@fjall/deploy-core 0.89.2

package/dist/src/aws/utils/regions.js

@@ -0,0 +1 @@
+export { DEFAULT_REGION, regions, AWS_REGIONS_METADATA, topRegions, commonRegions, parseRegionList, isValidRegion, isValidRegionFormat, getSuggestions, validateRegion, validateRegionList, filterDuplicateRegions, getRegionOptions, getRegionOptionsExcluding, getRegionName, createRegionFormatter } from "@fjall/generator";

package/dist/src/aws/utils/stackStatus.d.ts

@@ -0,0 +1,23 @@
+export interface CloudFormationStackStatus {
+    status: string;
+    safeToRedeploy: "Yes" | "No" | "Maybe";
+    description: string;
+    statusReason?: string;
+}
+export interface CloudFormationOutput {
+    OutputKey?: string;
+    OutputValue?: string;
+    ExportName?: string;
+}
+export interface DetailedStackStatus extends CloudFormationStackStatus {
+    needsRedeploy: boolean;
+    isInProgress: boolean;
+    isFailed: boolean;
+    isComplete: boolean;
+    canProceed: boolean;
+    recommendation?: string;
+}
+export declare const stackStatusMap: Record<string, {
+    safeToRedeploy: "Yes" | "No" | "Maybe";
+    description: string;
+}>;

package/dist/src/aws/utils/stackStatus.js

@@ -0,0 +1,90 @@
+export const stackStatusMap = {
+    CREATE_IN_PROGRESS: {
+        safeToRedeploy: "No",
+        description: "Stack is busy with creation"
+    },
+    CREATE_COMPLETE: {
+        safeToRedeploy: "Yes",
+        description: "Stack was successfully created"
+    },
+    CREATE_FAILED: {
+        safeToRedeploy: "Maybe",
+        description: "Stack creation failed - fix issues before redeploying"
+    },
+    DELETE_IN_PROGRESS: {
+        safeToRedeploy: "No",
+        description: "Stack is busy with deletion"
+    },
+    DELETE_COMPLETE: {
+        safeToRedeploy: "Yes",
+        description: "Stack was successfully deleted"
+    },
+    DELETE_FAILED: {
+        safeToRedeploy: "Maybe",
+        description: "Stack deletion failed - investigate before redeploying"
+    },
+    ROLLBACK_IN_PROGRESS: {
+        safeToRedeploy: "No",
+        description: "Stack is rolling back due to failure"
+    },
+    ROLLBACK_COMPLETE: {
+        safeToRedeploy: "Yes",
+        description: "Stack rolled back due to failure - fix issues before redeploying"
+    },
+    ROLLBACK_FAILED: {
+        safeToRedeploy: "No",
+        description: "Rollback failed - manual intervention needed"
+    },
+    UPDATE_IN_PROGRESS: {
+        safeToRedeploy: "No",
+        description: "Stack update is in progress"
+    },
+    UPDATE_COMPLETE: {
+        safeToRedeploy: "Yes",
+        description: "Stack update completed successfully"
+    },
+    UPDATE_FAILED: {
+        safeToRedeploy: "Maybe",
+        description: "Stack update failed - fix issues before redeploying"
+    },
+    UPDATE_ROLLBACK_IN_PROGRESS: {
+        safeToRedeploy: "No",
+        description: "Stack is rolling back an update"
+    },
+    UPDATE_ROLLBACK_COMPLETE: {
+        safeToRedeploy: "Yes",
+        description: "Stack update rolled back successfully"
+    },
+    UPDATE_ROLLBACK_FAILED: {
+        safeToRedeploy: "No",
+        description: "Update rollback failed - manual fix needed"
+    },
+    IMPORT_IN_PROGRESS: {
+        safeToRedeploy: "No",
+        description: "Resource import in progress"
+    },
+    IMPORT_COMPLETE: {
+        safeToRedeploy: "Yes",
+        description: "Resource import completed successfully"
+    },
+    IMPORT_ROLLBACK_IN_PROGRESS: {
+        safeToRedeploy: "No",
+        description: "Import rollback in progress"
+    },
+    IMPORT_ROLLBACK_COMPLETE: {
+        safeToRedeploy: "Yes",
+        description: "Import rollback completed"
+    },
+    IMPORT_ROLLBACK_FAILED: {
+        safeToRedeploy: "No",
+        description: "Import rollback failed - manual fix needed"
+    },
+    REVIEW_IN_PROGRESS: {
+        safeToRedeploy: "Yes",
+        description: "Stack is in review mode"
+    },
+    UNKNOWN: {
+        safeToRedeploy: "Maybe",
+        description: "Unknown stack status"
+    }
+};

