pre-fix cdkd import; re-run \`cdkd import\` or \`cdkd state orphan <stack>\` to recover.`, resourceType, logicalId, physicalId);
+		if (!this.isSnsServiceToken(serviceToken) && await this.isBackingLambdaGone(serviceToken)) {
+			this.logger.warn(`Backing Lambda for custom resource ${logicalId} no longer exists (${serviceToken}); treating the custom resource as already deleted`);
+			return;
+		}
 		try {
 			const cfnResponse = await this.invokeCustomResourceWithRetry(serviceToken, logicalId, "Delete", (invocation) => ({
 				RequestType: "Delete",
@@ -7563,6 +7621,25 @@ var CustomResourceProvider = class CustomResourceProvider {
 		return serviceToken.startsWith("arn:aws:sns:");
 	}
 	/**
+	* Single GetFunction probe used by the delete path's fail-fast pre-check
+	* (issue #804). Returns true ONLY on a definitive
+	* `ResourceNotFoundException` — the one signal that proves the backing
+	* Lambda is gone and the delete handler can never run. Any other failure
+	* (throttle, IAM denial, network) is inconclusive: fall through to the
+	* normal invoke path, which has its own error handling and the lenient
+	* delete catch.
+	*/
+	async isBackingLambdaGone(serviceToken) {
+		try {
+			await this.lambdaClient.send(new GetFunctionCommand({ FunctionName: serviceToken }));
+			return false;
+		} catch (error) {
+			if (error.name === "ResourceNotFoundException") return true;
+			this.logger.debug(`GetFunction pre-check for ${serviceToken} failed inconclusively (${error instanceof Error ? error.message : String(error)}); proceeding with the normal delete invoke`);
+			return false;
+		}
+	}
+	/**
 	* Invoke a custom resource, retrying on a *transient IAM-authorization*
 	* FAILED response.
 	*
@@ -11026,6 +11103,37 @@ var DagExecutor = class {
 	}
 };
 
+//#endregion
+//#region src/types/deployment-events.ts
+/**
+* Walk an error's `.cause` chain (bounded) and extract metadata for a
+* deployment event. The outermost error supplies `name` / `message`
+* (matching what the user sees in the log); the innermost AWS-SDK-shaped
+* error (the one carrying `$metadata`) supplies `awsErrorCode` /
+* `requestId` when present.
+*/
+function extractDeploymentEventError(err) {
+	if (!(err instanceof Error)) return {
+		name: "UnknownError",
+		message: String(err)
+	};
+	const result = {
+		name: err.name || "Error",
+		message: err.message
+	};
+	let current = err;
+	for (let depth = 0; depth < 10 && current instanceof Error; depth++) {
+		const maybeAws = current;
+		if (maybeAws.$metadata !== void 0) {
+			const code = maybeAws.Code ?? maybeAws.name;
+			if (code) result.awsErrorCode = code;
+			if (maybeAws.$metadata.requestId) result.requestId = maybeAws.$metadata.requestId;
+		}
+		current = current.cause;
+	}
+	return result;
+}
+
 //#endregion
 //#region src/analyzer/implicit-delete-deps.ts
 /**
@@ -11902,25 +12010,33 @@ var DeployEngine = class {
 	* information from state, then processes UPDATE/DELETE rollbacks, and finally
 	* processes sorted CREATE rollback deletions.
 	*/
-	async performRollback(completedOperations, stateResources, _stackName) {
+	async performRollback(completedOperations, stateResources, stackName) {
 		if (completedOperations.length === 0) {
 			this.logger.info("No completed operations to roll back.");
 			return;
 		}
 		this.logger.info(`Rolling back ${completedOperations.length} completed operation(s)...`);
+		this.recordEvent({
+			eventType: "ROLLBACK_STARTED",
+			stackName
+		});
 		const createOps = [];
 		const otherOps = [];
 		for (const op of completedOperations) if (op.changeType === "CREATE") createOps.push(op);
 		else otherOps.push(op);
 		for (let i = otherOps.length - 1; i >= 0; i--) {
 			const op = otherOps[i];
-			await this.performSingleRollback(op, stateResources);
+			await this.performSingleRollback(op, stateResources, stackName);
 		}
 		if (createOps.length > 0) {
 			const sortedCreateOps = this.sortRollbackCreates(createOps, stateResources);
-			for (const op of sortedCreateOps) await this.performSingleRollback(op, stateResources);
+			for (const op of sortedCreateOps) await this.performSingleRollback(op, stateResources, stackName);
 		}
 		this.logger.info("Rollback completed. Some resources may remain if deletion failed.");
+		this.recordEvent({
+			eventType: "ROLLBACK_FINISHED",
+			stackName
+		});
 	}
 	/**
 	* Sort CREATE rollback operations so that resources depending on others
@@ -11974,7 +12090,7 @@ var DeployEngine = class {
 	/**
 	* Perform a single rollback operation (extracted for reuse)
 	*/
-	async performSingleRollback(op, stateResources) {
+	async performSingleRollback(op, stateResources, stackName) {
 		try {
 			switch (op.changeType) {
 				case "CREATE": {
@@ -11990,6 +12106,14 @@ var DeployEngine = class {
 					await provider.delete(op.logicalId, op.physicalId, op.resourceType, op.properties, { expectedRegion: this.stackRegion });
 					delete stateResources[op.logicalId];
 					this.logger.info(`  Rollback: ${op.logicalId} deleted successfully`);
+					this.recordEvent({
+						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+						stackName,
+						operation: "CREATE",
+						logicalId: op.logicalId,
