@mettlecast/domain-cdk-packer 0.2.102 → 0.2.104

package/dist/DomainStack.js

@@ -175,6 +175,11 @@ export class DomainStack extends cdk.Stack {
         const environment = {
             TIB_DOMAIN_ID: domainId,
             TIB_EVENT_BUS_ARN: eventBusArn,
+            // #5282: the runtime resolves the `ctx.publish` bus from
+            // EVENT_BUS_NAME (falling back to 'default'). Inject the shared bus
+            // name so published domain events land on the project-scoped bus.
+            // Prefer the supplied name; derive from the ARN when it is omitted.
+            EVENT_BUS_NAME: eventBusName ?? cdk.Fn.select(1, cdk.Fn.split('/', eventBusArn)),
         };
         if (databaseUrl) {
             environment.DATABASE_URL = databaseUrl;
@@ -248,6 +253,7 @@ export class DomainStack extends cdk.Stack {
                             apiEntries,
                             environment,
                             eventBusArn,
+                            eventBusName,
                             reservedConcurrency,
                             logRetentionDays: logRetentionDays ?? 30,
                             lambdaGroupId: group.outboundAccess,
@@ -278,6 +284,7 @@ export class DomainStack extends cdk.Stack {
                             }),
                             environment,
                             eventBusArn,
+                            eventBusName,
                             dedicated: internalDedicated,
                             // Deterministic physical name so OTHER domain stacks can resolve
                             // this Lambda's ARN for cross-domain `ctx.actions` dispatch.
@@ -319,6 +326,7 @@ export class DomainStack extends cdk.Stack {
                     }),
                     environment,
                     eventBusArn,
+                    eventBusName,
                     dedicated,
                     reservedConcurrency,
                     logRetentionDays: logRetentionDays ?? 30,
@@ -620,6 +628,12 @@ export class DomainStack extends cdk.Stack {
             actionLambdas.forEach((fn) => {
                 iamPolicies.forEach(statement => fn.addToRolePolicy(statement));
             });
+            // #5282: actions publish domain events via `ctx.publish`. The runtime
+            // targets the bus named by EVENT_BUS_NAME, so the execution role needs
+            // events:PutEvents scoped to the shared bus ARN.
+            actionLambdas.forEach((fn) => {
+                eventBus.grantPutEventsTo(fn);
+            });
             // Add dbSecretArn grant if provided
             if (dbSecretArn) {
                 actionLambdas.forEach(fn => fn.addToRolePolicy(new iam.PolicyStatement({

package/dist/__tests__/bootstrap-invite-registration.test.js

@@ -91,6 +91,14 @@ describe('auth registry — bootstrap-invite registration (#5226)', () => {
             expect(bootstrapInviteSource).toContain("VALUES ($1, 'system', NULL, $2, 'sys_admin')");
             expect(bootstrapInviteSource).not.toContain("00000000-0000-0000-0000-000000000000");
         });
+        it('runs SQL through the raw pg client (ctx.db.client.query), not the Drizzle builder', () => {
+            // Regression for #5277: `DbContext.query` is the Drizzle query builder —
+            // an object, not a function. Calling it (`ctx.db.query(sql, params)`)
+            // throws `TypeError: e.db.query is not a function` at runtime. Raw SQL
+            // must go through the raw pg client exposed as `DbContext.client`.
+            expect(bootstrapInviteSource).toContain('ctx.db.client.query(');
+            expect(bootstrapInviteSource).not.toContain('ctx.db.query(');
+        });
     });
     describe('full documented build process — all current domains', () => {
         it('generates a registry file for EVERY domain under domains/ (auth, data-management, email, orgs)', () => {