package/dist/src/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @fjall/deploy-core — Shared Deployment Engine
+ *
+ * This package contains the deployment logic shared between the CLI and
+ * the webapp worker. Both callers construct a DeployParams object and
+ * call deploy(). The engine handles CDK synthesis, CloudFormation
+ * deployment, Docker builds, and multi-account cascade — reporting
+ * progress via typed callbacks.
+ *
+ * Auth, config discovery, and output formatting are the caller's
+ * responsibility. deploy-core receives credentials and a working
+ * directory; it never reads credential files or writes to the terminal.
+ */
+export type { AwsCredentials, DeployIdentity, DeployCallbacks, StepCompleteStatus, ProgressEvent, ProgressEventType, ResourceEvent, AwsAuthResult, CascadeDeploymentResult, CascadePhase, ApiClientInterface, EntitlementsData, DeployParams, DeployOptions, DeploymentType, DeployResult, OrgConfig, ProviderAccount, SSOSession } from "./types/index.js";
+export type { AwsProvider, AwsProviderCredentials, AwsSdkClientConstructor } from "./aws/index.js";
+export { SimpleAwsProvider } from "./aws/index.js";
+export { ensureOrganisationExists, describeOrganisation, enablePolicyTypes, enableServiceAccess, enableRamSharing, activateTrustedAccess, enableIpamDelegatedAdmin, updateBackupGlobalSettings, listAccounts, findAccount, createAccount, ensureOrganisationalUnitsExist, placeAccountsInOUs, activateCostAllocationTags, checkIdentityCentreStatus } from "./aws/index.js";
+export type { OrgDetails, OUMap, AccountPlacementResult, AccountInfo, IdentityCentreStatus, BackupGlobalSettings, CostAllocationTag, CreateAccountResult } from "./aws/index.js";
+export type { DeploymentContext, StepOutput, ApplicationDeploymentContext, CallerIdentity, StackOutput, StackOutputsRecord, ValidationResult, ProgressCallbacks, ApplicationStack, OrganisationType, DeploymentOperation, ApplicationOperation, OrganisationOperation, DeployOrderOptions, OpenNextPattern, AppResourceFlags, ParallelDeploymentResult, ParallelDeployGroup, ParallelOperation, ParallelOperationType, ParallelOperationState, ApplicationErrorType, StackDeploymentData, StackDeploymentOptions, ApplicationDeploymentData, ApplicationDestructionData, FjallStateFile, TemplateHashEntry } from "./types/index.js";
+export { ProgressReporter, APPLICATION_STACKS, ORGANISATION_TYPES, APPLICATION_DEPLOY_ORDER, APPLICATION_DESTROY_ORDER, OPENNEXT_DEPLOY_ORDER, OPENNEXT_DESTROY_ORDER, PARALLEL_DEPLOY_GROUPS, PARALLEL_DESTROY_GROUPS, OPENNEXT_PARALLEL_GROUPS, PARALLEL_OPERATION_TYPES, isApplicationOperation, isOrganisationOperation, getParallelDeployGroups, getParallelDestroyGroups, getApplicationDeployOrder, getApplicationDestroyOrder, getApplicationStackName, getOrganisationStackName, isApplicationStack, getApplicationStepName, getApplicationStepId, toPascalCase, isOpenNextPattern, OPENNEXT_PATTERNS, detectPattern, detectPayloadPattern, detectDatabase, deriveResourcesFromManifestStacks, STACK_NOT_FOUND_PATTERN, CDK_NO_STACKS_MATCH, INFRASTRUCTURE_FILENAME, ApplicationError, wrapApplicationError, FjallStateFileSchema, readStateFile, writeStateFile, createEmptyState, deleteStateFile, updateTemplateHash, getStateFilePath } from "./types/index.js";
+export { CdkService, CdkArgumentBuilder, CdkProcessManager, CdkEventMonitor, startStackMonitoring, DEFAULT_DEPLOY_TIMEOUT_MS, isCdkError, formatInfrastructureError, hasCdkDifferences, parseDiffOutput, CloudFormationService, CloudFormationError } from "./services/infrastructure/index.js";
+export type { CdkContext, CdkOptions, CdkOutput, CheckDifferencesResult, CdkServiceOptions, DiffDetails, CloudFormationCallbacks } from "./services/infrastructure/index.js";
+export { TemplateHashService, TemplateHashError, type TemplateComparisonResult } from "./services/supporting/index.js";
+export { CdkContextBuilder } from "./services/supporting/index.js";
+export { emitProgress, PROGRESS_MESSAGES, parseBuildPhase, buildStepContextBuildConfig, convertCloudFormationOutputsToRecord, type CloudFormationOutput } from "./services/supporting/index.js";
+export { ApplicationStackService } from "./services/application/index.js";
+export { CdkError } from "./types/errors/CdkError.js";
+export { BaseServiceError } from "./types/errors/ServiceError.js";
+export { filterDangerousEnvVars, maskSensitiveOutput, parseShellArgs } from "./util/securityHelpers.js";
+export { sleep } from "./util/sleep.js";
+export { fileExists } from "./util/fsHelpers.js";
+export { type Result, success, failure, isSuccess, isFailure } from "@fjall/generator";
+export { deploy } from "./orchestration/index.js";
+export { runOrganisationSetup } from "./orchestration/index.js";
+export type { OrgSetupPhase, OrgSetupCallbacks, OrgSetupConfig, OrgSetupResult, DockerProvider, DockerBuildParams, DockerBuildResult, ECRInitParams, ECRInitResult, TagImagesParams, TagImagesResult, DomainDeployProvider, DomainConfig, DomainDeployResult, DeployServices, DetectionResult } from "./orchestration/index.js";

