@go-to-k/cdkd 0.219.9 → 0.220.1

package/dist/{deploy-engine-DVP4vDXG.js → deploy-engine-CcOt3mUO.js}

@@ -3383,6 +3383,60 @@ var S3StateBackend = class {
 		}
 	}
 	/**
+	* Raw sidecar-object write under the state bucket. Used for non-state
+	* auxiliary files that share the bucket + region-resolution plumbing
+	* (e.g. deployment-event JSONL streams + their `index.json`, issue
+	* #808) without going through the state-schema validation that
+	* `saveState` applies. No optimistic locking — callers own their key
+	* uniqueness / last-writer-wins semantics.
+	*/
+	async putRawObject(key, body, contentType = "application/json") {
+		await this.ensureClientForBucket();
+		await this.s3Client.send(new PutObjectCommand({
+			Bucket: this.config.bucket,
+			Key: key,
+			Body: body,
+			ContentLength: Buffer.byteLength(body),
+			ContentType: contentType
+		}));
+	}
+	/**
+	* Raw sidecar-object read under the state bucket. Returns `null` when
+	* the key does not exist; other errors propagate.
+	*/
+	async getRawObject(key) {
+		await this.ensureClientForBucket();
+		try {
+			return await (await this.s3Client.send(new GetObjectCommand({
+				Bucket: this.config.bucket,
+				Key: key
+			}))).Body?.transformToString() ?? null;
+		} catch (error) {
+			if (isNoSuchKey(error) || error.name === "NotFound") return null;
+			throw error;
+		}
+	}
+	/**
+	* Raw key listing under an arbitrary key prefix in the state bucket
+	* (paginated). Used by `cdkd events` to discover regions / runs under
+	* `{prefix}/{stackName}/.../deployments/`.
+	*/
+	async listRawKeys(keyPrefix) {
+		await this.ensureClientForBucket();
+		const keys = [];
+		let continuationToken;
+		do {
+			const response = await this.s3Client.send(new ListObjectsV2Command({
+				Bucket: this.config.bucket,
+				Prefix: keyPrefix,
+				...continuationToken && { ContinuationToken: continuationToken }
+			}));
+			for (const obj of response.Contents ?? []) if (obj.Key) keys.push(obj.Key);
+			continuationToken = response.IsTruncated ? response.NextContinuationToken : void 0;
+		} while (continuationToken);
+		return keys;
+	}
+	/**
 	* HeadObject probe — returns true on 200, false on NotFound. Other errors
 	* propagate so we don't accidentally swallow IAM denials.
 	*/
@@ -3486,12 +3540,22 @@ function isNoSuchKey(error) {
 *
 * Locks have a TTL (time-to-live). Expired locks are automatically cleaned up
 * during acquisition attempts.
+*
+* Like `S3StateBackend`, the lock manager tolerates a state bucket that
+* lives in a different AWS region from the CLI's base region: before the
+* first S3 operation it resolves the bucket's actual region via
+* `GetBucketLocation` and, if it differs from the supplied client's region,
+* builds a private replacement client for that region (issue #803 — without
+* this, every lock acquisition against a cross-region bucket failed with
+* S3's 301 PermanentRedirect while state reads/writes succeeded).
 */
 var LockManager = class {
 	logger = getLogger().child("LockManager");
 	s3Client;
 	config;
 	ttlMs;
+	clientResolved = false;
+	resolveInFlight = null;
 	constructor(s3Client, config, options) {
 		this.s3Client = s3Client;
 		this.config = config;
@@ -3499,6 +3563,62 @@ var LockManager = class {
 		this.ttlMs = ttlMinutes * 60 * 1e3;
 	}
 	/**
+	* Resolve the state bucket's actual region and, if it differs from the
+	* supplied client's configured region, replace the client reference with
+	* a new S3Client pointed at the bucket's region.
+	*
+	* Mirrors `S3StateBackend.ensureClientForBucket()` (PR #60) with two
+	* deliberate differences:
+	*
+	* - The replacement client reuses the original client's resolved
+	*   credentials provider, so `--profile` / static credentials carry over
+	*   without the 8 LockManager call sites having to thread client options.
