@fjall/deploy-core 0.89.4 → 0.89.6

package/dist/src/orchestration/organisationDeploy.js

@@ -1,10 +1,11 @@
 import { success, failure } from "@fjall/generator";
-import { logger } from "@fjall/util";
 import { ORGANISATION_TYPES, getOrganisationStackName } from "../types/operations.js";
 import { CdkContextBuilder } from "../services/supporting/CdkContextBuilder.js";
-import { CloudFormationService } from "../services/infrastructure/CloudFormationService.js";
-import { SimpleAwsProvider } from "../aws/SimpleAwsProvider.js";
-import { buildParamsContext } from "./contextHelpers.js";
+import { stubCallerIdentity } from "../types/deployment/index.js";
+import { buildParamsContext, collectStackOutputs, synthOrFail, bootstrapOrFail, forwardOutput, forwardResourceProgress } from "./contextHelpers.js";
+import { partitionAccounts, deployCascadeAccount, readPlatformIpamPoolIds, deployDomains } from "./cascadeHelpers.js";
+import { maskSensitiveOutput } from "@fjall/util";
+import { INFRA_STEP_NAME, STEP_IDS } from "../types/stepDefinitions.js";
 /**
  * Organisation deployment orchestration.
  *
@@ -41,57 +42,81 @@ function buildOrgContext(params, services, operation, deployType, accountName) {
         path: operation.path,
         region: services.awsProvider.getRegion(),
         accountName,
-        callerIdentity: {
-            Account: services.awsProvider.getAccountId() ?? "",
-            Arn: "",
-            UserId: ""
-        },
-        ...buildParamsContext(params)
+        callerIdentity: stubCallerIdentity(services.awsProvider.getAccountId()),
+        ...buildParamsContext({
+            orgConfig: params.orgConfig,
+            identity: params.identity,
+            skipOidc: params.options?.skipOidc
+        })
     }, {
         verbose: params.options?.verbose,
         infraOnly: params.options?.infraOnly
     }, params.orgConfig);
 }
+const INFRA_STEPS = {
+    CONNECT: { id: STEP_IDS.CONNECT, name: INFRA_STEP_NAME.CONNECT },
+    PREPARE: { id: STEP_IDS.PREPARE_ENVIRONMENT, name: INFRA_STEP_NAME.PREPARE },
+    DEPLOY: { id: STEP_IDS.DEPLOY, name: INFRA_STEP_NAME.DEPLOY },
+    MONITORING: { id: STEP_IDS.MONITORING, name: INFRA_STEP_NAME.MONITORING },
+    ORG_DEPLOY: {
+        id: STEP_IDS.ORG_DEPLOY,
+        name: "Deploying organisation infrastructure"
+    }
+};
+const INFRA_STEP_TOTAL = 4;
 /**
  * Deploy a single organisation component (platform or account).
+ *
+ * Emits 4 named steps from INFRASTRUCTURE_STEP_NAMES: Connect securely →
+ * Prepare environment → Deploy infrastructure → Enable monitoring.
  */
 async function deploySingleComponent(params, services, operation, deployType, startTime) {
     const { callbacks } = params;
+    // Step 1: Connect securely — already seeded by the webapp trigger.
+    // Complete it now: credentials are available by the time deploy-core runs.