+						resourceType: op.resourceType,
+						...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					});
 					break;
 				}
 				case "UPDATE": {
@@ -12010,6 +12134,14 @@ var DeployEngine = class {
 					await provider.update(op.logicalId, currentResource.physicalId, op.resourceType, op.previousState.properties, currentResource.properties);
 					stateResources[op.logicalId] = op.previousState;
 					this.logger.info(`  Rollback: ${op.logicalId} restored successfully`);
+					this.recordEvent({
+						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+						stackName,
+						operation: "UPDATE",
+						logicalId: op.logicalId,
+						resourceType: op.resourceType,
+						...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					});
 					break;
 				}
 				case "DELETE":
@@ -12019,6 +12151,15 @@ var DeployEngine = class {
 		} catch (rollbackError) {
 			this.logger.warn(`  Rollback failed for ${op.logicalId} (${op.changeType}): ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
 			this.logger.warn("  Continuing with remaining rollback operations...");
+			this.recordEvent({
+				eventType: "ROLLBACK_RESOURCE_FAILED",
+				stackName,
+				operation: op.changeType,
+				logicalId: op.logicalId,
+				resourceType: op.resourceType,
+				...op.provisionedBy && { provisionedBy: op.provisionedBy },
+				error: extractDeploymentEventError(rollbackError)
+			});
 		}
 	}
 	/**
@@ -12028,13 +12169,25 @@ var DeployEngine = class {
 		const resourceType = change.resourceType;
 		const renderer = getLiveRenderer();
 		const needsReplacement = change.changeType === "UPDATE" && (change.propertyChanges?.some((pc) => pc.requiresReplacement) ?? false);
-		const baseLabel = `${change.changeType === "CREATE" ? "Creating" : change.changeType === "DELETE" ? "Deleting" : needsReplacement ? "Replacing" : "Updating"} ${logicalId} (${resourceType})${this.peekRoutingForLabel(change, stateResources[logicalId]) === "cc-api" ? " [CC API]" : ""}`;
+		const verb = change.changeType === "CREATE" ? "Creating" : change.changeType === "DELETE" ? "Deleting" : needsReplacement ? "Replacing" : "Updating";
+		const labelRouting = this.peekRoutingForLabel(change, stateResources[logicalId]);
+		const baseLabel = `${verb} ${logicalId} (${resourceType})${labelRouting === "cc-api" ? " [CC API]" : ""}`;
 		renderer.addTask(logicalId, baseLabel);
 		const operationKind = change.changeType === "CREATE" ? "CREATE" : change.changeType === "DELETE" ? "DELETE" : "UPDATE";
 		const providerMinTimeoutMs = this.providerRegistry.getProvider(resourceType).getMinResourceTimeoutMs?.() ?? 0;
 		const warnAfterMs = this.options.resourceWarnAfterByType?.[resourceType] ?? this.options.resourceWarnAfterMs ?? 3e5;
 		const globalTimeoutMs = this.options.resourceTimeoutMs ?? 18e5;
 		const timeoutMs = this.options.resourceTimeoutByType?.[resourceType] ?? Math.max(providerMinTimeoutMs, globalTimeoutMs);
+		const eventOp = operationKind;
+		const resourceStartedAt = Date.now();
+		this.recordEvent({
+			eventType: "RESOURCE_STARTED",
+			stackName,
+			operation: eventOp,
+			logicalId,
+			resourceType,
+			...labelRouting && { provisionedBy: labelRouting }
+		});
 		try {
 			await withResourceDeadline(async () => {
 				await this.provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress);
@@ -12051,10 +12204,30 @@ var DeployEngine = class {
 				},
 				onTimeout: (elapsedMs) => new ResourceTimeoutError(logicalId, resourceType, this.stackRegion, elapsedMs, operationKind, timeoutMs)
 			});
+			this.recordEvent({
+				eventType: "RESOURCE_SUCCEEDED",
+				stackName,
+				operation: eventOp,
+				logicalId,
+				resourceType,
+				...stateResources[logicalId]?.provisionedBy ? { provisionedBy: stateResources[logicalId]?.provisionedBy } : labelRouting && { provisionedBy: labelRouting },
+				...stateResources[logicalId]?.physicalId && { physicalId: stateResources[logicalId]?.physicalId },
+				durationMs: Date.now() - resourceStartedAt
+			});
 		} catch (error) {
 			renderer.removeTask(logicalId);
 			const message = error instanceof Error ? error.message : String(error);
 			this.logger.error(`Failed to ${change.changeType.toLowerCase()} ${logicalId}: ${message}`);
+			this.recordEvent({
+				eventType: "RESOURCE_FAILED",
+				stackName,
+				operation: eventOp,
+				logicalId,
+				resourceType,
+				...stateResources[logicalId]?.provisionedBy ? { provisionedBy: stateResources[logicalId]?.provisionedBy } : labelRouting && { provisionedBy: labelRouting },
+				durationMs: Date.now() - resourceStartedAt,
+				error: extractDeploymentEventError(error)
+			});
 			throw new ProvisioningError(`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? error : void 0);
 		} finally {
 			renderer.removeTask(logicalId);
@@ -12064,6 +12237,18 @@ var DeployEngine = class {
 		return deriveLabelRouting(change, existingState, this.providerRegistry);
 	}
 	/**
+	* #808 — forward one structured deployment event to the optional
+	* recorder. No-op when no recorder was supplied. `record()` is
+	* contractually synchronous and never-throwing, but we still guard
+	* with a try/catch so an event emission can NEVER abort a deploy.
