blogwright-analytics 0.4.0-beta.2 → 0.4.0-beta.4

package/dist/app/_app/version.json

@@ -1 +1 @@
-{"version":"1788197150274"}
+{"version":"1788644015180"}

package/dist/app/index.html

@@ -6,72 +6,76 @@
     <!-- A dashboard bound to loopback has no icon to serve; an empty data URL
          answers the browser's request without a round trip that would 404. -->
     <link rel="icon" href="data:," />
-    <link href="./_app/immutable/entry/start.B2ycr8Ji.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/FH_3TS2H.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/D2BnX0Uk.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/B3vZDoek.js" rel="modulepreload">
-		<link href="./_app/immutable/entry/app.cy9eKSTf.js" rel="modulepreload">
+    <link href="./_app/immutable/entry/start.Iz8smxW0.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/Cz3xtWLM.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/DVCZGvXq.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/DUJFqVVs.js" rel="modulepreload">
+		<link href="./_app/immutable/entry/app.w1HyN1Pe.js" rel="modulepreload">
 		<link href="./_app/immutable/chunks/HclGiUj8.js" rel="modulepreload">
 		<link href="./_app/immutable/chunks/xihTtKlq.js" rel="modulepreload">
-		<link href="./_app/immutable/nodes/0.UTMEigHJ.js" rel="modulepreload">
-		<link href="./_app/immutable/nodes/2.CQMIFodk.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/Bd1gDe3Y.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/Doz7YX1W.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/CyCGwyzf.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/ZvRY-WVy.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/DKMlMI4a.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/Dh958be7.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/CvyVA_jC.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/caXkbKD3.js" rel="modulepreload">
+		<link href="./_app/immutable/nodes/0.BjQeslHk.js" rel="modulepreload">
+		<link href="./_app/immutable/nodes/2.CByBWAMF.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/DmKBckYv.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/BUku_rSO.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/D6rPBWFd.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/Y5urAfNy.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/Sb-KFJGv.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/xefVn_UF.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/BQHoVMm0.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/BAneOF1f.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/DRQZHPoe.js" rel="modulepreload">
 		<link href="./_app/immutable/chunks/C58PZtCD.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/DJc8C0NK.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/CuOP1eLc.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/CAgm0Ruv.js" rel="modulepreload">
 		<link href="./_app/immutable/chunks/Db0q5_zr.js" rel="modulepreload">
 		<link href="./_app/immutable/chunks/CCch3uox.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/V9ZjaxiY.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/C7qhOD3U.js" rel="modulepreload">
 		<link href="./_app/immutable/chunks/BID1NNRh.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/-aNGNaBT.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/BumHYZmq.js" rel="modulepreload">
 		<link href="./_app/immutable/chunks/RobXhXPM.js" rel="modulepreload">
 		<link href="./_app/immutable/chunks/Dfvzj6n2.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/xIq_fFFM.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/BZrG8lR6.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/DCkHk5n_.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/BC0iYSWx.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/BJngAqxk.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/B5KRA4hC.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/RBkNRIpl.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/D26njVw7.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/CSrT-PUe.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/Cr8mHXFf.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/C0tbX_qQ.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/DodcabfQ.js" rel="modulepreload">
 		<link href="./_app/immutable/chunks/BR2LaRms.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/CRTcXoMo.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/vDgBJUjM.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/DMoYijy0.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/D0Ty6LN0.js" rel="modulepreload">
-		<link href="./_app/immutable/chunks/BnKf2MvA.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/DnQEoGed.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/BpoiI2_d.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/CU11V7_a.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/B6Dt35mA.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/BoX17NrM.js" rel="modulepreload">
+		<link href="./_app/immutable/chunks/DoNmKjPy.js" rel="modulepreload">
 		