+    callbacks.onStepComplete?.(INFRA_STEPS.CONNECT.id, INFRA_STEPS.CONNECT.name, "completed", 0, INFRA_STEP_TOTAL);
+    // Step 2: Prepare environment (synth + bootstrap)
+    callbacks.onStepStart?.(INFRA_STEPS.PREPARE.id, INFRA_STEPS.PREPARE.name, 1, INFRA_STEP_TOTAL);
     const context = buildOrgContext(params, services, operation, deployType, deployType === "account" ? operation.target : undefined);
     // Synth
     callbacks.onLog?.(`Synthesising ${deployType} infrastructure…`, "info");
-    const synthResult = await services.cdkService.runCdkSynth(context, (chunk) => callbacks.onCdkOutput?.(chunk, "synth"));
+    const synthResult = await synthOrFail(services, context, callbacks, "CDK synthesis failed");
     if (!synthResult.success) {
-        const error = new Error(`CDK synthesis failed: ${synthResult.error}`);
-        callbacks.onError?.(error);
-        return failure(error);
+        callbacks.onStepComplete?.(INFRA_STEPS.PREPARE.id, INFRA_STEPS.PREPARE.name, "error", 1, INFRA_STEP_TOTAL);
+        return synthResult;
     }
     // Bootstrap
-    callbacks.onCDKBootstrap?.("bootstrapping");
-    const bootstrapResult = await services.cdkService.runCdkBootstrap(context, (chunk) => callbacks.onOutput?.(chunk));
-    if (!bootstrapResult.success) {
-        callbacks.onCDKBootstrap?.("failed");
-        const error = new Error(`Bootstrap failed: ${bootstrapResult.error}`);
-        callbacks.onError?.(error);
-        return failure(error);
+    const bsResult = await bootstrapOrFail(services, context, callbacks);
+    if (!bsResult.success) {
+        callbacks.onStepComplete?.(INFRA_STEPS.PREPARE.id, INFRA_STEPS.PREPARE.name, "error", 1, INFRA_STEP_TOTAL);
+        return bsResult;
     }
-    callbacks.onCDKBootstrap?.("complete");
-    // Deploy
+    callbacks.onStepComplete?.(INFRA_STEPS.PREPARE.id, INFRA_STEPS.PREPARE.name, "completed", 1, INFRA_STEP_TOTAL);
+    // Step 3: Deploy infrastructure
     const stackName = getOrganisationStackName(operation.type);
-    const stepId = `${deployType}-deploy`;
-    const stepName = `Deploying ${deployType} infrastructure`;
-    callbacks.onStepStart?.(stepId, stepName, 0, 1);
-    const deployResult = await services.cdkService.runCdkDeploy(context, stackName, (chunk) => callbacks.onOutput?.(chunk), (event) => callbacks.onResourceProgress?.(event), services.awsProvider);
+    callbacks.onStepStart?.(INFRA_STEPS.DEPLOY.id, INFRA_STEPS.DEPLOY.name, 2, INFRA_STEP_TOTAL);
+    const deployResult = await services.cdkService.runCdkDeploy(context, stackName, forwardOutput(callbacks), forwardResourceProgress(callbacks), services.awsProvider);
     if (!deployResult.success) {
-        callbacks.onStepComplete?.(stepId, stepName, "error", 0, 1);
-        const error = new Error(deployResult.error);
+        callbacks.onStepComplete?.(INFRA_STEPS.DEPLOY.id, INFRA_STEPS.DEPLOY.name, "error", 2, INFRA_STEP_TOTAL);
+        const error = new Error(maskSensitiveOutput(deployResult.error));
         callbacks.onError?.(error);
         return failure(error);
     }
-    callbacks.onStepComplete?.(stepId, stepName, "completed", 0, 1);
+    callbacks.onStepComplete?.(INFRA_STEPS.DEPLOY.id, INFRA_STEPS.DEPLOY.name, "completed", 2, INFRA_STEP_TOTAL);
+    // Capture CloudFormation outputs (OIDC role ARN, etc.)
+    const outputsResult = await services.cfnService.getStackOutputs(stackName);
+    if (!outputsResult.success) {
+        callbacks.onLog?.("Failed to read stack outputs (non-critical)", "debug");
+    }
+    const outputs = collectStackOutputs(outputsResult);
+    // Step 4: Enable monitoring — CloudTrail + alarms are part of the
+    // Account stack. Signal post-deploy readiness.