+	*/
+	recordEvent(event) {
+		if (!this.options.eventRecorder) return;
+		try {
+			this.options.eventRecorder.record(event);
+		} catch {}
+	}
+	/**
 	* Inner body of provisionResource, extracted so the outer wrapper can
 	* apply the per-resource deadline (`withResourceDeadline`) without
 	* having the timeout / warn timer code dwarf the real provisioning
@@ -12487,5 +12672,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { WorkGraph as A, resolveCaptureObservedState as B, DagBuilder as C, shouldRetainResource as D, S3StateBackend as E, runDockerStreaming as F, CFN_TEMPLATE_BODY_LIMIT as G, resolveStateBucketWithDefault as H, Synthesizer as I, findLargeInlineResources as J, CFN_TEMPLATE_URL_LIMIT as K, getDefaultStateBucketName as L, formatDockerLoginError as M, getDockerCmd as N, AssetPublisher as O, runDockerForeground as P, resolveBucketRegion as Q, getLegacyStateBucketName as R, DiffCalculator as S, LockManager as T, resolveStateBucketWithDefaultAndSource as U, resolveSkipPrefix as V, warnDeprecatedNoPrefixCliFlag as W, AssemblyReader as X, uploadCfnTemplate as Y, clearBucketRegionCache as Z, ProviderRegistry as _, withRetry as a, IntrinsicFunctionResolver as b, formatResourceLine as c, gray as d, green as f, collectInlinePolicyNamesManagedBySiblings as g, IAMRoleProvider as h, withResourceDeadline as i, buildDockerImage as j, stringifyValue as k, bold as l, yellow as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as o, red as p, MIGRATE_TMP_PREFIX as q, DeployEngine as r, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, cyan as u, findActionableSilentDrops as v, TemplateParser as w, applyRoleArnIfSet as x, CloudControlProvider as y, resolveApp as z };
-//# sourceMappingURL=deploy-engine-Bl8wyosc.js.map
+export { resolveBucketRegion as $, stringifyValue as A, resolveApp as B, DiffCalculator as C, S3StateBackend as D, LockManager as E, runDockerForeground as F, warnDeprecatedNoPrefixCliFlag as G, resolveSkipPrefix as H, runDockerStreaming as I, MIGRATE_TMP_PREFIX as J, CFN_TEMPLATE_BODY_LIMIT as K, Synthesizer as L, buildDockerImage as M, formatDockerLoginError as N, shouldRetainResource as O, getDockerCmd as P, clearBucketRegionCache as Q, getDefaultStateBucketName as R, applyRoleArnIfSet as S, TemplateParser as T, resolveStateBucketWithDefault as U, resolveCaptureObservedState as V, resolveStateBucketWithDefaultAndSource as W, uploadCfnTemplate as X, findLargeInlineResources as Y, AssemblyReader as Z, collectInlinePolicyNamesManagedBySiblings as _, withRetry as a, CloudControlProvider as b, extractDeploymentEventError as c, cyan as d, gray as f, IAMRoleProvider as g, yellow as h, withResourceDeadline as i, WorkGraph as j, AssetPublisher as k, formatResourceLine as l, red as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as o, green as p, CFN_TEMPLATE_URL_LIMIT as q, DeployEngine as r, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, bold as u, ProviderRegistry as v, DagBuilder as w, IntrinsicFunctionResolver as x, findActionableSilentDrops as y, getLegacyStateBucketName as z };
+//# sourceMappingURL=deploy-engine-CFaK71E9.js.map