package/dist/src/index.js

@@ -0,0 +1,45 @@
+/**
+ * @fjall/deploy-core — Shared Deployment Engine
+ *
+ * This package contains the deployment logic shared between the CLI and
+ * the webapp worker. Both callers construct a DeployParams object and
+ * call deploy(). The engine handles CDK synthesis, CloudFormation
+ * deployment, Docker builds, and multi-account cascade — reporting
+ * progress via typed callbacks.
+ *
+ * Auth, config discovery, and output formatting are the caller's
+ * responsibility. deploy-core receives credentials and a working
+ * directory; it never reads credential files or writes to the terminal.
+ */
+export { SimpleAwsProvider } from "./aws/index.js";
+// Organisation setup primitives
+export { ensureOrganisationExists, describeOrganisation, enablePolicyTypes, enableServiceAccess, enableRamSharing, activateTrustedAccess, enableIpamDelegatedAdmin, updateBackupGlobalSettings, listAccounts, findAccount, createAccount, ensureOrganisationalUnitsExist, placeAccountsInOUs, activateCostAllocationTags, checkIdentityCentreStatus } from "./aws/index.js";
+export { ProgressReporter, APPLICATION_STACKS, ORGANISATION_TYPES, APPLICATION_DEPLOY_ORDER, APPLICATION_DESTROY_ORDER, OPENNEXT_DEPLOY_ORDER, OPENNEXT_DESTROY_ORDER, PARALLEL_DEPLOY_GROUPS, PARALLEL_DESTROY_GROUPS, OPENNEXT_PARALLEL_GROUPS, PARALLEL_OPERATION_TYPES, isApplicationOperation, isOrganisationOperation, getParallelDeployGroups, getParallelDestroyGroups, getApplicationDeployOrder, getApplicationDestroyOrder, getApplicationStackName, getOrganisationStackName, isApplicationStack, getApplicationStepName, getApplicationStepId, toPascalCase, isOpenNextPattern, OPENNEXT_PATTERNS, 
+// Pattern detection
+detectPattern, detectPayloadPattern, detectDatabase, deriveResourcesFromManifestStacks, 
+// Constants
+STACK_NOT_FOUND_PATTERN, CDK_NO_STACKS_MATCH, INFRASTRUCTURE_FILENAME, 
+// Application errors
+ApplicationError, wrapApplicationError, 
+// State management
+FjallStateFileSchema, readStateFile, writeStateFile, createEmptyState, deleteStateFile, updateTemplateHash, getStateFilePath } from "./types/index.js";
+// Infrastructure services
+export { CdkService, CdkArgumentBuilder, CdkProcessManager, CdkEventMonitor, startStackMonitoring, DEFAULT_DEPLOY_TIMEOUT_MS, isCdkError, formatInfrastructureError, hasCdkDifferences, parseDiffOutput, CloudFormationService, CloudFormationError } from "./services/infrastructure/index.js";
+// Supporting services
+export { TemplateHashService, TemplateHashError } from "./services/supporting/index.js";
+export { CdkContextBuilder } from "./services/supporting/index.js";
+export { emitProgress, PROGRESS_MESSAGES, parseBuildPhase, buildStepContextBuildConfig, convertCloudFormationOutputsToRecord } from "./services/supporting/index.js";
+// Application services
+export { ApplicationStackService } from "./services/application/index.js";
+// Error types
+export { CdkError } from "./types/errors/CdkError.js";
+export { BaseServiceError } from "./types/errors/ServiceError.js";
+// Utilities
+export { filterDangerousEnvVars, maskSensitiveOutput, parseShellArgs } from "./util/securityHelpers.js";
+export { sleep } from "./util/sleep.js";
+export { fileExists } from "./util/fsHelpers.js";
+// Re-export Result from generator for convenience
+export { success, failure, isSuccess, isFailure } from "@fjall/generator";
+// Orchestration — primary entry point
+export { deploy } from "./orchestration/index.js";
+export { runOrganisationSetup } from "./orchestration/index.js";