+	* - The original client is NOT destroyed. It is the shared `AwsClients.s3`
+	*   instance that other components (state backend, exports index) still
+	*   hold a reference to.
+	*
+	* `resolveBucketRegion` caches per bucket name for the process lifetime,
+	* so when the state backend has already resolved the same bucket this
+	* incurs no additional `GetBucketLocation` call.
+	*/
+	async ensureClientForBucket() {
+		if (this.clientResolved) return;
+		if (this.resolveInFlight) return this.resolveInFlight;
+		this.resolveInFlight = (async () => {
+			try {
+				const currentRegion = await this.s3Client.config.region();
+				const fallbackRegion = typeof currentRegion === "string" ? currentRegion : void 0;
+				let probeCredentials;
+				try {
+					probeCredentials = await this.s3Client.config.credentials();
+				} catch {
+					probeCredentials = void 0;
+				}
+				const bucketRegion = await resolveBucketRegion(this.config.bucket, {
+					...probeCredentials && { credentials: probeCredentials },
+					...fallbackRegion && { fallbackRegion }
+				});
+				if (bucketRegion !== currentRegion) {
+					this.logger.debug(`State bucket '${this.config.bucket}' is in '${bucketRegion}' (lock client was '${currentRegion}'); building a region-corrected S3 client for lock operations.`);
+					this.s3Client = new S3Client({
+						region: bucketRegion,
+						credentials: this.s3Client.config.credentials,
+						logger: {
+							debug: () => {},
+							info: () => {},
+							warn: () => {},
+							error: () => {}
+						}
+					});
+				}
+				this.clientResolved = true;
+			} finally {
+				this.resolveInFlight = null;
+			}
+		})();
+		return this.resolveInFlight;
+	}
+	/**
 	* Get the S3 key for a stack's lock file.
 	*
 	* Locks are region-scoped, mirroring the state key layout
@@ -3553,6 +3673,7 @@ var LockManager = class {
 	* @param operation Operation being performed (e.g., "deploy", "destroy")
 	*/
 	async acquireLock(stackName, region, owner, operation) {
+		await this.ensureClientForBucket();
 		const key = this.getLockKey(stackName, region);
 		const lockOwner = owner || this.getDefaultOwner();
 		const now = Date.now();
@@ -3615,6 +3736,7 @@ var LockManager = class {
 	* file (e.g. for state-listing tools that don't yet know the region).
 	*/
 	async getLockInfo(stackName, region) {
+		await this.ensureClientForBucket();
 		const key = this.getLockKey(stackName, region);
 		try {
 			this.logger.debug(`Getting lock info for stack: ${stackName}`);
@@ -3651,6 +3773,7 @@ var LockManager = class {
 	* Release a lock for a stack
 	*/
 	async releaseLock(stackName, region) {
+		await this.ensureClientForBucket();
 		const key = this.getLockKey(stackName, region);
 		try {
 			this.logger.debug(`Releasing lock for stack: ${stackName} (${region})`);
@@ -3685,6 +3808,7 @@ var LockManager = class {
 	* Internal method to delete the lock file from S3
 	*/
 	async deleteLock(stackName, region) {
+		await this.ensureClientForBucket();
 		const key = this.getLockKey(stackName, region);
 		await this.s3Client.send(new DeleteObjectCommand({
 			Bucket: this.config.bucket,
@@ -11049,6 +11173,37 @@ var DagExecutor = class {
 	}
 };
 
+//#endregion
+//#region src/types/deployment-events.ts
+/**
+* Walk an error's `.cause` chain (bounded) and extract metadata for a
+* deployment event. The outermost error supplies `name` / `message`
+* (matching what the user sees in the log); the innermost AWS-SDK-shaped
+* error (the one carrying `$metadata`) supplies `awsErrorCode` /
+* `requestId` when present.