+    callbacks.onStepStart?.(INFRA_STEPS.MONITORING.id, INFRA_STEPS.MONITORING.name, 3, INFRA_STEP_TOTAL);
+    callbacks.onStepComplete?.(INFRA_STEPS.MONITORING.id, INFRA_STEPS.MONITORING.name, "completed", 3, INFRA_STEP_TOTAL);
     return success({
         target: operation.target,
         deploymentType: "organisation",
+        outputs,
         durationMs: Date.now() - startTime
     });
 }
@@ -102,54 +127,67 @@ async function deployOrgWithCascade(params, services, operation, startTime) {
     const { callbacks, options } = params;
     const providerAccounts = params.orgConfig?.providerAccounts ?? [];
     const context = buildOrgContext(params, services, operation, "organisation");
+    // Compute step counts upfront so pre-deploy failures can reference them
+    const cascadeEnabled = options?.cascade !== false;
+    const cascadeAccountCount = cascadeEnabled ? providerAccounts.length : 0;
+    // Steps: prepare (synth+bootstrap) + org-deploy + cascade accounts
+    const totalSteps = 2 + cascadeAccountCount;
+    const { id: prepareStepId, name: prepareStepName } = INFRA_STEPS.PREPARE;
+    // Step 0: Prepare (synth + bootstrap)
+    callbacks.onStepStart?.(prepareStepId, prepareStepName, 0, totalSteps);
     // Synth
     callbacks.onLog?.("Synthesising organisation infrastructure…", "info");
-    const synthResult = await services.cdkService.runCdkSynth(context, (chunk) => callbacks.onCdkOutput?.(chunk, "synth"));
+    const synthResult = await synthOrFail(services, context, callbacks, "CDK synthesis failed");
     if (!synthResult.success) {
-        const error = new Error(`CDK synthesis failed: ${synthResult.error}`);
-        callbacks.onError?.(error);
-        return failure(error);
+        callbacks.onStepComplete?.(prepareStepId, prepareStepName, "error", 0, totalSteps);
+        return synthResult;
     }
     // Bootstrap org account
-    callbacks.onCDKBootstrap?.("bootstrapping");
-    const bootstrapResult = await services.cdkService.runCdkBootstrap(context, (chunk) => callbacks.onOutput?.(chunk));
-    if (!bootstrapResult.success) {
-        callbacks.onCDKBootstrap?.("failed");
-        const error = new Error(`Bootstrap failed: ${bootstrapResult.error}`);
-        callbacks.onError?.(error);
-        return failure(error);
+    const bsResult = await bootstrapOrFail(services, context, callbacks);
+    if (!bsResult.success) {
+        callbacks.onStepComplete?.(prepareStepId, prepareStepName, "error", 0, totalSteps);
+        return bsResult;
     }
-    callbacks.onCDKBootstrap?.("complete");
-    // Deploy org infrastructure
-    const orgStepId = "organisation-deploy";
-    const orgStepName = "Deploying organisation infrastructure";
-    const cascadeEnabled = options?.cascade !== false;
-    const cascadeAccountCount = cascadeEnabled ? providerAccounts.length : 0;
-    const totalSteps = 1 + cascadeAccountCount;
-    callbacks.onStepStart?.(orgStepId, orgStepName, 0, totalSteps);
+    callbacks.onStepComplete?.(prepareStepId, prepareStepName, "completed", 0, totalSteps);
+    // Step 1: Deploy org infrastructure
+    const { id: orgStepId, name: orgStepName } = INFRA_STEPS.ORG_DEPLOY;
+    callbacks.onStepStart?.(orgStepId, orgStepName, 1, totalSteps);
     const orgStackName = getOrganisationStackName(ORGANISATION_TYPES.ORGANISATION);
-    const orgResult = await services.cdkService.runCdkDeploy(context, orgStackName, (chunk) => callbacks.onOutput?.(chunk), (event) => callbacks.onResourceProgress?.(event), services.awsProvider);
+    const orgResult = await services.cdkService.runCdkDeploy(context, orgStackName, forwardOutput(callbacks), forwardResourceProgress(callbacks), services.awsProvider);
     if (!orgResult.success) {
-        callbacks.onStepComplete?.(orgStepId, orgStepName, "error", 0, totalSteps);
-        const error = new Error(orgResult.error);
+        callbacks.onStepComplete?.(orgStepId, orgStepName, "error", 1, totalSteps);
+        const error = new Error(maskSensitiveOutput(orgResult.error));
         callbacks.onError?.(error);
         return failure(error);
     }
-    callbacks.onStepComplete?.(orgStepId, orgStepName, "completed", 0, totalSteps);
+    // Capture org root stack outputs (OIDC role ARN, etc.)