-		<link href="./_app/immutable/assets/0.BTQrrh5B.css" rel="stylesheet">
+		<link href="./_app/immutable/assets/0.BfwUqNJ-.css" rel="stylesheet">
 		<link href="./_app/immutable/assets/Group.DaJMILJc.css" rel="stylesheet">
-		<link href="./_app/immutable/assets/Text.j9l35qB0.css" rel="stylesheet">
 		<link href="./_app/immutable/assets/Path.CvpwNZ6g.css" rel="stylesheet">
+		<link href="./_app/immutable/assets/Text.j9l35qB0.css" rel="stylesheet">
+		<link href="./_app/immutable/assets/Tooltip.BsTJVNOF.css" rel="stylesheet">
 		<link href="./_app/immutable/assets/Rect.CtRaGMmQ.css" rel="stylesheet">
 		<link href="./_app/immutable/assets/Line.fkmsECm9.css" rel="stylesheet">
 		<link href="./_app/immutable/assets/Circle.C5MKzgk2.css" rel="stylesheet">
-		<link href="./_app/immutable/assets/2.DoCaRy3T.css" rel="stylesheet">
+		<link href="./_app/immutable/assets/2.lkfjnM1s.css" rel="stylesheet">
 		<link href="./_app/immutable/assets/Voronoi.ce7atosu.css" rel="stylesheet">
 		<link href="./_app/immutable/assets/ChartAnnotations.CPxIG7Mw.css" rel="stylesheet">
 		<link href="./_app/immutable/assets/Labels.BxZ4NUVz.css" rel="stylesheet">
 		<link href="./_app/immutable/assets/Legend.DTV5rk9m.css" rel="stylesheet">
-		<link href="./_app/immutable/assets/DefaultTooltip.BXd66MzC.css" rel="stylesheet">
+		<link href="./_app/immutable/assets/DefaultTooltip.CXdtNw-m.css" rel="stylesheet">
   </head>
   <body data-sveltekit-preload-data="tap">
     
 			<script>
 				{
-					__sveltekit_ws17h5 = {
+					__sveltekit_uk2rko = {
 						base: new URL(".", location).pathname.slice(0, -1)
 					};
 
 					const element = document.currentScript.parentElement;
 
 					Promise.all([
-						import("./_app/immutable/entry/start.B2ycr8Ji.js"),
-						import("./_app/immutable/entry/app.cy9eKSTf.js")
+						import("./_app/immutable/entry/start.Iz8smxW0.js"),
+						import("./_app/immutable/entry/app.w1HyN1Pe.js")
 					]).then(([kit, app]) => {
 						kit.start(app, element);
 					});

package/dist/aws/firehose.d.ts

@@ -72,6 +72,25 @@ export interface IcebergDestinationInput {
      * without this processor would fail every record with nothing surfacing as an error.
      */
     readonly transformLambdaArn: string;
+    /**
+     * The CloudWatch log group Firehose writes its delivery errors into, sent as
+     * `CloudWatchLoggingOptions.LogGroupName`. Firehose creates neither the group nor the
+     * stream inside it, so both have to exist before a record can fail into them.
+     *
+     * Required rather than optional, for {@link STREAM_APPEND_ONLY}'s reason: this client
+     * builds exactly one shape of destination and always enables logging, so an optional
+     * field would model a call site that does not exist. A destination that quietly
+     * omitted the options is the failure this field exists to remove - one where the only
+     * account of an undelivered record is the record's absence.
+     */
+    readonly logGroupName: string;
+    /**
+     * The log stream inside {@link IcebergDestinationInput.logGroupName}, sent as
+     * `CloudWatchLoggingOptions.LogStreamName`. Named explicitly because enabling logging
+     * through the API - rather than through the console - creates neither the group nor
+     * the stream, so the caller owns both names.
+     */
+    readonly logStreamName: string;
 }
 /**
  * A delivery stream's lifecycle state in this repo's vocabulary rather than the
@@ -85,7 +104,7 @@ export type DeliveryState = 'creating' | 'create-failed' | 'active' | 'deleting'
  * The narrow view of `DescribeDeliveryStream` that `analytics status` needs, plus the
  * three fields {@link FirehoseClient.updateDestination} cannot be called without.
  *
- * The last three are optional and are set only when the response actually carried them.
+ * The last four are optional and are set only when the response actually carried them.
  * `VersionId` and `Destinations` are documented as required members of
  * `DeliveryStreamDescription`, so on the service's own response model they are always
  * there - but an absent one must reach the caller as absent rather than as `''` or
@@ -124,6 +143,18 @@ export interface DeliveryStreamStatus {
      * that omits the flag.
      */
     readonly appendOnly?: boolean | undefined;
+    /**
+     * Whether the live destination has CloudWatch error logging switched on, off
+     * `Destinations[0].IcebergDestinationDescription.CloudWatchLoggingOptions.Enabled`.
+     *
+     * Read back rather than assumed, for {@link DeliveryStreamStatus.appendOnly}'s reason:
+     * it is the second flag the stream node compares to decide whether the destination
+     * needs reconciling, and assuming a stream this plugin created carries the
+     * configuration this plugin sends today is exactly wrong for every stream created
+     * before it sent this one. Absent for a destination that is not an Iceberg one, or for
+     * a response that reports no logging options at all.
+     */
+    readonly loggingEnabled?: boolean | undefined;
 }
 /**
  * The current version and destination id `UpdateDestination` conditions on - the two