+*/
+function extractDeploymentEventError(err) {
+	if (!(err instanceof Error)) return {
+		name: "UnknownError",
+		message: String(err)
+	};
+	const result = {
+		name: err.name || "Error",
+		message: err.message
+	};
+	let current = err;
+	for (let depth = 0; depth < 10 && current instanceof Error; depth++) {
+		const maybeAws = current;
+		if (maybeAws.$metadata !== void 0) {
+			const code = maybeAws.Code ?? maybeAws.name;
+			if (code) result.awsErrorCode = code;
+			if (maybeAws.$metadata.requestId) result.requestId = maybeAws.$metadata.requestId;
+		}
+		current = current.cause;
+	}
+	return result;
+}
+
 //#endregion
 //#region src/analyzer/implicit-delete-deps.ts
 /**
@@ -11925,25 +12080,33 @@ var DeployEngine = class {
 	* information from state, then processes UPDATE/DELETE rollbacks, and finally
 	* processes sorted CREATE rollback deletions.
 	*/
-	async performRollback(completedOperations, stateResources, _stackName) {
+	async performRollback(completedOperations, stateResources, stackName) {
 		if (completedOperations.length === 0) {
 			this.logger.info("No completed operations to roll back.");
 			return;
 		}
 		this.logger.info(`Rolling back ${completedOperations.length} completed operation(s)...`);
+		this.recordEvent({
+			eventType: "ROLLBACK_STARTED",
+			stackName
+		});
 		const createOps = [];
 		const otherOps = [];
 		for (const op of completedOperations) if (op.changeType === "CREATE") createOps.push(op);
 		else otherOps.push(op);
 		for (let i = otherOps.length - 1; i >= 0; i--) {
 			const op = otherOps[i];
-			await this.performSingleRollback(op, stateResources);
+			await this.performSingleRollback(op, stateResources, stackName);
 		}
 		if (createOps.length > 0) {
 			const sortedCreateOps = this.sortRollbackCreates(createOps, stateResources);
-			for (const op of sortedCreateOps) await this.performSingleRollback(op, stateResources);
+			for (const op of sortedCreateOps) await this.performSingleRollback(op, stateResources, stackName);
 		}
 		this.logger.info("Rollback completed. Some resources may remain if deletion failed.");
+		this.recordEvent({
+			eventType: "ROLLBACK_FINISHED",
+			stackName
+		});
 	}
 	/**
 	* Sort CREATE rollback operations so that resources depending on others
@@ -11997,7 +12160,7 @@ var DeployEngine = class {
 	/**
 	* Perform a single rollback operation (extracted for reuse)
 	*/
-	async performSingleRollback(op, stateResources) {
+	async performSingleRollback(op, stateResources, stackName) {
 		try {
 			switch (op.changeType) {
 				case "CREATE": {
@@ -12013,6 +12176,14 @@ var DeployEngine = class {
 					await provider.delete(op.logicalId, op.physicalId, op.resourceType, op.properties, { expectedRegion: this.stackRegion });
 					delete stateResources[op.logicalId];
 					this.logger.info(`  Rollback: ${op.logicalId} deleted successfully`);
+					this.recordEvent({
+						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+						stackName,
+						operation: "CREATE",
+						logicalId: op.logicalId,
+						resourceType: op.resourceType,
+						...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					});
 					break;
 				}
 				case "UPDATE": {
@@ -12033,6 +12204,14 @@ var DeployEngine = class {
 					await provider.update(op.logicalId, currentResource.physicalId, op.resourceType, op.previousState.properties, currentResource.properties);
 					stateResources[op.logicalId] = op.previousState;
 					this.logger.info(`  Rollback: ${op.logicalId} restored successfully`);
+					this.recordEvent({
+						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+						stackName,
+						operation: "UPDATE",
+						logicalId: op.logicalId,
+						resourceType: op.resourceType,
+						...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					});
 					break;
 				}
 				case "DELETE":
@@ -12042,6 +12221,15 @@ var DeployEngine = class {
 		} catch (rollbackError) {
 			this.logger.warn(`  Rollback failed for ${op.logicalId} (${op.changeType}): ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
 			this.logger.warn("  Continuing with remaining rollback operations...");
+			this.recordEvent({