+    const orgOutputsResult = await services.cfnService.getStackOutputs(orgStackName);
+    if (!orgOutputsResult.success) {
+        callbacks.onLog?.("Failed to read org stack outputs (non-critical)", "debug");
+    }
+    const orgOutputs = collectStackOutputs(orgOutputsResult);
+    callbacks.onStepComplete?.(orgStepId, orgStepName, "completed", 1, totalSteps);
     // Cascade to platform + domains + member accounts
+    const cascadeErrors = [];
+    const allCascadeOutputs = [];
     if (cascadeEnabled && providerAccounts.length > 0) {
         callbacks.onCascadeStart?.();
-        const cascadeErrors = [];
         let accountsDeployed = 0;
         let platformDeployed = false;
         let domainsDeployed = false;
         // Phase 1: Deploy platform account
-        const platformAccount = providerAccounts.find((acc) => acc.environment === "platform");
+        const { platformAccount, memberAccounts } = partitionAccounts(providerAccounts);
         if (platformAccount) {
             callbacks.onCascadePhaseStart?.("platform");
             const platformResult = await deployCascadeAccount(params, services, operation, platformAccount, "platform", callbacks);
             if (platformResult.success) {
                 platformDeployed = true;
+                if (platformResult.data.outputs) {
+                    allCascadeOutputs.push({
+                        accountId: platformAccount.id,
+                        outputs: platformResult.data.outputs
+                    });
+                }
             }
             else {
                 cascadeErrors.push({
@@ -157,6 +195,7 @@ async function deployOrgWithCascade(params, services, operation, startTime) {
                     error: platformResult.error.message
                 });
             }
+            callbacks.onCascadePhaseComplete?.("platform");
         }
         // Phase 1.5: Read Platform stack outputs for IPAM pool IDs
         let ipamPoolIds = new Map();
@@ -168,24 +207,43 @@ async function deployOrgWithCascade(params, services, operation, startTime) {
             const domainResult = await deployDomains(params.domainProvider, callbacks);
             domainsDeployed = domainResult.domainsDeployed > 0;
             for (const err of domainResult.errors) {
-                cascadeErrors.push({ accountId: "domains", error: err });
+                cascadeErrors.push({
+                    accountId: "domains",
+                    error: maskSensitiveOutput(err)
+                });
             }
         }
         // Phase 3: Deploy member accounts in parallel
-        const memberAccounts = providerAccounts.filter((acc) => acc.environment !== "root" && acc.environment !== "platform");
         if (memberAccounts.length > 0) {
             callbacks.onCascadePhaseStart?.("accounts");
             const region = services.awsProvider.getRegion();
-            const memberResults = await Promise.all(memberAccounts.map((account) => {
+            const memberSettled = await Promise.allSettled(memberAccounts.map((account) => {
                 const regionSuffix = region.replace(/-/g, "");
                 const ipamPoolId = ipamPoolIds.get(`${account.id}-${regionSuffix}`);
                 return deployCascadeAccount(params, services, operation, account, "account", callbacks, ipamPoolId);
             }));
-            for (let j = 0; j < memberResults.length; j++) {
-                const result = memberResults[j];
+            memberSettled.forEach((settled, j) => {
                 const account = memberAccounts[j];
+                if (!account)
+                    return;
+                if (settled.status === "rejected") {
+                    cascadeErrors.push({
+                        accountId: account.id,
+                        error: maskSensitiveOutput(settled.reason instanceof Error
+                            ? settled.reason.message
+                            : String(settled.reason))
+                    });
+                    return;
+                }
+                const result = settled.value;
                 if (result.success) {
                     accountsDeployed++;
+                    if (result.data.outputs) {
+                        allCascadeOutputs.push({
+                            accountId: account.id,
+                            outputs: result.data.outputs
+                        });
+                    }
                 }
                 else {
                     cascadeErrors.push({
@@ -193,7 +251,8 @@ async function deployOrgWithCascade(params, services, operation, startTime) {
                         error: result.error.message
                     });
                 }
-            }
+            });
+            callbacks.onCascadePhaseComplete?.("accounts");
         }
         callbacks.onCascadeComplete?.({
             platformDeployed,
@@ -206,177 +265,20 @@ async function deployOrgWithCascade(params, services, operation, startTime) {
             const errorSummary = cascadeErrors
                 .map((e) => `  ${e.accountId}: ${e.error}`)
                 .join("\n");
-            callbacks.onLog?.(`Cascade completed with ${cascadeErrors.length} failure(s):\n${errorSummary}`, "warn");
+            callbacks.onLog?.(maskSensitiveOutput(`Cascade completed with ${cascadeErrors.length} failure(s):\n${errorSummary}`), "warn");
         }
     }
+    const warnings = cascadeErrors.length > 0
+        ? cascadeErrors.map((e) => maskSensitiveOutput(`${e.accountId}: ${e.error}`))
+        : undefined;
     return success({
         target: operation.target,
         deploymentType: "organisation",
-        durationMs: Date.now() - startTime
-    });
-}
-/**
- * Deploy a single cascade account (platform or member).
- * Assumes the target account's role, sets env credentials, and deploys.