package/dist/aws/firehose.js

@@ -139,6 +139,15 @@ function buildIcebergDestination(input) {
             ErrorOutputPrefix: input.errorOutputPrefix,
         },
         AppendOnly: STREAM_APPEND_ONLY,
+        // Firehose's only account of a record it could not deliver. Off by default, and
+        // `IcebergDestinationConfiguration` and `IcebergDestinationUpdate` both accept the
+        // member, so the one builder enables it on the create and on the reconcile alike -
+        // an existing stream is switched on in place rather than replaced.
+        CloudWatchLoggingOptions: {
+            Enabled: true,
+            LogGroupName: input.logGroupName,
+            LogStreamName: input.logStreamName,
+        },
         BufferingHints: {
             IntervalInSeconds: input.bufferIntervalSeconds,
             SizeInMBs: input.bufferSizeMb,
@@ -240,6 +249,7 @@ export class FirehoseClient {
             const versionId = description?.VersionId;
             const destinationId = destination?.DestinationId;
             const appendOnly = destination?.IcebergDestinationDescription?.AppendOnly;
+            const loggingEnabled = destination?.IcebergDestinationDescription?.CloudWatchLoggingOptions?.Enabled;
             return {
                 name: description?.DeliveryStreamName ?? name,
                 arn: description?.DeliveryStreamARN ?? '',
@@ -248,6 +258,7 @@ export class FirehoseClient {
                 ...(versionId !== undefined ? { versionId } : {}),
                 ...(destinationId !== undefined ? { destinationId } : {}),
                 ...(appendOnly !== undefined ? { appendOnly } : {}),
+                ...(loggingEnabled !== undefined ? { loggingEnabled } : {}),
             };
         }
         catch (err) {

package/dist/commands.js

@@ -172,7 +172,7 @@ function logStreamHealth(ctx, entries) {
  * A failed read degrades to a warning, which is the whole point of doing it
  * last: the table is the one part of this listing that needs credentials the
  * node reads do not (the vendor library attaches the catalog itself), so an
- * operator with no session still gets all twelve nodes and the stream's health.
+ * operator with no session still gets all fourteen nodes and the stream's health.
  */
 async function logRowCount(ctx, query) {
     const config = resolveAnalyticsConfig(ctx);