+				eventType: "ROLLBACK_RESOURCE_FAILED",
+				stackName,
+				operation: op.changeType,
+				logicalId: op.logicalId,
+				resourceType: op.resourceType,
+				...op.provisionedBy && { provisionedBy: op.provisionedBy },
+				error: extractDeploymentEventError(rollbackError)
+			});
 		}
 	}
 	/**
@@ -12051,13 +12239,25 @@ var DeployEngine = class {
 		const resourceType = change.resourceType;
 		const renderer = getLiveRenderer();
 		const needsReplacement = change.changeType === "UPDATE" && (change.propertyChanges?.some((pc) => pc.requiresReplacement) ?? false);
-		const baseLabel = `${change.changeType === "CREATE" ? "Creating" : change.changeType === "DELETE" ? "Deleting" : needsReplacement ? "Replacing" : "Updating"} ${logicalId} (${resourceType})${this.peekRoutingForLabel(change, stateResources[logicalId]) === "cc-api" ? " [CC API]" : ""}`;
+		const verb = change.changeType === "CREATE" ? "Creating" : change.changeType === "DELETE" ? "Deleting" : needsReplacement ? "Replacing" : "Updating";
+		const labelRouting = this.peekRoutingForLabel(change, stateResources[logicalId]);
+		const baseLabel = `${verb} ${logicalId} (${resourceType})${labelRouting === "cc-api" ? " [CC API]" : ""}`;
 		renderer.addTask(logicalId, baseLabel);
 		const operationKind = change.changeType === "CREATE" ? "CREATE" : change.changeType === "DELETE" ? "DELETE" : "UPDATE";
 		const providerMinTimeoutMs = this.providerRegistry.getProvider(resourceType).getMinResourceTimeoutMs?.() ?? 0;
 		const warnAfterMs = this.options.resourceWarnAfterByType?.[resourceType] ?? this.options.resourceWarnAfterMs ?? 3e5;
 		const globalTimeoutMs = this.options.resourceTimeoutMs ?? 18e5;
 		const timeoutMs = this.options.resourceTimeoutByType?.[resourceType] ?? Math.max(providerMinTimeoutMs, globalTimeoutMs);
+		const eventOp = operationKind;
+		const resourceStartedAt = Date.now();
+		this.recordEvent({
+			eventType: "RESOURCE_STARTED",
+			stackName,
+			operation: eventOp,
+			logicalId,
+			resourceType,
+			...labelRouting && { provisionedBy: labelRouting }
+		});
 		try {
 			await withResourceDeadline(async () => {
 				await this.provisionResourceBody(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress);
@@ -12074,10 +12274,30 @@ var DeployEngine = class {
 				},
 				onTimeout: (elapsedMs) => new ResourceTimeoutError(logicalId, resourceType, this.stackRegion, elapsedMs, operationKind, timeoutMs)
 			});
+			this.recordEvent({
+				eventType: "RESOURCE_SUCCEEDED",
+				stackName,
+				operation: eventOp,
+				logicalId,
+				resourceType,
+				...stateResources[logicalId]?.provisionedBy ? { provisionedBy: stateResources[logicalId]?.provisionedBy } : labelRouting && { provisionedBy: labelRouting },
+				...stateResources[logicalId]?.physicalId && { physicalId: stateResources[logicalId]?.physicalId },
+				durationMs: Date.now() - resourceStartedAt
+			});
 		} catch (error) {
 			renderer.removeTask(logicalId);
 			const message = error instanceof Error ? error.message : String(error);
 			this.logger.error(`Failed to ${change.changeType.toLowerCase()} ${logicalId}: ${message}`);
+			this.recordEvent({
+				eventType: "RESOURCE_FAILED",
+				stackName,
+				operation: eventOp,
+				logicalId,
+				resourceType,
+				...stateResources[logicalId]?.provisionedBy ? { provisionedBy: stateResources[logicalId]?.provisionedBy } : labelRouting && { provisionedBy: labelRouting },
+				durationMs: Date.now() - resourceStartedAt,
+				error: extractDeploymentEventError(error)
+			});
 			throw new ProvisioningError(`Failed to ${change.changeType.toLowerCase()} resource ${logicalId}`, resourceType, logicalId, stateResources[logicalId]?.physicalId, error instanceof Error ? error : void 0);
 		} finally {
 			renderer.removeTask(logicalId);
@@ -12087,6 +12307,18 @@ var DeployEngine = class {
 		return deriveLabelRouting(change, existingState, this.providerRegistry);
 	}
 	/**
+	* #808 — forward one structured deployment event to the optional
+	* recorder. No-op when no recorder was supplied. `record()` is
+	* contractually synchronous and never-throwing, but we still guard
+	* with a try/catch so an event emission can NEVER abort a deploy.