- */
-async function deployCascadeAccount(params, services, operation, account, deployType, callbacks, ipamPoolId) {
-    const operationKey = `${account.name}-${account.id}`;
-    const region = services.awsProvider.getRegion();
-    callbacks.onCascadeAccountStart?.(operationKey, account.id, region);
-    // Assume role in target account
-    if (!services.awsProvider.assumeRole) {
-        const error = new Error(`Cannot cascade to account ${account.name}: AwsProvider does not support assumeRole`);
-        callbacks.onCascadeAccountComplete?.(operationKey, false, error.message, region);
-        return failure(error);
-    }
-    const roleArn = `arn:aws:iam::${account.id}:role/fjall-deployment-role`;
-    let assumedCredentials;
-    try {
-        assumedCredentials = await services.awsProvider.assumeRole(roleArn, `fjall-cascade-${account.name}`);
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        callbacks.onCascadeAccountComplete?.(operationKey, false, message, region);
-        return failure(new Error(`Failed to assume role for ${account.name}: ${message}`));
-    }
-    // Build context for this account (includes IPAM pool ID if available)
-    const accountContext = CdkContextBuilder.buildDeploymentContext({
-        deployType,
-        target: operation.target,
-        path: operation.path,
-        region,
-        accountName: account.name,
-        callerIdentity: { Account: account.id, Arn: "", UserId: "" },
-        ipamPoolId,
-        ...buildParamsContext(params)
-    }, { verbose: params.options?.verbose }, params.orgConfig);
-    // Create account-scoped provider for CDK monitoring
-    const accountProvider = new SimpleAwsProvider({
-        accessKeyId: assumedCredentials.accessKeyId,
-        secretAccessKey: assumedCredentials.secretAccessKey,
-        sessionToken: assumedCredentials.sessionToken,
-        region,
-        accountId: account.id
+        outputs: orgOutputs,
+        ...(allCascadeOutputs.length > 0
+            ? { cascadeOutputs: allCascadeOutputs }
+            : {}),
+        durationMs: Date.now() - startTime,
+        warnings
     });
-    // Export account credentials for CDK subprocess
-    accountProvider.exportToEnv();
-    // Bootstrap the target account
-    callbacks.onCascadeAccountPhaseChange?.(operationKey, "synth", region);
-    const bootstrapResult = await services.cdkService.runCdkBootstrap(accountContext, (chunk) => callbacks.onOutput?.(chunk));
-    if (!bootstrapResult.success) {
-        services.awsProvider.exportToEnv();
-        callbacks.onCascadeAccountComplete?.(operationKey, false, `Bootstrap failed: ${bootstrapResult.error}`, region);
-        return failure(new Error(`Bootstrap failed for ${account.name}: ${bootstrapResult.error}`));
-    }
-    // Deploy the account stack
-    callbacks.onCascadeAccountPhaseChange?.(operationKey, "deploy", region);
-    const stackName = getOrganisationStackName(deployType === "platform"
-        ? ORGANISATION_TYPES.PLATFORM
-        : ORGANISATION_TYPES.ACCOUNT);
-    const deployResult = await services.cdkService.runCdkDeploy(accountContext, stackName, (chunk) => callbacks.onOutput?.(chunk), (event) => callbacks.onCascadeAccountResourceProgress?.(operationKey, event, region), accountProvider);
-    // Restore parent credentials
-    services.awsProvider.exportToEnv();
-    if (!deployResult.success) {
-        callbacks.onCascadeAccountComplete?.(operationKey, false, deployResult.error, region);
-        return failure(new Error(deployResult.error));
-    }
-    callbacks.onCascadeAccountComplete?.(operationKey, true, undefined, region);
-    return success(undefined);
-}
-/**
- * Read Platform stack outputs to extract IPAM pool IDs for member accounts.
- * Output keys follow the pattern `IpamPoolId{12-digit-accountId}{regionSuffix}`.
- * Returns a map keyed by `{accountId}-{regionSuffix}` → pool ID.
- * Non-fatal: returns empty map on any error.