package/dist/src/orchestration/applicationDeploy.d.ts

@@ -0,0 +1,11 @@
+import { type Result } from "@fjall/generator";
+import type { DeployParams, DeployResult } from "../types/params.js";
+import type { ApplicationOperation } from "../types/operations.js";
+import type { DeployServices } from "./serviceFactory.js";
+/**
+ * Core application deployment orchestration.
+ *
+ * Runs detection, bootstraps AWS, then deploys stacks in order —
+ * parallelising Phase 2 stacks (Storage, Messaging, Database) when possible.
+ */
+export declare function deployApplication(params: DeployParams, services: DeployServices, operation: ApplicationOperation): Promise<Result<DeployResult>>;

package/dist/src/orchestration/applicationDeploy.js

@@ -0,0 +1,327 @@
+import { success, failure } from "@fjall/generator";
+import { logger } from "@fjall/util";
+import { APPLICATION_STACKS, getApplicationDeployOrder, getApplicationStackName, getApplicationStepName, getApplicationStepId, PARALLEL_DEPLOY_GROUPS } from "../types/operations.js";
+import { CdkContextBuilder } from "../services/supporting/CdkContextBuilder.js";
+import { emitProgress } from "../services/supporting/helpers.js";
+import { buildParamsContext } from "./contextHelpers.js";
+import { runDetectionPipeline } from "./detectionPipeline.js";
+import { detectPattern } from "../types/patternDetection.js";
+/**
+ * Core application deployment orchestration.
+ *
+ * Runs detection, bootstraps AWS, then deploys stacks in order —
+ * parallelising Phase 2 stacks (Storage, Messaging, Database) when possible.
+ */
+export async function deployApplication(params, services, operation) {
+    const { callbacks, options } = params;
+    const startTime = Date.now();
+    // 1. Build deployment context
+    const context = CdkContextBuilder.buildDeploymentContext({
+        deployType: "application",
+        target: operation.appName,
+        path: operation.path,
+        region: services.awsProvider.getRegion(),
+        ...buildParamsContext(params)
+    }, {
+        verbose: options?.verbose,
+        infraOnly: options?.infraOnly
+    }, params.orgConfig);
+    // deployOnly: skip detection pipeline, deploy all stacks unconditionally
+    if (options?.deployOnly) {
+        callbacks.onLog?.("Deploy-only mode — skipping change detection", "info");
+        return deployAllStacks(params, services, operation, context, startTime);
+    }
+    // 2. Run detection pipeline
+    callbacks.onLog?.("Analysing infrastructure…", "info");
+    const detectionResult = await runDetectionPipeline(operation, services, context, callbacks);
+    if (!detectionResult.success) {
+        callbacks.onError?.(detectionResult.error);
+        return failure(detectionResult.error);
+    }
+    const detection = detectionResult.data;
+    // 3. Early exit if no differences
+    if (!detection.hasDifferences && !options?.force) {
+        callbacks.onLog?.("No infrastructure changes detected", "info");
+        return success({
+            target: operation.appName,
+            deploymentType: "application",
+            durationMs: Date.now() - startTime
+        });
+    }
+    // 4. Bootstrap AWS environment
+    callbacks.onCDKBootstrap?.("bootstrapping");
+    const bootstrapResult = await services.cdkService.runCdkBootstrap(context, (chunk) => callbacks.onOutput?.(chunk));
+    if (!bootstrapResult.success) {
+        callbacks.onCDKBootstrap?.("failed");
+        const error = new Error(`Bootstrap failed: ${bootstrapResult.error}`);
+        callbacks.onError?.(error);
+        return failure(error);
+    }
+    callbacks.onCDKBootstrap?.("complete");
+    // 5. Determine deploy order
+    const deployOrder = getApplicationDeployOrder({
+        pattern: detection.pattern,
+        resources: detection.resources
+    });
+    const totalSteps = deployOrder.length;
+    // 6. Deploy stacks
+    const allOutputs = {};
+    const deployedHashes = new Map();
