@fjall/deploy-core 0.89.4 → 0.89.5

package/dist/src/aws/AwsProvider.d.ts

@@ -12,8 +12,8 @@ export interface AwsProvider {
     getClient<T>(ClientClass: AwsSdkClientConstructor<T>): T;
     /** AWS region for this context. */
     getRegion(): string;
-    /** AWS account ID (resolved via STS GetCallerIdentity). */
-    getAccountId(): string | undefined;
+    /** AWS account ID — always available (callers resolve before calling deploy-core). */
+    getAccountId(): string;
     /** Raw credentials for subprocess environments (CDK). */
     getCredentials(): AwsProviderCredentials | undefined;
     /** Export credentials to process.env for spawned subprocesses. */

package/dist/src/aws/SimpleAwsProvider.d.ts

@@ -9,13 +9,12 @@ import type { AwsProvider, AwsProviderCredentials, AwsSdkClientConstructor } fro
 export declare class SimpleAwsProvider implements AwsProvider {
     private readonly credentials;
     private readonly region;
-    private accountId;
+    private readonly accountId;
     private readonly clientCache;
     constructor(awsCredentials: AwsCredentials);
     getClient<T>(ClientClass: AwsSdkClientConstructor<T>): T;
     getRegion(): string;
-    getAccountId(): string | undefined;
-    setAccountId(accountId: string): void;
+    getAccountId(): string;
     getCredentials(): AwsProviderCredentials;
     exportToEnv(): void;
     assumeRole(roleArn: string, sessionName: string): Promise<AwsProviderCredentials>;

package/dist/src/aws/SimpleAwsProvider.js

@@ -37,9 +37,6 @@ export class SimpleAwsProvider {
     getAccountId() {
         return this.accountId;
     }
-    setAccountId(accountId) {
-        this.accountId = accountId;
-    }
     getCredentials() {
         return this.credentials;
     }
@@ -59,7 +56,7 @@ export class SimpleAwsProvider {
         const response = await stsClient.send(new AssumeRoleCommand({
             RoleArn: roleArn,
             RoleSessionName: sessionName
-        }));
+        }), { abortSignal: AbortSignal.timeout(30_000) });
         const assumed = response.Credentials;
         if (!assumed?.AccessKeyId || !assumed?.SecretAccessKey) {
             throw new Error(`AssumeRole for ${roleArn} returned incomplete credentials`);

package/dist/src/orchestration/applicationDeploy.js

@@ -21,6 +21,11 @@ export async function deployApplication(params, services, operation) {
         target: operation.appName,
         path: operation.path,
         region: services.awsProvider.getRegion(),
+        callerIdentity: {
+            Account: services.awsProvider.getAccountId(),
+            Arn: "",
+            UserId: ""
+        },
         ...buildParamsContext(params)
     }, {
         verbose: options?.verbose,

package/dist/src/orchestration/contextHelpers.d.ts

@@ -6,4 +6,5 @@ import type { DeployParams } from "../types/params.js";
 export declare function buildParamsContext(params: DeployParams): {
     orgConfig?: string;
     fjallOrgId?: string;
+    fjallOidcConfigured?: boolean;
 };

package/dist/src/orchestration/contextHelpers.js

@@ -9,6 +9,7 @@ export function buildParamsContext(params) {
             : {}),
         ...(params.identity !== undefined
             ? { fjallOrgId: params.identity.fjallOrgId }
-            : {})
+            : {}),
+        ...(params.options?.skipOidc ? { fjallOidcConfigured: true } : {})
     };
 }