- */
-async function readPlatformIpamPoolIds(services, platformAccount, callbacks) {
-    const poolIds = new Map();
-    // Assume role in platform account to read its stack outputs
-    if (!services.awsProvider.assumeRole) {
-        logger.debug("organisationDeploy", "Cannot read Platform outputs: assumeRole not available");
-        return poolIds;
-    }
-    const region = services.awsProvider.getRegion();
-    const roleArn = `arn:aws:iam::${platformAccount.id}:role/fjall-deployment-role`;
-    let assumedCredentials;
-    try {
-        assumedCredentials = await services.awsProvider.assumeRole(roleArn, `fjall-ipam-read-${platformAccount.name}`);
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        logger.debug("organisationDeploy", `Cannot read Platform outputs: AssumeRole failed: ${message}`);
-        return poolIds;
-    }
-    // Create a temporary provider scoped to the platform account
-    const platformProvider = new SimpleAwsProvider({
-        accessKeyId: assumedCredentials.accessKeyId,
-        secretAccessKey: assumedCredentials.secretAccessKey,
-        sessionToken: assumedCredentials.sessionToken,
-        region,
-        accountId: platformAccount.id
-    });
-    const platformCfn = new CloudFormationService(platformProvider);
-    const outputsResult = await platformCfn.getStackOutputs("Platform");
-    if (!outputsResult.success) {
-        logger.debug("organisationDeploy", `Failed to read Platform stack outputs: ${outputsResult.error.message}`);
-        return poolIds;
-    }
-    const ipamPattern = /^IpamPoolId(\d{12})(\w+)$/;
-    for (const output of outputsResult.data) {
-        const match = output.OutputKey?.match(ipamPattern);
-        if (match && output.OutputValue) {
-            const key = `${match[1]}-${match[2]}`;
-            poolIds.set(key, output.OutputValue);
-        }
-    }
-    if (poolIds.size > 0) {
-        callbacks.onLog?.(`Read ${poolIds.size} IPAM pool ID(s) from Platform stack`, "info");
-    }
-    return poolIds;
-}
-/**
- * Deploy configured domains: apex domains sequentially, then delegated
- * domains in parallel. Delegates to the caller-provided DomainDeployProvider.
- */
-async function deployDomains(provider, callbacks) {
-    const domains = provider.getDomains();
-    if (domains.length === 0) {
-        return { domainsDeployed: 0, errors: [] };
-    }
-    callbacks.onCascadePhaseStart?.("domains");
-    const apexDomains = domains.filter((d) => d.type === "apex");
-    const delegatedDomains = domains.filter((d) => d.type === "delegated");
-    let domainsDeployed = 0;
-    const errors = [];
-    // Phase A: Apex domains (sequential — delegation roles must exist first)
-    for (const domain of apexDomains) {
-        const result = await provider.deployDomain(domain.name, callbacks);
-        if (result.success) {
-            domainsDeployed++;
-        }
-        else {
-            errors.push(`${domain.name}: ${result.error.message}`);
-        }
-    }
-    // Phase B: Delegated subdomains (parallel — independent of each other)
-    if (delegatedDomains.length > 0) {
-        const subdomainResults = await Promise.allSettled(delegatedDomains.map(async (domain) => {
-            const result = await provider.deployDomain(domain.name, callbacks);
-            if (result.success) {
-                domainsDeployed++;
-            }
-            else {
-                errors.push(`${domain.name}: ${result.error.message}`);
-            }
-        }));
-        for (const result of subdomainResults) {
-            if (result.status === "rejected") {
-                const message = result.reason instanceof Error
-                    ? result.reason.message
-                    : String(result.reason);
-                errors.push(`Subdomain deploy error: ${message}`);
-            }
-        }
-    }
-    return { domainsDeployed, errors };
 }

package/dist/src/orchestration/organisationDestroy.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Organisation destroy orchestration.
+ *
+ * Receives pre-authenticated credentials and destroys all organisation
+ * infrastructure in cascade order:
+ * 1. Member accounts across ALL regions in parallel
+ * 2. Platform account in primary region
+ * 3. Organisation root stack
+ *
+ * Auth, verification, and interactive prompts are the caller's job
+ * (per engine/consumer boundary).
+ */
+import { type Result } from "@fjall/generator";
+import type { DestroyParams, DestroyResult } from "../types/params.js";
+import type { OrganisationOperation } from "../types/operations.js";
+import type { DeployServices } from "./serviceFactory.js";
+/**
+ * Destroy organisation infrastructure with cascade.
+ *
+ * The cascade ordering is: members (parallel, multi-region) -> platform -> org stack.
+ * If any member or platform destruction fails, the org stack is NOT destroyed
+ * (to avoid orphaning resources).
+ */
+export declare function destroyOrganisation(params: DestroyParams, services: DeployServices, operation: OrganisationOperation): Promise<Result<DestroyResult>>;