+    for (let i = 0; i < deployOrder.length; i++) {
+        const stack = deployOrder[i];
+        const stackName = getApplicationStackName(operation.appName, stack);
+        const stepId = getApplicationStepId(stack, "deploy");
+        const stepName = getApplicationStepName(stack, "deploy");
+        // Check if stack is unchanged and exists
+        const hasChanges = detection.stackChanges.get(stackName) ?? true;
+        if (!hasChanges && !options?.force) {
+            callbacks.onStepStart?.(stepId, stepName, i, totalSteps);
+            callbacks.onLog?.(`Skipping ${stack} — no changes detected`, "info");
+            callbacks.onStepComplete?.(stepId, stepName, "skipped", i, totalSteps);
+            continue;
+        }
+        // Check for Phase 2 parallel deployment opportunity
+        const parallelStacks = getParallelPhase2Stacks(deployOrder, i, detection.stackChanges, options?.force);
+        if (parallelStacks.length >= 2) {
+            const parallelResult = await deployParallelPhase(parallelStacks, operation, services, context, callbacks, i, totalSteps, detection, allOutputs, deployedHashes);
+            if (!parallelResult.success)
+                return failure(parallelResult.error);
+            // Skip past the parallel stacks in the main loop
+            i += parallelStacks.length - 1;
+            continue;
+        }
+        // Docker build before Compute stack
+        if (stack === APPLICATION_STACKS.COMPUTE &&
+            detection.hasDockerfile &&
+            params.dockerProvider) {
+            const dockerResult = await runDockerBuild(params, services, operation, callbacks);
+            if (!dockerResult.success)
+                return failure(dockerResult.error);
+        }
+        // Sequential deployment
+        const deployResult = await deployStackSequential(stack, services, context, callbacks, i, totalSteps, allOutputs);
+        if (!deployResult.success)
+            return failure(deployResult.error);
+        // Track deployed hashes
+        const hash = detection.currentHashes.get(stackName);
+        if (hash) {
+            deployedHashes.set(stackName, hash);
+        }
+    }
+    // 7. Update state file with deployed hashes
+    if (deployedHashes.size > 0) {
+        const stateResult = await services.hashService.updateStateAfterDeploy(operation.path, deployedHashes);
+        if (!stateResult.success) {
+            logger.debug("applicationDeploy", "Failed to update state file", {
+                error: stateResult.error.message
+            });
+            callbacks.onLog?.(`Warning: failed to update state file — next deploy may re-deploy unchanged stacks: ${stateResult.error.message}`, "warn");
+        }
+    }
+    // 8. Resolve website URL
+    const websiteUrl = await services.stackService.resolveWebsiteUrl(operation.appName);
+    if (websiteUrl) {
+        allOutputs.websiteUrl = websiteUrl;
+    }
+    return success({
+        target: operation.appName,
+        deploymentType: "application",
+        outputs: Object.keys(allOutputs).length > 0 ? allOutputs : undefined,
+        durationMs: Date.now() - startTime
+    });
+}
+/**
+ * Identify Phase 2 stacks (Storage, Messaging, Database) that are consecutive
+ * in the deploy order and have changes. Returns them for parallel deployment
+ * only if there are at least 2.
+ */
+function getParallelPhase2Stacks(deployOrder, currentIndex, stackChanges, force) {
+    const phase2Set = new Set(PARALLEL_DEPLOY_GROUPS.PHASE_2.stacks);
+    const candidates = [];
+    for (let j = currentIndex; j < deployOrder.length; j++) {
+        if (phase2Set.has(deployOrder[j])) {
+            candidates.push(deployOrder[j]);
+        }
+        else {
+            break;
+        }
+    }
+    if (candidates.length < 2)
+        return [];
+    // Only include stacks that actually have changes (unless forced)
+    if (!force) {