package/dist/src/orchestration/organisationDeploy.js

@@ -42,7 +42,7 @@ function buildOrgContext(params, services, operation, deployType, accountName) {
         region: services.awsProvider.getRegion(),
         accountName,
         callerIdentity: {
-            Account: services.awsProvider.getAccountId() ?? "",
+            Account: services.awsProvider.getAccountId(),
             Arn: "",
             UserId: ""
         },
@@ -52,16 +52,37 @@ function buildOrgContext(params, services, operation, deployType, accountName) {
         infraOnly: params.options?.infraOnly
     }, params.orgConfig);
 }
+/**
+ * Infrastructure deployment step names — match the webapp's
+ * EXPECTED_INFRASTRUCTURE_STEPS exactly so the UI timeline lights up.
+ */
+const INFRA_STEPS = {
+    CONNECT: { id: "connect", name: "Connect securely" },
+    PREPARE: { id: "prepare", name: "Prepare environment" },
+    DEPLOY: { id: "deploy", name: "Deploy infrastructure" },
+    MONITORING: { id: "monitoring", name: "Enable monitoring" }
+};
+const INFRA_STEP_TOTAL = 4;
 /**
  * Deploy a single organisation component (platform or account).
+ *
+ * Emits 4 named steps matching the webapp's expected infrastructure
+ * timeline: Connect securely → Prepare environment → Deploy
+ * infrastructure → Enable monitoring.
  */
 async function deploySingleComponent(params, services, operation, deployType, startTime) {
     const { callbacks } = params;
+    // Step 1: Connect securely — already seeded by the webapp trigger.
+    // Complete it now: credentials are available by the time deploy-core runs.
+    callbacks.onStepComplete?.(INFRA_STEPS.CONNECT.id, INFRA_STEPS.CONNECT.name, "completed", 0, INFRA_STEP_TOTAL);
+    // Step 2: Prepare environment (synth + bootstrap)
+    callbacks.onStepStart?.(INFRA_STEPS.PREPARE.id, INFRA_STEPS.PREPARE.name, 1, INFRA_STEP_TOTAL);
     const context = buildOrgContext(params, services, operation, deployType, deployType === "account" ? operation.target : undefined);
     // Synth
     callbacks.onLog?.(`Synthesising ${deployType} infrastructure…`, "info");
     const synthResult = await services.cdkService.runCdkSynth(context, (chunk) => callbacks.onCdkOutput?.(chunk, "synth"));
     if (!synthResult.success) {
+        callbacks.onStepComplete?.(INFRA_STEPS.PREPARE.id, INFRA_STEPS.PREPARE.name, "error", 1, INFRA_STEP_TOTAL);
         const error = new Error(`CDK synthesis failed: ${synthResult.error}`);
         callbacks.onError?.(error);
         return failure(error);
@@ -71,24 +92,28 @@ async function deploySingleComponent(params, services, operation, deployType, st
     const bootstrapResult = await services.cdkService.runCdkBootstrap(context, (chunk) => callbacks.onOutput?.(chunk));
     if (!bootstrapResult.success) {
         callbacks.onCDKBootstrap?.("failed");
+        callbacks.onStepComplete?.(INFRA_STEPS.PREPARE.id, INFRA_STEPS.PREPARE.name, "error", 1, INFRA_STEP_TOTAL);
         const error = new Error(`Bootstrap failed: ${bootstrapResult.error}`);
         callbacks.onError?.(error);
         return failure(error);
     }
     callbacks.onCDKBootstrap?.("complete");
-    // Deploy
+    callbacks.onStepComplete?.(INFRA_STEPS.PREPARE.id, INFRA_STEPS.PREPARE.name, "completed", 1, INFRA_STEP_TOTAL);
+    // Step 3: Deploy infrastructure
     const stackName = getOrganisationStackName(operation.type);
-    const stepId = `${deployType}-deploy`;
-    const stepName = `Deploying ${deployType} infrastructure`;
-    callbacks.onStepStart?.(stepId, stepName, 0, 1);
+    callbacks.onStepStart?.(INFRA_STEPS.DEPLOY.id, INFRA_STEPS.DEPLOY.name, 2, INFRA_STEP_TOTAL);
     const deployResult = await services.cdkService.runCdkDeploy(context, stackName, (chunk) => callbacks.onOutput?.(chunk), (event) => callbacks.onResourceProgress?.(event), services.awsProvider);
     if (!deployResult.success) {
-        callbacks.onStepComplete?.(stepId, stepName, "error", 0, 1);
+        callbacks.onStepComplete?.(INFRA_STEPS.DEPLOY.id, INFRA_STEPS.DEPLOY.name, "error", 2, INFRA_STEP_TOTAL);
         const error = new Error(deployResult.error);
         callbacks.onError?.(error);
         return failure(error);
     }
-    callbacks.onStepComplete?.(stepId, stepName, "completed", 0, 1);
+    callbacks.onStepComplete?.(INFRA_STEPS.DEPLOY.id, INFRA_STEPS.DEPLOY.name, "completed", 2, INFRA_STEP_TOTAL);
+    // Step 4: Enable monitoring — CloudTrail + alarms are part of the
+    // Account stack. Signal post-deploy readiness.
+    callbacks.onStepStart?.(INFRA_STEPS.MONITORING.id, INFRA_STEPS.MONITORING.name, 3, INFRA_STEP_TOTAL);
+    callbacks.onStepComplete?.(INFRA_STEPS.MONITORING.id, INFRA_STEPS.MONITORING.name, "completed", 3, INFRA_STEP_TOTAL);
     return success({
         target: operation.target,
         deploymentType: "organisation",