package/dist/nodes.d.ts

@@ -3,24 +3,29 @@
  * CloudFront-logs-to-Iceberg pipeline is built from and nothing else: the
  * site's own bucket, distribution and log group stay in the CLI's graph
  * (`packages/cli/src/nodes.ts`) and are never touched from here. This module
- * carries all twelve of them, in four chains. The table chain - the S3 Tables bucket,
+ * carries all fourteen of them, in four chains. The table chain - the S3 Tables bucket,
  * the namespace inside it, the `page_views` table, and the Glue federation
  * Firehose reads that table through - runs `analytics-table-bucket` ->
  * `analytics-namespace` -> `analytics-table` ->
  * `analytics-catalog-integration`. The transform chain - the long-lived
- * `visitor_key` salt, the Lambda execution role whose policy names that
- * secret's ARN, and the record-transform function itself - runs
- * `analytics-salt-secret` -> `analytics-transform-role` ->
- * `analytics-transform-function`. The delivery chain - the bucket every record
- * Firehose cannot deliver lands in, the role it assumes, and the stream itself
- * - runs `analytics-error-bucket` -> `analytics-firehose-role` ->
- * `analytics-firehose-stream`, and joins the other two chains through the
- * role's four grants and the stream's destination. The vended-delivery chain -
+ * `visitor_key` salt, the log group the function's own output lands in, the
+ * Lambda execution role whose policy names that secret's ARN, and the
+ * record-transform function itself - runs `analytics-salt-secret` ->
+ * `analytics-transform-role` -> `analytics-transform-function`, with
+ * `analytics-transform-log-group` a second edge into that function. The
+ * delivery chain - the bucket every record Firehose cannot deliver lands in,
+ * the log group Firehose's delivery errors land in, the role it assumes, and
+ * the stream itself - runs `analytics-error-bucket` ->
+ * `analytics-firehose-role` -> `analytics-firehose-stream`, with
+ * `analytics-firehose-log-group` a second edge into that stream, and joins the
+ * other two chains through the role's five grants and the stream's
+ * destination. The vended-delivery chain -
  * the CloudWatch delivery destination pointing at that stream and the delivery
  * joining it to the site's log source - runs `analytics-log-destination` ->
  * `analytics-log-delivery` and hangs off the stream. All four are wired through
  * `dependsOn`, and a node depends on every node whose recorded ARN it
- * interpolates. {@link buildAnalyticsNodes} at the foot of this module returns
+ * interpolates - plus the two writers whose log group has to exist before the
+ * first line they write, which is an ordering with nothing read back. {@link buildAnalyticsNodes} at the foot of this module returns
  * the assembled set, and `plugin.ts` hands it to the SPI's `Plugin.nodes`;
  * assembling an array is all it does - nothing here reconciles anything.
  *
@@ -41,8 +46,8 @@
  * over the host's `signingUsEast1` signer; no node here picks a region for a
  * request. {@link ANALYTICS_REGION} below is the same region as *text*, needed
  * only because an ARN spells its region out and because every node `title`
- * states the pin, so the bootstrap output an operator reads carries it. Ten of
- * the twelve titles state it as the region they are created in; the two IAM
+ * states the pin, so the bootstrap output an operator reads carries it. Twelve
+ * of the fourteen titles state it as the region they are created in; the two IAM
  * role nodes state it as the pipeline they serve, because IAM is global and
  * "created in us-east-1" is not a property a role has (§Region pinning says so
  * in as many words) - a title claiming otherwise would be the pin stated
@@ -80,7 +85,7 @@ type AnalyticsContext = PluginContext<AnalyticsConfig>;
 /** One node of the analytics graph. */
 type AnalyticsNode = ResourceNode<AnalyticsContext>;
 /**
- * The `analytics-firehose-stream` node id. Exported, alone among the twelve,
+ * The `analytics-firehose-stream` node id. Exported, alone among the fourteen,
  * because `analytics status` reads this node's recorded outputs back out of
  * the scoped state its `read` hydrated - the stream's delivery health - and a
  * second copy of the string in `commands.ts` would be a state key with two
@@ -163,6 +168,22 @@ export declare function analyticsCatalogIntegrationNode(): AnalyticsNode;
  * anything had changed. The teardown says what it kept and how to remove it.
  */
 export declare function analyticsSaltSecretNode(): AnalyticsNode;
+/**
+ * The transform Lambda's own log group: the mapping decisions, the drop path,
+ * and the cold-start read of the salt secret - the only place this pipeline
+ * says *why* a record went where it did.