+        const withChanges = candidates.filter((stack) => {
+            // stackChanges is keyed by full stack name but we only have the type here;
+            // since we don't know the app name, check all entries ending with the stack type
+            for (const [key, changed] of stackChanges) {
+                if (key.endsWith(stack) && !changed)
+                    return false;
+            }
+            return true;
+        });
+        return withChanges.length >= 2 ? withChanges : [];
+    }
+    return candidates;
+}
+/**
+ * Deploy a group of stacks in parallel, reporting step events for each.
+ */
+async function deployParallelPhase(stacks, operation, services, context, callbacks, startIndex, totalSteps, detection, allOutputs, deployedHashes) {
+    // Emit step start for each parallel stack
+    for (let k = 0; k < stacks.length; k++) {
+        const stack = stacks[k];
+        const stepId = getApplicationStepId(stack, "deploy");
+        const stepName = getApplicationStepName(stack, "deploy");
+        callbacks.onStepStart?.(stepId, stepName, startIndex + k, totalSteps);
+    }
+    emitProgress(callbacks, "Deploying infrastructure in parallel…");
+    const parallelResult = await services.stackService.deployStacksInParallel(stacks, context, {
+        onOutput: (chunk) => callbacks.onOutput?.(chunk),
+        onResourceProgress: (event) => callbacks.onResourceProgress?.(event),
+        onStackComplete: (stack, stackSuccess, _duration, error) => {
+            const stepId = getApplicationStepId(stack, "deploy");
+            const stepName = getApplicationStepName(stack, "deploy");
+            const idx = startIndex + stacks.indexOf(stack);
+            callbacks.onStepComplete?.(stepId, stepName, stackSuccess ? "completed" : "error", idx, totalSteps);
+            if (!stackSuccess && error) {
+                callbacks.onError?.(error);
+            }
+        }
+    });
+    if (!parallelResult.success) {
+        return failure(parallelResult.error);
+    }
+    // Check for any failures
+    const failures = parallelResult.data.filter((r) => !r.success);
+    if (failures.length > 0) {
+        const failedStacks = failures.map((f) => f.stack).join(", ");
+        const errorDetails = failures
+            .map((f) => `${f.stack}: ${f.error?.message ?? "Unknown error"}`)
+            .join("\n");
+        return failure(new Error(`Failed to deploy stacks: ${failedStacks}\n\n${errorDetails}`));
+    }
+    // Collect outputs and track hashes for successful parallel stacks
+    for (const result of parallelResult.data) {
+        if (result.success && result.outputs) {
+            for (const [key, value] of Object.entries(result.outputs)) {
+                allOutputs[key] = String(value);
+            }
+        }
+        const stackName = getApplicationStackName(operation.appName, result.stack);
+        const hash = detection.currentHashes.get(stackName);
+        if (hash) {
+            deployedHashes.set(stackName, hash);
+        }
+    }
+    return success(undefined);
+}
+/**
+ * Run Docker build and push before deploying the Compute stack.
+ * Initialises ECR if needed, then builds and pushes the image.
+ */
+async function runDockerBuild(params, services, operation, callbacks) {
+    const dockerProvider = params.dockerProvider;
+    if (!dockerProvider)
+        return success(undefined);
+    const accountId = services.awsProvider.getAccountId();
+    if (!accountId) {
+        callbacks.onLog?.("Skipping Docker build — account ID not available", "warn");
+        return success(undefined);
+    }
+    const region = services.awsProvider.getRegion();
+    // Initialise ECR repository (non-fatal — CDK creates it if needed)
+    callbacks.onLog?.("Initialising ECR repository…", "info");
+    const ecrResult = await dockerProvider.initialiseECR({
+        appName: operation.appName,
+        region,
+        accountId
+    });