package/dist/__tests__/domain-stack.test.js

@@ -568,4 +568,69 @@ describe('DomainStack', () => {
             expect(actionRoute.Properties.AuthorizerId).toBeDefined();
         });
     });
+    /**
+     * Issue #5282 — API action event publishing.
+     *
+     * Production evidence: the auth API-action Lambda inserted a bootstrap
+     * invitation but `ctx.publish('auth.member.invited')` failed with
+     * `AccessDeniedException: events:PutEvents` on the EventBridge default bus.
+     * The runtime resolves the `ctx.publish` bus from the `EVENT_BUS_NAME` env
+     * var (falling back to 'default') and the grouped API-action Lambda's
+     * execution role previously had no `events:PutEvents`. These synth tests
+     * pin both halves of the packer fix.
+     */
+    describe('action event publishing (#5282)', () => {
+        const busName = 'tib-event-bus';
+        it('injects EVENT_BUS_NAME into the grouped API-action Lambda', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackEventBusName', {
+                registry: minimalRegistry,
+                eventBusArn,
+                eventBusName: busName,
+                projectId: 'Test',
+                envCode: 'Dev',
+            });
+            const template = Template.fromStack(stack);
+            const lambdas = template.findResources('AWS::Lambda::Function');
+            const actionApiLambdas = Object.values(lambdas).filter(l => l.Properties.Environment?.Variables?.POWERTOOLS_SERVICE_NAME === 'test-domain-action-api');
+            expect(actionApiLambdas.length).toBeGreaterThan(0);
+            for (const fn of actionApiLambdas) {
+                expect(fn.Properties.Environment?.Variables?.EVENT_BUS_NAME).toBe(busName);
+            }
+        });
+        it('derives EVENT_BUS_NAME from the bus ARN when eventBusName is omitted', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackEventBusDerived', {
+                registry: minimalRegistry,
+                eventBusArn,
+                projectId: 'Test',
+                envCode: 'Dev',
+            });
+            const template = Template.fromStack(stack);
+            const lambdas = template.findResources('AWS::Lambda::Function');
+            const actionApiLambdas = Object.values(lambdas).filter(l => l.Properties.Environment?.Variables?.POWERTOOLS_SERVICE_NAME === 'test-domain-action-api');
+            expect(actionApiLambdas.length).toBeGreaterThan(0);
+            for (const fn of actionApiLambdas) {
+                // Without an explicit name the packer derives it from the supplied
+                // bus ARN tail (`...:event-bus/tib-event-bus` → `tib-event-bus`) so
+                // published events target the shared bus, not the 'default' one.
+                expect(fn.Properties.Environment?.Variables?.EVENT_BUS_NAME).toBe('tib-event-bus');
+            }
+        });
+        it('grants action Lambda roles events:PutEvents scoped to the shared bus', () => {
+            const app = new cdk.App();
+            const stack = new DomainStack(app, 'TestDomainStackPutEvents', {
+                registry: minimalRegistry,
+                eventBusArn,
+                eventBusName: busName,
+                projectId: 'Test',
+                envCode: 'Dev',
+            });
+            const template = Template.fromStack(stack);
+            const policies = Object.values(template.findResources('AWS::IAM::Policy'));
+            const hasScopedPutEvents = policies.some(resource => resource.Properties.PolicyDocument.Statement.some(statement => statement.Action?.includes('events:PutEvents')
+                && JSON.stringify(statement.Resource).includes('event-bus/tib-event-bus')));
+            expect(hasScopedPutEvents).toBe(true);
+        });
+    });
 });

package/dist/grouped-lambda-factory.d.ts

@@ -45,6 +45,13 @@ export interface GroupedLambdaProps {
     environment: Record<string, string>;
     /** ARN of the project-scoped EventBridge bus. */
     eventBusArn: string;
+    /**
+     * Name of the project-scoped EventBridge bus. Injected as `EVENT_BUS_NAME`
+     * so the runtime's `ctx.publish` targets the shared bus instead of falling
+     * back to the AWS 'default' bus (#5282). When omitted, the name is derived
+     * from `eventBusArn` (e.g. `arn:...:event-bus/my-bus` → `my-bus`).
+     */
+    eventBusName?: string;
     /** VPC to place Lambdas in — required for Aurora connectivity. */
     vpc?: ec2.IVpc;
     /** Security groups to attach to the Lambda(s). */

package/dist/grouped-lambda-factory.js

@@ -200,6 +200,7 @@ export function createGroupedLambdas(scope, props) {
                     POWERTOOLS_LOG_LEVEL: 'INFO',
                     TIB_HANDLER_ID: entry.id,
                     TIB_EVENT_BUS_ARN: props.eventBusArn,
+                    EVENT_BUS_NAME: resolveEventBusName(props.eventBusName, props.eventBusArn),
                 },
                 timeout: cdk.Duration.seconds(30),
                 memorySize: 256,
@@ -226,6 +227,7 @@ export function createGroupedLambdas(scope, props) {
                 POWERTOOLS_LOG_LEVEL: 'INFO',
                 TIB_HANDLER_MAP: JSON.stringify(props.handlerEntries.map(e => e.id)),
                 TIB_EVENT_BUS_ARN: props.eventBusArn,
+                EVENT_BUS_NAME: resolveEventBusName(props.eventBusName, props.eventBusArn),
             },
             timeout: cdk.Duration.seconds(30),
             memorySize: 256,
@@ -235,6 +237,15 @@ export function createGroupedLambdas(scope, props) {
         }),
     ];
 }
+/**
+ * Resolves the EventBridge bus name injected as `EVENT_BUS_NAME`.
+ * Prefers the explicitly supplied name (avoids ARN parsing when the ARN is a
+ * dynamic reference); falls back to deriving the name from the ARN tail
+ * (`arn:...:event-bus/{name}` → `{name}`).
+ */
+function resolveEventBusName(eventBusName, eventBusArn) {
+    return eventBusName ?? cdk.Fn.select(1, cdk.Fn.split('/', eventBusArn));
+}
 function toLogRetention(days) {
     const map = {
         30: logs.RetentionDays.ONE_MONTH,
@@ -329,6 +340,7 @@ export function createGroupedApiActionLambda(scope, props) {
             POWERTOOLS_SERVICE_NAME: serviceName,
             POWERTOOLS_LOG_LEVEL: 'INFO',
             TIB_EVENT_BUS_ARN: props.eventBusArn,
+            EVENT_BUS_NAME: resolveEventBusName(props.eventBusName, props.eventBusArn),
         },
         timeout: cdk.Duration.seconds(30),
         memorySize: 256,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mettlecast/domain-cdk-packer",
-  "version": "0.2.102",
+  "version": "0.2.104",
   "type": "module",
   "publishConfig": {
     "registry": "https://registry.npmjs.org",