package/dist/src/services/infrastructure/CdkService.d.ts

@@ -19,6 +19,7 @@ export interface CdkContext {
     managementAccountId?: string;
     ipamPoolId?: string;
     fjallOrgId?: string;
+    fjallOidcConfigured?: string;
     orgConfig?: string;
 }
 export interface CdkOptions {

package/dist/src/services/infrastructure/CdkService.js

@@ -70,6 +70,7 @@ export class CdkService {
             managementAccountId: context.managementAccountId,
             ipamPoolId: context.ipamPoolId,
             fjallOrgId: context.fjallOrgId,
+            fjallOidcConfigured: context.fjallOidcConfigured ? "true" : undefined,
             orgConfig: context.orgConfig
         };
     }

package/dist/src/types/credentials.d.ts

@@ -10,7 +10,7 @@ export interface AwsCredentials {
     secretAccessKey: string;
     sessionToken?: string;
     region: string;
-    accountId?: string;
+    accountId: string;
 }
 /**
  * Pre-fetched organisation identity for org deployments.

package/dist/src/types/deployment/DeploymentTypes.d.ts

@@ -14,6 +14,7 @@ export interface DeploymentContext {
     managementAccountId?: string;
     ipamPoolId?: string;
     fjallOrgId?: string;
+    fjallOidcConfigured?: boolean;
     orgConfig?: string;
     options: {
         verbose?: boolean;

package/dist/src/types/params.d.ts

@@ -60,6 +60,8 @@ export interface DeployOptions {
     deployOnly?: boolean;
     passThroughCDK?: boolean;
     environment?: string;
+    /** Skip OIDC provider creation — set when OIDC is already configured (webapp Quick Create). */
+    skipOidc?: boolean;
 }
 export type DeploymentType = "application" | "organisation";
 export interface DeployResult {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fjall/deploy-core",
-  "version": "0.89.4",
+  "version": "0.89.5",
   "description": "Shared deployment engine for Fjall — used by CLI and webapp worker",
   "type": "module",
   "main": "dist/src/index.js",
@@ -32,12 +32,12 @@
     "@aws-sdk/client-ram": "^3.1009.0",
     "@aws-sdk/client-sso-admin": "^3.1009.0",
     "@aws-sdk/client-sts": "^3.1009.0",
-    "@fjall/generator": "^0.89.4",
-    "@fjall/util": "^0.89.4",
+    "@fjall/generator": "^0.89.5",
+    "@fjall/util": "^0.89.5",
     "zod": "^4.3.6"
   },
   "devDependencies": {
     "vitest": "^3.2.3"
   },
-  "gitHead": "6b2b2d2082b8c07174f4091202cd5bd9862f5556"
+  "gitHead": "1680c1a0be16950e9e10e571163ccc42198f6a8e"
 }