+    if (!ecrResult.success) {
+        callbacks.onLog?.(`ECR initialisation failed: ${ecrResult.error.message}`, "warn");
+    }
+    // Build and push Docker image
+    callbacks.onLog?.("Building and pushing Docker image…", "info");
+    const buildResult = await dockerProvider.buildAndPush({
+        appName: operation.appName,
+        appPath: operation.path,
+        region,
+        accountId
+    });
+    if (!buildResult.success) {
+        callbacks.onError?.(buildResult.error);
+        return failure(buildResult.error);
+    }
+    callbacks.onLog?.(`Docker image pushed: ${buildResult.data.imageUri}`, "info");
+    return success(undefined);
+}
+/**
+ * Deploy a single stack with step lifecycle events and output collection.
+ */
+async function deployStackSequential(stack, services, context, callbacks, stepIndex, totalSteps, allOutputs) {
+    const stepId = getApplicationStepId(stack, "deploy");
+    const stepName = getApplicationStepName(stack, "deploy");
+    callbacks.onStepStart?.(stepId, stepName, stepIndex, totalSteps);
+    const result = await services.stackService.deployStack(stack, context, {
+        onOutput: (chunk) => callbacks.onOutput?.(chunk),
+        onResourceProgress: (event) => callbacks.onResourceProgress?.(event)
+    });
+    if (!result.success) {
+        callbacks.onStepComplete?.(stepId, stepName, "error", stepIndex, totalSteps);
+        callbacks.onError?.(result.error);
+        return failure(result.error);
+    }
+    callbacks.onStepComplete?.(stepId, stepName, "completed", stepIndex, totalSteps);
+    if (result.data.outputs) {
+        for (const [key, value] of Object.entries(result.data.outputs)) {
+            allOutputs[key] = String(value);
+        }
+    }
+    return success(undefined);
+}
+/**
+ * Deploy all stacks unconditionally (deployOnly mode).
+ * Skips CDK synth/hash comparison — uses filesystem pattern detection only
+ * to determine deploy order, then deploys every stack sequentially.
+ */
+async function deployAllStacks(params, services, operation, context, startTime) {
+    const { callbacks } = params;
+    // Lightweight pattern detection (filesystem only, no CDK synth)
+    const { pattern } = detectPattern(operation.path);
+    const deployOrder = getApplicationDeployOrder({ pattern });
+    const totalSteps = deployOrder.length;
+    // Bootstrap
+    callbacks.onCDKBootstrap?.("bootstrapping");
+    const bootstrapResult = await services.cdkService.runCdkBootstrap(context, (chunk) => callbacks.onOutput?.(chunk));
+    if (!bootstrapResult.success) {
+        callbacks.onCDKBootstrap?.("failed");
+        const error = new Error(`Bootstrap failed: ${bootstrapResult.error}`);
+        callbacks.onError?.(error);
+        return failure(error);
+    }
+    callbacks.onCDKBootstrap?.("complete");
+    // Deploy all stacks sequentially
+    const allOutputs = {};
+    for (let i = 0; i < deployOrder.length; i++) {
+        const stack = deployOrder[i];
+        // Docker build before Compute stack
+        if (stack === APPLICATION_STACKS.COMPUTE && params.dockerProvider) {
+            const dockerResult = await runDockerBuild(params, services, operation, callbacks);
+            if (!dockerResult.success)
+                return failure(dockerResult.error);
+        }
+        const deployResult = await deployStackSequential(stack, services, context, callbacks, i, totalSteps, allOutputs);
+        if (!deployResult.success)
+            return failure(deployResult.error);
+    }
+    // Resolve website URL
+    const websiteUrl = await services.stackService.resolveWebsiteUrl(operation.appName);
+    if (websiteUrl) {
+        allOutputs.websiteUrl = websiteUrl;
+    }
+    return success({
+        target: operation.appName,
+        deploymentType: "application",
+        outputs: Object.keys(allOutputs).length > 0 ? allOutputs : undefined,
+        durationMs: Date.now() - startTime
+    });
+}