+ *
+ * Lambda writes into it under the execution role's existing
+ * `logs:CreateLogStream` and `logs:PutLogEvents`, scoped to this group and no
+ * other ({@link transformLogGroupArn}). The role is deliberately not granted
+ * `logs:CreateLogGroup`, because this node is what creates the group.
+ *
+ * It is at the head of the chain that writes to it -
+ * `analytics-transform-function` declares the edge - and the role does not,
+ * because the role's policy *derives* this group's ARN from the function's name
+ * rather than reading a recorded one, so there is no output to wait for.
+ */
+export declare function analyticsTransformLogGroupNode(): AnalyticsNode;
 /**
  * The transform Lambda's execution role: permission to write its own logs and
  * to read the one secret it needs, and nothing else.
@@ -226,7 +247,11 @@ export declare function transformUpdate(recorded: {
  * artifact's name, even though the zip travels inline rather than through a
  * bucket (see {@link MAX_INLINE_ZIP_BYTES} for why inline).
  *
- * It depends on `analytics-transform-role`, whose recorded ARN it runs as.
+ * It depends on `analytics-transform-role`, whose recorded ARN it runs as, and
+ * on `analytics-transform-log-group`, whose ARN it reads nothing of: a group
+ * that does not exist when the function first runs is a log line lost with
+ * nothing raised, and on teardown the reverse order the engine walks removes
+ * the function before the group holding the evidence of what it did.
  */
 export declare function analyticsTransformFunctionNode(): AnalyticsNode;
 /**
@@ -257,10 +282,32 @@ export declare function analyticsTransformFunctionNode(): AnalyticsNode;
  * transform did not run on them - inside a bucket the site serves from.
  */
 export declare function analyticsErrorBucketNode(): AnalyticsNode;
+/**
+ * The log group Firehose writes its delivery errors to, and the log stream
+ * inside it that they are written to.
+ *
+ * **Firehose creates neither.** Enabling error logging through the API rather
+ * than the console requires the group *and* the stream to exist in advance, so
+ * this node creates both - and re-ensures the stream on every `update` beside
+ * the retention, which is why {@link analyticsLogGroupNode} takes a stream at
+ * all. Without that, a group left by a run that stopped between
+ * `CreateLogGroup` and `CreateLogStream` is permanently one call short, with
+ * `read()` reporting it present and `update()` doing nothing about it, and the
+ * symptom is a delivery failure with nowhere to be explained.
+ *
+ * {@link DESTINATION_DELIVERY_STREAM} is the only stream created:
+ * `BackupDelivery` belongs to a destination configured with S3 backup, and the
+ * Iceberg destination this pipeline builds configures none.
+ *
+ * It is at the head of the chain that writes to it -
+ * `analytics-firehose-stream` declares the edge - while the delivery role does
+ * not, for the reason `analytics-transform-log-group`'s counterpart does not.
+ */
+export declare function analyticsFirehoseLogGroupNode(): AnalyticsNode;
 /**
  * The role Firehose assumes to read the catalog, write the table, invoke the
- * transform and store what it could not deliver - four grants, four concrete
- * resources, no `*`.
+ * transform, store what it could not deliver and say so in one log stream -
+ * five grants, five concrete resources, no `*`.
  *
  * It declares `dependsOn` on the three nodes whose recorded ARNs those grants
  * interpolate. `topoSort` drains zero-indegree nodes alphabetically
@@ -366,7 +413,7 @@ export declare function analyticsLogDestinationNode(): AnalyticsNode;
  */
 export declare function analyticsLogDeliveryNode(): AnalyticsNode;
 /**
- * The plugin's twelve resource nodes, assembled in the order the change spec's
+ * The plugin's fourteen resource nodes, assembled in the order the change spec's
  * §Analytics pipeline → Resource nodes table lists them. This is what
  * `Plugin.nodes` (`plugin.ts`) hands the CLI's generic `analytics bootstrap`
  * and `analytics destroy` verbs, and it is the whole of what this package
@@ -387,7 +434,7 @@ export declare function analyticsLogDeliveryNode(): AnalyticsNode;
  *
  * **No `ctx` parameter, deliberately.** The SPI declares `nodes?(ctx)` and the
  * CLI calls it with one, so this function is assignable to it as written - a
- * zero-argument function satisfies a one-argument signature. None of the twelve
+ * zero-argument function satisfies a one-argument signature. None of the fourteen
  * factories needs a context to be *built*: each reads `ctx` inside `read`,
  * `create`, `update` and `delete`, when the reconcile is actually running. A
  * parameter accepted and ignored here would be an unused binding and, worse, a