+	*/
+	recordEvent(event) {
+		if (!this.options.eventRecorder) return;
+		try {
+			this.options.eventRecorder.record(event);
+		} catch {}
+	}
+	/**
 	* Inner body of provisionResource, extracted so the outer wrapper can
 	* apply the per-resource deadline (`withResourceDeadline`) without
 	* having the timeout / warn timer code dwarf the real provisioning
@@ -12510,5 +12742,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { WorkGraph as A, resolveCaptureObservedState as B, DagBuilder as C, shouldRetainResource as D, S3StateBackend as E, runDockerStreaming as F, CFN_TEMPLATE_BODY_LIMIT as G, resolveStateBucketWithDefault as H, Synthesizer as I, findLargeInlineResources as J, CFN_TEMPLATE_URL_LIMIT as K, getDefaultStateBucketName as L, formatDockerLoginError as M, getDockerCmd as N, AssetPublisher as O, runDockerForeground as P, resolveBucketRegion as Q, getLegacyStateBucketName as R, DiffCalculator as S, LockManager as T, resolveStateBucketWithDefaultAndSource as U, resolveSkipPrefix as V, warnDeprecatedNoPrefixCliFlag as W, AssemblyReader as X, uploadCfnTemplate as Y, clearBucketRegionCache as Z, ProviderRegistry as _, withRetry as a, IntrinsicFunctionResolver as b, formatResourceLine as c, gray as d, green as f, collectInlinePolicyNamesManagedBySiblings as g, IAMRoleProvider as h, withResourceDeadline as i, buildDockerImage as j, stringifyValue as k, bold as l, yellow as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as o, red as p, MIGRATE_TMP_PREFIX as q, DeployEngine as r, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, cyan as u, findActionableSilentDrops as v, TemplateParser as w, applyRoleArnIfSet as x, CloudControlProvider as y, resolveApp as z };
-//# sourceMappingURL=deploy-engine-DVP4vDXG.js.map
+export { resolveBucketRegion as $, stringifyValue as A, resolveApp as B, DiffCalculator as C, S3StateBackend as D, LockManager as E, runDockerForeground as F, warnDeprecatedNoPrefixCliFlag as G, resolveSkipPrefix as H, runDockerStreaming as I, MIGRATE_TMP_PREFIX as J, CFN_TEMPLATE_BODY_LIMIT as K, Synthesizer as L, buildDockerImage as M, formatDockerLoginError as N, shouldRetainResource as O, getDockerCmd as P, clearBucketRegionCache as Q, getDefaultStateBucketName as R, applyRoleArnIfSet as S, TemplateParser as T, resolveStateBucketWithDefault as U, resolveCaptureObservedState as V, resolveStateBucketWithDefaultAndSource as W, uploadCfnTemplate as X, findLargeInlineResources as Y, AssemblyReader as Z, collectInlinePolicyNamesManagedBySiblings as _, withRetry as a, CloudControlProvider as b, extractDeploymentEventError as c, cyan as d, gray as f, IAMRoleProvider as g, yellow as h, withResourceDeadline as i, WorkGraph as j, AssetPublisher as k, formatResourceLine as l, red as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as o, green as p, CFN_TEMPLATE_URL_LIMIT as q, DeployEngine as r, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, bold as u, ProviderRegistry as v, DagBuilder as w, IntrinsicFunctionResolver as x, findActionableSilentDrops as y, getLegacyStateBucketName as z };
+//# sourceMappingURL=deploy-engine-CcOt3mUO.js.map