package/dist/src/orchestration/contextHelpers.d.ts

@@ -0,0 +1,9 @@
+import type { DeployParams } from "../types/params.js";
+/**
+ * Build the orgConfig/identity context fields shared by all deployment paths.
+ * CdkContextBuilder expects orgConfig as a JSON string and fjallOrgId as a string.
+ */
+export declare function buildParamsContext(params: DeployParams): {
+    orgConfig?: string;
+    fjallOrgId?: string;
+};

package/dist/src/orchestration/contextHelpers.js

@@ -0,0 +1,14 @@
+/**
+ * Build the orgConfig/identity context fields shared by all deployment paths.
+ * CdkContextBuilder expects orgConfig as a JSON string and fjallOrgId as a string.
+ */
+export function buildParamsContext(params) {
+    return {
+        ...(params.orgConfig !== undefined
+            ? { orgConfig: JSON.stringify(params.orgConfig) }
+            : {}),
+        ...(params.identity !== undefined
+            ? { fjallOrgId: params.identity.fjallOrgId }
+            : {})
+    };
+}

package/dist/src/orchestration/deploy.d.ts

@@ -0,0 +1,10 @@
+import { type Result } from "@fjall/generator";
+import type { DeployParams, DeployResult } from "../types/params.js";
+/**
+ * Deploy infrastructure for a target.
+ *
+ * Primary entry point for both CLI and webapp worker. Determines whether
+ * the target is an application or organisation deployment and routes
+ * to the appropriate orchestrator.
+ */
+export declare function deploy(params: DeployParams): Promise<Result<DeployResult>>;

package/dist/src/orchestration/deploy.js

@@ -0,0 +1,42 @@
+import { success } from "@fjall/generator";
+import { isApplicationOperation } from "../types/operations.js";
+import { createDeployServices } from "./serviceFactory.js";
+import { resolveOperation } from "./resolveOperation.js";
+import { deployApplication } from "./applicationDeploy.js";
+import { deployOrganisation } from "./organisationDeploy.js";
+/**
+ * Deploy infrastructure for a target.
+ *
+ * Primary entry point for both CLI and webapp worker. Determines whether
+ * the target is an application or organisation deployment and routes
+ * to the appropriate orchestrator.
+ */
+export async function deploy(params) {
+    const startTime = Date.now();
+    const services = createDeployServices(params);
+    const opResult = await resolveOperation(params.target, params.workingDirectory);
+    if (!opResult.success) {
+        params.callbacks.onError?.(opResult.error);
+        return opResult;
+    }
+    const operation = opResult.data;
+    if (isApplicationOperation(operation)) {
+        const result = await deployApplication(params, services, operation);
+        // Attach duration if not already set
+        if (result.success && result.data.durationMs === undefined) {
+            return success({
+                ...result.data,
+                durationMs: Date.now() - startTime
+            });
+        }
+        return result;
+    }
+    const result = await deployOrganisation(params, services, operation);
+    if (result.success && result.data.durationMs === undefined) {
+        return success({
+            ...result.data,
+            durationMs: Date.now() - startTime
+        });
+    }
+    return result;
+}

package/dist/src/orchestration/detectionPipeline.d.ts

@@ -0,0 +1,23 @@
+import { type Result } from "@fjall/generator";
+import type { DeployCallbacks } from "../types/callbacks.js";
+import type { DeploymentContext } from "../types/deployment/DeploymentTypes.js";
+import type { ApplicationOperation } from "../types/operations.js";
+import { type AppResourceFlags } from "../types/patternDetection.js";
+import type { PatternType } from "@fjall/generator";
+import type { DeployServices } from "./serviceFactory.js";
+export interface DetectionResult {
+    pattern: PatternType | null;
+    hasDatabase: boolean;
+    hasDifferences: boolean;
+    stackChanges: Map<string, boolean>;
+    currentHashes: Map<string, string>;
+    resources: AppResourceFlags;
+    hasDockerfile: boolean;
+}
+/**
+ * Pre-deployment analysis pipeline.
+ *
+ * Detects the application pattern, synthesises infrastructure, computes
+ * template hashes, and determines which stacks have changed.
+ */
+export declare function runDetectionPipeline(operation: ApplicationOperation, services: DeployServices, context: DeploymentContext, callbacks: DeployCallbacks): Promise<Result<DetectionResult>>;